chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

backend/app/routes/_common.py

@@ -1,4 +1,4 @@
-"""Route-layer shared helpers for the API contract (R6 S1a).
+"""Route-layer shared helpers for the API contract.
 
 Small, dependency-light guards that several route modules had hand-rolled with subtle
 drift. Keeping them here (imported by the route modules) means the "fetch a row or 404"
@@ -128,7 +128,7 @@ async def capped_stream_to(
 
 
 def issue_refused(exc: gitea.GiteaError) -> HTTPException:
-    """The refusal an issue-tracker failure (E16) answers as — the send, the preview and the
+    """The refusal an issue-tracker failure answers as — the send, the preview and the
     admin's connection test alike. Literal reasons, one per case: the frontend's contract test reads
     them to require a sentence for each in both languages."""
     match exc.reason:

backend/app/routes/admin.py

@@ -138,20 +138,21 @@ def _activate_user_by_email(db: Session, email: str) -> None:
     """Approving access activates a matching (e.g. pending password-registration) account so
     it can sign in. No-op if no such user exists yet (a Google user is created at first login).
 
-    E9.5 S1: this path deliberately does NOT revoke a preset password. Revoking here destroyed the
+    This path deliberately does NOT revoke a preset password. Revoking here destroyed the
     password a legitimate registrant had just chosen and made "your password was cleared for
     security" the DEFAULT experience, because approve-before-verify is the normal ordering.
 
-    S1 justified that by saying `password_login` refuses an unverified account BEFORE it looks at
-    `is_active`, so a pre-emptor could not sign in "approved or not". A review of the finished epic
-    showed that argument only holds while the address stays unverified — and S6's approval mail
-    hands the real owner a confirmation link precisely so they will end that state. Nothing replaced
-    the revoke, and that is deliberate: round 2 of the same review tried "the newest registration
-    owns an unverified account" and reverted it, because the rule is symmetric — an attacker can
-    always register last — and it handed anonymous callers a write onto a real account's credential.
-    The owner's recourse is password-reset, which proves the mailbox, rewrites the hash and bumps
-    the session epoch. The residual is logged as SEC-16. The revoke also stays on the Google-adoption path
-    (auth.revoke_preset_password_if_unverified), where ownership is actually attested."""
+    That was once justified by saying `password_login` refuses an unverified account BEFORE it
+    looks at `is_active`, so a pre-emptor could not sign in "approved or not". A review of the
+    finished epic showed that argument only holds while the address stays unverified — and the
+    approval mail hands the real owner a confirmation link precisely so they will end that state.
+    Nothing replaced the revoke, and that is deliberate: the same review later tried "the newest
+    registration owns an unverified account" and reverted it, because the rule is symmetric — an
+    attacker can always register last — and it handed anonymous callers a write onto a real
+    account's credential. The owner's recourse is password-reset, which proves the mailbox, rewrites
+    the hash and bumps the session epoch. The residual is logged as SEC-16. The revoke also stays on
+    the Google-adoption path (auth.revoke_preset_password_if_unverified), where ownership is
+    actually attested."""
     # Canonical, with the literal spelling preferred when both exist: approving
     # `npeter83.temu@gmail.com` must activate the account that registered as `npeter83temu@gmail.com`,
     # since Gmail delivers both to one mailbox and the admin decided about the mailbox.
@@ -402,7 +403,7 @@ def _serialize_user(u: User) -> dict:
         # deciding what kind of help someone needs.
         "password_revoked_at": iso(u.password_revoked_at),
         "has_google": u.google_sub is not None,
-        # Only when it DIFFERS from the account address (E9.5 S3): "connected" is not the same
+        # Only when it DIFFERS from the account address: "connected" is not the same
         # statement as "connected as someone else", and the second one is the one that explains a
         # confusing sign-in.
         "google_email": u.google_email if u.google_email != u.email else None,
@@ -551,7 +552,7 @@ def admin_delete_user(
     return {"deleted": user_id}
 
 
-# --- Stuck sign-ups: the admin lifeline (E9.5 S5, roadmap UX-25) ---------------------------------
+# --- Stuck sign-ups: the admin lifeline -----------------------------------------------------------
 
 
 def _pending_access_rows(db: Session) -> list[User]:
@@ -609,7 +610,7 @@ def user_access(
     _: User = Depends(admin_user),
     db: Session = Depends(get_db),
 ) -> dict:
-    """Everything the account panel shows about why this person can or cannot get in (E12 S5).
+    """Everything the account panel shows about why this person can or cannot get in.
 
     Its own endpoint rather than extra columns on /users: `is_allowed` and `can_activate` each run a
     query, and the panel opens for ONE user at a time — folding them into the list would pay that cost
@@ -628,7 +629,7 @@ def create_set_password_link(
     admin: User = Depends(admin_user),
     db: Session = Depends(get_db),
 ) -> dict:
-    """Mint a one-time link that lets this account set a password, with no email involved (E12 S5).
+    """Mint a one-time link that lets this account set a password, with no email involved.
 
