chore: publish verified 1.9.0-alpha OTA and app catalog

docs/post-1.9.0-work-backlog.md

@@ -262,6 +262,28 @@ ahead of that work or as an untested addition to the current release.
   from node-only demo to proper public app release without duplicate app IDs,
   conflicting state, lost configuration or automatic exposure before approval.
 
+### V4V persistent playback and existing demo music catalog
+
+- Use the demo song catalog from the existing V4V Portainer demo in the Gitea
+  repository identified above. Inspect its actual catalog configuration and media
+  sources; preserve artist attribution and payment destinations. Do not substitute
+  an invented catalog or copy credentials into public app configuration.
+- Integrate V4V with the local player bar: leaving or closing the app view must
+  retain playback, expose track information and playback controls, and offer a
+  button to reopen V4V at the same track and position without restarting playback.
+  Explicit stop remains available. This concerns closing the app view; operating
+  system termination/background restrictions require separate qualification.
+- Inspect supported app/player integration before choosing an implementation.
+  Maintain one playback session, prevent duplicate audio on reopen, authenticate
+  app-to-shell messages, and preserve the requirement of no native Nostr signer.
+- Test navigation, repeated close/reopen, pause/resume/seek, track changes,
+  disconnect/recovery and unavailable media on desktop and the actual companion.
+  Check track, queue and position continuity, accessible compact controls and
+  mobile background behavior. Record platform limitations rather than promising
+  playback after an operating system terminates the app.
+- Keep catalog and player integration within the Yaya-only demo scope until
+  separately approved for general release.
+
 ## 14. FIPS media transport requirement
 
 - Operator explicitly requires FIPS for streaming peer files and distributed

docs/release-1.9.0-acceptance.md

@@ -963,3 +963,18 @@ were not independently completed (funded regtest, prior operator purchase/free
 reopen and persisted ownership/file evidence remain separate). Dev Bitcoin is
 still in IBD; live full-chain Angor evidence is from Shorty. Historical discovery
 limitation was explicitly accepted, not relabeled a passing recovery test.
+
+### Public OTA assets verified and metadata promotion
+
+Canonical release proposal5957be8c89cd192308860c194b05bed9f3077093d8284db0350503ec4adbded8
+was marked applied. Local, ngit and Gitea main/tag parity passed; the annotated
+v1.9.0-alpha tag points to7abd04a7. Follow-up FIPS backlog proposal
+6015e09dcaba7004057dadb50b9dc09b5ada8e5cfdfa9be458ded7a0dad5002b
+was also marked applied with exact accepted main mirrored.
+
+Public backend, corrected frontend6d5135fa, signed manifest, signed catalog479f6193
+and companion0.5.34 APK all passed full download byte-count and SHA256 checks:
+`/tmp/archy-190-publish-ota.log`. Public manifest/catalog bytes also match their
+locally verified pinned-root signatures. Promote those exact bytes to the live
+metadata paths; no artifact or signature changed. ISO upload and demo deployment
+are separate ongoing operations, not inferred passed from OTA asset publication.