Cut a seam through the codec enumeration, and say what a failed one actually does (#194 )

probe() was 20 never-executed lines, the biggest single block on the report. It has been looked at twice and left out twice, and both closes were right about what they closed: #86 ruled it device-bound, and #133 re-checked that with ShadowMediaCodecList in hand and still declined, because MediaCodecInfoBuilder has no setIsAlias and no setCanonicalName -- "so the alias skip and the canonical-name dedup, the two things the class's KDoc calls out as easy to get wrong, are not reachable through it." That objection is about the shadow. It does not apply to a function taking its own entry type, which #133 did not evaluate. capabilitiesFrom(enumerate: () -> Sequence<CodecEntry>) holds every rule; the edge keeps only the mapping from MediaCodecList onto CodecEntry. The parameter is a Sequence rather than a List on purpose. runCatching has always wrapped the *iteration*, so a MediaCodecInfo whose properties throw partway leaves the codecs already read in place. A List parameter would move that throw outside the loop and turn a partial answer into an empty one -- a behaviour change smuggled in as a refactor. There is now a test for the partial case, and swapping the Sequence for an eager toList() reddens it. The behaviour change this DOES make is one line of log, and it is the reason the seam was worth cutting at all. The fallback said "Codec enumeration failed; assuming permissive" and returned empty sets -- but "video/avc" in emptySet() is false, so canEncode and canDecode answer no to everything and every job routes to FFmpeg. That is the restrictive answer, and it is the right one: FFmpeg does whatever Media3 does, only slower. The code stays; the message and the class KDoc now describe it. Seven tests. One of them was wrong first and the mutation is what said so: the alias case originally listed the alias *after* the codec it aliases and passed with the skip deleted, because canonicalName is shared and the dedup catches the second entry either way. The two rules overlap, so a fixture that does not separate them tests neither. Order separates them -- an alias arriving first claims the canonical name in `seen` and gets its own types credited, and the real codec is then dropped by the dedup. That is now the test, and it also says what the rule is worth: with a Set accumulator, an alias declaring the same types as its codec changes nothing, so the skip earns its place only when the two disagree. Mutations, each run and restored, each reddening the test that owns it: drop !isSoftwareOnly from the encoder predicate 1 red remove the alias skip 1 red (0 before the fixture was fixed) remove the canonical-name dedup 1 red remove the video/ prefix filter 1 red apply the hardware predicate to decoders too 1 red make the failure fallback permissive 2 red eager toList() instead of the lazy Sequence 1 red Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Render the container row for a video nothing could name (#199 )
2026-09-05 19:36:31 -05:00 · 2026-09-05 19:36:30 -05:00 · 2026-09-05 19:36:28 -05:00 · 2026-09-05 19:36:27 -05:00 · 2026-09-05 19:31:00 -05:00 · 2026-09-02 17:58:03 -05:00
33 changed files with 3325 additions and 109 deletions
@@ -130,9 +130,9 @@ install for code that can never run — and on API 37 the full APK does not fit
 - The `model` package is excluded from `ReturnCount` and `CyclomaticComplexMethod` only. It is the
  decision layer, where one branch is one documented user-visible outcome and the metric counts
  answers rather than complexity. Every other rule still applies there.
- **Coverage is reported, not gated** — **87.1% of lines (2025/2324), 69.1% of branches
-  (974/1410)**, measured 2026-08-27 with `./gradlew :app:jacocoTestReport`, against 502 JVM tests
-  in 71 classes.
+- **Coverage is reported, not gated** — **92.8% of lines (2183/2352), 81.3% of branches
+  (1091/1342)**, measured 2026-09-02 with `./gradlew :app:jacocoTestReport`, against 584 JVM tests
+  in 87 classes.

  **Every figure this file carried before 2026-08-24 was an artifact, roughly half the real one.**
  Robolectric loads classes through its own sandbox classloader with no source location, JaCoCo
@@ -159,8 +159,130 @@ install for code that can never run — and on API 37 the full APK does not fit
  chooses a branch the suite had never taken. Line coverage barely notices; branch coverage is the
  whole point.

+  Then #153's five children on 2026-08-29 — 87.1% -> 88.9% line, 69.1% -> **75.4%** branch, 502 ->
+  546 tests.
+
+  **That last branch figure moved for two reasons, and only one of them is new tests.** The
+  numerator rose 974 -> 1011; the denominator *fell* 1410 -> 1340. Both are the seam work. Pulling
+  a `when` out of a lambda inside a `collect` deletes the coroutine state machine's synthesized
+  branches around it, and what is left is a plain function whose branches a test can choose:
+  `ConversionViewModel$observe$1$1` went from carrying the whole mapping to 6 branches, while the
+  extracted `ConversionViewModelKt` covers 41 of 42 and `JoinViewModelKt` 38 of 39. So a seam is
+  worth more than the tests it enables — it also stops the measurement counting scaffolding.
+
+  Be careful quoting a branch move on its own for that reason. A percentage that rises because the
+  denominator shrank is not the same claim as one that rises because more branches are tested, and
+  this entry has a history of explaining its own numbers wrongly.
+
+  Then wave 3 (#167-#178) on 2026-09-02 — 88.9% -> 92.8% line, 75.4% -> **81.3%** branch, 546 ->
+  584 tests, in ten PRs from #179 to #188.
+
+  **Its shape is different from the two before it, and the difference is the thing to carry
+  forward.** Waves 1 and 2 were finding uncovered code. By wave 3 there was not much of that left,
+  so the gaps were sorted into two kinds before any test was written:
+
+  - **coverage gaps** — the line never executes. Filtered to sites where JaCoCo reports `mi > 0`, a
+    concrete instruction no test runs, which is what separates a real gap from a partial branch on
+    a compound condition. That filter cut the candidate list roughly in half and was right to.
+    **Wave 4 found it wrong in both directions, though — use the two filters below instead.**
+  - **assertion gaps** — JaCoCo is green and nothing checks the answer. `MainActivity`'s rail and
+    bottom bar were both *executed* by `AppRootRestorationTest` and **transposing them passed the
+    entire suite**; so did swapping the two progress-notification strings, and swapping `Content`'s
+    two destinations. No coverage number would ever have found any of the three.
+
+  **Wave 4 (2026-09-02) corrected that first filter, and the correction is the reusable part.**
+  `mi > 0` fails in both directions. It *over-reports* on Compose: `JoinScreen.kt:222` reads
+  `mi=10` and also `ci=38`, and `JoinStateAffordancesTest` already clicks that Save button and
+  asserts `save:joined.mp4` — the missed instructions are the synthesized `$changed`/`$dirty`
+  recomposition-skip path, the same codegen this file already warns about for *branch* counts,
+  showing up in the instruction count too. And it *under-reports* on warm methods with cold arms:
+  `ConversionViewModel.cancel()` misses no line, yet `activeWorkId?.let(...)` had only ever been
+  entered on the null side in 584 tests. Use two filters together instead:
+
+  - **`ci == 0`** — the line never executed. This is JaCoCo's own missed-line definition, so it
+    totals exactly the reported missed-line count and needs no judgement.
+  - **`ci > 0 && mb > 0` at method level** — a covered method with an arm nothing takes. This is
+    the only one that finds the `cancel()` shape.
+
+  Of wave 4's 251 missed branches, just **18** sat on lines that do execute, so the branch gap and
+  the line gap are largely the same gap; the second filter is about which of them are reachable.
+
+  So **every ticket named the mutation that had to go red, and that was its acceptance criterion
+  rather than a coverage delta**. It caught **two vacuous tests written in the same session**,
+  before either shipped:
+
+  - a `firstContainerHolding` test asserting a refusal still offered *something*. True, and
+    useless: the source container is a candidate in its own right, so the list stays non-empty
+    whatever the fallback does. What it actually buys is the codec the user asked for.
+  - a staged-delete test scanning for a `"join-"` prefix `StagingNames.forJob` does not produce —
+    it names files `<jobId>.<ext>`, so the assertion was true of everything.
+
+  It also corrected a *third* test that was not vacuous: `probeForConcat`'s KDoc claimed to drive
+  the `catch` arm, and rethrowing from that catch left it green. That is how the arm turned out to
+  be unreachable — see the next paragraph. A passing test with a wrong explanation is its own
+  failure mode.
+
+  **A green mutation is only evidence when the mutation is a real change**, which is the mirror
+  trap: one `classify` mutation stayed green because reordering two arms was semantically
+  equivalent for every reachable input. A bad mutation and a weak test look identical in the output.
+
+  Three things came back **not as the ticket described them**, which is a result rather than a
+  shortfall:
+
+  - `ContainerCapabilities:282`'s `exclude` filter **cannot drop anything**. `repair` always
+    changes a codec on the shared container — a codec it left alone is one `validate` would not
+    have refused — and the one non-default `exclude` carries `COPY` while every candidate carries
+    `NONE`. F4-shaped.
+  - `probeForConcat`'s catch arm is **unreachable on this runtime**. Robolectric's `MediaExtractor`
+    never throws from `setDataSource`, measured across an unregistered `content://` authority, a
+    missing `file://`, a file of garbage bytes and an `http://` URL — all four returned with
+    `trackCount = 0`. It stays device-only.
+  - `JobSnapshots:31`'s missed arm was **not** the `!isFile` one the ticket named — that is already
+    covered by the `reclaimed` fixture. It was `path == null`: a job carrying no output path at
+    all. Read the report, not the ticket, when the two disagree.
+
+  One item was **included against** the F4 rule rather than exempted by it, and the distinction is
+  worth having written down since both live in the same function: `ContainerCapabilities:94`
+  (`accepts(container, VideoCodec.NONE, mode)`) is dead in production today — every caller guards
+  `NONE` first — and was tested anyway, because its audio twin at `:101` has had a test since #136
+  and the asymmetry was the argument. The `COPY -> error(...)` arms beside it stay exempt, because
+  a second line of defence that can be provoked is not one.
+
+  Denominators moved here too, in both directions and for two different reasons: 1340 -> 1342
+  branches from `MediaProbe.merge`, 2348 -> 2352 lines from the `ConcatJoiner` interface. Neither
+  is new untested code.
+
  And **re-measure before quoting**: this entry was once written quoting 81.4%, measured four hours
  earlier, and was already three points stale by the time it was ready to merge.
+
+  **Wave 4's read (2026-09-02) moved no number at all, and that is its result.** It was a triage
+  rather than a test push: twelve tickets (**#192-#203**), four deferred candidates (**#204**), and
+  five findings (**F6-F10** in `docs/coverage-read-findings.md`). What it establishes is the shape
+  of what is left, which is different again from wave 3's:
+
+  - Of 169 never-executed lines, **81 are native or device edges and stay that way** —
+    `FFmpegEngine` 33, `Media3Engine` 24, `ConcatEngine` 14, `MainActivity.onCreate` 10 — their
+    zeroes being the `testDebugUnitTest`-only measurement boundary that #84, #85, #86 and #88 each
+    recorded before. A further **34 are device-bound only until a seam moves them**:
+    `AndroidDeviceCodecs` 20 (#194) and the 14 of `MediaProbe`'s 26 that are `readMediaInformation`
+    (#195). Do not read that second group as exempt — the two tickets exist because it is not.
+  - Most of the rest is **already closed with a reason on record**, or compiler-generated: default-arg
+    bridges, DI factory lambdas, synthetic `NoWhenBranchMatchedException` arms, coroutine completion.
+  - Six of the ten findings in that document are now "no action" or "not a test gap". By this point
+    the report's remaining red is mostly arms nothing can reach, members nothing calls, and arms a
+    test *can* reach but cannot pin — and a coverage number tells none of them apart.
+
+  **The biggest single gap it found was not a missed line.** `ConversionViewModel.cancel()` and
+  `JoinViewModel.cancel()` report every line covered; only the null arm of
+  `activeWorkId?.let(workManager::cancelWorkById)` had ever been entered, so nothing in 584 tests
+  connected the Cancel button to WorkManager (#192). That is what the second filter above is for.
+
+  It also re-opened a mechanism, not a close: #86 and #133 ruled `AndroidDeviceCodecs.probe()` out
+  **through `ShadowMediaCodecList`**, on the grounds that the builder cannot set `isAlias` or
+  `canonicalName`. A pure seam does not have that constraint, and #133 did not evaluate one. Read
+  #194 before re-arguing either way — and note the reason it is worth cutting is not coverage but
+  that the `runCatching` fallback logs "assuming permissive" while returning empty sets, which makes
+  `canEncode` and `canDecode` answer *no* for everything.
 - **Testable code is not done until it is tested.** If a piece is unit testable, it gets unit
  tests before it counts as done. If it is e2e testable, it gets e2e tests. Both clauses apply —
  a change that is both needs both.
@@ -182,6 +304,32 @@ install for code that can never run — and on API 37 the full APK does not fit

 - `kotlin.code.style=official`. Gradle stays Kotlin DSL.

+- **A stacked PR does not merge with `gh pr merge`, and `MERGED` is not proof it reached `main`.**
+  Two separate traps, both measured on 2026-08-27 while landing #144-#151.
+
+  `gh pr merge` uses the GraphQL mutation, which refuses a stacked PR outright: *"This pull request
+  is part of a stack and must be merged using the asynchronous merge REST API."* So does
+  `PUT .../pulls/{n}/merge`. The one that works is
+  `gh api -X PUT repos/OWNER/REPO/pulls/N/merge-async -f merge_method=merge`, which returns a uuid
+  to poll at `.../merge-async/{uuid}` until `status` is `merged` or `failed`.
+
+  **The second trap is worse, because nothing looks wrong.** GitHub retargets a stacked PR's base
+  to `main` when the PR below it merges, but *asynchronously*. Merge a stack faster than that
+  settles — five PRs about thirty seconds apart, in the case that found this — and each one merges
+  into its own base branch, which has itself already been merged and left behind. Every call
+  returns `status: merged` and every one is true. `gh pr list --state open` comes back empty, every
+  PR shows `MERGED`, and **none of the content is on `main`**.
+
+  What caught it was a coverage re-measure reading two points lower than the same tree had measured
+  an hour earlier; a fresh `git pull` changed nothing, which is what turned it into a question.
+  `git merge-base --is-ancestor <merge-sha> origin/main` answers it in one line. Do that after
+  merging a stack, or merge one at a time and re-read `baseRefName` between. #160 is what the
+  recovery cost.
+
+  The auto-retarget belongs to the stacking feature specifically. A PR opened with a plain
+  `gh pr create --base some-branch` does **not** retarget when that branch merges — it is left
+  pointing at a dead base and has to be moved by hand.
+
 - **File one-off issues with `tools/github/file-issue.sh`, not `gh issue create`.** `gh issue
  create` does not touch the project board, so the issue exists, carries its labels, and is
  invisible in the Kanban — indistinguishable from never having been filed. Measured 2026-08-24:
@@ -24,9 +24,11 @@ import androidx.compose.runtime.saveable.Saver
 import androidx.compose.runtime.saveable.rememberSaveable
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.testTag
 import androidx.media3.common.util.UnstableApi
 import org.libremediaconverter.convert.ConverterScreen
 import org.libremediaconverter.join.JoinScreen
+import org.libremediaconverter.ui.TestTags
 import org.libremediaconverter.ui.theme.LibreMediaConverterTheme

 /**
@@ -114,7 +116,7 @@ internal fun AppRoot(

    if (useRail) {
        Row(modifier = Modifier.fillMaxSize()) {
-            NavigationRail {
+            NavigationRail(modifier = Modifier.testTag(TestTags.Shell.NAVIGATION_RAIL)) {
                Destination.entries.forEach { item ->
                    NavigationRailItem(
                        selected = destination == item,
@@ -132,7 +134,7 @@ internal fun AppRoot(
        Scaffold(
            modifier = Modifier.fillMaxSize(),
            bottomBar = {
-                NavigationBar {
+                NavigationBar(modifier = Modifier.testTag(TestTags.Shell.NAVIGATION_BAR)) {
                    Destination.entries.forEach { item ->
                        NavigationBarItem(
                            selected = destination == item,
@@ -21,6 +21,11 @@ import org.libremediaconverter.model.VideoCodec
 *   words, "cannot be tested for correctness". It is a hint, not a guarantee, which is
 *   why the router treats a failed hardware export as a signal to fall back rather
 *   than trusting this up front.
+ * - **An enumeration that fails answers no to everything**, which sends every job to
+ *   FFmpeg. Empty sets are not a permissive default: `canEncode` looks a MIME type up in
+ *   [hardwareEncodeMimes] and finds nothing there. That is the intended answer — FFmpeg
+ *   can do whatever Media3 can, only slower — but it is the opposite of what this class
+ *   said until #194, so it is written down rather than left to be re-derived.
 */
 class AndroidDeviceCodecs private constructor(
    private val hardwareEncodeMimes: Set<String>,
@@ -46,22 +51,62 @@ class AndroidDeviceCodecs private constructor(

        fun get(): AndroidDeviceCodecs = cached ?: synchronized(this) { cached ?: probe().also { cached = it } }

-        private fun probe(): AndroidDeviceCodecs {
+        /**
+         * One entry of the platform's codec list, reduced to what the rules below read.
+         *
+         * The five booleans and the type list are the whole of what [capabilitiesFrom] needs, and
+         * none of them can be set on a `MediaCodecInfo` from a test: Robolectric ships
+         * `MediaCodecInfoBuilder`, but it has no `setIsAlias` and no `setCanonicalName`, which is
+         * exactly the objection #133 raised against reaching this code through
+         * `ShadowMediaCodecList`. That objection is about the shadow. It does not apply to a
+         * function that takes its own entry type, which is why this exists.
+         */
+        internal data class CodecEntry(
+            val canonicalName: String,
+            val isAlias: Boolean,
+            val isEncoder: Boolean,
+            val isHardwareAccelerated: Boolean,
+            val isSoftwareOnly: Boolean,
+            val supportedTypes: List<String>,
+        )
+
+        /**
+         * The enumeration rules, over entries a caller chooses.
+         *
+         * [probe] is the only production caller and supplies the real codec list; a test supplies
+         * its own, which is the point — the two rules this class's KDoc calls out as easy to get
+         * wrong, the alias skip and the canonical-name dedup, are unreachable any other way.
+         *
+         * **`enumerate` returns a `Sequence`, deliberately.** The `runCatching` has to wrap the
+         * *iteration* rather than a list built before it, because a `MediaCodecInfo` whose
+         * properties throw does so partway through — and when that happens the codecs already read
+         * are kept. Taking a `List` here would move that throw outside the loop and silently turn a
+         * partial answer into an empty one. That behaviour predates this seam; a `List` parameter
+         * would have changed it as a side effect of a refactor.
+         *
+         * **An enumeration that fails answers restrictively, and that is deliberate.** The sets
+         * come back empty, and `"video/avc" in emptySet()` is `false`, so [canEncode] and
+         * [canDecode] both answer no and every job routes to FFmpeg. FFmpeg can do everything
+         * Media3 can, only slower, so refusing the hardware path is the safe reading of "we could
+         * not find out what this device supports". This used to log "assuming permissive", which
+         * described the opposite of what the code does.
+         */
+        internal fun capabilitiesFrom(enumerate: () -> Sequence<CodecEntry>): AndroidDeviceCodecs {
            val encoders = mutableSetOf<String>()
            val decoders = mutableSetOf<String>()
            val seen = mutableSetOf<String>()

            runCatching {
-                MediaCodecList(MediaCodecList.REGULAR_CODECS).codecInfos.forEach { info ->
+                enumerate().forEach { entry ->
                    // Aliases point at the same underlying codec; counting both would
                    // double-count capabilities.
-                    if (info.isAlias) return@forEach
-                    if (!seen.add(info.canonicalName)) return@forEach
+                    if (entry.isAlias) return@forEach
+                    if (!seen.add(entry.canonicalName)) return@forEach

-                    info.supportedTypes.forEach { mime ->
+                    entry.supportedTypes.forEach { mime ->
                        if (!mime.startsWith("video/")) return@forEach
-                        if (info.isEncoder) {
-                            if (info.isHardwareAccelerated && !info.isSoftwareOnly) {
+                        if (entry.isEncoder) {
+                            if (entry.isHardwareAccelerated && !entry.isSoftwareOnly) {
                                encoders += mime
                            }
                        } else {
@@ -69,12 +114,32 @@ class AndroidDeviceCodecs private constructor(
                        }
                    }
                }
-            }.onFailure { Log.w(TAG, "Codec enumeration failed; assuming permissive.", it) }
+            }.onFailure { Log.w(TAG, "Codec enumeration failed; routing everything to FFmpeg.", it) }

            Log.i(TAG, "Hardware video encoders: $encoders")
            return AndroidDeviceCodecs(encoders, decoders)
        }

+        /**
+         * The thin edge: the real codec list, mapped onto [CodecEntry] one at a time.
+         *
+         * Lazily, so a property that throws does it inside [capabilitiesFrom]'s `runCatching` and
+         * on the entry that caused it — see that function's note on why the parameter is a
+         * `Sequence`.
+         */
+        private fun probe(): AndroidDeviceCodecs = capabilitiesFrom {
+            MediaCodecList(MediaCodecList.REGULAR_CODECS).codecInfos.asSequence().map { info ->
+                CodecEntry(
+                    canonicalName = info.canonicalName,
+                    isAlias = info.isAlias,
+                    isEncoder = info.isEncoder,
+                    isHardwareAccelerated = info.isHardwareAccelerated,
+                    isSoftwareOnly = info.isSoftwareOnly,
+                    supportedTypes = info.supportedTypes.toList(),
+                )
+            }
+        }
+
        /**
         * `internal` rather than `private` so the cross-check test can ask what a [VideoCodec]
         * means here and compare it with what [NAME_TO_MIME] says the same codec's names mean.
@@ -94,24 +94,61 @@ fun ConverterScreen(modifier: Modifier = Modifier, viewModel: ConversionViewMode
        state = state,
        settings = settings,
        validation = validation,
-        actions = ConverterActions(
+        actions = converterActions(
+            viewModel = viewModel,
            onPickInput = { pickInput.launch(arrayOf("*/*")) },
-            onPreset = viewModel::setPreset,
-            onContainer = viewModel::setContainer,
-            onVideoCodec = viewModel::setVideoCodec,
-            onAudioCodec = viewModel::setAudioCodec,
-            onSuggestion = viewModel::applySuggestion,
-            onQuality = viewModel::setQuality,
-            onEnginePreference = viewModel::setEnginePreference,
            onConvert = { requestNotifications.launch(Manifest.permission.POST_NOTIFICATIONS) },
-            onCancel = viewModel::cancel,
            onSave = { suggestedName -> chooseDestination.launch(suggestedName) },
-            onReset = viewModel::reset,
        ),
        modifier = modifier,
    )
 }

