diff --git a/docs/requirements.md b/docs/requirements.md
index 10ebbaaf..63c571be 100644
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -328,10 +328,11 @@ Internal architecture, components, and application logic.
 | DR-168 | Pause and resume actually stop and restart the bytes. `pause_download` wrote `status = 'paused'` and did nothing else, and no cancellation existed anywhere in the download stack — no token, no flag, no abort — so the streaming task ran on, kept writing, and overwrote the row with `completed`/`failed` when it finished: the row flicked to "paused" and undid itself. `resume_download` had the mirror defect, flipping the row to `pending` without calling `pump_download_queue`; the pump runs when something calls it rather than polling, so a resumed download sat untouched until an unrelated event happened to pump the queue. A per-download stop flag (`download::stop`) is the missing half — a module-level registry because the two sides never meet, the command holding Tauri state and the worker running detached in `async_runtime::spawn`. The worker reads it between chunks and on retry (so a pause is not swallowed by a 45-second backoff), flushes, and returns `Stopped`, which is deliberately **not** retryable and **not** recorded as a failure: the `.part` file is left intact because that is exactly what the resume's Range request continues from. Registering returns a *fresh* flag, or a resumed download would inherit the pause that stopped it and halt instantly. Cancel and `clear_stale_downloads` signal it too, so neither deletes a file still being written | Downloads | UR-055 | Done |
 | DR-169 | Partial files are actually reaped. The worker named its sidecar with `Path::with_extension("part")`, which *replaces* the extension — `movie.mp4` became `movie.part` — while every cleanup path deleted `"{file_path}.part"`, i.e. `movie.mp4.part`. The two never matched, so the partial file of every cancelled or failed download stayed on disk indefinitely, invisible to the disk-usage totals because no `downloads` row pointed at it. `partial_path` appends instead, is the single definition both the writer and the cleaners use, and incidentally removes a collision the old form had, where `movie.mp4` and `movie.mkv` mapped to one `movie.part` | Downloads | UR-055 | Done |
 | DR-170 | Downloads at a chosen bitrate are no longer corrupted by their own retries. Only the `original` preset asks for `Static=true`; every other rung requests a **transcode**, which Jellyfin serves chunked, with no `Content-Length`, and cannot byte-seek — so it ignores `Range` and answers `200` with the whole stream from the beginning rather than `206` with the requested tail. The worker sent the Range header whenever a `.part` existed and appended the body unconditionally, so each retry and each resume concatenated a fresh copy of the entire transcode onto the bytes already on disk: the file grew past its real size and would not play, which is why "downloads for different bitrates" stayed broken after the `videoBitRate` casing fix (DR-adc460f3) corrected the *request*. `resume_offset` makes the response decide — append only on a `206`, otherwise truncate and take the stream from the top — and the total size is computed from that offset rather than from a partial length the server never agreed to | Downloads | UR-071 | Done |
+| DR-172 | Native Android video is opt-in again, because as a default it shipped as **audio with no picture**. DR-161 flipped `experimentalNativeVideo` on so picture-in-picture could shrink a real video surface; on a device that produced sound and a blank screen. The decode path was never the problem — logcat showed ExoPlayer running (`Position update` ticks) and feeding a live `SurfaceView` with an active BufferQueue. The compositing was: the SurfaceView sits *behind* the WebView, and the step that clears the opaque layers above it never took effect, with `WebView transparent = false` logged and `= true` never appearing. So the video rendered correctly the whole time, behind an opaque page. This is exactly the defect the flag existed to contain — `VideoPlayer.scrubRegression.test.ts` had recorded that "the native SurfaceView has never been visible through the webview" — and enabling it by default shipped a verified decode path on top of an unverified display path. Reverting costs nothing that matters: PiP does not depend on it (DR-160 drives PiP from the WebView `<video>`), and working video outranks PiP showing a native surface. The flag stays available in Settings, now described as incomplete rather than as a performance win, and the scrub-regression mocks that were made explicit under DR-161 are kept explicit so those tests state which path they guard rather than inheriting a default that has now moved twice. Fixing the compositing is the prerequisite for trying this default again | UI | UR-003, UR-004, UR-041 | Done |
 | DR-171 | A downloaded video keeps audio the device can actually decode. `original` quality asked for `Static=true`, which hands back the source file byte-for-byte — E-AC-3/AC-3/DTS/TrueHD track included — and video is rendered on both platforms by the webview `<video>` element, which decodes none of them. Streaming already knew this: DR-149 judges the track the server would serve against `WEBVIEW_AUDIO_CODECS` and forces a transcode over Jellyfin's own direct-play offer, because 10.11.5 honours a `DirectPlayProfile`'s container and video codec but ignores its audio codec. The download path never consulted that policy, so the *same film* had sound when streamed and played as picture in silence once downloaded — and offline a download is the only source a video has, so there was no working path left to fall back to. The rule is now one rule: `served_audio_codec` picks the track the server will serve (the default, or the first when none is marked) and both callers judge it, the streaming verdict staying a bool and the download path needing the codec itself so it can say what to re-encode. Only the audio is re-encoded — `allowVideoStreamCopy=true` keeps an h264 source's picture byte-for-byte and no bitrate or resolution cap is added, so `original` still means original quality; a source the webview could not have rendered anyway (HEVC) becomes h264 as a side effect, which is the only form of it that would have played. The decision is per item rather than blanket because the transcode costs the byte-range resumability `Static=true` gives the download worker (see DR-170 for what a chunked, length-less response does to a resume), so a file whose audio already plays keeps the direct copy. An unknown codec — item not fetchable, or the server named none — changes nothing: the policy only ever *adds* a transcode, so it cannot make a working download worse. The codec set judged against is the **webview's**, not the platform's, even though DR-161 made ExoPlayer the Android default: `experimentalNativeVideo` is a user setting, a downloaded file outlives whatever it was set to when the file arrived, and the narrow list is the only one that holds on both sides of it — at the cost of a Dolby-licensed device re-encoding a track its ExoPlayer could have played. `resolve_video_download_url` is the single entrance for all three resolution sites (the frontend's per-item command, the bulk series/season enqueue, and the offline-queued resume), since the pure builder cannot look a codec up and a caller that forgets to is exactly how the silent downloads shipped. **Files already downloaded stay silent** — the bytes on disk are the wrong bytes and only a re-download replaces them | Downloads | UR-071, UR-004 | Done |