     The answer to SEC-15, SEC-16 and "no SMTP and someone forgot their password" at once. The admin
     hands the link over by whatever channel they trust; opening it sets a password and signs out

backend/app/routes/admin_logs.py

@@ -1,4 +1,4 @@
-"""The admin diagnostics console's read side (E22.6): query `log_events`, the server's stored log.
+"""The admin diagnostics console's read side: query `log_events`, the server's stored log.
 
 Admin-only and read-only — rows leave the table through the retention job (`log_retention_days`),
 never through here. Reading is not audited: it changes nothing, and the console's live tail polls,

backend/app/routes/auth.py

@@ -1,6 +1,6 @@
 """Auth HTTP endpoints (OAuth login/callback, register/verify, password, session mgmt).
 
-Split out of app/auth.py (R12 S2); the core auth surface (current_user, scopes, token
+Split out of app/auth.py; the core auth surface (current_user, scopes, token
 helpers) stays in app/auth.py, imported below."""
 
 import secrets
@@ -53,7 +53,7 @@ VERIFY_TTL = timedelta(hours=24)
 # in and sets no password.
 APPROVAL_VERIFY_TTL = timedelta(days=7)
 RESET_TTL = timedelta(hours=1)
-# An admin-issued set-password link (E12 S5) travels out of band — the admin has to actually reach the
+# An admin-issued set-password link travels out of band — the admin has to actually reach the
 # person and hand it over — so the one-hour reset window is far too short. A day matches VERIFY_TTL and
 # the affordance the admin was shown.
 ADMIN_SETPW_TTL = timedelta(hours=24)
@@ -163,7 +163,7 @@ class InviteRequest(NamedTuple):
 
     `invite` is the row the request now lives under — which is NOT always the address that was just
     typed: one Gmail mailbox spelled two ways settles on whichever row already exists, and that row's
-    address is where mail will go. Callers that tell the user what happened need it (E9.5 S4).
+    address is where mail will go. Callers that tell the user what happened need it.
     `is_new` is the old boolean return in a name: true only when a row was created or a denied one
     reopened, i.e. exactly when admins should hear about it. A repeat request must not re-spam them.
     """
@@ -188,7 +188,7 @@ def upsert_pending_invite(db: Session, email: str, lang: str | None = None) -> I
 
     The commit contract is unchanged: this still commits ONLY when it writes something. Callers rely
     on that — `_register_account` persists its own flushed user precisely because a no-op here
-    commits nothing (E9.5 S6).
+    commits nothing.
     """
     email = (email or "").lower()
     if not valid_email(email):
@@ -245,7 +245,7 @@ def _access_notice_url(kind: str, email: str = "", inv: Invite | None = None) ->
 
     It rides the FRAGMENT, not the query string, for the same reason the verify/reset tokens do
     (SB3): a fragment never reaches the server, a proxy access log or a Referer header — and this
-    notice now carries the user's address. Naming it is the point of E9.5 S4: on 2026-09-03 a
+    notice now carries the user's address. Naming it is the point: on 2026-09-03 a
     registration as `npeter83.temu@` met an OAuth claim of `npeter83temu@`, and a screen that said
     "request recorded" without saying FOR WHAT hid the mismatch for a day.
 
@@ -297,9 +297,9 @@ class EmailPasswordIn(BaseModel):
     password: str | None = None
     # The language the sign-up page was in. Captured at registration because it is the ONLY moment
     # the choice exists anywhere the server can see: it lives in the browser until an account does,
-    # and a preference nobody recorded cannot be backfilled later (the lesson `google_email` taught
-    # in E9.5 S3 — those rows still read NULL until each user signs in again). Nothing reads it yet;
-    # the bilingual mail templates are E9.5 S7.
+    # and a preference nobody recorded cannot be backfilled later (as `google_email` showed: those
+    # rows still read NULL until each user signs in again). Nothing reads it yet; the bilingual
+    # mail templates will.
     lang: str | None = None
 
 
@@ -510,7 +510,7 @@ def _sync_google_email(db: Session, user: User, email: str) -> None:
     of the spelling they chose, because sign-in matches the stored address first. Google returns the
     account's PRIMARY address, which need not be what they registered with — and can never contain a
     `+` at all — so without this guard every plus-tagged registration lost its tag on the first Google
-    sign-in. (E9.5 S3 made that reachable by matching adoption across spellings; the rewrite itself is
+    sign-in. (Matching adoption across spellings made that reachable; the rewrite itself is
     older.)
 
