Quick Deck: play a deck's video and audio

apps/README.md

@@ -38,7 +38,7 @@ them. They live in `apps/` of the [OctoSense repository](../README.md); until
   speech, embedding and asynchronous video requests. Apps declare `model` and
   exact host API versions; provider entitlement is checked when used. See the
   [media contract and validation limits](ai-providers/host-service/MEDIA.md).
-- **The `deck` host service** (`deck/host-service`, ADR 0013) is the deckcraft presentation engine behind `deck.*`: decks inspected, read as outline text, rendered to PNG, created from titles and bullets, and converted (pptx, native, outline, PDF), confined to the caller's own folder. Its app is Quick Deck (`quickdeck/bundle`), whose calls work in Quick Deck's own storage. For Quick Deck v2 it also keeps open documents (`apps/quickdeck/design/SERVICE.md`): `deck.open` and `deck.create` return a handle, and the methods on it (slides, objects, text, formatting, design, notes, transitions, undo and redo, drawing a slide into a render cache, Present's order and build steps, save and export) each run reviewed engine commands through the same gate as the system agent's `deck.run`, as one undo step. Every file the service opens first passes its own import guard, which refuses a zip beyond its bounds, an encrypted `.pptx` and a legacy `.ppt` before the engine reads it. A deck's audio and video come along as they are: drawn with their poster, saved and exported unchanged, and never decoded or played.
+- **The `deck` host service** (`deck/host-service`, ADR 0013) is the deckcraft presentation engine behind `deck.*`: decks inspected, read as outline text, rendered to PNG, created from titles and bullets, and converted (pptx, native, outline, PDF), confined to the caller's own folder. Its app is Quick Deck (`quickdeck/bundle`), whose calls work in Quick Deck's own storage. For Quick Deck v2 it also keeps open documents (`apps/quickdeck/design/SERVICE.md`): `deck.open` and `deck.create` return a handle, and the methods on it (slides, objects, text, formatting, design, notes, transitions, undo and redo, drawing a slide into a render cache, Present's order and build steps, save and export) each run reviewed engine commands through the same gate as the system agent's `deck.run`, as one undo step. Every file the service opens first passes its own import guard, which refuses a zip beyond its bounds, an encrypted `.pptx` and a legacy `.ppt` before the engine reads it. A deck's audio and video come along as they are: drawn with their poster, saved and exported unchanged, and never decoded by the service; `deck.media` hands Quick Deck a clip's bytes as a file in its storage, which the app plays with the runtime's `Video` widget (the system's own player).
 - **The `cad` engine service** (`cad/host-service`): the cadcraft drafting engine behind `cad.*` (ADR 0013, no bundle yet) — inspect, query, measure, render and convert DXF/DWG drawings, every path inside the caller's own folder.
 - **The `light` engine service** (`light/host-service`) is lightcraft's RAW
   develop engine behind `light.*` (ADR 0013): EXIF/XMP metadata, the develop
@@ -131,7 +131,7 @@ profiles. Phone-sized desktop captures are not physical-device verification.
 | [AI providers](ai-providers/bundle) | `os.ai-providers` | The assistant's LLM providers: a primary and fallbacks, each with a model pull-down from octos's catalog and Test connection; an add wizard (family, model, route, key, test); Show QR for phone and import by camera, image or paste | `storage`, `llm` | none (the service connects, not the app) | [`llm`](ai-providers/host-service) |
 | [YouTube](youtube/bundle) | `os.youtube` | YouTube search (the runtime's keyless `sys.video`, which reads YouTube's own results page), result rows with thumbnails and LIVE or length badges, topic chips, playback of YouTube's mobile watch page in `WebReader`, and a history of what was played on this device | `storage`, `net`, `glance` | `www.youtube.com`, `m.youtube.com`, `i.ytimg.com` | `youtube.notify` via the shell notice service |
