Merge remote-tracking branch 'origin/main' into m-115b-tmp

Count the annotation, not the comment saying a test does not carry it

.github/scripts/e2e-report-shape-test.sh

@@ -0,0 +1,193 @@
+#!/usr/bin/env bash
+#
+# Exercises e2e-report-shape.sh's baseline counter against fixture source, with no emulator and
+# no CI run. Run it directly:
+#
+#   .github/scripts/e2e-report-shape-test.sh
+#
+# WHY THIS CAN EXIST AT ALL: the counter is a pure function of the working tree. It greps
+# `app/src/androidTest` for `@FailsOnEmulatorApi37` and compares the total against the number
+# committed in FailsOnEmulatorApi37.kt. Nothing about that needs a device, which is the whole
+# reason #120 could be measured rather than argued about.
+#
+# WHY A THROWAWAY REPO ROOT rather than a knob on the script. The report finds its own root from
+# `BASH_SOURCE`, so a copy of it placed at `<root>/.github/scripts/` reads `<root>/app/src/...`.
+# Building that root is three mkdirs and costs the shipped script nothing:
+#
+#   - the REAL script is what runs, byte for byte, so reverting the matcher reddens this test
+#     rather than a testing-only code path beside it;
+#   - no environment variable exists that could point the LIVE count somewhere else, which is
+#     the failure mode #83 built the baseline check to prevent in the first place;
+#   - XML_DIR resolves inside the throwaway root, so a stale app/build/outputs left by a real
+#     run on a developer machine cannot leak into the numbers here.
+#
+# WHAT IT GUARDS (#120). The old matcher looked for the string anywhere on any line, so a KDoc
+# saying `Deliberately not @FailsOnEmulatorApi37` counted as a marked test and every PR got a
+# deviation notice that was wrong. The obvious repair -- count only lines that are nothing but
+# the annotation -- silently stops counting `@FailsOnEmulatorApi37 @Test`, which is legal Kotlin,
+# and undercounting is the direction that hides a genuine new marker. The fixture carries every
+# shape at once -- three that count and three that must not, enumerated in its own header -- so
+# both mistakes fail here instead of on a PR: against testdata/marker-shapes the old matcher says
+# 5, own-line-only says 2, and the shipped one 3.
+#
+# NOT WIRED INTO CI, deliberately and as a known gap. Adding a step to the Static analysis job
+# would add a new way for a gating job to go red, and #120 was explicit that nothing about it may
+# change any job's status or the pass/fail rules. shellcheck still covers this file, since that
+# step reads `git ls-files '*.sh'` rather than a fixed list.
+set -uo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPORT="$SCRIPT_DIR/e2e-report-shape.sh"
+FIXTURE_DIR="$SCRIPT_DIR/testdata/marker-shapes"
+FIXTURE="$FIXTURE_DIR/MarkerShapes.kt"
+
+TMP="$(mktemp -d)"
+# Single quotes: the path is expanded when the trap fires, not when it is set.
+trap 'rm -rf -- "$TMP"' EXIT
+
+failures=0
+
+pass() { printf 'ok    %s\n' "$1"; }
+
+fail() {
+  failures=$((failures + 1))
+  printf 'FAIL  %s\n' "$1"
+  shift
+  printf '        %s\n' "$@"
+}
+
+# assert_contains <name> <haystack> <needle>
+# `case` rather than grep: the strings being matched carry backticks and an em dash, and this
+# way neither the shell nor a regex engine gets an opinion about them.
+assert_contains() {
+  case "$2" in
+    *"$3"*) pass "$1" ;;
+    *) fail "$1" "wanted to find: $3" "in:" "$2" ;;
+  esac
+}
+
+assert_absent() {
+  case "$2" in
+    *"$3"*) fail "$1" "did NOT want to find: $3" "in:" "$2" ;;
+    *) pass "$1" ;;
+  esac
+}
+
+# make_root <marked-tree-dir> <baseline-number>
+# Assembles a throwaway repo root around the given tree and prints its path.
+make_root() {
+  local tree="$1" baseline="$2" root testdir
+  root="$(mktemp -d "$TMP/root.XXXXXX")"
+  testdir="$root/app/src/androidTest/java/org/libremediaconverter"
+  mkdir -p "$root/.github/scripts" "$testdir"
+  cp -- "$REPORT" "$root/.github/scripts/"
+  cp -- "$tree"/*.kt "$testdir/"
+
+  # The synthetic stand-in for the committed baseline. Its KDoc names the marker the way the real
+  # file does -- in brackets, never with an `@` -- because the real file lives inside the tree
+  # being counted, so an `@` spelling here would add a phantom to every number below.
+  cat > "$testdir/FailsOnEmulatorApi37.kt" <<EOF
+package org.libremediaconverter
+
+/** Stand-in for the real marker file. Only [FAILS_ON_EMULATOR_API37_BASELINE] is read. */
+const val FAILS_ON_EMULATOR_API37_BASELINE = $baseline
+EOF
+
+  # A clean, untruncated run of exactly <baseline> tests, all failing -- which is what the
+  # advisory leg looks like when nothing has drifted. It leaves the marked count as the only
+  # field that can deviate, so every assertion below is about the thing under test.
+  cat > "$root/gradle.log" <<EOF
+> Task :app:connectedDebugAndroidTest
+Starting $baseline tests on test(AVD) - 16
+There was $baseline failure(s).
+EOF
+
+  printf '%s\n' "$root"
+}
+
+# run_report <root>  -- stdout of the real script; its summary lands in <root>/summary.md.
+run_report() {
+  E2E_WEDGED_AFTER='' GITHUB_STEP_SUMMARY="$1/summary.md" \
+    bash "$1/.github/scripts/e2e-report-shape.sh" 37 "$1/gradle.log" \
+    "$1/app/src/androidTest/java/org/libremediaconverter/FailsOnEmulatorApi37.kt"
+}
+
+# ---------------------------------------------------------------------------
+# The fixture still carries every shape.
+#
+# Three of the checks below are covered twice over -- deleting a real annotation moves the count
+# and fails a case further down. The two decoys are not: drop the KDoc mention and the count
+# stays 3, so the precision this whole ticket is about would stop being tested and nothing would
+# say so. That asymmetry is why the shapes are asserted by name rather than only by their effect
+# on the total.
+# ---------------------------------------------------------------------------
+fixture_text="$(cat -- "$FIXTURE")"
+assert_contains "fixture: the import"           "$fixture_text" 'import org.libremediaconverter.FailsOnEmulatorApi37'
+assert_contains "fixture: annotation own line"  "$fixture_text" '
+    @FailsOnEmulatorApi37
+    @Test'
+assert_contains "fixture: annotation with @Test on one line" "$fixture_text" '@FailsOnEmulatorApi37 @Test'
+assert_contains "fixture: annotation nested and indented" "$fixture_text" '
+        @FailsOnEmulatorApi37'
+assert_contains "fixture: KDoc mention (this is #120)" "$fixture_text" "* Deliberately not \`@FailsOnEmulatorApi37\`"
+assert_contains "fixture: commented-out annotation" "$fixture_text" '// @FailsOnEmulatorApi37'
+
+# ---------------------------------------------------------------------------
+# 1. The fixture's three real annotations against a baseline of 3: no deviation.
+#
+# This one case fails under both wrong matchers -- the old one counts 5, own-line-only counts 2 --
+# which is why it is first.
+# ---------------------------------------------------------------------------
+root="$(make_root "$FIXTURE_DIR" 3)"
+out="$(run_report "$root")"
+assert_contains "3 real markers, baseline 3: reports a match" "$out" '  baseline: matches (3 expected, 3 failed)'
+assert_absent   "3 real markers, baseline 3: says nothing about the tree" "$out" 'the tree carries'
+assert_contains "3 real markers, baseline 3: summary agrees" \
+  "$(cat -- "$root/summary.md")" '**Matches the committed baseline of 3**'
+
+# ---------------------------------------------------------------------------
+# 2. A fourth REAL annotation. The count has to move and the deviation has to fire.
+#
+# The important half of #120: precision was the bug, but a matcher that stopped noticing a new
+# marker would have been a worse one, silently.
+# ---------------------------------------------------------------------------
+plus_one="$(mktemp -d "$TMP/plusone.XXXXXX")"
+cp -- "$FIXTURE" "$plus_one/"
+cat > "$plus_one/FourthMarker.kt" <<'EOF'
+package org.libremediaconverter.fixture
+
+class FourthMarker {
+    @FailsOnEmulatorApi37
+    @Test
+    fun addedToday() = Unit
+}
+EOF
+root="$(make_root "$plus_one" 3)"
+out="$(run_report "$root")"
+assert_contains "a 4th real marker: the deviation fires, and counts 4" "$out" \
+  "  baseline DEVIATION: the tree carries 4 tests marked \`@FailsOnEmulatorApi37\` but the baseline says 3 — update FAILS_ON_EMULATOR_API37_BASELINE"
+assert_contains "a 4th real marker: the summary carries it too" "$(cat -- "$root/summary.md")" \
+  "- the tree carries 4 tests marked \`@FailsOnEmulatorApi37\` but the baseline says 3"
+
+# ---------------------------------------------------------------------------
+# 3. Delete the same-line annotation and the count must drop to 2.
+#
+# This is the trap, pinned down. `@FailsOnEmulatorApi37 @Test` on one line is what separates the
+# shipped matcher from `^[[:space:]]*@NAME[[:space:]]*$`, and without this case the fixture entry
+# guarding it could be deleted as decoration -- case 1 would then pass under the wrong matcher.
+# Here the same-line entry is worth exactly one, and it is asserted to be.
+# ---------------------------------------------------------------------------
+minus_same_line="$(mktemp -d "$TMP/minus.XXXXXX")"
+sed -e '/@FailsOnEmulatorApi37 @Test/d' -- "$FIXTURE" > "$minus_same_line/MarkerShapes.kt"
+root="$(make_root "$minus_same_line" 3)"
+out="$(run_report "$root")"
+assert_contains "same-line annotation removed: counts 2, so it was worth 1" "$out" \
+  "  baseline DEVIATION: the tree carries 2 tests marked \`@FailsOnEmulatorApi37\` but the baseline says 3 — update FAILS_ON_EMULATOR_API37_BASELINE"
+
+echo
+if [ "$failures" -eq 0 ]; then
+  echo "e2e-report-shape-test.sh: all checks passed"
+  exit 0
+fi
+echo "e2e-report-shape-test.sh: $failures check(s) failed"
+exit 1

.github/scripts/e2e-report-shape.sh

@@ -0,0 +1,353 @@
+#!/usr/bin/env bash
+#
+# Reports the SHAPE of an instrumented run -- how many tests were expected, how many
+# reported, how many failed, and whether the run completed at all -- to the step log and to
+# the job summary. In advisory mode it also compares that shape against a committed baseline
+# and says plainly whether it matches.
+#
+# WHY THIS EXISTS (#83): the advisory API 37 leg is red on every PR by design, so a NEW failure
+# joining the known ones is invisible -- nothing in a red X distinguishes "the known ones" from
+# "the known ones plus yours". CLAUDE.md tells everyone not to read that job's red as their
+# change breaking something, which is correct, and which also means nobody looks.
+#
+# WHY NOT A BARE FAILURE COUNT, measured rather than assumed. On this image the run is usually
+# truncated: `Test run failed to complete. Expected 3 tests, received 2.` with
+# `INSTRUMENTATION_ABORTED: System has crashed.` A count taken from a truncated run misleads in
+# both directions -- a fourth marked test can still yield the same number if the abort lands
+# earlier, and the known set getting worse can LOWER it. So all four fields are recorded, and
+# the one saying the run was truncated is recorded with them.
+#
+# WHY IT IS A SEPARATE SCRIPT rather than a function inside e2e-run.sh: it is a pure seam. It
+# reads a captured log plus the test XML and writes a report, so it can be run against a REAL
+# log saved from a REAL CI run -- which is how the baseline comparison was shown to fire
+# without waiting on an emulator. `git ls-files '*.sh'` also picks it up for shellcheck for
+# free.
+#
+# THIS SCRIPT NEVER FAILS A RUN. It is a diagnostic, and e2e-run.sh's header explains why that
+# rule is absolute here. Every field defaults to `unknown` and every comparison is guarded,
+# because an unset variable under `set -u`, or a `[ "" -eq 3 ]`, is exactly how a diagnostic
+# becomes the thing that turns a leg red. It exits 0 unconditionally.
+#
+# Usage:
+#   e2e-report-shape.sh <label> <gradle-log> [<baseline-file>]
+#   E2E_WEDGED_AFTER=<seconds>   the wrapper timeout killed gradle after that many seconds
+#
+# With a third argument the run is compared against the baseline in that file (advisory mode)
+# and a `::notice::` is emitted per deviation. NEVER `::error::`: the advisory job is
+# `continue-on-error: true` and stays that way, and an error annotation would be a new way for
+# a diagnostic to change a conclusion.
+#
+# WHY THE WEDGE ARRIVES AS AN ENV VAR (#118) rather than being read out of the log like every
+# other field: there is nothing in the log to read. A wedge is gradle never returning, so gradle
+# never printed a verdict, never printed a truncation line, and never aborted instrumentation --
+# the log of a wedged leg is the log of a run that simply stops. Measured on job 98035980326:
+# `expected: 59`, `received: 59`, `completed cleanly: yes`, six seconds before the wedge warning,
+# for a leg that the timeout had killed 22 minutes in. Only e2e-run.sh knows, because only it
+# saw `timeout` exit 124, so it says so. Guessing it from a log that ends abruptly would call
+# every cancelled run a wedge.
+#
+# It is read as a STRING and only ever interpolated into one. `[ -n ... ]`, never `-gt`: it
+# crosses a process boundary from a shell that deliberately sets it EMPTY on every non-wedge
+# path, and an arithmetic test on an empty string is the header's rule four paragraphs up.
+set -uo pipefail
+
+LABEL="${1:-unknown}"
+LOG="${2:-}"
+BASELINE_FILE="${3:-}"
+WEDGED_AFTER="${E2E_WEDGED_AFTER:-}"
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "$SCRIPT_DIR/../.." && pwd)"
+XML_DIR="$REPO_ROOT/app/build/outputs/androidTest-results/connected/debug"
+
+# Gradle colours its output even when it is piped, so `FAILED` arrives wrapped in escape codes.
+# The numeric lines parsed below are not coloured, but stripping is cheap insurance against a
+# pattern that would otherwise silently match nothing.
+ESC="$(printf '\033')"
+scan() { [ -s "$LOG" ] && sed -e "s/${ESC}\[[0-9;]*[a-zA-Z]//g" -- "$LOG"; }
+first_number() { grep -oE '[0-9]+' | head -1; }
+
+# ---------------------------------------------------------------------------
+# Source 1: the runner's own output. This is the ONLY place a truncation is visible. The test
+# XML read below is written even for an aborted run and says nothing whatever about the abort
+# -- measured on run 32865281555, where the XML reports a tidy tests="3" failures="3" for a run
+# the runner had just described as truncated. That is the reason this parses stdout at all.
+# ---------------------------------------------------------------------------
+starting_line="$(scan | grep -aoE 'Starting [0-9]+ tests on .*' | tail -1)"
+abort_line="$(scan | grep -aoE 'Test run failed to complete\. Expected [0-9]+ tests, received [0-9]+\.' | tail -1)"
+aborted_hits="$(scan | grep -ac 'INSTRUMENTATION_ABORTED' || true)"
+failure_line="$(scan | grep -aoE 'There was [0-9]+ failure\(s\)\.' | tail -1)"
+failed_names="$(scan | grep -aoE 'Execute [A-Za-z0-9_.$]+: FAILED' | sed -e 's/^Execute //' -e 's/: FAILED$//' | sort -u)"
+
+expected="$(printf '%s' "$starting_line" | first_number)"
+expected_src="\`$starting_line\`"
+abort_expected="$(printf '%s' "$abort_line" | grep -oE 'Expected [0-9]+' | first_number)"
+abort_received="$(printf '%s' "$abort_line" | grep -oE 'received [0-9]+' | first_number)"
+log_failed="$(printf '%s' "$failure_line" | first_number)"
+
+# `Starting N tests` is missing when the framework restarted under the run and Gradle never got
+# a test list. The truncation line still carries the number it was told to expect.
+if [ -z "$expected" ] && [ -n "$abort_expected" ]; then
+  expected="$abort_expected"
+  expected_src="\`$abort_line\`"
+fi
+
+# ---------------------------------------------------------------------------
+# Source 2: the JUnit XML. Measured on both a truncated advisory run and a green gating leg:
+# `<testsuites tests="N" failures="M">` is present in both, and aggregates every suite. It is
+# the authority on how many results landed and how many were failures. It is NOT an authority
+# on whether the run finished, which is what source 1 is for.
+# ---------------------------------------------------------------------------
+#
+# Read ONLY when the runner said a test run happened. `app/build` survives between runs on a
+# developer machine -- tools/local-emulator/run-e2e.sh drives several API levels against one
+# checkout -- so a leg that never got as far as starting tests would otherwise be reported from
+# the previous leg's XML, which is a wrong answer rather than a missing one.
+xml_head=""
+xml_count=0
+if [ -n "$starting_line$abort_line" ] && [ -d "$XML_DIR" ]; then
+  while IFS= read -r f; do
+    xml_count=$((xml_count + 1))
+    [ -z "$xml_head" ] && xml_head="$(grep -ao '<testsuites[^>]*>' "$f" | head -1)"
+  done < <(find "$XML_DIR" -maxdepth 1 -name 'TEST-*.xml' -print 2> /dev/null | sort)
+fi
+xml_tests="$(printf '%s' "$xml_head" | grep -oE ' tests="[0-9]+"' | first_number)"
+xml_failed="$(printf '%s' "$xml_head" | grep -oE ' failures="[0-9]+"' | first_number)"
+
+# ---------------------------------------------------------------------------
+# Derive the four fields, each with where its number came from. Everything stays a string, so a
+# missing source reads `unknown` rather than becoming 0 -- a report claiming 0 tests when it
+# merely could not see them would announce a deviation on every cancelled run.
+# ---------------------------------------------------------------------------
+received="unknown"
+received_src="no source"
+if [ -n "$xml_tests" ]; then
+  received="$xml_tests"
+  received_src="test XML \`<testsuites tests=\"$xml_tests\">\`"
+elif [ -n "$abort_received" ]; then
+  received="$abort_received"
+  received_src="\`$abort_line\`"
+elif [ -n "$expected" ] && [ -z "$abort_line" ]; then
+  received="$expected"
+  received_src="the run was not truncated, so every expected test reported"
+  # ... unless it was killed, in which case "not truncated" is only "gradle never got as far as
+  # saying so". This is the branch the wedged leg in #118 took -- with no XML written yet, the
+  # number is what the runner was TOLD to run, and the source line said the opposite in the same
+  # table that called the leg clean. The number is deliberately left alone: it is still the best
+  # available answer, and only the claim about where it came from was wrong.
+  [ -n "$WEDGED_AFTER" ] \
+    && received_src="no test XML was written and gradle never printed a truncation line — but the leg was killed mid-run, so this is what it was told to run, not what reported"
+fi
+
+failed="unknown"
+failed_src="no source"
+if [ -n "$xml_failed" ]; then
+  failed="$xml_failed"
+  failed_src="test XML \`<testsuites failures=\"$xml_failed\">\`"
+elif [ -n "$log_failed" ]; then
+  failed="$log_failed"
+  failed_src="\`$failure_line\`"
+fi
+
+if [ -z "$expected" ]; then
+  expected="unknown"
+  expected_src="no \`Starting N tests\` line"
+fi
+
+# A run whose start nobody can see is not a run of zero tests. Cancellation (this workflow sets
+# cancel-in-progress) and the `Starting 0 tests` shape a framework restart produces both land
+# here, and both have to say so rather than compare a number that does not exist.
+no_run="none"
+if [ "$expected" = "unknown" ] && [ "$received" = "unknown" ]; then
+  no_run="nothing"
+elif [ "$expected" = "0" ]; then
+  no_run="zero"
+fi
+
+if [ -n "$abort_line" ]; then
+  completed="**no**"
+  completed_src="\`$abort_line\` with \`INSTRUMENTATION_ABORTED\`"
+elif [ "${aborted_hits:-0}" -gt 0 ]; then
+  completed="**no**"
+  completed_src="\`INSTRUMENTATION_ABORTED\` in the runner output"
+elif [ "$no_run" = "nothing" ]; then
+  # "cleanly" would be a lie about a run that left no evidence it happened.
+  completed="unknown"
+  completed_src="no runner output to read"
+elif [ -n "$WEDGED_AFTER" ]; then
+  # The wedge is checked LAST of the four, so it only ever overrides the `yes`. The two "no"s
+  # above are already right and name the abort, which the wedge row does not; `unknown` is
+  # already right too. A wedge on top of an abort is both facts, and both get printed.
+  completed="**no**"
+  completed_src="the wrapper timeout killed gradle after ${WEDGED_AFTER}s — instrumentation itself was never aborted, which is why nothing in the log says so"
+else
+  completed="yes"
+  completed_src="no truncation line and no \`INSTRUMENTATION_ABORTED\`"
+fi
+
+# ---------------------------------------------------------------------------
+# Advisory mode: compare against the committed baseline.
+#
+# ONE number covers both compared fields, and that is deliberate rather than a shortcut. The
+# marker means "cannot pass on this image", so the number of tests carrying it is both how many
+# the advisory leg should run and how many should fail. A smaller `failed` means one now passes
+# -- which is the trigger to delete the annotation, written down in FailsOnEmulatorApi37.kt.
+# ---------------------------------------------------------------------------
+#
+# `advisory` and `baseline` are two variables on purpose. "A comparison was asked for" and "a
+# number was found to compare against" are different facts, and collapsing them is how this
+# report would go quietly back to being the thing #83 filed: the `sed` below is anchored, so
+# indenting the const into an object -- or renaming it, or moving it to another file -- empties
+# `baseline`, and a single flag would take the whole comparison down with it while the table
+# kept printing. An unreadable baseline is itself a deviation, and is announced as one.
+advisory="no"
+baseline=""
+marked=""
+deviations=()
+if [ -n "$BASELINE_FILE" ]; then
+  advisory="yes"
+  [ -f "$BASELINE_FILE" ] \
+    && baseline="$(sed -nE 's/^const val FAILS_ON_EMULATOR_API37_BASELINE = ([0-9]+).*/\1/p' "$BASELINE_FILE" | head -1)"
+  # What the tree actually carries. Reported next to the baseline so a stale baseline shows up
+  # here rather than only once the emulator disagrees with it.
+  #
+  # ANCHORED AT LINE START, AND WHITESPACE-OR-END-OF-LINE AFTER THE NAME (#120). The #81 check
+  # this replaces matched the string anywhere on any line, so #113's KDoc reading `Deliberately
+  # not @FailsOnEmulatorApi37` counted as a fourth marked test and the report announced a
+  # deviation on every PR. That is worse than a wrong number: #83 built this so a new failure
+  # could not be invisible, and a notice that is wrong every time teaches everyone to skim past
+  # deviation notices.
+  #
+  # THE OBVIOUS REPAIR IS A TRAP, and the reason for the second half of the pattern.
+  # `^[[:space:]]*@NAME[[:space:]]*$` -- "the annotation on a line of its own" -- also stops
+  # counting `@FailsOnEmulatorApi37 @Test`, which is legal Kotlin, and UNDERcounting is the
+  # dangerous direction: it hides a genuine new marker, which is the one thing this exists to
+  # catch. Measured against `testdata/marker-shapes`, a fixture carrying every shape at once:
+  # the old matcher says 5, own-line-only says 2, this one says 3. On the real tree, 4 / 3 / 3.
+  # e2e-report-shape-test.sh runs that fixture through this whole script.
+  #
+  # `^[[:space:]]*@` cannot match an `import` line, so the old `grep -v import` goes with it
+  # rather than staying to imply a filter is still doing work.
+  #
+  # This is a regex over source text and not a parser. An annotation inside a multi-line string,
+  # or inside a `/* */` block that opened mid-line, would still be counted. Neither exists here;
+  # if one ever does, this check wants a different tool rather than a longer regex.
+  if [ -d "$REPO_ROOT/app/src/androidTest" ]; then
+    marked="$(grep -rhcE '^[[:space:]]*@FailsOnEmulatorApi37([[:space:]]|$)' \
+      "$REPO_ROOT/app/src/androidTest" --include='*.kt' \
+      | awk '{ total += $1 } END { print total + 0 }' || true)"
+  fi
+fi
+
+if [ "$advisory" = "yes" ] && [ -z "$baseline" ]; then
+  deviations+=("the committed baseline could not be read from \`$(basename -- "$BASELINE_FILE")\` — has \`FAILS_ON_EMULATOR_API37_BASELINE\` been renamed, indented into a class, or moved? Nothing was compared")
+fi
+
+if [ -n "$baseline" ]; then
+  if [ "$no_run" = "nothing" ]; then
+    deviations+=("no test run observed — the runner never reported starting one, where the baseline expects $baseline tests carrying \`@FailsOnEmulatorApi37\`")
+  elif [ "$no_run" = "zero" ]; then
+    deviations+=("the runner started 0 tests, where the baseline expects $baseline — on this image that is the framework having restarted under the run, not an empty test list")
+  else
+    if [ "$expected" != "unknown" ] && [ "$expected" != "$baseline" ]; then
+      deviations+=("the runner started $expected tests, the baseline is $baseline")
+    fi
+    if [ "$failed" != "unknown" ] && [ "$failed" != "$baseline" ]; then
+      deviations+=("$failed tests failed, the baseline is $baseline — every test carrying the marker is expected to fail on this image, so fewer means one now passes and more means a new one joined")
+    fi
+  fi
+  if [ -n "$marked" ] && [ "$marked" != "$baseline" ]; then
+    deviations+=("the tree carries $marked tests marked \`@FailsOnEmulatorApi37\` but the baseline says $baseline — update FAILS_ON_EMULATOR_API37_BASELINE")
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Emit. Step log first, so the common case needs neither the summary page nor an artifact.
+# ---------------------------------------------------------------------------
+echo "----- RUN SHAPE (api${LABEL}) -----"
+echo "  expected:          $expected"
+echo "  received:          $received"
+echo "  failed:            $failed"
+# Above `completed cleanly`, because it is the line that says what happened to the leg and the
+# other one only qualifies it. A reader who stops after three rows still sees it.
+if [ -n "$WEDGED_AFTER" ]; then
+  echo "  wedged:            yes -- gradle was killed after ${WEDGED_AFTER}s and never returned"
+fi
+echo "  completed cleanly: ${completed//\*/}"
+if [ -n "$abort_received" ]; then
+  echo "  received before the abort: $abort_received"
+fi
+if [ -n "$failed_names" ]; then
+  echo "  failed tests:"
+  printf '%s\n' "$failed_names" | sed -e 's/^/    /'
+fi
+if [ "$advisory" = "yes" ]; then
+  if [ "${#deviations[@]}" -eq 0 ]; then
+    echo "  baseline: matches ($baseline expected, $baseline failed)"
+  else
+    printf '  baseline DEVIATION: %s\n' "${deviations[@]}"
+  fi
+fi
+
+# A notice, never an error. See the header.
+if [ "${#deviations[@]}" -gt 0 ]; then
+  for d in "${deviations[@]}"; do
+    echo "::notice::E2E api${LABEL}: $d"
+  done
+fi
+
+if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+  {
+    echo "### E2E api${LABEL} — run shape"
+    echo
+    echo "| field | value | where it came from |"
+    echo "| --- | --- | --- |"
+    echo "| expected | $expected | $expected_src |"
+    echo "| received | $received | $received_src |"
+    echo "| failed | $failed | $failed_src |"
+    if [ -n "$WEDGED_AFTER" ]; then
+      echo "| wedged | **yes** | \`timeout\` fired after ${WEDGED_AFTER}s and killed gradle (exit 124), which is what e2e-run.sh then captured the wedge diagnostics for |"
+    fi
+    echo "| completed cleanly | $completed | $completed_src |"
+    if [ -n "$abort_received" ]; then
+      echo "| received before the abort | $abort_received | the same line — the XML above counts the truncated test as a failure, this number does not |"
+    fi
+    echo
+    if [ -n "$failed_names" ]; then
+      echo "Failed:"
+      echo
+      printf '%s\n' "$failed_names" | sed -e 's/^/- `/' -e 's/$/`/'
+      echo
+    fi
+    if [ "$xml_count" -gt 1 ]; then
+      echo "> $xml_count test XML files were present; the counts above come from the first."
+      echo
+    fi
+    if [ "$advisory" = "yes" ]; then
+      if [ "${#deviations[@]}" -eq 0 ]; then
+        echo "**Matches the committed baseline of $baseline** — $baseline tests carry \`@FailsOnEmulatorApi37\` and all $baseline failed, which is what this job is for."
+      elif [ -z "$baseline" ]; then
+        echo "**The committed baseline could not be read, so nothing was compared.** Announced as a notice, not an error: this job is advisory and its conclusion is unchanged by anything here."
+        echo
+        printf -- '- %s\n' "${deviations[@]}"
+      else
+        echo "**DEVIATION from the committed baseline of $baseline.** Announced as a notice, not an error: this job is advisory and its conclusion is unchanged by anything here."
+        echo
+        printf -- '- %s\n' "${deviations[@]}"
+      fi
+      echo
+      echo "<sub>The baseline lives beside the marker, in \`FailsOnEmulatorApi37.kt\`. \`completed cleanly\` is recorded rather than compared: the truncation is intermittent — of eight advisory runs read on 2026-08-25, seven aborted and one did not — so comparing it would announce a deviation on a run that is fine.</sub>"
+    else
+      echo "<sub>No baseline comparison: that is the advisory API 37 leg only. The shape is recorded here anyway because a truncated run reports fewer results than it ran, which is what issue #108 looks like on a gating leg.</sub>"
+    fi
+    echo
+  } >> "$GITHUB_STEP_SUMMARY"
+  # The summary page is the deliverable -- "readable without opening a log" is what #83 asked
+  # for -- and GitHub exposes no API for reading a job summary back, so a write that silently
+  # did not happen would be invisible. This line is in the step log, which can be read.
+  echo "  (the table above is also on the job summary page)"
+else
+  echo "  (GITHUB_STEP_SUMMARY is unset -- step log only)"
+fi
+
+exit 0

.github/scripts/e2e-run.sh

@@ -34,6 +34,13 @@ TMP="${RUNNER_TEMP:-/tmp}"
 LOGCAT_LOG="$TMP/logcat-api${LABEL}.txt"
 DIAG_LOG="$TMP/diagnostics-api${LABEL}.txt"
 WEDGE_LOG="$TMP/wedge-diagnostics-api${LABEL}.txt"
+# Gradle's own output, captured to a file as well as the step log, because the run-shape report
+# below has to parse it. Uploaded with the diagnostics, so a report that reads wrong can be
+# checked against what it read.
+GRADLE_LOG="$TMP/gradle-api${LABEL}.txt"
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "$SCRIPT_DIR/../.." && pwd)"
 
 # ~5 min is a healthy leg (measured across API 33-36), and this wraps only the gradle client,
 # a subset of that. 20 min is generous enough never to trip on a slow-but-working run, and far
@@ -214,18 +221,60 @@ status=0
 # script rather than forking it: that runs several API levels back to back against one checkout
 # and passes `--rerun`, so a level cannot be skipped as up-to-date and report the previous
 # level's results as its own. CI gets a fresh runner per level and does not need it.
+#
+# `2>&1 | tee`, and the `2>&1` is the load-bearing half. The step log merges both streams, so
+# reading one cannot tell you which stream a line came from -- and the single line the report
+# below needs most, `Test run failed to complete. ... INSTRUMENTATION_ABORTED`, is not on
+# stdout. Capturing stdout alone would leave the report saying "completed cleanly: yes" forever,
+# which is precisely the comparison that cannot fire. pipefail is already set and tee exits 0,
+# so the pipeline's status is still gradle's -- including the 124 that means the wrapper fired.
+#
+# `tee` and not `tee -a`, unlike the logcat above: CI gets a fresh runner per leg, but
+# tools/local-emulator/run-e2e.sh reuses one machine, and an appended log would have the report
+# reading the PREVIOUS run of the same API level. The console goes plain rather than showing
+# gradle's live progress bar, which is what it already did in CI.
 # shellcheck disable=SC2086
 timeout -k 30s "$WEDGE_TIMEOUT" \
   ./gradlew :app:connectedDebugAndroidTest -PabiFilters=x86_64 --stacktrace \
-  ${E2E_EXTRA_GRADLE_ARGS:-} || status=$?
+  ${E2E_EXTRA_GRADLE_ARGS:-} 2>&1 | tee "$GRADLE_LOG" || status=$?
 echo "::endgroup::"
 
+# Whether the wrapper timeout fired, decided ONCE. 124 is `timeout` saying it killed the
+# command, and two places downstream need that fact: capture_wedge below, and the report, which
+# otherwise calls a killed leg `completed cleanly: yes` (#118). Deriving it twice is how those
+# two would drift apart -- the report would keep printing after someone changed what a wedge
+# means here. It stays a string: empty on every other path, so those legs pass an empty
+# E2E_WEDGED_AFTER and the report behaves exactly as before.
+wedged=""
+[ "$status" -eq 124 ] && wedged="$WEDGE_TIMEOUT"
+
+# The run-shape report: expected/received/failed and whether the run finished, every time,
+# green or red. It never changes `status` -- it is a diagnostic, and the header's rule about
+# diagnostics applies to it as much as to every probe below.
+#
+# E2E_WEDGED_AFTER is the wedge, told to the report rather than left for it to infer. It cannot
+# be inferred: a wedge is gradle never returning, so gradle printed no verdict at all, and the
+# log the report reads looks like a run that simply stopped. Only this script knows the
+# difference, because only this script saw the exit status.
+#
+# The baseline argument, and only it, turns on the comparison, and only the advisory API 37 job
+# passes E2E_ADVISORY=1. Comparing on the gating legs would announce a deviation on all five of
+# them every run, since they run the whole suite rather than the marked three. They still get
+# the report: a truncated run reporting fewer results than it ran is what #108 looks like, and
+# `completed cleanly` is the field that shows it.
+if [ "${E2E_ADVISORY:-}" = "1" ]; then
+  E2E_WEDGED_AFTER="$wedged" bash "$SCRIPT_DIR/e2e-report-shape.sh" "$LABEL" "$GRADLE_LOG" \
+    "$REPO_ROOT/app/src/androidTest/java/org/libremediaconverter/FailsOnEmulatorApi37.kt" || true
+else
+  E2E_WEDGED_AFTER="$wedged" bash "$SCRIPT_DIR/e2e-report-shape.sh" "$LABEL" "$GRADLE_LOG" || true
+fi
+
 if [ "$status" -eq 0 ]; then
   kill "$LOGCAT_PID" 2>/dev/null || true
   exit 0
 fi
 
-if [ "$status" -eq 124 ]; then
+if [ -n "$wedged" ]; then
   capture_wedge "api${LABEL}"
 else
   echo "::error::E2E api${LABEL} failed (exit $status)"

.github/scripts/testdata/marker-shapes/MarkerShapes.kt

@@ -0,0 +1,54 @@
+// NOT A TEST, AND NEVER COMPILED. This is fixture data for e2e-report-shape-test.sh, which
+// copies it into a throwaway repo root and runs the real report script against that. It lives
+// under .github/ deliberately: Gradle only compiles app/src/**, ktlint and detekt are applied to
+// :app only, and the report's own count reads app/src/androidTest -- so nothing here can reach
+// the build, the linters, or the number the advisory job compares against. Verified by running
+// the report against the real repo root with this file committed: still 3.
+//
+// It carries every shape the counter has to tell apart, in one file, because the bug in #120 was
+// exactly that two of them look alike to a substring match. Three count and three must not:
+//
+//   COUNTS       the annotation on its own line
+//   COUNTS       the annotation sharing a line with @Test -- legal Kotlin, and the case the
+//                obvious "own line only" repair silently drops
+//   COUNTS       the annotation indented inside a nested class
+//   must NOT     a KDoc mentioning it -- this is #120 itself, copied from Media3EngineTest
+//   must NOT     a commented-out annotation
+//   must NOT     the import
+//
+// Three count. That is what the synthetic baseline in the test is set to, so the fixture and the
+// baseline agree exactly the way the real tree and FAILS_ON_EMULATOR_API37_BASELINE do.
+//
+// The `@Test` here is spelled the way a real test spells it so the fixture reads like source
+// rather than like a regex exercise. Nothing runs it.
+
+package org.libremediaconverter.fixture
+
+import org.junit.Test
+import org.libremediaconverter.FailsOnEmulatorApi37
+
+class MarkerShapes {
+    @FailsOnEmulatorApi37
+    @Test
+    fun ownLine() = Unit
+
+    @FailsOnEmulatorApi37 @Test
+    fun sameLineAsTest() = Unit
+
+    /**
+     * Deliberately not `@FailsOnEmulatorApi37`: nothing here decodes or encodes, so no emulator
+     * codec is involved and the API 37 image has no quarrel with it.
+     */
+    @Test
+    fun mentionedInKdoc() = Unit
+
+    // @FailsOnEmulatorApi37 -- taken off on 2026-01-01, kept as a note rather than deleted
+    @Test
+    fun commentedOut() = Unit
+
+    class Nested {
+        @FailsOnEmulatorApi37
+        @Test
+        fun indentedDeeper() = Unit
+    }
+}

.github/workflows/build.yml

@@ -13,6 +13,17 @@ on:
 # reference amounts to running whatever that repository contains tomorrow. This matters
 # more here than on pull requests: these jobs sign nothing today, but they do publish
 # the artifacts people install.
+# Declared here rather than inherited, for the reason status_check.yml gives for its own
+# block: the token's reach should be readable in the file that uses it, and a repository
+# default that widens later should not silently widen these jobs with it. The repository
+# default is `read` today, so this changes nothing about what runs -- it fixes what a
+# reader can know without leaving the file, and it is what CodeQL alert #1 asked for.
+#
+# The `release` job below overrides this with `contents: write`, which is how job-level
+# permissions work: this is a default, not a ceiling.
+permissions:
+  contents: read
+
 env:
   GRADLE_CACHE_PATHS: |
     ~/.gradle/caches
@@ -81,7 +92,11 @@ jobs:
 
       - name: Verify the released artifacts
         run: |
-          APK=$(ls app/build/outputs/apk/release/*.apk | head -1)
+          # A glob, not `ls | head`: the glob is already here, and parsing ls is what
+          # SC2012 is about. Gradle's names have no spaces today, which is exactly the
+          # kind of assumption that holds until it does not.
+          apks=(app/build/outputs/apk/release/*.apk)
+          APK="${apks[0]}"
           # A release that shipped one ABI, or lost 16 KB alignment, would install
           # fine on a test device and fail for users or at Play submission. Both are
           # cheap to check and expensive to discover later.

.github/workflows/status_check.yml

@@ -182,6 +182,23 @@ jobs:
           docker run --rm "$SHELLCHECK" --version
           git ls-files -z '*.sh' | xargs -0 -r docker run --rm -v "$PWD:/mnt" "$SHELLCHECK"
 
+      # actionlint closes the half shellcheck cannot see. The step above reads .sh files;
+      # a good deal of this repo's bash lives in inline `run:` blocks instead -- the release
+      # verification here, the emulator setup and teardown in this file and in
+      # api37-debug.yml. actionlint parses each workflow and runs shellcheck over every
+      # `run:`, on top of its own checks for expression syntax, `needs:` references, matrix
+      # keys and action input names.
+      #
+      # Pinned by digest for the same reason shellcheck is, and with a second reason of its
+      # own: actionlint's documented install is `bash <(curl -s .../download-actionlint.bash)`
+      # off a moving branch, which would sit badly in a repo that pins every action by SHA.
+      - name: actionlint
+        env:
+          ACTIONLINT: rhysd/actionlint@sha256:9d36088643581e728c969f35141f88139fec77280b2be23c1f66f8e40e1025e7
+        run: |
+          docker run --rm "$ACTIONLINT" -version
+          docker run --rm -v "$PWD:/repo" -w /repo "$ACTIONLINT" -color
+
       # `!cancelled()` rather than a plain sequence: a shellcheck failure above must not
       # cost the ktlint/detekt/lint lists. Same reason this step passes --continue -- one
       # round trip should produce every list, not stop at the first.
@@ -240,17 +257,38 @@ jobs:
           # CAVEAT, read this before trusting a green here: this leg runs with
           # SystemUI disabled and the framework restarted under it. No other leg
           # and no Pixel run uses that configuration. It is defensible only because
-          # nothing in this suite touches system UI -- these are Media3, FFmpeg and
+          # nothing THIS LEG RUNS touches system UI -- Media3, FFmpeg and
           # WorkManager tests -- and because the alternative is no CI coverage of
           # the level this app targets. **Anything that ever does depend on system
           # UI must not trust this row.** E2E_DISABLE_SYSTEM_UI is what does it;
           # .github/scripts/e2e-run.sh explains the mechanism and why every step of
           # it is verified rather than assumed.
           #
-          # api-level must be "37.0". A bare 37 is not an SDK package and fails
-          # during setup, which cost a run to discover.
+          # "this leg" and not "this suite", since 2026-08-24, and the difference is
+          # now load-bearing: SafPickerRoundTripTest DOES touch system UI. It drives
+          # DocumentsUI and rotates the display, and both reach the gralloc mapper
+          # this image aborts in -- disabling SystemUI removes the IDLE trigger, not
+          # those. Measured per method on android-37.0: the ROTATION test takes the
+          # framework down (INSTRUMENTATION_ABORTED) and carries
+          # @FailsOnEmulatorApi37, so notAnnotation below keeps it off this row; the
+          # PICKER test passes and runs here like anything else. A rotation rebuilds
+          # every surface at once, and starting another app's activity does not.
           #
-          # notAnnotation removes the two tests that do not pass on this image; they
+          # So this row does now run one test that depends on system UI, and the
+          # caveat above still applies to it: a green here is not evidence the picker
+          # works on a device with SystemUI running -- the Pixel release check is.
+          # docs/api-37-emulator-crash.md has the per-method measurements, and the
+          # correction that produced them.
+          #
+          # api-level must be a POINT release. A bare 37 is not an SDK package and
+          # fails during setup, which cost a run to discover. `37.0` is the choice
+          # here rather than the only option: `37.1` and `37.2-beta*` exist and
+          # abort the same way, and api37-debug.yml's inputs document both, with
+          # the wrinkle that above 37.0 they ship only as google_apis_ps16k.
+          # docs/api-37-emulator-crash.md measures 37.0 rev 6 and 37.1 rev 8 side
+          # by side, so pinning 37.0 is a decision, not a constraint.
+          #
+          # notAnnotation removes the three tests that do not pass on this image; they
           # run in the advisory job below, off the same marker so they cannot end up
           # in both or neither. docs/api-37-emulator-crash.md has the measurements.
           - label: "37"
@@ -339,6 +377,7 @@ jobs:
           path: |
             ${{ runner.temp }}/logcat-api${{ matrix.label }}.txt
             ${{ runner.temp }}/diagnostics-api${{ matrix.label }}.txt
+            ${{ runner.temp }}/gradle-api${{ matrix.label }}.txt
           if-no-files-found: warn
 
       # Only exists when the wrapper timeout tripped, so `ignore` keeps healthy runs quiet
@@ -351,7 +390,7 @@ jobs:
           if-no-files-found: ignore
 
   # ---------------------------------------------------------------------------
-  # The two API 37 tests the gating row above excludes, run on their own so they
+  # The three API 37 tests the gating row above excludes, run on their own so they
   # stay visible instead of disappearing behind a notAnnotation.
   #
   # continue-on-error: it reports, it never blocks. That is the whole reason it is
@@ -359,17 +398,29 @@ jobs:
   # job's `E2E API <label>` name, and a check cannot be both required and advisory
   # under one name.
   #
-  # It is named for WHAT IT RUNS, deliberately. Both tests drive a full H.264 ->
-  # H.265 hardware transcode through Media3Engine -- which is exactly what
-  # separates them from the two Media3EngineTest cases that pass here, since those
-  # two never decode video. The current theory about why they fail is in the next
-  # paragraph, where it can be corrected without renaming a check that people have
-  # already learned to look for.
+  # It was named for WHAT IT RUNS, and that is now APPROXIMATE rather than exact.
+  # When this job was created it held two tests, both driving a full H.264 -> H.265
+  # hardware transcode through Media3Engine -- which is exactly what separated them
+  # from the two Media3EngineTest cases that pass here, since those two never decode
+  # video. Since 2026-08-25 it also holds SafPickerRoundTripTest's rotation case,
+  # which drives no transcode at all: a real rotation rebuilds every surface at once
+  # and takes the framework down on this image (INSTRUMENTATION_ABORTED), which is a
+  # different failure from the decoder one below.
+  #
+  # The name is kept anyway, and that is a decision rather than an oversight. This is
+  # not a required context, it is red on every PR by design, and it is one people
+  # have learned to look for -- renaming a check costs more than the imprecision
+  # does. **The marker is the definition, not the name:** what this job holds is the
+  # tests that cannot pass on the API 37 emulator image, whatever their subject. The
+  # theory about the Media3 pair is in the next paragraph, where it can be corrected
+  # without touching the name.
   #
   # THEORY, NOT SETTLED: the exception surfaces at `dequeueOutputBuffer` on
   # `c2.goldfish.h264.decoder`, the emulator's own codec, which gets its frames out
   # of a host-side colour buffer -- the same readback machinery that aborts
-  # surfaceflinger on this image. What is MEASURED is narrower: these two fail on
+  # surfaceflinger on this image. It is about the MEDIA3 PAIR only; the rotation
+  # case above fails for its own reason. What is MEASURED is narrower: those two
+  # fail on
   # the API 37 emulator image; pass at API 36 on this runner under the same renderer
   # AND the same SystemUI-disable path; pass at API 33-36 without that path at all,
   # since nothing below 37 needs it; and pass on a physical Pixel 10 Pro XL at 37. That the decoder is the culprit rather than something else
@@ -417,6 +468,12 @@ jobs:
           # The complement of the gating row's notAnnotation, off the same marker,
           # so a test can never be excluded from both jobs or run in both.
           E2E_EXTRA_GRADLE_ARGS: "-Pandroid.testInstrumentationRunnerArguments.annotation=org.libremediaconverter.FailsOnEmulatorApi37"
+          # Turns on the baseline comparison in the run-shape report, and only here. Every leg
+          # prints the shape; this is the one that also says whether it matches
+          # FAILS_ON_EMULATOR_API37_BASELINE, because this is the one whose test list is the
+          # marker. A deviation is a `::notice::` -- this job stays continue-on-error and stays
+          # out of the required contexts, so nothing the report finds can change a conclusion.
+          E2E_ADVISORY: "1"
         with:
           # Every device pin below matches the gating row exactly, so a difference
           # between the two jobs is the test selection and nothing else.
@@ -449,6 +506,7 @@ jobs:
           path: |
             ${{ runner.temp }}/logcat-api${{ env.E2E_LABEL }}.txt
             ${{ runner.temp }}/diagnostics-api${{ env.E2E_LABEL }}.txt
+            ${{ runner.temp }}/gradle-api${{ env.E2E_LABEL }}.txt
           if-no-files-found: warn
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

CLAUDE.md

@@ -64,16 +64,50 @@ of the first one that fails.
 on this machine (below), so without it an androidTest compile error is not discovered until CI.
 ktlint and detekt also cover the `test`/`androidTest` source sets that `lintDebug` skips.
 
-## Instrumented tests do not run locally
+## Instrumented tests: where they actually run
 
-Two independent reasons, so do not spend time on either:
+This section said the opposite until 2026-08-24, and both of its claims had been false for two
+days. Read it as the current answer, and see the git history if you need the old one.
 
-- **Emulators segfault on this host.** qemu dies on every AVD. Instrumented tests run on CI or on
-  the physical Pixel, never in a local emulator.
-- **The API 37 image is broken.** `android-37.0` crash-loops surfaceflinger inside its own gralloc
-  mapper, so every test fails there regardless of this app. `docs/api-37-emulator-crash.md` records
-  the evidence and the ruled-out fixes; CI's matrix therefore stops at API 36 even though targetSdk
-  is 37. **API 37 needs a manual check on the Pixel 10 Pro XL before each release.**
+- **Local emulators work, for API 33-36.** `tools/local-emulator/run-e2e.sh` runs them on this
+  host. The segfault that made this look impossible was not a broken machine: SwiftShader's Reactor
+  JIT writes generated shader code onto the heap and executes it, Fedora's SELinux policy denies
+  `execheap`, and qemu dies. Choosing a different renderer avoids it entirely — `-gpu host`,
+  `angle_indirect` and `swangle_indirect` all boot, while `auto`, `off`, `guest` and
+  `swiftshader_indirect` do not. `docs/local-emulator.md` has the evidence and the per-API renderer
+  table.
+- **CI runs API 37, and it gates.** The matrix is 33/34/35/36/37. **Three** of the 60 instrumented
+  tests cannot pass on that image, for two unrelated reasons: two Media3 hardware transcodes fail
+  inside the emulator's own `c2.goldfish.h264.decoder`, and one SAF test takes the framework down
+  when it rotates the display. All three carry `@FailsOnEmulatorApi37` and run in a separate
+  `continue-on-error` job; the gating leg runs the other 57.
+
+  That job is still called `E2E API 37 Media3 hardware transcode (advisory)`, which no longer
+  describes everything in it. The name is kept deliberately — it is not a required context and
+  people have learned to look for it — so **read the marker, not the name**, for what it holds.
+  **It is red on every PR, by design**: do not read it as your change breaking something, and do
+  not read a green run as evidence those three tests pass.
+  `docs/api-37-emulator-crash.md` has the measurements.
+
+  **That instruction is also why nobody looks, so the job now reports its own shape** — expected,
+  received, failed, and whether the run completed — to the job summary, and compares it against
+  `FAILS_ON_EMULATOR_API37_BASELINE`, committed beside the marker. A deviation is a `::notice::`;
+  the job stays advisory and its conclusion is untouched. **Add or remove a `@FailsOnEmulatorApi37`
+  and that number changes in the same diff**, or the next run says so. A bare failure count would
+  not have worked: the run is usually truncated by an `INSTRUMENTATION_ABORTED`, and the test XML
+  is written anyway and says nothing about it — `.github/scripts/e2e-report-shape.sh` is where that
+  is measured and explained.
+
+  Every leg prints that table, advisory or not, and **on the wedge path it also carries a `wedged:`
+  row** (#118). `completed cleanly` only ever meant "instrumentation was not aborted", which stays
+  true of a leg the `WEDGE_TIMEOUT` killed 22 minutes in — so without that row the table read
+  `received: 59, completed cleanly: yes` for a leg that had just died. The wedge is passed to the
+  report as `E2E_WEDGED_AFTER` by `e2e-run.sh`, which is the only thing that can know it: a wedge
+  is gradle never returning, so the log it left says nothing about it.
+
+Still true, and the reason the advisory job is not simply deleted: **API 37 needs a manual check on
+the Pixel 10 Pro XL before each release.** Those three tests are the one thing CI cannot answer
+for.
 
