release: 0.78.7 (bug/verify-link-and-approval-lockout)

Review found the backfill's fourth predicate `AND email_verified = false` strands
exactly the subset that needs it most. The revoke does not invalidate the account's
outstanding verification token, so clicking the emailed link is the natural next
thing such a user does — and it sets email_verified=True while password_hash stays
NULL. That row then has no route back at all: reset ineligible, resend refuses an
already-verified address, set-password needs a session the account cannot obtain,
and nothing re-stamps it because the revoke itself is guarded on being unverified.

The remaining three predicates already pin the victim set exactly: registration and
the setup wizard always set a hash, every Google row carries a google_sub (adoption
assigns it before revoking), and nothing in the codebase ever clears google_sub — so
a local, non-demo, passwordless row can only have come from the revoke. Widening is
therefore safe, and it is the argument the docstring was already making while the
SQL contradicted it.

Also corrects that docstring: set-password is unreachable because the account cannot
authenticate at all, not because the epoch bump killed a session — an unverified
account is refused at login before a session is ever minted, so it never had one.

Dockerfile

@@ -60,6 +60,19 @@ RUN apt-get update \
     && rm /tmp/deno.zip \
     && rm -rf /var/lib/apt/lists/*
 
+# Intel NEO OpenCL runtime (intel-opencl-icd) — needed by the Plex transcode's HDR/10-bit HW path, which
+# tone-maps HDR→SDR on the GPU via `tonemap_opencl` (Gen 9.5 / UHD 630 can't tonemap in the VAAPI VPP, so
+# OpenCL is the only HW route; without this the 10-bit branch drops to CPU libx264). NEO was REMOVED from
+# Debian trixie (this base = python:3.12-slim = trixie), so it's pulled from **bookworm** — the 22.43 there
+# still supports Gen 9.5 and its .deb runs on trixie (verified live on the prod UHD 630). The bookworm apt
+# source is added only for this one install and removed after, so it can't drift the rest of the image.
+# Harmless on hosts with no /dev/dri or no OpenCL use (the runtime just sits unused).
+RUN printf 'Types: deb\nURIs: http://deb.debian.org/debian\nSuites: bookworm\nComponents: main\nSigned-By: /usr/share/keyrings/debian-archive-keyring.pgp\n' > /etc/apt/sources.list.d/bookworm.sources \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends -t bookworm intel-opencl-icd \
+    && rm /etc/apt/sources.list.d/bookworm.sources \
+    && rm -rf /var/lib/apt/lists/*
+
 # Install from the PINNED lock (requirements.lock, generated from requirements.txt) so the image is
 # byte-reproducible and the exact versions are the ones pip-audit scanned in CI — not whatever floats
 # up from the floor ranges on build day. Regenerate the lock when requirements.txt changes (see its header).

VERSION

@@ -1 +1 @@
-0.78.0
+0.78.7

backend/alembic/versions/0077_plex_playback_class.py

@@ -0,0 +1,54 @@
+"""plex_items playback-class facet (E7: filter the feed by Direct Play / Direct Stream / Transcode)
+
+Adds the columns the playback-class filter needs:
+  * transcode_hw   — for a `playable="transcode"` item, whether the prod iGPU can hardware-transcode it
+                     (codec HW-decodable AND 8-bit SDR) vs software-only. NULL for non-transcode items.
+  * video_bit_depth — the source video bit depth (from the Plex media Stream), NULL until probed.
+  * media_probed_at — watermark for the bit-depth backfill (NULL = not yet probed).
+
+Backfill for existing rows: `transcode_hw` is derived from the ALREADY-stored `codec_video` alone (the
+same HW-decodable allow-list `plex.sync.HW_DECODABLE_CODECS` / `plex.stream` use), so the filter works
+immediately after migration. Bit depth is unknown for existing rows (the cheap Plex listing doesn't
+carry it), so a 10-bit/HDR HEVC is provisionally 'hw' here and later refined to 'sw' by the bit-depth
+backfill (`plex.sync._probe_media_batch`) once its Stream is probed. `video_bit_depth`/`media_probed_at`
+start NULL.
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0077_plex_playback_class"
+down_revision: Union[str, None] = "0076_media_asset_kind"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("plex_items", sa.Column("transcode_hw", sa.Boolean(), nullable=True))
+    op.add_column("plex_items", sa.Column("video_bit_depth", sa.Integer(), nullable=True))
+    op.add_column(
+        "plex_items", sa.Column("media_probed_at", sa.DateTime(timezone=True), nullable=True)
+    )
+    op.create_index("ix_plex_items_transcode_hw", "plex_items", ["transcode_hw"])
+    # Codec-only derivation for existing rows — keep this codec set identical to
+    # plex.sync.HW_DECODABLE_CODECS. Bit depth is unknown here, so provisionally 8-bit (→ hw for a
+    # decodable codec); the bit-depth backfill downgrades 10-bit/HDR HEVC to sw later.
+    op.execute(
+        """
+        UPDATE plex_items
+           SET transcode_hw = CASE
+               WHEN playable = 'transcode'
+               THEN lower(codec_video) IN ('h264','hevc','h265','vp9','vc1','mpeg2video')
+               ELSE NULL
+           END
+        """
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_plex_items_transcode_hw", table_name="plex_items")
+    op.drop_column("plex_items", "media_probed_at")
+    op.drop_column("plex_items", "video_bit_depth")
+    op.drop_column("plex_items", "transcode_hw")

backend/alembic/versions/0078_password_revoked_at.py

@@ -0,0 +1,58 @@
+"""users.password_revoked_at — remember that SEC-10 dropped a preset password
+
+Revision ID: 0078_password_revoked_at
+Revises: 0077_plex_playback_class
+Create Date: 2026-09-02
+
+SEC-10 (`auth.revoke_preset_password_if_unverified`) nulls `password_hash` when an account whose email
+was never verified is attested (Google adoption, or admin approval). That left NO trace, and
+password-reset eligibility keyed off `password_hash IS NOT NULL` — so such an account could neither
+sign in (no password) nor request a reset link (not "eligible"): a permanent lockout with a silent,
+uniform response at every step.
+
+This column is that trace. A row with `password_revoked_at` set is a local account that HAD a password
+and had it revoked, so the reset flow treats it as eligible again. Setting a password (reset-confirm or
+/auth/set-password) clears the stamp. A Google-only account that never had a password keeps it NULL and
+stays reset-ineligible by design — its owner adds a password from Settings while signed in.
+
+Backfill: the signature is exact and narrow — a local (google_sub IS NULL), non-demo account with NO
+password could ONLY have got there through the revoke. Registration always sets a hash, the setup
+wizard sets one too, every Google row carries a google_sub (the adoption path assigns it BEFORE
+revoking), and nothing in the codebase ever clears google_sub. Stamp those with the current time so
+they become recoverable without operator intervention.
+
+Deliberately NOT also requiring `email_verified = false`, even though the revoke only fires on an
+unverified account: verifying is exactly what such a victim does NEXT. The revoke does not invalidate
+the outstanding verification token, so clicking the emailed link sets email_verified=True while
+password_hash stays NULL — and that row has no route back at all (reset ineligible, resend refuses an
+already-verified address, and set-password needs a signed-in session the account can no longer obtain:
+no password to sign in with, and no Google identity). Those are the victims who most need the stamp,
+so the predicate must not exclude them.
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0078_password_revoked_at"
+down_revision: Union[str, None] = "0077_plex_playback_class"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "users",
+        sa.Column("password_revoked_at", sa.DateTime(timezone=True), nullable=True),
+    )
+    op.execute(
+        "UPDATE users SET password_revoked_at = now() "
+        "WHERE password_hash IS NULL "
+        "AND google_sub IS NULL "
+        "AND is_demo = false"
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("users", "password_revoked_at")

backend/app/audit.py

@@ -30,6 +30,7 @@ class AuditAction:
     INVITE_APPROVE = "invite_approve"
     INVITE_DENY = "invite_deny"
     INVITE_ADD = "invite_add"
+    INVITE_DELETE = "invite_delete"
     DEMO_ADD = "demo_add"
     DEMO_REMOVE = "demo_remove"
     DEMO_RESET = "demo_reset"

backend/app/config.py

@@ -265,7 +265,7 @@ class Settings(BaseSettings):
     # --- Transcode (playable="transcode") re-encode tuning (E6 S1) ---
     # Hardware-encoder policy: "auto" = VAAPI (h264_vaapi) when the iGPU render node is present AND the
     # source codec is hardware-decodable, else libx264 software; "on" = force VAAPI wherever the render
-    # node exists (skip the decodability gate); "off" = always software. See plex/stream.py `_want_hw`.
+    # node exists (skip the decodability gate); "off" = always software. See plex/stream.py `_select_encode`.
     plex_transcode_hw: str = "auto"
     # Software-fallback libx264 tuning (IGNORED on the VAAPI path). `preset` trades CPU for size; `crf`
     # trades quality for size (lower = better + bigger). `max_height` caps the SOFTWARE transcode's output

backend/app/downloads/edit.py

@@ -447,9 +447,9 @@ def run_ffprobe_json(
 ) -> dict | None:
     """One ffprobe call → its parsed JSON dict, or None on any failure (timeout, non-zero exit,
     missing binary, unparseable output). The SINGLE ffprobe-JSON-invocation point in the downloads
-    package: the browser-playability codec probe here and the upload-ingest probe (`upload._probe`)
-    both go through it, so the subprocess flags/timeout/error handling live in one place instead of
-    two drifting copies."""
+    package: the browser-playability codec probe here and the shared media probe (`probe.probe_media`,
+    used by both the download worker's finalize and the upload ingest) both go through it, so the
+    subprocess flags/timeout/error handling live in one place instead of drifting copies."""
     args = ["ffprobe", "-v", "error"]
     if show_streams:
         args.append("-show_streams")