+/**
+ * Which of the ViewModel's methods each affordance on the screen calls.
+ *
+ * ## Why this is a function rather than an argument list
+ *
+ * It was an argument list, inside [ConverterScreen], which no test reached: `ConverterScreenContent`
+ * builds its own [ConverterActions], so every test in the suite drove the stateless inner and none
+ * of them ever saw the wiring.
+ *
+ * Most of the list is safe without a test, and saying so is more useful than pretending otherwise:
+ * `onContainer`, `onVideoCodec`, `onAudioCodec`, `onPreset`, `onSuggestion`, `onQuality` and
+ * `onEnginePreference` each take a distinct type, so binding one to another's setter does not
+ * compile. Verified rather than assumed — swapping `onVideoCodec` and `onAudioCodec` fails with
+ * *"Inapplicable candidate(s): fun setAudioCodec(codec: AudioCodec)"*.
+ *
+ * **[ConverterActions.onCancel] and [ConverterActions.onReset] are the exception.** Both are
+ * `() -> Unit`, so swapping them compiles silently — also verified — and ships a Cancel button that
+ * throws the conversion away and a Start-over button that leaves it on screen. That pair is what
+ * `ConverterWiringTest` exists for.
+ *
+ * The three launcher-backed actions stay parameters: they need an `ActivityResultLauncher`, which
+ * is the part that genuinely needs the composition, and keeping them out means the rest can be
+ * checked without one.
+ */
+@UnstableApi
+internal fun converterActions(
+    viewModel: ConversionViewModel,
+    onPickInput: () -> Unit,
+    onConvert: () -> Unit,
+    onSave: (suggestedName: String) -> Unit,
+): ConverterActions = ConverterActions(
+    onPickInput = onPickInput,
+    onPreset = viewModel::setPreset,
+    onContainer = viewModel::setContainer,
+    onVideoCodec = viewModel::setVideoCodec,
+    onAudioCodec = viewModel::setAudioCodec,
+    onSuggestion = viewModel::applySuggestion,
+    onQuality = viewModel::setQuality,
+    onEnginePreference = viewModel::setEnginePreference,
+    onConvert = onConvert,
+    onCancel = viewModel::cancel,
+    onSave = onSave,
+    onReset = viewModel::reset,
+)
+
 /**
 * Everything [ConverterScreenContent] can ask for, in one value.
 *
@@ -50,19 +50,42 @@ object MediaProbe {
    )

    fun probe(context: Context, uri: Uri): InputProbe {
-        val extracted = probeWithExtractor(context, uri)
-        val info = probeWithFFprobe(context, uri)
+        val merged = merge(probeWithExtractor(context, uri), probeWithFFprobe(context, uri))
+        if (merged.kind == InputKind.UNPARSEABLE) {
+            // Not a failure: an unparseable input is a strong signal that this job belongs on
+            // FFmpeg. Reporting an unknown codec makes the router say so.
+            Log.i(TAG, "Neither MediaExtractor nor FFprobe could read $uri; routing to FFmpeg.")
+        }
+        return merged
+    }

+    /**
+     * What the two probes together say about one input.
+     *
+     * A pure function, and `internal` for the same reason [extractedFrom] is: the precedence rules
+     * below are the answer to "which probe wins", and until this was pulled out of [probe] the only
+     * way to ask was to have a real `MediaExtractor` and a real FFprobe **disagree**, which nothing
+     * on any source set can arrange. `RemuxTest` drives this on a device against committed
+     * fixtures, but only ever with one probe answering and the other agreeing or also failing --
+     * so every elvis here was taken in one direction and never the other.
+     *
+     * The rules, each of which is a decision rather than an accident:
+     *
+     * - **The extractor wins on codecs.** It is the platform's own view of what it can decode,
+     *   which is the thing the router is about to ask about. FFprobe's name for the same track can
+     *   differ, and the copy planner keys off these strings.
+     * - **FFprobe alone reports the container.** `MediaExtractor` cannot, which is why [InputProbe]
+     *   carries a nullable one and `CopyPlanner` treats null as "container unknown".
+     * - **Duration is the larger of the two**, not the first non-zero. Either probe can report zero
+     *   for a file the other times correctly, and a zero duration makes the FFmpeg progress
+     *   percentage undefined.
+     */
+    internal fun merge(extracted: Extracted?, info: FFprobeInfo?): InputProbe {
        val videoCodec = extracted?.videoCodec ?: info?.videoCodec
        val audioCodec = extracted?.audioCodec ?: info?.audioCodec
        val kind = classify(extracted, info)

-        if (kind == InputKind.UNPARSEABLE) {
-            // Not a failure: an unparseable input is a strong signal that this job belongs on
-            // FFmpeg. Reporting an unknown codec makes the router say so.
-            Log.i(TAG, "Neither MediaExtractor nor FFprobe could read $uri; routing to FFmpeg.")
-            return UNREADABLE
-        }
+        if (kind == InputKind.UNPARSEABLE) return UNREADABLE

        return InputProbe(
            videoCodec = videoCodec,
@@ -83,7 +106,7 @@ object MediaProbe {
     * audio file and a corrupt file indistinguishable. The source-info card cannot describe either
     * honestly until they are separate, and neither can the copy planner.
     */
-    private fun classify(extracted: Extracted?, info: FFprobeInfo?): InputKind = when {
+    internal fun classify(extracted: Extracted?, info: FFprobeInfo?): InputKind = when {
        info?.isImage == true -> InputKind.IMAGE
        extracted == null && info == null -> InputKind.UNPARSEABLE
        (extracted?.videoCodec ?: info?.videoCodec) != null -> InputKind.VIDEO
@@ -162,7 +185,11 @@ object MediaProbe {
        }
    }

-    private class FFprobeInfo(
+    /**
+     * `internal` rather than `private` for the same reason [Extracted] is, and it should have been
+     * from the start: [merge] cannot be named from a test while half its signature is private.
+     */
+    internal class FFprobeInfo(
        val container: Container?,
        val videoCodec: String?,
        val audioCodec: String?,
@@ -4,6 +4,7 @@ import android.content.Context
 import android.net.Uri
 import androidx.media3.common.util.UnstableApi
 import org.libremediaconverter.codec.AndroidDeviceCodecs
+import org.libremediaconverter.ffmpeg.ConcatEngine
 import org.libremediaconverter.ffmpeg.FFmpegEngine
 import org.libremediaconverter.model.ConversionRequest
 import org.libremediaconverter.model.DeviceCodecs
@@ -40,6 +41,27 @@ interface SoftwareTranscoder {
    )
 }

+/**
+ * The join path. Implemented by [org.libremediaconverter.ffmpeg.ConcatEngine].
+ *
+ * Added last of the three, and the gap it closes was measured rather than guessed:
+ * `PerJobStagingTest`'s KDoc records that reverting `ConcatWorker` to a constant staging name left
+ * all 257 tests green, because nothing in the JVM suite can get past a `ConcatEngine` constructed
+ * in place. Everything after that line -- the failure mapping, the message fallback, the staged
+ * delete -- was untested on every source set.
+ *
+ * The result type stays nested in the implementation rather than being lifted here. Moving it would
+ * touch every call site to buy nothing: what a test needs is the ability to *not* run FFmpeg, and
+ * that is the method, not the type.
+ */
+interface ConcatJoiner {
+    suspend fun join(
+        inputs: List<Uri>,
+        output: File,
+        format: OutputFormat = OutputFormat.MP4_H264,
+    ): ConcatEngine.Result
+}
+
 /**
 * The seam that lets tests force failure paths.
 *
@@ -69,6 +91,9 @@ object ConversionDependencies {
    @Volatile
    var software: () -> SoftwareTranscoder = { FFmpegEngine() }

+    @Volatile
+    var concat: (Context) -> ConcatJoiner = { ConcatEngine(it) }
+
    @Volatile
    var publisher: (Context) -> OutputPublisher = { OutputPublisher(it) }

@@ -103,6 +128,7 @@ object ConversionDependencies {
    fun reset() {
        hardware = { Media3Engine(it) }
        software = { FFmpegEngine() }
+        concat = { ConcatEngine(it) }
        publisher = { OutputPublisher(it) }
        deviceCodecs = { AndroidDeviceCodecs.get() }
        probe = { context, uri -> MediaProbe.probe(context, uri) }
@@ -7,6 +7,7 @@ import com.arthenica.ffmpegkit.FFmpegKit
 import com.arthenica.ffmpegkit.FFmpegKitConfig
 import com.arthenica.ffmpegkit.ReturnCode
 import kotlinx.coroutines.suspendCancellableCoroutine
+import org.libremediaconverter.convert.ConcatJoiner
 import org.libremediaconverter.convert.MediaProbe
 import org.libremediaconverter.convert.StagingNames
 import org.libremediaconverter.model.ConcatPlanner
@@ -24,11 +25,11 @@ import kotlin.coroutines.resumeWithException
 * reliably fail when they differ — it can emit a file whose later segments are
 * garbled. See [ConcatPlanner].
 */
-class ConcatEngine(private val context: Context) {
+class ConcatEngine(private val context: Context) : ConcatJoiner {

    data class Result(val strategy: ConcatStrategy, val output: File)

-    suspend fun join(inputs: List<Uri>, output: File, format: OutputFormat = OutputFormat.MP4_H264): Result {
+    override suspend fun join(inputs: List<Uri>, output: File, format: OutputFormat): Result {
        require(inputs.size >= 2) { "Joining needs at least two files." }

        val paths = inputs.map { uri ->
@@ -56,17 +56,38 @@ fun JoinScreen(modifier: Modifier = Modifier, viewModel: JoinViewModel = viewMod

    JoinScreenContent(
        state = state,
-        actions = JoinActions(
+        actions = joinActions(
+            viewModel = viewModel,
            onPickInputs = { pickInputs.launch(arrayOf("video/*")) },
-            onJoin = viewModel::join,
-            onCancel = viewModel::cancel,
            onSave = { suggestedName -> chooseDestination.launch(suggestedName) },
-            onReset = viewModel::reset,
        ),
        modifier = modifier,
    )
 }

+/**
+ * Which of the ViewModel's methods each affordance on the join screen calls.
+ *
+ * The join-side twin of `converterActions`, and the transposition risk here is worse: **three**
+ * `() -> Unit` bindings rather than two. `onJoin`, `onCancel` and `onReset` are mutually
+ * interchangeable as far as the compiler is concerned, so a Join button that cancels, or a Cancel
+ * button that starts the job, is a swap nothing but a test would catch.
+ *
+ * See `converterActions` for why the launcher-backed actions stay parameters.
+ */
+@UnstableApi
+internal fun joinActions(
+    viewModel: JoinViewModel,
+    onPickInputs: () -> Unit,
+    onSave: (suggestedName: String) -> Unit,
+): JoinActions = JoinActions(
+    onPickInputs = onPickInputs,
+    onJoin = viewModel::join,
+    onCancel = viewModel::cancel,
+    onSave = onSave,
+    onReset = viewModel::reset,
+)
+
 /**
 * Everything [JoinScreenContent] can ask for, in one value.
 *
@@ -5,6 +5,7 @@ import android.net.Uri
 import androidx.lifecycle.AndroidViewModel
 import androidx.lifecycle.viewModelScope
 import androidx.media3.common.util.UnstableApi
+import androidx.work.Data
 import androidx.work.WorkInfo
 import androidx.work.WorkManager
 import kotlinx.coroutines.CoroutineDispatcher
@@ -30,6 +31,108 @@ import org.libremediaconverter.work.jobSnapshots
 import java.io.File
 import java.util.UUID

+/**
+ * One update about a running join, as WorkManager last reported it.
+ *
+ * The join-side twin of `ConversionUpdate`, and deliberately the same shape: this pair of seams is
+ * one refactor done twice, and letting them diverge would make the two flows harder to compare than
+ * the duplication costs. There is no `progressPercent` here because `ConcatWorker` publishes none —
+ * a join is indeterminate.
+ */
+internal data class JoinUpdate(val state: WorkInfo.State, val runAttemptCount: Int, val outputData: Data)
+
+/**
+ * What the join screen should show, given what WorkManager last said about the job.
+ *
+ * The join-side twin of `conversionStateFrom`, extracted for the same reason and with the same two
+ * exclusions: the ownership check stays at the call site, and this takes no responsibility for the
+ * staged file. See that function's KDoc for the argument in full.
+ *
+ * Five arms had never been chosen by any test before this was cut out, because a real `ConcatWorker`
+ * only ever produces a terminal state with well-formed output.
+ *
+ * @param cancelled where a cancellation lands, which differs for a reattached job — see [observe].
+ */
+@UnstableApi
+internal fun joinStateFrom(update: JoinUpdate, inputs: List<InputFile>, cancelled: JoinState): JoinState =
+    when (update.state) {
+        // BLOCKED is a job waiting on a prerequisite, which the user has nothing to do about and
+        // nothing useful to be told about. It reads as "starting", like a fresh ENQUEUED.
+        WorkInfo.State.RUNNING, WorkInfo.State.BLOCKED -> JoinState.Joining(inputs)
+
+        // ENQUEUED after a run means a retry is pending -- the same rule, and the same reasoning, as
+        // the convert side. See `conversionStateFrom`.
+        WorkInfo.State.ENQUEUED ->
+            if (update.runAttemptCount > 0) {
+                JoinState.Waiting(inputs)
+            } else {
+                JoinState.Joining(inputs)
+            }
+
+        WorkInfo.State.SUCCEEDED -> joinedFrom(update.outputData)
+
+        // A worker that dies before it can report anything leaves no output data at all, and an
+        // exception's message can be an empty string. Both would read as a failure with nothing said,
+        // so blank falls back like missing does.
+        WorkInfo.State.FAILED -> JoinState.Failed(
+            update.outputData.getString(ConcatWorker.KEY_ERROR)
+                ?.takeIf { it.isNotBlank() }
+                ?: ConcatWorker.GENERIC_FAILURE_MESSAGE,
+        )
+
+        WorkInfo.State.CANCELLED -> cancelled
+    }
+
+/**
+ * The `SUCCEEDED` arm. A join that reported success and named no file has nothing to offer.
+ */
+@UnstableApi
+private fun joinedFrom(outputData: Data): JoinState {
+    val path = outputData.getString(ConcatWorker.KEY_OUTPUT_PATH)
+        ?: return JoinState.Failed(JOINED_WITHOUT_A_FILE_MESSAGE)
+    return JoinState.Joined(
+        staged = File(path),
+        strategy = strategyFrom(outputData.getString(ConcatWorker.KEY_STRATEGY)),
+        // A join enqueued before the worker reported these carries neither, and the fallback is
+        // the format such a job really used -- ConcatWorker.request has always defaulted to it,
+        // and the join screen has never offered a choice.
+        suggestedName = outputData.getString(ConcatWorker.KEY_SUGGESTED_NAME)
+            ?.takeIf { it.isNotBlank() }
+            ?: ConcatWorker.outputNameFor(ConcatWorker.DEFAULT_FORMAT),
+        mimeType = outputData.getString(ConcatWorker.KEY_MIME_TYPE)
+            ?.takeIf { it.isNotBlank() }
+            ?: ConcatWorker.DEFAULT_FORMAT.mimeType,
+    )
+}
+
+/**
+ * The strategy a finished join reported, or [ConcatStrategy.REENCODE] when it named none.
+ *
+ * **Looked up rather than `valueOf`, and that is a fix rather than a style choice.** `valueOf`
+ * throws `IllegalArgumentException` on a name this build does not define, and this runs inside a
+ * `viewModelScope` collect with no handler -- so the throw does not become a `Failed` state, it
+ * takes the process down.
+ *
+ * Reachable for the reason `WorkerEnumFallbackTest` and `JobTags` are both written on: WorkManager
+ * keeps finished work for about a week, so a downgrade or a rollback hands this build a job
+ * enqueued by another one. `ConcatWorker` writes `result.strategy.name` into the output `Data`, so
+ * a build that added a third strategy would leave this one crashing on its own completed joins.
+ *
+ * `ConcatWorker.kt` already made exactly this change for `KEY_FORMAT`, and says why in as many
+ * words: *"Looked up rather than `valueOf` … a format name this build does not define used to throw
+ * past the catch."* The same read on this side had not been changed with it.
+ *
+ * REENCODE is the safe default rather than an arbitrary one: it is the answer for inputs that do
+ * not match, so a job whose strategy cannot be read is described as the more conservative of the
+ * two rather than being claimed as a lossless stream copy.
+ */
+private fun strategyFrom(name: String?): ConcatStrategy =
+    ConcatStrategy.entries.firstOrNull { it.name == name } ?: ConcatStrategy.REENCODE
+
+/** A join that reported success and named no file. There is nothing to offer the user to save. */
+internal const val JOINED_WITHOUT_A_FILE_MESSAGE: String =
+    "Joining reported success but produced no file."
+
 sealed interface JoinState {
    data object Idle : JoinState
    data class Ready(val inputs: List<InputFile>) : JoinState
@@ -251,56 +354,19 @@ class JoinViewModel @JvmOverloads constructor(
                // takes ownership of the staged file, and a superseded observation must not do
                // that either.
                if (!ownership.stillHeldBy(token)) return@collect
-                _state.value = when (info.state) {
-                    WorkInfo.State.RUNNING, WorkInfo.State.BLOCKED -> JoinState.Joining(inputs)
-                    WorkInfo.State.ENQUEUED ->
-                        if (info.runAttemptCount > 0) {
-                            JoinState.Waiting(inputs)
-                        } else {
-                            JoinState.Joining(inputs)
-                        }
-
-                    WorkInfo.State.SUCCEEDED -> {
-                        val path = info.outputData.getString(ConcatWorker.KEY_OUTPUT_PATH)
-                        val strategy = info.outputData.getString(ConcatWorker.KEY_STRATEGY)
-                            ?.let(ConcatStrategy::valueOf) ?: ConcatStrategy.REENCODE
-                        if (path == null) {
-                            JoinState.Failed("Joining reported success but produced no file.")
-                        } else {
-                            val staged = File(path)
-                            // Take responsibility for the file at the same moment the state
-                            // starts referring to it, so the two cannot disagree.
-                            pendingStaged = staged
-                            JoinState.Joined(
-                                staged = staged,
-                                strategy = strategy,
-                                // A join enqueued before the worker reported these carries
-                                // neither, and the fallback is the format such a job really
-                                // used -- ConcatWorker.request has always defaulted to it, and
-                                // the join screen has never offered a choice.
-                                suggestedName = info.outputData
-                                    .getString(ConcatWorker.KEY_SUGGESTED_NAME)
-                                    ?.takeIf { it.isNotBlank() }
-                                    ?: ConcatWorker.outputNameFor(ConcatWorker.DEFAULT_FORMAT),
-                                mimeType = info.outputData
-                                    .getString(ConcatWorker.KEY_MIME_TYPE)
-                                    ?.takeIf { it.isNotBlank() }
-                                    ?: ConcatWorker.DEFAULT_FORMAT.mimeType,
-                            )
-                        }
-                    }
-
-                    // A worker that dies before it can report anything leaves no output data at
-                    // all, and an exception's message can be an empty string. Both would read as
-                    // a failure with nothing said, so blank falls back like missing does.
-                    WorkInfo.State.FAILED -> JoinState.Failed(
-                        info.outputData.getString(ConcatWorker.KEY_ERROR)
-                            ?.takeIf { it.isNotBlank() }
-                            ?: ConcatWorker.GENERIC_FAILURE_MESSAGE,
-                    )
-
-                    WorkInfo.State.CANCELLED -> cancelled
-                }
+                val next = joinStateFrom(
+                    JoinUpdate(
+                        state = info.state,
+                        runAttemptCount = info.runAttemptCount,
+                        outputData = info.outputData,
+                    ),
+                    inputs = inputs,
+                    cancelled = cancelled,
+                )
+                // Read off the result rather than assigned inside the mapping -- see the same
+                // three lines in ConversionViewModel for why that is the better half of the swap.
+                if (next is JoinState.Joined) pendingStaged = next.staged
+                _state.value = next
            }
        }
    }
@@ -56,6 +56,20 @@ object TestTags {
     */
    const val RETRY_SAVE: String = "action.retrySave"

+    /**
+     * The adaptive shell around both screens -- `AppRoot`'s two layouts.
+     *
+     * Named because there is no other way to tell them apart from a test. Both render the same two
+     * destinations with the same labels and the same selection state, so every assertion that could
+     * be written without these tags is satisfied by either layout, and transposing the two bodies
+     * passed the whole suite. Exactly one of the two exists at a time, which is what makes
+     * `assertExists` / `assertDoesNotExist` on this pair a statement about the width class.
+     */
+    object Shell {
+        const val NAVIGATION_RAIL: String = "shell.navigationRail"
+        const val NAVIGATION_BAR: String = "shell.navigationBar"
+    }
+
    /** `ConverterScreen`. */
    object Converter {
        const val CHOOSE_FILE: String = "converter.chooseFile"
@@ -15,7 +15,6 @@ import kotlinx.coroutines.CancellationException
 import org.libremediaconverter.convert.ConversionDependencies
 import org.libremediaconverter.convert.InputQuery
 import org.libremediaconverter.convert.StagingNames
-import org.libremediaconverter.ffmpeg.ConcatEngine
 import org.libremediaconverter.model.OutputFormat

 /**
@@ -37,7 +36,7 @@ class ConcatWorker(context: Context, params: WorkerParameters) : CoroutineWorker

    override suspend fun doWork(): Result {
        val uris = inputData.getStringArray(KEY_INPUT_URIS)?.map(Uri::parse)
-            ?: return Result.failure(workDataOf(KEY_ERROR to "No input files."))
+            ?: return Result.failure(workDataOf(KEY_ERROR to NO_INPUTS_MESSAGE))
        if (uris.size < 2) {
            return Result.failure(workDataOf(KEY_ERROR to TOO_FEW_INPUTS_MESSAGE))
        }
@@ -77,7 +76,7 @@ class ConcatWorker(context: Context, params: WorkerParameters) : CoroutineWorker
                ),
            )

-            val result = ConcatEngine(applicationContext).join(uris, staged, format)
+            val result = ConversionDependencies.concat(applicationContext).join(uris, staged, format)
            Result.success(
                workDataOf(
                    KEY_OUTPUT_PATH to staged.absolutePath,
@@ -148,6 +147,16 @@ class ConcatWorker(context: Context, params: WorkerParameters) : CoroutineWorker
         * Here rather than in the ViewModel because the rule is the worker's: `request(...)` takes
         * a `List<Uri>` and checks nothing about its length, so this is the guard that always runs.
         */
+        /**
+         * A job carrying no input array at all -- a downgrade, or a queue entry from a build that
+         * spelled the key differently.
+         *
+         * A constant rather than the literal it was, for the convention #158 established: a message
+         * the user can see is named once, so a test asserts the same string the worker writes
+         * rather than a copy of it that can drift.
+         */
+        const val NO_INPUTS_MESSAGE: String = "No input files."
+
        const val TOO_FEW_INPUTS_MESSAGE: String = "Pick at least two files to join."

