jlipworth · Aug 23, 2026 · Aug 23, 2026
@@ -78,6 +78,7 @@ site/
 artifacts/agent-sim-runs/
 artifacts/agent-platform-runs/
 artifacts/app-store-screenshots/
+artifacts/app-store-artwork/
 
 # Local performance-audit evidence (raw traces and manifests may be sensitive)
 artifacts/performance-audit/

@@ -21,10 +21,11 @@ They share the SwiftUI app core, custom AVFoundation player, and
 `PMSKit` backend layer while owning platform-specific shells, input, and system integration.
 
 > **Distribution status:** Labstream is publicly distributed as source for local builds. The
-> former visionOS-only identity has an invitation-only internal TestFlight build, but there is no
-> public App Store release. The coordinated 1.6.1 release is preparing a new neutral universal-
-> purchase identity for visionOS, iOS/iPadOS, tvOS, and macOS. Platform versions remain pre-release
-> until their individual hardware, TestFlight, metadata, and App Review gates pass. See the
+> neutral universal-purchase App Store Connect record now has processed 1.6.1 (build 1) builds for
+> visionOS, iOS/iPadOS, tvOS, and macOS in invitation-only internal TestFlight. Product metadata
+> and initial privacy-safe screenshots are staged, but there is no public App Store release.
+> Platform versions remain pre-release until their individual hardware, review-access, storefront,
+> and App Review gates pass. See the
 > [release and App Store status](docs/RELEASES.md).
 
 > **Development status:** This is an active, pre-release project rather than a compatibility

@@ -8,10 +8,10 @@ Connect contact details, review credentials, tokens, private server addresses, o
 
 | Product | Source version | Distribution status |
 | --- | --- | --- |
-| Apple Vision Pro (`Labstream`) | 1.6.1 (build 1) | Neutral-identity preflight archive produced; exact-release-commit archive, validation, upload, and physical acceptance pending. |
-| iPhone and iPad (`LabstreamMobile`) | 1.6.1 (build 1) | Neutral-identity preflight archive produced; one final iOS archive covers both device families. Validation, upload, and physical acceptance pending. |
-| Apple TV (`LabstreamTV`) | 1.6.1 (build 1) | Unsigned preflight archive produced; Apple Distribution signing, validation, upload, and physical acceptance pending. |
-| Mac (`LabstreamMac`) | 1.6.1 (build 1) | Neutral-identity preflight archive produced; exact-release-commit archive, validation, upload, sandbox, and live-host acceptance pending. |
+| Apple Vision Pro (`Labstream`) | 1.6.1 (build 1) | Clean `20bea2546dd1` archive uploaded and processed; selected for the platform version and available to the internal TestFlight group. Physical TestFlight acceptance and review access remain pending. |
+| iPhone and iPad (`LabstreamMobile`) | 1.6.1 (build 1) | Clean `20bea2546dd1` universal iOS archive uploaded and processed; selected for the platform version and available to the internal TestFlight group. Physical iPhone and iPad acceptance remain pending. |
+| Apple TV (`LabstreamTV`) | 1.6.1 (build 1) | Clean `20bea2546dd1` archive uploaded and processed; selected for the platform version and available to the internal TestFlight group. Physical Apple TV acceptance remains pending. |
+| Mac (`LabstreamMac`) | 1.6.1 (build 1) | Clean `20bea2546dd1` archive uploaded and processed; selected for the platform version and installed from TestFlight on a Mac. Deeper sandbox and live-host acceptance remain pending. |
 
 The four targets share the neutral `org.labstream.Labstream` bundle identifier and are intended
 for one App Store Connect universal-purchase record. The earlier private visionOS 1.6.0 build used
@@ -24,6 +24,14 @@ macOS each use their own archive. Metadata, screenshots, build selection, review
 acceptance remain platform-specific even when the platforms share one purchase record. A platform
 must not be marked ready merely because another platform passed review.
 