backend/app/downloads/pipeline.py

@@ -15,7 +15,7 @@ from app.config import settings
 from app.db import SessionLocal
 from app.downloads import edit as editmod
 from app.downloads import errors as dlerrors
-from app.downloads import adapters, credentials, formats, mediakind, service, storage
+from app.downloads import adapters, credentials, formats, mediakind, probe, service, storage
 from app.downloads.jobdb import (
     _edit_staging_dir,
     _job_status,
@@ -475,15 +475,14 @@ def _download(
                 asset.rel_path = rel
                 asset.size_bytes = size
                 asset.duration_s = meta.duration_s
-                asset.width = int(info["width"]) if info.get("width") else None
-                asset.height = int(info["height"]) if info.get("height") else None
+                # Codecs/dims come from a PROBE of the finished file — the ground truth — NOT yt-dlp's
+                # `info` dict, whose codec fields are absent for some sources (Facebook among them):
+                # deriving media_kind from those nulls misclassified a real H.264 video as a
+                # download-only 'file' with no in-app play/edit. Same probe the upload ingest uses.
+                asset.vcodec, asset.acodec, asset.width, asset.height = probe.resolve_media_facts(
+                    final, info
+                )
                 asset.container = ext
-                asset.vcodec = (
-                    info.get("vcodec") if info.get("vcodec") not in (None, "none") else None
-                )
-                asset.acodec = (
-                    info.get("acodec") if info.get("acodec") not in (None, "none") else None
-                )
                 asset.media_kind = mediakind.derive(asset.vcodec, asset.acodec)
                 asset.title = meta.title
                 asset.uploader = meta.uploader

backend/app/downloads/probe.py

@@ -0,0 +1,107 @@
+"""Ground-truth media probe for a produced library file — the SINGLE place both ingest paths ask
+"what is actually on disk?".
+
+`media_kind` (and the stored `vcodec`/`acodec`/`width`/`height`) must reflect the real file, not an
+extractor's metadata: yt-dlp's `info` dict omits codec fields for some sources (e.g. Facebook), and
+deriving the kind from those nulls misclassified a genuine H.264 video as a download-only `file`
+(no in-app play). So the download worker (`pipeline`) and the local upload ingest (`upload`) both
+probe the finished file here; `mediakind.derive` then turns the probed codecs into the kind.
+"""
+
+from pathlib import Path
+
+from app.downloads import edit as editmod
+
+# ffprobe container formats that mean "this is a still image / image sequence", NOT playable media.
+# A standalone jpg/png/gif/webp/bmp reports a real video stream (codec mjpeg/png/…) with no
+# `attached_pic` flag, so without this guard it would classify as media_kind='video' and get a Play
+# button + a broken in-app <video> player (and inline serving on the public share). Keyed on the
+# container format so an animated gif/webp also lands as a generic 'file' (no browser plays those in
+# a <video> either). SVG and anything else ffprobe can't decode already fails the probe → 'file'.
+_IMAGE_FORMATS = {
+    "image2",
+    "image2pipe",
+    "png_pipe",
+    "mjpeg",
+    "mjpeg_pipe",
+    "jpeg_pipe",
+    "gif",
+    "webp_pipe",
+    "bmp_pipe",
+    "tiff_pipe",
+    "ico",
+    "svg_pipe",
+}
+
+
+def _facts_from_probe(
+    data: dict,
+) -> tuple[str | None, str | None, int | None, int | None, int | None]:
+    """(vcodec, acodec, width, height, duration_s) parsed from a NON-None ffprobe JSON dict. A still
+    image / image-sequence container yields no vcodec (→ generic 'file'); a video stream flagged
+    `attached_pic` (embedded cover art in an mp3/m4a) is skipped — it's a thumbnail, not a real video
+    track, so an audio file with album art still classifies as audio."""
+    fmt = data.get("format") or {}
+    fmt_names = {n.strip() for n in (fmt.get("format_name") or "").split(",")}
+    if fmt_names & _IMAGE_FORMATS:
+        return None, None, None, None, None
+
+    vcodec = acodec = None
+    width = height = None
+    for stream in data.get("streams", []):
+        kind = stream.get("codec_type")
+        if kind == "video" and vcodec is None:
+            if (stream.get("disposition") or {}).get("attached_pic"):
+                continue  # cover art, not a video track
+            vcodec = stream.get("codec_name")
+            width = stream.get("width")
+            height = stream.get("height")
+        elif kind == "audio" and acodec is None:
+            acodec = stream.get("codec_name")
+
+    duration = None
+    try:
+        raw = fmt.get("duration")
+        if raw is not None:
+            duration = int(float(raw))
+    except (TypeError, ValueError):
+        duration = None
+    return vcodec, acodec, width, height, duration
+
+
+def probe_media(path: Path) -> tuple[str | None, str | None, int | None, int | None, int | None]:
+    """(vcodec, acodec, width, height, duration_s) from one ffprobe call; all None if ffprobe fails
+    or the file isn't playable media (an unprobeable file — or a still image — is treated as a generic
+    non-media file, so it becomes a download-only 'file' rather than a broken 'video')."""
+    data = editmod.run_ffprobe_json(path, show_streams=True, show_format=True)
+    if data is None:
+        return None, None, None, None, None
+    return _facts_from_probe(data)
+
+
+def resolve_media_facts(
+    path: Path, info: dict
+) -> tuple[str | None, str | None, int | None, int | None]:
+    """(vcodec, acodec, width, height) for the stored download asset: PROBE the finished file on disk
+    (the ground truth). yt-dlp's `info` omits codec/dimension fields for some sources (Facebook among
+    them), so deriving media_kind from it there labelled a real H.264 video a download-only 'file'.
+
+    Precedence is by whether the probe RAN, not per-field: if ffprobe read the file, its codec verdict
+    is authoritative — INCLUDING a deliberate None (cover-art-only audio, a still image). A per-field
+    `probe or info` fallback would let `info`'s stale vcodec resurrect a video track the file doesn't
+    have (yt-dlp reports a progressive `vcodec` for an audio-mode download whose video it then strips),
+    mislabelling an audio download as a broken in-app 'video'. Only when ffprobe could NOT read the
+    file at all do we fall back to `info` (the pre-probe behaviour, a safety net); the cosmetic
+    dimensions still gap-fill from `info` in either case."""
+    data = editmod.run_ffprobe_json(path, show_streams=True, show_format=True)
+    info_v = info.get("vcodec") if info.get("vcodec") not in (None, "none") else None
+    info_a = info.get("acodec") if info.get("acodec") not in (None, "none") else None
+    info_w = int(info["width"]) if info.get("width") else None
+    info_h = int(info["height"]) if info.get("height") else None
+    if data is None:
+        # ffprobe could not read the file — fall back to the extractor's info entirely.
+        return info_v, info_a, info_w, info_h
+    pv, pa, pw, ph, _dur = _facts_from_probe(data)
+    # Probe ran → its codecs win outright (a None means "no such track", not "unknown"); info only
+    # gap-fills the cosmetic width/height the probe couldn't read.
+    return pv, pa, pw if pw is not None else info_w, ph if ph is not None else info_h

backend/app/downloads/upload.py

@@ -24,70 +24,9 @@ from sqlalchemy.orm import Session
 
 from app.config import settings
 from app.downloads import edit as editmod
-from app.downloads import mediakind, quota, service, storage
+from app.downloads import mediakind, probe, quota, service, storage
 from app.models import DownloadJob, MediaAsset
 
-# ffprobe container formats that mean "this is a still image / image sequence", NOT playable media.
-# A standalone jpg/png/gif/webp/bmp reports a real video stream (codec mjpeg/png/…) with no
-# `attached_pic` flag, so without this guard it would classify as media_kind='video' and get a Play
-# button + a broken in-app <video> player (and inline serving on the public share). Keyed on the
-# container format so an animated gif/webp also lands as a generic 'file' (no browser plays those in
-# a <video> either). SVG and anything else ffprobe can't decode already fails the probe → 'file'.
-_IMAGE_FORMATS = {
-    "image2",
-    "image2pipe",
-    "png_pipe",
-    "mjpeg",
-    "mjpeg_pipe",
-    "jpeg_pipe",
-    "gif",
-    "webp_pipe",
-    "bmp_pipe",
-    "tiff_pipe",
-    "ico",
-    "svg_pipe",
-}
-
-
-def _probe(path: Path) -> tuple[str | None, str | None, int | None, int | None, int | None]:
-    """(vcodec, acodec, width, height, duration_s) from one ffprobe call; all None if ffprobe fails
-    or the file isn't playable media (an unprobeable file — or a still image — is treated as a generic
-    non-media upload, so it becomes a download-only 'file' rather than broken 'video').
-
-    A video stream flagged `attached_pic` (embedded cover art in an mp3/m4a) is skipped — it's a
-    thumbnail, not a real video track, so an audio file with album art still classifies as audio."""
-    data = editmod.run_ffprobe_json(path, show_streams=True, show_format=True)
-    if data is None:
-        return None, None, None, None, None
-
-    fmt = data.get("format") or {}
-    fmt_names = {n.strip() for n in (fmt.get("format_name") or "").split(",")}
-    if fmt_names & _IMAGE_FORMATS:
-        # A still image / image sequence is a generic file, not video — no vcodec means media_kind='file'.
-        return None, None, None, None, None
-
-    vcodec = acodec = None
-    width = height = None
-    for stream in data.get("streams", []):
-        kind = stream.get("codec_type")
-        if kind == "video" and vcodec is None:
-            if (stream.get("disposition") or {}).get("attached_pic"):
-                continue  # cover art, not a video track
-            vcodec = stream.get("codec_name")
-            width = stream.get("width")
-            height = stream.get("height")
-        elif kind == "audio" and acodec is None:
-            acodec = stream.get("codec_name")
-
-    duration = None
-    try:
-        raw = fmt.get("duration")
-        if raw is not None:
-            duration = int(float(raw))
-    except (TypeError, ValueError):
-        duration = None
-    return vcodec, acodec, width, height, duration
-
 
 def _title_from_filename(filename: str) -> str:
     """A human display title from the original upload name: the stem with separators tidied to
@@ -112,7 +51,7 @@ def ingest_upload(
     rejected upload leaves nothing behind and the caller just cleans up its temp file."""
     quota.check_upload(db, user_id, size)  # the file's size is known → charge it up front
 
-    vcodec, acodec, width, height, duration = _probe(src_path)
+    vcodec, acodec, width, height, duration = probe.probe_media(src_path)
     kind = mediakind.derive(vcodec, acodec)
 
     # An upload never dedups (each file is its own asset): a random ref makes the cache key unique,

backend/app/email.py

@@ -3,6 +3,11 @@
 Gmail SMTP + App Password by default. Deliberately fail-soft: if SMTP isn't configured
 or a send errors, we log and return False so the caller can fall back to in-app
 notifications — email is never load-bearing for the app's core flow.
+
+Fail-soft must not mean invisible, though: every drop also leaves an in-app notice in the admins'
+inbox (see `_alert_admins`). An instance whose SMTP was never filled in silently swallows
+verification links, password resets and access-request notices, and the operator's first clue used
+to be a person telling them nothing arrived.
 """
 
 import logging
@@ -11,28 +16,88 @@ import ssl
 from email.message import EmailMessage
 from email.utils import formatdate
 
