@maccesar/titools 5.1.0 → 5.2.0

package/skills/ti-admob-unified/references/module-changelog.md

@@ -0,0 +1,54 @@
+> Source snapshot: official ti.admob.unified 1.0.0 documentation at commit `5b4cbf9` (copied 2026-10-11). Relative links rebased for this skill.
+
+# Changelog
+
+## [1.0.0] — Unreleased
+
+### Audit corrections
+
+- Normalize iOS load errors to the shared constants and return actual Booleans through the bridge.
+- Implement percentage-based application volume on iOS and validate the same range on Android.
+- Hide accidental iOS state/helper exports while preserving native delegates and lifecycle callbacks.
+- Expose fullscreen configuration properties on Android and retain primitive extras; defer banner reconfiguration to its next load.
+- Allow consent retries after failures, refresh cached results after privacy options, and serialize reset with outstanding UMP work.
+- Read Android's standard IAB preferences and restrict mediation availability to installed adapters.
+- Capture the presented rewarded ad's reward independently of dismissal/reload; serialize fullscreen SDK operations on the UI thread.
+- Remove targeting values and test-device IDs from module-owned debug messages.
+- Fix library callback reentrancy, share concurrent privacy/Inspector operations, and wait for iOS adaptive layout.
+- Keep banner-button feedback in the button with light-green styling; reuse the current banner on reload without collapsing its slot.
+- Keep ads and listeners through an Android light/dark switch: the example and the cleanup guide ignore the `close` event Titanium fires while it recreates the activity.
+- Check fullscreen request dimensions at Show in the library and playground; reload only the selected stale ad, without rotation listeners or timers.
+- Accept iOS UMP UUID test identifiers and support per-platform consent test defaults in the example application's properties.
+
+
+First public release. Earlier development snapshots were not published releases.
+
+### Dependency refresh
+
+- Update Google Mobile Ads to iOS 13.10.0 and Android 25.5.0; UMP remains at iOS 3.1.0 and Android 4.0.0.
+- Update all five adapters to the September 23, 2026 published versions listed in [Dependencies](dependencies.md).
+- Remove IronSourceAdQualitySDK from Unity: Unity Ads 4.20.1 no longer depends on it.
+- Pin Guava 33.7.1-android in the core and OkHttp 4.12.0 in InMobi/Liftoff to replace the Guava, OkHttp and Okio versions flagged in the security review.
+- Retain the version contract test: Meta now matches across platforms; Liftoff retains the documented SDK difference.
+
+### Unified core
+
+- One iOS/Android JavaScript API for standard/adaptive banners, interstitials, rewarded ads and app open ads.
+- Consent-first UMP flow, portable ATT completion and Ad Inspector support.
+- Idempotent initialization, serialized loads and deterministic cleanup.
+- Google Mobile Ads and UMP only; no third-party network adapters in the core.
+- The examples use only the core without a mediation flag. Google Mobile Ads automatically discovers adapters supplied by selected complements; `disableMediation: true` remains an explicit session exception.
+
+### Optional mediation
+
+- Five independent dependency modules: `ti.admob.unified.mediation.applovin`, `.meta`, `.inmobi`, `.unity` and `.liftoff`, each on Android and iOS at `1.0.0`.
+- Each Android complement declares only its adapter Maven coordinate. Each iOS complement vendors only its own adapter, SDK and required resources/dependencies.
+- Unity includes UnityAdapter, UnityAds and UnityCoherenceLib. Its updated SDK no longer requires IronSourceAdQualitySDK.
+- ironSource mediation is deferred; IronSourceAdapter and IronSource are not distributed.
+- SDKs and adapters were updated to the published September 23, 2026 versions; framework checksums were regenerated. See [Dependencies](dependencies.md).
+- `getMediationStatus()` returns generic Google initialization diagnostics; pre-release provider probes and no-op consent setters were removed. `disableMediation` remains a global startup control.
+- Release artifacts are discovered from complement folders and manifests; packaged dependencies are checked against literal Gradle declarations without a provider list. Nothing is published or tagged by the build scripts.
+
+### Validation
+
+Packaging/linking and Google test-ad loading are separate from third-party ad delivery. Provider delivery requires configured accounts, mappings and Ad Inspector evidence; it is not established by a successful build or a Google test ad. See [release validation](mediation.md#release-validation).

package/skills/ti-admob-unified/references/module-license.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 César Estrada
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/skills/ti-admob-unified/references/privacy.md

@@ -0,0 +1,254 @@
+> Source snapshot: official ti.admob.unified 1.0.0 documentation at commit `5b4cbf9` (copied 2026-10-11). Relative links rebased for this skill.
+
+# Privacy and initialization
+
+`ti.admob.unified` exposes Google UMP as an event-based workflow. Callback properties are not part of the contract.
+
+## Required order
+
+Use this order on every app launch:
+
+1. Register module listeners.
+2. Call `requestConsent({ ... })`.
+3. Wait for the terminal `consent_complete` event.
+4. Check `event.canRequestAds` or `canRequestAds()`.
+5. Call `initialize({ ... })` once.
+6. Create and load ads only after initialization succeeds.
+
+App Tracking Transparency is optional and separate from UMP. `canRequestAds()` remains the only ad-request gate. If the application uses tracking, resolve ATT before `initialize()`; otherwise skip it. See [Optional: if the application requests ATT](getting-started.md#optional-if-the-application-requests-att).
+
+Check UMP even when the consent operation reports an error. Consent from a previous session may still allow requests; `canRequestAds` determines whether the application can continue.
+
+Google's UMP guidance also requires a consent-information update every app session and warns against deriving status from cached consent strings. See [UMP for Android](https://developers.google.com/admob/android/privacy) and [UMP for iOS](https://developers.google.com/admob/ios/privacy).
+
+## `requestConsent(config)`
+
+Starts the UMP consent-information update and immediately loads/presents a form if one is required.
+
+| Property                  | Type     | Default        | Description                                                            |
+| ------------------------- | -------- | -------------- | ---------------------------------------------------------------------- |
+| `geography`               | Number   | Native default | A `DEBUG_GEOGRAPHY_*` constant. Development only.                      |
+| `testDeviceIds`           | String[] | `[]`           | UMP hashed test-device identifiers. Used when `geography` is supplied. |
+| `tagForUnderAgeOfConsent` | Boolean  | `false`        | Marks the consent request as under age of consent.                     |
+
+Use `{}` when no options are needed:
+
+```js
+Admob.requestConsent({})
+```
+
+The operation is idempotent:
+
+- Concurrent calls share the active native operation.
+- The first accepted call supplies the configuration.
+- A later call after completion re-emits the cached `consent_complete` result.
+- `resetConsent()` clears UMP test state and the module's cached consent operation so a new request can run.
+
+Do not put `resetConsent()` in a production launch path.
+
+## `consent_complete`
+
+Every accepted consent operation reaches this terminal event:
+
+```js
+{
+  success: true,
+  canRequestAds: true,
+  privacyOptionsRequired: false
+}
+```
+
+On failure:
+
+```js
+{
+  success: false,
+  canRequestAds: false,
+  privacyOptionsRequired: false,
+  error: 'Native UMP error message',
+  code: 1
+}
+```
+
+The exact native `code` is platform and SDK dependent. Do not make business logic depend on a particular code.
+
+The payload temporarily retains these deprecated keys:
+
+- `canShowAds`
+- `canShowPersonalizedAds`
+- `isGDPR`
+- `isPrivacyOptionsRequired`
+
+New code must use `canRequestAds` and `privacyOptionsRequired`.
+
+The legacy `consent_ready` and `consent_error` events are emitted before the modern terminal event for compatibility. Do not subscribe to all three for the same workflow or initialization may be attempted more than once.
+
+## `canRequestAds()`
+
+Returns UMP's current permission to request ads.
+
+```js
+if (Admob.canRequestAds()) {
+  // An ad request may be made.
+}
+```
+
+This is the only supported request gate.
+
+- `canShowAds()` is a deprecated alias.
+- `canShowPersonalizedAds()` is deprecated and always returns `false`.
+- `isGDPR()` is a legacy diagnostic and must not gate ads.
+- Do not parse `IABTCF_*` storage.
+- Do not derive or inject an `npa` request flag from these legacy methods.
+
+Google Mobile Ads applies the privacy signals collected by UMP.
+
+## `initialize(config)`
+
+Configures the global Google Mobile Ads request settings and initializes the SDK.