        /**
@@ -0,0 +1,129 @@
+package org.libremediaconverter
+
+import androidx.activity.ComponentActivity
+import androidx.compose.material3.windowsizeclass.WindowWidthSizeClass
+import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performClick
+import androidx.media3.common.util.UnstableApi
+import androidx.work.Data
+import org.junit.After
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.convert.ConversionDependencies
+import org.libremediaconverter.convert.installTestWorkManager
+import org.libremediaconverter.model.InputProbe
+import org.libremediaconverter.ui.TestTags
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+
+/**
+ * Which navigation affordance the shell actually renders, and which screen it actually shows.
+ *
+ * Assertion gaps rather than coverage gaps, both of them, and that is why they lasted.
+ * `AppRootRestorationTest` already drives `AppRoot` at `Compact` and `Expanded`, so JaCoCo is green
+ * on `useRail` -- but it asserts only that the *selected tab* survives recreation, through a stub
+ * `content` composable. Nothing anywhere queried for a rail or a bar, and nothing rendered the real
+ * screens. Two consequences, both measured before this file existed:
+ *
+ * - **Transposing the `NavigationRail` and `NavigationBar` bodies passed the entire suite.**
+ * - **Transposing `Content`'s two arms passed it too** -- a tablet showing the phone chrome, or the
+ *   Convert tab opening the Join screen, and 546 tests with nothing to say about either.
+ *
+ * `AppRoot`'s own KDoc is why this matters more than it looks: from targetSdk 37 the app is resized
+ * and rotated whether or not it is ready, so the width class is not a preference, it is whatever
+ * the system hands over.
+ *
+ * ## Two things this needed that the rest of the suite does not
+ *
+ * **`createAndroidComposeRule`, not `createComposeRule`.** Rendering `AppRoot` with its *default*
+ * content reaches `ConverterScreen`'s `viewModel = viewModel()`, which needs a
+ * `ViewModelStoreOwner`; the plain rule supplies none. It works because both ViewModels are
+ * `@JvmOverloads constructor(app: Application, …)`, so `AndroidViewModelFactory` can build them,
+ * and because `app/build.gradle.kts` already puts `ui-test-manifest`'s `ComponentActivity` in the
+ * merged manifest the unit tests build against -- which that file says in terms.
+ *
+ * **Tags on the two bars.** They are in `TestTags`, applied inside `main`, for the reason that
+ * file's KDoc gives: a tag the test hands down proves only that the test set it.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class AdaptiveShellTest {
+
+    @get:Rule
+    val composeRule = createAndroidComposeRule<ComponentActivity>()
+
+    @Before
+    fun setUp() {
+        val app = RuntimeEnvironment.getApplication()
+        installTestWorkManager(app, Data.EMPTY)
+        // The real screens are composed here, so their ViewModels are real too. Neither test is
+        // about probing or publishing; left alone they would reach the FFprobe loader and this
+        // machine's codec list, and decide things no assertion mentions.
+        ConversionDependencies.probe = { _, _ -> InputProbe() }
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    @Test
+    fun `a phone gets the bottom bar and a tablet gets the rail`() {
+        setShell(WindowWidthSizeClass.Compact)
+
+        composeRule.onNodeWithTag(TestTags.Shell.NAVIGATION_BAR).assertExists()
+        composeRule.onNodeWithTag(TestTags.Shell.NAVIGATION_RAIL).assertDoesNotExist()
+    }
+
+    @Test
+    fun `an expanded window gets the rail`() {
+        setShell(WindowWidthSizeClass.Expanded)
+
+        composeRule.onNodeWithTag(TestTags.Shell.NAVIGATION_RAIL).assertExists()
+        composeRule.onNodeWithTag(TestTags.Shell.NAVIGATION_BAR).assertDoesNotExist()
+    }
+
+    /**
+     * The width class no test had ever passed.
+     *
+     * `useRail` is `!= Compact`, so Medium takes the rail with Expanded. Narrowing it to
+     * `== Expanded` is a one-character change that breaks every tablet and unfolded foldable and
+     * nothing else -- and until this test, nothing in either source set used `Medium` at all.
+     */
+    @Test
+    fun `a medium window is a rail window, not a phone`() {
+        setShell(WindowWidthSizeClass.Medium)
+
+        composeRule.onNodeWithTag(TestTags.Shell.NAVIGATION_RAIL).assertExists()
+        composeRule.onNodeWithTag(TestTags.Shell.NAVIGATION_BAR).assertDoesNotExist()
+    }
+
+    /**
+     * The mapping every other test stubs out: which screen each destination actually opens.
+     *
+     * Matched on each screen's own "choose a file" affordance rather than on a title, because those
+     * tags are applied by the screens themselves -- so this fails if the destinations are
+     * transposed, and it fails for the right reason.
+     */
+    @Test
+    fun `Convert opens the converter and Join opens the join screen`() {
+        setShell(WindowWidthSizeClass.Compact)
+
+        composeRule.onNodeWithTag(TestTags.Converter.CHOOSE_FILE).assertExists()
+        composeRule.onNodeWithTag(TestTags.Join.CHOOSE_FILES).assertDoesNotExist()
+
+        composeRule.onNodeWithText(Destination.JOIN.label).performClick()
+
+        composeRule.onNodeWithTag(TestTags.Join.CHOOSE_FILES).assertExists()
+        composeRule.onNodeWithTag(TestTags.Converter.CHOOSE_FILE).assertDoesNotExist()
+    }
+
+    /** [AppRoot] with its real content, which is the half nothing else composes. */
+    private fun setShell(width: WindowWidthSizeClass) {
+        composeRule.setContent { AppRoot(width) }
+    }
+}
@@ -0,0 +1,201 @@
+package org.libremediaconverter.codec
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.model.VideoCodec
+import org.robolectric.RobolectricTestRunner
+
+/**
+ * The rules `AndroidDeviceCodecs.probe()` applies to the platform's codec list.
+ *
+ * ## Why this is not a third run of the #86/#133 spike
+ *
+ * #86 closed `probe()` as device-bound. #133 re-opened the question with
+ * `ShadowMediaCodecList` in hand and closed it again, for a reason that was right about what it
+ * was answering: `MediaCodecInfoBuilder` "has no `setIsAlias` and no `setCanonicalName`, so the
+ * alias skip and the canonical-name dedup — the two things the class's KDoc calls out as easy to
+ * get wrong — are not reachable through it."
+ *
+ * **That objection is about the shadow.** It does not apply to a function that takes its own entry
+ * type, which is what `capabilitiesFrom` now does. The half #133 named as unreachable is the half
+ * this file spends most of its cases on.
+ *
+ * ## What made the seam worth cutting, which is not coverage
+ *
+ * The `runCatching` fallback logged *"assuming permissive"* and returned empty sets — and empty
+ * sets are **restrictive**: `"video/avc" in emptySet()` is `false`, so `canEncode` and `canDecode`
+ * both answer no and every job routes to FFmpeg. The code was right and the message described the
+ * opposite of it. That is pinned below, so whichever reading a future change takes, it has to say
+ * so out loud.
+ *
+ * Robolectric only because `capabilitiesFrom` logs what it found; the rules themselves are pure.
+ */
+@RunWith(RobolectricTestRunner::class)
+class CodecEnumerationTest {
+
+    /**
+     * The alias skip, in the one arrangement where it is observable — and finding that arrangement
+     * is the whole of this test.
+     *
+     * A first attempt listed the alias *after* the codec it aliases and passed with the skip
+     * deleted, because `canonicalName` is shared and the dedup below catches the second entry
+     * either way. The two rules overlap, so a fixture that does not separate them tests neither.
+     *
+     * What separates them is **order**. `MediaCodecInfo.getCanonicalName()` on an alias returns the
+     * underlying codec's name, so an alias arriving first claims that name in `seen` and has its
+     * own `supportedTypes` credited — and then the real codec is dropped by the dedup. Without the
+     * alias skip the device is described by whichever entry the platform happened to list first.
+     *
+     * That also says what the rule is worth. With a `Set` accumulator, an alias declaring the same
+     * types as its codec changes nothing whichever order they arrive in; the skip earns its place
+     * only when the two disagree, which is exactly when believing the wrong one matters.
+     */
+    @Test
+    fun `an alias listed before the codec it aliases does not describe the device`() {
+        val codecs = capabilities(
+            entry("c2.qti.avc.encoder", encoder = true, types = listOf(HEVC), alias = true),
+            entry("c2.qti.avc.encoder", encoder = true, types = listOf(AVC)),
+        )
+
+        assertTrue("the real codec's types are the device's", codecs.canEncode(VideoCodec.H264))
+        assertFalse(
+            "an alias must not be credited with types the codec it aliases never claimed",
+            codecs.canEncode(VideoCodec.H265),
+        )
+    }
+
+    @Test
+    fun `two entries sharing a canonical name are read once`() {
+        val codecs = capabilities(
+            entry("c2.qti.avc.encoder", encoder = true, types = listOf(AVC)),
+            entry("c2.qti.avc.encoder", encoder = true, types = listOf(HEVC)),
+        )
+
+        assertEquals(setOf(AVC), codecs.hardwareEncoders())
+    }
+
+    /**
+     * Both halves of the hardware predicate, one arm at a time.
+     *
+     * A vendor may declare a codec hardware-accelerated *and* software-only; the class KDoc is
+     * explicit that the first flag "cannot be tested for correctness", so the second is what stops
+     * a mislabelled software encoder being treated as the fast path.
+     */
+    @Test
+    fun `an encoder counts as hardware only when it is accelerated and not software-only`() {
+        assertEquals(
+            setOf(AVC),
+            capabilities(entry("hw", encoder = true, accelerated = true, types = listOf(AVC))).hardwareEncoders(),
+        )
+        assertEquals(
+            emptySet<String>(),
+            capabilities(entry("sw", encoder = true, accelerated = false, types = listOf(AVC))).hardwareEncoders(),
+        )
+        assertEquals(
+            "a codec claiming both must not be trusted as hardware",
+            emptySet<String>(),
+            capabilities(
+                entry("both", encoder = true, accelerated = true, softwareOnly = true, types = listOf(AVC)),
+            ).hardwareEncoders(),
+        )
+    }
+
+    /**
+     * Decoders are collected regardless of the hardware flags, and that asymmetry is the design.
+     *
+     * `canDecode` asks whether the platform can read the input at all — a software decoder answers
+     * that as well as a hardware one. `canEncode` asks whether the *fast path* exists, which is a
+     * different question and why only encoders are filtered.
+     */
+    @Test
+    fun `a software decoder still counts as something the platform can read`() {
+        val codecs = capabilities(
+            entry(
+                "c2.android.avc.decoder",
+                encoder = false,
+                accelerated = false,
+                softwareOnly = true,
+                types = listOf(AVC),
+            ),
+        )
+
+        assertTrue(codecs.canDecode("h264"))
+    }
+
+    @Test
+    fun `audio types are ignored on both sides`() {
+        val codecs = capabilities(
+            entry("aac.encoder", encoder = true, accelerated = true, types = listOf("audio/mp4a-latm")),
+            entry("aac.decoder", encoder = false, types = listOf("audio/mp4a-latm")),
+        )
+
+        assertEquals(emptySet<String>(), codecs.hardwareEncoders())
+        // Not "the platform cannot decode AAC" -- `canDecode` is asked about *video* codec names,
+        // and an unknown name is answered permissively. The point is that nothing audio reached
+        // either set.
+        assertTrue("an unknown name stays permissive", codecs.canDecode("something-nobody-named"))
+    }
+
+    /**
+     * The failure fallback, pinned as the restrictive answer it actually is.
+     *
+     * #194 decided this rather than assuming it: the code stays, the message changes. If a later
+     * change wants the permissive reading its old log line described, this test is what makes that
+     * a decision instead of a drift.
+     */
+    @Test
+    fun `an enumeration that fails sends every job to FFmpeg`() {
+        val codecs = AndroidDeviceCodecs.capabilitiesFrom { error("MediaCodecList exploded") }
+
+        assertFalse("a failed enumeration must not claim a hardware encoder", codecs.canEncode(VideoCodec.H264))
+        assertFalse(codecs.canDecode("h264"))
+        assertEquals(emptySet<String>(), codecs.hardwareEncoders())
+    }
+
+    /**
+     * A list that throws partway keeps what it already read.
+     *
+     * This predates the seam — `runCatching` has always wrapped the iteration rather than a list
+     * built before it — and it is asserted here because the seam is where it could quietly have
+     * been lost. Taking a `List` instead of a `Sequence` would move the throw outside the loop and
+     * turn this partial answer into an empty one, with no test to notice.
+     */
+    @Test
+    fun `codecs read before a failing entry are kept`() {
+        val codecs = AndroidDeviceCodecs.capabilitiesFrom {
+            sequence {
+                yield(entry("good", encoder = true, accelerated = true, types = listOf(AVC)))
+                error("the sixth codec's properties threw")
+            }
+        }
+
+        assertEquals(setOf(AVC), codecs.hardwareEncoders())
+    }
+
+    private fun capabilities(vararg entries: AndroidDeviceCodecs.Companion.CodecEntry) =
+        AndroidDeviceCodecs.capabilitiesFrom { entries.asSequence() }
+
+    private fun entry(
+        canonicalName: String,
+        encoder: Boolean,
+        accelerated: Boolean = true,
+        softwareOnly: Boolean = false,
+        alias: Boolean = false,
+        types: List<String>,
+    ) = AndroidDeviceCodecs.Companion.CodecEntry(
+        canonicalName = canonicalName,
+        isAlias = alias,
+        isEncoder = encoder,
+        isHardwareAccelerated = accelerated,
+        isSoftwareOnly = softwareOnly,
+        supportedTypes = types,
+    )
+
+    private companion object {
+        const val AVC = "video/avc"
+        const val HEVC = "video/hevc"
+    }
+}
@@ -7,6 +7,7 @@ import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
 import org.libremediaconverter.model.CodecNames
+import org.libremediaconverter.model.InputProbe
 import org.libremediaconverter.model.VideoCodec

 /**
@@ -133,6 +134,38 @@ class CodecVocabularyTest {
     * landed, a device with no HEVC decoder answered true for `x265` and Media3 was handed a job it
     * could not do; now the router sends it to FFmpeg without spending the attempt.
     */
+    /**
+     * The sentinel is not just another unknown name, and the difference is the whole guard.
+     *
+     * `canDecode` ends `?: true` -- a name neither table knows keeps the permissive answer, because
+     * the app would rather try than refuse a file it might handle. `InputProbe.UNPARSEABLE` has to
+     * be the exception: the platform has *already* failed to parse the input, so there is nothing
+     * for a decoder to be permissive about, and waving it through spends a Media3 attempt on a job
+     * that cannot start.
+     *
+     * The `cinepak` line is what makes the sentinel line mean something. Without it, deleting the
+     * early return leaves this test green -- both names would fall through to the same `?: true`.
+     * The pair is the assertion.
+     *
+     * `DeviceCodecs.PERMISSIVE` carries the same rule and `ConversionRouterTest` pins its routing
+     * consequence. This is the implementation that runs on a device.
+     */
+    @Test
+    fun `the unparseable sentinel is refused even where an unknown name is waved through`() {
+        val everything = AndroidDeviceCodecs.forTesting(
+            encoders = emptySet(),
+            decoders = setOf("video/avc", "video/hevc"),
+        )
+        assertFalse(
+            "the platform could not parse this input, so there is nothing to decode with",
+            everything.canDecode(InputProbe.UNPARSEABLE),
+        )
+        assertTrue(
+            "a merely unknown name still keeps the permissive answer",
+            everything.canDecode("cinepak"),
+        )
+    }
+
    @Test
    fun `a device without the decoder now says so for the aliases it used to wave through`() {
        val hevcOnly = AndroidDeviceCodecs.forTesting(encoders = emptySet(), decoders = setOf("video/hevc"))
@@ -0,0 +1,180 @@
+package org.libremediaconverter.convert
+
+import android.app.Application
+import androidx.media3.common.util.UnstableApi
+import androidx.work.OneTimeWorkRequestBuilder
+import androidx.work.WorkInfo
+import androidx.work.WorkManager
+import androidx.work.workDataOf
+import kotlinx.coroutines.Dispatchers
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.join.JoinState
+import org.libremediaconverter.join.JoinViewModel
+import org.libremediaconverter.model.InputProbe
+import org.libremediaconverter.work.ConcatWorker
+import org.libremediaconverter.work.ConversionWorker
+import org.libremediaconverter.work.JobTags
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import java.util.UUID
+import java.util.concurrent.TimeUnit
+
+/**
+ * That `cancel()` cancels the job, on both screens.
+ *
+ * ## Why this was missing, which is the interesting part
+ *
+ * Both `cancel()` methods are one line — `activeWorkId?.let(workManager::cancelWorkById)` — and
+ * **JaCoCo reports every line of both as covered**. `SettingsEditsTest`'s
+ * `cancelling with no active job does nothing rather than throwing` runs the method, and its own
+ * comment names which half it drives: "`activeWorkId?.let(...)` -- the null side". The other side
+ * had never been entered, and `JoinViewModel.cancel()` had no test at all.
+ *
+ * So no line-level coverage filter could see this. What surfaces it is a method-level read —
+ * `mi=11, ci=7, mb=1, cb=1` on both — a covered method with an arm nothing takes. That is the
+ * second of the two filters #194 records, and this is the gap that argued for it.
+ *
+ * The affordance tests are not this. `ConverterStateAffordancesTest` and `JoinStateAffordancesTest`
+ * click `TestTags.CANCEL` and assert the *action* fires into a stub; `ScreenWiringTest` asserts the
+ * action calls `viewModel.cancel()`. Both halves were pinned and the join between them was not, so
+ * nothing in 584 tests connected the button to WorkManager.
+ *
+ * ## Why the job is enqueued with a delay
+ *
+ * The test WorkManager runs on a `SynchronousExecutor`, so an ordinary request finishes inline —
+ * which is exactly why only the null half was ever covered: by the time a test could call
+ * `cancel()`, `convert()`'s job was already terminal. `setInitialDelay` is what `TestScheduler`
+ * honours, so the job sits in `ENQUEUED` until the test lets it go, and it never does.
+ *
+ * **Production never sets a delay**, so the request is built here rather than through
+ * `ConversionWorker.request`. The *state* is not synthetic: `ENQUEUED` at `runAttemptCount == 0` is
+ * what every job passes through before the scheduler picks it up, `Reattachment.choose` ranks it
+ * `QUEUED`, and `conversionStateFrom` maps it to `Converting(input, 0)`. The delay changes how long
+ * the job stays in a real state, not which state it is in.
+ *
+ * ## What is asserted, and in which order
+ *
+ * WorkManager's own record first, then the screen. The screen alone would be a weaker claim than it
+ * looks: `CANCELLED` maps to `Idle` for a reattached job, and `Idle` is also where a ViewModel that
+ * did nothing at all would sit.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class CancelReachesWorkManagerTest {
+
+    private lateinit var app: Application
+    private lateinit var workManager: WorkManager
+
+    @Before
+    fun setUp() {
+        app = RuntimeEnvironment.getApplication()
+        ConversionDependencies.publisher = { RecordingPublisher(app) }
+        ConversionDependencies.probe = { _, _ -> InputProbe() }
+        installTestWorkManager(app, workDataOf())
+        workManager = WorkManager.getInstance(app)
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    @Test
+    fun `cancelling a queued conversion cancels that job`() {
+        val id = enqueueQueuedConversion()
+        val viewModel = ConversionViewModel(app, Dispatchers.Unconfined)
+        awaitState(viewModel.state, "Converting") { it is ConversionState.Converting }
+
+        viewModel.cancel()
+
+        assertEquals(
+            "Cancel must reach WorkManager, not just the screen",
+            WorkInfo.State.CANCELLED,
+            stateOf(id),
+        )
+        awaitState(viewModel.state, "Idle") { it is ConversionState.Idle }
+    }
+
+    @Test
+    fun `cancelling a queued join cancels that job`() {
+        val id = enqueueQueuedJoin()
+        val viewModel = JoinViewModel(app, Dispatchers.Unconfined)
+        awaitState(viewModel.state, "Joining") { it is JoinState.Joining }
+
+        viewModel.cancel()
+
+        assertEquals(
+            "Cancel must reach WorkManager, not just the screen",
+            WorkInfo.State.CANCELLED,
+            stateOf(id),
+        )
+        awaitState(viewModel.state, "Idle") { it is JoinState.Idle }
+    }
+
+    /**
+     * The negative that bounds both: cancelling must cancel the job the screen is showing, and only
+     * that one.
+     *
+     * Without this, `cancel()` could cancel everything in the queue — `cancelAllWork()` in place of
+     * `cancelWorkById(activeWorkId)` — and both tests above would still pass.
+     */
+    @Test
+    fun `cancelling one conversion leaves another queued job alone`() {
+        val bystander = enqueueQueuedConversion(displayName = "beach.mp4")
+        val id = enqueueQueuedConversion(displayName = "holiday.mp4")
+        val viewModel = ConversionViewModel(app, Dispatchers.Unconfined)
+        val converting = awaitState(viewModel.state, "Converting") { it is ConversionState.Converting }
+        val onScreen = (converting as ConversionState.Converting).input.displayName
+
+        viewModel.cancel()
+
+        // Which of the two the ViewModel reattached to is the query's business, not this test's --
+        // the comparator leaves queued jobs tied deliberately, per Reattachment's ordering notes.
+        // So assert the shape rather than the identity: exactly one is cancelled, and the other is
+        // untouched.
+        val cancelled = listOf(id, bystander).filter { stateOf(it) == WorkInfo.State.CANCELLED }
+        assertEquals(
+            "exactly one job may be cancelled, with $onScreen on screen",
+            1,
+            cancelled.size,
+        )
+    }
+
+    private fun stateOf(id: UUID): WorkInfo.State =
+        requireNotNull(workManager.getWorkInfoById(id).get()) { "no WorkInfo for $id" }.state
+
+    /**
+     * A conversion sitting in the queue, which is where every job starts.
+     *
+     * Built by hand rather than through `ConversionWorker.request` for the reason in the class
+     * KDoc; the display-name tag is included because `reattach()` reads it for the file card, and a
+     * job without one would exercise the `UNKNOWN_INPUT_NAME` fallback instead of this test's
+     * subject.
+     */
+    private fun enqueueQueuedConversion(displayName: String = "holiday.mp4"): UUID {
+        val request = OneTimeWorkRequestBuilder<ConversionWorker>()
+            .addTag(JobTags.displayName(displayName))
+            .setInitialDelay(QUEUE_HOLD_HOURS, TimeUnit.HOURS)
+            .build()
+        workManager.enqueue(request).result.get()
+        return request.id
+    }
+
+    private fun enqueueQueuedJoin(inputCount: Int = 2): UUID {
+        val request = OneTimeWorkRequestBuilder<ConcatWorker>()
+            .addTag(JobTags.inputCount(inputCount))
+            .setInitialDelay(QUEUE_HOLD_HOURS, TimeUnit.HOURS)
+            .build()
+        workManager.enqueue(request).result.get()
+        return request.id
+    }
+
+    private companion object {
+        /** Long enough that `TestScheduler` never releases the job during a test run. */
+        const val QUEUE_HOLD_HOURS = 1L
+    }
+}
@@ -205,6 +205,34 @@ class FileCardTest {
        assertNoRow("Length")
    }

