t66: app names on a device that exposes none

The reported Shield names no app: `pm dump com.netflix.ninja` is ~2241 lines of
dumpsys and grep for `application-label` over the whole capture finds nothing.
The probe shipped `| head -300`, which cut the dump BEFORE the package section,
so "no label" was a truncation artefact; the sweep then named every app after
its own package id, and the apps editor pre-filled the `pkg=pkg` row the user
read as a bug.

  * the probe greps ON THE DEVICE for the three shapes Android prints
    (`application-label`, `nonLocalizedLabel`, `labelRes`); a quoted value is a
    name, `null` and a resource id are not. The dump is never truncated.
  * after APP_LABEL_PROBE_LIMIT consecutive "ran, no label" answers the device
    is taken at its word: the sweep stops spending a shell per package
    (APP_LABEL_TTL expiry re-checks, and a package whose probe FAILED still owes
    its retry — t57 UNIT 0 survives, driven by the app on screen).
  * ONE precedence chain in `ha_adb_common/app_label.resolve_package_name`, used
    by the media player, the Current App sensor, the discovery table, the source
    list and the apps editor: user map > device label > curated map > package id
    (the id shown ONCE, `name` empty when nothing names the app).
  * the curated table covers the user's 21 apps (community-maintained, not
    device truth) and the Configure row says when the device named nothing.
  * the real device shape is a test fixture (trimmed, and marked as such in the
    file: the raw capture is not in the repo) pinning that no label is
    extracted, that the probe count is bounded, and that `Netflix` surfaces.

Also drops the dead `ATTR_MEDIA_DAG_NOW_PLAYING` re-exports left by the t65
flattening and updates the RESEARCH_SHIELD now-playing note to the flat names.

No real Shield was available: the fetch/burst behaviour is exercised against the
documented Android output and the trimmed reproduction of the reported capture.

tests/test_command_routing.py

@@ -875,7 +875,9 @@ class TestPrivacyOrdering:
         player._last_channel = "101"
         np = player._get_app_now_playing()
 
-        assert np["title"] == TIVIMATE_PACKAGE  # app identity, not the channel
+        # t66: the identity tier now resolves through the shared chain, so the app
+        # reads by its name — still the APP, never the channel or the media title.
+        assert np["title"] == "TiviMate"
         assert np["title"] != "101"
 
     async def test_channel_number_never_leaks_in_privacy_mode_with_last_known(self, modules):
@@ -893,7 +895,8 @@ class TestPrivacyOrdering:
         np = player._get_app_now_playing()
 
         assert np["state"] == "playing"  # playback truth survives privacy
-        assert np["title"] == TIVIMATE_PACKAGE  # but identity stays the app
+        assert np["title"] == "TiviMate"  # but identity stays the app
+        assert "Sky News" not in np.values()  # the media title never leaks
 
 
 class TestVolumeAndPowerLadder:
@@ -1725,23 +1728,26 @@ class TestCurrentAppNameEndToEndT55:
         return player, manager, sensor, poller
 
     async def test_known_app_resolves_by_fetching_its_label(self, modules):
+        # t66: a package NOT in the curated table, so the fall-through under test
+        # is really the raw id and not a curated name.
         player, manager, sensor, poller = self._wire(
-            modules, "com.netflix.ninja", {"com.netflix.ninja": "application-label: 'Netflix'"}
+            modules,
+            "com.example.labelled",
+            {"com.example.labelled": "application-label: 'Labelled App'"},
         )
 
         # first render: cache miss → the sensor falls through to the package
-        assert sensor.native_value == "com.netflix.ninja"
-        assert manager.app_label_requests == {"com.netflix.ninja"}
+        assert sensor.native_value == "com.example.labelled"
+        assert manager.app_label_requests == {"com.example.labelled"}
 
         # the watchdog drains the fetch for the CURRENT package
         await manager._watchdog_cycle(5.0)
         await asyncio.sleep(0)
-        assert poller.dumps and "com.netflix.ninja" in poller.dumps[0]
+        assert poller.dumps and "com.example.labelled" in poller.dumps[0]
 
         # next render: the resolved device name, in the sensor AND the player
-        assert sensor.native_value == "Netflix"
-        assert sensor.extra_state_attributes["app_name"] == "Netflix"
-        assert player.app_name == "Netflix"
+        assert sensor.native_value == "Labelled App"
+        assert player.app_name == "Labelled App"
 
     async def test_mapped_app_never_needs_the_device_label(self, modules):
         player, manager, sensor, poller = self._wire(
@@ -1818,7 +1824,9 @@ class TestCurrentAppNameEndToEndT55:
         here — the pre-fix tree fails this at the second cycle.
         """
         player, manager, sensor, poller = self._wire(
-            modules, "ar.tvplayer.tv", {"ar.tvplayer.tv": "application-label: 'TiviMate'"}
+            modules,
+            "com.example.labelled",
+            {"com.example.labelled": "application-label: 'Labelled App'"},
         )
 
         async def _blank(_cmd):
@@ -1827,16 +1835,16 @@ class TestCurrentAppNameEndToEndT55:
 
         # cycle 1: the transport delivered nothing → a FAILED fetch
         poller.shell = _blank
-        assert sensor.native_value == "ar.tvplayer.tv"
+        assert sensor.native_value == "com.example.labelled"
         await manager._watchdog_cycle(5.0)
         await asyncio.sleep(0)
 
-        assert "ar.tvplayer.tv" not in manager._app_labels  # nothing stamped
-        assert sensor.native_value == "ar.tvplayer.tv"
+        assert "com.example.labelled" not in manager._app_labels  # nothing stamped
+        assert sensor.native_value == "com.example.labelled"
 