     Never overwrite with an address another account already owns either: that would hit the unique
@@ -722,7 +722,7 @@ def _consume_password_token(db: Session, raw: str | None) -> tuple[User, str] |
 
 
 def issue_set_password_link(db: Session, user: User) -> tuple[str, datetime]:
-    """An admin-issued, single-use link that lets `user` set a password without any email (E12 S5).
+    """An admin-issued, single-use link that lets `user` set a password without any email.
 
     One mechanism answers three things: SEC-15 (on a no-SMTP instance every registration is
     auto-verified, so a pre-empted address cannot be recovered by mail), SEC-16 (a pre-empted address
@@ -804,10 +804,10 @@ def _register_account(email: str, password: str, lang: str | None = None) -> Non
             # for the same input — so it is not a new capability, just the end of a dead end. An
             # account that is already confirmed still gets nothing: there is nothing to confirm.
             #
-            # And a re-send is ALL it does: the submitted password is discarded. E9.5's closing
+            # And a re-send is ALL it does: the submitted password is discarded. A closing
             # review tried "while the address is unverified, the newest registration owns it"
             # (replace the hash, kill the outstanding verify tokens) as a fix for address
-            # pre-emption, and round 2 showed it was worse than the problem — DO NOT REPEAT IT.
+            # pre-emption, and it proved worse than the problem — DO NOT REPEAT IT.
             # The rule is symmetric, and an attacker can always be last: it hands an unauthenticated
             # caller the power to overwrite a real registrant's chosen password and delete the
             # confirmation link already in their inbox, and on a SEC-10-stripped row (password_hash
@@ -866,7 +866,7 @@ def _register_account(email: str, password: str, lang: str | None = None) -> Non
 
 def issue_verification_link(db: Session, user: User, ttl: timedelta | None = None) -> str:
     """A fresh confirmation link for `user`, returned rather than sent — for a mail that carries the
-    link inside a larger message (the branching approval/invitation mails, E9.5 S6).
+    link inside a larger message (the branching approval/invitation mails).
 
     Same token machinery and the same fragment (SB3) as the standalone confirmation mail, so the two
     kinds of link cannot drift apart in shape or in how they are consumed."""
@@ -881,8 +881,8 @@ def send_verification_link(db: Session, user: User) -> bool:
     address is the one its owner chose to be reachable at, and a `+tag` there is usually deliberate.
     The token rides the URL FRAGMENT (#) so it can never reach a proxy/access log or a Referer (SB3).
 
-    One definition, three callers — registration, the self-service resend, and the admin-side resend
-    (E9.5 S5). The link's shape and TTL must not drift between them; a verification mail that differs
+    One definition, three callers — registration, the self-service resend, and the admin-side resend.
+    The link's shape and TTL must not drift between them; a verification mail that differs
     by who triggered it is a bug waiting to be discovered by exactly one user.
 
     Returns whether the mail actually went out, so a caller with a human waiting on the answer (the
@@ -905,8 +905,8 @@ def verify_email_confirm(body: TokenIn, db: Session = Depends(get_db)) -> dict:
     dropped the password this account registered with, so sign-in would answer with the deliberately
     uniform "Invalid email or password" — true, but unreadable to the person who just proved they own
     the mailbox. Saying so leaks nothing: holding a valid single-use verify token for this account
-    already proves that much. Since E9.5 S1 the common source of that state is gone (admin approval no
-    longer revokes), leaving accounts stripped before that change and the Google-adoption path, so this
+    already proves that much. The common source of that state is gone (admin approval no longer
+    revokes), leaving accounts stripped before that change and the Google-adoption path, so this
     flag is rare now — but it must stay, because those users have no other way back in."""
     user = _consume_token(db, body.token, "verify")
     if user is None:
@@ -966,7 +966,7 @@ def _login_refused(status: int, reason: str, user: User | None = None, **extra)
     that proof (`invalid`, `rate_limited`) carry nothing at all, so they stay byte-identical for a
     real account and an unknown one.
 
-    Since E9.5 S1 the two gates are order-independent, so `approved` really can be true while
+    The two gates are order-independent, so `approved` really can be true while
     `email_verified` is false, and vice versa — the SPA renders whichever is actually outstanding
     rather than assuming a sequence.
     """
@@ -1145,21 +1145,21 @@ def revoke_preset_password_if_unverified(user: User) -> None:
     session it minted; the owner re-sets one via password-reset. No-op for an already-verified account,
     so a legit no-SMTP registration is unaffected.
 
-    The Google-adoption callback is the ONLY caller (E9.5 S1). Admin approval used to call this too, and
-    dropping it was right for the reason S1 gave — the revoke destroyed the password a legitimate
+    The Google-adoption callback is the ONLY caller. Admin approval used to call this too, and
+    dropping it was right for the reason given — the revoke destroyed the password a legitimate
     registrant had just chosen, and since the admin normally decides before the user reads their mail,
     that made the "your password was cleared" detour the DEFAULT path rather than an edge case.
 
