Add PNG encoding and screenshot rendering script

- Implement a lightweight PNG writer in `installer/src/png.rs` for encoding 8-bit RGB pixels.
- Include functions for generating PNG file structure, CRC checks, and zlib compression.
- Add tests to validate PNG encoding and checksum calculations.
- Create `tools/render_installer_screenshots.sh` to automate the process of rendering installer screenshots on Windows via WSL.
- The script builds the installer, captures screenshots, and recompresses the images for documentation.

Author: superwilso

.github/release-notes.md

@@ -102,7 +102,8 @@ On Windows:
 Get-FileHash .\cinder-installer-windows-x64.exe -Algorithm SHA256
 ```
 
-Every file above also has a GitHub build attestation. With the [GitHub CLI](https://cli.github.com):
+Every file above also has a GitHub build attestation. With the [GitHub CLI](https://cli.github.com)
+2.49 or later (older versions, including the 2.45 Ubuntu packages, do not have this command):
 
 ```
 gh attestation verify cinder-installer-windows-x64.exe -R superwilso/Cinder

CHANGELOG.md

@@ -20,8 +20,18 @@ level the commit history supports; from `v0.1.6` onward, entries are written as
 
 ### Fixed
 
+- **An install or update through the installer ended on Sony's player.** *Launcher-tested;
+  device-unverified.* The installer tells people not to unplug the player while it updates, so the
+  boot after an install always had a cable in — and a cable at power-on is the escape to Sony's
+  player, so the install looked as if it had failed. The installer now leaves a one-shot pass on
+  `/data`: the next boot starts Cinder with the cable in, and the launcher spends the pass on that
+  boot whether or not Cinder starts, so from the boot after it a cable at power-on reaches Sony's
+  player again. The launcher honours the pass only if it could delete it; POWER in the logo and the
+  bad-boot counter still cover that boot, and cinder-home removes any pass left over once it is
+  healthy. `tools/cinder-install.sh` uses the same pass in place of the persistent opt-out it used
+  to borrow and give back.
 - **The Library sorted lowercase and accented names below "Z".** *Host-tested against names from
-  the reference library; device-unverified.* Every list compared names byte by byte, so every
+  the reference library; device-verified 2026-09-14.* Every list compared names byte by byte, so every
   capital came before every lowercase letter and every accented letter after `z`: 12 of 310
   artists (`alt‐J`, `bôa`, `julie`, `the north` …) and 127 song titles sat under `Zola Jesus`,
   while the A–Z rail filed them under their letters. Artists, albums, songs, folders and playlists
@@ -33,12 +43,22 @@ level the commit history supports; from `v0.1.6` onward, entries are written as
 
 ### Added
 
-- **Settings ▸ Ignore "The" in artists.** *Host-tested; device-unverified.* Off by default, so
+- **Settings ▸ Ignore "The" in artists.** *Host-tested; device-verified 2026-09-14.* Off by default, so
   artists sort as written. On, "The Beatles" sorts among the B's — in the Artists tab, the Albums
   tab's artist groups and Songs sorted by artist, and on the A–Z rail — the way Sony's own player
   files it. Song titles and album names keep their "The" either way. The lists re-sort the moment
   it is switched, an open artist or album page stays on what it was showing, and Reset settings
   turns it off.
+
+### Changed
+
+- **The README shows the installer's real window** instead of an ASCII sketch of it. The pictures
+  come from the installer itself: `--screenshots <dir>` (Windows, not in `--help`) renders the
+  Home, Options and Confirm pages for a stand-in player, reading no drive, and
+  `tools/render_installer_screenshots.sh` runs it from WSL. `tools/release.sh` re-renders them when
+  the machine it runs on has Windows interop.
+- **Release notes and `SECURITY.md` say which GitHub CLI can check an attestation**: 2.49 or later.
+  Ubuntu's packaged 2.45 does not have `gh attestation verify`.
 
 ## [0.3.6] — 2026-09-14
 

README.md

@@ -173,27 +173,15 @@ Linux.
 