 | [Calendar](calendar/bundle) | `os.calendar` | Month/day calendar, event details and editor; app-owned event/agenda cards in Glance, with saved-event navigation | `calendar`, `glance` | none | [`calendar`](calendar/host-service) (Calendar-owned executor; granted cross-app tools) |
-| [Quick Deck](quickdeck/bundle) | `os.quickdeck` (desktop) | A presentation editor: a library of decks with their covers, an editor with a slide navigator, a canvas and an inspector (Format, Layout, Theme, Notes), text edited in place, pictures, shapes, tables and charts with their data, a slide sorter with sections, New from an outline (typed, or drafted by the person's own AI provider), Present and Export (.pptx, PDF, pictures); open a presentation from the device. See [its README](quickdeck/README.md), with the runs that test it | `storage`, `files`, `deck`, `model` | none | the [`deck`](deck/host-service) engine service's open-document methods in [design/SERVICE.md](quickdeck/design/SERVICE.md), in the app's own storage; the shell's `files.status` and `files.import`; `model.complete` for Draft with AI |
+| [Quick Deck](quickdeck/bundle) | `os.quickdeck` (desktop) | A presentation editor: a library of decks with their covers, an editor with a slide navigator, a canvas and an inspector (Format, Layout, Theme, Notes), text edited in place, pictures, shapes, tables and charts with their data, a slide sorter with sections, New from an outline (typed, or drafted by the person's own AI provider), Present and Export (.pptx, PDF, pictures); a deck's video and audio played in the editor and in Present where the system has a player; open a presentation from the device. See [its README](quickdeck/README.md), with the runs that test it | `storage`, `files`, `deck`, `model` | none | the [`deck`](deck/host-service) engine service's open-document methods in [design/SERVICE.md](quickdeck/design/SERVICE.md), in the app's own storage; the shell's `files.status` and `files.import`; `model.complete` for Draft with AI |
 | [PDF Tools](pdftools/bundle) | `os.pdftools` (desktop) | The PDFs in its own storage: a library with each first page, a document view with page thumbnails, text with find, and info; a page view; merge in three steps (choose, order, done) and split every few pages or where you choose; open a PDF from the device (up to 64 MiB) and remove one. See [its README](pdftools/README.md), with the hidden-shell journey that tests it | `storage`, `files`, `pdf` | none | the [`pdf`](pdf/host-service) engine service in the app's own storage: `pdf.info`, `pdf.render`, `pdf.text`, `pdf.merge`, `pdf.split`; the shell's `files.status` and `files.import` |
 | [Writer](writer/bundle) | `os.writer` (desktop) | A calm editor on a white page (a line starting with `#` is a heading, `-` a bullet, `>` a quote), a document list, Save as a Word document, a preview of the saved document with an outline from its headings, and export to PDF, Markdown, HTML or OpenDocument; drafts autosave in the app's storage | `storage`, `word` | none | [`word`](word/host-service) (`word.convert`, `word.info`, `word.inspect`), in Writer's own storage |
 | [AppCard](appcard) | native, opt-in | The AppCard assistant: a routing brain picks or composes an app agent, which generates a live Splash or webview card. Shells link it only with `app-appcard`; not shipped by default | n/a (not a bundle) | n/a | the shell's octos kernel |
@@ -233,7 +233,14 @@ See [capabilities and execution boundaries](../docs/capabilities.md).
   -p octosense-shell --lib quickdeck_model`). The inspector's states (#507:
   a box's anchor and autofit, a chart's elements, a table's options, the
   colour set, font pair and footer, following a change and its undo) were
-  verified the same day, in `card-host` and with the real engine.
+  verified the same day, in `card-host` and with the real engine. Playback
+  (2026-10-13; `deck.media` of #515, the runtime's `Video` widget): the
+  sample clip played over its box, paused and stopped in `card-host` on a Mac,
+  and in Present by itself and on a tap; with the real engine on Linux,
+  `deck.media` wrote each clip into the storage and every clip said
+  "Playback isn't available on this system" (no MP4 decoder there); in a
+  macOS shell with the real engine the clips played, in the editor and in
+  Present.
