fix(plex,channels): deep-review fixes — durable watch-sync + no shared-link clobber

Deep-review of the quickfix batch surfaced two data/preference-loss bugs plus
smaller items; all fixed with tests.

- watch_sync _pull_apply: don't let the Plex-authoritative pull overwrite a DIRTY
  local row (a change whose immediate push failed) — that stranded the value
  forever since _repush_dirty only retries dirty rows. Leave it dirty for re-push.
- PlexProvider / ChannelsProvider: a partial shared link opened in a fresh tab
  persisted mount-time DEFAULTS over the account's stored scope/sort/filters
  (base read before the account was pinned). Persist/keep only URL-present dims;
  re-hydrate the omitted ones from storage.
- playback resume write-back: guard against out-of-order delivery (a superseded
  older push now drops) and evict the throttle map so it can't grow unbounded.
- PlexPlayer: announce mid-playback buffering to assistive tech (role=status +
  sr-only label); new plex.player.buffering (HU+EN).
- columnSort: hoist the shared key:dir sort codec used by both URL-state modules.
- Tests: dirty-guard + flag-settle + per-key throttle scoping + superseded-push
  (backend); hold-repeat/suppress-click/unmount + partial-link no-clobber +
  refetch-doesn't-clobber-undo (frontend). Backend pytest 475, FE vitest 519.

backend/app/plex/watch_sync.py

@@ -369,6 +369,14 @@ def _pull_apply(
     # `_same_state`; a row that reaches here really is out of step with the source of truth. The
     # `_same_state` + `synced_to_plex` short-circuit above still absorbs the freshly-pushed case (Plex
     # echoes the same shape a beat later) so a just-pushed row never bounces.
+    if st is not None and not st.synced_to_plex:
+        # Durability guard: this row holds a local change that never reached Plex — its immediate push
+        # failed, so it's still dirty. Do NOT let the Plex-authoritative pull overwrite it and clear the
+        # flag: that would strand the local value forever, since `_repush_dirty` only retries dirty rows.
+        # Leave it dirty; `_repush_dirty` (later in this same run) pushes the local value up to Plex. This
+        # closes the "Plex flapped mid-session" lost-update — the one case the Plex-wins comment's
+        # "almost always already pushed" assumption above excludes.
+        return None
     if st is None:
         st = PlexState(user_id=user_id, item_id=item_id)
         db.add(st)

backend/app/routes/plex/playback.py

@@ -4,7 +4,7 @@ import hashlib
 import os
 import tempfile
 import threading
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 
 import httpx
 from fastapi import (
@@ -171,15 +171,33 @@ _push_throttle_lock = threading.Lock()
 def _should_push_resume(user_id: int, item_id: int, now: datetime, final: bool) -> bool:
     """Whether to mirror this resume checkpoint to Plex now. `final` always pushes; a periodic tick
     pushes only when ≥_PUSH_THROTTLE_S has elapsed since the last push for this (user, item). Records
-    `now` as the last-push time whenever it returns True so the window is measured from the real push."""
+    `now` as the last-push time whenever it returns True so the window is measured from the real push
+    (and so `_resume_push_superseded` can drop an older, still-pending push — see there)."""
     with _push_throttle_lock:
         last = _last_push_at.get((user_id, item_id))
         if final or last is None or (now - last).total_seconds() >= _PUSH_THROTTLE_S:
             _last_push_at[(user_id, item_id)] = now
+            # Opportunistic eviction so the map can't grow unbounded over a long-lived process (one
+            # entry per item ever checkpointed). Anything older than a few windows is dead — a push
+            # completes in seconds, so a stale entry protects nothing.
+            if len(_last_push_at) > 2048:
+                cutoff = now - timedelta(seconds=_PUSH_THROTTLE_S * 6)
+                for k in [k for k, t in _last_push_at.items() if t < cutoff]:
+                    del _last_push_at[k]
             return True
         return False
 
 
+def _resume_push_superseded(user_id: int, item_id: int, intent: datetime) -> bool:
+    """True if a newer resume push for this (user, item) was scheduled after `intent`. Called at the
+    HTTP boundary of a background resume push: because periodic and seek/pause pushes are independent
+    background tasks with no ordering guard, an older still-pending periodic push could otherwise land
+    at Plex AFTER a newer backward-seek push and — with the Plex-authoritative pull — durably revive the
+    stale position. Skipping a superseded push keeps the last-scheduled position the one Plex settles on."""
+    with _push_throttle_lock:
+        return _last_push_at.get((user_id, item_id), intent) > intent
+
+
 @router.get("/person-image")
 def person_image(u: str, request: Request) -> Response:
     """Proxy a cast/crew photo from Plex's public metadata CDN (host-whitelisted; no token needed).
@@ -202,6 +220,26 @@ def person_image(u: str, request: Request) -> Response:
     return imgcache.response(r.content, ct)
 