 On a device or emulator, build only the ABI it can execute:
 
@@ -96,12 +130,29 @@ install for code that can never run — and on API 37 the full APK does not fit
 - The `model` package is excluded from `ReturnCount` and `CyclomaticComplexMethod` only. It is the
   decision layer, where one branch is one documented user-visible outcome and the metric counts
   answers rather than complexity. Every other rule still applies there.
-- **Coverage is reported, not gated** — **29.8% of lines (629/2113), 28.7% of branches**, measured
-  on `main` 2026-08-23 with `./gradlew :app:jacocoTestReport`. A floor needs a baseline that has
-  settled first, and this one has not: the figure **fell** from the ~31% recorded earlier even
-  though the JVM suite went from 11 test files to 43. Main source grew 4,114 -> 5,715 lines over
-  the same period, so the denominator outran the numerator. Re-measure before quoting it; do not
-  assume more tests means a higher percentage here.
+- **Coverage is reported, not gated** — **84.9% of lines (1971/2321), 63.8% of branches**,
+  measured 2026-08-26 with `./gradlew :app:jacocoTestReport`, against 454 JVM tests in 67 classes.
+
+  **Every figure this file carried before 2026-08-24 was an artifact, roughly half the real one.**
+  Robolectric loads classes through its own sandbox classloader with no source location, JaCoCo
+  skips no-location classes by default, and nothing told it otherwise — so **not one Robolectric
+  test counted**, and Robolectric is what exercises the framework edge here. The
+  `isIncludeNoLocationClasses` block in `app/build.gradle.kts` is what fixes it; **do not delete
+  it as stray config**, and re-run the numbers if you ever touch it. Same commit, same 335 tests:
+  29.7% -> 69.2% with that block alone.
+
+  The old entry also explained the wrong thing. It said coverage **fell** as the suite grew from 11
+  test files to 43 because "the denominator outran the numerator" on framework-edge code "the JVM
+  cannot reach". The JVM reaches that code fine. What actually happened is that the new tests were
+  disproportionately Robolectric, so each one added denominator and no numerator — the measurement
+  was punishing exactly the tests that were hardest to write.
+
+  Two things still hold. A floor needs a baseline that has settled, and this one has not: it moved
+  39 points in a single build change on 2026-08-24, then another 16 as the #52 test push and the
+  fixes it turned up landed — 69.2% -> 84.9% line, 53.2% -> 63.8% branch — while the denominator
+  grew 2194 -> 2321, because that work added production code of its own. And **re-measure before
+  quoting**: this entry was written quoting 81.4%, measured four hours earlier, and was already
+  three points stale by the time it was ready to merge.
 - **Testable code is not done until it is tested.** If a piece is unit testable, it gets unit
   tests before it counts as done. If it is e2e testable, it gets e2e tests. Both clauses apply —
   a change that is both needs both.
@@ -112,9 +163,9 @@ install for code that can never run — and on API 37 the full APK does not fit
     documents the reasoning — turns "needs a device" into "a pure function plus a thin edge".
     Robolectric is in the JVM source set, `compose-ui-test-junit4` with it, so Compose screens are
     unit testable too. Reach for the seam before concluding something cannot be unit tested.
-  - **E2E is runnable locally now.** `tools/local-emulator/run-e2e.sh` runs API 33-36 on this
-    machine; see `docs/local-emulator.md`. That was believed impossible until the SELinux/renderer
-    cause was found, and it is what makes the e2e half of this norm enforceable.
+  - **E2E is runnable locally**, API 33-36, via `tools/local-emulator/run-e2e.sh` — see
+    "Instrumented tests: where they actually run" above. That was believed impossible until the
+    SELinux/renderer cause was found, and it is what makes the e2e half of this norm enforceable.
   - **A test has to bite.** Revert the line it covers, confirm it goes red, restore. A review of
     this codebase ran 46 mutations against a 257-test suite and **9 were vacuous** — five of them
     passing the whole suite over a completely unguarded code path. Green is not evidence.
@@ -153,11 +204,12 @@ install for code that can never run — and on API 37 the full APK does not fit
   `podman run --rm -v "$PWD:/mnt:z" docker.io/koalaman/shellcheck@sha256:61862eba... <files>`
   (the digest is in `status_check.yml`; there is no shellcheck system package on this host).
 
-  **It does not cover inline `run:` blocks in the workflows**, and a good deal of this repo's bash
-  lives there. `actionlint` does cover them — it runs shellcheck over each `run:` — and reports one
-  pre-existing `info` finding in `build.yml`. It is not wired in because every action here is
-  pinned by SHA, and actionlint's usual installer is a `curl | bash` off a moving branch; doing it
-  properly means pinning a container digest. Tracked separately rather than bolted on.
+  **`actionlint` covers the half shellcheck cannot see** — the inline `run:` blocks, where a good
+  deal of this repo's bash lives. It runs shellcheck over each `run:` plus its own checks on
+  expression syntax, `needs:` references, matrix keys and action inputs. It sits in the same job,
+  **pinned by digest** for the reason above and one of its own: its documented installer is a
+  `curl | bash` off a moving branch, which does not belong in a repo that pins every action by SHA.
+  Locally: `podman run --rm -v "$PWD:/repo:z" -w /repo docker.io/rhysd/actionlint@sha256:9d360886... -color`.
 
 ## Dependency versions
 

README.md

@@ -113,7 +113,14 @@ container × codec matrix — including combinations that cannot work, which it
 offers alternatives for rather than hiding.
 
 Conversions run as durable background work, so they survive leaving the app and are
-restored after a restart.
+restored when you reopen it.
+
+One case is not restored, and it is worth knowing about. If Android refuses to let a job
+restart in the background, it is retried on an exponential backoff for about eight and a
+half hours and then given up on — and a job that has been given up on does not come back
+when you reopen the app. Reopening the app is what grants permission to run, so a
+conversion that has stalled this way is best started again from the app rather than waited
+on.
 
 ## Building
 

app/build.gradle.kts

@@ -1,3 +1,4 @@
+import org.gradle.api.tasks.PathSensitivity
 import org.gradle.testing.jacoco.tasks.JacocoReport
 
 plugins {
@@ -188,6 +189,40 @@ detekt {
 }
 
 // Pin the coverage agent rather than inheriting whatever Gradle bundles.
+// Robolectric loads every class it touches through its own sandbox classloader, and those
+// classes arrive with no source location. JaCoCo skips no-location classes by default, so
+// without this block **not one Robolectric test counts** -- and Robolectric is what exercises
+// the framework edge here: the workers, the publisher, both ViewModels, every Compose screen.
+//
+// Measured on e06b082, same 335 tests, same 0 failures, only this block added:
+//
+//     LINE    29.7% -> 69.2%        OutputPublisher      0.0% -> 97.5%
+//     BRANCH  29.8% -> 53.2%        ConversionViewModel  0.0% -> 85.4%
+//
+// The discriminator, if this ever looks like superstition: inside ConverterScreenKt, `describe`
+// is the one non-Composable and is exercised by a plain JVM test -- it reported 8/8 covered while
+// every @Composable in the same class reported 0, including ones whose mutations demonstrably
+// failed the build when reverted.
+//
+// `excludes` is not optional. Without it JaCoCo walks JDK-internal classes that Robolectric has
+// no location for either, and the test JVM dies rather than reporting a number.
+tasks.withType<Test>().configureEach {
+    // ReleasePermissionTest reads .github/workflows/build.yml, and Gradle cannot infer that a
+    // test depends on a file outside the source set. Without this the task stays UP-TO-DATE
+    // when the workflow changes, so the guard goes stale exactly when it matters. Measured:
+    // deleting the release job's `contents: write` and re-running gave "BUILD SUCCESSFUL in
+    // 614ms" with the test never executing; the same mutation under --rerun-tasks failed it.
+    // A guard that does not re-run when its subject changes is not a guard.
+    inputs.file(rootProject.file(".github/workflows/build.yml"))
+        .withPropertyName("releaseWorkflow")
+        .withPathSensitivity(PathSensitivity.RELATIVE)
+
+    extensions.configure<JacocoTaskExtension> {
+        isIncludeNoLocationClasses = true
+        excludes = listOf("jdk.internal.*")
+    }
+}
+
 jacoco {
     toolVersion = libs.versions.jacoco.get()
 }
@@ -211,8 +246,11 @@ val jacocoGeneratedExcludes = listOf(
 )
 
 // AGP 9 compiles Kotlin through its built-in compiler, which writes here rather than to the
-// classic `tmp/kotlin-classes/debug`. All hand-written code in this module is Kotlin, so the
-// javac output (BuildConfig and R only) is not read at all.
+// classic `tmp/kotlin-classes/debug`. All hand-written code in the MAIN source set is Kotlin, so
+// the javac output (BuildConfig and R only) is not read at all. There is now one hand-written
+// Java file in the module -- androidTest's FixtureDocumentsProvider, which cannot be Kotlin
+// because the process it runs in has no Kotlin stdlib; its own header explains why. It is in
+// androidTest, so it is not in this task's classDirectories and this stays accurate.
 val jacocoDebugKotlinClasses = layout.buildDirectory.dir(
     "intermediates/built_in_kotlinc/debug/compileDebugKotlin/classes",
 )
@@ -306,9 +344,9 @@ dependencies {
     // the tests stay green.
     testImplementation(platform(libs.compose.bom))
     testImplementation(libs.compose.ui.test.junit4)
-    // For `runTest` alone, in EscapedCoroutineErrors.kt. It arrives transitively with the
-    // rule above anyway; declared because a test file imports it directly, and an import of
-    // something nobody asked for breaks the day the library that pulled it in stops.
+    // For `runTest` alone, in ConversionViewModelProbeFailureTest. It arrives transitively
+    // with the rule above anyway; declared because a test file imports it directly, and an
+    // import of something nobody asked for breaks the day the library that pulled it in stops.
     testImplementation(libs.kotlinx.coroutines.test)
 
     androidTestImplementation(platform(libs.compose.bom))
@@ -316,5 +354,11 @@ dependencies {
     androidTestImplementation(libs.androidx.espresso.core)
     androidTestImplementation(libs.compose.ui.test.junit4)
     androidTestImplementation(libs.androidx.work.testing)
+    // androidTest only, and it has to be: UiAutomator drives the whole device, including
+    // windows belonging to other packages. The system file picker is one -- DocumentsUI runs
+    // in its own process, so Compose's matchers cannot see it and Espresso's cannot either
+    // (both are scoped to this process's view hierarchy). Nothing on the JVM has a device to
+    // drive, so there is no unit-test counterpart to add it to.
+    androidTestImplementation(libs.androidx.uiautomator)
     debugImplementation(libs.compose.ui.test.manifest)
 }

app/src/androidTest/AndroidManifest.xml

@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  The first manifest this source set has ever had, and it exists for one component.
+
+  SafPickerRoundTripTest drives the real system file picker. DocumentsUI only shows what a
+  DocumentsProvider offers it, so a test that picks a file needs a provider to pick from, and
+  that provider has to be declared: a ContentProvider is instantiated by the system from a
+  manifest entry and cannot be registered from test code.
+
+  It is declared HERE rather than in src/debug on purpose. src/debug would put a fake storage
+  root inside the shipped debug APK, where it would show up in every developer's own file
+  picker and in every other app's; this way it is installed only by the instrumentation APK,
+  alongside the test that needs it, and is gone the moment that APK is uninstalled.
+
+  The four attributes are not decoration. Each one is required for the picker to see it:
+
+    exported             DocumentsUI is another app; an unexported provider is invisible to it.
+    permission           MANAGE_DOCUMENTS is held by DocumentsUI and essentially nothing else,
+                         so this is what stops any installed app from reading the fixture. The
+                         provider is exported to the *picker*, not to the world.
+    grantUriPermissions  How the app under test ends up able to read the URI it was handed. The
+                         picker returns the document URI with FLAG_GRANT_READ_URI_PERMISSION,
+                         and that flag does nothing unless the provider allows grants. Without
+                         it the pick "succeeds" and every read of the result fails.
+    DOCUMENTS_PROVIDER   The action DocumentsUI queries the package manager for. No filter, no
+                         root in the drawer.
+
+  The authority carries the .test suffix because this component belongs to the instrumentation
+  package (org.libremediaconverter.test), not to the app. Authorities are global to the device:
+  reusing the app's would collide with the app on any device where both are installed.
+-->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <application>
+        <provider
+            android:name="org.libremediaconverter.saf.FixtureDocumentsProvider"
+            android:authorities="org.libremediaconverter.test.fixtures"
+            android:exported="true"
+            android:grantUriPermissions="true"
+            android:permission="android.permission.MANAGE_DOCUMENTS">
+            <intent-filter>
+                <action android:name="android.content.action.DOCUMENTS_PROVIDER" />
+            </intent-filter>
+        </provider>
+    </application>
+
+</manifest>

app/src/androidTest/java/org/libremediaconverter/FailsOnEmulatorApi37.kt

@@ -18,7 +18,38 @@ package org.libremediaconverter
  * Removing it is the goal, and the trigger is written down: a new API 37.x system image, or an
  * ATD image for 37. Delete the annotation from the tests, and the advisory job goes empty and
  * the gating one grows by two.
+ *
+ * **How many tests carry it is committed below**, as [FAILS_ON_EMULATOR_API37_BASELINE], and the
+ * advisory job checks the run against it. Adding or removing a marker means changing that number
+ * in the same diff.
  */
 @Retention(AnnotationRetention.RUNTIME)
 @Target(AnnotationTarget.CLASS, AnnotationTarget.FUNCTION)
 annotation class FailsOnEmulatorApi37
+
+/**
+ * How many tests carry [FailsOnEmulatorApi37] — the advisory API 37 job's committed baseline.
+ *
+ * **No Kotlin reads this, and it is not stray config.** `.github/scripts/e2e-report-shape.sh`
+ * parses it out of this file by name, with a line-anchored pattern, and the advisory job compares
+ * the run it just did against it: this many tests should start, and all of them should fail.
+ * Deleting it, renaming it, or indenting it into a class stops the comparison — the report would
+ * keep printing with nothing to compare to, so it announces that it could not read the baseline
+ * rather than falling quiet. If you see that notice, this line is what it means.
+ *
+ * **One number, both checks, and that is what the marker means.** A test carrying it cannot pass
+ * on this image, so the count is simultaneously how many the advisory leg runs and how many fail.
+ * A *smaller* failure count is the interesting direction: it means one of them now passes, which
+ * is the trigger the KDoc above names for deleting the annotation.
+ *
+ * So: adding or removing a [FailsOnEmulatorApi37] means changing this number, in this file, in
+ * the same diff. The report says so on the run itself if you forget — it prints the tree's own
+ * `grep` count beside this one.
+ *
+ * Why a baseline at all (#83): that job is `continue-on-error` and red on every PR by design, so
+ * a red X cannot distinguish the known failures from the known failures plus a new one. Counting
+ * failures alone does not fix it either — the run is usually truncated by an
+ * `INSTRUMENTATION_ABORTED`, so the count is a number taken from a partial run. The report
+ * records the truncation next to the counts for that reason.
+ */
+const val FAILS_ON_EMULATOR_API37_BASELINE = 3

app/src/androidTest/java/org/libremediaconverter/bench/RealMediaBenchmark.kt

@@ -36,8 +36,20 @@ import java.io.File
  *  1. that the hardware path is worth having a second engine for at all, and
  *  2. that x264's CRF is worth the GPL licence the app carries for it.
  *
- * Skips itself when the sample files are absent, so it is harmless in CI. Populate with:
- *   adb push <file>.mp4 /sdcard/Android/data/org.libremediaconverter/files/
+ * Skips itself when the sample files are absent, so it is harmless in CI — every green E2E
+ * leg reports two skips, and these are they.
+ *
+ * The two files it looks for, by exact name:
+ *
+ *  - [H264_SAMPLE] for [hardwareVersusSoftwareOnRealVideo]
+ *  - [AV1_SAMPLE] for [av1InputRoutesAccordingToDeviceDecodeSupport]
+ *
+ * **Where they go, and how, is on [samples] — read it before staging anything.** This used to
+ * carry an `adb push` line naming the external files dir, which [samples] then explains cannot
+ * work: a pushed file stays owned by the shell user and the app reads EACCES, surfacing as an
+ * unparseable input rather than a permission error. The instruction and its own refutation sat
+ * twelve lines apart. It is named in one place now rather than restated here, because restating
+ * it is what let the two drift.
  */
 @UnstableApi
 @RunWith(AndroidJUnit4::class)

app/src/androidTest/java/org/libremediaconverter/convert/Media3EngineTest.kt

@@ -11,15 +11,26 @@ import kotlinx.coroutines.runBlocking
 import kotlinx.coroutines.withTimeout
 import org.junit.After
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.libremediaconverter.FailsOnEmulatorApi37
+import org.libremediaconverter.model.AudioCodec
+import org.libremediaconverter.model.AudioPlan
+import org.libremediaconverter.model.Container
 import org.libremediaconverter.model.ConversionRequest
+import org.libremediaconverter.model.CopyPlanner
+import org.libremediaconverter.model.InputKind
+import org.libremediaconverter.model.InputProbe
 import org.libremediaconverter.model.OutputFormat
+import org.libremediaconverter.model.OutputSpec
+import org.libremediaconverter.model.VideoCodec
+import org.libremediaconverter.model.VideoPlan
 import java.io.File
+import java.util.concurrent.CancellationException
 import java.util.concurrent.Executors
 import java.util.concurrent.TimeUnit
 
@@ -170,6 +181,63 @@ class Media3EngineTest {
         )
     }
 
+    /**
+     * The builders that used to throw where nothing could catch them.
+     *
+     * `EditedMediaItem.Builder` rejects a composition with both tracks removed —
+     * checkState("Audio and video cannot both be removed") — and the engine builds it on its own
+     * HandlerThread. That build sat *between* two narrow `runCatching` blocks, one around
+     * `buildTransformer` and one around `start`, so the exception reached the thread's uncaught
+     * handler and took the process with it while the continuation was never resumed.
+     *
+     * `ContainerCapabilities.validate` now refuses the spec that gets here from the picker; this
+     * is the other half — the engine surviving a request that arrives without being validated.
+     * Deliberately not `@FailsOnEmulatorApi37`: nothing here decodes or encodes, so no emulator
+     * codec is involved. The builder refuses the input before any media is touched.
+     */
+    @Test
+    fun aPlanThatRemovesBothTracksFailsInsteadOfKillingTheProcess() {
+        val request = ConversionRequest(
+            spec = OutputSpec(Container.MP4, VideoCodec.H265, AudioCodec.NONE),
+            probe = InputProbe(
+                videoCodec = null,
+                audioCodec = "mp3",
+                hasVideo = false,
+                container = Container.MP3,
+                kind = InputKind.AUDIO_ONLY,
+            ),
+        )
+        // Asserted rather than assumed: ConversionRequest's default probe says hasVideo = true,
+        // and with it this same spec plans to (Encode, Drop) and nothing throws at all — which
+        // would make the whole test vacuous without a word of warning.
+        val plan = CopyPlanner.plan(request.spec, request.probe)
+        assertEquals(VideoPlan.Drop, plan.video)
+        assertEquals(AudioPlan.Drop, plan.audio)
+
+        val failure = runCatching {
+            runBlocking {
+                withTimeout(BUILDER_TIMEOUT_MS) {
+                    engine.transcode(Uri.fromFile(input), output, request) {}
+                }
+            }
+        }.exceptionOrNull()
+
+        // Two assertions, and the second is not pedantry. withTimeout raises
+        // TimeoutCancellationException, and `java.util.concurrent.CancellationException` *extends*
+        // IllegalStateException — so testing only the type below would call an unresumed
+        // continuation a pass. A hang is the other half of this defect and every bit as bad as the
+        // crash: the worker would sit holding a foreground service forever.
+        assertFalse(
+            "the continuation was never resumed — the failure escaped instead of being reported: " +
+                "$failure",
+            failure is CancellationException,
+        )
+        assertTrue(
+            "the builder's refusal must surface as a failed job, not a dead process; got $failure",
+            failure is IllegalStateException,
+        )
+    }
+
     private fun durationMsOf(file: File): Long {
         val extractor = MediaExtractor()
         return try {
@@ -211,5 +279,12 @@ class Media3EngineTest {
 
     private companion object {
         const val TIMEOUT_SECONDS = 120L
+
+        /**
+         * Short on purpose. Nothing is decoded or encoded on this path — the builder refuses the
+         * input outright — so anything approaching this is a hang, which is what the test is
+         * looking for.
+         */
+        const val BUILDER_TIMEOUT_MS = 30_000L
     }
 }

app/src/androidTest/java/org/libremediaconverter/saf/FixtureDocumentsProvider.java

@@ -0,0 +1,234 @@
+package org.libremediaconverter.saf;
+
+import android.database.Cursor;
+import android.database.MatrixCursor;
+import android.os.CancellationSignal;
+import android.os.ParcelFileDescriptor;
+import android.provider.DocumentsContract.Document;
+import android.provider.DocumentsContract.Root;
+import android.provider.DocumentsProvider;
+
+import java.io.File;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+/**
+ * One file, offered to the system file picker, so that picking one can be tested at all.
+ *
+ * <p>DocumentsUI does not browse a filesystem: it lists what {@link DocumentsProvider}s hand it.
+ * So a test that drives the real picker has to supply the thing being picked, and it has to
+ * supply it as a manifest-declared component, because a {@code ContentProvider} is instantiated
+ * by the system and cannot be registered from test code. {@code
+ * app/src/androidTest/AndroidManifest.xml} is that declaration and says why each of its
+ * attributes is load-bearing.
+ *
+ * <h2>The only Java file in this module, and it has to be</h2>
+ *
+ * <p>Everything else here is Kotlin. This cannot be: <b>the Kotlin standard library is not on
+ * this class's classpath at runtime.</b>
+ *
+ * <p>Instrumentation code normally never notices. The test APK's dex is loaded into the app's
+ * process, where the app APK supplies {@code kotlin.jvm.internal.Intrinsics} — so the test APK is
+ * built without it, deliberately, since packaging a second copy is what {@code
+ * checkDebugAndroidTestDuplicateClasses} exists to prevent. A provider is different. It is a
+ * component of the instrumentation <i>package</i>, so when DocumentsUI queries it the system
+ * starts a plain {@code org.libremediaconverter.test} process with only the test APK on its dex
+ * path, and no app APK anywhere. The Kotlin version of this file crashed there on its first
+ * query, before returning a single row:
+ *
+ * <pre>
+ * FATAL EXCEPTION: binder:6369_2
+ * Process: org.libremediaconverter.test
+ * java.lang.NoClassDefFoundError: Failed resolution of: Lkotlin/jvm/internal/Intrinsics;
+ *     at org.libremediaconverter.saf.FixtureDocumentsProvider.queryDocument
+ * </pre>
+ *
+ * <p>The compiler emits that reference for the null checks on almost every function, so there is
+ * no Kotlin dialect that avoids it. For the same reason nothing here imports {@code androidx.*}:
+ * those classes are absent from this process for exactly the same reason. Framework and JDK only.
+ *
+ * <h2>Why a provider rather than a file in Downloads</h2>
+ *
+ * <p>That would have worked, and it would have tested less. Two properties are what {@code
+ * SafPickerRoundTripTest} actually needs:
+ *
+ * <ul>
+ *   <li><b>The root declares {@link Root#COLUMN_MIME_TYPES}, and DocumentsUI filters by it.</b>
+ *       That is what gives the screen's MIME filter a mutation with a shape: ask for a type this
+ *       root does not offer and the root itself is not in the picker, so the failure reads as
+ *       "the fixture root is not there" rather than "one file among the hundreds in Downloads was
+ *       not listed".
+ *   <li><b>The contents are exactly this and nothing else.</b> A shared directory accumulates
+ *       whatever earlier runs and other tests left in it, and a picker test that finds the wrong
+ *       file passes.
+ * </ul>
+ *
+ * <p>The descriptor is opened on a real file rather than served through a pipe, deliberately.
+ * {@code InputQuery.sizeOf} falls back to {@code ParcelFileDescriptor.statSize} when a provider
+ * omits {@code OpenableColumns.SIZE}, and a pipe's {@code statSize} is {@code -1} — an unknown
+ * size, which is a different case with a screen of its own. This fixture is meant to be an
+ * ordinary, fully described file, so that the one thing under test is the round trip.
+ */
+public final class FixtureDocumentsProvider extends DocumentsProvider {
+
+    /**
+     * What the picker calls this root.
+     *
+     * <p>Deliberately not a word any other root uses. The picker's own landing screen already
+     * offers "Images", "Audio", "Videos" and "Documents", and a UiAutomator selector that could
+     * match two things is not a selector.
+     */
+    public static final String ROOT_TITLE = "LMC R38 fixtures";
+
+    /**
+     * What the file card has to end up showing.
+     *
+     * <p>The same string reaches the assertion two ways — as the picker row UiAutomator taps, and
+     * as {@code OpenableColumns.DISPLAY_NAME} on the URI the app is handed — which is exactly the
+     * round trip under test.
+     */
+    public static final String FIXTURE_DISPLAY_NAME = "lmc-r38-fixture.mp4";
+
+    /**
+     * The type the root advertises, and the one the MIME mutation has to stop matching.
+     *
+     * <p>A real type rather than something invented, so the wildcard filter the screen passes
+     * today is not the only filter under which this test could pass.
+     */
+    public static final String FIXTURE_MIME_TYPE = "video/mp4";
+
+    private static final String ROOT_ID = "lmc-r38-root";
+    private static final String ROOT_DOCUMENT_ID = "root";
+    private static final String FIXTURE_DOCUMENT_ID = "root/" + FIXTURE_DISPLAY_NAME;
+
+    /** Already in this source set, and already a real H.264 MP4 the engines can open. */
+    private static final String FIXTURE_ASSET = "sample_h264.mp4";
+
+    private static final String[] DEFAULT_ROOT_PROJECTION = {
+        Root.COLUMN_ROOT_ID,
+        Root.COLUMN_DOCUMENT_ID,
+        Root.COLUMN_TITLE,
+        Root.COLUMN_SUMMARY,
+        Root.COLUMN_MIME_TYPES,
+        Root.COLUMN_FLAGS,
+        Root.COLUMN_ICON,
+    };
+
+    private static final String[] DEFAULT_DOCUMENT_PROJECTION = {
+        Document.COLUMN_DOCUMENT_ID,
+        Document.COLUMN_DISPLAY_NAME,
+        Document.COLUMN_MIME_TYPE,
+        Document.COLUMN_FLAGS,
+        Document.COLUMN_SIZE,
+        Document.COLUMN_LAST_MODIFIED,
+    };
+
+    @Override
+    public boolean onCreate() {
+        return true;
+    }
+
+    /**
+     * The single root.
+     *
+     * <p>{@link Root#COLUMN_MIME_TYPES} is the important column. Left null it would mean "this
+     * root supports everything", the picker would list it whatever was asked for, and the MIME
+     * mutation would have nothing to bite on.
+     */
+    @Override
+    public Cursor queryRoots(String[] projection) {
+        MatrixCursor cursor = new MatrixCursor(projection != null ? projection : DEFAULT_ROOT_PROJECTION);
+        cursor.newRow()
+            .add(Root.COLUMN_ROOT_ID, ROOT_ID)
+            .add(Root.COLUMN_DOCUMENT_ID, ROOT_DOCUMENT_ID)
+            .add(Root.COLUMN_TITLE, ROOT_TITLE)
+            .add(Root.COLUMN_SUMMARY, "Instrumentation fixture")
+            .add(Root.COLUMN_MIME_TYPES, FIXTURE_MIME_TYPE)
+            .add(Root.COLUMN_FLAGS, Root.FLAG_LOCAL_ONLY)
+            .add(Root.COLUMN_ICON, android.R.drawable.ic_menu_gallery);
+        return cursor;
+    }
+
+    @Override
+    public Cursor queryDocument(String documentId, String[] projection) throws FileNotFoundException {
+        MatrixCursor cursor = new MatrixCursor(projection != null ? projection : DEFAULT_DOCUMENT_PROJECTION);
+        if (ROOT_DOCUMENT_ID.equals(documentId)) {
+            addDirectoryRow(cursor);
+        } else if (FIXTURE_DOCUMENT_ID.equals(documentId)) {
+            addFixtureRow(cursor);
+        } else {
+            throw new FileNotFoundException("no such document: " + documentId);
+        }
+        return cursor;
+    }
+
+    @Override
+    public Cursor queryChildDocuments(String parentDocumentId, String[] projection, String sortOrder)
+            throws FileNotFoundException {
+        MatrixCursor cursor = new MatrixCursor(projection != null ? projection : DEFAULT_DOCUMENT_PROJECTION);
+        if (ROOT_DOCUMENT_ID.equals(parentDocumentId)) {
+            addFixtureRow(cursor);
+        }
+        return cursor;
+    }
+
+    @Override
+    public ParcelFileDescriptor openDocument(String documentId, String mode, CancellationSignal signal)
+            throws FileNotFoundException {
+        if (!FIXTURE_DOCUMENT_ID.equals(documentId)) {
+            throw new FileNotFoundException("no such document: " + documentId);
+        }
+        return ParcelFileDescriptor.open(fixtureFile(), ParcelFileDescriptor.MODE_READ_ONLY);
+    }
+
+    private void addDirectoryRow(MatrixCursor cursor) {
+        cursor.newRow()
+            .add(Document.COLUMN_DOCUMENT_ID, ROOT_DOCUMENT_ID)
+            .add(Document.COLUMN_DISPLAY_NAME, ROOT_TITLE)
+            .add(Document.COLUMN_MIME_TYPE, Document.MIME_TYPE_DIR)
+            .add(Document.COLUMN_FLAGS, 0)
+            .add(Document.COLUMN_SIZE, null);
+    }
+
+    private void addFixtureRow(MatrixCursor cursor) throws FileNotFoundException {
+        File file = fixtureFile();
+        cursor.newRow()
+            .add(Document.COLUMN_DOCUMENT_ID, FIXTURE_DOCUMENT_ID)
+            .add(Document.COLUMN_DISPLAY_NAME, FIXTURE_DISPLAY_NAME)
+            .add(Document.COLUMN_MIME_TYPE, FIXTURE_MIME_TYPE)
+            .add(Document.COLUMN_FLAGS, 0)
+            .add(Document.COLUMN_SIZE, file.length())
+            .add(Document.COLUMN_LAST_MODIFIED, file.lastModified());
+    }
+
+    /**
+     * The fixture on disk, unpacked from this APK's own assets the first time anything asks.
+     *
+     * <p>On demand rather than seeded once in {@link #onCreate()}, because this process is started
+     * by whoever queries the provider and can be killed between two queries of the same test.
+     *
+     * <p>A failure here is reported as {@link FileNotFoundException} rather than swallowed. A
+     * provider that answers with a zero-byte file would put the test on the "Size unknown" screen
+     * with nothing saying why.
+     */
+    private File fixtureFile() throws FileNotFoundException {
+        File file = new File(getContext().getFilesDir(), FIXTURE_DISPLAY_NAME);
+        if (file.length() > 0L) {
+            return file;
+        }
+        try (InputStream source = getContext().getAssets().open(FIXTURE_ASSET);
+                OutputStream sink = new FileOutputStream(file)) {
+            byte[] buffer = new byte[8192];
+            int read;
+            while ((read = source.read(buffer)) != -1) {
+                sink.write(buffer, 0, read);
+            }
+        } catch (IOException e) {
+            throw new FileNotFoundException("could not unpack " + FIXTURE_ASSET + ": " + e);
+        }
+        return file;
+    }
+}