+App Store Connect currently has the shared app information, free price schedule, published
+**Data Not Collected** privacy answer, platform descriptions, review contacts, build selections,
+manual-release settings, and one privacy-safe synthetic placeholder screenshot for each submitted
+device family. Those screenshots prove the capture and upload path, but they are not the intended
+public product-page set. App availability is not yet enabled. Licensed demo media, final screenshot
+capture and review, demo review access, review notes, physical-platform acceptance, storefront
+scope, Digital Services Act status where applicable, and final submission remain open.
+
 `1.6.1` is the user-facing marketing version (`CFBundleShortVersionString`). The number in
 parentheses is the App Store build number (`CFBundleVersion`). A new marketing version begins at
 build 1; each replacement upload for the same platform and marketing version must use a higher
@@ -45,8 +53,9 @@ The first neutral-identity deployment should proceed in this order:
 4. Upload each archive and wait for App Store Connect processing. Treat warnings or missing
    platform associations as blockers; do not advance a different binary merely because it shares
    the version number.
-5. Complete shared app information plus platform-specific metadata, screenshots, build selection,
-   privacy/export answers, review notes, and review access.
+5. Establish the reviewer environment and its licensed sample-media inventory, then capture and
+   privacy-review the final platform-specific screenshot sets. Complete shared app information plus
+   platform metadata, build selection, privacy/export answers, review notes, and review access.
 6. Install processed builds through TestFlight on every submitted device family, starting from a
    fresh install for the identity boundary and sign-in checks. Record the platform-specific gates
    below.
@@ -68,6 +77,22 @@ those conditions is uncertain, run a dedicated review-only Jellyfin instance ins
 credentials only in App Store Connect. Test the final instructions from clean installs on Vision
 Pro, iPhone, iPad, Apple TV, and Mac before submission.
 
+The official stable demo is the first evaluation lane before provisioning new infrastructure. It
+currently exposes a passwordless shared account, Quick Connect, Movies/Shows/Music/Playlists, and a
+catalog containing public/open test media. It is useful for compatibility and screenshot trials,
+but it is not yet accepted as the final reviewer dependency: the shared account is mutable,
+downloads are disabled, service resets can interrupt sessions, and the project's permission for
+third-party App Store marketing screenshots still needs to be established. Labstream supports the
+demo's passwordless Jellyfin login as of
+[issue #283](https://github.com/jlipworth/Labstream/issues/283).
+
+Prefer a Labstream-controlled review instance with a deterministic catalog of original,
+public-domain, or appropriately Creative Commons media. Record every title, artwork source,
+license, attribution requirement, and permitted screenshot/review use in a repository manifest;
+do not use commercial movie or television artwork merely because a metadata provider can return
+it. The same catalog should drive automated screenshots and the reviewer journey so the captured
+UI matches the environment Apple can actually test.
+
 ## Apple-platform release checklist
 
 ### Repository and binary
@@ -76,14 +101,14 @@ Pro, iPhone, iPad, Apple TV, and Mac before submission.
       bundles, or personal media data, including in newly added files.
 - [ ] `PMSKit` hermetic tests, repository hygiene, strict MkDocs, and the affected native test
       matrix pass.
-- [ ] Clean Release archives are produced for iOS/iPadOS, visionOS, tvOS, and macOS with the
+- [x] Clean Release archives are produced for iOS/iPadOS, visionOS, tvOS, and macOS with the
       intended Xcode release and Apple Distribution signing; every archive reports the neutral
       bundle identifier and expected marketing version and build number.
-- [ ] Archives are reproducible from the exact public release commit. If that commit changes after
+- [x] Archives are reproducible from the exact public release commit. If that commit changes after
       a preflight archive, rebuild rather than treating the older archive as the submission binary.
-- [ ] Every platform archive passes Xcode validation and App Store Connect processing without
+- [x] Every platform archive passes Xcode validation and App Store Connect processing without
       compliance or binary warnings.
-- [ ] Each selected App Store Connect build reports the intended minimum OS, device family,
+- [x] Each selected App Store Connect build reports the intended minimum OS, device family,
       entitlements, and supported architecture.
 - [ ] A physical Vision Pro TestFlight smoke covers first launch, sign-in, browse, playback,
       seeking, subtitles, audio, Cinema, background/foreground, and diagnostics. Simulator smoke
@@ -102,52 +127,61 @@ Pro, iPhone, iPad, Apple TV, and Mac before submission.
 