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
 from app import sysconfig
 from app.config import settings
 from app.db import SessionLocal
+from app.models import User
+from app.notifications import create_notification
+from app.ratelimit import RateLimiter
 
 log = logging.getLogger("siftlode.email")
 
-
-def _smtp() -> dict:
-    """Effective SMTP config (admin DB override over env defaults). Opens its own short
-    session because email is often sent from a BackgroundTask, outside a request's db."""
-    with SessionLocal() as db:
-        return {
-            "host": sysconfig.get_str(db, "smtp_host"),
-            "port": sysconfig.get_int(db, "smtp_port"),
-            "user": sysconfig.get_str(db, "smtp_user"),
-            "password": sysconfig.get_str(db, "smtp_password"),
-            "from": sysconfig.get_str(db, "smtp_from"),
-        }
+# One admin notice an hour per reason. A relay that is down fails every send, and the inbox must
+# stay readable; the log keeps the full record either way.
+_alert_throttle = RateLimiter(max_events=1, window_seconds=3600)
 
 
-def email_enabled() -> bool:
-    c = _smtp()
+def _alert_admins(reason: str, subject: str, recipients: list[str]) -> None:
+    """Record an in-app notice that a message did NOT go out. Best effort in every direction: it
+    opens its own session (callers are often background tasks), swallows its own errors, and never
+    reports failure to the caller — this is the fallback path, it must not become a new way to
+    break a send."""
+    if not _alert_throttle.allow(reason):
+        return
+    try:
+        with SessionLocal() as db:
+            admins = (
+                db.execute(
+                    select(User.id).where(
+                        User.role == "admin",
+                        User.is_active.is_(True),
+                        User.is_suspended.is_(False),
+                    )
+                )
+                .scalars()
+                .all()
+            )
+            if not admins:
+                # Nothing was recorded, so don't let this cost the next hour of alerts on the very
+                # path whose job is to stop drops going unseen. Same on the failure branch below.
+                _alert_throttle.reset()
+                return
+            for uid in admins:
+                create_notification(
+                    db,
+                    user_id=uid,
+                    type="email_undelivered",
+                    # English fallback; the inbox renders a translated version from `data`.
+                    title="Email could not be sent",
+                    body=subject,
+                    data={"reason": reason, "subject": subject, "recipients": recipients},
+                    commit=False,
+                )
+            db.commit()
+    except Exception:
+        _alert_throttle.reset()
+        log.exception("Could not record the undelivered-email notice (%r)", subject)
+
+
+def _read_smtp(db: Session) -> dict:
+    return {
+        "host": sysconfig.get_str(db, "smtp_host"),
+        "port": sysconfig.get_int(db, "smtp_port"),
+        "user": sysconfig.get_str(db, "smtp_user"),
+        "password": sysconfig.get_str(db, "smtp_password"),
+        "from": sysconfig.get_str(db, "smtp_from"),
+    }
+
+
+def _smtp(db: Session | None = None) -> dict:
+    """Effective SMTP config (admin DB override over env defaults). Opens its own short session when
+    the caller has none, because email is usually sent from a BackgroundTask outside a request's db.
+    A caller that IS inside a request should pass its session: reading the password decrypts a Fernet
+    value, and /api/me polls this for every admin tab."""
+    if db is not None:
+        return _read_smtp(db)
+    with SessionLocal() as own:
+        return _read_smtp(own)
+
+
+def email_enabled(db: Session | None = None) -> bool:
+    c = _smtp(db)
     return bool(c["host"] and c["user"] and c["password"])
 
 
@@ -47,6 +112,7 @@ def _send(to: list[str], subject: str, body: str, reply_to: str | None = None) -
     c = _smtp()
     if not (c["host"] and c["user"] and c["password"]):
         log.info("SMTP not configured; skipping email %r to %s", subject, recipients)
+        _alert_admins("not_configured", subject, recipients)
         return False
     msg = EmailMessage()
     msg["Subject"] = subject
@@ -67,6 +133,7 @@ def _send(to: list[str], subject: str, body: str, reply_to: str | None = None) -
         return True
     except Exception:
         log.exception("SMTP send failed (%r to %s)", subject, recipients)
+        _alert_admins("send_failed", subject, recipients)
         return False
 
 

backend/app/models.py

@@ -47,6 +47,12 @@ class User(Base, TimestampMixin):
     email: Mapped[str] = mapped_column(String(320), unique=True, index=True)
     # argon2id hash for email+password login; NULL for Google-only / demo accounts.
     password_hash: Mapped[str | None] = mapped_column(String(255))
+    # When SEC-10 dropped a preset password (see auth.revoke_preset_password_if_unverified). Without
+    # this trace a revoked account was indistinguishable from a Google-only one, so it failed the
+    # password-reset eligibility check and could never be recovered — it could neither sign in nor
+    # reset. Set = "had a password, lost it to the guard" -> reset-eligible. Cleared whenever a
+    # password is set again (reset-confirm / set-password).
+    password_revoked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
     # Email ownership proven (Google sign-in is implicitly verified; password registration
     # verifies via a link). Login requires this AND is_active.
     email_verified: Mapped[bool] = mapped_column(Boolean, default=False, server_default="false")
@@ -1127,6 +1133,22 @@ class PlexItem(Base, TimestampMixin, UpdatedAtMixin):
     # Browser-playability class from ffprobe: "direct" | "remux" | "transcode" (None = unprobed).
     playable: Mapped[str | None] = mapped_column(String(12), index=True)
     probed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    # Transcode HW-capability facet (E7 playback-class filter). NULL for non-transcode items; for a
+    # `playable="transcode"` item: True = the prod iGPU can hardware-transcode it (codec is HW-decodable
+    # AND the source is 8-bit SDR), False = software libx264 only (AV1/XviD, or a 10-bit/HDR source that
+    # breaks the VAAPI nv12 pipeline — see plex/stream.py). Derived by `plex.sync.transcode_hw_capable`:
+    # set codec-only at sync (bit depth unknown from the cheap listing), then refined by the bit-depth
+    # backfill (`_probe_media_batch`) which downgrades a 10-bit/HDR HEVC to False. The one filterable
+    # home of the invariant `_want_hw`'s source gate computes at play time — kept in sync via the shared
+    # classifier so the catalog facet and the runtime encoder choice never disagree by codec.
+    transcode_hw: Mapped[bool | None] = mapped_column(Boolean, index=True)
+    # Video bit depth (8/10/12…) from the Plex media Stream, filled by the bit-depth backfill. NULL =
+    # not yet probed. Surfaced on the info page (e.g. "HEVC · 10-bit") and feeds `transcode_hw`.
+    video_bit_depth: Mapped[int | None] = mapped_column(Integer)
+    # Watermark for the bit-depth backfill: when this item's media Stream was last probed for
+    # bit-depth/HDR. NULL = never (the backfill's work-list). Only HW-decodable transcode items are
+    # probed (the rest are SW-only by codec and need no bit-depth); see `_probe_media_batch`.
+    media_probed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
     # Intro/credit markers: [{"type": "intro"|"credits", "start_s": int, "end_s": int}, ...]
     markers: Mapped[list | None] = mapped_column(JSON)
     added_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), index=True)

backend/app/plex/cards.py

@@ -33,6 +33,7 @@ def movie_card(it: PlexItem, st: PlexState | None) -> dict:
         "thumb": f"/api/plex/image/{it.rating_key}",
         "art": _art_url(it.rating_key, it.art_key),
         "playable": it.playable,
+        "transcode_hw": it.transcode_hw,  # HW/SW transcode split → the 4-way corner-dot badge
         "status": st.status if st else "new",
         "position_seconds": st.position_seconds if st else 0,
     }
@@ -65,6 +66,7 @@ def episode_card(e: PlexItem, st: PlexState | None) -> dict:
         "duration_seconds": e.duration_s,
         "thumb": f"/api/plex/image/{e.rating_key}",
         "playable": e.playable,
+        "transcode_hw": e.transcode_hw,  # HW/SW transcode split → the 4-way corner-dot badge
         "status": st.status if st else "new",
         "position_seconds": st.position_seconds if st else 0,
     }

backend/app/plex/query.py

@@ -9,6 +9,8 @@ from datetime import datetime, timedelta, timezone
 from sqlalchemy import and_, case, func, or_, select, type_coerce
 from sqlalchemy.dialects.postgresql import JSONB
 
+from app.models import PlexItem
+
 TS_CONFIG = "public.unaccent_simple"
 
 # --- Language-aware column pickers (E5 S6) ----------------------------------
@@ -206,6 +208,33 @@ def apply_meta_filters(q, model, p: dict, lang: str = "en"):
     return q.where(*conds) if conds else q
 
 
+# --- Playback-class filter (E7) — MOVIE-ONLY (a show is an aggregate with no single class) ---------
+# The 4 classes the feed filter + facet expose, derived from the stored `playable` + `transcode_hw`.
+# ONE definition (this SQL CASE) so the filter WHERE and the facet counts can't drift: `playable_conds`
+# filters on it, `facets` groups by it. transcode_hw IS NOT True groups NULL (unprobed) with software.
+# Public — it is the shared source of truth imported by routes.plex.browse (facet order + zero-fill).
+PLAYBACK_CLASSES = ("direct", "remux", "transcode_hw", "transcode_sw")
+
+
+def playback_class_expr():
+    """SQL CASE mapping a PlexItem (movie) to its playback-class string, or NULL. The HW branch must
+    precede the generic transcode branch (ordered evaluation)."""
+    return case(
+        (PlexItem.playable == "direct", "direct"),
+        (PlexItem.playable == "remux", "remux"),
+        (and_(PlexItem.playable == "transcode", PlexItem.transcode_hw.is_(True)), "transcode_hw"),
+        (PlexItem.playable == "transcode", "transcode_sw"),
+        else_=None,
+    )
+
+
+def playable_conds(sel: list[str]) -> list:
+    """A one-element condition list (or empty) selecting the given playback classes — an OR via
+    `class IN (...)` over the shared CASE. Unknown keys are dropped."""
+    keep = [c for c in sel if c in PLAYBACK_CLASSES]
+    return [playback_class_expr().in_(keep)] if keep else []
+
+
 @dataclass
 class LibraryFilters:
     """The shared sidebar filter query-params for /library + /facets, declared once and injected via
@@ -228,6 +257,7 @@ class LibraryFilters:
     keywords: str | None = None  # TMDB keyword chips (E5 S5), CSV; language-neutral
     collections: str | None = None  # CSV of collection rating_keys
     collection_mode: str = "any"  # how multiple collections combine: any (OR, default) | all (AND)
+    playable: str | None = None  # CSV of playback classes: direct|remux|transcode_hw|transcode_sw
 
     def as_dict(self) -> dict:
         return {
@@ -247,6 +277,7 @@ class LibraryFilters:
             "keywords": self.keywords,
             "collections": self.collections,
             "collection_mode": self.collection_mode,
+            "playable": self.playable,
         }
 