         # the next render re-enqueues, and the retry is what recovers the label
-        assert manager.app_label("ar.tvplayer.tv") is None
-        assert manager.app_label_requests == {"ar.tvplayer.tv"}
+        assert manager.app_label("com.example.labelled") is None
+        assert manager.app_label_requests == {"com.example.labelled"}
         dump_count = len([d for d in poller.dumps if "pm dump" in d])
 
         real_shell = _LabelPoller.shell.__get__(poller, _LabelPoller)
@@ -1846,9 +1854,9 @@ class TestCurrentAppNameEndToEndT55:
 
         # a later GOOD dump recovers it — the pre-fix cache made this impossible
         assert len([d for d in poller.dumps if "pm dump" in d]) == dump_count + 1
-        assert sensor.native_value == "TiviMate"
-        assert sensor.extra_state_attributes["app_name"] == "TiviMate"
-        assert player.app_name == "TiviMate"
+        assert sensor.native_value == "Labelled App"
+        assert sensor.extra_state_attributes["app_name"] == "Labelled App"
+        assert player.app_name == "Labelled App"
 
     @pytest.mark.parametrize("blank", [None, ""], ids=["none", "empty"])
     async def test_the_player_recovers_the_label_after_a_failed_fetch(
@@ -1861,7 +1869,9 @@ class TestCurrentAppNameEndToEndT55:
         stuck on the package id — so both are pinned.
         """
         player, manager, sensor, poller = self._wire(
-            modules, "com.netflix.ninja", {"com.netflix.ninja": "application-label: 'Netflix'"}
+            modules,
+            "com.example.labelled",
+            {"com.example.labelled": "application-label: 'Labelled App'"},
         )
 
         async def _blank(_cmd):
@@ -1869,19 +1879,19 @@ class TestCurrentAppNameEndToEndT55:
             return blank
 
         poller.shell = _blank
-        assert player.app_name == "com.netflix.ninja"
+        assert player.app_name == "com.example.labelled"
         await manager._watchdog_cycle(5.0)
         await asyncio.sleep(0)
-        assert "com.netflix.ninja" not in manager._app_labels
-        assert player.app_name == "com.netflix.ninja"
+        assert "com.example.labelled" not in manager._app_labels
+        assert player.app_name == "com.example.labelled"
 
-        assert manager.app_label("com.netflix.ninja") is None  # re-enqueued
+        assert manager.app_label("com.example.labelled") is None  # re-enqueued
         poller.shell = _LabelPoller.shell.__get__(poller, _LabelPoller)
         await manager._watchdog_cycle(5.0)
         await asyncio.sleep(0)
 
-        assert player.app_name == "Netflix"
-        assert sensor.native_value == "Netflix"
+        assert player.app_name == "Labelled App"
+        assert sensor.native_value == "Labelled App"
 
     async def test_a_genuinely_label_less_package_is_still_negatively_cached(
         self, modules
@@ -1910,16 +1920,16 @@ class TestCurrentAppNameEndToEndT55:
     async def test_the_fetch_targets_the_app_on_screen_not_the_previous_one(self, modules):
         player, manager, sensor, poller = self._wire(
             modules,
-            "ar.tvplayer.tv",
+            "com.example.one",
             {
-                "ar.tvplayer.tv": "application-label: 'TiviMate'",
-                "com.google.android.youtube.tv": "application-label: 'YouTube'",
+                "com.example.one": "application-label: 'One TV'",
+                "com.example.two": "application-label: 'Two TV'",
             },
         )
 
-        assert sensor.native_value == "ar.tvplayer.tv"  # miss for the 1st app
-        manager._on_current_app("com.google.android.youtube.tv")
-        assert sensor.native_value == "com.google.android.youtube.tv"
+        assert sensor.native_value == "com.example.one"  # miss for the 1st app
+        manager._on_current_app("com.example.two")
+        assert sensor.native_value == "com.example.two"
 
         # both packages are queued; the watchdog drains ONE per cycle
         await manager._watchdog_cycle(5.0)
@@ -1929,9 +1939,9 @@ class TestCurrentAppNameEndToEndT55:
 
         # every drained fetch names a package, and the app that is CURRENT is
         # the one the sensor now shows the label of
-        assert "ar.tvplayer.tv" in poller.dumps[0]
-        assert "com.google.android.youtube.tv" in poller.dumps[1]
-        assert sensor.native_value == "YouTube"
+        assert "com.example.one" in poller.dumps[0]
+        assert "com.example.two" in poller.dumps[1]
+        assert sensor.native_value == "Two TV"
 
 
 class TestAvailabilityLadder:

tests/test_config_flow_ux.py

@@ -2250,8 +2250,9 @@ class TestDiscoveryFeedsTheAppsTable:
             [
                 {"package": "ar.tvplayer.tv", "name": "TiviMate", "icon": "mdi:television-classic"},
                 {"package": "org.xbmc.kodi", "name": "Kodi", "icon": "mdi:kodi"},
-                {"package": "com.example.handmade", "name": "com.example.handmade",
-                 "icon": "mdi:television"},
+                # t66: a discovered app nothing can name comes through as name ""
+                # (the sweep no longer repeats the package id as a name)
+                {"package": "com.example.handmade", "name": "", "icon": "mdi:television"},
             ],
         )
 