+
+| Property                       | Type     | Description                                                                                                          |
+| ------------------------------ | -------- | -------------------------------------------------------------------------------------------------------------------- |
+| `testDeviceIds`                | String[] | Google Mobile Ads test-device identifiers.                                                                           |
+| `ageRestrictedTreatment`       | String   | One `AGE_RESTRICTED_TREATMENT_*` constant.                                                                           |
+| `maxAdContentRating`           | String   | One `MAX_AD_CONTENT_RATING_*` constant.                                                                              |
+| `tagForChildDirectedTreatment` | Boolean  | Deprecated compatibility input; maps to child/unspecified.                                                           |
+| `tagForUnderAgeOfConsent`      | Boolean  | Deprecated initialization input; maps to child/unspecified. This is distinct from the UMP option with the same name. |
+
+`applicationId` and `debugGeography` are not initialization properties.
+
+Initialization is idempotent:
+
+- Concurrent calls share one native operation.
+- The first accepted configuration wins.
+- A call after completion re-emits the cached `module_initialized` result.
+- An Android failure caused by a missing current activity can be retried.
+
+### `module_initialized`
+
+Success:
+
+```js
+{
+  success: true,
+  status: 'Native initialization status description'
+}
+```
+
+Android can report a missing-activity failure:
+
+```js
+{
+  success: false,
+  error: 'No current activity',
+  code: -1
+}
+```
+
+Use `status` for diagnostics. Its text is not a stable machine-readable value.
+
+## App Tracking Transparency
+
+`requestTrackingAuthorization()` is available on both platforms and emits:
+
+```js
+{
+  status: 3,
+  authorized: true,
+  applicable: true
+}
+```
+
+On iOS, the numeric status follows Apple's `ATTrackingManagerAuthorizationStatus`:
+
+| Value | Meaning        |
+| ----: | -------------- |
+|   `0` | Not determined |
+|   `1` | Restricted     |
+|   `2` | Denied         |
+|   `3` | Authorized     |
+
+On Android, ATT does not apply. The method completes synchronously with `status: 3`, `authorized: true`, and `applicable: false`, allowing the same listener and call site on both platforms.
+
+Always wait for `tracking_authorization_completed`, even if the user resolved ATT in an earlier session. Denial changes tracking availability and does not imply `canRequestAds() === false`; UMP still determines permission to request ads.
+
+ATT is optional. An application that calls `requestTrackingAuthorization()` must ship `NSUserTrackingUsageDescription` in its plist, because Apple's prompt cannot be presented without one. An application that never calls it should omit the key: Apple reviews the prompt against actual behavior, and UMP works without it. See [Getting started](getting-started.md#ios).
+
+## Privacy options
+
+After consent completes, use either the event payload or `isPrivacyOptionsRequired()` to decide whether the app should show a visible, interactive privacy entry point:
+
+```js
+privacyButton.visible = Admob.isPrivacyOptionsRequired()
+privacyButton.touchEnabled = privacyButton.visible
+```
+
+When the user taps it:
+
+```js
+const onPrivacyDismissed = event => {
+  if (!event.success) {
+    Ti.API.warn(`Privacy options failed: ${event.error}`)
+  }
+
+  privacyButton.visible = event.privacyOptionsRequired
+  privacyButton.touchEnabled = privacyButton.visible
+}
+
+Admob.addEventListener('privacy_options_dismissed', onPrivacyDismissed)
+
+privacyButton.addEventListener('click', () => {
+  Admob.presentPrivacyOptions({})
+})
+```
+
+The event payload is:
+
+```js
+{
+  success: true,
+  canRequestAds: true,
+  privacyOptionsRequired: true
+}
+```
+
+Failures add `error` and `code`. Remove the module listener when its owning service is disposed.
+
+## Testing UMP
+
+Use debug geography only with registered UMP test devices:
+
+```js
+Admob.requestConsent({
+  geography: Admob.DEBUG_GEOGRAPHY_EEA,
+  testDeviceIds: ['HASHED_UMP_TEST_DEVICE_ID'],
+  tagForUnderAgeOfConsent: false
+})
+```
+
+Available debug constants:
+
+- `DEBUG_GEOGRAPHY_DISABLED`
+- `DEBUG_GEOGRAPHY_EEA`
+- `DEBUG_GEOGRAPHY_REGULATED_US_STATE`
+- `DEBUG_GEOGRAPHY_OTHER`
+
+Do not store the numeric values; use the names because the native enum values are platform-owned.
