Close out session: publish-apk SSH verified, mark 09-21 handover supersededHEADmain

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sj3CoWEedM56bebByKgNxA

2 files changed, 29 insertions, 30 deletions

diff --git a/listen-handover-2026-09-21.md b/listen-handover-2026-09-21.md
index 0fdd482..2aa6e8a 100644
--- a/listen-handover-2026-09-21.md
+++ b/listen-handover-2026-09-21.md
@@ -1,37 +1,31 @@
 ---
 name: listen-handover-2026-09-21
-description: State of the Listen app as of 2026-09-21 end of session — artwork/player/queue-reorder committed but unverified on-device; publish blocked on host name
-metadata: 
+description: "SUPERSEDED — 2026-09-21 handover (artwork/player/queue-reorder); both its open items are resolved, see project_listen_tier3_fingerprinting.md for current state"
+metadata:
   node_type: memory
   type: project
   originSessionId: 0e4bffd6-5847-4b40-9037-6bfb9055e654
-  modified: 2026-09-21T22:00:48.962Z
+  modified: 2026-09-27T00:51:05.003Z
 ---
 
-Commit `84ec886` ("Add artwork, a real player screen, and queue drag-reorder") landed on `main`,
-(recorded here as `7f634ca` originally — that SHA is not in the repo, so the commit was
-amended before pushing; `84ec886` is the one that exists)
-gate-green (COVERAGE_EXCEPTION used for the expected Media3-glue drop, matching the four prior
-uses in `listen/CLAUDE.md`). Implements the plan at Phase 2 pre-work Peter chose: artwork
-(Coil3, pinned to 3.3.0 — later versions need a newer Kotlin/Compose than this project runs),
-a real player screen (scrubbing, per-show persisted speed), and queue drag-and-drop reorder
-(`sh.calvin.reorderable`). Android Auto real-car verification is still deliberately deferred.
+**Superseded as of 2026-09-26.** This originally recorded two open items from the artwork/
+player-screen/queue-reorder commit (`84ec886`); both are now resolved and this file is kept only
+for the historical note on the amended-commit SHA mismatch, which cost a future session real time
+once already.
 
-**Not yet done, pick up here:**
-- **Never verified on a device.** No phone was connected this session (`adb devices` empty).
-  Build succeeded (`assembleDebug`), but nobody has actually looked at artwork rendering,
-  scrubbing, per-show speed persistence, or drag-reorder in the app. Do this first.
-- **Not published.** `/workspace/devtools/bin/publish-apk` refused: it's hard-gated to a host
-  named `tungsten` (the deploy box), and this session ran on `fedora`. That gate is deliberate
-  (its own comment: bypassing it once caused a "deploy to a sandbox" mistake). This needs a
-  decision from Peter — publish from wherever `tungsten` actually is, or explicitly add `fedora`
-  to the allowlist in `/workspace/devtools/bin/publish-apk` — not something to route around
-  silently.
+- The artwork/player/drag-reorder work was verified on-device in a later tungsten session (see
+  [[project_listen_android_auto]] and the Phase 2 commits that followed — Phase 2 as a whole,
+  including Tier 3 fingerprinting, is now complete).
+- `publish-apk` no longer needs to run on `tungsten` itself: it now takes `PUBLISH_SSH=tungsten`
+  from another machine (Fedora) and sends the file over ssh, verified working
+  2026-09-26 (published `listen-debug.apk` from Fedora successfully). See `devtools/README.md`
+  for usage; no memory entry needed beyond this pointer since the capability is documented in
+  the repo itself.
 
-**Why:** the session hit its weekly limit mid-flow; Peter needed to reboot to get device access
-working and asked to just get the code built and committed rather than wait.
-**How to apply:** next session, check `adb devices` first — if a phone is present, sideload via
-`android-launch-check` and actually exercise the four features before considering this done.
+**Historical note, still worth keeping:** a commit made this session was recorded here as
+`7f634ca`, which turned out not to exist in the repo — it had been amended before pushing, and
+the real SHA was `84ec886`. A future session hunting for a commit that was never actually pushed
+under the SHA a handover cites should suspect this class of mismatch, not assume the memory is
+simply wrong about which repo it's in.
 
-See also [[fedora-android-build-setup]] (still the environment this all ran under) and
-[[workspace-layout]].
+See [[workspace-git-remotes]] and [[project_listen_tier3_fingerprinting]] for current state.
diff --git a/project_listen_tier3_fingerprinting.md b/project_listen_tier3_fingerprinting.md
index a7f4d06..9720708 100644
--- a/project_listen_tier3_fingerprinting.md
+++ b/project_listen_tier3_fingerprinting.md
@@ -5,7 +5,7 @@ metadata:
   node_type: memory
   type: project
   originSessionId: 0e4bffd6-5847-4b40-9037-6bfb9055e654
-  modified: 2026-09-26T22:58:51.673Z
+  modified: 2026-09-27T00:51:13.020Z
 ---
 
 Commit `4e37185` on `listen` (pushed to tungsten) adds Tier 3 of the skip feature: detecting a
@@ -44,5 +44,10 @@ to), re-fetch that show's episodes on a real *time delay* before concluding the
 **Not yet verified on a device** — no phone was connected this session. In particular:
 `MediaCodecClipSource` (the MediaExtractor/MediaCodec decode loop) has never run on real hardware,
 and the `MigrationTest` 6→7 case has never run on an emulator/device either. Both need a real run
-before this is trusted with real playback — check `adb devices` first next session, per
-[[listen-handover-2026-09-21]]'s own standing note about that.
+before this is trusted with real playback — check `adb devices` first next session.
+
+**The build is published and ready to sideload**, though: `listen-debug.apk` at
+`https://static.terst.org/files/listen-debug.apk`, sent from Fedora via
+`PUBLISH_SSH=tungsten publish-apk ...` (devtools gained this 2026-09-25; no more need to run
+`publish-apk` on tungsten itself). That APK includes this Tier 3 commit. Device verification is
+the only thing left before this is trusted.