@@ -2263,7 +2264,9 @@ class TestDiscoveryFeedsTheAppsTable:
         assert lines[0] == "ar.tvplayer.tv=Telly"
         # every discovered app is a row too — this is the live bug
         assert "org.xbmc.kodi=Kodi" in lines
-        assert "com.example.handmade=com.example.handmade" in lines
+        # ...but an app nothing names is NOT pre-filled as `pkg=pkg` (t66): the id
+        # would be stored as if it were a name. The row editor still offers it.
+        assert not [line for line in lines if line.startswith("com.example.handmade=")]
         # the user's name wins over the device label for the same package
         assert not [line for line in lines if line == "ar.tvplayer.tv=TiviMate"]
         # ...and the discovered icon is NEVER written into the icon column

tests/test_connection.py

@@ -18,7 +18,7 @@ from nsh.connection import (
     ShieldConnectionManager,
     StateStore,
 )
-from nsh.const import ADB_POLL_INTERVAL, APP_LABEL_EXIT_MARKER
+from nsh.const import ADB_POLL_INTERVAL, APP_LABEL_EXIT_MARKER, APP_LABEL_GREP_SHAPES
 
 
 def test_connection_module_depends_on_no_homeassistant():
@@ -310,12 +310,16 @@ class TestAppLabelCache:
 
         await asyncio.sleep(0)  # drain the fetch task
 
-        # t57: the dump carries the exit marker too, so a blank answer can be
-        # told from a FAILED fetch; the package is still quoted
+        # t57: the probe carries the exit marker too, so a blank answer can be told
+        # from a FAILED fetch; the package is still quoted. t66: the label candidates
+        # are filtered ON THE DEVICE, and the 2241-line dump is never truncated —
+        # `head -300` cut it before the package section on the user's Shield.
         assert manager._poller.shell_calls == [
-            f"pm dump {shlex.quote(wicked)} 2>/dev/null | head -300; "
+            f"pm dump {shlex.quote(wicked)} 2>/dev/null | "
+            f"grep -E {shlex.quote(APP_LABEL_GREP_SHAPES)} | head -40; "
             f"echo {APP_LABEL_EXIT_MARKER}$?"
         ]
+        assert "head -300" not in manager._poller.shell_calls[0]
 
 
 class TestLogcatStream:

tests/test_installed_apps.py

@@ -37,6 +37,8 @@ def scoped_entity_stubs():
 from nsh.connection import ShieldConnectionManager  # noqa: E402
 from nsh.const import (  # noqa: E402
     APP_ICON_FALLBACKS,
+    APP_LABEL_EXIT_MARKER,
+    APP_LABEL_GREP_SHAPES,
     APP_LIST_TTL,
     CONF_APP_NAME_MAP,
 )
@@ -50,16 +52,35 @@ from nsh.ha_adb_common import (  # noqa: E402
 
 # ── realistic device output ────────────────────────────────────────────────
 
-#: `pm list packages -3` on a Shield with a normal app set. Wrapped the way a
-#: real adb shell answers (a bare list, no header).
+#: `pm list packages -3` on the user's Shield (t66). These are the apps the
+#: report listed, which is also why they are the curated table's rows: on THIS
+#: device the firmware names none of them, so the table — not the device — is where
+#: the names come from. `org.xbmc.kodi` and `com.example.handmade` are kept as the
+#: packages NOTHING can name (no device label, no curated row), so the fall-through
+#: to "" is pinned on the same list.
 USER_PACKAGES = (
     "package:ar.tvplayer.tv\n"
+    "package:be.digitalia.mediasession2mqtt\n"
+    "package:com.amazon.amazonvideo.livingroom\n"
+    "package:com.esaba.downloader\n"
     "package:com.github.damontecres.wholphin\n"
-    "package:com.netflix.ninja\n"
+    "package:com.google.android.sambadocumentsprovider\n"
+    "package:com.google.android.speech.pumpkin\n"
+    "package:com.google.android.tts\n"
+    "package:com.google.android.tvlauncher\n"
     "package:com.google.android.youtube.tv\n"
+    "package:com.hyperion.grabber\n"
+    "package:com.lonelycatgames.Xplore\n"
+    "package:com.nendo.argosy\n"
+    "package:com.netflix.ninja\n"
+    "package:com.plexapp.mediaserver.smb\n"
+    "package:com.retroarch\n"
+    "package:com.spocky.projengmenu\n"
+    "package:dev.jdtech.jellyfin\n"
+    "package:dev.trooped.tvquickbars\n"
+    "package:flar2.homebutton\n"
+    "package:tv.pluto.android\n"
     "package:org.xbmc.kodi\n"
-    "package:com.plexapp.android\n"
-    "package:com.spotify.tv.android\n"
     "package:com.example.handmade\n"
 )
 
@@ -88,18 +109,133 @@ DUMP_LABEL_LESS = (
     "  codePath=/data/app/com.example.handmade\n"
 )
 
