100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
peter	7360339039	fix(api): a non-finite number in a JSON body is refused with a 422, not a 500 ... The JSON parser under FastAPI accepts `Infinity`/`NaN`, and both progress checkpoints truncate the position with `int()` — a hand-written checkpoint came back as a 500 with a traceback. Their bodies now refuse non-finite floats, and the app's validation handler — FastAPI's own shape — echoes a non-finite input by name: the default one failed to serialise its own error (JSON has no NaN), which was a 500 by another route. Sibling of the subtitle routes' non-finite query parameters.	2026-09-11 03:18:17 +02:00
peter	473d9f02f2	fix(plex): subtitle windows land where the full pass does, and the extractor stops re-reading, respawning and outliving the process ... Deep-review round 2 of the 2026-09 bug hunt, over the round-1 fix diff. - A window was LATE by the distance to the keyframe its input seek landed on, and then doubled for good once the full pass merged in: a cue already running at the window's start came out at a negative time, and the webvtt muxer's default shifted the whole output so it sat at 0. Measured on the real Westworld S01E06 at 25:00: every window cue +5.005 s, 682 cues merged instead of 608. `-avoid_negative_ts disabled` keeps the times exact (the parser reads ffmpeg's signed-field spelling of a negative time); now 608/608 on that file, and a real-ffmpeg test pins it. - A full pass that failed was re-armed every minute while the viewer watched what it did publish — a whole-container read per minute. It now backs off for an hour; windows keep running meanwhile. - A failed WINDOW set the track's failure memo, so any uncovered position read "failed" — a final answer that ends the player's poll, even with the full pass about to deliver, and one any account could plant with an absurd `at`. It now marks only the span it failed to read; "failed" is given once the full pass AND a window there have both failed. - Windows join by what they COVER, not a bucketed identity: a backward seek no longer waits behind a window that cannot cover it, and a playhead crossing a bucket edge no longer queues a second read. The queue is bounded per track and overall. - shutdown() sets a flag a worker checks before it spawns ffmpeg (one still in its Plex lookup used to start a read after the kill sweep); queued-job cancellation and the lifespan call are now tested. - A window starts where ffmpeg is told to seek (rounded to the ms it gets), a rounded-up millisecond carries into the minute (no more `00:00:60.000`), a key's first publish claims nothing before its VTT lands, and `at`/`offset`/`start`/`aoff` refuse non-finite values (`at` also an absurd one).	2026-09-11 03:18:08 +02:00
peter	d2e225666b	test(playlists): let react-query's notify tick run inside act before the reopen click ... The D1 regression test patched the cache and clicked at once; react-query delivers a cache write to its observers on a setTimeout(0), so under the gate's parallel load the click could beat the page's re-render and read the old row (748, not 830). Test-only race — a human reopen comes seconds later. Stable across three full-suite runs; the D1 mutation still turns it red.	2026-09-11 01:45:53 +02:00
peter	efd95fca01	fix(ui): the card's channel name is a real link too; call sites the bug hunt left untested now have tests ... Deep-review R6 — the small items: - The video card's channel name was still a <button> (pre-existing): ctrl/middle-click did nothing there while the title above it and the player's channel name honoured them. It renders through ChannelNameLink now, which grew a forwarded ref (the clamp measurement), pass-through attributes, a `tooltip`, and an opt-in `stopPropagation` so no click reaches the card's row. - ChannelNameLink rendered an empty, still-tabbable <a> for a channel with no title yet (a stub first seen through a live search; pre-existing at this site). It falls back to the translated "Channel". - The feed's SortKey→SortOption mapping existed twice in Feed.tsx; one `feedSortOptions` in feedSort.ts serves both modes (DIRECTIONLESS is module-private again). - The backfill refresh's comment claimed a one-page cost. It refetches every loaded page of the grid, and that is the right price: backfilled videos are older, so they land below the head. Tests for call sites that could be deleted with every lane green: the channel page running the backfill refresh (knip had been blinded by the hook test's import), Feed handing the grid the live results in the chosen key AND direction, the card using the link. Plus the alt-click arm of the shared click predicate, and a plex filter-chip test that claimed it made no request while firing a real one. Verified on localdev: the feed's channel names are anchors (same 14 px muted look), a plain click opens the channel in-app. 7 mutations, each red on its assertion.	2026-09-11 01:38:31 +02:00
peter	060deb89d2	fix(playlists): "remove" inside the player targets the list it came from, reports failure, and keeps the cursor and focus honest ... Deep-review R5 — five defects in the Remove button f76a2afb put inside the YT player: - It removed from whichever playlist was selected by the time it was pressed, not the one the player was launched from; the selection can change under an open player (the command palette opens over it). The launch list is now part of the player snapshot, and the optimistic row removal only touches the list actually on screen. - A 403/404 failed in total silence: the catch claimed the global dialog had reported it, but `req` deliberately leaves those to the caller. It now notifies, as moveItemTo already did (the silent catch predates this round; the full-screen consumer did not). New key playlists.removeFailed, HU+EN. - It computed the next item from the cursor as it was when the button was pressed, but prev/next and auto-advance keep working under the confirm dialog: the viewer was thrown back onto a video they had moved past. It reads the live cursor, and if they moved on it just drops the item from the queue. - The button was disabled for the confirm's lifetime, so the dialog's focus restore hit a disabled element and a keyboard user who cancelled was left on <body>, outside the aria-modal player. A ref guards the double press instead. - Its accessible name was a bare "Remove"; it now names its object, like the row control. The call-site wiring (step on, drop from the queue, close on the last item, leave everything alone when the removal did not happen) finally has tests. Verified on localdev in the real YT player: a row reopened at the 136 s it had just stored; Cancel returned focus to the Remove button; a confirmed removal stepped 1/3 -> 1/2. 10 mutations, each red on its assertion. Scratch list and positions reset.	2026-09-11 01:28:27 +02:00
peter	4869d6c108	fix(player): the resume position reaches the playlist page and live search, not just the feed ... Deep-review R4. 1630a3df wrote the YT player's stored position into the react-query cache so a reopen could not rewind it — but only the feed actually read it back: - Playlists renders from its own undoable copy of the list, re-seeded only when the SET of ids changes, so the patched position never reached it: close a video at 830 s, reopen it from the playlist, and it resumed at the old spot and the next checkpoint wrote that over the 830. A detail with the same membership now rebases its fresh rows into every snapshot, keeping order and undo history. (The ids-only guard is older than this round; the write that depended on it was new.) - Live YouTube search results carry the same per-user position and open the same player, but their cache was never patched. It is now — patched only, never invalidated, since refetching an API-sourced search page spends 100 quota units. Tests for what had none: a Playlists harness (PlayerModal stubbed to record its launch props) and a PlayerModal harness with a fake IFrame API that records where each item is started — the latter pins that stepping back to an item watched earlier in the same session resumes at THIS session's position. 3 mutations, each red on its assertion.	2026-09-11 01:19:14 +02:00
peter	d20317e0f1	fix(plex): the collection page's watched toggle and Sort control survive the sort joining the query key ... Deep-review R3. When 889d2acf put the sort into the collection detail's query key, two things on the page did not follow it: - The watched toggle's optimistic write kept the key's old spelling. setQueryData matches exactly, so it landed on an entry nothing reads, and its resync only invalidates the library root — the click succeeded server-side and changed nothing on screen (badge, icon, aria-label) until a reload; a second click toggled it back. One `detailKey` now serves the read and the write. - Every sort change was a key with no data yet, so the whole page — hero, grid, and the Sort control with its open panel — was swapped for a spinner, and focus fell to <body>: key and direction could not be set in one visit. The previous page now stays on screen while the new order loads, for the SAME collection only (stepping to another must not show this one's hero meanwhile). Verified on localdev (Rocky Collection): the toggle flips the poster; IMDb rating then Descending set in one open panel, the hero never blanked, order reversed. 3 mutations, each red on its test.	2026-09-11 01:12:51 +02:00
peter	d2ba65e383	fix(plex): the subtitle poll backs off on errors, a failed <track> is replaced, and a resume asks for the right window ... Deep-review R2, plus one defect found while verifying it on localdev. - The status poll re-armed every second after a FAILED request: `data` stays empty on an error, so it read as "still preparing" for as long as the player was open — and the request was not quiet, so a persistent 500 re-opened the global error dialog every second. It now backs off to 10 s (a blip still heals on its own) and is quiet; the player already shows the failure inline. - A <track> whose own VTT fetch failed never fetched again: with the server's answer unchanged its key was unchanged, so React kept the dead element — silently blank subtitles. The key (now built in the hook, where it is tested) carries a failed-load count; after two remounts the track is reported as unavailable instead. - Found in UAT: until the first timeupdate `abs` is 0, so after a resume every poll said at=0 and the first window was cut around the head of the film (a resume at 20:00 polled at=0 for as long as it stayed paused). The poll reports the session's start until playback ticks. And the window's dedup identity is the track plus a window-length bucket of its start — keyed on the track alone (R1), the right window queued behind that wrong one. The poll's start/stop rules finally have tests (every earlier one resolved a single fixed answer). Verified on localdev against Westworld S1E6 resumed at 20:00: the polls carried at=1197, one subtitle line on screen at 21:02, the poll stopped at `ready`; the real file's window (56 cues) + full pass (608) merged to 608 — the old merge would have served 664. 11 mutations, all red.	2026-09-11 01:08:27 +02:00
peter	cf7ec5e9ec	fix(plex): the subtitle extractor's seams — doubled cues, a truncated track cached as whole, a poll that respawned ffmpeg ... Deep-review of the bug-hunt round (R1). The background extractor from ed4ab4e1 held, but its seams did not: - Window + full pass doubled every cue in the first hour. merge_vtt de-duplicated on the raw timing text, and the two passes spell a timestamp differently (shift_vtt writes HH:MM:SS.mmm, ffmpeg's webvtt muxer drops the hour below 1 h; shift_vtt(-0.0) never normalised the full pass). Timing is now parsed and re-emitted canonically, keyed with the cue text so two cues sharing a time survive. - A full pass that exited non-zero was published as complete: "ready" forever, subtitles ending where ffmpeg died, and no eviction to ever retry. It now covers only up to its last cue, is never complete, and records the failure memo. - The window's dedup identity held the live playhead, so every 1 s poll queued another read of the file. It is keyed on the track now, and a queued job re-checks coverage before reading anything. - A sidecar track waited behind an unrelated embedded full pass (the full job is per item). Its window job now fetches it whole — one small request. - The <track> fetch ran the scheduler at position 0: an unrequested window over the head of the file, and a refusal of a window that was on disk. It is a pure read of the cache now. - publish() is serialised (a lost update became permanent once complete was set); the pool is shut down and running ffmpeg children killed at app shutdown (they held interpreter exit for minutes); ?at=inf is a 422, not a 500; and both subtitle routes use current_user instead of the cookie-only poster gate, which let a suspended or epoch-revoked session keep scheduling reads (pre-existing). _extract_and_publish finally has tests of its own — every earlier test stubbed it out. 19 mutations, each red on the assertion that names it.	2026-09-11 00:52:59 +02:00
peter	f76a2afbf1	feat(ui): the four small gaps — player delete, repeat-move, a real channel link, YT search sorting ... Items 2, 4, 5 and 7 of the bug hunt, one round. They are independent, but they are all the same kind of thing: an action that exists somewhere else in the app and is missing where you actually want it. **5 — the channel name in the YT player is a link again.** It was a `<button>`, so middle-click and Ctrl/Cmd-click did nothing on a thing that looks exactly like a link (the YouTube icon beside it IS an anchor and opens a tab). It is now a real `<a>` whose href is the same `?chan=<id>` URL `openChannel` pushes, with a plain left click still taking the in-app path — that path does more than navigate, since the player must close and reclaim its own Back-to-close history entry first. The "is this click ours or the browser's" test is now ONE predicate (`isPlainLeftClick`), which VideoCard's card link also uses, so a second such link cannot forget the middle-click arm. **2 — "Remove" from inside the player.** The parent owns the removal (the SAME `removeItem` the row menu and the inline ✕ use: one confirm, one optimistic update, one undo-stack rebase), and the player owns what happens next, because it is the only side that knows which item is playing — its launch queue is frozen at mount. It drops the item, plays what followed, and closes when the list runs out. That forced a real fix in Playlists: the player's mount was derived from `shown` every render, so anything that dropped the launch row yanked the player off the screen mid-playback. That was a latent edge (change the view and it happens) and the normal case for this feature. The parent now snapshots what it launched with, and only onClose takes the player down. **4 — "Move to <the last list you moved to>".** The submenu is two levels deep and moving a run of videos into the same list is the shape this gets used in. The remembered id is a per-account pref; the row is derived from `moveTargets`, which already excludes the list you are looking at, so it cannot offer a move to where the video already is. Remembered only on a SUCCESSFUL move — a shortcut to a move that failed is a shortcut to failing again. Absent, not disabled, when there is nothing to repeat: there is nothing to explain. **7 — the live-YouTube results can be sorted.** Client-side, over the page already loaded. Not a new `order=` param, and this is the decision worth recording: the owner's case is "even one page of results", i.e. reorder what is on screen; a re-query would REPLACE the results, which is not what "sort these" means; and the zero-quota scrape source has no order parameter at all, so a server-side control would silently do nothing (or quietly cost 100 quota units) depending on which source served the page. Only keys a search hit carries are offered — `subscribers`/`priority` describe a subscription, which a search hit is not, and `shuffle` on a ranked list is noise. Its own pref, so sorting a search page never re-sorts the library behind it. Verified in the browser on localdev against the real account: the channel name renders as `<a href="…&chan=…">` and a ctrl-click / middle-click is left to the browser while a plain click still opens the channel in-app; removing from the player stepped 1/3 → 1/2 onto the next video and closed on the last one; the row menu grew "Move to “…”" only after a move and only on a list that is not the target; and the results sort reordered by views 41.7M → 29.8M → 24.2M → 15.8M. (The pane's own ctrl-click arrives without the modifier — a harness limit, so the modifier cases were driven as real MouseEvents.) Scratch playlists and the touched prefs were cleaned up afterwards. 22 vitest, mutation-checked against 14 mutations (no href at all · href without the rest of the query · every click hijacked in-app · the middle-click arm dropped from the predicate · plain click no longer in-app · always jumping to the top of the list · the removed item left in the queue · no clamp when the last item goes · an empty queue not reported as "nothing left" · sort-then-reverse flipping ties · unknown values first · titles compared numerically · shuffle offered on search results · direction ignored) — each red on exactly the test that names it. Item 4 has no test of its own: its rule is enforced by construction, not by a check.	2026-09-10 22:34:12 +02:00
peter	889d2acf52	feat(plex): the collection page sorts, and a linked collection has a name ... Two halves of the same report ("Collectionben nem működik a rendezés?"). The pasted browse URL sorts correctly — that part was working. What did not: The Collection INFO page had no sort control at all and a hardcoded release-year-ascending order. It now shows the browse grid's Sort control, with the browse grid's vocabulary, because a second sort vocabulary on a neighbouring surface is exactly the kind of drift this repo keeps paying for: `PLEX_SORT_KEYS` is now one tuple in `plex/query.py`, and a test pins BOTH implementations to it — browse's key→column map (extracted from the handler to be reachable) and the collection page's key→member map. A key added to the vocabulary without teaching one of them fails the gate instead of putting a dead option in the menu. Ordering a collection cannot be a single ORDER BY: its two legs are different tables, so the merged member list is sorted in Python. Members with no value for the key sink to the END in both directions (a movie with no rating is not "the worst rated" — the browse grid's `nullslast()`), and ties always resolve title-ascending, so flipping the direction reverses the ranking rather than the alphabet inside it. `lastwatched` needed the show leg's `resumed_at`, so the page now takes ONE rollup pass that yields both the badge status and the recency instead of the status alone — without it that menu entry would have ordered every show as never-watched. The default stays release-year ascending: a franchise reads in release order, and that is what the page did before. The other half: a shared Plex link carries the collection filter as bare rating_keys, so a link opened cold had no name for them — the sidebar token rendered `17045` and the chip could only say "Collection". `GET /api/plex/collections` takes a `keys=` CSV now, and a display-only hook resolves just the missing ids. It deliberately does NOT write them into `collectionTitles`: that map is hashed into the Plex query keys, so storing a resolved label there would split the cache from the identical state and refetch the grid for a piece of text. Verified in the browser on localdev against the real Plex library: the movie collection's menu offers Length and the show collection's does not (the same scope rule as browse); rating-ascending reorders 8.1/7.4/7.2/6.6/6.5 correctly; `lastwatched` on a show collection brings the in-progress shows up; the choice survives a reload (it is a server pref, on its own key so opening a collection never re-sorts the library behind it); and the reported URL now reads "Pirates of the Caribbean Collection" in both the sidebar and the chip. 12 pytest + 8 vitest, mutation-checked against 14 mutations (direction ignored, nulls first, no stable tiebreak, unknown key untouched, wrong default, show recency dropped, empty `keys=` falling through to everything, a key missing from either sort map, every id refetched, ids unsorted, fetched titles unmerged, the chip ignoring them, the hook's result never reaching the builder) — each red on exactly the test that names it.	2026-09-10 22:05:39 +02:00
