docs: reconcile README, design and harness docs with shipped behavior

README.md

@@ -16,8 +16,8 @@ the TV surface reuses the shared data, domain, theme, and component layers.
 Mobile, on the emulator harness against the live API:
 
 - OAuth sign-in through an Auth Tab, with the session in Android secure storage
-- Files: browse, paginate, sort per folder, rename, move, trash, delete, and
-  watched progress on media rows
+- Files: browse, paginate, sort per folder, rename, move, trash, delete, copy
+  items shared with you, and watched progress on media rows
 - Trash: browse, restore one or all, delete permanently, empty
 - Transfers and search
 - Video playback with subtitles, 10-second touch seek, autoplay next, and
@@ -55,15 +55,15 @@ TV:
   the account's Trash setting. Center on a media row plays it full-screen
   through Media3 (HLS or MP4 per the account's playback type) with a
   play/pause overlay, a D-pad seek bar (Left, Right, rewind and
-  fast-forward scrub), a resume prompt, and Language, Subtitles and Speed
-  pickers; subtitles start from the account's settings. Back dismisses a
-  picker, then seek mode, then the controls, then returns to the row. The
-  player publishes a media session for system media controls and remote media
-  keys
-- Search through the system IME, with recent-query chips and paged results
-  that open in Files
-- History grouped under relative-date headers; an event opens its file in
-  Files, and Clear confirms first
+  fast-forward scrub), a resume prompt, Language, Subtitles and Speed
+  pickers, and autoplay next; subtitles start from the account's settings.
+  Back dismisses a picker, then seek mode, then the controls, then returns to
+  the row. The player publishes a media session for system media controls and
+  remote media keys
+- Search through the system IME, with recent-query chips and paged results;
+  a video or audio result plays, anything else opens in Files
+- History grouped under relative-date headers; an event opens its file as a
+  Search result does, and Clear confirms first
 - Account: identity and quota header, Playback and Storage settings saved
   through the shared settings controllers, App and device information with a
   Diagnostics dialog, and Sign out

design/README.md

@@ -60,19 +60,21 @@ and are tinted by Compose at the point of use.
 
 # Mobile video
 
-Video opens in immersive fullscreen with sensor landscape on phones. Tablets
-and multiwindow use the available window. Back restores the shell's orientation
-and system bars. Controls auto-hide during playback; tapping reveals them,
-and system navigation remains available by an edge swipe. TalkBack and keyboard
-navigation keep controls visible.
+Video opens in immersive fullscreen. On phones, a landscape video turns the
+window to sensor landscape; a portrait video keeps the window's orientation.
+Tablets and multiwindow use the available window. Back restores the shell's
+orientation and system bars. Controls auto-hide during playback; tapping
+reveals them, and system navigation remains available by an edge swipe.
+TalkBack and keyboard navigation keep controls visible.
 
 The overlay has a back arrow and raw filename, screen-centered play/pause and
 ten-second seek buttons, and a compact timeline with inline timestamps. Audio,
 Speed and Captions share a centered row of 20dp icons and labels. A dimmed overlay
 protects transport contrast without separate decorative button circles.
-Captions are always discoverable: Media3's supported tracks determine the list,
-including embedded tracks absent from API subtitle metadata. Sheets retain the
-existing speed, audio, and caption choices across player recreation.
+Captions are always discoverable unless the account hides subtitles
+(`hide_subtitles`): Media3's supported tracks determine the list, including
+embedded tracks absent from API subtitle metadata. Sheets retain the existing
+speed, audio, and caption choices across player recreation.
 
 Hierarchy references inspected through Mobbin:
 [Netflix](https://mobbin.com/screens/2070ec46-5424-4a50-acf2-9f5f90d39b79) and

docs/behavior.md

@@ -103,8 +103,9 @@ Friends' shared files (`is_shared`) and the shared folders (`SHARED_ROOT`,
 `SHARED_FRIEND`) accept no owner mutations, so neither surface offers Rename,
 Move, Move to trash/Delete or Mark as watched/unwatched on them. Download and
 Share file (which downloads the original, then opens the share sheet) stay on
-shared files, as web and iOS keep Download. On TV, Menu on a shared folder
-opens nothing.
+shared files, as web and iOS keep Download. On TV, a shared media file offers
+only Open in VLC, as tv-native does, and Menu on any other shared item opens
+nothing.
 
 On mobile, a friend's shared file or folder, and anything inside one, offers
 Make a copy, as web and iOS do; the shared root and each friend's folder

docs/design-v3-discrepancies.md

@@ -12,8 +12,9 @@ The design contract records these Android adapter behaviors:
 - Navigation indicator geometry remains Material-owned. The current Compose
   Material 3 Expressive implementation renders `56x32dp`, not the older
   `64x32dp` preview value.
-- Android TV file-row glyphs use `42px` on the 2x card and `21dp` on the xhdpi
-  emulator.
+- Android TV file-row glyph size remains Compose for TV-owned:
+  `ListItemDefaults.IconSize` renders `32dp`, not the preview's `42px` on the
+  2x card.
 - The phone scheme includes the secondary, container, background and inverse
   roles used by stock navigation, bottom-sheet, FAB and snackbar components.
 - Compose for TV receives the equivalent container and inverse-role projection

docs/harness.md

@@ -893,8 +893,8 @@ reaches it on the next session validation.
 Long-press Center or press Menu on a Files row for the oracle's files-actions
 state: a centred dialog titled with the file's name, one full-width button per
 action and Cancel last, the first action focused; a row with no actions (a
-shared folder, or a text row before the trash setting is confirmed) opens
-nothing, as in tv-native. Open in VLC hands the
+shared item that is not media, or a text row before the trash setting is
+confirmed) opens nothing, as in tv-native. Open in VLC hands the
 original `/files/{id}/stream` URL to `org.videolan.vlc` with `ACTION_VIEW`; a
 dialog explains when VLC is not installed. Mark as watched writes the video's
 duration as its position and Mark as unwatched clears it; both appear only
@@ -925,7 +925,8 @@ row on the server value and offers Try again above the section. Choose your
 proxy loads `/tunnel/routes` when it opens and lists the direct route first;
 Video playback type lists MP4 above HLS (default) as the oracle does. Turning
 Trash off confirms first with Cancel focused. Keep account history flips the
-History pane. Video playback buffer size stays out: there is no server key.
+History pane. Video playback buffer size stays out: TV always buffers as
+tv-native's default ([TV playback](./behavior.md#tv-playback)).
 Every dialog returns focus to the row that opened it. Settings are the shared
 test identity's, so read them before a proof and restore what you flip: