android: what the device has actually been tested for — the map, and the steps it could close

Most of this port is proven against an object in memory and only some of it
against the phone, and nobody had written down which was which. Writing it
down found four phone steps — `library-ambience`, `queue`, `lyrics` and
`community` — named and screenshotted with no entry in `PHONE_EXPECT` at all,
and the driver reads a missing key as a pass, so all four had been green since
the rounds that wrote them; they have assertions now, tolerant of Kyle's own
library and of nothing else.

Thirty-three more steps move onto the device: everything that can be proven
there without downloading, joining, sending, signing in or writing to his
library. The library's shape and its sort (nav state, not config), a local
track's sheet off a real path, Search's recents out of this WebView's own
storage, a queue row's sheet opened and not tapped, the walk's own playlist
with a row removed and put back by Undo — the first round trip that stash has
made through real SQLite — the import review's Keep switch restored before the
draft is created, the sleep timer set and put out by the next step, the
stream-cache chip and the Wi-Fi-only guard read first and restored last, and a
port the core has to refuse.

ANDROID.md carries the map beside Verifying: what the device walk proves (121
named steps, up from 88, plus the seven things after the loop that no mock can
do), what stays mock-only and why — needs `__ssMock`, needs a fresh install,
needs a viewport the phone walk refuses to set, needs the dev flavour, or
would download, join, or destroy his data — which six of the new steps are
conditional on what his own library happens to hold, and what still needs a
person. No product code in this round: four inserts in the phone half of
smoke.mjs, one in the doc.

ANDROID.md

@@ -1350,6 +1350,110 @@ takes the lock-screen card's still last, because it leaves the phone locked;
 `--only-lock` takes just that still of whatever is on the bar (resuming it if
 paused) without the walk.
 
