A6 (#172): six one-branch outcomes nothing produced, and one that cannot be produced

Each of these is a site where JaCoCo reported mi > 0 -- a concrete instruction no test
runs -- rather than a partial branch on a compound condition, which is how the group was
filtered in the first place. Six closed, one moved to the exclusions.

  AndroidDeviceCodecs:35   the UNPARSEABLE sentinel, refused where an unknown name is not
  ContainerCapabilities:94 accepts(container, VideoCodec.NONE, mode) -- the audio twin has
                           had a test since #136; the asymmetry is the argument
  ContainerCapabilities:323 repairVideo's keep-the-requested-codec arm
  ContainerCapabilities:348 firstContainerHolding's fallback container
  OutputPublisher:230      the resolver call that throws -- the third case the KDoc names
                           and the one the shape list was missing
  JobSnapshots:31          a job that recorded no output path at all

Every one was mutated and confirmed red, then restored. Two are worth stating because
they did not go red first time or would not have:

**The firstContainerHolding test was vacuous on its first draft.** It asserted the
refusal still offered *something*, and deleting the fallback left it green: the source
container is a candidate in its own right, so the list stays non-empty and only its
contents change. Rewritten around AVI, which has no mapping for H.265, and asserting the
codec survives -- without the fallback the app silently offers H.264 instead, which is
the actual loss. This is the failure mode CLAUDE.md records from the mutation review, met
head on rather than in the abstract.

**OutputPublisher:230 needed one line.** `a destination whose size cannot be determined is
never deleted` already walked three RowShapes; QUERY_THROWS was the fourth case its own
KDoc names -- "a resolver call that throws" -- and the only one that reaches `?: false`
through runCatching rather than through a cursor answer.

ContainerCapabilities:282's `.filter { it != exclude }` is **not** closed here and is not
a gap: nothing can make it drop anything. On the shared container `repair` always changes
at least one codec, because a codec it left alone is one validate would not have refused;
every other candidate differs by container; and the single call site passing a non-default
exclude (validateVideo:186) excludes a spec carrying VideoCodec.COPY while every repaired
candidate carries NONE. F4-shaped -- recorded rather than covered, and 550 tests agree.

550 -> 555 JVM tests, 0 failures. Five new tests rather than six: OutputPublisher:230
is one line inside a test that already existed. No production code changed.
Line 2087/2348 -> 2090/2348; branch 1011/1340 -> 1022/1340.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -130,9 +130,9 @@ install for code that can never run — and on API 37 the full APK does not fit
 - The `model` package is excluded from `ReturnCount` and `CyclomaticComplexMethod` only. It is the
   decision layer, where one branch is one documented user-visible outcome and the metric counts
   answers rather than complexity. Every other rule still applies there.
-- **Coverage is reported, not gated** — **87.1% of lines (2025/2324), 69.1% of branches
-  (974/1410)**, measured 2026-08-27 with `./gradlew :app:jacocoTestReport`, against 502 JVM tests
-  in 71 classes.
+- **Coverage is reported, not gated** — **88.9% of lines (2087/2348), 75.4% of branches
+  (1011/1340)**, measured 2026-08-29 with `./gradlew :app:jacocoTestReport`, against 546 JVM tests
+  in 76 classes.
 
   **Every figure this file carried before 2026-08-24 was an artifact, roughly half the real one.**
   Robolectric loads classes through its own sandbox classloader with no source location, JaCoCo
@@ -159,6 +159,21 @@ install for code that can never run — and on API 37 the full APK does not fit
   chooses a branch the suite had never taken. Line coverage barely notices; branch coverage is the
   whole point.
 
