feat(player): native video on Linux, and one contract for every player (v0.11.0)

mpv now decodes video on Linux, drawn into a framebuffer we own and blitted
into the default vbox's draw handler. Tauri's widget tree is untouched, so an
upgrade that assumes its own layout cannot invalidate this. Direct play means
the original file, hardware decoding, and no server transcode at all — where
previously every desktop video was re-encoded to h264 for the browser engine,
whatever the file actually was. Off by default: JELLYTAU_NATIVE_VIDEO=1.

That settles finding 2 of playback-backend-unification.md — "native video
cannot be composited with a Tauri webview" — by demonstration rather than
argument, on X11 and Wayland both.

Turning it on exposed nine defects, none of them mpv's. Each was the same
mistake in a different place: a capability written down as a compile-time fact
about the platform, or a state asserted instead of confirmed.

  DR-238/246  a seek routed by the stream's container rather than by what the
              engine could do with it - correct only while one player handled
              those streams, silent the moment another did
  DR-239      a property handled but never observed, so the play/pause button
              waited for an event that could not arrive
  DR-240      fullscreen expanding the document while the window stayed put
  DR-241      a seek issued before the engine had a file, failed, and discarded
              - which is why resume began at zero
  DR-247      a Linux-only gate outliving the caller that made it Linux-only,
              breaking the Android build outright
  DR-250      a stop aimed at whichever renderer bookkeeping believed was in
              charge, missing the one actually making sound
  DR-251      a duration of zero believed, leaving the seek bar no scale
  DR-252      a junk float converted to a Duration, panicking the backend the
              instant a length-less stream appeared

So the MediaPlayer contract (DR-242 … DR-247): `open` carries a start position,
so no caller sequences load-then-seek and none can race an engine's load;
`seek` states a destination and leaves in-place-versus-re-open to the engine;
`snapshot` is one coherent read; and `Phase::Opening` names the window where
intent used to be lost. One conformance suite runs against every engine —
FakePlayer and mpv under cargo test, ExoPlayer instrumented on a device — so an
engine is either correct or visibly failing.

Two of the nine were introduced during this work and caught on hardware, not by
any suite: an over-broad capability that grouped ExoPlayer with mpv, and the
Duration panic. The suites test engines that behave. That is recorded in
docs/native-player-verification.md, which asks for the exact action sequences
that found them.

Verified: all automated gates, conformance (mpv 9/9, legacy 8/9 by design,
ExoPlayer 7/7 on device), and manual desktop and Android passes on real
hardware.

Known open and deliberately shipped: resume reads local progress and never the
server's; the background-audio handoff still declares a state swap it does not
confirm (the symptom is now impossible, the race is not); and `bun run
android:dev` builds an APK carrying the release application id, whose failure
message advises an uninstall that would destroy app data. Fix that last one
before anyone else builds for Android.

Squashed from worktree-linux-native-video, which keeps the per-defect history.

src-tauri/src/player/seek.rs

@@ -25,12 +25,14 @@ pub enum VideoSeekStrategy {
 ///
 /// # Arguments
 /// * `is_local` - Whether the file is a local download
-/// * `is_hls` - Whether the stream URL contains ".m3u8" (HLS stream)
+/// * `seeks_transcoded_in_place` - Whether the engine rendering this stream
+///   can seek a server-side transcode without re-opening it. Declared by the
+///   engine via `Capabilities`, never inferred from the URL or the renderer.
 /// * `needs_transcoding` - Whether the content needs transcoding
 /// * `use_html5` - Whether frontend is using HTML5 video element
 pub fn determine_video_seek_strategy(
     is_local: bool,
-    is_hls: bool,
+    seeks_transcoded_in_place: bool,
     needs_transcoding: bool,
     use_html5: bool,
 ) -> VideoSeekStrategy {
@@ -39,23 +41,39 @@ pub fn determine_video_seek_strategy(
         return VideoSeekStrategy::LocalNativeSeek;
     }
 
