Keep TV Recommendations enabled by default on SHIELD

.github/workflows/v2-tests.yml

@@ -228,6 +228,10 @@ jobs:
         working-directory: v2
         run: npm run test:device-logs
 
+      - name: TVRecommendations safety defaults
+        working-directory: v2
+        run: TVRECOMMENDATIONS_EVIDENCE=1 npm run test:tvrecommendations-safety
+
       - name: Launcher rows
         working-directory: v2
         run: LAUNCHER_CURATION_EVIDENCE=1 npm run test:launcher-rows
@@ -253,6 +257,8 @@ jobs:
             v2/screenshots/frames-light/
             v2/evidence/launcher-curation-2026-10-23/*-simulated.png
             v2/evidence/launcher-curation-2026-10-23/launcher-states-simulated.webm
+            v2/evidence/tvrecommendations-safety/*-simulated.png
+            v2/evidence/tvrecommendations-safety/caution-review-simulated.webm
           retention-days: 7
           if-no-files-found: ignore
 

v2/crates/core/data/app-lists/shield.json

@@ -55,17 +55,17 @@
   },
   {
     "package": "com.google.android.tvrecommendations",
-    "name": "Sponsored Content",
+    "name": "TV Recommendations",
     "method": "disable",
-    "risk": "safe",
-    "optimize_description": "Removes Sponsored / Top Picks rows on the stock Google TV home. Also removes the home-screen Watch Next rows that surface Apple TV / Netflix Continue Watching. No effect if you've switched to a custom launcher.",
-    "restore_description": "Restores sponsored and Watch Next rows on stock launcher.",
-    "default_optimize": true,
+    "risk": "high",
+    "optimize_description": "Disabling can remove stock-home recommendation rows and may stop key input from NVIDIA's SHIELD TV phone app after a reboot, even with a custom launcher. An external report covers darcy and foster_e devices on Android 11; other models and firmware are unverified. Keep enabled if you use the phone remote.",
+    "restore_description": "Re-enables TV Recommendations, including the reported phone-remote dependency. Recovery on your model and firmware has not been verified here.",
+    "default_optimize": false,
     "default_restore": true,
     "play_store": true,
-    "reviewed_at": "2026-05-29",
+    "reviewed_at": "2026-10-22",
     "sources": [
-      "git history (6d8106f)"
+      "https://github.com/Gathin23/cleanyourtv/blob/30626a8e4714f86bf837384b109b5c73ee736917/docs/TROUBLESHOOTING.md#shield-tv-phone-app-connects-but-no-key-does-anything"
     ],
     "device_scope": [
       "shield"

v2/crates/core/src/commands/loader.rs

@@ -122,6 +122,53 @@ mod tests {
 
     use crate::engine::{classify_with_catalog, CatalogVerdict, Safety, SafetySource};
 
+    #[test]
+    fn tvrecommendations_is_not_a_default_removal_and_explains_remote_risk() {
+        let bundle = load_embedded_app_lists().expect("embedded lists parse");
+        let entry = bundle
+            .shield
+            .iter()
+            .find(|e| e.package == "com.google.android.tvrecommendations")
+            .expect("SHIELD recommendations entry exists");
+        assert!(
+            !entry.default_optimize,
+            "phone-remote dependency must not be selected automatically"
+        );
+        assert!(entry.default_restore);
+        let verdict = classify_with_catalog(
+            &entry.package,
+            Some(CatalogVerdict {
+                risk: entry.risk,
+                description: &entry.optimize_description,
+            }),
+        );
+        match verdict {
+            Safety::Caution { reason, source } => {
+                assert_eq!(source, SafetySource::ReviewedCatalog);
+                for evidence in [
+                    "phone app",
+                    "reboot",
+                    "custom launcher",
+                    "darcy",
+                    "foster_e",
+                    "Android 11",
+                    "unverified",
+                ] {
+                    assert!(
+                        reason.contains(evidence),
+                        "missing consequence or evidence limit: {evidence}"
+                    );
+                }
+            }
+            other => panic!("expected Caution, got {other:?}"),
+        }
+        assert!(entry
+            .sources
+            .iter()
+            .any(|s| s.contains("30626a8e4714f86bf837384b109b5c73ee736917")));
+        assert!(!entry.optimize_description.contains("No effect"));
+    }
+
     /// The shipped lists, not a fixture. This is the assertion that would have
     /// caught the regression where 82 of 89 curated apps reported "role and
     /// effects unknown" beside their own description.