+### What each walk actually proves
+
+The two step lists are not the same test, and which is which had never been
+written down. The mock walk is the bigger one (252 named steps) and the only
+one that can arm a failure, turn the phone over or answer as a fresh install.
+The device walk (121 named steps, up from 88) is the smaller one and the only
+one that touches a real core, a real library, a real audio thread and the
+system underneath them. The gap between them is where this list lives.
+
+Writing it down turned up four phone steps — `library-ambience`, `queue`,
+`lyrics` and `community` — that were named, screenshotted, and asserted
+against nothing at all: the driver reads `expect[s.name] ? expect[s.name](info)
+: true`, so a missing key in `PHONE_EXPECT` is a silent pass, and all four had
+one. They have expectations now.
+
+**Proven on the device.** Boot and its census; playback out of the real
+library; the ambience following a real cover — the accent is in the still and
+asserted by neither walk; the artwork viewer; the queue reordered, and a queue
+row's sheet opened; the lyrics face, the nudge, the per-track auto-sync
+switch, the tap room and the real-DSP estimate (all of it discarded); a reload
+that keeps the audio thread; a library track's own sheet, off a real path; the
+Library's shape, its sort and every one of its five tabs; Search and its
+recents; a playlist made, filled, dragged, a row removed and put back by Undo,
+filtered and deleted; four import doors — including the folder door on a real
+folder, and two of their system pickers dismissed with BACK — and the review's
+Keep-unresolved switch; the share-sheet intent; six of You's switches and
+chips written to the real config and read back out of it, then put back —
+volume normalization, word-by-word fill, the upload slots, the streaming
+ceiling, the embedded-cover size and the stream cache's retention — and the
+listening port both ways and a refused one; the sleep timer; the Wi-Fi-only
+guard; the shade's notice read back out of `dumpsys notification`; contacts
+read over real IPC; a cold artist page, its ⋯, the whole-discography page and
+its A–Z; the first-run preview with `setupWrites` at 0; eleven raw backend
+strings through `__ss.say`; and a refused transfer's sentence.
+
+Then, after the step loop, seven things the mock cannot do at all: a
+force-stop and the paused restore that follows it (waited out past the
+thirteen-second FGS-kill window), the position restored, playback resumed, the
+system media session and its ownership, media keys, ten seconds in the
+background with the position still advancing, and SoulStream's own mixer
+underruns.
+
+One block in the phone walk pulls bytes, and only when the app is signed in:
+the trailing network block types `--query` into Search, streams a peer's copy
+into the stream cache, and browses the raw peers and a share. Nothing else in
+either list downloads, joins, sends or signs in.
+
+**Mock-only, and why** (178 named steps). These are the reasons rather than a
+partition: a step can sit under more than one of them, and the last bullet is
+the only one that says a step could move and has not.
+
+- *Needs `__ssMock`* — the nine weather steps and the fifteen failure faces.
+  That object is the mock library's own door and does not exist in a real
+  build. The SENTENCES those screens print are proven on the device anyway, by
+  `trouble-words` and `trouble-xfer`; the screens that carry them are not.
+- *Needs a fresh install* — the ten `fresh-*` steps. On the device only the
+  preview door is walked, and it writes nothing.
+- *Needs a viewport override* — the nine landscape and portrait steps. A
+  `view` step on the phone walk is a deliberate failure, because a real
+  device's orientation is not the harness's to set, so the sideways layout has
+  never been seen on a device at all.
+- *Needs the dev flavour* — `diag` and `diag-back`. `devBuild` is
+  `import.meta.env.DEV` or the mock key, and the embedded build Kyle carries
+  reads false, so the row is not there to tap.
+- *Would download, save or rewrite his files* — the catalog, peer, browse and
+  Save steps, the cover re-fetch, the portrait refresh, chosen and pasted
+  lyrics, a saved sync, the vocal-reduced copy, a hero photo set.
+- *Would join, send or sign in* — rooms and their users, buddies, the contact
+  editor, the taste chips, a user looked up.
+- *Would change what is playing* — `queue-removed` and `queue-moved-up`. The
+  device opens that sheet and reads it; it does not tap a row in it.
+- *Destroys his data* — `history-confirm` and `history-cleared`. Never on his
+  phone.
+- *Structurally empty on this phone* — Home's feed sections and the Gaps
+  shelf. Follows live in the library folder and the phone's own folder starts
+  without any, so on the device `gaps` can only be asked to render and to stay
+  quiet.
+- *No reason but time* — not every remaining step has a reason above it.
+  These would be safe on the device and simply have not been moved: the
+  sheet's own Move-up and Move-down rows and a drag refused under a filter
+  (all three on the walk's own playlist), rename, unpin, `wifi-off`, the
+  empty search and the did-you-mean pair (both wanting a query his own
+  library can answer for), and the several `-again` steps that only put a
+  screen back. This round stopped where it stopped.
+
+**Conditional on the device.** Six of the new steps pass vacuously when his
+own data cannot produce the condition, and are named here so they do not
+become the next generation of silent passes: `gaps` (no follows),
+`queue-row-sheet` (nothing after the walked track), `playlist-drag-held` and
+the drag-refusal clause of `playlist-filter` (both need a playlist longer than
+one row — a one-track record makes a one-row playlist, and `reorder.js`
+refuses to lift a list that short), `import-keep-off` (a paste that resolved
+completely), and `you-keep` (the cache already set to Forever, which the step
+will not move because coming back writes the flag and not the number). The row
+count `playlist-row-sheet` stashes is what keeps the rest of that block from
+passing on a probe that read nothing.
+
+**Needs a person.** A live room joined and a message sent; a real Save over
+cellular with the Wi-Fi switch on; the lock-screen card (`--lockscreen` takes
+that still and asserts nothing about it); the first real export written
+through Android's create-document sheet, which the walk only ever dismisses
+with BACK; the phone physically turned sideways; and a genuine first run on a
+device that has never had the app.
+
 ## Not done yet
 
 Thirty rounds in, this is the honest map: what is deliberately absent, what