+  Then #153's five children on 2026-08-29 — 87.1% -> 88.9% line, 69.1% -> **75.4%** branch, 502 ->
+  546 tests.
+
+  **That last branch figure moved for two reasons, and only one of them is new tests.** The
+  numerator rose 974 -> 1011; the denominator *fell* 1410 -> 1340. Both are the seam work. Pulling
+  a `when` out of a lambda inside a `collect` deletes the coroutine state machine's synthesized
+  branches around it, and what is left is a plain function whose branches a test can choose:
+  `ConversionViewModel$observe$1$1` went from carrying the whole mapping to 6 branches, while the
+  extracted `ConversionViewModelKt` covers 41 of 42 and `JoinViewModelKt` 38 of 39. So a seam is
+  worth more than the tests it enables — it also stops the measurement counting scaffolding.
+
+  Be careful quoting a branch move on its own for that reason. A percentage that rises because the
+  denominator shrank is not the same claim as one that rises because more branches are tested, and
+  this entry has a history of explaining its own numbers wrongly.
+
   And **re-measure before quoting**: this entry was once written quoting 81.4%, measured four hours
   earlier, and was already three points stale by the time it was ready to merge.
 - **Testable code is not done until it is tested.** If a piece is unit testable, it gets unit
@@ -182,6 +197,32 @@ install for code that can never run — and on API 37 the full APK does not fit
 
 - `kotlin.code.style=official`. Gradle stays Kotlin DSL.
 
+- **A stacked PR does not merge with `gh pr merge`, and `MERGED` is not proof it reached `main`.**
+  Two separate traps, both measured on 2026-08-27 while landing #144-#151.
+
+  `gh pr merge` uses the GraphQL mutation, which refuses a stacked PR outright: *"This pull request
+  is part of a stack and must be merged using the asynchronous merge REST API."* So does
+  `PUT .../pulls/{n}/merge`. The one that works is
+  `gh api -X PUT repos/OWNER/REPO/pulls/N/merge-async -f merge_method=merge`, which returns a uuid
+  to poll at `.../merge-async/{uuid}` until `status` is `merged` or `failed`.
+
+  **The second trap is worse, because nothing looks wrong.** GitHub retargets a stacked PR's base
+  to `main` when the PR below it merges, but *asynchronously*. Merge a stack faster than that
+  settles — five PRs about thirty seconds apart, in the case that found this — and each one merges
+  into its own base branch, which has itself already been merged and left behind. Every call
+  returns `status: merged` and every one is true. `gh pr list --state open` comes back empty, every
+  PR shows `MERGED`, and **none of the content is on `main`**.
+
+  What caught it was a coverage re-measure reading two points lower than the same tree had measured
+  an hour earlier; a fresh `git pull` changed nothing, which is what turned it into a question.
+  `git merge-base --is-ancestor <merge-sha> origin/main` answers it in one line. Do that after
+  merging a stack, or merge one at a time and re-read `baseRefName` between. #160 is what the
+  recovery cost.
+
+  The auto-retarget belongs to the stacking feature specifically. A PR opened with a plain
+  `gh pr create --base some-branch` does **not** retarget when that branch merges — it is left
+  pointing at a dead base and has to be moved by hand.
+
 - **File one-off issues with `tools/github/file-issue.sh`, not `gh issue create`.** `gh issue
   create` does not touch the project board, so the issue exists, carries its labels, and is
   invisible in the Kanban — indistinguishable from never having been filed. Measured 2026-08-24:

app/src/test/java/org/libremediaconverter/codec/CodecVocabularyTest.kt

@@ -7,6 +7,7 @@ import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
 import org.libremediaconverter.model.CodecNames
+import org.libremediaconverter.model.InputProbe
 import org.libremediaconverter.model.VideoCodec
 
 /**
@@ -133,6 +134,38 @@ class CodecVocabularyTest {
      * landed, a device with no HEVC decoder answered true for `x265` and Media3 was handed a job it
      * could not do; now the router sends it to FFmpeg without spending the attempt.
      */
+    /**
+     * The sentinel is not just another unknown name, and the difference is the whole guard.
+     *
+     * `canDecode` ends `?: true` -- a name neither table knows keeps the permissive answer, because
+     * the app would rather try than refuse a file it might handle. `InputProbe.UNPARSEABLE` has to
+     * be the exception: the platform has *already* failed to parse the input, so there is nothing
+     * for a decoder to be permissive about, and waving it through spends a Media3 attempt on a job
+     * that cannot start.
+     *
+     * The `cinepak` line is what makes the sentinel line mean something. Without it, deleting the
+     * early return leaves this test green -- both names would fall through to the same `?: true`.
+     * The pair is the assertion.
+     *
+     * `DeviceCodecs.PERMISSIVE` carries the same rule and `ConversionRouterTest` pins its routing
+     * consequence. This is the implementation that runs on a device.
+     */
+    @Test
+    fun `the unparseable sentinel is refused even where an unknown name is waved through`() {
+        val everything = AndroidDeviceCodecs.forTesting(
+            encoders = emptySet(),
+            decoders = setOf("video/avc", "video/hevc"),
+        )
+        assertFalse(
+            "the platform could not parse this input, so there is nothing to decode with",
+            everything.canDecode(InputProbe.UNPARSEABLE),
+        )
+        assertTrue(
+            "a merely unknown name still keeps the permissive answer",
+            everything.canDecode("cinepak"),
+        )
+    }
+
     @Test
     fun `a device without the decoder now says so for the aliases it used to wave through`() {
         val hevcOnly = AndroidDeviceCodecs.forTesting(encoders = emptySet(), decoders = setOf("video/hevc"))

