diff --git a/README.md b/README.md
index 5813119..0e69ec7 100644
--- a/README.md
+++ b/README.md
@@ -52,6 +52,9 @@ and rule traces back to a section (and often a community demand source) there.
 | Navigation bar: any module can be a bottom-bar tab, not just Calendar/Jarvis/Inbox/Tasks | Done |
 | Clock timer: tap an h/m/s wheel to type the value on a number keyboard; a full number hops to the field on the right automatically | Done |
 | Clear Sky Map module: full clearoutside.com forecast for any spot (search, coordinates or device location) - hourly good/OK/bad ratings, total/low/medium/high cloud, visibility, fog, precipitation, wind, temperature, dew point, humidity, pressure, ozone, sun/moon ephemeris, dark windows and estimated sky quality/Bortle class. No API key needed; place lookup via OpenStreetMap Nominatim | Done |
+| Navigation bar settings list every module (was still showing only the original four), with a searchable picker; the default bar stays Home + Calendar/Tasks/Inbox/Jarvis | Done |
+| Downloader resolves session-bound player links (ThisVid and the rest of the kt_player family) by letting the page's own player run in an offscreen WebView and recording the media request, then downloads it with that session's Referer, Cookie and User-Agent; teaser/sprite/ad URLs are filtered out | Done |
+| Brick tags are programmed on pairing (LifeOS MIME record + Android Application Record), so a tap flips a mode with the app closed and without a chooser; broader NDEF/TECH/TAG filters, tag id read from the record, and an NFC-off banner that opens NFC settings | Done |
 | Deferred post-alpha: Glance home-screen widgets, HA WebSocket live state/zones, Vault unlock UI, first-run onboarding checklist (grants live in Settings → System access), FinTS bank sync | Planned |
 
 **Google-free by design:** no Google service is ever called at runtime (no Play Services, no Google recognizer, no Google Maps). Remaining Google-*authored* open-source, fully on-device libraries: AndroidX/Jetpack (unavoidable on Android), MediaPipe (Gemma inference), ML Kit on-device OCR/barcode (no network) — swap candidates documented in the plan.
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index e2268b2..6605881 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -10,8 +10,8 @@ android {
 
     defaultConfig {
         applicationId = "com.lifeos"
-        versionCode = 19
-        versionName = "0.1.0-alpha.19"
+        versionCode = 20
+        versionName = "0.1.0-alpha.20"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 
diff --git a/app/src/main/kotlin/com/lifeos/app/ui/LifeOsApp.kt b/app/src/main/kotlin/com/lifeos/app/ui/LifeOsApp.kt
index a32a92f..2eb9885 100644
--- a/app/src/main/kotlin/com/lifeos/app/ui/LifeOsApp.kt
+++ b/app/src/main/kotlin/com/lifeos/app/ui/LifeOsApp.kt
@@ -69,7 +69,14 @@ fun LifeOsApp(captureRequests: Int = 0, navBarIds: List<String> = emptyList()) {
     // tabs in their chosen ORDER (the stored list is ordered).
     val barItems = remember(navBarIds) {
         if (navBarIds.isEmpty()) {
-            TopLevelDestination.entries.toList()
+            // Default four tabs; Settings can swap in any other module.
+            listOf(
+                TopLevelDestination.HOME,
+                TopLevelDestination.CALENDAR,
+                TopLevelDestination.TASKS,
+                TopLevelDestination.INBOX,
+                TopLevelDestination.ASSISTANT,
+            )
         } else {
             listOf(TopLevelDestination.HOME) +
                 navBarIds.mapNotNull { id ->
diff --git a/app/src/main/kotlin/com/lifeos/app/ui/settings/SettingsScreen.kt b/app/src/main/kotlin/com/lifeos/app/ui/settings/SettingsScreen.kt
index 2d5bb6b..5d00a53 100644
--- a/app/src/main/kotlin/com/lifeos/app/ui/settings/SettingsScreen.kt
+++ b/app/src/main/kotlin/com/lifeos/app/ui/settings/SettingsScreen.kt
@@ -57,6 +57,7 @@ import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import com.lifeos.core.designsystem.component.SectionHeader
 import com.lifeos.core.designsystem.theme.PALETTE_DYNAMIC
 import com.lifeos.core.designsystem.theme.ThemePalettes
+import com.lifeos.core.ui.navigation.TopLevelDestination
 
 /** Central settings (§8.4 onboarding grants + endpoints in one place). */
 @OptIn(ExperimentalMaterial3Api::class)
@@ -130,13 +131,10 @@ fun SettingsRoute(
             )
 
             SectionHeader(title = "Navigation bar")
-            val navLabels = mapOf(
-                "CALENDAR" to "Calendar",
-                "TASKS" to "Tasks",
-                "INBOX" to "Inbox",
-                "ASSISTANT" to "Jarvis",
-            )
-            // Enabled tabs first (orderable), then disabled ones to re-enable.
+            // Every module can be a tab; Home stays pinned as the first slot.
+            val navLabels = TopLevelDestination.entries
+                .filter { it != TopLevelDestination.HOME }
+                .associate { it.name to it.label }
             uiState.navBarItems.forEachIndexed { index, id ->
                 ReorderRow(
                     label = navLabels[id] ?: id,
@@ -148,24 +146,44 @@ fun SettingsRoute(
                     onToggle = { viewModel.onEvent(SettingsUiEvent.ToggleNavItem(id)) },
                 )
             }
-            navLabels.keys.filter { it !in uiState.navBarItems }.forEach { id ->
-                ReorderRow(
-                    label = navLabels[id] ?: id,
-                    enabled = false,
-                    canMoveUp = false,
-                    canMoveDown = false,
-                    onMoveUp = {},
-                    onMoveDown = {},
-                    onToggle = { viewModel.onEvent(SettingsUiEvent.ToggleNavItem(id)) },
-                )
-            }
             Text(
-                "Toggle tabs and order them with the arrows — Home stays pinned first. " +
+                "Toggle tabs and order them with the arrows - Home stays pinned first. " +
                     "Everything stays reachable from the Home grid.",
                 style = MaterialTheme.typography.bodySmall,
                 color = MaterialTheme.colorScheme.onSurfaceVariant,
             )
 