peter	782362b808	fix(channels): the video grid follows a running backfill instead of freezing until F5 ... "Get full history" on a channel page left the list on the cards the channel already had. The count above it climbed into the thousands, the grid did not move, and only a browser F5 brought the rest in. The mechanism: the backfill runs in a BackgroundTask, so the PATCH that starts it returns before a single row is written — and the mutation invalidates `qk.feed()` on that RESPONSE, which just refetches the OLD catalogue. Nothing afterwards refetches it: the feed's infinite query has no interval, and the app-wide defaults are `staleTime: 30s` + `refetchOnWindowFocus: false`. The job emits no event either (the realtime layer only carries messages today), so the channel detail's 4s live poll is the only thing in the app that sees the job progress — and it refreshed only `qk.channel`. So the poll now drives the grid too: on a tick where the stored count moved (or the backfill finished), it invalidates `qk.feed()` and the `qk.feedSummary()` behind the count pill. The window is the poll's own (`deep_requested && !backfill_done` on the previous reading), so a detail refetch caused by some other mutation — each of which invalidates the feed itself — cannot come through here twice. Measured on localdev against the real account, same instrument, `document.visibilityState` forced visible (the poll deliberately pauses on a hidden tab, and a headless pane reads hidden — without that the first measurement was about the harness, not the fix): before — CASCADA 19 -> 176 stored: the header updated live to "162 normal", the grid and its count pill sat on "5 items" for 50s. after — fern 54 -> 139 stored: "54 items" -> "139 items" by ~12s, no reload. 6 vitest, mutation-checked against six mutations (no invalidation at all; grid only, count pill forgotten; predicate ignored; no channel-identity guard; completion with an unchanged count dropped; poll-window guard dropped) — each one red on exactly the test that names it.	2026-09-10 20:56:16 +02:00
peter	5a42d76e8a	feat(plex): an off-by-default loudness normalisation toggle for playback ... Bug hunt 2026-09, item 14 — "how does the multichannel downmix work, and is it normalised?" It isn't: `plex/stream.py` has always encoded `-c:a aac -ac 2 -b:a 192k`, i.e. fixed stereo with ffmpeg's default downmix matrix and no loudness handling at all, which is why a film mastered for a cinema arrives with whispered dialogue and deafening action. New admin knob `plex_audio_loudnorm` (Configuration → Plex), DEFAULT OFF: it makes a film markedly louder and narrows its dynamic range, which is a taste call rather than a fix. It sits at the end of the Plex group, after the software-transcode knobs — it is an audio concern, not one of the libx264 ones. -af aformat=channel_layouts=stereo,loudnorm=I=-16:TP=-1.5:LRA=11,aresample=48000 Three things about that chain are load-bearing and each has a test: * the downmix is FORCED FIRST rather than left to `-ac 2` — measuring 5.1 and folding it down afterwards would normalise something other than what is heard; * the trailing resample is not decoration: `loudnorm` runs its own resampler at 192 kHz internally, which the AAC encoder will not take; * one `-af`, no stream index, so EVERY audio rendition of a multi-audio file is normalised — not just the first. The knob is also part of the session directory name (`…_multi-ln_+0.00`), because it changes the audio the segments contain, and a session left over from before the admin flipped it must not be mistaken for one that honours it. The suffix is appended with a DASH: `_SESSION_DIR_RE` treats the tag as one underscore-free field, and that regex is the only thing keeping the orphan sweep off what may be a shared scratch path. A test pins both halves — the name changes, and the sweep still recognises it. Measured end-to-end on the app's own HLS segments (a real 5.1 AC3 file, same item, same 160 s offset, same ten segments): OFF -35.2 LUFS, ON -17.2 LUFS. On a 60 s bench: I -27.6 → -16.6 LUFS with LRA 13.3 → 9.8 LU. A/V sync is untouched — under this pipeline's own `-copyts` the audio start PTS is identical with and without the filter, so the 3 s lookahead desyncs nothing. Direct-played files are served untouched and stay so; a 5.1 mix is always `remux`, so the reported case is fully covered.	2026-09-10 20:02:06 +02:00
peter	ed4ab4e13c	fix(plex): subtitles stop blocking the request, and stop re-reading the file ... Bug hunt 2026-09, items 8 and 12 — the two things the Plex player was measurably lying about. Item 8: picking a subtitle track showed nothing for a long time, and the reported workaround was to stop/start until it suddenly worked. Measured on prod against a 17.06 GB MKV with two embedded SubRip tracks: full pass, one track 154 s full pass, both tracks in ONE run 111 s -c:s copy (no WebVTT conversion) 143 s from 1:00:00 to the end of file 66 s a 630 s window at 1:00:00, both 8 s So the conversion was never the cost: ffmpeg streams every byte of the container between its seek point and its stop point, and the array delivers ~140 MB/s. The only lever is reading less. Three changes follow from that: * a window around the playhead is extracted and published FIRST (seconds), and the full pass completes behind it; * every embedded text track rides that same single read — picking Hungarian used to cost a full pass and then switching to English cost another one; * none of it happens inside a request any more. The endpoint answers 202 while a background worker extracts, the player polls /status (carrying its position, so the window follows the viewer), and one ffmpeg run finally has a timeout. -copyts is deliberately absent from a windowed pass: with it ffmpeg ignores -t and reads the whole container anyway (measured — a [0, 600 s] window still took the full 145 s), so a window comes back on a zero-based clock and is shifted to absolute time here. Cached tracks written by older builds have no coverage sidecar and count as complete, so nothing is re-extracted after the upgrade. The <track> is no longer mounted before the server has something to put in it; a "Preparing subtitles: …" notice stands in, and a track that can never be shown says why instead of leaving the viewer to conclude the picker does nothing. Item 12: "Bitrate" read a constant 211 kbps on every remux, because it was the master playlist's BANDWIDTH — which ffmpeg derives from the one stream whose rate it knows, the -b:a 192k AAC track, plus 10%. It is a measurement now: bytes per second of MEDIA from hls.js FRAG_LOADED, accumulated per fragment type and summed (a multi-audio session's video and audio renditions cover the same media seconds, so pooling them would report half the truth), and an honest dash until the first fragment lands. The panel also finally names the audio and subtitle track in play. Verified in the browser against the real Plex library, and every new test mutation-checked.	2026-09-10 19:31:05 +02:00
peter	b8bff504d8	fix(plex): "Clear resume point" now tells Plex about an in-progress item ... The button deletes the local row and mirrors the un-mark to Plex, but it decided whether to push from the previous STATUS alone (prev_status != "new") — and an in-progress item's row is status="new" carrying a position, which is exactly how the importer maps a bare viewOffset. So for the single case the button exists for, nothing was ever sent to Plex: the offset stayed, and the next pull imported it straight back. The user cleared Protector twice and it returned to Continue watching at 92s both times. Push now when Plex holds anything to clear — a view count, or a resume point. "hidden" stays Siftlode-only and pushes nothing, which is what this endpoint's docstring always claimed and the status-only guard contradicted. One unscrobble clears BOTH viewCount and viewOffset — measured against the live server from a watched+offset state and an offset-only one, so the push itself needed no change. The client docstring that claimed "clears viewCount" is what sent the first diagnosis down a wrong path (a timeline write with time=0, which does not clear an offset at all); it now records what the server actually does. Verified end to end on the real Plex server: the button leaves viewCount=None viewOffset=None, and a full 44,885-item re-import brings back no row for it.	2026-09-09 23:55:51 +02:00
peter	1630a3df3c	fix(player): the YT progress checkpoint reaches the cache, so a reopen cannot rewind it ... The player checkpointed every 5s and the server stored it, but nothing wrote the new position back into react-query: the close path only marked qk.feed() stale with refetchType "none", and nothing refetches the feed until it remounts (staleTime 30s, refetchOnWindowFocus off). So the resume read the position the cache had been FETCHED with, and the next checkpoint then persisted that older value over the newer one. Measured on localdev: played to 830s, closed (server had 830), reopened the same card without a reload -> the row was back to 751s. 79 seconds of progress destroyed by a reopen, and the card's progress bar never moved either. The Plex player already solved this for its detail query, with a comment describing the identical failure; this is the feed-side twin that was missed in that sweep. patchCachedProgress writes the position the SERVER stored (the endpoint clears trivially-early and near-finished checkpoints to 0, so mirroring our own reading would disagree with the row) into every cached feed page and playlist detail, keeping array identity where nothing changed. A session map covers the second half: the launch queue is frozen at mount, so stepping next->prev back to an item played earlier in the same session resumed from that snapshot. Verified in the browser: 811 -> close 816 -> reopen 825, and the card now shows Continue/Restart.	2026-09-09 23:55:51 +02:00
peter	14b5fe2e31	release: 0.83.0 (feature/e24-anti-paralysis)	2026-09-09 22:04:14 +02:00
peter	d260aabfd7	chore(release): 0.83.0 — the Home surface	2026-09-09 22:01:33 +02:00
peter	d832bb19ce	fix(e24): review round 4 — a test that pinned nothing, and prose still ahead of the code ... Round 4 reviewed round 3's commit. Nothing in production behaviour was wrong; what was wrong was the round's own test and its comments, which is the failure class this loop keeps finding. - The new NavigationProvider case named after the `&& !channelViewRef.current` clause never reached it. With storage cleared and a bare URL the provider lands on "home" (E24's own default), not "feed", so asking for "feed" was an ordinary page change and the guard's first conjunct short-circuited. Deleting the clause left all 828 tests green — a dead nav control (the rail's own module stops closing an open channel page) with no red anywhere. The test now asserts the precondition and calls `setPage` with the page that IS current. - Both new Home cases rejected a promise and then asserted after one fixed macrotask. React-query notifies through `notifyManager`'s own `setTimeout(0)`, registered after any timer the test schedules, so the assertion raced it; two reviewers measured intermittent reds. They poll for a signal that the rejection LANDED instead — the reroll button releasing, which is also the honest one for the empty-answer case, where the empty state is already on screen while the press is in flight and asserting it early would pass either way. - `buryUnder`'s comment still opened with "one rule for both entry points" ten lines above the paragraph saying the rule is complete only for one of them, listed the non-reporting palette rows without `openChannel` — which has its own `replaceState` no-push branch and is reached from PlayerModal too — and pointed at a ROADMAP.md this repository does not contain. - `history.dom.test.ts`'s header claimed its layers close by genuine Backs only, which two of its own tests contradict; and `CommandPalette.ordering.dom.test.tsx` still claimed to be "the only assertion in the suite" doing what the file corrected in round 3 also does. Round 3's message said that pair was handled and only one side had been. The provider test was re-mutation-checked (dropping the clause now goes red), and both hardened Home tests still go red against their own reverts. Seven consecutive full runs green. Gate: ruff, ruff format, 3x tsc, eslint (0 errors), prettier, knip, vitest 828, pytest 1005.	2026-09-09 01:02:22 +02:00
peter	59efc8f2e8	fix(e24): review round 3 — the holes round 2's own fixes left ... Round 3 reviewed the round-2 commit across six dimensions. Fifteen findings, five survived three adversarial refuters each; three died on 2+ refutations (a keyboard-focus claim that is a property of `ui/Button` at all six of its `loading` call sites, a contract-test false-pass that needs a deliberate revert plus a self-incriminating comment, and a MAX_EXCLUDE coupling whose slice is unreachable from the real client). - `rerolling` was still wrong for a FAILED press. `data === undefined` is true forever for a key whose request failed (`retry: false`), so the next unrelated mutation re-disabled the reroll button — the same defect round 2 reported, one branch over. `!isFetched` is the flag that remembers a key settled; `!isError` would not have worked, because query-core resets a data-less query to "pending" for the duration of a refetch, hiding the error exactly when it matters. - The hero fallback used `??`, which cannot tell "this budget's last pick resolved to NO hero" from "nothing remembered". So a press that failed after an empty one resurrected the card the page had already excluded as seen and just said it had nothing beyond. The tagged slot is now authoritative for its own budget. - `setPage`'s boolean — the input the whole burial rule reads — was asserted by nothing. The type fences the SHAPE, so deleting a `return` fails tsc, but swapping the two values passed typecheck and all 822 tests. NavigationProvider gets its first render test, on the value AND on the effects the early return skips. - `closeThenNavigate`'s door into `buryUnder` was equally unpinned: reverting that one call site to the old unconditional burial left the suite green. It has the mirror case now. - The comment claiming one rule serves both entry points was overstated. `buryUnder` fails OPEN, and `CommandItem.run` is typed `() => void`, so only the palette's bare `() => setPage(page)` rows forward the boolean at all. Nothing regressed — that path buried unconditionally before — but the prose said more than the code does, so it now says what is true and points at the deferred fix. Same for a "the only assertion in the suite" claim that the file it cites as precedent also makes. Every new test mutation-checked red for the right reason, both edges where there are two. Gate: ruff, ruff format, 3x tsc, eslint (0 errors), prettier, knip, vitest 828, pytest 1005.	2026-09-09 00:39:37 +02:00
peter	e4ffd59ca7	fix(e24): review round 2 — a buried history entry, a stale hero, and a spinner that was not ours ... Nine of the round's ten surviving findings. The tenth (a failed shelf reorder leaving an order the server rejected on screen) is on ROADMAP.md: its obvious remedy reintroduces the overlapping-move defect the code already documents, so it wants a design, not a review edit. - `navigateOverOverlays` buried the live overlay entries before knowing whether the navigation pushed one. `setPage` no-ops when the page is already current and Home is the default landing page, so Shift+W over a player ON Home marked its entry buried under a push that never happened: the unmount consumed the mark instead of reclaiming the entry, and the next browser Back was a press that did nothing. `setPage` now reports whether it navigated, and one `buryUnder` rule serves both entry points — `closeThenNavigate` takes the same no-op navigation from a palette command for the page you are already on. - The hero could answer a new time budget with the previous one's pick. The chip row resets seed/seen/press but cannot reset an answer that already resolved, and `keepPreviousData` chained through the disabled seed-0 query — so a reroll under "10 perc" showed the film picked for "Bármennyi" while it loaded, and kept it if the request failed. `lastPick` now carries the server's own budget echo, and the placeholder is scoped to the budget. - The reroll button spun and swallowed clicks after mark-watched, bookmark, pin and shelf moves: the pick key sits under the invalidated `discover` prefix on purpose, so raw `isFetching` was true for background refetches. It now means "a press of mine is outstanding" — which still covers the first press, where there is no placeholder. - Failed writes on Home toasted the page's LOAD-failure string over a fully loaded page; they get their own key (HU+EN). The empty-state reroll had no `loading`, so the press was unacknowledged and a second click skipped a tier. `danger` moved into the shared unpin row so the same command is not red on the shelf and neutral in the rail below it. - Two comments claimed things the code does not do: the `exclude` cap guards no "unbounded scan" (it never reaches SQL), and the route test that named the cap sends three keys. Tests: the burial rule gets its own file (it is the one assertion that lets a reconcile issue a real programmatic back()); App's keymap wiring gets a source contract, because dropping it left all 818 tests green; `add_pin`'s IntegrityError arm was reached by nothing. Every new test mutation-checked red, both edges where the predicate has two. Gate: ruff, ruff format, 3x tsc, eslint (0 errors), prettier, knip, vitest 822, pytest 1005.	2026-09-09 00:12:53 +02:00
peter	3709b71a94	fix(e24): the review's low findings — dead constants, honest labels, a 500 that should be a 404 ... `add_pin`'s IntegrityError handler assumed the unique constraint was the only way in and re-raised otherwise, so a target row pruned between `resolve_ref` confirming it and the INSERT (a Plex sync dropping a removed item) tripped the FK and handed the user a 500. Semantically that is the same "no such thing" the pre-check already returns. Untested: the race needs two concurrent transactions. The five per-kind unique constraints had no test at all — the route's own dedupe returns before reaching the DB, and the migration drift check filters constraint diffs out as noise, so they could go missing with every lane green. Frontend, all from the same review: the shelf's unpin row is now `danger` like every other destructive row in the app; the hero's artwork button says what it will actually do and names the item instead of always announcing "Play"; the empty-budget message offers a reroll rather than `StateMessage`'s "Retry", which promised a re-run of something that had not failed; `setState` and the watch-later toggle catch their rejections instead of leaving an unhandled promise and a click that silently does nothing. `StateMessage` gained a `compact` rung, which retires the frontend's only two `!important` overrides — they existed to beat the primitive's own padding from the call site, and were the copyable idiom for the next surface that wanted a compact empty state. Dead vocabulary removed or made load-bearing: `DISCOVER_BUDGETS` was exported, re-exported and consumed by nothing while `Home.tsx` re-typed the same four bands (a `readonly DiscoverBudget[]` accepts any subset, so a fifth band would have typechecked green and rendered no chip); `PIN_KINDS`' value export had no consumer at all; `useComfortPin` no longer publishes `pinIdOf`/`toggle`, which nothing outside the module calls. Three comments corrected against the code they describe: a pointer to a `resolve.py` that was never written, the file header's claim that Home defines no card component of its own, and the `seen` window still quoting the 8 that was measured and abandoned for 32. The rest of the review's survivors are logged on ROADMAP.md under "Deferred — E24 epic-end deep-review (2026-09-08)" — the ones whose dissent was substantive, and the ones whose fix is wider than the finding.	2026-09-08 03:23:59 +02:00