app/src/androidTest/java/org/libremediaconverter/saf/SafPickerRoundTripTest.kt

@@ -0,0 +1,786 @@
+package org.libremediaconverter.saf
+
+import android.app.UiAutomation
+import androidx.compose.ui.test.ComposeTimeoutException
+import androidx.compose.ui.test.assertTextEquals
+import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
+import androidx.compose.ui.test.onAllNodesWithTag
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.performClick
+import androidx.media3.common.util.UnstableApi
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import androidx.test.uiautomator.By
+import androidx.test.uiautomator.BySelector
+import androidx.test.uiautomator.Configurator
+import androidx.test.uiautomator.StaleObjectException
+import androidx.test.uiautomator.UiDevice
+import androidx.test.uiautomator.Until
+import org.junit.After
+import org.junit.Assert.assertNotEquals
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.FailsOnEmulatorApi37
+import org.libremediaconverter.MainActivity
+import org.libremediaconverter.ui.TestTags
+
+/**
+ * Choosing a file, through the real system picker, and still having it after a rotation.
+ *
+ * Two defects, and neither is reachable from anywhere else in this repo.
+ *
+ * **The picker is opened with a filter, and a filter can hide the user's file.** `ConverterScreen`
+ * launches `ActivityResultContracts.OpenDocument` with a MIME array; DocumentsUI hides every root
+ * and every document that array does not match. Narrow it and the app still compiles, still
+ * renders, still passes every JVM test — and the user taps "Choose file" and is shown an empty
+ * picker. Nothing in either source set drove SAF **as a picker** before this: the only SAF coverage
+ * is the publish side, in `OutputPublisherPublishTest`, against hand-written `ContentProvider`
+ * fakes. The launcher wiring, the filter, and the read grant that comes back had never been
+ * executed by a test.
+ *
+ * **The picked file has to survive a rotation.** `MainActivity` declares no `configChanges`, so
+ * every rotation destroys and recreates it, and `ConversionViewModel` holds the picked file in a
+ * plain `MutableStateFlow` with no `SavedStateHandle` behind it. The only thing that carries it
+ * across is the retained `ViewModelStore` the Activity gets from resolving the ViewModel through
+ * `LocalViewModelStoreOwner`. Scope it to the composition instead and the file is gone.
+ *
+ * ### Why these two are one test class
+ *
+ * A rotation test alone has no bite of its own. `AppRootRestorationTest` already catches
+ * `rememberSaveable` -> `remember` on the JVM, and a second test whose only mutation is one an
+ * existing test catches is the vacuous test this whole decomposition exists to prevent. So the
+ * rotation here runs **from a real picked input**, which is a state no JVM test can produce:
+ * `AppRootRestorationTest` injects a stub `content` lambda specifically to avoid standing up
+ * either ViewModel, and `StateRestorationTester` saves into an in-memory map rather than a
+ * `Bundle`.
+ *
+ * ### #93: what actually failed was reading the screen, not the picker
+ *
+ * Ninety minutes after this class landed it started failing on gating legs at API 33, 34, 35 and
+ * 37 — on diffs that were two KDoc comments, a MIME lookup table and a README paragraph (#93).
+ * Every failure named the fixture root, so it read as a root-discovery race, and the ticket was
+ * filed on that reading. It was not one, and it was not the `StaleObjectException` #80 had fixed
+ * an hour earlier either.
+ *
+ * **DocumentsUI was fine.** On the API 34 leg of run 32806342548 its own
+ * `ProvidersAccess: Matched roots` names
+ * `content://org.libremediaconverter.test.fixtures/root/lmc-r38-root` five times inside the sixty
+ * seconds the test spent failing, `ActivityTaskManager` logged the `PickActivity` as `Displayed`,
+ * and the provider process started on cue.
+ *
+ * **This process could not read any window at all.** Two counts settle it. Across that whole leg
+ * UiAutomator logged `Retrieving node with selector` 1095 times and `Node not found with selector`
+ * 1095 times — not one selector ever matched, from the first query of the run. The green leg of
+ * the same job asked 7 times and found 5. `UiDevice.getWindowRoots` builds its search set from
+ * `UiAutomation.getWindows()` and, on API 21 and up, from nothing else; an empty list there makes
+ * every selector unfindable and says nothing whatever about SAF. The corroborating detail is that
+ * `By.desc("Show roots")` — the toolbar button, present on that screen whether the roots list is
+ * stale or not — was also not found, 28 s after the picker was displayed.
+ *
+ * **A fresh picker is not the repair, and this was measured rather than assumed.** The same leg
+ * opened a *second* `PickActivity` for the second test, in the same DocumentsUI process
+ * (pid 3299), and read exactly as little from it. So whatever was broken outlived one window.
+ * [requireAReadableScreen] is the part aimed at that: it asks whether this process can see the
+ * app's own window *before* the picker is opened, and [rebuildUiAutomation] tears the connection
+ * down and builds another if it cannot.
+ *
+ * **The check has since caught the real thing, in CI, and the connection rebuild did not repair
+ * it.** Run 32811493607, API 35 and API 37 legs, both tests, 12 s each instead of 60:
+ *
+ * ```
+ * java.lang.AssertionError: UiAutomator cannot see this app's own window, so it could not have
+ *   seen the picker's either. This is not a SAF failure.
+ *     at SafPickerRoundTripTest.requireAReadableScreen
+ * ```
+ *
+ * That is the diagnosis this class could not previously give, and it moves the question off SAF
+ * for good.
+ *
+ * ### What the window list said, and why nothing here can fix it
+ *
+ * [describeWindows] was added to that failure so the next occurrence would close the question
+ * rather than reopen it. It did — on the API 34 leg of run 32812248131 and again, character for
+ * character, on the API 33 leg of run 32812892103:
+ *
+ * ```
+ * ... Waking the device, dismissing the keyguard and rebuilding the UiAutomation connection all
+ * failed to make it readable. What it could see: com.android.systemui[type=3], android[type=3]
+ * ```
+ *
+ * `type=3` is `AccessibilityWindowInfo.TYPE_SYSTEM`. The list is **not** empty — it holds the
+ * system windows and **not one `TYPE_APPLICATION` window**, on a device where the framework had
+ * already logged `Displayed org.libremediaconverter/.MainActivity`. So the application layer
+ * never reaches accessibility on those boots, and every selector in this class, the picker's and
+ * the app's alike, is unfindable for the whole instrumentation run.
+ *
+ * Three CI runs on this branch caught the fault, at API 33, 34, 35 and 37, and every one of them
+ * printed that same list. It is not one level's quirk.
+ *
+ * ### And that list is what identified the occluder
+ *
+ * `android[type=3]` is `system_server`, and what it was holding is in the same logcat, minutes
+ * before this class ever ran:
+ *
+ * ```
+ * ANR in com.google.android.apps.nexuslauncher (com.google.android.apps.nexuslauncher/.NexusLauncherActivity)
+ * Reason: Input dispatching timed out (Application does not have a focused window)
+ * Window{4ed8414 u0 Application Not Responding: com.google.android.apps.nexuslauncher}
+ * ```
+ *
+ * **The launcher ANRs on a loaded runner emulator, and the dialog it leaves behind never goes
+ * away.** It is opaque and fullscreen, so `AccessibilityWindowManager` drops every application
+ * window beneath it — which is how the app can be `Displayed` and unreadable at once, the
+ * contradiction that made #93 look like a SAF bug for six PRs. It is present on both legs
+ * examined, at API 33 and 34, at the failure timestamp.
+ *
+ * So [dismissASystemErrorDialog] is tried first, and it is the remedy with a mechanism behind it.
+ * The other two are kept behind it and are **measured as not the cause**: [unlockTheDevice] (the
+ * keyguard theory, from `KeyguardViewMediator` reporting an unprovisioned device — dismissing it
+ * changed nothing) and [rebuildUiAutomation]. A second `PickActivity` is not a remedy for this
+ * either, and that was measured too: the first failing leg opened one and read as little from it.
+ *
+ * **What is honest about the dialog remedy: it has been shown to do no harm, not to work.** It
+ * was forced on with no dialog present and the suite stayed green, which is the way a blind
+ * `click()` could have broken a healthy run. Dismissing a real ANR dialog has not been observed,
+ * because the fault has never been reproduced locally — not on six warm runs, not on cold
+ * full-suite runs at API 34 and 35 on freshly created AVDs under `swangle_indirect` at two cores,
+ * not under host load. If it recurs, the message now names the dialog and the window list, so the
+ * next step is a measurement rather than another theory.
+ *
+ * ### The whole pick is retried, which is a separate and smaller claim
+ *
+ * [pickTheFixture] also backs out and asks for another picker when the walk comes up short. That
+ * is not the answer to the paragraph above; it is the answer to a picker whose *lists* were built
+ * before their data arrived, which is a real thing DocumentsUI does and which
+ * [tapPickerNode]'s re-find cannot reach either — it re-acquires a handle inside the one picker.
+ *
+ * One API 37 run failed a step deeper than the rest: the root appeared and
+ * `[TEXT='\Qlmc-r38-fixture.mp4\E']` did not. **That shape has not been reproduced or
+ * diagnosed.** It is covered here only because a fresh pick re-walks from Recent, and that is
+ * worth writing down rather than letting the retry read as a fix for something nobody measured.
+ *
+ * ### The mutations, and what they printed
+ *
+ * Both were run, not asserted. Narrowing the wildcard array `ConverterScreen.kt` passes to
+ * `pickInput.launch` — to `arrayOf("application/x-lmc-no-such-type")` — empties the picker of the
+ * fixture root entirely, and both tests fail on the assertion that names it. **Re-run after the
+ * #93 retry landed**, because a retry that tolerated an absent root would have made this mutation
+ * vacuous, which is the one thing that must not happen here:
+ *
+ * ```
+ * java.lang.AssertionError: the system picker never showed BySelector [TEXT='\QLMC R38 fixtures\E'],
+ *   in 3 separate pickers (the last one left org.libremediaconverter in front)
+ *     at org.libremediaconverter.saf.SafPickerRoundTripTest.pickTheFixture(SafPickerRoundTripTest.kt:268)
+ * ```
+ *
+ * The root is absent from all three pickers, so all three report it, and the cost of saying so is
+ * bounded: 126 s and 127 s for the two tests, against the 1200 s wrapper timeout in
+ * `.github/scripts/e2e-run.sh`. The clause about what was left in front is not decoration either
+ * — it is what says the retry really did get back to the app between attempts rather than tapping
+ * behind a picker that never closed.
+ *
+ * **That mutation only shows the retry failing correctly.** Showing it *recovering* needs a
+ * failure that goes away, so one was injected: a field making the first
+ * [walkThePickerToTheFixture] of each test return a selector nothing matches. Both tests then
+ * passed, with `ActivityTaskManager` logging four `OPEN_DOCUMENT` starts for the two of them —
+ * two pickers each. That is the run which says the reopened pick completes: that
+ * `pickInput.launch` is not refused from the re-resumed Activity, and that the second test's
+ * reopen, which lands in the last-accessed stack rather than on Recent, still walks to the file.
+ * Making the ViewModel composition-scoped leaves the picker test alone and fails
+ * [thePickedInputSurvivesARealRotation], with `:app:testDebugUnitTest` still BUILD SUCCESSFUL —
+ * which is the divergence this ticket was filed to establish, and which was doubted on it. It is
+ * `viewModel()` -> `viewModel(viewModelStoreOwner = remember { <a plain ViewModelStoreOwner> })`,
+ * **plus** `factory = ViewModelProvider.AndroidViewModelFactory()` and a `MutableCreationExtras`
+ * carrying `APPLICATION_KEY`. The factory half is not decoration: an owner that is not a
+ * `HasDefaultViewModelProviderFactory` contributes no creation extras, and the default factory
+ * cannot construct an `AndroidViewModel` without them — so the owner swap alone crashes on
+ * construction instead of demonstrating the scope. The PR body quotes both failures verbatim.
+ *
+ * ### It has to be an unlocked emulator
+ *
+ * The Pixel 10 Pro XL is secure-locked and cannot be unlocked from a shell, so the picker cannot be
+ * driven there at all. That is why this gap survived as long as it did.
+ * `tools/local-emulator/run-e2e.sh` runs API 33-36 on the development host, and both tests pass
+ * there: **59 / 0 / 0 / 2 at API 33 and again at API 36**, whole suite, 2026-08-24.
+ *
+ * ### Why only the rotation test carries [FailsOnEmulatorApi37]
+ *
+ * This class is the first thing in the suite that touches system UI, and the android-37.x images
+ * are where that stops being free: surfaceflinger aborts inside the guest's Gralloc5 mapper, init
+ * SIGKILLs zygote with it, and the framework restarts underneath the run. Disabling SystemUI --
+ * the deviation the API 37 leg already makes -- removes the *idle* trigger, not this one.
+ *
+ * The marker is on one method and not on the class, because that is what was measured, one method
+ * per fresh emulator, on `android-37.0` under `swangle_indirect`:
+ *
+ * ```
+ * thePickedInputSurvivesARealRotation            INSTRUMENTATION_ABORTED: System has crashed.
+ *                                               Expected 1 tests, received 0
+ * pickingAFileThroughTheSystemPickerFillsInTheFileCard                              PASSED
+ * ```
+ *
+ * A rotation rebuilds every surface on screen at once, which the mapper does not survive; merely
+ * starting DocumentsUI does not.
+ *
+ * **The first version of this said the class, and it was wrong.** The picker test had failed at
+ * API 37 too -- with a `StaleObjectException` that turned out to be this file's own bug rather
+ * than the image's, and which CI then reproduced deterministically at API 33, 34 and 35. Fixing
+ * it ([tapPickerNode]) and re-measuring is what separated the two. An annotation is a claim about
+ * an image, and a broken test makes every image look broken; **re-measure after fixing a test
+ * before deciding what the platform did.**
+ *
+ * The annotation says only that, and CI reads it twice, so the rotation test runs on the advisory
+ * API 37 leg and not the gating one. **Do not read it as "a rotation is allowed to lose the
+ * file".** That is what API 33 through 36 are for, and they answer it.
+ */
+@UnstableApi
+@RunWith(AndroidJUnit4::class)
+class SafPickerRoundTripTest {
+
+    @get:Rule
+    val composeRule = createAndroidComposeRule<MainActivity>()
+
+    private val device: UiDevice =
+        UiDevice.getInstance(InstrumentationRegistry.getInstrumentation())
+
+    /** The app under test, whose own window is what [requireAReadableScreen] asks for. */
+    private val appPackage: String =
+        InstrumentationRegistry.getInstrumentation().targetContext.packageName
+
+    /** Set by the one test that rotates, read by [restoreOrientation]. See its KDoc. */
+    private var rotated = false
+
+    /**
+     * Leave the device the way it was found — and only if this test moved it.
+     *
+     * Two things are deliberate here, and both are about the *other* tests on the device rather
+     * than about these two.
+     *
+     * The flag, because this runs after every test in the class, not only the one that rotated. An
+     * unconditional restore issues a WindowManager rotation request after the picker test as well,
+     * which has nothing to undo; JUnit does not promise method order, so that is an interaction
+     * between two tests that no single-class run would ever show. Tracked as a flag rather than
+     * read back off `isNaturalOrientation`, because a device whose *natural* orientation is
+     * landscape would answer that question the wrong way round.
+     *
+     * And `unfreezeRotation`, because `setOrientationNatural` does not merely rotate: it freezes
+     * the rotation there. A run that stopped after it would hand the next test a device that
+     * cannot rotate at all.
+     */
+    @After
+    fun restoreOrientation() {
+        if (!rotated) return
+        device.setOrientationNatural()
+        device.unfreezeRotation()
+        device.waitForIdle()
+    }
+
+    @Test
+    fun pickingAFileThroughTheSystemPickerFillsInTheFileCard() {
+        pickTheFixture()
+
+        composeRule.onNodeWithTag(TestTags.Converter.FILE_CARD_NAME)
+            .assertTextEquals(FixtureDocumentsProvider.FIXTURE_DISPLAY_NAME)
+
+        // Not the same assertion twice. The name above comes from a metadata query, which a URI
+        // with no read grant answers just as well; this line only appears once something has
+        // opened the file and read its header. It is what says the picker handed back a URI the
+        // app can actually USE -- delete grantUriPermissions from the fixture's manifest entry and
+        // the name still arrives while this goes red.
+        //
+        // The whole "Container: MP4" and not "MP4": DetailRow renders the label and the value as
+        // one semantics node.
+        awaitNode(TestTags.Converter.detailRow(CONTAINER_LABEL))
+        composeRule.onNodeWithTag(TestTags.Converter.detailRow(CONTAINER_LABEL))
+            .assertTextEquals("$CONTAINER_LABEL: MP4")
+    }
+
+    @Test
+    @FailsOnEmulatorApi37
+    fun thePickedInputSurvivesARealRotation() {
+        pickTheFixture()
+        // The identity hash rather than the Activity itself, so nothing here keeps a destroyed
+        // Activity reachable across the recreation it is being used to detect.
+        val before = System.identityHashCode(composeRule.activity)
+
+        device.setOrientationLandscape()
+        rotated = true
+        composeRule.waitForIdle()
+
+        // Two guards before the assertion that matters, because both of the ways this test could
+        // pass while proving nothing are silent ones.
+        //
+        // A device that ignored the rotation request would leave the app exactly as it was, and
+        // "the file is still there" would then be a statement about a screen nothing happened to.
+        assertNotEquals(
+            "the device did not actually rotate, so nothing below is about a rotation",
+            NATURAL_ROTATION,
+            device.displayRotation,
+        )
+        // And a rotation that did NOT recreate the Activity -- a configChanges attribute added to
+        // the manifest, an aspect-ratio or orientation lock -- would make this a recomposition
+        // test. The retained ViewModelStore is only interesting because the Activity around it
+        // really was destroyed and rebuilt.
+        assertNotEquals(
+            "the rotation did not recreate MainActivity, so the retained ViewModelStore was never used",
+            before,
+            System.identityHashCode(composeRule.activity),
+        )
+
+        awaitNode(TestTags.Converter.FILE_CARD_NAME)
+        composeRule.onNodeWithTag(TestTags.Converter.FILE_CARD_NAME)
+            .assertTextEquals(FixtureDocumentsProvider.FIXTURE_DISPLAY_NAME)
+    }
+
+    // --- driving the picker ---------------------------------------------------------------
+
+    /**
+     * Taps "Choose file", walks the system picker to the fixture, and returns once the app has it.
+     *
+     * Everything between the first tap and the last belongs to `com.google.android.documentsui`,
+     * which is why UiAutomator is here at all: Compose's matchers stop at this process's
+     * composition and Espresso's at its view hierarchy, and the picker is neither.
+     *
+     * **What is retried here is the whole pick.** [tapPickerNode]'s re-find re-acquires a handle
+     * to a node inside the picker that is already open, so it cannot reach a list that was built
+     * before its data arrived. Backing out and tapping "Choose file" again gets a *second*
+     * `PickActivity`, which rebuilds every list in it — and is what a user does when a picker
+     * comes up wrong. It is **not** the answer to the unreadable-screen failure in the class
+     * KDoc; [requireAReadableScreen], one line above, is the part aimed at that.
+     *
+     * The first attempt keeps the full [PICKER_TIMEOUT_MS]; the later ones use
+     * [REOPENED_TIMEOUT_MS], because by then the picker's process, its provider and its root cache
+     * are all warm and the only thing being waited on is one screen. That is what keeps the cost
+     * of a genuinely absent root bounded — see the class KDoc.
+     */
+    private fun pickTheFixture() {
+        var missing: BySelector? = null
+        repeat(PICK_ATTEMPTS) { attempt ->
+            requireAReadableScreen()
+            openThePicker()
+            missing = walkThePickerToTheFixture(
+                if (attempt == 0) PICKER_TIMEOUT_MS else REOPENED_TIMEOUT_MS,
+            )
+            if (missing == null) {
+                awaitNode(TestTags.Converter.FILE_CARD_NAME)
+                return
+            }
+            dismissThePicker()
+        }
+        throw AssertionError(
+            "the system picker never showed $missing, in $PICK_ATTEMPTS separate pickers " +
+                "(the last one left ${device.currentPackageName} in front)",
+        )
+    }
+
+    /**
+     * Refuses to go near the picker until this process can read a window it already knows is there.
+     *
+     * **This is the check that would have answered #93 outright**, instead of leaving six PRs to
+     * infer a SAF fault from a picker that was never the problem. It is here because of what the
+     * failing logcat counts. Across the whole API 34 leg UiAutomator
+     * asked for a node 1095 times and logged `Node not found` 1095 times — it never read anything,
+     * from the first query of the run onwards. The green leg of the same job asked 7 times and
+     * found 5. So the window list `UiDevice` searches, `UiAutomation.getWindows()`, was empty for
+     * that entire instrumentation run; on API 21 and up that list is the *only* place
+     * `getWindowRoots` looks, so an empty one makes every selector unfindable and says nothing
+     * about the app, the picker or the fixture.
+     *
+     * The probe is deliberately the app's **own** window, asked while the app is in front and
+     * before anything is tapped. It is the one window that must be readable for any of the rest to
+     * mean anything, so a failure here is unambiguous — where "the picker never showed the root"
+     * was not, and is what sent #93 looking at package installation and root caches.
+     *
+     * The repair is [rebuildUiAutomation]. It has been forced on and measured — a rebuilt
+     * connection still reads windows, which is the way it could have been worse than nothing —
+     * but it has **never been run against the real fault**, because the fault has never been
+     * reproduced on demand. See the class KDoc. What is certain is that a fresh picker is *not*
+     * the repair: the failing leg opened a second `PickActivity` for the second test, in the
+     * same DocumentsUI process, and read exactly as little from it.
+     */
+    private fun requireAReadableScreen() {
+        val app = By.pkg(appPackage)
+        if (device.wait(Until.hasObject(app), READABLE_TIMEOUT_MS) == true) return
+        dismissASystemErrorDialog()
+        if (device.wait(Until.hasObject(app), READABLE_TIMEOUT_MS) == true) return
+        unlockTheDevice()
+        if (device.wait(Until.hasObject(app), READABLE_TIMEOUT_MS) == true) return
+        rebuildUiAutomation()
+        if (device.wait(Until.hasObject(app), READABLE_TIMEOUT_MS) != true) {
+            throw AssertionError(
+                "UiAutomator cannot see this app's own window, so it could not have seen the " +
+                    "picker's either. This is not a SAF failure. Closing a system error dialog, " +
+                    "waking the device, dismissing the keyguard and rebuilding the UiAutomation " +
+                    "connection all failed to make it readable. What it could see: " +
+                    describeWindows(),
+            )
+        }
+    }
+
+    /**
+     * Closes a system "isn't responding" dialog, if that is what is on top of the app.
+     *
+     * **This is the occluder #93 turned out to have**, and it took the window list in the failure
+     * message to find it. `AppNotRespondingDialog` belongs to `system_server`, so it is the
+     * `android[type=3]` in `com.android.systemui[type=3], android[type=3]` — and it is opaque and
+     * fullscreen, so `AccessibilityWindowManager` drops every application window beneath it. The
+     * app is `Displayed` and unreadable at the same time, which is exactly the contradiction this
+     * class spent #93 failing to explain. It is not even this app's dialog:
+     *
+     * ```
+     * ANR in com.google.android.apps.nexuslauncher (com.google.android.apps.nexuslauncher/.NexusLauncherActivity)
+     * Reason: Input dispatching timed out (Application does not have a focused window)
+     * Window{4ed8414 u0 Application Not Responding: com.google.android.apps.nexuslauncher}
+     * ```
+     *
+     * The launcher ANRs on a loaded runner emulator minutes before this class runs, and the dialog
+     * it leaves behind never goes away on its own.
+     *
+     * Dismissed by resource id rather than by button text, because the text is localised and the
+     * ids are not, and by id rather than by "the first button in the system window", because that
+     * would click whatever system window happened to be there. `aerr_wait` first: it dismisses the
+     * dialog and leaves the offending app alone, which is the polite answer when the app is not
+     * ours. Back is not tried — `BaseErrorDialog` swallows key events.
+     */
+    private fun dismissASystemErrorDialog() {
+        for (id in ERROR_DIALOG_BUTTONS) {
+            val button = device.findObject(By.res(id)) ?: continue
+            button.click()
+            device.waitForIdle()
+            return
+        }
+    }
+
+    /**
+     * Wakes the display and asks the keyguard to go away.
+     *
+     * The cheapest explanation for "this process cannot see the app's own window" is that
+     * something is in front of it, and on a runner emulator that something is the lock screen:
+     * these images come up unprovisioned, and `KeyguardViewMediator` says so in as many words --
+     * `we need to show the keyguard since the device isn't provisioned yet`. An occluded window is
+     * not in the accessibility window list, which is the same symptom as a broken connection and
+     * has a far more ordinary cause.
+     *
+     * `wm dismiss-keyguard` rather than a swipe, because it is a request to the window manager
+     * rather than a gesture that has to land somewhere this process cannot see. It is only
+     * attempted on the failure path -- a device that was readable never reaches here -- so a run
+     * where the keyguard was never up pays nothing and is not altered.
+     */
+    private fun unlockTheDevice() {
+        device.wakeUp()
+        device.executeShellCommand("wm dismiss-keyguard")
+        device.waitForIdle()
+    }
+
+    /** The accessibility window list, for a failure message that says what was actually there. */
+    private fun describeWindows(): String {
+        val windows = InstrumentationRegistry.getInstrumentation().uiAutomation.windows
+        if (windows.isEmpty()) return "no windows at all (UiAutomation.getWindows() is empty)"
+        return windows.joinToString(", ") { "${it.root?.packageName ?: "?"}[type=${it.type}]" }
+    }
+
+    /**
+     * Tears down this run's `UiAutomation` connection and establishes a new one.
+     *
+     * `Instrumentation.getUiAutomation` hands back the existing connection unless the flags differ
+     * from the ones it was created with, in which case it destroys it and builds another — so
+     * asking for different flags and then for the original ones back is how a test reaches the
+     * connection at all. `UiDevice` re-reads the flags from `Configurator` on every call rather
+     * than caching an instance, so the next selector goes through the new connection.
+     *
+     * `FLAG_DONT_SUPPRESS_ACCESSIBILITY_SERVICES` is toggled rather than chosen: it is only being
+     * used as a value that differs from whatever is configured, and it is put back.
+     *
+     * **Forced on and measured, because the obvious way for this to be worse than nothing is
+     * silent.** `UiDevice` puts `FLAG_RETRIEVE_INTERACTIVE_WINDOWS` on the service info during its
+     * own initialisation, and `getWindows()` is empty without it — so a rebuilt connection that
+     * did not get the flag back would cause exactly the emptiness this is meant to cure, on the
+     * one path where it is the last hope. Run unconditionally on every attempt, on a cold API 34
+     * emulator, both tests passed, and logcat shows the connection really being replaced rather
+     * than handed back: `Init UiAutomation[id=2, flags=0]`, then `id=4, flags=1`, then
+     * `id=6, flags=0`, with `Registering UiTestAutomationService` between each.
+     */
+    private fun rebuildUiAutomation() {
+        val configurator = Configurator.getInstance()
+        val flags = configurator.uiAutomationFlags
+        val instrumentation = InstrumentationRegistry.getInstrumentation()
+        configurator.uiAutomationFlags = flags xor UiAutomation.FLAG_DONT_SUPPRESS_ACCESSIBILITY_SERVICES
+        instrumentation.getUiAutomation(configurator.uiAutomationFlags)
+        configurator.uiAutomationFlags = flags
+        instrumentation.getUiAutomation(flags)
+    }
+
+    /** Waits for the app to be showing its own screen again, then asks for a picker. */
+    private fun openThePicker() {
+        awaitNode(TestTags.Converter.CHOOSE_FILE)
+        composeRule.onNodeWithTag(TestTags.Converter.CHOOSE_FILE).performClick()
+    }
+
+    /**
+     * Null once the fixture URI is with the app, or the selector whose list never carried it.
+     *
+     * Three things have to be there, in order, and the `when` names them in that order so that a
+     * failure says which one was missing rather than "the picker did not work".
+     *
+     * **The first branch is what tells an unreadable picker from an absent root.** In #93 neither
+     * the root *nor the toolbar's "Show roots" button* could be found for sixty seconds, and a
+     * stale roots list would have left the toolbar findable. Both arrived as one message. Asking
+     * for the picker's package on its own separates them: `never showed BySelector [PKG=...]`
+     * means the picker was not readable, and the root selector means the root was not offered.
+     *
+     * The second is the line the MIME filter mutation fails on: DocumentsUI matches the requested
+     * types against `Root.COLUMN_MIME_TYPES` and drops the roots that cannot answer, so a filter
+     * the fixture root does not satisfy takes the root out of the picker altogether — along with
+     * "Images", "Audio", "Videos" and "Documents", measured on API 34.
+     *
+     * **The third takes no recovery action of its own, and that is deliberate rather than an
+     * oversight.** [openTheRootsDrawer] exists because a root has a *second* place it can be
+     * shown; a document in a directory listing has no second place, so there is nothing an
+     * in-picker action could do. Its recovery is the outer loop: a fresh picker re-walks from
+     * Recent into the root, which rebuilds the directory listing as well as the roots strip.
+     */
+    private fun walkThePickerToTheFixture(timeoutMs: Long): BySelector? {
+        val picker = By.pkg(DOCUMENTS_UI_PACKAGE)
+        val root = By.text(FixtureDocumentsProvider.ROOT_TITLE)
+        val fixture = By.text(FixtureDocumentsProvider.FIXTURE_DISPLAY_NAME)
+        return when {
+            device.wait(Until.hasObject(picker), timeoutMs) != true -> picker
+            !tapPickerNode(root, timeoutMs, ifAbsent = ::openTheRootsDrawer) -> root
+            !tapPickerNode(fixture, timeoutMs) -> fixture
+            else -> null
+        }
+    }
+
+    /**
+     * The picker's own drawer, opened only when the root was not on the screen it landed on.
+     *
+     * **In practice it never runs, and #80 was right to say so.** A hierarchy dump taken on a
+     * cold API 34 emulator while this test was passing has the fixture root on the landing
+     * screen — `text="LMC R38 fixtures"` at `android:id/title`, under a `BROWSE FILES IN OTHER
+     * APPS` header — with the drawer shut (`Show roots` present, `Hide roots` absent). So the
+     * roots strip is the normal path and the drawer is a widening, kept because a device with a
+     * populated Recent may push the strip off screen. Looking in a second place widens where the
+     * root is searched for; it does not weaken what has to be found, which is still this root.
+     */
+    private fun openTheRootsDrawer() {
+        device.findObject(By.desc(SHOW_ROOTS_DESCRIPTION))?.click()
+    }
+
+    /**
+     * Backs out of the picker until the app has the window focus again.
+     *
+     * **The focus is asked of the Activity, not of UiAutomator, and that is not a stylistic
+     * choice.** The failure this retry exists for is a picker window UiAutomator cannot see, so a
+     * probe that went through the same accessibility window list would cheerfully report "the
+     * picker is gone" about the window that is still in front — and the reopened pick would then
+     * tap "Choose file" behind it. `Activity.hasWindowFocus` comes from the framework instead, and
+     * answers about the app rather than about the picker.
+     *
+     * It is also why this counts backs rather than pressing a fixed number of them. One back is
+     * enough from Recent and two are needed from inside the root, but a third from Recent would
+     * finish `MainActivity` and take the rest of the test with it.
+     */
+    private fun dismissThePicker() {
+        repeat(BACK_PRESSES) {
+            if (awaitAppFocus()) return
+            // Before the back press, not instead of it: an app-error dialog swallows key events,
+            // so a back aimed at the picker lands on the dialog and nothing moves. Measured --
+            // API 34 of run 32813885120 exhausted all four presses with `android` in front, which
+            // is that dialog, while the launcher it belonged to went on ANRing behind everything.
+            dismissASystemErrorDialog()
+            device.pressBack()
+        }
+        // The check after the last press, and not a spare one: `repeat` presses on its final
+        // iteration too, so without this a dismissal that worked on the last press would still be
+        // reported as a failure to close.
+        if (!awaitAppFocus()) {
+            throw AssertionError(
+                "the system picker would not close: after $BACK_PRESSES back presses the app " +
+                    "still does not have the window focus, and ${device.currentPackageName} is " +
+                    "in front. What could be seen: " + describeWindows(),
+            )
+        }
+    }
+
+    /** True once [MainActivity] has the window focus, false if it does not take it in time. */
+    private fun awaitAppFocus(): Boolean = try {
+        composeRule.waitUntil("the app has the window focus back", FOCUS_TIMEOUT_MS) {
+            composeRule.activity.hasWindowFocus()
+        }
+        true
+    } catch (_: ComposeTimeoutException) {
+        false
+    }
+
+    /**
+     * Finds the picker node [selector] names and taps it, re-finding it if it goes stale.
+     *
+     * **The re-finding is not padding, and this is not a retry of the assertion.** A `UiObject2`
+     * holds an `AccessibilityNodeInfo` captured when it was found, and DocumentsUI is still
+     * settling when the node first appears — its list rebinds, the roots strip lays out, a window
+     * animates. If the node is replaced in that gap, `click()` throws `StaleObjectException`
+     * against the handle rather than missing the target. Measured on a cold API 34 emulator:
+     *
+     * ```
+     * androidx.test.uiautomator.StaleObjectException
+     *   at androidx.test.uiautomator.UiObject2.getAccessibilityNodeInfo(UiObject2.java:1042)
+     *   at androidx.test.uiautomator.UiObject2.click(UiObject2.java:526)
+     * ```
+     *
+     * So what is retried is *acquiring a handle to a node that has to be there anyway*. **A node
+     * that is simply not in this picker is reported rather than retried here** — it comes back as
+     * `false`, and [pickTheFixture] answers it with a whole new picker, which is the only thing
+     * that rebuilds a list or a window. The MIME mutation's bite is untouched either way: a root
+     * that is not in the picker is not found on any attempt or in any picker, and the failure is
+     * still "the system picker never showed" rather than a stale one.
+     */
+    private fun tapPickerNode(selector: BySelector, timeoutMs: Long, ifAbsent: () -> Unit = {}): Boolean {
+        var stale: StaleObjectException? = null
+        repeat(TAP_ATTEMPTS) { attempt ->
+            // ifAbsent only on the first attempt: it navigates, and re-navigating from a screen it
+            // already reached would walk away from the node.
+            val node = awaitPickerNode(selector, timeoutMs, if (attempt == 0) ifAbsent else ({}))
+                ?: return false
+            device.waitForIdle()
+            try {
+                node.click()
+                return true
+            } catch (e: StaleObjectException) {
+                stale = e
+            }
+        }
+        throw AssertionError("$selector kept going stale between finding it and tapping it", stale)
+    }
+
+    /**
+     * The picker node [selector] names, or null if this picker never showed it.
+     *
+     * [ifAbsent] runs once, after the first wait comes up empty, and then the wait is repeated. A
+     * null return from `findObject` is deliberately not an error there: it is the "already on the
+     * right screen" case.
+     */
+    private fun awaitPickerNode(selector: BySelector, timeoutMs: Long, ifAbsent: () -> Unit) =
+        device.wait(Until.findObject(selector), timeoutMs)
+            ?: run {
+                ifAbsent()
+                device.wait(Until.findObject(selector), timeoutMs)
+            }
+
+    /**
+     * Blocks until [tag] is in the composition, so an assertion cannot race the picker's result.
+     *
+     * The described overload of `waitUntil`, not the bare one. A timeout is how both of this
+     * class's mutations report themselves, and the bare overload's message is
+     * `Condition still not satisfied after 30000 ms` — which names neither the node nor the test.
+     * With the description it says which affordance never arrived, which is the whole finding.
+     */
+    private fun awaitNode(tag: String) {
+        composeRule.waitUntil("a node tagged $tag exists", APP_TIMEOUT_MS) {
+            composeRule.onAllNodesWithTag(tag).fetchSemanticsNodes().isNotEmpty()
+        }
+    }
+
+    private companion object {
+
+        /**
+         * Generous on purpose. This waits on another app being started, and on FFprobe spawning a
+         * native process over a `content://` URI; a timeout that merely usually passes is a flaky
+         * gating leg on five API levels, which costs far more than the seconds it saves.
+         */
+        const val PICKER_TIMEOUT_MS = 30_000L
+        const val APP_TIMEOUT_MS = 30_000L
+
+        /**
+         * The same wait once a picker has already come and gone, and shorter for a reason.
+         *
+         * What [PICKER_TIMEOUT_MS] is generous about is a cold start: DocumentsUI's process, the
+         * fixture's provider process, the root cache. By the second attempt all three are warm and
+         * the only thing left to wait on is one screen being laid out — measured at 2.7 to 3.4 s
+         * from the picker starting, on cold CI emulators at API 33, 34 and 35. Ten seconds is
+         * three times the worst of those, and it is what keeps a genuinely absent root — the MIME
+         * mutation — from costing three full-length attempts.
+         */
+        const val REOPENED_TIMEOUT_MS = 10_000L
+
+        /**
+         * How long the app is given to take the window focus back after a back press.
+         *
+         * Short, because this is asked once per back press and the first one is always asked while
+         * the picker is still in front, where it is *expected* to time out.
+         */
+        const val FOCUS_TIMEOUT_MS = 3_000L
+
+        /**
+         * How long this process is given to be able to read the screen at all.
+         *
+         * Short, and it is not waiting on anything being drawn: the app is already in front
+         * when this is asked. It is waiting only on the accessibility window list existing,
+         * which either does within a poll or two or -- as in #93 -- not at all.
+         */
+        const val READABLE_TIMEOUT_MS = 5_000L
+
+        /** `Surface.ROTATION_0`, named rather than `0` so the comparison reads. */
+        const val NATURAL_ROTATION = 0
+
+        /**
+         * How many pickers the fixture may fail to appear in before that is the finding.
+         *
+         * Three. Each one is a fresh `PickActivity` -- a fresh window, a fresh accessibility
+         * registration, a fresh roots query and a fresh directory load -- so this bounds the thing
+         * #93 measured, which is a picker that came up unreadable *once*. A root that is genuinely
+         * not offered is absent from all three, which is what keeps #64's MIME mutation red.
+         */
+        const val PICK_ATTEMPTS = 3
+
+        /**
+         * How many back presses may be spent getting out of a picker.
+         *
+         * One is enough from Recent, two from inside the fixture's own directory. Four leaves room
+         * for a picker that has been navigated deeper than this test ever navigates it, and stops
+         * well short of the count that would start finishing `MainActivity` instead.
+         */
+        const val BACK_PRESSES = 4
+
+        /**
+         * The package the system picker runs in.
+         *
+         * Named rather than resolved: `PackageManager.resolveActivity` is deprecated from API 33
+         * and its replacement is a lint argument this test does not need to have. A wrong value
+         * here cannot pass silently -- it is the first thing [walkThePickerToTheFixture] looks
+         * for, so the failure would read `never showed BySelector [PKG='...']` on every device.
+         * It is `com.google.android.documentsui` on every `google_apis` emulator image the CI
+         * matrix uses and on the Pixel 10 Pro XL.
+         */
+        const val DOCUMENTS_UI_PACKAGE = "com.google.android.documentsui"
+
+        /**
+         * How many times a picker node may be re-found before its staleness is the finding.
+         *
+         * Three, not "until the timeout". Each attempt already waits up to [PICKER_TIMEOUT_MS] for
+         * the node to exist, so this bounds only the settling window after it does; a node that is
+         * still being replaced after three of those is telling you something about the device, and
+         * a loop that hid it would be the flake rather than the fix.
+         */
+        const val TAP_ATTEMPTS = 3
+
+        /**
+         * The buttons on the framework's app-error dialogs, by resource id.
+         *
+         * `aerr_wait` is first because it dismisses the dialog without killing the app under it,
+         * and the app under it is usually the launcher rather than anything this suite owns.
+         * `button1` catches the plainer `BaseErrorDialog` shapes that have no `aerr_` ids.
+         */
+        val ERROR_DIALOG_BUTTONS = listOf(
+            "android:id/aerr_wait",
+            "android:id/aerr_close",
+            "android:id/button1",
+        )
+
+        /** DocumentsUI's drawer button. It carries no text, only this description. */
+        const val SHOW_ROOTS_DESCRIPTION = "Show roots"
+
+        /** The detail row `MediaProbe` fills in for anything it could open and identify. */
+        const val CONTAINER_LABEL = "Container"
+    }
+}

app/src/main/java/org/libremediaconverter/codec/AndroidDeviceCodecs.kt

@@ -75,7 +75,13 @@ class AndroidDeviceCodecs private constructor(
             return AndroidDeviceCodecs(encoders, decoders)
         }
 
-        private fun mimeFor(codec: VideoCodec): String? = when (codec) {
+        /**
+         * `internal` rather than `private` so the cross-check test can ask what a [VideoCodec]
+         * means here and compare it with what [NAME_TO_MIME] says the same codec's names mean.
+         * The JVM test source set is a friend of `main`, so this stays invisible outside the
+         * module — the precedent is `MainActivity`'s `Destination`.
+         */
+        internal fun mimeFor(codec: VideoCodec): String? = when (codec) {
             VideoCodec.H264 -> MediaFormat.MIMETYPE_VIDEO_AVC
             VideoCodec.H265 -> MediaFormat.MIMETYPE_VIDEO_HEVC
             VideoCodec.VP8 -> MediaFormat.MIMETYPE_VIDEO_VP8
@@ -87,20 +93,62 @@ class AndroidDeviceCodecs private constructor(
             VideoCodec.COPY, VideoCodec.NONE -> null
         }
 
-        /** Maps an FFprobe-style codec name onto a MediaFormat MIME type. */
-        private fun mimeForCodecName(name: String): String? = when (name.lowercase()) {
-            "h264", "avc", "avc1" -> MediaFormat.MIMETYPE_VIDEO_AVC
-            "hevc", "h265", "hvc1" -> MediaFormat.MIMETYPE_VIDEO_HEVC
-            "vp8" -> MediaFormat.MIMETYPE_VIDEO_VP8
-            "vp9" -> MediaFormat.MIMETYPE_VIDEO_VP9
-            "av1", "av01" -> MediaFormat.MIMETYPE_VIDEO_AV1
-            "mpeg4" -> MediaFormat.MIMETYPE_VIDEO_MPEG4
-            // Unknown to us: assume the platform can handle it and let a failed export
-            // trigger the FFmpeg fallback, rather than pre-emptively refusing hardware.
-            else -> null
-        }
+        /**
+         * FFprobe-style codec names, and the MediaFormat MIME type each one asks about.
+         *
+         * This is the same vocabulary `CodecNames.VIDEO_ALIASES` holds, written out a second time
+         * because this side has to answer in platform MIME types and `model` does not depend on
+         * Android. Two copies of one vocabulary drift, and these had: `x264`, `hev1`, `x265` and
+         * `vp09` resolved for display and routing and fell through to null here, so the app ran
+         * the capability check blind on inputs it had already identified (#87). They are listed
+         * now, which **changes behaviour** for those four names — see [mimeForCodecName].
+         *
+         * A map rather than a `when` because a `when` cannot be enumerated, and `CodecVocabularyTest`
+         * has to walk both key sets to notice the next divergence.
+         */
+        internal val NAME_TO_MIME: Map<String, String> = mapOf(
+            "h264" to MediaFormat.MIMETYPE_VIDEO_AVC,
+            "avc" to MediaFormat.MIMETYPE_VIDEO_AVC,
+            "avc1" to MediaFormat.MIMETYPE_VIDEO_AVC,
+            "x264" to MediaFormat.MIMETYPE_VIDEO_AVC,
+            "hevc" to MediaFormat.MIMETYPE_VIDEO_HEVC,
+            "h265" to MediaFormat.MIMETYPE_VIDEO_HEVC,
+            "hvc1" to MediaFormat.MIMETYPE_VIDEO_HEVC,
+            "hev1" to MediaFormat.MIMETYPE_VIDEO_HEVC,
+            "x265" to MediaFormat.MIMETYPE_VIDEO_HEVC,
+            "vp8" to MediaFormat.MIMETYPE_VIDEO_VP8,
+            "vp9" to MediaFormat.MIMETYPE_VIDEO_VP9,
+            "vp09" to MediaFormat.MIMETYPE_VIDEO_VP9,
+            "av1" to MediaFormat.MIMETYPE_VIDEO_AV1,
+            "av01" to MediaFormat.MIMETYPE_VIDEO_AV1,
+            "mpeg4" to MediaFormat.MIMETYPE_VIDEO_MPEG4,
+        )
 
-        /** Test seam: lets instrumented tests build a probe from explicit sets. */
+        /**
+         * The names in [NAME_TO_MIME] that no [VideoCodec] member spells, and why.
+         *
+         * MPEG-4 Part 2 is decodable input the app never targets, so there is no enum for it and
+         * `CodecNames` is right not to carry it. That makes it the one place the two tables
+         * legitimately differ. It is listed rather than implied so the cross-check can tell a
+         * documented asymmetry from a fresh drift — and so the list itself is checked: a name here
+         * that `CodecNames` does resolve is a divergence being waved through, and the test fails on
+         * it.
+         */
+        internal val DECODE_ONLY_NAMES: Set<String> = setOf("mpeg4")
+
+        /**
+         * Maps an FFprobe-style codec name onto a MediaFormat MIME type.
+         *
+         * Null keeps its documented meaning — unknown to us: assume the platform can handle it and
+         * let a failed export trigger the FFmpeg fallback, rather than pre-emptively refusing
+         * hardware. What changed with #87 is which names are unknown. Four that FFmpeg genuinely
+         * emits used to land here and be treated as unknown while the rest of the app knew exactly
+         * what they were; a device without the matching decoder now routes them to FFmpeg up front
+         * instead of spending a doomed hardware attempt to find out.
+         */
+        internal fun mimeForCodecName(name: String): String? = NAME_TO_MIME[name.lowercase()]
+
+        /** Test seam: lets a test build a probe from explicit sets, on a device or on the JVM. */
         fun forTesting(encoders: Set<String>, decoders: Set<String>) = AndroidDeviceCodecs(encoders, decoders)
     }
 }

app/src/main/java/org/libremediaconverter/convert/ConversionViewModel.kt

@@ -101,7 +101,42 @@ sealed interface ConversionState {
         val mimeType: String = "",
     ) : ConversionState
     data class Saved(val displayName: String) : ConversionState
-    data class Failed(val message: String) : ConversionState
+
+    /**
+     * The job, or the save that followed it, could not be finished.
+     *
+     * [retry] is non-null for exactly one cause: a [ConversionViewModel.save] whose copy to the
+     * user's destination threw. That save deliberately keeps the staged file -- it can be the only
+     * copy of an hour of transcoding -- and this is what lets the screen offer it again. Every
+     * other failure leaves it null, because there is nothing staged to offer: a transcode that
+     * died produced no output, and a save that found the file gone has nothing left to save.
+     *
+     * Nullable rather than a `SaveFailed` state of its own. What the screen does with the message
+     * is identical either way, so a second variant would make every exhaustive `when` grow an arm
+     * that duplicates this one.
+     *
+     * A view of the file, not a second owner of it -- see [PendingSave].
+     */
+    data class Failed(val message: String, val retry: PendingSave? = null) : ConversionState
+}
+
+/**
+ * The staged output a save would target from this state, or null when there is nothing to save.
+ *
+ * One function for two callers that have to agree. [ConversionViewModel.save] picks the file to
+ * copy with it, and `ConverterScreen` registers its `CreateDocument` contract with the MIME type
+ * it returns; when those two read the state separately, a retry offered after a failed save opened
+ * the dialog with the *picker's* current type instead of the finished job's -- wrong for any job
+ * whose spec has been edited since, and for every reattached job, whose spec was never in these
+ * settings at all.
+ *
+ * Top-level and `internal` rather than a member of the ViewModel, so the screen can call it
+ * without one -- which is also what makes the derivation testable on the JVM.
+ */
+internal fun ConversionState.pendingSave(): PendingSave? = when (this) {
+    is ConversionState.Converted -> PendingSave(staged, suggestedName, mimeType)
+    is ConversionState.Failed -> retry
+    else -> null
 }
 
 @UnstableApi
@@ -120,6 +155,29 @@ class ConversionViewModel @JvmOverloads constructor(
      * the first screen.
      */
     private val cleanupDispatcher: CoroutineDispatcher = Dispatchers.IO,
+    /**
+     * Where the two blocking hops behind a pick run — the metadata query and the probe.
+     *
+     * A seam for the probe above all, because that is the one call in this class that throws
+     * on purpose. [probeOrUnreadable] rethrows anything that is not a native load failure, and
+     * the `launch` it runs in has no exception handler by design: on a device the error reaches
+     * the thread's default handler and takes the process down, which is what an
+     * [OutOfMemoryError] should do.
+     *
+     * On the JVM there is no such handler. kotlinx-coroutines-test installs a process-wide
+     * collector, once and for the life of the classloader, that keeps an escaped error and
+     * hands it to whichever `runTest` starts next — so it failed a Compose test class that had
+     * nothing to do with it, and *which* class moved between runs of identical code. Naming the
+     * dispatcher is what lets a test keep the throw inside its own window, where it fails the
+     * test that caused it and is consumed rather than collected.
+     *
+     * Both hops rather than the probe alone, which is where this differs from the seam issue #66
+     * proposed: leaving the metadata query on a real [Dispatchers.IO] makes the coroutine resume
+     * on a main looper that Robolectric leaves paused, and that bounce is precisely the
+     * asynchrony that made delivery unpredictable. One dispatcher covers a whole pick, and
+     * leaves nothing about it to timing.
+     */
+    private val pickDispatcher: CoroutineDispatcher = Dispatchers.IO,
 ) : AndroidViewModel(app) {
 
     private val workManager = WorkManager.getInstance(app)
@@ -135,13 +193,34 @@ class ConversionViewModel @JvmOverloads constructor(
     private var observer: Job? = null
     private var activeWorkId: UUID? = null
 
+    /**
+     * Who is allowed to write to this screen — see [ScreenOwnership] for the rule and why
+     * cancelling the superseded coroutine is not one.
+     *
+     * Every write below that lands after a suspension point is guarded by it: the two in
+     * [onInputPicked] and the one in [observe].
+     *
+     * [save] is the one left out, deliberately — and not because it is safe in both directions.
+     * Nothing can overwrite what it writes: it is reachable only from [ConversionState.Converted]
+     * or a [ConversionState.Failed] carrying its file, so the only observation that could belongs
+     * to a job already in a terminal state, which will not emit again. What it can still do is
+     * land on top of a [reset] taken while its copy was in flight, putting `Saved` on a screen the
+     * user has just cleared. Guarding it would drop that write instead, reporting nothing for a
+     * file that may genuinely have reached the user's destination. Which of those two is right is
+     * a question about what the screen should offer during a save, not about this race, so it is
+     * filed as issue #123 rather than decided here in passing.
+     */
+    private val ownership = ScreenOwnership()
+
     /**
      * The staged output this ViewModel is responsible for deleting.
      *
-     * A field rather than something read back out of [_state], because the state machine
-     * cannot answer the question on the path that needs it most: a failed [save] lands on
-     * [ConversionState.Failed], which carries a message and no file at all. By then the
-     * only remaining reference would have been lost.
+     * A field rather than something read back out of [_state], and still one now that
+     * [ConversionState.Failed] carries a [PendingSave] after a failed [save]. That handle is a
+     * view for the screen to offer a retry through; this one is the single reference [reset]
+     * deletes through, and keeping the two apart is what stops a second owner appearing. Reading
+     * the file back out of the state machine instead would mean trusting every state that has no
+     * file -- `Idle`, `Saved`, a transcode failure -- to say so.
      */
     private var pendingStaged: File? = null
 
@@ -184,6 +263,10 @@ class ConversionViewModel @JvmOverloads constructor(
      * `Data` — see [ConversionState.Converted].
      */
     private fun reattach() {
+        // Read before the launch, and before the query it is about to suspend in. This is the
+        // claim the answer will belong to: anything the user does from here on supersedes it, and
+        // reading it on the far side of the query would read whatever superseded it instead.
+        val token = ownership.current
         viewModelScope.launch {
             val reattachment = Reattachment.choose(
                 workManager.jobSnapshots(
@@ -194,8 +277,17 @@ class ConversionViewModel @JvmOverloads constructor(
 
             // The query suspends, so by now the user may have picked a file or started a
             // conversion of their own. Either owns the screen; reattaching over it would throw
-            // away what they just did. Both this check and the assignment below run on the main
-            // dispatcher with no suspension point between them, so nothing can interleave.
+            // away what they just did.
+            //
+            // This catches a pick that has already *landed*, and only that. It used to claim that
+            // "both this check and the assignment below run on the main dispatcher with no
+            // suspension point between them, so nothing can interleave" — which was the exact
+            // opposite of what happens. There is no assignment below. There is observe(), which
+            // launches a *separate* coroutine that must suspend on `collect` before it can write
+            // anything, so the check happens at one moment and the write lands at another with a
+            // whole pick able to fit in between. That was issue #49, and believing this comment is
+            // why it read as flaky CI for two days. What actually holds the line is the token
+            // observe() carries: see [ScreenOwnership].
             if (_state.value !is ConversionState.Idle || activeWorkId != null) return@launch
 
             // Only a job that is the sole explanation for its staged file gets to name the input.
@@ -221,7 +313,7 @@ class ConversionViewModel @JvmOverloads constructor(
             activeWorkId = reattachment.job.id
             // No initial state of our own: the flow's first emission carries the job's real
             // state, so observe() maps it exactly as it would for a conversion started here.
-            observe(reattachment.job.id, input, cancelled = ConversionState.Idle)
+            observe(reattachment.job.id, input, cancelled = ConversionState.Idle, token = token)
         }
     }
 
@@ -237,25 +329,34 @@ class ConversionViewModel @JvmOverloads constructor(
     fun setQuality(quality: QualityTier) = _settings.update { it.copy(quality = quality) }
     fun setEnginePreference(preference: EnginePreference) = _settings.update { it.copy(enginePreference = preference) }
 
+    /**
+     * The tap is the claim, which is why [ScreenOwnership.claim] is called here and not inside the
+     * `launch`. A claim made in the coroutine would only be immediate for as long as
+     * `Dispatchers.Main.immediate` happened to run it inline, and a deferred claim leaves the same
+     * gap this closes: it is the difference between the user owning the screen from the moment
+     * they tapped and owning it from whenever their coroutine got around to running.
+     */
     fun onInputPicked(uri: Uri) {
+        val token = ownership.claim()
         viewModelScope.launch {
             // Both the metadata query and the probe touch disk, and the probe spawns FFprobe.
             // Neither belongs on the main thread.
-            val file = withContext(Dispatchers.IO) { InputQuery.describe(getApplication(), uri) }
+            val file = withContext(pickDispatcher) { InputQuery.describe(getApplication(), uri) }
+            // Every write below the hop above is guarded, this one included: two picks in quick
+            // succession suspend here together, and without this the slower one would land last
+            // and put the file the user did not choose on screen.
+            if (!ownership.stillHeldBy(token)) return@launch
             // Show the file as soon as its name and size are known. Probing now runs FFprobe on
             // every pick, which is a native process spawn, and making the whole screen wait on it
             // would read as the app having ignored the tap.
             _state.value = ConversionState.Ready(file)
 
-            val probe = withContext(Dispatchers.IO) { probeOrUnreadable(uri) }
-            // Only fill in the probe if the user has not moved on in the meantime.
-            _state.update { current ->
-                if (current is ConversionState.Ready && current.input.uri == uri) {
-                    ConversionState.Ready(file.copy(probe = probe))
-                } else {
-                    current
-                }
-            }
+            val probe = withContext(pickDispatcher) { probeOrUnreadable(uri) }
+            // Only fill in the probe if the user has not moved on in the meantime. The claim is
+            // what says whether they have -- it covers a second pick of the same URI, which a
+            // comparison of URIs cannot, and every state a later claim could have written.
+            if (!ownership.stillHeldBy(token)) return@launch
+            _state.value = ConversionState.Ready(file.copy(probe = probe))
         }
     }
 
@@ -306,10 +407,13 @@ class ConversionViewModel @JvmOverloads constructor(
             quality = settings.quality,
             enginePreference = settings.enginePreference,
         )
+        // Tapping Convert claims the screen for this job, which is what supersedes the pick's
+        // still-in-flight probe and any reattachment that has not finished asking.
+        val token = ownership.claim()
         activeWorkId = request.id
         workManager.enqueue(request)
         _state.value = ConversionState.Converting(input, 0)
-        observe(request.id, input)
+        observe(request.id, input, token = token)
     }
 
     /**
@@ -317,12 +421,27 @@ class ConversionViewModel @JvmOverloads constructor(
      *   picked file, ready to convert again. For one picked up by [reattach] there is no picked
      *   file — the URI that job holds belongs to a process that no longer exists — so it lands
      *   on Idle instead, rather than offering a Convert button over a file nothing can open.
+     * @param token the claim this observation belongs to. Nothing here can write until `collect`
+     *   has resumed with a `WorkInfo`, which is some time after the caller decided to observe, so
+     *   the claim is checked again at the last possible moment rather than trusted from then. This
+     *   is issue #49's fix and the only thing standing between a superseded observation and the
+     *   user's screen — see [ScreenOwnership].
      */
-    private fun observe(id: UUID, input: InputFile, cancelled: ConversionState = ConversionState.Ready(input)) {
+    private fun observe(
+        id: UUID,
+        input: InputFile,
+        cancelled: ConversionState = ConversionState.Ready(input),
+        token: Long,
+    ) {
         observer?.cancel()
         observer = viewModelScope.launch {
             workManager.getWorkInfoByIdFlow(id).collect { info ->
                 if (info == null) return@collect
+                // Ahead of the `when`, not merely ahead of the assignment: the SUCCEEDED branch
+                // takes ownership of the staged file, and a superseded observation must not do
+                // that either. The state and `pendingStaged` are meant to refer to the same file
+                // or to no file, and this is where that stays true.
+                if (!ownership.stillHeldBy(token)) return@collect
                 _state.value = when (info.state) {
                     WorkInfo.State.RUNNING -> ConversionState.Converting(
                         input,
@@ -403,35 +522,50 @@ class ConversionViewModel @JvmOverloads constructor(
     /**
      * Copies the staged result out to the destination the user picked.
      *
+     * Reached from [ConversionState.Converted] and again from a [ConversionState.Failed] that an
+     * earlier save left carrying its file. [pendingSave] is what makes those one call rather than
+     * two, so a retry cannot drift from the first attempt in what it copies or what it calls it.
+     *
      * The existence check is not redundant with the one reattachment already made. That one ran
      * inside a tag query which, for a result offered on launch, can be hours older than the tap —
      * and `cacheDir` is exactly the directory the OS empties when it wants space, which is also
      * what the sweep does to anything a day old. Without it the file's absence arrived as
-     * `staged.inputStream()` throwing, and `e.message` put a raw ENOENT path on screen.
+     * `staged.inputStream()` throwing, and `e.message` put a raw ENOENT path on screen. A retry
+     * meets that same check a second time, which is the point of reusing it here.
      */
     fun save(destination: Uri) {
-        val converted = _state.value as? ConversionState.Converted ?: return
-        if (!converted.staged.isFile) {
+        val pending = _state.value.pendingSave() ?: return
+        if (!pending.staged.isFile) {
+            // No retry handle: the file such a state would offer again is exactly the one that
+            // has gone, so carrying it would put a button on screen that cannot do anything.
             _state.value = ConversionState.Failed(STAGED_FILE_GONE_MESSAGE)
             return
         }
         viewModelScope.launch {
             runCatching {
                 withContext(Dispatchers.IO) {
-                    publisher.publish(converted.staged, destination)
-                    converted.staged.delete()
+                    publisher.publish(pending.staged, destination)
+                    pending.staged.delete()
                 }
             }.onSuccess {
                 // publish() already deleted it; nothing left to clean up.
                 pendingStaged = null
-                _state.value = ConversionState.Saved(converted.suggestedName)
+                _state.value = ConversionState.Saved(pending.suggestedName)
             }.onFailure { e ->
                 // Deliberately NOT cleared. A failed save may mean the staged file is the
                 // only copy of an hour of transcoding, and the user's destination did not
                 // receive it -- deleting here would destroy the work to tidy up a cache
                 // directory. It stays collectable: by a later reset(), or by the sweep once
                 // it is old enough to be certain nobody is coming back for it.
-                _state.value = ConversionState.Failed(e.message ?: "Could not save the file.")
+                //
+                // `pending` rides on the state so the screen can offer that file again. It used
+                // to live only in `pendingStaged`, where nothing on screen could reach it -- so
+                // the single button this branch rendered was "Start over", which deletes the very
+                // file the paragraph above goes out of its way to keep. It is `pending` rather
+                // than a fresh handle for the second failure's sake: a retry that fails again
+                // lands back here still carrying the file, not on a bare Failed that would take
+                // the offer away.
+                _state.value = ConversionState.Failed(e.message ?: "Could not save the file.", pending)
             }
         }
     }
@@ -445,8 +579,18 @@ class ConversionViewModel @JvmOverloads constructor(
      * cancelled with [viewModelScope] if the Activity finishes first, so it is a best
      * effort rather than a guarantee. `OutputPublisher.sweepStaging` is the backstop for
      * the times it does not run.
+     *
+     * **It still deletes from a [ConversionState.Failed] carrying a [PendingSave], and that is a
+     * decision rather than something inherited.** Deletion is acceptable there only because the
+     * alternative was offered first: the screen puts "Try saving again" directly above this
+     * button, so reaching it is the user saying the work is not worth keeping. Until that button
+     * existed, this delete was the only thing a failed save could lead to — which was the defect.
      */
     fun reset() {
+        // Start over is a claim like any other. The cancel below is a request honoured at the next
+        // suspension point, so a collector already on its way to a write has nothing left to
+        // honour it at; the claim is what actually stops that write landing on top of Idle.
+        ownership.claim()
         observer?.cancel()
         observer = null
         activeWorkId = null

app/src/main/java/org/libremediaconverter/convert/ConverterScreen.kt

@@ -73,8 +73,11 @@ fun ConverterScreen(modifier: Modifier = Modifier, viewModel: ConversionViewMode
     // stands: some providers rewrite a document's extension to match it, so an MP3 offered as
     // video/webm can arrive with the wrong one. Read straight off the collected state, so this
     // recomposes because it depends on that rather than because an unrelated line happens to.
+    // Through pendingSave() rather than a cast to Converted, so a retry offered after a failed
+    // save opens the dialog with the type its first attempt used -- the cast answered null for a
+    // Failed, and the fallback below is the current picker, which a reattached job never set.
     // Remembered against the type so the launcher re-registers only when it actually changes.
-    val destinationMime = (state as? ConversionState.Converted)?.mimeType ?: settings.spec.mimeType
+    val destinationMime = state.pendingSave()?.mimeType ?: settings.spec.mimeType
     val chooseDestination = rememberLauncherForActivityResult(
         remember(destinationMime) { ActivityResultContracts.CreateDocument(destinationMime) },
     ) { uri -> uri?.let(viewModel::save) }
@@ -87,6 +90,89 @@ fun ConverterScreen(modifier: Modifier = Modifier, viewModel: ConversionViewMode
         ActivityResultContracts.RequestPermission(),
     ) { viewModel.convert() }
 