 | DR-162 | Video streams are opened against a **bandwidth ceiling the user chose**, instead of a fixed allowance nobody could change. Every video URL carried `MaxStreamingBitrate=20000000`/`VideoBitrate=18000000`, `PlaybackInfo` negotiated at 20 Mbps, and the device profile advertised `999999999` — so on a metered or slow connection the only lever was not watching. `StreamingQuality` is a ladder of ceilings (Original, 20/10/8/4/2/1 Mbps, 720 kbps) in which a step is not a label but a bundle of transcode parameters: the total ceiling, the audio share of it, and the resolution that budget can carry. It lives in Rust because those numbers are Jellyfin encoding vocabulary — the frontend names a variant and reads labels back over `player_get_streaming_qualities`, the same arrangement as the EQ preset curves. The video bitrate is the total *minus* the audio share, so the two together honour the cap rather than overshooting it by the size of the audio track, and `MaxHeight` falls with the ladder so a small budget is not spent on pixels it cannot afford. The cap has to reach the **negotiation**, not only the transcode URL: `max_static_bitrate` in the device profile is what makes the server refuse to direct-play a source fatter than the ceiling, and without it a 30 Mbps remux is handed over untouched and every URL parameter downstream is moot — which is why it is applied at all four places that decide bandwidth (the HLS builder, `PlaybackInfo`, `open_live_stream`, and the background-audio handoff, which takes the lower of the cap and its own 384 kbps). The ceiling is process-wide rather than a field on `OnlineRepository`, mirroring `INCLUDE_CATALOG_BROWSE`: it is a preference about *this device's connection*, it must survive a repository rebuilt on re-login, and every builder plus the negotiation have to agree on it or the cap leaks. Settings owns the durable default and is the only writer to `app_settings` — persisted unlike the rest of `VideoSettings`, because a limit set for a metered connection that silently reverts to uncapped on the next launch spends the user's data with no changed setting to show for it — and it is restored at startup from the async runtime, defaulting to uncapped if the read fails so a database problem degrades to the old behaviour rather than to an arbitrary limit. The in-player menu is the per-video override: a cap is a property of the stream the server is producing, so it cannot be applied to one already in flight — `player_set_stream_quality` re-opens the stream at the new quality and resumes at the current position, reloading a native backend itself and handing HTML5 a URL for the same `reloadSource` primitive the audio-track switch uses, so no strategy branch lives in the UI. It deliberately does not persist. This gives UR-070 its resume-at-the-same-point mechanism; the server-offered per-item rendition list that requirement also asks for remains proposed | Playback | UR-074, UR-070 | Done |
-| DR-172 | Tiles of mixed shapes are laid out **justified** rather than gridded. A CSS grid gives every cell one box, so on a page holding square music covers, 16:9 library backdrops and 2:3 posters at once, everything that is not the chosen shape is cropped to it — the home shortcut strip was explicitly forcing `aspect="video"` on music libraries for exactly this reason, which lined the row up by cutting the covers down. `layoutMosaic` packs tiles into rows of a **shared height** and gives each its own width from its own aspect ratio: it adds tiles to a row until the height needed to fill the container has fallen to the target, closes the row there (so rows land at or below the target, never above), and justifies the row to the container width by absorbing the rounding remainder into its widest tile, where a pixel is least visible. The last row is deliberately *not* justified — with one tile left over, filling the width would inflate it to a banner — so it sits at the target height, left-aligned. Ratios are clamped to a band, which costs a crop on genuine outliers and stops one panorama owning a row or one very tall image shrinking to a sliver. It is a pure module with no DOM: the component supplies only the two things the DOM knows — the measured container width, and the artwork's *decoded* aspect ratio, reported by `CachedImage` so the layout uses the shape an image actually has rather than the one its item type implies. Those measurements are committed in one debounced batch rather than per image, because artwork arrives over several hundred milliseconds and re-packing on each arrival would shuffle the grid under the pointer repeatedly. Labels are drawn *over* the bottom of each tile rather than beneath it: a caption below sits outside the computed box, and one that wraps to two lines would break the row alignment the layout exists to provide | UI | UR-075 | Done |
-| DR-173 | A library knows which favourites category it belongs to, and the frontend does not work it out. The mosaic offers a favourites tile per category beside its library, which needs a collection-type → category answer; deriving it in Svelte would have re-created the exact leak `SearchScope::item_types` was extracted to close (docs/specs/scoped-search-boundary.md) — one table of Jellyfin vocabulary, differing only in which vocabulary. `SearchScope::for_collection_type` maps `movies`/`tvshows`/`music` and returns `None` for everything else, so a Live TV or books library gets no tile at all rather than one opening an unfiltered list; `All` is never derived from a library, being the cross-library entry offered beside them rather than a property of one. `Library::new` stamps the result onto every library at construction — a constructor rather than a struct literal precisely so a derived field cannot be forgotten at one of the four sites — and it rides to the frontend as an optional `favoritesScope`, absent rather than null when there is none. The UI's remaining share is presentation only: what to call the tile, where to put it, and showing a category's tile **once** however many libraries share it, since two movie libraries have one favourites list between them | UI | UR-075, UR-067 | Done |
+| DR-174 | Tiles of mixed shapes are laid out **justified** rather than gridded. A CSS grid gives every cell one box, so on a page holding square music covers, 16:9 library backdrops and 2:3 posters at once, everything that is not the chosen shape is cropped to it — the home shortcut strip was explicitly forcing `aspect="video"` on music libraries for exactly this reason, which lined the row up by cutting the covers down. `layoutMosaic` packs tiles into rows of a **shared height** and gives each its own width from its own aspect ratio: it adds tiles to a row until the height needed to fill the container has fallen to the target, closes the row there (so rows land at or below the target, never above), and justifies the row to the container width by absorbing the rounding remainder into its widest tile, where a pixel is least visible. The last row is deliberately *not* justified — with one tile left over, filling the width would inflate it to a banner — so it sits at the target height, left-aligned. Ratios are clamped to a band, which costs a crop on genuine outliers and stops one panorama owning a row or one very tall image shrinking to a sliver. It is a pure module with no DOM: the component supplies only the two things the DOM knows — the measured container width, and the artwork's *decoded* aspect ratio, reported by `CachedImage` so the layout uses the shape an image actually has rather than the one its item type implies. Those measurements are committed in one debounced batch rather than per image, because artwork arrives over several hundred milliseconds and re-packing on each arrival would shuffle the grid under the pointer repeatedly. Labels are drawn *over* the bottom of each tile rather than beneath it: a caption below sits outside the computed box, and one that wraps to two lines would break the row alignment the layout exists to provide | UI | UR-075 | Done |
+| DR-175 | A library knows which favourites category it belongs to, and the frontend does not work it out. The mosaic offers a favourites tile per category beside its library, which needs a collection-type → category answer; deriving it in Svelte would have re-created the exact leak `SearchScope::item_types` was extracted to close (docs/specs/scoped-search-boundary.md) — one table of Jellyfin vocabulary, differing only in which vocabulary. `SearchScope::for_collection_type` maps `movies`/`tvshows`/`music` and returns `None` for everything else, so a Live TV or books library gets no tile at all rather than one opening an unfiltered list; `All` is never derived from a library, being the cross-library entry offered beside them rather than a property of one. `Library::new` stamps the result onto every library at construction — a constructor rather than a struct literal precisely so a derived field cannot be forgotten at one of the four sites — and it rides to the frontend as an optional `favoritesScope`, absent rather than null when there is none. The UI's remaining share is presentation only: what to call the tile, where to put it, and showing a category's tile **once** however many libraries share it, since two movie libraries have one favourites list between them | UI | UR-075, UR-067 | Done |
 | DR-161 | Native video is the default, so picture-in-picture has a real surface. DR-160 makes PiP work on the HTML5 path, but that path can only ever shrink the *UI* into the PiP window; showing the video itself needs the SurfaceView behind the WebView, which is what `experimentalNativeVideo` gates. The flag now defaults to on when the user has never chosen, with an explicit stored choice still winning in both directions so anyone who turned it off keeps it off. This is a deliberate acceptance of risk: the flag existed because the native path was an unfinished spike, and `VideoPlayer.scrubRegression.test.ts` documents its history — a native init that flipped to HTML5 mid-lifecycle and left seeks going down one path while ExoPlayer played on another. Those tests pin the **flag-off** interim override (native response overridden to HTML5, backend stopped once), which the default no longer selects, so they now mock the flag off rather than inherit it: they still guard that path, but they no longer describe what ships. The native scrub/seek path is consequently not covered by the suite and needs device verification | UI | UR-041, UR-003 | Needs device verification |
 | DR-159 | The background-audio handoff stops leaking its relative timeline. The handoff plays the episode as a *relative* stream — the audio-only URL is built with `StartTimeTicks` = the position the screen was locked at, so ExoPlayer's zero is the handoff point — and `background_audio_base` holds the offset that turns one back into a real position. The base was a **display-only** correction, applied in exactly two places (the lockscreen scrubber and the internal truncation maths) while every other consumer worked in the relative timeline treating the number as absolute. Each crossing threw away exactly `base` seconds, which is why the jump-back distance varied with where the screen was locked and read as random. Three crossings were live: progress reporting to Jellyfin sent the relative position every 30s, so the server was told `real − base` — and since DR-155 now mirrors the server's position back and refreshes on a cache hit, that regressed value returned as the resume point (lock at 40 min, listen to 90, reopen at 50); lockscreen seeks went out absolute and came back relative, against a chunked length-less transcode that cannot honour a seek at all, so a clamped seek landed at stream zero; and media3's own `seekToDefaultPosition`/`seekBack`/`seekForward` bypassed the `ForwardingPlayer` wrapper entirely, reaching the real ExoPlayer — `Util.handlePlayButtonAction` seeking an ended player to the relative zero being the same mechanism as DR-129's truncation bug through a different door. The fix converts **once, at the boundary**: `JellyTauPlayer`'s position tick adds the base (and shifts the duration with it, since the stream's own length is only what remains) before either `nativeOnPositionUpdate` or the lockscreen sees it, so position updates, progress reports, the frontend and the truncation check all speak the episode's timeline and none needs to know a handoff happened. The base is consequently *removed* from `claim_stream_resume`, `truncated_stream_resume_position` and `player_exit_background_audio`, where adding it now double-counts, and the lockscreen's `positionOffsetMs` addition goes with it (the field remains, read-only, as the tick's input). Inbound seeks go the other way: `seek_absolute` is the new boundary for every outside seek, re-opening the stream at the requested position via `resume_stream_at` when a handoff is active — which is what `onSeekTo` had claimed for months in a comment describing code that did not exist — and an ordinary seek otherwise. `seekToDefaultPosition` is swallowed rather than forwarded, since Rust already owns what "play after the stream ended" means and the `play()` that follows reaches it. Exit reads the position *before* clearing either base, or a tick landing in between hands back a relative one | Player | UR-040, UR-005, UR-025 | Done (pending device verification) |
 | DR-158 | A watched toggle, on the episode row, the season header, the series and movie hero, and the Episode Focus View. Both halves of the backend already existed and neither had a caller: `mark_played` (`POST /PlayedItems`) was reachable only from the sync drain replaying rows the *reporter* had queued, and `clear_watch_history` (`DELETE /PlayedItems`) only from the destructive "erase this series' history" button — so the sole way to mark something watched was to play it. Jellyfin applies both recursively over a season or series, so the container case needs no client-side fan-out *online*. Offline it does: `storage_set_watched` writes the item **and its descendants** (drawn from `items` by `parent_id`/`album_id`/`season_id`/`series_id`, so an uncached id selects nothing and the statement no-ops instead of raising a foreign-key error), because otherwise marking a season watched with no server would tick the season and leave every episode inside it unwatched. It is deliberately separate from `storage_mark_played`, which stays the single-item "this finished playing" path that increments `play_count`. Un-marking clears the resume position as well as the flag, matching the server. `QueuedOp::MarkUnplayed` gives the queue the missing direction — pushing as `clear_watch_history` — so the toggle works offline both ways rather than only one; without it un-marking would have been the half that needed a connection. The button is an everyday toggle, so unlike `ClearHistoryButton` it does not confirm, and it holds an optimistic state because the caller's `watched` prop only catches up after a reload (a season means a round trip, during which the button would otherwise appear to ignore the tap) | UI | UR-073 | Done |
@@ -391,7 +392,7 @@ Internal architecture, components, and application logic.
 | UR-038 | IR-010 | DR-043 |
 | UR-039 | - | DR-045, DR-046 |
 | UR-040 | IR-025 | DR-051, DR-052, DR-129, DR-130, DR-159 |
-| UR-041 | IR-026 | DR-053, DR-160, DR-161 |
+| UR-041 | IR-026 | DR-053, DR-160, DR-161, DR-172 |
 | UR-042 | IR-009, IR-014 | DR-054 |
 | UR-043 | IR-027 | DR-055 |
 | UR-044 | - | DR-056 |
@@ -424,7 +425,7 @@ Internal architecture, components, and application logic.
 | UR-072 | - | DR-156 |
 | UR-073 | - | DR-158 |
 | UR-074 | - | DR-162 |
-| UR-075 | - | DR-172, DR-173 |
+| UR-075 | - | DR-174, DR-175 |
 
