Release 0.12.0

docs/architecture.md

@@ -0,0 +1,46 @@
+# Runtime boundaries
+
+The native service remains one translation unit because LG symbols are resolved
+at runtime. Its implementation headers share the context declared in service.c;
+they are included once in dependency order, not independent public libraries.
+Formatting must preserve include order (`SortIncludes: Never`).
+
+| Module | Responsibility |
+| --- | --- |
+| service.c | Runtime context, LG/Luna loading, registration and shutdown |
+| service_api.h | Start/stop, root restart, settings and autostart actions |
+| service_calibration.h | Bounded calibration lease, proposals, profiles, model discovery |
+| service_status.h | Read-only status serialization |
+| capture_loop.h | Scheduler, histogram acquisition, missing-data recovery and output |
+| receiver_stream.h | Independent, nonblocking receiver LED subscription |
+| source_bridge.h | Bounded color continuity during source transitions |
+| handover.h | Exclusive PicCap/histogram capture ownership |
+
+Connection stages are explicitly named in runtime_states.h:
+Disconnected → Connecting → Authenticating (when configured) → Layout → Subscribed.
+Any connection, authorization or parsing failure closes the connection and
+schedules a bounded retry. Up to eight buffered messages are consumed per tick,
+including ticks where no new bytes arrive. Buffer capacity and read budgets remain
+bounded. LED count/profile changes trigger a fresh layout subscription.
+
+The color bridge uses Idle → Holding → WaitingFrame → Fading → Idle. It holds the
+last histogram frame while PicCap starts, clears its priority before observing a
+fresh PicCap frame, then blends for 500 ms. The transition expires after 3 seconds;
+real black bypasses the fade. The opposite direction seeds histogram continuity
+from a fresh receiver frame. Capture ownership remains in handover.h; the observer
+never acquires LG capture. Stop cancels the bridge and releases owned resources.
+
+The UI calibration session uses Starting → Waiting → Measuring/Validating →
+Committing → finished. Each asynchronous callback checks its original session
+identity, so a cancelled session cannot modify a newly started session. Proposals
+remain unsaved until the user selects Save profile. The native lease still bounds
+the session if the UI disappears.
+
+UI action errors take precedence over transient status errors. Polling cannot
+erase them; starting the next action clears them. Receiver settings, capture state,
+calibration state and presentation errors remain distinct.
+
+VERSION generates app/package metadata and native/version.h. release.py tests
+portable logic locally, builds the ARM service and verifies the exact package.
+Hardware capture and Magic Remote behavior still require a later TV check; a host
+test is not evidence of LG hardware behavior.

docs/publishing-review.md

@@ -136,3 +136,24 @@ symlink were verified. Actual autostart disable/enable requests succeeded, with
 Autostart restored to On. No receiver color correction, WLED configuration or
 PicCap autostart setting was changed. A local browser preview was unavailable
 because the browser policy rejected file URLs; no alternate browser path was used.
+
+## Version 0.12.0
+
+Receiver stream processing now drains complete buffered messages when no new
+bytes arrive. A regression fixture buffers seventeen updates and verifies all
+three processing batches without additional socket writes. Action errors survive
+status polling and are cleared by the next user action. Tests also cover delayed
+calibration replies after cancellation and a new session.
+
+Connection and bridge states are named enums; UI calibration phases and session
+identity checks isolate asynchronous work. The native service is separated into
+runtime bootstrap, Luna actions, calibration, status and capture-loop modules.
+Production C and JavaScript are formatted consistently; include dependency order
+is preserved explicitly.
+
+VERSION generates app/package/runtime versions. release.py passes all JavaScript,
+portable native and Python version-drift tests, cross-compiles the ARM service and
+checks the IPK's embedded metadata, executable architecture, size and SHA-256.
+Package timestamps are deterministic. No TV installation, application launch or
+service restart was performed for this version while the user was watching a film.
+Live LG capture and physical remote validation remain pending for this release.

docs/release-0.12.0.md

@@ -0,0 +1,11 @@
+# HyperDRM 0.12.0
+
+- Process buffered receiver updates even when no additional network data arrives.
+- Keep action errors visible across background status polling.
+- Name connection, transition and calibration states; ignore stale calibration callbacks.
+- Split and format native service modules and application JavaScript.
+- Generate versions from VERSION and add a tested, reproducible release workflow.
+
+Validation: all portable native, JavaScript and Python version tests pass; the
+ARM IPK's embedded versions, architecture, size and SHA-256 match its manifest.
+This release has not yet been installed or validated on the TV.