+            var navSearch by remember { mutableStateOf("") }
+            var showNavPicker by remember { mutableStateOf(false) }
+            Button(onClick = { showNavPicker = !showNavPicker }) {
+                Text(if (showNavPicker) "Done adding tabs" else "Add a module as a tab")
+            }
+            if (showNavPicker) {
+                OutlinedTextField(
+                    value = navSearch,
+                    onValueChange = { navSearch = it },
+                    label = { Text("Search modules") },
+                    singleLine = true,
+                    modifier = Modifier.fillMaxWidth(),
+                )
+                navLabels.entries
+                    .filter { (id, label) ->
+                        id !in uiState.navBarItems &&
+                            (navSearch.isBlank() || label.contains(navSearch.trim(), ignoreCase = true))
+                    }
+                    .forEach { (id, label) ->
+                        ReorderRow(
+                            label = label,
+                            enabled = false,
+                            canMoveUp = false,
+                            canMoveDown = false,
+                            onMoveUp = {},
+                            onMoveDown = {},
+                            onToggle = { viewModel.onEvent(SettingsUiEvent.ToggleNavItem(id)) },
+                        )
+                    }
+            }
+
             SectionHeader(title = "AI")
             OutlinedTextField(
                 value = uiState.ollamaBaseUrl,
diff --git a/feature/brick/src/main/AndroidManifest.xml b/feature/brick/src/main/AndroidManifest.xml
index d613fc8..4d6dc5c 100644
--- a/feature/brick/src/main/AndroidManifest.xml
+++ b/feature/brick/src/main/AndroidManifest.xml
@@ -49,13 +49,25 @@
             android:noHistory="true"
             android:taskAffinity="com.lifeos.brick.nfc"
             android:theme="@style/Theme.LifeOs">
+            <!--
+              Preferred route: tags Brick programmed carry this MIME record plus
+              an Android Application Record, so a tap reaches LifeOS even with
+              the app closed and no chooser appears.
+            -->
             <intent-filter>
                 <action android:name="android.nfc.action.NDEF_DISCOVERED" />
                 <category android:name="android.intent.category.DEFAULT" />
                 <data android:mimeType="application/vnd.lifeos.brick" />
             </intent-filter>
+            <!-- Tags written by other tools (plain text records) still work. -->
+            <intent-filter>
+                <action android:name="android.nfc.action.NDEF_DISCOVERED" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="text/plain" />
+            </intent-filter>
             <intent-filter>
                 <action android:name="android.nfc.action.TECH_DISCOVERED" />
+                <category android:name="android.intent.category.DEFAULT" />
             </intent-filter>
             <!--
               Last-resort filter: plain tags whose NDEF mime does not match and
diff --git a/feature/brick/src/main/kotlin/com/lifeos/feature/brick/BrickScreen.kt b/feature/brick/src/main/kotlin/com/lifeos/feature/brick/BrickScreen.kt
index 7279134..1f5ce1a 100644
--- a/feature/brick/src/main/kotlin/com/lifeos/feature/brick/BrickScreen.kt
+++ b/feature/brick/src/main/kotlin/com/lifeos/feature/brick/BrickScreen.kt
@@ -1,6 +1,7 @@
 package com.lifeos.feature.brick
 
 import android.app.Activity
+import android.content.Intent
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
@@ -59,6 +60,8 @@ import androidx.lifecycle.LifecycleEventObserver
 import com.lifeos.core.database.brick.BrickProfileEntity
 import com.lifeos.core.designsystem.component.EmptyState
 import com.lifeos.feature.brick.nfc.BrickReader
+import com.lifeos.feature.brick.nfc.BrickTagWriter
+import com.lifeos.feature.brick.nfc.uid
 import java.text.SimpleDateFormat
 import java.util.Date
 import java.util.Locale
@@ -98,9 +101,20 @@ fun BrickRoute(viewModel: BrickViewModel = hiltViewModel()) {
     // Reader mode stays on the whole time Brick is open: while pairing a tag it
     // captures the id, otherwise a tap flips the matching mode right here.
     // (Outside the app, the manifest's NFC filters route taps to BrickNfcActivity.)
+    val appContext = LocalContext.current
+    val nfcReady = remember(appContext) {
+        android.nfc.NfcAdapter.getDefaultAdapter(appContext)?.isEnabled != false
+    }
     BrickReaderEffect(
-        onUid = { uid ->
-            if (viewModel.pairingTag.value) viewModel.onTagPaired(uid) else viewModel.onTagTapped(uid)
+        onTag = { tag ->
+            val uid = tag.uid() ?: return@BrickReaderEffect
+            if (viewModel.pairingTag.value) {
+                // Pairing also programs the tag, which is what makes taps work
+                // with LifeOS closed.
+                viewModel.onTagPaired(uid, BrickTagWriter.write(tag, uid, appContext.packageName))
+            } else {
+                viewModel.onTagTapped(uid)
+            }
         },
     )
 
@@ -142,6 +156,32 @@ fun BrickRoute(viewModel: BrickViewModel = hiltViewModel()) {
                 }
             }
 
+            if (!nfcReady) {
+                item {
+                    Card {
+                        Column(modifier = Modifier.padding(16.dp), verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                            Text("NFC is off", style = MaterialTheme.typography.titleMedium)
+                            Text(
+                                "Turn NFC on to pair a tag and to flip modes by tapping it. Android only " +
+                                    "dispatches tags while the screen is unlocked, so a tap wakes nothing " +
+                                    "from a locked phone.",
+                                style = MaterialTheme.typography.bodyMedium,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            )
+                            Button(
+                                onClick = {
+                                    runCatching {
+                                        appContext.startActivity(
+                                            Intent(android.provider.Settings.ACTION_NFC_SETTINGS),
+                                        )
+                                    }
+                                },
+                            ) { Text("Open NFC settings") }
+                        }
+                    }
+                }
+            }
+
             active?.let { mode ->
                 item {
                     Card {
@@ -233,6 +273,7 @@ private fun ProfileEditor(viewModel: BrickViewModel, snackbarHostState: Snackbar
     val apps by viewModel.apps.collectAsState()
     val pairing by viewModel.pairingTag.collectAsState()
     val current = draft ?: return
+    val nfcSettingsContext = LocalContext.current
     var query by remember { mutableStateOf("") }
     var showAllApps by remember { mutableStateOf(false) }
 
