A launch that opens in brand, and a sheet that stops resizing

── The splash, in three beats ──

Crimson edge to edge with the truck running across it in white; the invert;
then the mark.

The red starts before Flutter does. Four surfaces painted white before any
Dart runs — launch_background at both API levels, windowSplashScreenBackground
on Android 12+ in light and dark, and the iOS launch storyboard — and leaving
any one of them white makes the launch a white flash followed by a red one.
That flash is the only part of a launch a customer consciously notices.

The invert is one gesture rather than a fade. A white truck on a background
turning white is an invisible truck, so the ground lightens as the truck
darkens, off one controller, and the screen turns itself inside out with the
truck still on it. Fading it would have left the screen empty for the moment
before the mark.

The truck's colour is no longer its own: it is painted through srcIn, so the
file's palette is discarded and only alpha survives. A replacement Lottie now
needs no preparation, and tool/lottie_brand.py is off this path.

`splash.json` is a seamless 3.9s loop — frame 0 is frame 60, the truck never
arrives or departs — so there is no completion to hand over on. _truckBeat is
a decision about how long a launch may hold somebody, not a property of the
file. The comment claiming six seconds was wrong on both counts.

── Three things the splash was getting wrong quietly ──

It showed the wrong logo: doormile-icon.png, the previous mark, to a customer
who had just tapped the new one. tool/icons.py now cuts doormile-mark.png from
the same master alpha as the launcher icon, so they cannot drift again.

The fallback loader was invisible on red. _RoadLoader painted in DmColors.brand
on what used to be a white screen; on crimson that is crimson on crimson, and
it drew nothing at all on exactly the devices that had fallen back to it.

The mark appeared and left in the same frame — _minimum was the sum of the
beats exactly, so the clock ran out as the entrance finished. Hence _markHold.

── The truck was not in the middle ──

Not a layout bug: both beats sit in a Center and always did. The artwork is
drawn low and to the right inside its own 500x500 composition, so a centred
widget rendered an off-centre picture — 30pt right, 36pt down.

splash_centring_test.dart renders a frame at phone size and density, finds the
ink and fails if either beat drifts. It is the only form of test that could
have caught this, and the one that will catch it again when the Lottie is
replaced, which is when the correction goes stale. Two things it taught:
one enormous pump does not let the splash's async start-up chain advance, and
capturing at pixelRatio 1 rasterizes the speed lines too faintly to detect,
which truncates the bounding box and moves the measured centre by 12pt.

── The destination sheet stops resizing ──

Tapping ONE TOUCH opened a tall sheet that snapped shorter a few frames later.
DmAsyncList renders four skeleton rows while it loads — 302pt — and the states
that replace them are nearer 200; the sheet was Flexible, so it was as tall as
whichever state its content happened to be in, and the modal is still
animating up while that swap happens.

The list now lives in a box of one height. That also removes a second resize:
the sheet grew from 48% of the screen to 74% when a state was picked. Both
steps now measure 64% and it never changes size again.

And DmAsyncList takes initialItems, fed by AppState.cachedCities: FutureBuilder
reports `waiting` on its first build even for an already-complete future, so a
warm cache still flashed a skeleton over data it already had.

Three skeleton rows here rather than four — sheet_stability_test caught that
302pt overflows the smallest box the clamp can produce.

test/design_snapshot_test.dart

@@ -6,6 +6,7 @@ import 'package:doormile_cx/data/doormile_api.dart';
 import 'package:doormile_cx/data/location_service.dart';
 import 'package:doormile_cx/main.dart';
 import 'package:doormile_cx/state/app_state.dart';
+import 'package:doormile_cx/ui/tokens.dart';
 import 'package:flutter/material.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
 import 'package:flutter/services.dart';
@@ -56,6 +57,20 @@ Future<void> _settle(WidgetTester tester, [int ms = 800]) async {
   }
 }
 
+/// Pumps until the splash's ground has left [DmColors.splash].
+///
+/// Returns on the first frame of the invert, so a caller can step into the
+/// middle of it by a known amount. Gives up after six seconds rather than
+/// spinning forever if the splash never starts.
+Future<void> _pumpToInvert(WidgetTester tester) async {
+  for (var i = 0; i < 120; i++) {
+    final scaffold = tester.widget<Scaffold>(find.byType(Scaffold).first);
+    if (scaffold.backgroundColor != DmColors.splash) return;
+    await tester.pump(const Duration(milliseconds: 50));
+  }
+  fail('the splash never left crimson');
+}
+
 Future<void> _shot(WidgetTester tester, String name) async {
   await expectLater(
     find.byType(MaterialApp),
@@ -95,7 +110,7 @@ void main() {
     // blank gaps in every picture of the entrance.
     await tester.runAsync(() async {
       for (final asset in const [
-        'assets/images/doormile-icon.png',
+        'assets/images/doormile-mark.png',
         'assets/images/doormile-logo.png',
       ]) {
         await precacheImage(
@@ -105,20 +120,34 @@ void main() {
       }
     });
 
-    // Both beats, with raw pumps: `_settle` always runs four extra 400ms
+    // All three beats, with raw pumps: `_settle` always runs four extra 400ms
     // frames at the end, which is 2.5s — past the moment the splash hands
-    // over, so it would photograph the login screen instead of either one.
+    // over, so it would photograph the login screen instead of any of them.
     // The clock does not start until the engine says it has rasterized a
     // frame and the composition has parsed, which under the test binding is
-    // about 1.2s. Both shots are taken relative to that, not to pumpWidget.
+    // about 1.2s. Every shot is taken relative to that, not to pumpWidget.
     await tester.pump();
     await tester.pump(const Duration(milliseconds: 2000));
-    await _shot(tester, '00-splash-animation');
+    await _shot(tester, '00-splash-truck');
 
-    // Past the handover, plus a frame for the switch to settle.
-    await tester.pump(const Duration(milliseconds: 1200));
-    await tester.pump(const Duration(milliseconds: 400));
-    await _shot(tester, '00b-splash-mark');
+    // ── The next two are found, not counted to ──
+    //
+    // The splash's clock does not start at `pumpWidget`: it waits for the
+    // composition to parse and for the engine to report a rasterized frame,
+    // and how long that takes depends on what else is in the tree. Two
+    // attempts at counting milliseconds from here photographed the invert
+    // 25ms in, and then the login screen. So this watches for the beat
+    // instead — the ground leaving crimson is unambiguous and needs no
+    // estimate of anything.
+    await _pumpToInvert(tester);
+    await tester.pump(const Duration(milliseconds: 160));
+    await _shot(tester, '00b-splash-invert');
+
+    // Past the invert, and far enough into the mark's entrance to photograph
+    // the mark rather than its fade. `_markHold` is what leaves room for this.
+    await tester.pump(const Duration(milliseconds: 320));
+    await tester.pump(const Duration(milliseconds: 620));
+    await _shot(tester, '00c-splash-mark');
 
     // The splash holds for its own minimum — and the waits in front of it — before handing over.
     await _settle(tester, 4400);