 ---
 
@@ -584,11 +585,11 @@ Internal architecture, components, and application logic.
 | UT-154 | `mark_unplayed` parses to `QueuedOp::MarkUnplayed` and is rejected without an item id, and a queued un-mark drains to the server as `clear_watch_history` | DR-158 | Done |
 | UT-156 | A capped step reaches the transcode URL as all four of its parts (total ceiling, the video/audio split summing to the cap, and a `MaxHeight`), the uncapped default keeps the historical 20/18 Mbps allowance and constrains no resolution, and the background-audio handoff takes the lower of the cap and its own 384 kbps | DR-162 | Done |
 | UT-157 | The quality ladder is internally consistent — video + audio equals the cap at every step, audio never consumes the budget, only `Original` is uncapped — descends in bitrate, resolution and audio share together, and round-trips through the serde token it is persisted as | DR-162 | Done |
-| UT-158 | Justified rows fill the container width exactly and never overflow it, every tile in a row shares one height, and each tile's width follows its own aspect ratio — a 16:9 tile coming out more than twice the width of a 2:3 tile at the same height | DR-172 | Done |
-| UT-159 | The awkward cases of the packing: a short last row is left at the target height rather than stretched across the container, a last row that would overflow is brought down, an extreme ratio is clamped instead of taking a row to itself, a missing or nonsensical ratio falls back to square instead of collapsing the tile, an unmeasured container renders nothing rather than 1px tiles, and every tile is placed exactly once in order | DR-172 | Done |
-| UT-160 | The default row height suits its container: it grows with the width, stays inside its bounds, and at phone width still fits two 16:9 tiles side by side | DR-172 | Done |
-| UT-161 | A collection type maps to its favourites scope (`movies`/`tvshows`/`music`), every other kind — Live TV, channels, box sets, books, unknown — maps to none rather than to `All`, and a constructed library carries the scope across the wire as `favoritesScope`, omitted entirely when it has none | DR-173 | Done |
-| UT-167 | The mosaic's composition: the cross-library favourites entry leads, each library is followed by its own category tile pointing at that category's tab, a category shared by two libraries still yields one tile, a library kind favourites do not carve up yields none, a scope the page offers no tab for is ignored, and every tile is uniquely keyed | DR-172, DR-173 | Done |
+| UT-158 | Justified rows fill the container width exactly and never overflow it, every tile in a row shares one height, and each tile's width follows its own aspect ratio — a 16:9 tile coming out more than twice the width of a 2:3 tile at the same height | DR-174 | Done |
+| UT-159 | The awkward cases of the packing: a short last row is left at the target height rather than stretched across the container, a last row that would overflow is brought down, an extreme ratio is clamped instead of taking a row to itself, a missing or nonsensical ratio falls back to square instead of collapsing the tile, an unmeasured container renders nothing rather than 1px tiles, and every tile is placed exactly once in order | DR-174 | Done |
+| UT-160 | The default row height suits its container: it grows with the width, stays inside its bounds, and at phone width still fits two 16:9 tiles side by side | DR-174 | Done |
+| UT-161 | A collection type maps to its favourites scope (`movies`/`tvshows`/`music`), every other kind — Live TV, channels, box sets, books, unknown — maps to none rather than to `All`, and a constructed library carries the scope across the wire as `favoritesScope`, omitted entirely when it has none | DR-175 | Done |
+| UT-167 | The mosaic's composition: the cross-library favourites entry leads, each library is followed by its own category tile pointing at that category's tab, a category shared by two libraries still yields one tile, a library kind favourites do not carve up yields none, a scope the page offers no tab for is ignored, and every tile is uniquely keyed | DR-174, DR-175 | Done |
 | UT-153 | Scroll handling per navigation kind: a forward move always lands at the top even when the previous page was scrolled and even when the target was visited before, Back restores that route's own saved offset (and the top when it has none), offsets are kept per route rather than shared, a repeated Back still restores, and the initial load leaves the container alone | DR-156 | Done |
 | UT-142 | The audio codecs offered for video direct play: a Dolby device's real `MediaCodecList` output drops `ac3`/`eac3`, AMR and raw PCM are dropped too, a fully-supported list is passed through untouched, a list with nothing decodable still claims `aac`, and stray spacing or casing does not decide whether the user gets sound | DR-148 | Done |
 | UT-143 | Subtitle URLs resolve to plain strings before they reach the markup (never a Promise), unresolvable tracks are dropped, a stale selection collapses to "Off", and a server-default track is never auto-selected | UR-020, DR-023 | Done |
diff --git a/docs/specs/library-mosaic.md b/docs/specs/library-mosaic.md
index fe568e05..3d076b10 100644
--- a/docs/specs/library-mosaic.md
+++ b/docs/specs/library-mosaic.md
@@ -1,7 +1,7 @@
 # Spec: Library mosaic (library overview + home shortcuts)
 
 **Status:** Implemented
-**Requirements:** UR-075 → DR-172, DR-173 (with UR-067 → DR-117 extended)
+**Requirements:** UR-075 → DR-174, DR-175 (with UR-067 → DR-117 extended)
 **UX spec:** [ux-flows.md](../ux-flows.md) §5C.2 (Favourites)
 
 ## Summary
diff --git a/docs/traceability.md b/docs/traceability.md
index 822efa4d..33051fc6 100644
--- a/docs/traceability.md
+++ b/docs/traceability.md
@@ -1,15 +1,15 @@
 # Code Traceability Matrix
 
-**Generated:** 8/16/2026, 12:05:50 AM
+**Generated:** 8/16/2026, 12:51:46 AM
 
 ## Summary
 
 - **Total Files Scanned:** 358
-- **Total TRACES Found:** 709
+- **Total TRACES Found:** 710
 - **Requirements Covered:**
   - User Requirements (UR): 71
   - Integration Requirements (IR): 19
-  - Development Requirements (DR): 150
+  - Development Requirements (DR): 151
   - Jellyfin API Requirements (JA): 28
 
 ## Requirements by Type
@@ -26,7 +26,7 @@ IR-003, IR-004, IR-009, IR-010, IR-011, IR-012, IR-013, IR-014, IR-015, IR-016,
 
 ### Development Requirements (DR)
 ```
-DR-001, DR-002, DR-003, DR-004, DR-005, DR-006, DR-007, DR-009, DR-010, DR-011, DR-012, DR-013, DR-014, DR-015, DR-016, DR-017, DR-018, DR-020, DR-021, DR-022, DR-023, DR-024, DR-025, DR-026, DR-027, DR-028, DR-029, DR-030, DR-032, DR-033, DR-034, DR-035, DR-036, DR-037, DR-038, DR-039, DR-040, DR-041, DR-043, DR-044, DR-045, DR-047, DR-048, DR-049, DR-050, DR-051, DR-052, DR-053, DR-054, DR-055, DR-056, DR-057, DR-058, DR-059, DR-060, DR-061, DR-062, DR-063, DR-064, DR-065, DR-066, DR-067, DR-068, DR-069, DR-070, DR-074, DR-075, DR-076, DR-077, DR-078, DR-079, DR-080, DR-081, DR-082, DR-083, DR-084, DR-085, DR-086, DR-087, DR-088, DR-089, DR-090, DR-091, DR-092, DR-093, DR-095, DR-096, DR-097, DR-098, DR-099, DR-100, DR-101, DR-102, DR-103, DR-104, DR-105, DR-106, DR-107, DR-108, DR-109, DR-110, DR-111, DR-112, DR-113, DR-114, DR-115, DR-116, DR-117, DR-118, DR-119, DR-120, DR-123, DR-126, DR-127, DR-128, DR-129, DR-130, DR-131, DR-132, DR-133, DR-134, DR-135, DR-136, DR-137, DR-140, DR-141, DR-142, DR-143, DR-147, DR-148, DR-149, DR-150, DR-151, DR-152, DR-153, DR-154, DR-155, DR-156, DR-157, DR-158, DR-159, DR-160, DR-162, DR-167, DR-168, DR-169, DR-170, DR-171, DR-172, DR-173
+DR-001, DR-002, DR-003, DR-004, DR-005, DR-006, DR-007, DR-009, DR-010, DR-011, DR-012, DR-013, DR-014, DR-015, DR-016, DR-017, DR-018, DR-020, DR-021, DR-022, DR-023, DR-024, DR-025, DR-026, DR-027, DR-028, DR-029, DR-030, DR-032, DR-033, DR-034, DR-035, DR-036, DR-037, DR-038, DR-039, DR-040, DR-041, DR-043, DR-044, DR-045, DR-047, DR-048, DR-049, DR-050, DR-051, DR-052, DR-053, DR-054, DR-055, DR-056, DR-057, DR-058, DR-059, DR-060, DR-061, DR-062, DR-063, DR-064, DR-065, DR-066, DR-067, DR-068, DR-069, DR-070, DR-074, DR-075, DR-076, DR-077, DR-078, DR-079, DR-080, DR-081, DR-082, DR-083, DR-084, DR-085, DR-086, DR-087, DR-088, DR-089, DR-090, DR-091, DR-092, DR-093, DR-095, DR-096, DR-097, DR-098, DR-099, DR-100, DR-101, DR-102, DR-103, DR-104, DR-105, DR-106, DR-107, DR-108, DR-109, DR-110, DR-111, DR-112, DR-113, DR-114, DR-115, DR-116, DR-117, DR-118, DR-119, DR-120, DR-123, DR-126, DR-127, DR-128, DR-129, DR-130, DR-131, DR-132, DR-133, DR-134, DR-135, DR-136, DR-137, DR-140, DR-141, DR-142, DR-143, DR-147, DR-148, DR-149, DR-150, DR-151, DR-152, DR-153, DR-154, DR-155, DR-156, DR-157, DR-158, DR-159, DR-160, DR-162, DR-167, DR-168, DR-169, DR-170, DR-171, DR-172, DR-174, DR-175
 ```
 