@@ -302,14 +343,30 @@ private fun ProfileEditor(viewModel: BrickViewModel, snackbarHostState: Snackbar
                                 )
                             }
                             Text(
-                                if (pairing) "Hold the tag against the back of the phone…"
-                                else "Any NFC tag or card works — one tap flips this mode on and off. " +
-                                    "Tap it here any time to test.",
+                                if (pairing) {
+                                    "Hold the tag against the back of the phone. LifeOS also writes a " +
+                                        "small record onto it so taps work with the app closed."
+                                } else {
+                                    "Any writable NFC tag works. Pairing programs the tag, so a tap flips " +
+                                        "this mode from anywhere - no need to open LifeOS first. The screen " +
+                                        "does have to be unlocked; Android never dispatches tags while locked."
+                                },
                                 style = MaterialTheme.typography.bodySmall,
                                 color = MaterialTheme.colorScheme.onSurfaceVariant,
                             )
-                            OutlinedButton(onClick = { viewModel.startTagPairing() }, enabled = !pairing) {
-                                Text(if (current.nfcTagId == null) "Pair tag" else "Pair a different tag")
+                            Row(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                                OutlinedButton(onClick = { viewModel.startTagPairing() }, enabled = !pairing) {
+                                    Text(if (current.nfcTagId == null) "Pair tag" else "Pair a different tag")
+                                }
+                                OutlinedButton(
+                                    onClick = {
+                                        runCatching {
+                                            nfcSettingsContext.startActivity(
+                                                Intent(android.provider.Settings.ACTION_NFC_SETTINGS),
+                                            )
+                                        }
+                                    },
+                                ) { Text("NFC settings") }
                             }
                         }
                     }
@@ -478,14 +535,14 @@ private fun MinuteField(label: String, minuteOfDay: Int?, onChange: (Int?) -> Un
  * when the screen goes away so the system's normal tag dispatch takes over again.
  */
 @Composable
-private fun BrickReaderEffect(onUid: (String) -> Unit) {
+private fun BrickReaderEffect(onTag: (android.nfc.Tag) -> Unit) {
     val context = LocalContext.current
     val lifecycleOwner = LocalLifecycleOwner.current
     DisposableEffect(lifecycleOwner) {
         val activity = context as? Activity ?: return@DisposableEffect onDispose {}
         val observer = LifecycleEventObserver { _, event ->
             when (event) {
-                Lifecycle.Event.ON_RESUME -> BrickReader.start(activity) { uid -> onUid(uid); true }
+                Lifecycle.Event.ON_RESUME -> BrickReader.startForTag(activity) { tag -> onTag(tag); true }
                 Lifecycle.Event.ON_PAUSE -> BrickReader.stop(activity)
                 else -> Unit
             }
diff --git a/feature/brick/src/main/kotlin/com/lifeos/feature/brick/BrickViewModel.kt b/feature/brick/src/main/kotlin/com/lifeos/feature/brick/BrickViewModel.kt
index db3acb9..8a08ce1 100644
--- a/feature/brick/src/main/kotlin/com/lifeos/feature/brick/BrickViewModel.kt
+++ b/feature/brick/src/main/kotlin/com/lifeos/feature/brick/BrickViewModel.kt
@@ -133,12 +133,23 @@ class BrickViewModel @Inject constructor(
 
     fun startTagPairing() { _pairingTag.value = true }
 
-    /** Called by the screen when a tag is read while the editor is pairing. */
-    fun onTagPaired(tagId: String) {
+    /**
+     * Called by the screen when a tag is read while the editor is pairing.
+     *
+     * @param programmed whether the Brick record could be written onto the tag.
+     *   Without it, taps only register while LifeOS is open, so the difference
+     *   is worth telling the user about.
+     */
+    fun onTagPaired(tagId: String, programmed: Result<Unit>) {
         val normalized = tagId.trim().uppercase()
         _pairingTag.value = false
         updateDraft { it.copy(nfcTagId = normalized, activator = "NFC", deactivator = "NFC") }
-        _message.value = "Tag $normalized paired — remember to Save"
+        _message.value = if (programmed.isSuccess) {
+            "Tag $normalized paired and programmed - taps work with LifeOS closed. Remember to Save"
+        } else {
+            "Tag $normalized paired by serial - taps only register with LifeOS open " +
+                "(${programmed.exceptionOrNull()?.message ?: "could not write to the tag"}). Remember to Save"
+        }
     }
 
     /**
diff --git a/feature/brick/src/main/kotlin/com/lifeos/feature/brick/nfc/BrickNfc.kt b/feature/brick/src/main/kotlin/com/lifeos/feature/brick/nfc/BrickNfc.kt
index 2c20ae7..4061c0f 100644
--- a/feature/brick/src/main/kotlin/com/lifeos/feature/brick/nfc/BrickNfc.kt
+++ b/feature/brick/src/main/kotlin/com/lifeos/feature/brick/nfc/BrickNfc.kt
@@ -2,6 +2,7 @@ package com.lifeos.feature.brick.nfc
 
 import android.app.Activity
 import android.content.Intent
+import android.nfc.NdefMessage
 import android.nfc.NfcAdapter
 import android.nfc.Tag
 
@@ -9,8 +10,17 @@ import android.nfc.Tag
 fun Tag.uid(): String? =
     id?.joinToString("") { "%02X".format(it) }?.takeIf { it.isNotEmpty() }
 
-/** Hex UID from an NFC dispatch intent, or null when it carries no tag. */
+/**
+ * Hex UID from an NFC dispatch intent. Prefers the id Brick wrote into the
+ * tag's NDEF record (that survives tags whose serial the system hides) and
+ * falls back to the raw tag serial.
+ */
 fun Intent.tagUid(): String? {
+    @Suppress("DEPRECATION")
+    val messages = getParcelableArrayExtra(NfcAdapter.EXTRA_NDEF_MESSAGES)
+        ?.filterIsInstance<NdefMessage>()
+        .orEmpty()
+    messages.firstNotNullOfOrNull { BrickTagWriter.brickPayload(it) }?.let { return it }
     @Suppress("DEPRECATION")
     val tag = getParcelableExtra<Tag>(NfcAdapter.EXTRA_TAG) ?: return null
     return tag.uid()
@@ -23,24 +33,26 @@ fun Intent.tagUid(): String? {
  */
 object BrickReader {
 