 

backend/app/plex/stream.py

@@ -34,6 +34,7 @@ from app.config import settings
 from app.downloads.edit import encode_thread_cap
 from app.models import PlexItem
 from app.plex import paths
+from app.plex.sync import HW_DECODABLE_CODECS
 
 log = logging.getLogger("siftlode.plex")
 
@@ -96,12 +97,14 @@ class HlsSession:
         entry: str,
         transcode: bool = False,
         hw: bool = False,
+        tonemap: bool = False,
     ):
         self.key = key
         self.dir = directory
         self.proc = proc
         self.transcode = transcode  # video re-encoded (non-h264 source), not stream-copied
         self.hw = hw  # transcode ran on the VAAPI hardware encoder (else libx264 software)
+        self.tonemap = tonemap  # HW HDR/10-bit path: OpenCL tonemap between VAAPI decode and encode
         self.start_s = start_s  # the REQUESTED seek offset
         # The REAL media start: with `-ss X -c:v copy` ffmpeg can only cut at the nearest earlier
         # keyframe K<=X, and hls.js zero-bases the timeline to K (so video.currentTime=0 is K, not X).
@@ -143,7 +146,7 @@ _HLS_TAIL = [
 
 # --- Transcode (playable="transcode") video re-encode -----------------------------------------
 # The remux path stream-copies the video (`-c:v copy`); a non-h264 source can't be copied and must be
-# re-encoded to H.264. Two encoders, chosen per-session by `_want_hw`:
+# re-encoded to H.264. The encoder + tonemap are chosen per-session by `_select_encode`:
 #   * VAAPI hardware (`h264_vaapi`) — the prod default once the iGPU is passed in. A full GPU pipeline
 #     (decode + scale + encode all on-device) offloads the CPU almost entirely, so several concurrent
 #     1080p transcodes are fine and the API stays responsive.
@@ -153,24 +156,125 @@ _HLS_TAIL = [
 # Everything else — the `-copyts`/`_HLS_TAIL`/segment/seek-restart model and the AAC audio path — is
 # unchanged, so hls.js, subtitles, multi-audio and seeking keep working exactly as for remux.
 _VAAPI_DEVICE = "/dev/dri/renderD128"
+# Where an OpenCL ICD registers its driver. The Intel NEO runtime (intel-opencl-icd) drops an .icd file
+# here; its presence is the precondition for the HW HDR→SDR tonemap graph (see _opencl_present).
+_OPENCL_ICD_DIR = Path("/etc/OpenCL/vendors")
 # Codecs the prod iGPU (UHD 630 / Quick Sync Gen 9.5) can hardware-DECODE — the precondition for the
-# full-GPU VAAPI pipeline. A source outside this set (AV1, MPEG-4 ASP/XviD…) falls back to software even
-# when the render node is present, because the GPU can't decode it to feed its own encoder.
-_HW_DECODABLE = {"h264", "hevc", "h265", "vp9", "vc1", "mpeg2video"}
+# full-GPU VAAPI pipeline. A source outside it (AV1, MPEG-4 ASP/XviD…) falls back to software even with
+# the render node present, because the GPU can't decode it to feed its own encoder. THE single source is
+# plex.sync, so the runtime encoder choice here and the catalog `transcode_hw` facet can't disagree by
+# codec; aliased to the old name to keep the call sites below unchanged.
+_HW_DECODABLE = HW_DECODABLE_CODECS
+# Color-transfer values that mark a true-HDR source (PQ / HLG). A HW-decodable HDR source can't take the
+# plain scale_vaapi=format=nv12 path (Gen 9.5 VPP refuses it) — it needs the OpenCL tonemap graph
+# (_venc_opts tonemap branch) when the OpenCL runtime is present, else software libx264. A 10-bit source
+# WITHOUT one of these transfers is SDR, not HDR, and must not be tone-mapped. See _probe_video_kind.
+_HDR_TRANSFERS = {"smpte2084", "arib-std-b67"}
 
 
-def _hwaccel_in_opts(hw: bool) -> list[str]:
+# The three source classes that drive the transcode-pipeline choice (see _probe_video_kind).
+_VK_HWSAFE = "hwsafe"  # 8-bit SDR — the plain scale_vaapi=format=nv12 GPU path
+_VK_HDR = "hdr"  # PQ/HLG HDR — needs the OpenCL tonemap graph (or software if no runtime)
+_VK_SDR10 = "sdr10"  # 10-bit *SDR* — a plain 10→8-bit downconvert, NEVER the HDR tone curve
+
+
+def _probe_video_kind(src: Path) -> str:
+    """Classify the source for the transcode pipeline — one of `_VK_HWSAFE` / `_VK_HDR` / `_VK_SDR10`:
+
+      * `_VK_HWSAFE` — 8-bit SDR: safe for the plain VAAPI path (`scale_vaapi=format=nv12` + h264_vaapi).
+      * `_VK_HDR`    — PQ/HLG HDR (any depth): the plain scale path breaks on Gen 9.5 VPP, so it needs the
+        OpenCL tonemap graph (`tonemap_opencl=hable`) when the runtime is present, else software libx264.
+      * `_VK_SDR10`  — 10-bit but *SDR* (bt709 etc.): NOT HDR. Applying the HDR hable tone curve here would
+        visibly alter an SDR picture (crushed highlights/midtones) where only a 10→8-bit downconvert was
+        needed, so it must NOT take the tonemap graph — it goes to software libx264, which CPU-decodes and
+        downconverts to 8-bit yuv420p exactly. (Kept off the plain scale_vaapi 10-bit path too: that path
+        is unverified on Gen 9.5 VPP, and software is the known-correct downconvert.)
+
+    Ground truth from ffprobe (bit depth via pix_fmt / bits_per_raw_sample, HDR via color_transfer); the
+    Plex mirror doesn't store these. Returns `_VK_HWSAFE` on any probe failure: the runtime HW→SW fallback
+    in start_session backstops a HW session that still produces nothing, so a probe miss only costs the
+    rare wasted first attempt, never a stranded item."""
+    try:
+        out = subprocess.run(
+            [
+                "ffprobe",
+                "-v",
+                "error",
+                "-select_streams",
+                "v:0",
+                "-show_entries",
+                "stream=pix_fmt,bits_per_raw_sample,color_transfer",
+                "-of",
+                "default=noprint_wrappers=1",
+                str(src),
+            ],
+            capture_output=True,
+            text=True,
+            timeout=10,
+        )
+    except (subprocess.SubprocessError, OSError):
+        return _VK_HWSAFE
+    pix_fmt = bits = transfer = ""
+    for line in out.stdout.splitlines():
+        k, _, v = line.strip().partition("=")
+        v = v.strip().lower()
+        if k == "pix_fmt":
+            pix_fmt = v
+        elif k == "bits_per_raw_sample":
+            bits = v
+        elif k == "color_transfer":
+            transfer = v
+    if transfer in _HDR_TRANSFERS:
+        return _VK_HDR  # PQ/HLG — needs a real HDR→SDR tonemap, not a plain downconvert
+    # >8-bit but not HDR = 10-bit SDR. bits_per_raw_sample OR the pix_fmt bit-depth suffix
+    # (yuv420p10le, p010le, yuv444p12le…) signals >8-bit even when the other is absent.
+    if (bits.isdigit() and int(bits) > 8) or re.search(r"(?:10|12|16)(?:le|be)$", pix_fmt):
+        return _VK_SDR10
+    return _VK_HWSAFE
+
+
+def _opencl_present() -> bool:
+    """Whether an OpenCL runtime (Intel NEO / intel-opencl-icd) is installed — the precondition for the
+    HW HDR→SDR tonemap graph. Gen 9.5 VPP can't tonemap natively (tonemap_vaapi fails), so the working
+    HW path for a 10-bit/HDR source is VAAPI-decode → OpenCL tonemap → VAAPI-encode, which needs an ICD
+    registered here. Absent on the dev box and until the image bakes NEO in → those sources take
+    software libx264. Its own function so it's monkeypatchable in tests, mirroring _render_node_present."""
+    try:
+        return any(_OPENCL_ICD_DIR.glob("*.icd"))
+    except OSError:
+        return False
+
+
+def _hwaccel_in_opts(hw: bool, tonemap: bool = False) -> list[str]:
     """VAAPI decode options, placed before `-i` so the source is decoded (and kept) on the GPU.
     `-hwaccel_output_format vaapi` keeps frames as GPU surfaces all the way to `h264_vaapi` — no
-    round-trip to system memory. Empty for the software path."""
+    round-trip to system memory. Empty for the software path.
+
+    The tonemap variant additionally derives an OpenCL device FROM the VAAPI one (`opencl=ocl@va`) so
+    tonemap_opencl can map the decoded surfaces zero-copy (see _venc_opts); it needs named devices, so it
+    uses `-init_hw_device` + `-hwaccel_device` rather than the plain path's implicit `-vaapi_device`."""
     if not hw:
         return []
+    if tonemap:
+        return [
+            "-init_hw_device",
+            f"vaapi=va:{_VAAPI_DEVICE}",
+            "-init_hw_device",
+            "opencl=ocl@va",
+            "-hwaccel",
+            "vaapi",
+            "-hwaccel_output_format",
+            "vaapi",
+            "-hwaccel_device",
+            "va",
+        ]
     return ["-hwaccel", "vaapi", "-hwaccel_output_format", "vaapi", "-vaapi_device", _VAAPI_DEVICE]
 
 
 def _venc_opts(
     transcode: bool,
     hw: bool,
+    tonemap: bool = False,
     preset: str = "veryfast",
     crf: int = 20,
     max_height: int = 0,
@@ -183,6 +287,23 @@ def _venc_opts(
     if not transcode:
         return ["-c:v", "copy"]
     force_kf = ["-force_key_frames", f"expr:gte(t,n_forced*{_SEG_SECONDS})"]
+    if hw and tonemap:
+        # HDR/10-bit HW path: Gen 9.5 VPP can't tonemap (scale_vaapi=format=nv12 fails), so the decoded
+        # VAAPI surfaces are mapped to OpenCL (hwmap=derive_device=opencl), tone-mapped HDR→SDR to 8-bit
+        # nv12 there (tonemap_opencl, hable curve, bt709 out), then mapped back to VAAPI (reverse=1) for
+        # h264_vaapi. `-filter_hw_device ocl` tells the filter graph which device to run the OpenCL
+        # filters on. Full GPU pipeline — ~1 CPU core, several×realtime on the UHD 630 (measured).
+        return [
+            "-filter_hw_device",
+            "ocl",
+            "-vf",
+            "hwmap=derive_device=opencl,"
+            "tonemap_opencl=tonemap=hable:transfer=bt709:matrix=bt709:primaries=bt709:format=nv12,"
+            "hwmap=derive_device=vaapi:reverse=1",
+            "-c:v",
+            "h264_vaapi",
+            *force_kf,
+        ]
     if hw:
         # scale_vaapi with format=nv12 downconverts a 10-bit (p010) HEVC source to 8-bit nv12 so
         # h264_vaapi (8-bit High) can encode it; for an 8-bit source it's a cheap format pass-through.
@@ -220,20 +341,53 @@ def _render_node_present() -> bool:
     return Path(_VAAPI_DEVICE).exists()
 