 ### The three things it does
 
-```
-┌────────────────────────────────────────────────────────────────┐
-│  Cinder                                       0.3.1 · stable   │
-├────────────────────────────────────────────────────────────────┤
-│   Player:  D:\                                    [ Rescan ]   │
-│   Cinder is installed (installer 0.3.0, stable) — Thu Sep 11    │
-│                                                                 │
-│   ┌──────────────────────────────────────────────────────────┐ │
-│   │ Install Cinder                                           │ │
-│   │ Fresh install: choose the optional parts, then flash.    │ │
-│   ├──────────────────────────────────────────────────────────┤ │
-│   │ Update Cinder                                            │ │
-│   │ Same components as last time, new build.                 │ │
-│   ├──────────────────────────────────────────────────────────┤ │
-│   │ Uninstall                                                │ │
-│   │ Put the stock Sony player back.                          │ │
-│   └──────────────────────────────────────────────────────────┘ │
-│                                                                 │
-│   [ Check for a newer release ]   [ Clean up 11 staged files ] │
-└────────────────────────────────────────────────────────────────┘
-```
+<p align="center">
+  <img src="docs/screenshots/installer-home.png" width="440" alt="The installer's home page: the player it found, what is installed on it, and Install, Update and Uninstall">
+</p>
+<p align="center">
+  <img src="docs/screenshots/installer-options.png" width="330" alt="Choosing the optional components, with the selected one described below the list">
+  <img src="docs/screenshots/installer-confirm.png" width="330" alt="The confirmation page: every choice, what is copied, and what the player does next">
+</p>
+
+*The real window, rendered by `tools/render_installer_screenshots.sh` for a stand-in player.*
 
 **Install** asks which optional parts you want, then stages them. **Update** reads the choices
 already on the player out of its own `cinder_components.conf` and keeps them, so a new build never

RECOVERY.md

@@ -11,7 +11,7 @@ the whole design: the 2026-07-26 brick happened because every escape that existe
 
 | # | Escape | Depends on |
 |---|--------|-----------|
-| 0 | **Boot with the USB cable connected → stock.** | Nothing. No filesystem, no shell, no counter. |
+| 0 | **Boot with the USB cable connected → stock.** Except the first boot after an install or update: the installer leaves a one-shot pass so the player comes back on Cinder with the cable still in, and the launcher spends that pass on that boot whether Cinder starts or not. The boot after it escapes again. | Nothing. No filesystem, no shell, no counter. (A pass the launcher cannot delete is ignored, so a broken `/data` leaves the escape on.) |
 | 0b | **Press POWER while the Sony logo shows → stock**, for that boot only (verified 2026-09-11). Once or twice while the logo is up: a press in its first second or two is before the kernel, and after the launcher runs (~10 s) is too late. Holding POWER to switch on is one press and never counts. | The kernel's own log and a shell. No filesystem, no counter. |
 | 1 | **Bad-boot counter** hits `MAXBAD=4` → stock, by itself. | A writable `/data` (ext4). |
 | 2 | `/contents/cinderhome_off` over USB-MSC → stock. | A mountable `/contents` + a PC. |

SECURITY.md

@@ -72,7 +72,9 @@ sha256sum -c SHA256SUMS
 `SHA256SUMS` is attached to each release. It proves the download matches what the release workflow
 produced. On its own it does **not** prove the workflow built this source tree.
 