+    /**
+     * A video the app knows a great deal about and cannot name the container of.
+     *
+     * Not an edge case. `InputProbe.container`'s own KDoc says `MediaExtractor` cannot report a
+     * container at all -- it comes from FFprobe -- so any run where FFprobe did not answer produces
+     * exactly this: real codec, real dimensions, real duration, `container = null`.
+     *
+     * **The twin was already tested and this one was not**, which is the argument for adding it.
+     * `FileCard` renders `probe.container?.label ?: "Unknown"` twice, once in the `AUDIO_ONLY`
+     * branch (`ConverterScreen.kt:660`) and once in the `VIDEO` branch (`:668`), and
+     * `an audio-only file nothing else could describe degrades one row at a time` drives only the
+     * first. Same expression, same fallback, one kind covered. That asymmetry is the same one
+     * `CLAUDE.md` records for including `ContainerCapabilities:94`.
+     *
+     * The other rows are asserted alongside so this is not a copy of the audio-only case: there,
+     * everything is unknown at once; here, one field is missing from a probe that is otherwise
+     * complete, and the rest must be unaffected by it.
+     */
+    @Test
+    fun `a video file whose container nothing identified says so and keeps its other rows`() {
+        setFileCard(input(probe = VIDEO_PROBE.copy(container = null)))
+
+        assertRow("Container", "Unknown")
+        assertRow("Video", "${VideoCodec.H264.label} · 1920×1080")
+        assertRow("Audio", AudioCodec.AAC.label)
+        assertRow("Length", "1:30")
+    }
+
    /**
     * The row is one node, not a label node beside a value node. A test matching on `"Container"`
     * alone would pass against either shape.
@@ -0,0 +1,99 @@
+package org.libremediaconverter.convert
+
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.model.AudioCodec
+import org.libremediaconverter.model.AudioPlan
+import org.libremediaconverter.model.Container
+import org.libremediaconverter.model.ConversionRequest
+import org.libremediaconverter.model.CopyPlanner
+import org.libremediaconverter.model.InputProbe
+import org.libremediaconverter.model.OutputSpec
+import org.libremediaconverter.model.VideoCodec
+import org.libremediaconverter.model.VideoPlan
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import java.io.File
+import java.util.concurrent.CancellationException
+
+/**
+ * A job that reached Media3 with a container Media3 cannot mux.
+ *
+ * [Media3Muxers]' own KDoc names the defect this guards: *"the router claimed five containers while
+ * the engine silently wrote MP4 for all of them."* `factoryFor` answers null for fourteen of the
+ * app's containers, and `buildTransformer` turns that null into a failed job rather than letting
+ * `Transformer` fall back to its default muxer.
+ *
+ * The guard had never fired. `Media3Engine$buildTransformer$3` -- the `requireNotNull` message
+ * lambda -- was four lines and four branches at 0%, which is to say the entire repair for a defect
+ * the codebase went to the trouble of writing down was untested. Weakening it would restore that
+ * bug silently, because the wrong output is a *playable file with the wrong container*, not a crash.
+ *
+ * Same harness and same two disciplines as [Media3EngineEmptyCompositionTest]: assert the plan
+ * really is the one the test needs before driving the engine, and rule out
+ * `CancellationException` so an unresumed continuation cannot read as a pass.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class Media3MuxerGuardTest {
+
+    @Test
+    fun `a container Media3 cannot mux fails the job rather than silently writing MP4`() {
+        val context = RuntimeEnvironment.getApplication()
+        val engine = Media3Engine(context)
+        val request = ConversionRequest(
+            spec = OutputSpec(Container.WEBM, VideoCodec.VP9, AudioCodec.OPUS),
+            probe = InputProbe(videoCodec = "h264", audioCodec = "aac", container = Container.MP4),
+        )
+
+        // The premise, asserted rather than assumed -- three separate ways this test could pass
+        // over a path it never entered.
+        val plan = CopyPlanner.plan(request.spec, request.probe)
+        assertEquals("the plan has to still be WebM by the time the engine sees it", Container.WEBM, plan.container)
+        assertNull("...and Media3 really has no muxer for it", Media3Muxers.factoryFor(plan.container))
+        // Not the empty-composition refusal, which fires earlier and is a different test's subject.
+        assertNotEquals(VideoPlan.Drop, plan.video)
+        assertNotEquals(AudioPlan.Drop, plan.audio)
+
+        val failure = try {
+            runCatching {
+                runBlocking {
+                    withTimeout(TIMEOUT_MS) {
+                        engine.transcode(Uri.parse("file:///dev/null"), File(context.cacheDir, "guard.webm"), request) {
+                        }
+                    }
+                }
+            }.exceptionOrNull()
+        } finally {
+            engine.close()
+        }
+
+        assertFalse(
+            "the continuation was never resumed -- the refusal escaped instead of failing the job: $failure",
+            failure is CancellationException,
+        )
+        // Type *and* message, and the message half is the load-bearing one. Replacing the
+        // requireNotNull with a fallback factory does not make the export succeed here: it lets it
+        // run on and fail some other way, which a bare type assertion would happily accept.
+        assertTrue("expected the muxer guard to refuse the job, got $failure", failure is IllegalArgumentException)
+        assertTrue(
+            "the refusal has to name the container it could not mux, got: ${failure?.message}",
+            failure?.message.orEmpty().contains("cannot mux") &&
+                failure?.message.orEmpty().contains(Container.WEBM.name),
+        )
+    }
+
+    private companion object {
+        /** Nothing is decoded or muxed on this path -- the guard refuses before any of that. */
+        const val TIMEOUT_MS = 10_000L
+    }
+}
@@ -0,0 +1,166 @@
+package org.libremediaconverter.convert
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.libremediaconverter.model.Container
+import org.libremediaconverter.model.InputKind
+import org.libremediaconverter.model.InputProbe
+
+/**
+ * Which of the two probes wins, when they disagree.
+ *
+ * [MediaProbe.probe] runs `MediaExtractor` and FFprobe independently and then merges the two, and
+ * every rule in that merge is a decision. None of them had a test, for a reason that is structural
+ * rather than an oversight: `RemuxTest` drives the whole thing on a device against committed
+ * fixtures, but only ever with **one probe answering and the other agreeing or also failing**.
+ * Nothing on any source set can arrange for a real extractor and a real FFprobe to disagree, so
+ * every elvis in the merge was taken in one direction and never the other.
+ *
+ * Cutting `merge` out of `probe` is what makes the question askable. Both halves of its signature
+ * had to become `internal` for that -- `Extracted` already was, with a KDoc giving this exact
+ * reason; `FFprobeInfo` simply never got the same treatment.
+ */
+class MediaProbeMergeTest {
+
+    /**
+     * The rule with the loudest failure mode, and `isImageFormat`'s own KDoc names it: a false
+     * positive here "makes the source-info card describe a video as an image". So the image verdict
+     * has to beat a real video codec from the extractor, and the ordering that makes it do so is
+     * the first arm of `classify` rather than anything a reader would infer from the fields.
+     */
+    @Test
+    fun `an image verdict from FFprobe beats a video codec from the extractor`() {
+        val merged = MediaProbe.merge(
+            extracted = extracted(video = "h264"),
+            info = info(video = "mjpeg", isImage = true),
+        )
+
+        assertEquals(InputKind.IMAGE, merged.kind)
+    }
+
+    @Test
+    fun `the extractor wins on codecs, because it is the view the router will act on`() {
+        val merged = MediaProbe.merge(
+            extracted = extracted(video = "h264", audio = "aac"),
+            info = info(video = "hevc", audio = "mp3"),
+        )
+
+        assertEquals("h264", merged.videoCodec)
+        assertEquals("aac", merged.audioCodec)
+    }
+
+    @Test
+    fun `FFprobe answers for a file the extractor could not open`() {
+        val merged = MediaProbe.merge(extracted = null, info = info(video = "vp9", audio = "opus"))
+
+        assertEquals("vp9", merged.videoCodec)
+        assertEquals("opus", merged.audioCodec)
+        assertEquals(InputKind.VIDEO, merged.kind)
+    }
+
+    @Test
+    fun `the extractor answers for a file FFprobe could not read`() {
+        val merged = MediaProbe.merge(extracted = extracted(video = "h264", audio = "aac"), info = null)
+
+        assertEquals("h264", merged.videoCodec)
+        assertEquals("aac", merged.audioCodec)
+        assertNull("only FFprobe can name the container, so it stays unknown here", merged.container)
+    }
+
+    /**
+     * The larger of the two, not the first non-zero.
+     *
+     * Either probe can report zero for a file the other times correctly, and a zero duration makes
+     * the FFmpeg progress percentage undefined -- `FFmpegEngine` divides by it. Both orderings are
+     * asserted because "take the extractor's" and "take the larger" agree in one direction and not
+     * the other, and only one of them is the rule.
+     */
+    @Test
+    fun `duration is the longer of the two readings, whichever probe supplied it`() {
+        assertEquals(
+            5_000L,
+            MediaProbe.merge(extracted(duration = 0L), info(duration = 5_000L)).durationMs,
+        )
+        assertEquals(
+            5_000L,
+            MediaProbe.merge(extracted(duration = 5_000L), info(duration = 0L)).durationMs,
+        )
+    }
+
+    @Test
+    fun `dimensions come from the extractor, and from FFprobe only when it has none`() {
+        assertEquals(1920, MediaProbe.merge(extracted(width = 1920), info(width = 640)).width)
+        assertEquals(640, MediaProbe.merge(extracted = null, info = info(width = 640)).width)
+        assertEquals(0, MediaProbe.merge(extracted(width = 0), info(width = 0)).width)
+    }
+
+    @Test
+    fun `the container comes from FFprobe, which is the only probe that can name one`() {
+        val merged = MediaProbe.merge(extracted(video = "h264"), info(container = Container.MKV))
+
+        assertEquals(Container.MKV, merged.container)
+    }
+
+    @Test
+    fun `a file with audio and no video is audio-only, not unparseable`() {
+        val merged = MediaProbe.merge(extracted(video = null, audio = "mp3"), info = null)
+
+        assertEquals(InputKind.AUDIO_ONLY, merged.kind)
+        assertFalse(merged.hasVideo)
+    }
+
+    @Test
+    fun `a file neither probe could open is the one unreadable answer`() {
+        val merged = MediaProbe.merge(extracted = null, info = null)
+
+        assertEquals(MediaProbe.UNREADABLE, merged)
+        assertEquals(InputProbe.UNPARSEABLE, merged.videoCodec)
+    }
+
+    /**
+     * The arm the ticket was filed for: parsed, and carrying no stream either probe recognised.
+     *
+     * Distinct from "neither probe could open it" -- here the extractor opened the file happily and
+     * found nothing convertible, which is what a container holding only subtitles looks like. It
+     * has to reach the same [MediaProbe.UNREADABLE] answer, because the router keys off that and
+     * there is nothing here for Media3 to do either way.
+     *
+     * Its input was already being built elsewhere in the suite -- `MediaProbeTrackWalkTest` calls
+     * `extractedFrom(emptyList())` and gets exactly this -- and had simply never been handed to the
+     * merge.
+     */
+    @Test
+    fun `a file that parsed but carries no recognised stream is unreadable too`() {
+        val merged = MediaProbe.merge(extracted = MediaProbe.extractedFrom(emptyList()), info = null)
+
+        assertEquals(InputKind.UNPARSEABLE, merged.kind)
+        assertEquals(MediaProbe.UNREADABLE, merged)
+    }
+
+    @Test
+    fun `hasVideo follows the codec that survived the merge, not either probe alone`() {
+        assertTrue(MediaProbe.merge(extracted(video = null), info(video = "vp9")).hasVideo)
+        assertFalse(MediaProbe.merge(extracted(video = null, audio = "aac"), info(video = null)).hasVideo)
+    }
+
+    private fun extracted(
+        video: String? = "h264",
+        audio: String? = "aac",
+        duration: Long = 1_000L,
+        width: Int = 1280,
+        height: Int = 720,
+    ) = MediaProbe.Extracted(video, audio, duration, width, height)
+
+    private fun info(
+        container: Container? = null,
+        video: String? = "h264",
+        audio: String? = "aac",
+        duration: Long = 1_000L,
+        width: Int = 1280,
+        height: Int = 720,
+        isImage: Boolean = false,
+    ) = MediaProbe.FFprobeInfo(container, video, audio, duration, width, height, isImage)
+}
@@ -0,0 +1,213 @@
+package org.libremediaconverter.convert
+
+import android.app.Application
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.work.Data
+import androidx.work.ListenableWorker
+import androidx.work.testing.TestListenableWorkerBuilder
+import androidx.work.workDataOf
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.runBlocking
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.join.JoinState
+import org.libremediaconverter.join.JoinViewModel
+import org.libremediaconverter.model.ConversionRequest
+import org.libremediaconverter.model.EnginePreference
+import org.libremediaconverter.model.InputProbe
+import org.libremediaconverter.model.OutputFormat
+import org.libremediaconverter.work.ConcatWorker
+import org.libremediaconverter.work.ConversionWorker
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import java.io.File
+import java.util.UUID
+
+/**
+ * A failure that says nothing still has to say something.
+ *
+ * Three sites, all `ci == 0` before this file, and all the same rule:
+ *
+ * ```
+ * work/ConversionWorker.kt:316     cause.message ?: GENERIC_FAILURE_MESSAGE
+ * convert/ConversionViewModel.kt:631   e.message ?: SAVE_FAILED_MESSAGE
+ * join/JoinViewModel.kt:416           e.message ?: SAVE_FAILED_MESSAGE
+ * ```
+ *
+ * Every existing test throws *with* a message, so the right-hand side had never been evaluated
+ * anywhere in the suite. A `Throwable` carrying none is not exotic — `RuntimeException()`,
+ * `IOException()` and most platform exceptions raised without an argument all have a null message.
+ *
+ * ## Held in one class, against the ticket's suggestion
+ *
+ * #193 proposed putting each case beside the behaviour it neighbours. They are together instead,
+ * because they are one rule at three layers and because the trap below has to be explained once
+ * rather than three times. `FailedSaveRetryTest` sets the precedent for both ViewModels in one
+ * file; this extends it by one worker.
+ *
+ * ## The trap, which is why the worker case asserts what it does
+ *
+ * `ConversionStateMappingTest`'s *"a failure with nothing said still says something"* looks like it
+ * already covers the worker site. It does not: it drives the **read** side, `map(FAILED, Data.EMPTY)`,
+ * and that side has a fallback of its own (`ConversionViewModel.kt:147-149`):
+ *
+ * ```kotlin
+ * update.outputData.getString(ConversionWorker.KEY_ERROR)
+ *     ?.takeIf { it.isNotBlank() }
+ *     ?: ConversionWorker.GENERIC_FAILURE_MESSAGE
+ * ```
+ *
+ * So mutating the worker's fallback to `.orEmpty()` writes `KEY_ERROR to ""`, and the ViewModel
+ * turns that straight back into the same constant. **A test asserting on the resulting `Failed`
+ * state stays green under the mutation**, which is most likely why the write-side fallback survived
+ * three waves of test work. The worker case therefore reads `KEY_ERROR` off the worker's own
+ * `Result`, before anything downstream can repair it.
+ *
+ * The two save cases have no such second line: both write `_state.value` directly, so the state is
+ * the right thing to assert there.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class MessagelessFailureTest {
+
+    private lateinit var app: Application
+    private lateinit var publisher: RecordingPublisher
+    private lateinit var staged: File
+
+    @Before
+    fun setUp() {
+        app = RuntimeEnvironment.getApplication()
+        publisher = RecordingPublisher(app)
+        ConversionDependencies.publisher = { publisher }
+        ConversionDependencies.probe = { _, _ -> InputProbe() }
+        staged = publisher.createStagingFile("holiday.mp4").apply { writeBytes(ByteArray(4096)) }
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    /**
+     * The engine gives up without saying why, which is what a native crash looks like from here.
+     *
+     * Asserted on the worker's own output `Data` rather than on a screen — see the class KDoc.
+     */
+    @Test
+    fun `a conversion that fails without a message still reports one`() {
+        installTestWorkManager(app, Data.EMPTY)
+        ConversionDependencies.software = { MessagelessTranscoder }
+
+        val result = runBlocking { failingWorker().doWork() }
+
+        assertTrue("the job must fail rather than retry, got $result", result is ListenableWorker.Result.Failure)
+        assertEquals(
+            "a failure with no message must still put something on screen",
+            ConversionWorker.GENERIC_FAILURE_MESSAGE,
+            (result as ListenableWorker.Result.Failure).outputData.getString(ConversionWorker.KEY_ERROR),
+        )
+    }
+
+    @Test
+    fun `a save that fails without a message still reports one`() {
+        installTestWorkManager(app, conversionOutput())
+        val viewModel = ConversionViewModel(app, Dispatchers.Unconfined)
+        viewModel.onInputPicked(Uri.parse("content://test/holiday.mkv"))
+        awaitState(viewModel.state, "Ready") { it is ConversionState.Ready }
+        viewModel.convert()
+        awaitState(viewModel.state, "Converted") { it is ConversionState.Converted }
+
+        publisher.publishFailure = RuntimeException()
+        viewModel.save(DESTINATION)
+
+        val failed = awaitState(viewModel.state, "Failed") { it is ConversionState.Failed } as ConversionState.Failed
+        assertEquals(SAVE_FAILED_MESSAGE, failed.message)
+        // The handle travels even on the wordless path. Without this, a fallback that also dropped
+        // `pending` would pass -- and the file would be unreachable from the screen that just said
+        // the save failed.
+        assertNotNull("a wordless failure must still offer the file again", failed.retry)
+    }
+
+    @Test
+    fun `a join save that fails without a message still reports one`() {
+        installTestWorkManager(app, joinOutput())
+        val viewModel = JoinViewModel(app, Dispatchers.Unconfined)
+        viewModel.onInputsPicked(listOf(Uri.parse("content://test/a.mp4"), Uri.parse("content://test/b.mp4")))
+        awaitState(viewModel.state, "Ready") { it is JoinState.Ready }
+        viewModel.join()
+        awaitState(viewModel.state, "Joined") { it is JoinState.Joined }
+
+        publisher.publishFailure = RuntimeException()
+        viewModel.save(DESTINATION)
+
+        val failed = awaitState(viewModel.state, "Failed") { it is JoinState.Failed } as JoinState.Failed
+        assertEquals(SAVE_FAILED_MESSAGE, failed.message)
+        assertNotNull("a wordless failure must still offer the file again", failed.retry)
+    }
+
+    /**
+     * `FORCE_SOFTWARE` so the failure comes straight out of `runFFmpeg`.
+     *
+     * `AUTO` would enter `runMedia3OrFallBack`, whose catch runs the job a second time in software
+     * — the same exception would arrive, but through a path this test is not about and which
+     * `HardwareFallbackTest` already owns.
+     */
+    private fun failingWorker(): ConversionWorker {
+        val spec = OutputFormat.MP4_H265.spec
+        return TestListenableWorkerBuilder<ConversionWorker>(
+            context = app,
+            inputData = workDataOf(
+                ConversionWorker.KEY_INPUT_URI to "file:///tmp/holiday.mp4",
+                ConversionWorker.KEY_DISPLAY_NAME to "holiday.mp4",
+                ConversionWorker.KEY_CONTAINER to spec.container.name,
+                ConversionWorker.KEY_VIDEO_CODEC to spec.videoCodec.name,
+                ConversionWorker.KEY_AUDIO_CODEC to spec.audioCodec.name,
+                ConversionWorker.KEY_ENGINE_PREFERENCE to EnginePreference.FORCE_SOFTWARE.name,
+            ),
+            runAttemptCount = 0,
+        ).setId(JOB_ID).build()
+    }
+
+    private fun conversionOutput() = workDataOf(
+        ConversionWorker.KEY_OUTPUT_PATH to staged.absolutePath,
+        ConversionWorker.KEY_SUGGESTED_NAME to SUGGESTED_NAME,
+        ConversionWorker.KEY_MIME_TYPE to JOB_MIME_TYPE,
+    )
+
+    private fun joinOutput() = workDataOf(
+        ConcatWorker.KEY_OUTPUT_PATH to staged.absolutePath,
+        ConcatWorker.KEY_SUGGESTED_NAME to SUGGESTED_NAME,
+        ConcatWorker.KEY_MIME_TYPE to JOB_MIME_TYPE,
+    )
+
+    private companion object {
+        val DESTINATION: Uri = Uri.parse("content://test/destination.mp4")
+        val JOB_ID: UUID = UUID.fromString("00000000-0000-4000-8000-00000000019a")
+        const val SUGGESTED_NAME = "holiday.mp4"
+        const val JOB_MIME_TYPE = "video/mp4"
+    }
+}
+
+/**
+ * An engine that gives up without saying why.
+ *
+ * `RuntimeException()` rather than a subclass with a blank message: `Throwable.message` is *null*
+ * here, which is the case the elvis exists for. A blank-but-present message takes the left-hand
+ * side and is a different path — `ConversionStateMappingTest` covers that one, on the read side.
+ */
+@UnstableApi
+private object MessagelessTranscoder : SoftwareTranscoder {
+    override suspend fun run(
+        request: ConversionRequest,
+        inputPath: String,
+        output: File,
+        durationMs: Long,
+        onProgress: (Int) -> Unit,
+    ): Unit = throw RuntimeException()
+}
@@ -232,6 +232,12 @@ class OutputPublisherPublishTest {
            RowShape.NO_SIZE_COLUMN to "a cursor with no SIZE column",
            RowShape.NULL_SIZE to "a cursor whose SIZE cell is null",
            RowShape.NO_ROWS to "a cursor holding no rows",
+            // The third case the KDoc names -- "a resolver call that throws" -- and the one the
+            // list was missing. It reaches `?: false` through `runCatching` rather than through a
+            // cursor answer, so it is the only one of the four that proves the catch is load
+            // bearing: a provider that revokes its grant between the picker and the write must not
+            // have its document deleted on the way out.
+            RowShape.QUERY_THROWS to "a provider that throws out of query",
        ).forEach { (shape, description) ->
            FakeSafProvider.deleteRequests.clear()
            FakeSafProvider.backingFile(documentUri).writeBytes(ByteArray(0))
@@ -0,0 +1,241 @@
+package org.libremediaconverter.convert
+
+import android.app.Application
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.work.Data
+import androidx.work.workDataOf
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.join.JoinState
+import org.libremediaconverter.join.JoinViewModel
+import org.libremediaconverter.join.joinActions
+import org.libremediaconverter.model.AudioCodec
+import org.libremediaconverter.model.Container
+import org.libremediaconverter.model.EnginePreference
+import org.libremediaconverter.model.OutputFormat
+import org.libremediaconverter.model.QualityTier
+import org.libremediaconverter.model.VideoCodec
+import org.libremediaconverter.work.ConcatWorker
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+
+/**
+ * That each affordance is wired to the ViewModel method it is named after.
+ *
+ * ## What this covers that no other test can
+ *
+ * `ConverterScreenContentTest`, `ConverterStateAffordancesTest` and `JoinScreenContentTest` all
+ * drive the **stateless** content composables, which build their own `ConverterActions`. So the
+ * wiring — the list of `viewModel::` references the stateful outer hands down — was seen by nothing
+ * in the suite.
+ *
+ * ## The hazard is narrower than "seventeen bindings", and this says so
+ *
+ * #156 was filed claiming a transposition of any two bindings would survive the suite. That is not
+ * true, and it was worth checking rather than testing on the assumption:
+ *
+ * | swap | result |
+ * |---|---|
+ * | `onVideoCodec` ↔ `onAudioCodec` | **rejected by the compiler** |
+ * | `onCancel` ↔ `onReset` | **compiles** |
+ *
+ * Every typed binding — container, both codecs, preset, suggestion, quality, engine preference —
+ * takes a distinct parameter type, so the compiler is already the test. Writing assertions for
+ * those would be theatre.
+ *
+ * **The `() -> Unit` bindings are the real gap**, because they are interchangeable to the compiler:
+ * two on the converter screen (`onCancel`, `onReset`) and three on the join screen (`onJoin`,
+ * `onCancel`, `onReset`). A Cancel that discards the finished file, or a Join that cancels, is a
+ * one-character mistake that ships.
+ *
+ * ## How they are told apart
+ *
+ * By effect, not by a recording double. `reset()` sets the state to `Idle`; `cancel()` with no
+ * active job leaves it alone (`ConversionViewModel.cancel` is `activeWorkId?.let(...)`, and
+ * `SettingsEditsTest` pins that). Driving each from a non-`Idle` state is therefore enough to say
+ * which one ran.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class ScreenWiringTest {
+
+    private lateinit var app: Application
+
+    @Before
+    fun setUp() {
+        app = RuntimeEnvironment.getApplication()
+        ConversionDependencies.publisher = { RecordingPublisher(app) }
+        ConversionDependencies.probe = { _, _ -> org.libremediaconverter.model.InputProbe() }
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    // --- the converter screen ----------------------------------------------
+
+    @Test
+    fun `Start over resets, and Cancel does not`() {
+        // The transposition that compiles. If onReset were bound to cancel, this stays on Ready.
+        installTestWorkManager(app, Data.EMPTY)
+        val pick = ParkedPickDispatcher()
+        val viewModel = ConversionViewModel(app, pickDispatcher = pick)
+        val actions = converterActions(viewModel, onPickInput = {}, onConvert = {}, onSave = {})
+        viewModel.onInputPicked(INPUT_URI)
+        pick.runAll()
+        assertNotEquals(
+            "the fixture needs a non-Idle state or neither action is observable",
+            ConversionState.Idle,
+            viewModel.state.value,
+        )
+
+        actions.onReset()
+
+        assertEquals(ConversionState.Idle, viewModel.state.value)
+    }
+
+    @Test
+    fun `Cancel leaves the picked file on screen`() {
+        // The other half. Without it, a wiring with BOTH actions bound to reset passes the test
+        // above -- and that is exactly what a copy-paste of the wrong line produces.
+        installTestWorkManager(app, Data.EMPTY)
+        val pick = ParkedPickDispatcher()
+        val viewModel = ConversionViewModel(app, pickDispatcher = pick)
+        val actions = converterActions(viewModel, onPickInput = {}, onConvert = {}, onSave = {})
+        viewModel.onInputPicked(INPUT_URI)
+        pick.runAll()
+        val before = viewModel.state.value
+
+        actions.onCancel()
+
+        assertEquals(
+            "Cancel must not throw away the pick the way Start over does",
+            before,
+            viewModel.state.value,
+        )
+    }
+
+    @Test
+    fun `each settings affordance reaches the setting it is named after`() {
+        // The typed bindings. The compiler already rejects a transposition among these, so this is
+        // not that assertion -- it is the cheaper one that each is bound to *something*, and that a
+        // binding dropped to `{}` during an edit would be caught.
+        installTestWorkManager(app, Data.EMPTY)
+        val pick = ParkedPickDispatcher()
+        val viewModel = ConversionViewModel(app, pickDispatcher = pick)
+        val actions = converterActions(viewModel, onPickInput = {}, onConvert = {}, onSave = {})
+
+        actions.onPreset(OutputFormat.WEBM_VP9)
+        assertEquals(OutputFormat.WEBM_VP9.spec, viewModel.settings.value.spec)
+
+        actions.onContainer(Container.MKV)
+        assertEquals(Container.MKV, viewModel.settings.value.spec.container)
+
+        actions.onVideoCodec(VideoCodec.H264)
+        assertEquals(VideoCodec.H264, viewModel.settings.value.spec.videoCodec)
+
+        actions.onAudioCodec(AudioCodec.FLAC)
+        assertEquals(AudioCodec.FLAC, viewModel.settings.value.spec.audioCodec)
+
+        actions.onQuality(QualityTier.BEST)
+        assertEquals(QualityTier.BEST, viewModel.settings.value.quality)
+
+        actions.onEnginePreference(EnginePreference.FORCE_SOFTWARE)
+        assertEquals(EnginePreference.FORCE_SOFTWARE, viewModel.settings.value.enginePreference)
+
+        actions.onSuggestion(OutputFormat.MP4_H264.spec)
+        assertEquals(OutputFormat.MP4_H264.spec, viewModel.settings.value.spec)
+    }
+
+    @Test
+    fun `the launcher-backed actions are the ones the screen supplies`() {
+        // Not wired to the ViewModel at all, deliberately -- they need an ActivityResultLauncher.
+        // Asserted so that a later edit routing one of them at the ViewModel is noticed.
+        installTestWorkManager(app, Data.EMPTY)
+        val pick = ParkedPickDispatcher()
+        val viewModel = ConversionViewModel(app, pickDispatcher = pick)
+        val called = mutableListOf<String>()
+        val actions = converterActions(
+            viewModel,
+            onPickInput = { called += "pick" },
+            onConvert = { called += "convert" },
+            onSave = { called += "save:$it" },
+        )
+
+        actions.onPickInput()
+        actions.onConvert()
+        actions.onSave("holiday.mp4")
+
+        assertEquals(listOf("pick", "convert", "save:holiday.mp4"), called)
+    }
+
+    // --- the join screen, where three are interchangeable -------------------
+
+    @Test
+    fun `Start over resets the join, and Cancel does not`() {
+        installTestWorkManager(app, workDataOf(ConcatWorker.KEY_OUTPUT_PATH to "/dev/null"))
+        val pick = ParkedPickDispatcher()
+        val viewModel = JoinViewModel(app, pickDispatcher = pick)
+        val actions = joinActions(viewModel, onPickInputs = {}, onSave = {})
+        viewModel.onInputsPicked(TWO_INPUTS)
+        pick.runAll()
+        assertTrue(
+            "the fixture needs a non-Idle state: ${viewModel.state.value}",
+            viewModel.state.value !is JoinState.Idle,
+        )
+
+        actions.onReset()
+
+        assertEquals(JoinState.Idle, viewModel.state.value)
+    }
+
+    @Test
+    fun `Cancel leaves the picked files on screen`() {
+        installTestWorkManager(app, workDataOf(ConcatWorker.KEY_OUTPUT_PATH to "/dev/null"))
+        val pick = ParkedPickDispatcher()
+        val viewModel = JoinViewModel(app, pickDispatcher = pick)
+        val actions = joinActions(viewModel, onPickInputs = {}, onSave = {})
+        viewModel.onInputsPicked(TWO_INPUTS)
+        pick.runAll()
+        val before = viewModel.state.value
+
+        actions.onCancel()
+
+        assertEquals(before, viewModel.state.value)
+    }
+
+    @Test
+    fun `Join starts the job rather than cancelling or resetting it`() {
+        // The third of the join screen's interchangeable trio, and the one whose transposition is
+        // worst: a Join button bound to cancel does nothing at all, which reads as a dead button.
+        installTestWorkManager(app, workDataOf(ConcatWorker.KEY_OUTPUT_PATH to "/dev/null"))
+        val pick = ParkedPickDispatcher()
+        val viewModel = JoinViewModel(app, pickDispatcher = pick)
+        val actions = joinActions(viewModel, onPickInputs = {}, onSave = {})
+        viewModel.onInputsPicked(TWO_INPUTS)
+        pick.runAll()
+
+        actions.onJoin()
+
+        assertTrue(
+            "Join must leave Ready for a running state, not sit still and not go Idle: " +
+                "${viewModel.state.value}",
+            viewModel.state.value is JoinState.Joining || viewModel.state.value is JoinState.Joined,
+        )
+    }
+
+    private companion object {
+        val INPUT_URI: Uri = Uri.parse("content://test/holiday.mov")
+        val TWO_INPUTS = listOf(
+            Uri.parse("content://test/a.mp4"),
+            Uri.parse("content://test/b.mp4"),
+        )
+    }
+}
@@ -0,0 +1,197 @@
+package org.libremediaconverter.convert
+
+import android.app.Application
+import androidx.media3.common.util.UnstableApi
+import androidx.work.Data
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertNull
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.model.AudioCodec
+import org.libremediaconverter.model.Container
+import org.libremediaconverter.model.EnginePreference
+import org.libremediaconverter.model.OutputFormat
+import org.libremediaconverter.model.QualityTier
+import org.libremediaconverter.model.VideoCodec
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+
+/**
+ * The seven one-line edits the settings sheet makes, and what each one leaves alone.
+ *
+ * ## Why these needed a file of their own
+ *
+ * `setPreset` was covered. The six beside it — `setContainer`, `setVideoCodec`, `setAudioCodec`,
+ * `applySuggestion`, `setQuality`, `setEnginePreference` — and `cancel()` had **no coverage at
+ * all**, which is the tell: they are reachable from the JVM suite by exactly the route `setPreset`
+ * already takes, and nothing had asked.
+ *
+ * ## What is actually being asserted
+ *
+ * Not "the setter sets something". Each of these copies into a nested `OutputSpec`, so the failure
+ * worth catching is **a setter that writes the right value into the wrong field, or that rebuilds
+ * the spec and silently discards the other two**. So every test here asserts the field it changed
+ * *and* that the rest of the spec survived — a `setContainer` implemented as
+ * `it.copy(spec = OutputFormat.MP4_H265.spec.copy(container = container))` would pass a test that
+ * only checked the container.
+ *
+ * `ConverterScreenContentTest` cannot cover this: it builds `ConverterActions` itself and never
+ * touches the ViewModel. That the *screen* calls these is #156's, and neither implies the other.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class SettingsEditsTest {
+
+    private lateinit var app: Application
+    private lateinit var viewModel: ConversionViewModel
+
+    @Before
+    fun setUp() {
+        app = RuntimeEnvironment.getApplication()
+        installTestWorkManager(app, Data.EMPTY)
+        viewModel = ConversionViewModel(app)
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    @Test
+    fun `choosing a preset replaces the whole spec`() {
+        viewModel.setPreset(OutputFormat.WEBM_VP9)
+
+        assertEquals(OutputFormat.WEBM_VP9.spec, viewModel.settings.value.spec)
+    }
+
+    @Test
+    fun `changing the container leaves both codecs alone`() {
+        // Moved off the default spec first, and that is load-bearing rather than tidiness. The
+        // default IS `OutputFormat.MP4_H265.spec`, so a `setContainer` that rebuilt the spec from
+        // that preset instead of from the current one produced an identical answer and the
+        // mutation went green. Editing the codecs away from the default first is what makes
+        // "the other two survived" an assertion rather than a coincidence.
+        viewModel.setPreset(OutputFormat.WEBM_VP9)
+        val before = viewModel.settings.value.spec
+
+        viewModel.setContainer(Container.MKV)
+
+        val after = viewModel.settings.value.spec
+        assertEquals(Container.MKV, after.container)
+        assertEquals("the video codec is not the container's to change", before.videoCodec, after.videoCodec)
+        assertEquals("the audio codec is not the container's to change", before.audioCodec, after.audioCodec)
+    }
+
+    @Test
+    fun `changing the video codec leaves the container and the audio codec alone`() {
+        // The transposition this guards against is real: setVideoCodec and setAudioCodec take
+        // different enum types, but a copy(...) naming the wrong field compiles wherever the types
+        // happen to line up, and the picker would silently set the other one.
+        val before = viewModel.settings.value.spec
+
+        viewModel.setVideoCodec(VideoCodec.VP9)
+
+        val after = viewModel.settings.value.spec
+        assertEquals(VideoCodec.VP9, after.videoCodec)
+        assertEquals(before.container, after.container)
+        assertEquals(before.audioCodec, after.audioCodec)
+    }
+
+    @Test
+    fun `changing the audio codec leaves the container and the video codec alone`() {
+        val before = viewModel.settings.value.spec
+
+        viewModel.setAudioCodec(AudioCodec.OPUS)
+
+        val after = viewModel.settings.value.spec
+        assertEquals(AudioCodec.OPUS, after.audioCodec)
+        assertEquals(before.container, after.container)
+        assertEquals(before.videoCodec, after.videoCodec)
+    }
+
+    @Test
+    fun `applying a suggestion replaces the spec without disturbing quality or engine`() {
+        // A suggestion comes from ContainerCapabilities when the current spec is invalid, so it is
+        // a whole spec by construction. What it must not do is reset the two settings beside it.
+        viewModel.setQuality(QualityTier.BEST)
+        viewModel.setEnginePreference(EnginePreference.FORCE_SOFTWARE)
+
+        viewModel.applySuggestion(OutputFormat.MKV_H264.spec)
+
+        val settings = viewModel.settings.value
+        assertEquals(OutputFormat.MKV_H264.spec, settings.spec)
+        assertEquals(QualityTier.BEST, settings.quality)
+        assertEquals(EnginePreference.FORCE_SOFTWARE, settings.enginePreference)
+    }
+
+    @Test
+    fun `changing the quality leaves the spec and the engine preference alone`() {
+        // Both neighbours are moved off their defaults first. Asserting against AUTO -- which is
+        // what `ConversionSettings` starts with -- let a `setQuality` that also reset the engine
+        // preference to AUTO pass, because the reset and the survival looked identical.
+        viewModel.setPreset(OutputFormat.WEBM_VP9)
+        viewModel.setEnginePreference(EnginePreference.FORCE_SOFTWARE)
+        val before = viewModel.settings.value.spec
+
+        viewModel.setQuality(QualityTier.BEST)
+
+        val settings = viewModel.settings.value
+        assertEquals(QualityTier.BEST, settings.quality)
+        assertEquals(before, settings.spec)
+        assertEquals(
+            "quality is not the engine preference's to change",
+            EnginePreference.FORCE_SOFTWARE,
+            settings.enginePreference,
+        )
+    }
+
+    @Test
+    fun `changing the engine preference leaves the spec and the quality alone`() {
+        // Off the defaults for the same reason as the test above: QualityTier.FAST is the starting
+        // value, so asserting it here would have been satisfied by a reset as readily as by a
+        // survival.
+        viewModel.setPreset(OutputFormat.WEBM_VP9)
+        viewModel.setQuality(QualityTier.BEST)
+        val before = viewModel.settings.value.spec
+
+        viewModel.setEnginePreference(EnginePreference.FORCE_SOFTWARE)
+
+        val settings = viewModel.settings.value
+        assertEquals(EnginePreference.FORCE_SOFTWARE, settings.enginePreference)
+        assertEquals(before, settings.spec)
+        assertEquals(
+            "the engine preference is not the quality's to change",
+            QualityTier.BEST,
+            settings.quality,
+        )
+    }
+
+    @Test
+    fun `editing past every preset leaves no matching preset`() {
+        // `matchingPreset` is what the settings sheet reads to decide whether to show a preset as
+        // selected or to say "Custom". Editing one field of a preset must drop it out of the list
+        // rather than leaving the old one highlighted.
+        viewModel.setPreset(OutputFormat.MP4_H265)
+        assertEquals(OutputFormat.MP4_H265, viewModel.settings.value.matchingPreset)
+
+        viewModel.setAudioCodec(AudioCodec.FLAC)
+
+        assertNull(
+            "an edited spec is no longer any preset, and the sheet says Custom",
+            viewModel.settings.value.matchingPreset,
+        )
+        assertNotEquals(OutputFormat.MP4_H265.spec, viewModel.settings.value.spec)
+    }
+
+    @Test
+    fun `cancelling with no active job does nothing rather than throwing`() {
+        // `activeWorkId?.let(...)` -- the null side. A user can reach Cancel through a state that
+        // has already finished, and taking the app down for it would be worse than doing nothing.
+        viewModel.cancel()
+
+        assertEquals(ConversionState.Idle, viewModel.state.value)
+    }
+}
@@ -0,0 +1,70 @@
+package org.libremediaconverter.convert
+
+import android.net.Uri
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.model.ConcatPlanner
+import org.libremediaconverter.model.ConcatStrategy
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+
+/**
+ * A clip in a join that nothing could read, from the probe all the way to the strategy.
+ *
+ * Both halves of this are covered already, and separately: `MediaProbeTrackWalkTest` pins what
+ * `concatInputFrom` makes of a track list, and `ConcatPlannerTest`'s
+ * `an unknown codec is not treated as a match` pins what the planner does with a hand-built
+ * `ConcatInput(video = null)`. **Nothing spanned the two**, and the span is the load-bearing part:
+ * the planner's safety rests on the probe really producing that shape, and the hand-built fixture
+ * would go on passing if it stopped.
+ *
+ * Measured rather than asserted: mutating `concatInputFrom`'s initial `video` to a non-null
+ * placeholder leaves `ConcatPlannerTest` green and turns this red.
+ *
+ * ## The asymmetry this protects
+ *
+ * `ConcatPlanner` guards its video check against a null codec (`ConcatStrategy.kt:51`) and its
+ * audio check not at all (`:54`). **That is correct, not an oversight.** `MediaProbe.shortName`
+ * returns a non-null `String`, so in `concatInputFrom` a null `audioCodec` means the track is
+ * *absent* — and two clips with no audio genuinely do match. A null `videoCodec` carries both
+ * meanings, absent or unreadable, which is why only that one is guarded.
+ *
+ * So the audio check is safe *because* the video guard fires first on a clip nothing could read.
+ * Nothing wrote that coupling down and nothing held it.
+ *
+ * ## What this deliberately does not cover
+ *
+ * `probeForConcat`'s `catch` arm (`MediaProbe.kt:300-302`). It is **not reachable on the JVM**:
+ * Robolectric's `MediaExtractor` never throws from `setDataSource`, measured across an
+ * unregistered `content://` authority, a missing `file://`, a file of garbage bytes and an `http://`
+ * URL — all four returned normally with `trackCount = 0`. So the failure arrives here as an empty
+ * track list rather than as an exception, which reaches the same `ConcatInput(null, null, 0, 0, 0)`
+ * by the other road. The catch stays device-only, and this file does not pretend otherwise.
+ */
+@RunWith(RobolectricTestRunner::class)
+class UnreadableJoinInputTest {
+
+    @Test
+    fun `a clip nothing could read probes as unknown, and an unknown clip is re-encoded`() {
+        val unreadable = MediaProbe.probeForConcat(RuntimeEnvironment.getApplication(), UNREADABLE)
+
+        assertNull("an unreadable clip proves nothing about its video codec", unreadable.videoCodec)
+        assertNull("nor about its audio codec", unreadable.audioCodec)
+        assertEquals("nor about its dimensions", 0, unreadable.width)
+        assertEquals(0, unreadable.height)
+        assertEquals(0, unreadable.frameRate)
+
+        assertEquals(
+            "a clip nothing could read is not evidence of a match with anything",
+            ConcatStrategy.REENCODE,
+            ConcatPlanner.plan(listOf(unreadable, unreadable)),
+        )
+    }
+
+    private companion object {
+        /** `content://` so the probe takes the SAF branch a real pick takes. Nothing answers it. */
+        val UNREADABLE: Uri = Uri.parse("content://test/vanished.mp4")
+    }
+}
@@ -166,6 +166,54 @@ class FFmpegCommandBuilderTest {
        assertPair(cmd(OutputFormat.OPUS), "-c:a", "libopus")
    }

