NinaPlayer R15.3 physical product verification
checkpoint: 0.15.0-r15.3
date: 2026-08-13
status: PASS for tested ARM64 debug product flow and public HTTPS support service

Host/build
----------
- core unit tests: PASS
- app debug unit task: PASS (no app JVM test sources)
- ARM64 debug APK: PASS
- ARM64 AndroidTest APK compilation: PASS
- x86_64 debug APK + AndroidTest APK compilation: PASS after compatibility regression fix
- website Node tests: PASS
- full deterministic source verification: PASS (431-file manifest; verify-all exit 0)

Physical Xiaomi Android API 36 / ARM64
--------------------------------------
- required audio permission and automatic MediaStore scan: PASS
- real existing library and /MP3 folder discovery: PASS
- local fuzzy search, folder/artist playback and 66-item direct queue: PASS
- repeat, shuffle and radialista controls: PASS
- exact last song/position restored paused after reinstall/relaunch: PASS
- deferred AI playlist suggestions: PASS
- real Alibaba/Qwen playlist planning and immediate playlist actions/status: PASS
- real yt-dlp search/selection: PASS
- real YouTube download: PASS
- real transcode, MediaStore publication and repository reconciliation: PASS
- real published `Yesterday (Remastered 2009)` playback: PASS
- Android MediaSession state/metadata/duration: PASS
- live download pause/continue/cancel UI: PASS
- support submission through hidden diagnostic UI: PASS
- app/API key survived upgrade installs: PASS
- fatal Java/native crashes and ANRs observed in accepted flow: 0

Public service
--------------
- HTTPS website and health endpoint: PASS
- Certbot certificate installed: PASS
- app-originated diagnostic stored in PostgreSQL: PASS (NINA-053732D1D4)
- stored payload forbidden-value audit: SANITIZED
- existing dev11 site/vhost modified: NO

Environment note
----------------
- The pre-existing API 34/35/36 AVDs hung in QEMU CPU threads during this final continuation despite
  `/dev/kvm` being installed, accessible and reported usable. No retry was counted as a product pass.
- Destructive instrumentation classes were not run on the user's personal phone. The safe contracts compiled;
  installation of the separate AndroidTest package was rejected by the phone's install-via-USB policy.
- The prior source-frozen R15.2 emulator campaign remains the accepted 882/882 automated baseline.

Deliberate exclusions
---------------------
- private release signing: NOT RUN — no release signing identity was supplied
- production two-device WebRTC/ICE/TURN: NOT RUN
- second physical target device: NOT RUN