-    private const val FLAGS = NfcAdapter.FLAG_READER_NFC_A or
+    private const val TECHS = NfcAdapter.FLAG_READER_NFC_A or
         NfcAdapter.FLAG_READER_NFC_B or
         NfcAdapter.FLAG_READER_NFC_F or
         NfcAdapter.FLAG_READER_NFC_V or
-        NfcAdapter.FLAG_READER_NO_PLATFORM_SOUNDS or
-        NfcAdapter.FLAG_READER_SKIP_NDEF_CHECK
+        NfcAdapter.FLAG_READER_NO_PLATFORM_SOUNDS
 
     /** Starts reading; returns false when the device has no usable NFC. */
-    fun start(activity: Activity, onUid: (String) -> Boolean): Boolean {
+    fun start(activity: Activity, onUid: (String) -> Boolean): Boolean =
+        startForTag(activity) { tag -> tag.uid()?.let { onUid(it) } ?: false }
+
+    /**
+     * Reader mode that hands over the whole tag, so pairing can also program it.
+     * NDEF discovery stays on here (unlike plain id reading) because writing
+     * needs the Ndef/NdefFormatable technology to be available.
+     */
+    fun startForTag(activity: Activity, onTag: (Tag) -> Boolean): Boolean {
         val adapter = NfcAdapter.getDefaultAdapter(activity) ?: return false
         if (!adapter.isEnabled) return false
         runCatching {
-            adapter.enableReaderMode(
-                activity,
-                { tag -> tag.uid()?.let { onUid(it) } },
-                FLAGS,
-                null,
-            )
+            adapter.enableReaderMode(activity, { tag -> onTag(tag) }, TECHS, null)
         }.onFailure { return false }
         return true
     }
diff --git a/feature/brick/src/main/kotlin/com/lifeos/feature/brick/nfc/BrickTagWriter.kt b/feature/brick/src/main/kotlin/com/lifeos/feature/brick/nfc/BrickTagWriter.kt
new file mode 100644
index 0000000..0b4a920
--- /dev/null
+++ b/feature/brick/src/main/kotlin/com/lifeos/feature/brick/nfc/BrickTagWriter.kt
@@ -0,0 +1,65 @@
+package com.lifeos.feature.brick.nfc
+
+import android.nfc.NdefMessage
+import android.nfc.NdefRecord
+import android.nfc.Tag
+import android.nfc.tech.Ndef
+import android.nfc.tech.NdefFormatable
+
+/** MIME type of the record Brick writes, matched by the manifest NDEF filter. */
+const val BRICK_MIME = "application/vnd.lifeos.brick"
+
+/**
+ * Programs a tag so taps work with LifeOS closed (§Module Brick).
+ *
+ * Reading a tag's serial number only works while an app holds NFC reader mode,
+ * i.e. while LifeOS is open. For a tap to reach a closed app, Android needs the
+ * tag itself to carry a record the system can route: a MIME record LifeOS
+ * declares an intent filter for, plus an Android Application Record so LifeOS
+ * always wins the dispatch instead of a chooser appearing.
+ */
+object BrickTagWriter {
+
+    /** Writes the Brick record, keeping the tag's serial number as the payload. */
+    fun write(tag: Tag, uid: String, packageName: String): Result<Unit> = runCatching {
+        val message = NdefMessage(
+            arrayOf(
+                NdefRecord.createMime(BRICK_MIME, uid.uppercase().toByteArray()),
+                // Last record: the system launches this package and nothing else.
+                NdefRecord.createApplicationRecord(packageName),
+            ),
+        )
+
+        val ndef = Ndef.get(tag)
+        if (ndef != null) {
+            ndef.connect()
+            try {
+                require(ndef.isWritable) { "That tag is write-protected" }
+                require(ndef.maxSize >= message.toByteArray().size) {
+                    "That tag is too small (${ndef.maxSize} bytes)"
+                }
+                ndef.writeNdefMessage(message)
+            } finally {
+                runCatching { ndef.close() }
+            }
+            return@runCatching
+        }
+
+        val formatable = NdefFormatable.get(tag)
+            ?: error("That tag cannot store data, so taps only work with LifeOS open")
+        formatable.connect()
+        try {
+            formatable.format(message)
+        } finally {
+            runCatching { formatable.close() }
+        }
+    }
+
+    /** Reads the UID Brick wrote onto the tag, if any (used by intent dispatch). */
+    fun brickPayload(message: NdefMessage?): String? = message?.records
+        ?.firstOrNull { record ->
+            String(record.type).equals(BRICK_MIME, ignoreCase = true)
+        }
+        ?.let { String(it.payload).trim().uppercase() }
+        ?.takeIf { it.isNotEmpty() }
+}
diff --git a/feature/brick/src/main/res/xml/brick_nfc_tech.xml b/feature/brick/src/main/res/xml/brick_nfc_tech.xml
index 0c88eb6..8ebd2ec 100644
--- a/feature/brick/src/main/res/xml/brick_nfc_tech.xml
+++ b/feature/brick/src/main/res/xml/brick_nfc_tech.xml
@@ -22,4 +22,16 @@
     <tech-list>
         <tech>android.nfc.tech.Ndef</tech>
     </tech-list>
+    <tech-list>
+        <tech>android.nfc.tech.NdefFormatable</tech>
+    </tech-list>
+    <tech-list>
+        <tech>android.nfc.tech.MifareClassic</tech>
+    </tech-list>
+    <tech-list>
+        <tech>android.nfc.tech.IsoDep</tech>
+    </tech-list>
+    <tech-list>
+        <tech>android.nfc.tech.NfcBarcode</tech>
+    </tech-list>
 </resources>
diff --git a/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/DownloaderScreen.kt b/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/DownloaderScreen.kt
index b84df4b..08dae36 100644
--- a/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/DownloaderScreen.kt
+++ b/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/DownloaderScreen.kt
@@ -41,22 +41,20 @@ import com.lifeos.core.database.downloads.DownloadDao
 import com.lifeos.core.designsystem.component.EmptyState
 import com.lifeos.feature.downloader.data.DownloadEngine
 import com.lifeos.feature.downloader.data.MediaCandidate
-import com.lifeos.feature.downloader.data.MediaExtractor
+import com.lifeos.feature.downloader.data.MediaResolver
 import com.lifeos.feature.downloader.data.SiteCatalog
 import com.lifeos.feature.downloader.data.SupportedSite
 import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.SharingStarted
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.flow.stateIn
 import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
 import javax.inject.Inject
 