app/src/test/java/org/libremediaconverter/convert/OutputPublisherPublishTest.kt

@@ -232,6 +232,12 @@ class OutputPublisherPublishTest {
             RowShape.NO_SIZE_COLUMN to "a cursor with no SIZE column",
             RowShape.NULL_SIZE to "a cursor whose SIZE cell is null",
             RowShape.NO_ROWS to "a cursor holding no rows",
+            // The third case the KDoc names -- "a resolver call that throws" -- and the one the
+            // list was missing. It reaches `?: false` through `runCatching` rather than through a
+            // cursor answer, so it is the only one of the four that proves the catch is load
+            // bearing: a provider that revokes its grant between the picker and the write must not
+            // have its document deleted on the way out.
+            RowShape.QUERY_THROWS to "a provider that throws out of query",
         ).forEach { (shape, description) ->
             FakeSafProvider.deleteRequests.clear()
             FakeSafProvider.backingFile(documentUri).writeBytes(ByteArray(0))

app/src/test/java/org/libremediaconverter/convert/SettingsEditsTest.kt

@@ -0,0 +1,197 @@
+package org.libremediaconverter.convert
+
+import android.app.Application
+import androidx.media3.common.util.UnstableApi
+import androidx.work.Data
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertNull
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.model.AudioCodec
+import org.libremediaconverter.model.Container
+import org.libremediaconverter.model.EnginePreference
+import org.libremediaconverter.model.OutputFormat
+import org.libremediaconverter.model.QualityTier
+import org.libremediaconverter.model.VideoCodec
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+
+/**
+ * The seven one-line edits the settings sheet makes, and what each one leaves alone.
+ *
+ * ## Why these needed a file of their own
+ *
+ * `setPreset` was covered. The six beside it — `setContainer`, `setVideoCodec`, `setAudioCodec`,
+ * `applySuggestion`, `setQuality`, `setEnginePreference` — and `cancel()` had **no coverage at
+ * all**, which is the tell: they are reachable from the JVM suite by exactly the route `setPreset`
+ * already takes, and nothing had asked.
+ *
+ * ## What is actually being asserted
+ *
+ * Not "the setter sets something". Each of these copies into a nested `OutputSpec`, so the failure
+ * worth catching is **a setter that writes the right value into the wrong field, or that rebuilds
+ * the spec and silently discards the other two**. So every test here asserts the field it changed
+ * *and* that the rest of the spec survived — a `setContainer` implemented as
+ * `it.copy(spec = OutputFormat.MP4_H265.spec.copy(container = container))` would pass a test that
+ * only checked the container.
+ *
+ * `ConverterScreenContentTest` cannot cover this: it builds `ConverterActions` itself and never
+ * touches the ViewModel. That the *screen* calls these is #156's, and neither implies the other.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class SettingsEditsTest {
+
+    private lateinit var app: Application
+    private lateinit var viewModel: ConversionViewModel
+
+    @Before
+    fun setUp() {
+        app = RuntimeEnvironment.getApplication()
+        installTestWorkManager(app, Data.EMPTY)
+        viewModel = ConversionViewModel(app)
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    @Test
+    fun `choosing a preset replaces the whole spec`() {
+        viewModel.setPreset(OutputFormat.WEBM_VP9)
+
+        assertEquals(OutputFormat.WEBM_VP9.spec, viewModel.settings.value.spec)
+    }
+
+    @Test
+    fun `changing the container leaves both codecs alone`() {
+        // Moved off the default spec first, and that is load-bearing rather than tidiness. The
+        // default IS `OutputFormat.MP4_H265.spec`, so a `setContainer` that rebuilt the spec from
+        // that preset instead of from the current one produced an identical answer and the
+        // mutation went green. Editing the codecs away from the default first is what makes
+        // "the other two survived" an assertion rather than a coincidence.
+        viewModel.setPreset(OutputFormat.WEBM_VP9)
+        val before = viewModel.settings.value.spec
+
+        viewModel.setContainer(Container.MKV)
+
+        val after = viewModel.settings.value.spec
+        assertEquals(Container.MKV, after.container)
+        assertEquals("the video codec is not the container's to change", before.videoCodec, after.videoCodec)
+        assertEquals("the audio codec is not the container's to change", before.audioCodec, after.audioCodec)
+    }
+
+    @Test
+    fun `changing the video codec leaves the container and the audio codec alone`() {
+        // The transposition this guards against is real: setVideoCodec and setAudioCodec take