peter	cedebe0ffb	test(e24): close the review's coverage gaps, and correct a comment that was untrue ... `test_only_a_show_row_pays_for_a_resolution` seeded no watch state, so every rail query inner-joined its way to zero rows and the loop body — with it the assertion — never ran. It now seeds a video, a movie and an episode, and asserts all three kinds are present before the loop, so it cannot go vacuous again. The Plex half of the surprise rail had no test for either of its promises: every test that reached `plex_surprise` passed budget="any" against a library with no state rows, so the duration bounds and the already-started exclusion could both be deleted with the suite green. The YouTube half has had tests for the same two rules since S1 — the asymmetric half of one principle. `plex_item` and `plex_show` — two of the five pinnable kinds — were pinned by no test at all, leaving the rating_key → internal-id translation and both shelf arms uncovered, including the self-reference cycle that once 500'd the shelf. And `GET /api/discover/pick` was exercised only through its domain function, so the route's own query-string translation could regress silently; the new test excludes all three candidates, which is what proves the whole list parsed rather than one unsplit string. `PIN_COLUMNS`/`PIN_KINDS` claimed in a comment to be the one place the pin vocabulary is spoken and had no readers anywhere: `resolve_ref` re-spelled the column names and the route re-typed the kind list. Both now drive off the constants. The `_NO_TS` sentinel was introduced as a crash fix and is not one. The key it replaced, `(ts is not None, ts)`, cannot raise — tuple comparison finds the first UNEQUAL element via `==`, so two null keys compare equal and `None < None` is never reached; three independent runs confirmed it over every permutation. The rationale now says what the sentinel actually buys, lives once in `plex.rollup`, and the third rail that was still on the older spelling has been swept to match. Its test is renamed and re-scoped to the mutation it does catch. Frontend: the reroll's second press asserted `expect.any(Array)`, which cannot tell an accumulating exclusion window from a replacing one — both that and SEEN_WINDOW = 1 (each reinstating the measured nine-card cycle) left the suite green. And `onInfo`'s jump type was untested while `onPlay`'s was pinned twice, so pointing the ⓘ affordance at the player typechecked and shipped green. All eight fixes mutation-checked; every mutant died on its intended test.	2026-09-08 03:14:21 +02:00
peter	fdc1eabbe0	fix(e24): the review's seven frontend defects on the Home surface ... Shift+W was dead whenever anything was open. The global handler called `setPage` directly, so the page change unmounted the player (it lives inside the module column) and that unmount's reconcile reclaimed the entry the navigation had just pushed — the player closed and the page snapped back. `closeThenNavigate` cannot serve here: a global key does not know which overlay is open, or whether one is. `navigateOverOverlays` is the same fix one step shorter — bury the live overlay entries first, so the unmount consumes the marks instead of issuing `history.back()`. `q.isError` had no `&& !data` guard, alone among 33 call sites and against the convention `ui/QueryState` documents: react-query flips status to error on a failed REFETCH while keeping the payload, and every mutation here invalidates the discover prefix, so one blip while marking a card watched blanked a fully populated landing page. The reroll's key rooted at "discover-pick", outside the prefix every mutation invalidates, so a rerolled hero outlived the page: play it, finish it, and it was still the answer with a zeroed progress bar. It now sits under the same root. A FAILED reroll also rewound the hero to the card the page loaded with, several presses back, because a new key per press means `keepPreviousData` (pending-only) cannot cover an error; the last resolved pick is held instead. The bookmark on a rail tile never updated — `VideoCard` reads `video.saved` from this payload and keeps no optimistic state — so the star stayed empty and the next click re-sent the same call. The shelf reorder wrote a captured snapshot back on failure rather than re-asking the server, which its own comment promised: two overlapping moves each reverted to their own snapshot and settled on an order neither side held, and since `before` is the whole payload a rollback also discarded any rail refresh that had landed meanwhile. It now invalidates the discover PREFIX on settle, which also fixes the sibling budgets keeping the pre-move order. The hero/rail de-duplication matched one key, so for a Plex series — the rail row is the show, the hero is the episode it resolves to — the same series printed twice; it now matches both keys, as `hero.pick`'s own exclusion already did. And when the hero empties the resume rail, the rail is hidden rather than announcing "nothing half-finished right now" under a hero captioned "where you left off". Ten regression tests, all mutation-checked. Three of them were rewritten after the first mutation round showed they could not go red: two asserted before the state under test had settled, one matched a title the Plex tile does not render.	2026-09-08 03:03:45 +02:00
peter	84f4b20e5a	fix(e24): the review's three backend defects — blocklist, shelf order, next episode ... The resume rail built its own SELECT instead of going through `filtered_query` and copied only three of its predicates, so it dropped the per-user channel blocklist the module docstring claims it inherits. Blocking a channel never touches `video_states`, so a half-watched video from it kept its resume position and headed the rail — and, at the default budget with the resume tier leading, became the landing page's hero: the app answering "what should I watch" with the thing the user had just banned. The clause is now `feedquery.not_blocked_cond`, shared with `filtered_query` rather than copied a second time; the feed's SCOPE clauses stay deliberately unapplied, for the reason `yt_video_row` already gives. `next_position` returned the shelf's row COUNT while nothing ever renumbers positions — `remove_pin` deletes, and every FK cascade removes a pin when its target disappears. Past the first hole the count under-counts, so a new pin landed in the middle of the shelf and, past the second, on a position another pin already held. `max(position) + 1`, the idiom `routes/playlists` already uses. `next_episode` took the FIRST in-progress episode in broadcast order while `plex.rollup`, which drives the show page's Resume button, takes the last. One show therefore had two different "continue watching" answers, with the Home tile ranking it by its most recent touch and then offering the episode abandoned weeks earlier. The new test asserts the two implementations against each other rather than against a literal. All three mutation-checked: each new test goes red for the defect it names.	2026-09-08 02:32:08 +02:00
peter	828dad015c	feat(e24): reach the Home surface — the landing toggle, a palette command, Shift+W ... S4's reachability half. Home already led the nav order; what was missing was every way IN other than the rail. - Settings → Appearance → Startup: "Start on Home", the documented escape hatch for the landing override. Deliberately still localStorage and not a server pref — `loadInitialPage` answers before /api/me lands, and a landing module decided after the first paint is a visible jump. Its two stored values are now ONE exported constant, so the writer and the boot-time reader cannot drift on a magic string. - The command palette gets "Meglepetés" / "Surprise me": it navigates to Home and rerolls the hero on arrival. No second "Mit nézzek?" row beside it — the Home module row already matches that phrase through its descriptive title. - A global Shift+W jumps to Home. A chord, not a bare `w`: the Plex player binds bare letters and `w` sits on `s`, so a blind reach for the subtitle key would have thrown a viewer out of the film. The palette's request crosses a lazy module boundary, so it is a token that waits (lib/homeIntent) rather than an event fired into an empty room. Browser-measured: taken with a compare-and-clear, because StrictMode's double-invoked mount effect otherwise rerolled twice and landed on the page two picks deep. HU/EN parity kept; UAT on localdev in both languages, including the empty shelf.	2026-09-08 00:06:34 +02:00
peter	82914b56ca	fix(e24): the Home surface's three UAT findings — Back, the reroll, and a show card ... All three were measured before they were touched, and the diagnosis moved twice. **Back from a Plex title played off Home landed on the Plex module's root.** One click pushed three history entries: the page navigation, the sub-view opened by the `jumpTo` hand-off, and — under StrictMode, whose effect body runs twice before `setJumpTo(null)` re-renders — that same sub-view a second time. So the first Back visibly did nothing and the second stranded the user on a Discover page they had never visited. A cross-module hand-off is the CONTINUATION of the navigation that brought you there, not a second navigation, so it now REPLACES the page entry instead of stacking on it (`useHistorySubview.open(view, {replace})`, asked for by the jump target). Replacing is also idempotent, which is what disarms the StrictMode double-run. The intent rides on `PlexJumpTarget` rather than being inferred, because the header typeahead jumps from INSIDE the module, where the entry being replaced would be a sub-view the user really was looking at. **"Mást kérek" cycled nine cards and never left the resume tier.** Measured: twelve presses, nine distinct titles, period nine, every one `tier: "resume"` — the shelf and the surprise tier were unreachable by pressing the button. Two causes multiplied: the tiers were tried in a fixed priority order over a 20-row resume rail, so the button just walked down it; and the client's rolling exclusion window of 8 guaranteed the wrap. The press count now rotates which tier answers first (`start`), so each press offers a different KIND of answer — the user's call, given the choice between that, a wider window, and a surprise-only reroll. The fallthrough is kept, so a press does not come back empty because the tier it led with had nothing. The window is matched to the server's own cap rather than a smaller number of ours. **A half-watched series on Home opened the show page.** A movie already went straight to the player; only shows did not — and the comfort shelf and the hero both resolved a show to its next episode while this rail alone did not, handing back six seasons to choose between. The rail row now carries `next`, and the client already played `next ?? card`, so this is a backend fix. Affording it needed `queries.next_episode` to stop loading every episode of the show into Python to pick one of them (236 rows for Friends, 227 for JAG) — three ordered LIMIT 1 probes instead. The show→episode rule now lives in ONE function (`rails.playable`), which is what the shelf, the hero and the rail all call; two implementations are how they came to disagree. Ten mutations run, all ten red for the right test — including a first pass where the press count reached `api.discoverPick` and stopped there, invisible because every Home test mocks that module. The slice now has its own URL test. Verified in a clean browser tab against the live account: one Back returns to Home, the rotation gives resume/comfort/surprise across nine presses with no repeat, and Westworld opens at S1E1 rather than at its show page.	2026-09-06 05:38:28 +02:00
peter	ccd5f3739a	feat(e24): pin to the comfort shelf from every card and row ... S3 wires the shelf's editor. The gesture is the E10 right-click menu, so the decision "this is comfort media" can be made where the thing is — the feed, a Plex grid, a channel row, a playlist — rather than only on the page that lists the shelf. One shared piece, `components/comfortPin.tsx`: the five pin-kind constructors, the shelf query, and ONE `ActionMenuItem` that switches Pin/Unpin honestly (and says "not known yet" with a disabled row until the shelf has answered, since a confident "Pin" over something already pinned is exactly the quiet lie the house rules forbid). Surfaces that already have a row menu compose the item in (`Playlists`, `PlaylistsRail`); the rest mount `ComfortPinMenu`. Two structural notes: - The feed's menu lives in `VirtualFeed`, not in `Feed` — that is the list, and it is also what gives the channel page the gesture for free, since it renders `<Feed channelScoped>` all the way down. - Cards take `menuProps` as a FUNCTION of the row, not the built props object. `triggerProps` is stable across renders while its return value is not, and a fresh object prop would blow past `VideoCard`'s memo for every card in the virtualized feed on every parent render. `DataTable` and `ChannelLayoutGrid` grow a generic `rowProps` so a channel row answers the same gesture in both of the manager's layouts; the table stays domain-free and never learns what a menu is. On Home the shelf tile's menu is the whole editor: four move rows (front / left / right / end, reusing the playlist menu's ordering idiom) plus the unpin, over menu rows rather than drag & drop — dragging inside a horizontal, scrolling Carousel fights the scroll, and menu rows are keyboard-reachable for free. The reorder is optimistic on the cached payload and re-asks the server on failure rather than showing an order that was never accepted. The exhausted shelf tile (a pinned channel with nothing unwatched left) is `aria-disabled`, not `disabled`: measured in Chromium, a disabled button still receives contextmenu and pointerdown, but it loses focus — and with it Shift+F10, the only keyboard route to the menu it most needs. Verified end to end in the browser against the live account: all five pin kinds, the reorder (persisted across a reload), the unpin, and the honest Unpin label on a resume tile that is already on the shelf.	2026-09-06 05:07:06 +02:00
peter	f3c0b7be23	feat(e24): the Home surface — one question, one answer, both sources ... E24 S2. A new `home` module in layout C+ (the mockup the owner picked): the time-budget chips on top, one large hero that answers them, then the comfort shelf and a cross-source resume rail. Home is the landing — deliberately OVER the remembered last module, since landing on whatever you happened to close the app on is the habit this epic exists to replace; `LS.startOnHome = "0"` opts an account back out (Settings toggle lands in S4). No third card component: each unified card carries the native feed / Plex payload, so the rails render through the existing VideoCard (`cardsSmall`) and PlexPosterCard, and `aspect` decides the tile shape without branching on source. Plex playback hands off to the Plex module via a new `jumpTo` type — the player lives there with its lazy hls.js and its provider tree, and mounting a second one on the landing page to save one hand-off would be the expensive way round. Four defects found by driving it in a real browser against the live account, each now pinned by a mutation-checked test: - **The reroll gave the same card back.** A new seed only re-draws the SURPRISE tier; the resume tier deterministically returns the most recently progressed thing that fits, so anyone with something half-finished pressed a dead button. `/pick` now takes an `exclude` list of `<source>:<id>` keys and the client keeps a rolling window of 8. Excluding a SHOW also excludes the episode it resolves to — otherwise the same suggestion comes back wearing a hat. - **"Nothing to suggest yet" flashed over a full library** whenever a reroll was in flight: the new query key has no data for a beat. An empty state standing in for a loading one is the dishonesty the house rules name outright. The hero now falls back to the loaded payload while a pick is pending, and only trusts a null once the pick has RESOLVED. - **A budget change replaced the page — chips included — with a spinner**, so the control you just clicked vanished under your cursor. `keepPreviousData`, the same reason the feed uses it. - **The hero printed twice**, once as itself and once as the first resume tile. Two smaller UI calls made from the same session: the budget caption sits NEXT to its chips rather than in SegmentedToggle's justify-between mode, which on an 80rem page throws the answers to the far edge; and the feed takes the YouTube mark its own toolbar already uses, since Home now owns the house icon. Gate green: ruff, ruff format, 3x tsc, eslint, prettier, knip, vitest 780, pytest 989. Verified end to end on localdev against the real account: budget chips re-answer (matched on REMAINING time — a 51-minute video with 2:46 left is a ten-minute answer), the reroll walks three distinct heroes, and a Plex show tile opens its drill-down in the Plex module.	2026-09-06 04:14:14 +02:00
peter	53b50231ff	feat(e24): the Home surface read-model — hero, resume rail, comfort shelf ... E24 S1. The anti-paralysis answer layer, served from our own Postgres with no upstream call: one hero suggestion, one CROSS-SOURCE resume rail, and the user's own comfort shelf. Survey first, because the roadmap line was wrong about the starting point: Plex already ships the whole trio (E5's Discover rails, including a reshuffling Surprise me), the YouTube side ships none of it, and nothing anywhere answers the question across both. The data already existed on both sides — VideoState and PlexState are structurally identical, the feed has an `in_progress` filter and a seeded shuffle, and the YT player already resumes position. - app/discover/budget.py — the time bands. "How much time do you have" (10 perc / 30 perc / egy este / mindegy) replaces 15/D's mood questionnaire: deterministic, answerable from a column we have, and it picks the source for free. Matched against REMAINING time, so a film with 8 minutes left is a ten-minute answer. An unknown runtime fits only the unbounded band. - app/discover/cards.py — a thin unified card that carries the NATIVE feed / Plex payload, so the page renders with the existing card components instead of a third one. `aspect` is the one new field: a rail needs to know poster from 16:9, and that is a property of the artwork, not of the module. - app/discover/queries.py — the SQL, reusing feedquery and plex.rollup rather than the Plex Discover ROUTE, whose LibraryFilters narrowing belongs to a surface that has a sidebar. One seed drives both halves so a reroll moves them together. - app/discover/hero.py — resume -> comfort -> surprise, with the chosen tier in the payload so the client labels it honestly instead of guessing. - comfort_pins (0083): five nullable CASCADE-ing FKs under num_nonnulls(...) = 1 rather than a flag or a polymorphic string ref. A flag cannot order a shelf or hold a channel; a string ref would let a deleted library item leave a dead tile on the one surface whose whole job is to be reliable. Two honest-state rules the tests pin: the surprise draw excludes anything already started (the resume tier may have skipped it for not fitting, and offering it back as "Meglepetés" would contradict the question), and which source leads the draw follows the seed, so the Plex library can actually answer "egy este". Gate green: ruff, ruff format, 3x tsc, eslint, prettier, knip, vitest 770, pytest 987.	2026-09-06 03:31:26 +02:00
peter	5703c4d713	fix(plex): a null progress timestamp must sort a rail row last, not raise ... The Continue-watching and Surprise rails sorted on `(ts is not None, ts)`. That key LOOKS null-safe and is not: two rows that both lack a timestamp compare equal on the flag and then compare `None < None`, which raises — so a show whose rollup has no `resumed_at`, or a movie state written before `progress_updated_at` existed, could 500 the rail instead of sorting last. Replaced with an explicit epoch sentinel, and named it beside the other rail constants so the sibling rail E24 adds cannot re-derive the same broken key.	2026-09-06 03:31:09 +02:00
peter	013f19faca	refactor(plex): move content_libs down into the query layer ... The browse scope is a pure DB query with no request state, but it lived in routes/plex/_shared.py. E24's Home surface needs the same scope from a domain package, and a domain package importing from routes/ inverts the one-way dependency CLAUDE.md draws. Moved to app/plex/query.py and renamed to content_libs (public — it is a domain helper now). Swept all five call sites and both tests in one go rather than leaving a re-export shim: the canonical-patterns table already names the routes.admin re-export as the anti-pattern.	2026-09-06 03:31:02 +02:00
peter	8d9a99ce54	release: 0.82.0 (feature/e10-platform-ergonomics)	2026-09-06 02:37:10 +02:00