+
+`resetConsent()` exists for controlled testing. It does not remove the need to request consent information again, and it must not be exposed as a general "revoke consent" implementation. Use `presentPrivacyOptions()` for the publisher-rendered privacy entry point.
+
+
+## Interactive consent demo
+
+The published `example/app.js` includes **Consent demo** controls in development/test builds on Android and iOS. First launch uses the normal region. Production builds hide these controls and ignore saved debug settings.
+
+1. In the visible **Test device** field, use the physical device's UMP identifier from the SDK log, including any hyphens on iOS; the app remembers it. To prefill a development build, set the string application property `demo.consentDeviceIds.ios` or `demo.consentDeviceIds.android` in the consumer's `tiapp.xml`. A saved nonempty field takes precedence. iOS simulators need no identifier. Enter only finishes typing.
+2. Tap the scenario selector, choose **Europe — consent form**, **US — privacy options**, **Other region — no form**, or **My actual region**, then tap **Run test**. Selecting a scenario alone does not reset consent. Running it clears the previous UMP choice and replaces existing ads.
+3. The single result below the button reports progress and completion. Europe requests consent; US opens privacy options when available; Other and the actual region can finish without a dialog. Which form is available depends on the AdMob message configuration. The banner slot keeps its height while ads reload.
+4. Use **Advertising privacy options** to revise a choice without resetting. Relaunching preserves the chosen mode, hashes and consent. Run **My actual region** to remove the region override.
+
+Demo ad unit IDs do not register physical devices for UMP debugging. If the SDK log redacts the hash, use an iOS simulator; an unregistered physical device may ignore forced geography.
+
+These test buttons reset UMP consent only. They cannot reset Apple's ATT permission. Do not copy these testing controls or debug geography into a production consent flow. Unknown/error states are displayed separately from a successful result that does not require privacy options.
+
+Google reference: [Testing UMP on iOS](https://developers.google.com/admob/ios/privacy#testing) and [Testing UMP on Android](https://developers.google.com/admob/android/privacy#testing).

package/skills/ti-admob-unified/references/roadmap.md

@@ -0,0 +1,146 @@
+> Source snapshot: official ti.admob.unified 1.0.0 documentation at commit `5b4cbf9` (copied 2026-10-11). Relative links rebased for this skill.
+
+# ti.admob.unified roadmap
+
+## Current baseline
+
+Version `1.0.0` establishes one portable AdMob distribution with five optional mediation complements:
+
+- Titanium `13.2.0.GA`
+- iOS `15.0+`
+- Google Mobile Ads iOS `13.10.0`
+- User Messaging Platform iOS `3.1.0`
+- Android API `24+`, the floor the Titanium module template sets
+- Google Mobile Ads Android `25.5.0`
+- User Messaging Platform Android `4.0.0`
+- five optional per-network modules on iOS and Android; ironSource mediation deferred
+- idempotent initialization and consent
+- terminal `consent_complete` events
+- one standard/adaptive banner lifecycle on both platforms
+- one interstitial/rewarded/app open lifecycle and event contract on both platforms
+- portable tracking-authorization completion on both platforms
+- no manual TCF personalization inference
+
+## Implemented for 1.0.0
+
+### Privacy contract
+
+- `canRequestAds()` is the only supported ad-request gate.
+- UMP updates and form presentation use the current native flow.
+- `initialize()` and `requestConsent()` serialize concurrent calls.
+- Every accepted consent operation reaches `consent_complete`.
+- Privacy-options dismissal always emits a terminal event.
+- `requestTrackingAuthorization()` is portable after UMP: iOS resolves ATT and Android completes immediately with `applicable: false`.
+- Legacy privacy aliases remain documented but are not used by new examples.
+
+### Banner contract
+
+- Standard and adaptive banners expose `load()`, `pause()`, `resume()`, `destroy()`, `isLoaded()`, and both historical destruction aliases.
+- Common event names and payload keys are aligned.
+- Adaptive `loaded` reports the real height in density-independent units.
+- `destroy()` is terminal, repeatable, and emits `destroyed` once.
+- Native delegates, listeners, controllers, views, and activity lifecycle registrations are released.