+#: The REAL device shape, trimmed: `pm dump com.netflix.ninja` on the user's Shield
+#: (captured 2026-10-12; the observed structure is recorded in
+#: ``docs/INTENTS_PLAN.md`` §1). It is the evidence behind this work — the raw
+#: ~2241-line capture text is NOT in the repository, so this is a faithful
+#: reproduction of the recorded structure, not the capture itself.
+#:
+#: WHAT IS REPRODUCED: the whole-dumpsys envelope (`DUMP OF SERVICE package:`,
+#: then `activity`, `meminfo`, `procstats`, `usagestats`, `batterystats`), the
+#: package section opening with `Activity Resolver Table:` followed by the
+#: receiver/service tables, Netflix's real entries (`cast:`, `http`/`https` with
+#: `www.netflix.com` path globs, `nflx:`, `netflix:`, `MAIN` +
+#: `LEANBACK_LAUNCHER`) and the capture's own noise (`com.netflix.action.DEBUG_*`,
+#: `androidx.*`, `com.google.firebase.*`, `ConstraintProxy*`) — and, the point of
+#: the whole exercise, NO `application-label` line anywhere: grepping the capture
+#: for `application-label` found nothing.
+#:
+#: (`nonLocalizedLabel=null`, `labelRes=0x7f0f0d31`) — the capture's record covers
+#: the resolver tables, not this block. They are here because they are exactly the
+#: shapes the on-device search must NOT read as a name: `null` is not a name, and a
+#: resource id is not a name either. The bodies of the four trailing service
+#: sections are trimmed to one line each (the capture is ~2241 lines; this is ~80).
+DUMP_NETFLIX_REAL = (
+    "DUMP OF SERVICE package:\n"
+    "Activity Resolver Table:\n"
+    "  Full MIME Types:\n"
+    "    video/*: 7f0f4c12 com.netflix.ninja/.ui.MainActivity filter 7f0f0a11\n"
+    "      Action: \"android.intent.action.VIEW\"\n"
+    "      Category: \"android.intent.category.DEFAULT\"\n"
+    "      Category: \"android.intent.category.BROWSABLE\"\n"
+    "      Scheme: \"https\"\n"
+    "        Authority: \"www.netflix.com\": -1\n"
+    "        Path: \"PatternMatcher{LITERAL,/title}\"\n"
+    "      Scheme: \"http\"\n"
+    "        Authority: \"www.netflix.com\": -1\n"
+    "    nflx: 7f0f4c12 com.netflix.ninja/.ui.MainActivity filter 7f0f0a12\n"
+    "      Action: \"android.intent.action.VIEW\"\n"
+    "      Category: \"android.intent.category.DEFAULT\"\n"
+    "      Scheme: \"nflx\"\n"
+    "    netflix: 7f0f4c12 com.netflix.ninja/.ui.MainActivity filter 7f0f0a13\n"
+    "      Action: \"android.intent.action.VIEW\"\n"
+    "      Scheme: \"netflix\"\n"
+    "  Non-Data Actions:\n"
+    "    android.intent.action.MAIN:\n"
+    "      7f0f4c12 com.netflix.ninja/.ui.MainActivity filter 7f0f0a14\n"
+    "        Action: \"android.intent.action.MAIN\"\n"
+    "        Category: \"android.intent.category.LEANBACK_LAUNCHER\"\n"
+    "    cast:\n"
+    "      7f0f4c12 com.netflix.ninja/.ui.MainActivity filter 7f0f0a15\n"
+    "        Action: \"android.intent.action.VIEW\"\n"
+    "        Scheme: \"cast\"\n"
+    "    com.netflix.action.DEBUG_FORCE_EXIT:\n"
+    "      7f0f4c12 com.netflix.ninja/.DebugReceiver filter 7f0f0a16\n"
+    "        Action: \"com.netflix.action.DEBUG_FORCE_EXIT\"\n"
+    "Receiver Resolver Table:\n"
+    "  Non-Data Actions:\n"
+    "    androidx.work.DiagnosticsReportReceiver:\n"
+    "      7f0f4c12 com.netflix.ninja/androidx.work.impl.diagnostics.DiagnosticsReceiver\n"
+    "    com.google.firebase.MESSAGING_EVENT:\n"
+    "      7f0f4c12 com.netflix.ninja/com.google.firebase.messaging.FirebaseMessagingService\n"
+    "    com.netflix.action.DEBUG_PUSH_NOTIFICATION:\n"
+    "      7f0f4c12 com.netflix.ninja/.push.DebugPushReceiver\n"
+    "Service Resolver Table:\n"
+    "  Non-Data Actions:\n"
+    "    com.google.firebase.INSTANCE_ID_EVENT:\n"
+    "      7f0f4c12 com.netflix.ninja/com.google.firebase.iid.FirebaseInstanceIdService\n"
+    "Provider Resolver Table:\n"
+    "  Authorities:\n"
+    "    com.netflix.ninja.androidx-startup:\n"
+    "      7f0f4c12 com.netflix.ninja/androidx.startup.InitializationProvider\n"
+    "Permissions:\n"
+    "  Permission [com.netflix.ninja.C2D_MESSAGE]:\n"
+    "    sourcePackage=com.netflix.ninja\n"
+    "Packages:\n"
+    "  Package [com.netflix.ninja] (7f1a2b3c):\n"
+    "    userId=10123\n"
+    "    pkg=Package{7f1a2b3c com.netflix.ninja}\n"
+    # the two INFERRED lines (see the note above): the shapes the search must skip
+    "    nonLocalizedLabel=null\n"
+    "    labelRes=0x7f0f0d31\n"
+    "    versionCode=61102 minSdk=21 targetSdk=29\n"
+    "    versionName=6.11.2 build 3413\n"
+    "    codePath=/data/app/com.netflix.ninja-1/base.apk\n"
+    "    ConstraintProxy.BatteryBroadcastReceiver=\n"
+    "      com.netflix.ninja/androidx.work.impl.constraints.trackers."
+    "ConstraintProxy$BatteryChargingProxy\n"
+    "  Activity Resolver Table: (nothing else listed for this package)\n"
+    "DUMP OF SERVICE activity:\n"
+    "  ACTIVITY MANAGER PENDING INTENTS (dumpsys activity pending)\n"
+    "    (nothing)\n"
+    "DUMP OF SERVICE meminfo:\n"
+    "  Applications Memory Usage (in Kilobytes):\n"
+    "DUMP OF SERVICE procstats:\n"
+    "  Process Stats:\n"
+    "DUMP OF SERVICE usagestats:\n"
+    "  In-memory rollup:\n"
+    "DUMP OF SERVICE batterystats:\n"
+    "  Battery Stats:\n"
+)
+
+
+def _on_device_grep(dump: str) -> str:
+    """What the WIRE carries once the fetch greps on the device (t66).
+
+    The real command is ``pm dump <pkg> | grep -E <shapes> | head -40``, so the
+    2241-line dump never crosses ADB: only the matching lines do, plus the exit
+    marker the manager relies on. A fake that returned the whole dump would only
+    prove that the PARSER tolerates it — not that the manager never had to.
+    """
+    shapes = APP_LABEL_GREP_SHAPES.split("|")
+    hits = [line for line in dump.splitlines() if any(s in line for s in shapes)]
+    return "\n".join(hits[:40]) + f"\n{APP_LABEL_EXIT_MARKER}0\n"
+
 
 class _DiscoveryPoller:
     """A poller whose shell answers the discovery commands from fixtures."""
 