+    ConverterScreenContent(
+        state = state,
+        settings = settings,
+        validation = validation,
+        actions = ConverterActions(
+            onPickInput = { pickInput.launch(arrayOf("*/*")) },
+            onPreset = viewModel::setPreset,
+            onContainer = viewModel::setContainer,
+            onVideoCodec = viewModel::setVideoCodec,
+            onAudioCodec = viewModel::setAudioCodec,
+            onSuggestion = viewModel::applySuggestion,
+            onQuality = viewModel::setQuality,
+            onEnginePreference = viewModel::setEnginePreference,
+            onConvert = { requestNotifications.launch(Manifest.permission.POST_NOTIFICATIONS) },
+            onCancel = viewModel::cancel,
+            onSave = { suggestedName -> chooseDestination.launch(suggestedName) },
+            onReset = viewModel::reset,
+        ),
+        modifier = modifier,
+    )
+}
+
+/**
+ * Everything [ConverterScreenContent] can ask for, in one value.
+ *
+ * A holder rather than twelve parameters because detekt's `LongParameterList` sits at its default
+ * threshold of six and `config/detekt/detekt.yml` does not relax it for `@Composable` the way it
+ * relaxes `LongMethod` and `CyclomaticComplexMethod` -- `AdvancedPicker` already sits exactly on
+ * that threshold. The rule exempts data classes, so the callbacks travel together.
+ *
+ * In production every one of these is a launcher or a `ConversionViewModel` call. Naming them here
+ * instead of handing the content a ViewModel is the whole point of the seam: a test can render a
+ * [ConversionState] no ViewModel can be driven into, since `Waiting` needs a denied foreground
+ * start and `Converted` needs a worker run that has already succeeded.
+ */
+internal data class ConverterActions(
+    /** Open the document picker. The `Idle` and `Ready` branches both offer it. */
+    val onPickInput: () -> Unit,
+    val onPreset: (OutputFormat) -> Unit,
+    val onContainer: (Container) -> Unit,
+    val onVideoCodec: (VideoCodec) -> Unit,
+    val onAudioCodec: (AudioCodec) -> Unit,
+    val onSuggestion: (OutputSpec) -> Unit,
+    val onQuality: (QualityTier) -> Unit,
+    val onEnginePreference: (EnginePreference) -> Unit,
+    /**
+     * Start the job. It asks for the notification permission first, which is why the screen never
+     * calls `convert` directly -- the launcher's result callback does, whichever way it went.
+     */
+    val onConvert: () -> Unit,
+    val onCancel: () -> Unit,
+    /**
+     * Open the save dialog for the finished output.
+     *
+     * Takes the suggested name rather than reading it back off the state, because the name comes
+     * from the job -- see `ConversionWorker.KEY_SUGGESTED_NAME` -- and the branch that renders the
+     * button is the only place that has it.
+     */
+    val onSave: (suggestedName: String) -> Unit,
+    val onReset: () -> Unit,
+)
+
+/**
+ * The converter screen, with its state handed in.
+ *
+ * Split from [ConverterScreen] so that state has somewhere to come from other than a live
+ * `ConversionViewModel`. Driving the screen through a real one needs a `WorkManager` and a media
+ * probe in the constructor, and even then two of the six states are unreachable: `Waiting` follows
+ * a denied foreground start and `Converted` follows a completed worker.
+ *
+ * `internal` rather than private, because `src/test` is a friend of `main` and this is what the
+ * state tests compose. The leaves below stay exactly where they were -- this function is a move,
+ * not a redesign, and the tests that already pin those leaves are what says so.
+ */
+@UnstableApi
+@Composable
+internal fun ConverterScreenContent(
+    state: ConversionState,
+    settings: ConversionSettings,
+    validation: Validation,
+    actions: ConverterActions,
+    modifier: Modifier = Modifier,
+) {
     Column(
         modifier = modifier
             .fillMaxSize()
@@ -115,7 +201,7 @@ fun ConverterScreen(modifier: Modifier = Modifier, viewModel: ConversionViewMode
                     modifier = Modifier.padding(bottom = 16.dp),
                 )
                 Button(
-                    onClick = { pickInput.launch(arrayOf("*/*")) },
+                    onClick = actions.onPickInput,
                     modifier = Modifier
                         .fillMaxWidth()
                         .height(PrimaryButtonHeight)
@@ -132,21 +218,19 @@ fun ConverterScreen(modifier: Modifier = Modifier, viewModel: ConversionViewMode
 
                     is ConversionState.Ready -> {
                         FileCard(s.input)
-                        FormatPicker(settings.matchingPreset, viewModel::setPreset)
+                        FormatPicker(settings.matchingPreset, actions.onPreset)
                         AdvancedPicker(
                             spec = settings.spec,
                             validation = validation,
-                            onContainer = viewModel::setContainer,
-                            onVideoCodec = viewModel::setVideoCodec,
-                            onAudioCodec = viewModel::setAudioCodec,
-                            onSuggestion = viewModel::applySuggestion,
+                            onContainer = actions.onContainer,
+                            onVideoCodec = actions.onVideoCodec,
+                            onAudioCodec = actions.onAudioCodec,
+                            onSuggestion = actions.onSuggestion,
                         )
-                        QualityPicker(settings.quality, viewModel::setQuality)
-                        EnginePicker(settings.enginePreference, viewModel::setEnginePreference)
+                        QualityPicker(settings.quality, actions.onQuality)
+                        EnginePicker(settings.enginePreference, actions.onEnginePreference)
                         Button(
-                            onClick = {
-                                requestNotifications.launch(Manifest.permission.POST_NOTIFICATIONS)
-                            },
+                            onClick = actions.onConvert,
                             // The Advanced picker lets an impossible combination be selected on
                             // purpose, so this is what stops it from being run.
                             enabled = validation.isValid,
@@ -156,7 +240,7 @@ fun ConverterScreen(modifier: Modifier = Modifier, viewModel: ConversionViewMode
                                 .testTag(TestTags.Converter.CONVERT),
                         ) { Text("Convert") }
                         OutlinedButton(
-                            onClick = { pickInput.launch(arrayOf("*/*")) },
+                            onClick = actions.onPickInput,
                             modifier = Modifier
                                 .fillMaxWidth()
                                 .testTag(TestTags.Converter.CHOOSE_DIFFERENT_FILE),
@@ -173,7 +257,7 @@ fun ConverterScreen(modifier: Modifier = Modifier, viewModel: ConversionViewMode
                                 .testTag(TestTags.Converter.PROGRESS),
                         )
                         OutlinedButton(
-                            onClick = viewModel::cancel,
+                            onClick = actions.onCancel,
                             modifier = Modifier.fillMaxWidth().testTag(TestTags.CANCEL),
                         ) { Text("Cancel") }
                     }
@@ -192,7 +276,7 @@ fun ConverterScreen(modifier: Modifier = Modifier, viewModel: ConversionViewMode
                             style = MaterialTheme.typography.bodyMedium,
                         )
                         OutlinedButton(
-                            onClick = viewModel::cancel,
+                            onClick = actions.onCancel,
                             modifier = Modifier.fillMaxWidth().testTag(TestTags.CANCEL),
                         ) { Text("Cancel") }
                     }
@@ -208,17 +292,21 @@ fun ConverterScreen(modifier: Modifier = Modifier, viewModel: ConversionViewMode
                             // explains why a job was slow, makes the software fallback
                             // visible, and is how the user learns a remux happened rather
                             // than a re-encode.
-                            AssistChip(onClick = {}, label = { Text(s.routeReason) })
+                            AssistChip(
+                                onClick = {},
+                                label = { Text(s.routeReason) },
+                                modifier = Modifier.testTag(TestTags.Converter.ROUTE_REASON),
+                            )
                         }
                         Button(
-                            onClick = { chooseDestination.launch(s.suggestedName) },
+                            onClick = { actions.onSave(s.suggestedName) },
                             modifier = Modifier
                                 .fillMaxWidth()
                                 .height(PrimaryButtonHeight)
                                 .testTag(TestTags.SAVE_FILE),
                         ) { Text("Save file") }
                         OutlinedButton(
-                            onClick = viewModel::reset,
+                            onClick = actions.onReset,
                             modifier = Modifier.fillMaxWidth().testTag(TestTags.START_OVER),
                         ) { Text("Start over") }
                     }
@@ -226,7 +314,7 @@ fun ConverterScreen(modifier: Modifier = Modifier, viewModel: ConversionViewMode
                     is ConversionState.Saved -> {
                         Text("Saved ${s.displayName}.", style = MaterialTheme.typography.bodyLarge)
                         Button(
-                            onClick = viewModel::reset,
+                            onClick = actions.onReset,
                             modifier = Modifier
                                 .fillMaxWidth()
                                 .height(PrimaryButtonHeight)
@@ -240,13 +328,36 @@ fun ConverterScreen(modifier: Modifier = Modifier, viewModel: ConversionViewMode
                             color = MaterialTheme.colorScheme.error,
                             style = MaterialTheme.typography.bodyMedium,
                         )
-                        Button(
-                            onClick = viewModel::reset,
-                            modifier = Modifier
-                                .fillMaxWidth()
-                                .height(PrimaryButtonHeight)
-                                .testTag(TestTags.START_OVER),
-                        ) { Text("Start over") }
+                        val retry = s.retry
+                        if (retry == null) {
+                            // Nothing was staged, so "Start over" is the whole of what is on
+                            // offer and stays the primary button.
+                            Button(
+                                onClick = actions.onReset,
+                                modifier = Modifier
+                                    .fillMaxWidth()
+                                    .height(PrimaryButtonHeight)
+                                    .testTag(TestTags.START_OVER),
+                            ) { Text("Start over") }
+                        } else {
+                            Button(
+                                onClick = { actions.onSave(retry.suggestedName) },
+                                modifier = Modifier
+                                    .fillMaxWidth()
+                                    .height(PrimaryButtonHeight)
+                                    .testTag(TestTags.RETRY_SAVE),
+                            ) { Text("Try saving again") }
+                            // Start over still deletes the file this state is carrying, and that
+                            // is deliberate: `reset()` is what stops a full-size output sitting in
+                            // cache until the sweep. What makes the delete acceptable is the
+                            // button above it. Deletion is the user's choice only once the
+                            // alternative has been offered -- and until that button existed, this
+                            // one was the only thing a failed save could lead to.
+                            OutlinedButton(
+                                onClick = actions.onReset,
+                                modifier = Modifier.fillMaxWidth().testTag(TestTags.START_OVER),
+                            ) { Text("Start over") }
+                        }
                     }
                 }
             }

app/src/main/java/org/libremediaconverter/convert/Media3Engine.kt

@@ -68,42 +68,64 @@ class Media3Engine(private val context: Context) : HardwareTranscoder {
     ): Unit = suspendCancellableCoroutine { cont ->
         val plan = CopyPlanner.plan(request.spec, request.probe)
         handler.post {
-            val transformer = runCatching { buildTransformer(plan, cont) }
-                .getOrElse {
-                    cont.resumeWithException(it)
-                    return@post
-                }
-
-            // Dropping the tracks the target does not have is what stops an audio-only export
-            // from carrying a re-encoded video track. Without setRemoveVideo, asking for M4A
-            // produced an HEVC stream in a file named .m4a.
-            val item = EditedMediaItem.Builder(MediaItem.fromUri(input))
-                .setRemoveVideo(plan.video == VideoPlan.Drop)
-                .setRemoveAudio(plan.audio == AudioPlan.Drop)
-                .build()
-
-            // A Composition is the only way to ask for transmuxing; the plain
-            // start(EditedMediaItem, path) overload always re-encodes. This is the remux path.
-            val composition = Composition.Builder(EditedMediaItemSequence.Builder(item).build())
-                .setTransmuxVideo(plan.video == VideoPlan.Copy)
-                .setTransmuxAudio(plan.audio == AudioPlan.Copy)
-                .build()
-
-            cont.invokeOnCancellation {
-                // cancel() has the same single-thread requirement as start().
-                handler.post { runCatching { transformer.cancel() } }
-            }
-
-            runCatching { transformer.start(composition, output.absolutePath) }
-                .onFailure {
-                    cont.resumeWithException(it)
-                    return@post
-                }
-
-            pollProgress(transformer, cont, onProgress)
+            // One guard around the whole body, deliberately.
+            //
+            // This used to be two narrow ones — around `buildTransformer` and around
+            // `transformer.start` — with the two Media3 builders sitting unguarded between them.
+            // On this thread that is not a small gap: nothing here has a caller to throw back to,
+            // so an escaping exception reaches the HandlerThread's uncaught handler and takes the
+            // process down, while [cont] is never resumed either way. `EditedMediaItem.Builder`
+            // does exactly that for a plan that drops both tracks
+            // ("Audio and video cannot both be removed"), which a queued job can still carry.
+            // Widening the guard costs nothing on success and turns every such refusal into a
+            // failed job with a reason.
+            runCatching { startExport(input, output, plan, cont, onProgress) }
+                .onFailure { if (cont.isActive) cont.resumeWithException(it) }
         }
     }
 
+    /**
+     * Builds the export and hands it to Transformer. Runs on the HandlerThread; may throw.
+     *
+     * Everything Transformer's single-thread contract covers lives here, so that the caller has
+     * exactly one place to catch. Returning normally means the export is running and [cont] belongs
+     * to the listener; throwing means it never started and the caller owns resuming.
+     */
+    private fun startExport(
+        input: Uri,
+        output: File,
+        plan: ConversionPlan,
+        cont: CancellableContinuation<Unit>,
+        onProgress: (Int) -> Unit,
+    ) {
+        val transformer = buildTransformer(plan, cont)
+
+        // Dropping the tracks the target does not have is what stops an audio-only export
+        // from carrying a re-encoded video track. Without setRemoveVideo, asking for M4A
+        // produced an HEVC stream in a file named .m4a.
+        val item = EditedMediaItem.Builder(MediaItem.fromUri(input))
+            .setRemoveVideo(plan.video == VideoPlan.Drop)
+            .setRemoveAudio(plan.audio == AudioPlan.Drop)
+            .build()
+
+        // A Composition is the only way to ask for transmuxing; the plain
+        // start(EditedMediaItem, path) overload always re-encodes. This is the remux path.
+        val composition = Composition.Builder(EditedMediaItemSequence.Builder(item).build())
+            .setTransmuxVideo(plan.video == VideoPlan.Copy)
+            .setTransmuxAudio(plan.audio == AudioPlan.Copy)
+            .build()
+
+        // Registered before start(), so a cancellation racing the export always finds a
+        // transformer to cancel.
+        cont.invokeOnCancellation {
+            // cancel() has the same single-thread requirement as start().
+            handler.post { runCatching { transformer.cancel() } }
+        }
+
+        transformer.start(composition, output.absolutePath)
+        pollProgress(transformer, cont, onProgress)
+    }
+
     /**
      * @throws IllegalArgumentException if [plan] names a container Media3 cannot mux. That is a
      *   routing bug rather than a runtime condition — [org.libremediaconverter.model.ConversionRouter]
@@ -138,31 +160,6 @@ class Media3Engine(private val context: Context) : HardwareTranscoder {
             .build()
     }
 
-    /**
-     * Media3 encodes only H.264 and H.265 of the codecs this app offers.
-     *
-     * VP8/VP9/AV1 targets never reach here — the router sends them to FFmpeg because
-     * `Transformer.setVideoMimeType` rejects them — so anything unexpected returns null and lets
-     * Transformer pick, rather than silently substituting H.265 the way the old mapping did.
-     */
-    private fun videoMimeTypeFor(codec: VideoCodec): String? = when (codec) {
-        VideoCodec.H264 -> MimeTypes.VIDEO_H264
-        VideoCodec.H265 -> MimeTypes.VIDEO_H265
-        // Never reached: only an Encode plan consults this, and COPY/NONE are not Encode.
-        VideoCodec.COPY, VideoCodec.NONE -> null
-        VideoCodec.VP8, VideoCodec.VP9, VideoCodec.AV1 -> null
-    }
-
-    private fun audioMimeTypeFor(codec: AudioCodec): String? = when (codec) {
-        AudioCodec.AAC -> MimeTypes.AUDIO_AAC
-        AudioCodec.OPUS -> MimeTypes.AUDIO_OPUS
-        AudioCodec.VORBIS -> MimeTypes.AUDIO_VORBIS
-        AudioCodec.PCM -> MimeTypes.AUDIO_RAW
-        AudioCodec.COPY, AudioCodec.NONE -> null
-        // MP3 and FLAC have no Android encoder; the router routes them to FFmpeg.
-        AudioCodec.MP3, AudioCodec.FLAC -> null
-    }
-
     /**
      * Polls export progress on the Transformer's own thread.
      *
@@ -192,7 +189,57 @@ class Media3Engine(private val context: Context) : HardwareTranscoder {
         thread.quitSafely()
     }
 
-    private companion object {
+    /**
+     * The progress interval, and the two enum-to-MIME tables.
+     *
+     * The tables are pure functions of a codec enum, so they sit here rather than on the instance:
+     * a JVM test can then exercise every arm without constructing an engine, which would start a
+     * real [HandlerThread] to answer a lookup. `internal` rather than `private` for the reason
+     * `MainActivity`'s `Destination` records — the JVM test source set is a friend of `main`, so
+     * these stay invisible to anything outside the module.
+     */
+    internal companion object {
         const val PROGRESS_INTERVAL_MS = 250L
+
+        /**
+         * Media3 encodes only H.264 and H.265 of the codecs this app offers.
+         *
+         * VP8/VP9/AV1 targets never reach here — the router sends them to FFmpeg because
+         * `Transformer.setVideoMimeType` rejects them — so anything unexpected returns null and
+         * lets Transformer pick, rather than silently substituting H.265 as the old mapping did.
+         */
+        internal fun videoMimeTypeFor(codec: VideoCodec): String? = when (codec) {
+            VideoCodec.H264 -> MimeTypes.VIDEO_H264
+            VideoCodec.H265 -> MimeTypes.VIDEO_H265
+            // Never reached, and no longer only asserted: `Media3EngineMimeTypesTest` drives
+            // `CopyPlanner` over every spec it can be handed and shows that no Encode plan carries
+            // either, which is what turns "COPY/NONE are not Encode" into a checked claim.
+            VideoCodec.COPY, VideoCodec.NONE -> null
+            VideoCodec.VP8, VideoCodec.VP9, VideoCodec.AV1 -> null
+        }
+
+        /**
+         * Media3 encodes AAC, Opus and PCM. Three arms below are dead, not two.
+         *
+         * The comment this replaces named MP3 and FLAC as the exceptions, which reads as though
+         * every other arm were live. **Vorbis is not.** A single router rule diverts every audio
+         * codec outside {AAC, Opus, PCM} to FFmpeg, and Vorbis is outside it, so
+         * `VORBIS -> AUDIO_VORBIS` names a MIME type Transformer is never actually asked for.
+         *
+         * The arm stays because the mapping is correct — deleting a right answer out of
+         * unreachable code buys nothing — but it is an entry waiting on a routing change rather
+         * than a live one. `Media3EngineMimeTypesTest` routes all six encodable codecs and asserts
+         * which three arrive, so if that set moves, the disagreement fails rather than surprises.
+         */
+        internal fun audioMimeTypeFor(codec: AudioCodec): String? = when (codec) {
+            AudioCodec.AAC -> MimeTypes.AUDIO_AAC
+            AudioCodec.OPUS -> MimeTypes.AUDIO_OPUS
+            AudioCodec.VORBIS -> MimeTypes.AUDIO_VORBIS
+            AudioCodec.PCM -> MimeTypes.AUDIO_RAW
+            AudioCodec.COPY, AudioCodec.NONE -> null
+            // MP3 and FLAC have no Android encoder at any API level, so the router sends them to
+            // FFmpeg before an encoder is ever asked for.
+            AudioCodec.MP3, AudioCodec.FLAC -> null
+        }
     }
 }

app/src/main/java/org/libremediaconverter/convert/MediaProbe.kt

@@ -242,8 +242,20 @@ object MediaProbe {
         else -> Container.MKV
     }
 
-    /** FFprobe describes still images through the image demuxers rather than a media container. */
-    private fun isImageFormat(formatName: String): Boolean {
+    /**
+     * FFprobe describes still images through the image demuxers rather than a media container.
+     *
+     * The two halves of the rule are not interchangeable. `image2` is a whole name — what FFprobe
+     * reports for a numbered image sequence — while `_pipe` has to be a *suffix* test, because the
+     * piped demuxers are named one per image codec: `png_pipe`, `jpeg_pipe`, `webp_pipe`, and
+     * thirty more. Relaxing that suffix to a substring would swallow `yuv4mpegpipe`, which is raw
+     * video, and `classify` checks this before anything else — so a false positive makes the
+     * source-info card describe a video as an image.
+     *
+     * `internal` so the unit tests can name both halves; the JVM test source set is a friend of
+     * `main`, so this stays invisible outside the module.
+     */
+    internal fun isImageFormat(formatName: String): Boolean {
         val names = formatName.split(',').map { it.trim().lowercase() }
         return names.any { it == "image2" || it.endsWith("_pipe") }
     }
@@ -284,11 +296,35 @@ object MediaProbe {
         }
     }
 
-    private fun MediaFormat.intOr(key: String, fallback: Int = 0): Int =
+    /**
+     * One track property as an Int, or [fallback] when the format has no Int to give.
+     *
+     * `containsKey` alone is not enough, because `MediaFormat` is a heterogeneous map: a key it
+     * holds as a Float answers `getInteger` with a `ClassCastException` rather than a coercion, and
+     * `KEY_FRAME_RATE` — which [probeForConcat] reads — is legitimately set either way. The
+     * `runCatching` is therefore load-bearing rather than defensive. Without it a single
+     * oddly-typed field throws past the whole track loop, and the catch there answers with an empty
+     * [ConcatInput], discarding the codec and dimensions that had already been read.
+     *
+     * `internal` for the unit tests, as [shortName].
+     */
+    internal fun MediaFormat.intOr(key: String, fallback: Int = 0): Int =
         if (containsKey(key)) runCatching { getInteger(key) }.getOrDefault(fallback) else fallback
 
-    /** MediaFormat MIME -> the short codec names the router and FFmpeg both speak. */
-    private fun shortName(mime: String): String = when (mime) {
+    /**
+     * MediaFormat MIME -> the short codec names the router and FFmpeg both speak.
+     *
+     * A lookup table over platform constants is the shape that rots quietly. Most of these arms are
+     * translations rather than trimming — `video/avc` is `h264`, `audio/mp4a-latm` is `aac`,
+     * `video/x-vnd.on2.vp9` is `vp9` — so a dropped arm does not fail. It falls through to
+     * `substringAfter('/')` and reports a different, plausible-looking string that
+     * `CodecNames` may or may not still recognise, and an unrecognised codec is how a
+     * stream-copyable file quietly becomes a re-encode.
+     *
+     * `internal` so the unit tests can name every arm; the JVM test source set is a friend of
+     * `main`, so this stays invisible outside the module.
+     */
+    internal fun shortName(mime: String): String = when (mime) {
         MediaFormat.MIMETYPE_VIDEO_AVC -> "h264"
         MediaFormat.MIMETYPE_VIDEO_HEVC -> "hevc"
         MediaFormat.MIMETYPE_VIDEO_VP8 -> "vp8"

app/src/main/java/org/libremediaconverter/convert/OutputPublisher.kt

@@ -23,6 +23,24 @@ const val STAGED_FILE_GONE_MESSAGE: String =
     "The finished file is no longer in the cache, so there is nothing left to save. " +
         "Start over to make it again."
 
+/**
+ * A staged file that is still there to be saved, and everything the save dialog needs to offer it.
+ *
+ * The three travel together because a save cannot be repeated without all of them: the file to
+ * copy, the name to suggest, and the MIME type `CreateDocument` has to be registered with. None of
+ * them can be rederived from the pickers once the job is over -- they come from the job's own
+ * output `Data`, and a reattached job's spec was never in the current settings at all.
+ *
+ * Kept next to [STAGED_FILE_GONE_MESSAGE] for the same reason it is: both ViewModels need it and
+ * staging is what it is about.
+ *
+ * **A view of the staged file, never an owner of it.** The delete still runs through each
+ * ViewModel's own `pendingStaged` field, so a state carrying one of these can be dropped without
+ * losing the only reference -- which is what keeps "a `Failed` that carries a file" from being a
+ * new way to leak one.
+ */
+data class PendingSave(val staged: File, val suggestedName: String, val mimeType: String)
+
 /**
  * Staging and publication of conversion output.
  *

app/src/main/java/org/libremediaconverter/convert/ScreenOwnership.kt

@@ -0,0 +1,57 @@
+package org.libremediaconverter.convert
+
+/**
+ * Which of the things writing to a screen is still allowed to.
+ *
+ * Both ViewModels are a state machine written to from several coroutines that each suspend before
+ * they write: a pick hops to a dispatcher for the metadata query, a reattachment hops for the tag
+ * query, and an observation of a WorkManager job cannot write at all until its `collect` has
+ * resumed with a `WorkInfo`. Whoever resumes last wins, which is how issue #49 let a finished job
+ * from an earlier session take a screen the user had already picked a file on.
+ *
+ * The rule this makes enforceable is one line: **every write that lands after a suspension point
+ * checks the claim it was made under, and drops itself if that claim has been superseded.** The
+ * claim is taken synchronously, when the user acts; the check happens immediately before the
+ * write. Superseded work is *dropped*, not reordered — a dropped write cannot come back later.
+ *
+ * Cancelling the superseded coroutine is not a substitute and was never going to be. `Job.cancel`
+ * is a request, honoured at the next suspension point; a collector that has already resumed and is
+ * on its way to `_state.value = …` has no suspension point left to honour it at, so the write
+ * lands anyway. Cancellation also cannot help at all in the case #49 actually reported, where
+ * nothing supersedes the observation until after it has been launched. Both ViewModels still
+ * cancel their old observer, because leaving a collector running is a leak — but the guarantee
+ * does not rest on it.
+ *
+ * **Confined to the main dispatcher, and that confinement is the atomicity argument.** Every
+ * claim and every check runs there, with no suspension point between a check and the write it
+ * guards, so a claim can never land between the two. Nothing here is synchronized and nothing is
+ * `@Volatile`: making the field visible across threads would invite exactly the off-main use this
+ * cannot support, and would replace an argument that holds with one that only looks like it does.
+ */
+internal class ScreenOwnership {
+
+    private var claims = 0L
+
+    /**
+     * The claim in force now.
+     *
+     * Read by work that is about to suspend and will want to know, when it comes back, whether
+     * the screen it was reading is still the screen it is writing to. Read it *before* the
+     * suspension, not after — reading it afterwards would return whatever claim superseded it,
+     * which is the bug rather than the check for it.
+     */
+    val current: Long get() = claims
+
+    /**
+     * Takes the screen, invalidating every write still in flight under an older claim.
+     *
+     * Called synchronously from the user's action rather than from inside the coroutine it
+     * starts. A claim made inside a `launch` is only immediate while the dispatcher happens to
+     * run it inline, and a deferred claim is no claim at all: it would leave the same gap this
+     * exists to close.
+     */
+    fun claim(): Long = ++claims
+
+    /** Whether [token] is still the claim in force, and may therefore write. */
+    fun stillHeldBy(token: Long): Boolean = token == claims
+}

app/src/main/java/org/libremediaconverter/join/JoinScreen.kt

@@ -46,13 +46,54 @@ fun JoinScreen(modifier: Modifier = Modifier, viewModel: JoinViewModel = viewMod
 
     // The contract's MIME type comes from the finished job rather than from a literal: some
     // providers rewrite a document's extension to match it, so naming MP4 for a join that is not
-    // one can hand the user a file the extension lies about. Remembered against that type so the
-    // launcher re-registers only when it actually changes.
-    val destinationMime = (state as? JoinState.Joined)?.mimeType ?: ConcatWorker.DEFAULT_FORMAT.mimeType
+    // one can hand the user a file the extension lies about. Through pendingSave() rather than a
+    // cast to Joined, so a retry after a failed save opens with the type its first attempt used.
+    // Remembered against that type so the launcher re-registers only when it actually changes.
+    val destinationMime = state.pendingSave()?.mimeType ?: ConcatWorker.DEFAULT_FORMAT.mimeType
     val chooseDestination = rememberLauncherForActivityResult(
         remember(destinationMime) { ActivityResultContracts.CreateDocument(destinationMime) },
     ) { uri -> uri?.let(viewModel::save) }
 
+    JoinScreenContent(
+        state = state,
+        actions = JoinActions(
+            onPickInputs = { pickInputs.launch(arrayOf("video/*")) },
+            onJoin = viewModel::join,
+            onCancel = viewModel::cancel,
+            onSave = { suggestedName -> chooseDestination.launch(suggestedName) },
+            onReset = viewModel::reset,
+        ),
+        modifier = modifier,
+    )
+}
+
+/**
+ * Everything [JoinScreenContent] can ask for, in one value.
+ *
+ * Five callbacks would fit under detekt's `LongParameterList` threshold, unlike the converter's
+ * twelve. It is a holder anyway, so both screens present the same shape to the state tests and
+ * neither one has to be reworked the first time a branch grows a button.
+ */
+internal data class JoinActions(
+    /** Open the multi-document picker. The `Idle` and `Ready` branches both offer it. */
+    val onPickInputs: () -> Unit,
+    val onJoin: () -> Unit,
+    val onCancel: () -> Unit,
+    /** Open the save dialog. Takes the name the job chose -- see `ConcatWorker.KEY_SUGGESTED_NAME`. */
+    val onSave: (suggestedName: String) -> Unit,
+    val onReset: () -> Unit,
+)
+
+/**
+ * The join screen, with its state handed in.
+ *
+ * The same split as [org.libremediaconverter.convert.ConverterScreenContent], for the same reason:
+ * `JoinState.Waiting` follows a denied foreground start and `JoinState.Joined` follows a completed
+ * concatenation, so neither is reachable by driving a real `JoinViewModel`.
+ */
+@UnstableApi
+@Composable
+internal fun JoinScreenContent(state: JoinState, actions: JoinActions, modifier: Modifier = Modifier) {
     Column(
         modifier = modifier
             .fillMaxSize()
@@ -81,7 +122,7 @@ fun JoinScreen(modifier: Modifier = Modifier, viewModel: JoinViewModel = viewMod
                     modifier = Modifier.padding(bottom = 16.dp),
                 )
                 Button(
-                    onClick = { pickInputs.launch(arrayOf("video/*")) },
+                    onClick = actions.onPickInputs,
                     modifier = Modifier
                         .fillMaxWidth()
                         .height(PrimaryButtonHeight)
@@ -99,14 +140,14 @@ fun JoinScreen(modifier: Modifier = Modifier, viewModel: JoinViewModel = viewMod
                     is JoinState.Ready -> {
                         s.inputs.forEach { FileRow(it) }
                         Button(
-                            onClick = viewModel::join,
+                            onClick = actions.onJoin,
                             modifier = Modifier
                                 .fillMaxWidth()
                                 .height(PrimaryButtonHeight)
                                 .testTag(TestTags.Join.JOIN),
                         ) { Text("Join ${s.inputs.size} files") }
                         OutlinedButton(
-                            onClick = { pickInputs.launch(arrayOf("video/*")) },
+                            onClick = actions.onPickInputs,
                             modifier = Modifier
                                 .fillMaxWidth()
                                 .testTag(TestTags.Join.CHOOSE_DIFFERENT_FILES),
@@ -124,7 +165,7 @@ fun JoinScreen(modifier: Modifier = Modifier, viewModel: JoinViewModel = viewMod
                                 .testTag(TestTags.Join.PROGRESS),
                         )
                         OutlinedButton(
-                            onClick = viewModel::cancel,
+                            onClick = actions.onCancel,
                             modifier = Modifier.fillMaxWidth().testTag(TestTags.CANCEL),
                         ) { Text("Cancel") }
                     }
@@ -138,7 +179,7 @@ fun JoinScreen(modifier: Modifier = Modifier, viewModel: JoinViewModel = viewMod
                             style = MaterialTheme.typography.bodyMedium,
                         )
                         OutlinedButton(
-                            onClick = viewModel::cancel,
+                            onClick = actions.onCancel,
                             modifier = Modifier.fillMaxWidth().testTag(TestTags.CANCEL),
                         ) { Text("Cancel") }
                     }
@@ -157,14 +198,14 @@ fun JoinScreen(modifier: Modifier = Modifier, viewModel: JoinViewModel = viewMod
                             style = MaterialTheme.typography.bodySmall,
                         )
                         Button(
-                            onClick = { chooseDestination.launch(s.suggestedName) },
+                            onClick = { actions.onSave(s.suggestedName) },
                             modifier = Modifier
                                 .fillMaxWidth()
                                 .height(PrimaryButtonHeight)
                                 .testTag(TestTags.SAVE_FILE),
                         ) { Text("Save file") }
                         OutlinedButton(
-                            onClick = viewModel::reset,
+                            onClick = actions.onReset,
                             modifier = Modifier.fillMaxWidth().testTag(TestTags.START_OVER),
                         ) { Text("Start over") }
                     }
@@ -172,7 +213,7 @@ fun JoinScreen(modifier: Modifier = Modifier, viewModel: JoinViewModel = viewMod
                     is JoinState.Saved -> {
                         Text("Saved ${s.displayName}.", style = MaterialTheme.typography.bodyLarge)
                         Button(
-                            onClick = viewModel::reset,
+                            onClick = actions.onReset,
                             modifier = Modifier
                                 .fillMaxWidth()
                                 .height(PrimaryButtonHeight)
@@ -186,13 +227,32 @@ fun JoinScreen(modifier: Modifier = Modifier, viewModel: JoinViewModel = viewMod
                             color = MaterialTheme.colorScheme.error,
                             style = MaterialTheme.typography.bodyMedium,
                         )
-                        Button(
-                            onClick = viewModel::reset,
-                            modifier = Modifier
-                                .fillMaxWidth()
-                                .height(PrimaryButtonHeight)
-                                .testTag(TestTags.START_OVER),
-                        ) { Text("Start over") }
+                        val retry = s.retry
+                        if (retry == null) {
+                            // Nothing staged, so "Start over" is all there is and stays primary.
+                            Button(
+                                onClick = actions.onReset,
+                                modifier = Modifier
+                                    .fillMaxWidth()
+                                    .height(PrimaryButtonHeight)
+                                    .testTag(TestTags.START_OVER),
+                            ) { Text("Start over") }
+                        } else {
+                            Button(
+                                onClick = { actions.onSave(retry.suggestedName) },
+                                modifier = Modifier
+                                    .fillMaxWidth()
+                                    .height(PrimaryButtonHeight)
+                                    .testTag(TestTags.RETRY_SAVE),
+                            ) { Text("Try saving again") }
+                            // Start over still deletes the carried file, for the reason the
+                            // converter screen writes out next to the same pair of buttons:
+                            // the delete is a choice only once the alternative is on screen.
+                            OutlinedButton(
+                                onClick = actions.onReset,
+                                modifier = Modifier.fillMaxWidth().testTag(TestTags.START_OVER),
+                            ) { Text("Start over") }
+                        }
                     }
                 }
             }

app/src/main/java/org/libremediaconverter/join/JoinViewModel.kt

@@ -18,7 +18,9 @@ import kotlinx.coroutines.withContext
 import org.libremediaconverter.convert.ConversionDependencies
 import org.libremediaconverter.convert.InputFile
 import org.libremediaconverter.convert.InputQuery
+import org.libremediaconverter.convert.PendingSave
 import org.libremediaconverter.convert.STAGED_FILE_GONE_MESSAGE
+import org.libremediaconverter.convert.ScreenOwnership
 import org.libremediaconverter.model.ConcatStrategy
 import org.libremediaconverter.work.ConcatWorker
 import org.libremediaconverter.work.JobTags
@@ -44,7 +46,30 @@ sealed interface JoinState {
         val mimeType: String,
     ) : JoinState
     data class Saved(val displayName: String) : JoinState
-    data class Failed(val message: String) : JoinState
+
+    /**
+     * The join, or the save that followed it, could not be finished.
+     *
+     * [retry] is non-null for exactly one cause, and for the same reason as on
+     * `ConversionState.Failed`: a [JoinViewModel.save] whose copy to the user's destination threw
+     * keeps the staged file, and this is what lets the screen offer it again. Every other failure
+     * leaves it null — a join that died produced no output, and a save that found the file gone
+     * has nothing left to save.
+     */
+    data class Failed(val message: String, val retry: PendingSave? = null) : JoinState
+}
+
+/**
+ * The staged output a save would target from this state, or null when there is nothing to save.
+ *
+ * The join tab's half of `ConversionState.pendingSave`, and it exists for the same reason: `save`
+ * and `JoinScreen`'s `CreateDocument` registration both have to answer this question, and answering
+ * it twice is how a retry ends up opening the dialog with a type the finished job never chose.
+ */
+internal fun JoinState.pendingSave(): PendingSave? = when (this) {
+    is JoinState.Joined -> PendingSave(staged, suggestedName, mimeType)
+    is JoinState.Failed -> retry
+    else -> null
 }
 
 @UnstableApi
@@ -52,6 +77,15 @@ class JoinViewModel @JvmOverloads constructor(
     app: Application,
     /** Where [reset] runs its delete. See the same parameter on `ConversionViewModel`. */
     private val cleanupDispatcher: CoroutineDispatcher = Dispatchers.IO,
+    /**
+     * Where the metadata query behind a pick runs. See the same parameter on `ConversionViewModel`.
+     *
+     * The join side had no such seam, and the gap was not cosmetic: the one write `onInputsPicked`
+     * makes lands *after* this hop, so a test that wants to ask what happens while a pick is still
+     * in flight had no way to hold one there. Issue #49's race is exactly that question, and it
+     * went unasked on this side for as long as the dispatcher was a literal.
+     */
+    private val pickDispatcher: CoroutineDispatcher = Dispatchers.IO,
 ) : AndroidViewModel(app) {
 
     private val workManager = WorkManager.getInstance(app)
@@ -66,13 +100,28 @@ class JoinViewModel @JvmOverloads constructor(
     private var observer: Job? = null
     private var activeWorkId: UUID? = null
 
+    /**
+     * Who is allowed to write to this screen -- see [ScreenOwnership], which carries the rule and
+     * the reason cancelling the superseded coroutine is not one.
+     *
+     * The convert side had issue #49 reported against it four times in two days; this side has the
+     * identical shape and was never reported, because nothing was watching. Every write below that
+     * lands after a suspension point is guarded: the one in [onInputsPicked] and the one in
+     * [observe]. [save] is the one left out, deliberately and with the same limit its counterpart
+     * in `ConversionViewModel` spells out: nothing can overwrite what it writes, but it can still
+     * land on top of a [reset] taken while its copy was in flight. Which way that should go is a
+     * question about the save screen rather than about this race -- issue #123.
+     */
+    private val ownership = ScreenOwnership()
+
     /**
      * The staged output this ViewModel is responsible for deleting.
      *
      * Held here rather than read back out of [_state] for the same reason as in
-     * `ConversionViewModel`: a failed [save] lands on [JoinState.Failed], which carries a
-     * message and no file, so the state machine cannot answer this on the one path that
-     * most needs it.
+     * `ConversionViewModel`, and still held here now that [JoinState.Failed] carries a
+     * [PendingSave] after a failed [save]: that handle is a view for the screen to offer a retry
+     * through, this one is the single reference [reset] deletes through, and keeping the two
+     * apart is what stops a second owner of the file appearing.
      */
     private var pendingStaged: File? = null
 
@@ -91,6 +140,10 @@ class JoinViewModel @JvmOverloads constructor(
      * the rules about which job and why.
      */
     private fun reattach() {
+        // Read before the launch, and before the query it is about to suspend in: this is the
+        // claim the answer belongs to. Reading it on the far side of the query would read whatever
+        // superseded it, which is the bug rather than the check for it.
+        val token = ownership.current
         viewModelScope.launch {
             val reattachment = Reattachment.choose(
                 workManager.jobSnapshots(
@@ -100,8 +153,15 @@ class JoinViewModel @JvmOverloads constructor(
             ) ?: return@launch
 
             // The query suspends, so the user may have picked files or started a join in the
-            // meantime. Theirs wins. No suspension point between this check and the assignment
-            // below, and both run on the main dispatcher, so nothing can interleave.
+            // meantime. Theirs wins.
+            //
+            // This catches a pick that has already *landed*, and only that. It used to claim there
+            // was "no suspension point between this check and the assignment below", which was the
+            // opposite of what happens: there is no assignment below, only observe(), which
+            // launches a separate coroutine that cannot write until its `collect` resumes. The
+            // check happens at one moment and the write lands at another, with a whole pick able
+            // to fit in between -- issue #49. The token observe() carries is what holds that line;
+            // see [ScreenOwnership].
             if (_state.value !is JoinState.Idle || activeWorkId != null) return@launch
 
             // Joins used to stage under one constant name, so two finished joins always reported
@@ -121,19 +181,29 @@ class JoinViewModel @JvmOverloads constructor(
                 InputFile(Uri.EMPTY, "", sizeBytes = null)
             }
             activeWorkId = reattachment.job.id
-            observe(reattachment.job.id, inputs, cancelled = JoinState.Idle)
+            observe(reattachment.job.id, inputs, cancelled = JoinState.Idle, token = token)
         }
     }
 
+    /**
+     * The tap is the claim, which is why it is taken here rather than inside the `launch` -- and
+     * above the early return, so the refusal below is covered by it too. A claim made in the
+     * coroutine is only immediate while `Dispatchers.Main.immediate` happens to run it inline, and
+     * a deferred claim leaves exactly the gap this closes.
+     */
     fun onInputsPicked(uris: List<Uri>) {
+        val token = ownership.claim()
         if (uris.size < 2) {
             _state.value = JoinState.Failed("Pick at least two files to join.")
             return
         }
         viewModelScope.launch {
-            val files = withContext(Dispatchers.IO) {
+            val files = withContext(pickDispatcher) {
                 uris.map { InputQuery.describe(getApplication(), it) }
             }
+            // Guarded like every other write that lands after a hop: two picks in quick succession
+            // suspend here together, and the slower one would otherwise land last.
+            if (!ownership.stillHeldBy(token)) return@launch
             _state.value = JoinState.Ready(files)
         }
     }
@@ -147,10 +217,13 @@ class JoinViewModel @JvmOverloads constructor(
             // did answer would hand the space check a lower bound it would read as a total.
             totalBytes = InputQuery.total(inputs.map { it.sizeBytes }),
         )
+        // Tapping Join claims the screen for this job, superseding any reattachment that has not
+        // finished asking.
+        val token = ownership.claim()
         activeWorkId = request.id
         workManager.enqueue(request)
         _state.value = JoinState.Joining(inputs)
-        observe(request.id, inputs)
+        observe(request.id, inputs, token = token)
     }
 
     /**
@@ -158,12 +231,25 @@ class JoinViewModel @JvmOverloads constructor(
      *   files, ready to join again. For one picked up by [reattach] there are no picked files —
      *   what that job holds are URIs granted to a process that no longer exists — so it lands on
      *   Idle rather than offering to re-join files nothing can open.
+     * @param token the claim this observation belongs to. Nothing here can write until `collect`
+     *   has resumed with a `WorkInfo`, which is some time after the caller decided to observe, so
+     *   the claim is checked again at the last possible moment rather than trusted from then. See
+     *   [ScreenOwnership], and issue #49.
      */
-    private fun observe(id: UUID, inputs: List<InputFile>, cancelled: JoinState = JoinState.Ready(inputs)) {
+    private fun observe(
+        id: UUID,
+        inputs: List<InputFile>,
+        cancelled: JoinState = JoinState.Ready(inputs),
+        token: Long,
+    ) {
         observer?.cancel()
         observer = viewModelScope.launch {
             workManager.getWorkInfoByIdFlow(id).collect { info ->
                 if (info == null) return@collect
+                // Ahead of the `when`, not merely ahead of the assignment: the SUCCEEDED branch
+                // takes ownership of the staged file, and a superseded observation must not do
+                // that either.
+                if (!ownership.stillHeldBy(token)) return@collect
                 _state.value = when (info.state) {
                     WorkInfo.State.RUNNING, WorkInfo.State.BLOCKED -> JoinState.Joining(inputs)
                     WorkInfo.State.ENQUEUED ->
@@ -229,29 +315,38 @@ class JoinViewModel @JvmOverloads constructor(
      * join offered by reattachment was last seen during a tag query that may be hours old, and
      * `cacheDir` is reclaimed by the OS and swept by this app. Without it the file's absence
      * reached the screen as a raw ENOENT path.
+     *
+     * Reached from [JoinState.Joined] and again from a [JoinState.Failed] an earlier save left
+     * carrying its file; [pendingSave] is what makes those the same call.
      */
     fun save(destination: Uri) {
-        val joined = _state.value as? JoinState.Joined ?: return
-        if (!joined.staged.isFile) {
+        val pending = _state.value.pendingSave() ?: return
+        if (!pending.staged.isFile) {
+            // No retry handle -- the file it would offer again is the one that has gone.
             _state.value = JoinState.Failed(STAGED_FILE_GONE_MESSAGE)
             return
         }
         viewModelScope.launch {
             runCatching {
                 withContext(Dispatchers.IO) {
-                    publisher.publish(joined.staged, destination)
-                    joined.staged.delete()
+                    publisher.publish(pending.staged, destination)
+                    pending.staged.delete()
                 }
             }.onSuccess {
                 // publish() already deleted it; nothing left to clean up.
                 pendingStaged = null
-                _state.value = JoinState.Saved(joined.suggestedName)
+                _state.value = JoinState.Saved(pending.suggestedName)
             }.onFailure { e ->
                 // Deliberately NOT cleared -- see the same branch in ConversionViewModel.
                 // A failed save can leave the staged file as the only copy of the work, so
                 // it is left for a later reset() or for the sweep to collect once its age
                 // makes it certain nobody is coming back for it.
-                _state.value = JoinState.Failed(e.message ?: "Could not save the file.")
+                //
+                // `pending` travels on the state so the screen can offer the file again rather
+                // than leaving "Start over" -- which deletes it -- as the only thing on offer.
+                // Passing `pending` rather than rebuilding it is what keeps a retry that fails
+                // again on a carrying Failed instead of a bare one.
+                _state.value = JoinState.Failed(e.message ?: "Could not save the file.", pending)
             }
         }
     }
@@ -261,8 +356,16 @@ class JoinViewModel @JvmOverloads constructor(
      *
      * Best effort, not a guarantee: the delete is cancelled with [viewModelScope] if the
      * Activity finishes first. `OutputPublisher.sweepStaging` is the backstop.
+     *
+     * It deletes from a [JoinState.Failed] carrying a [PendingSave] too, deliberately and for the
+     * reason `ConversionViewModel.reset` writes out: the screen offers "Try saving again" above
+     * this button, so deletion is what the user chose rather than all this state could do.
      */
     fun reset() {
+        // Start over is a claim like any other. The cancel below is a request honoured at the next
+        // suspension point, so a collector already on its way to a write has nothing left to
+        // honour it at; the claim is what stops that write landing on top of Idle.
+        ownership.claim()
         observer?.cancel()
         observer = null
         activeWorkId = null

app/src/main/java/org/libremediaconverter/model/CodecNames.kt

@@ -15,36 +15,97 @@ package org.libremediaconverter.model
  */
 object CodecNames {
 
-    fun videoFromName(name: String?): VideoCodec? = when (name?.lowercase()) {
-        null, InputProbe.UNPARSEABLE -> null
-        "h264", "avc", "avc1", "x264" -> VideoCodec.H264
-        "hevc", "h265", "hvc1", "hev1", "x265" -> VideoCodec.H265
-        "vp8" -> VideoCodec.VP8
-        "vp9", "vp09" -> VideoCodec.VP9
-        "av1", "av01" -> VideoCodec.AV1
-        else -> null
-    }
+    /**
+     * The video vocabulary, as data rather than a `when`.
+     *
+     * This is not the only place the app spells these names. `AndroidDeviceCodecs` reads the same
+     * FFprobe strings to decide what the device can decode, and answers in platform MIME types,
+     * which `model` cannot name without depending on Android. The two copies drifted apart:
+     * `x264`, `hev1`, `x265` and `vp09` resolved here and returned null there, so the app
+     * identified the codec for display and routing and then ran the device check blind, attempting
+     * a hardware path it had enough information to skip (#87).
+     *
+     * The reason this is a map is that **a `when` cannot be enumerated**, so nothing could compare
+     * the two tables. `CodecVocabularyTest` walks both key sets, so a name added to or removed
+     * from one side alone now fails the build rather than waiting for a wasted transcode to show
+     * it.
+     *
+     * Keys are lowercase; [videoFromName] lowercases before looking one up.
+     */
+    internal val VIDEO_ALIASES: Map<String, VideoCodec> = mapOf(
+        "h264" to VideoCodec.H264,
+        "avc" to VideoCodec.H264,
+        "avc1" to VideoCodec.H264,
+        "x264" to VideoCodec.H264,
+        "hevc" to VideoCodec.H265,
+        "h265" to VideoCodec.H265,
+        "hvc1" to VideoCodec.H265,
+        "hev1" to VideoCodec.H265,
+        "x265" to VideoCodec.H265,
+        "vp8" to VideoCodec.VP8,
+        "vp9" to VideoCodec.VP9,
+        "vp09" to VideoCodec.VP9,
+        "av1" to VideoCodec.AV1,
+        "av01" to VideoCodec.AV1,
+    )
 
-    fun audioFromName(name: String?): AudioCodec? = when (name?.lowercase()) {
-        null -> null
-        "aac", "mp4a", "aac_latm" -> AudioCodec.AAC
-        "opus" -> AudioCodec.OPUS
-        "vorbis" -> AudioCodec.VORBIS
-        "mp3", "mp3float", "mpga" -> AudioCodec.MP3
-        "flac" -> AudioCodec.FLAC
-        "pcm", "raw", "pcm_s16le", "pcm_s24le", "pcm_f32le" -> AudioCodec.PCM
-        else -> null
-    }
+    /**
+     * The audio vocabulary, data for the same reason.
+     *
+     * Nothing cross-checks this one yet, and that is a gap rather than a decision: the device
+     * capability check is video-only, so this module holds no second audio table to compare it
+     * against. `Media3Engine.audioMimeTypeFor` is the other half, and #85 owns that file.
+     */
+    internal val AUDIO_ALIASES: Map<String, AudioCodec> = mapOf(
+        "aac" to AudioCodec.AAC,
+        "mp4a" to AudioCodec.AAC,
+        "aac_latm" to AudioCodec.AAC,
+        "opus" to AudioCodec.OPUS,
+        "vorbis" to AudioCodec.VORBIS,
+        "mp3" to AudioCodec.MP3,
+        "mp3float" to AudioCodec.MP3,
+        "mpga" to AudioCodec.MP3,
+        "flac" to AudioCodec.FLAC,
+        "pcm" to AudioCodec.PCM,
+        "raw" to AudioCodec.PCM,
+        "pcm_s16le" to AudioCodec.PCM,
+        "pcm_s24le" to AudioCodec.PCM,
+        "pcm_f32le" to AudioCodec.PCM,
+    )
+
+    fun videoFromName(name: String?): VideoCodec? = asCodecName(name)?.let(VIDEO_ALIASES::get)
+
+    fun audioFromName(name: String?): AudioCodec? = asCodecName(name)?.let(AUDIO_ALIASES::get)
 
     /** Human-readable name for the source-info card. Falls back to the raw probe string. */
-    fun describeVideo(name: String?): String = when {
+    fun describeVideo(name: String?): String = describe(name) { videoFromName(it)?.label }
+
+    fun describeAudio(name: String?): String = describe(name) { audioFromName(it)?.label }
+
+    /**
+     * Lowercases a probe string, and answers null for the two inputs that are not codec names at
+     * all: absent, and the [InputProbe.UNPARSEABLE] sentinel.
+     *
+     * The sentinel would miss every key anyway, so naming it changes no answer. Naming it is still
+     * the point: `videoFromName` excluded it explicitly and `audioFromName` did not, which read as
+     * though the two disagreed about what the sentinel means — the same asymmetry as #74 one
+     * function further up.
+     */
+    private fun asCodecName(name: String?): String? =
+        if (name == null || name == InputProbe.UNPARSEABLE) null else name.lowercase()
+
+    /**
+     * The shared body of [describeVideo] and [describeAudio].
+     *
+     * They are one function apiece over one vocabulary, and they had stopped matching:
+     * `describeVideo` answered "Unrecognised" for [InputProbe.UNPARSEABLE] and `describeAudio` fell
+     * through to `?: name` instead. The sentinel opens with a NUL, so that fallback would have put
+     * a U+0000 into a `Text` on the source-info card (#74). Sharing the arms is what stops the next
+     * one being added to one side only.
+     */
+    private fun describe(name: String?, label: (String) -> String?): String = when {
         name == null -> "Unknown"
         name == InputProbe.UNPARSEABLE -> "Unrecognised"
-        else -> videoFromName(name)?.label ?: name
-    }
-
-    fun describeAudio(name: String?): String = when {
-        name == null -> "Unknown"
-        else -> audioFromName(name)?.label ?: name
+        else -> label(name) ?: name
     }
 }

app/src/main/java/org/libremediaconverter/model/ContainerCapabilities.kt

@@ -129,9 +129,25 @@ object ContainerCapabilities {
             }
         }
 
-        if (spec.videoCodec == VideoCodec.NONE && spec.audioCodec == AudioCodec.NONE) {
+        // Two faces of one rule: the output would carry no tracks at all.
+        //
+        // The first is visible in the spec alone — NONE on both axes. The second only emerges once
+        // the spec meets the probe, because [CopyPlanner] drops a video track the *input* does not
+        // have no matter which codec was named for it, so "H.265 + no audio" on an MP3 plans to
+        // (Drop, Drop) exactly as "None + None" does. Asking the spec alone answered the first and
+        // missed the second, and the miss was not cosmetic: `EditedMediaItem.Builder` refuses that
+        // composition with IllegalStateException("Audio and video cannot both be removed"), on
+        // Transformer's own thread, where the user would have seen a dead app rather than a reason.
+        if (spec.audioCodec == AudioCodec.NONE && (spec.videoCodec == VideoCodec.NONE || !probe.hasVideo)) {
             return Validation.Invalid(
-                "This would produce an empty file — keep at least one track.",
+                if (spec.videoCodec == VideoCodec.NONE) {
+                    "This would produce an empty file — keep at least one track."
+                } else {
+                    // Names both halves. "No video track" alone reads as though the video setting
+                    // were the only thing wrong, and the user would fix that and still be stuck.
+                    "This file has no video track, so turning the audio off too would produce an " +
+                        "empty file."
+                },
                 suggestions(
                     // Ask for both tracks back, then let repair settle what this container and
                     // this input can actually give.
@@ -162,7 +178,12 @@ object ContainerCapabilities {
             if (!probe.hasVideo) {
                 return Validation.Invalid(
                     "This file has no video track to copy.",
-                    listOf(spec.copy(videoCodec = VideoCodec.NONE)),
+                    // Dropping the video is the right shape of answer, but it is only half of one:
+                    // `spec.copy(videoCodec = NONE)` is valid exactly when the audio axis already
+                    // happened to be fine, and refused otherwise — a Vorbis or PCM source into MP4,
+                    // an MP3 into WebM. Handing it to the shared path repairs both axes and drops
+                    // anything that still fails, so the chip cannot lead to a second error.
+                    suggestions(spec.copy(videoCodec = VideoCodec.NONE), probe, exclude = spec),
                 )
             }
             val source = CodecNames.videoFromName(probe.videoCodec)
@@ -284,8 +305,12 @@ object ContainerCapabilities {
     private fun repairVideo(spec: OutputSpec, probe: InputProbe): VideoCodec {
         val container = spec.container
         if (spec.videoCodec == VideoCodec.NONE || !container.canHoldVideo) return VideoCodec.NONE
+        // There is no video track to make one out of, so naming a codec would be a suggestion
+        // [CopyPlanner] drops on the floor. It also read as a non-sequitur: before this line, the
+        // repair offered for an MP3 was "H.264", the first codec MP4 happens to encode.
+        if (!probe.hasVideo) return VideoCodec.NONE
 