 
-def _want_hw(db: DbSession, item: PlexItem, transcode: bool) -> bool:
-    """Whether to use the VAAPI hardware encoder for this transcode session, honouring the admin
-    `plex_transcode_hw` policy: "off" → always software; "on" → VAAPI wherever the render node exists
-    (trusting the admin, skipping the source-decodability gate); "auto" (default) → VAAPI only when the
-    render node is present AND the iGPU can hardware-decode the source (else the full-GPU pipeline can't
-    feed itself → software libx264)."""
+def _select_encode(db: DbSession, item: PlexItem, transcode: bool, src: Path) -> tuple[bool, bool]:
+    """Pick the transcode video pipeline for this session — returns `(hw, tonemap)`:
+      * `(False, False)` → software libx264 (the fallback: no render node, non-decodable source, or a
+        10-bit/HDR source with no OpenCL runtime to tonemap on the GPU).
+      * `(True, False)`  → full-GPU VAAPI (`scale_vaapi=format=nv12` + `h264_vaapi`) — an 8-bit SDR source.
+      * `(True, True)`   → VAAPI decode → OpenCL tonemap → VAAPI encode — a true-HDR (PQ/HLG) source, when
+        the OpenCL runtime is present (Gen 9.5 VPP can't tonemap natively).
+
+    A 10-bit *SDR* source is deliberately NOT a `(True, True)` case: it needs a plain 10→8-bit downconvert,
+    not the HDR tone curve (which would visibly darken/flatten an SDR picture), so it drops to software.
+
+    Honours the admin `plex_transcode_hw` policy: "off" → always software; "on" → HW wherever the render
+    node exists (trusting the admin, skipping the decodability gate — the runtime HW→SW fallback still
+    backstops a session that produces nothing — but still routing a true-HDR source through the tonemap
+    graph so it doesn't hit the scale_vaapi wall); "auto" (default) → HW only when the render node is
+    present AND the iGPU can hardware-decode the source, with tonemap chosen only for a true-HDR (PQ/HLG)
+    source that has an OpenCL runtime, while a 10-bit SDR source drops to software."""
     if not transcode:
-        return False
+        return (False, False)
     mode = (sysconfig.get_str(db, "plex_transcode_hw") or "auto").lower()
     if mode == "off" or not _render_node_present():
-        return False
+        return (False, False)
     if mode == "on":
-        return True
-    return (item.codec_video or "").lower() in _HW_DECODABLE
+        # Trust the admin: HW wherever the render node exists, skipping the decodability gate (the runtime
+        # backstop catches a miss). Only a true-HDR (PQ/HLG) source needs the tonemap graph — a 10-bit SDR
+        # source takes the plain scale path here, NOT the HDR tone curve. Probe only when OpenCL exists
+        # (short-circuit), so "on" stays probe-free where tonemap can't apply anyway.
+        tonemap = _opencl_present() and _probe_video_kind(src) == _VK_HDR
+        return (True, tonemap)
+    # auto
+    if (item.codec_video or "").lower() not in _HW_DECODABLE:
+        return (False, False)
+    kind = _probe_video_kind(src)
+    if kind == _VK_HWSAFE:
+        return (True, False)  # 8-bit SDR → full-GPU scale path
+    if kind == _VK_HDR:
+        # PQ/HLG: HW OpenCL tonemap when the runtime is present, else software libx264.
+        return (True, True) if _opencl_present() else (False, False)
+    # _VK_SDR10 — 10-bit SDR: a plain 10→8-bit downconvert, done exactly on the CPU. Never the HDR tone
+    # curve (it would alter an SDR picture), and off the unverified scale_vaapi 10-bit path — software.
+    return (False, False)
+
+
+def _want_hw(db: DbSession, item: PlexItem, transcode: bool, src: Path) -> bool:
+    """The HW gate on its own (the `hw` half of `_select_encode`). A readability shim for the tests that
+    assert only whether a session runs on the GPU (production decides via `_select_encode` directly)."""
+    return _select_encode(db, item, transcode, src)[0]
 
 
 # CPU-nice increment for the SOFTWARE transcode child. The Plex ffmpeg is a Popen in the long-lived API
@@ -288,15 +442,17 @@ def _ffmpeg_cmd(
     audio_langs: list[str] | None = None,
     transcode: bool = False,
     hw: bool = False,
+    tonemap: bool = False,
     preset: str = "veryfast",
     crf: int = 20,
     max_height: int = 0,
 ) -> list[str]:
     # For a transcode session the video is re-encoded (VAAPI or libx264) instead of stream-copied; the
     # hwaccel decode options go before -i, the encoder args replace `-c:v copy` below. Everything else is
-    # identical to remux.
-    venc = _venc_opts(transcode, hw, preset, crf, max_height)
-    args = ["ffmpeg", "-nostdin", "-loglevel", "error", *_hwaccel_in_opts(hw)]
+    # identical to remux. `tonemap` is the HDR/10-bit HW variant (OpenCL tonemap between VAAPI decode and
+    # encode) — it needs matching decode-side (named devices) and encode-side (the OpenCL filter graph) opts.
+    venc = _venc_opts(transcode, hw, tonemap, preset, crf, max_height)
+    args = ["ffmpeg", "-nostdin", "-loglevel", "error", *_hwaccel_in_opts(hw, tonemap)]
     # Keep ORIGINAL timestamps on the output so the first segment carries the true absolute PTS of the
     # keyframe ffmpeg actually seeked to. hls.js still zero-bases playback to that PTS; we read it back
     # (see _probe_first_pts) to learn the real content offset. Without -copyts the segment PTS is
@@ -425,67 +581,104 @@ def start_session(
         return None
     key = item.rating_key
     start_s = max(0.0, float(start_s))
-    hw = _want_hw(db, item, transcode)
-    # Software-fallback encode tuning — read only on the SW transcode path (the VAAPI path and remux
-    # ignore preset/crf/max_height, and remux must not touch the DB for them).
-    preset, crf, max_height = "veryfast", 20, 0
-    if transcode and not hw:
-        preset = sysconfig.get_str(db, "plex_transcode_preset") or "veryfast"
-        crf = sysconfig.get_int(db, "plex_transcode_crf")
-        max_height = sysconfig.get_int(db, "plex_transcode_max_height")
     audio_langs = _probe_audio_langs(src) if multi else []
     is_multi = len(audio_langs) > 1  # only worth a master playlist when there really are ≥2 tracks
-    # Nice the SOFTWARE transcode child (not the HW path, and not remux) so a CPU-bound re-encode can't
-    # starve the co-located API/playback. preexec_fn runs in the forked child (POSIX); on a platform
-    # without fork (the API always runs in a Linux container in prod) it's simply omitted.
-    preexec = _sw_child_preexec if (transcode and not hw and os.name == "posix") else None
-    with _lock:
-        old = _sessions.pop(key, None)
-        if old is not None:
-            _kill(old)
-        tag = "multi" if is_multi else str(audio_ord)
-        directory = _HLS_ROOT / f"{key}_{int(start_s)}_{tag}_{aoff:+.2f}"
-        shutil.rmtree(directory, ignore_errors=True)
-        directory.mkdir(parents=True, exist_ok=True)
-        proc = subprocess.Popen(
-            _ffmpeg_cmd(
-                src,
-                start_s,
-                directory,
-                audio_ord,
-                aoff,
-                audio_langs if is_multi else None,
-                transcode=transcode,
-                hw=hw,
-                preset=preset,
-                crf=crf,
-                max_height=max_height,
-            ),
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-            preexec_fn=preexec,
-        )
-        s = HlsSession(
-            key,
-            directory,
-            proc,
-            start_s,
-            "master.m3u8" if is_multi else "index.m3u8",
-            transcode=transcode,
-            hw=hw,
-        )
-        _sessions[key] = s
-        # Admin-configurable concurrency cap (Configuration → Plex → Max concurrent transcodes);
-        # at least 1 so playback can't be capped to zero.
-        _enforce_cap(max(1, sysconfig.get_int(db, "plex_max_transcodes")))
+    tag = "multi" if is_multi else str(audio_ord)
+    directory = _HLS_ROOT / f"{key}_{int(start_s)}_{tag}_{aoff:+.2f}"
 
-    # Wait for the first video segment, then warm up a few more — all outside the lock (this blocks on
-    # ffmpeg producing them, and we must not hold up other sessions).
     def _seg(i: int) -> Path:
         # multi-audio: the video rendition is variant v0 → seg_{i}_0.ts; single-audio → seg_{i}.ts
         return directory / (f"seg_{i}_0.ts" if is_multi else f"seg_{i}.ts")
 