+- Each proxy accepts one active load and at most one deferred load while paused.
+- Application and host-lifecycle pauses are independent causes; neither resumes the other's pause.
+- Inline adaptive banners, `maxHeight`, `customAdSize`, `contentUrl`, and `requestAgent` work on both platforms.
+- `smart_banner` resolves to `BANNER` on both platforms, with no special case on either.
+
+### Fullscreen contract
+
+- Interstitial, rewarded, and app open proxies expose the same `load()`, `show()`, `isLoaded()`, and terminal `destroy()` lifecycle.
+- Duplicate loads are serialized and native fullscreen references are single-use.
+- Common events include `adUnitId` and `adType`; failures add `error`, `message`, and `code`.
+- Both platforms emit `opened`, `showed_fullscreen_content`, and `destroyed`.
+- Native callbacks/delegates are detached during explicit destruction and Titanium proxy release.
+- App open checks Google's four-hour validity window on demand, without a timer.
+
+### Distribution
+
+- The `ti.admob.unified` artifacts contain Google Mobile Ads and UMP alone: ~14 MB on iOS, ~325 KB on Android, and no network SDK in the consuming application's POM.
+- Five dependency modules under `mediation/<network>/` distribute eleven iOS frameworks and five Android adapter coordinates. Unity includes Coherence; neither AdQuality nor ironSource advertising is included.
+- Dependency versions and iOS checksums are reproducible.
+- Static contract tests cover privacy, lifecycle, payload, cleanup, artifacts, and documentation.
+
+## Release readiness
+
+The September 2026 audit distinguishes module behavior, consumer integration and provider delivery. A successful build or Google test banner proves neither third-party delivery nor all privacy scenarios.
+
+The correction pass now has executable coverage for library cleanup and reentrant retries, consent reset ordering, percentage volume validation and delayed reward callbacks. Both native bridges returned the expected Boolean types and loaded all five implemented formats. Repeated banner taps preserved the scroll position in the Android emulator. Three physical-iPad launches loaded the adaptive banner at 810 × 150 and all three fullscreen formats; the earlier startup sizing failure did not recur, but its cause has not been isolated.
+
+Remaining acceptance work:
+
+- record fullscreen dismissal and actual reward delivery separately from load and presentation;
+- cover consent acceptance/rejection, privacy reopening, ATT states and orientation/lifecycle changes on the available devices;
+- retain the intermittent iOS Rewarded timeout and its UIKit reproduction until a reproducible SDK/runtime resolution is established;
+- verify provider-side consent propagation and review the updated transitive dependency results in [Dependencies](dependencies.md#transitive-security-review);
+- validate intended mediation providers with configured accounts, mappings and Ad Inspector. Core-only applications need no provider accounts.
+
+The declared minimum OS versions and complete physical-device interaction matrix remain unverified. Simulator and emulator evidence is recorded separately. No additional device purchase is required to continue independent checks.
+
+## Next contract work
+
+These improvements can be developed without changing the established banner and privacy APIs:
+
+- keep the shared percentage-based `setAppVolume()` behavior covered on both platforms;
+- remove deprecated privacy and destruction aliases in a future major release.
+
+## Declared parity debt
+
+Both platforms must expose an identical JavaScript surface. An audit against the native sources on 5 August 2026 found the divergences below. That pass recorded them as closed based largely on static tests. The September audit reopened cases involving bridge types and accidental exports. The table below is historical context; release acceptance requires runtime verification of the current binaries.
