[GLinnik21]

Fourth PR of the playback-refusal series (#918). It is stacked on #1061 (S2a), so the diff shown is S2b only.

The device's capability answer is fixed once more after boot. Stored refusals no longer change it in the background. Each play start now computes its own value: the boot snapshot less the install's stored refusals that apply.

Closes #1047

What changed

devcaps (platform/src/devcaps.rs)

• Layers (an RwLock<Arc<Caps>> plus flags) becomes Boot, held in a OnceLock that only probe sets. caps() returns the same Arc on every call.
• These are deleted: fold, apply_learned, project_stored_refusals, Refusal.firmware (the codename filter's only reader; the build string already identifies the firmware) and the test door caps_on_this_thread_for_test.
• New Caps::minus(rows, build) is pure. It narrows each row watched on build by refusal_ceiling, the same rule Caps::without uses.
• New devcaps::start_caps(stored) applies the debug flags to its input and returns the boot Arc itself when no row applies.

Session (plex/src/plex/session.rs)

• replace_cache no longer projects onto devcaps. project_native_audio_refusals is deleted.
• Session::applied_refusals(&self) is a pure public method that keeps S2a's rule: named rows, plus rows proved LEARNED_REFUSAL_PROOFS times.

The play-start edge (src/app/playback.rs)

• start_caps() reads session::peek() once and feeds every production play start: request_play, request_play_movie, request_preview and request_play_queue_item, at the 9 sites in app/playback.rs, app/content.rs, app/playback/queue_transport.rs and dev/scenarios.rs.
• Retry and the in-flight re-resolve still reuse the request's attempt (Route: one capability value per playback request; the planner reads no global #1054).

Readers that must see learned rows

• The track menu's "converted by your server" mark now reads the play's attempt: audio_converted_by_server(ps, ..), with ps threaded through track_menu.rs.
• The detail facts row reads start_caps(&peek().applied_refusals()).
• Without these two changes, both would show a refused track as direct-playing.
• The engine's video reads, diagnostics and the lab snapshot stay on the boot value.

Behaviour changes

• S2a's interim note about asynchronous learning is resolved. No reader depends on caps() changing any more. A refusal recorded in this run applies from the next play start once its queued write has landed.
• Unwritable storage. A named refusal is lost along with the session's cache, the same way every other preference is. The next play is refused once, and the recovery ladder converts it. The recovery machine stays per-request: it does not carry refusals between plays.
• plxnative-nativeaudioforget ignores every stored row, including one recorded this run. -wide without -learn, or a set that reports no codename, records nothing and applies nothing.
• The start value can rise again. While the session cache is unloaded, peek() is empty, so a play started in that window plans without stored rows. It is refused once, then converted.
• Diagnostics and the lab snapshot now show the boot audio set. A learned row in force appears in the event log as the new per-play line devcaps: play start less learned refusals (N stored) -> audio=… channels=…. That line replaces the boot fold line.
• The converted mark follows the playback's own direct-play mode. A setting changed mid-playback moves it at the next request.
• Cost on a set that has learned a row. The facts row runs start_caps on each detail-hero paint. With no stored rows this is one peek() and the boot Arc. With a row in force, each paint also pays one Caps clone and minus.

Tests

New or rewritten:

• caps_is_one_arc_across_a_recorded_refusal (plx_plex). Red on the base: the stored row moved caps(): opus ceiling None -> Some(2). Its save(&peek()) runs the projection path that production ran.
• applied_refusals_hands_over_named_and_twice_proved_rows_only (plx_plex).
• devcaps:
  • the_start_lacks_an_applied_row_and_keeps_the_boot;
  • the_debug_flags_decide_which_stored_rows_the_start_applies (five flag cases);
  • a_build_change_clears_the_rows_from_the_start;
  • the_boot_readers_see_one_unchanged_value.
• Four devcaps tests ported from apply_learned to minus.
• the_converted_mark_reads_the_attempt_not_the_boot (plx_media).
• the_facts_row_reads_the_start_value (plx_media).
  • On the base it is red only in the host rig, where the storage worker's projection never reaches the test thread: the facts row promised Direct Play for a combination this install watched the pipeline refuse.
  • It does not reproduce a production defect at the base. There, the worker's fold did narrow the global once the write landed.
  • It guards S2b's contract: put the facts row back on caps() and it fails.
• Hostsim rig (pump.rs):
  • the_next_play_starts_without_a_twice_proved_dts_surround asserts through start_caps and checks that caps() is untouched;
  • one proof leaves the next start on the boot Arc;
  • three rig tests now read the record at the start edge instead of a moved caps().
• a_dca_track_direct_plays_on_a_set_with_a_dts_row drops the thread door and passes, so nothing on that plan path reads caps().

The remaining new tests use new APIs, so their red was a compile failure.

Crate suites on the committed tree:

• make test-crate C=plx_platform: test result: ok. 308 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
• make test-crate C=plx_plex: test result: ok. 743 passed; 0 failed
• make test-crate C=plx_media: test result: ok. 1804 passed; 0 failed; 64 ignored
• make test-hostsim C=plx_media: test result: ok. 1990 passed; 0 failed; 64 ignored
• make test-crate C=plx_appkit T=track_menu: test result: ok. 151 passed; 0 failed; 199 filtered out
• make test-crate C=app: test result: ok. 1059 passed; 0 failed
• make check-nodef: clean.
• check-deps and check-module-layers: green.

ci/allow/*, ci/machines.ini and ci/list-caps.ini are unchanged. make check and the ARM build are left to this PR's CI.

Docs

• player/CLAUDE.md: where a stored refusal reaches a play, the new log line, and the forget semantics.
• docs/sans-io.md: caps() is write-once; the facts row reads the start value and the track menu reads the attempt.
• devcaps, session and recovery.rs comments.
• The globals-ledger test's docstring in tests/test_harness.py.

🤖 Generated with Claude Code