-    if wait_for(_seg(0), timeout=25.0):
+    def _spawn(
+        hw: bool, tonemap: bool = False, *, replace_only: "HlsSession | None" = None
+    ) -> "HlsSession | None":
+        # `replace_only` makes the supersede identity-aware for the runtime fallback: the whole
+        # check-and-replace happens under ONE _lock, so a newer same-key session (a concurrent
+        # seek-restart) installed between the fallback's decision and here is never clobbered. When the
+        # registered session is no longer `replace_only`, we abort and return None (the caller yields to
+        # whoever is registered now). The INITIAL spawn passes replace_only=None and always supersedes —
+        # that is the seek-restart's intended last-writer-wins.
+        # Software-fallback encode tuning — read only on the SW transcode path (the VAAPI path and
+        # remux ignore preset/crf/max_height, and remux must not touch the DB for them).
+        preset, crf, max_height = "veryfast", 20, 0
+        if transcode and not hw:
+            preset = sysconfig.get_str(db, "plex_transcode_preset") or "veryfast"
+            crf = sysconfig.get_int(db, "plex_transcode_crf")
+            max_height = sysconfig.get_int(db, "plex_transcode_max_height")
+        # Nice the SOFTWARE transcode child (not the HW path, and not remux) so a CPU-bound re-encode
+        # can't starve the co-located API/playback. preexec_fn runs in the forked child (POSIX); on a
+        # platform without fork (the API always runs in a Linux container in prod) it's simply omitted.
+        preexec = _sw_child_preexec if (transcode and not hw and os.name == "posix") else None
+        with _lock:
+            if replace_only is not None and _sessions.get(key) is not replace_only:
+                return None  # superseded/culled while we waited out of lock — don't clobber the newer one
+            old = _sessions.pop(key, None)
+            if old is not None:
+                _kill(old)
+            shutil.rmtree(directory, ignore_errors=True)
+            directory.mkdir(parents=True, exist_ok=True)
+            proc = subprocess.Popen(
+                _ffmpeg_cmd(
+                    src,
+                    start_s,
+                    directory,
+                    audio_ord,
+                    aoff,
+                    audio_langs if is_multi else None,
+                    transcode=transcode,
+                    hw=hw,
+                    tonemap=tonemap,
+                    preset=preset,
+                    crf=crf,
+                    max_height=max_height,
+                ),
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+                preexec_fn=preexec,
+            )
+            s = HlsSession(
+                key,
+                directory,
+                proc,
+                start_s,
+                "master.m3u8" if is_multi else "index.m3u8",
+                transcode=transcode,
+                hw=hw,
+                tonemap=tonemap,
+            )
+            _sessions[key] = s
+            # Admin-configurable concurrency cap (Configuration → Plex → Max concurrent transcodes);
+            # at least 1 so playback can't be capped to zero.
+            _enforce_cap(max(1, sysconfig.get_int(db, "plex_max_transcodes")))
+        return s
+
+    s = _spawn(*_select_encode(db, item, transcode, src))
+    # Wait for the first video segment outside the lock (this blocks on ffmpeg, and we must not hold up
+    # other sessions). Pass the proc so a HW session that dies at VAAPI init fails fast (not after 25s).
+    ready = wait_for(_seg(0), timeout=25.0, proc=s.proc)
+    if not ready and s.hw:
+        # We waited on _seg(0) OUTSIDE _lock, so `s.proc` dying is ambiguous: it may have failed on its
+        # own (VAProfile/init/tonemap refusal), OR a concurrent same-key _spawn (a rapid seek-restart) or
+        # _enforce_cap may have killed it to install/keep a newer session. Respawn on libx264 (no HW, no
+        # tonemap) so a genuinely-failed GPU session never strands playback — but pass `replace_only=s` so
+        # the respawn is a no-op if we've been superseded: the identity check and the pop+replace share
+        # ONE lock in _spawn, so we can never tear down the newer session. s.hw is now False, so the route
+        # honestly reports "CPU" and the player's Preparing-stream state stays correct.
+        log.warning(
+            "plex transcode: HW session produced no segments — falling back to software key=%s", key
+        )
+        respawned = _spawn(False, False, replace_only=s)
+        if respawned is None:
+            # Superseded/culled mid-fallback — yield whoever is registered now (a newer seek-restart), or
+            # our own now-dead session if the key was cap-culled. Never None here: the POST /session route
+            # turns a None return into a "Media file not found on disk" 404 — dishonest for a file that
+            # exists. A (dead) session instead degrades to a retryable 404 ("No active playback session" /
+            # "Not available yet") the client re-requests.
+            return current_session(key) or s
+        s = respawned
+        ready = wait_for(_seg(0), timeout=25.0, proc=s.proc)
+    if ready:
         # For a seek (start_s>0) learn the REAL start offset K from the first segment's absolute PTS,
         # so the client's absolute clock + subtitle shift key off the true keyframe, not the requested
         # offset. On probe failure we keep the provisional requested offset (old behaviour, small drift).
@@ -497,17 +690,18 @@ def start_session(
         # at the first segment that isn't ready in time — ffmpeg produces them faster than realtime once
         # warm, so a miss means something slow and we proceed rather than block the request further.
         for i in range(1, _WARMUP_SEGMENTS):
-            if not wait_for(_seg(i), timeout=_WARMUP_SEG_TIMEOUT_S):
+            if not wait_for(_seg(i), timeout=_WARMUP_SEG_TIMEOUT_S, proc=s.proc):
                 break
     log.info(
-        "plex hls session start key=%s req=%.1f real=%.3f multi=%s audio=%s transcode=%s hw=%s",
+        "plex hls session start key=%s req=%.1f real=%.3f multi=%s audio=%s transcode=%s hw=%s tonemap=%s",
         key,
         start_s,
         s.media_start_s,
         is_multi,
         audio_ord,
         transcode,
-        hw,
+        s.hw,
+        s.tonemap,
     )
     return s
 
@@ -520,10 +714,14 @@ def current_session(key: str) -> HlsSession | None:
         return s
 
 
-def wait_for(path: Path, timeout: float = 20.0) -> bool:
+def wait_for(path: Path, timeout: float = 20.0, proc: subprocess.Popen | None = None) -> bool:
     """Wait until a session file (playlist / segment) exists and is non-empty. Segments are
     produced ~faster than realtime, so a segment just ahead of playback appears quickly; a segment
-    far beyond the generated region won't (the frontend restarts the session at a seek instead)."""
+    far beyond the generated region won't (the frontend restarts the session at a seek instead).
+
+    With `proc` given, also stop as soon as that ffmpeg exits: a VAAPI session that fails to init
+    (10-bit/HDR VAProfile refusal) dies within ~1s producing nothing, and without this we'd block the
+    whole `timeout` before the HW→SW fallback could kick in — turning the fix into a stall."""
     end = time.time() + timeout
     while time.time() < end:
         try:
@@ -531,6 +729,12 @@ def wait_for(path: Path, timeout: float = 20.0) -> bool:
                 return True
         except OSError:
             pass
+        if proc is not None and proc.poll() is not None:
+            # the producer exited — no more segments are coming; one last check then give up.
+            try:
+                return path.exists() and path.stat().st_size > 0
+            except OSError:
+                return False
         time.sleep(0.15)
     return path.exists()
 

backend/app/plex/sync.py

@@ -18,7 +18,7 @@ item-detail/player path (P2), not here.
 import logging
 from datetime import datetime, timezone
 
-from sqlalchemy import select
+from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
 from app import sysconfig
@@ -58,6 +58,57 @@ def classify_playable(vcodec: str | None, acodec: str | None, container: str | N
     return "direct"
 
 
+# Video codecs the prod iGPU (UHD 630 / Quick Sync Gen 9.5) can hardware-DECODE — the precondition for
+# the full-GPU VAAPI transcode pipeline. THE single source of this set: plex.stream imports it here so
+# the runtime encoder choice (`_want_hw`) and this catalog facet can never disagree by codec. A source
+# outside it (AV1, MPEG-4 ASP/XviD…) is software-only even on the iGPU (it can't decode it to feed its
+# own encoder).
+HW_DECODABLE_CODECS = frozenset({"h264", "hevc", "h265", "vp9", "vc1", "mpeg2video"})
+# Color-transfer values marking an HDR source (PQ / HLG). A 10-bit/HDR source breaks the VAAPI
+# scale=nv12 path on Gen 9.5 (see plex.stream) → software transcode, so it counts as NOT HW-capable.
+_HDR_TRANSFERS = frozenset({"smpte2084", "arib-std-b67"})
+
+
+def transcode_hw_capable(
+    playable: str | None,
+    vcodec: str | None,
+    bit_depth: int | None = None,
+    hdr: bool = False,
+) -> bool | None:
+    """The stored `PlexItem.transcode_hw` facet: for a `playable="transcode"` item, whether the prod
+    iGPU can HARDWARE-transcode it (else software libx264 only); None for a non-transcode item. HW needs
+    a HW-decodable codec AND an 8-bit SDR source — a 10-bit/HDR source (bit_depth>8 or an HDR transfer)
+    breaks the VAAPI nv12 pipeline and falls back to software. `bit_depth`/`hdr` are unknown at sync
+    time (the cheap listing carries no Stream), so they default to 8-bit SDR (codec-only) and the
+    bit-depth backfill refines a 10-bit/HDR HEVC to False later."""
+    if playable != "transcode":
+        return None
+    if (vcodec or "").lower() not in HW_DECODABLE_CODECS:
+        return False
+    if bit_depth is not None and bit_depth > 8:
+        return False
+    return not hdr
+
+
+def _video_stream_props(meta: dict) -> tuple[int | None, bool]:
+    """(bit_depth, is_hdr) from a FULL Plex metadata dict's video Stream (Media→Part→Stream, streamType
+    1). Only the rich metadata call carries Stream; the cheap listing does not — so this is read by the
+    bit-depth backfill, not the listing sync. (None, False) when absent/unparseable."""
+    for m in meta.get("Media") or []:
+        for part in m.get("Part") or []:
+            for s in part.get("Stream") or []:
+                if s.get("streamType") != 1:  # 1 = video
+                    continue
+                bd = s.get("bitDepth")
+                try:
+                    depth = int(bd) if bd else None
+                except (TypeError, ValueError):
+                    depth = None
+                hdr = str(s.get("colorTrc") or "").lower() in _HDR_TRANSFERS
+                return depth, hdr
+    return None, False
+
+
 def _epoch(v) -> datetime | None:
     try:
         return datetime.fromtimestamp(int(v), tz=timezone.utc) if v else None
@@ -217,6 +268,13 @@ def sync(db: Session) -> dict:
                 stats["people_enriched"] = _enrich_people_batch(db, plex)
             except Exception as e:  # best-effort — never fail the sync over the backfill
                 log.warning("Plex people enrich batch failed: %s", e)
+            # Probe a bounded batch of HW-decodable transcode items for bit-depth/HDR, so the
+            # playback-class filter's HW/SW split is precise (a 10-bit/HDR HEVC → software) over
+            # successive runs. Only HW-decodable-codec transcodes are probed — the rest are SW by codec.
+            try:
+                stats["media_probed"] = _probe_media_batch(db, plex)
+            except Exception as e:  # best-effort — never fail the sync over the backfill
+                log.warning("Plex media probe batch failed: %s", e)
     except PlexNotConfigured as e:
         return {"skipped": str(e)}
     except PlexError as e:
@@ -236,6 +294,49 @@ def sync(db: Session) -> dict:
 # How many titles to rich-fetch per sync run for the cast backfill — bounds the extra Plex load; the
 # whole library is covered over successive runs (each fetched item is stamped people_enriched_at once).
 _ENRICH_BATCH = 60
+# Same bounded-per-run pattern for the bit-depth probe. Only HW-decodable-codec transcode items are
+# probed (typically a small minority — the bulk of transcodes are old codecs that are SW by codec), so
+# a modest batch covers the work-list in a run or two; a stuck item retries next run (watermark unset).
+_PROBE_BATCH = 60
+
+
+def _probe_media_batch(db: Session, plex: PlexClient, limit: int = _PROBE_BATCH) -> int:
+    """Rich-fetch up to `limit` not-yet-probed HW-decodable transcode items, read the video Stream's
+    bit-depth + HDR, and store `video_bit_depth` + the refined `transcode_hw` (a 10-bit/HDR HEVC →
+    False/software). Stamps `media_probed_at` on every attempt (success OR a Plex miss with no Stream),
+    so an item is probed once and not re-fetched every sync; a transient fetch FAILURE leaves the
+    watermark unset to retry. Oldest-id first. Returns how many items were probed this run."""
+    rows = (
+        db.execute(
+            select(PlexItem)
+            .where(
+                PlexItem.playable == "transcode",
+                func.lower(PlexItem.codec_video).in_(HW_DECODABLE_CODECS),
+                PlexItem.media_probed_at.is_(None),
+            )
+            .order_by(PlexItem.id)
+            .limit(limit)
+        )
+        .scalars()
+        .all()
+    )
+    now = datetime.now(timezone.utc)
+    n = 0
+    for row in rows:
+        try:
+            meta = plex.metadata(row.rating_key) or {}
+        except Exception as e:  # transient — leave media_probed_at NULL so it retries next run
+            log.debug("Plex media probe fetch failed for %s: %s", row.rating_key, e)
+            continue
+        bit_depth, hdr = _video_stream_props(meta)
+        row.video_bit_depth = bit_depth
+        row.transcode_hw = transcode_hw_capable("transcode", row.codec_video, bit_depth, hdr)
+        row.media_probed_at = (
+            now  # probed (even if Plex carried no Stream — don't re-fetch forever)
+        )
+        n += 1
+    db.commit()
+    return n
 