 ### Jellyfin API Requirements (JA)
@@ -2192,26 +2192,26 @@ JA-001, JA-002, JA-003, JA-004, JA-005, JA-007, JA-008, JA-010, JA-011, JA-012,
 - **File:** [`src/lib/components/player/VideoPlayer.tapSurface.test.ts`](src/lib/components/player/VideoPlayer.tapSurface.test.ts#L5)
   - **Line:** 5
   - **Context:** `Unknown`
-- **File:** [`src/lib/components/player/VideoPlayer.touchScrub.test.ts`](src/lib/components/player/VideoPlayer.touchScrub.test.ts#L21)
-  - **Line:** 21
-  - **Context:** `Unknown`
 - **File:** [`src/lib/components/player/tapGestures.ts`](src/lib/components/player/tapGestures.ts#L21)
   - **Line:** 21
   - **Context:** `Unknown`
 - **File:** [`src/lib/components/player/VideoPlayer.svelte`](src/lib/components/player/VideoPlayer.svelte#L1)
   - **Line:** 1
   - **Context:** `Unknown`
+- **File:** [`src/lib/components/player/VideoPlayer.touchScrub.test.ts`](src/lib/components/player/VideoPlayer.touchScrub.test.ts#L21)
+  - **Line:** 21
+  - **Context:** `Unknown`
 
 ### DR-099
 
 **Locations:** 2 file(s)
 
-- **File:** [`src/lib/components/player/VideoPlayer.touchScrub.test.ts`](src/lib/components/player/VideoPlayer.touchScrub.test.ts#L21)
-  - **Line:** 21
-  - **Context:** `Unknown`
 - **File:** [`src/lib/components/player/VideoPlayer.svelte`](src/lib/components/player/VideoPlayer.svelte#L1)
   - **Line:** 1
   - **Context:** `Unknown`
+- **File:** [`src/lib/components/player/VideoPlayer.touchScrub.test.ts`](src/lib/components/player/VideoPlayer.touchScrub.test.ts#L21)
+  - **Line:** 21
+  - **Context:** `Unknown`
 
 ### DR-100
 
@@ -3615,6 +3615,14 @@ JA-001, JA-002, JA-003, JA-004, JA-005, JA-007, JA-008, JA-010, JA-011, JA-012,
 
 ### DR-172
 
+**Locations:** 1 file(s)
+
+- **File:** [`src/lib/stores/nativeVideo.ts`](src/lib/stores/nativeVideo.ts#L47)
+  - **Line:** 47
+  - **Context:** `Unknown`
+
+### DR-174
+
 **Locations:** 8 file(s)
 
 - **File:** [`src/lib/components/common/CachedImage.svelte`](src/lib/components/common/CachedImage.svelte#L18)
@@ -3642,7 +3650,7 @@ JA-001, JA-002, JA-003, JA-004, JA-005, JA-007, JA-008, JA-010, JA-011, JA-012,
   - **Line:** 121
   - **Context:** `Unknown`
 
-### DR-173
+### DR-175
 
 **Locations:** 9 file(s)
 
@@ -4118,7 +4126,7 @@ JA-001, JA-002, JA-003, JA-004, JA-005, JA-007, JA-008, JA-010, JA-011, JA-012,
 
 ### UR-003
 
-**Locations:** 28 file(s)
+**Locations:** 29 file(s)
 
 - **File:** [`src/lib/api/bindings.ts`](src/lib/api/bindings.ts#L149)
   - **Line:** 149
@@ -4165,6 +4173,9 @@ JA-001, JA-002, JA-003, JA-004, JA-005, JA-007, JA-008, JA-010, JA-011, JA-012,
 - **File:** [`src/lib/stores/nativeVideo.ts`](src/lib/stores/nativeVideo.ts#L3)
   - **Line:** 3
   - **Context:** `Unknown`
+- **File:** [`src/lib/stores/nativeVideo.ts`](src/lib/stores/nativeVideo.ts#L47)
+  - **Line:** 47
+  - **Context:** `Unknown`
 - **File:** [`src/lib/utils/videoSurface.ts`](src/lib/utils/videoSurface.ts#L4)
   - **Line:** 4
   - **Context:** `Unknown`
@@ -4207,7 +4218,7 @@ JA-001, JA-002, JA-003, JA-004, JA-005, JA-007, JA-008, JA-010, JA-011, JA-012,
 
 ### UR-004
 
-**Locations:** 35 file(s)
+**Locations:** 36 file(s)
 
 - **File:** [`src/lib/api/bindings.ts`](src/lib/api/bindings.ts#L306)
   - **Line:** 306
@@ -4242,6 +4253,9 @@ JA-001, JA-002, JA-003, JA-004, JA-005, JA-007, JA-008, JA-010, JA-011, JA-012,
 - **File:** [`src/lib/stores/nativeVideo.ts`](src/lib/stores/nativeVideo.ts#L3)
   - **Line:** 3
   - **Context:** `Unknown`
+- **File:** [`src/lib/stores/nativeVideo.ts`](src/lib/stores/nativeVideo.ts#L47)
+  - **Line:** 47
+  - **Context:** `Unknown`
 - **File:** [`src/lib/utils/videoSurface.ts`](src/lib/utils/videoSurface.ts#L4)
   - **Line:** 4
   - **Context:** `Unknown`
@@ -4749,6 +4763,17 @@ JA-001, JA-002, JA-003, JA-004, JA-005, JA-007, JA-008, JA-010, JA-011, JA-012,
   - **Line:** 157
   - **Context:** `pub fn file_size(&self) -> Option<u64> {`
 
+### UT-026
+
+**Locations:** 2 file(s)
+
+- **File:** [`src-tauri/src/player/backend.rs`](src-tauri/src/player/backend.rs#L245)
+  - **Line:** 245
+  - **Context:** `Unknown`
+- **File:** [`src-tauri/src/player/backend.rs`](src-tauri/src/player/backend.rs#L251)
+  - **Line:** 251
+  - **Context:** `Unknown`
+
 ### UT-027
 