+    /**
+     * The arm most conversions actually take, and the only one in `audioArgs` with no test.
+     *
+     * `flac wav and opus select the right encoders` above covers the three named arms; MP3 has its
+     * own. AAC arrives through the `else`, so nothing named it and nothing pinned either half of
+     * what it emits -- neither `aac` nor `192k` appeared anywhere in this file. Both are shipped
+     * defaults: MP4 and M4A are the formats the picker offers first, so this is the audio
+     * every ordinary conversion gets.
+     *
+     * The bitrate is asserted as well as the encoder because it is the half a refactor is likelier
+     * to lose. An `-b:a` that quietly changed would not fail anything, would not look wrong in a
+     * command line, and would show up only as files that sound different from the ones the app
+     * produced last month.
+     */
+    @Test
+    fun `aac is the default encoder, at the bitrate the app ships`() {
+        assertPair(cmd(OutputFormat.MP4_H264), "-c:a", "aac")
+        assertPair(cmd(OutputFormat.MP4_H264), "-b:a", "192k")
+        // Through the `else` rather than through a named arm, so an AAC branch added above it later
+        // has to keep answering the same way.
+        assertPair(cmd(OutputFormat.M4A_AAC), "-c:a", "aac")
+        assertPair(cmd(OutputFormat.M4A_AAC), "-b:a", "192k")
+    }
+
+    /**
+     * Turning audio off, which the Advanced picker offers and nothing had ever built a command for.
+     *
+     * `audioArgs`' `Drop` arm was `ci == 0`. The suite's only `-an` assertion is in
+     * `gif generates a palette to avoid banding and drops audio`, and that one comes from the image
+     * path (`FFmpegCommandBuilder.kt:79`/`:90`), which emits `-an` directly and never reaches
+     * `audioArgs`. Two sites, one string, one tested.
+     *
+     * It is a live path rather than defensive code: `AdvancedPicker` renders all of
+     * `AudioCodec.entries` including `NONE`, `ContainerCapabilities.validate` permits audio-off
+     * whenever the input has video, and MKV routes the job to FFmpeg.
+     *
+     * Both halves are asserted. `-an` alone would still pass if the arm fell through to the `else`
+     * and emitted an AAC encoder beside it -- a file that is silent because the flag won, carrying
+     * an encoder nobody asked for.
+     */
+    @Test
+    fun `turning audio off drops the track instead of encoding one`() {
+        val args = cmd(OutputSpec(Container.MKV, VideoCodec.H264, AudioCodec.NONE))
+
+        assertTrue("audio turned off must emit -an, got $args", args.contains("-an"))
+        assertFalse("a dropped track must not also carry an encoder, got $args", args.contains("-c:a"))
+    }
+
    @Test
    fun `audio only formats never carry a video encoder`() {
        listOf(OutputFormat.MP3, OutputFormat.FLAC, OutputFormat.WAV, OutputFormat.OPUS)
@@ -0,0 +1,200 @@
+package org.libremediaconverter.join
+
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.work.Data
+import androidx.work.WorkInfo
+import androidx.work.workDataOf
+import org.junit.Assert.assertEquals
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.convert.InputFile
+import org.libremediaconverter.model.ConcatStrategy
+import org.libremediaconverter.work.ConcatWorker
+import org.robolectric.RobolectricTestRunner
+
+/**
+ * Every answer [joinStateFrom] can give, chosen rather than stumbled into.
+ *
+ * The join-side twin of `ConversionStateMappingTest`, and the argument is the same one: the mapping
+ * ran on every test that drove a real `ConcatWorker`, but a real worker only ever reaches a terminal
+ * state with well-formed output, so five arms had never been *chosen* by anything.
+ *
+ * ## The one that is not just coverage
+ *
+ * `an unknown strategy name is read as a re-encode rather than thrown` covers a real defect this
+ * seam exposed. The line it replaces was:
+ *
+ * ```kotlin
+ * .getString(ConcatWorker.KEY_STRATEGY)?.let(ConcatStrategy::valueOf) ?: ConcatStrategy.REENCODE
+ * ```
+ *
+ * `valueOf` throws on a name this build does not define, and this runs inside a `viewModelScope`
+ * collect with no handler — so it does not become a `Failed` state, it takes the process down.
+ * `ConcatWorker.kt` had already made this exact change for `KEY_FORMAT` and written down why; the
+ * matching read on this side had not been changed with it.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class JoinStateMappingTest {
+
+    @Test
+    fun `a running join is joining`() {
+        assertEquals(JoinState.Joining(INPUTS), map(WorkInfo.State.RUNNING))
+    }
+
+    @Test
+    fun `a blocked join looks like one that is starting`() {
+        // Folded into the RUNNING arm deliberately: a job waiting on a prerequisite is nothing the
+        // user can act on, and a separate word for it would be noise.
+        assertEquals(JoinState.Joining(INPUTS), map(WorkInfo.State.BLOCKED))
+    }
+
+    @Test
+    fun `an enqueued join that has already run is waiting to retry`() {
+        assertEquals(JoinState.Waiting(INPUTS), map(WorkInfo.State.ENQUEUED, runAttemptCount = 1))
+    }
+
+    @Test
+    fun `an enqueued join that has never run is simply starting`() {
+        // The other side. Without it, a mapping that ignored runAttemptCount passes the test above.
+        assertEquals(JoinState.Joining(INPUTS), map(WorkInfo.State.ENQUEUED, runAttemptCount = 0))
+    }
+
+    @Test
+    fun `a success that named no file is a failure, not an empty success`() {
+        assertEquals(
+            JoinState.Failed(JOINED_WITHOUT_A_FILE_MESSAGE),
+            map(WorkInfo.State.SUCCEEDED, data = Data.EMPTY),
+        )
+    }
+
+    @Test
+    fun `a success carries the strategy the worker actually used`() {
+        // Not cosmetic: the join screen tells the user whether their files were stream-copied or
+        // re-encoded, which is the difference between lossless and lossy.
+        val joined = map(
+            WorkInfo.State.SUCCEEDED,
+            data = workDataOf(
+                ConcatWorker.KEY_OUTPUT_PATH to "/cache/conversions/joined.mp4",
+                ConcatWorker.KEY_STRATEGY to ConcatStrategy.STREAM_COPY.name,
+            ),
+        ) as JoinState.Joined
+
+        assertEquals(ConcatStrategy.STREAM_COPY, joined.strategy)
+    }
+
+    @Test
+    fun `an unknown strategy name is read as a re-encode rather than thrown`() {
+        // The defect. A build that added a third strategy leaves finished joins in the queue naming
+        // it, and WorkManager keeps those about a week -- the premise WorkerEnumFallbackTest and
+        // JobTags are both written on. With `valueOf` this throws IllegalArgumentException inside a
+        // viewModelScope collect that has no handler, so it is not a Failed state, it is a crash.
+        //
+        // REENCODE rather than STREAM_COPY because it is the conservative answer: describing an
+        // unknown join as lossless would be a claim the app cannot support.
+        val joined = map(
+            WorkInfo.State.SUCCEEDED,
+            data = workDataOf(
+                ConcatWorker.KEY_OUTPUT_PATH to "/cache/conversions/joined.mp4",
+                ConcatWorker.KEY_STRATEGY to "SMART_CONCAT_V2",
+            ),
+        ) as JoinState.Joined
+
+        assertEquals(ConcatStrategy.REENCODE, joined.strategy)
+    }
+
+    @Test
+    fun `a success with no strategy at all falls back the same way`() {
+        val joined = map(
+            WorkInfo.State.SUCCEEDED,
+            data = workDataOf(ConcatWorker.KEY_OUTPUT_PATH to "/cache/conversions/joined.mp4"),
+        ) as JoinState.Joined
+
+        assertEquals(ConcatStrategy.REENCODE, joined.strategy)
+    }
+
+    @Test
+    fun `a success from older work falls back to the format such a job really used`() {
+        val joined = map(
+            WorkInfo.State.SUCCEEDED,
+            data = workDataOf(ConcatWorker.KEY_OUTPUT_PATH to "/cache/conversions/joined.mp4"),
+        ) as JoinState.Joined
+
+        assertEquals(ConcatWorker.outputNameFor(ConcatWorker.DEFAULT_FORMAT), joined.suggestedName)
+        assertEquals(ConcatWorker.DEFAULT_FORMAT.mimeType, joined.mimeType)
+    }
+
+    @Test
+    fun `a blank name or type falls back the same way a missing one does`() {
+        val joined = map(
+            WorkInfo.State.SUCCEEDED,
+            data = workDataOf(
+                ConcatWorker.KEY_OUTPUT_PATH to "/cache/conversions/joined.mp4",
+                ConcatWorker.KEY_SUGGESTED_NAME to "",
+                ConcatWorker.KEY_MIME_TYPE to "  ",
+            ),
+        ) as JoinState.Joined
+
+        assertEquals(ConcatWorker.outputNameFor(ConcatWorker.DEFAULT_FORMAT), joined.suggestedName)
+        assertEquals(ConcatWorker.DEFAULT_FORMAT.mimeType, joined.mimeType)
+    }
+
+    @Test
+    fun `a failure carries the reason the worker gave`() {
+        assertEquals(
+            JoinState.Failed("Not enough free space to join these files."),
+            map(
+                WorkInfo.State.FAILED,
+                data = workDataOf(
+                    ConcatWorker.KEY_ERROR to "Not enough free space to join these files.",
+                ),
+            ),
+        )
+    }
+
+    @Test
+    fun `a failure with nothing said still says something`() {
+        assertEquals(
+            JoinState.Failed(ConcatWorker.GENERIC_FAILURE_MESSAGE),
+            map(WorkInfo.State.FAILED, data = Data.EMPTY),
+        )
+    }
+
+    @Test
+    fun `a failure whose message is blank falls back like a missing one`() {
+        assertEquals(
+            JoinState.Failed(ConcatWorker.GENERIC_FAILURE_MESSAGE),
+            map(WorkInfo.State.FAILED, data = workDataOf(ConcatWorker.KEY_ERROR to " ")),
+        )
+    }
+
+    @Test
+    fun `a cancellation lands wherever the caller said it should`() {
+        // A join started here goes back to Ready with the picked files; one picked up by reattach
+        // goes to Idle, because those URIs belong to a process that no longer exists.
+        assertEquals(
+            JoinState.Ready(INPUTS),
+            map(WorkInfo.State.CANCELLED, cancelled = JoinState.Ready(INPUTS)),
+        )
+        assertEquals(JoinState.Idle, map(WorkInfo.State.CANCELLED, cancelled = JoinState.Idle))
+    }
+
+    private fun map(
+        state: WorkInfo.State,
+        runAttemptCount: Int = 0,
+        data: Data = Data.EMPTY,
+        cancelled: JoinState = JoinState.Ready(INPUTS),
+    ): JoinState = joinStateFrom(
+        JoinUpdate(state = state, runAttemptCount = runAttemptCount, outputData = data),
+        inputs = INPUTS,
+        cancelled = cancelled,
+    )
+
+    private companion object {
+        val INPUTS = listOf(
+            InputFile(Uri.parse("content://test/a.mp4"), "a.mp4", 1024L),
+            InputFile(Uri.parse("content://test/b.mp4"), "b.mp4", 2048L),
+        )
+    }
+}
@@ -451,6 +451,99 @@ class ContainerCapabilitiesTest {
        }
    }