peter	45dd4bdda7	chore(release): 0.82.0 — E10 Platform & Ergonomics	2026-09-06 02:37:07 +02:00
peter	dac391a890	fix(e10): review round 3 — settle the focus race in a browser instead of guessing again ... Round 3 reviewed round 2's diff. Trend across the loop: 32 findings over the whole epic, 15 over round 1's fixes, 11 over round 2's. What it caught is mostly the same shape as before — a guard narrowed until it was wrong in the other direction — plus one item this branch had now got wrong three different ways. Backspace ownership over the player, third and final answer. Round 1 deferred to nothing (the cheat sheet took the key and the player stopped underneath it). Round 1's fix deferred to `anyLayerAbove` (the player's own gear/tracks popovers push layers too, so it stopped closing them). Round 2's fix named the sheet and palette (the app-wide ErrorDialog is neither, so the player tore down under it). The rule that actually holds is not a list of overlays: the player's own panels answer first, because handleBack's cascade is what closes them, and anything else layered above takes the key. The rail's inline rename is settled by measurement rather than argument. Two rounds reasoned about whether a React passive effect lands before or after floating-ui's return-focus microtask and reached opposite conclusions; a jsdom harness built to decide it reproduced no failure for ANY shape, because focus never enters the menu there — so it was deleted rather than kept as a test that discriminates nothing. Checked in a real browser instead: the field opens and holds focus. The shipped fix works, and the comment now says what was measured rather than what was inferred. The same check found that round 1's OTHER rail fix never worked at all. Escape does run its own handler (typing then Escape leaves the name unchanged, so it cancels rather than blur-commits) and the row button is focusable when focused from outside — yet focus still lands on <body>. Three explanations, none of which survived. So the refocus machinery is reverted to the shape that shipped before this epic and the gap is documented where the next person will hit it, with the evidence and an instruction to instrument before theorising. A fourth guess would have been worse than a known bug. Also: the two comments in Playlists.tsx that still claimed the disabled menu rows explain themselves — untrue since round 2 reverted `inert`, and exactly the comment-vs-code drift CLAUDE.md calls the source of the worst bugs here. And the move-failure toast printed HttpError.detail verbatim, which for the reachable 404 is the backend's bare English "Unknown playlist"; only a structured detail has been through localizeDetail, so only a structured detail reaches the toast now.	2026-09-06 02:22:23 +02:00
peter	4b33036e7c	fix(e10): review round 2 — revert what round 1 got wrong, narrow what it got too broad ... Round 2 reviewed round 1's own fix diff, which is where a fix round does its damage. It found 15 issues in 792 lines — a much higher density than round 1 found in the whole epic — and most were regressions round 1 introduced. So this follows the rule rather than fighting it: revert the fixes whose mechanism was wrong, narrow the ones whose guard was too broad, and stop reaching for a third variant. REVERTED, because the mechanism does not work: - The `inert` menu item. Round 1 swapped a native `disabled` for `aria-disabled` so a row's "why is this off" tooltip could be reached. floating-ui's list navigation skips `aria-disabled="true"` exactly as it skips `disabled` (isListIndexDisabled) — and AnchoredPopover's own comment, written before this branch, already said so. The swap fixed nothing and made the mouse worse: without native `disabled` the row took pointer events, the full active highlight and DOM focus, then no-opped on click. The underlying finding is logged where the prop was, unfixed and honest: the reason has to go somewhere a disabled row is not. - `useContextMenu` owning the focus restore. Turning floating-ui's returnFocus off platform-wide traded one bug for two: Playlists spreads triggerProps on a bare <tr>, so restoring to it is a spec no-op and Escape stranded focus on <body>; and with dismissOnScroll now on, the restore's plain focus() scrolled the row back into view, undoing the scroll that closed the menu. Patching that needs three more guards on one fix. The original bug — the rail's rename field dying on arrival — is fixed at the field instead: it focuses from an effect, which is scheduled after the microtask that was blurring it. NARROWED, because the fix was right and the guard was not: - PlexPlayer's Backspace deferred to `anyLayerAbove`, but the player's own gear and tracks menus register layers via useDismiss — so Backspace stopped closing them and did nothing at all. Only the cheat sheet and the palette own that key, so it names them. - `historyDepth = 0` also desynced the counter from overlays the navigation does NOT unmount (About and ReleaseNotes live outside the page column), leaving one Back to both navigate and close them. The entries are marked buried and consumed silently by reconcile instead. - The move's error toast fired for every status, so a transport fault surfaced twice on top of req's own dialog. Scoped to 403/404. - The palette's moved-pointer guard could not judge the FIRST move of a session and went stale across a close. `e.movementX/Y` asks the browser directly and needs no state. - `useKeyScope("contextMenu")` runs once per hook, and the Playlists page mounts two — so the cheat sheet rendered the chords twice under a duplicated React key. The scope stack dedupes. - The `enabled:hover:` sweep missed the half that lives in CSS, so a disabled glass button still lifted. `.glass-hover:not(:disabled):hover`. - ShareDialog's migrated buttons passed a colour className that the variant's own colour class outranks under clsx, so Revoke hovered neutral and a password-protected link looked unprotected. The colour goes on the icon, as the Copy button beside them already did. - `matchesShortcut` took an untyped id and ids are only unique within a scope, so `back` would have answered for the wrong player. Keyed on scope + id, both literal. And the systemic one: round 2 reverted eight of round 1's behaviour fixes as a single mutation and all 763 tests still passed. Round 1 tested the three fixes that were easy to test and none of the rest. So the guards with the widest blast radius are pinned now, each mutation-checked to fail for its own reason: the global keymap's repeat/allowInInput/disabled handling (a new dom test), the cheat sheet bound to the real useContextMenu rather than a scope stub, the scope dedupe, the history burial, and the Button accessible-name union — whose @ts-expect-error fixtures turn a widened type into a red typecheck lane. The chipLane contract test that round 1 rewrote to count per lane counted the import line as a lane, giving every file one free mirror — so the exact hole it was rewritten to close was still open. Mutation-checked both ways this time.	2026-09-06 01:57:32 +02:00
peter	80dea4f307	fix(e10): review round 1, part 2 — the docs the epic invalidated, and three contracts made real ... Finishes round 1. Part 1 took the runtime bugs; this takes the prose that had gone false and the three "the comment says so" gaps behind it. CLAUDE.md is auto-loaded into every agent session and ui/README.md is not, so an architecture paragraph that still described a flat components bag was the most expensive stale sentence in the repo: the next agent adding a popover reads it, sees no platform layer, and writes the generic component into components/ — the invisible-layer failure this epic exists to end. It now names components/ui/ and says the boundary is lint-enforced. The canonical-patterns table gained the three rows the epic established: ui/Button over a hand-rolled <button>, a keymap row over a private keydown listener, and disabled-when-busy vs inert-when-inapplicable. ui/README.md's inventory was written in this branch's first commit and never learned about CommandPalette, ContextMenu/useContextMenu, KeyboardHelp or gridColumns — in a section whose own closing rule is that a second component painting the same thing is how the last inconsistency happened. It also claimed "everything is rem-derived" while VirtualGrid's minCol/GRID_GAP are deliberately px; that is now stated as the exception it is, and a new section records which promises here are tests rather than sentences. Three contracts stopped being prose: - A text-less Button must carry a name. "Required for iconOnly" was a doc comment, which is why the migration shipped two nameless icon buttons through eight green lanes. It is a union now, covering both spellings (iconOnly, and size="icon"/"icon-sm"), satisfied by label, aria-label or title. It caught one more on the way in: Banner's dismiss took an optional dismissTitle, so it could render unnamed — it falls back to common.close now. - gridColumns' gutter arithmetic. Every existing assertion survived replacing floor((w + GAP) / (minCol + GAP)) with the naive floor(w / (minCol + GAP)): the fixed widths agree, the capped cases are cap-bound, and the loops compare columnsFor against itself. Pinned at the exact-fit boundaries where the two first disagree (536 and 828). - ShareDialog's link row. Only Copy was migrated in S1, leaving one 2rem button between two 1.75rem ones — and on a coarse pointer .touch-target grew only the migrated one to 2.75rem while the destructive Revoke stayed small. Also: the maxCols docstring said 8 columns of 384px where the test it shipped with asserts 369.	2026-09-06 01:30:40 +02:00
peter	20e17c0ccb	fix(e10): review round 1 — the boundary that did not bind, and 14 more ... The epic-end review found 32 verified issues. This is the first fix round: the three highs, the user-facing mediums, and the tests that were passing for the wrong reason. Docs and the remaining low-severity tail are next. The boundary rule was the worst of them. Both `no-restricted-imports` regexes were written in plain "..." literals, where `\.` is an unknown escape that collapses to the any-char `.` — so the rule read like a boundary and matched far less than one. `../../lib/api` (the barrel every feature component imports) and `../../components/Feed` (the same file `../Feed` names) both sailed through a green gate. String.raw, a third pattern for the second spelling, and a vitest over ESLint.lintText so a rule that silently matches nothing can never look like a clean codebase again. closeThenNavigate waited for exactly one reclaim popstate. With a second Back-closable layer still mounted — a palette opened over the player — the navigation unmounted that layer too, and its reconcile backed over the entry the navigation had just pushed: "go to Channels" closed the player and landed on the feed. It now waits for the LAST programmatic back, then adopts the entries the navigation buried, and falls back after 250ms rather than hanging if no popstate is ever coming. The rail's inline rename died on arrival. With no domReference, floating- ui's returnFocus falls through to a module-global stack and restores some unrelated element from an earlier popover — blurring the field into its own commit-and-close, from the second popover of a session onward. The context menu now owns the restore: back to the row, but only if the row is still there and nothing else has claimed focus. Also: - Backspace under the cheat sheet stopped Plex playback and dropped to the grid; `back` now defers to any layer above, like `escape` beside it. - A move invalidated only the source list, so the target kept serving pre-move contents for 30s while the rail already counted N+1. - Every move error a user can reach is a 404, which `req` leaves to the caller — so the row snapped back in silence and the shipped moveErrors strings were unreachable. - swallowClick armed on long-press but was disarmed only by the click it was armed for; any press that produced no click ate the next tap on the whole list. - The context menu stayed parked over whatever row scrolled under it. - overflow-clip on the chip lanes ate the focus ring's top and bottom. - "Why is this off" rode on disabled rows, which show no tooltip and take no focus: a new `inert` item keeps the reason readable. - Shift+F10 was advertised app-wide but wired only on Playlists; it has its own scope now, and useContextMenu matches through the shared parser instead of its own literals. - Mod+K could not close the palette, `h` machine-gunned on auto-repeat, and both were bound above the branch that mounts their overlays. - Palette options were in the tab order under aria-activedescendant, and a scroll-synthesised mousemove stole the keyboard selection. - The OSD live region was created together with its own text. - Ending a rename stranded focus on <body>. - The Button variants' hover halves are `enabled:` — the one migrated site that had guarded its own lost the guard on the way in. - HU builtinLocked named the list "Watch later" in a Hungarian sentence. Tests: the chip-lane contract counted per FILE, so a second hand-rolled lane in an already-compliant file was invisible; the closeThenNavigate ordering test only passed on a popstate left behind by its neighbours and failed alone, so it moved to its own file.	2026-09-05 23:52:29 +02:00
peter	7d302f71b7	feat(e10): let an ultrawide buy bigger cards instead of more of them ... The viewport contract has two ends, and only the floor was enforced. An auto-fill grid answers "more room" with more columns, never bigger ones, so it settles just above its minimum column at any width: measured at 3440px, the feed laid out 11 columns of 264px. A feed diluted across an ultrawide fails the contract as surely as a broken one at the floor. Multi-column feed views now carry a `maxCols`; past it the leftover width flows into the items. At 3440: cards 11x264 -> 8x370, cardsSmall 15 -> 11x264 (still visibly the dense card, and never as wide as cards gets), tiles 7 -> 6x498. Each cap is set so the item tops out near 1.5x its own minCol, which is what keeps a view recognisably itself. A cap can only bind ABOVE the width at which that many columns already fit, so it is a pure ultrawide affordance — 1024, 1920 and 2560 lay out exactly as before. Verified in the browser at all three widths and across all five views. The Channels grid needs no cap: the page's own 96rem --content-mw already bounds it. Also renames VirtualGrid's `maxCol` to `colMaxWidth`. It was never a column count — it is the single-column reading-width cap — and `maxCol`/`maxCols` one letter apart is the kind of drift that has bitten this repo before. The column maths moves to ui/gridColumns.ts as a pure function so both ends of the contract are unit-testable without a layout engine; the tests assert the cap's numbers, that it never binds at the floor, and that the dense card cannot grow into the standard one.	2026-09-05 22:22:28 +02:00
peter	f99240d8ca	fix(e10): stop the hidden chip measurer scrolling the whole app sideways ... The four chip lanes render an intentionally unbounded hidden "mirror" so the shared fit core can read each chip's natural width. An absolutely positioned box still contributes to its ancestors' SCROLLABLE overflow, and `visibility: hidden` does not exempt it — and nothing between the toolbar band and <html> clipped it. At the 1024x768 floor that meant the channel manager's document scroll width was 1258px: the whole app scrolled 249px sideways into dead space and dragged the fixed header to x=-177. The same mirror was also 228px wide inside the Tags column's 144px cell, which pushed the table to 990px inside its 906px container — i.e. it broke DataTable's "the table never exceeds its container" contract and truncated channel names to "The...". One cause, two symptoms. The lane now carries a shared `chipLaneClass` = `relative overflow-clip`, so the contract lives in one constant instead of four hand-rolled class strings. `clip` rather than `hidden` because it creates no scrollport, so nothing can ever scroll the mirror into view. Measurement is untouched: offsetLeft/offsetWidth are layout values and a clip does not change layout. Measured after: document 1258 -> 1024, sideways scroll 249 -> 0, table 990 -> 921 with no cell overflow, and the "+N" collapse still fits exactly as before. A source-level test asserts every component rendering a mirror uses the lane class — the drift a fifth hand-rolled lane would introduce, which no DOM test can catch since jsdom has no layout engine to overflow.	2026-09-05 22:22:14 +02:00
peter	cc8cf96c19	feat(e10): a jump-to palette on Ctrl/Cmd+K ... Reaching a channel three modules away cost a rail, a page and a scroll. Now it costs a keystroke and half a word: Mod+K searches modules, channels, playlists, the saved views applicable where you stand, and the app-wide actions. Scope agreed with the product owner: navigation + actions, but only the reversible local ones (the shortcuts sheet, the theme). "Sync from YouTube" is deliberately absent — it is a long-running job against a quota, it wants the progress and error surface the Channels page already gives it, and one mistyped Enter is a worse failure than the walk it would have saved. Matching is word-wise and accent-folded, because this is a bilingual app and nobody reaches for the accent keys in a hurry: "pod thevr" finds TheVR Podcast and "penzugy" finds pénzügy. The arrows walk one flat result list so crossing a group heading is invisible, and the field carries the combobox/listbox aria tree that virtual selection needs. ui/CommandPalette is domain-free (items are a prop, per the ui/ import rule); AppCommandPalette supplies them. The shell is Modal again, with a new `top` placement so a search-first dialog grows downwards instead of jumping as results change. Also fixes a bug the palette hit on its first run, and that PlayerModal had already hit once: closing a dialog reclaims its Back-to-close history entry with a programmatic history.back(), which undoes any pushState made before it lands — so a command that navigates only closed the palette. The rule is now closeThenNavigate() in history.ts with a test, and PlayerModal's inline copy is gone. The global `h` moves out of KeyboardHelp into useGlobalKeymap beside Mod+K, so one listener owns the whole `global` scope and dispatch's exhaustiveness keeps meaning what it says.	2026-09-05 21:33:29 +02:00
peter	86163958d6	feat(e10): one keyboard cheat sheet for the whole app ... The Plex player had a shortcuts overlay nobody else did, so the YouTube player's Space/F/arrows and the Plex browser's Backspace were documented nowhere. ui/KeyboardHelp is that sheet for every surface, opened by a global `h` - not the conventional `?`, which is a Shift chord on a Hungarian layout, while `h` is the key this app's reader already has in their fingers from the player. It renders the shared table filtered to the scopes that are LIVE: a surface registers its scope with useKeyScope while mounted, and only while its keys really do something - PlexBrowse deactivates its own scope inside the player, where its Backspace no-ops, so the sheet cannot promise a "Back one level" the handler declines to perform. Same rule for the `when` rows: ⇧←/⇧→ are listed only inside a series, an answer the player publishes because the sheet cannot ask. No new overlay primitive, after checking: Modal already portals into document.fullscreenElement ?? document.body (so this works over a fullscreen player), registers an Escape layer, traps focus and handles browser Back. Third time this epic that the thing was already built. Shift+F10 is in the table as `handledLocally` - documented and sharing the chord parser, but matched by useContextMenu on the focused row. dispatch neither routes it nor demands a handler for it, so the exhaustiveness check stays honest about what it actually covers. Also: A/S have cycled the Plex audio and subtitle tracks since E5, but silently - the only way to see where you landed was to open the tracks menu, the exact round-trip the shortcut exists to avoid. cycleAudio and cycleSubtitle now return the track they moved to, and the player flashes it over the video.	2026-09-05 21:15:42 +02:00