-    S1 also claimed the revoke was REDUNDANT there, because `password_login` refuses an unverified
+    The revoke was also called REDUNDANT there, because `password_login` refuses an unverified
     account before it reads `is_active`. That part was wrong, and the epic's own review caught it: the
-    gate holds only while the address is unverified, and S6's approval mail exists to get the real
+    gate holds only while the address is unverified, and the approval mail exists to get the real
     owner to end that state — at which point a pre-emptor's password works. Nothing replaced the
     revoke, and that is deliberate. The review tried "the newest registration owns an unverified
     account" and reverted it: the rule is symmetric, so an attacker can simply register last, and it
     would have handed anonymous callers a write onto a real account's credential. What the owner
     actually has is password-reset, which proves the mailbox, rewrites the hash and bumps the epoch.
     The residual is logged as SEC-16; re-adding a caller here would put "your password was cleared"
-    back in front of every legitimate registrant, which is the whole reason S1 removed it.
+    back in front of every legitimate registrant, which is the whole reason it was removed.
 
     `password_revoked_at` is what makes "the owner re-sets one via password-reset" actually true. The
     revoke leaves `password_hash IS NULL`, which is also what a Google-only account looks like — and

backend/app/routes/channels.py

@@ -67,8 +67,8 @@ def list_channels(user: User = Depends(current_user), db: Session = Depends(get_
 
     # Per-channel aggregates over the shared catalog (channel_aggregates), computed on read rather than
     # denormalised: an Index Only Scan over a ~20 MB index, where it used to read every video's heap page
-    # (681 MB on prod, a 2–6 s first open once something else had pushed it out of memory, E31 S4d).
-    # (The Normal/Shorts/Live breakdown moved to the channel-detail page in R14, so it is no longer
+    # (681 MB on prod, a 2–6 s first open once something else had pushed it out of memory).
+    # (The Normal/Shorts/Live breakdown moved to the channel-detail page, so it is no longer
     # computed here — the manager table dropped its N/S/L column.)
     channel_ids = [c.id for _, c in rows]
     agg: dict[str, dict] = {}
@@ -276,7 +276,7 @@ def _channel_detail_dict(
         "explored": explored,
         "blocked": blocked,
         "stored_videos": stored,
-        # Per-type breakdown (Normal / Shorts / Live) — R14 moved it off the manager table onto the
+        # Per-type breakdown (Normal / Shorts / Live) — moved off the manager table onto the
         # channel page. Same aggregation the manager list uses (count_normal = stored − shorts − live).
         "count_normal": count_normal,
         "count_short": count_short,
@@ -349,7 +349,7 @@ def channel_detail(
     )
     blocked = _is_blocked(db, user, channel_id)
     # Stored total + the Normal/Shorts/Live split in one grouped pass (same filters as the manager
-    # list), so the channel page can show the per-type breakdown R14 moved off the table.
+    # list), so the channel page can show the per-type breakdown that moved off the table.
     n_all, n_short, n_live = db.execute(
         select(
             func.count(Video.id),

backend/app/routes/config.py

@@ -139,7 +139,7 @@ def test_issue_tracker(
     _: User = Depends(admin_user),
     db: Session = Depends(get_db),
 ) -> dict:
-    """Check the configured issue tracker (E16): the repository answers with this token, takes
+    """Check the configured issue tracker: the repository answers with this token, takes
     issues, and is PRIVATE — the one it must be, since an issue carries its reporter's log."""
     try:
         return {"ok": True, **gitea.check(db)}

backend/app/routes/debug_sessions.py

@@ -1,4 +1,4 @@
-"""Debug sessions (E16): Start → reproduce → Stop, the screenshots, and the evidence under review.
+"""Debug sessions: Start → reproduce → Stop, the screenshots, and the evidence under review.
 
 The session itself — what tags a request, its cap, its level — is `app/debugsession.py`. These routes
 are the user's handle on their OWN sessions only: another user's id 404s (`owned_or_404`), including
@@ -181,7 +181,7 @@ def export_session(
     )
 
 
-# --- the issue tracker (S4) -----------------------------------------------------------------
+# --- the issue tracker ----------------------------------------------------------------------
 # Issues a user may open per hour — counted once the tracker is ASKED to open one (an answer that
 # goes missing may still have created it, so an attempt cannot be given back); finishing a half-sent
 # one, or an attempt refused before the tracker was asked, is not counted. The composer sends one at

backend/app/routes/diagnostics.py

@@ -1,4 +1,4 @@
-"""The browser's log, sent while its user has a raised diagnostics level (E22 S5).
+"""The browser's log, sent while its user has a raised diagnostics level.
 
