0.3.05

CLAUDE.md

@@ -470,7 +470,8 @@ still hear the news. Four publishers today:
   repeating an outage every minute would bury everything else. This is the alert that
   earns the banner its place over playback: video direct-plays from Emby, so when Emby
   stops answering the film stalls with no explanation, and the gateway is still up to
-  say why. `MEMBY_EMBY_HEALTH_INTERVAL=0` turns the probe and both banners off.
+  say why when the household permits playback overlays. `MEMBY_EMBY_HEALTH_INTERVAL=0`
+  turns the probe and both banners off.
 
 `mergeAlerts` interleaves derived and published alerts newest-first and caps at
 `maxAlerts`, which is why every alert carries a timestamp. Alerts also carry their own
@@ -492,13 +493,22 @@ because stealing D-pad focus mid-browse is worse than a missed notice;
 and alerts are suppressed under maintenance and under a mandatory update, which own the
 screen.
 
-**The bar appears over playback too**, not only over the launcher: `PlayerActivity`
-mounts the same composable in a `ComposeView` (`player_service_alerts` in
-`activity_player.xml`, declared before the loading and error overlays so those cover it).
+**Where the bar may appear is the server's decision.** `GatewaySettings.NotificationDisplay`
+is `everywhere`, `home_only` (the default) or `off`, and `/v1/status` carries the effective
+value on every poll. `NotificationDisplayPolicy.fromWire` defaults missing and unknown
+values to Home only, and `notificationEligible` is the single rule every renderer uses:
+Home only admits browsing and refuses playback, Everywhere admits both, and Off admits
+neither. The server also omits `alerts` under Off, but the client still applies the rule so
+an alert already offered cannot remain visible after an operator changes the setting.
+Only the call sites identify their `NotificationSurface`; no screen owns policy logic.
+
+When Everywhere is selected, `PlayerActivity` mounts the same composable in a `ComposeView`
+(`player_service_alerts` in `activity_player.xml`, declared before the loading and error
+overlays so those cover it).
 `alertsSuppressed` starts *true* and is cleared only by `hidePlaybackLoading`, which is
 reached once the preroll is over and the first frame is up — an alert composed behind an
 overlay would be marked seen by a viewer who never saw it, which is the same failure
-`alertShown` exists to prevent. Because it now covers somebody's film, the bar is
+`alertShown` exists to prevent. Because it can cover somebody's film, the bar is
 deliberately small (76dp), near-black, and eases in over ~680ms rather than snapping
 down. It shows the **Emby mark**, not item artwork: a library refresh and an outage have
 no artwork, and one constant mark reads as "your server is talking" where a poster made