# Riff 0.1.3-rc — audit corrections and delivery

This is dated implementation and verification evidence, not an additional behavior contract. The
user authorized the audit corrections, documentation reconciliation, 0.1.3-rc version, commit/push
and installation on phone and HU.

## Implemented corrections

1. **Collision acquisition:** one guarded acquisition boundary now covers initial metadata and
   deferred Media.ID collision/fallback reads. Checkpoints retain newly discovered FAILEDL1
   observations in the working set; prepared results cannot resurrect them. Journal/control failures
   abort the pass instead of being mistaken for failed media. See
   [source failures](/Riff/LATEST/indexer-source-failures).
2. **Artwork cancellation:** slow provider cancellation is dispatched through a bounded canceller
   rather than invoked under the artwork-owner lock. Queue start and transitions do not wait for
   image-provider cancellation. Existing timeout, cache, stale-result and bounded retry policy
   remains under the [artwork owner](/Riff/LATEST/ui-foundation#physical-ui-and-artwork).
3. **Profile commands:** deferred reactions, AI/manual/bookmark queue commands and associated
   completions retain their originating store, profile and epoch. Serialized profile work and
   transactional admission reject stale queue activation after a profile switch. See
   [queue commands](/Riff/LATEST/player-queues).
4. **Long source identifiers:** the shared Android source-key constructor hashes the complete exact
   document URI into a fixed-width XXH3 field; long Unicode names no longer overflow the bounded RAM
   journal protocol. Names remain display data. See
   [reliable IPC](/Riff/LATEST/reliable-player-indexer-ipc).
5. **Partial album positions:** partial Disc/Track/total evidence joins a complete position only
   when there is one compatible maximal class. Missing fields cannot bridge declared repeats or
   conflicting positions. The chosen factual carrier preserves known position evidence without
   inventing tags. See [position owner](/Riff/LATEST/album-grouping-positions).
6. **Artwork after generation changes:** selecting an occurrence re-requests its exact resolved
   binding at the current library generation, including an already buffered next track. Empty
   selection and stale completion are guarded.
7. **Failed physical source opens:** a shared datasource retries remaining physical bindings after
   an IOException from opening a candidate and commits the chosen binding only after success.
   Exhaustion, repeated candidates and queue replacement are bounded. This does not promise failover
   after decoder consumption has begun.

Focused consolidation shares SAF path traversal between URI/artwork resolution, acquisition
guarding, source-key construction and profile-command context. Catalog construction reuses common
album-position evidence and indexed membership lookups. Accepted library cohorts reuse prepared
models while still resolving current grants. No broad mechanical file split or unmeasured
performance claim is part of this delivery.

The acquisition API documentation now describes the implemented optional revision check. Current
status separates installed APKs from the independently published website. The
[architecture map](/Riff/LATEST/architecture-decisions) routes these decisions to their owners.

## Source and signed artifact

Implementation commit **877febd94d960bfd21f370caac83df142459a398** was committed on main and pushed
to origin/main before the signed build. Its reviewed scope includes the previously pending,
user-authorized Indexer/album/UI/artwork changes as well as these audit corrections: 224 files,
12,762 insertions and 3,543 deletions. Build outputs, private device evidence and secrets are
excluded. Final delivery evidence is a separate documentation-only update after this source commit.

- Version: **0.1.3-rc**, versionCode **6**, **RC 261013**.
- APK: **riff-0.1.3-rc-261013.apk**, 106,962,128 bytes.
- APK SHA-256: **6a0c2bdb9e8ca233181f0a937dcd716a161b8bdf2e9ab55aa812cfe2bdce1cd9**.
- Signing certificate SHA-256: **8f1dce0e9f5ae50fbead23ddb3d60182f9af4b3a584481eeee1f3df5c499e67d**.
- Model SHA-256: **8819c2b3723d448dc63e92c12135a57eab00a3f867697439e4eb327bc6f32813**.

The release helper derives the application version from the Gradle owner. Signed build command:

```sh
python3 bin/build_release.py --output-dir releases/261013-rc-0.1.3
```

Cuetree format **10** and Player schema **15** are unchanged by these corrections. No migration,
partial conversion, working-package clear or full library reset was introduced. Older incompatible
formats still follow the existing complete-recreation contract.

