fix(e12): the restart hint pointed at the one command that undoes a rollback

Round three, on round two's diff. The trend across the loop is 47 -> 34 -> 15 raw
findings; the ops half kept producing the sharpest ones because the gate cannot run it.

**`docker compose start` ignores a newly pinned IMAGE_TAG.** Round two removed the
automatic restart because it re-ran `alembic upgrade head` — and then told the operator to
run that exact command by hand, in both scripts and the docs. `start` relaunches the
container that already exists, which still carries the tag being rolled back FROM, so
pinning 0.79.0 and following the printed instruction brings 0.80.0 back up and re-applies
its migrations. Verified against a real daemon: after changing the pinned tag, `start` kept
the old image and only `up -d` picked up the new one. Both scripts and the doc now say
`up -d`, with the pin-first caveat where the operator reads it.

**The reset flag outlived its token.** Reverting round one's "each link clears the other"
went one step too far: a `#verify=` link pasted over a standing reset notice replaces the
whole fragment, so the reset token is gone — but `resetPending` stayed true, and being
checked first it hid the confirmation while promising a recovery that signing out could no
longer complete. The flag is now cleared when the fragment it describes is gone, which is
narrower than what was reverted and does not blank the signed-out card.

**A test that could not fail.** The shared-asset regression test seeded the asset as
`pending`, and `_reset_asset_pending` only acts on `downloading` — so the release half was a
no-op and deleting it kept the suite green. Seeded as the worker actually leaves it now.

Also: the malformed-URL guard answers with urlguard's structured detail rather than a bare
English string, so both halves of one typo class get the same localized copy, and the third
site in that module handing user input to `urlparse` was swept with it; the asset is
released after the job is terminal, not before; the Stats 403 toast gets the wizard handle
its own comment claimed it had; the pasted Windows recipe sets `$ErrorActionPreference`
inside the block (a scriptblock inherits the caller's, so a `SilentlyContinue` profile
swallowed every throw) and cleans up the container-side dump on the failure path too; the
restore warning moved to the warning stream so a `> log` redirect cannot file it away; and
two comments narrowed to what the code does.

Gate green: vitest 685, pytest 950.

backend/app/downloads/errors.py

@@ -18,8 +18,9 @@ explanation (and decides whether a retry makes sense). The raw text stays availa
 # it deliberately has no rule. Nothing re-classifies a stored `job.error` today; if anything ever
 # does, it must carry the original code rather than re-deriving one from this text.
 #
-# Other worker-raised texts (ffmpeg, "produced no output file", the urlguard refusal) are still
-# inline literals at their raise sites — pinned by markers here, but not owned here.
+# Other worker-raised texts are still inline literals at their raise sites. The ffmpeg ones and
+# "produced no output file" have markers here; the urlguard refusal deliberately has none and
+# classifies as `unknown` — it is a refusal, not a diagnosis, and no category would say more.
 QUOTA_FULL_MESSAGE = "Your download storage is full — free up space, then try again."
 NETWORK_REDACTED_MESSAGE = "The server could not reach that address."
 

backend/app/downloads/pipeline.py

@@ -570,7 +570,6 @@ def _download(
         # Fail this job only. The asset is untouched and goes back to `pending`, so another user's
         # job for the same video is claimed and downloaded normally instead of inheriting a reason
         # that is about someone else's account.
-        _reset_asset_pending(asset_id)
         msg = str(exc)[:500]
         with SessionLocal() as db:
             service.finalize_if_running(
@@ -582,6 +581,10 @@ def _download(
                 phase=None,
             )
             db.commit()
+        # Released AFTER the job is terminal: the moment the asset is `pending` another job can claim
+        # it, and this one must already be out of the way. (The staging tree is still torn down in
+        # `finally` below — the same narrow window the pause/cancel path above has always had.)
+        _reset_asset_pending(asset_id)
         log.info("job %s refused for its owner: %s", job_id, msg)
     except Exception as exc:  # noqa: BLE001 — surface any failure to the user, keep worker alive
         msg = str(exc)[:500]

backend/app/routes/downloads.py

@@ -68,12 +68,15 @@ def resolve_source(raw: str) -> tuple[str, str]:
     if raw.startswith(("http://", "https://")):
         # `urlparse` raises ValueError on a malformed authority ("http://[::1/x"), and this runs
         # BEFORE the urlguard check that would otherwise turn it into a structured refusal — so
-        # unguarded, that typo escapes as a 500. Same answer as any other unusable link.
+        # unguarded, that typo escapes as a 500. Answered in urlguard's own shape, because it is the
+        # same typo class: ":99999" is caught there and localized, and one of the two arriving as a
+        # bare English string would be exactly the split the canonical-patterns table forbids.
         try:
             u = urlparse(raw)
         except ValueError as exc:
             raise HTTPException(
-                status_code=400, detail="That doesn't look like a valid video link."
+                status_code=422,
+                detail={"code": "url_blocked", "reason": urlguard.REASON_MALFORMED},
             ) from exc
         host = u.netloc.lower()
         if "youtube.com" in host:
@@ -552,7 +555,12 @@ def _clean_url(raw) -> str | None:
         return None
     if not url.startswith(("http://", "https://")):
         return None
-    parsed = urlparse(url)
+    # The third site in this module handing user input to `urlparse`, which raises on a malformed
+    # authority. This one already has a "not a plausible URL" answer, so the typo belongs in it.
+    try:
+        parsed = urlparse(url)
+    except ValueError:
+        return None
     if not parsed.netloc:
         return None
     return url[:2048]

backend/tests/test_download_limits.py

@@ -251,8 +251,15 @@ def test_a_refusal_for_one_user_does_not_poison_the_shared_asset(db, monkeypatch
     full = _sized_asset(db, 1500, "already-held")
     _job(db, over.id, queue_pos=0, status="done", asset_id=full.id)
 
+    # `downloading` is the state the worker leaves it in — `_claim_asset` compare-and-sets it before
+    # the child runs — and `_reset_asset_pending` only acts on that status. Seeded as `pending` this
+    # assertion would pass with the release deleted.
     shared = MediaAsset(
-        source_kind="youtube", source_ref="x" * 11, format_sig="s", status="pending", ref_count=2
+        source_kind="youtube",
+        source_ref="x" * 11,
+        format_sig="s",
+        status="downloading",
+        ref_count=2,
     )
     db.add(shared)
     db.flush()