     def __init__(self, *, packages=USER_PACKAGES, launcher=LAUNCHER_RESOLVED,
-                 dumps=None, failure=False):
+                 dumps=None, failure=False, on_device_grep=False):
         self.connected = True
         self.connected_override = True
         self.packages = packages
         self.launcher = launcher
         self.dumps = dict(dumps or {})
         self.failure = failure
+        #: t66: True = the fixture values are RAW device dumps and the fake applies
+        #: the on-device grep before answering, like the real command does.
+        self.on_device_grep = on_device_grep
         self.shell_calls: list[str] = []
 
     @property
@@ -119,7 +255,7 @@ class _DiscoveryPoller:
 
             for package, dump in self.dumps.items():
                 if shlex.quote(package) in cmd or package in cmd:
-                    return dump
+                    return _on_device_grep(dump) if self.on_device_grep else dump
             return "__NSH_EXIT:0\n"  # ran, no label
         return None
 
@@ -132,15 +268,9 @@ class TestPackageListParsing:
     """`pm list packages -3`."""
 
     def test_real_output_parses_one_package_per_line(self):
+        # the order of `pm list packages -3` is preserved, one id per line
         assert parse_package_list(USER_PACKAGES) == [
-            "ar.tvplayer.tv",
-            "com.github.damontecres.wholphin",
-            "com.netflix.ninja",
-            "com.google.android.youtube.tv",
-            "org.xbmc.kodi",
-            "com.plexapp.android",
-            "com.spotify.tv.android",
-            "com.example.handmade",
+            line.removeprefix("package:") for line in USER_PACKAGES.splitlines()
         ]
 
     def test_noise_and_duplicates_are_tolerated(self):
@@ -192,10 +322,19 @@ class TestInstalledPackagesMerge:
     """User apps plus the active launcher, de-duplicated."""
 
     def test_launcher_is_added_last(self):
-        packages = installed_packages(USER_PACKAGES, LAUNCHER_RESOLVED)
+        # t66: the user's own list contains the launcher, so the append-last
+        # property is pinned on a list that does NOT already have it
+        user_only = USER_PACKAGES.replace("package:com.google.android.tvlauncher\n", "")
+        packages = installed_packages(user_only, LAUNCHER_RESOLVED)
         assert packages[-1] == "com.google.android.tvlauncher"
+        assert packages.count("com.google.android.tvlauncher") == 1
         assert packages[0] == "ar.tvplayer.tv"
 
+    def test_a_launcher_already_listed_keeps_its_place(self):
+        packages = installed_packages(USER_PACKAGES, LAUNCHER_RESOLVED)
+        assert packages.count("com.google.android.tvlauncher") == 1
+        assert packages == parse_package_list(USER_PACKAGES)
+
     def test_a_third_party_launcher_is_not_duplicated(self):
         user = "package:com.example.launcher\npackage:com.a\n"
         launcher = "com.example.launcher/.MainActivity"
@@ -239,17 +378,22 @@ class TestDiscoverySweep:
         by_pkg = {row["package"]: row for row in rows}
         assert by_pkg["ar.tvplayer.tv"]["name"] == "TiviMate"  # from the dump
         assert by_pkg["ar.tvplayer.tv"]["icon"] == "mdi:television-classic"
-        # a label-less app keeps its discovered name (the package id) and is
-        # still a row — it must not vanish from the table
-        assert by_pkg["com.example.handmade"]["name"] == "com.example.handmade"
-        # and every row's name/icon is a string
+        # t66: nothing can name `com.example.handmade` (the dump carries no label
+        # and it is not in the curated table), so its name is "" — the id is
+        # already published once in `package`, and a name that repeats it is the
+        # `pkg=pkg` row the user reported from the apps editor. The row itself is
+        # still offered: it must not vanish from the table.
+        assert by_pkg["com.example.handmade"]["name"] == ""
+        assert by_pkg["com.example.handmade"]["package"] == "com.example.handmade"
+        # every row has a string name ("" when nothing names it) and a real icon
         for row in rows:
-            assert isinstance(row["name"], str) and row["name"]
+            assert isinstance(row["name"], str)
             assert isinstance(row["icon"], str) and row["icon"]
 
     async def test_the_live_bug_the_discovered_list_is_a_superset(self):
-        """The complaint in one assertion: every app the user has, plus the
-        curated four, is offered — not just the curated four."""
+        """The complaint in one assertion: every app the user has is offered, and
+        each one is NAMED — on this device none of them is named by the firmware.
+        """
         from nsh.const import DEFAULT_APP_DIRECTORY
 
         poller = _DiscoveryPoller(dumps={"ar.tvplayer.tv": DUMP_TIVIMATE})
@@ -257,21 +401,19 @@ class TestDiscoverySweep:
 
         rows = await manager.async_refresh_installed_apps()
         packages = {row["package"] for row in rows}
+        by_pkg = {row["package"]: row for row in rows}
 