 @HiltViewModel
 class DownloaderViewModel @Inject constructor(
-    private val extractor: MediaExtractor,
+    private val resolver: MediaResolver,
     private val engine: DownloadEngine,
     private val downloadDao: DownloadDao,
 ) : ViewModel() {
@@ -82,11 +80,18 @@ class DownloaderViewModel @Inject constructor(
             _busy.value = true
             _message.value = null
             _candidates.value = emptyList()
-            val result = withContext(Dispatchers.IO) { runCatching { extractor.extract(target) } }
+            val result = runCatching { resolver.resolve(target) }
             _busy.value = false
-            result.onSuccess { found ->
-                _candidates.value = found
-                if (found.isEmpty()) _message.value = "No downloadable media found on that page."
+            result.onSuccess { outcome ->
+                _candidates.value = outcome.candidates
+                _message.value = when {
+                    outcome.candidates.isEmpty() ->
+                        "No downloadable media found on that page."
+                    outcome.usedPlayer ->
+                        "Resolved with the in-app player - links are tied to this session, " +
+                            "so download them now."
+                    else -> null
+                }
             }.onFailure { _message.value = it.message ?: "Couldn't reach that URL." }
         }
     }
diff --git a/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/DownloadEngine.kt b/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/DownloadEngine.kt
index 7b526c5..d502cb2 100644
--- a/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/DownloadEngine.kt
+++ b/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/DownloadEngine.kt
@@ -73,9 +73,9 @@ class DownloadEngine @Inject constructor(
         try {
             resolver.openOutputStream(target)!!.use { out ->
                 if (candidate.kind == "HLS") {
-                    val segments = resolveHlsSegments(candidate.url)
+                    val segments = resolveHlsSegments(candidate.url, candidate.headers)
                     segments.forEachIndexed { index, segmentUrl ->
-                        client.newCall(Request.Builder().url(segmentUrl).header("User-Agent", UA).build())
+                        client.newCall(request(segmentUrl, candidate.headers))
                             .execute().use { response ->
                                 check(response.isSuccessful) { "HTTP ${response.code} on segment" }
                                 total += response.body.byteStream().copyTo(out)
@@ -83,7 +83,7 @@ class DownloadEngine @Inject constructor(
                         downloadDao.setProgress(id, "RUNNING", ((index + 1) * 100 / segments.size))
                     }
                 } else {
-                    client.newCall(Request.Builder().url(candidate.url).header("User-Agent", UA).build())
+                    client.newCall(request(candidate.url, candidate.headers))
                         .execute().use { response ->
                             check(response.isSuccessful) { "HTTP ${response.code}" }
                             val length = response.body.contentLength()
@@ -114,11 +114,24 @@ class DownloadEngine @Inject constructor(
         }
     }
 
+    /**
+     * Builds the stream request. Session-bound links (resolved by the offscreen
+     * player) only work when their Referer, Cookie and User-Agent come along.
+     */
+    private fun request(url: String, headers: Map<String, String>): Request =
+        Request.Builder().url(url).apply {
+            header("User-Agent", headers["User-Agent"] ?: UA)
+            headers.forEach { (name, value) ->
+                if (!name.equals("User-Agent", ignoreCase = true) && value.isNotBlank()) {
+                    header(name, value)
+                }
+            }
+        }.build()
+
     /** Master playlists pick the highest-bandwidth variant; media playlists list segments. */
-    private fun resolveHlsSegments(playlistUrl: String): List<String> {
+    private fun resolveHlsSegments(playlistUrl: String, headers: Map<String, String>): List<String> {
         fun fetch(u: String): String =
-            client.newCall(Request.Builder().url(u).header("User-Agent", UA).build()).execute()
-                .use { it.body.string() }
+            client.newCall(request(u, headers)).execute().use { it.body.string() }
 
         fun absolute(base: String, line: String): String = when {
             line.startsWith("http") -> line
diff --git a/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/KvsPlayer.kt b/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/KvsPlayer.kt
deleted file mode 100644
index 2e5fe7b..0000000
--- a/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/KvsPlayer.kt
+++ /dev/null
@@ -1,60 +0,0 @@
-package com.lifeos.feature.downloader.data
-
-/**
- * kt_player ("KVS") link decoder. ThisVid and a long tail of tube sites hand
- * out `function/0/https://.../<scrambled>` URLs plus a `license_code`; the
- * player unscrambles one path segment client-side before playing.
- *
- * Reimplemented here so those pages resolve fully on-device, with no external
- * extractor binary involved.
- */
-internal object KvsPlayer {
-
-    /** Turns a license code into the digit sequence the shuffle is driven by. */
-    fun licenseToken(license: String): List<Int> {
-        val modified = license.replace("$", "").replace("0", "1")
-        if (modified.length < 2) return emptyList()
-        val center = modified.length / 2
-        val front = modified.substring(0, center + 1).toLongOrNull() ?: return emptyList()
-        val back = modified.substring(center).toLongOrNull() ?: return emptyList()
-        val shuffled = (4 * kotlin.math.abs(front - back)).toString()
-        val trimmed = shuffled.take(center + 1)
-        return trimmed.map { char -> char.digitToIntOrNull() ?: 0 }
-    }
-
-    /**
-     * @param url a `function/0/<real url>` style link from the page's flashvars.
-     * @return the playable URL, or null when the input is not a KVS link.
-     */
-    fun decode(url: String, licenseCode: String): String? {
-        if (!url.contains("/get_file/") && !url.startsWith("function/0/")) return null
-        val real = url.removePrefix("function/0/")
-        if (licenseCode.isBlank()) return real
-        val parts = real.split('/').toMutableList()
-        // The scrambled segment is the one after the /get_file/ marker.
-        val index = parts.indexOf("get_file").let { if (it >= 0) it + 1 else 5 }
-        val segment = parts.getOrNull(index) ?: return real
-        if (segment.length < 32) return real
-        val token = licenseToken(licenseCode)
-        if (token.isEmpty()) return real
-
-        var magic = segment.take(32)
-        for (o in 31 downTo 0) {
-            val sum = token.drop(o).sum()
-            val l = (o + sum) % 32
-            val builder = StringBuilder(32)
-            for (i in 0 until 32) {
-                builder.append(
-                    when (i) {
-                        o -> magic[l]
-                        l -> magic[o]
-                        else -> magic[i]
-                    },
-                )
-            }
-            magic = builder.toString()
-        }
-        parts[index] = magic + segment.substring(32)
-        return parts.joinToString("/")
-    }
-}
diff --git a/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/MediaExtractor.kt b/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/MediaExtractor.kt
index 7089b5b..561584a 100644
--- a/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/MediaExtractor.kt
+++ b/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/MediaExtractor.kt
@@ -6,12 +6,24 @@ import java.util.concurrent.TimeUnit
 import javax.inject.Inject
 import javax.inject.Singleton
 