 - [ ] App name, subtitle, category, age rating, description, keywords, copyright, and availability
       are complete and match the product that was tested.
-- [ ] The description states that Labstream connects to a server selected by the user, provides no
+- [x] The description states that Labstream connects to a server selected by the user, provides no
       media, and is unofficial and unaffiliated with Plex, Jellyfin, and Emby.
-- [ ] The public support URL and privacy-policy URL resolve over HTTPS:
+- [x] The public support URL and privacy-policy URL resolve over HTTPS:
       [Support](https://jlipworth.github.io/Labstream/support/) and
       [Privacy](https://jlipworth.github.io/Labstream/privacy/).
-- [ ] Every platform version has reviewed screenshots for each required App Store device size;
+- [ ] Replace the currently staged single-image synthetic placeholders with final, reviewed
+      screenshot sets for every required App Store device size;
       the Vision Pro set includes at least one 3840 × 2160 image. Apple permits up to ten
       screenshots and up to three optional app previews per supported size and localization. See
       Apple's current
       [screenshot specifications](https://developer.apple.com/help/app-store-connect/reference/app-information/screenshot-specifications)
       before capture because requirements can change.
-- [ ] Screenshots show only authorized media and contain no account, server, network, or personal
-      information.
-- [ ] App Privacy answers match the shipped privacy manifest and runtime behavior. The current
+- [ ] Final screenshots show only licensed demo media and contain no account, server, network, or
+      personal information. At minimum, cover Home, library browsing, a title detail surface, and
+      playback; add Downloads only on platforms that ship it and platform-specific features only
+      where they are actually available.
+- [ ] Screenshot automation can reproduce the accepted set from clean fixture/review state for
+      iPhone, iPad, Mac, Apple TV, and Apple Vision Pro, and the exported files pass the repository
+      size/privacy manifest validator before upload.
+- [x] App Privacy answers match the shipped privacy manifest and runtime behavior. The current
       intended answer is **Data Not Collected**: Labstream has no developer analytics, tracking,
       telemetry upload, or developer-operated backend. Re-audit this if dependencies or behavior
       change.
-- [ ] Export-compliance answers match the binary. `ITSAppUsesNonExemptEncryption` is currently
+- [x] Export-compliance answers match the binary. `ITSAppUsesNonExemptEncryption` is currently
       false; re-evaluate if cryptography use changes.
 
 ### TestFlight and App Review
 
-- [ ] TestFlight beta description, feedback contact, and **What to Test** text are current. Internal
+- [x] TestFlight beta description, feedback contact, and **What to Test** text are current. Internal
       builds remain available for 90 days; Apple currently permits up to 100 internal App Store
       Connect users. See the current [TestFlight overview](https://developer.apple.com/help/app-store-connect/test-a-beta-version/testflight-overview).
-- [ ] Review contact information is complete in App Store Connect. Do not commit it here.
+- [x] Review contact information is complete in App Store Connect. Do not commit it here.
 - [ ] Because the app requires sign-in, App Review has a stable, non-expiring demo path and clear
       steps for choosing a backend, signing in, browsing a library, and playing authorized sample
       media. Store credentials only in App Store Connect, never in Git or issue comments.
 - [ ] The review environment is reachable from Apple networks without a VPN or private DNS, uses
       non-personal sample media that may be shown to reviewers, and is tested from a fresh install
       on every submitted platform. If a community demo service is used, verify its current terms,
       stability, credentials, and permission for App Review before depending on it.
+- [ ] Do not enable public availability, add a platform version for review, or submit the app until
+      the licensed-media manifest, final screenshot sets, and clean-install reviewer journey above
+      have been accepted.
 - [ ] Review notes explain local-network access, direct connections to user-selected servers,
       optional offline downloads, the absence of bundled media, and where Cinema mode is found.
 - [ ] Review notes call out platform differences: one iOS binary serves iPhone and iPad; tvOS has
       no downloads/offline surface; Cinema is visionOS-only; and macOS uses a sandboxed native app.
-- [ ] The correct build is attached to each platform version before **Add for Review** and the final
+- [x] The correct build is attached to each platform version before **Add for Review** and the final
       **Submit for Review** action. See Apple's current
       [submission procedure](https://developer.apple.com/help/app-store-connect/manage-submissions-to-app-review/submit-an-app).
 
 ### Account-holder and legal gates
 
 These gates cannot be completed by source changes or automation:
 
-- [ ] The Account Holder reviews and accepts any current Apple Developer Program agreement.
+- [x] The Account Holder reviews and accepts any current Apple Developer Program agreement.
 - [ ] Trader status is declared. Apple requires a declaration even when an app is not offered in
       the EU; EU distribution by a trader requires verified public contact information. See
       Apple's [EU Digital Services Act guidance](https://developer.apple.com/help/app-store-connect/manage-compliance-information/manage-european-union-digital-services-act-trader-requirements/).