-        # the curated list the integration used to fall back to
+        # the curated table is exactly the app set the report listed
         assert set(DEFAULT_APP_DIRECTORY) <= packages
-        # ...and the apps it missed, which is what the user reported
-        for package in (
-            "ar.tvplayer.tv",                          # TiviMate
-            "com.github.damontecres.wholphin",         # Wholphin
-            "com.netflix.ninja",                       # Netflix
-            "com.google.android.youtube.tv",           # YouTube
-            "org.xbmc.kodi",
-            "com.plexapp.android",
-            "com.spotify.tv.android",
-            "com.example.handmade",
-        ):
-            assert package in packages, package
+        # ...and every one of those apps reads by its NAME, from the curated map,
+        # with the device naming nothing (t66)
+        for package, name in DEFAULT_APP_DIRECTORY.items():
+            assert name
+            assert by_pkg[package]["name"], package
+            if package != "ar.tvplayer.tv":  # this one's dump DOES carry a label
+                assert by_pkg[package]["name"] == name, package
+        assert by_pkg["ar.tvplayer.tv"]["name"] == "TiviMate"  # the device wins here
+        assert by_pkg["org.xbmc.kodi"]["name"] == ""  # known to nobody
         assert "com.google.android.tvlauncher" in packages  # + the launcher
         # a system app the device never lists as -3 is NOT invented here
         assert "com.android.systemui" not in packages
@@ -504,6 +646,13 @@ class TestDiscoveryUsesTheCachedLabelPath:
         dumps = [c for c in poller.shell_calls if "pm dump" in c]
         assert dumps  # the first sweep labelled everything it could
         assert len(dumps) >= 5  # ...and it did dump for the unlabelled ones
+        # t66: and then it STOPPED. On this device 5 probes in a row find no label,
+        # so the sweep does not spend one shell per package — the packaged-in
+        # in-flight window is the only slack above the probe limit.
+        from nsh.const import APP_LABEL_PROBE_LIMIT, APP_SWEEP_CONCURRENCY
+
+        assert len(dumps) <= APP_LABEL_PROBE_LIMIT + APP_SWEEP_CONCURRENCY + 1
+        assert len(dumps) < len(USER_PACKAGES.splitlines())
 
         # the cache now answers for EVERY package, so a forced re-sweep lists
         # again but dumps nothing at all (the 24 h label cache, not the table TTL)
@@ -514,11 +663,21 @@ class TestDiscoveryUsesTheCachedLabelPath:
         assert manager.app_label("ar.tvplayer.tv") == "TiviMate"
         by_pkg = {row["package"]: row for row in rows}
         assert by_pkg["ar.tvplayer.tv"]["name"] == "TiviMate"
-        assert by_pkg["org.xbmc.kodi"]["name"] == "org.xbmc.kodi"
+        # nothing names kodi (it is in no curated row, and the memo'd device says
+        # "no label"): the row shows the id ONCE, in `package`, and name ""
+        assert by_pkg["org.xbmc.kodi"]["name"] == ""
 
     async def test_a_failed_label_is_retried_by_the_next_sweep(self):
         """UNIT 0 semantics at scale: a transient failure is not permanent."""
-        poller = _DiscoveryPoller(dumps={"org.xbmc.kodi": "application-label: 'Kodi'"})
+        # a SMALL app set, with the failing package FIRST: it is the first probe the
+        # sweep makes, so its failure is recorded before the device-level memo can
+        # form — which is exactly the state the retry guarantee is about
+        packages = "package:org.xbmc.kodi\n" + "".join(
+            f"package:com.example.app{i}\n" for i in range(6)
+        )
+        poller = _DiscoveryPoller(
+            packages=packages, dumps={"org.xbmc.kodi": "application-label: 'Kodi'"}
+        )
         manager = _manager(poller)
         real_shell = poller.shell
         state = {"fail_kodi": True}
@@ -532,10 +691,19 @@ class TestDiscoveryUsesTheCachedLabelPath:
         poller.shell = _flaky
         rows = await manager.async_refresh_installed_apps()
         by_pkg = {row["package"]: row for row in rows}
-        assert by_pkg["org.xbmc.kodi"]["name"] == "org.xbmc.kodi"  # fell back
+        assert by_pkg["org.xbmc.kodi"]["name"] == ""  # fell back (nothing names it)
         assert manager.app_label("org.xbmc.kodi") is None  # NOT cached
 
+        # t66: the device-level memo is set by now (5 label-less answers), so the
+        # sweep will not fan out again — but kodi's FAILED probe is still owed its
+        # retry, and the app on screen is what drives it (t57 UNIT 0 survives).
+        assert manager.app_labels_absent is True
+        assert manager._probe_still_owed("org.xbmc.kodi") is True
+        assert await manager._dump_label("org.xbmc.kodi", on_demand=True) is None
+
         state["fail_kodi"] = False
+        await manager._fetch_app_label("org.xbmc.kodi")  # the on-demand retry
+        assert manager.app_label("org.xbmc.kodi") == "Kodi"
         manager._installed_apps = None
         rows2 = await manager.async_refresh_installed_apps()
         by_pkg2 = {row["package"]: row for row in rows2}
@@ -667,3 +835,174 @@ def test_importing_the_discovery_module_needs_no_home_assistant():
 