## Automated verification

The current Gradle XML reports contain **674 JVM cases**, with zero failures, errors or skips:

| Module        | Cases |
| ------------- | ----: |
| Configuration |    27 |
| Indexer       |   163 |
| Player        |   298 |
| Cuegrain core |    46 |
| Cuetree core  |   134 |
| Cuetree CLI   |     6 |

```sh
./gradlew :configuration:test :indexer:testDebugUnitTest :app:testDebugUnitTest :cuegrain:core:test :cuetree:core:test :cuetree:cli:test :app:lintRelease :app:ktlintCheck :indexer:ktlintCheck :cuetree:core:ktlintCheck :app:assembleInstrumented :app:assembleInstrumentedAndroidTest --console=plain
```

The task graph passes, with unchanged Gradle tasks allowed to remain up-to-date. Android release
lint, pinned Kotlin formatting, signature/alignment, model and release checks pass.

**13 isolated Android cases pass on HU** against the final implementation. They cover slow
cancellation listeners, cache/recovery/stale artwork, profile-switch ordering with real SQLite,
physical-open alternatives/exhaustion/queue replacement and the real service source-resolution
boundary with a blocked artwork provider and generation invalidation. The disposable instrumentation
target is separate from the user's working package.

```sh
adb -s <HU> shell -n am instrument -w -e class link.roadio.riff.player.artwork.ArtworkCancellationInstrumentedTest,link.roadio.riff.player.artwork.PlayerArtworkLoaderInstrumentedTest,link.roadio.riff.player.artwork.ArtworkProviderRecoveryInstrumentedTest,link.roadio.riff.player.storage.ProfileCommandInstrumentedTest,link.roadio.riff.player.playback.BindingFallbackInstrumentedTest,link.roadio.riff.player.playback.ArtworkIndependentSourceInstrumentedTest link.roadio.riff.instrumented.test/androidx.test.runner.AndroidJUnitRunner
```

The exact executed class argument and result are retained in the private Android log. Device
addresses, media names, raw logs, screenshots and backup contents are not published here.

## Working-device verification

The same signed APK is installed on phone and HU. Installed bytes, certificate continuity, package
UID, first-install time and exact persisted SAF grants were compared before and after installation.
The phone retains two grants and HU one. Player backups remain private.

Actual Album Play, two visible FWD taps and a genuine automatic transition after a normal near-end
seek pass on both devices. The newly selected queue reached PLAYING after its loading state:

| Device role | Queue PLAYING observed | First FWD | Second FWD |
| ----------- | ---------------------: | --------: | ---------: |
| Phone       |                 699 ms |    532 ms |     591 ms |
| HU          |                 852 ms |    635 ms |     623 ms |

These are bounded command-to-observed MediaSession readiness samples obtained by coarse ADB polling.
An initial sample from the old phone queue is excluded. They are neither physical speaker-output
latency nor a controlled same-media benchmark. Once the seek settled, both automatic transitions
changed occurrence while remaining PLAYING without an observed new buffering event. No fatal
exception, ANR, out-of-memory or playback-error marker was found in these smoke-run logs. Both
devices were left paused.

Phone reconnection was necessary before installation; that transport interruption is not an
application failure. This delivery does not claim exhaustive absence of defects, long-running
indexing throughput, universal provider behavior or supported vehicle-host certification.

## Evidence and publication boundaries

Private evidence is under status/rc-0.1.3-261013/ on the canonical dev box: reviewed staged scope,
test reports, Android logs, signed-build log, release manifest, installation continuity receipts,
Player backups and playback samples. These files are not part of the public source commit.

Owning Wiki updates and exact outgoing archives were published and checked by API readback,
anonymous HTTP/title verification and whole-Riff visibility audit. Final delivery/worklog updates
use the same publication gate, followed by pinned Markdown and current-reference checks.

The [public website publication](/Riff/LATEST/website-release-261013) remains a separate, older
0.1.2-rc APK/source snapshot. Updating it was not part of this request.