+        // different enum types, but a copy(...) naming the wrong field compiles wherever the types
+        // happen to line up, and the picker would silently set the other one.
+        val before = viewModel.settings.value.spec
+
+        viewModel.setVideoCodec(VideoCodec.VP9)
+
+        val after = viewModel.settings.value.spec
+        assertEquals(VideoCodec.VP9, after.videoCodec)
+        assertEquals(before.container, after.container)
+        assertEquals(before.audioCodec, after.audioCodec)
+    }
+
+    @Test
+    fun `changing the audio codec leaves the container and the video codec alone`() {
+        val before = viewModel.settings.value.spec
+
+        viewModel.setAudioCodec(AudioCodec.OPUS)
+
+        val after = viewModel.settings.value.spec
+        assertEquals(AudioCodec.OPUS, after.audioCodec)
+        assertEquals(before.container, after.container)
+        assertEquals(before.videoCodec, after.videoCodec)
+    }
+
+    @Test
+    fun `applying a suggestion replaces the spec without disturbing quality or engine`() {
+        // A suggestion comes from ContainerCapabilities when the current spec is invalid, so it is
+        // a whole spec by construction. What it must not do is reset the two settings beside it.
+        viewModel.setQuality(QualityTier.BEST)
+        viewModel.setEnginePreference(EnginePreference.FORCE_SOFTWARE)
+
+        viewModel.applySuggestion(OutputFormat.MKV_H264.spec)
+
+        val settings = viewModel.settings.value
+        assertEquals(OutputFormat.MKV_H264.spec, settings.spec)
+        assertEquals(QualityTier.BEST, settings.quality)
+        assertEquals(EnginePreference.FORCE_SOFTWARE, settings.enginePreference)
+    }
+
+    @Test
+    fun `changing the quality leaves the spec and the engine preference alone`() {
+        // Both neighbours are moved off their defaults first. Asserting against AUTO -- which is
+        // what `ConversionSettings` starts with -- let a `setQuality` that also reset the engine
+        // preference to AUTO pass, because the reset and the survival looked identical.
+        viewModel.setPreset(OutputFormat.WEBM_VP9)
+        viewModel.setEnginePreference(EnginePreference.FORCE_SOFTWARE)
+        val before = viewModel.settings.value.spec
+
+        viewModel.setQuality(QualityTier.BEST)
+
+        val settings = viewModel.settings.value
+        assertEquals(QualityTier.BEST, settings.quality)
+        assertEquals(before, settings.spec)
+        assertEquals(
+            "quality is not the engine preference's to change",
+            EnginePreference.FORCE_SOFTWARE,
+            settings.enginePreference,
+        )
+    }
+
+    @Test
+    fun `changing the engine preference leaves the spec and the quality alone`() {
+        // Off the defaults for the same reason as the test above: QualityTier.FAST is the starting
+        // value, so asserting it here would have been satisfied by a reset as readily as by a
+        // survival.
+        viewModel.setPreset(OutputFormat.WEBM_VP9)
+        viewModel.setQuality(QualityTier.BEST)
+        val before = viewModel.settings.value.spec
+
+        viewModel.setEnginePreference(EnginePreference.FORCE_SOFTWARE)
+
+        val settings = viewModel.settings.value
+        assertEquals(EnginePreference.FORCE_SOFTWARE, settings.enginePreference)
+        assertEquals(before, settings.spec)
+        assertEquals(
+            "the engine preference is not the quality's to change",
+            QualityTier.BEST,
+            settings.quality,
+        )
+    }
+
+    @Test
+    fun `editing past every preset leaves no matching preset`() {
+        // `matchingPreset` is what the settings sheet reads to decide whether to show a preset as
+        // selected or to say "Custom". Editing one field of a preset must drop it out of the list
+        // rather than leaving the old one highlighted.
+        viewModel.setPreset(OutputFormat.MP4_H265)
+        assertEquals(OutputFormat.MP4_H265, viewModel.settings.value.matchingPreset)
+
+        viewModel.setAudioCodec(AudioCodec.FLAC)
+
+        assertNull(
+            "an edited spec is no longer any preset, and the sheet says Custom",
+            viewModel.settings.value.matchingPreset,
+        )
+        assertNotEquals(OutputFormat.MP4_H265.spec, viewModel.settings.value.spec)
+    }
+
+    @Test
+    fun `cancelling with no active job does nothing rather than throwing`() {
+        // `activeWorkId?.let(...)` -- the null side. A user can reach Cancel through a state that
+        // has already finished, and taking the app down for it would be worse than doing nothing.
+        viewModel.cancel()
+
+        assertEquals(ConversionState.Idle, viewModel.state.value)
+    }
+}