 The client keeps its log in memory (frontend `lib/log.ts`). Only after the user consented to Részletes
 or Teljes in Settings → Diagnosztika does it stream that log here, in batches, and each batch lands in
@@ -14,7 +14,7 @@ Nothing from the body is trusted as-is:
     modified client would not;
   * an event below the consented level is dropped (a Részletes consent does not store what only
     Teljes may carry), and so is the whole batch once the level has lapsed — where an open debug
-    session the request names counts as consent to ITS level (E16), and only its own events keep
+    session the request names counts as consent to ITS level, and only its own events keep
     its tag;
   * the timestamp is clamped to the consent window, so a row cannot dodge the retention job by
     claiming to come from the future.
@@ -63,7 +63,7 @@ class ClientEvent(BaseModel):
     attrs: dict[str, Any] | None = None
     request_id: str | None = Field(default=None, pattern=r"^[A-Za-z0-9._-]{8,64}$")
     tab_id: str | None = Field(default=None, pattern=r"^[A-Za-z0-9_-]{1,32}$")
-    # The debug session the event was captured in (E16); kept only when it is the one this request
+    # The debug session the event was captured in; kept only when it is the one this request
     # names in `X-Debug-Session` and the auth dependency found it the caller's own and open.
     debug_session_id: str | None = Field(default=None, pattern=r"^[0-9a-f]{16}$")
     version: str | None = Field(default=None, max_length=64)
@@ -138,7 +138,7 @@ def ingest_events(
     body: ClientEventsIn = Depends(_parsed_events),
     db: Session = Depends(get_db),
 ) -> dict:
-    # A debug session the request names raises the level for its own events (E16): starting one is
+    # A debug session the request names raises the level for its own events: starting one is
     # the consent to that level for its duration, whatever the user's own level is.
     session = debugsession.from_header(db, user, request.headers.get(debugsession.HEADER))
     level, _ = debugsession.level_for(user, session)

backend/app/routes/discover.py

@@ -1,10 +1,10 @@
-"""E24 · the Home surface's HTTP shell.
+"""The Home surface's HTTP shell.
 
 Thin by construction: every decision — what counts as in progress, what fits a time budget, which
 tier the hero comes from — lives in `app/discover/`, so the scheduler, a future CLI or a test can ask
 the same questions without a request. This file validates, gates and serializes.
 
-The consolidated `GET /api/discover` mirrors the Plex Discover route's one-payload shape (E5 S4): a
+The consolidated `GET /api/discover` mirrors the Plex Discover route's one-payload shape: a
 landing page that fires four requests to answer one question would spend its whole budget on the
 thing it exists to remove.
 """
@@ -72,7 +72,7 @@ def get_discover(
 # never reaches SQL — `hero.pick` uses it only as set membership over an already-bounded candidate
 # pool (the resume rail's `RAIL_LIMIT` rows, the shelf, `SURPRISE_DRAW` surprise draws) — so there is
 # no scan for a crafted URL to unbound, and the set is built in full before this slice anyway. The
-# comment that claimed otherwise was corrected in round 2; the request line's own length is what
+# comment that claimed otherwise was later corrected; the request line's own length is what
 # actually bounds a hostile `exclude`.
 MAX_EXCLUDE = 32
 

backend/app/routes/downloads.py

@@ -498,7 +498,7 @@ def upload_download(
     upload: SpooledUpload = Depends(spool_upload),
     db: Session = Depends(get_db),
 ) -> dict:
-    """Ingest a local file into the caller's library (E7 S5). Any file type is accepted; media
+    """Ingest a local file into the caller's library. Any file type is accepted; media
     (video/audio) gets the full function set, a generic file is download-only. The body IS the file
     (see the header note above); `spool_upload` has already authenticated the caller and streamed it
     to a temp path under the download volume, so what is left here is the non-yt-dlp ingest which
@@ -914,7 +914,7 @@ def share_download(
             user_id=recipient.id,
             type="download_shared",
             title=(job.display_name or "A download") + " was shared with you",
-            # The client names the notice in the reader's language from `data` (E30); the title is the
+            # The client names the notice in the reader's language from `data`; the title is the
             # English fallback only.
             data={
                 "kind": "download_shared",
@@ -1033,7 +1033,7 @@ def list_links(
 
 class CreateLinkIn(BaseModel):
     password: str = ""
-    # D1 (E7 S3): a newly shared download is downloadable by default — the common intent is "let the
+    # D1: a newly shared download is downloadable by default — the common intent is "let the
     # recipient have the file", not stream-only. Forward-only: this only sets the default for links
     # minted from now on; existing links keep whatever `allow_download` they were created with (the
     # column default stays False, so no back-catalogue link silently flips). The owner can still

backend/app/routes/feed.py

@@ -235,7 +235,7 @@ def get_feed_years(
     user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
-    """Per-year video counts for the year control (item 8 / E8·S2): the quick recent-year chips and the
+    """Per-year video counts for the year control: the quick recent-year chips and the
     "more…" per-year-counts dialog. Every filter EXCEPT the publish-date narrowing applies, so picking a
     year re-queries the feed but not this list. Response: {"years": [{"year": <int>, "count": <int>}]},
     newest year first."""