 **Locations:** 1 file(s)
@@ -4939,9 +4964,6 @@ JA-001, JA-002, JA-003, JA-004, JA-005, JA-007, JA-008, JA-010, JA-011, JA-012,
 - **File:** [`src/lib/components/player/VideoPlayer.tapSurface.test.ts`](src/lib/components/player/VideoPlayer.tapSurface.test.ts#L5)
   - **Line:** 5
   - **Context:** `Unknown`
-- **File:** [`src/lib/components/player/VideoPlayer.touchScrub.test.ts`](src/lib/components/player/VideoPlayer.touchScrub.test.ts#L21)
-  - **Line:** 21
-  - **Context:** `Unknown`
 - **File:** [`src/lib/components/player/backgroundAudioHandoff.ts`](src/lib/components/player/backgroundAudioHandoff.ts#L69)
   - **Line:** 69
   - **Context:** `Unknown`
@@ -4963,6 +4985,9 @@ JA-001, JA-002, JA-003, JA-004, JA-005, JA-007, JA-008, JA-010, JA-011, JA-012,
 - **File:** [`src/lib/components/player/VideoPlayer.svelte`](src/lib/components/player/VideoPlayer.svelte#L801)
   - **Line:** 801
   - **Context:** `Unknown`
+- **File:** [`src/lib/components/player/VideoPlayer.touchScrub.test.ts`](src/lib/components/player/VideoPlayer.touchScrub.test.ts#L21)
+  - **Line:** 21
+  - **Context:** `Unknown`
 - **File:** [`src/lib/player/adapters/html5Adapter.ts`](src/lib/player/adapters/html5Adapter.ts#L19)
   - **Line:** 19
   - **Context:** `Unknown`
@@ -8047,17 +8072,6 @@ JA-001, JA-002, JA-003, JA-004, JA-005, JA-007, JA-008, JA-010, JA-011, JA-012,
   - **Line:** 853
   - **Context:** `Unknown`
 
-### UT-026
-
-**Locations:** 2 file(s)
-
-- **File:** [`src-tauri/src/player/backend.rs`](src-tauri/src/player/backend.rs#L245)
-  - **Line:** 245
-  - **Context:** `Unknown`
-- **File:** [`src-tauri/src/player/backend.rs`](src-tauri/src/player/backend.rs#L251)
-  - **Line:** 251
-  - **Context:** `Unknown`
-
 ### UT-108
 
 **Locations:** 2 file(s)
@@ -8810,14 +8824,14 @@ JA-001, JA-002, JA-003, JA-004, JA-005, JA-007, JA-008, JA-010, JA-011, JA-012,
 - **File:** [`src/lib/components/player/VideoPlayer.tapSurface.test.ts`](src/lib/components/player/VideoPlayer.tapSurface.test.ts#L5)
   - **Line:** 5
   - **Context:** `Unknown`
-- **File:** [`src/lib/components/player/VideoPlayer.touchScrub.test.ts`](src/lib/components/player/VideoPlayer.touchScrub.test.ts#L21)
-  - **Line:** 21
-  - **Context:** `Unknown`
 - **File:** [`src/lib/components/player/tapGestures.ts`](src/lib/components/player/tapGestures.ts#L21)
   - **Line:** 21
   - **Context:** `Unknown`
 - **File:** [`src/lib/components/player/VideoPlayer.svelte`](src/lib/components/player/VideoPlayer.svelte#L1)
   - **Line:** 1
   - **Context:** `Unknown`
+- **File:** [`src/lib/components/player/VideoPlayer.touchScrub.test.ts`](src/lib/components/player/VideoPlayer.touchScrub.test.ts#L21)
+  - **Line:** 21
+  - **Context:** `Unknown`
 
 
diff --git a/package.json b/package.json
index 257dcba1..c9240e57 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jellytau",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "",
   "type": "module",
   "packageManager": "bun@1.3.5",
diff --git a/scripts/extract-traces.test.ts b/scripts/extract-traces.test.ts
index a741a61d..92e58db6 100644
--- a/scripts/extract-traces.test.ts
+++ b/scripts/extract-traces.test.ts
@@ -175,8 +175,8 @@ describe("live requirements.md", () => {
 
     expect(defined.UR).toBe(75);
     expect(defined.IR).toBe(32);
-    expect(defined.DR).toBe(164);
+    expect(defined.DR).toBe(165);
     expect(defined.JA).toBe(35);
-    expect(defined.total).toBe(306);
+    expect(defined.total).toBe(307);
   });
 });
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index de0305fc..1b647cd8 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -2018,7 +2018,7 @@ dependencies = [
 
 [[package]]
 name = "jellytau"
-version = "0.5.3"
+version = "0.5.4"
 dependencies = [
  "aes-gcm",
  "async-trait",
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 44511aac..bb35b078 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "jellytau"
-version = "0.5.3"
+version = "0.5.4"
 description = "A Tauri App"
 authors = ["you"]
 edition = "2021"
diff --git a/src-tauri/src/repository/types.rs b/src-tauri/src/repository/types.rs
index d21269df..f17f8b84 100644
--- a/src-tauri/src/repository/types.rs
+++ b/src-tauri/src/repository/types.rs
@@ -44,7 +44,7 @@ pub struct Library {
     /// collection-type → category table any more than an item-type one. See
     /// `SearchScope::for_collection_type`.
     ///
-    /// TRACES: UR-075 | DR-173
+    /// TRACES: UR-075 | DR-175
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub favorites_scope: Option<SearchScope>,
 }
@@ -389,7 +389,7 @@ impl SearchScope {
     /// `All` is never returned: it is the *absence* of a category, offered
     /// alongside the libraries rather than derived from one.
     ///
-    /// TRACES: UR-075 | DR-173 | UT-161
+    /// TRACES: UR-075 | DR-175 | UT-161
     pub fn for_collection_type(collection_type: &str) -> Option<SearchScope> {
         match collection_type {
             "movies" => Some(SearchScope::Movies),
@@ -707,7 +707,7 @@ mod search_scope_tests {
         assert!(matches!(all.scope, Some(SearchScope::All)));
     }
 
-    /// TRACES: DR-173 | UT-161
+    /// TRACES: DR-175 | UT-161
     #[test]
     fn test_collection_type_maps_to_its_favorites_scope() {
         assert_eq!(
@@ -728,7 +728,7 @@ mod search_scope_tests {
     /// than one that opens an unfiltered list. `All` is never derived from a
     /// library — it is the cross-library entry offered beside them.
     ///
-    /// TRACES: DR-173 | UT-161
+    /// TRACES: DR-175 | UT-161
     #[test]
     fn test_uncategorised_collection_types_have_no_favorites_scope() {
         for collection_type in ["livetv", "channels", "boxsets", "books", "unknown", ""] {
@@ -740,7 +740,7 @@ mod search_scope_tests {
         }
     }
 
