# Riff 1.1.0 — direct catalog consumption > Owner: cold catalog admission, Player browse representation and on-demand binding resolution. > Adopted for 1.1.0; replaces inherited rules in these scopes. ## Committed catalog admission After selected application-data root admission, Indexer MUST expose the latest compatible committed Player MDIA/ALBM/ARTS/GNRV cohort before initializing scanning or its mutable factual graph. Read CURRENT once; verify the content-named MANIFEST checksum, then inspect every declared member's actual size. A size mismatch rejects the candidate without hashing its payload. Only when all sizes agree, verify every member's XXH3-64. Only after integrity succeeds, read identifiers and header versions, generation, identity scheme and metadata revision for compatibility/cohort agreement. Return read-only descriptors for the exact verified inodes. CURRENT/PREVIOUS recovery and selected root/relocation fences remain authoritative; never enumerate directories to choose a replacement. Startup MUST NOT repeat semantic or cross-reference validation, decode all records, reconstruct catalog entities, check source-media presence or wait for a new scan. Integrity proves unchanged bytes of a previously producer-validated immutable publication. Header checks remain bounded. Factual persistence follows the same integrity-first admission rule; allocating its working graph belongs to subsequent Indexer work and MUST NOT block descriptor delivery. The integrity/admission phase for the measured 6.24 MB reference cohort on the release-reference HU MUST finish in less than 1,000 ms. Report its monotonic start/end separately from Activity launch, configuration, browser readiness and Media3 readiness. The broader cold-start deadline remains owned by [engineering verification](/Riff/LATEST/engineering-verification#performance-and-verification). Loss of mapped backing storage after admission remains the accepted storage risk; no speculative media scan or cross-root fallback is added. ## Publication validation Indexer computes derived catalog membership, ordered occurrences, references and complete semantic validation before activating a new immutable publication. Failed candidates leave the previous cohort usable. An unchanged pass creates no new publication/generation. Repeated startup readers trust these committed facts after integrity and compatibility checks. Publication ordering checks MUST NOT materialize the previous snapshot merely to compare its header watermarks. ## Player browse representation Player MUST retain mapped catalogs and compact indexes/references, not a complete recursive BrowserItem/metadata graph or separate full Music/Books trees. Create display-row objects for the current page and bounded prefetch. Profile mode/overrides, ordering and search are views over the same cohort. Compact indices and comparison keys for an opened collection are permitted; normalize keys once rather than in each comparison. Folder child indexing may make one linear pass over raw parent/identity fields; it does not decode every node's attributes or construct nested row objects. Navigation and lookup operate by catalog/context identifiers. Queue creation, reaction membership, playlist lookup and current-track lookup MUST NOT force a recursive full-browser traversal. A lazy children list alone does not satisfy this rule if consumers materialize the complete graph. Snapshot-local record indices never become durable identities. New generations are accepted atomically; existing consumers retain their immutable backing bytes for their required lifetime. ## Prepared collection views Album/Artist/Genre key access MUST read ready identity/presentation and prepared view facts; it MUST NOT enumerate member tracks, classify media, resolve bindings or create preceding display rows. Prepare compact effective Book/Music membership once per immutable cohort and relevant profile classification revision, off the UI thread. Music and Books views share those facts. Profile filtering does not regroup Indexer entities. Preserve mixed membership, override precedence and SHRT resolution. A changed view is activated atomically with stale-profile/cohort/session fences. Prepare collection comparison/A–Z keys and ordering off-main and reuse them for that immutable collection view. Lazy initialization MUST NOT transfer an unbounded preparation pass or its wait to the UI thread. Navigation and breadcrumbs resolve catalog IDs through the catalog index and compact view-position/membership indices; they MUST NOT linearly instantiate/search preceding rows. The ID index is separate from alphabetical presentation order. Display rows remain page-bounded. ## Fragment containers in Folders A physical media file with admitted usable FILF structure is presented as a virtual directory. Its children and Play/Add expansion contain only the corresponding ordered FILF occurrences, never a `Full file` entry. Retain the base MEDIA in the catalog for uniform source/artwork/binding facts. Without admitted usable structure, the physical file remains an ordinary track. Temporary section unavailability does not change an admitted container back into a full-file track. Use the corresponding ready ALBM Album name, with the existing CUE/tag priority, normalization and Mojibake owner; Player MUST NOT invent another title-selection, parsing or repair rule. If one physical file participates in several admitted Albums, expose one virtual directory per ALBM with that Album's FILF positions for that file. Do not choose one competing title arbitrarily. Keep physical-copy occurrence/binding context and repeated positions. Recursive Folder Play/Add obeys the same fragment-only expansion. Virtual directory identity is 64-bit XXH3 of the source-occurrence identity and Album.ID, under the existing content-ID framing; it is not Media.ID. ## Queue and binding resolution Queues retain ordered Media.ID occurrences and their context, including repeats, fragment bounds, NULL-queue/book continuation and bookmarks under their existing owners. Queue construction does not resolve/check the physical source of every entry. Resolve only the current occurrence and bounded playback prefetch. FILF structure and album membership are already Indexer facts; Player never reparses source metadata or regroups them. Before decoder consumption, Player's common source resolver checks that the selected binding exists and can be opened for reading. Prefer the binding of the exact selected/restored occurrence, then try equivalent sources in deterministic catalog order. Actual availability at this point determines the first usable binding; cached availability is not proof that a file still exists. Browsing and catalog admission perform no such media-presence probes. Missing sources are handled without starting a decoder for that source. Opening may still race removal, so ordinary open failure retries the next permissible binding; exhausted bindings use the common playback failure policy. Never splice another source after decoder-consumed reads have started. ## Verification Verify checksum/size/header ordering, valid PREVIOUS fallback, producer rejection of invalid references, lazy bounded rows, profile sorting/A-Z, exact/repeated queue occurrences, Book/NULL continuation, physical-copy preference, missing-first binding fallback and descriptor lifetime. After installation, measure cold process starts and a reboot on HU with retained current data. Record catalog admission, browser and Media3/audio milestones independently; Activity launch time alone is not acceptance. No physical power-cut result is inferred from reboot testing.