backend/app/routes/me.py

@@ -158,12 +158,12 @@ def get_me(
         "pending_activations": pending_activations,
         "email_configured": email_configured,
         "preferences": user.preferences or {},
-        # The consented diagnostics level in force and when it lapses (E22 S5). The client applies
+        # The consented diagnostics level in force and when it lapses. The client applies
         # it to its own log and streams that log while it is raised.
         "diagnostics": diagnostics.state(db, user),
-        # The live debug session, if one is recording (E16) — a reload resumes it.
+        # The live debug session, if one is recording — a reload resumes it.
         "debug_session": _live_session(db, user),
-        # Where a bug report goes (E16 S4): the tracker's repository, or None — download only.
+        # Where a bug report goes: the tracker's repository, or None — download only.
         "issues": gitea.target(db),
     }
 

backend/app/routes/plex/__init__.py

@@ -4,7 +4,7 @@ Read endpoints (libraries/browse/show/image) are available to ANY authenticated
 (pure-Siftlode included) — this is an access layer to the Plex library WITHOUT requiring a plex.tv
 account, and playback is a local file. Admin endpoints test the connection and run the catalog sync.
 
-Split out of the former single routes/plex.py (R12 S1). `router` keeps the same shape the app
+Split out of the former single routes/plex.py. `router` keeps the same shape the app
 wiring expects (`plex_routes.router`), so main.py is unchanged.
 """
 

backend/app/routes/plex/browse.py

@@ -285,7 +285,7 @@ def unified_library(
     episodes = []
     if tsq is not None and want_shows and field in ("all", "episode"):
         ep_st = aliased(PlexState)
-        # In HU an episode is found by its Hungarian title too (E30: the overlay now fills it) — and
+        # In HU an episode is found by its Hungarian title too (the overlay fills it) — and
         # still by its English one, like `vector_match` does for the grid.
         if field == "episode":
             ep_vec = func.to_tsvector(TS_CONFIG, func.coalesce(PlexItem.title, ""))
@@ -360,8 +360,8 @@ def facets(
 
     # The shows that pass the watch-state scope, asked ONCE. The per-user episode rollup behind it is a
     # full pass over the user's episodes (~10 ms on a prod-sized library), and each of the show groups
-    # (genres, ratings, studios, years, rating max) asked it again: half of a filtered facets call
-    # (E31 S4e). The same filter on the same rows, so the counts do not change
+    # (genres, ratings, studios, years, rating max) asked it again: half of a filtered facets call.
+    # The same filter on the same rows, so the counts do not change
     # (test_plex_facets_grid_parity).
     shows_in_scope: list[int] | None = None
     if show_ids and show in ("watched", "in_progress", "unwatched"):
@@ -545,7 +545,7 @@ def facets(
     for c in split_csv(f.playable):
         if c in PLAYBACK_CLASSES:
             playable_counts.setdefault(c, 0)
-    # Names in the reader's alphabet: the genres are Hungarian words for a Hungarian reader (E30 S1).
+    # Names in the reader's alphabet: the genres are Hungarian words for a Hungarian reader.
     alpha = {w: i for i, w in enumerate(sorted_words(db, [*genre_counts, *studio_counts], lang))}
     return {
         "genres": [

backend/app/routes/plex/detail.py

@@ -153,7 +153,7 @@ def show_detail(
         all_cards.append(card)
     show_roll = rollup.rollup(all_cards)
 
-    # Cast + IMDb + tagline are served from the DB row (persisted by the cast backfill, E5 S5b). The one
+    # Cast + IMDb + tagline are served from the DB row (persisted by the cast backfill). The one
     # remaining live call is `related` — a Plex recommendation hub we don't mirror — which also carries
     # the metadata used to lazily fill a not-yet-enriched show. Any live failure just drops `related` and
     # the lazy fill; the row-served detail below still renders (outage-resilient).
@@ -213,7 +213,7 @@ def show_detail(
             "first": show_roll["first"],
             "episode_count": show_roll["episode_count"],
             "collection_keys": sh.collection_keys or [],
-            # TMDB enrichment (E5 S2), served from the row.
+            # TMDB enrichment, served from the row.
             "tmdb": plex_tmdb.serve_block(db, sh, lang=lang),
         },
         "seasons": [_season_block(se, by_season.get(se.id, [])) for se in seasons],
@@ -353,7 +353,7 @@ _TRACK_TAIL = re.compile(r"\(([^()]+)\)\s*$")
 