+/** Result of a static page scan. */
+data class ExtractResult(
+    val candidates: List<MediaCandidate>,
+    /**
+     * True when the page drives its player through obfuscated, session-bound
+     * JavaScript, so only [PlayerResolver] can produce a working link.
+     */
+    val playerNeeded: Boolean = false,
+)
+
 /** A downloadable media stream discovered on a page. */
 data class MediaCandidate(
     val url: String,
     val title: String,
     val mimeType: String,
     val kind: String, // VIDEO, AUDIO, HLS
+    /** Request headers the stream needs (Referer, Cookie, User-Agent). */
+    val headers: Map<String, String> = emptyMap(),
 )
 
 /**
@@ -34,39 +46,45 @@ class MediaExtractor @Inject constructor() {
         .followRedirects(true)
         .build()
 
-    fun extract(pageUrl: String): List<MediaCandidate> {
+    fun extract(pageUrl: String): ExtractResult {
         val url = normalize(pageUrl.trim())
         require(url.startsWith("http")) { "Enter a full http(s) URL" }
 
         // The URL itself may already be the media file.
         directKind(url)?.let { kind ->
-            return listOf(MediaCandidate(url, fileName(url), mimeFor(url), kind))
+            return ExtractResult(listOf(MediaCandidate(url, fileName(url), mimeFor(url), kind)))
         }
 
         val found = linkedMapOf<String, MediaCandidate>()
         siteHelper(url)?.let { helper -> found.putAll(helper.associateBy { it.url }) }
-        if (found.size >= 4) return found.values.toList()
+        if (found.size >= 4) return ExtractResult(found.values.toList())
 
-        val page = fetch(url) ?: return found.values.toList()
+        val page = fetch(url) ?: return ExtractResult(found.values.toList())
         if (page.mediaType.startsWith("video/") || page.mediaType.startsWith("audio/")) {
-            return listOf(
-                MediaCandidate(
-                    url = url,
-                    title = fileName(url),
-                    mimeType = page.mediaType,
-                    kind = if (page.mediaType.startsWith("audio/")) "AUDIO" else "VIDEO",
+            return ExtractResult(
+                listOf(
+                    MediaCandidate(
+                        url = url,
+                        title = fileName(url),
+                        mimeType = page.mediaType,
+                        kind = if (page.mediaType.startsWith("audio/")) "AUDIO" else "VIDEO",
+                    ),
                 ),
             )
         }
         if (!page.mediaType.contains("html") && !page.mediaType.contains("json")) {
-            return found.values.toList()
+            return ExtractResult(found.values.toList())
         }
 
+        // Scrambled player links cannot be repaired here; the page's own player
+        // has to resolve them (PlayerResolver).
+        val playerNeeded = KVS_MARKER.containsMatchIn(page.body)
+
         found.putAll(parseHtml(page.body, url).associateBy { it.url })
 
         // One level of iframe following: most file hosts and embeds put the real
         // player one frame deeper.
-        if (found.isEmpty()) {
+        if (found.isEmpty() && !playerNeeded) {
             IFRAME.findAll(page.body)
                 .map { absolute(it.groupValues[1], url) }
                 .filter { it.startsWith("http") && it != url }
@@ -79,7 +97,7 @@ class MediaExtractor @Inject constructor() {
                 }
         }
 
-        return found.values.take(10).toList()
+        return ExtractResult(found.values.take(10).toList(), playerNeeded)
     }
 
     // ---- site helpers ------------------------------------------------------
@@ -177,6 +195,7 @@ class MediaExtractor @Inject constructor() {
             if (candidate.startsWith("//")) candidate = "https:$candidate"
             if (candidate.startsWith("/")) candidate = absolute(candidate, baseUrl)
             if (!candidate.startsWith("http")) return
+            if (isJunk(candidate)) return
             val kind = directKind(candidate) ?: return
             found.putIfAbsent(candidate, MediaCandidate(candidate, label, mimeFor(candidate), kind))
         }
@@ -187,28 +206,12 @@ class MediaExtractor @Inject constructor() {
         VIDEO_SRC.findAll(html).forEach { add(it.groupValues[1]) }
         // Player JSON keys used across platforms and file hosts.
         JSON_MEDIA.findAll(html).forEach { add(it.groupValues[1]) }
-        // kt_player / KVS pages: scrambled links plus a license code.
-        kvs(html, title).forEach { found.putIfAbsent(it.url, it) }
         // Raw media links anywhere in the document (players, JSON blobs).
         RAW_MEDIA.findAll(html).forEach { add(unescape(it.value)) }
 
         return found.values.take(10).toList()
     }
 
-    private fun kvs(html: String, title: String): List<MediaCandidate> {
-        val license = LICENSE_CODE.find(html)?.groupValues?.get(1).orEmpty()
-        return KVS_URL.findAll(html).mapNotNull { match ->
-            val raw = unescape(match.groupValues[2])
-            val resolved = if (raw.startsWith("function/0/")) {
-                KvsPlayer.decode(raw, license)
-            } else {
-                KvsPlayer.decode(raw, license) ?: raw
-            } ?: return@mapNotNull null
-            val kind = directKind(resolved) ?: "VIDEO"
-            MediaCandidate(resolved, title, mimeFor(resolved), kind)
-        }.toList()
-    }
-
     private data class Page(val body: String, val mediaType: String)
 
     private fun fetch(url: String): Page? = runCatching {
@@ -239,6 +242,12 @@ class MediaExtractor @Inject constructor() {
         else -> url
     }
 