peter	12822a9e04	feat(e10): put every keyboard shortcut in one table ... Six surfaces each owned a private keydown listener with its own key literals and its own idea of "am I typing?", and they had drifted: PlexPlayer matched `case "a"` without checking modifiers, so Ctrl+A (select all) cycled the audio track, and its typing guard missed <select> and contentEditable where the other two surfaces covered both. lib/keymap.ts is a TABLE, not a dispatcher. Each surface keeps its own listener and closures - PlexPlayer's refs are not worth re-plumbing - but the chords, the modifier rules and the typing guard live in one place, and dispatch() binds a scope's rows to handlers through a mapped type, so a row without a handler (or a handler without a row) is a tsc error rather than a comment someone forgets. Matching is now exact on modifiers, which is what kills the Ctrl+A bug and lets Shift+arrow be its own row beside the bare arrow. Escape opts out of the typing guard (allowInInput) so it stays the way out of a player's own subtitle-offset field. The player's shortcut sheet renders helpLines() instead of a hand-copied array beside the handler - the two used to be edited separately, which is how a sheet ends up documenting a key that no longer exists. Labels move to the new `keys` i18n namespace (EN + HU), and a test asserts every row is named in both.	2026-09-05 20:58:17 +02:00
peter	928eac4c89	feat(e10): open the app's menu with a right-click, starting with playlist rows ... S2's headline was never a new Menu: `ActionMenu` already sits on `AnchoredPopover` (arrows, typeahead, Escape, anchor-flip). What was missing is an INPUT PATH into it, so this adds `useContextMenu` + `<ContextMenu>` over the same `ActionMenuItem[]` and the same `MenuItemList` — a row cannot grow a right-click menu that looks or behaves unlike its own ⋯ menu. Three ways in: right-click anywhere on the row, long-press on touch/pen, and Shift+F10 / the Menu key. The LEFT button is untouched and keeps the row's own action. One popover per list, anchored to a virtual element at the pointer (native behaviour, and a table of 200 rows would otherwise mount 200 floating contexts to keep 199 shut). Platform bits it needed: `hoverAlso` on AnchoredPopover (a submenu falls open under a mouse and is tapped by a finger — mouse-only, so a tap's synthetic mouseenter can't race the click toggle) and `elementRef` on PopoverItem (the submenu anchors to the very menuitem that opens it, where aria-haspopup/expanded belong). `ActionMenuItem` becomes a discriminated union — a row either fires or opens a submenu — plus `danger` and `separatorBefore`. First consumers, both in Playlists: - item rows: play · move to another list (a submenu of every other playlist, one gesture) · to top / up / down / bottom · remove. Reordering goes through the same undoable store as the drag handle and is disabled under a view for the same reason, with the same explanation rather than silence. - rail rows: rename (in the row that was right-clicked, keeping its cover so the rail doesn't jump) · delete. Both now run through `usePlaylistActions`, which also takes over the detail header's pencil and trash — the delete dialog's YouTube branch and the "what gets selected next" rule exist once, not twice. - the rail gains a "recently changed" sort key off the new `updated_at`. NOT the default: a rail that reshuffles itself while you look at it costs more than it saves.	2026-09-05 19:59:56 +02:00
peter	b28be682fe	feat(e10): make "move a video to another list" one atomic request ... The one-step move S2 needs has no honest client-side shape: "add to the target, then remove from the source" leaves the video in BOTH lists whenever the second call fails, and the reverse order loses it entirely. So it is one endpoint in one transaction — POST /api/playlists/{id}/items/{video_id}/move — which re-parents the existing item row (so `added_at` survives), recomputes `dirty` on both sides, and is idempotent when the target already holds the video. Also publishes `updated_at` on the playlist summary, and bumps it explicitly for the edits that only write `playlist_items` (add / remove / reorder / move). UpdatedAtMixin's `onupdate` fires on an UPDATE of the playlist row, so without `_touch` the rail's coming "recently changed" sort would have seen renames and nothing else.	2026-09-05 19:59:41 +02:00
peter	7e97559615	feat(e10): put the 1024x768 size contract inside the primitives ... S1c, the last part of S1. The contract now lives in components/ui/ and in one CSS recipe instead of in ~160 call sites: - Minimum target 2.75rem, on coarse pointers only (.touch-target). A 32px icon button is fine with a mouse -- precise pointer, hover to confirm the aim -- and not fine with a thumb, so it grows exactly where there is no precise pointer, which on this app's real second device is the tablet. It grows the real box rather than painting an invisible ::after hit area, because two expanded hit areas on icon buttons 4px apart would overlap and the overlap fires the WRONG button. `link` is excluded: it is text inside a sentence. - 2.75rem rather than 44px so the target obeys the text-size slider like everything else; verified that the type/geometry ladder was already rem-derived off --font-scale, so nothing else was needed there. - The ladder is documented as a closed set in Button.tsx, with the site counts it was derived from, and ui/README.md states the contract. Measured in the browser: fine pointer 36x36 and 34px-tall buttons (unchanged), coarse pointer the same buttons at 44x44 and 44px tall. 1024x768 renders identically. 3x tsc, eslint, knip, prettier and 690 vitest green.	2026-09-05 18:49:48 +02:00
peter	721467ef69	feat(e10): finish the mappable Button migration, including the ui/ layer itself ... Third sweep, 20 more sites: the rest of AdminUsers (the access-request and invite clusters), Scheduler, SettingsPanel, SetupWizard, About, Feed, KeyGate, OnboardingWizard -- and, importantly, four platform components that were still hand-rolling their own buttons: Modal's close, Banner's dismiss, SidePanel's two toggles and QueryState's retry. A platform layer that bypasses its own primitive is the same defect one level up. Hand-rolled buttons with their own geometry: 110 -> 39; Button call sites 37 -> 106. What is left is deliberate, and it is the list Button's own docstring excludes plus two families this pass refused to force: video overlay controls painted on white/N, drag handles, chip removers, accent-solid pills, the bg-card family on the signed-out screen, and sites whose paint is conditional (`suspended ? warn : neutral`) or otherwise has no variant yet. Forcing those through a className override would be unsafe without tailwind-merge, which is exactly the hazard this sprint documented. 3x tsc, eslint, knip, prettier, 689 vitest green; UAT on Settings and the About dialog (its close button and full-width CTA are both migrated), clean console.	2026-09-05 18:41:41 +02:00
peter	47e2293de3	feat(e10): migrate the notification, message, auth and Plex action buttons ... Second sweep, 34 more sites: NotificationsPanel (14 -- eight identical accent text links, three ghost icon buttons, two ghost text actions), Welcome's five auth links, KeyGate, Messages, NavSidebar, ChatThread, ShareDialog, ChannelPage, PlexPlaylistView, PlexPlaylistAdd, PlexCollectionEditor and plexViews. Moves the font-weight out of Button's BASE and into each variant, so the `link` variant can be semibold (which is what every text link in this app looks like) while the action variants stay medium, and no element can end up with two font-* utilities. Welcome is the one signed-out surface this session cannot see, so only its byte-identical link swaps were taken; its primary submit and the bg-card button family are left for a pass that can UAT the screen. 3x tsc, eslint, knip, prettier, 689 vitest green; UAT on Notifications, Messages and the nav rail, clean console in a fresh tab.	2026-09-05 18:39:22 +02:00
peter	29bb914a95	feat(e10): re-aim the Button variants at the paint the app actually uses, and migrate the first 15 sites ... Counting the un-migrated call sites showed the primitive and the app had drifted into two different looks: the majority of hand-rolled buttons hover to accent (outline) and fill with card (ghost), while Button hovered to fg and filled with surface. That split is the inconsistency this epic exists to remove, so the primitive follows the majority rather than the other way round -- 16 existing call sites shift slightly, ~90 hand-rolled ones stop being special. Adds the variants the call sites prove are missing (outline-accent, outline-danger, outline-warn, link), an icon-sm size for the p-1.5 icon family, and a size=none so a link owns no button padding; renames danger-outline to danger-soft so it cannot be confused with outline-danger (red at rest vs red on hover). Two new tests lock the link-size default and the rule that a variant never adds a second font-weight utility -- without tailwind-merge, two font-* utilities are decided by stylesheet order, not class order, so that is a real hazard. Migrates AdminUsers, AuditLog, Channels, TagManager, Playlists, PlaylistsRail and SettingsPanel (Button call sites 37 -> 52). Left alone deliberately: conditional-paint sites, video-overlay white buttons, drag handles, chip removers and card-click targets -- the families Button's own docstring excludes. 3x tsc, eslint, knip, prettier and 689 vitest green; visual UAT on Users, Access requests and Playlists at 1280x900, no console errors.	2026-09-05 18:31:00 +02:00
peter	5bfcf5d83a	refactor(e10): move the platform components into components/ui/ and enforce the boundary ... The app HAS a platform layer -- AnchoredPopover (22 importers, with arrows/typeahead/Escape/anchor-flip), QueryState (21), Modal (17), PageShell, DataTable, Tabs, Tooltip and ~26 more -- but it sat flat among ~160 feature components with nothing marking it as one. Several of those files describe themselves as 'the one place' or 'canonical' and were still bypassed by hand-rolled markup, because a layer nobody can see is a layer nobody uses; three separate inventory passes of this codebase misread it the same way. Moves the 33 domain-free modules into components/ui/, rewrites the imports in 89 files, and makes the boundary a lint rule rather than a convention: inside ui/ a one-level-up import (a feature component) and any lib/api slice are errors. The rule was verified to fire on both and to leave generic lib/ helpers alone. README.md states which side of the line a component belongs on and why. No behaviour change: 3x tsc, eslint, knip, prettier and 687 vitest tests all green; no backend file touched.	2026-09-05 16:58:29 +02:00
peter	31fa554b87	release: 0.81.0 (improvement/e12-security-ops)	2026-09-05 04:54:26 +02:00
peter	6a0efba477	chore(release): 0.81.0 — E12 Security & Ops Hardening	2026-09-05 04:54:15 +02:00
peter	9f28f46839	fix(e12): unbreak the gate, and stop printing a command that can strand the restore ... Round five. 47 -> 34 -> 15 -> 7 -> 6 raw findings, and this round's sharpest was the loop's own blind spot: **the branch did not pass the gate.** `prettier --check` is one of its eight lanes and I had been running the other seven, so an unformatted `onError` from round one sat on the branch for four rounds — `siftlode publish` would have refused it, with no --skip flag to get past. **The restart hint could still strand the restored data.** Round four said the scripts no longer print a command they cannot resolve; they did. The COMPOSE_FILE fallback only fires when `docker-compose.yml` is ABSENT, so in a source checkout it never fires and the hint expanded to a bare, pasteable `docker compose up -d` — which reads the other file, whose volumes are `pgdata`/`downloads` rather than `siftlode_pgdata`/`siftlode_downloads`, and recreates the database on an empty one. When the file is unresolved the scripts now print `-f <the compose file you started with>`: not runnable, which is the point. **A comment naming the wrong owner.** `formats.py` still said a zero budget is "a refusal for enqueue to make" — the premise round one disproved, three files away from the two docstrings that now say the opposite. Anyone acting on it would delete the worker's refusal and re-open the original inversion, so it now says where the refusal actually lives. Also: the reset-flag rule was rewritten in three consecutive rounds and pinned by nothing — two tests now cover a fragment losing its token, both by a pasted verify link and by navigating away entirely; `backup.ps1` deletes a partially-copied dump before throwing, the guard round four gave the docs but not the script it mirrors; and one comment that read as if the asset were untouched by a line four below it. Gate green, all eight lanes: ruff, ruff format, 3x tsc, eslint, prettier, knip, vitest 687, pytest 950.	2026-09-05 04:41:21 +02:00
peter	14f1c97c0a	fix(e12): a bare up -d picks the wrong compose file, and recreates the database ... Round four, on round three's diff. 47 -> 34 -> 15 -> 7 raw findings. **The printed restart command could strand the restored data.** Round three replaced `start` with `up -d` because `start` ignores a newly pinned tag — but printed it bare. In the git-clone layout BOTH compose files exist, so the scripts' COMPOSE_FILE fallback never fires and a bare `docker compose up -d` reads `docker-compose.yml`: different volume names, locally built images, no IMAGE_TAG at all. `stop` and `exec` had been fine there (they resolve running containers by project and service), but `up -d` RECREATES — so the operator pastes the hint straight after a successful restore and gets `db` on a new empty volume and a first-run setup wizard, with their data in an orphaned volume. Verified: the two files resolve `siftlode_pgdata` vs `pgdata` and different images. The scripts no longer print a command that recreates from a file they did not resolve. They name the compose file when they resolved one, and otherwise say to start it the way the operator normally does — with the caveats on their own lines rather than in a parenthetical at the end of a very long one. **The reset flag is now decided where the live hash is already parsed.** Round three cleared it in the token effect, which only runs when a NEW verify token arrives — so the back button, or re-pasting an already-consumed verify link, still left the banner promising a recovery whose token was gone. Setting it from the hash on every fragment change is both smaller and closes those. Also: the doc said `start` "still carries the old tag" four lines after "pin the older IMAGE_TAG", where "old" then reads as the tag being rolled back TO — it now reuses the scripts' unambiguous wording; the Windows recipe removes a partially-copied dump before throwing, so a mid-stream `cp` failure cannot leave a truncated file under the final name; and `$WarningPreference` is pinned beside `$ErrorActionPreference` so an inherited SilentlyContinue cannot drop the half-restored warning, with the comment corrected to say what the warning stream actually is. Gate green: vitest 685, pytest 950.	2026-09-05 04:31:13 +02:00
peter	fc56f514b3	fix(e12): the restart hint pointed at the one command that undoes a rollback ... Round three, on round two's diff. The trend across the loop is 47 -> 34 -> 15 raw findings; the ops half kept producing the sharpest ones because the gate cannot run it. **`docker compose start` ignores a newly pinned IMAGE_TAG.** Round two removed the automatic restart because it re-ran `alembic upgrade head` — and then told the operator to run that exact command by hand, in both scripts and the docs. `start` relaunches the container that already exists, which still carries the tag being rolled back FROM, so pinning 0.79.0 and following the printed instruction brings 0.80.0 back up and re-applies its migrations. Verified against a real daemon: after changing the pinned tag, `start` kept the old image and only `up -d` picked up the new one. Both scripts and the doc now say `up -d`, with the pin-first caveat where the operator reads it. **The reset flag outlived its token.** Reverting round one's "each link clears the other" went one step too far: a `#verify=` link pasted over a standing reset notice replaces the whole fragment, so the reset token is gone — but `resetPending` stayed true, and being checked first it hid the confirmation while promising a recovery that signing out could no longer complete. The flag is now cleared when the fragment it describes is gone, which is narrower than what was reverted and does not blank the signed-out card. **A test that could not fail.** The shared-asset regression test seeded the asset as `pending`, and `_reset_asset_pending` only acts on `downloading` — so the release half was a no-op and deleting it kept the suite green. Seeded as the worker actually leaves it now. Also: the malformed-URL guard answers with urlguard's structured detail rather than a bare English string, so both halves of one typo class get the same localized copy, and the third site in that module handing user input to `urlparse` was swept with it; the asset is released after the job is terminal, not before; the Stats 403 toast gets the wizard handle its own comment claimed it had; the pasted Windows recipe sets `$ErrorActionPreference` inside the block (a scriptblock inherits the caller's, so a `SilentlyContinue` profile swallowed every throw) and cleans up the container-side dump on the failure path too; the restore warning moved to the warning stream so a `> log` redirect cannot file it away; and two comments narrowed to what the code does. Gate green: vitest 685, pytest 950.	2026-09-05 04:18:33 +02:00
peter	358d722ce9	fix(e12): close what round one broke, and revert two fixes that overreached ... Round two of the review loop, on round one's own diff. Two of its findings were regressions the fixes themselves introduced, which is exactly what the loop is for: **A per-user refusal was writing onto a shared row.** MediaAssets are deduped across users, and the generic failure handler puts the message on the asset — right for an upstream failure, wrong for "your storage is full". Two users queuing the same video share one asset, so the first user hitting their cap failed the second user's job with the first one's private reason, telling someone with an empty library to free up space. The refusal now raises `_OwnerRefused`, caught separately: the job fails, the asset goes back to `pending` for whoever else holds it. Pinned by a test that drives `_download` directly — the refusal happens before extraction, so nothing needs stubbing. **The restore scripts restarted the app, undoing the restore.** `docker compose start` re-runs the container command, and that runs `alembic upgrade head` — so on the rollback path this documents as recommended (restore the dump, THEN pin the older tag) the newer image immediately re-applied the migrations the restore had just undone, and on a FAILED restore it put the app back on a half-restored schema. Both are the opposite of why the stop was added. Nothing is restarted automatically now; the scripts say what to run and when, and the docs' snippets say the same. **Reverted rather than patched:** the OnboardingWizard toast (the wizard already renders that failure inline, next to a Retry button — three recoveries for one failure), and `useVerifyEntry`'s "each new link clears the other". The latter blanked the signed-out card's only banner, where nothing renders the reset flag to replace it. The two states are independent again; what changes is that `dismiss` peels ONE layer, which is what the original finding was actually about. Also: `Stats` uses the YouTube helper rather than the bare one, so the route's English 403 detail no longer beats the translated fallback under a Hungarian UI; `urlparse` guarded alongside `.port` (an unclosed bracket raised just as late), the reason renamed `malformed` since "bad port" misdescribes it; three docstrings narrowed to what the code actually does (the worker's byte check is per-job, not an aggregate ledger, and not on the edit path; the redirect residual leaks a reachability oracle, which the note had denied; the invalidation helper does not cover suspend); the pasted Windows recipe wrapped so `throw` can stop it; the bash one-liner's failure branch no longer exits 0; and the tests that were missing for the round-one fixes — the account panel's error paths, the invalidation set, and the shared-asset case above. Gate green: vitest 685, pytest 950.	2026-09-05 04:02:57 +02:00