-    /// TRACES: DR-173 | UT-161
+    /// TRACES: DR-175 | UT-161
     #[test]
     fn test_library_carries_its_favorites_scope_to_the_frontend() {
         let music = Library::new("1".into(), "Music".into(), "music".into(), None);
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 276fe11f..1f1e42af 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "jellytau",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "identifier": "com.dtourolle.jellytau",
   "build": {
     "beforeDevCommand": "bun run dev",
diff --git a/src/lib/api/bindings.ts b/src/lib/api/bindings.ts
index 292812e7..690adde4 100644
--- a/src/lib/api/bindings.ts
+++ b/src/lib/api/bindings.ts
@@ -2082,7 +2082,7 @@ export type Library = { id: string; name: string; collectionType: string; imageT
  * collection-type → category table any more than an item-type one. See
  * `SearchScope::for_collection_type`.
  * 
- * TRACES: UR-075 | DR-173
+ * TRACES: UR-075 | DR-175
  */
 favoritesScope?: SearchScope | null }
 /**
diff --git a/src/lib/components/common/CachedImage.svelte b/src/lib/components/common/CachedImage.svelte
index 6bbd73ec..93832afc 100644
--- a/src/lib/components/common/CachedImage.svelte
+++ b/src/lib/components/common/CachedImage.svelte
@@ -15,7 +15,7 @@
      * Called once the bitmap is decoded, with its intrinsic pixel size. Lets a
      * layout that sizes boxes from artwork (the mosaic) use the shape the image
      * actually has rather than the one its item type suggests.
-     * TRACES: UR-075 | DR-172
+     * TRACES: UR-075 | DR-174
      */
     onNaturalSize?: (width: number, height: number) => void;
   }
diff --git a/src/lib/components/library/MosaicGrid.svelte b/src/lib/components/library/MosaicGrid.svelte
index ccbbbf7b..16ebc52c 100644
--- a/src/lib/components/library/MosaicGrid.svelte
+++ b/src/lib/components/library/MosaicGrid.svelte
@@ -11,7 +11,7 @@
   arrives over a few hundred milliseconds, and re-packing on each arrival would
   shuffle the grid under the viewer's cursor several times over.
 
-  TRACES: UR-075 | DR-172
+  TRACES: UR-075 | DR-174
 -->
 <script lang="ts" generics="T extends { key: string; ratio: number }">
   import type { Snippet } from "svelte";
diff --git a/src/lib/components/library/MosaicTile.svelte b/src/lib/components/library/MosaicTile.svelte
index c6712c3c..54aeeba1 100644
--- a/src/lib/components/library/MosaicTile.svelte
+++ b/src/lib/components/library/MosaicTile.svelte
@@ -7,7 +7,7 @@
   lines would no longer line up with its neighbours. Keeping everything inside
   the box is what lets `layoutMosaic` own the geometry completely.
 
-  TRACES: UR-075 | DR-172
+  TRACES: UR-075 | DR-174
 -->
 <script lang="ts">
   import type { Snippet } from "svelte";
diff --git a/src/lib/components/library/libraryMosaic.ts b/src/lib/components/library/libraryMosaic.ts
index d0346b54..276714e4 100644
--- a/src/lib/components/library/libraryMosaic.ts
+++ b/src/lib/components/library/libraryMosaic.ts
@@ -9,7 +9,7 @@
 // `favoritesScope` (Rust: `SearchScope::for_collection_type`). This file only
 // decides what to *call* it and where to put it.
 //
-// TRACES: UR-075, UR-067 | DR-172, DR-173 | UT-167
+// TRACES: UR-075, UR-067 | DR-174, DR-175 | UT-167
 
 import type { Library } from "$lib/api/types";
 import {
diff --git a/src/lib/components/library/mosaic.ts b/src/lib/components/library/mosaic.ts
index 791a8904..31744d28 100644
--- a/src/lib/components/library/mosaic.ts
+++ b/src/lib/components/library/mosaic.ts
@@ -9,7 +9,7 @@
 //
 // Presentation only — nothing here knows what a library or a media item is.
 //
-// TRACES: UR-075 | DR-172 | UT-158, UT-159, UT-160
+// TRACES: UR-075 | DR-174 | UT-158, UT-159, UT-160
 
 /** A tile to place: an opaque key and the aspect ratio (width / height) to honour. */
 export interface MosaicInput {
diff --git a/src/lib/components/player/VideoPlayer.scrubRegression.test.ts b/src/lib/components/player/VideoPlayer.scrubRegression.test.ts
index 40f92d89..8e39f125 100644
--- a/src/lib/components/player/VideoPlayer.scrubRegression.test.ts
+++ b/src/lib/components/player/VideoPlayer.scrubRegression.test.ts
@@ -23,12 +23,12 @@ import { describe, it, expect, vi, beforeEach } from "vitest";
 // ---- Mocks (must precede component import) --------------------------------
 
 const channelHandlers: Record<string, (event: any) => void> = {};
-// These tests pin the **flag-off** interim behaviour: when `experimentalNativeVideo`
-// is off, VideoPlayer overrides Android's native backend response to HTML5
-// rendering and stops the native backend. That flag now defaults to *on*
-// (DR-160, so picture-in-picture has a real surface to shrink into), so the
-// default no longer selects this path and the tests have to say which path they
-// are guarding rather than inherit it. (DR-161)
+// These tests pin the **flag-off** behaviour: when `experimentalNativeVideo` is
+// off, VideoPlayer overrides Android's native backend response to HTML5
+// rendering and stops the native backend. That is the default again (DR-172,
+// after native video shipped as audio with no picture), so this mock now agrees
+// with the default rather than opposing it — kept explicit so the tests state
+// which path they guard instead of inheriting whatever the default happens to be.
 vi.mock("$lib/stores/nativeVideo", async (importOriginal) => {
   const actual = await importOriginal<typeof import("$lib/stores/nativeVideo")>();
   return {
diff --git a/src/lib/components/player/VideoPlayer.touchScrub.test.ts b/src/lib/components/player/VideoPlayer.touchScrub.test.ts
index 97c02abc..89b6fcb4 100644
--- a/src/lib/components/player/VideoPlayer.touchScrub.test.ts
+++ b/src/lib/components/player/VideoPlayer.touchScrub.test.ts
@@ -26,12 +26,12 @@ import { describe, it, expect, vi, beforeEach } from "vitest";
 // ---- Mocks (must precede component import) --------------------------------
 
 const channelHandlers: Record<string, (event: any) => void> = {};
-// These tests pin the **flag-off** interim behaviour: when `experimentalNativeVideo`
-// is off, VideoPlayer overrides Android's native backend response to HTML5
-// rendering and stops the native backend. That flag now defaults to *on*
-// (DR-160, so picture-in-picture has a real surface to shrink into), so the
-// default no longer selects this path and the tests have to say which path they
-// are guarding rather than inherit it. (DR-161)
+// These tests pin the **flag-off** behaviour: when `experimentalNativeVideo` is
+// off, VideoPlayer overrides Android's native backend response to HTML5
+// rendering and stops the native backend. That is the default again (DR-172,
+// after native video shipped as audio with no picture), so this mock now agrees
+// with the default rather than opposing it — kept explicit so the tests state
+// which path they guard instead of inheriting whatever the default happens to be.
 vi.mock("$lib/stores/nativeVideo", async (importOriginal) => {
   const actual = await importOriginal<typeof import("$lib/stores/nativeVideo")>();
   return {
diff --git a/src/lib/stores/nativeVideo.ts b/src/lib/stores/nativeVideo.ts
index 3940107a..b39c0df9 100644
--- a/src/lib/stores/nativeVideo.ts
+++ b/src/lib/stores/nativeVideo.ts
@@ -27,26 +27,32 @@ const STORAGE_KEY = "jellytau-experimental-native-video";
 const NATIVE_VIDEO_ATTR = "data-native-video";
 
