CouchPotatoPlayer Android tv source and notice materials

Artifact 1.2.0/387; full Git source 96ecefbf6292303ddb8c375ff1f9f149b1a63c50.
Application runtime source dc6604f3df6dbf21d3b88816c258298b0341b42c.
AAB SHA256 7a92bd35401f9f44f86ebb900798d944b4a333370f64fed0c8599415c2166777
Actual Google-signed APK SHA256 ffa8765d08f7b75281e9a7aba6308e598cfd8b7df54666bf1aeda97d14e0d7b6
Hermes bundle SHA256 21a8fd8e2140a0c366a3dc891616ef6899ca918036f3d1a1f266bc560ad174a6

EXACT APPLICATION AND HOST SOURCES
The fresh Git source archive contains all 26 selected production-source paths,
the lockfile and 42 current third_party/notices files. The actual target Hermes
map verifies 24 runtime files;
2 platform/type-only files
are explicitly Git/archive-only, without a false mapped-source claim.
Apply all 30 mandatory same-path host overlays. The target version/generated
inputs override the base source checkpoint. Follow BUILD-RECONSTRUCTION.txt:
real pinned Media3/FFmpeg Git preparation first, both ARM ABIs, then overlays,
CPP_SKIP_VERSION_BUMP=1 and the explicit compatible provider AAR override.
The tracked debug keystore is excluded; supply your own signing material.

UNCHANGED CORRESPONDING COMPONENT SOURCES
Original 373 source/notices filenames, hashes and existing URLs are retained.
The full provider source closure, patches, configurations, dependency sources
and build instructions correspond to AAR SHA256
413adddae5450e5f53837ed4129420c1f7dc5d00a8766a012d0ae702c2a48f15
and matching source TAR SHA256
bc3e7e374bcd55f8e68fbad04a6d39ecd956beba1a7637dcacb7fff9a861ed5b.
All 20 shipped ARMv7/ARM64 provider payloads retain the verified provenance.
The historical source package includes x86_64 as a superset, while this app
ships only the two ARM ABIs. Current CPPlayerKit/Media3 JNI hashes are recorded
separately; they are not asserted identical to the original JNI builds.
The unchanged Media3/FFmpeg source comparison covers 10158 entries; historical
preflight provenance is explicitly qualified rather than relabelled.
All 82 native payloads, 6 DEX files, Hermes and 7 embedded notice/Billing payloads
in the actual Google APK match this AAB. This is payload correspondence,
not a runtime installation, cloud, purchase or restore test.

MODIFICATION AND RELINKING
Use the supplied component sources and their build scripts to build compatible
replacement libraries. The build uses the process-only provider AAR override;
the SDK default pin is unchanged. Replace the matching ABI libraries and sign
modified installations with your own credentials. Production signing keys,
service-account/OAuth secrets, private provider settings and the raw review
code are not supplied. No additional license to proprietary CPP/CPPlayerKit
code is granted. Existing upstream licenses and applicable modification,
debugging and relinking rights remain controlling.

ATTRIBUTION AND LIMITS
The original 382/383 supplement is unchanged. Fresh current successor mapping
in the host ZIP records 8 external identities/163 original mapped files per target
and 4 Expo-Updates native payloads. Original full texts are retained; historical
57 root-notice candidates/44 production-graph flags are not 57 confirmed defects.
The 48 without mapped JS are not proved absent from native code/assets.
The own local SwiftTS module is qualified separately, without an invented
external copyright text. This is not an exhaustive dependency/license audit,
Apple source/relink pack or byte-reproducible native-rebuild claim.
The source packages do not establish a public production store rollout.
