[jlipworth]

Summary

• distinguish a retained-but-temporarily-unavailable saved session from invalid or missing credentials
• admit a deliberately restricted Offline launch surface only when a completed local media file is present
• expose reconnect, sign-in, Settings, local playback, resume, and deletion without fabricating a browse-ready server session
• keep tvOS on the existing sign-in path because it does not ship downloads
• document the behavior and add it to the cross-backend manual checklist

Addresses #259.

Validation

• swift test --package-path PMSKit --no-parallel --skip 'Live.*ProbeTests' (1,662 tests passed)
• affected native build matrix: visionOS, iPhone/iPad, tvOS, and macOS builds passed
• targeted SessionRestoreOutcomeTests, BrowseUIGateTests, and OfflineLaunchAvailabilityTests passed
• strict MkDocs build, repository link validation, Mermaid validation, and scripts/ci-hygiene.sh passed
• visionOS passive fixture smoke passed and rendered the expected Home surface
• macOS host build/launch smoke passed; staged host app was removed afterward
• iPhone passive fixture rendered the expected Home surface, but the helper exited during teardown with a CoreSimulator launchd error; no simulator remained booted

Remaining acceptance gates

• manually prove disconnected cold launch and local playback with a real completed download for Plex, Jellyfin, and Emby
• prove expired/revoked credentials still require sign-in
• prove reconnect transitions back to the normal authenticated shell without duplicate presentation

Test note

The full macOS-hosted test lane reported pre-existing concurrency-sensitive failures in SideAssetFetchCoordinatorTests.testQueuedCancellationMovesAdmissionAuthorityToSurvivingOwner() and DownloadStoreLookupTests.startupRetirementPreservesCrossKindMainMediaAlias(). The former passed on targeted rerun; the feature-specific tests all passed.