app/src/test/java/org/libremediaconverter/model/ContainerCapabilitiesTest.kt

@@ -451,6 +451,99 @@ class ContainerCapabilitiesTest {
         }
     }
 
+    /**
+     * The video twin of `no audio track is accepted by every container in both modes`.
+     *
+     * Dead in production today, and deliberately so: every caller guards `NONE` before asking the
+     * matrix, so nothing reaches this arm through the app. **The asymmetry is the argument, not the
+     * reachability** -- its audio counterpart at the top of the same `when` has had a dedicated
+     * test since #136, and one of a matched pair being covered is how a later reader concludes the
+     * other was considered and exempted. It was not; it was simply missed.
+     *
+     * Not the same shape as the two `COPY -> error(...)` arms, which `docs/coverage-read-findings.md`
+     * records as a named exemption (F4). Those are guards that must not be provokable. This is a
+     * documented answer -- "no video track fits anywhere" -- and an answer is a thing to pin.
+     */
+    @Test
+    fun `no video track is accepted by every container in both modes`() {
+        Container.entries.forEach { container ->
+            listOf(CodecMode.COPY, CodecMode.ENCODE).forEach { mode ->
+                assertTrue(
+                    "$container should accept no video track ($mode)",
+                    ContainerCapabilities.accepts(container, VideoCodec.NONE, mode),
+                )
+            }
+        }
+    }
+
+    /**
+     * A suggestion that keeps the codec the user asked for, rather than falling back to the
+     * container's first encodable one.
+     *
+     * `repairVideo`'s third arm -- "the request is not a copy, and this container can encode it" --
+     * is the one that preserves intent, and it was the only arm of the four nothing reached. The
+     * property test above executes `repairVideo` on every case it walks and lands elsewhere each
+     * time: an explicit COPY that works, a source the container can carry untouched, or no video
+     * track at all.
+     *
+     * The route is indirect because it is the only one the app has. VP9 into WebM is a perfectly
+     * good video request; what makes it invalid is the *audio* -- WebM carries Opus and Vorbis, not
+     * AAC. So `validateAudio` refuses, `suggestions` looks for a container that can hold what was
+     * asked for, and MP4 can encode VP9. The suggestion has to come back carrying VP9: swapping to
+     * the container's first encodable codec would discard the choice the user made.
+     */
+    @Test
+    fun `a repaired suggestion keeps the video codec the user chose`() {
+        val invalid = ContainerCapabilities.validate(
+            OutputSpec(Container.WEBM, VideoCodec.VP9, AudioCodec.AAC),
+            h264Source,
+        )
+
+        assertTrue("WebM cannot hold AAC, so this spec is invalid", invalid is Validation.Invalid)
+        val suggestions = (invalid as Validation.Invalid).suggestions
+        assertTrue(
+            "expected a suggestion that still encodes VP9, got $suggestions",
+            suggestions.any { it.videoCodec == VideoCodec.VP9 },
+        )
+        assertEverySuggestionValid(invalid, h264Source)
+    }
+
+    /**
+     * The fallback in `firstContainerHolding`: when the input's own container cannot hold the
+     * codec the user asked for, any container that can will do.
+     *
+     * The preferred half -- "the container the input already uses" -- is what every other case
+     * reaches, because they all start from a file whose own container carries the codec in
+     * question. The elvis after it had never run.
+     *
+     * AVI is the input that makes it run: AVI predates H.265 and has no mapping for it, so asking
+     * an AVI for H.265 is refused, and the container the input already uses cannot be part of the
+     * answer. Without the fallback the only candidates left are AVI itself and the container
+     * holding the *source* codec -- also AVI -- so the refusal still offers something, but what it
+     * offers is H.264: the app quietly declines the codec the user asked for instead of moving them
+     * to a container that supports it.
+     *
+     * That is why this asserts the codec survives rather than that the list is non-empty. A
+     * non-empty assertion passes with the fallback deleted -- measured, not assumed.
+     */
+    @Test
+    fun `an input whose container cannot hold the requested codec is moved, not downgraded`() {
+        val aviSource = InputProbe(videoCodec = "h264", audioCodec = "aac", container = Container.AVI)
+
+        val invalid = ContainerCapabilities.validate(
+            OutputSpec(Container.AVI, VideoCodec.H265, AudioCodec.AAC),
+            aviSource,
+        )
+
+        assertTrue("AVI has no mapping for H.265", invalid is Validation.Invalid)
+        val suggestions = (invalid as Validation.Invalid).suggestions
+        assertTrue(
+            "expected a container that can actually hold H.265, got $suggestions",
+            suggestions.any { it.videoCodec == VideoCodec.H265 },
+        )
+        assertEverySuggestionValid(invalid, aviSource)
+    }
+
     @Test
     fun `resolving audio COPY before asking the matrix is required`() {
         // The audio twin of `resolving COPY before asking the matrix is required`, and the reason is