     assert module.__doc__ and "pm list packages -3" in module.__doc__
     assert not [n for n in dir(module) if n.startswith("hass")]
+
+
+class TestTheRealDeviceShape:
+    """t66: the user's own `pm dump com.netflix.ninja` shape, and what it implies.
+
+    Three properties are pinned against the fixture, because each one was a live
+    defect: the capture carries no label the parser can mistake for a name; the
+    fetch must not truncate the dump nor keep shelling every package once the
+    device has said it has no labels; and the name the user then SEES comes from
+    the curated table.
+    """
+
+    def test_no_label_is_extracted_from_the_whole_capture(self):
+        from nsh.ha_adb_common import parse_app_label, parse_application_label
+
+        # the capture's shape, in one place: a whole dumpsys (not a stub), whose
+        # package section is a resolver table rather than a manifest block
+        assert DUMP_NETFLIX_REAL.startswith("DUMP OF SERVICE package:\n")
+        assert "Activity Resolver Table:" in DUMP_NETFLIX_REAL
+        assert "DUMP OF SERVICE batterystats:" in DUMP_NETFLIX_REAL
+        assert len(DUMP_NETFLIX_REAL.splitlines()) > 60
+
+        # (a) NOTHING in it is a name — this is the "no label" the report saw, and
+        # it must be a parse result, not a truncation artefact
+        assert "application-label" not in DUMP_NETFLIX_REAL
+        assert parse_application_label(DUMP_NETFLIX_REAL) is None
+        assert parse_app_label(DUMP_NETFLIX_REAL) is None
+
+    def test_the_inferred_shapes_are_not_mistaken_for_names(self):
+        """The two ApplicationInfo lines the capture's record does not cover."""
+        from nsh.ha_adb_common import parse_label_res, parse_non_localized_label
+
+        assert parse_non_localized_label(DUMP_NETFLIX_REAL) is None  # =null
+        assert parse_label_res(DUMP_NETFLIX_REAL) is None  # a resource id
+        assert parse_non_localized_label("nonLocalizedLabel=Netflix") == "Netflix"
+        assert parse_label_res('labelRes="Netflix"') == "Netflix"
+        assert parse_label_res("labelRes=0x7f0f0d31") is None
+
+    async def test_the_search_runs_on_the_device_and_the_dump_is_never_truncated(self):
+        poller = _DiscoveryPoller(
+            dumps={"com.netflix.ninja": DUMP_NETFLIX_REAL}, on_device_grep=True
+        )
+        manager = _manager(poller)
+
+        # nothing names this package, and the probe still RAN: a definitive answer
+        assert await manager._dump_label("com.netflix.ninja") == ""
+
+        commands = [c for c in poller.shell_calls if "pm dump" in c]
+        assert len(commands) == 1
+        assert "head -300" not in commands[0]  # the defect: it cut the dump short
+        assert "grep -E" in commands[0]  # the fix: filtered before the wire
+        for shape in ("application-label", "nonLocalizedLabel", "labelRes"):
+            assert shape in commands[0], shape
+
+    async def test_one_shell_per_package_then_the_device_is_believed(self):
+        poller = _DiscoveryPoller(
+            dumps={"com.netflix.ninja": DUMP_NETFLIX_REAL}, on_device_grep=True
+        )
+        manager = _manager(poller)
+
+        rows = await manager.async_refresh_installed_apps()
+        dumps = [c for c in poller.shell_calls if "pm dump" in c]
+
+        # (b) the sweep did NOT spend one shell per package: on this device 5
+        # label-less answers in a row are the device-level conclusion, and only the
+        # packages already in flight can add to that count
+        from nsh.const import APP_LABEL_PROBE_LIMIT, APP_SWEEP_CONCURRENCY
+
+        assert len(dumps) <= APP_LABEL_PROBE_LIMIT + APP_SWEEP_CONCURRENCY + 1
+        assert len(dumps) < len(USER_PACKAGES.splitlines())
+        assert manager.app_labels_absent is True
+        assert "Netflix" in {row["name"] for row in rows}
+
+        # a forced re-sweep costs ZERO further probes: every package is cached
+        manager._installed_apps = None
+        await manager.async_refresh_installed_apps(force=True)
+        assert [c for c in poller.shell_calls if "pm dump" in c] == dumps
+
+    async def test_the_curated_name_is_what_surfaces(self):
+        """(c) the name the user sees, on every surface that shows one."""
+        from nsh.const import DEFAULT_APP_DIRECTORY
+        from nsh.ha_adb_common import resolve_package_name
+        from nsh.media_player import resolve_app_name
+
+        poller = _DiscoveryPoller(
+            dumps={"com.netflix.ninja": DUMP_NETFLIX_REAL}, on_device_grep=True
+        )
+        manager = _manager(poller)
+        rows = await manager.async_refresh_installed_apps()
+        by_pkg = {row["package"]: row for row in rows}
+
+        # the discovery table
+        assert by_pkg["com.netflix.ninja"]["name"] == "Netflix"
+
+        # the chain the entities call: no user map, and the device named nothing
+        assert resolve_app_name("com.netflix.ninja", {}, manager.app_label) == "Netflix"
+        assert (
+            resolve_package_name(
+                "com.netflix.ninja", device_label="", curated=DEFAULT_APP_DIRECTORY
+            )
+            == "Netflix"
+        )
+
+        # ...and the installed-apps sensor publishes the same table
+        sensor_module = load_entity_modules()["sensor"]
+        sensor = sensor_module.NvidiaShieldAppsSensor.__new__(
+            sensor_module.NvidiaShieldAppsSensor
+        )
+        entry = type("E", (), {})()
+        entry.entry_id = "e1"
+        entry.options = {}
+        entry.runtime_data = manager
+        entry.title = "mdarcy"
+        sensor.hass = entity_stublib.FakeHass()
+        sensor._entry = entry
+        assert any(
+            app["package"] == "com.netflix.ninja" and app["name"] == "Netflix"
+            for app in sensor.extra_state_attributes["installed_apps"]
+        )
+
+
+def test_the_name_chain_is_one_order_everywhere():
+    """user map > device label > curated > raw id, in ONE pure function (t66)."""
+    from nsh.ha_adb_common import resolve_package_name
+
+    curated = {"com.curated": "Curated", "com.both": "Curated Both"}
+    user = {"com.mapped": "Mapped", "com.both": "Mapped Both"}
+
+    assert resolve_package_name("com.mapped", user_map=user, curated=curated) == "Mapped"
+    assert resolve_package_name("com.curated", device_label="From Device") == "From Device"
+    assert resolve_package_name("com.curated", curated=curated) == "Curated"
+    assert resolve_package_name("com.both", user_map=user, curated=curated) == "Mapped Both"
+    # the device label sits BELOW the user map and ABOVE the curated table
+    assert (
+        resolve_package_name("com.both", user_map={}, device_label="D", curated=curated)
+        == "D"
+    )
+    # the id is shown ONCE, and an empty package has no name at all
+    assert resolve_package_name("com.nobody", curated=curated) == "com.nobody"
+    assert resolve_package_name("", curated=curated) is None
+    assert resolve_package_name(None) is None
+    # a blank device label is not a name (it is what a memo'd device returns)
+    assert resolve_package_name("com.curated", device_label="", curated=curated) == "Curated"
+    assert resolve_package_name("com.curated", device_label="  ", curated=curated) == "Curated"
+
+
+def test_the_device_label_lookup_is_lazy():
+    """A mapped app must not cost a device probe (t66).
+
+    ``media_player.resolve_app_name`` passes its ``app_label`` accessor, which
+    ENQUEUES an on-demand fetch on a miss: calling it for an app the user already
+    named would spend a shell to learn something nobody reads.
+    """
+    from nsh.ha_adb_common import resolve_package_name
+
+    calls: list[str] = []
+
+    def _device_label(package):
+        calls.append(package)
+        return None
+
+    assert (
+        resolve_package_name(
+            "com.mapped", user_map={"com.mapped": "Mapped"}, device_label=_device_label
+        )
+        == "Mapped"
+    )
+    assert calls == []  # the device was never asked
+
+    assert resolve_package_name("com.other", device_label=_device_label) == "com.other"
+    assert calls == ["com.other"]  # ...and it IS asked when the map misses