peter	fe38dfbcca	fix(e12): close the eighteen findings the E12 review round left standing ... The deep review of the branch raised 47 findings, 18 of which survived adversarial verification. Grouped by what they actually were: **The size ceiling inverted at its boundary.** `remaining_bytes` clamped to 0 for a user already at their storage cap, and `build_ydl_opts` reads 0 as "no limit" — so the one user over quota was the only one downloading with no ceiling at all. `check_enqueue` could not catch it: it ran while the job was queued and the user was still under the cap. The arithmetic moves into `quota.remaining_bytes` (where every other max_bytes decision lives, and where it can be tested), and the worker now fails the job outright rather than proceeding unbounded — as a non-retryable `quota_exceeded`, since retrying cannot help until space is freed. **Silent failures in the new account panel.** All three actions went through `quiet: true` endpoints, which suppress the global error dialog on the promise that the caller reports inline — with no `onError`, that promise was broken and a refusal rendered as nothing. On the broken-SMTP instance this panel exists for, an admin would read silence as "the mail went out". The co-invalidation set and the email-off predicate move to `lib/adminUsers`, shared with the pending-access queue, so the two copies of these mutations cannot drift apart again — which is how half of this was lost in the first place. **A rollback recipe that destroyed data without working.** `alembic downgrade -1` steps back one migration, but a release routinely ships several (0.80.0 shipped four): it drops the newest one's columns and leaves the schema at a revision the older image also cannot resolve, i.e. the crash loop it was meant to escape, minus the data. The dump restore is now the recommended path, and the alembic route asks the target version for its own head revision instead of counting backwards. Also: redirects named in the urlguard docstring beside the DNS-rebinding residual they share a fix with (SEC-17); a malformed port refused as `bad_port` instead of escaping as a 500; the pull cooldown extended to the sibling route spending the same QuotaAction; restore stops the app before dropping its tables; the PowerShell cleanup can no longer decide the script's verdict on 5.1, nor report the wrong exit code; the documented one-liners hardened to match the scripts; the registry's retention window stated where pinning is advertised; the two banners made mutually exclusive so neither can shadow the other; `hover:bg-hover` (a utility this project never generated) replaced by the `selectable` recipe; the clipboard helper reused; and the sync cooldown's copy swept to the two callers that discarded it. Verified: gate green (vitest 678, pytest 949), and the panel, the row hover and the reset banner UAT'd on localdev.	2026-09-05 03:41:58 +02:00
peter	f98b060e2b	feat(admin): an account panel, and a set-password link that needs no email ... Design option C, chosen by the user 2026-09-05. Nothing in the admin UI ever showed an account's GATE STATE: an admin could see a "Pending approval" chip but not whether the address was confirmed, whether SEC-10 had cleared the password, or which Google account was attached — so every support conversation started by guessing. Clicking a row now opens a drawer that says which gate the person is actually stuck behind, with the recovery actions under that readout rather than in the row. The drawer is `Modal placement="drawer"`, not a second dialog: the layer stack, ESC, the focus trap, Back-to-close and the scroll lock are the hard parts, and duplicating them is how two shells drift apart. It slides in, and honours prefers-reduced-motion like the rest. The link itself (SEC-15, SEC-16, and the everyday "no SMTP and someone forgot theirs") reuses the existing token machinery and the SAME `#reset=` entry the mailed link uses, so the signed-out card consumes it with no new flow. It is a distinct token KIND for one reason: a mailed reset arrives in the mailbox, so completing it proves ownership and confirms the address; an admin-issued link proves nothing about the mailbox — the admin hands it over by whatever means they choose — so it must not satisfy the email gate. Claiming otherwise would be the same false attestation SEC-15 is about. Issuing does not revoke the current password: a misclick must not lock anyone out. USING it rewrites the hash and bumps the session epoch, which is what evicts a squatter — SEC-16's actual remedy. Spending either kind burns the siblings of both, so a completed reset cannot leave a live admin link behind. The non-consuming probe learned the new kind too, or every admin link would have opened onto "this link is spent". The audit log records that a link was issued, by whom, for whom — never the link, which is a live credential-setting secret and the last thing that belongs in a long-lived log a human reads. Not gated on account state on purpose: it is useful for a pre-empted address, a revoked password, a Google-only account that wants one, and a plain forgotten password. Narrowing it would only make it refuse exactly when the admin needs it. The shared demo account is the one exception. Verified on localdev, both languages, end to end: issue from the panel -> the signed-in tab shows the honest "reset links open in a signed-out window" banner with the token still in the address bar -> signing out draws the "Set a new password" form, which is only possible because the probe recognises the new kind. Gate: pytest 925 -> 942, vitest 676.	2026-09-05 01:46:58 +02:00
peter	bc9e34d0ae	fix(auth): close the three leftovers E9.5 logged but kept out of its diff ... DX-17, three one-liners the epic's canonical sweep did not reach: `routes/setup.py::setup_admin` still resolved the wizard's admin by literal `User.email ==`. The wizard can be re-run, and E9.5's premise is that two spellings of one Gmail mailbox are one person — so a second run under the other spelling would have created exactly the duplicate admin row the epic exists to prevent. `routes/admin.py::_decide` hand-rolled `db.get` + 404 where the file's newer endpoints use `get_or_404`. There were TWO such sites, not the one the review named; both are converted, per the house rule that a principle gets fixed everywhere in one sweep. `useVerifyEntry`'s `hashchange` listener recognised `#verify=` but not `#reset=`, so pasting a reset link into a tab already running the app was silently ignored — the same silence that made the verify half a bug. It now notices, and says out loud that reset links need a signed-out window; the fragment is still deliberately left in the address bar (review round 4), so signing out from that tab recovers it. DX-16: `.catch(() => setOutcome("invalid"))` could not tell a spent token from a 502 mid-deploy or a dropped connection, and by then the fragment is cleared — so a network blip was reported as "that link is no longer valid", pushing the user to request a fresh one on the strength of a false statement. Only a 400 carrying {code:"verify"} is the server's verdict now; everything else gets its own outcome, with no resend CTA, because the token is untouched and retrying it works. The rule was already written one file away for the reset-link probe: "a network blip must never be cached as 'this link is dead'". Two existing tests asserted the old conflation by rejecting with a bare Error("400"); they now reject with the real HttpError. The errors are built inside the rejection, not hoisted: mountAt calls vi.resetModules(), so an HttpError imported earlier is a different class identity and `instanceof` would quietly miss. Gate: vitest 671 -> 676, pytest 924 -> 925.	2026-09-05 01:35:09 +02:00
peter	0cc450d1c9	fix(downloads,sync): bound what one user can make the server fetch, download and spend ... SEC-12: the download box accepts an arbitrary http(s) URL and yt-dlp fetches it from the WORKER, so any approved user could aim the server at the compose network, the LAN or a cloud metadata endpoint — and read the result off job.error, where "connection refused" vs "HTTP Error 401" vs "timed out" is a port scanner. downloads/urlguard.py refuses a URL whose host resolves to a loopback/private/link-local/reserved address, at enqueue AND again in the worker (DNS can move in between, and the worker is where the socket opens). A network-class failure on a `url` job now reports one fixed sentence instead of the raw transport text; the error CODE is still classified from the original, so the localized explanation is unchanged. DNS rebinding is explicitly NOT closed — that needs the connection gated inside yt-dlp — and the module says so rather than implying more than it does. SEC-13: `noplaylist` only demotes a video-inside-a-playlist URL to that video, so a URL that is purely a playlist or channel still expanded into every entry — one enqueue, unbounded downloads. `playlist_items` pins it to one. Size was unbounded too: `check_enqueue` compares the CURRENT footprint against the cap, and a download's size is unknown until it lands, so one job could overshoot by any amount; the owner's remaining budget is now handed to yt-dlp as `max_filesize`, applied AFTER the adapter merge so no source adapter can raise a limit the quota layer set. A join's cut-list is capped at 100: an accurate join emits two filters per segment into one ffmpeg filter_complex. SEC-14: the YouTube budget is instance-wide, so one user holding down a manual sync spent the day for everyone. Per-user (not per-IP — the cost belongs to the account) 3-per-10-minutes limiters on the two bulk pulls, subscriptions and playlists, with separate budgets so one does not close the other. The review also listed /rss, /backfill and /enrich; E3 deleted them, and search stays unlimited on purpose — it is interactive, not a bulk pull. Gate: pytest 896 -> 924 (none skipped), vitest 671.	2026-09-05 01:03:24 +02:00
peter	688efb9ed6	feat(selfhost): license the repo, and make Plex actually usable on the public compose files ... DX-10: the repo invited people to clone, build and self-host while carrying no LICENSE at all — which legally means all rights reserved, so none of that was permitted. Adds the verbatim GNU AGPL-3.0 text, the SPDX id in package.json and a README section. AGPL rather than MIT deliberately: this is a server application, so the case worth covering is someone running a modified copy as a network service. DX-12: .env.example documented PLEX_MEDIA_HOST_PATH -> /plex-media and the README advertised the Plex library, but only the localdev and home compose files carried the mount — on both PUBLIC files the module could read Plex's catalogue and then fail to open a single file, because it streams the media itself rather than proxying Plex. Both api and worker now mount it read-only with an empty named volume as the fallback, and self-hosting.md gains the section that explains the server URL/token, the path map and the mount together (it had never mentioned Plex). DX-15: the worker had no init: true on either public file, though localdev and home both carry tini with the reason written out — without PID 1 reaping, a watchdog hard-kill of a download's process group orphans its ffmpeg/yt-dlp grandchildren. Verified: 'compose config' resolves on both files, the Plex mount comes out read_only: true on api and worker, and init lands on worker (not just the bgutil-pot sidecar). Gate green: vitest 671, pytest 896.	2026-09-05 00:53:26 +02:00
peter	ca4e559cc7	fix(ops): make backup/restore work, and give upgrades a pin and a rollback ... DX-13: both shell scripts ran bare 'docker compose', which has no config file to find in the layout docs/self-hosting.md tells people to use (only docker-compose.selfhost.yml is downloaded) — they now fall back to it, while a source checkout keeps resolving docker-compose.yml as before. The two PowerShell scripts moved the dump through the PS pipeline, which corrupts binary on 5.1 and cannot express -Encoding Byte at all on 7 ('Byte' is not a supported encoding name), so they simply failed there; they now write inside the container and 'docker compose cp' it across. backup.sh also wrote its output straight into backups/, leaving a truncated file that looks like a real backup when pg_dump fails — it writes a .part and promotes on success. Both restores report a non-zero pg_restore rather than printing 'Restored' over it. Docs now state that a backup is the dump PLUS .env: without TOKEN_ENCRYPTION_KEY every encrypted secret in the restored database is unreadable, which the old one-line 'back up the volume' never said. DX-14: 'latest' moves with every release and migrations run on every boot, so self-hosters had no way to choose when they move and no way back. Docs gain IMAGE_TAG pinning, a rollback recipe (image-only vs schema-bearing) and the migration-failed-at-boot case; CHANGELOG.md is generated from releaseNotes.ts so the file cannot drift from what the app shows, and 'siftlode release' refuses on a stale one rather than regenerating it into the clean tree it just demanded. Verified: dump + restore round-trip on both platforms against localdev into a scratch database (8 users, 262822 videos, schema 0082_invite_lang), and IMAGE_TAG=0.80.0 resolves on both services in 'compose config'.	2026-09-05 00:50:07 +02:00
peter	e23128b4a1	release: 0.80.0 (improvement/e9.5-onboarding-access)	2026-09-04 23:28:30 +02:00
peter	0d5f8f0708	chore(release): 0.80.0 — E9.5 Onboarding & Access flow ... Release notes for the epic: bilingual mail, one-mail-one-click approval, order-independent gates with named states, canonical Gmail identity, the admin lifeline for sign-ups stuck outside, and the four-round closing review that converged 12 -> 4 -> 3 -> 2.	2026-09-04 23:28:23 +02:00
peter	a03bf8d371	fix(auth): stop erasing a reset link the signed-in tree never reads (E9.5 review round 4) ... Round 4 came back converged — nothing above low, and both findings in one family. This is the half worth fixing, because the branch introduced it. Only the signed-out auth card consumes a `#reset=` token, and S2 moved the address-bar cleanup up to a hook App mounts unconditionally. So opening a password-reset link in a browser that already holds a session erased the token from the URL while nothing had read it: the page loads, nothing is said, and clicking the link again does exactly the same, because the token is untouched and the session is still there. That is the dead end this epic exists to remove, and `main` did not have it — the strip used to live inside the card, which a signed-in visitor never renders. An unspent reset fragment now stays, which restores the recovery that shape always had: signing out reloads with the fragment intact and the form is waiting. Once the card has spent the token a later reload meets S4's named dead-link screen, which is true. The affirmative version — a banner telling a signed-in visitor that reset links open in a signed-out window — is logged with DX-15, along with the `hashchange` half that still only recognises `#verify=`.	2026-09-04 23:14:46 +02:00
peter	3dc14402b0	test(auth): pin what rounds 1 and 2 left unpinned (E9.5 review round 3) ... Three low findings, all in what the review rounds themselves wrote. The comment on `test_approving_an_unverified_account_keeps_its_password` still asserted the argument rounds 1 and 2 refuted — that dropping the approval-time revoke was safe because `password_login` reads `email_verified` first — while the docstrings on the two functions it describes now say the opposite. Two contradictory "why" records for one rule is how the round-1 takeover primitive got reasoned into existence in the first place, so the test comment now carries the corrected account and names SEC-16. `test_a_later_registration_leaves_a_link_already_in_flight_alive` asserted a subset relation that is vacuously true on an empty set, and the guard that made it non-empty had gone out with the revert. It now pins both halves: the old link survives, and exactly one new one appears. Round 2's own fix — activation moved to after a successful send — was unpinned; putting it back above the send left the suite green. The failed-invitation test now also asserts the account was not activated by a request the UI reported as a failure.	2026-09-04 23:04:09 +02:00
peter	540ca244c8	revert(auth): the newest registration does not own an unverified account (E9.5 review round 2) ... Round 1 fixed the address pre-emption chain by letting a later registration replace the password on an unverified account and delete its outstanding verify tokens. Round 2 read that code and showed it was worse than what it fixed, so it goes back out. It closes nothing. The rule is symmetric and an attacker can simply register last — on a timer, inside the five-per-five-minutes budget — while the owner registers once. What it does add is two primitives an unauthenticated caller did not have: overwrite a real registrant's chosen password, and delete the confirmation link already sitting in their inbox (the approval mail's 7-day token is an ordinary verify token, so the blanket delete took that too). Worst of all it fired on the rows SEC-10 left stripped — password_hash NULL, password_revoked_at set, active — installing an attacker's password where the entire state means "there is none", and clearing the stamp that is the only reason password-reset still accepts them. That is a straight takeover which did not exist before, in the code written to prevent one. The owner's recourse needed no new primitive and already worked: password-reset accepts a pre-empted account, proves the mailbox, rewrites the hash and bumps the session epoch. What remains is the bounded window between a confirmation click and that reset, which is SEC-16 — logged with this attempt written down, so the next person does not reach for it again. Two smaller round-2 findings go with it. `upsert_pending_invite`'s new exact-spelling tie-break ran before any status preference, so it could deterministically pick a DENIED sibling over a pending one and reopen it — the very outcome its comment claimed to prevent; the status preference now comes first. And `send_invitation` activated the account before the send it might have to report as failed, so a request the UI called a failure had quietly let someone in; activation now follows a mail that actually left. The verify token minted to render that mail still commits either way — it is single-use, expires on its own and was mailed nowhere, and the note says so rather than leaving the next reader to wonder whether it was missed.	2026-09-04 22:54:52 +02:00
peter	563fa0513d	fix(auth): close what the epic's own review found (E9.5 review round 1) ... Eleven findings survived adversarial verification; these are the fixes. **Address pre-emption.** S1 dropped the approval-time password revoke, arguing `password_login` refuses an unverified account before it reads `is_active`. Two verifiers showed that holds only while the address stays unverified — and S6's approval mail exists to get the real owner to end that state, at which point the squatter's password works. While an address is unverified the NEWEST registration now owns it: the password is replaced and every outstanding verify token deleted, so the owner takes the row back simply by registering, and a link already in flight cannot confirm it for anyone else. The residual (an owner who confirms and neither registers nor resets) is logged as SEC-16 beside SEC-15, where the re-attestation path it needs already lives. The comments that asserted the old, false invariant now say what actually guards this. **The entry URL.** S2 moved `clearEntryUrl()` out of the signed-out auth card into a hook App mounts unconditionally, and it blanket-stripped the whole query string, the fragment and `history.state` on the FIRST commit. That broke first-run setup outright — the wizard mounts only after its query resolves and then finds no `?token=` — and silently ate `?link=`/`?oauth=` (no toast, no refetch after connecting Google), `?v=`/`?chan=` deep links, and scroll restoration. It now clears only the fragment and the two one-time flags it owns, and preserves `history.state`. **The env allow-list.** S3 canonicalised the Invite branch of `is_allowed` and left the ALLOWED_EMAILS/ADMIN_EMAILS fallback matching literally — the 2026-09-03 lockout with a different source of truth, plus a shadowing trick where an unauthenticated request under a sibling spelling permanently masked an env grant. Canonical on both sides now, and the same for the delete dialog's warning and the ADMIN_EMAILS role bootstrap. **Honest states.** `send_invitation` stamped "I already wrote to them" before a fail-soft background send; it sends inline and records only what left. The admin-side resend answered `{ok: true}` for a dropped mail; it now says so. Both also activate/serialize consistently with the other decide paths. **Correctness sweep.** The 7-day approval link said "expires in 168 hours" — durations render in days once there is more than one. `_register_account`, `upsert_pending_invite` and `add_invite` picked among canonical siblings with no ORDER BY and no exact-spelling tie-break, so which account got the re-send, and whether a denied row was reopened over a pending one, was up to Postgres. `purge_user` deleted every canonically-equal invite, revoking a surviving sibling account's access. `ConfirmProvider` wrapped its ReactNode message in a `<p>`. Approving no longer leaves the stuck-sign-ups list stale. The refusal panels announce and take focus. **Tests.** Three mailers rewritten this epic never rendered in any test; every `send_*` now renders in both languages. The orphan-key guard could not fail (it scanned the catalog that defines the keys) and had no reverse direction. Newly pinned: canonical activation, the surviving sibling's grant, a failed invitation and resend, an expired reset link, a throttled login's silence, the per-language admin fan-out, and that the entry URL keeps what it does not own.	2026-09-04 22:42:15 +02:00