+
+| Divergence closed                                                                                                                                                               | How                                                                                                                                     |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
+| `requestAgent` was dropped by the three iOS fullscreen proxies. Their manual configuration from the creation dictionary bypasses `_initWithProperties:` and never read the key. | `configureWithDict:` reads it in all three, mirroring Android.                                                                          |
+| `extras` was a live property on iOS and creation-only on Android: assigning it after creating a banner did nothing, and reading it back returned `undefined`.                   | Both Android banner proxies gained the property. It takes effect on the next `load()`, the same as `requestAgent`.                      |
+| The adaptive `loaded` payload carried seven size keys on Android and two on iOS.                                                                                                | iOS reports the same seven. `density` comes from `UIScreen.scale`, which yields only 1, 2 or 3 where Android reports fractional values. |
+| Fullscreen proxies exposed their internal state as readable properties on iOS and none on Android, including the native handle (`GADInterstitialAd`).                           | Plain ivars with `accessInstanceVariablesDirectly` disabled, so Kroll's key lookup finds nothing.                                       |
+| `collapsible` was Android-only.                                                                                                                                                 | Implemented on iOS through `GADExtras`, the same key and values Android puts in its Bundle.                                             |
+| iOS filtered banner events by whether a listener was registered; Android emitted them unconditionally.                                                                          | The guard is gone. Banner proxies descend from `TiViewProxy`, so the events reach a listener on the container.                          |
+| `DEBUG_GEOGRAPHY_OTHER` returned the deprecated `UMPDebugGeographyNotEEA` (2) on iOS while Android sent 4, and `DEBUG_GEOGRAPHY_REGULATED_US_STATE` was the literal `@(3)`.     | Both return the SDK enum, which matches Android's values.                                                                               |
+| iOS substituted `"coins"` and `1` when the SDK granted a reward with no values, so an application could credit a reward Android never granted.                                  | The payload carries what the SDK reported, or `null`.                                                                                   |
+| iOS `resume()` never restored `autoloadEnabled` after `pause()` turned it off, so one trip to the background left the banner opted out for the rest of the session.             | `pause()` remembers the value and `resume()` restores it, once every pause cause is clear.                                              |
+| Adaptive events fired by the Android proxy itself omitted `adaptiveType`, which the view included.                                                                              | Every adaptive event carries it.                                                                                                        |
+
+## Differences that stay
+
+The following differences are classified as SDK limitations and are documented where relevant. They are not scheduled for correction:
+
+| Difference                                         | Why it stays                                                                                                                                                                       |
+| -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `module_initialized` has no error branch           | Neither SDK reports one. `GADInitializationStatus` carries no error, and Android's callback has no failure path either; its only `success: false` is a missing-Activity pre-check. |
+| `applicable` in `tracking_authorization_completed` | App Tracking Transparency does not exist on Android.                                                                                                                               |
+| The values of the `TEST_*` constants               | They are Google's own demo unit IDs, deliberately different per platform.                                                                                                          |
+| `isTestDevice()`                                   | iOS answers "are any test devices registered?", Android "is this device one?". The iOS SDK does not offer the second.                                                              |
+| The text of error messages                         | Load errors use shared constants; presentation/UMP/Inspector codes retain their native domains. The text describes the platform failure ("no view controller" against "no activity").                                                      |
+
+## Deferred formats
+
+- Rewarded interstitial
+- Native
+
+Their constants are already exported, but they do not have working cross-platform factories. Implementing one requires a complete native proxy, shared events and payloads, cleanup semantics, tests, examples, and physical validation.
+
+These formats remain to be implemented to match the modules this one replaces. As of 4 August 2026: `ti.android.admob` `11.1.0` ships proxies for app open, rewarded interstitial and native, and `ti.admob` `8.1.0` on iOS documents an `AD_TYPE_APP_OPEN`. App open ships here on both platforms, which leaves rewarded interstitial and native.
+
+Decided on 4 August 2026:
+
+- Rewarded interstitial is planned next. App open came first because it was the only format present in both replaced modules.
+- Native remains deferred because none of the applications in progress has a content list that needs ads styled as list items. The decision reflects current use cases, rather than implementation difficulty. A future app with a content feed would justify reconsidering it.
+
+Each new format must meet the existing contract: a complete native proxy on both platforms, shared events and payloads, terminal cleanup, contract tests, an example, and physical validation.
+
+## Mediation maintenance
+
+The five complements live in `mediation/<network>/` and target the same first release, `1.0.0`, as the core.
+
+- Keep the five shared adapter/network SDK pairs current on both platforms.
+- Keep every adapter out of the core module. A contract test fails if `ios/module.xcconfig`, `android/build.gradle`, the core `pbxproj`, or the core checksum inventory names a network again.
+- Preserve one JavaScript ad contract and portable diagnostics.
+- Track privacy manifests, resource bundles, SKAdNetwork guidance, and store disclosure changes with every dependency update.
+- Require consumer builds, physical-device tests, and Ad Inspector evidence before release: record hardware evidence separately from simulator integration and Google test ads.
+- Evaluate additional networks only when they can be supported on both platforms without fragmenting the public API.
