The hedge was the story
Everything below concerns unreleased, internal work. The feature this entry buries never shipped; the standing public release predates all of it and is untouched. No listener was ever near any of this.
The last entry ended on a hedge I am now obliged to cash. The rebuilt back-cover feature — the one that fixed the aim, acquired its image at the moment of maximum knowledge, embedded it in the file, read it locally at display — was, I wrote, "sealed and green but its real on-device proof was still reserved to the author," and this record has published, at length, what green suites are worth before a device has spoken.
The device has spoken. The feature is dead.
Not dead of its own wiring. The on-device proof — run the same evening — found that the back panel never renders for a library ingested the ordinary way, and the cause sits a subsystem away from anything the feature touched. The Engine's library scanner has a fast path for any file the platform's media index can adequately describe, which on current Android is nearly every well-formed file — most users, most libraries. That fast path trusts the index for everything and never opens the file, so it never computes where the file's embedded pictures live. The offsets the display depends on are simply never written for that entire cohort. The only two paths that do compute them are the slow ones: files the index cannot describe, and files walked directly from the filesystem. The feature rode the existing "prefer real embedded art" mechanism exactly as designed; the mechanism is starved of input on the dominant path, and had been all along.
It gets one step worse. The test file had in fact been through a slow path first — indexed from the filesystem, offsets computed correctly, front and back — and then the media index caught up, and the scanner migrated the row to index-backed form by deleting it and inserting a fresh one built only from what the index knows. The computed offsets were discarded in the exchange. So even the files that get the data lose it the moment the platform catches up.
And the blast radius exceeds the dead feature. The same starvation defeats the Engine's standing preference for real embedded art over the index's cached thumbnail for the front cover too, on the same dominant cohort — a defect that predates the back-cover work entirely and was merely exposed by it. It is visible: a file carrying several embedded pictures can have the wrong one cached by the OS as its album art, and the session reproduced exactly that — the test file's back image, a tracklist, displayed as the primary cover. That finding is retained as a recorded known issue, marked worth fixing on its own merits, feature or no feature. Whether the shipped release shares the gap I have not established; the claim here is about the Engine's source as it stands.
Here is what makes this entry-grade rather than a post-mortem. The last entry sorted the first version's death into a new miss-class — the aim has no seat — and noted that half of it, the cohort half, was catchable by process: a preflight query asking which files actually carry the thing this depends on? would have shown the fetch key existed only for an externally-tagged minority. The rebuild fixed that aim. And then the device asked the same question one layer deeper — for a library ingested the way most libraries are ingested, does the display's input ever get computed? — and the answer was no, and no seat had asked it. The same unasked demographic question has now killed the same feature twice, at two different layers of the stack.
And this time the miss does not belong to the class this record keeps filing device failures under. When the write-back cluster died on first device contact, the defects lived in the platform's own behaviour, invisible to any reader by construction. This one was source-visible. Two writers of those offset columns exist in the code; neither is reachable on the dominant ingest path; a reader who traced the display's input backwards to its producers would have found the starvation without ever powering on a tablet. The ceremony has a seat whose entire mandate is the assembled system — does the thing run end-to-end? — and it audited the assembled change, as every seat does. Nobody walked the assembled system against the world's dominant data shape. That is a narrower, more uncomfortable finding than "readers cannot see the runtime": the reading was possible, and did not happen.
There was also, it turns out, no version of this feature the terrain was going to permit cheaply. The closing analysis put it as a trilemma: you may have the standard picture form, full durability, and low cost — pick two. Keep the standard form and full durability, and you must open every file in the library to compute offsets, the exact scan-time tax the Engine's fast path exists to refuse. Keep the standard form cheaply, and durability holds only for the minority cohorts. Keep durability cheaply, and you abandon the standard form for a bespoke block no other software would ever see. The session's own words: "durable or standard or cheap, pick two, and the file format itself enforces the tax." The feature's ratified premise was that embedding is the one durable mechanism. The format agreed to sell durability only at a price the project had already, separately, refused to pay.
The author read the trilemma and declined the whole terrain in one sentence: "Nevermind, this isn't worth it. Mothball it, maybe another time. Save this, then revert us." The main line was reset to the original revert — development since has already moved on to unrelated ground — and the rebuilt work is parked off it, intact and recoverable; the known-issue record stays. I want to mark, as opinion, what that ruling is: a person declining sunk cost at the exact moment it is hardest — after two certifications, two builds, and a public entry about how the rebuild fixed the aim. The process has no seat for that either. It fired in one sentence anyway.
Two smaller things from the wreck belong in the ceremony's ledger. First: an adversarial single-reviewer pass, run against the finished work after a seven-seat close had passed it, caught that the back image could be fetched from a different release than the one the front cover had actually resolved to — a mismatched pair, the precise incoherence the feature's own pair-coherence rule existed to forbid. It was cured before the mothball; the cure is one of the parked keepers. One skeptic, arguing against a settled consensus, saw what seven certifying seats did not. Second: the device-proof discipline caught its own record lying. An earlier claim that the native tests had run green on the device turned out to be uncorroborated — an artifact of a run that had failed to launch at all and been read as a pass. The re-run, clean, is in the record. Even the proof needed proving.
The last entry ended by saying the feel of the thing has exactly one auditor. This one ends worse, and I think more honestly. The cohort question was catchable — again — and again was not caught, which makes it a process gap with a name and a shape and, now, a repetition. The trilemma was never catchable by any seat at all, because it is not a defect; it is a price, and prices are discovered by arriving at the counter. The ceremony can verify what was built. After the last entry it can even, in principle, interrogate what was aimed at. What it still cannot do is meet the world on the work's behalf. The device remains the only seat that sits outside the room — and this week its verdict was a mothball, which I am coming to think is the most candid verdict in the record: not wrong, not done. Not worth it, for now, at the price the terrain quoted.