CouchPotatoPlayer Android tv 1.2.0 (377) — source and notice materials
 Exact application source commit: de1478c848c82a6d6b2f9b4e410ad73f4baf658e
 Recorded upload AAB SHA256: 026412d20b6851cedbb0a54202cce1c00530eb12ef5cead5803297867856b247
 Hermes application bundle SHA256: 6862befc3c485147c0611b2b47124ab408da9bc658b511ad8d02a1196ff7d379
 Recorded local QA APK SHA256: c288c2e3446c3b8b2bdae865f2fd35e2a9b565ff8687e92d033f9d57532123f9

 SCOPE AND SIGNATURE
 The source correspondence below is verified against the recorded Play upload
 AAB and its AAB-derived local QA APK. The QA APK uses the existing upload key;
 it is NOT Google-app-signed and is NOT a website distribution download. A matching
 Google-signed universal APK has not been verified by this pack. No Google-signed
 APK hash, website availability date or public store rollout is asserted.

 EXACT NEW APPLICATION SOURCE
 CouchPotatoPlayer-source-v1.2.0-377-de1478c8.zip is a fresh git archive of the exact commit above, with its Git ZIP
 comment and selected source bytes checked. Historical373 application source is
 not used as the source of this build. Original app and CPPlayerKit licensing is
 unchanged; this publication grants no new rights to proprietary original code.
 Production signing credentials, OAuth values and generated bundles are excluded.
 The repository's existing development debug.keystore is unchanged from373 and
 is not a production signing credential. Android SDKs and installed dependencies remain separate build inputs.

 REUSED COMPONENT SOURCE AND NOTICE FILES
 The manifest explicitly identifies each byte-identical reused373 component file
 and retains its original filename/hash/public URL. It does not relabel old files.
 - android-libmpv-lgpl-sources-373.zip: all20 actual provider shared libraries in
   ARMv7/ARM64 match the373 APK, actual AAR and the already published source
   provenance hashes. The complete provider source closure, patches, build.py,
   configuration, notices and build instructions therefore remain applicable.
 - android-media3-ffmpeg-8.1.3-source-373.zip: all10158 FFmpeg/Media3 decoder source
   files, build script, free2ABI metadata and referenced module/host inputs were
   freshly compared with this build's checkout and match. Rebuilt libffmpegJNI
   binaries have their own recorded hashes; bit-for-bit rebuilds are not claimed.
   Current additional host inputs are in android-tv-377-host-build-materials.zip; they supersede any older
   build-number/target-specific descriptions in the reused373 source package.
 - pro-iap-notices-373.zip: the dependency/lock inputs are unchanged, expo-iap6.3.0,
   OpenIAP Google/Core4.0.6 and actual Billing9.1.0 remain in use. Billing's SDK
   license and bundled notices are retained. Shared Apple notices in that pack do
   not mean this Android build ships Apple code or supplies Apple relink materials.
 - npm-notices-373.zip: the375 evidence for802 installed identities and751 notice
   payload comparisons is reused after exact lockfile/patch and all non-script
   package manifest fields match375. The sole script-only difference is recorded.
   This pack does not perform a new installed-notice audit or claim complete attribution.
 - apk-embedded-notices-373.zip: all7 actual original notice/Billing payloads in
   this AAB and local QA APK match those373 bytes; its historical README is not a
   claim that the373 APK is this build. Current provenance is in COMPONENTS-377.json.

 REPLACING SHARED LIBRARIES
 Use the component source archives and included build scripts/configuration to
 rebuild compatible shared libraries. Replace appropriate Android ABI entries in
 an APK/AAR and sign a modified installation with your own Android credentials.
 No production signing key, Google app-signing key or SDK is supplied. Nothing in
 this publication restricts rights granted by the controlling upstream licenses,
 including applicable rights to modify or debug changes to library components.

 LIMITATIONS
 This is a technical correspondence record, not a complete license audit or legal
 certification.57 installed package identities in the inherited npm inventory lack
 package-root notice files;44 are in a conservative production graph which also
 includes build/CLI tools. Monorepo attribution and exact runtime-shipment mapping
 remain unverified. This Android-only pack makes no Apple source/relink claim.
 OAuth grant and encrypted sync product QA have separate acceptance evidence;
 this source publication audit makes no runtime-success or Store-purchase claim.
 No fresh native source rebuild was performed as part of this source audit. Google-signed
 universal APK comparison remains an explicit separate step.
 