Description
Add Samsung Tizen smart TVs as first-class Hydra head devices. Test bench: 2 × 2025 Samsung Q7F QLEDs (QE43Q7FA, QE55Q7FA) on Tizen 8/9.
## Timing constraint
**DO NOT start implementation before 2026-05-26.** Major event 2026-05-22 → 2026-05-25; this plan touches hydracluster (new head type, new API handlers, store schema) and could destabilize the cluster mid-event.
## Approach (summary — full plan in `~/.claude/plans/shimmering-rolling-avalanche.md` on the planning workstation)
Native-from-the-start: fork community `brightcraft/moonlight-tizen` (GPL-3.0 WASM + AVPlay) into a new repo `cederikdotcom/hydraheadsamsungtv`. Layered as a Tizen `.wgt`:
- Hydra orchestrator (TypeScript): polls `/api/v1/heads/{id}`, drives pairing + stream via a JS bridge into the WASM module, sends status PUTs.
- moonlight-tizen WASM (forked, GPL-3.0): patches add `window.hydraMoonlight.pair/stream(...)` exports; default UI hidden.
- Pairing PIN to Sunshine is **proxied through the cluster** (new POST `/api/v1/heads/{id}/pair` and GET `/api/v1/heads/{id}/sunshine/clients`) to avoid shipping Sunshine creds to TVs and to bypass Tizen WebView TLS strictness against Sunshine's self-signed certs.
## License boundary
hydraheadflatscreen escapes GPL via subprocess (`exec.Command moonlight-qt`). On Tizen there is no subprocess model, so our orchestrator JS and forked WASM ship in one `.wgt` and the combined artifact must be GPL-3.0. Cluster-side Go changes stay unaffected (they communicate over HTTP, not linked code).
## Provisioning + auto-update
All ops via `hydracluster exec` on a **LAN-exec node** (can be local at venue OR centralized at hub reaching venue LAN over WireGuard). Only Tizen Developer Mode enablement requires physical operator at the TV (one-time per TV).
Fleet update: cluster `hydraheadsamsungtv-update` subcommand walks TV inventory, dispatches `sdb connect + tizen install` via the resolved LAN-exec node per venue. No new pusher binary; reuses existing exec channel.
## Cluster changes (the riskier work — why post-event)
- `hydracluster/pkg/store/store.go`: accept `"samsungtv"` type
- `hydracluster/pkg/api/handlers_head.go`: type passthrough, new pair-proxy handlers, `commands` field in head config response, LAN-exec-node selection per venue
- `hydracluster/cmd/...`: new `hydraheadsamsungtv-update` subcommand
- `landconfigregistry`: new `lan-exec` role with sdb + tizen-cli baked in
- `hydravenues`: venue records gain `lan_exec_node_id`
## Milestones
- M0 Sideload upstream brightcraft on QE55Q7FA, stream from venue Sunshine
- M1 Repo init + submodule + GPL LICENSE + CI builds unsigned .wgt
- M2 Orchestrator polling + status PUTs
- M3 Pairing automation via cluster proxy
- M4 Stream launch from cluster assignment
- M5 Hydranode-push provisioning
- M6 Cluster rolling deploy subcommand
- M7 Cluster `samsungtv` type accepted
- M8 Tizen 9 Game Mode mitigation tested
Full plan with verification per milestone, repo layout, file-paths-to-modify, and pitfalls (Tizen 9 Game Mode freeze, Samsung dev cert rotation, TV power-state) is in the local plan file.