 /**
- * Whether the native path is on, defaulting to **on** when the user has never
- * chosen.
+ * Whether the native path is on. **Off** unless the user turned it on.
  *
- * It shipped defaulting to off while the native path was a spike. It is now the
- * default because picture-in-picture is built on it: PiP shrinks the *Activity*,
- * so it needs a real video surface behind the WebView to show, and on the HTML5
- * path there is nothing for it to shrink into but the UI itself (DR-160).
+ * DR-161 briefly made this default to on, so picture-in-picture could shrink a
+ * real video surface. On a device that shipped as **audio with no picture**:
+ * ExoPlayer decoded correctly and fed its SurfaceView, but the SurfaceView sits
+ * *behind* the WebView and the compositing that clears the opaque layers above it
+ * never took effect — logcat showed `WebView transparent = false` and never
+ * `= true`. So the video was rendering the whole time, behind the page.
+ *
+ * That is the defect the flag existed to contain, and it is why the default is
+ * back off: video working matters more than PiP showing the native surface, and
+ * PiP still works without it via the HTML5 path (DR-160). Native video remains
+ * available in Settings for anyone testing it.
  *
  * An explicit stored choice still wins in both directions, so anyone who turned
- * it off keeps it off.
+ * it on keeps it on.
+ *
+ * TRACES: UR-003, UR-004 | DR-172
  */
 function load(): boolean {
-  if (typeof localStorage === "undefined") return true;
+  if (typeof localStorage === "undefined") return false;
   try {
-    const stored = localStorage.getItem(STORAGE_KEY);
-    return stored === null ? true : stored === "true";
+    return localStorage.getItem(STORAGE_KEY) === "true";
   } catch {
-    // Private-mode / disabled storage — no stored choice is readable, so this is
-    // the same case as "never chosen".
-    return true;
+    // Private-mode / disabled storage — default to the safe (HTML5) path.
+    return false;
   }
 }
 
@@ -74,8 +80,8 @@ function createExperimentalNativeVideoStore() {
 }
 
 /**
- * User opt-out for the native Android video path. **Defaults to on** since
- * DR-161 — see `load()`. The name still says "experimental" because the flag
+ * User opt-in for the native Android video path. **Defaults to off** again since
+ * DR-172 — see `load()`. The name says "experimental" because the flag
  * remains a suppressor of Rust's backend choice, not a promoter of it.
  */
 export const experimentalNativeVideo = createExperimentalNativeVideoStore();
diff --git a/src/lib/utils/favoritesView.ts b/src/lib/utils/favoritesView.ts
index 9ac1ba03..c1135ca3 100644
--- a/src/lib/utils/favoritesView.ts
+++ b/src/lib/utils/favoritesView.ts
@@ -41,7 +41,7 @@ export function resolveFavoritesScope(raw: string | null | undefined): Favorites
  * than folded into "all": a caller asking "which category is this?" wants no
  * answer, not the cross-category one.
  *
- * TRACES: UR-075 | DR-173
+ * TRACES: UR-075 | DR-175
  */
 export function asFavoritesScope(
   scope: SearchScope | null | undefined,
diff --git a/src/lib/utils/pictureInPicture.ts b/src/lib/utils/pictureInPicture.ts
index 12eeb613..5d3cbb1f 100644
--- a/src/lib/utils/pictureInPicture.ts
+++ b/src/lib/utils/pictureInPicture.ts
@@ -97,9 +97,9 @@ export function setAutoEnterEnabled(enabled: boolean): void {
  * needs for the PiP window's aspect ratio and the play state for its play/pause
  * action.
  *
- * The flag defaults to **on** now (DR-161), so Android normally shrinks the real
- * ExoPlayer surface instead; this remains the path for Linux and for anyone who
- * turned the flag off.
+ * The flag is back to defaulting **off** (DR-172, after native video shipped as
+ * audio with no picture), so this is once again the path Android normally takes —
+ * which is why PiP does not depend on that flag being on.
  *
  * Pass `active: false` when the element goes away, or PiP would be offered over a
  * video that is no longer there.
diff --git a/src/routes/+page.svelte b/src/routes/+page.svelte
index 73e19c8b..8b37ab5e 100644
--- a/src/routes/+page.svelte
+++ b/src/routes/+page.svelte
@@ -118,7 +118,7 @@
   // The shortcut strip is a mosaic row: one height, each tile as wide as its own
   // artwork. It used to force 16:9 on everything so square music covers lined up
   // with wide backdrops — which lined them up by cropping the covers.
-  // TRACES: UR-075 | DR-172
+  // TRACES: UR-075 | DR-174
   const LIBRARY_STRIP_HEIGHT = 132;
   const libraryTiles = $derived(
     shortcutLibraries.map((lib) => ({ key: lib.id, ratio: assumedLibraryRatio(lib), library: lib }))
diff --git a/src/routes/library/+page.svelte b/src/routes/library/+page.svelte
index 688b9410..4adfbdcc 100644
--- a/src/routes/library/+page.svelte
+++ b/src/routes/library/+page.svelte
@@ -45,7 +45,7 @@
   // The overview is a mosaic: rows of one height, tiles of their own widths, so
   // a square music cover sits beside a wide backdrop without either being
   // cropped to the other's shape. Each category also gets a favourites tile of
-  // its own, beside the library it belongs to. TRACES: UR-075 | DR-172, DR-173
+  // its own, beside the library it belongs to. TRACES: UR-075 | DR-174, DR-175
   const mosaicEntries = $derived(buildLibraryMosaic(visibleLibraries));
 
   // Track if we've done an initial load and previous server state
@@ -255,7 +255,7 @@
              category's own favourites sits beside its library — a labelled tile
              at the same weight as a library is the difference between a feature
              people find and one they don't. ux-flows §5C.2.
-             TRACES: UR-067, UR-075 | DR-117, DR-172 -->
+             TRACES: UR-067, UR-075 | DR-117, DR-174 -->
         <MosaicGrid items={mosaicEntries} gap={8}>
           {#snippet tile(entry)}
             {#if entry.kind === "favorites"}
diff --git a/src/routes/settings/+page.svelte b/src/routes/settings/+page.svelte
index 8a0e25bc..8a4aa8ba 100644
--- a/src/routes/settings/+page.svelte
+++ b/src/routes/settings/+page.svelte
@@ -744,10 +744,10 @@
                 </h3>
                 <p class="text-sm text-gray-400 mt-1">
                   Decode video with the device's hardware decoder instead of the
-                  built-in web player. Better performance and battery life, and
-                  required for picture-in-picture to show the video rather than
-                  the app. Still less tested — turn this off if video fails to
-                  appear or seeking misbehaves.
+                  built-in web player. Better performance and battery life in
+                  principle, but incomplete: on some devices the picture does not
+                  appear at all and only the sound plays. Leave this off unless
+                  you are helping test it.
                 </p>
               </div>
               <button