-Releases tagged after 2026-09-14 also carry a GitHub build attestation for every published file:
+Releases from v0.3.5 on also carry a GitHub build attestation for every published file. Checking
+it needs GitHub CLI 2.49 or later; older versions, including the 2.45 Ubuntu packages, do not have
+the command:
 
 ```sh
 gh attestation verify cinder-installer-windows-x64.exe -R superwilso/Cinder

cinder-home/deploy/install_cinderhome.sh

@@ -458,7 +458,9 @@ fi
 #    after MAXBAD. (The old launcher reset the counter on a blind 60 s timer, which a hung
 #    process "survives" → it never accumulated → soft-brick. That bug is removed.)
 #  * ESCAPES, weakest dependency first (each works when the one below it cannot):
-#      1. USB cable connected at boot          -> stock. No fs, no shell, no counter. Always works.
+#      1. USB cable connected at boot          -> stock. No fs, no shell, no counter. Always works,
+#         except the ONE boot after an install: the installer's pass stands it down so the updated
+#         player comes back on Cinder with the cable in (see CABLE_PASS below).
 #     1b. POWER pressed while the logo shows    -> stock. No fs either: reads the kernel log.
 #         (added 2026-09-11 — NOT yet verified on hardware; the cable escape stays until it is)
 #      2. /contents/cinderhome_off  (USB-MSC)  -> stock. Needs a mountable /contents.
@@ -527,7 +529,28 @@ usb_connected() {
 }
 # Cost is zero on a cable-free boot: nothing sleeps unless a cable is actually present. The 3 s
 # re-check rejects the transient CONNECTED blip the gadget emits while enumerating.
-if [ ! -f /data/cinder/cable_escape_off ] && [ ! -f /contents/cinderhome_cable_off ] \
+#
+# FIRST BOOT AFTER AN INSTALL: the escape stands down ONCE (added 2026-09-14). The installer tells
+# people not to unplug the player while it updates, so the boot that follows an install always has
+# a cable in — and this escape sent every one of them to Sony's player, which looks exactly like a
+# failed install ("it refuses to switch into your bootloader now", the first community tester).
+# install_cinderhome.sh writes $CABLE_PASS after its sanity gate; this spends it.
+#   * SPENT BEFORE IT IS HONOURED, on every boot, cable or not. The pass covers the next boot and
+#     no other, whether or not the new build ever starts: it never waits on the app it would rescue.
+#     A build that hangs on that boot costs one more restart, and the restart escapes.
+#   * HONOURED ONLY IF THE DELETE WORKED. A pass that cannot be removed would stand the escape down
+#     on every boot, so a failed rm leaves the escape armed — this fails toward stock.
+#   * /data only, never /contents: it is not a switch a PC or a person can leave set.
+#   * Nothing else stands down. POWER in the logo (1b) and the bad-boot counter cover this boot.
+# cinder-home also deletes a leftover pass once it has proven healthy (mark_healthy_maybe).
+CABLE_PASS=$STATE/cable_pass_once
+CABLE_PASS_SPENT=0
+if [ -e "$CABLE_PASS" ]; then
+    rm "$CABLE_PASS" 2>/dev/null; sync
+    [ -e "$CABLE_PASS" ] || CABLE_PASS_SPENT=1
+fi
+if [ "$CABLE_PASS_SPENT" = 0 ] \
+   && [ ! -f /data/cinder/cable_escape_off ] && [ ! -f /contents/cinderhome_cable_off ] \
    && usb_connected; then
     sleep 3
     usb_connected && run_stock "$@"
@@ -818,6 +841,10 @@ log_sv() {
     [ -n "$LOGF" ] && ( echo "cinderhome-launch: $*" >> "$LOGF" ) 2>/dev/null
     true
 }
+# Said here, not at rung 0: the log is only chosen above. DEVICE_CHECKLIST 11.9 looks for this line.
+if [ "$CABLE_PASS_SPENT" = 1 ]; then
+    log_sv "cable escape stood down for this boot: first boot after an install (the pass is spent)"
+fi
 # The redirect rides on a SIMPLE COMMAND, never on `exec`. A redirection failure on a simple
 # command is just a non-zero rc; on `exec` it makes sh exit WITHOUT running anything, which is the
 # precise shape of the 2026-07-26 brick. /contents also legitimately disappears mid-session during
@@ -943,6 +970,13 @@ fi
 # location and the legacy /contents one (an upgrade from a pre-2026-07-26 build leaves those).
 "$BB" mkdir -p /data/cinder 2>/dev/null
 "$BB" rm -f /data/cinder/off /data/cinder/bootcount /data/cinder/DISABLED_badboot /data/cinder/once_stock 2>/dev/null
+# The post-install cable pass ($CABLE_PASS in the launcher above). The installer tells people not to
+# unplug, so the boot after this one has a cable in, and without the pass it lands on Sony's player
+# and the install looks as if it failed. Written only past the sanity gate, so an aborted install
+# never leaves one; the launcher spends it on the next boot. 0644 for the same umask reason as