+    /**
+     * The video twin of `no audio track is accepted by every container in both modes`.
+     *
+     * Dead in production today, and deliberately so: every caller guards `NONE` before asking the
+     * matrix, so nothing reaches this arm through the app. **The asymmetry is the argument, not the
+     * reachability** -- its audio counterpart at the top of the same `when` has had a dedicated
+     * test since #136, and one of a matched pair being covered is how a later reader concludes the
+     * other was considered and exempted. It was not; it was simply missed.
+     *
+     * Not the same shape as the two `COPY -> error(...)` arms, which `docs/coverage-read-findings.md`
+     * records as a named exemption (F4). Those are guards that must not be provokable. This is a
+     * documented answer -- "no video track fits anywhere" -- and an answer is a thing to pin.
+     */
+    @Test
+    fun `no video track is accepted by every container in both modes`() {
+        Container.entries.forEach { container ->
+            listOf(CodecMode.COPY, CodecMode.ENCODE).forEach { mode ->
+                assertTrue(
+                    "$container should accept no video track ($mode)",
+                    ContainerCapabilities.accepts(container, VideoCodec.NONE, mode),
+                )
+            }
+        }
+    }
+
+    /**
+     * A suggestion that keeps the codec the user asked for, rather than falling back to the
+     * container's first encodable one.
+     *
+     * `repairVideo`'s third arm -- "the request is not a copy, and this container can encode it" --
+     * is the one that preserves intent, and it was the only arm of the four nothing reached. The
+     * property test above executes `repairVideo` on every case it walks and lands elsewhere each
+     * time: an explicit COPY that works, a source the container can carry untouched, or no video
+     * track at all.
+     *
+     * The route is indirect because it is the only one the app has. VP9 into WebM is a perfectly
+     * good video request; what makes it invalid is the *audio* -- WebM carries Opus and Vorbis, not
+     * AAC. So `validateAudio` refuses, `suggestions` looks for a container that can hold what was
+     * asked for, and MP4 can encode VP9. The suggestion has to come back carrying VP9: swapping to
+     * the container's first encodable codec would discard the choice the user made.
+     */
+    @Test
+    fun `a repaired suggestion keeps the video codec the user chose`() {
+        val invalid = ContainerCapabilities.validate(
+            OutputSpec(Container.WEBM, VideoCodec.VP9, AudioCodec.AAC),
+            h264Source,
+        )
+
+        assertTrue("WebM cannot hold AAC, so this spec is invalid", invalid is Validation.Invalid)
+        val suggestions = (invalid as Validation.Invalid).suggestions
+        assertTrue(
+            "expected a suggestion that still encodes VP9, got $suggestions",
+            suggestions.any { it.videoCodec == VideoCodec.VP9 },
+        )
+        assertEverySuggestionValid(invalid, h264Source)
+    }
+
+    /**
+     * The fallback in `firstContainerHolding`: when the input's own container cannot hold the
+     * codec the user asked for, any container that can will do.
+     *
+     * The preferred half -- "the container the input already uses" -- is what every other case
+     * reaches, because they all start from a file whose own container carries the codec in
+     * question. The elvis after it had never run.
+     *
+     * AVI is the input that makes it run: AVI predates H.265 and has no mapping for it, so asking
+     * an AVI for H.265 is refused, and the container the input already uses cannot be part of the
+     * answer. Without the fallback the only candidates left are AVI itself and the container
+     * holding the *source* codec -- also AVI -- so the refusal still offers something, but what it
+     * offers is H.264: the app quietly declines the codec the user asked for instead of moving them
+     * to a container that supports it.
+     *
+     * That is why this asserts the codec survives rather than that the list is non-empty. A
+     * non-empty assertion passes with the fallback deleted -- measured, not assumed.
+     */
+    @Test
+    fun `an input whose container cannot hold the requested codec is moved, not downgraded`() {
+        val aviSource = InputProbe(videoCodec = "h264", audioCodec = "aac", container = Container.AVI)
+
+        val invalid = ContainerCapabilities.validate(
+            OutputSpec(Container.AVI, VideoCodec.H265, AudioCodec.AAC),
+            aviSource,
+        )
+
+        assertTrue("AVI has no mapping for H.265", invalid is Validation.Invalid)
+        val suggestions = (invalid as Validation.Invalid).suggestions
+        assertTrue(
+            "expected a container that can actually hold H.265, got $suggestions",
+            suggestions.any { it.videoCodec == VideoCodec.H265 },
+        )
+        assertEverySuggestionValid(invalid, aviSource)
+    }
+
    @Test
    fun `resolving audio COPY before asking the matrix is required`() {
        // The audio twin of `resolving COPY before asking the matrix is required`, and the reason is
@@ -28,6 +28,7 @@ class TagTableUniquenessTest {
    fun `every tag constant has its own value`() {
        val tags = tagsIn(
            TestTags::class.java,
+            TestTags.Shell::class.java,
            TestTags.Converter::class.java,
            TestTags.Join::class.java,
        )
@@ -0,0 +1,237 @@
+package org.libremediaconverter.work
+
+import android.app.Application
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.work.Data
+import androidx.work.ListenableWorker
+import androidx.work.testing.TestListenableWorkerBuilder
+import androidx.work.workDataOf
+import kotlinx.coroutines.runBlocking
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.convert.ConcatJoiner
+import org.libremediaconverter.convert.ConversionDependencies
+import org.libremediaconverter.convert.StagingNames
+import org.libremediaconverter.convert.installTestWorkManager
+import org.libremediaconverter.ffmpeg.ConcatEngine
+import org.libremediaconverter.model.ConcatStrategy
+import org.libremediaconverter.model.OutputFormat
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import java.io.File
+import java.util.UUID
+
+/**
+ * What a join does when the engine fails partway.
+ *
+ * Everything past `ConcatWorker`'s `setForeground` was untested on **every** source set, and the
+ * repo had already measured the cost: `PerJobStagingTest`'s KDoc records that reverting
+ * `ConcatWorker` to a constant staging name left all 257 tests green, because nothing in the JVM
+ * suite can get past a `ConcatEngine` constructed in place. `RefusedJobTest` says the same from the
+ * other side -- "the next thing past the count guard is `ConcatEngine`, which is native".
+ * `ConcatEngineTest` on a device tests the engine directly, bypassing the worker, and
+ * `ConcatWorkerTest` covers only the too-few-inputs guard and the happy path.
+ *
+ * `ConversionDependencies.concat` is the seam that closes it, added here to sit beside the
+ * `.hardware` and `.software` that `ConversionWorker` has had all along -- the asymmetry between the
+ * two workers was the whole reason one of them had a tested failure path and the other did not.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class ConcatFailureTest {
+
+    private lateinit var app: Application
+    private lateinit var publisher: AlwaysRoomPublisher
+
+    @Before
+    fun setUp() {
+        app = RuntimeEnvironment.getApplication()
+        publisher = AlwaysRoomPublisher(app)
+        ConversionDependencies.publisher = { publisher }
+        installTestWorkManager(app, Data.EMPTY)
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    @Test
+    fun `a join whose engine fails reports the engine's own reason`() {
+        ConversionDependencies.concat = { FailingJoiner { error(DEMUXER_MESSAGE) } }
+
+        val result = runBlocking { joinWorker().doWork() }
+
+        assertEquals(
+            ListenableWorker.Result.failure(workDataOf(ConcatWorker.KEY_ERROR to DEMUXER_MESSAGE)),
+            result,
+        )
+    }
+
+    /**
+     * A failure carrying no message at all, which Kotlin and Java both allow and FFmpegKit's
+     * wrappers can produce.
+     *
+     * Without the fallback the user is shown an empty error, and `JoinViewModel` cannot tell that
+     * from a job that reported nothing -- the two would be one blank screen with different causes.
+     */
+    @Test
+    fun `a failure with no message of its own still says something`() {
+        ConversionDependencies.concat = { FailingJoiner { throw RuntimeException() } }
+
+        val result = runBlocking { joinWorker().doWork() }
+
+        assertEquals(
+            ListenableWorker.Result.failure(
+                workDataOf(ConcatWorker.KEY_ERROR to ConcatWorker.GENERIC_FAILURE_MESSAGE),
+            ),
+            result,
+        )
+    }
+
+    /**
+     * The staged file is deleted on the way out.
+     *
+     * The joiner writes before it fails, exactly as `PartialThenFailingTranscoder` does on the
+     * conversion side: a stub that only threw would let a missing `staged.delete()` pass. What it
+     * costs to lose is a full-size partial per failed join, sitting in cache until the sweep is old
+     * enough to be sure nobody is coming back for it.
+     *
+     * Asserted against the file the joiner was actually handed rather than by scanning the staging
+     * directory for a name. The first draft did scan, for a `"join-"` prefix that
+     * `StagingNames.forJob` does not produce -- it names files `<jobId>.<ext>` -- so the assertion
+     * was trivially true and the mutation walked straight through it.
+     */
+    @Test
+    fun `a failed join leaves nothing behind in staging`() {
+        val joiner = FailingJoiner { error(DEMUXER_MESSAGE) }
+        ConversionDependencies.concat = { joiner }
+
+        runBlocking { joinWorker().doWork() }
+
+        val staged = requireNotNull(joiner.lastOutput) { "the joiner never ran, so this proves nothing" }
+        assertEquals(
+            "the fixture has to write before it fails, or the delete is unobservable",
+            PARTIAL_BYTES,
+            joiner.bytesWritten,
+        )
+        assertFalse("a failed join must not leave its partial behind: $staged", staged.exists())
+    }
+
+    /**
+     * The success path, and the staging name #159's fixture and `PerJobStagingTest` both care about.
+     *
+     * Worth its place rather than a happy-path formality: `PerJobStagingTest`'s KDoc records that
+     * **reverting `ConcatWorker` to a constant staging name left all 257 tests green**, because
+     * nothing could reach the line that names the file. This is the test that was missing when that
+     * was written -- the join's output `Data` had never been read by anything on the JVM.
+     *
+     * The staged path is asserted to carry the job id, not a constant: two joins of the same format
+     * sharing one name is the defect, and `ConcatEngine`'s list file collided harder still.
+     */
+    @Test
+    fun `a join that works reports its own staged file, strategy and name`() {
+        val joiner = SucceedingJoiner()
+        ConversionDependencies.concat = { joiner }
+
+        val result = runBlocking { joinWorker().doWork() }
+
+        assertTrue("got $result", result is ListenableWorker.Result.Success)
+        val data = (result as ListenableWorker.Result.Success).outputData
+        assertEquals(
+            "the staged file has to be this job's, not a name every join shares",
+            File(publisherStagingDir(), StagingNames.forJob(JOB_ID, OutputFormat.MP4_H264.extension)).absolutePath,
+            data.getString(ConcatWorker.KEY_OUTPUT_PATH),
+        )
+        assertEquals(ConcatStrategy.STREAM_COPY.name, data.getString(ConcatWorker.KEY_STRATEGY))
+        assertEquals(OutputFormat.MP4_H264.mimeType, data.getString(ConcatWorker.KEY_MIME_TYPE))
+        assertTrue(
+            "the save dialog needs a name with the right extension, got ${data.getString(
+                ConcatWorker.KEY_SUGGESTED_NAME,
+            )}",
+            data.getString(ConcatWorker.KEY_SUGGESTED_NAME).orEmpty().endsWith(".${OutputFormat.MP4_H264.extension}"),
+        )
+    }
+
+    /**
+     * The arm beside the count guard: no URI array at all.
+     *
+     * Covered today only by `UnopenableUriTest` on a device, although it runs before staging and
+     * before any native code. It is the exact sibling of `RefusedJobTest`'s ConversionWorker twin,
+     * and it belongs on the JVM with it -- a device test for a branch that needs no device is a
+     * slower test that reports later.
+     */
+    @Test
+    fun `a join with no input array at all is refused with a message`() {
+        val result = runBlocking {
+            TestListenableWorkerBuilder<ConcatWorker>(
+                context = app,
+                inputData = workDataOf(ConcatWorker.KEY_FORMAT to OutputFormat.MP4_H264.name),
+                runAttemptCount = 0,
+            ).setId(JOB_ID).build().doWork()
+        }
+
+        assertEquals(
+            ListenableWorker.Result.failure(workDataOf(ConcatWorker.KEY_ERROR to ConcatWorker.NO_INPUTS_MESSAGE)),
+            result,
+        )
+    }
+
+    private fun publisherStagingDir(): File? = publisher.createStagingFile("probe").parentFile
+
+    private fun joinWorker(): ConcatWorker = TestListenableWorkerBuilder<ConcatWorker>(
+        context = app,
+        inputData = workDataOf(
+            ConcatWorker.KEY_INPUT_URIS to arrayOf(FIRST.toString(), SECOND.toString()),
+            ConcatWorker.KEY_TOTAL_BYTES to TOTAL_BYTES,
+            ConcatWorker.KEY_FORMAT to OutputFormat.MP4_H264.name,
+        ),
+        runAttemptCount = 0,
+    ).setId(JOB_ID).build()
+
+    private companion object {
+        val FIRST: Uri = Uri.parse("file:///tmp/one.mp4")
+        val SECOND: Uri = Uri.parse("file:///tmp/two.mp4")
+        const val TOTAL_BYTES = 2048L
+        const val DEMUXER_MESSAGE = "the demuxer rejected the input list"
+        const val PARTIAL_BYTES = 2048
+        val JOB_ID: UUID = UUID.fromString("00000000-0000-4000-8000-00000000000b")
+    }
+}
+
+/** A joiner that writes something and then fails, so a missing `staged.delete()` cannot pass. */
+private class FailingJoiner(private val failure: () -> Nothing) : ConcatJoiner {
+
+    /** The handle the worker created, kept so a test can ask whether it survived the failure. */
+    var lastOutput: File? = null
+    var bytesWritten = 0
+
+    override suspend fun join(inputs: List<Uri>, output: File, format: OutputFormat): ConcatEngine.Result {
+        lastOutput = output
+        output.writeBytes(ByteArray(PARTIAL_BYTES))
+        bytesWritten = PARTIAL_BYTES
+        failure()
+    }
+
+    private companion object {
+        const val PARTIAL_BYTES = 2048
+    }
+}
+
+/** The joiner that finishes, so the success path and the output `Data` can be read on the JVM. */
+private class SucceedingJoiner : ConcatJoiner {
+    override suspend fun join(inputs: List<Uri>, output: File, format: OutputFormat): ConcatEngine.Result {
+        output.writeBytes(ByteArray(OUTPUT_BYTES))
+        return ConcatEngine.Result(ConcatStrategy.STREAM_COPY, output)
+    }
+
+    private companion object {
+        const val OUTPUT_BYTES = 4096
+    }
+}
@@ -0,0 +1,88 @@
+package org.libremediaconverter.work
+
+import android.content.pm.ServiceInfo
+import org.junit.Assert.assertEquals
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.annotation.Config
+
+/**
+ * [ConversionForegroundType.current] answers differently on each of the three API regimes, and
+ * until this file only one of them was ever executed.
+ *
+ * `app/src/test/resources/robolectric.properties` pins the whole JVM suite to `sdk=36`, so every
+ * Robolectric test that reaches a `ForegroundInfo` takes the `mediaProcessing` arm and no other.
+ * The 33 and 34 arms were cold: 3 lines and 3 of 4 branches, measured on `main` at `d354f64`.
+ *
+ * **The instrumented test is not a substitute, and the reason is specific.**
+ * `ConversionWorkerTest.foregroundTypeMatchesTheRunningApiLevel` asserts against whichever API the
+ * leg happens to be — one arm per leg, never the other two — and the legs that would cover 33 and
+ * 34 are the ones issue #122 wedges. `docs/coverage-read-findings.md` records an API 33 run that
+ * reported `received: 60` and `failed: unknown`: the regime *was* exercised, and that leg could
+ * not have said so if it had broken. Four `@Config` classes here pin all three arms
+ * deterministically, in the same `./gradlew` invocation as everything else.
+ *
+ * `minSdk` is 33, so none of these is dead code — each is a device someone is running the app on.
+ *
+ * **SDK 35 is in the list for the boundary, not for the answer.** It shares its answer with 36,
+ * which would make it look redundant. It is not: relaxing `>= VANILLA_ICE_CREAM` to `>` is invisible
+ * at every level except exactly 35, so without this class that mutation survives the suite.
+ */
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [33])
+class ForegroundTypeApi33Test {
+
+    /**
+     * Zero rather than a named constant because there is no constant to name: API 33 does not
+     * require a type, and `mediaProcessing` does not exist here to pass. `ForegroundInfo` reads 0
+     * as "no type at all", which is what this regime wants.
+     */
+    @Test
+    fun `api 33 asks for no foreground service type`() {
+        assertEquals(0, ConversionForegroundType.current())
+    }
+}
+
+/**
+ * API 34 makes a type mandatory and still has no `mediaProcessing`, so `dataSync` is the only
+ * sensible fit. See [ForegroundTypeApi33Test] for why this file exists.
+ */
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [34])
+class ForegroundTypeApi34Test {
+
+    @Test
+    fun `api 34 falls back to dataSync, the only type that fits`() {
+        assertEquals(ServiceInfo.FOREGROUND_SERVICE_TYPE_DATA_SYNC, ConversionForegroundType.current())
+    }
+}
+
+/**
+ * The first level with `mediaProcessing`, and therefore the one that tells `>=` from `>`.
+ * See [ForegroundTypeApi33Test].
+ */
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [35])
+class ForegroundTypeApi35Test {
+
+    @Test
+    fun `api 35 is the first level that takes mediaProcessing`() {
+        assertEquals(ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROCESSING, ConversionForegroundType.current())
+    }
+}
+
+/**
+ * The level the rest of the suite runs at, asserted here rather than assumed — it is the one arm
+ * that was already covered, and leaving it out would make this file look like it is about the old
+ * levels rather than about all three regimes. See [ForegroundTypeApi33Test].
+ */
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [36])
+class ForegroundTypeApi36Test {
+
+    @Test
+    fun `api 36 keeps mediaProcessing`() {
+        assertEquals(ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROCESSING, ConversionForegroundType.current())
+    }
+}
@@ -0,0 +1,226 @@
+package org.libremediaconverter.work
+
+import android.app.Application
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.work.Data
+import androidx.work.ListenableWorker
+import androidx.work.testing.TestListenableWorkerBuilder
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.runBlocking
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertThrows
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.convert.ConversionDependencies
+import org.libremediaconverter.convert.HardwareTranscoder
+import org.libremediaconverter.convert.SoftwareTranscoder
+import org.libremediaconverter.convert.installTestWorkManager
+import org.libremediaconverter.model.Container
+import org.libremediaconverter.model.ConversionRequest
+import org.libremediaconverter.model.DeviceCodecs
+import org.libremediaconverter.model.EnginePreference
+import org.libremediaconverter.model.InputProbe
+import org.libremediaconverter.model.OutputFormat
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import java.io.File
+import java.util.UUID
+
+/**
+ * What happens when the hardware engine does not finish the job.
+ *
+ * `runMedia3OrFallBack` was eleven lines at 0% on the JVM and `isCancellation` had never been
+ * called by any unit test at all. Its own KDoc calls the fallback the protection against vendor
+ * hardware encoders that "cannot be tested for correctness", so it is the branch most likely to
+ * matter on a device nobody here owns — and it was reachable the whole time through
+ * `ConversionDependencies.hardware`, which no unit test had ever used.
+ *
+ * The sharp one is cancellation. `runMedia3OrFallBack` catches `Throwable`, so without the
+ * `isCancellation` re-throw a user cancelling a hardware transcode would have the app quietly
+ * start a *second* conversion in software — the one thing cancelling is supposed to prevent.
+ *
+ * `ForcedFailureTest` covers the failure half on a device. It does not cover the cancellation half,
+ * and this host cannot run it either way.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class HardwareFallbackTest {
+
+    private lateinit var app: Application
+    private lateinit var hardware: RecordingHardwareTranscoder
+    private lateinit var software: RecordingSoftwareTranscoder
+
+    @Before
+    fun setUp() {
+        app = RuntimeEnvironment.getApplication()
+        hardware = RecordingHardwareTranscoder()
+        software = RecordingSoftwareTranscoder()
+        ConversionDependencies.publisher = { AlwaysRoomPublisher(app) }
+        ConversionDependencies.hardware = { hardware }
+        ConversionDependencies.software = { software }
+        // A probe with real codecs, not the default: `InputProbe()` reports UNPARSEABLE, which
+        // PERMISSIVE.canDecode refuses, and the router would send every job here straight to
+        // FFmpeg without any of these tests mentioning why.
+        ConversionDependencies.probe = { _, _ -> H264_SOURCE }
+        ConversionDependencies.deviceCodecs = { DeviceCodecs.PERMISSIVE }
+        installTestWorkManager(app, Data.EMPTY)
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    @Test
+    fun `a hardware failure runs the job again in software, on a clean staging file`() {
+        hardware.failWith = { error("the vendor encoder produced nothing usable") }
+
+        val result = runBlocking { worker().doWork() }
+
+        assertTrue("the job should still succeed, got $result", result is ListenableWorker.Result.Success)
+        assertEquals("the hardware engine gets exactly one attempt", 1, hardware.attempts)
+        assertEquals("and the job then goes to software", 1, software.attempts)
+        // The `staged.delete()` between the two, asserted where it is observable: FFmpeg must not
+        // find a half-written hardware output sitting at the path it is about to write.
+        assertFalse(
+            "the partial hardware output must be gone before FFmpeg starts",
+            software.outputExistedOnEntry,
+        )
+        assertEquals("the hardware engine is closed either way", 1, hardware.closes)
+    }
+
+    @Test
+    fun `a cancelled hardware transcode is not quietly retried in software`() {
+        hardware.failWith = { throw CancellationException("the user pressed Cancel") }
+
+        assertThrows(CancellationException::class.java) { runBlocking { worker().doWork() } }
+
+        assertEquals("the hardware engine ran", 1, hardware.attempts)
+        assertEquals(
+            "cancelling must not start a second conversion -- that is the whole point of cancelling",
+            0,
+            software.attempts,
+        )
+        assertEquals("and the engine is still closed on the way out", 1, hardware.closes)
+    }
+
+    @Test
+    fun `a hardware transcode that works never reaches the software engine`() {
+        val result = runBlocking { worker().doWork() }
+
+        assertTrue("got $result", result is ListenableWorker.Result.Success)
+        assertEquals(1, hardware.attempts)
+        assertEquals("the fallback is a fallback, not a second pass", 0, software.attempts)
+        assertEquals(1, hardware.closes)
+    }
+
+    /**
+     * #169: the display-name fallback, which reaches further than the notification title.
+     *
+     * `inputData.getString(KEY_DISPLAY_NAME) ?: "input"` had never taken its right-hand side. The
+     * value is not only the foreground notification's title: it feeds `outputNameFor`, so it is
+     * also the filename offered in the user's save dialog. A job enqueued by an older build, or
+     * built by hand, carries no such key.
+     */
+    @Test
+    fun `a job that names no input file still suggests an output name`() {
+        val result = runBlocking { worker(displayName = null).doWork() }
+
+        assertTrue("got $result", result is ListenableWorker.Result.Success)
+        val suggested = (result as ListenableWorker.Result.Success)
+            .outputData.getString(ConversionWorker.KEY_SUGGESTED_NAME)
+        assertTrue(
+            "expected a name built from the fallback, got $suggested",
+            suggested.orEmpty().startsWith("input"),
+        )
+    }
+
+    private fun worker(displayName: String? = DISPLAY_NAME): ConversionWorker {
+        val spec = OutputFormat.MP4_H265.spec
+        val entries = buildMap<String, Any> {
+            put(ConversionWorker.KEY_INPUT_URI, INPUT.toString())
+            displayName?.let { put(ConversionWorker.KEY_DISPLAY_NAME, it) }
+            put(ConversionWorker.KEY_SIZE_BYTES, INPUT_BYTES)
+            put(ConversionWorker.KEY_CONTAINER, spec.container.name)
+            put(ConversionWorker.KEY_VIDEO_CODEC, spec.videoCodec.name)
+            put(ConversionWorker.KEY_AUDIO_CODEC, spec.audioCodec.name)
+            // AUTO rather than FORCE_SOFTWARE, which is what every other worker test uses and is
+            // exactly why this path had no coverage: forcing software never enters the function.
+            put(ConversionWorker.KEY_ENGINE_PREFERENCE, EnginePreference.AUTO.name)
+        }
+        return TestListenableWorkerBuilder<ConversionWorker>(
+            context = app,
+            inputData = Data.Builder().putAll(entries).build(),
+            runAttemptCount = 0,
+        ).setId(JOB_ID).build()
+    }
+
+    private companion object {
+        val INPUT: Uri = Uri.parse("file:///tmp/holiday.mp4")
+        const val DISPLAY_NAME = "holiday.mp4"
+        const val INPUT_BYTES = 1024L
+        val JOB_ID: UUID = UUID.fromString("00000000-0000-4000-8000-000000000009")
+        val H264_SOURCE = InputProbe(
+            videoCodec = "h264",
+            audioCodec = "aac",
+            container = Container.MP4,
+            durationMs = 1_000,
+        )
+    }
+}
+
+/**
+ * A hardware engine that writes something before it fails, and remembers being closed.
+ *
+ * Writing first is the point, exactly as it is for `PartialThenFailingTranscoder`: an engine that
+ * only threw would let a missing `staged.delete()` pass unnoticed.
+ */
+@UnstableApi
+private class RecordingHardwareTranscoder : HardwareTranscoder {
+
+    var attempts = 0
+    var closes = 0
+    var failWith: (() -> Unit)? = null
+
+    override suspend fun transcode(input: Uri, output: File, request: ConversionRequest, onProgress: (Int) -> Unit) {
+        attempts++
+        output.writeBytes(ByteArray(PARTIAL_BYTES))
+        failWith?.invoke()
+    }
+
+    override fun close() {
+        closes++
+    }
+
+    private companion object {
+        const val PARTIAL_BYTES = 2048
+    }
+}
+
+/** The software engine, recording whether the hardware attempt's leftovers were cleared first. */
+private class RecordingSoftwareTranscoder : SoftwareTranscoder {
+
+    var attempts = 0
+    var outputExistedOnEntry = false
+
+    override suspend fun run(
+        request: ConversionRequest,
+        inputPath: String,
+        output: File,
+        durationMs: Long,
+        onProgress: (Int) -> Unit,
+    ) {
+        attempts++
+        outputExistedOnEntry = output.exists()
+        output.writeBytes(ByteArray(OUTPUT_BYTES))
+    }
+
+    private companion object {
+        const val OUTPUT_BYTES = 512
+    }
+}
@@ -16,6 +16,7 @@ import androidx.work.testing.WorkManagerTestInitHelper
 import androidx.work.workDataOf
 import kotlinx.coroutines.runBlocking
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Before
 import org.junit.Test
@@ -125,6 +126,39 @@ class JobSnapshotsTest {
        assertEquals(newer.absolutePath, Reattachment.choose(snapshots)?.job?.outputPath)
    }