 
 def _track_naming(s: dict) -> dict:
-    """What the player names a track from (E30). Plex's `displayTitle` is in the SERVER's language
+    """What the player names a track from. Plex's `displayTitle` is in the SERVER's language
     ("English (AC3 5.1)", "magyar Forced", "中文 (EAC3 Stereo)"), so it is sent only as the fallback
     `label`; the client builds the name in the reader's language from the language tag, the
     forced / SDH flags and the codec tail. No title and no language → no label (the client numbers it)."""
@@ -538,6 +538,6 @@ def item_detail(
         "prev_id": prev_id,
         "next_id": next_id,
         "collections": _collection_strips(db, it, user.id, lang),
-        # TMDB enrichment (E5 S2), served from the row — movies only (episodes aren't enriched).
+        # TMDB enrichment, served from the row — movies only (episodes aren't enriched).
         "tmdb": plex_tmdb.serve_block(db, it, lang=lang) if it.kind == "movie" else None,
     }

backend/app/routes/plex/discover.py

@@ -1,11 +1,11 @@
-"""Plex Discover: the rail-surface read-model (E5 S4).
+"""Plex Discover: the rail-surface read-model.
 
 A consolidated payload for the dedicated Discover landing — a stack of horizontal rails:
 Continue watching · Recently added · Browse-by-genre tiles · Because you watched X — plus a
 separate, reshuffling Surprise-me sample. Serve-from-DB only: the recommendation rail reads the
-recs the S2 TMDB engine already persisted (`PlexItem.recommendations`), never a live TMDB call, and
+recs the TMDB engine already persisted (`PlexItem.recommendations`), never a live TMDB call, and
 every card comes from the same `movie_card`/`show_card` serializers the grid uses (so rails inherit
-S1's `art` + S3's rating/summary for free). The rails carry EN metadata (like the other non-grid
+their `art` + rating/summary for free). The rails carry EN metadata (like the other non-grid
 card paths); the HU overlay coalesces only in the main grid.
 
 The sidebar metadata filters (genre / rating / year / collection / …) narrow EVERY rail too, so the
@@ -114,8 +114,8 @@ def _recently_added(
         else []
     )
     # Merge the two type-homogeneous lists by added_at, then serialize each side in one batch so the
-    # per-card state lookups stay batched (no N+1). Same `or NO_TS` key as the two rails below — the
-    # E24 review found this one still on the older `(is not None, value)` form, i.e. one rule in two
+    # per-card state lookups stay batched (no N+1). Same `or NO_TS` key as the two rails below — a
+    # review found this one still on the older `(is not None, value)` form, i.e. one rule in two
     # spellings, with the two comments explaining it differently.
     tagged = [(m.added_at, "movie", m) for m in movies] + [(s.added_at, "show", s) for s in shows]
     tagged.sort(key=lambda t: t[0] or rollup.NO_TS, reverse=True)

backend/app/routes/plex/people.py

@@ -176,10 +176,10 @@ def person_detail(
     people who share a name share a page. Each section is capped at _PERSON_SECTION_MAX. An unknown name
     simply returns empty sections.
 
-    E5 S6: the first time a page is opened, the person's TMDB bio + "Known for" credits are lazily
-    fetched (from the S2-linked `tmdb_person_id`) and persisted, then served from the row on every open.
+    The first time a page is opened, the person's TMDB bio + "Known for" credits are lazily
+    fetched (from the linked `tmdb_person_id`) and persisted, then served from the row on every open.
     The fetch runs OFF the request path (a background task); the first open serves whatever's in the row
-    with `enriching` set, and the page asks again until the bio lands. E30 S6: the people_enrich job
+    with `enriching` set, and the page asks again until the bio lands. The people_enrich job
     fetches everyone ahead of time, so this lazy path is only for a person the job hasn't reached yet.
     """
     lang = norm_lang(lang)
@@ -187,7 +187,7 @@ def person_detail(
     # Lazy one-time bio enrich, scheduled AFTER the response so the TMDB call is never on the serve path.
     # Gated by a per-person cooldown so concurrent/rapid opens (or repeated opens while TMDB is degraded)
     # can't pile background tasks onto the shared threadpool.
-    # `enriching` tells the page the bio is on its way (E30 S6): it asks again shortly instead of showing
+    # `enriching` tells the page the bio is on its way: it asks again shortly instead of showing
     # an empty page until the next open. True while a fetch is pending, including one an earlier open
     # already reserved.
     enriching = (

backend/app/routes/plex/playback.py

@@ -169,7 +169,7 @@ _PROGRESS_MIN_S = 5
 
 _FINISH_MARGIN_S = 30
 
-# S2 write-back throttle: the resume position is now pushed to Plex on the periodic (non-final)
+# Write-back throttle: the resume position is now pushed to Plex on the periodic (non-final)
 # checkpoint too — not only on the final pause/unmount flush — so Plex (the source of truth) stays
 # current in near-real-time. To keep a single watch from spraying `/:/timeline` calls, a push is
 # rate-limited to at most one per item per user every _PUSH_THROTTLE_S seconds; a `final` checkpoint
@@ -360,7 +360,7 @@ def item_progress(
 ) -> dict:
     """Checkpoint the resume position while playing (near the end → mark watched + clear it).
 