v2/evidence/tvrecommendations-safety/.gitignore

@@ -0,0 +1 @@
+raw/

v2/evidence/tvrecommendations-safety/README.md

@@ -0,0 +1,51 @@
+# TV Recommendations conservative safety correction
+
+The v2 SHIELD catalog previously described `com.google.android.tvrecommendations`
+as Safe, selected it for default optimization, and claimed custom launchers had no
+consequences. It now defaults to Keep and produces Caution, with original wording
+about a reported phone-remote dependency after reboot. Select all safe also leaves
+it on Keep. Explicit manual choices and the existing Restore default remain.
+No device action or engine behavior was added.
+
+Evidence is an [external report pinned at 30626a8](https://github.com/Gathin23/cleanyourtv/blob/30626a8e4714f86bf837384b109b5c73ee736917/docs/TROUBLESHOOTING.md#shield-tv-phone-app-connects-but-no-key-does-anything).
+It describes reboot comparisons on SHIELD darcy and foster_e devices running
+Android11. This project did not reproduce that hardware behavior. Model years,
+exact firmware builds and behavior on other devices are not inferred from package
+identity. This conservative default applies to the SHIELD catalog because retaining
+the package avoids a reported loss of remote input; it does not claim every model
+has been proved affected. Restore copy also leaves recovery unverified.
+
+Only the package identity and reported consequence were used as research evidence.
+The new catalog text and tests were independently written; upstream code and prose
+were not copied. The inspected upstream root license is MIT. No strict clean-room
+certification is claimed because upstream material was inspected.
+
+Local validation passed:
+
+- Shipped-data Rust regression: non-default removal, Caution, restore default,
+  pinned provenance and consequence/model limits.
+- Offline browser regression: full App List and Optimize consequence display,
+  default Keep, Select all safe exclusion and Restore Enable for simulated disabled
+  state. No removal command was issued.
+- Existing recommendation-label regressions, Svelte check (0 errors/0 warnings),
+  production frontend build and regenerated 16 dark + 16 light gallery frames/GIFs.
+- Workspace Rust tests: core465, desktop114 (one existing live test ignored),
+  mobile26, license2 and registry9 passed. Workspace fmt and clippy passed.
+
+Exact-head CI and independent review gate the PR. Local macOS checks do not prove
+all platforms. No real phone/TV commands, disabling, installs or APK execution
+occurred. Shared catalog data will affect mobile only when this change is integrated
+into its branch; this PR does not cross mobile's physical/release acceptance gates.
+
+[App List caution detail](caution-detail-simulated.png),
+[Optimize Keep and consequence](optimize-keep-simulated.png) and the
+[3.36-second video](caution-review-simulated.webm) are **SIMULATED**. Asset hashes
+are recorded in `visual-sha256.json`. The demo target is enabled to make the
+automatic-selection assertion meaningful; disabled restoration is a test-only
+fixture. Demo JSON was regenerated as common followed by SHIELD, including the
+existing Ambient Mode ordering correction without changing its data.
+
+Scope is the requested v2 catalog. The separately maintained v1 PowerShell entry
+still has the older default/description and needs a focused follow-up; it is not
+covered by this PR's validation. PR211's experimental catalog and its enrichment
+remain separate and unmerged, and PR180/PR163 gates are untouched.

v2/evidence/tvrecommendations-safety/clippy.txt

@@ -0,0 +1,8 @@
+    Checking shield-optimizer-core v2.3.0 (/Users/bryanroscoe/Developer/shield-tvrecommendations-safety-20261022/v2/crates/core)
+   Compiling tauri-plugin-atv-adb v0.1.0 (/Users/bryanroscoe/Developer/shield-tvrecommendations-safety-20261022/v2/mobile/tauri-plugin-atv-adb)
+   Compiling atv-optimizer-mobile v0.1.0 (/Users/bryanroscoe/Developer/shield-tvrecommendations-safety-20261022/v2/mobile/src-tauri)
+   Compiling shield-optimizer-v2 v2.3.0 (/Users/bryanroscoe/Developer/shield-tvrecommendations-safety-20261022/v2/src-tauri)
+    Checking adb_client v3.2.2 (/Users/bryanroscoe/Developer/shield-tvrecommendations-safety-20261022/v2/vendor/adb_client)
+    Checking atvopt-license v0.1.0 (/Users/bryanroscoe/Developer/shield-tvrecommendations-safety-20261022/v2/tools/atvopt-license)
+    Checking registry-triage v0.1.0 (/Users/bryanroscoe/Developer/shield-tvrecommendations-safety-20261022/v2/tools/registry-triage)
+    Finished `dev` profile [unoptimized] target(s) in 7.80s

v2/evidence/tvrecommendations-safety/visual-sha256.json

@@ -0,0 +1,5 @@
+{
+  "caution-detail-simulated.png": "24337fa09821a27b121dc3bfb9609bc0292a3bef0dac211410db6424cd02c737",
+  "caution-review-simulated.webm": "9453e6c4c5ba7b88fe00614863ca4b51897cc8fd9fc546c441450182c5fc6450",
+  "optimize-keep-simulated.png": "4f782b1a92fe7c1a67e8d8b48f7f4e2a3f127d9f1050ebcafbb544bec85e074f"
+}