+    /**
+     * A job in the tag query that never recorded an output path at all.
+     *
+     * Distinct from the three cases above, which all *have* a path and differ in what it names. A
+     * job still running, or one that finished without writing its result key, carries no path at
+     * all -- and `getWorkInfosByTagFlow` returns it alongside the finished ones, because the tag is
+     * the worker class and every attempt ever enqueued carries it.
+     *
+     * The guard is the `?.` in `path?.let(::File)`. Without it the null goes straight into a `File`
+     * constructor. What this pins is the consequence rather than the null check: such a job must
+     * not be offered as a result, so `Reattachment.choose` has to walk past it to the job that
+     * really produced a file. Choosing it would put a Converted screen in front of the user with a
+     * Save button that has nothing to save.
+     */
+    @Test
+    fun `a job that recorded no output path is not offered as a result`() {
+        val real = stagedFile("real.mp4", bytes = 4096)
+        finishedWithOutput(real)
+        finishedWithNoOutput()
+
+        val snapshots = snapshots()
+
+        assertEquals("both jobs carry the tag, so both come back", 2, snapshots.size)
+        val silent = snapshots.single { it.outputPath == null }
+        assertFalse("no path means no output, not an empty one", silent.outputExists)
+        assertEquals("and no time either, for the same reason", 0L, silent.outputModifiedAt)
+        assertEquals(
+            "the reattachment has to walk past it to the job that really produced a file",
+            real.absolutePath,
+            Reattachment.choose(snapshots)?.job?.outputPath,
+        )
+    }
+
    private fun snapshots(): List<JobSnapshot> = runBlocking {
        workManager.jobSnapshots(
            tag = ConversionWorker::class.java.name,
@@ -152,6 +186,11 @@ class JobSnapshotsTest {
        ).result.get()
    }