 - **Writer** (2026-10-09). In a hidden desktop shell built from this tree
   (`MAKEPAD_WM_TEST_APP=writer`, a hidden `--remote` run, light and dark),
   with the real `word` engine working in Writer's own storage: a document

apps/README.zh-CN.md

@@ -33,7 +33,7 @@ OctoSense-System-Apps 仓库（已归档）。
 - **`model` 媒体 API** 使用宿主持有的供应商配置，执行有上限的图片、语音、向量和异步
   视频请求。应用声明 `model` 和精确宿主 API 版本；调用时检查供应商权益。见
   [媒体契约与验证范围](ai-providers/host-service/MEDIA.zh-CN.md)。
-- **`deck` 宿主服务**（`deck/host-service`，ADR 0013）把 deckcraft 演示文稿引擎放在 `deck.*` 之后：检查幻灯片、提取大纲文本、渲染 PNG、按标题和要点新建演示文稿，以及格式转换（pptx、原生格式、大纲、PDF），全部限制在调用方自己的文件夹内。它的应用是 Quick Deck（`quickdeck/bundle`），其调用在 Quick Deck 自己的存储中运行。它还为 Quick Deck v2 保持打开的文档（`apps/quickdeck/design/SERVICE.md`）：`deck.open` 和 `deck.create` 返回一个句柄，作用于它的方法（幻灯片、对象、文本、格式、设计、备注、切换效果、撤销与重做、把幻灯片绘制到渲染缓存、放映的顺序与动画步骤、保存与导出）都通过与系统代理的 `deck.run` 相同的入口运行经过审查的引擎命令，每次调用合为一个撤销步骤。服务打开的每个文件都先通过它自己的导入检查：在引擎读取之前，拒绝超出界限的 zip、加密的 `.pptx` 以及旧版 `.ppt`。演示文稿中的音频和视频会原样保留：显示其海报图，保存和导出时不作改动，并且从不解码或播放。
+- **`deck` 宿主服务**（`deck/host-service`，ADR 0013）把 deckcraft 演示文稿引擎放在 `deck.*` 之后：检查幻灯片、提取大纲文本、渲染 PNG、按标题和要点新建演示文稿，以及格式转换（pptx、原生格式、大纲、PDF），全部限制在调用方自己的文件夹内。它的应用是 Quick Deck（`quickdeck/bundle`），其调用在 Quick Deck 自己的存储中运行。它还为 Quick Deck v2 保持打开的文档（`apps/quickdeck/design/SERVICE.md`）：`deck.open` 和 `deck.create` 返回一个句柄，作用于它的方法（幻灯片、对象、文本、格式、设计、备注、切换效果、撤销与重做、把幻灯片绘制到渲染缓存、放映的顺序与动画步骤、保存与导出）都通过与系统代理的 `deck.run` 相同的入口运行经过审查的引擎命令，每次调用合为一个撤销步骤。服务打开的每个文件都先通过它自己的导入检查：在引擎读取之前，拒绝超出界限的 zip、加密的 `.pptx` 以及旧版 `.ppt`。演示文稿中的音频和视频会原样保留：显示其海报图，保存和导出时不作改动，服务从不解码它们；`deck.media` 把剪辑的字节作为文件交给 Quick Deck 存储，由应用用运行时的 `Video` 控件（系统自己的播放器）播放。
 - **`cad` 引擎服务**（`cad/host-service`）：cadcraft 制图引擎，提供 `cad.*` 方法（ADR 0013，暂无 bundle）——在调用方自己的文件夹内检查、查询、测量、渲染和转换 DXF/DWG 图纸。
 - **`light` 引擎服务**（`light/host-service`）把 lightcraft 的 RAW 显影引擎
   放在 `light.*` 方法之后（ADR 0013）：EXIF/XMP 元数据、显影控制目录、单张与
@@ -108,7 +108,7 @@ OctoSense-System-Apps 仓库（已归档）。
 | [AI providers](ai-providers/bundle) | `os.ai-providers` | 助手的大模型服务商：一个主用与若干备用，每项都有来自 octos 模型目录的型号下拉菜单和“测试连接”；添加向导（系列、型号、线路、密钥、测试）；“为手机显示二维码”，以及通过相机、图片或粘贴导入 | `storage`、`llm` | 无（由服务联网，而不是应用） | [`llm`](ai-providers/host-service) |
 | [YouTube](youtube/bundle) | `os.youtube` | YouTube 搜索（运行时无需密钥的 `sys.video`，读取 YouTube 自己的搜索结果页），带缩略图和直播或时长角标的结果列表、话题标签，在 `WebReader` 中播放 YouTube 移动版观看页，以及本机播放记录 | `storage`、`net`、`glance` | `www.youtube.com`、`m.youtube.com`、`i.ytimg.com` | Shell 通知服务的 `youtube.notify` |
 | [Calendar](calendar/bundle) | `os.calendar` | 月历、按日列表、日程详情与编辑器；Glance 使用应用自有卡片，并能打开已保存日程 | `calendar`、`glance` | 无 | [`calendar`](calendar/host-service)（日历持有执行器；跨应用工具需授权） |