-        val source = CodecNames.videoFromName(probe.videoCodec).takeIf { probe.hasVideo }
+        val source = CodecNames.videoFromName(probe.videoCodec)
         val copyable = source != null && accepts(container, source, CodecMode.COPY)
 
         return when {

app/src/main/java/org/libremediaconverter/ui/TestTags.kt

@@ -45,6 +45,17 @@ object TestTags {
 
     const val SAVE_FILE: String = "action.saveFile"
 
+    /**
+     * The retry a `Failed` offers after a save that threw, on both screens.
+     *
+     * Its own tag rather than [SAVE_FILE], because the two are different claims about the screen.
+     * [SAVE_FILE] is the first attempt from a finished job; this one may appear only where a staged
+     * file survived a failed save. Sharing a tag would collapse "a transcode failure offers nothing
+     * to save" and "a failed save offers the file again" into one query, and that first assertion
+     * is the one stopping a Save button from appearing where there is nothing to save.
+     */
+    const val RETRY_SAVE: String = "action.retrySave"
+
     /** `ConverterScreen`. */
     object Converter {
         const val CHOOSE_FILE: String = "converter.chooseFile"
@@ -55,6 +66,15 @@ object TestTags {
         /** The determinate bar in `Converting`. It carries no text, so nothing else can find it. */
         const val PROGRESS: String = "converter.progress"
 
+        /**
+         * The chip on `Converted` that says which engine ran the job and why.
+         *
+         * Conditional on `routeReason` being non-blank, and that condition is what the tag is for:
+         * its text comes from the finished job, so a text matcher looking for it would have to
+         * name a routing explanation the screen does not own.
+         */
+        const val ROUTE_REASON: String = "converter.routeReason"
+
         const val FILE_CARD: String = "converter.fileCard"
         const val FILE_CARD_NAME: String = "converter.fileCard.name"
 

app/src/main/java/org/libremediaconverter/ui/theme/Theme.kt

@@ -25,8 +25,18 @@ private val LightColorScheme = lightColorScheme(
  * Material 3 theme.
  *
  * Dynamic color (Material You) needs API 31+; minSdk is 33, so it is available
- * unconditionally and no version guard is required. It stays switchable so users can
- * opt back to the brand palette.
+ * unconditionally and no version guard is required.
+ *
+ * [dynamicColor] has no caller. `MainActivity` is the single call site and takes the
+ * default, so the parameter is always `true`, the two dynamic branches always win, and
+ * [DarkColorScheme] and [LightColorScheme] are dead: nothing in the app can opt back to the
+ * brand palette. `ThemeColorSchemeTest` reaches those two branches only by passing
+ * [dynamicColor] explicitly -- a test doing it, not a feature.
+ *
+ * That is known rather than an oversight. #68 holds the choice between adding a switch,
+ * deleting the dead branches together with the template palette, and replacing that palette
+ * first; it is undecided, so nothing here should be read as a promise that any of them
+ * happens.
  */
 @Composable
 fun LibreMediaConverterTheme(

app/src/test/java/org/libremediaconverter/AppRootRestorationTest.kt

@@ -8,6 +8,7 @@ import androidx.compose.runtime.setValue
 import androidx.compose.ui.platform.testTag
 import androidx.compose.ui.test.assertIsSelected
 import androidx.compose.ui.test.junit4.StateRestorationTester
+import androidx.compose.ui.test.junit4.v2.createComposeRule
 import androidx.compose.ui.test.onNodeWithTag
 import androidx.compose.ui.test.onNodeWithText
 import androidx.compose.ui.test.performClick
@@ -33,19 +34,22 @@ import org.robolectric.RobolectricTestRunner
  * representation survives a `Bundle` round trip. A JVM round-trip test on the
  * saver covers the representation.
  *
- * Robolectric rather than the instrumented suite, deliberately. The instrumented tests
- * cannot run on the development host at all (see CLAUDE.md), and a red test nobody can
- * execute is not a loop anyone can work in.
+ * Robolectric rather than the instrumented suite, deliberately -- but not because the
+ * instrumented suite is unavailable. It runs on this host for API 33-36
+ * (`tools/local-emulator/run-e2e.sh`), and CI runs 33-37. The reason is cost: this test
+ * needs a composition and a saved-state round trip, nothing a device supplies, and it runs
+ * in the same `./gradlew` invocation as every other JVM test instead of booting an
+ * emulator. A loop measured in seconds is a loop people stay inside.
  */
 @UnstableApi
 @RunWith(RobolectricTestRunner::class)
 class AppRootRestorationTest {
 
-    // Not `createComposeRule()` directly: see [drainEscapedCoroutineErrors]. Every Compose test
-    // class in this source set starts there, whether or not it is the one that happens to be
-    // running when another test's escaped coroutine error is delivered.
+    // The rule is the **v2** one (`androidx.compose.ui.test.junit4.v2`) while
+    // [StateRestorationTester], which takes it below, is not. The mismatched imports are
+    // deliberate: the v2 package has no tester of its own and the two do interoperate.
     @get:Rule
-    val composeRule = createDrainedComposeRule()
+    val composeRule = createComposeRule()
 
     private val restoration = StateRestorationTester(composeRule)
 

app/src/test/java/org/libremediaconverter/EscapedCoroutineErrors.kt

@@ -1,53 +0,0 @@
-package org.libremediaconverter
-
-import androidx.compose.ui.test.junit4.v2.createComposeRule
-import kotlinx.coroutines.test.runTest
-
-/**
- * Clears coroutine errors this module's tests deliberately let escape, so they land on the test
- * that caused them instead of on the next one to start.
- *
- * **Every Compose test class in `src/test` has to start here.** `createComposeRule` runs the
- * composition inside `runTest`, and `runTest` opens by throwing `UncaughtExceptionsBeforeTest` for
- * anything already sitting in kotlinx-coroutines-test's collector -- a process-wide
- * `CoroutineExceptionHandler` it installs once and never removes.
- *
- * There is one deposit into that collector here, and it is not a mistake:
- * `ConversionViewModelProbeFailureTest.an OutOfMemoryError is not swallowed` proves an OOM raised
- * inside the probe is rethrown rather than reported as an unreadable file. `onInputPicked` runs it
- * in `viewModelScope.launch`, which has no exception handler by design -- the ViewModel's own KDoc
- * says a real OOM should reach the thread's handler and take the process down. On the JVM the
- * collector takes it instead, holds it, and hands it to whichever `runTest` starts next.
- *
- * It surfaced as two *different* Compose test classes failing on two consecutive runs of the same,
- * green, code, with a message naming neither the test nor the error's origin. Which class catches
- * it moves because the throw happens on a real `Dispatchers.IO` thread, after the state assertion
- * that ends the test that caused it -- so it can be delivered long after that class is done.
- *
- * A `@Before` method cannot do this: the compose rule's `runTest` wraps the statement that calls
- * `@Before`, so it has already thrown. `@BeforeClass` cannot either -- Robolectric runs it outside
- * the sandbox classloader, where the collector is a different object. Draining while the rule is
- * being *constructed* is early enough, because JUnit builds a fresh test-class instance, and with
- * it every `@get:Rule` field, before evaluating any rule.
- *
- * The real fix is a seam: give the probe hop an injectable dispatcher the way
- * `ConversionViewModel`'s constructor already does for `cleanupDispatcher`, and the error would
- * have somewhere to land. That is a production change, so it belongs in its own commit.
- */
-fun drainEscapedCoroutineErrors() {
-    // Entering a test scope is what flushes the collector; the flush is reported as this
-    // throwing, and there is nothing to assert about an error another test already asserted on.
-    runCatching { runTest {} }
-}
-
-/**
- * [createComposeRule], with [drainEscapedCoroutineErrors] run first. Use this rather than
- * `createComposeRule` directly in `src/test`.
- *
- * It also keeps the one mixed import in one place: the rule comes from the **v2** package
- * (`androidx.compose.ui.test.junit4.v2`) while `StateRestorationTester`, which takes it, does not.
- */
-fun createDrainedComposeRule() = run {
-    drainEscapedCoroutineErrors()
-    createComposeRule()
-}

app/src/test/java/org/libremediaconverter/ci/ReleasePermissionTest.kt

@@ -0,0 +1,67 @@
+package org.libremediaconverter.ci
+
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.io.File
+
+/**
+ * That the release job still holds the one permission it needs to publish.
+ *
+ * `build.yml`'s `release` job declares `contents: write`, and nothing was checking it. Deleting
+ * those two lines leaves actionlint clean and CodeQL silent — a *narrower* permission is not an
+ * alert — and the job is `if: startsWith(github.ref, 'refs/tags/v')`, so no pull request and no
+ * merge to `main` can exercise it. Measured: with the declaration removed, every gating check
+ * still passes. The first thing that would notice is a release failing to publish, at the moment
+ * someone is trying to cut one.
+ *
+ * The deletion also looks like tidying. A top-level `permissions: contents: read` now sits
+ * directly above it, so a reader could reasonably take the job-level block for a duplicate. It is
+ * an override, not a duplicate, and a comment saying so is not a check.
+ *
+ * `BackupExclusionsTest` is the precedent: a file that is configuration rather than code, load
+ * bearing, and unguarded because nothing compiles it.
+ *
+ * **What this pins, and what it does not.** It asserts the declaration exists in the `release`
+ * job's block. It cannot assert that a release actually publishes — that needs a tag push, which
+ * is the thing no PR can do. So this is a tripwire against silent removal, not proof the release
+ * path works.
+ */
+class ReleasePermissionTest {
+
+    @Test
+    fun `the release job declares the write permission it needs to publish`() {
+        val release = jobBlock("release")
+        assertTrue(
+            "build.yml's `release` job no longer declares `contents: write`. It is the only " +
+                "permission that lets the job create a release, the top-level block above it is " +
+                "`contents: read`, and nothing else in CI would catch this until a tag failed to " +
+                "publish. If the release moved elsewhere, delete this test deliberately.",
+            release.any { it.trimStart().startsWith("contents: write") },
+        )
+    }
+
+    /**
+     * The lines of one top-level job, from its `  <name>:` header to the next job at that indent.
+     *
+     * Line-based rather than parsed: the module has no YAML dependency, and adding one to read two
+     * lines would be a worse trade than a scan that fails loudly when the shape changes.
+     */
+    private fun jobBlock(name: String): List<String> {
+        val lines = workflow.readLines()
+        val start = lines.indexOfFirst { it == "  $name:" }
+        check(start >= 0) { "no `  $name:` job in ${workflow.path} — has the file been restructured?" }
+        val rest = lines.drop(start + 1)
+        val end = rest.indexOfFirst { it.matches(Regex("^ {2}[A-Za-z0-9_-]+:.*")) }
+        return if (end < 0) rest else rest.take(end)
+    }
+
+    /**
+     * Found by walking up rather than by a fixed relative path: Gradle's working directory for the
+     * unit tests is the module, but that is a default rather than a promise.
+     */
+    private val workflow: File
+        get() = generateSequence(File(".").absoluteFile) { it.parentFile }
+            .map { File(it, ".github/workflows/build.yml") }
+            .firstOrNull { it.isFile }
+            ?: error("could not find .github/workflows/build.yml above ${File(".").absolutePath}")
+}

app/src/test/java/org/libremediaconverter/codec/CodecVocabularyTest.kt

@@ -0,0 +1,173 @@
+package org.libremediaconverter.codec
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.libremediaconverter.model.CodecNames
+import org.libremediaconverter.model.VideoCodec
+
+/**
+ * Bites on #87: two tables read one codec vocabulary and had stopped agreeing.
+ *
+ * `CodecNames.VIDEO_ALIASES` answers "which enum is this FFprobe name", for the source-info card
+ * and for routing. `AndroidDeviceCodecs.NAME_TO_MIME` answers "which MIME do I ask this device
+ * about", for the capability check. On `ad28293` five names lived in one and not the other: `x264`,
+ * `hev1`, `x265` and `vp09` were identified for display and then fell through the device check as
+ * unknown, so the app attempted a hardware path it had enough information to skip; `mpeg4` ran the
+ * other way and rendered as a raw name on the card.
+ *
+ * Per-table arm tests would have passed on both tables and encoded the disagreement, which is why
+ * these walk the key sets instead. A name added to — or removed from — one side alone fails here.
+ */
+class CodecVocabularyTest {
+
+    private val aliases = CodecNames.VIDEO_ALIASES
+    private val mimes = AndroidDeviceCodecs.NAME_TO_MIME
+    private val decodeOnly = AndroidDeviceCodecs.DECODE_ONLY_NAMES
+
+    @Test
+    fun `no video codec name resolves for display without also resolving for the device check`() {
+        assertEquals(
+            "resolve in CodecNames but return null from mimeForCodecName, so the device check runs blind",
+            emptySet<String>(),
+            aliases.keys - mimes.keys,
+        )
+    }
+
+    @Test
+    fun `no video codec name resolves for the device check without being a name the app can label`() {
+        assertEquals(
+            "resolve in AndroidDeviceCodecs but not in CodecNames, and are not listed as decode-only",
+            emptySet<String>(),
+            mimes.keys - aliases.keys - decodeOnly,
+        )
+    }
+
+    /**
+     * Membership is not enough: `"x265" to MIMETYPE_VIDEO_AVC` would satisfy both key sets and
+     * still ask the device about the wrong codec.
+     */
+    @Test
+    fun `the two tables agree on what each name means, not merely that they know it`() {
+        aliases.forEach { (name, codec) ->
+            val expected = AndroidDeviceCodecs.mimeFor(codec)
+            assertNotNull("$name maps to $codec, which has no MIME to ask about", expected)
+            assertEquals("$name is $codec in CodecNames", expected, mimes[name])
+        }
+    }
+
+    /**
+     * The exception list is the escape hatch: any future divergence could be waved through by
+     * adding the name to it. Guard both directions so it cannot be.
+     */
+    @Test
+    fun `the decode-only names are genuinely decode-only`() {
+        decodeOnly.forEach { name ->
+            assertNotNull("$name is listed as decode-only but the device check cannot resolve it", mimes[name])
+            assertNull(
+                "$name is listed as decode-only, but CodecNames does resolve it — that is a divergence " +
+                    "being waved through rather than a documented exception",
+                CodecNames.videoFromName(name),
+            )
+        }
+    }
+
+    /**
+     * The five names #87 measured, pinned by name so the specific regression cannot come back
+     * quietly even if someone rewrites the tables above.
+     */
+    @Test
+    fun `the names that used to resolve on one side only resolve on both`() {
+        mapOf(
+            "x264" to VideoCodec.H264,
+            "hev1" to VideoCodec.H265,
+            "x265" to VideoCodec.H265,
+            "vp09" to VideoCodec.VP9,
+        ).forEach { (name, codec) ->
+            assertEquals("$name is a name FFmpeg emits", codec, CodecNames.videoFromName(name))
+            assertEquals(
+                "$name has to reach the device check too, or the app identifies it and then asks blind",
+                AndroidDeviceCodecs.mimeFor(codec),
+                AndroidDeviceCodecs.mimeForCodecName(name),
+            )
+        }
+        // The one that runs the other way: decodable input with no enum to name it.
+        assertNull("mpeg4 is not an output the app can target", CodecNames.videoFromName("mpeg4"))
+        assertNotNull("mpeg4 is still decodable input", AndroidDeviceCodecs.mimeForCodecName("mpeg4"))
+    }
+
+    /**
+     * Without this the agreement test above could pass on two nulls.
+     *
+     * `MediaFormat.MIMETYPE_VIDEO_AVC` is a Java compile-time constant, so it is inlined and the
+     * unit-test classpath's stubbed `android.jar` never has to supply it. If that ever stops being
+     * true, every MIME comparison here would be `null == null` and green — the vacuous-mutation
+     * failure this repo has counted before. Assert one literal so the stub fails loudly instead.
+     */
+    @Test
+    fun `the MIME constants are real strings rather than stubs`() {
+        assertEquals("video/avc", AndroidDeviceCodecs.mimeForCodecName("h264"))
+        assertEquals("video/hevc", AndroidDeviceCodecs.mimeForCodecName("hevc"))
+        assertEquals("video/avc", AndroidDeviceCodecs.mimeFor(VideoCodec.H264))
+    }
+
+    @Test
+    fun `codec names are matched case-insensitively on both sides`() {
+        assertEquals(VideoCodec.H265, CodecNames.videoFromName("HEV1"))
+        assertEquals("video/hevc", AndroidDeviceCodecs.mimeForCodecName("HEV1"))
+    }
+
+    @Test
+    fun `a name neither table knows still resolves to nothing`() {
+        assertNull(CodecNames.videoFromName("cinepak"))
+        assertNull(AndroidDeviceCodecs.mimeForCodecName("cinepak"))
+    }
+
+    /**
+     * The behaviour #87 actually changes, at the seam that uses it.
+     *
+     * `canDecode` treats an unresolved name as "assume the platform copes". Before the alias
+     * landed, a device with no HEVC decoder answered true for `x265` and Media3 was handed a job it
+     * could not do; now the router sends it to FFmpeg without spending the attempt.
+     */
+    @Test
+    fun `a device without the decoder now says so for the aliases it used to wave through`() {
+        val hevcOnly = AndroidDeviceCodecs.forTesting(encoders = emptySet(), decoders = setOf("video/hevc"))
+        assertTrue("x265 is HEVC by another name", hevcOnly.canDecode("x265"))
+        assertFalse("this device has no AVC decoder, and x264 is AVC", hevcOnly.canDecode("x264"))
+        assertTrue("a name nobody knows keeps the permissive answer", hevcOnly.canDecode("cinepak"))
+    }
+
+    /**
+     * The other half of the null policy, at the seam it exists for — #86.
+     *
+     * `mimeFor`'s `COPY, NONE -> null` arm carries its consequence in a comment: "Returning null
+     * makes canEncode answer true, which is the right answer: a copied or absent track places no
+     * demand on the hardware." That is a product decision, and until this test nothing held it. A
+     * MIME appearing in that arm would make a device with no matching encoder refuse a stream copy
+     * — a job that never encodes anything — and the router would send it to FFmpeg to re-mux what
+     * Media3 could have re-muxed.
+     *
+     * The `H264` line is what makes the other two mean something: without it, a `canEncode` that
+     * simply returned `true` would satisfy this test. `NONE` is asserted separately from `COPY`
+     * because they are one arm today and two answers, and splitting the arm must not silently
+     * halve the coverage.
+     */
+    @Test
+    fun `a device with no video encoder at all still permits a copied or absent track`() {
+        val noEncoders = AndroidDeviceCodecs.forTesting(encoders = emptySet(), decoders = setOf("video/avc"))
+        assertTrue(
+            "a copied track is re-muxed, not encoded, so no encoder is required",
+            noEncoders.canEncode(VideoCodec.COPY),
+        )
+        assertTrue("an absent track places no demand on the hardware", noEncoders.canEncode(VideoCodec.NONE))
+        assertFalse(
+            "this device has no AVC encoder, so an H.264 target has to be refused — without this, " +
+                "a canEncode that always answered true would satisfy the two assertions above",
+            noEncoders.canEncode(VideoCodec.H264),
+        )
+    }
+}

app/src/test/java/org/libremediaconverter/codec/VideoCodecMimeAgreementTest.kt

@@ -0,0 +1,162 @@
+package org.libremediaconverter.codec
+
+import androidx.media3.common.util.UnstableApi
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Test
+import org.libremediaconverter.convert.Media3Engine
+import org.libremediaconverter.model.VideoCodec
+
+/**
+ * Bites on #86: a fifth `VideoCodec -> MIME` table, and nothing checking it agrees with the fourth.
+ *
+ * [AndroidDeviceCodecs.mimeFor] and [Media3Engine.videoMimeTypeFor] take the same enum and return a
+ * MIME string, from opposite ends of one export. The first asks the device *"have you an encoder
+ * for this?"*; the second tells Transformer *"produce this."* If they name different MIME types for
+ * the same codec, the app checks for one encoder and then requests another — the check passes, the
+ * export succeeds, and the user's H.265 file contains H.264. Both were `private` until #85 and #87
+ * widened them, so this assertion could not be written before; each table had per-arm tests that
+ * pinned its own answers and could not see the other side.
+ *
+ * **They do not agree everywhere, and must not be forced to.** Three buckets, all pinned below:
+ *
+ * - **H.264 and H.265** — both tables name a MIME, and it has to be the same one. This is the
+ *   bucket the defect lives in.
+ * - **VP8, VP9 and AV1** — the device table names a real MIME, Transformer's returns null. That is
+ *   correct, not drift: `Transformer.setVideoMimeType` will not accept them, so the router sends
+ *   them to FFmpeg before Media3 is asked anything, while a device may still genuinely own a VP9
+ *   encoder and `canEncode` has to give a truthful answer about it. Flattening `mimeFor` to null
+ *   here to "make the tables agree" would make `canEncode(VP9)` answer true on hardware that has
+ *   no VP9 encoder. The routing half of that claim is proved in
+ *   `Media3EngineMimeTypesTest.the router sends exactly H264 and H265 video encodes to Media3`,
+ *   which drives the real router; it is not repeated here.
+ * - **COPY and NONE** — neither names a MIME, because neither is encoded at all.
+ *
+ * The fourth bucket is asserted empty: a codec Transformer names and the device check cannot ask
+ * about would mean `canEncode` waving through a target the app then really does encode.
+ *
+ * **Audio has no partner, and that is a gap rather than a decision.** [Media3Engine.audioMimeTypeFor]
+ * is the same shape one enum over — `AudioCodec -> MIME` — but [AndroidDeviceCodecs] enumerates
+ * `video/` MIME types only, so there is no device-side audio table to cross-check it against. An
+ * audio encoder this device lacks is therefore not caught up front the way a video one is; the job
+ * reaches Media3 and falls back after failing. Named here so the asymmetry reads as unfinished
+ * rather than intended.
+ */
+@UnstableApi
+class VideoCodecMimeAgreementTest {
+
+    /** Both tables name a MIME. The pair has to match; this is the whole point of the file. */
+    private val bothNameAMime = setOf(VideoCodec.H264, VideoCodec.H265)
+
+    /** Only the device table names one, because Transformer is never asked for these. */
+    private val deviceOnly = setOf(VideoCodec.VP8, VideoCodec.VP9, VideoCodec.AV1)
+
+    /** Neither names one: nothing is encoded, so there is no encoder to name. */
+    private val neitherNamesOne = setOf(VideoCodec.COPY, VideoCodec.NONE)
+
+    /**
+     * Sorts every [VideoCodec] by what the two tables actually answer, then compares the sorting
+     * with the buckets documented above.
+     *
+     * This is what makes the agreement test below non-vacuous, and it is deliberately an exact
+     * comparison in all four directions. A codec added to the enum lands in some bucket and fails
+     * here rather than arriving unclassified. A table that starts returning null for everything —
+     * the shape a filtered loop would pass on — empties two buckets and fails here. And a
+     * *convergence* fails too: giving `videoMimeTypeFor(VP9)` a real MIME moves VP9 out of
+     * `deviceOnly`, which is the point. The divergence should be deliberate and visible, so
+     * changing it should require saying so in this file.
+     */
+    @Test
+    fun `each video codec is in the bucket the two tables actually put it in`() {
+        assertEquals(
+            "codecs both tables name a MIME for",
+            bothNameAMime,
+            VideoCodec.entries.filter { device(it) != null && transformer(it) != null }.toSet(),
+        )
+        assertEquals(
+            "codecs only the device check names a MIME for, because Transformer will not encode them",
+            deviceOnly,
+            VideoCodec.entries.filter { device(it) != null && transformer(it) == null }.toSet(),
+        )
+        assertEquals(
+            "codecs neither table names a MIME for, because nothing is encoded",
+            neitherNamesOne,
+            VideoCodec.entries.filter { device(it) == null && transformer(it) == null }.toSet(),
+        )
+        assertEquals(
+            "codecs Transformer names a MIME for that the device check cannot ask about — canEncode " +
+                "would answer true without looking, for a codec Media3 really is told to produce",
+            emptySet<VideoCodec>(),
+            VideoCodec.entries.filter { device(it) == null && transformer(it) != null }.toSet(),
+        )
+    }
+
+    /**
+     * The cross-check itself.
+     *
+     * Per-arm tests in either file cannot catch this: each pins its own table's answers, so a pair
+     * changed in lockstep with its own expectations stays green on both sides while the two tables
+     * describe different codecs.
+     */
+    @Test
+    fun `where both tables name a MIME they name the same one`() {
+        bothNameAMime.forEach { codec ->
+            val asked = device(codec)
+            val requested = transformer(codec)
+            assertNotNull("AndroidDeviceCodecs has no MIME to ask the device about for ${codec.label}", asked)
+            assertNotNull("Media3Engine has no MIME to give Transformer for ${codec.label}", requested)
+            assertEquals(
+                "${codec.label}: the device is asked about $asked and Transformer is then told to " +
+                    "produce $requested, so the capability check answers about a codec that is not the output",
+                asked,
+                requested,
+            )
+        }
+    }
+
+    /**
+     * The documented divergence, asserted rather than described.
+     *
+     * Both halves matter. The null side is Media3's refusal; the non-null side is the device
+     * check's genuine question, and it is the half a reader "tidying up" the disagreement would
+     * delete.
+     */
+    @Test
+    fun `the codecs Transformer will not encode are still codecs this device may or may not have`() {
+        deviceOnly.forEach { codec ->
+            assertNotNull(
+                "${codec.label} goes to FFmpeg, but canEncode still has to answer truthfully about " +
+                    "this device's encoder — a null here makes it answer true without looking",
+                device(codec),
+            )
+            assertNull(
+                "Transformer rejects ${codec.label}, so naming a MIME for it would request an export " +
+                    "Media3 cannot perform",
+                transformer(codec),
+            )
+        }
+    }
+
+    /**
+     * Guards every comparison above against passing as `null == null`.
+     *
+     * `MediaFormat`'s MIME types are Java compile-time constants and are inlined, so the unit-test
+     * classpath's stubbed `android.jar` never supplies them; `MimeTypes`' come from a real
+     * `media3-common` jar. If either stopped holding, the buckets would collapse and this fails
+     * first, with the reason. Same guard, and the same reason, as
+     * `CodecVocabularyTest.the MIME constants are real strings rather than stubs`.
+     */
+    @Test
+    fun `both tables return real MIME strings rather than stubs`() {
+        assertEquals("video/avc", AndroidDeviceCodecs.mimeFor(VideoCodec.H264))
+        assertEquals("video/hevc", AndroidDeviceCodecs.mimeFor(VideoCodec.H265))
+        assertEquals("video/x-vnd.on2.vp9", AndroidDeviceCodecs.mimeFor(VideoCodec.VP9))
+        assertEquals("video/avc", Media3Engine.videoMimeTypeFor(VideoCodec.H264))
+        assertEquals("video/hevc", Media3Engine.videoMimeTypeFor(VideoCodec.H265))
+    }
+
+    private fun device(codec: VideoCodec): String? = AndroidDeviceCodecs.mimeFor(codec)
+
+    private fun transformer(codec: VideoCodec): String? = Media3Engine.videoMimeTypeFor(codec)
+}

app/src/test/java/org/libremediaconverter/convert/AdvancedPanelSavedStateTest.kt

@@ -7,6 +7,7 @@ import androidx.compose.runtime.CompositionLocalProvider
 import androidx.compose.runtime.MutableState
 import androidx.compose.runtime.saveable.LocalSaveableStateRegistry
 import androidx.compose.runtime.saveable.SaveableStateRegistry
+import androidx.compose.ui.test.junit4.v2.createComposeRule
 import androidx.compose.ui.test.onNodeWithTag
 import androidx.compose.ui.test.performClick
 import androidx.media3.common.util.UnstableApi
@@ -15,7 +16,6 @@ import org.junit.Assert.assertTrue
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
-import org.libremediaconverter.createDrainedComposeRule
 import org.libremediaconverter.model.AudioCodec
 import org.libremediaconverter.model.Container
 import org.libremediaconverter.model.OutputSpec
@@ -57,9 +57,8 @@ import org.robolectric.RobolectricTestRunner
 @RunWith(RobolectricTestRunner::class)
 class AdvancedPanelSavedStateTest {
 
-    // Not `createComposeRule()` directly: see [drainEscapedCoroutineErrors].
     @get:Rule
-    val composeRule = createDrainedComposeRule()
+    val composeRule = createComposeRule()
 
     /**
      * `canBeSaved = { true }` deliberately.

app/src/test/java/org/libremediaconverter/convert/AdvancedPickerTest.kt

@@ -6,6 +6,7 @@ import androidx.compose.ui.test.hasAnyAncestor
 import androidx.compose.ui.test.hasTestTag
 import androidx.compose.ui.test.hasText
 import androidx.compose.ui.test.junit4.StateRestorationTester
+import androidx.compose.ui.test.junit4.v2.createComposeRule
 import androidx.compose.ui.test.onAllNodesWithTag
 import androidx.compose.ui.test.onNodeWithTag
 import androidx.compose.ui.test.onNodeWithText
@@ -16,7 +17,6 @@ import org.junit.Assert.assertTrue
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
-import org.libremediaconverter.createDrainedComposeRule
 import org.libremediaconverter.model.AudioCodec
 import org.libremediaconverter.model.Container
 import org.libremediaconverter.model.ContainerCapabilities
@@ -61,9 +61,11 @@ import org.robolectric.RobolectricTestRunner
 @RunWith(RobolectricTestRunner::class)
 class AdvancedPickerTest {
 
-    // Not `createComposeRule()` directly: see [drainEscapedCoroutineErrors].
+    // The rule is the **v2** one (`androidx.compose.ui.test.junit4.v2`) while
+    // [StateRestorationTester], which takes it below, is not. The mismatched imports are
+    // deliberate: the v2 package has no tester of its own and the two do interoperate.
     @get:Rule
-    val composeRule = createDrainedComposeRule()
+    val composeRule = createComposeRule()
 
     private val restoration = StateRestorationTester(composeRule)
 

app/src/test/java/org/libremediaconverter/convert/ConversionViewModelCleanupTest.kt

@@ -93,8 +93,12 @@ class ConversionViewModelCleanupTest {
         assertTrue("a failed save must not destroy the only copy", staged.exists())
         assertEquals(emptyList<File>(), publisher.discarded)
 
-        // Failed carries no file reference at all, so this only works because the handle is
-        // a ViewModel field rather than something read back out of the state machine.
+        // The handle is a ViewModel field rather than something read back out of the state
+        // machine, and stays one now that a save-failed `Failed` also carries a `PendingSave`:
+        // that is a view for the screen to offer a retry through, never a second owner of the
+        // file. This delete goes through the field, which is what keeps a state that is dropped
+        // rather than read from taking the only reference with it. What the state carries, and
+        // what the screen then does with it, are `FailedSaveRetryTest`'s.
         viewModel.reset()
 
         assertEquals(listOf(staged), publisher.discarded)

app/src/test/java/org/libremediaconverter/convert/ConversionViewModelProbeFailureTest.kt

@@ -2,14 +2,15 @@ package org.libremediaconverter.convert
 
 import android.app.Application
 import android.net.Uri
-import android.os.Looper
 import androidx.media3.common.util.UnstableApi
 import androidx.work.workDataOf
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.test.runTest
 import org.junit.After
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertNotNull
 import org.junit.Assert.assertNull
+import org.junit.Assert.assertThrows
 import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
@@ -18,8 +19,6 @@ import org.libremediaconverter.model.InputProbe
 import org.libremediaconverter.work.ConversionWorker
 import org.robolectric.RobolectricTestRunner
 import org.robolectric.RuntimeEnvironment
-import org.robolectric.Shadows.shadowOf
-import java.util.concurrent.TimeUnit
 
 /**
  * That a probe which throws leaves a screen the user can act on, not a dead coroutine.
@@ -87,19 +86,35 @@ class ConversionViewModelProbeFailureTest {
      * is out of memory" into "this video looks unreadable" and let the app carry on in a
      * state it cannot honour — which is the regression a blanket `catch (Throwable)` would
      * have introduced, and the reason this defect was left open rather than fixed carelessly.
+     *
+     * **The error itself is what is asserted here, and that is what the `pickDispatcher` seam
+     * bought.** With the hop hard-coded to `Dispatchers.IO` this was impossible: the throw
+     * happened on a pool thread some time after this method had returned, so all a test could do
+     * was infer it from a card that never filled in — which is also what a probe returning null
+     * would look like. Worse, the escaped error went into kotlinx-coroutines-test's process-wide
+     * collector and was rethrown at whichever `runTest` started next, which is a *different*
+     * Compose class between runs of identical code. Putting the pick on [Dispatchers.Unconfined]
+     * runs it inline, inside a `runTest` whose scope owns the collector's callback: the error is
+     * handed to this test and consumed, rather than stored for a stranger.
+     *
+     * Note where it surfaces — at the end of `runTest`, not inside `onInputPicked`. `launch`
+     * gives an escaped error to the handler chain and never to its caller, so nothing can catch
+     * it at the call itself. This is as close as the coroutine machinery allows, and unlike the
+     * old assertion it is the real [OutOfMemoryError] instance.
      */
     @Test
     fun `an OutOfMemoryError is not swallowed`() {
         ConversionDependencies.probe = { _, _ -> throw OutOfMemoryError("Failed to allocate 512 MB") }
+        // Unconfined for the pick, so the whole of onInputPicked runs inline on this thread and
+        // has thrown before runTest can leave the scope that has to receive the error.
+        val viewModel = ConversionViewModel(app, Dispatchers.Unconfined, Dispatchers.Unconfined)
 
-        val viewModel = ConversionViewModel(app, Dispatchers.Unconfined)
-        viewModel.onInputPicked(INPUT)
+        val escaped = assertThrows(OutOfMemoryError::class.java) { runTest { viewModel.onInputPicked(INPUT) } }
 
-        // The observable difference, and the reason this is asserted on state rather than on a
-        // caught throwable: the probe hop is on Dispatchers.IO, so an error that escapes lands
-        // on that thread's handler rather than at this call. What must not happen is the card
-        // filling in with an "unreadable" verdict the app would then act on.
-        val settled = settle(viewModel)
+        assertEquals("Failed to allocate 512 MB", escaped.message)
+        // The other half of the contract, unchanged: an OOM is about the process, so the card is
+        // left as it was rather than filled in with a verdict the app would then act on.
+        val settled = viewModel.state.value
         // `sizeBytes = null`, not `0L`: no provider is registered for this authority, so the
         // metadata query returns nothing and the descriptor cannot be opened either. That is the
         // unknown, and it stopped being spelled the same way as "empty" -- see [InputQuery].
@@ -125,30 +140,20 @@ class ConversionViewModelProbeFailureTest {
     private fun pickedProbe(): InputProbe? {
         val viewModel = ConversionViewModel(app, Dispatchers.Unconfined)
         viewModel.onInputPicked(INPUT)
+        // The predicate is the guard, and it is the only one needed. It requires `Ready`, so a
+        // pick that ended in `Failed` never satisfies it and `awaitState` fails on its timeout
+        // naming what it was waiting for -- "Ready with a probe" -- which says more than a
+        // separate assertion could. A `ready as? ConversionState.Failed` check used to sit here
+        // and was dead: `Ready` and `Failed` are sibling subtypes of one sealed interface, so
+        // the cast was always null and the assertNull could never fire. Measured, not assumed --
+        // flipping it to assertNotNull failed all three callers of this helper.
         val ready = awaitState(viewModel.state, "Ready with a probe") {
             it is ConversionState.Ready && it.input.probe != null
         }
-        assertNull("nothing here should reach a terminal failure", (ready as? ConversionState.Failed))
         return (ready as ConversionState.Ready).input.probe
     }
 
-    /**
-     * Pumps the looper the way [awaitState] does, but for a fixed span and without requiring
-     * anything to happen — here "the pick never came back" is the expected outcome, so there
-     * is no predicate to wait on.
-     */
-    private fun settle(viewModel: ConversionViewModel): ConversionState {
-        val deadline = System.nanoTime() + TimeUnit.MILLISECONDS.toNanos(SETTLE_MS)
-        while (System.nanoTime() < deadline) {
-            shadowOf(Looper.getMainLooper()).idle()
-            Thread.sleep(POLL_MS)
-        }
-        return viewModel.state.value
-    }
-
     private companion object {
         val INPUT: Uri = Uri.parse("content://test/holiday.mp4")
-        const val SETTLE_MS = 500L
-        const val POLL_MS = 5L
     }
 }

app/src/test/java/org/libremediaconverter/convert/ConverterLeafTagsTest.kt

@@ -2,6 +2,7 @@ package org.libremediaconverter.convert
 
 import android.net.Uri
 import androidx.compose.ui.test.assertCountEquals
+import androidx.compose.ui.test.junit4.v2.createComposeRule
 import androidx.compose.ui.test.onAllNodesWithTag
 import androidx.compose.ui.test.onNodeWithTag
 import androidx.compose.ui.test.performClick
@@ -9,7 +10,6 @@ import androidx.media3.common.util.UnstableApi
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
-import org.libremediaconverter.createDrainedComposeRule
 import org.libremediaconverter.model.AudioCodec
 import org.libremediaconverter.model.Container
 import org.libremediaconverter.model.EnginePreference
@@ -47,7 +47,7 @@ import org.robolectric.RobolectricTestRunner
 class ConverterLeafTagsTest {
 
     @get:Rule
-    val composeRule = createDrainedComposeRule()
+    val composeRule = createComposeRule()
 
     private fun assertResolvesToOneNode(tag: String) {
         composeRule.onAllNodesWithTag(tag).assertCountEquals(1)

app/src/test/java/org/libremediaconverter/convert/ConverterPickerSelectionTest.kt

@@ -6,6 +6,7 @@ import androidx.compose.ui.test.assertIsSelected
 import androidx.compose.ui.test.hasAnyAncestor
 import androidx.compose.ui.test.hasTestTag
 import androidx.compose.ui.test.hasText
+import androidx.compose.ui.test.junit4.v2.createComposeRule
 import androidx.compose.ui.test.onNodeWithText
 import androidx.compose.ui.test.performClick
 import androidx.media3.common.util.UnstableApi
@@ -13,7 +14,6 @@ import org.junit.Assert.assertEquals
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
-import org.libremediaconverter.createDrainedComposeRule
 import org.libremediaconverter.model.EnginePreference
 import org.libremediaconverter.model.OutputFormat
 import org.libremediaconverter.model.QualityTier
@@ -48,7 +48,7 @@ import org.robolectric.RobolectricTestRunner
 class ConverterPickerSelectionTest {
 
     @get:Rule
-    val composeRule = createDrainedComposeRule()
+    val composeRule = createComposeRule()
 
     /**
      * The chip carrying [label] inside the row tagged [rowTag].

app/src/test/java/org/libremediaconverter/convert/ConverterScreenContentTest.kt

@@ -0,0 +1,114 @@
+package org.libremediaconverter.convert
+
+import android.net.Uri
+import androidx.compose.ui.test.junit4.v2.createComposeRule
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.performClick
+import androidx.compose.ui.test.performScrollTo
+import androidx.media3.common.util.UnstableApi
+import org.junit.Assert.assertEquals
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.model.Validation
+import org.libremediaconverter.ui.TestTags
+import org.robolectric.RobolectricTestRunner
+import java.io.File
+
+/**
+ * The seam carries a `ConversionState` in and an action back out.
+ *
+ * The defect this bites on is the extraction having quietly stopped being an extraction: a
+ * `ConverterScreenContent` that ignores the `state` it was handed, or renders the finished job's
+ * affordances without wiring them to the callbacks the entry point supplies. Neither shows up at
+ * compile time -- an unread parameter compiles, and a `Button` whose `onClick` does nothing is a
+ * valid `Button` -- and neither is visible from the leaf tests, which compose `FileCard`,
+ * `AdvancedPicker` and the pickers directly and never see a state at all.
+ *
+ * **Both assertions were unreachable before R38.5**, which is the point of the ticket rather than
+ * a remark about it. `ConversionState.Converted` is produced only by a `ConversionWorker` run that
+ * has already succeeded, so no test can drive a real `ConversionViewModel` into it: it would need
+ * a `WorkManager`, a media probe, a staged output file and a completed job. Handing the state in
+ * is the only way to ask what the screen does with it.
+ *
+ * Deliberately not the state matrix. Which affordances each of the six `ConversionState`s renders
+ * is R38.6 (#62); this file asserts only that the injection point exists and works in both
+ * directions, so the two PRs cannot collide over the same cases.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class ConverterScreenContentTest {
+
+    @get:Rule
+    val composeRule = createComposeRule()
+
+    /** What the screen asked to save, in the order it asked. Empty until Save is tapped. */
+    private val savedAs = mutableListOf<String>()
+
+    @Test
+    fun `a converted job renders the save button`() {
+        setContent(converted())
+
+        composeRule.onNodeWithTag(TestTags.SAVE_FILE).assertExists()
+    }
+
+    /**
+     * The direction that did not exist before this change.
+     *
+     * Asserting the *name* rather than just that something was called: the suggested name comes
+     * from the job -- `ConversionWorker.KEY_SUGGESTED_NAME` -- and is what the save dialog opens
+     * with, so a Save button wired to the wrong branch's state would hand over the wrong one and
+     * a bare "was called" check would stay green.
+     */
+    @Test
+    fun `tapping save hands back the name the finished job chose`() {
+        setContent(converted())
+
+        composeRule.onNodeWithTag(TestTags.SAVE_FILE).performScrollTo().performClick()
+
+        assertEquals(listOf("holiday.mp4"), savedAs)
+    }
+
+    /**
+     * `staged` names a file that does not exist, on purpose.
+     *
+     * The branch renders `formatBytes(s.staged.length())`, and `length()` answers `0L` for a
+     * missing path rather than throwing, so the size line reads `0 B` and no temporary folder is
+     * needed. `routeReason` stays blank, which is what keeps the routing chip out of the tree --
+     * that chip is R38.6's case, not this file's.
+     */
+    private fun converted() = ConversionState.Converted(
+        input = InputFile(
+            uri = Uri.parse("content://test/holiday.mkv"),
+            displayName = "holiday.mkv",
+            sizeBytes = 12_345_678L,
+        ),
+        staged = File("no-such-staged-output.mp4"),
+        suggestedName = "holiday.mp4",
+        mimeType = "video/mp4",
+    )
+
+    private fun setContent(state: ConversionState) {
+        composeRule.setContent {
+            ConverterScreenContent(
+                state = state,
+                settings = ConversionSettings(),
+                validation = Validation.Valid,
+                actions = ConverterActions(
+                    onPickInput = {},
+                    onPreset = {},
+                    onContainer = {},
+                    onVideoCodec = {},
+                    onAudioCodec = {},
+                    onSuggestion = {},
+                    onQuality = {},
+                    onEnginePreference = {},
+                    onConvert = {},
+                    onCancel = {},
+                    onSave = { suggestedName -> savedAs += suggestedName },
+                    onReset = {},
+                ),
+            )
+        }
+    }
+}

app/src/test/java/org/libremediaconverter/convert/ConverterStateAffordancesTest.kt