+
+## Longer-term platform work
+
+- Evaluate Android Google Mobile Ads Next-Gen only after its migration cost and Titanium compatibility are understood.
+- Revisit the minimum Titanium, iOS, and Android baselines as upstream SDK requirements change.

package/skills/ti-admob-unified/references/source-notes.md

@@ -0,0 +1,33 @@
+# Official sources and snapshot maintenance
+
+The native module is `ti.admob.unified`; this skill is `ti-admob-unified`. It works in ordinary Titanium apps as well as games and does not depend on `ti.game`, `ti.synthengine` or PurgeTSS.
+
+## Provenance
+
+Copied from César's module repository `macCesar/ti.admob.unified`, at clean commit `5b4cbf9347a51c4f959dc262ac1500f82f28b4a0` on 2026-10-11. The source checkout in this workspace is `/Users/cesar/Developer/openSource/TiAdmobUnified/ti.admob.unified`; use the installed package's documentation or the module's actual repository in other environments, not that machine-specific path as a dependency. The 1.0.0 first public release remains under preparation according to this session; re-check its release status when installing later.
+
+`source-snapshot.json` records original paths, source SHA-256, destination hashes and rebased Markdown links. Eleven official `documentation/*.md` guides are preserved, with dependency inventory, roadmap, contributing guide, upstream changelog and module license. Each Markdown file adds a source line and rewrites relative links (with any separately recorded broken-anchor correction) so they resolve inside the skill. Long API/banner references add generated TOCs. This provenance applies to the copied references, not to TiTools' curated `game-monetization.md` or this note.
+
+`assets/example/lib/ads.js`, `assets/example/library-usage.js` and `assets/example/app.js` are byte-identical official source files. They are application code resources, not scripts to run in Node for ad delivery. The library is intended to be copied unchanged into the consuming app; keep project policies in a separate director/controller. Review native integration on both target platforms.
+
+## Source priority and updates
+
+Use the installed native module/build and its official docs for actual APIs and parity. This snapshot is a reproducible source for the documented 1.0.0 contract, not a proof of native ad delivery. A newer local build can carry behavior ahead of a version label; reconcile documented methods with installed artifacts before changing integration.
+
+When updating the skill, inspect source changes and repository state, copy the official docs/example library, rebase all local links, regenerate only the affected TOCs, and update source and destination hashes. Keep the copy-ready library untouched. Run TiTools manifest, anchor, snapshot/link and example syntax tests; check packaging and installability. Validate integration and selected-provider delivery independently when a device/accounts are available. Do not silently refresh only version labels or hashes around unreviewed API changes.
+
+Provider accounts, mediation groups, credentials, placement mappings and network privacy settings live outside a successful compile. `getMediationStatus()` describes Google's adapter initialization map, not installation inventory or delivery. Use the official mediation guide, current linked Google/provider setup documents, and single-source Ad Inspector testing. A Google demo ad cannot validate AppLovin/Meta/InMobi/Unity/Liftoff demand.
+
+## TiTools audit convention
+
+The maintainer-only `titools-skill-auditor` source map registers this skill. Use its quality/coverage workflow for future updates, including reading every affected official source, reporting docs/native disagreements and preserving verified author additions. The title `## Community-Discovered Patterns` denotes protected content; do not remove it merely because official docs do not mention it. Update or move it when official docs gain equivalent coverage. Creation of this new skill follows the authorized skill-creator task rather than reopening an audit approval gate.
+
+Before an update run this maintainer tool from the TiTools repository:
+
+```bash
+node scripts/verify-module-snapshot.mjs --source /path/to/ti.admob.unified
+```
+
+It reports changed/missing sources, newly added official Markdown, modified shipped mirrors, source dirtiness and commit changes. It performs no fetch, pull, write or hash refresh. Compare the pinned commit to the candidate commit, review the report and relevant native/library changes, then perform only the authorized update. Native-module releases, provider SDK changes and official-doc corrections can all trigger a review.
+
+Snapshot link correction: the official API page still links to `#mediation-diagnostics-and-compatibility` after its heading became `Mediation diagnostics`. The mirrored link targets `#mediation-diagnostics`; `source-snapshot.json` records the exact transformation and tests reconstruct the original source hash. The module repository was not edited. Re-check this correction during the next refresh.