tests/test_media_sources.py

@@ -57,7 +57,13 @@ class TestSourceList:
     def test_it_falls_back_to_the_curated_directory(self, modules):
         player, _served = _player(modules)  # no map configured
 
-        assert player.source_list == ["TiviMate", "Wholphin", "Netflix", "YouTube"]
+        # t66: the curated table grew to cover the apps the report listed, and the
+        # dropdown is the same table (so it is asserted against the table itself,
+        # not a copy that would drift)
+        from nsh.const import DEFAULT_APP_DIRECTORY
+
+        assert player.source_list == list(DEFAULT_APP_DIRECTORY.values())
+        assert "Netflix" in player.source_list  # a name the user recognises
 
     def test_a_blank_name_never_reaches_the_dropdown(self, modules):
         """t49: the map is hand-editable, so 'com.x=' must not offer an empty entry.
@@ -464,8 +470,25 @@ class TestCaseInsensitiveNames:
         assert player.source == "  TiviMate  "  # this surface shows it as typed
         assert player.source not in player.source_list
 
-    def test_a_blank_map_value_falls_through_to_the_raw_package(self, modules):
-        """Blanks are not displayed as nothing — the chain continues past them."""
+    def test_a_blank_map_value_falls_through_the_chain(self, modules):
+        """Blanks are not displayed as nothing — the chain continues past them (t66).
+
+        Past a blank map value comes the device label, then the curated table, then
+        the raw id: `ar.tvplayer.tv` is curated, so the dropdown row is its NAME.
+        The raw-id tail of the same chain is pinned in the test below.
+        """
         player, _served = _player(modules, app_map={TIVIMATE: ""}, foreground=TIVIMATE)
 
-        assert player.source == TIVIMATE
+        assert player.source == "TiviMate"
+
+    def test_a_package_nothing_names_stays_raw(self, modules):
+        """The last tier: no map value, no device label, no curated row → the id.
+
+        It is shown ONCE (the id itself), never as a `pkg=pkg` pair.
+        """
+        player, _served = _player(
+            modules, app_map={"com.example.unknown": ""}, foreground="com.example.unknown"
+        )
+
+        assert player.source == "com.example.unknown"
+        assert player.source_list == []  # a name is the ticker's raw id

tests/test_standalone_setup.py

@@ -1360,7 +1360,12 @@ class TestAppNameMapResolution:
         assert player.app_name == "TiviMate"
         assert player.app_id == "ar.tvplayer.tv"  # app_id stays raw
 
-    async def test_unmapped_package_stays_raw(self):
+    async def test_a_curated_package_reads_by_its_name(self):
+        """t66: an app the user did NOT map still gets a name — from the curated table.
+
+        This is the device the report describes: `pm dump` names nothing, and a
+        package absent from the user's own map used to read as its raw id.
+        """
         import entity_stublib
 
         modules = entity_stublib.load_entity_modules()
@@ -1371,7 +1376,21 @@ class TestAppNameMapResolution:
         manager._on_current_app("com.google.android.youtube.tv")
         await asyncio.sleep(0.05)
 
-        assert player.app_name == "com.google.android.youtube.tv"
+        assert player.app_name == "YouTube"
+
+    async def test_an_unmapped_uncurated_package_stays_raw(self):
+        """The chain's last tier, on the same surface: nothing names it → the id."""
+        import entity_stublib
+
+        modules = entity_stublib.load_entity_modules()
+        player, _s, _i = _cmd_player(modules)
+        player._entry.options["app_name_map"] = {"ar.tvplayer.tv": "TiviMate"}
+
+        manager = player._manager
+        manager._on_current_app("com.example.nobody")
+        await asyncio.sleep(0.05)
+
+        assert player.app_name == "com.example.nobody"
 
     async def test_cached_manifest_label_is_the_second_tier(self):
         """P5-1: below the explicit map sits the device manifest label."""