app/src/test/java/org/libremediaconverter/work/ForegroundTypeRegimeTest.kt

@@ -0,0 +1,88 @@
+package org.libremediaconverter.work
+
+import android.content.pm.ServiceInfo
+import org.junit.Assert.assertEquals
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.annotation.Config
+
+/**
+ * [ConversionForegroundType.current] answers differently on each of the three API regimes, and
+ * until this file only one of them was ever executed.
+ *
+ * `app/src/test/resources/robolectric.properties` pins the whole JVM suite to `sdk=36`, so every
+ * Robolectric test that reaches a `ForegroundInfo` takes the `mediaProcessing` arm and no other.
+ * The 33 and 34 arms were cold: 3 lines and 3 of 4 branches, measured on `main` at `d354f64`.
+ *
+ * **The instrumented test is not a substitute, and the reason is specific.**
+ * `ConversionWorkerTest.foregroundTypeMatchesTheRunningApiLevel` asserts against whichever API the
+ * leg happens to be — one arm per leg, never the other two — and the legs that would cover 33 and
+ * 34 are the ones issue #122 wedges. `docs/coverage-read-findings.md` records an API 33 run that
+ * reported `received: 60` and `failed: unknown`: the regime *was* exercised, and that leg could
+ * not have said so if it had broken. Four `@Config` classes here pin all three arms
+ * deterministically, in the same `./gradlew` invocation as everything else.
+ *
+ * `minSdk` is 33, so none of these is dead code — each is a device someone is running the app on.
+ *
+ * **SDK 35 is in the list for the boundary, not for the answer.** It shares its answer with 36,
+ * which would make it look redundant. It is not: relaxing `>= VANILLA_ICE_CREAM` to `>` is invisible
+ * at every level except exactly 35, so without this class that mutation survives the suite.
+ */
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [33])
+class ForegroundTypeApi33Test {
+
+    /**
+     * Zero rather than a named constant because there is no constant to name: API 33 does not
+     * require a type, and `mediaProcessing` does not exist here to pass. `ForegroundInfo` reads 0
+     * as "no type at all", which is what this regime wants.
+     */
+    @Test
+    fun `api 33 asks for no foreground service type`() {
+        assertEquals(0, ConversionForegroundType.current())
+    }
+}
+
+/**
+ * API 34 makes a type mandatory and still has no `mediaProcessing`, so `dataSync` is the only
+ * sensible fit. See [ForegroundTypeApi33Test] for why this file exists.
+ */
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [34])
+class ForegroundTypeApi34Test {
+
+    @Test
+    fun `api 34 falls back to dataSync, the only type that fits`() {
+        assertEquals(ServiceInfo.FOREGROUND_SERVICE_TYPE_DATA_SYNC, ConversionForegroundType.current())
+    }
+}
+
+/**
+ * The first level with `mediaProcessing`, and therefore the one that tells `>=` from `>`.
+ * See [ForegroundTypeApi33Test].
+ */
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [35])
+class ForegroundTypeApi35Test {
+
+    @Test
+    fun `api 35 is the first level that takes mediaProcessing`() {
+        assertEquals(ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROCESSING, ConversionForegroundType.current())
+    }
+}
+
+/**
+ * The level the rest of the suite runs at, asserted here rather than assumed — it is the one arm
+ * that was already covered, and leaving it out would make this file look like it is about the old
+ * levels rather than about all three regimes. See [ForegroundTypeApi33Test].
+ */
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [36])
+class ForegroundTypeApi36Test {
+
+    @Test
+    fun `api 36 keeps mediaProcessing`() {
+        assertEquals(ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROCESSING, ConversionForegroundType.current())
+    }
+}