peter	10c0ca4cf7	feat(email): write to people in their own language (E9.5 S7) ... Twelve mails carried hardcoded English while the app itself has enforced HU/EN parity since E5. A mail is the one user-facing surface nobody can re-render by switching the UI language: it arrives once, in whatever language we picked, and stays that way. That made the epic's own headline mail — "one mail, one click" — English for a Hungarian reader. The text moved to a catalog (`mailtext.py`) with a `text(key, lang, **vars)` renderer, and the parity rule is now a test rather than a habit: every key must carry both languages AND the same `{placeholders}`. A translation that drops `{link}` sends a mail with no link in it; one that invents a placeholder raises inside a background task nobody is watching. Both are silent in production. Every `send_*` takes the language as its second argument, resolved by the REQUEST handler and never inside the mail — these all run as background tasks, after the request's session is gone, which is the same reason the approval mail computes its link in the handler. Where the language comes from, in order: the account's own preference; failing that, the language the person asked us in; failing that, English. The middle one is new — `invites.lang`, migration `0082` — because the mails an access request produces go to an address that usually has no account yet, and the signal does exist: the page their form was submitted from, or the locale Google reported for a sign-in we refused. Captured rather than derived, for the third time in this epic (`google_email` in S3, `preferences.language` in S6 taught the same lesson): a signal that exists only in one moment cannot be backfilled later. So the admin is asked in exactly one place — the invitation to an address they typed in themselves, where nobody has ever told us anything. That send is now a dialog rather than a bare click, which is also where the "you already wrote to them" warning belongs — it used to live only in a tooltip the admin may never hover, guarding the one action whose failure mode is mailing a real person twice. S6's registration `lang` field turned out to be dead on arrival: the backend accepted it, the frontend never sent it, so every account has been storing nothing. The request builders now stamp the UI language themselves — a signal that has to be passed in by every caller is one every caller can forget, which is exactly how it shipped unset. Admins are notified one mail per language group instead of one blast to everyone. They are people with their own UI language; a single message would have to pick one of them and be wrong for the rest. Also removes a duplicated `invited_at` column declaration on `Invite` (two identical definitions landed in S6).	2026-09-04 20:29:33 +02:00
peter	a76bab9b34	feat(auth): one mail, one click — the approval mail carries the confirmation link (E9.5 S6) ... The funnel's common ordering made a person open TWO messages: one saying their access was approved, another asking them to confirm their address. The approval mail now branches on what they actually still have to do — carry the confirmation link, point at sign-in, or say a confirmation mail follows once they register — so the usual case is one mail and one click. A mail that guesses wrong is worse than a plain one: telling someone to sign in while their address is unconfirmed contradicts the screen that will refuse them. That embedded link lives 7 days rather than the usual 24 hours. Nobody sits waiting for an approval — it can easily be read on Monday after a weekend, and an expired link spends the one-mail promise and puts them back on two. The risk is small: the token only ever confirms an address; it signs nobody in and sets no password. The most likely root cause of the 2026-09-03 report that a confirmation mail "never arrived" is here too, and it was never a delivery failure: re-registering an address that already had an unconfirmed account returned in SILENCE — same cheerful "check your inbox", no mail sent at all. It now re-sends the link. Nothing new leaks: the response and its timing are unchanged, and the public verify/resend already does exactly this for the same input. Whitelisting stays silent, and that is a decision, not an omission. The operator opens a door as a possibility — usually already agreed with the person — and a row can sit approved for weeks with nobody registering; a mail fired automatically there would be nudging someone who never asked. Telling them is its own act on its own button, `invited_at` records it so a second click is a decision rather than an accident, and the button only appears where nobody is behind the address yet: "the door is open, come in" is meaningless to someone already inside. Two things UAT caught that no test would have. Every fresh registration appeared in BOTH admin lists at once, because the stuck-sign-ups filter keyed on "unconfirmed" — the rule is now "the address may sign in, and this account still can't", which leaves an undecided request with the queue that owns it. And the invitation button was offered on every approved row, half of which are existing users. Also: the confirmation mail finally says what its link's rules are (once, 24 hours) — the reset mail always has, while this one left the reader to discover both by meeting a dead link. The card's "didn't get the email?" moves up under the form, and the three waiting messages name the spam folder, which is where a first message to a fresh recipient sometimes lands. Registration now records the language the sign-up page was in. Nothing reads it yet — the bilingual templates are S7 — but it is the only moment that choice exists anywhere the server can see, and a preference nobody recorded cannot be backfilled later. UAT on localdev: re-registering re-sent the link (one token became two, one account); approval issued a 7-day token and moved the account into the stuck list with only a re-send; whitelisting mailed nobody; the invitation recorded itself and the row then warned that sending again would write twice. Test data removed.	2026-09-04 04:05:28 +02:00
peter	7acdf5d577	feat(admin): surface the sign-ups that are stuck outside, and let an admin finish letting them in (E9.5 S5) ... Approve an address BEFORE the person registers and their sign-up produces no queue row at all — `_decide` only takes a still-pending invite — so the Access-requests screen sat empty, the tab badge read zero, and the only working move was re-typing the address into the whitelist box. Nobody would guess that, and on 2026-09-03 nobody did. This is roadmap UX-25, where two earlier attempts were reverted after review. Both moved AUTHORITY: auto-activating on registration turns a standing whitelist entry into a bearer grant for whoever registers the address first, and reopening the approved invite to `pending` lets an anonymous sign-up REVOKE a standing approval. What was actually missing was visibility, so this changes nothing about what an unauthenticated caller can cause — the admin could already do exactly this by re-entering the address; they just had no way to know they had to. The section lists every account that cannot sign in yet and says WHICH gate is shut, because the two dead ends look the same from the admin's chair: waiting for activation, or waiting on a confirmation mail. Naming the unconfirmed ones is not decoration — on a no-SMTP instance that is the difference between the owner and whoever registered the address first (SEC-15), and an admin about to let someone in should see it. A person the queue above already covers is deliberately NOT listed here; two buttons for one person is worse than one. Activate is gated on `is_allowed` — the same function the sign-in paths consult, in core, so the button that appears and the badge that counts cannot disagree. Without that gate it would manufacture an inconsistent account: password sign-in only checks `is_active` and would let them in, while their Google sign-in would be turned away and silently reopened as a fresh access request. Letting in someone with no approved invite stays the whitelist box's job, which says so out loud. The badge counts activations SEPARATELY from pending invites rather than widening an existing field's meaning, and only counts what genuinely waits on the admin: an unconfirmed account waits on its owner, so it is listed with a re-send but does not nag. The admin-side resend says plainly what happened, including refusing when the instance has no working SMTP — mail is fail-soft everywhere else, and that silence is exactly what left the 0.78.5 sign-ups with nothing to fall back on. `send_verification_link` is now one function with three callers (registration, the public resend, this one), so the link's shape and TTL cannot drift by who triggered it. UAT on localdev, both languages: the UX-25 shape reproduced end to end (approve the address, then register), the badge counting it, Activate letting them in and dropping the badge, the row losing its Activate but keeping the re-send, a fresh token issued by the re-send, and both actions in the audit log. Test data removed.	2026-09-04 03:27:48 +02:00
peter	b1086e05dc	fix(auth): stop drawing a reset form the link can no longer fill (E9.5 S4) ... Reported from UAT: delete an account, then open its password-reset link. The card drew the full "set a new password" form — because a `#reset=` fragment was present, and nothing more — and only after the user had typed a password did the server answer 400. Measured first: no security hole. A user's tokens cascade away with the row, so nothing can be set on a deleted or a re-created account. What was left is a dead end of exactly the kind this epic exists to remove, and it is not rare: a reset link lives one hour, mail is slow or lands in spam, and whoever got two mails clicks the older one. password-reset/check answers whether a link is still usable WITHOUT spending it, so asking can never cost the user their one real attempt — the property the tests pin hardest. It gets its own limiter, because opening a link must not eat the budget for requesting one, and a throttled caller is told "ok", never "dead": this check may only ever save someone a wasted form, so when it cannot answer it degrades to the old behaviour instead of declaring a live link finished. The confirm endpoint stays the authority, and its failure raises the same named screen, since the token can die between the two calls or the probe itself may have failed. A too-short password is deliberately NOT that screen. The length check runs before the token is spent, so a typo costs the link nothing, and the card tells the two 400s apart by `reason` so only one of them takes the form down. Both email-link confirmations (verify, password-reset/confirm) now answer in the {code, reason} shape S4 introduced. They were the last refusals a user meets by simply clicking an old link while still being answered in hardcoded English under a bilingual UI. The seven remaining bare strings in this module (register, request-access, the demo guards, set-password) sit behind client-side validation the UI does first; they are logged as a follow-up rather than swept in silently here. One bug found by the UAT itself, in the new code: the check went out FOUR times per opened link — StrictMode double-invokes effects and the shell remounts the card as the session probe settles. Harmless per request, but against a per-IP limit it would exhaust the budget in two reloads and then silently fall back to drawing the form unchecked: nothing errors, the feature just stops working. Deduped in a module-level map holding the in-flight promise (a ref dies with the remount that causes it); a failed probe drops itself so a blip is never cached as "dead". The test renders the card twice, because with one render the guard would rot undetected. UAT on localdev: the reported scenario end to end (delete the account, open the link) shows the named screen and no form; a live link still opens the form and completes; the CTA lands on the request-a- link form; one probe per opened link. Throwaway accounts removed.	2026-09-04 02:38:01 +02:00
peter	ed91c83dd7	fix(auth): name the state and the address behind a refused sign-in (E9.5 S4) ... "Your account is awaiting admin approval." was true and useless. It never said WHICH mailbox the account was on, and on 2026-09-03 that silence hid a Gmail alias mismatch for a day: a registration as np.temu@gmail.com met a Google claim of nptemu@gmail.com, and every screen in the funnel agreed to say nothing about it. Every refusal password-login can answer with now uses the codebase's structured {code, reason} detail, built in one helper. The three that arrive AFTER the password is proven carry the address on the account plus both gate flags; the two that answer before it (invalid, rate_limited) carry nothing, so a wrong password and an unknown account stay byte-identical. The frontend renders the first three as a named screen in place of the form — there is nothing to retype once the password is correct — with an icon, the two-gate checklist, the address in monospace, and a resend CTA where one helps. Reporting each gate from its own flag is the payoff of S1: approved-but-unverified is a real state now, and a screen that assumed a sequence would send that user off to wait for an admin who has already decided. The Google access-request notice names the address too, and says so when the request was already on file under ANOTHER spelling of the same mailbox — the honest version of "we didn't open a second one", stated only when it applies. It moved from the query string to the fragment: the notice now carries an address, and a query string lands in every reverse-proxy access log. Same reasoning that put the verify/reset tokens there, and the same owner already clears it. urlencode, not an f-string, because URLSearchParams reads a bare + in a fragment as a space and would mangle exactly the +tag addresses this epic exists to protect. upsert_pending_invite returns the row it settled on beside the is-new flag, since the row's stored address is what the notice has to name and what mail will go to. Deviation from the PendingScreen mockup, deliberately: no "Sign out" button and no separate "Not your address?" link. The mockup drew the panel in the app shell; the accepted decision (a) keeps the pending user session-less, so there is no session to end, and the address is named directly above a "Back to sign in" that answers the same question. UAT on localdev, both languages: all three refusals with the typed spelling deliberately differing from the stored one (the panel named the stored one), the resend CTA carrying the typed address into the resend form, and both access-request banners with a +tag address surviving the fragment round trip. Throwaway accounts and the language switch reverted.	2026-09-04 01:56:55 +02:00
peter	a614ee2435	feat(auth): show the Google address beside the one the account registered with (E9.5 S3) ... An account can now hold two true addresses: the one its owner typed, which a Google sign-in no longer overwrites, and the one Google answers with. Only the first was stored, so Settings could say 'Connected' without saying connected AS WHOM -- exactly what someone who registered with a +tag needs to know. users.google_email (migration 0080) records Google's answer at sign-in and at an in-app link. /api/me exposes it ONLY when it differs from the account address, so the comparison lives in one place and the majority, whose two addresses are the same string, see no change at all. Rendered in the account menu as a muted third line under the identity, and in the Settings sign-in row under the existing hint. A short 'Google' label rather than a brand glyph: the app draws one icon set (lucide), and a generic mail icon next to an email address says nothing. It also reads to a screen reader, which an unlabelled logo would not. No backfill is possible -- Google's answer is only known at sign-in -- so accounts linked earlier stay NULL until their owner next signs in with Google.	2026-09-04 01:23:11 +02:00
peter	c74487fbb3	fix(auth): keep the address the user registered with, and let it sign them in (E9.5 S3) ... Two halves of one rule: the address someone typed is theirs to keep, and it must be the one that gets them back in. A plus-tagged or dotted Gmail is often a deliberate choice -- registering as me+siftlode@gmail.com is how you find out later which site leaked your address. The Google callback overwrote it with the account's primary, which can never contain a '+', so the tag vanished on the first Google sign-in and, because sign-in matched the stored address, took their chosen address with it. The rewrite line is older than this epic, but S3 made it reachable here by matching adoption across spellings. It now runs only when the mailbox GENUINELY changed, and lives in a named helper rather than inline, so the rule has one home. The three lookups that resolve a typed address -- password login, password reset, verify resend -- go through find_user_by_email: exact spelling first, then the unique canonical candidate, and None when several accounts share a mailbox rather than guessing which one a password should open. Reset and resend previously answered a different spelling with silence (they reply uniformly by design), which was a dead end with no way out. Their mail now goes to the address on the account, never the one typed into the form.	2026-09-04 01:07:54 +02:00
peter	876cece881	fix(auth): match identity on a canonical email, so one Gmail mailbox is one account (E9.5 S3) ... Gmail delivers x.y@, xy@ and xy+tag@ to one inbox; the invite gate only lowercased. On 2026-09-03 that turned an approved user's Google sign-in into a silent SECOND access request -- OAuth returns the account's stored primary, which need not be the spelling they typed -- and left prod with two user rows for one mailbox (ids 13, 14). The +tag case fails every time: a Google account cannot contain +, so OAuth can only ever answer with the base address. Mail still goes to the address AS TYPED; only identity matching uses the canonical form. utils.canonical_email is the single definition, and a model validator derives users.email_canonical / invites.email_canonical on every write, so no call site can forget it. Scope is narrow on purpose: dots are significant on most providers and the Gmail rule does not hold for Workspace custom domains. Swept every sibling of the same principle, not just the reported one: is_allowed, upsert_pending_invite, the Google-callback adoption, _register_account (so no new duplicate pair can be created), _activate_user_by_email, admin _accounts_for (an invite backing a live user under another spelling used to look deletable) and add_invite, plus purge_user, which now erases every canonically-equal invite instead of leaving one behind that still grants access. Migration 0079 backfills both columns and indexes them NON-uniquely: prod already carries canonical duplicates (approved invite pairs since 2026-06-16), and merging accounts is a judgement call about people's data, not something a migration does on its own. A test pins the backfill SQL against the Python helper.	2026-09-04 00:14:12 +02:00