-    S2 write-back: the resume position is mirrored to Plex (the source of truth) on the periodic
+    Write-back: the resume position is mirrored to Plex (the source of truth) on the periodic
     checkpoint too, not only on the final flush — throttled to ≥_PUSH_THROTTLE_S per item (see
     `_should_push_resume`). `final` (sent on pause / seek / pagehide / unmount) pushes immediately and
     resets the throttle window, so Plex sees a settled position the instant the user pauses or seeks."""
@@ -696,7 +696,7 @@ def stream_hls_file(
     (viewer, rating_key) and a seek-restart replaces the viewer's registered one, while the DIRECTORY
     is per (key, viewer, offset, tag) — so resolving by the key alone handed the old player the new
     session's `seg_12.ts`, produced from a different offset under `-copyts`: wrong
-    bytes with a 200, which the player has no way to notice (deep-review round 5). A request for a
+    bytes with a 200, which the player has no way to notice. A request for a
     session that is no longer the registered one is a 404, and the player reclaims at the playhead.
 
     That reclaim is also why a request with no live session is no longer auto-started here: the
@@ -728,7 +728,7 @@ def stream_hls_file(
     # `proc` so a session whose ffmpeg has already exited answers at once instead of polling out the
     # whole timeout: this is a SYNC route on the ~40-slot threadpool, holding a pooled DB connection
     # with it, so every such wait is a worker (and a connection) parked for 20 s — an ordinary seek
-    # past the produced region was enough to do it (round 5).
+    # past the produced region was enough to do it.
     if not plex_stream.wait_for(path, timeout, proc=s.proc):
         raise refused(404, "not_ready")
     try:

backend/app/routes/plex/playlists.py

@@ -296,7 +296,7 @@ def _items_by_rks(db: Session, rks: list) -> list[PlexItem]:
 
 
 class PlexItemAddBulkIn(PlexItemKeysIn):
-    # Where each key goes back (E28 S3e2, the list page's "Undo" of a removal): an index over the
+    # Where each key goes back (the list page's "Undo" of a removal): an index over the
     # ORDERED rows, one per key. The two-call shape (append, then send the whole order) leaves the rows
     # at the end whenever the second call fails, and the order it sends would overwrite anything
     # another tab changed in between.

backend/app/routes/saved_views.py

@@ -54,7 +54,7 @@ def list_views(
 
 # A feed view's tag pick is read by more than the feed: the autotag job keeps every tag a view names
 # (sync/autotag.py). Held here to the shape the feed sends — a list of tag ids, at most this many — so
-# a hand-made body (`"tags": 5`, or 60k ids) can't break that job for every user (E32 review).
+# a hand-made body (`"tags": 5`, or 60k ids) can't break that job for every user.
 _MAX_VIEW_TAGS = 500
 
 

backend/app/routes/setup.py

@@ -71,10 +71,10 @@ def setup_admin(body: SetupAdminIn, db: Session = Depends(require_setup)) -> dic
         raise refused(400, "invalid_email")
     if len(password) < PASSWORD_MIN_LEN:
         raise refused(400, "weak_password", min=PASSWORD_MIN_LEN)
-    # Resolve canonically, not by the literal string (DX-17). The wizard can be re-run, and E9.5's
-    # whole point is that two spellings of one Gmail mailbox are one person — matching literally here
-    # would let a second run under the other spelling create the DUPLICATE admin row the epic exists
-    # to prevent. Every other lookup went canonical in S3; this one was outside that diff.
+    # Resolve canonically, not by the literal string (DX-17). The wizard can be re-run, and the
+    # whole point of canonical email is that two spellings of one Gmail mailbox are one person —
+    # matching literally here would let a second run under the other spelling create the DUPLICATE
+    # admin row it exists to prevent. Every other lookup was canonical already; this one was missed.
     user = db.execute(
         select(User).where(User.email_canonical == canonical_email(email))
     ).scalar_one_or_none()

backend/app/routes/sync.py

@@ -37,7 +37,7 @@ def sync_subscriptions(user: User = Depends(current_user), db: Session = Depends
             result = import_subscriptions(db, user)
     except YouTubeError as exc:
         # The onboarding wizard's first call: an unguarded failure here was a raw 500 and the
-        # blocking "Server error" dialog, with nothing the user could act on (E9 F1).
+        # blocking "Server error" dialog, with nothing the user could act on.
         db.rollback()
         raise youtube_refusal(exc) from exc
     result["quota_used_estimate"] = m.used