app/src/test/java/org/libremediaconverter/work/JobSnapshotsTest.kt

@@ -16,6 +16,7 @@ import androidx.work.testing.WorkManagerTestInitHelper
 import androidx.work.workDataOf
 import kotlinx.coroutines.runBlocking
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Before
 import org.junit.Test
@@ -125,6 +126,39 @@ class JobSnapshotsTest {
         assertEquals(newer.absolutePath, Reattachment.choose(snapshots)?.job?.outputPath)
     }
 
+    /**
+     * A job in the tag query that never recorded an output path at all.
+     *
+     * Distinct from the three cases above, which all *have* a path and differ in what it names. A
+     * job still running, or one that finished without writing its result key, carries no path at
+     * all -- and `getWorkInfosByTagFlow` returns it alongside the finished ones, because the tag is
+     * the worker class and every attempt ever enqueued carries it.
+     *
+     * The guard is the `?.` in `path?.let(::File)`. Without it the null goes straight into a `File`
+     * constructor. What this pins is the consequence rather than the null check: such a job must
+     * not be offered as a result, so `Reattachment.choose` has to walk past it to the job that
+     * really produced a file. Choosing it would put a Converted screen in front of the user with a
+     * Save button that has nothing to save.
+     */
+    @Test
+    fun `a job that recorded no output path is not offered as a result`() {
+        val real = stagedFile("real.mp4", bytes = 4096)
+        finishedWithOutput(real)
+        finishedWithNoOutput()
+
+        val snapshots = snapshots()
+
+        assertEquals("both jobs carry the tag, so both come back", 2, snapshots.size)
+        val silent = snapshots.single { it.outputPath == null }
+        assertFalse("no path means no output, not an empty one", silent.outputExists)
+        assertEquals("and no time either, for the same reason", 0L, silent.outputModifiedAt)
+        assertEquals(
+            "the reattachment has to walk past it to the job that really produced a file",
+            real.absolutePath,
+            Reattachment.choose(snapshots)?.job?.outputPath,
+        )
+    }
+
     private fun snapshots(): List<JobSnapshot> = runBlocking {
         workManager.jobSnapshots(
             tag = ConversionWorker::class.java.name,
@@ -152,6 +186,11 @@ class JobSnapshotsTest {
         ).result.get()
     }
 
+    /** A job that carries the tag and no result key -- still running, or finished without one. */
+    private fun finishedWithNoOutput() {
+        workManager.enqueue(OneTimeWorkRequestBuilder<ConversionWorker>().build()).result.get()
+    }
+
     private companion object {
         /** Two fixed moments a day apart, so the ordering is stated rather than raced for. */
         const val OLDER_MS = 1_700_000_000_000L