@@ -0,0 +1,478 @@
+package org.libremediaconverter.convert
+
+import android.net.Uri
+import androidx.compose.ui.semantics.ProgressBarRangeInfo
+import androidx.compose.ui.test.assertIsEnabled
+import androidx.compose.ui.test.assertIsNotEnabled
+import androidx.compose.ui.test.assertRangeInfoEquals
+import androidx.compose.ui.test.assertTextEquals
+import androidx.compose.ui.test.junit4.v2.createComposeRule
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performClick
+import androidx.compose.ui.test.performScrollTo
+import androidx.media3.common.util.UnstableApi
+import org.junit.Assert.assertEquals
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.model.AudioCodec
+import org.libremediaconverter.model.Container
+import org.libremediaconverter.model.OutputSpec
+import org.libremediaconverter.model.Validation
+import org.libremediaconverter.model.VideoCodec
+import org.libremediaconverter.ui.TestTags
+import org.robolectric.RobolectricTestRunner
+import java.io.File
+
+/**
+ * Every `ConversionState` renders its own affordances, and only its own.
+ *
+ * The defect this bites on is a `when` arm that has drifted from the state it names: a button
+ * offered in a state where it cannot work, a state's own data never reaching the node that is
+ * supposed to display it, or an affordance wired to the wrong callback. None of that is a compile
+ * error -- every arm of the `when` returns `Unit`, so an arm can render anything at all -- and none
+ * of it is visible from the leaf tests, which compose `FileCard`, `AdvancedPicker` and the three
+ * pickers directly and never see a `ConversionState`.
+ *
+ * The arm most worth guarding is `Ready`'s `enabled = validation.isValid`. The Advanced picker
+ * deliberately lets an impossible container / codec combination be selected -- `AdvancedPicker`'s
+ * KDoc says teaching the constraint beats hiding it -- so that single expression is the only thing
+ * standing between an invalid spec and a job that cannot succeed. `enabled = true` compiles, renders
+ * an identical screen apart from one colour, and passes every other test in this suite.
+ *
+ * Callbacks are asserted by **identity, over the whole log**: [fired] records all twelve of them and
+ * each assertion compares the complete list against one expected entry. A bare "the callback ran"
+ * check stays green when an arm fires the right callback for the wrong reason, and a check on one
+ * callback alone stays green when an arm fires two.
+ *
+ * ### Not asserted here, so that each is a decision rather than an omission
+ *
+ * - **`Failed`'s error colour.** #62's table asks for the message "in the error colour". Compose
+ *   publishes no text colour to the semantics tree -- there is no `SemanticsProperties` entry for
+ *   it -- so it is unobservable from a JVM test, the same limit `FileCardTest` records for
+ *   `HorizontalDivider`. The message text itself is asserted; the colour would need a screenshot.
+ * - **The three `assertDoesNotExist` checks on [TestTags.Converter.FILE_CARD] are compile-guarded,
+ *   not guarded by this file.** `Idle` is a `data object`, `Saved` carries a `displayName`, and
+ *   `Failed` carries a message and -- after a failed save only -- the staged file it left behind;
+ *   none of the three has an `input`, so `FileCard(s.input)` does not compile in those arms. The
+ *   lines stay because they state the intent cheaply, but they are not what stops a `FileCard`
+ *   appearing there and this file does not claim they are.
+ * - **Which constant each chip hands back** belongs to `ConverterPickerSelectionTest`, and **what
+ *   the file card says about an unknown size** to `FileCardTest`. This file asserts that `Ready`
+ *   puts those leaves on screen at all, not what they then do.
+ * - **The suggested name `Converted` hands to the save dialog** is pinned by
+ *   `ConverterScreenContentTest`; repeating it here would be a second copy of one assertion.
+ * - **`ConverterScreen`'s permission dance.** `requestNotifications` calls `convert()` on both grant
+ *   and deny, deliberately -- the KDoc explains that the foreground service runs either way -- and
+ *   it lives in the entry point, above the seam this file composes.
+ * - **`is ConversionState.Idle -> Unit` in the nested `when`.** The outer `when` peels `Idle` off
+ *   first, so that arm is permanently unreachable and no test can reach it.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class ConverterStateAffordancesTest {
+
+    @get:Rule
+    val composeRule = createComposeRule()
+
+    /**
+     * Every callback the screen fired, in order, tagged with the value it carried.
+     *
+     * All twelve are recorded rather than only the one under test, so an assertion can be
+     * `assertEquals(listOf("cancel"), fired)` -- which says "this one and nothing else".
+     */
+    private val fired = mutableListOf<String>()
+
+    // -------------------------------------------------------------------- Idle
+
+    @Test
+    fun `an idle screen offers the prompt and the picker, and nothing to act on yet`() {
+        setContent(ConversionState.Idle)
+
+        composeRule.onNodeWithText("Pick a file to convert.").assertExists()
+        composeRule.onNodeWithTag(TestTags.Converter.CHOOSE_FILE).assertExists()
+        composeRule.onNodeWithTag(TestTags.Converter.CONVERT).assertDoesNotExist()
+        composeRule.onNodeWithTag(TestTags.CANCEL).assertDoesNotExist()
+        // Compile-guarded rather than guarded here -- `Idle` has no `input`. See the class KDoc.
+        composeRule.onNodeWithTag(TestTags.Converter.FILE_CARD).assertDoesNotExist()
+    }
+
+    /**
+     * No [performScrollTo] on this one, unlike every other click below. `Idle` is the centred
+     * branch outside the `verticalScroll` column, so it has no scrollable ancestor to scroll in.
+     */
+    @Test
+    fun `tapping choose file on an idle screen asks for a file and does nothing else`() {
+        setContent(ConversionState.Idle)
+
+        composeRule.onNodeWithTag(TestTags.Converter.CHOOSE_FILE).performClick()
+
+        assertEquals(listOf("pickInput"), fired)
+    }
+
+    // ------------------------------------------------------------------- Ready
+
+    /**
+     * All four pickers, the card above them and both buttons below, in one assertion each.
+     *
+     * A superset of #62's "all five pickers": which four or five of these count as a picker is not
+     * worth arguing about, so the case names everything the arm emits.
+     */
+    @Test
+    fun `a picked file offers its card, all four pickers and both buttons`() {
+        setContent(ConversionState.Ready(input()))
+
+        composeRule.onNodeWithTag(TestTags.Converter.FILE_CARD).assertExists()
+        composeRule.onNodeWithTag(TestTags.Converter.FORMAT_CHIPS).assertExists()
+        composeRule.onNodeWithTag(TestTags.Converter.ADVANCED_TOGGLE).assertExists()
+        composeRule.onNodeWithTag(TestTags.Converter.QUALITY_CHIPS).assertExists()
+        composeRule.onNodeWithTag(TestTags.Converter.ENGINE_CHIPS).assertExists()
+        composeRule.onNodeWithTag(TestTags.Converter.CONVERT).assertExists()
+        composeRule.onNodeWithTag(TestTags.Converter.CHOOSE_DIFFERENT_FILE).assertExists()
+    }
+
+    /** The card is handed `s.input`, so the name on it is how the state is shown to have arrived. */
+    @Test
+    fun `the file card on a picked file names the file that was picked`() {
+        setContent(ConversionState.Ready(input()))
+
+        composeRule.onNodeWithTag(TestTags.Converter.FILE_CARD_NAME).assertTextEquals("holiday.mkv")
+    }
+
+    @Test
+    fun `convert is offered for a spec that can be produced`() {
+        setContent(ConversionState.Ready(input()), validation = Validation.Valid)
+
+        composeRule.onNodeWithTag(TestTags.Converter.CONVERT).assertIsEnabled()
+    }
+
+    @Test
+    fun `tapping convert starts the job and does nothing else`() {
+        setContent(ConversionState.Ready(input()), validation = Validation.Valid)
+
+        composeRule.onNodeWithTag(TestTags.Converter.CONVERT).performScrollTo().performClick()
+
+        assertEquals(listOf("convert"), fired)
+    }
+
+    /**
+     * The bite named in #62. Reverting `enabled = validation.isValid` to `enabled = true` reddens
+     * exactly this case, and nothing else in the repository.
+     */
+    @Test
+    fun `convert is withheld for a spec that cannot be produced`() {
+        setContent(ConversionState.Ready(input()), validation = INVALID)
+
+        composeRule.onNodeWithTag(TestTags.Converter.CONVERT).assertIsNotEnabled()
+    }
+
+    /** The other button on the arm goes back to the picker rather than starting anything. */
+    @Test
+    fun `tapping choose a different file asks for a file rather than converting`() {
+        setContent(ConversionState.Ready(input()))
+
+        composeRule
+            .onNodeWithTag(TestTags.Converter.CHOOSE_DIFFERENT_FILE)
+            .performScrollTo()
+            .performClick()
+
+        assertEquals(listOf("pickInput"), fired)
+    }
+
+    // -------------------------------------------------------------- Converting
+
+    /**
+     * Two independent readings of the same `percent`, on purpose.
+     *
+     * The heading is a string and the bar is a float, and the arm computes them from the state
+     * separately -- `"${s.percent}%"` against `s.percent / 100f`. A hardcoded bar and a hardcoded
+     * heading are different mistakes, so neither assertion covers the other.
+     */
+    @Test
+    fun `a running job reports how far it has got, in words and on the bar`() {
+        setContent(ConversionState.Converting(input(), percent = 42))
+
+        composeRule.onNodeWithText("Converting… 42%").assertExists()
+        composeRule
+            .onNodeWithTag(TestTags.Converter.PROGRESS)
+            .assertRangeInfoEquals(ProgressBarRangeInfo(0.42f, 0f..1f))
+    }
+
+    @Test
+    fun `a running job offers cancel and not start over`() {
+        setContent(ConversionState.Converting(input(), percent = 42))
+
+        composeRule.onNodeWithTag(TestTags.CANCEL).assertExists()
+        composeRule.onNodeWithTag(TestTags.START_OVER).assertDoesNotExist()
+    }
+
+    @Test
+    fun `tapping cancel on a running job cancels it and does nothing else`() {
+        setContent(ConversionState.Converting(input(), percent = 42))
+
+        composeRule.onNodeWithTag(TestTags.CANCEL).performScrollTo().performClick()
+
+        assertEquals(listOf("cancel"), fired)
+    }
+
+    // ----------------------------------------------------------------- Waiting
+
+    /**
+     * The second bite named in #62. Deleting the `Cancel` button from the `Waiting` arm reddens
+     * this case and the one below it.
+     *
+     * The paragraph is asserted in full rather than by a fragment because it is the only thing the
+     * arm renders besides the card and the button, and because its wording is the arm's whole
+     * job -- `FailureOutcome` records that two different causes land here and the state cannot tell
+     * them apart, so the text has to cover both. A reword should redden one test, and this is it.
+     */
+    @Test
+    fun `a paused job explains why and still offers cancel`() {
+        setContent(ConversionState.Waiting(input()))
+
+        composeRule.onNodeWithText(PAUSED_PARAGRAPH).assertExists()
+        composeRule.onNodeWithTag(TestTags.CANCEL).assertExists()
+    }
+
+    @Test
+    fun `tapping cancel on a paused job cancels it and does nothing else`() {
+        setContent(ConversionState.Waiting(input()))
+
+        composeRule.onNodeWithTag(TestTags.CANCEL).performScrollTo().performClick()
+
+        assertEquals(listOf("cancel"), fired)
+    }
+
+    // --------------------------------------------------------------- Converted
+
+    @Test
+    fun `a finished job offers save and start over, and no longer offers cancel`() {
+        setContent(converted())
+
+        composeRule.onNodeWithTag(TestTags.SAVE_FILE).assertExists()
+        composeRule.onNodeWithTag(TestTags.START_OVER).assertExists()
+        composeRule.onNodeWithTag(TestTags.CANCEL).assertDoesNotExist()
+    }
+
+    @Test
+    fun `tapping start over on a finished job resets and does not save`() {
+        setContent(converted())
+
+        composeRule.onNodeWithTag(TestTags.START_OVER).performScrollTo().performClick()
+
+        assertEquals(listOf("reset"), fired)
+    }
+
+    /**
+     * The chip carries the job's own explanation, so its text is the assertion rather than its
+     * presence: a chip showing the engine name, or the previous job's reason, would still exist.
+     */
+    @Test
+    fun `a finished job shows the routing decision the job reported`() {
+        setContent(converted(routeReason = "Software — the MKV input needed a re-encode"))
+
+        composeRule
+            .onNodeWithTag(TestTags.Converter.ROUTE_REASON)
+            .assertTextEquals("Software — the MKV input needed a re-encode")
+    }
+
+    /** The other side of the `isNotBlank` guard, which is unguarded without a case of its own. */
+    @Test
+    fun `a finished job that reported no routing decision shows no chip`() {
+        setContent(converted(routeReason = ""))
+
+        composeRule.onNodeWithTag(TestTags.Converter.ROUTE_REASON).assertDoesNotExist()
+    }
+
+    // ------------------------------------------------------------------- Saved
+
+    @Test
+    fun `a saved file names itself and offers another conversion`() {
+        setContent(ConversionState.Saved(displayName = "holiday.mp4"))
+
+        composeRule.onNodeWithText("Saved holiday.mp4.").assertExists()
+        composeRule.onNodeWithTag(TestTags.Converter.CONVERT_ANOTHER).assertExists()
+        // Compile-guarded rather than guarded here -- `Saved` has no `input`. See the class KDoc.
+        composeRule.onNodeWithTag(TestTags.Converter.FILE_CARD).assertDoesNotExist()
+    }
+
+    @Test
+    fun `tapping convert another after a save resets and does nothing else`() {
+        setContent(ConversionState.Saved(displayName = "holiday.mp4"))
+
+        composeRule
+            .onNodeWithTag(TestTags.Converter.CONVERT_ANOTHER)
+            .performScrollTo()
+            .performClick()
+
+        assertEquals(listOf("reset"), fired)
+    }
+
+    // ------------------------------------------------------------------ Failed
+
+    /**
+     * The message is the arm's only output that carries information, and it comes from the state.
+     * An arm rendering a fixed apology would look right and say nothing, which is why the assertion
+     * is on the text handed in rather than on a node existing.
+     */
+    @Test
+    fun `a failed job renders the reason it was given and offers a restart`() {
+        setContent(ConversionState.Failed(message = "Ran out of space while writing the output."))
+
+        composeRule.onNodeWithText("Ran out of space while writing the output.").assertExists()
+        composeRule.onNodeWithTag(TestTags.START_OVER).assertExists()
+        composeRule.onNodeWithTag(TestTags.SAVE_FILE).assertDoesNotExist()
+        // Compile-guarded rather than guarded here -- `Failed` has no `input`. See the class KDoc.
+        composeRule.onNodeWithTag(TestTags.Converter.FILE_CARD).assertDoesNotExist()
+    }
+
+    /**
+     * **The assertion that bounds #30's whole change**, and the one worth breaking things to keep.
+     *
+     * A transcode that died staged nothing, so its `Failed` carries no [PendingSave] and there is
+     * nothing for a save dialog to be handed. Making the retry unconditional -- or making the
+     * `WorkInfo.State.FAILED` arm of `ConversionViewModel.observe` carry a handle it has no file
+     * for -- puts a button on screen that can only fail, and this is what notices.
+     */
+    @Test
+    fun `a transcode failure offers no way to save`() {
+        setContent(ConversionState.Failed(message = "Ran out of space while writing the output."))
+
+        composeRule.onNodeWithTag(TestTags.RETRY_SAVE).assertDoesNotExist()
+        composeRule.onNodeWithTag(TestTags.SAVE_FILE).assertDoesNotExist()
+    }
+
+    @Test
+    fun `tapping start over after a failure resets and does nothing else`() {
+        setContent(ConversionState.Failed(message = "Ran out of space while writing the output."))
+
+        composeRule.onNodeWithTag(TestTags.START_OVER).performScrollTo().performClick()
+
+        assertEquals(listOf("reset"), fired)
+    }
+
+    // ----------------------------------------------------- Failed, carrying a file
+
+    /**
+     * The defect in #30, stated as what the branch must render.
+     *
+     * `save()` keeps the staged file on a failure deliberately -- it can be the only copy of an
+     * hour of transcoding -- and before this the only control here was "Start over", wired to
+     * `reset()`, which deletes exactly that file. Both buttons, not one: the restart has to stay
+     * reachable, because leaving a full-size file in cache is the outcome it exists to avoid.
+     */
+    @Test
+    fun `a failed save offers the file again as well as a restart`() {
+        setContent(failedSave())
+
+        composeRule.onNodeWithTag(TestTags.RETRY_SAVE).assertExists()
+        composeRule.onNodeWithTag(TestTags.START_OVER).assertExists()
+    }
+
+    /**
+     * The name, not just that something fired: it comes from the finished job, and a retry wired to
+     * a literal or to the picker's current guess would hand the dialog a name the job never chose.
+     */
+    @Test
+    fun `tapping try saving again hands back the name the job chose`() {
+        setContent(failedSave())
+
+        composeRule.onNodeWithTag(TestTags.RETRY_SAVE).performScrollTo().performClick()
+
+        assertEquals(listOf("save:holiday.mp4"), fired)
+    }
+
+    /**
+     * Start over from here still resets, and resetting still deletes -- see `reset()`'s KDoc for
+     * why that is acceptable now and was not before. What it must not do is save on the way past.
+     */
+    @Test
+    fun `tapping start over after a failed save resets and does not save`() {
+        setContent(failedSave())
+
+        composeRule.onNodeWithTag(TestTags.START_OVER).performScrollTo().performClick()
+
+        assertEquals(listOf("reset"), fired)
+    }
+
+    // ------------------------------------------------------------------ Harness
+
+    private fun input() = InputFile(
+        uri = Uri.parse("content://test/holiday.mkv"),
+        displayName = "holiday.mkv",
+        sizeBytes = 12_345_678L,
+    )
+
+    /**
+     * `staged` names a path that does not exist, deliberately: `File.length()` answers `0L` for a
+     * missing file rather than throwing, so the size line reads `0 B` and no temporary folder is
+     * needed to render the arm.
+     */
+    /**
+     * A `Failed` an earlier save left carrying its file, which is the only way [retry] is non-null.
+     *
+     * The same missing `staged` path as [converted], and for the same reason: this arm renders no
+     * size line at all, so nothing here ever touches the filesystem.
+     */
+    private fun failedSave() = ConversionState.Failed(
+        message = "There was not enough room on the destination.",
+        retry = PendingSave(
+            staged = File("no-such-staged-output.mp4"),
+            suggestedName = "holiday.mp4",
+            mimeType = "video/mp4",
+        ),
+    )
+
+    private fun converted(routeReason: String = "") = ConversionState.Converted(
+        input = input(),
+        staged = File("no-such-staged-output.mp4"),
+        routeReason = routeReason,
+        suggestedName = "holiday.mp4",
+        mimeType = "video/mp4",
+    )
+
+    private fun setContent(state: ConversionState, validation: Validation = Validation.Valid) {
+        composeRule.setContent {
+            ConverterScreenContent(
+                state = state,
+                settings = ConversionSettings(),
+                validation = validation,
+                actions = ConverterActions(
+                    onPickInput = { fired += "pickInput" },
+                    onPreset = { fired += "preset:$it" },
+                    onContainer = { fired += "container:$it" },
+                    onVideoCodec = { fired += "videoCodec:$it" },
+                    onAudioCodec = { fired += "audioCodec:$it" },
+                    onSuggestion = { fired += "suggestion:$it" },
+                    onQuality = { fired += "quality:$it" },
+                    onEnginePreference = { fired += "engine:$it" },
+                    onConvert = { fired += "convert" },
+                    onCancel = { fired += "cancel" },
+                    onSave = { fired += "save:$it" },
+                    onReset = { fired += "reset" },
+                ),
+            )
+        }
+    }
+
+    private companion object {
+
+        /**
+         * A spec no container can hold, with somewhere to go instead.
+         *
+         * Built here rather than run through `ContainerCapabilities` because what makes a spec
+         * invalid is that class's subject; all this arm needs is a `Validation` that answers
+         * `isValid == false`.
+         */
+        val INVALID = Validation.Invalid(
+            message = "WebM cannot hold H.264 video.",
+            suggestions = listOf(OutputSpec(Container.MKV, VideoCodec.H264, AudioCodec.AAC)),
+        )
+
+        /** Copied from the `Waiting` arm, where it is written as two concatenated fragments. */
+        const val PAUSED_PARAGRAPH =
+            "Paused. Android limits background media processing, so this will " +
+                "resume automatically — keeping the app open helps it along."
+    }
+}

app/src/test/java/org/libremediaconverter/convert/FailedSaveRetryTest.kt

@@ -0,0 +1,370 @@
+package org.libremediaconverter.convert
+
+import android.app.Application
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.work.workDataOf
+import kotlinx.coroutines.Dispatchers
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.join.JoinState
+import org.libremediaconverter.join.JoinViewModel
+import org.libremediaconverter.join.pendingSave
+import org.libremediaconverter.model.InputProbe
+import org.libremediaconverter.model.OutputFormat
+import org.libremediaconverter.work.ConcatWorker
+import org.libremediaconverter.work.ConversionWorker
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import java.io.File
+
+/**
+ * A failed save has to leave the file *offerable*, not merely undeleted.
+ *
+ * The defect is #30, and both halves of it were already written down in `main`. `save()`'s
+ * `onFailure` kept the staged file on purpose -- "deleting here would destroy the work to tidy up
+ * a cache directory" -- and then handed the screen a `Failed` carrying a message and nothing else,
+ * so the single control that branch rendered was "Start over", wired to `reset()`, which deletes
+ * exactly that file. The intent and the affordance disagreed, and the affordance won.
+ *
+ * `ConversionViewModelCleanupTest` already pins the *keeping*: after a failed save the file is
+ * still on disk and nothing has been discarded. It stays green with the state carrying nothing,
+ * because it reads the filesystem rather than the state. This file asserts the other half -- that
+ * the handle reaches the state a screen can read -- and the negative that bounds it: a failure
+ * with nothing staged behind it must not sprout a save button.
+ *
+ * Both ViewModels in one class, following `MissingStagedFileTest`. They are separate state
+ * machines that can each hold a staged file at once, but this defect and its fix are the same
+ * shape in both, and splitting them would put the two halves of one invariant in two files.
+ *
+ * ### Not asserted here, so each is a decision rather than an omission
+ *
+ * - **That the destination received the bytes.** [RecordingPublisher.publish] is a stub, which is
+ *   the only way to make a save fail deterministically -- and making it fail is what every case
+ *   here needs. `OutputPublisherPublishTest` owns what a real publish writes.
+ * - **The screen's two buttons.** `ConverterStateAffordancesTest` and `JoinStateAffordancesTest`
+ *   own what each state renders; this file owns what each state carries.
+ * - **`ConverterScreen`'s `destinationMime` line itself.** It lives in the entry point, above the
+ *   `ScreenContent` seam, and reaching it needs a real ViewModel inside a composition. What it
+ *   reads -- `pendingSave()?.mimeType` -- is asserted directly instead, which is why that
+ *   derivation was moved out of the entry point in the first place.
+ * - **Picking a new input while a `Failed` carries a file.** `onInputPicked` overwrites the state
+ *   without discarding, from `Converted` exactly as much as from a carrying `Failed`, and neither
+ *   branch renders a picker. It is a pre-existing path this change neither opens nor widens: the
+ *   carried handle is a view of `pendingStaged`, never a second owner of the file.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class FailedSaveRetryTest {
+
+    private lateinit var app: Application
+    private lateinit var publisher: RecordingPublisher
+    private lateinit var staged: File
+
+    @Before
+    fun setUp() {
+        app = RuntimeEnvironment.getApplication()
+        publisher = RecordingPublisher(app)
+        ConversionDependencies.publisher = { publisher }
+        // MediaProbe spawns FFprobe, whose loader throws with no native library present.
+        ConversionDependencies.probe = { _, _ -> InputProbe() }
+
+        staged = publisher.createStagingFile("holiday.mp4").apply { writeBytes(ByteArray(4096)) }
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    // ------------------------------------------------------------------ Convert
+
+    /**
+     * The bite named in #30's fix. Emitting a plain `Failed` from `save()`'s `onFailure` -- which
+     * is what `main` did -- reddens this case on the null handle, and nothing else in the suite.
+     */
+    @Test
+    fun `a failed save leaves the staged file offerable, not merely undeleted`() {
+        val viewModel = failedSaveViewModel()
+
+        val failed = viewModel.state.value as ConversionState.Failed
+        val retry = failed.retry
+        assertNotNull("a failed save must leave the staged file offerable, not just on disk", retry)
+        assertEquals("the retry must name the file the conversion actually produced", staged, retry?.staged)
+        // Both from the job's own output Data rather than from the pickers, so a retry opens the
+        // same dialog the first attempt did.
+        assertEquals(SUGGESTED_NAME, retry?.suggestedName)
+        assertEquals(JOB_MIME_TYPE, retry?.mimeType)
+        assertTrue("a failed save must not destroy the only copy", staged.exists())
+    }
+
+    /**
+     * The whole point of carrying the handle: the second attempt is a real save, not a new job.
+     *
+     * `publishFailure` is cleared between the two calls, so one `RecordingPublisher` plays both a
+     * full destination and an empty one -- which is exactly the user's situation.
+     */
+    @Test
+    fun `retrying a failed save publishes the file and leaves nothing staged`() {
+        val viewModel = failedSaveViewModel()
+
+        publisher.publishFailure = null
+        viewModel.save(DESTINATION)
+
+        val saved = awaitState(viewModel.state, "Saved") { it is ConversionState.Saved }
+        assertEquals(SUGGESTED_NAME, (saved as ConversionState.Saved).displayName)
+        assertFalse("a successful retry should have removed the staged file", staged.exists())
+        // Nothing to collect afterwards: the retry published it, so reset() has no work left.
+        viewModel.reset()
+        assertEquals(emptyList<File>(), publisher.discarded)
+    }
+
+    /**
+     * The second failure must not eat the file the first one kept.
+     *
+     * A `Failed` built fresh from `e.message` alone would drop the handle here while every other
+     * assertion in this file stayed green -- the file is still on disk, and the first failure
+     * already proved the state can carry it.
+     */
+    @Test
+    fun `a retry that fails again still carries the file rather than dropping it`() {
+        val viewModel = failedSaveViewModel()
+
+        publisher.publishFailure = IllegalStateException("destination volume still full")
+        viewModel.save(DESTINATION)
+
+        // Waited for by the *second* message rather than by `is Failed`: the state was already
+        // Failed when the retry started, so the type alone would be satisfied before it ran.
+        val failed = awaitState(viewModel.state, "the second failure") {
+            it is ConversionState.Failed && it.message == "destination volume still full"
+        } as ConversionState.Failed
+        assertEquals("the second failure must offer the same file the first one did", staged, failed.retry?.staged)
+        assertTrue(staged.exists())
+        assertEquals(emptyList<File>(), publisher.discarded)
+    }
+
+    /**
+     * "Start over" still deletes, and that is the decision `reset()`'s KDoc records: acceptable
+     * only because "Try saving again" is on screen beside it. Exactly once, through the publisher.
+     */
+    @Test
+    fun `start over from a failed save discards the carried file exactly once`() {
+        val viewModel = failedSaveViewModel()
+
+        viewModel.reset()
+
+        assertEquals(ConversionState.Idle, viewModel.state.value)
+        assertEquals(listOf(staged), publisher.discarded)
+        assertFalse(staged.exists())
+    }
+
+    /**
+     * A retry meets the same existence check the first attempt did, so a file collected by the
+     * sweep or by the OS in between is reported as a sentence rather than as a raw ENOENT path.
+     * And the state that reports it carries nothing: there is no file left to offer.
+     */
+    @Test
+    fun `a retry whose staged file has gone says so and offers nothing further`() {
+        val viewModel = failedSaveViewModel()
+        assertTrue("the fixture must start with a real staged file", staged.delete())
+
+        publisher.publishFailure = null
+        viewModel.save(DESTINATION)
+
+        val failed = viewModel.state.value as ConversionState.Failed
+        assertEquals(STAGED_FILE_GONE_MESSAGE, failed.message)
+        assertNull("a file that has gone cannot be offered again", failed.retry)
+    }
+
+    /**
+     * The negative that bounds the whole change, and the reason `retry` is nullable.
+     *
+     * A transcode that died staged nothing, so there is no file to hand back -- and a `Failed`
+     * that carried one anyway would put a save button on a screen with nothing to save. Driven
+     * through a worker that really fails rather than by constructing the state, because the line
+     * under test is the `WorkInfo.State.FAILED` arm of `observe`.
+     */
+    @Test
+    fun `a transcode failure carries nothing to save`() {
+        installFailingTestWorkManager(app, workDataOf(ConversionWorker.KEY_ERROR to "The encoder gave up."))
+        val viewModel = ConversionViewModel(app, Dispatchers.Unconfined)
+        viewModel.onInputPicked(Uri.parse("content://test/holiday.mp4"))
+        awaitState(viewModel.state, "Ready") { it is ConversionState.Ready }
+
+        viewModel.convert()
+
+        val failed = awaitState(viewModel.state, "Failed") { it is ConversionState.Failed } as ConversionState.Failed
+        assertEquals("The encoder gave up.", failed.message)
+        assertNull("a transcode failure has nothing staged, so it must offer no save", failed.retry)
+        assertNull("and nothing for the save dialog to open with either", failed.pendingSave())
+    }
+
+    /**
+     * What the save dialog reopens with, which is the entry point's only reader of this state.
+     *
+     * The pickers are moved *after* the job finishes, which is what makes this bite: a retry that
+     * asked the current settings would offer `audio/mpeg` for a file the job wrote as MP4. The
+     * same gap is permanent for a reattached job, whose spec was never in these settings at all.
+     */
+    @Test
+    fun `a retry offers the type the job chose, not the one the pickers now show`() {
+        val viewModel = failedSaveViewModel()
+
+        viewModel.setPreset(OutputFormat.MP3)
+
+        assertEquals(
+            "the fixture needs the pickers to disagree with the job",
+            "audio/mpeg",
+            viewModel.settings.value.spec.mimeType,
+        )
+        assertEquals(JOB_MIME_TYPE, viewModel.state.value.pendingSave()?.mimeType)
+    }
+
+    // --------------------------------------------------------------------- Join
+
+    @Test
+    fun `a failed join save leaves the staged file offerable, not merely undeleted`() {
+        val viewModel = failedJoinSaveViewModel()
+
+        val failed = viewModel.state.value as JoinState.Failed
+        val retry = failed.retry
+        assertNotNull("a failed save must leave the staged file offerable, not just on disk", retry)
+        assertEquals(staged, retry?.staged)
+        assertEquals(SUGGESTED_NAME, retry?.suggestedName)
+        assertEquals(JOB_MIME_TYPE, retry?.mimeType)
+        assertTrue(staged.exists())
+    }
+
+    @Test
+    fun `retrying a failed join save publishes the file and leaves nothing staged`() {
+        val viewModel = failedJoinSaveViewModel()
+
+        publisher.publishFailure = null
+        viewModel.save(DESTINATION)
+
+        val saved = awaitState(viewModel.state, "Saved") { it is JoinState.Saved }
+        assertEquals(SUGGESTED_NAME, (saved as JoinState.Saved).displayName)
+        assertFalse(staged.exists())
+        viewModel.reset()
+        assertEquals(emptyList<File>(), publisher.discarded)
+    }
+
+    @Test
+    fun `a join retry that fails again still carries the file rather than dropping it`() {
+        val viewModel = failedJoinSaveViewModel()
+
+        publisher.publishFailure = IllegalStateException("destination volume still full")
+        viewModel.save(DESTINATION)
+
+        // By the second message, not by `is Failed` -- see the converter case above.
+        val failed = awaitState(viewModel.state, "the second failure") {
+            it is JoinState.Failed && it.message == "destination volume still full"
+        } as JoinState.Failed
+        assertEquals(staged, failed.retry?.staged)
+        assertTrue(staged.exists())
+        assertEquals(emptyList<File>(), publisher.discarded)
+    }
+
+    @Test
+    fun `start over from a failed join save discards the carried file exactly once`() {
+        val viewModel = failedJoinSaveViewModel()
+
+        viewModel.reset()
+
+        assertEquals(JoinState.Idle, viewModel.state.value)
+        assertEquals(listOf(staged), publisher.discarded)
+        assertFalse(staged.exists())
+    }
+
+    @Test
+    fun `a join failure carries nothing to save`() {
+        installFailingTestWorkManager(app, workDataOf(ConcatWorker.KEY_ERROR to "The files could not be joined."))
+        val viewModel = JoinViewModel(app, Dispatchers.Unconfined)
+        viewModel.onInputsPicked(listOf(Uri.parse("content://test/a.mp4"), Uri.parse("content://test/b.mp4")))
+        awaitState(viewModel.state, "Ready") { it is JoinState.Ready }
+
+        viewModel.join()
+
+        val failed = awaitState(viewModel.state, "Failed") { it is JoinState.Failed } as JoinState.Failed
+        assertEquals("The files could not be joined.", failed.message)
+        assertNull("a join failure has nothing staged, so it must offer no save", failed.retry)
+        assertNull(failed.pendingSave())
+    }
+
+    // ------------------------------------------------------------------ Harness
+
+    /**
+     * A ViewModel driven to `Converted` and then through a save that threw.
+     *
+     * The WorkManager is installed here rather than in `@Before`, because two cases in this class
+     * need one whose workers fail instead.
+     */
+    private fun failedSaveViewModel(): ConversionViewModel {
+        installTestWorkManager(app, conversionOutput())
+        // Unconfined so reset()'s delete runs inline instead of on a real IO thread.
+        val viewModel = ConversionViewModel(app, Dispatchers.Unconfined)
+        viewModel.onInputPicked(Uri.parse("content://test/holiday.mkv"))
+        awaitState(viewModel.state, "Ready") { it is ConversionState.Ready }
+        viewModel.convert()
+        awaitState(viewModel.state, "Converted") { it is ConversionState.Converted }
+
+        publisher.publishFailure = IllegalStateException("destination volume full")
+        viewModel.save(DESTINATION)
+        awaitState(viewModel.state, "Failed") { it is ConversionState.Failed }
+        return viewModel
+    }
+
+    /** The join tab's equivalent, driven to `Joined` and then through a save that threw. */
+    private fun failedJoinSaveViewModel(): JoinViewModel {
+        installTestWorkManager(app, joinOutput())
+        val viewModel = JoinViewModel(app, Dispatchers.Unconfined)
+        viewModel.onInputsPicked(listOf(Uri.parse("content://test/a.mp4"), Uri.parse("content://test/b.mp4")))
+        awaitState(viewModel.state, "Ready") { it is JoinState.Ready }
+        viewModel.join()
+        awaitState(viewModel.state, "Joined") { it is JoinState.Joined }
+
+        publisher.publishFailure = IllegalStateException("destination volume full")
+        viewModel.save(DESTINATION)
+        awaitState(viewModel.state, "Failed") { it is JoinState.Failed }
+        return viewModel
+    }
+
+    /**
+     * The output `Data` a finished conversion reports.
+     *
+     * The name and type are set rather than left out, so the assertions above are about what the
+     * *job* chose. Both ViewModels fall back to a derivation when they are missing, and a fixture
+     * that omitted them would be asserting the fallback while looking like it asserted the job.
+     *
+     * Spelled out per worker rather than shared with [joinOutput], even though the two constants
+     * hold the same strings today. A test that leaned on that would be asserting a coincidence.
+     */
+    private fun conversionOutput() = workDataOf(
+        ConversionWorker.KEY_OUTPUT_PATH to staged.absolutePath,
+        ConversionWorker.KEY_SUGGESTED_NAME to SUGGESTED_NAME,
+        ConversionWorker.KEY_MIME_TYPE to JOB_MIME_TYPE,
+    )
+
+    /** The output `Data` a finished join reports. See [conversionOutput]. */
+    private fun joinOutput() = workDataOf(
+        ConcatWorker.KEY_OUTPUT_PATH to staged.absolutePath,
+        ConcatWorker.KEY_SUGGESTED_NAME to SUGGESTED_NAME,
+        ConcatWorker.KEY_MIME_TYPE to JOB_MIME_TYPE,
+    )
+
+    private companion object {
+        val DESTINATION: Uri = Uri.parse("content://test/destination.mp4")
+
+        const val SUGGESTED_NAME = "holiday.mp4"
+
+        /** What the job wrote. [OutputFormat.MP3]'s `audio/mpeg` is what the pickers move to. */
+        const val JOB_MIME_TYPE = "video/mp4"
+    }
+}

app/src/test/java/org/libremediaconverter/convert/FileCardTest.kt

@@ -3,13 +3,13 @@ package org.libremediaconverter.convert
 import android.net.Uri
 import androidx.compose.ui.test.assertCountEquals
 import androidx.compose.ui.test.assertTextEquals
+import androidx.compose.ui.test.junit4.v2.createComposeRule
 import androidx.compose.ui.test.onChildren
 import androidx.compose.ui.test.onNodeWithTag
 import androidx.media3.common.util.UnstableApi
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
-import org.libremediaconverter.createDrainedComposeRule
 import org.libremediaconverter.model.AudioCodec
 import org.libremediaconverter.model.Container
 import org.libremediaconverter.model.InputKind
@@ -56,7 +56,7 @@ import org.robolectric.RobolectricTestRunner
 class FileCardTest {
 
     @get:Rule
-    val composeRule = createDrainedComposeRule()
+    val composeRule = createComposeRule()
 
     @Test
     fun `a file no provider could measure says so in words rather than showing a zero`() {

app/src/test/java/org/libremediaconverter/convert/Media3EngineEmptyCompositionTest.kt

@@ -0,0 +1,105 @@
+package org.libremediaconverter.convert
+
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.model.AudioCodec
+import org.libremediaconverter.model.AudioPlan
+import org.libremediaconverter.model.Container
+import org.libremediaconverter.model.ConversionRequest
+import org.libremediaconverter.model.CopyPlanner
+import org.libremediaconverter.model.InputKind
+import org.libremediaconverter.model.InputProbe
+import org.libremediaconverter.model.OutputSpec
+import org.libremediaconverter.model.VideoCodec
+import org.libremediaconverter.model.VideoPlan
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import java.io.File
+import java.util.concurrent.CancellationException
+
+/**
+ * What happens when Media3 refuses the export before it starts.
+ *
+ * `EditedMediaItem.Builder` rejects a composition with both tracks removed —
+ * checkState("Audio and video cannot both be removed") — and [Media3Engine] builds it on its own
+ * HandlerThread. That build used to sit *between* two narrow `runCatching` blocks, one around
+ * `buildTransformer` and one around `start`, so the exception escaped `handler.post`'s body: it
+ * reached the thread's uncaught handler, which on Android takes the process down, and the
+ * continuation was left unresumed either way.
+ *
+ * Robolectric runs the real [android.os.HandlerThread] and the real Media3 builders, so the whole
+ * sequence happens here — the engine really posts, really builds, and really throws. What it cannot
+ * reproduce is the *consequence* of an escaped throw: a JVM background thread dying is not process
+ * death. So the assertion is on the half that is observable everywhere and is the half that
+ * matters to the user — the suspension is resolved, with the reason, rather than left hanging.
+ * `Media3EngineTest.aPlanThatRemovesBothTracksFailsInsteadOfKillingTheProcess` is the same case on
+ * a device.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class Media3EngineEmptyCompositionTest {
+
+    @Test
+    fun `a plan that removes both tracks fails the job instead of escaping the handler thread`() {
+        val context = RuntimeEnvironment.getApplication()
+        val engine = Media3Engine(context)
+        val request = ConversionRequest(
+            spec = OutputSpec(Container.MP4, VideoCodec.H265, AudioCodec.NONE),
+            probe = InputProbe(
+                videoCodec = null,
+                audioCodec = "mp3",
+                hasVideo = false,
+                container = Container.MP3,
+                kind = InputKind.AUDIO_ONLY,
+            ),
+        )
+
+        // Asserted rather than assumed: ConversionRequest's default probe says hasVideo = true, and
+        // with it this same spec plans to (Encode, Drop), nothing throws, and the test would pass
+        // over a code path it never entered.
+        val plan = CopyPlanner.plan(request.spec, request.probe)
+        assertEquals(VideoPlan.Drop, plan.video)
+        assertEquals(AudioPlan.Drop, plan.audio)
+
+        val failure = try {
+            runCatching {
+                runBlocking {
+                    withTimeout(TIMEOUT_MS) {
+                        engine.transcode(Uri.parse("file:///dev/null"), File(context.cacheDir, "empty.mp4"), request) {}
+                    }
+                }
+            }.exceptionOrNull()
+        } finally {
+            engine.close()
+        }
+
+        // Both halves are load-bearing, and the second is not pedantry: withTimeout raises
+        // TimeoutCancellationException, and `java.util.concurrent.CancellationException` *extends*
+        // IllegalStateException — so testing only the first would call an unresumed continuation a
+        // pass. This assertion was written that way, and the mutation is what found it.
+        assertFalse(
+            "the continuation was never resumed — the failure escaped instead of being reported: $failure",
+            failure is CancellationException,
+        )
+        assertTrue(
+            "the builder's refusal must surface as a failed job; got $failure",
+            failure is IllegalStateException,
+        )
+    }
+
+    private companion object {
+        /**
+         * Short on purpose. Nothing is decoded, encoded or muxed on this path — the builder refuses
+         * the input outright — so anything approaching this is a hang, which is the failure mode
+         * this test is looking for.
+         */
+        const val TIMEOUT_MS = 10_000L
+    }
+}

app/src/test/java/org/libremediaconverter/convert/Media3EngineMimeTypesTest.kt

@@ -0,0 +1,287 @@
+package org.libremediaconverter.convert
+
+import androidx.media3.common.MimeTypes
+import androidx.media3.common.util.UnstableApi
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.libremediaconverter.model.AudioCodec
+import org.libremediaconverter.model.AudioPlan
+import org.libremediaconverter.model.Container
+import org.libremediaconverter.model.ConversionPlan
+import org.libremediaconverter.model.ConversionRequest
+import org.libremediaconverter.model.ConversionRouter
+import org.libremediaconverter.model.CopyPlanner
+import org.libremediaconverter.model.DeviceCodecs
+import org.libremediaconverter.model.Engine
+import org.libremediaconverter.model.InputProbe
+import org.libremediaconverter.model.OutputSpec
+import org.libremediaconverter.model.VideoCodec
+import org.libremediaconverter.model.VideoPlan
+
+/**
+ * Guards [Media3Engine]'s two enum-to-MIME tables and the claims written above them.
+ *
+ * The defect: neither table was exercised at all, so nothing stood between a wrong entry and the
+ * user's file. Point `H265` at `VIDEO_H264` and every hardware HEVC export writes H.264 into a
+ * file the user asked to be H.265 — Transformer does exactly as told, the export succeeds, and
+ * the only symptom is a codec nobody chose.
+ *
+ * Worse, one arm carried an assertion instead of a value:
+ *
+ * ```
+ * // Never reached: only an Encode plan consults this, and COPY/NONE are not Encode.
+ * ```
+ *
+ * That is a claim about *callers* parked in a branch of a callee. It happens to be true, and
+ * nothing whatsoever checked it, so it would have gone on reading as true after it stopped being.
+ *
+ * Three kinds of test, because arm-by-arm equality alone would only pin today's answers:
+ *
+ * 1. Every arm of both tables, nulls included.
+ * 2. The "never reached" claim, proved over every plan [CopyPlanner] can produce.
+ * 3. The tables against [ConversionRouter]'s actual decisions rather than against its codec sets —
+ *    the comments claim behaviour ("the router routes them to FFmpeg"), and a set can be right
+ *    while the rule that reads it is wrong.
+ *
+ * A JVM test rather than an instrumented one: both tables take an enum and return a constant.
+ */
+@UnstableApi
+class Media3EngineMimeTypesTest {
+
+    @Test
+    fun `every video codec maps to the MIME type Transformer will be given`() {
+        assertEquals(
+            "EXPECTED_VIDEO_MIME must name every VideoCodec, so a new one cannot arrive untested",
+            VideoCodec.entries.toSet(),
+            EXPECTED_VIDEO_MIME.keys,
+        )
+        VideoCodec.entries.forEach { codec ->
+            assertEquals(
+                "videoMimeTypeFor(${codec.label})",
+                EXPECTED_VIDEO_MIME.getValue(codec),
+                Media3Engine.videoMimeTypeFor(codec),
+            )
+        }
+    }
+
+    @Test
+    fun `every audio codec maps to the MIME type Transformer will be given`() {
+        assertEquals(
+            "EXPECTED_AUDIO_MIME must name every AudioCodec, so a new one cannot arrive untested",
+            AudioCodec.entries.toSet(),
+            EXPECTED_AUDIO_MIME.keys,
+        )
+        AudioCodec.entries.forEach { codec ->
+            assertEquals(
+                "audioMimeTypeFor(${codec.label})",
+                EXPECTED_AUDIO_MIME.getValue(codec),
+                Media3Engine.audioMimeTypeFor(codec),
+            )
+        }
+    }
+
+    /**
+     * The "never reached" claim, proved rather than repeated.
+     *
+     * [Media3Engine] asks these tables only for `plan.video as? VideoPlan.Encode`, and every plan
+     * it sees comes from [CopyPlanner]. So the claim reduces to a property of the planner: over
+     * every spec it can be handed, an `Encode` never carries `COPY` or `NONE`. That holds because
+     * both codecs are answered before the `Encode` branch, and the fallback draws from
+     * `ContainerCapabilities.encodableVideo`, which contains neither — but this asserts it instead
+     * of trusting the reading.
+     *
+     * The counters are not decoration. `(plan.video as? VideoPlan.Encode)?.let { ... }` asserts
+     * nothing at all for a `Drop` or `Copy` plan, so a sweep that stopped producing `Encode` plans
+     * would stay green while checking nothing.
+     */
+    @Test
+    fun `no plan CopyPlanner can produce carries COPY or NONE inside an Encode`() {
+        var videoEncodes = 0
+        var audioEncodes = 0
+        everyPlan().forEach { (spec, probe, plan) ->
+            (plan.video as? VideoPlan.Encode)?.let {
+                videoEncodes++
+                assertTrue(
+                    "CopyPlanner produced VideoPlan.Encode(${it.codec}) for $spec against $probe",
+                    it.codec != VideoCodec.COPY && it.codec != VideoCodec.NONE,
+                )
+            }
+            (plan.audio as? AudioPlan.Encode)?.let {
+                audioEncodes++
+                assertTrue(
+                    "CopyPlanner produced AudioPlan.Encode(${it.codec}) for $spec against $probe",
+                    it.codec != AudioCodec.COPY && it.codec != AudioCodec.NONE,
+                )
+            }
+        }
+        assertTrue("the sweep produced no video Encode plan, so it asserted nothing", videoEncodes > 0)
+        assertTrue("the sweep produced no audio Encode plan, so it asserted nothing", audioEncodes > 0)
+    }
+
+    /**
+     * The video table's other claim: VP8, VP9 and AV1 targets "never reach here".
+     *
+     * Asked of the router rather than of its private codec set, so the rule is what is under test.
+     */
+    @Test
+    fun `the router sends exactly H264 and H265 video encodes to Media3`() {
+        val onMedia3 = REAL_VIDEO_CODECS.filter { engineForVideoEncode(it) == Engine.MEDIA3 }
+        assertEquals(listOf(VideoCodec.H264, VideoCodec.H265), onMedia3)
+    }
+
+    /**
+     * The audio table's sibling claim, and where it turned out to be incomplete.
+     *
+     * The comment named MP3 and FLAC. One rule — `audioEncode !in MEDIA3_AUDIO` — diverts Vorbis
+     * by exactly the same logic, so three of the six encodable codecs never reach the table, not
+     * two. Asserted as the whole set rather than as two memberships, which is what makes the
+     * omission visible.
+     */
+    @Test
+    fun `the router keeps MP3 FLAC and Vorbis audio encodes off Media3`() {
+        val onMedia3 = REAL_AUDIO_CODECS.filter { engineForAudioEncode(it) == Engine.MEDIA3 }
+        assertEquals(listOf(AudioCodec.AAC, AudioCodec.OPUS, AudioCodec.PCM), onMedia3)
+    }
+
+    /**
+     * The binding that makes the two halves above one test rather than two coincidences.
+     *
+     * A codec the router starts sending to Media3 must have a MIME type here, or Transformer is
+     * left to pick its own and the user gets a codec they did not choose.
+     */
+    @Test
+    fun `every codec the router sends to Media3 has a MIME type`() {
+        REAL_VIDEO_CODECS.filter { engineForVideoEncode(it) == Engine.MEDIA3 }.forEach { codec ->
+            assertNotNull(
+                "${codec.label} is routed to Media3 but videoMimeTypeFor returns null",
+                Media3Engine.videoMimeTypeFor(codec),
+            )
+        }
+        REAL_AUDIO_CODECS.filter { engineForAudioEncode(it) == Engine.MEDIA3 }.forEach { codec ->
+            assertNotNull(
+                "${codec.label} is routed to Media3 but audioMimeTypeFor returns null",
+                Media3Engine.audioMimeTypeFor(codec),
+            )
+        }
+    }
+
+    /**
+     * The reverse direction, which holds for video and not for audio.
+     *
+     * Every video codec the router withholds has a null entry, so that table is exactly the set of
+     * codecs Media3 is asked to encode. Audio has one entry more than the router will ever use:
+     * `VORBIS -> AUDIO_VORBIS` is correct and unreachable. Pinned deliberately — if a routing
+     * change makes Vorbis live, this is the test that says the arm above stopped being dead.
+     */
+    @Test
+    fun `Vorbis is the one MIME type the router never asks for`() {
+        REAL_VIDEO_CODECS.filter { engineForVideoEncode(it) == Engine.FFMPEG }.forEach { codec ->
+            assertEquals(
+                "${codec.label} never reaches Media3, so it must not name a MIME type",
+                null,
+                Media3Engine.videoMimeTypeFor(codec),
+            )
+        }
+        val namedButUnrouted = REAL_AUDIO_CODECS
+            .filter { Media3Engine.audioMimeTypeFor(it) != null }
+            .filter { engineForAudioEncode(it) == Engine.FFMPEG }
+        assertEquals(listOf(AudioCodec.VORBIS), namedButUnrouted)
+        assertEquals(MimeTypes.AUDIO_VORBIS, Media3Engine.audioMimeTypeFor(AudioCodec.VORBIS))
+    }
+
+    /**
+     * Routes a video-only re-encode to [codec] and reports the engine chosen.
+     *
+     * `mpeg2video` is the load-bearing detail: [CopyPlanner] upgrades a request to a stream copy
+     * when the source codec matches, and a `Copy` plan would answer a different question. A name
+     * `CodecNames` cannot resolve forces an `Encode` for every codec, which the assertion pins so
+     * that a planner change cannot quietly turn this sweep into a sweep of `Copy` plans.
+     */
+    private fun engineForVideoEncode(codec: VideoCodec): Engine {
+        val request = ConversionRequest(
+            spec = OutputSpec(Container.MP4, codec, AudioCodec.NONE),
+            probe = InputProbe(videoCodec = "mpeg2video", container = Container.MKV),
+        )
+        assertEquals(
+            "this request no longer plans a video Encode, so its engine says nothing about $codec",
+            VideoPlan.Encode(codec),
+            CopyPlanner.plan(request.spec, request.probe).video,
+        )
+        return ConversionRouter.route(request, DeviceCodecs.PERMISSIVE).engine
+    }
+
+    /** The audio counterpart. `ac3` is unresolvable for the same reason `mpeg2video` is. */
+    private fun engineForAudioEncode(codec: AudioCodec): Engine {
+        val request = ConversionRequest(
+            spec = OutputSpec(Container.MP4, VideoCodec.NONE, codec),
+            probe = InputProbe(audioCodec = "ac3", hasVideo = false, container = Container.MKV),
+        )
+        assertEquals(
+            "this request no longer plans an audio Encode, so its engine says nothing about $codec",
+            AudioPlan.Encode(codec),
+            CopyPlanner.plan(request.spec, request.probe).audio,
+        )
+        return ConversionRouter.route(request, DeviceCodecs.PERMISSIVE).engine
+    }
+
+    private fun everyPlan(): List<Triple<OutputSpec, InputProbe, ConversionPlan>> =
+        ALL_SPECS.flatMap { spec -> PROBES.map { Triple(spec, it, CopyPlanner.plan(spec, it)) } }
+
+    private companion object {
+
+        /** Every arm of `videoMimeTypeFor`, including the ones the tests above prove unreachable. */
+        val EXPECTED_VIDEO_MIME: Map<VideoCodec, String?> = mapOf(
+            VideoCodec.H264 to MimeTypes.VIDEO_H264,
+            VideoCodec.H265 to MimeTypes.VIDEO_H265,
+            VideoCodec.VP8 to null,
+            VideoCodec.VP9 to null,
+            VideoCodec.AV1 to null,
+            // Unreachable, and asserted anyway: the proof lives in another test, and a reader
+            // deleting these would leave the arms themselves unexercised.
+            VideoCodec.COPY to null,
+            VideoCodec.NONE to null,
+        )
+
+        val EXPECTED_AUDIO_MIME: Map<AudioCodec, String?> = mapOf(
+            AudioCodec.AAC to MimeTypes.AUDIO_AAC,
+            AudioCodec.OPUS to MimeTypes.AUDIO_OPUS,
+            AudioCodec.VORBIS to MimeTypes.AUDIO_VORBIS,
+            AudioCodec.PCM to MimeTypes.AUDIO_RAW,
+            AudioCodec.MP3 to null,
+            AudioCodec.FLAC to null,
+            AudioCodec.COPY to null,
+            AudioCodec.NONE to null,
+        )
+
+        /** Codecs a user can actually ask to be produced: `COPY` and `NONE` are instructions. */
+        val REAL_VIDEO_CODECS = VideoCodec.entries - VideoCodec.COPY - VideoCodec.NONE
+        val REAL_AUDIO_CODECS = AudioCodec.entries - AudioCodec.COPY - AudioCodec.NONE
+
+        /** Every output a spec can name — 15 containers by 7 video codecs by 8 audio codecs. */
+        val ALL_SPECS: List<OutputSpec> = Container.entries.flatMap { container ->
+            VideoCodec.entries.flatMap { video ->
+                AudioCodec.entries.map { audio -> OutputSpec(container, video, audio) }
+            }
+        }
+
+        /** Inputs chosen to reach each of [CopyPlanner]'s branches. */
+        val PROBES = listOf(
+            // Nothing known about the source at all.
+            InputProbe(),
+            // Identified, and the container changes: the copy upgrade applies.
+            InputProbe(videoCodec = "h264", audioCodec = "aac", container = Container.MKV),
+            // Identified, container unchanged: the copy upgrade deliberately does not apply.
+            InputProbe(videoCodec = "h264", audioCodec = "aac", container = Container.MP4),
+            // Copyable but not encodable by either engine — the fallback's reason for existing.
+            InputProbe(videoCodec = "av1", audioCodec = "flac", container = Container.MKV),
+            // Real codecs this app cannot name, so a copy is never proven safe.
+            InputProbe(videoCodec = "mpeg2video", audioCodec = "ac3", container = Container.AVI),
+            // The platform extractor could not open it.
+            InputProbe(videoCodec = InputProbe.UNPARSEABLE),
+            // Audio only.
+            InputProbe(videoCodec = null, audioCodec = "opus", hasVideo = false, container = Container.OGG),
+        )
+    }
+}

