[jwhiting]

Connect the Mac app with one link containing the server address and, when required, its access token. The setup screen supplies a prompt for the person's agent and a link field. A successful connection is saved for later launches; Television › Disconnect from Server (⌘,) forgets it and returns to setup, including from the upgrade gate.

• tv links checks the running server's authentication requirements and prints its connect links. CLI startup and tv links use terminal hyperlinks for interactive output and plain URLs for pipes.
• Connection dialogs distinguish an unreachable server from a rejected token or required desktop upgrade. A dropped connection keeps the interface and live artifact documents mounted, escalates after three failed reconnect attempts, and recovers automatically. Authorization failures stop retries; a displayed upgrade gate stays until reload.
• The desktop main process owns connection checks, persistence, cancellation, retries and navigation. The packaged page paints Connected before navigation; only that page can call the connection IPC. A failed remote page load returns to saved-connection recovery.
• Setup and local dialogs share the production controls and modal presentation, with bundled Clouds, fonts, icons and their notices. The dialog drag strip sits inside the native dialog so it remains usable during modality. The served app composes the upgrade gate, keeping its markdown dependencies out of the local renderer. Large controls also reach canonical v2; frozen v1 stays unchanged.
• The administrator guide teaches connect links and tv links and gives Mac or browser instructions appropriate to the person's computer. PR-authoring guidance defines the reader, useful validation evidence and where working records belong.

Server APIs, WebSocket messages, served-page parameters, the remote native bridge and connection.json retain their contracts. The required desktop version remains 1.3.1, and the recommendation remains 1.4.0. Older desktop apps can still reconnect, though the served page's recovery instruction names Disconnect from Server while those apps retain Connect to server….

Validation. npm run verify -- blaxel passed at 6cd71e7c, covering static checks and the CLI, browser and real-Electron suites. The daemon-acceptance suite also passed real installation, refresh, boot, stop and uninstall. Subsequent commits change only documentation and developer guidance. The theme-reset test exercises the built application with its existing assertions, timeouts and retry settings; PR #12 addresses Chromium response buffers exhausting RAM-backed /tmp during repeated reloads of unbundled pages on Blaxel.

Signed desktop product checks. The candidate build is 261001hquaj28w0, version 1.4.15, built from 6cd71e7 without a version override. It remains unreleased: Apple Silicon DMG, Mac zip. The current application code matches that build.

Josh ran the following checks on his Mac against servers running the PR code:

Check	Steps and observed result
Mac install — PASS	Installed and opened the candidate without a Gatekeeper warning. Dock and application menu showed Television; About showed 1.4.15. The earlier saved connection opened successfully.
Connect screen — PASS	Copy reached the real system clipboard; window dragging worked. A rejected token and an unreachable address produced validation errors. A valid connect link connected successfully.
Bridge and IPC — PASS	Disconnect from Server worked through the menu and ⌘,, and was disabled on setup. Launching with the server down showed the local error page and recovered when the server returned. Dropping an established connection showed Disconnected, then Can't connect with server, and recovered automatically. Token rejection showed Access token required on both the served and local pages; the local Disconnect button worked, and a new link restored the connection.
Updates — PASS for notice and restart	ToDesktop's simulated update-available scenario showed the desktop update notice. Restart to update quit and reopened the app.
Upgrade gate — PASS	Launched the same 1.4.15 candidate with --runtime-simulate-updates=update-available and connected to a server run from source at 8e7cd67b with TV_TEST_VERSION=1.4.15 and TV_TEST_REQUIRED_DESKTOP_VERSION=2.0.0. The gate appeared initially without Restart to update, then showed it once the simulated update was ready. The top strip dragged the window while gated. Television › Disconnect from Server returned to the connect screen.

An agent checked the same build's Mac zip: Electron license files and bundled notices PASS. The agent extracted and read Contents/Resources/LICENSE.electron.txt and Contents/Resources/LICENSES.chromium.html, confirming Electron's MIT license and Chromium's credits are present and readable. Inside Contents/Resources/app.asar, dist/THIRD-PARTY-NOTICES.txt and dist/clouds/THIRD-PARTY-NOTICES.txt matched the corresponding build outputs byte for byte. The desktop notices include Phosphor Icons, Hind's font license, and the Clouds photo and palette terms; the Clouds folder carries its own photo and palette terms. The app's plist and packaged manifest report 1.4.15.

Not checked on the signed build: appearance switching and Reduce Motion.

A server whose connection check succeeds but whose page repeatedly fails to load can cycle through saved-connection recovery without backoff; Disconnect from Server remains available. Local appearance follows the Mac at launch and retains the server's native appearance input during that run; persistence across launches is tracked in TV-912.