-| [Quick Deck](quickdeck/bundle) | `os.quickdeck`（桌面） | 演示文稿编辑器：带封面的演示文稿库，带幻灯片导航栏、画布和检查器（Format、Layout、Theme、Notes）的编辑器，原地编辑文本，图片、形状、表格和带数据的图表，带分节的幻灯片浏览视图，从大纲新建（手动输入，或由用户自己的 AI 提供方起草），放映和导出（.pptx、PDF、图片）；从本设备打开演示文稿。见[它的 README](quickdeck/README.zh-CN.md)，其中有测试它的各次运行 | `storage`、`files`、`deck`、`model` | 无 | [`deck`](deck/host-service) 引擎服务中 [design/SERVICE.md](quickdeck/design/SERVICE.md) 规定的打开文档方法，在应用自己的存储中运行；Shell 的 `files.status` 和 `files.import`；Draft with AI 使用 `model.complete` |
+| [Quick Deck](quickdeck/bundle) | `os.quickdeck`（桌面） | 演示文稿编辑器：带封面的演示文稿库，带幻灯片导航栏、画布和检查器（Format、Layout、Theme、Notes）的编辑器，原地编辑文本，图片、形状、表格和带数据的图表，带分节的幻灯片浏览视图，从大纲新建（手动输入，或由用户自己的 AI 提供方起草），放映和导出（.pptx、PDF、图片）；在系统有播放器时，于编辑器和放映中播放演示文稿的视频和音频；从本设备打开演示文稿。见[它的 README](quickdeck/README.zh-CN.md)，其中有测试它的各次运行 | `storage`、`files`、`deck`、`model` | 无 | [`deck`](deck/host-service) 引擎服务中 [design/SERVICE.md](quickdeck/design/SERVICE.md) 规定的打开文档方法，在应用自己的存储中运行；Shell 的 `files.status` 和 `files.import`；Draft with AI 使用 `model.complete` |
 | [PDF Tools](pdftools/bundle) | `os.pdftools`（桌面） | 管理自己存储中的 PDF：带首页预览的资料库，带页面缩略图、可查找的文字和信息的文档视图；单页视图；三步合并（选择、排序、完成），以及按固定页数或在指定页面处拆分；从设备打开 PDF（最大 64 MiB）和移除 PDF。见[它的 README](pdftools/README.zh-CN.md)，其中介绍了测试它的隐藏 Shell 流程 | `storage`、`files`、`pdf` | 无 | 在应用自己的存储中工作的 [`pdf`](pdf/host-service) 引擎服务：`pdf.info`、`pdf.render`、`pdf.text`、`pdf.merge`、`pdf.split`；Shell 的 `files.status` 和 `files.import` |
 | [Writer](writer/bundle) | `os.writer`（桌面端） | 白纸上的安静编辑器（以 `#` 开头的行是标题，`-` 是列表项，`>` 是引用）、文档列表、保存为 Word 文档、预览已保存的文档并按其标题生成大纲，以及导出为 PDF、Markdown、HTML 或 OpenDocument；草稿自动保存在应用自己的存储中 | `storage`、`word` | 无 | [`word`](word/host-service)（`word.convert`、`word.info`、`word.inspect`），在 Writer 自己的存储中 |
 | [AppCard](appcard) | 原生，需显式启用 | AppCard 助手：路由大脑选择或组合一个应用 Agent，由它生成实时的 Splash 或 webview 卡片。Shell 只在启用 `app-appcard` 时链接它；默认不发布 | 不适用（不是 bundle） | 不适用 | Shell 的 octos 内核 |
@@ -181,7 +181,10 @@ WebView 页面、图库导出、邮件、新闻、Glance 或单次模型调用
   #503 的真实 `deck` 引擎：从大纲生成演示文稿、原地编辑文本、格式、图表、主题、备注、浏览视图、保存、导出和放映，先浅色后深色，然后重启。模型测试通过（`cargo test --locked
   -p octosense-shell --lib quickdeck_model`）。检查器的状态（#507：文本框的垂直对齐和自动调整、
   图表的元素、表格的选项、配色方案、字体搭配和页脚，以及它们跟随改动和撤销）于同日在
-  `card-host` 中和真实引擎上验证。
+  `card-host` 中和真实引擎上验证。播放（2026-10-13；#515 的 `deck.media`，运行时的 `Video` 控件）：
+  在 Mac 上的 `card-host` 中，示例剪辑在其框中播放、暂停和停止，放映中可自动开始或点按开始；
+  在 Linux 上用真实引擎时，`deck.media` 把每个剪辑写入存储，而每个剪辑都显示
+  "Playback isn't available on this system"（那里没有 MP4 解码器）；在 macOS 上使用真实引擎的 Shell 中，剪辑在编辑器和放映中都能播放。
 - **Writer**（2026-10-09）。在用本仓库构建的隐藏桌面 Shell 中（`MAKEPAD_WM_TEST_APP=writer`，
   隐藏窗口的 `--remote` 运行，浅色与深色），使用在 Writer 自己存储中工作的真实 `word` 引擎：
   通过 instrument 输入的文档被保存为 Word 文档（`word.convert` 转换 Writer 写到 `work/` 的