+# search_on below.
+echo 1 > /data/cinder/cable_pass_once 2>/dev/null && "$BB" chmod 644 /data/cinder/cable_pass_once 2>/dev/null \
+    && echo "cable pass: the next boot starts Cinder with the cable in"
 # Library search: an opt-in component with no files, so the choice itself is what gets installed.
 # A flag in /data/cinder — machine-written state, off the MSC volume a PC can edit — that
 # cinder-home reads at startup. Written or removed on EVERY install, so an Update that turns it
@@ -964,7 +998,8 @@ umount /system 2>/dev/null
 echo "== done. reboot to normal; appmgr launches cinder-home as the Home app. =="
 echo "   SAFETY: a failed/hung launch AUTO-REVERTS to stock after 4 boots (no wbrt)."
 echo "   Escapes, in order of how little they depend on:"
-echo "     1. boot with the USB CABLE CONNECTED -> stock. Needs no filesystem, always works."
+echo "     1. boot with the USB CABLE CONNECTED -> stock. Needs no filesystem, always works —"
+echo "        except the NEXT boot, which ignores the cable once so Cinder starts with it in."
 echo "     2. create /contents/cinderhome_off over USB-MSC -> stock."
 echo "     3. create /contents/cinderhome_clear over USB-MSC -> clears the latch, tries again"
 echo "        (same as tools/flash.sh --clear-latch)."

cinder-home/src/main.cpp

@@ -1529,6 +1529,13 @@ void mark_healthy_maybe() {
         ::sync();
         g_counter_reset = true;
         clog_("healthy: bad-boot counter cleared");
+        // The post-install cable pass ($CABLE_PASS in deploy/install_cinderhome.sh). The launcher
+        // spends it on the boot after an install and honours it only if that delete worked, so one
+        // still here means the delete failed and the cable escape was armed this boot anyway.
+        // Removing it now stops a stale pass standing the escape down on some later boot.
+        // The path MUST stay in step with $CABLE_PASS.
+        if (::unlink("/data/cinder/cable_pass_once") == 0)
+            clog_("healthy: removed a leftover post-install cable pass — the cable escape is armed");
     }
 }
 

cinder-home/tools/test_launcher.sh

@@ -108,6 +108,22 @@ scenario "only the HW keycode line"                 stock  '{ echo "$BOOT"; HWK
 scenario "kernel log with no timestamps"            cinder 'printf "(0)[28:pmic_thread_kth]kpd: Power Key generate, pressed=1\n" > $R/proc/klog'
 scenario "power escape ignores the cable opt-out"   stock  ': > $R/data/cinder/cable_escape_off; { echo "$BOOT"; KPD 12.000001 1; } > $R/proc/klog'
 scenario "late pwrkey_int_handler line: no count"   cinder '{ echo "$BOOT"; printf "<5>[    6.201337] (0)[28:pmic_thread_kth][Power/PMIC] [pwrkey_int_handler] Release pwrkey\n"; } > $R/proc/klog'
+# The post-install cable pass (2026-09-14). The installer says "do not unplug", so the first boot
+# after an install always has a cable in, and rung 0 sent every one of them to stock.
+# install_cinderhome.sh now leaves a one-shot pass on /data: spent on the next boot whatever
+# happens, honoured only if the launcher could delete it, and never a reason to skip POWER.
+CABLE='echo CONFIGURED > $R/sys/class/android_usb/android0/state'
+pass_state() { [ -e "$1/data/cinder/cable_pass_once" ] && echo present || echo spent; }
+scenario "cable + post-install pass -> cinder"       cinder "$CABLE"'; : > $R/data/cinder/cable_pass_once'
+check "  the pass is spent" "$(pass_state "$LAST_R")" spent
+check "  the log says the escape stood down" "$(grep -c 'cable escape stood down' "$LAST_R/contents/cinderhome.log")" 1
+check "  the next cable boot escapes again" "$(sh "$LAST_R/launch.sh" 2>/dev/null | grep -c STOCK)" 1
+check "  and does not claim a pass" "$(grep -c 'cable escape stood down' "$LAST_R/contents/cinderhome.log")" 1
+scenario "pass with no cable is spent all the same"  cinder ': > $R/data/cinder/cable_pass_once'
+check "  the pass is spent" "$(pass_state "$LAST_R")" spent
+scenario "a pass on /contents grants nothing"        stock  "$CABLE"'; : > $R/contents/cable_pass_once'
+scenario "a pass that cannot be deleted -> stock"    stock  "$CABLE"'; mkdir -p $R/data/cinder/cable_pass_once/x'
+scenario "POWER in the logo beats the pass"          stock  "$CABLE"'; : > $R/data/cinder/cable_pass_once; { echo "$BOOT"; KPD 3.576327 1; } > $R/proc/klog'
 scenario "/contents NOT mounted (the brick)"      stock  'printf "rootfs / rootfs rw 0 0\n" > $R/proc/mounts'
 # THE SAFETY NET CANNOT BE ARMED. Two ways of saying it, because one of them lies when the test
 # runs as root: chmod 555 does not stop uid 0, so on a root shell the counter write SUCCEEDS, the