@@ -4,8 +4,10 @@ Labstream is a native Apple-platform media client for Plex, Jellyfin, and Emby.
 pre-release App Store set includes Apple Vision Pro, one universal iPhone/iPad target, a
 streaming-only Apple TV target, and a native Mac target. Labstream is distributed publicly as
 source. A retired personal-identity visionOS build exists in invitation-only internal TestFlight,
-but the neutral four-platform App Store record has not yet been created and the 1.6.1 builds have
-not been uploaded. There is no public App Store release. Labstream is designed
+and the neutral four-platform App Store record now has processed 1.6.1 (build 1) builds in
+invitation-only internal TestFlight. Initial product metadata and privacy-safe screenshots are
+staged, but review access, hardware acceptance, storefront scope, and App Review remain open.
+There is no public App Store release. Labstream is designed
 around privacy: the app has no
 developer-operated backend, talks to the media services/server you choose, and does not
 automatically send diagnostics or analytics to the developer.

@@ -0,0 +1,67 @@
+# Jellyfin public-demo evaluation for screenshots and App Review
+
+**Status:** active research; do not treat the public service as the accepted App Review
+environment yet.
+
+## Question
+
+Can Labstream use Jellyfin's official public stable demo for cross-platform storefront screenshots
+and Apple's reviewer journey, avoiding a dedicated review server?
+
+## Confirmed on 2026-08-22
+
+- Jellyfin explicitly identifies its public demo as an exception provided for evaluation and
+  testing in its [server policy](https://jellyfin.org/docs/general/community-standards/servers/).
+  Its client-testing documentation also directs testers to the stable/unstable demo and says the
+  login page provides credentials.
+- `https://demo.jellyfin.org/stable/` was reachable and reported Jellyfin Server 10.11.11.
+- The stable service exposed a shared passwordless account, Quick Connect, and Movies, Shows,
+  Music, and Playlists libraries. The visible catalog included Blender shorts and older/open-media
+  film and television material with poster/backdrop art.
+- A credential-ephemeral PMSKit live probe passed the shared views, items, and metadata wrappers:
+  HTTP 200 for all three. No token, session, item identifier, server-internal address, or response
+  body was retained. Timeline mutation was deliberately not enabled against the shared account.
+- The public account policy disabled media downloads. Shared preferences were mutable, so another
+  visitor can change language and presentation state.
+- Passwordless Jellyfin sign-in landed through
+  [issue #283](https://github.com/jlipworth/Labstream/issues/283) and
+  [PR #284](https://github.com/jlipworth/Labstream/pull/284). The UI now requires the server and
+  username but allows an empty password, while Emby and Plex validation remain unchanged. A
+  transient authentication/logout check against the stable demo passed without retaining a token.
+
+## Current interpretation
+
+| Use | Current verdict | Reason |
+| --- | --- | --- |
+| PMSKit compatibility testing | Suitable | Official test purpose and live browse/metadata proof. |
+| Screenshot workflow prototyping | Suitable with review | Realistic catalog and artwork, but selected visible assets still need license provenance. |
+| Final public storefront screenshots | Unresolved | Access to a demo does not by itself establish third-party marketing rights for every downloaded metadata image. |
+| Complete Apple reviewer account | Not yet suitable | Shared mutable state, disabled downloads, possible reset interruptions, and no Labstream-controlled availability. |
+
+Jellyfin has historically told public-demo testers that the service resets hourly, and its own
+vendor-certification discussion describes separate private vendor environments. Those records are
+useful risk evidence, but the current reset schedule must be revalidated rather than assumed from
+an older issue.
+
+The public catalog's media may be public domain or Free Culture, but that does not automatically
+prove the provenance of every poster, logo, backdrop, or third-party metadata-provider image.
+Only assets with an auditable source/license should appear in Labstream's final screenshots.
+
+## Exit criteria
+
+1. [x] Merge #283, validate the request against the stable demo, and preserve Emby/Plex behavior.
+   Clean-install reviewer-journey testing remains part of criterion 2.
+2. Exercise browse, details, artwork, playback, and platform navigation against the stable demo on
+   iPhone, iPad, Mac, Apple TV, and Apple Vision Pro.
+3. Identify a screenshot title/artwork subset with source, license, attribution, and marketing-use
+   permission recorded in a repository manifest.
+4. Observe whether resets or shared-state changes make deterministic capture or multi-day review
+   instructions unreliable.
+5. Decide whether disabled downloads prevent Apple from receiving sufficient access to the
+   submitted iOS/iPadOS, macOS, and visionOS products.
+
+If any final-use criterion fails, provision a minimal Labstream-controlled Jellyfin environment.
+A container or small Proxmox LXC is preferable to a full VM when the existing infrastructure and
+security boundary allow it. A public-domain library generator such as
+[`stdjflib`](https://github.com/iwalton3/stdjflib) may reduce catalog setup work, but it requires a
+separate source/security/license review before deployment.