peter	e5997ca567	fix(auth): consume a verification token that arrives without a page load (E9.5 S2) ... Found in UAT. Navigating a tab that already runs the app to a URL differing only in the fragment is a same-document navigation: nothing reloads, so the import-time entry snapshot never sees the token. It sat unconsumed in the address bar and the previous outcome stayed on screen -- the same silence this sprint set out to remove, wearing a different hat. Pasting the emailed link into a running tab does exactly this, and our verification mails were plain text until 0.78.8, which makes pasting the normal way to use one. A hashchange listener now picks up the new token, the guard tracks consumed tokens rather than a single fired flag (still exactly one POST per token), and a fresh link clears the standing outcome instead of leaving the old banner up.	2026-09-03 23:57:18 +02:00
peter	c134b514c1	fix(auth): confirm an emailed verification link wherever it is opened (E9.5 S2) ... The token was only ever consumed inside Welcome.tsx, which App renders ONLY when there is no session. Opening the emailed link in a browser that already held a Siftlode session posted nothing, the fragment was then stripped, and the user got no signal at all -- the link simply did nothing. Incognito worked, which is why it survived. Confirmation now happens in App, above that branch: signed out the outcome still drives the auth card's banners, signed in it drives a top-of-app bar. The entry URL is snapshotted once at import time (lib/entryUrl) instead of per component, so no future URL writer can strip a token before whoever needs it has read it -- that ordering race is what broke this in the first place. POST /auth/verify now names the address it confirmed, which matters when the browser holds a session for a different account; the same reasoning as password_reset_required already covers the disclosure. Also here, from the 2026-09-02 review tail: the dead GET /auth/verify goes (both senders emit the fragment form, and the last query-token link expired 24h after the 0.78.7 deploy), a spent #verify=/#reset= fragment is cleared while signed in, and the auth-card banners get role=status. The verifyOkReset copy no longer blames admin approval, which E9.5 S1 made false.	2026-09-03 23:45:31 +02:00
peter	243869401a	fix(auth): stop discarding a legitimate password on admin approval (E9.5 S1) ... SEC-10 revoked any password set while an account's email was unverified, on both the Google-adoption and the admin-approval path. On the approval path that was redundant: password_login refuses an unverified account before it ever reads is_active, so approval hands a pre-emptor's password nothing it could use. All the revoke achieved there was destroying the password a legitimate registrant had just chosen -- and since the admin normally decides before the user reads their mail, 'your password was cleared for security' was the DEFAULT experience, not an edge case. The guard stays on the Google-adoption path, where the real owner does attest ownership. password_reset_required and the ok_reset banner stay: accounts stripped on prod before this change have no other way back in. Two existing tests pinned the old rule, so they are rewritten rather than deleted, and the SEC-10 recovery pack now builds the revoked state through the surviving producer.	2026-09-03 23:32:34 +02:00
peter	7339a0b84b	release: 0.79.0 (improvement/e9-playlist)	2026-09-03 21:59:31 +02:00
peter	c960c07a6a	release: 0.79.0 notes + version bump ... E9 Playlist module: total playtime in both playlist headers, the header compacted to two rows, and the sticky column header sitting flush. Plus the six defects the epic-end deep review confirmed.	2026-09-03 21:59:09 +02:00
peter	3cfdb36f06	test(format): pin the sub-minute truncation (E9 R2) ... Round 2 mutation-checked round 1's own fix and found the one line it left uncovered: every table row was an integer, so `Math.floor(sec)` in the new seconds tier could be deleted or swapped for round/ceil with the suite still green — exactly the "later cleanup removes it as redundant" failure the fix's comment claims to prevent. Two fractional rows kill all three mutants.	2026-09-03 21:51:14 +02:00
peter	ada95d04a4	fix(playlists): one rendering for a playlist total, honest below a minute (E9 R1) ... Epic-end deep review, round 1. Six findings survived verification; five of them were one defect wearing different hats. formatRuntime floored 1-59s to "0m". Harmless while it only ever formatted a Plex movie's length, but 12D repurposed it for an aggregate, and a total is the only input that can land under a minute: a playlist of Shorts reported "0m" while the rail beside it read "0:45". Fixed in the function, not behind a `>= 60` guard at each of the seven call sites — the invariant belongs where it cannot be forgotten. Its contract comment claimed "Plex movie/episode lengths" and was two epics stale. The rail rendered the same playlist total as formatDuration (1:23:45) while the new header rendered formatRuntime (1h 23m) — two shapes of one number, side by side on one screen. The rail now uses formatRuntime too; formatTotalHours had already recorded that H:MM:SS is wrong for an aggregate. The rename input kept min-w-0 without flex-1 in the compacted row, so it was the only shrinkable child beside a shrink-0 action cluster. The Plex half of this same epic already had the fix; this restores the symmetry. plex.browse.items had no plural forms, so a one-item Plex playlist read "1 items". Pre-existing, but the new header is the call site where count=1 is ordinary. Both languages get both forms, no key drift. formatRuntime had no unit tests at all across seven call sites. Added a tier table plus a sweep asserting no non-zero second ever renders as "0m". Dropped after 3/3 adversarial refutations: the meta-line segment ordering (the filtered count is labelled, and count-then-runtime is the convention) and the null-duration lower bound (the server's own SUM has skipped NULLs since long before this branch; changing only the client would split them).	2026-09-03 21:43:04 +02:00
peter	1b004e6ccf	feat(plex): total playtime in the playlist header (E9 S3) ... Parity with the YouTube playlist header (E9 12D): the Plex playlist detail now carries a meta line under the title — "N items · Xh Ym", summed from the items' duration_seconds. No backend change: leaf_card already serializes duration_seconds for both movies and episodes, and no new i18n key either — the count reuses plex.browse.items, the same key the collection header uses. The title/rename input moved into a min-w-0 flex-1 column so the meta line sits under both; the line is hidden on an empty playlist.	2026-09-02 18:30:06 +02:00
peter	95c33e0b0f	refactor(playlists): compact the playlist header to two rows (E9 12A) ... The header portals into the shell's FIXED toolbar band, so its height is list height the user never gets back — and it was spending four stacked blocks on it: title, meta line, an action row, then a separate view-control row under the cover. Option B collapses that into two tight rows beside a smaller cover: title + rename/YouTube-link on the first, with Play-all, push/revert/delete and the unsynced badge pushed right; the meta line (count · playtime · filtered) and the view controls (group-by, reset view, save order, view status, undo/redo) sharing the second. Every control and its gating is unchanged — the view-control group still appears only for `items.length > 1 || viewActive`, so a one-item playlist shows just the meta line. Measured on a 32-item playlist: the band goes 170px -> 88px at rest (122px while a view is active, where the status sentence wraps), which is ~80px more visible list.	2026-09-02 03:45:07 +02:00
peter	4e6bcbc078	fix(playlists): stop the table header shifting up on first scroll (E9 12B) ... The playlist content wrapper carried `pt-3`, so its sticky column header sat 12px below the scroller top at rest and jumped up to `top:0` on the first scroll. Drop the top padding so the header is flush from rest and never shifts — the fixed toolbar band above supplies the breathing room, matching the channel table's already-correct pattern.	2026-09-02 03:39:17 +02:00
peter	e17fb5bbf5	feat(playlists): total playtime in header + sticky-header fade fix (E9 S1) ... Surface the playlist's total playtime beside the item count in the detail header (12D) — sums every item's duration (formatRuntime "h m", matching the approved mockup), hidden when nothing sums. Data is already client-side; no backend change. Pass fadeTop:false for the playlists page (12B) so the shell's top edge-fade no longer sits over the already-sticky column header (tableHeader.tsx:257), matching the channels/audit pages.	2026-09-02 03:39:17 +02:00
peter	a9044ece50	release: 0.78.8 (improvement/email-html-alternative)	2026-09-02 03:24:59 +02:00
peter	473aafd1c8	release: bump VERSION to 0.78.8 + release notes	2026-09-02 03:24:56 +02:00
peter	7019e3afdf	fix(email): give every mail an HTML alternative so its link is clickable ... The bodies are text/plain only, so whether the URL in a verification or password-reset mail is a link at all was the client's decision. Gmail, Outlook and Apple Mail linkify plain text; lighter web clients render the body verbatim and leave the link as dead text — in a message whose entire purpose is that one link. _send now attaches an HTML part generated from the SAME plain body, rather than per-template HTML that would have to be kept in sync with it: one converter, all eleven templates, and text/plain stays the primary part and the source of truth. Escaping runs before linkification — bodies interpolate untrusted values (a requester's address, the operator contact) — so no caller can inject markup, and a query string's `&` is already `&amp;` when it reaches the href, which is what an HTML attribute wants. Sentence-final punctuation is trimmed out of the href while url-safe token characters (`-`, `_`) are left alone. Inline styles only, no images, no external CSS, no tracking.	2026-09-02 03:13:23 +02:00
peter	c81b110637	release: 0.78.7 (bug/verify-link-and-approval-lockout)	2026-09-02 02:31:19 +02:00
peter	2ecc70ca6d	release: bump VERSION to 0.78.7 + release notes	2026-09-02 02:31:14 +02:00
peter	f8c63e80c2	fix(auth): widen the 0078 backfill so revoke victims who verified are rescued too ... Review found the backfill's fourth predicate `AND email_verified = false` strands exactly the subset that needs it most. The revoke does not invalidate the account's outstanding verification token, so clicking the emailed link is the natural next thing such a user does — and it sets email_verified=True while password_hash stays NULL. That row then has no route back at all: reset ineligible, resend refuses an already-verified address, set-password needs a session the account cannot obtain, and nothing re-stamps it because the revoke itself is guarded on being unverified. The remaining three predicates already pin the victim set exactly: registration and the setup wizard always set a hash, every Google row carries a google_sub (adoption assigns it before revoking), and nothing in the codebase ever clears google_sub — so a local, non-demo, passwordless row can only have come from the revoke. Widening is therefore safe, and it is the argument the docstring was already making while the SQL contradicted it. Also corrects that docstring: set-password is unreachable because the account cannot authenticate at all, not because the epoch bump killed a session — an unverified account is refused at login before a session is ever minted, so it never had one.	2026-09-02 02:21:46 +02:00
peter	3ac3d382e7	fix(auth): stop the address-bar mirror eating emailed auth tokens, and unlock revoked accounts ... Two independent bugs made an email+password registration unrecoverable in prod. The verification link did nothing. urlWithParams/clearParams rebuilt the URL as pathname+query and dropped the fragment — but the one-time auth tokens ride the fragment (#verify=/#reset=, SB3), and the providers that mirror nav params (useUrlMirror in FeedFilters/Playlists/Plex/Channels) sit ABOVE the lazily-loaded <App> in main.tsx. Their mount effect replaceState'd the token away before the auth card's chunk had loaded, so the card read an empty hash: the link opened a bare sign-in page, no request, no banner. Both helpers now carry the fragment over. The account was then locked out for good. SEC-10 nulls password_hash when an unverified account is attested (here: admin approval landing before the user could verify — which the bug above made impossible). That is indistinguishable from a Google-only account, and reset eligibility keyed off password_hash alone, so no reset link was ever issued: no password to sign in with, and no way to get one. users.password_revoked_at records the revocation, reset eligibility honours it, and setting a password again (reset-confirm or set-password) clears it. An account that never had a password stays ineligible on purpose — its owner adds one from Settings. /auth/verify now also answers password_reset_required so the card can say why the registered password stopped working, instead of leaving the user at the uniform "Invalid email or password". Telling the holder of a valid verify token leaks nothing: they have already proved they own the mailbox. The 0078 migration backfills the stamp for rows carrying the exact lockout signature (local, non-demo, no password, unverified), so existing victims recover unaided.	2026-09-02 01:28:45 +02:00
peter	94c62ca699	release: 0.78.6 (feat/admin-invite-delete-email-health)	2026-09-02 00:36:52 +02:00
peter	1fe24d374a	docs(tests): correct the deny-vs-delete rationale in the invites test file ... Round 4's only finding: the file header and one comment still said Deny stops a refused person re-asking. It does not — upsert_pending_invite reopens a denied row as pending — and the delete_invite docstring in the same branch already says so. The real difference is that Deny records an auditable decision and mails the requester; Delete forgets the address.	2026-09-02 00:15:21 +02:00
peter	2cba6b9fca	docs: round-3 copy corrections, and pin the two behaviours nothing was guarding ... Round 3's correctness/security pass came back clean; what was left said more than the code does. - emailOff promised the access-request list is where sign-ups show up. A sign-up on an address that is already approved or already pending adds nothing to it (roadmap UX-25), and "only" was falsified by this release's own inbox notice. - deleteConfirm claimed the admin was dropping "an approval you already gave" — it is the confirmation for pending and denied rows too. - sendFailed blamed the mail server for rejecting a message; the reason covers connect, DNS, TLS and login failures alike, so it now describes the symptom and leaves the diagnosis to the log. - ADMIN_EMAILS re-promotion happens in the Google callback only, not on any sign-in. Tests: the decided-list copy of the delete affordance was never rendered (both new cases fail if that branch is dropped), and the throttle release — a deliberate behaviour the notes advertise — was asserted by nothing; a drop with no admin yet, or with a failing write, must not silence the following hour.	2026-09-02 00:06:01 +02:00
peter	8d7aaad9a8	fix: warn before the delete, not after — plus round-2 copy and a11y corrections ... Round 2 on the feature diff (15 → 12): - still_allowed_by_env now rides the invite LIST as well as the delete response, so the confirmation warns while the admin can still change their mind. It mattered most for a DENIED row on an env-allow-listed address: deleting it silently converted a refusal into a grant, and the only warning arrived after the irreversible click. - Both inbox bodies claimed to name "the most recent" dropped message. The throttle records the FIRST of each hour and never updates it, so they now say "one of them", and the not-configured body finally names where to fix it. - settings.invites.emailOff told the admin they "get no notice when someone signs up" — rendered directly above the queue that shows exactly that. Only the email is lost, and it now says so. - The disabled delete buttons put their reason out of reach: `disabled` drops a control from the tab order and suppresses its title. Switched to aria-disabled + preventDefault, the pattern Playlists.tsx already established for the same reason. - deleteInvite is quiet, so the 409 the UI handles with a translated toast no longer also raises the server's English detail as a modal. - After a completed password reset, Back landed on the reset form again with a consumed token — the history change made that state reachable. The token is cleared on success so the reset view stops being the card's root. - The hu deleteHasAccount named a tab that renders under a different label. Tests: a dom test for the Access-requests panel covering both has_account variants and all three delete outcomes, /api/me flag cases, an ADMIN_EMAILS case, and the env-allowlist test now patches the raw setting so the parsing stays under test.	2026-09-01 23:50:29 +02:00
peter	85043013f0	fix: address the feature review — accurate copy, reachable controls, real coverage ... Round 1 on the feature diff found 15; the substantive ones: - The delete control VANISHED on any invite whose address had registered, which is the ordinary sign-up shape (register writes the User and the pending invite together). The guard stays broad — that row is the account's approval gate, and orphaning it strands someone who can then neither sign in nor be approved — but the control is now a disabled button carrying the reason, on both lists, so an admin never sees a row silently missing a button its neighbours have. - Deleting an entry is not always a revoke: is_allowed falls back to the env ALLOWED_EMAILS / ADMIN_EMAILS lists once no row exists, and an ADMIN_EMAILS address is force-promoted on its next Google sign-in. The route now reports still_allowed_by_env and the UI says so instead of claiming access was removed. - "Deny keeps the row so they can't immediately re-ask" was simply false — upsert_pending_invite reopens a denied row. Corrected everywhere it was stated. - The Configuration warning reads me.email_configured, which save() did not invalidate, so it kept warning about fields the admin had just filled in. - The read-only variant was an aria-hidden span explained only by a Tooltip that the hints toggle can switch off; now a disabled button with title + aria-label. - The delete error path threw away the 409's reason (the stale-list case) and left the stale row on screen. - The throttle window was spent even when no notice was written, silencing the next hour on the path whose job is to stop silent drops. - email_enabled() opened a second session and decrypted the SMTP password on every /api/me poll; it now takes the caller's session. - welcomeMode.dom.test.ts never rendered the card, so reverting the history wiring to useState left it green. A render test now drives the real links and fails on that revert (verified). Plus /api/me flag tests, the registration-shaped pending case, the env-allowlist case, and a release note that matches what the code does.	2026-09-01 23:31:49 +02:00
peter	44f626f732	feat(admin): delete a whitelist entry, and stop hiding a broken mail setup ... Three operator gaps, all found the same way — a person could not sign up and the app showed nobody anything. - DELETE /api/admin/invites/{id} with a delete control on both the pending requests and the previously-decided list. Deny keeps the row so the person cannot immediately re-ask; delete forgets the address. Refused with 409 while a User row exists for it, because is_allowed reads that row and removing it would revoke a live user's access with no other sign — the list ships has_account so the UI withholds the button instead of offering one that fails. - Email is fail-soft by design, which had come to mean invisible. _send() now records an email_undelivered notification for every admin when a message is skipped or rejected, naming the message that was lost, throttled to one an hour. /api/me carries email_configured, driving a standing warning on Configuration → Email / SMTP and above the access-request list. - The sign-in card's Create account / Forgot password / Didn't get the email views are history entries (useHistorySubview), so Back returns to the previous view instead of only moving the address bar. Also: the per-test rate-limiter reset sweeps every loaded app.* module rather than a hand-kept list of three — this change added a limiter outside it.	2026-09-01 23:09:25 +02:00