fix(r5): address the third /code-review high round — 7 findings

- the sweep guard anchors the rating_key to digits: the round-2 widening had
  degenerated to "anything ending in _<digits>" (backup_2024, release_10)
- RSS counts apply-side failures too, so a read-only database no longer reports
  a wholly failed poll as "ok — new=0, failed=0"
- the player reads/writes its volume directly (readAccount/writeAccount): the
  persisted-object hook rendered nothing and cost a second write per settle
- new tests: the sweep guard's accept/reject table, and run_ffmpeg's threading
  (drain, cancel while silent, stall watchdog, stderr tail on a nonzero exit)
- the breaker sentinel is checked one way (isinstance) at all four sites
- run_rss_poll is typed dict[str, int]

All three new test groups were mutation-checked: reverting each fix turns them
red (or, for the cancel/stall pair, hangs — which is the bug itself).

backend/app/plex/stream.py

@@ -35,12 +35,18 @@ _HLS_ROOT = Path(settings.plex_hls_dir) if settings.plex_hls_dir else Path(setti
 _SEG_SECONDS = 6
 _SESSION_IDLE_S = 600  # reap a session with no access for this long
 # A session directory is named `{rating_key}_{int(start_s)}_{tag}_{aoff:+.2f}` (see start_session);
-# before multi-audio it was just `{rating_key}_{int(start_s)}`, so the tail is OPTIONAL here — the
-# oldest leftovers on disk carry the old shape and are exactly what the sweep exists to remove.
-# `sweep_orphans` deletes ONLY names matching this: `_HLS_ROOT` is admin-configurable
-# (PLEX_HLS_DIR), so it may legitimately point at a shared scratch path we do not own — a blanket
-# "delete every directory under the root" would take the neighbours with it.
-_SESSION_DIR_RE = re.compile(r"^.+_\d+(_[^_]+_[+-]\d+\.\d{2})?$")
+# before multi-audio it was just `{rating_key}_{int(start_s)}`. `sweep_orphans` deletes ONLY names
+# matching one of those two shapes: `_HLS_ROOT` is admin-configurable (PLEX_HLS_DIR), so it may
+# legitimately point at a shared scratch path we do not own, and a blanket "delete every directory
+# under the root" would take the neighbours with it.
+#
+# The KEY is anchored to digits (a Plex rating_key is a number) — that is what keeps foreign names
+# out. A `.+` there let `snapshot_2024_backup_+1.00` through, and pairing `.+` with an optional tail
+# degenerated all the way to "anything ending in _<digits>" (`backup_2024`, `release_10`). A
+# non-numeric rating_key would merely leave its directory unswept, which is the safe direction to
+# fail. Covered by test_plex_stream.py — this regex is the only thing standing between the sweep
+# and someone else's data.
+_SESSION_DIR_RE = re.compile(r"^\d+_\d+(_[^_]+_[+-]\d+\.\d{2})?$")
 
 _lock = threading.Lock()
 _sessions: dict[str, "HlsSession"] = {}

backend/app/sync/playlists.py

@@ -346,10 +346,11 @@ def push_playlist(db: Session, user: User, pl: Playlist, *, live=None) -> dict:
             created = 1
             # Brand-new playlist: just append every video in order.
             for vid in desired:
-                if breaker.run(
+                added = breaker.run(
                     lambda v=vid: yt.add_playlist_item(pl.yt_playlist_id, v),
                     lambda v=vid: failures.append(v),
-                ) is not FAILED:
+                )
+                if not isinstance(added, _Failed):
                     inserted += 1
             if not failures:
                 pl.synced_fingerprint = fingerprint(pl.name, desired)
@@ -382,10 +383,11 @@ def push_playlist(db: Session, user: User, pl: Playlist, *, live=None) -> dict:
         # Delete extras (local is authoritative).
         for it in current:
             if it["video_id"] not in desired_set:
-                if breaker.run(
+                dropped = breaker.run(
                     lambda i=it: yt.delete_playlist_item(i["item_id"]),
                     lambda i=it: failures.append(i["video_id"]),
-                ) is not FAILED:
+                )
+                if not isinstance(dropped, _Failed):
                     deleted += 1
         # Insert missing (append; the reorder pass below fixes positions).
         cur_set = set(cur_vids)
@@ -407,12 +409,13 @@ def push_playlist(db: Session, user: User, pl: Playlist, *, live=None) -> dict:
                 continue  # failed insert; skip
             if i < len(model) and model[i] == want:
                 continue
-            if breaker.run(
+            moved = breaker.run(
                 lambda w=want, pos=i: yt.move_playlist_item(
                     item_id_by_vid[w], pl.yt_playlist_id, w, pos
                 ),
                 lambda w=want: failures.append(w),
-            ) is FAILED:
+            )
+            if isinstance(moved, _Failed):
                 continue
             reordered += 1
             j = model.index(want)

backend/app/sync/runner.py

@@ -48,11 +48,15 @@ def get_service_user(db: Session) -> User | None:
     return users[0] if users else None
 
 
-def run_rss_poll(db: Session, channels: list[Channel] | None = None) -> dict:
-    """Poll every channel's free RSS feed. Returns `{"new": inserted, "failed": unreadable_feeds}`
-    — the failure count is part of the RESULT, not just a log line, so the scheduler card and the
-    audit summary can tell "no new uploads" apart from "every feed was unreachable" (an egress
-    outage otherwise renders identically to a quiet hour)."""
+def run_rss_poll(db: Session, channels: list[Channel] | None = None) -> dict[str, int]:
+    """Poll every channel's free RSS feed. Returns `{"new": inserted, "failed": channels_that_did
+    _not_complete}` — the failure count is part of the RESULT, not just a log line, so the scheduler
+    card and the audit summary can tell "no new uploads" apart from "nothing worked" (an egress
+    outage, or a database that can't accept writes, otherwise renders identically to a quiet hour).
+
+    `failed` counts a channel whose feed could not be READ *or* whose rows could not be APPLIED —
+    both leave the channel un-polled, and counting only the first would move the blind spot rather
+    than remove it."""
     if channels is None:
         channels = db.execute(select(Channel)).scalars().all()
     total = len(channels)
@@ -87,12 +91,15 @@ def run_rss_poll(db: Session, channels: list[Channel] | None = None) -> dict:
             try:
                 new += apply_rss_feed(db, channel, entries)
             except Exception:
+                # A write failure (read-only DB, failover) leaves the channel just as un-polled as
+                # an unreachable feed — count it, or a wholly broken run still reports "failed=0".
                 db.rollback()
+                failed += 1
                 log.exception("RSS apply failed for channel %s", channel.id)
             done += 1
             progress.report(done, total, "rss_poll")
     if failed:
-        log.warning("RSS poll: %d/%d channel feeds could not be read", failed, total)
+        log.warning("RSS poll: %d/%d channels could not be polled", failed, total)
     return {"new": new, "failed": failed}