+    /** Skips teasers, sprites and ad creatives that are not the real stream. */
+    private fun isJunk(url: String): Boolean {
+        val clean = url.substringBefore('?').lowercase()
+        return JUNK.any { it in clean }
+    }
+
     private fun directKind(url: String): String? {
         val clean = url.substringBefore('?').lowercase()
         return when {
@@ -297,11 +306,8 @@ class MediaExtractor @Inject constructor() {
             "\"(?:contentUrl|playbackUrl|progressiveUrl|hlsUrl|hlsManifestUrl|videoUrl|video_url|media_url|streamUrl|file|src)\"\\s*:\\s*\"([^\"]+)\"",
             RegexOption.IGNORE_CASE,
         )
-        val KVS_URL = Regex(
-            "(video_url|video_alt_url\\d*|video_url_text)\\s*:\\s*'([^']+)'",
-            RegexOption.IGNORE_CASE,
-        )
-        val LICENSE_CODE = Regex("license_code\\s*:\\s*'([^']+)'", RegexOption.IGNORE_CASE)
+        val JUNK = listOf("preview", "thumb", "sprite", "timeline", "trailer", "advert", "/ads/")
+        val KVS_MARKER = Regex("license_code\\s*:|function/0/", RegexOption.IGNORE_CASE)
         val RAW_MEDIA = Regex("https?://[^\\s\"'<>\\\\]+?\\.(?:mp4|webm|m4v|mp3|m4a|flac|m3u8)(?:\\?[^\\s\"'<>\\\\]*)?")
         val VIDEO_EXT = listOf(".mp4", ".webm", ".m4v", ".mov", ".mkv")
         val AUDIO_EXT = listOf(".mp3", ".m4a", ".ogg", ".oga", ".wav", ".flac")
diff --git a/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/MediaResolver.kt b/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/MediaResolver.kt
new file mode 100644
index 0000000..9ef1801
--- /dev/null
+++ b/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/MediaResolver.kt
@@ -0,0 +1,38 @@
+package com.lifeos.feature.downloader.data
+
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/** What a scan produced, plus how it was produced (shown in the UI). */
+data class ResolveOutcome(
+    val candidates: List<MediaCandidate>,
+    val usedPlayer: Boolean,
+)
+
+/**
+ * Chooses how to get a stream out of a page (§Module Downloader): the cheap
+ * static scan first, and the offscreen-player route when the page hides its
+ * link behind session-bound player JavaScript (ThisVid and the rest of the
+ * kt_player family) or when the static scan comes up empty.
+ */
+@Singleton
+class MediaResolver @Inject constructor(
+    private val extractor: MediaExtractor,
+    private val playerResolver: PlayerResolver,
+) {
+
+    suspend fun resolve(pageUrl: String): ResolveOutcome {
+        val static = withContext(Dispatchers.IO) { extractor.extract(pageUrl) }
+        if (!static.playerNeeded && static.candidates.isNotEmpty()) {
+            return ResolveOutcome(static.candidates, usedPlayer = false)
+        }
+        val viaPlayer = playerResolver.resolve(pageUrl)
+        return if (viaPlayer.isNotEmpty()) {
+            ResolveOutcome(viaPlayer, usedPlayer = true)
+        } else {
+            ResolveOutcome(static.candidates, usedPlayer = false)
+        }
+    }
+}
diff --git a/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/PlayerResolver.kt b/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/PlayerResolver.kt
new file mode 100644
index 0000000..6f022e3
--- /dev/null
+++ b/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/PlayerResolver.kt
@@ -0,0 +1,184 @@
+package com.lifeos.feature.downloader.data
+
+import android.annotation.SuppressLint
+import android.content.Context
+import android.webkit.CookieManager
+import android.webkit.WebResourceRequest
+import android.webkit.WebResourceResponse
+import android.webkit.WebView
+import android.webkit.WebViewClient
+import com.lifeos.core.common.log.LifeLogger
+import dagger.hilt.android.qualifiers.ApplicationContext
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.withContext
+import kotlinx.coroutines.withTimeoutOrNull
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * Player-driven resolver (§Module Downloader).
+ *
+ * Some sites hand the player a scrambled link that only its own obfuscated
+ * JavaScript can turn into a real file URL, and the resulting link is bound to
+ * the browsing session (cookies plus a Referer check). Reimplementing each
+ * site's scrambler is a losing game, so LifeOS instead lets the page's own
+ * player do the work in an offscreen WebView and records the media request it
+ * makes, together with the cookies needed to fetch it.
+ *
+ * Nothing is shown to the user and nothing leaves the phone: the WebView is
+ * created, driven and destroyed inside this call.
+ */
+@Singleton
+class PlayerResolver @Inject constructor(
+    @ApplicationContext private val context: Context,
+) {
+
+    suspend fun resolve(pageUrl: String, timeoutMs: Long = 30_000): List<MediaCandidate> =
+        withTimeoutOrNull(timeoutMs) { drive(pageUrl) } ?: emptyList()
+
+    @SuppressLint("SetJavaScriptEnabled")
+    private suspend fun drive(pageUrl: String): List<MediaCandidate> {
+        val seen = linkedMapOf<String, MediaCandidate>()
+        var title = pageUrl.substringAfterLast('/').ifBlank { "media" }
+
+        val webView = withContext(Dispatchers.Main) {
+            WebView(context).apply {
+                settings.javaScriptEnabled = true
+                settings.domStorageEnabled = true
+                settings.mediaPlaybackRequiresUserGesture = false
+                settings.loadsImagesAutomatically = false
+                settings.userAgentString = BROWSER_UA
+                CookieManager.getInstance().setAcceptCookie(true)
+                CookieManager.getInstance().setAcceptThirdPartyCookies(this, true)
+                webViewClient = object : WebViewClient() {
+                    override fun shouldInterceptRequest(
+                        view: WebView?,
+                        request: WebResourceRequest?,
+                    ): WebResourceResponse? {
+                        val url = request?.url?.toString() ?: return null
+                        if (isMedia(url)) {
+                            seen.putIfAbsent(url, MediaCandidate(url, title, mimeFor(url), kindFor(url)))
+                        }
+                        return null
+                    }
+                }
+                loadUrl(pageUrl)
+            }
+        }
+
+        try {
+            // Give the page time to boot its player, then nudge it into playing
+            // so the media request actually happens.
+            repeat(POLLS) { round ->
+                delay(POLL_MS)
+                withContext(Dispatchers.Main) {
+                    webView.title?.takeIf { it.isNotBlank() }?.let { title = it.take(80) }
+                    if (round >= 1) webView.evaluateJavascript(NUDGE_JS) { result ->