 
+def _push_resume_guarded(
+    user_id: int,
+    item_id: int,
+    rating_key: str,
+    time_ms: int,
+    duration_ms: int,
+    expect_ts: datetime | None,
+    intent: datetime,
+) -> None:
+    """Background entrypoint for a resume push that drops itself if a newer resume push for the same
+    (user, item) was scheduled after it (see `_resume_push_superseded`), then delegates to the real
+    push. This narrows the periodic-vs-seek write-ordering race to the (rare) case where the older push
+    has already left the process before the newer one is scheduled."""
+    if _resume_push_superseded(user_id, item_id, intent):
+        return
+    plex_watch.push_state_to_plex(
+        user_id, item_id, rating_key, "resume", time_ms, duration_ms, expect_ts
+    )
+
+
 def _push_watch(
     background: BackgroundTasks,
     db: Session,
@@ -211,10 +249,14 @@ def _push_watch(
     action: str,
     time_ms: int = 0,
     duration_ms: int = 0,
+    intent: datetime | None = None,
 ) -> None:
     """Schedule a best-effort Siftlode→Plex watch push, but only for a user whose owner link has
     push enabled — non-owner users never touch Plex. Guarding here (with the request session) avoids
-    spinning up a throwaway background session on every state change for the common no-link case."""
+    spinning up a throwaway background session on every state change for the common no-link case.
+
+    A `resume` push with an `intent` timestamp is routed through `_push_resume_guarded` so a superseded
+    (older) push can't land out of order; `watched`/`unwatched` scrobbles go straight through."""
     if plex_watch.link_for_push(db, user_id) is None:
         return
     # Capture the row's freshest timestamp NOW so the background push can tell if a newer local edit
@@ -226,6 +268,12 @@ def _push_watch(
         .scalars()
         .first()
     )
+    marker = plex_watch._state_marker(st)
+    if action == "resume" and intent is not None:
+        background.add_task(
+            _push_resume_guarded, user_id, item_id, rating_key, time_ms, duration_ms, marker, intent
+        )
+        return
     background.add_task(
         plex_watch.push_state_to_plex,
         user_id,
@@ -234,7 +282,7 @@ def _push_watch(
         action,
         time_ms,
         duration_ms,
-        plex_watch._state_marker(st),
+        marker,
     )
 
 
@@ -284,6 +332,10 @@ def item_progress(
         st.position_seconds = 0
         st.progress_updated_at = now
         st.synced_to_plex = False
+        # Terminal state for resume write-back: drop the throttle/ordering entry so the map doesn't
+        # retain a dead key for every finished item.
+        with _push_throttle_lock:
+            _last_push_at.pop((user.id, it.id), None)
         db.commit()
         # Immediate on the watched transition; skip a repeat scrobble if it was already watched
         # (a later checkpoint of the same finished item would otherwise bump Plex's viewCount again).
@@ -321,6 +373,7 @@ def item_progress(
             "resume",
             position * 1000,
             duration * 1000,
+            intent=now,
         )
     return {"position_seconds": position}
 

backend/tests/test_plex_watch_sync.py

@@ -14,7 +14,11 @@ from sqlalchemy import select
 
 from app.models import PlexItem, PlexLibrary, PlexState, User
 from app.plex.watch_sync import _pull_apply
-from app.routes.plex.playback import _PUSH_THROTTLE_S, _should_push_resume
+from app.routes.plex.playback import (
+    _PUSH_THROTTLE_S,
+    _resume_push_superseded,
+    _should_push_resume,
+)
 
 
 def _seed_item_and_user(db):
@@ -29,9 +33,10 @@ def _seed_item_and_user(db):
     return item.id, user.id
 
 
-def test_pull_plex_wins_over_newer_local_resume(db):
-    """The core S2 change: a locally-in-progress item whose local edit is NEWER than Plex's still
-    resolves to PLEX's position on the incremental pull — Plex is authoritative, no LWW."""
+def test_pull_plex_wins_over_diverging_synced_local_resume(db):
+    """The core S2 change: a SYNCED local row (its state already reached Plex) that later diverges from
+    Plex = a real external Plex-side change, so the incremental pull resolves to PLEX's position — Plex
+    is authoritative, no LWW. (A DIRTY local row is protected instead — see the dirty-guard test.)"""
     item_id, user_id = _seed_item_and_user(db)
     now = datetime.now(timezone.utc)
     db.add(
@@ -41,7 +46,7 @@ def test_pull_plex_wins_over_newer_local_resume(db):
             status="new",
             position_seconds=300,
             progress_updated_at=now,  # local touched just now — "newer" than Plex
-            synced_to_plex=False,
+            synced_to_plex=True,  # but already pushed → a later Plex divergence is an external change
         )
     )
     db.flush()
@@ -62,8 +67,8 @@ def test_pull_plex_wins_over_newer_local_resume(db):
     assert st.synced_to_plex is True
 
 
-def test_pull_plex_watched_wins_over_local_in_progress(db):
-    """Plex marking the item watched propagates even over a fresh local in-progress row."""
+def test_pull_plex_watched_wins_over_synced_local_in_progress(db):
+    """Plex marking the item watched propagates over a SYNCED local in-progress row (external change)."""
     item_id, user_id = _seed_item_and_user(db)
     now = datetime.now(timezone.utc)
     db.add(
@@ -73,7 +78,7 @@ def test_pull_plex_watched_wins_over_local_in_progress(db):
             status="new",
             position_seconds=300,
             progress_updated_at=now,
-            synced_to_plex=False,
+            synced_to_plex=True,
         )
     )
     db.flush()
@@ -125,6 +130,104 @@ def test_pull_no_bounce_on_matching_row(db):
     assert st.position_seconds == 100, "no churn to the stored position"
 