app/src/test/java/org/libremediaconverter/convert/MediaProbeImageFormatTest.kt

@@ -0,0 +1,91 @@
+package org.libremediaconverter.convert
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The image-demuxer rule, which looks arbitrary until it is read as a suffix.
+ *
+ * `MediaProbe.classify` asks [MediaProbe.isImageFormat] before anything else, so this one boolean
+ * overrides everything both probes found: true and the source-info card says "Image" and a size,
+ * false and it says container, codec and length. Neither mistake fails loudly.
+ *
+ * The rule has two halves and they are not the same shape. `image2` is a whole format name —
+ * FFprobe reports it for a numbered image sequence — while the piped demuxers are named one per
+ * image codec, so `_pipe` has to be matched as a *suffix*: `png_pipe`, `jpeg_pipe`, `webp_pipe`
+ * and some thirty more. Widening that suffix to a substring is the tempting simplification and it
+ * is wrong, because `yuv4mpegpipe` is raw video.
+ *
+ * The image names were measured rather than recalled. `ffprobe -show_entries format=format_name`
+ * reports `png_pipe` for a `.png`, `jpeg_pipe` for a `.jpg`, `yuv4mpegpipe` for a `.y4m`, and
+ * `image2` only when that demuxer is named explicitly. The container names come from
+ * [MediaProbeFormatTest], and the case and spacing variants are synthetic — those exercise the
+ * normalisation rather than anything FFprobe emits.
+ *
+ * One real format name is deliberately not asserted either way. `image2pipe` gets a false answer
+ * here, being neither `image2` nor a `_pipe` suffix, and that is inert rather than a latent bug:
+ * FFprobe only selects it when the demuxer is named with `-f image2pipe`, while `probeWithFFprobe`
+ * forces no format at all, so a picked image arrives as `png_pipe` or its own codec's equivalent.
+ * Pinning today's answer for a name this app cannot receive would be a test about FFmpeg's command
+ * line rather than about this rule.
+ */
+class MediaProbeImageFormatTest {
+
+    @Test
+    fun `a numbered image sequence is an image`() {
+        assertIsImage("image2")
+    }
+
+    /** What a picked PNG or JPEG actually reports, and the reason the suffix rule exists. */
+    @Test
+    fun `the per-codec piped demuxers are images`() {
+        assertIsImage("png_pipe")
+        assertIsImage("jpeg_pipe")
+        assertIsImage("webp_pipe")
+    }
+
+    /**
+     * The half that a substring match would break.
+     *
+     * `yuv4mpegpipe` contains `pipe` and is not an image: it is raw uncompressed video, and
+     * describing it as an image would hide its codec, its size and its length from the card while
+     * leaving the file perfectly convertible.
+     */
+    @Test
+    fun `a format that merely contains pipe is not an image`() {
+        assertNotImage("yuv4mpegpipe")
+    }
+
+    /** The ordinary media containers, which is what the false answer is mostly for. */
+    @Test
+    fun `a real container is not an image`() {
+        assertNotImage("mov,mp4,m4a,3gp,3g2,mj2")
+        assertNotImage("matroska,webm")
+        assertNotImage("mp3")
+    }
+
+    /**
+     * FFprobe names every format sharing the demuxer, so the entry that matters can be anywhere in
+     * the list — and the padding and case are normalised the same way [MediaProbe.containerFrom]
+     * normalises them.
+     */
+    @Test
+    fun `an image entry is found anywhere in the list, whatever its spacing or case`() {
+        assertIsImage("PNG_PIPE")
+        assertIsImage(" image2 ")
+        assertIsImage("something_else, tiff_pipe")
+    }
+
+    /** Nothing to go on is not an image; the card falls back to describing an unknown container. */
+    @Test
+    fun `an empty format name is not an image`() {
+        assertNotImage("")
+    }
+
+    private fun assertIsImage(formatName: String) =
+        assertTrue("isImageFormat(\"$formatName\")", MediaProbe.isImageFormat(formatName))
+
+    private fun assertNotImage(formatName: String) =
+        assertFalse("isImageFormat(\"$formatName\")", MediaProbe.isImageFormat(formatName))
+}

app/src/test/java/org/libremediaconverter/convert/MediaProbeMimeNamesTest.kt

@@ -0,0 +1,108 @@
+package org.libremediaconverter.convert
+
+import android.media.MediaFormat
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+/**
+ * The MIME -> short codec name table, which nothing downstream would notice going wrong.
+ *
+ * `MediaExtractor` answers in platform MIME spellings; the router, the copy planner and the
+ * source-info card all speak FFmpeg's short names. [MediaProbe.shortName] is the one place those
+ * two vocabularies meet, and most of its arms are translations rather than trimming — `video/avc`
+ * is `h264`, `audio/mp4a-latm` is `aac`, `video/x-vnd.on2.vp9` is `vp9`.
+ *
+ * So a dropped or mistyped arm does not throw. It falls through to `substringAfter('/')` and
+ * reports a different, entirely plausible-looking string. `CodecNames` carries alias lists that
+ * happen to rescue some of those (`avc`, `av01`, `raw`) and not others (`mp4a-latm`,
+ * `x-vnd.on2.vp9`), which is exactly why leaning on the rescue is not a plan: an unrecognised
+ * codec is how a stream-copyable file quietly becomes a re-encode, and how the card ends up naming
+ * a codec no user has heard of. This table is the only place those arms are pinned.
+ *
+ * A plain JVM test rather than Robolectric: `MediaFormat.MIMETYPE_*` are Java compile-time String
+ * constants, so this test and `MediaProbe` alike carry the literals in their own bytecode and the
+ * framework class is never loaded.
+ *
+ * Every case names its MIME in the failure message, because the MIME is the thing that has to be
+ * looked up when one of these goes red.
+ */
+class MediaProbeMimeNamesTest {
+
+    @Test
+    fun `an AVC track is reported as h264, which is what everything downstream calls it`() {
+        assertShortName("h264", MediaFormat.MIMETYPE_VIDEO_AVC)
+    }
+
+    /** On2's vendor MIME looks nothing like the codec name FFmpeg and the router use. */
+    @Test
+    fun `the VP8 and VP9 vendor MIMEs are reported without their vendor prefix`() {
+        assertShortName("vp8", MediaFormat.MIMETYPE_VIDEO_VP8)
+        assertShortName("vp9", MediaFormat.MIMETYPE_VIDEO_VP9)
+    }
+
+    @Test
+    fun `AV1 and MPEG-4 are reported by codec name rather than by MIME spelling`() {
+        assertShortName("av1", MediaFormat.MIMETYPE_VIDEO_AV1)
+        assertShortName("mpeg4", MediaFormat.MIMETYPE_VIDEO_MPEG4)
+    }
+
+    @Test
+    fun `an AAC track is reported as aac, not as the mp4a-latm its MIME says`() {
+        assertShortName("aac", MediaFormat.MIMETYPE_AUDIO_AAC)
+    }
+
+    @Test
+    fun `uncompressed audio is reported as pcm, which is not what its MIME says either`() {
+        assertShortName("pcm", MediaFormat.MIMETYPE_AUDIO_RAW)
+    }
+
+    /**
+     * Four arms produce exactly what the fallback would produce anyway.
+     *
+     * `video/hevc` -> `hevc`, `audio/opus` -> `opus`, `audio/flac` -> `flac`,
+     * `audio/vorbis` -> `vorbis`: for these the `when` arm and `substringAfter('/')` agree, so
+     * deleting the arm changes no observable behaviour and no test can catch it. That is a
+     * property of the code rather than a gap here, and it is reported as such rather than dressed
+     * up as coverage. The assertions still earn their place — they pin the promise the router is
+     * given (`hevc`, whatever the MIME happens to spell) against a later edit that changes the
+     * mapping rather than deleting it.
+     */
+    @Test
+    fun `the arms whose MIME subtype already is the short name still map to it`() {
+        assertShortName("hevc", MediaFormat.MIMETYPE_VIDEO_HEVC)
+        assertShortName("opus", MediaFormat.MIMETYPE_AUDIO_OPUS)
+        assertShortName("flac", MediaFormat.MIMETYPE_AUDIO_FLAC)
+        assertShortName("vorbis", MediaFormat.MIMETYPE_AUDIO_VORBIS)
+    }
+
+    /**
+     * The fallback, which is what makes an unlisted codec describable at all.
+     *
+     * These are real `MediaFormat` MIMEs with no arm of their own. Dropping the subtype is the
+     * right guess far more often than reporting the whole MIME would be — FFprobe calls the first
+     * of these `ac3` too.
+     */
+    @Test
+    fun `a MIME with no arm of its own falls back to its subtype`() {
+        assertShortName("ac3", MediaFormat.MIMETYPE_AUDIO_AC3)
+        assertShortName("mpeg2", MediaFormat.MIMETYPE_VIDEO_MPEG2)
+        assertShortName("dolby-vision", MediaFormat.MIMETYPE_VIDEO_DOLBY_VISION)
+    }
+
+    /**
+     * The surprising half of `substringAfter`'s contract, pinned deliberately.
+     *
+     * With no `/` in the string it returns the whole input rather than the empty string. Today's
+     * callers gate on a `video/` or `audio/` prefix so they cannot reach this, but "report what
+     * you were given" rather than "report nothing" is what would keep a malformed MIME visible on
+     * the card instead of blank.
+     */
+    @Test
+    fun `a MIME with no subtype separator is reported unchanged`() {
+        assertShortName("weird", "weird")
+        assertShortName("", "")
+    }
+
+    private fun assertShortName(expected: String, mime: String) =
+        assertEquals("shortName(\"$mime\")", expected, MediaProbe.shortName(mime))
+}

app/src/test/java/org/libremediaconverter/convert/MediaProbeTrackFieldsTest.kt

@@ -0,0 +1,79 @@
+package org.libremediaconverter.convert
+
+import android.media.MediaFormat
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+
+/**
+ * Reading Int track properties out of a `MediaFormat`, which is a heterogeneous map.
+ *
+ * [MediaProbe.intOr] guards two different failures with one expression, and only one of them is
+ * obvious. A key the format does not carry is the easy half. The other is a key it *does* carry
+ * with a value of another type: `getInteger` casts rather than coerces, so a frame rate stored as
+ * a Float answers with a `ClassCastException`. `probeForConcat` reads `KEY_FRAME_RATE`, which the
+ * platform accepts either way, and its `catch` sits outside the track loop — so without the
+ * `runCatching` one oddly-typed field would discard the codec and dimensions already read from
+ * that file and the join would re-encode for no reason.
+ *
+ * Robolectric rather than a plain JVM test, unlike the two sibling `MediaProbe` helper tests: this
+ * one needs a real `MediaFormat` instance, not just its compile-time String constants.
+ */
+@RunWith(RobolectricTestRunner::class)
+class MediaProbeTrackFieldsTest {
+
+    @Test
+    fun `a property the format carries as an Int is read`() {
+        val format = videoFormat()
+
+        assertEquals(1920, with(MediaProbe) { format.intOr(MediaFormat.KEY_WIDTH) })
+        assertEquals(1080, with(MediaProbe) { format.intOr(MediaFormat.KEY_HEIGHT) })
+    }
+
+    /**
+     * A track that simply does not say. `MediaExtractor` omits `KEY_FRAME_RATE` for plenty of real
+     * files, and 0 is what `ConcatPlanner` reads as "cannot prove a match".
+     */
+    @Test
+    fun `a key the format does not carry gives the fallback`() {
+        val format = videoFormat()
+
+        assertEquals(0, with(MediaProbe) { format.intOr(MediaFormat.KEY_FRAME_RATE) })
+        assertEquals(-1, with(MediaProbe) { format.intOr(MediaFormat.KEY_FRAME_RATE, -1) })
+    }
+
+    /**
+     * The premise of the `runCatching`, pinned against the platform rather than assumed.
+     *
+     * If `getInteger` coerced a Float instead of throwing, the guard below would be testing
+     * nothing at all — so the throw is asserted directly first.
+     */
+    @Test
+    fun `getInteger refuses a Float rather than coercing it`() {
+        val format = videoFormat()
+        format.setFloat(MediaFormat.KEY_FRAME_RATE, NON_INTEGRAL_FRAME_RATE)
+
+        val thrown = runCatching { format.getInteger(MediaFormat.KEY_FRAME_RATE) }.exceptionOrNull()
+
+        assertTrue("expected getInteger to refuse a Float, got $thrown", thrown is ClassCastException)
+    }
+
+    /** And that refusal is answered with the fallback, not passed on to the caller. */
+    @Test
+    fun `a frame rate the format carries as a Float gives the fallback rather than throwing`() {
+        val format = videoFormat()
+        format.setFloat(MediaFormat.KEY_FRAME_RATE, NON_INTEGRAL_FRAME_RATE)
+
+        assertEquals(0, with(MediaProbe) { format.intOr(MediaFormat.KEY_FRAME_RATE) })
+        assertEquals(-1, with(MediaProbe) { format.intOr(MediaFormat.KEY_FRAME_RATE, -1) })
+    }
+
+    private fun videoFormat(): MediaFormat = MediaFormat.createVideoFormat(MediaFormat.MIMETYPE_VIDEO_AVC, 1920, 1080)
+
+    private companion object {
+        /** NTSC's 30000/1001, the frame rate that cannot be stored as an Int in the first place. */
+        const val NON_INTEGRAL_FRAME_RATE = 29.97f
+    }
+}

app/src/test/java/org/libremediaconverter/convert/OutputPublisherStagingTest.kt

@@ -18,8 +18,10 @@ import java.util.UUID
  * the actual filesystem — the same calls `reset()` makes, without needing a ViewModel (both
  * of those construct a `WorkManager`, which is not initialised on the JVM classpath).
  *
- * The instrumented suite cannot run on the development host, so this is the only place the
- * "Start over leaks a full-size copy" defect can be caught before CI.
+ * The instrumented suite could also catch the "Start over leaks a full-size copy" defect --
+ * it runs on this host for API 33-36 (`tools/local-emulator/run-e2e.sh`) and on CI for
+ * 33-37. Here rather than there because a real `cacheDir` is all the defect needs, and
+ * finding it costs an emulator boot there and a few seconds here.
  */
 @RunWith(RobolectricTestRunner::class)
 class OutputPublisherStagingTest {

app/src/test/java/org/libremediaconverter/convert/ParkedPickDispatcher.kt

@@ -0,0 +1,63 @@
+package org.libremediaconverter.convert
+
+import kotlinx.coroutines.CoroutineDispatcher
+import java.util.concurrent.ConcurrentLinkedQueue
+import kotlin.coroutines.CoroutineContext
+
+/**
+ * A dispatcher that holds a pick in flight until the test lets it finish.
+ *
+ * Issue #49 is about what a ViewModel does *while* a pick is between the tap and the write it
+ * eventually makes. Both ViewModels put a blocking hop there — the metadata query, and on the
+ * convert side the probe as well — and both hops go through an injectable dispatcher. Handing
+ * them this one turns "the pick has been made but has not landed yet" from a window a test has
+ * to race into a state it can simply sit in.
+ *
+ * Nothing here is a fake pick. The real `InputQuery.describe` still runs, on this thread,
+ * whenever [runAll] is called; the only thing under the test's control is *when*.
+ *
+ * Confined to the thread that drives the test. Both ViewModels reach `withContext(pickDispatcher)`
+ * from a coroutine on the main dispatcher, so [dispatch] is only ever called from there — the
+ * queue is concurrent anyway, because a dispatcher that quietly dropped a block from another
+ * thread would fail as a hang rather than as an assertion.
+ */
+class ParkedPickDispatcher : CoroutineDispatcher() {
+
+    private val parked = ConcurrentLinkedQueue<Runnable>()
+
+    /**
+     * How many blocks are waiting.
+     *
+     * Asserted on before the interesting part of a test, because "the pick was in flight" is a
+     * premise rather than a detail: a zero here means the pick had already landed and whatever
+     * the test went on to prove was proved about a different situation.
+     */
+    val parkedCount: Int get() = parked.size
+
+    override fun dispatch(context: CoroutineContext, block: Runnable) {
+        parked += block
+    }
+
+    /**
+     * Removes everything parked, oldest first, and hands it to the caller to run.
+     *
+     * What [runAll] cannot express: two picks are two hops through this dispatcher, and the defect
+     * they can produce is the *first* one finishing last. Running them in the order they arrived
+     * is the one order in which nothing goes wrong, so a test has to be able to choose.
+     */
+    fun takeParked(): List<Runnable> = generateSequence { parked.poll() }.toList()
+
+    /**
+     * Runs everything parked, and everything that parks as a result.
+     *
+     * The loop is not defensive: `ConversionViewModel.onInputPicked` makes two hops through this
+     * dispatcher — the metadata query, then the probe — and the second is only enqueued once the
+     * first has run. Draining once would leave the probe parked for the rest of the process.
+     */
+    fun runAll() {
+        while (true) {
+            val next = parked.poll() ?: return
+            next.run()
+        }
+    }
+}

app/src/test/java/org/libremediaconverter/convert/PickOwnershipTest.kt

@@ -0,0 +1,125 @@
+package org.libremediaconverter.convert
+
+import android.app.Application
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.work.workDataOf
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.model.InputProbe
+import org.libremediaconverter.work.ConversionWorker
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import java.io.File
+
+/**
+ * The half of issue #49 that is not about reattachment at all.
+ *
+ * `onInputPicked` makes two writes and both of them land after a hop off the main thread, so both
+ * belong to whichever pick was in flight rather than to whichever pick the user last made. Nothing
+ * was enforcing that. Two taps in quick succession — an easy thing to do while a `content://`
+ * metadata query is slow — put the loser's file on screen if its query happened to come back
+ * second, which is the same defect the ticket reported against reattachment with a different
+ * coroutine on the losing side.
+ *
+ * Both cases below were measured rather than assumed: deleting either guard turns the matching
+ * test red, and deleting the probe one turns nine other tests red with it. Neither was ever
+ * reported, because a pick that loses to another pick still shows *a* file the user chose -- which
+ * is what made it worth closing alongside #49 rather than leaving as a second thing to find.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class PickOwnershipTest {
+
+    private lateinit var app: Application
+    private lateinit var parkedPick: ParkedPickDispatcher
+    private lateinit var viewModel: ConversionViewModel
+
+    @Before
+    fun setUp() {
+        app = RuntimeEnvironment.getApplication()
+        ConversionDependencies.publisher = { RecordingPublisher(app) }
+        ConversionDependencies.probe = { _, _ -> PROBE }
+        installTestWorkManager(app, workDataOf(ConversionWorker.KEY_OUTPUT_PATH to "/dev/null"))
+
+        parkedPick = ParkedPickDispatcher()
+        viewModel = ConversionViewModel(app, pickDispatcher = parkedPick)
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    /**
+     * Two taps, and the first one's metadata query is the slow one.
+     *
+     * The order is chosen rather than raced: both queries are parked, and this runs the second
+     * before the first. Without an ownership check the straggler writes last and the screen ends
+     * up showing a file the user moved off two taps ago.
+     */
+    @Test
+    fun `the slower of two picks does not land on top of the faster one`() {
+        viewModel.onInputPicked(FIRST)
+        viewModel.onInputPicked(SECOND)
+
+        val queries = parkedPick.takeParked()
+        assertEquals("both picks should be in flight", 2, queries.size)
+        // The second pick's query comes back first; the first pick's is the straggler.
+        queries[1].run()
+        queries[0].run()
+
+        val current = viewModel.state.value
+        assertEquals(
+            "a pick the user has already replaced took the screen: $current",
+            SECOND,
+            (current as ConversionState.Ready).input.uri,
+        )
+    }
+
+    /**
+     * The second of `onInputPicked`'s two writes, which lands a whole probe later.
+     *
+     * The probe hop is a native process spawn, so it is the longest gap in a pick and the easiest
+     * one to pick again during. This used to be guarded by comparing URIs against the state, which
+     * answers a narrower question than the one that matters — it cannot tell a second pick of the
+     * same file from the first, and it reads a state that a later claim may not have written yet,
+     * which is exactly this case: the newer pick has claimed the screen but its own query has not
+     * come back, so the state still names the older file and the comparison waves it through.
+     */
+    @Test
+    fun `a probe from a pick the user has moved off does not fill the card in`() {
+        viewModel.onInputPicked(FIRST)
+        parkedPick.takeParked().single().run()
+        assertEquals(FIRST, (viewModel.state.value as ConversionState.Ready).input.uri)
+
+        // The user picks again while the first pick is still probing.
+        viewModel.onInputPicked(SECOND)
+        val pending = parkedPick.takeParked()
+        assertEquals("the first probe and the second query should both be waiting", 2, pending.size)
+        pending[0].run()
+
+        assertNull(
+            "a probe belonging to a pick the user replaced must not reach the card",
+            (viewModel.state.value as ConversionState.Ready).input.probe,
+        )
+
+        // And the pick that did win still fills its own card in, probe included.
+        pending[1].run()
+        parkedPick.runAll()
+        val settled = viewModel.state.value as ConversionState.Ready
+        assertEquals(SECOND, settled.input.uri)
+        assertNotNull("the winning pick's own probe still has to land", settled.input.probe)
+    }
+
+    private companion object {
+        val FIRST: Uri = Uri.fromFile(File("/tmp/first.mp4"))
+        val SECOND: Uri = Uri.fromFile(File("/tmp/second.mp4"))
+        val PROBE = InputProbe(videoCodec = "h264")
+    }
+}

app/src/test/java/org/libremediaconverter/convert/ReattachmentOwnershipTest.kt

@@ -0,0 +1,156 @@
+package org.libremediaconverter.convert
+
+import android.app.Application
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.work.WorkManager
+import androidx.work.workDataOf
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.model.InputProbe
+import org.libremediaconverter.work.ConversionWorker
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import java.io.File
+
+/**
+ * Issue #49, on the JVM and without the race.
+ *
+ * `ReattachOnLaunchTest.doesNotOverwriteAPickTheUserHasAlreadyMade` has been catching this on
+ * devices since 2026-08-24 — four occurrences, spread across API 33, 35 and 36, which is what
+ * ruled out an emulator-image quirk. Every one was on attempt 1 and every one passed on re-run,
+ * which is why it was read as flaky infrastructure for two days. It is not. The assertion it fails
+ * on is `expected null, but was:<Converted>`: a finished job from an earlier session taking a
+ * screen the user had already picked a file on.
+ *
+ * The defect is a check-then-act whose act is deferred into another coroutine. `reattach()` reads
+ * `_state.value` and then calls `observe()`, which *launches* a collector that has to suspend on
+ * `getWorkInfoByIdFlow(...).collect` before it can write anything. So the check happens at one
+ * moment and the write lands at another:
+ *
+ * 1. `init` starts the tag query and suspends in it.
+ * 2. The user picks a file; `onInputPicked` suspends in its metadata query.
+ * 3. The query comes back. `_state.value` is still `Idle` — step 2 has not written yet — so the
+ *    guard passes and an observation of the old job is launched.
+ * 4. The pick lands. `Ready(picked)`. The user owns the screen.
+ * 5. The observation's first `WorkInfo` arrives and writes `Converted(yesterday)` over it.
+ *
+ * The comment above that guard claimed "no suspension point between this check and the assignment
+ * below, so nothing can interleave". There is no assignment below, and the check and the write
+ * are in different coroutines.
+ *
+ * [ReattachGuardsTest] covers the case where the pick has already *landed*, which the plain guard
+ * does catch. This covers the one where it is still in flight, which it does not.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class ReattachmentOwnershipTest {
+
+    private lateinit var app: Application
+    private lateinit var publisher: RecordingPublisher
+    private lateinit var workManager: WorkManager
+    private lateinit var staged: File
+
+    @Before
+    fun setUp() {
+        app = RuntimeEnvironment.getApplication()
+        publisher = RecordingPublisher(app)
+        ConversionDependencies.publisher = { publisher }
+        ConversionDependencies.probe = { _, _ -> InputProbe() }
+
+        staged = publisher.createStagingFile("holiday_converted.mp4").apply { writeBytes(ByteArray(4096)) }
+        installTestWorkManager(app, workDataOf(ConversionWorker.KEY_OUTPUT_PATH to staged.absolutePath))
+        workManager = WorkManager.getInstance(app)
+        // The situation reattachment exists for: a conversion that finished in a process that is
+        // gone, with its output still in the cache and nothing in the UI holding its id.
+        workManager.enqueue(
+            ConversionWorker.request(
+                inputUri = Uri.parse("content://test/holiday.mp4"),
+                displayName = "holiday.mp4",
+                sizeBytes = 4_096L,
+            ),
+        ).result.get()
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    /**
+     * The race, made into a state the test can sit in rather than one it has to catch.
+     *
+     * The pick is parked on a dispatcher this test owns, so it stays in flight — issued, not yet
+     * written — for as long as the assertions need it to be. Everything else is production: a
+     * real `WorkManager` holding a real finished job, the real `reattach`, the real `observe`.
+     *
+     * Determinism comes from where Robolectric leaves the main looper. `reattach`'s tag query hops
+     * to a real [kotlinx.coroutines.Dispatchers.IO] thread, so its continuation can only come back
+     * as a message posted to the main looper — and that looper is paused, so it cannot run until
+     * something pumps it. `onInputPicked` is an ordinary synchronous call from this thread. The
+     * pick is therefore *always* issued before the guard runs; none of it is left to timing, which
+     * is the whole point of writing it here rather than relying on the rare device sighting.
+     */
+    @Test
+    fun `a conversion found while the user was picking never reaches the screen`() {
+        val picked = Uri.fromFile(File(app.cacheDir, "beach.mp4").apply { writeBytes(ByteArray(2048)) })
+        val parkedPick = ParkedPickDispatcher()
+        val viewModel = ConversionViewModel(app, pickDispatcher = parkedPick)
+        viewModel.onInputPicked(picked)
+
+        assertEquals(
+            "the pick must still be in flight, or this proves something about a different situation",
+            1,
+            parkedPick.parkedCount,
+        )
+
+        // The control, and the reason this test does not rest on a settle window being long
+        // enough. A second ViewModel with nothing to supersede it reattaches to the same job
+        // through the same code; when it has arrived, the whole query-guard-observe-write path has
+        // demonstrably run to completion. `viewModel` started its own reattachment first, so it
+        // has had at least as long. Waiting on this rather than on a sleep is what makes the
+        // assertion below "it did not happen" rather than "it had not happened yet".
+        reattachmentHasRunToCompletion()
+
+        val current = viewModel.state.value
+        assertTrue("reattachment took the screen from the user: $current", current is ConversionState.Idle)
+
+        // And the pick, when it lands, is what stays there.
+        parkedPick.runAll()
+        val ready = awaitState(viewModel.state, "Ready") { it is ConversionState.Ready }
+        assertEquals(picked, (ready as ConversionState.Ready).input.uri)
+        reattachmentHasRunToCompletion()
+        assertEquals("the user's pick must survive a late reattachment", ready, viewModel.state.value)
+    }
+
+    /**
+     * The other half of the contract: a reattachment nobody has superseded still takes the screen.
+     *
+     * Without this, dropping every reattachment on the floor would pass the test above. Same job,
+     * same WorkManager, same production path — only the pick is missing.
+     */
+    @Test
+    fun `a conversion nobody has superseded still reaches the screen`() {
+        val converted = awaitState(ConversionViewModel(app).state, "Converted") {
+            it is ConversionState.Converted
+        }
+
+        assertEquals(staged.absolutePath, (converted as ConversionState.Converted).staged.absolutePath)
+        assertEquals("holiday.mp4", converted.input.displayName)
+    }
+
+    /**
+     * Drives a throwaway ViewModel through a whole reattachment, and returns once it has landed.
+     *
+     * [awaitState] pumps the main looper, which is what runs every reattachment continuation
+     * waiting on it — this one's, and the one belonging to the ViewModel under test, which was
+     * posted earlier and therefore runs first.
+     */
+    private fun reattachmentHasRunToCompletion() {
+        awaitState(ConversionViewModel(app).state, "Converted") { it is ConversionState.Converted }
+    }
+}

app/src/test/java/org/libremediaconverter/convert/StagingCleanupSupport.kt

@@ -82,6 +82,28 @@ class SucceedingWorkerFactory(private val outputData: Data) : WorkerFactory() {
     }
 }
 
+/**
+ * Stands in for a worker that died, reporting [outputData] on the way out.
+ *
+ * The counterpart to [SucceedingWorkerFactory], and needed for the same reason: the real workers
+ * cannot run on the JVM, so the only way to ask what a ViewModel does with a `FAILED` `WorkInfo` is
+ * to produce one. A `Result.failure` carrying `KEY_ERROR` is exactly what both real workers report
+ * when their engine gives up, and it is the one path where nothing has ever been staged.
+ *
+ * `runAttemptCount` is irrelevant here: `Result.failure` is terminal, so WorkManager does not retry
+ * it and the state goes straight to `Failed` rather than through `Waiting`.
+ */
+class FailingWorkerFactory(private val outputData: Data) : WorkerFactory() {
+
+    override fun createWorker(
+        appContext: Context,
+        workerClassName: String,
+        workerParameters: WorkerParameters,
+    ): ListenableWorker = object : Worker(appContext, workerParameters) {
+        override fun doWork(): Result = Result.failure(outputData)
+    }
+}
+
 /**
  * Installs a synchronous test WorkManager whose workers succeed with [outputData].
  *
@@ -89,6 +111,16 @@ class SucceedingWorkerFactory(private val outputData: Data) : WorkerFactory() {
  */
 fun installTestWorkManager(context: Context, outputData: Data): SucceedingWorkerFactory {
     val factory = SucceedingWorkerFactory(outputData)
+    installWorkManager(context, factory)
+    return factory
+}
+
+/** Installs a synchronous test WorkManager whose workers fail, reporting [outputData]. */
+fun installFailingTestWorkManager(context: Context, outputData: Data) {
+    installWorkManager(context, FailingWorkerFactory(outputData))
+}
+
+private fun installWorkManager(context: Context, factory: WorkerFactory) {
     WorkManagerTestInitHelper.initializeTestWorkManager(
         context,
         Configuration.Builder()
@@ -98,7 +130,6 @@ fun installTestWorkManager(context: Context, outputData: Data): SucceedingWorker
             .setWorkerFactory(factory)
             .build(),
     )
-    return factory
 }
 
 /**

app/src/test/java/org/libremediaconverter/join/JoinLeafTagsTest.kt

@@ -2,13 +2,13 @@ package org.libremediaconverter.join
 
 import android.net.Uri
 import androidx.compose.ui.test.assertCountEquals
+import androidx.compose.ui.test.junit4.v2.createComposeRule
 import androidx.compose.ui.test.onAllNodesWithTag
 import androidx.media3.common.util.UnstableApi
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.libremediaconverter.convert.InputFile
-import org.libremediaconverter.createDrainedComposeRule
 import org.libremediaconverter.ui.TestTags
 import org.robolectric.RobolectricTestRunner
 
@@ -32,7 +32,7 @@ import org.robolectric.RobolectricTestRunner
 class JoinLeafTagsTest {
 
     @get:Rule
-    val composeRule = createDrainedComposeRule()
+    val composeRule = createComposeRule()
 
     private fun input(displayName: String) = InputFile(
         uri = Uri.parse("content://test/$displayName"),

app/src/test/java/org/libremediaconverter/join/JoinPickOwnershipTest.kt

@@ -0,0 +1,87 @@
+package org.libremediaconverter.join
+
+import android.app.Application
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.work.workDataOf
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.convert.ConversionDependencies
+import org.libremediaconverter.convert.ParkedPickDispatcher
+import org.libremediaconverter.convert.RecordingPublisher
+import org.libremediaconverter.convert.installTestWorkManager
+import org.libremediaconverter.work.ConcatWorker
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+
+/**
+ * `PickOwnershipTest`'s case on the join side.
+ *
+ * `onInputsPicked` makes one write and it lands after a hop off the main thread, so it belongs to
+ * whichever pick was in flight rather than to whichever set of files the user last chose. Two
+ * selections in quick succession — likelier here than on the convert side, since a join picks
+ * several files at a time and the metadata query is per file — put the loser's files on screen if
+ * its query came back second.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class JoinPickOwnershipTest {
+
+    private lateinit var app: Application
+    private lateinit var parkedPick: ParkedPickDispatcher
+    private lateinit var viewModel: JoinViewModel
+
+    @Before
+    fun setUp() {
+        app = RuntimeEnvironment.getApplication()
+        ConversionDependencies.publisher = { RecordingPublisher(app) }
+        installTestWorkManager(app, workDataOf(ConcatWorker.KEY_OUTPUT_PATH to "/dev/null"))
+
+        parkedPick = ParkedPickDispatcher()
+        viewModel = JoinViewModel(app, pickDispatcher = parkedPick)
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    /**
+     * Two selections, with the first one's metadata query the slow one.
+     *
+     * The order is chosen rather than raced: both queries are parked, and this runs the second
+     * before the first.
+     */
+    @Test
+    fun `the slower of two selections does not land on top of the faster one`() {
+        viewModel.onInputsPicked(FIRST)
+        viewModel.onInputsPicked(SECOND)
+
+        val queries = parkedPick.takeParked()
+        assertEquals("both selections should be in flight", 2, queries.size)
+        // The second selection's query comes back first; the first one's is the straggler.
+        queries[1].run()
+        queries[0].run()
+
+        val current = viewModel.state.value
+        assertEquals(
+            "a selection the user has already replaced took the screen: $current",
+            SECOND,
+            (current as JoinState.Ready).inputs.map { it.uri },
+        )
+    }
+
+    private companion object {
+        val FIRST = listOf(
+            Uri.parse("content://test/first-a.mp4"),
+            Uri.parse("content://test/first-b.mp4"),
+        )
+        val SECOND = listOf(
+            Uri.parse("content://test/second-a.mp4"),
+            Uri.parse("content://test/second-b.mp4"),
+        )
+    }
+}

app/src/test/java/org/libremediaconverter/join/JoinReattachmentOwnershipTest.kt

@@ -0,0 +1,166 @@
+package org.libremediaconverter.join
+
+import android.app.Application
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.work.WorkManager
+import androidx.work.workDataOf
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.convert.ConversionDependencies
+import org.libremediaconverter.convert.ParkedPickDispatcher
+import org.libremediaconverter.convert.RecordingPublisher
+import org.libremediaconverter.convert.awaitState
+import org.libremediaconverter.convert.installTestWorkManager
+import org.libremediaconverter.model.ConcatStrategy
+import org.libremediaconverter.work.ConcatWorker
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import java.io.File
+
+/**
+ * Issue #49 on the join side, where nothing was watching for it.
+ *
+ * `reattach()` checks that the screen is still free, and then hands the answer to `observe()`,
+ * which writes from a *different* coroutine that has to suspend on `collect` before it can write
+ * anything at all. So the check happens at one moment and the write lands at another, with a
+ * whole pick able to fit in between:
+ *
+ * 1. `init` starts the tag query and suspends in it.
+ * 2. The user picks files; `onInputsPicked` suspends in its metadata query.
+ * 3. The query comes back. The screen is still `Idle` — step 2 has not written yet — so the
+ *    guard passes and an observation of the old job is launched.
+ * 4. The pick lands. `Ready(picked)`. The user owns the screen.
+ * 5. The observation's first `WorkInfo` arrives and writes `Joined(yesterday's file)` over it.
+ *
+ * The comment above that guard used to say "no suspension point between this check and the
+ * assignment below, so nothing can interleave". There is no assignment below, and the two lines
+ * are in different coroutines.
+ *
+ * The convert side has been failing this on CI for two days — four occurrences across three API
+ * levels, each read as flaky infrastructure. `JoinViewModel` has the identical shape and no test
+ * at all, which is why this one was written before the fix rather than after it.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class JoinReattachmentOwnershipTest {
+
+    private lateinit var app: Application
+    private lateinit var publisher: RecordingPublisher
+    private lateinit var workManager: WorkManager
+    private lateinit var staged: File
+
+    @Before
+    fun setUp() {
+        app = RuntimeEnvironment.getApplication()
+        publisher = RecordingPublisher(app)
+        ConversionDependencies.publisher = { publisher }
+
+        staged = publisher.createStagingFile("joined-yesterday.mp4").apply { writeBytes(ByteArray(4096)) }
+        installTestWorkManager(
+            app,
+            workDataOf(
+                ConcatWorker.KEY_OUTPUT_PATH to staged.absolutePath,
+                ConcatWorker.KEY_STRATEGY to ConcatStrategy.STREAM_COPY.name,
+            ),
+        )
+        workManager = WorkManager.getInstance(app)
+        // The situation reattachment exists for: a join that finished in a process that is gone,
+        // with its output still in the cache and nothing in the UI holding its id.
+        workManager.enqueue(
+            ConcatWorker.request(
+                inputs = listOf(
+                    Uri.parse("content://test/yesterday-a.mp4"),
+                    Uri.parse("content://test/yesterday-b.mp4"),
+                ),
+                totalBytes = 8_192L,
+            ),
+        ).result.get()
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    /**
+     * The race, made into a state the test can sit in rather than one it has to catch.
+     *
+     * The pick is parked on a dispatcher this test owns, so it is in flight — issued, not yet
+     * written — for as long as the assertions need it to be. Everything else is real: a real
+     * `WorkManager` holding a real finished job, the production `reattach`, the production
+     * `observe`.
+     *
+     * Determinism comes from where Robolectric leaves the main looper. `reattach`'s tag query
+     * hops to a real [kotlinx.coroutines.Dispatchers.IO] thread, so its continuation can only
+     * come back as a message posted to the main looper — and that looper is paused, so it cannot
+     * run until something pumps it. `onInputsPicked` is an ordinary synchronous call from this
+     * thread. The pick is therefore always issued before the guard runs, with nothing left to
+     * timing.
+     */
+    @Test
+    fun `a join found while the user was picking never reaches the screen`() {
+        val parkedPick = ParkedPickDispatcher()
+        val viewModel = JoinViewModel(app, pickDispatcher = parkedPick)
+        viewModel.onInputsPicked(PICKED)
+
+        assertEquals(
+            "the pick must still be in flight, or this proves something about a different situation",
+            1,
+            parkedPick.parkedCount,
+        )
+
+        // The control, and the reason this test does not rest on a settle window being long
+        // enough. A second ViewModel with nothing to supersede it reattaches to the same job
+        // through the same code; when it has arrived, the whole query-guard-observe-write path
+        // has demonstrably run to completion. `viewModel` started its own reattachment first, so
+        // it has had at least as long. Waiting on this rather than on a sleep is what makes the
+        // assertion below "it did not happen" instead of "it had not happened yet".
+        reattachmentHasRunToCompletion()
+
+        val current = viewModel.state.value
+        assertTrue("reattachment took the screen from the user: $current", current is JoinState.Idle)
+
+        // And the pick, when it lands, is what stays there.
+        parkedPick.runAll()
+        val ready = awaitState(viewModel.state, "Ready") { it is JoinState.Ready }
+        assertEquals(PICKED, (ready as JoinState.Ready).inputs.map { it.uri })
+        reattachmentHasRunToCompletion()
+        assertEquals("the user's pick must survive a late reattachment", ready, viewModel.state.value)
+    }
+
+    /**
+     * The other half of the contract: a reattachment nobody has superseded still takes the screen.
+     *
+     * Without this, dropping every reattachment on the floor would pass the test above. It is the
+     * same job, the same WorkManager and the same production path — only the pick is missing.
+     */
+    @Test
+    fun `a join nobody has superseded still reaches the screen`() {
+        val joined = awaitState(JoinViewModel(app).state, "Joined") { it is JoinState.Joined }
+
+        assertEquals(staged.absolutePath, (joined as JoinState.Joined).staged.absolutePath)
+    }
+
+    /**
+     * Drives a throwaway ViewModel through a whole reattachment, and returns once it has landed.
+     *
+     * [awaitState] pumps the main looper, which is what runs every reattachment continuation
+     * waiting on it — this one's and the one belonging to the ViewModel under test, which was
+     * posted earlier and therefore runs first.
+     */
+    private fun reattachmentHasRunToCompletion() {
+        awaitState(JoinViewModel(app).state, "Joined") { it is JoinState.Joined }
+    }
+
+    private companion object {
+        val PICKED = listOf(
+            Uri.parse("content://test/clip-one.mp4"),
+            Uri.parse("content://test/clip-two.mp4"),
+        )
+    }
+}

app/src/test/java/org/libremediaconverter/join/JoinScreenContentTest.kt

@@ -0,0 +1,82 @@
+package org.libremediaconverter.join
+
+import androidx.compose.ui.test.junit4.v2.createComposeRule
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.performClick
+import androidx.compose.ui.test.performScrollTo
+import androidx.media3.common.util.UnstableApi
+import org.junit.Assert.assertEquals
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.model.ConcatStrategy
+import org.libremediaconverter.ui.TestTags
+import org.robolectric.RobolectricTestRunner
+import java.io.File
+
+/**
+ * The join screen's half of the same seam, and the same two directions.
+ *
+ * The defect is the one `ConverterScreenContentTest` describes -- a content composable that
+ * ignores the state handed to it, or renders the finished job's affordances unwired -- and it has
+ * to be asked separately here because the two screens share no code. `JoinScreen` and
+ * `ConverterScreen` were extracted in the same commit by the same hand, which is exactly the
+ * circumstance in which one of them gets the wiring right and the other does not.
+ *
+ * `JoinState.Joined` is unreachable through a real `JoinViewModel` for the same reason
+ * `ConversionState.Converted` is: only a `ConcatWorker` run that has already succeeded produces
+ * one, carrying the strategy it chose and the name it picked.
+ *
+ * `JoinScreenKt` is the honest remaining coverage gap on this repo, and closing it is R38.7 (#63),
+ * not this file. Which affordances each `JoinState` renders belongs there; this asserts only that
+ * the injection point exists.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class JoinScreenContentTest {
+
+    @get:Rule
+    val composeRule = createComposeRule()
+
+    /** What the screen asked to save, in the order it asked. Empty until Save is tapped. */
+    private val savedAs = mutableListOf<String>()
+
+    @Test
+    fun `a finished join renders the save button`() {
+        setContent(joined())
+
+        composeRule.onNodeWithTag(TestTags.SAVE_FILE).assertExists()
+    }
+
+    @Test
+    fun `tapping save hands back the name the finished join chose`() {
+        setContent(joined())
+
+        composeRule.onNodeWithTag(TestTags.SAVE_FILE).performScrollTo().performClick()
+
+        assertEquals(listOf("joined.mp4"), savedAs)
+    }
+
+    /** `staged` names a missing file deliberately -- see the same helper on the converter side. */
+    private fun joined() = JoinState.Joined(
+        staged = File("no-such-staged-output.mp4"),
+        strategy = ConcatStrategy.STREAM_COPY,
+        suggestedName = "joined.mp4",
+        mimeType = "video/mp4",
+    )
+
+    private fun setContent(state: JoinState) {
+        composeRule.setContent {
+            JoinScreenContent(
+                state = state,
+                actions = JoinActions(
+                    onPickInputs = {},
+                    onJoin = {},
+                    onCancel = {},
+                    onSave = { suggestedName -> savedAs += suggestedName },
+                    onReset = {},
+                ),
+            )
+        }
+    }
+}