 
 def _enrich_people_batch(db: Session, plex: PlexClient, limit: int = _ENRICH_BATCH) -> int:
@@ -369,15 +470,41 @@ def _apply_item(row: PlexItem, lib_id: int, kind: str, meta: dict) -> None:
     row.added_at = _epoch(meta.get("addedAt"))
     _apply_facet_fields(row, meta)  # filterable/orderable extras (shared with shows)
     mf = _media_facts(meta)
+    new_vcodec = mf.get("codec_video")
+    new_part_key = mf.get("part_key")
+    # The physical file was replaced when its video codec changes OR — for a SINGLE-version item — when its
+    # Plex Part key changes (a re-encode / quality upgrade gets a new part id). Either way any probed
+    # bit-depth is stale, so reset the probe watermark and re-derive transcode_hw from codec alone until the
+    # backfill re-probes. Codec alone is NOT enough: a same-codec bit-depth re-encode (8-bit→10-bit HEVC)
+    # keeps the codec `hevc` but flips the HW class, and only the part-key move catches it.
+    #
+    # The part-key check is gated on single-version because `_media_facts` reads media[0]/part[0], and for a
+    # MULTI-version item (an original + a Plex "Optimized" copy) that order isn't guaranteed stable across
+    # listings — an unguarded part-key compare would then reset+re-probe every sync and oscillate the
+    # transcode_hw bucket between the two versions. A multi-version same-codec re-encode not self-healing is
+    # an acceptable rare edge; a per-sync re-probe loop is not.
+    single_version = len(meta.get("Media") or []) <= 1
+    codec_changed = (row.codec_video or "").lower() != (new_vcodec or "").lower()
+    if codec_changed or (single_version and row.part_key != new_part_key):
+        row.video_bit_depth = None
+        row.media_probed_at = None
     row.file_path = mf.get("file_path")
-    row.part_key = mf.get("part_key")
+    row.part_key = new_part_key
     row.container = mf.get("container")
-    row.codec_video = mf.get("codec_video")
+    row.codec_video = new_vcodec
     row.codec_audio = mf.get("codec_audio")
     row.size_bytes = mf.get("size_bytes")
     row.playable = classify_playable(
         mf.get("codec_video"), mf.get("codec_audio"), mf.get("container")
     )
+    # transcode_hw: keep the bit-depth backfill's authoritative value (it folds in bit-depth + HDR) once
+    # probed; otherwise (re)derive the provisional codec-only class. A non-transcode item is always None,
+    # even if it had been probed as a transcode before (an audio/container flip to remux without a codec
+    # change wouldn't reset the watermark, so pin it here).
+    if row.playable != "transcode":
+        row.transcode_hw = None
+    elif row.media_probed_at is None:
+        row.transcode_hw = transcode_hw_capable("transcode", row.codec_video, row.video_bit_depth)
 
 
 def _prune_stale(

backend/app/ratelimit.py

@@ -18,6 +18,13 @@ class RateLimiter:
         self._hits: dict[str, list[float]] = {}
         self._lock = threading.Lock()
 
+    def reset(self) -> None:
+        """Forget every recorded attempt. Each limiter is a module-level singleton, so a test suite
+        sharing one process would otherwise pool all of its attempts into a single window and
+        eventually trip an unrelated test with a 429."""
+        with self._lock:
+            self._hits.clear()
+
     def allow(self, key: str) -> bool:
         """Record an attempt for ``key`` and return whether it is within the limit.
 

backend/app/routes/admin.py

@@ -1,6 +1,7 @@
 """Admin-only onboarding: review access requests (Invites), approve/deny, manual add.
 Also the demo-account admin surface: the demo email whitelist + a manual state reset."""
 
+from collections.abc import Iterable
 from datetime import datetime, timezone
 
 from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException
@@ -18,6 +19,7 @@ from app.auth import (
     operator_contact,
     purge_user,
 )
+from app.config import settings
 from app.db import get_db
 from app.demo import reset_demo_state
 from app.models import (
@@ -31,7 +33,26 @@ from app.utils import iso, valid_email
 router = APIRouter(prefix="/api/admin", tags=["admin"])
 
 
-def _serialize(inv: Invite) -> dict:
+def _accounts_for(db: Session, emails: Iterable[str]) -> set[str]:
+    """Which of these addresses already have an account. Batched, so listing the invites costs one
+    extra query. An invite whose address has an account must not be deletable: `is_allowed` reads
+    this row, so removing it would silently revoke a live user's access."""
+    wanted = {e.lower() for e in emails if e}
+    if not wanted:
+        return set()
+    rows = db.execute(select(User.email).where(User.email.in_(wanted))).scalars()
+    return {e.lower() for e in rows if e}
+
+
+def _env_allowed(email: str) -> bool:
+    """Whether the env bootstrap lists still let this address in. `is_allowed` consults them only
+    when no Invite row exists, so this is exactly what deleting the row would fall back to — and the
+    admin has to know that BEFORE they confirm, not from a toast afterwards."""
+    email = (email or "").lower()
+    return email in settings.allowed_email_set or email in settings.admin_email_set
+
+
+def _serialize(inv: Invite, *, has_account: bool = False) -> dict:
     return {
         "id": inv.id,
         "email": inv.email,
@@ -40,6 +61,11 @@ def _serialize(inv: Invite) -> dict:
         "requested_at": iso(inv.requested_at),
         "decided_at": iso(inv.decided_at),
         "decided_by": inv.decided_by,
+        # Drives the delete affordance: an entry backed by an account is not removable here.
+        "has_account": has_account,
+        # …and whether removing it would actually take access away, or leave the env allow-list
+        # granting it anyway (for an ADMIN_EMAILS address, as an admin).
+        "still_allowed_by_env": _env_allowed(inv.email),
     }
 
 
@@ -56,7 +82,8 @@ def list_invites(
     rows = db.execute(stmt.order_by(Invite.requested_at.desc())).scalars().all()
     order = {"pending": 0, "approved": 1, "denied": 2}
     rows.sort(key=lambda i: order.get(i.status, 9))
-    return [_serialize(i) for i in rows]
+    accounts = _accounts_for(db, (i.email for i in rows))
+    return [_serialize(i, has_account=(i.email or "").lower() in accounts) for i in rows]
 
 
 def _activate_user_by_email(db: Session, email: str) -> None:
@@ -107,7 +134,7 @@ def approve_invite(
     inv = _decide(db, invite_id, admin, approved=True)
     _activate_user_by_email(db, inv.email)
     background.add_task(email_mod.send_access_approved, inv.email)
-    return _serialize(inv)
+    return _serialize(inv, has_account=bool(_accounts_for(db, [inv.email])))
 
 
 @router.post("/invites/{invite_id}/deny")
@@ -121,7 +148,7 @@ def deny_invite(
     # account is activated, so this is an email only (the requester has no in-app inbox yet).
     inv = _decide(db, invite_id, admin, approved=False)
     background.add_task(email_mod.send_access_denied, inv.email)
-    return _serialize(inv)
+    return _serialize(inv, has_account=bool(_accounts_for(db, [inv.email])))
 
 
 class AddInviteIn(BaseModel):
@@ -150,7 +177,49 @@ def add_invite(
     )
     db.commit()
     _activate_user_by_email(db, email)
-    return _serialize(inv)
+    return _serialize(inv, has_account=bool(_accounts_for(db, [email])))
+
+
+@router.delete("/invites/{invite_id}")
+def delete_invite(
+    invite_id: int,
+    admin: User = Depends(admin_user),
+    db: Session = Depends(get_db),
+) -> dict:
+    """Remove a whitelist/request entry outright — the counterpart to add_invite, for an address that
+    never became an account (an approval added by mistake, or one that is no longer wanted). Deny
+    records a decision and keeps the row for the audit trail; delete forgets the address. Neither
+    stops the person asking again: `upsert_pending_invite` reopens a denied row, and a deleted one
+    simply comes back as a fresh pending request.
+
+    Refused once an account exists for the address, whatever its state: this row is the account's
+    approval gate, and orphaning the account from it would leave a person who can neither sign in nor
+    be approved. Delete the USER instead — purge_user removes the invite along with it.
+
+    Reports `still_allowed_by_env`, because deleting the row is NOT always a revoke: `is_allowed`
+    falls back to the env ALLOWED_EMAILS / ADMIN_EMAILS bootstrap lists once no invite exists, so for
+    an address on those the deletion leaves access intact (and an ADMIN_EMAILS address is still
+    promoted to admin on its next Google sign-in). The admin has to hear that, not guess it."""
+    inv = db.get(Invite, invite_id)
+    if inv is None:
+        raise HTTPException(status_code=404, detail="No such invite")
+    if _accounts_for(db, [inv.email]):
+        raise HTTPException(
+            status_code=409,
+            detail="That address already has an account — delete the account instead.",
+        )
+    still_allowed_by_env = _env_allowed(inv.email)
+    audit.record(
+        db,
+        admin.id,
+        AuditAction.INVITE_DELETE,
+        target_type="invite",
+        target_id=inv.id,
+        summary=inv.email,
+    )
+    db.delete(inv)
+    db.commit()
+    return {"deleted": invite_id, "still_allowed_by_env": still_allowed_by_env}
 
