[cosmictaserdev-creator]

Changes

• Fix Android hostname-aware TLS failures by using Ktor OkHttp clients across Spotify, lyric sources, canvas and integrations; retain normal certificate and hostname verification.
• Repair Spotify Web Player session/token handling and restore connection state without exposing cookies.
• Add provider ordering/toggles, richer timing detection and progressive lyric upgrades; preserve word boundaries across renderers.
• Stabilize centered lyric following, pause follow during manual browsing, and expose lyric styles, custom fonts and sizing.
• Add local-folder list navigation, including the Library Local page.
• Improve addon format compatibility and playback resolution.
• Wire the empty auto-playlist download action; invalidate failed download URLs; try alternate audio formats and keep URL/format metadata consistent.
• Restore ParametricEQ text import in the current equalizer screen.
• Make player icon previews open an in-app chooser for icons already assigned to controls; keep file browsing explicit and merge concurrent slot updates safely.
• Fix cramped quick-action rows and independent/cold widget rendering.
• Add configurable navigation visibility, recognition cancellation and selected-track metadata insights.
• Keep video crop output inside its container and correct drift against audio playback.

Verification

• Kotlin compilation passed for the current implementation.
• Earlier ARM64 build and lyric spacing/centering tests passed.
• French translation PR Complete French localization / Full translation (values-fr) #107 was repaired, passed both CI builds, and merged separately.
• The ARM64 app build passed with the player-icon chooser change. Before that UI change, 27 focused app tests passed; library suites passed (lyrics 13, Spotify 14, addons 13, canvas 16), 83 tests total with zero failures/errors/skips. The chooser change was rebuilt, but no new tests were run.
• Installed the completed hostname/lyrics ARM64 build on a Galaxy M34 running Android 16. The app's actual OkHttp clients completed TLS and received HTTP responses from Spotify (404), LrcLib (200), Apple Music catalog (404), LastFM (400), and Apple video (200). Error HTTP statuses at unauthenticated root URLs are expected; they confirm TLS completed.
• The ARM64 build containing the player-icon fix is available at app/build/outputs/apk/arm64Foss/debug/app-arm64-foss-debug.apk. This latest icon UI change has not been installed on-device; the user will check it.
• User requested verification without their Spotify account. Full Spotify account login/restore and AI provider responses remain unverified.

CI limitations

GitHub default CodeQL Java/Kotlin autobuild cannot configure the Android native build because the runner has no NDK (28.2.13676358 requested). The Python analysis also fails because no Python application source is present. These are analysis setup failures; no repository security settings were changed or checks disabled. Regular Android CI builds are still running for the latest follow-up.

Issue coverage

Concrete changes address #90, #91, #92, #101, #102, #108, #110 and #111, with recovery changes relevant to #93, #99, #100 and #112.

All 20 open reports were inspected. Honor tablet flashing/sidebar performance, random downloaded-track crashes, theme icon disappearance, library frame pacing, authenticated podcasts, old-device sorting/crop reports and the lossless previous-track loop still need matching reproduction evidence. These reports are not being closed based only on source review.

Scope

Created from current main after #107. Existing local README/contribution-guide edits and documentation deletions are excluded. Source licenses and attribution are retained in NOTICE.