-    // HLS streams and direct play (non-transcoded) support native seeking
-    if is_hls || !needs_transcoding {
-        if use_html5 {
-            // HTML5 backend - frontend handles seeking via videoElement.currentTime
-            // We don't call backend.seek() because video is in HTML5 element, not in MPV
-            VideoSeekStrategy::Html5NativeSeek
-        } else {
-            // Native backend (MPV) - backend handles seeking
-            VideoSeekStrategy::BackendNativeSeek
-        }
+    // A server-side transcode is produced *from* `StartTimeTicks`, so where the
+    // seek lands is a property of the request, not of the stream in hand.
+    //
+    // hls.js is the exception: handed a VOD playlist it seeks within it and lets
+    // the server catch up segment by segment. mpv's HLS demuxer cannot make
+    // Jellyfin transcode from a new offset, so for the native backend a
+    // transcoded seek must re-negotiate the stream regardless of container.
+    //
+    // Before native video shipped, `use_html5` was always true for HLS and the
+    // native+HLS+transcode cell was unreachable, which is why `is_hls` alone
+    // used to be a safe proxy for "seekable in place". It no longer is: turning
+    // native video on routed every transcoded seek into a backend seek that
+    // silently does nothing, and presents as "resume does not work".
+    if needs_transcoding {
+        // Whether a transcode can be seeked in place is a property of the
+        // engine, and the engine states it. This used to be inferred from
+        // `is_hls`, which held only while hls.js was the sole HLS renderer —
+        // and stopped holding the moment mpv became one (DR-238).
+        return match (seeks_transcoded_in_place, use_html5) {
+            (true, true) => VideoSeekStrategy::Html5NativeSeek,
+            (true, false) => VideoSeekStrategy::BackendNativeSeek,
+            (false, true) => VideoSeekStrategy::Html5ReloadStream,
+            (false, false) => VideoSeekStrategy::BackendReloadStream,
+        };
+    }
+
+    // Direct play and direct stream are seekable where they sit.
+    if use_html5 {
+        // The frontend seeks via videoElement.currentTime; calling backend.seek()
+        // would move a player that is not the one rendering.
+        VideoSeekStrategy::Html5NativeSeek
     } else {
-        // Transcoded non-HLS streams need server-side seek (reload from new position)
-        if use_html5 {
-            VideoSeekStrategy::Html5ReloadStream
-        } else {
-            VideoSeekStrategy::BackendReloadStream
-        }
+        VideoSeekStrategy::BackendNativeSeek
     }
 }
 
@@ -220,26 +238,63 @@ mod tests {
         );
     }
 
-    /// Test video seek strategy for HLS streams
+    /// Non-transcoded streams seek in place regardless of the engine's
+    /// transcode ability, which only applies to transcodes.
     #[test]
-    fn test_seek_strategy_hls_stream() {
-        // HLS with HTML5 - frontend handles seek, don't call backend
+    fn test_seek_strategy_direct_stream() {
+        // HTML5 renders, so the frontend seeks the element
         assert_eq!(
             determine_video_seek_strategy(false, true, false, true),
             VideoSeekStrategy::Html5NativeSeek
         );
-        // HLS with native backend - backend handles seek
+        // The native engine renders, so it seeks
         assert_eq!(
             determine_video_seek_strategy(false, true, false, false),
             VideoSeekStrategy::BackendNativeSeek
         );
-        // HLS even with needs_transcoding flag - still native seek (HLS supports it)
+        // A transcode an engine says it can move: seek in place
         assert_eq!(
             determine_video_seek_strategy(false, true, true, true),
             VideoSeekStrategy::Html5NativeSeek
         );
     }
 
+    /// A server-side transcode cannot be seeked by the native backend.
+    ///
+    /// Jellyfin produces a transcode from `StartTimeTicks`; hls.js can seek
+    /// within the VOD playlist it is handed, but mpv's HLS demuxer cannot make
+    /// the server transcode from a new offset, so the stream has to be
+    /// re-negotiated. Before native video existed, `use_html5` was always true
+    /// for HLS and this case was unreachable — turning native video on routed
+    /// every transcoded seek into a native seek that silently does nothing,
+    /// which presents as "resume does not work".
+    ///
+    /// TRACES: UR-040 | DR-238, DR-246 | UT-217
+    #[test]
+    fn test_transcoded_seek_follows_the_engines_declared_ability() {
+        // An engine that cannot move a server-side transcode re-opens it,
+        // whichever side is rendering.
+        assert_eq!(
+            determine_video_seek_strategy(false, false, true, false),
+            VideoSeekStrategy::BackendReloadStream
+        );
+        assert_eq!(
+            determine_video_seek_strategy(false, false, true, true),
+            VideoSeekStrategy::Html5ReloadStream
+        );
+        // hls.js can, and says so, so it seeks in place.
+        assert_eq!(
+            determine_video_seek_strategy(false, true, true, true),
+            VideoSeekStrategy::Html5NativeSeek
+        );
+        // The container the stream arrives in no longer decides anything: the
+        // same declared ability gives the same answer on the native side.
+        assert_eq!(
+            determine_video_seek_strategy(false, true, true, false),
+            VideoSeekStrategy::BackendNativeSeek
+        );
+    }
+
     /// Test video seek strategy for direct play (non-transcoded) streams
     #[test]
     fn test_seek_strategy_direct_play() {