 
+def test_pull_keeps_dirty_local_on_divergence(db):
+    """Durability guard: a DIRTY row (a local change whose immediate push failed → synced_to_plex=False)
+    must NOT be overwritten by a diverging Plex signal, and must stay dirty so `_repush_dirty` can push
+    the local value up. Overwriting-and-clearing here would strand the local change forever."""
+    item_id, user_id = _seed_item_and_user(db)
+    now = datetime.now(timezone.utc)
+    db.add(
+        PlexState(
+            user_id=user_id,
+            item_id=item_id,
+            status="watched",  # user just marked watched locally; the scrobble to Plex failed
+            position_seconds=0,
+            watched_at=now,
+            progress_updated_at=now,
+            synced_to_plex=False,  # dirty — never reached Plex
+        )
+    )
+    db.flush()
+
+    # Plex still lists it in on_deck at an old in-progress offset (it never got the watched scrobble).
+    changed = _pull_apply(db, user_id, item_id, "new", 240, plex_ts=now - timedelta(seconds=60))
+    db.flush()
+
+    assert changed is None, "a dirty local row must not be clobbered by the pull"
+    st = (
+        db.execute(
+            select(PlexState).where(PlexState.user_id == user_id, PlexState.item_id == item_id)
+        )
+        .scalars()
+        .one()
+    )
+    assert st.status == "watched", "local watched preserved"
+    assert st.position_seconds == 0
+    assert st.synced_to_plex is False, "stays dirty so _repush_dirty retries the push"
+
+
+def test_pull_settles_flag_on_matching_dirty_row(db):
+    """Anti-bounce, dirty branch: a row that already MATCHES Plex but is still dirty gets its
+    synced_to_plex flag settled to True (no churn), so `_repush_dirty` stops re-pushing it forever."""
+    item_id, user_id = _seed_item_and_user(db)
+    now = datetime.now(timezone.utc)
+    db.add(
+        PlexState(
+            user_id=user_id,
+            item_id=item_id,
+            status="new",
+            position_seconds=100,
+            progress_updated_at=now,
+            synced_to_plex=False,  # dirty, but already agrees with Plex
+        )
+    )
+    db.flush()
+
+    changed = _pull_apply(db, user_id, item_id, "new", 102, plex_ts=now + timedelta(seconds=2))
+    db.flush()
+
+    assert changed is None, "a matching row makes no change"
+    st = (
+        db.execute(
+            select(PlexState).where(PlexState.user_id == user_id, PlexState.item_id == item_id)
+        )
+        .scalars()
+        .one()
+    )
+    assert st.position_seconds == 100, "no churn to the stored position"
+    assert st.synced_to_plex is True, "the dirty flag is settled so it isn't re-pushed endlessly"
+
+
+def test_should_push_resume_scopes_by_user_and_item():
+    """The throttle window is keyed by the FULL (user, item) tuple: pushing for one key must not
+    suppress a distinct user or a distinct item within the same window."""
+    now = datetime.now(timezone.utc)
+    assert _should_push_resume(9101, 9201, now, final=False) is True  # (u1, i1) first tick
+    # Same window, different item for the same user → independent, still pushes.
+    assert _should_push_resume(9101, 9202, now, final=False) is True
+    # Same window, different user, same item → independent, still pushes.
+    assert _should_push_resume(9102, 9201, now, final=False) is True
+    # And the original key is still throttled within its window (proves the above weren't just "always").
+    assert _should_push_resume(9101, 9201, now + timedelta(seconds=1), final=False) is False
+
+
+def test_resume_push_superseded_drops_older_pending_push():
+    """The write-ordering guard: an older still-pending resume push is dropped once a newer push for the
+    same (user, item) has been scheduled, so a reordered stale position can't land at Plex last."""
+    key = (9301, 9301)
+    t0 = datetime.now(timezone.utc)
+    # Schedule an initial push at t0 (records t0 as the last-push time for this key).
+    assert _should_push_resume(*key, t0, final=False) is True
+    # Nothing newer yet → the t0 push is current, not superseded.
+    assert _resume_push_superseded(*key, t0) is False
+    # A newer push (e.g. a backward seek) is scheduled at t1 > t0.
+    t1 = t0 + timedelta(seconds=1)
+    assert _should_push_resume(*key, t1, final=True) is True
+    # Now the still-pending t0 push is superseded and must drop; the t1 push is current.
+    assert _resume_push_superseded(*key, t0) is True
+    assert _resume_push_superseded(*key, t1) is False
+
+
 def test_should_push_resume_final_always_pushes():
     """A final checkpoint (pause / seek / stop) always pushes, bypassing the throttle."""
     now = datetime.now(timezone.utc)