app/src/test/java/org/libremediaconverter/join/JoinStateAffordancesTest.kt

@@ -0,0 +1,329 @@
+package org.libremediaconverter.join
+
+import android.net.Uri
+import androidx.compose.ui.semantics.ProgressBarRangeInfo
+import androidx.compose.ui.semantics.SemanticsProperties
+import androidx.compose.ui.semantics.getOrNull
+import androidx.compose.ui.test.SemanticsMatcher
+import androidx.compose.ui.test.assertRangeInfoEquals
+import androidx.compose.ui.test.assertTextEquals
+import androidx.compose.ui.test.junit4.v2.createComposeRule
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performClick
+import androidx.compose.ui.test.performScrollTo
+import androidx.media3.common.util.UnstableApi
+import org.junit.Assert.assertEquals
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.convert.InputFile
+import org.libremediaconverter.convert.PendingSave
+import org.libremediaconverter.model.ConcatStrategy
+import org.libremediaconverter.ui.TestTags
+import org.robolectric.RobolectricTestRunner
+import java.io.File
+
+/**
+ * Every `JoinState` renders its own affordances, wired to its own callback.
+ *
+ * The defect is a branch of `JoinScreenContent`'s `when` that reads the wrong thing: a count taken
+ * from a literal rather than from `inputs`, a strategy line that describes the other strategy, a
+ * button wired to the neighbouring branch's callback, a `Failed` that drops the message it carries.
+ * None of that is visible at compile time -- every branch of the `when` type-checks against the
+ * same `JoinScreenContent` signature -- and none of it is visible from the leaf tests either, which
+ * compose `FileRow` on its own and never see a state.
+ *
+ * `JoinScreenContentTest` deliberately asks only whether the seam exists, using `Joined`. This is
+ * the matrix behind it: seven states, each pinned to what it lets the user do next.
+ *
+ * ### Two assertions here that nothing else in the suite makes
+ *
+ * **Order.** A join is the one flow where the order of the inputs is the content of the output --
+ * the empty state promises "in the order you want them" -- so the rows are read back sorted by
+ * their position on screen and compared as a list, not as a set. `JoinLeafTagsTest` proves a row
+ * tags itself with the file it shows; nothing proved the rows come out in the order they went in.
+ *
+ * **Indeterminate.** The join progress bar carries no percentage, on purpose: FFmpeg reports
+ * progress against one input's duration, which means nothing across a concatenation. The converter
+ * screen's bar is determinate, so "it has a progress bar" is the assertion that would not notice a
+ * fabricated percentage arriving here.
+ *
+ * ### Not asserted here, deliberately
+ *
+ * `JoinState.Joined.mimeType` is not rendered by this composable at all -- it is read by the entry
+ * point, to open the save dialog with a type that matches the finished job. The colour of the
+ * `Failed` message is `MaterialTheme.colorScheme.error`, which is theme lookup rather than state
+ * logic, so it is left to the eye. The `is JoinState.Idle -> Unit` arm inside the scrolling branch
+ * is unreachable by construction: the outer `when` peels `Idle` off first.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class JoinStateAffordancesTest {
+
+    @get:Rule
+    val composeRule = createComposeRule()
+
+    /** Which callback the screen invoked, in order, with what it passed. Empty until one fires. */
+    private val events = mutableListOf<String>()
+
+    @Test
+    fun `the empty state asks for files in order and offers the picker`() {
+        setContent(JoinState.Idle)
+
+        composeRule.onNodeWithText("Pick two or more files to join, in the order you want them.").assertExists()
+        // No `performScrollTo` on this one: `Idle` is the centred branch, outside the scrolling
+        // column every other state renders into, so there is nothing to scroll.
+        composeRule.onNodeWithTag(TestTags.Join.CHOOSE_FILES).performClick()
+
+        assertEquals(listOf("pickInputs"), events)
+    }
+
+    /**
+     * The rows come out in the order the inputs went in.
+     *
+     * Sorted by position rather than trusting the order `fetchSemanticsNodes` happens to return, so
+     * the assertion is about what the user sees down the screen. Three inputs, with names whose
+     * alphabetical order is not their picked order, so a list that had been sorted anywhere on the
+     * way through would not be able to pass this.
+     */
+    @Test
+    fun `the picked inputs are listed in the order they were picked`() {
+        val picked = listOf("intro.mp4", "middle.mp4", "outro.mp4")
+        setContent(JoinState.Ready(inputs = picked.map(::input)))
+
+        val topToBottom = composeRule.onAllNodes(isFileRow)
+            .fetchSemanticsNodes()
+            .sortedBy { it.positionInRoot.y }
+            .map { it.config[SemanticsProperties.TestTag] }
+
+        assertEquals(picked.map(TestTags.Join::fileRow), topToBottom)
+    }
+
+    /**
+     * Three inputs, not two: two is the minimum a join accepts, so a button that had been
+     * hardcoded to the smallest legal join would still read correctly with two on screen.
+     */
+    @Test
+    fun `the join button counts the files it will join`() {
+        setContent(JoinState.Ready(inputs = listOf(input("intro.mp4"), input("middle.mp4"), input("outro.mp4"))))
+
+        composeRule.onNodeWithTag(TestTags.Join.JOIN).assertTextEquals("Join 3 files")
+        composeRule.onNodeWithTag(TestTags.Join.JOIN).performScrollTo().performClick()
+
+        assertEquals(listOf("join"), events)
+    }
+
+    /** `Ready` is the one working state that still offers the picker, to replace the selection. */
+    @Test
+    fun `a ready join can be repicked`() {
+        setContent(JoinState.Ready(inputs = listOf(input("intro.mp4"), input("outro.mp4"))))
+
+        composeRule.onNodeWithTag(TestTags.Join.CHOOSE_DIFFERENT_FILES).performScrollTo().performClick()
+
+        assertEquals(listOf("pickInputs"), events)
+    }
+
+    @Test
+    fun `a running join names the count and shows a bar with no percentage`() {
+        setContent(JoinState.Joining(inputs = listOf(input("intro.mp4"), input("outro.mp4"))))
+
+        composeRule.onNodeWithText("Joining 2 files…").assertExists()
+        composeRule.onNodeWithTag(TestTags.Join.PROGRESS).assertRangeInfoEquals(ProgressBarRangeInfo.Indeterminate)
+        composeRule.onNodeWithTag(TestTags.CANCEL).performScrollTo().performClick()
+
+        assertEquals(listOf("cancel"), events)
+    }
+
+    /**
+     * The paragraph is byte-identical to the converter screen's, which is the point of asserting
+     * the whole of it rather than a fragment: the two branches were worded together, and a reword
+     * that lands on one screen only is the failure this notices.
+     */
+    @Test
+    fun `a paused join explains itself and still offers cancel`() {
+        setContent(JoinState.Waiting(inputs = listOf(input("intro.mp4"), input("outro.mp4"))))
+
+        composeRule.onNodeWithText(PAUSED_PARAGRAPH).assertExists()
+        composeRule.onNodeWithTag(TestTags.CANCEL).performScrollTo().performClick()
+
+        assertEquals(listOf("cancel"), events)
+    }
+
+    @Test
+    fun `a stream copied join says nothing was re-encoded`() {
+        setContent(joined(ConcatStrategy.STREAM_COPY))
+
+        composeRule.onNodeWithText(STREAM_COPY_EXPLANATION).assertExists()
+        composeRule.onNodeWithText(REENCODE_EXPLANATION).assertDoesNotExist()
+    }
+
+    /**
+     * The other half of the pair. Asserting the absence of the stream-copy line as well, because a
+     * branch that had collapsed to one answer would still render *an* explanation.
+     */
+    @Test
+    fun `a re-encoded join says the files differed`() {
+        setContent(joined(ConcatStrategy.REENCODE))
+
+        composeRule.onNodeWithText(REENCODE_EXPLANATION).assertExists()
+        composeRule.onNodeWithText(STREAM_COPY_EXPLANATION).assertDoesNotExist()
+    }
+
+    /** The size comes from the staged file, which is missing here, so `length()` answers `0L`. */
+    @Test
+    fun `a finished join reports the size of what it produced`() {
+        setContent(joined(ConcatStrategy.STREAM_COPY))
+
+        composeRule.onNodeWithText("Joined — 0 MB.").assertExists()
+    }
+
+    @Test
+    fun `a finished join offers save and start over, and they are not the same button`() {
+        setContent(joined(ConcatStrategy.STREAM_COPY))
+
+        composeRule.onNodeWithTag(TestTags.SAVE_FILE).performScrollTo().performClick()
+        composeRule.onNodeWithTag(TestTags.START_OVER).performScrollTo().performClick()
+
+        assertEquals(listOf("save:joined.mp4", "reset"), events)
+    }
+
+    @Test
+    fun `a saved join names the file and offers to join more`() {
+        setContent(JoinState.Saved(displayName = "holiday-joined.mp4"))
+
+        composeRule.onNodeWithText("Saved holiday-joined.mp4.").assertExists()
+        composeRule.onNodeWithTag(TestTags.Join.JOIN_MORE).assertTextEquals("Join more")
+        composeRule.onNodeWithTag(TestTags.Join.JOIN_MORE).performScrollTo().performClick()
+
+        assertEquals(listOf("reset"), events)
+    }
+
+    /**
+     * The message is the whole content of this state -- it is the only thing that says why the job
+     * stopped -- and it arrives as a string the failure produced, so a branch that rendered a fixed
+     * apology instead would look correct on screen.
+     */
+    @Test
+    fun `a failed join renders the message it carries`() {
+        setContent(JoinState.Failed(message = "The second file has no audio track, so joining stopped."))
+
+        composeRule.onNodeWithText("The second file has no audio track, so joining stopped.").assertExists()
+    }
+
+    @Test
+    fun `a failed join offers start over`() {
+        setContent(JoinState.Failed(message = "The second file has no audio track, so joining stopped."))
+
+        composeRule.onNodeWithTag(TestTags.START_OVER).performScrollTo().performClick()
+
+        assertEquals(listOf("reset"), events)
+    }
+
+    /**
+     * The negative that bounds #30 on this screen. A join that died staged nothing, so its `Failed`
+     * carries no [PendingSave] and there is nothing a save dialog could be handed. A retry button
+     * rendered unconditionally here could only fail, and this is what notices.
+     */
+    @Test
+    fun `a failed join offers no way to save`() {
+        setContent(JoinState.Failed(message = "The second file has no audio track, so joining stopped."))
+
+        composeRule.onNodeWithTag(TestTags.RETRY_SAVE).assertDoesNotExist()
+        composeRule.onNodeWithTag(TestTags.SAVE_FILE).assertDoesNotExist()
+    }
+
+    /**
+     * #30 on this screen: `save()` keeps the staged file when the copy out throws, and until this
+     * branch grew a second button the only control it rendered was "Start over" -- `reset()`, which
+     * deletes exactly that file. Both, not one: the restart still has to be reachable.
+     */
+    @Test
+    fun `a failed join save offers the file again as well as a restart`() {
+        setContent(failedSave())
+
+        composeRule.onNodeWithTag(TestTags.RETRY_SAVE).assertExists()
+        composeRule.onNodeWithTag(TestTags.START_OVER).assertExists()
+    }
+
+    /** The name comes from the job, so a retry wired to a literal would hand back the wrong one. */
+    @Test
+    fun `tapping try saving again hands back the name the join chose`() {
+        setContent(failedSave())
+
+        composeRule.onNodeWithTag(TestTags.RETRY_SAVE).performScrollTo().performClick()
+
+        assertEquals(listOf("save:joined.mp4"), events)
+    }
+
+    @Test
+    fun `tapping start over after a failed join save resets and does not save`() {
+        setContent(failedSave())
+
+        composeRule.onNodeWithTag(TestTags.START_OVER).performScrollTo().performClick()
+
+        assertEquals(listOf("reset"), events)
+    }
+
+    /** Anything `FileRow` tagged, whichever file it is showing. The prefix comes from the table. */
+    private val isFileRow = SemanticsMatcher("is a join file row") { node ->
+        node.config.getOrNull(SemanticsProperties.TestTag)?.startsWith(TestTags.Join.fileRow("")) == true
+    }
+
+    private fun input(displayName: String) = InputFile(
+        uri = Uri.parse("content://test/$displayName"),
+        displayName = displayName,
+        sizeBytes = 4_000_000L,
+    )
+
+    /**
+     * A `Failed` an earlier save left carrying its file, which is the only way `retry` is non-null.
+     * `staged` names a missing file for the same reason [joined] does -- this arm reads no length.
+     */
+    private fun failedSave() = JoinState.Failed(
+        message = "There was not enough room on the destination.",
+        retry = PendingSave(
+            staged = File("no-such-staged-output.mp4"),
+            suggestedName = "joined.mp4",
+            mimeType = "video/mp4",
+        ),
+    )
+
+    /** `staged` names a missing file deliberately -- see the same helper in `JoinScreenContentTest`. */
+    private fun joined(strategy: ConcatStrategy) = JoinState.Joined(
+        staged = File("no-such-staged-output.mp4"),
+        strategy = strategy,
+        suggestedName = "joined.mp4",
+        mimeType = "video/mp4",
+    )
+
+    private fun setContent(state: JoinState) {
+        composeRule.setContent {
+            JoinScreenContent(
+                state = state,
+                actions = JoinActions(
+                    onPickInputs = { events += "pickInputs" },
+                    onJoin = { events += "join" },
+                    onCancel = { events += "cancel" },
+                    onSave = { suggestedName -> events += "save:$suggestedName" },
+                    onReset = { events += "reset" },
+                ),
+            )
+        }
+    }
+
+    private companion object {
+        /** Byte-identical to the converter screen's, and split the same way `main` splits it. */
+        const val PAUSED_PARAGRAPH =
+            "Paused. Android limits background media processing, so this will " +
+                "resume automatically — keeping the app open helps it along."
+
+        const val STREAM_COPY_EXPLANATION =
+            "Files matched, so they were joined without " +
+                "re-encoding — no quality loss."
+
+        const val REENCODE_EXPLANATION =
+            "Files differed in format, so they were re-encoded " +
+                "to match."
+    }
+}

app/src/test/java/org/libremediaconverter/model/CodecNamesTest.kt

@@ -1,6 +1,7 @@
 package org.libremediaconverter.model
 
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertNull
 import org.junit.Test
 
@@ -10,6 +11,16 @@ import org.junit.Test
  * Three vocabularies meet: `MediaExtractor` MIME types, FFprobe `codec_name` strings, and the
  * enums. Stream copy depends on the round trip, so a missing alias here shows up as "we could not
  * identify the source codec" and silently costs the user a re-encode.
+ *
+ * Also bites on #74: `describeVideo` and `describeAudio` are one function apiece over one
+ * vocabulary and had stopped matching. Only the video side special-cased
+ * [InputProbe.UNPARSEABLE]; the audio side fell through to the raw name, and that sentinel opens
+ * with a NUL, so the source-info card would have rendered a control character. The arms are shared
+ * now, and the tests below assert both sides so the symmetric bug cannot reappear on the other one.
+ *
+ * The tables these read are cross-checked against the device capability check by
+ * `CodecVocabularyTest` (#87). Deliberately not repeated here: this file is what each name means,
+ * that one is whether the app's two copies of the vocabulary still agree.
  */
 class CodecNamesTest {
 
@@ -48,4 +59,52 @@ class CodecNamesTest {
         // An unrecognised but real codec name is more useful shown than hidden.
         assertEquals("cinepak", CodecNames.describeVideo("cinepak"))
     }
+
+    /** The audio row of the same card, which had none of the above. */
+    @Test
+    fun `audio descriptions degrade exactly the way video ones do`() {
+        assertEquals("AAC", CodecNames.describeAudio("mp4a"))
+        assertEquals("Unknown", CodecNames.describeAudio(null))
+        assertEquals("Unrecognised", CodecNames.describeAudio(InputProbe.UNPARSEABLE))
+        assertEquals("qdm2", CodecNames.describeAudio("qdm2"))
+    }
+
+    /**
+     * #74's actual failure mode, stated as the thing the user would have seen.
+     *
+     * `InputProbe.UNPARSEABLE` is `"\u0000unparseable"`. Falling through to `?: name` does not
+     * mislabel the track, it puts U+0000 into a `Text`.
+     */
+    @Test
+    fun `no description can put a control character on the card`() {
+        listOf(CodecNames.describeAudio(InputProbe.UNPARSEABLE), CodecNames.describeVideo(InputProbe.UNPARSEABLE))
+            .forEach { assertFalse("$it leaks the sentinel", it.contains('\u0000')) }
+    }
+
+    /**
+     * Every alias, pinned one at a time.
+     *
+     * The tables became maps so `CodecVocabularyTest` could enumerate them; this is what catches a
+     * key mistyped or a value pointing at the wrong enum while that rewrite happened.
+     */
+    @Test
+    fun `every name in the tables resolves to the codec it spells`() {
+        CodecNames.VIDEO_ALIASES.forEach { (name, codec) ->
+            assertEquals(name, codec, CodecNames.videoFromName(name))
+        }
+        CodecNames.AUDIO_ALIASES.forEach { (name, codec) ->
+            assertEquals(name, codec, CodecNames.audioFromName(name))
+        }
+        assertEquals(VideoCodec.H264, CodecNames.videoFromName("x264"))
+        assertEquals(VideoCodec.VP9, CodecNames.videoFromName("vp09"))
+        assertEquals(AudioCodec.MP3, CodecNames.audioFromName("mpga"))
+        assertEquals(AudioCodec.OPUS, CodecNames.audioFromName("opus"))
+    }
+
+    /** The audio lookup reads the sentinel the same way the video one does. */
+    @Test
+    fun `the unparseable sentinel resolves to nothing on the audio side too`() {
+        assertNull(CodecNames.audioFromName(InputProbe.UNPARSEABLE))
+        assertNull(CodecNames.audioFromName(null))
+    }
 }

app/src/test/java/org/libremediaconverter/model/ContainerCapabilitiesTest.kt

@@ -11,6 +11,11 @@ import org.junit.Test
  * `OutputFormat` used to be twelve hand-picked triples, and its KDoc defended that on the grounds
  * that a closed set was what made routing decidable. Opening it up moves that burden here, so this
  * is where decidability now has to be proven.
+ *
+ * That includes what a refusal offers instead. `Validation.Invalid` promises every suggestion is
+ * itself valid and names this class as the proof, so a branch that assembles its own suggestion
+ * list rather than going through `suggestions()` is only checked here if some row happens to reach
+ * it — which is how a dead-end chip survived two widenings of that table.
  */
 class ContainerCapabilitiesTest {
 
@@ -20,6 +25,44 @@ class ContainerCapabilitiesTest {
         container = Container.MP4,
     )
 
+    /**
+     * An MP3, and the reason several rules below need a second probe.
+     *
+     * `hasVideo = false` is the load-bearing field. Every rule that reads only the spec answers the
+     * same for this input as for a video file, which is exactly how a spec naming a video codec was
+     * called valid for a file with no video track to put in it.
+     */
+    private val mp3Source = InputProbe(
+        videoCodec = null,
+        audioCodec = "mp3",
+        hasVideo = false,
+        kind = InputKind.AUDIO_ONLY,
+        container = Container.MP3,
+    )
+
+    /**
+     * An audio-only input carrying a codec MP4 has no place for at all.
+     *
+     * Vorbis lives in Ogg and Matroska; MP4 carries AAC, MP3, Opus and FLAC. That gap is what turns
+     * a suggestion which merely drops the video track into a second refusal.
+     */
+    private val vorbisSource = InputProbe(
+        videoCodec = null,
+        audioCodec = "vorbis",
+        hasVideo = false,
+        kind = InputKind.AUDIO_ONLY,
+        container = Container.OGG,
+    )
+
+    /** The same shape, for the other codec MP4 refuses. One case is a coincidence; two is the rule. */
+    private val pcmSource = InputProbe(
+        videoCodec = null,
+        audioCodec = "pcm_s16le",
+        hasVideo = false,
+        kind = InputKind.AUDIO_ONLY,
+        container = Container.WAV,
+    )
+
     // --- copy and encode are different questions ----------------------------
 
     /**
@@ -82,20 +125,56 @@ class ContainerCapabilitiesTest {
         }
     }
 
-    /** A suggestion that is itself invalid is worse than no suggestion. */
+    /**
+     * A suggestion that is itself invalid is worse than no suggestion.
+     *
+     * Only a branch that assembles its own suggestion list can break that promise: [suggestions]
+     * ends by filtering on `validate(...).isValid`, so everything routed through it is valid by
+     * construction. Those branches are what this table has to cover — the image output, and copy
+     * the video from a file that has none, which built its list by hand and came back refused for
+     * a Vorbis or PCM source into MP4 and an MP3 into WebM. The Advanced picker showed a one-tap
+     * fix that led straight to a second error, through two widenings of this table that never
+     * reached the branch.
+     */
     @Test
     fun `every suggestion is itself valid`() {
-        val broken = OutputSpec(Container.WEBM, VideoCodec.H264, AudioCodec.AAC)
-        val result = ContainerCapabilities.validate(broken, h264Source)
+        val cases = listOf(
+            OutputSpec(Container.WEBM, VideoCodec.H264, AudioCodec.AAC) to h264Source,
+            // The audio-only input. Every rejection it can reach used to hand back `None + None`
+            // — a spec validation refuses in the next breath — because these branches built their
+            // suggestion by hand instead of going through the repair-and-filter path.
+            OutputSpec(Container.MP4, VideoCodec.H265, AudioCodec.NONE) to mp3Source,
+            OutputSpec(Container.MP4, VideoCodec.COPY, AudioCodec.NONE) to mp3Source,
+            OutputSpec(Container.MP4, VideoCodec.NONE, AudioCodec.NONE) to mp3Source,
+            OutputSpec(Container.MP4, VideoCodec.COPY, AudioCodec.AAC) to mp3Source,
+            // Copy-the-video-from-a-file-with-no-video, the last branch that built its offer by
+            // hand. It escaped the five rows above because `spec.copy(videoCodec = NONE)` is valid
+            // exactly when the audio axis happens to be fine — true for the AAC and MP3 sources
+            // used there, false for any audio the target container cannot carry.
+            OutputSpec(Container.MP4, VideoCodec.COPY, AudioCodec.COPY) to vorbisSource,
+            OutputSpec(Container.MP4, VideoCodec.COPY, AudioCodec.COPY) to pcmSource,
+            OutputSpec(Container.WEBM, VideoCodec.COPY, AudioCodec.COPY) to mp3Source,
+            // The same branch with audio the container *can* hold, which is the half that already
+            // worked and must keep working: the repair here is a copy, so the offer is the very
+            // spec the caller handed to `suggestions`. It survives only because the exclusion is
+            // against what the user asked for rather than against the repair.
+            OutputSpec(Container.MP4, VideoCodec.COPY, AudioCodec.COPY) to mp3Source,
+            // The one branch that still builds its list by hand, so that it is asserted rather
+            // than merely reasoned about: an image container takes `None + None` and nothing else,
+            // which makes its single offer valid by construction.
+            OutputSpec(Container.GIF, VideoCodec.H264, AudioCodec.AAC) to h264Source,
+        )
 
-        val invalid = result as? Validation.Invalid
-            ?: throw AssertionError("expected H.264 in WebM to be rejected")
-        assertTrue("no alternatives offered", invalid.suggestions.isNotEmpty())
-        invalid.suggestions.forEach { suggestion ->
-            assertTrue(
-                "suggested $suggestion is itself invalid",
-                ContainerCapabilities.validate(suggestion, h264Source).isValid,
-            )
+        cases.forEach { (spec, probe) ->
+            val invalid = ContainerCapabilities.validate(spec, probe) as? Validation.Invalid
+                ?: throw AssertionError("expected $spec to be rejected")
+            assertTrue("no alternatives offered for $spec on $probe", invalid.suggestions.isNotEmpty())
+            invalid.suggestions.forEach { suggestion ->
+                assertTrue(
+                    "suggested $suggestion for $spec on $probe is itself invalid",
+                    ContainerCapabilities.validate(suggestion, probe).isValid,
+                )
+            }
         }
     }
 
@@ -127,6 +206,117 @@ class ContainerCapabilitiesTest {
         assertTrue((result as Validation.Invalid).suggestions.isNotEmpty())
     }
 
+    /**
+     * The same rule, seen only against the probe.
+     *
+     * A video codec named for a file with no video track is dropped, not encoded — so
+     * MP4/H.265/None on an MP3 empties the output exactly as None/None does. Reading the spec
+     * alone answered "valid" because the spec names a video codec, and the job went to Media3,
+     * where `EditedMediaItem.Builder` refuses a composition with both tracks removed by throwing
+     * on Transformer's own HandlerThread.
+     */
+    @Test
+    fun `a video codec named for a file with no video track and no audio is refused`() {
+        ContainerCapabilities.encodableVideo(Container.MP4).forEach { codec ->
+            val spec = OutputSpec(Container.MP4, codec, AudioCodec.NONE)
+            val result = ContainerCapabilities.validate(spec, mp3Source)
+
+            assertFalse(
+                "MP4/${codec.label}/None on an audio-only input plans to (Drop, Drop) and would " +
+                    "produce an empty file; it must be refused. Got $result",
+                result.isValid,
+            )
+        }
+    }
+
+    /**
+     * The refusal is only worth having if it leads somewhere.
+     *
+     * The COPY form of this was already refused, but its one hand-built suggestion was
+     * `None + None` — which validation refuses in the next breath, so the Advanced picker offered
+     * a one-tap fix that fixed nothing. Every face of the rule now goes through the shared
+     * suggestion path, so the offer keeps the one track the input actually has.
+     */
+    @Test
+    fun `refusing an empty output still offers a way to keep the audio`() {
+        listOf(VideoCodec.H265, VideoCodec.H264, VideoCodec.COPY, VideoCodec.NONE).forEach { codec ->
+            val spec = OutputSpec(Container.MP4, codec, AudioCodec.NONE)
+            val invalid = ContainerCapabilities.validate(spec, mp3Source) as? Validation.Invalid
+                ?: throw AssertionError("expected MP4/${codec.label}/None to be rejected")
+
+            assertTrue(
+                "a refusal with no way out is a dead end in the Advanced picker",
+                invalid.suggestions.isNotEmpty(),
+            )
+            assertTrue(
+                "every suggestion must keep a track, got ${invalid.suggestions}",
+                invalid.suggestions.all { it.audioCodec != AudioCodec.NONE },
+            )
+        }
+    }
+
+    /**
+     * A repair must not name a track the input does not have.
+     *
+     * `repairVideo` used to fall through to "the first codec this container can encode" whenever
+     * nothing else fitted, and for an MP3 that produced the non-sequitur `MP4 · H.264 · Copy`.
+     * It validated, so nothing caught it — but [CopyPlanner] drops that video track anyway, which
+     * makes the codec in the offer a fiction.
+     */
+    @Test
+    fun `a repair for a file with no video track never names a video codec`() {
+        listOf(
+            OutputSpec(Container.MP4, VideoCodec.H265, AudioCodec.NONE),
+            OutputSpec(Container.MP4, VideoCodec.NONE, AudioCodec.NONE),
+            OutputSpec(Container.MP4, VideoCodec.COPY, AudioCodec.NONE),
+        ).forEach { spec ->
+            val invalid = ContainerCapabilities.validate(spec, mp3Source) as Validation.Invalid
+            invalid.suggestions.forEach {
+                assertEquals(
+                    "offering ${it.videoCodec.label} for a file with no video track is a fiction; " +
+                        "CopyPlanner drops it. Suggested $it for $spec",
+                    VideoCodec.NONE,
+                    it.videoCodec,
+                )
+            }
+        }
+    }
+
+    /**
+     * The rule stated as the property it is, over the whole matrix.
+     *
+     * A plan of (Drop, Drop) is precisely the composition `EditedMediaItem.Builder` refuses to
+     * build, so no non-image spec that reaches it may be called valid. Sweeping every container ×
+     * codec × codec against both probes is what stops the next container or codec from
+     * reintroducing the gap on an axis nobody thought to write a case for.
+     *
+     * Image outputs are exempt and deliberately so: GIF and PNG frames carry no codecs at all, and
+     * `None + None` is the only spec they accept — but they never reach Media3, because the router
+     * sends every image output to FFmpeg.
+     */
+    @Test
+    fun `no valid non-image spec plans to remove both tracks`() {
+        val specs = Container.entries
+            .filterNot { it == Container.GIF || it == Container.IMAGE_SEQUENCE }
+            .flatMap { container -> VideoCodec.entries.map { container to it } }
+            .flatMap { (container, video) -> AudioCodec.entries.map { OutputSpec(container, video, it) } }
+        val cases = specs.flatMap { spec -> listOf(h264Source, mp3Source).map { spec to it } }
+
+        val empties = cases.filter { (spec, probe) ->
+            val plan = CopyPlanner.plan(spec, probe)
+            plan.video == VideoPlan.Drop && plan.audio == AudioPlan.Drop
+        }
+
+        assertTrue("the sweep found nothing to check — the filter has gone wrong", empties.isNotEmpty())
+        empties.forEach { (spec, probe) ->
+            assertFalse(
+                "$spec on $probe plans to (Drop, Drop) — an empty file, and the composition " +
+                    "Media3 cannot build — so it must not validate",
+                ContainerCapabilities.validate(spec, probe).isValid,
+            )
+        }
+    }
+
     @Test
     fun `copying is offered as the fix when the codec is right but unencodable`() {
         val av1Source = InputProbe(videoCodec = "av1", audioCodec = "aac", container = Container.MKV)

app/src/test/java/org/libremediaconverter/model/ConversionRouterTest.kt

@@ -350,6 +350,34 @@ class ConversionRouterTest {
         }
     }
 
+    /**
+     * Why `Media3Engine` still needs a guard of its own.
+     *
+     * `ContainerCapabilities.validate` now refuses "a video codec with the audio off" for an input
+     * with no video track, so neither the picker nor `ConversionWorker` will start one. Routing is
+     * a separate question and still answers MEDIA3 — nothing about a dropped track makes the job
+     * un-hardware-able — so a request that skips validation, from a direct
+     * `ConversionWorker.request(...)` or a job queued before the settings changed, arrives at the
+     * engine with a plan Media3 cannot build. That has to fail the job, not the process.
+     */
+    @Test
+    fun `a plan that drops both tracks still routes to media3`() {
+        val audioOnly = InputProbe(
+            videoCodec = null,
+            audioCodec = "mp3",
+            hasVideo = false,
+            container = Container.MP3,
+            kind = InputKind.AUDIO_ONLY,
+        )
+        val spec = OutputSpec(Container.MP4, VideoCodec.H265, AudioCodec.NONE)
+
+        val plan = CopyPlanner.plan(spec, audioOnly)
+        assertEquals(VideoPlan.Drop, plan.video)
+        assertEquals(AudioPlan.Drop, plan.audio)
+
+        assertEquals(Engine.MEDIA3, route(spec, probe = audioOnly).engine)
+    }
+
     @Test
     fun `audio-only formats are flagged as such`() {
         assertEquals(true, OutputFormat.MP3.isAudioOnly)

app/src/test/java/org/libremediaconverter/model/CopyPlannerTest.kt

@@ -146,6 +146,33 @@ class CopyPlannerTest {
         assertTrue("copying the only track is still a remux", plan.isPureRemux)
     }
 
+    /**
+     * The one plan `Media3Engine` cannot be handed.
+     *
+     * `EditedMediaItem.Builder` refuses a composition with both tracks removed —
+     * checkState("Audio and video cannot both be removed") — and this is how an ordinary-looking
+     * spec reaches it: a video codec named for a file that has no video, with the audio switched
+     * off. Neither half is unusual on its own, which is why validation could read the spec, see a
+     * video codec, and call it fine.
+     */
+    @Test
+    fun `an audio-only source with the audio dropped removes both tracks`() {
+        val audioOnly = InputProbe(
+            videoCodec = null,
+            audioCodec = "mp3",
+            hasVideo = false,
+            container = Container.MP3,
+            kind = InputKind.AUDIO_ONLY,
+        )
+        val plan = CopyPlanner.plan(
+            OutputSpec(Container.MP4, VideoCodec.H265, AudioCodec.NONE),
+            audioOnly,
+        )
+        assertEquals(VideoPlan.Drop, plan.video)
+        assertEquals(AudioPlan.Drop, plan.audio)
+        assertTrue("an empty plan is not a remux", !plan.isPureRemux)
+    }
+
     @Test
     fun `copying one track and encoding the other is not a pure remux`() {
         val plan = CopyPlanner.plan(

app/src/test/java/org/libremediaconverter/ui/theme/ThemeColorSchemeTest.kt

@@ -0,0 +1,131 @@
+package org.libremediaconverter.ui.theme
+
+import androidx.compose.material3.ColorScheme
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.ui.graphics.luminance
+import androidx.compose.ui.test.junit4.v2.createComposeRule
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertTrue
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+
+/**
+ * The theme has to resolve the scheme its arguments name, and `ThemeKt` had no test at all --
+ * 23 lines, none of them covered, which is how #68 was found.
+ *
+ * Only two of the four branches in [LibreMediaConverterTheme]'s `when` are reachable from the
+ * app. `MainActivity` is the single call site and passes no arguments, so `dynamicColor` is
+ * always `true` and the live choice is between the dynamic dark and dynamic light schemes.
+ * Those two are what ships, and asserting on them survives whichever way #68 is decided.
+ *
+ * **The other two branches have no caller.** `dynamicColor = false` is passed below by this
+ * test and by nothing else in `app/src`, so the coverage it produces is not evidence that a
+ * switch exists -- misreading it that way is the whole reason #68 was filed. #68 is the open
+ * decision about whether one ever will exist.
+ *
+ * What the assertions distinguish the branches on was measured under Robolectric `sdk=36`
+ * rather than assumed. The dynamic palette resolves to the platform's own default there --
+ * dark background `#121318` against light `#FAF8FF`, dark primary `#B0C6FF` -- and that is a
+ * different hue from the brand palette's [Purple80] / [Purple40]. A dynamic scheme reads the
+ * device, so those exact values belong to the Robolectric stub and to no particular phone,
+ * which is why the live-branch tests compare the two resolved schemes against each other
+ * instead of hard-coding either one.
+ */
+@RunWith(RobolectricTestRunner::class)
+class ThemeColorSchemeTest {
+
+    // The **v2** rule (`androidx.compose.ui.test.junit4.v2`), as everywhere else in this
+    // source set.
+    @get:Rule
+    val composeRule = createComposeRule()
+
+    /**
+     * Every scheme the `when` can produce, read out of [MaterialTheme] inside the content
+     * lambda -- the only place that shows what the theme actually chose, rather than what the
+     * caller hoped for.
+     *
+     * All four are resolved in one composition because `setContent` may be called once per
+     * test, and a comparison needs at least two of them.
+     */
+    private fun resolveAll(): Schemes {
+        lateinit var dynamicDark: ColorScheme
+        lateinit var dynamicLight: ColorScheme
+        lateinit var brandDark: ColorScheme
+        lateinit var brandLight: ColorScheme
+        composeRule.setContent {
+            LibreMediaConverterTheme(darkTheme = true) { dynamicDark = MaterialTheme.colorScheme }
+            LibreMediaConverterTheme(darkTheme = false) { dynamicLight = MaterialTheme.colorScheme }
+            LibreMediaConverterTheme(darkTheme = true, dynamicColor = false) {
+                brandDark = MaterialTheme.colorScheme
+            }
+            LibreMediaConverterTheme(darkTheme = false, dynamicColor = false) {
+                brandLight = MaterialTheme.colorScheme
+            }
+        }
+        composeRule.waitForIdle()
+        return Schemes(dynamicDark, dynamicLight, brandDark, brandLight)
+    }
+
+    private class Schemes(
+        val dynamicDark: ColorScheme,
+        val dynamicLight: ColorScheme,
+        val brandDark: ColorScheme,
+        val brandLight: ColorScheme,
+    )
+
+    /**
+     * The live branches, and the one assertion that catches them being swapped: both dynamic
+     * schemes come from the same device palette, so they are similar enough that identity or a
+     * bare inequality would prove nothing. Background luminance is not similar -- it is the
+     * thing dark mode is for.
+     */
+    @Test
+    fun `dark mode resolves a darker scheme than light mode`() {
+        val schemes = resolveAll()
+
+        val dark = schemes.dynamicDark.background.luminance()
+        val light = schemes.dynamicLight.background.luminance()
+        assertTrue(
+            "darkTheme = true should resolve the dynamic dark scheme, whose background " +
+                "luminance ($dark) is below the light scheme's ($light)",
+            dark < light,
+        )
+    }
+
+    /**
+     * Which of the two dark branches ran, and which of the two light ones: the scheme a live
+     * call resolves is the dynamic one, not the brand palette sitting next to it.
+     */
+    @Test
+    fun `the live branches take the dynamic palette rather than the brand one`() {
+        val schemes = resolveAll()
+
+        assertNotEquals(
+            "the default dynamicColor = true should not resolve the brand dark palette",
+            Purple80,
+            schemes.dynamicDark.primary,
+        )
+        assertNotEquals(
+            "the default dynamicColor = true should not resolve the brand light palette",
+            Purple40,
+            schemes.dynamicLight.primary,
+        )
+    }
+
+    /**
+     * The two dead branches. Nothing in `app/src` passes `dynamicColor = false`; this test
+     * does it directly, because the parameter is public, and that is the only way either
+     * branch runs. Covered so a later decision on #68 starts from a tested `when` -- not
+     * because the brand palette is reachable in the app.
+     */
+    @Test
+    fun `the brand palette branches run only when dynamicColor is passed explicitly`() {
+        val schemes = resolveAll()
+
+        assertEquals(Purple80, schemes.brandDark.primary)
+        assertEquals(Purple40, schemes.brandLight.primary)
+    }
+}

docs/api-37-emulator-crash.md

@@ -32,8 +32,12 @@ reached* is not. Re-measured on 2026-08-22, seven runs, one variable at a time:
 | r06 | `android-37.1` rev 8 | `swangle_indirect` | ANGLE | **yes, 285 s** | 23 |
 | r07 | `android-37.0` rev 6 | `host` + `-feature -HostComposition` | host | **no**, wedged adb at 208 s | not readable |
 
-The discriminator is exact across all seven: **a run boots if and only if the emulator log says
-something other than `gles_mode_selected:host`.**
+The discriminator is exact across the **six runs that reported**: a run boots if and only if the
+emulator log says something other than `gles_mode_selected:host`. r07 is excluded on purpose — it
+wedged adb at 208 s and is recorded below as inconclusive rather than ruled out, and a row this
+page calls inconclusive cannot also be counted as evidence. Excluding it costs nothing: r07 is a
+`host` row, so the discriminator predicts it would not boot, and confirming a prediction with the
+one run whose evidence did not come back would add no information either way.
 
 One caveat about how independent those rows are, because the table flatters itself. `-gpu
 angle_indirect` (r05) and `-gpu swangle_indirect` (r03) both logged `gles_mode_selected:swangle`
@@ -230,11 +234,17 @@ booted (`emulator_alive=yes`). The host emulator is fine; the guest is not.
 
 ## Can the suite run on it?
 
-**Almost.** `tools/local-emulator/run-e2e.sh 37` now runs the whole suite locally, and all of it
-passes except two tests. Measured at `22c7914`: **49 tests, 2 failures, 0 errors, 2 skipped** — 45
-passed, the two `Media3EngineTest` failures dissected below, and the two `assumeTrue` skips every
-level has. It costs two deviations from how every other level is run, and both are worth
-understanding before trusting the leg.
+**Almost, and less so than it was.** `tools/local-emulator/run-e2e.sh 37` runs the whole suite
+locally. Measured at `22c7914`: **49 tests, 2 failures, 0 errors, 2 skipped** — 45 passed, the two
+`Media3EngineTest` failures dissected below, and the two `assumeTrue` skips every level has. It
+costs two deviations from how every other level is run, and both are worth understanding before
+trusting the leg.
+
+**That was the high-water mark.** On 2026-08-24 a test that touches system UI joined the suite,
+and the level stopped *finishing* rather than merely failing two —
+[see below](#something-does-depend-on-system-ui-now-and-it-is-excluded-rather-than-trusted).
+Two `Media3EngineTest` failures is what **CI's gating leg** expects, because it filters on
+`notAnnotation`; a local `run-e2e.sh 37` does not filter and sees more.
 
 Two things about that total before it is compared with anything. It is the size of the suite on
 the checkout that ran, not a property of API 37 — `app/src/androidTest` held 49 `@Test` methods at
@@ -320,10 +330,60 @@ and proceeding straight to the tests fails exactly as before. The harness theref
 1. **The renderer is ANGLE, not the host GPU.** Shared with nothing else in the matrix — API
    33–36 run `-gpu host` locally, and CI runs `swiftshader_indirect`.
 2. **SystemUI is disabled.** The API 37 leg does not run the same device configuration as any
-   other leg or as the Pixel. It is defensible here only because nothing in this suite touches
-   system UI — these are Media3, FFmpeg and WorkManager tests — and because the alternative is no
-   local API 37 coverage at all. **Anything that ever does depend on system UI must not trust
-   this leg.**
+   other leg or as the Pixel. It was defensible here because nothing in this suite touched
+   system UI — Media3, FFmpeg and WorkManager tests — and because the alternative is no local
+   API 37 coverage at all. **Anything that ever does depend on system UI must not trust this
+   leg.** Something now does; see the section below.
+
+### Something does depend on system UI now, and half of it is excluded
+
+Added 2026-08-24, and the first entry on this page that is not a codec.
+
+`SafPickerRoundTripTest` drives the real system file picker and rotates the display. Both reach
+the gralloc mapper — DocumentsUI is another app's windows, and a rotation rebuilds every surface
+on screen — and **disabling SystemUI does not help**, because it removes the *idle* trigger
+(RegionSamplingThread's nav-bar luma sampling) and not this one.
+
+Measured one method per fresh emulator, `android-37.0`, `swangle_indirect`, SystemUI disabled and
+verified quiet — separately, because inferring the second from the first is the mistake this
+page's opening correction is about:
+
+| test | result on android-37.0 | `hasReadColorBufferDma` aborts in the window |
+|---|---|---|
+| `thePickedInputSurvivesARealRotation` | **fails**: `INSTRUMENTATION_ABORTED: System has crashed.`, `Expected 1 tests, received 0`. The framework dies **during** it, so the JUnit XML carries a failure with no text at all. | 3 |
+| `pickingAFileThroughTheSystemPickerFillsInTheFileCard` | **passes** | 4 |
+
+So a rotation, which rebuilds every surface at once, is what the mapper does not survive. Merely
+starting DocumentsUI is not. Only the rotation test carries `@FailsOnEmulatorApi37`; the picker
+test runs on the gating leg like anything else.
+
+#### The correction that produced that table
+
+**The first version of this section said both tests failed, and put the marker on the class.** The
+picker test had indeed failed at API 37 — with `androidx.test.uiautomator.StaleObjectException`,
+which looked like a framework restart invalidating an accessibility node, because that is exactly
+what it looks like.
+
+It was the test's own bug. `UiObject2` caches the `AccessibilityNodeInfo` it was found with, and
+DocumentsUI is still settling when a node first appears; the handle went stale before `click()`.
+CI then reproduced it **deterministically** at API 33, 34 and 35 — every cold runner emulator, not
+intermittently — which is what made it obviously not an API 37 property. It had passed locally
+only because the emulator was warm.
+
+The lesson is worth more than the measurement: **an annotation is a claim about an image, and a
+broken test makes every image look broken.** Re-measure after fixing a test before deciding what
+the platform did. Both the abort and the stale node produce "the run fell over", and only one of
+them was the image.
+
+#### Two consequences worth stating rather than discovering
+
+- **`run-e2e.sh 37` applies no annotation filter**, unlike CI, so a local API 37 run includes the
+  rotation test and therefore **does not finish**: its totals come back short and which later
+  tests ran is arbitrary. The summary row says so.
+- **The advisory job is still named `E2E API 37 Media3 hardware transcode (advisory)`** and now
+  carries a test that is neither Media3 nor a transcode. Renaming a check is a branch-protection
+  change and was deliberately not made in the same PR; the name is stale, the behaviour is
+  correct.
 
 ### The two remaining failures are the same bug, one layer down
 
@@ -453,8 +513,9 @@ API 37", not "is that codec broken".
 
 `.github/workflows/api37-debug.yml` carried "roughly every 20 s" for the kill cycle in its own
 comments. That number was the watchdog's **sampling** interval, not the cadence, and the two got
-conflated. Measured across the seven runs above, gaps between successive `hasReadColorBufferDma`
-aborts run **20 s to 90 s, median 60–70 s — three to five aborts in a four-minute window**.
+conflated. Measured across the **six runs whose crash buffer could be read** — r07 wedged adb
+before one could be taken, so it contributes no gaps — successive `hasReadColorBufferDma` aborts
+run **20 s to 90 s, median 60–70 s — three to five aborts in a four-minute window**.
 Slower than assumed, and still not slow enough: install, data-directory creation and
 instrumentation start-up do not fit inside one gap.
 
@@ -650,9 +711,15 @@ though a new API level shipped. Watch for these instead:
 - **`E2E API 37 Media3 hardware transcode (advisory)` going green.** Nothing announces this: the
   job is `continue-on-error`, so it fixing itself looks exactly like a check nobody reads
   quietly ceasing to be red. It is listed here because that makes it the *least* likely of these
-  triggers to be noticed, not the most. When it happens, delete `@FailsOnEmulatorApi37` from the
-  two tests rather than the job — the gating leg picks them back up on its own, and the advisory
-  job then runs nothing and can go.
+  triggers to be noticed, not the most. When it happens, delete `@FailsOnEmulatorApi37` from
+  everything carrying it rather than deleting the job — the gating leg picks them back up on its
+  own, and the advisory job then runs nothing and can go.
+
+  **It is not two tests any more.** As of 2026-08-24 the marker is on `Media3EngineTest`'s two
+  methods *and* on `SafPickerRoundTripTest` as a class, and the two groups fail for unrelated
+  reasons — a codec and the gralloc mapper. They can go green independently, so check both before
+  concluding the marker is done; and the job's name still says "Media3 hardware transcode", which
+  half of what it runs is not.
 
 ## Correction owed to `CLAUDE.md`
 

gradle/libs.versions.toml

@@ -42,6 +42,18 @@ annotation = "1.+"
 junit = "4.+"
 androidxJunit = "1.+"
 espressoCore = "3.+"
+# UiAutomator. FLOATING, and the argument for it is the one the guard already makes:
+# androidx.test.uiautomator is inside `floatedGroupPrefixes` ("androidx."), so `2.+` reads
+# as "the newest RELEASED 2.x" exactly the way `work = "2.+"` does -- and this library does
+# publish alphas above its stable, so without the guard it would be a pin.
+#
+# Not pinned like ktlint/detekt/robolectric, because it is not that kind of dependency. Those
+# are pinned because a new *rule* or a new *runtime* makes untouched files fail -- the tool
+# changes its verdict on code nobody edited. UiAutomator has no verdict: it clicks what a
+# selector names, and a selector that stops matching is this repo's test to fix, in a diff
+# that says so. `2.` and not bare `+` because 3.x does not exist yet and a major is where the
+# selector API would be free to change under exactly that assumption.
+uiautomator = "2.+"
 # PINNED, unlike its neighbours. Under semver a 0.x minor is allowed to break, and
 # this library is load-bearing exactly where breakage is hardest to see: the wrapper
 # reaches for smartexception.java.Exceptions only when an FFmpeg call FAILS, so a
@@ -139,14 +151,20 @@ junit = { group = "junit", name = "junit", version.ref = "junit" }
 androidx-junit = { group = "androidx.test.ext", name = "junit", version.ref = "androidxJunit" }
 androidx-espresso-core = { group = "androidx.test.espresso", name = "espresso-core", version.ref = "espressoCore" }
 
+# The only way to touch UI this app does not own. Compose's own matchers stop at this
+# process's composition, and the system file picker is a DocumentsUI activity in another
+# process -- so a SAF round trip is unreachable without it.
+androidx-uiautomator = { group = "androidx.test.uiautomator", name = "uiautomator", version.ref = "uiautomator" }
+
 # Robolectric — an Android runtime for the JVM test source set, so file-lifecycle behaviour
 # that needs a real Context can be verified without a device. The instrumented suite cannot
 # run on the development host at all (see CLAUDE.md), so an androidTest-only red test is not
 # a TDD loop anyone here can execute.
 robolectric = { group = "org.robolectric", name = "robolectric", version.ref = "robolectric" }
 
-# Only for its `runTest`, and only to drain the collector kotlinx-coroutines-test installs
-# process-wide. See EscapedCoroutineErrors.kt in the JVM test source set.
+# Only for its `runTest`, and only so the one test that deliberately lets a coroutine error
+# escape owns the collector callback while it does -- otherwise the error is kept process-wide
+# and rethrown at whichever `runTest` starts next. See ConversionViewModelProbeFailureTest.
 kotlinx-coroutines-test = { group = "org.jetbrains.kotlinx", name = "kotlinx-coroutines-test", version.ref = "coroutinesTest" }
 
 [plugins]

tools/local-emulator/run-e2e.sh

@@ -15,11 +15,13 @@
 # EXIT CODE: 0 only if every level was green; 1 if any level failed, wedged or could not be
 # set up; 2 if it refused to start at all. **A bare `run-e2e.sh` therefore exits 1 by design.**
 # API 37 is in the default list on purpose -- leaving it out is what left the level unlooked-at
-# for as long as it was -- and it is permanently two failures short of green, on the emulator's
-# own c2.goldfish.h264.decoder rather than on anything this app does. The summary names the two,
-# so a third is visibly new, and the last line printed says the same thing. Anything that reads a
-# non-zero exit as breakage should name the levels it wants: `run-e2e.sh 33 34 35 36` is the
-# sweep that can be green. docs/api-37-emulator-crash.md has the measurements.
+# for as long as it was -- and it is permanently short of green, on the emulator image rather
+# than on anything this app does. Since 2026-08-24 it does not even FINISH: one of its expected
+# failures kills the framework, so the totals come back short with an arbitrary tail. The summary
+# names every failure it expects, so an unnamed one is visibly new, and the last line printed
+# says the same thing. Anything that reads a non-zero exit as breakage should name the levels it
+# wants: `run-e2e.sh 33 34 35 36` is the sweep that can be green.
+# docs/api-37-emulator-crash.md has the measurements.
 #
 # WHY THIS EXISTS, AND WHAT IT DELIBERATELY DOES NOT DO
 #
@@ -234,10 +236,24 @@ ensure_avd() {
   else
     if [ ! -d "$img_dir" ]; then
       echo "  installing $pkg"
-      yes | sdkmanager --install "$pkg" > /dev/null 2>&1 || {
+      # Read sdkmanager's own status, not the pipeline's. `yes` never ends, so the moment
+      # sdkmanager exits and closes the pipe, `yes` dies of SIGPIPE with 141 -- and this
+      # script runs under `pipefail`, which takes the rightmost NON-ZERO status. A package
+      # that installed perfectly therefore reported "FAILED to install".
+      #
+      # Measured rather than reasoned: under `set -o pipefail`, `yes | true` exits 141 on
+      # every run, and `yes | sh -c 'exit 3'` exits 3 -- so the pipeline status cannot tell
+      # a clean install from a broken one, while ${PIPESTATUS[1]} reports 0 and 3.
+      #
+      # The `echo no | avdmanager` below is deliberately NOT changed. One line fits the pipe
+      # buffer, so echo has already exited before the close and there is no signal to
+      # receive; `echo no | true` measured 0 on every run. Only an unbounded producer is
+      # exposed to this.
+      yes | sdkmanager --install "$pkg" > /dev/null 2>&1
+      if [ "${PIPESTATUS[1]}" -ne 0 ]; then
         echo "  FAILED to install $pkg"
         return 1
-      }
+      fi
     fi
     echo "  creating AVD $avd from $pkg"
     echo no | avdmanager create avd -n "$avd" -k "$pkg" -d pixel_6 --force > /dev/null 2>&1 || {
@@ -320,9 +336,20 @@ boot_emulator() {
 #
 # THIS IS A DEVIATION, and it is deliberately loud rather than silent. The API 37 leg does not
 # run the same device configuration as API 33-36 or as the Pixel. It is defensible only
-# because nothing in this suite touches SystemUI -- these are Media3, FFmpeg and WorkManager
-# tests -- and because the alternative is no API 37 coverage at all. Anything that ever does
-# depend on system UI must not trust this leg. docs/api-37-emulator-crash.md explains why.
+# because nothing in this suite touched SystemUI -- Media3, FFmpeg and WorkManager tests --
+# and because the alternative is no API 37 coverage at all. Anything that ever does depend on
+# system UI must not trust this leg. docs/api-37-emulator-crash.md explains why.
+#
+# "Touched", past tense, since 2026-08-24. SafPickerRoundTripTest drives DocumentsUI and rotates
+# the display, and both reach the gralloc mapper these images abort in -- disabling SystemUI
+# removes the IDLE trigger, not those. Measured per method on android-37.0: the ROTATION test
+# takes the framework down (INSTRUMENTATION_ABORTED) and carries @FailsOnEmulatorApi37; the
+# picker test passes.
+#
+# THIS SCRIPT APPLIES NO ANNOTATION FILTER, unlike CI, so a local `run-e2e.sh 37` runs the
+# rotation test anyway -- and because that test kills the framework rather than merely failing,
+# THE LEVEL DOES NOT FINISH. Its totals come back short and which later tests ran is arbitrary.
+# CI's gating leg never sees it.
 #
 # The retry loop is not defensive padding: at the moment boot_completed flips, the framework
 # may be in one of its restarts and `pm` is simply not published yet. The first attempt at this
@@ -564,13 +591,25 @@ for api in "${APIS[@]}"; do
   guest_forensics "$api"
   # API 37 is in the default list on purpose, and it is expected to be red. Leaving it out would
   # put the level back where this whole exercise found it -- untested and unlooked-at -- but a
-  # summary that just says "2 failures" with no explanation trains people to ignore the exit
-  # code. So the row says which two, and a THIRD failure is then obviously new.
+  # summary that just says "N failures" with no explanation trains people to ignore the exit
+  # code. So the row NAMES the expected ones, and anything else is then obviously new.
+  #
+  # The list grew on 2026-08-24 and the shape of the row changed with it. The two
+  # Media3EngineTest failures are a codec; the third is the gralloc bug reached through system
+  # UI, and it takes the framework DOWN rather than merely failing -- so the level does not
+  # finish, and the totals come back SHORT (50 of 59 when this was written) with the later
+  # tests never run. A run whose totals do not add up is expected here now, which it never
+  # was before.
   case "$api" in
     37 | 37.*)
       line="$line
-    expected here: 2 failures, both Media3EngineTest, on c2.goldfish.h264.decoder.
-    A third is new -- docs/api-37-emulator-crash.md"
+    expected here: 2 Media3EngineTest failures on c2.goldfish.h264.decoder, plus
+    SafPickerRoundTripTest.thePickedInputSurvivesARealRotation -- which kills the framework
+    rather than merely failing, so the run ABORTS partway and the total comes back SHORT with
+    an arbitrary tail. That is expected here too, and never was before. Anything else is new.
+    CI's gating leg sees only the first two: the rotation test carries @FailsOnEmulatorApi37
+    and this script, unlike CI, applies no annotation filter.
+    docs/api-37-emulator-crash.md"
       ;;
   esac
   if [ "$rc" -ne 0 ]; then
@@ -596,8 +635,9 @@ echo "=============================================================="
 # worse than no note at all.
 if [ "$overall" -ne 0 ] && [ "$NON37_RED" -eq 0 ]; then
   echo "note: the only level that went red is API 37, which exits non-zero by design -- it is"
-  echo "      permanently 2 failures short of green. Confirm its row above shows exactly those"
-  echo "      two and nothing else; docs/api-37-emulator-crash.md says why they are the image."
+  echo "      permanently short of green, and since 2026-08-24 it does not even finish. Confirm"
+  echo "      its row above names every failure it shows; docs/api-37-emulator-crash.md says why"
+  echo "      each of them is the image rather than this app."
 fi
 
 exit "$overall"