+                        result?.split("|")
+                            ?.map { it.trim('"', '\\', ' ') }
+                            ?.filter { isMedia(it) }
+                            ?.forEach { url ->
+                                seen.putIfAbsent(url, MediaCandidate(url, title, mimeFor(url), kindFor(url)))
+                            }
+                    }
+                }
+                // One extra round after the first hit picks up alternate qualities.
+                if (seen.isNotEmpty() && round >= 2) return@repeat
+            }
+            val cookies = withContext(Dispatchers.Main) {
+                CookieManager.getInstance().getCookie(pageUrl).orEmpty()
+            }
+            val headers = buildMap {
+                put("Referer", pageUrl)
+                put("User-Agent", BROWSER_UA)
+                if (cookies.isNotBlank()) put("Cookie", cookies)
+            }
+            return seen.values
+                .map { it.copy(title = title, headers = headers) }
+                .sortedByDescending { qualityScore(it.url) }
+                .take(6)
+        } catch (t: Throwable) {
+            LifeLogger.e(TAG, "Player resolve failed for $pageUrl", t)
+            return emptyList()
+        } finally {
+            withContext(Dispatchers.Main) {
+                webView.stopLoading()
+                webView.loadUrl("about:blank")
+                webView.destroy()
+            }
+        }
+    }
+
+    private fun isMedia(url: String): Boolean {
+        if (!url.startsWith("http")) return false
+        val clean = url.substringBefore('?').lowercase()
+        if (JUNK.any { it in clean }) return false
+        return MEDIA_EXT.any { clean.endsWith(it) } ||
+            clean.contains(".m3u8") ||
+            clean.contains("/get_file/")
+    }
+
+    private fun kindFor(url: String): String {
+        val clean = url.substringBefore('?').lowercase()
+        return when {
+            clean.contains(".m3u8") -> "HLS"
+            clean.endsWith(".mp3") || clean.endsWith(".m4a") -> "AUDIO"
+            else -> "VIDEO"
+        }
+    }
+
+    private fun mimeFor(url: String): String = when {
+        url.contains(".m3u8") -> "video/mp2t"
+        url.contains(".webm") -> "video/webm"
+        url.contains(".mp3") -> "audio/mpeg"
+        else -> "video/mp4"
+    }
+
+    /** Rough ordering so the best rendition is offered first. */
+    private fun qualityScore(url: String): Int = Regex("""(\d{3,4})p""").find(url)
+        ?.groupValues?.get(1)?.toIntOrNull()
+        ?: 1080
+
+    private companion object {
+        const val TAG = "PlayerResolver"
+        const val BROWSER_UA =
+            "Mozilla/5.0 (Linux; Android 14; SM-S908B) AppleWebKit/537.36 (KHTML, like Gecko) " +
+                "Chrome/128.0.0.0 Mobile Safari/537.36"
+        const val POLL_MS = 1_200L
+        const val POLLS = 18
+        val MEDIA_EXT = listOf(".mp4", ".m4v", ".webm", ".mov", ".mkv", ".mp3", ".m4a")
+        val JUNK = listOf(
+            "preview", "thumb", "sprite", "timeline", "trailer", "/ads/", "advert",
+            "logo", "watermark", ".jpg", ".png", ".gif", ".vtt", ".css", ".js",
+        )
+
+        /**
+         * Reads whatever the player has already resolved and, if nothing is
+         * playing yet, mutes and starts it so the stream request is issued.
+         */
+        val NUDGE_JS = """
+            (function() {
+              var out = [];
+              var media = document.querySelectorAll('video, audio, source');
+              for (var i = 0; i < media.length; i++) {
+                if (media[i].src) out.push(media[i].src);
+                if (media[i].currentSrc) out.push(media[i].currentSrc);
+              }
+              var players = document.querySelectorAll('video, audio');
+              for (var j = 0; j < players.length; j++) {
+                try { players[j].muted = true; players[j].play(); } catch (e) {}
+              }
+              if (players.length === 0) {
+                var starters = ['.fp-ui', '.vjs-big-play-button', '.play-button', '.player',
+                                '#kt_player', '#player', '[class*=play]'];
+                for (var k = 0; k < starters.length; k++) {
+                  var el = document.querySelector(starters[k]);
+                  if (el) { try { el.click(); } catch (e) {} break; }
+                }
+              }
+              return out.join('|');
+            })();
+        """.trimIndent()
+    }
+}
diff --git a/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/SiteCatalog.kt b/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/SiteCatalog.kt
index a914909..bd838bb 100644
--- a/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/SiteCatalog.kt
+++ b/feature/downloader/src/main/kotlin/com/lifeos/feature/downloader/data/SiteCatalog.kt
@@ -11,8 +11,8 @@ data class SupportedSite(
 /**
  * Curated catalogue of sites the on-device extractor handles, grouped so the
  * module can show what is worth pasting. Everything here is reached with the
- * generic extractor plus the site helpers in [MediaExtractor] - no external
- * service, no API keys, no accounts.
+ * generic extractor, the site helpers in [MediaExtractor] or the offscreen
+ * [PlayerResolver] - no external service, no API keys, no accounts.
  *
  * Sites needing a logged-in session (private posts, paid courses) are listed
  * with that caveat instead of being silently omitted.
@@ -88,7 +88,7 @@ object SiteCatalog {
         SupportedSite("Upstream", "upstream.to", "File host", "HLS"),
 
         // ---- Adult (kt_player / KVS family and friends) ---------------------
-        SupportedSite("ThisVid", "thisvid.com", "Adult", "KVS player links decoded on-device"),
+        SupportedSite("ThisVid", "thisvid.com", "Adult", "Resolved by the offscreen player (session-bound links)"),
         SupportedSite("xHamster", "xhamster.com", "Adult", "Direct mp4/HLS"),
         SupportedSite("XVideos", "xvideos.com", "Adult", "Direct mp4/HLS"),
         SupportedSite("Pornhub", "pornhub.com", "Adult", "Direct mp4"),
@@ -97,7 +97,7 @@ object SiteCatalog {
         SupportedSite("Eporner", "eporner.com", "Adult", "Direct mp4"),
         SupportedSite("Redgifs", "redgifs.com", "Adult", "Direct mp4"),
         SupportedSite("Motherless", "motherless.com", "Adult", "Direct mp4"),
-        SupportedSite("KVS tube sites", "kt_player", "Adult", "Any site using the kt_player script"),
+        SupportedSite("KVS tube sites", "kt_player", "Adult", "Any kt_player site, via the offscreen player"),
     )
 
     val categories: List<String> = sites.map { it.category }.distinct()