+    /** A job that carries the tag and no result key -- still running, or finished without one. */
+    private fun finishedWithNoOutput() {
+        workManager.enqueue(OneTimeWorkRequestBuilder<ConversionWorker>().build()).result.get()
+    }
+
    private companion object {
        /** Two fixed moments a day apart, so the ordering is stated rather than raced for. */
        const val OLDER_MS = 1_700_000_000_000L
@@ -0,0 +1,89 @@
+package org.libremediaconverter.work
+
+import android.app.Notification
+import androidx.media3.common.util.UnstableApi
+import androidx.work.Data
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.convert.installTestWorkManager
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import java.util.UUID
+
+/**
+ * The two things a progress notification can say, and that they are not the same thing.
+ *
+ * An assertion gap rather than a coverage one, and the distinction is the reason this file exists.
+ * JaCoCo is green on `build`'s `if (indeterminate)`, because `ProgressNotificationTest` drives it
+ * through a real worker -- but that test reads only the notification id and
+ * `Notification.EXTRA_PROGRESS`. **Nothing had ever read the text.** Swapping the two branches, or
+ * collapsing them into one string, passed the entire suite.
+ *
+ * What it costs to get wrong is small and constant: a conversion that has been running for four
+ * minutes still saying "Preparing", or one that has not started reporting yet claiming 0%. Neither
+ * is a crash, and neither would be found by anything else here -- which is exactly the kind of
+ * thing that survives for a long time.
+ *
+ * Nothing else in the suite constructs [ConversionNotifications] directly.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class NotificationProgressTextTest {
+
+    /**
+     * `build` reaches `WorkManager.getInstance` for the Cancel action's PendingIntent, so the
+     * notification cannot be built at all without one. That coupling is why nothing had ever
+     * constructed this class directly and read what it produced.
+     */
+    @Before
+    fun setUp() {
+        installTestWorkManager(RuntimeEnvironment.getApplication(), Data.EMPTY)
+    }
+
+    @Test
+    fun `an indeterminate notification says something different from a measured one`() {
+        val context = RuntimeEnvironment.getApplication()
+        val notifications = ConversionNotifications(context)
+
+        val preparing = notifications.build(JOB_ID, TITLE, percent = 0, indeterminate = true).text()
+        val measured = notifications.build(JOB_ID, TITLE, percent = 42, indeterminate = false).text()
+
+        assertNotEquals(
+            "the two states have to read differently, or the text says nothing at all",
+            preparing,
+            measured,
+        )
+        assertTrue(
+            "a measured notification has to carry its percentage, got \"$measured\"",
+            measured.contains("42"),
+        )
+        assertTrue(
+            "an indeterminate one must not invent one, got \"$preparing\"",
+            !preparing.contains("42") && !preparing.contains("0"),
+        )
+    }
+
+    /**
+     * The title is the caller's, not the builder's -- it is the file the user picked, and it is what
+     * tells two simultaneous conversions apart in the shade.
+     */
+    @Test
+    fun `the notification is titled with the file it is converting`() {
+        val context = RuntimeEnvironment.getApplication()
+
+        val built = ConversionNotifications(context).build(JOB_ID, TITLE, percent = 10)
+
+        assertEquals(TITLE, built.extras.getString(Notification.EXTRA_TITLE))
+    }
+
+    private fun Notification.text(): String = extras.getString(Notification.EXTRA_TEXT).orEmpty()
+
+    private companion object {
+        const val TITLE = "holiday.mp4"
+        val JOB_ID: UUID = UUID.fromString("00000000-0000-4000-8000-00000000000a")
+    }
+}
@@ -1,22 +1,27 @@
 # Coverage-read findings

-**Status:** five findings, none fixed, none urgent. F5 was added on 2026-08-27, found while decomposing #132 into children — it had been listed there as a test gap, and is not one. Every entry here is a *code* observation —
-something a test would document rather than repair. The test gaps found in the same read are
-tickets #132 and #133, not entries here; see [Not covered here](#not-covered-here).
-**Scope:** what a JaCoCo read on 2026-08-26 turned up that writing a test would not fix. This is
-a survey, not a work order. Acting on any entry is a separate decision and would be its own commit.
-**Last verified:** `main` at `dc8b7c3`, 2026-08-26. Coverage re-measured that day with
-`./gradlew :app:jacocoTestReport`: **84.9% line (1971/2321), 63.8% branch (900/1410)**, against
-**456 JVM tests in 68 classes**. `CLAUDE.md` quotes 454 in 67 from four hours earlier; the
-percentages are unchanged, so no figure there is stale.
+**Status:** ten findings, none fixed, none urgent. F1-F4 came from the 2026-08-26 read; F5 was added
+on 2026-08-27 while decomposing #132; **F6-F10 were added on 2026-09-02 from the wave-4 read**. Every
+entry here is a *code* observation — something a test would document rather than repair. The test
+gaps found in the same reads are tickets, not entries here; see [Not covered here](#not-covered-here).
+**Scope:** what a JaCoCo read turned up that writing a test would not fix. This is a survey, not a
+work order. Acting on any entry is a separate decision and would be its own commit.
+**Last verified:** `main` at `54ca2dd`, 2026-09-02. Coverage measured that day with
+`./gradlew :app:jacocoTestReport`: **92.8% line (2183/2352), 81.3% branch (1091/1342)**, against
+**584 JVM tests in 87 classes**, matching what `CLAUDE.md` quotes.
+
+The wave-4 read that produced F6-F10 also produced twelve test tickets, **#192-#203**, plus **#204**
+for four candidates whose cost was not obviously worth paying. The split between them is the same one
+this document has always drawn: a ticket is where a test goes, an entry here is where a test would not
+help.

 ## Why this document is separate from `defect-audit.md`

 `defect-audit.md` is the record of the 2026-08-22 defect sweep: sixteen entries, each a thing that
 is *wrong at runtime*. Nothing here is wrong at runtime today. These are arms that cannot be
-reached, accessors nobody calls, and one KDoc that contradicts the code beside it — the category
-`defect-audit.md` calls **latent**, plus one that is not a defect at all and is recorded so the
-next coverage read does not re-file it.
+reached, accessors nobody calls, and two KDocs that contradict the code beside them — the category
+`defect-audit.md` calls **latent**, plus several that are not defects at all and are recorded so the
+next coverage read does not re-file them.

 They are here rather than in that document because folding them in would inflate a sixteen-entry
 audit whose status metadata has already gone stale once, and because they share a provenance:
@@ -24,7 +29,7 @@ every one fell out of reading a coverage report, and every one is the kind of th
 report is *good* at surfacing and a test is bad at fixing. F5 is the clearest case — it was filed
 as a test gap first, and only stopped being one when someone went looking for its callers.

-Entry ids are `F1`–`F5` so they cannot be confused with `defect-audit.md`'s `D1`–`D16`.
+Entry ids are `F1`–`F10` so they cannot be confused with `defect-audit.md`'s `D1`–`D16`.

 ## How to read the confidence labels

@@ -262,6 +267,179 @@ no way to make it happen now.

 ---

+## F6 — Four more arms that cannot be reached, and one KDoc among them that is false
+
+**Severity: low · Confirmed by inspection · F4's family, found in the wave-4 read**
+
+```
+app/src/main/java/org/libremediaconverter/model/ConversionRouter.kt:178-179
+app/src/main/java/org/libremediaconverter/model/ConversionRouter.kt:221
+app/src/main/java/org/libremediaconverter/model/ContainerCapabilities.kt:297
+app/src/main/java/org/libremediaconverter/model/ContainerCapabilities.kt:324, :340
+```
+
+Four sites that a coverage report flags and that no test can reach. Each is recorded with the
+upstream guard that makes it unreachable, because that guard is what would have to change first.
+
+- **`ConversionRouter:178-179`** — the missed branch is `orEmpty()`'s absent-key arm on
+  `MEDIA3_MUXABLE_VIDEO[plan.container]`. `MEDIA3_CONTAINERS` is `setOf(MP4)` and `route()` returns at
+  `:104` for anything else, so `media3CanMux` only ever sees MP4, which both maps key. Same function
+  as F4's second pair, one line below it.
+- **`ConversionRouter:221`** — `DeviceCodecs.PERMISSIVE.canDecode` returning **false** for
+  `InputProbe.UNPARSEABLE`. `PERMISSIVE` has no production caller at all (tests only), and the
+  router's one `canDecode` call at `:128` is already preceded by `:117` returning FFMPEG for
+  `UNPARSEABLE`. **Its KDoc at `:214-217` is false as written:**
+
+  > That exception matters: a device double that claims it can decode an unparseable file would let
+  > the router send a doomed job to Media3.
+
+  It would not — `:117` already caught it. This is F2's shape: a comment that describes a hazard the
+  code upstream has removed. Correcting it is a one-line change and should not be bundled with
+  anything.
+- **`ContainerCapabilities:297`** — `if (container == GIF || container == IMAGE_SEQUENCE) return null`
+  in `repair`. `repair`'s only caller is `suggestions` (`:281`); `validate` returns at `:121` for
+  `isImageOutput` (which is exactly GIF ∥ IMAGE_SEQUENCE) before `suggestions` is reached, and
+  `firstContainerHolding` filters on `CARRIES_VIDEO`, which is empty for both.
+- **`ContainerCapabilities:324` and `:340`** — the `else ->` arms themselves are exercised; what is
+  missed is the elvis tail, `firstOrNull() ?: VideoCodec.NONE` / `?: AudioCodec.NONE`. Reaching it
+  needs a container with no encodable codec on that axis. Audio-only containers return early at
+  `:307`, and the only containers with an empty audio set are GIF and IMAGE_SEQUENCE, excluded at
+  `:297` above.
+
+**Recorded so the next read does not re-file them.** F4's rule applies unchanged: a second line of
+defence that can be provoked is not a second line of defence, and widening a private function to make
+one reachable buys a test that asserts a fallback fires when called in a way production cannot call
+it.
+
+---
+
+## F7 — `probeWithExtractor`'s catch is unreachable for the same measured reason `probeForConcat`'s is
+
+**Severity: n/a · No action · completes a measurement already on record**
+
+```
+app/src/main/java/org/libremediaconverter/convert/MediaProbe.kt:180-182
+```
+
+```kotlin
+} catch (e: Exception) {
+    Log.i(TAG, "Platform extractor could not read $uri.", e)
+    null
+}
+```
+
+`CLAUDE.md` records the measurement for the *other* extractor site: Robolectric's `MediaExtractor`
+never throws from `setDataSource`, checked across an unregistered `content://` authority, a missing
+`file://`, a file of garbage bytes and an `http://` URL — all four returned with `trackCount = 0`.
+
+`probeWithExtractor` calls the same overload, three lines apart in the same file, and the measurement
+covers it identically. It was simply not written down for this site, so a future read would re-derive
+it. It stays device-only, alongside `probeForConcat`'s.
+
+**Two neighbouring line counts are artifacts of this, not separate gaps.** `MediaProbe:184` and
+`:331` each report 27 missed instructions and are the `finally` block's synthetic exception-path copy
+— JaCoCo duplicates a `finally` per exit path, and the exceptional one is unreachable for the reason
+above. Do not read them as a third and fourth site.
+
+---
+
+## F8 — Three more dead members, and six unused defaults
+
+**Severity: low · Confirmed by inspection · F3's family**
+
+```
+app/src/main/java/org/libremediaconverter/model/CopyPlanner.kt:28          ConversionPlan.hasVideo
+app/src/main/java/org/libremediaconverter/codec/AndroidDeviceCodecs.kt:39  hardwareEncoders()
+app/src/main/java/org/libremediaconverter/ffmpeg/ConcatEngine.kt:30        Result.output
+app/src/main/java/org/libremediaconverter/convert/Transcoders.kt:28, :29, :40, :61
+app/src/main/java/org/libremediaconverter/work/Reattachment.kt:28, :30
+```
+
+- **`ConversionPlan.hasVideo`** — zero callers in `main`, `test` or `androidTest`. Every `hasVideo`
+  hit in the tree is `InputProbe.hasVideo`, `OutputSpec.hasVideo` or `Container.extensionFor(hasVideo)`,
+  which are different properties on different types. A test asserting
+  `plan.hasVideo == (plan.video != VideoPlan.Drop)` is vacuous by construction.
+- **`AndroidDeviceCodecs.hardwareEncoders()`** — its only caller is `RealMediaBenchmark`, in
+  `androidTest`. Production reads capabilities through `DeviceCodecs`, never the raw set.
+- **`ConcatEngine.Result.output`** — `ConcatWorker` reads `result.strategy` and uses the `staged`
+  file it passed in, never `.output`.
+- **`Transcoders.kt`'s default arguments** — `request` and `onProgress` on
+  `HardwareTranscoder.transcode` (`:28`, `:29`), `onProgress` on `SoftwareTranscoder.run` (`:40`),
+  and `format` on `ConcatJoiner.join` (`:61`). All three production call sites
+  (`ConversionWorker.kt:208`, `:234`, `ConcatWorker.kt:79`) pass every argument, so the synthesised
+  `$default` bridges and `$DefaultImpls` copies are never entered. The
+  `request: ConversionRequest = ConversionRequest(OutputFormat.MP4_H265.spec)` default is the one
+  worth a second look: nothing anywhere omits it, so an interface silently promises H.265 to a
+  caller that does not exist.
+- **`JobSnapshot`'s `outputModifiedAt` and `tags` defaults** — `JobSnapshots.kt:32-42` passes all
+  seven fields, so the synthesised `$default` constructor (20 missed instructions at
+  `Reattachment.kt:14`) is never entered.
+
+**Not a test gap, for F3's reason.** Delete them, or keep them and know they are unused; either is a
+decision, and a test restating the compiler is not.
+
+---
+
+## F9 — Both workers' `getForegroundInfo` overrides are dead, and this is why
+
+**Severity: n/a · No action · sharpens #88 rather than reopening it**
+
+```
+app/src/main/java/org/libremediaconverter/work/ConversionWorker.kt:342-346
+app/src/main/java/org/libremediaconverter/work/ConcatWorker.kt:132-136
+```
+
+**#88 already closed on these**, after reading both and finding no decision worth a seam — the
+correct call, and it stands. What #88 did not name is the reason they are cold in the first place,
+which is stronger than "the JVM cannot reach them":
+
+WorkManager calls `getForegroundInfoAsync()` **only for expedited work**. `ConversionWorker`'s own
+KDoc says expedited is deliberately not used, and `grep -rn 'setExpedited\|OutOfQuotaPolicy' app/src`
+returns nothing. So both overrides are dead in production today, not merely untested — a test would
+assert the shape of something nothing invokes.
+
+They are still correct to keep: `ForegroundInfo` is required by the `CoroutineWorker` contract and
+`setForeground` is called explicitly elsewhere. **What would reopen this** is the same trigger #88
+named — a `getForegroundInfo` that starts branching — plus one more: the day anything calls
+`setExpedited`.
+
+---
+
+## F10 — Three arms that are reachable, uncovered, and cannot be made to bite
+
+**Severity: n/a · No action · the shape a coverage number cannot distinguish**
+
+```
+app/src/main/java/org/libremediaconverter/convert/ConversionViewModel.kt:550, :553
+app/src/main/java/org/libremediaconverter/join/JoinViewModel.kt:349, :352, :278
+```
+
+F4 and F6 hold arms that cannot be *reached*. These can — and a test written against them would still
+pass under the mutation that ought to redden it, which is the harder case to spot and the more
+expensive one to discover halfway through writing the test.
+
+- **`observer?.cancel()`'s non-null arm** (`ConversionViewModel:550`, `JoinViewModel:349`). Reachable
+  by calling `convert()` twice. But `ScreenOwnership`'s token is what actually blocks the superseded
+  write — the ViewModel's own KDoc at `reset()` says the cancel is "a request honoured at the next
+  suspension point" and "the claim is what actually stops that write". Delete `observer?.cancel()`
+  and the suite stays green, correctly.
+- **`if (info == null) return@collect`** (`ConversionViewModel:553`, `JoinViewModel:352`). Reachable
+  through `pruneWork()`. But when the null arrives the state is already terminal, so removing the
+  guard crashes the collector and **leaves the state unchanged** — a state assertion is green under
+  the mutation. The only observable is an escaped coroutine exception, which the ViewModel's own KDoc
+  documents as unreliable on the JVM: kotlinx-coroutines-test's process-wide collector hands it to
+  whichever `runTest` starts next.
+- **`JoinViewModel:278`'s `Ambiguous` arm.** Looks like the twin of `ReattachGuardsTest`'s "a result
+  two jobs both claim", and is not. An `Ambiguous` requires a shared `outputPath`, so it can only be a
+  *finished* job — which maps to `Joined`, a state that reads nothing from `inputs`. **The Convert-side
+  twin does bite**, because `displayNameOf(tags)` reaches the file card; the asymmetry is the point.
+
+**Recorded because each of these was picked up as a candidate and put down again.** The wave-4 read
+lost time to all three before the mutation test was run in the head rather than the editor, which is
+the cheaper order.
+
+---
+
 ## Summary

 | ID | Finding | Severity | Evidence | Action |
@@ -271,12 +449,23 @@ no way to make it happen now.
 | F3 | `ConversionRequest.videoCodec` / `.audioCodec` have no callers | low | confirmed by inspection | delete, or keep for symmetry — **not** a test gap |
 | F4 | Two private guards reachable only by direct call | n/a | confirmed by inspection | **no action** — named exemption, per #88 |
 | F5 | `ConversionNotifications.areEnabled()` is never called | low | confirmed by inspection; grep returns the declaration only | **decide**: act on it or delete it — **not** a test gap |
+| F6 | Four more unreachable arms; `ConversionRouter:214-217`'s KDoc is false | low | confirmed by inspection; each traced to its upstream guard | **no action**, except the one-line KDoc fix |
+| F7 | `probeWithExtractor`'s catch is unreachable, as `probeForConcat`'s is | n/a | measured across four URI shapes (recorded in `CLAUDE.md`) | **no action** — device-only, now written down for both sites |
+| F8 | Three more dead members and six unused defaults | low | confirmed by inspection; grep per member | delete or keep knowingly — **not** a test gap |
+| F9 | Both `getForegroundInfo` overrides are dead: expedited work is never used | n/a | confirmed by inspection; `grep setExpedited` returns nothing | **no action** — sharpens #88's close |
+| F10 | Three reachable arms where no mutation bites | n/a | confirmed by inspection; each mutation traced to its masking guard | **no action** — recorded to stop the next read re-picking them |

 Order, if these are acted on: **F1 and F5 first, separately.** They are the two with a possible
 user-visible answer — a format the app can produce and does not offer, and a warning the app
-documents and does not give — and either answer changes what the tidying should look like. F2 and F3
-are tidying and belong in one commit with each other, not with F1 or F5. F4 is finished by being
-written down.
+documents and does not give — and either answer changes what the tidying should look like. F2, F3 and
+F8 are tidying and belong in one commit with each other, not with F1 or F5. F6's KDoc correction is a
+third kind: one line, no decision, and it should not wait on the tidying. F4, F7, F9 and F10 are
+finished by being written down.
+
+**Six of the ten are now "no action" or "not a test gap", and that is the useful shape.** By wave 4
+the report's remaining red is mostly this: arms nothing can reach, members nothing calls, and arms a
+test can reach but not pin. A coverage number cannot tell any of them from a real gap, which is why
+this document exists and why it grows faster than the percentage moves.

 **F1 and F5 share a shape worth naming:** both are places where a comment describes behaviour the
 code does not have, and in both the tempting fix (delete the dead arm, test the dead method) would
@@ -287,7 +476,15 @@ freeze the wrong answer in place. The decision comes first.
 **The test gaps from the same read.** Seven JVM-side gaps (**#132**) and three seam questions
 (**#133**) came out of this coverage read and are tracked there, because they are work rather than
 observations. This document holds only what a test would not fix. #133 also records why
-`AndroidDeviceCodecs.probe()` was considered and left out, so that spike is not run a third time.
+`AndroidDeviceCodecs.probe()` was considered and left out **through `ShadowMediaCodecList`**, so that
+spike is not run a third time.
+
+**Updated 2026-09-02:** #194 proposes reaching the same code through a *pure seam* instead, which is a
+different mechanism and one #133 did not evaluate — the builder objection it turns on (no
+`setIsAlias`, no `setCanonicalName`) does not apply to a function taking its own entry type. #133's
+close stands for the shadow; it is not a close on the seam. #194 also carries the reason the seam is
+worth cutting at all, which is not coverage: the `runCatching` fallback logs "assuming permissive" and
+returns empty sets, which makes `canEncode` and `canDecode` answer *no* for everything.

 **`ConversionForegroundType.current()`**, which looked like the sharpest gap in the read and is not.
 Its API 33 and 34 arms are cold on the JVM, but issue **#88** already established that the class is
@@ -321,6 +518,25 @@ the real ones — **34 of 383** and **20 of 143** missed — and the screens are
 better-covered files in the repo, which is what #52, #57 and #61 were for. **Do not chase the
 branch number here.** If a future read wants a screen metric, use lines.

+**Updated 2026-09-02: the same codegen inflates the *instruction* count, which wave 3's filter did
+not allow for.** Wave 3 selected candidates on `mi > 0` — at least one missed instruction — which was
+right to prefer over a bare branch count and is still wrong on these files. `JoinScreen.kt:222` reads
+`mi=10` and looks uncovered; it also reads `ci=38`, and `JoinStateAffordancesTest` already clicks that
+Save button and asserts `save:joined.mp4`. Every `onClick` lambda body flagged this way turned out to
+be covered at method level, the missed instructions being the recomposition-skip path again.
+
+Use `ci == 0` — the line never executed, which is JaCoCo's own missed-line definition — and pair it
+with a method-level `ci > 0 && mb > 0` pass for covered methods with cold arms. Neither filter alone
+is enough: `ConversionViewModel.cancel()` misses no line at all, yet its non-null arm had never been
+entered in 584 tests (#192). `CLAUDE.md`'s coverage entry carries the same correction.
+
+**Also codegen, also not gaps**, recorded once so they are not re-derived: the synthetic
+`NoWhenBranchMatchedException` closing an exhaustive `when` (`ConverterScreen:399`, `:686`,
+`JoinScreen:278`, `MainActivity:160`); the inner `is Idle -> Unit` arms at `ConverterScreen:253-254`
+and `JoinScreen:158-159`, which are structurally unreachable because the outer `when` already routed
+`Idle`; and the closing brace of a `launch` block whose `collect` never terminates
+(`ConversionViewModel:578`, `JoinViewModel:371`).
+
 **Anything requiring a device.** `MediaProbe`'s FFprobe half (`MediaProbe.kt:151, 156-158, 173-188`)
 and `FFmpegEngine` in full report 0% on the JVM and are covered by `androidTest`. JaCoCo measures
 `testDebugUnitTest` only; their zeroes are a boundary, as #84, #85, #86 and #88 each recorded