 
 # --- Users & roles --------------------------------------------------------------------

backend/app/routes/auth.py

@@ -636,12 +636,25 @@ def _register_account(email: str, password: str) -> None:
             # no-op as the pre-check hit — roll back and stop.
             db.rollback()
             return
-        upsert_pending_invite(db, email)  # admin-approval gate (commits)
+        upsert_pending_invite(db, email)  # admin-approval gate
+        # Persist the account ourselves. upsert_pending_invite commits only when it actually writes an
+        # invite row — not when this address already has a pending or approved one — and _issue_token
+        # below only runs with SMTP on. So for an address the admin had already approved (or one whose
+        # request was still pending), on an instance with no working SMTP, NOTHING along this path
+        # committed and the flushed user was silently rolled back when the session closed: the
+        # would-be user got the uniform "ok" and no account, and re-registering did the same again.
+        # Commit unconditionally; it is a no-op when upsert already committed the same transaction.
+        db.commit()
         if email_ok:
             raw = _issue_token(db, user, "verify", VERIFY_TTL)
             # Fragment (#), not a query token: keeps the token out of proxy/access logs + Referer (SB3).
             email_mod.send_verify_email(email, f"{_app_base()}/#verify={raw}")
         admins = admin_notify_emails(db)
+        # Fired unconditionally, unlike the other two callers which gate on a fresh invite row: for
+        # an address the admin already approved, nothing lands in the Access-requests queue, so this
+        # is the only place the account's existence is announced at all. Delivery is a separate
+        # matter — with no working SMTP `_send` drops it, which is why the pre-approved registrant
+        # still needs the admin to notice them (roadmap UX-25).
         if admins:
             email_mod.send_admin_new_request(admins, email)
 
@@ -649,15 +662,22 @@ def _register_account(email: str, password: str) -> None:
 @router.post("/verify")
 def verify_email_confirm(body: TokenIn, db: Session = Depends(get_db)) -> dict:
     """Confirm an email-verification token the SPA read from the URL fragment (SB3). Uniform 400
-    on any invalid/expired/used token."""
+    on any invalid/expired/used token.
+
+    `password_reset_required` tells the SPA to send the user straight to the reset flow: an admin who
+    approved this account BEFORE it was verified tripped SEC-10, so the password chosen at registration
+    is gone and sign-in would answer with the deliberately uniform "Invalid email or password" — true,
+    but unreadable to the person who just proved they own the mailbox. Saying so leaks nothing: holding
+    a valid single-use verify token for this account already proves that much."""
     user = _consume_token(db, body.token, "verify")
     if user is None:
         raise HTTPException(
             status_code=400, detail="This verification link is invalid or has expired."
         )
     user.email_verified = True
+    needs_password = user.password_hash is None and user.password_revoked_at is not None
     db.commit()
-    return {"ok": True}
+    return {"ok": True, "password_reset_required": needs_password}
 
 
 @router.post("/verify/resend")
@@ -701,8 +721,10 @@ def verify_email(token: str, db: Session = Depends(get_db)):
     if user is None:
         return RedirectResponse(url="/?verify=invalid")
     user.email_verified = True
+    needs_password = user.password_hash is None and user.password_revoked_at is not None
     db.commit()
-    return RedirectResponse(url="/?verify=ok")
+    # Same two outcomes as the POST flow above, so an old link in flight lands on the same guidance.
+    return RedirectResponse(url="/?verify=" + ("ok_reset" if needs_password else "ok"))
 
 
 @router.post("/password-login")
@@ -767,10 +789,18 @@ def _send_reset_if_eligible(email: str) -> None:
     """Background worker for password_reset_request: issue a reset token + email the link, but ONLY
     for a real (non-demo) password account. Runs after the response with its own DB session, so the
     request's timing never reveals whether the account exists. Token rides the URL FRAGMENT (#) so it
-    can't leak into proxy/access logs or a Referer (SB3)."""
+    can't leak into proxy/access logs or a Referer (SB3).
+
+    "Password account" is `password_hash OR password_revoked_at` — an account SEC-10 stripped had a
+    password and must be able to get a new one, or it is locked out permanently (no password to sign in
+    with, and formerly no reset link either). A Google-only account that never had a password stays
+    ineligible on purpose: its owner adds one from Settings (/auth/set-password) while signed in, which
+    proves identity through the session rather than by mail."""
     with SessionLocal() as db:
         user = db.execute(select(User).where(User.email == email)).scalar_one_or_none()
-        if user is not None and user.password_hash and not user.is_demo:
+        if user is None or user.is_demo:
+            return
+        if user.password_hash or user.password_revoked_at:
             raw = _issue_token(db, user, "reset", RESET_TTL)
             email_mod.send_password_reset(email, f"{_app_base()}/#reset={raw}")
 
@@ -789,6 +819,7 @@ def password_reset_confirm(body: TokenPasswordIn, db: Session = Depends(get_db))
     if user is None:
         raise HTTPException(status_code=400, detail="This reset link is invalid or has expired.")
     user.password_hash = hash_password(new_password)
+    user.password_revoked_at = None  # the account has a password again — SEC-10's trace is spent
     # A valid reset link proves control of the mailbox, so completing a reset also verifies the
     # email — this rescues an account that registered but never clicked the verification link (it
     # can then sign in). The separate admin-approval gate (is_active) is deliberately NOT touched
@@ -831,9 +862,15 @@ def revoke_preset_password_if_unverified(user: User) -> None:
     ownership is finally attested (Google adoption, or admin approval), drop that password and bump the
     epoch to revoke any session it minted; the owner re-sets one via password-reset. No-op for an
     already-verified account, so a legit no-SMTP registration is unaffected. The single source for this
-    rule — both the Google-callback and admin-activation paths call it so they can't drift."""
+    rule — both the Google-callback and admin-activation paths call it so they can't drift.
+
+    `password_revoked_at` is what makes "the owner re-sets one via password-reset" actually true. The
+    revoke leaves `password_hash IS NULL`, which is also what a Google-only account looks like — and
+    _send_reset_if_eligible keyed off exactly that, so a revoked account silently got no reset link and
+    was locked out for good (it could not sign in either). The stamp separates the two cases."""
     if not user.email_verified:
         user.password_hash = None
+        user.password_revoked_at = datetime.now(timezone.utc)
         bump_session_epoch(user)
 
 
@@ -903,6 +940,7 @@ def set_password(
         if not verify_password(body.current_password or "", user.password_hash):
             raise HTTPException(status_code=403, detail="Current password is incorrect.")
     user.password_hash = hash_password(new_password)
+    user.password_revoked_at = None  # same as the reset path: a password exists again
     # SA4: a password change logs out every OTHER session; re-stamp this cookie at the new epoch so
     # the person making the change stays signed in here. Commit BEFORE re-stamping so a failed commit
     # can't leave the cookie at a newer epoch than the DB (which would wrongly 401 THIS session).

backend/app/routes/me.py

@@ -13,6 +13,7 @@ from app.auth import (
     optional_current_user,
     purge_user,
 )
+from app import email as email_mod
 from app import sysconfig
 from app.db import get_db
 from app.models import Invite, User
@@ -98,11 +99,16 @@ def get_me(
     if user is None:
         return {"authenticated": False}
     pending_invites = 0
+    # Admin-only, because it drives an operator warning: email is fail-soft, so a half-filled SMTP
+    # config costs verification links, password resets and access-request notices with nothing
+    # visible anywhere. Surfacing it here puts the warning on the screens where onboarding happens.
+    email_configured = True
     if user.role == "admin":
         pending_invites = (
             db.scalar(select(func.count()).select_from(Invite).where(Invite.status == "pending"))
             or 0
         )
+        email_configured = email_mod.email_enabled(db)  # this request's session; no second connect
     return {
         "authenticated": True,
         "id": user.id,
@@ -121,6 +127,7 @@ def get_me(
         "can_read": has_read_scope(user),
         "can_write": has_write_scope(user),
         "pending_invites": pending_invites,
+        "email_configured": email_configured,
         "preferences": user.preferences or {},
     }
 

backend/app/routes/plex/browse.py

@@ -2,6 +2,7 @@
 
 from fastapi import APIRouter, Depends, Query
 from sqlalchemy import (
+    Boolean,
     Integer,
     String,
     and_,
@@ -27,6 +28,7 @@ from app.plex import rollup
 from app.plex.cards import episode_card
 from app.plex.query import (
     FIELD_COLUMNS,
+    PLAYBACK_CLASSES,
     TS_CONFIG,
     LibraryFilters,
     apply_meta_filters,
@@ -36,6 +38,8 @@ from app.plex.query import (
     genres_col,
     meta_filter_conds,
     movie_status_case,
+    playable_conds,
+    playback_class_expr,
     show_status_case,
     split_csv,
     summary_col,
@@ -135,6 +139,7 @@ def unified_library(
                 PlexItem.originally_available_at.label("rel"),
                 PlexItem.duration_s.label("duration_s"),
                 PlexItem.playable.label("playable"),
+                PlexItem.transcode_hw.label("transcode_hw"),
                 cast(null(), Integer).label("season_count"),
                 func.coalesce(st.position_seconds, 0).label("position_seconds"),
                 m_status.label("status"),
@@ -156,6 +161,8 @@ def unified_library(
             mq = mq.where(PlexItem.duration_s >= f.duration_min)
         if f.duration_max is not None:
             mq = mq.where(PlexItem.duration_s <= f.duration_max)
+        # Playback-class filter (movie-only — a show is an aggregate with no single class).
+        mq = mq.where(*playable_conds(split_csv(f.playable)))
         if tsq is not None:
             mq = mq.where(vector_match(PlexItem, lang, tsq))
         if recheck is not None:
@@ -179,6 +186,7 @@ def unified_library(
                 PlexShow.originally_available_at.label("rel"),
                 cast(null(), Integer).label("duration_s"),
                 cast(null(), String).label("playable"),
+                cast(null(), Boolean).label("transcode_hw"),
                 PlexShow.child_count.label("season_count"),
                 literal(0).label("position_seconds"),
                 s_status.label("status"),
@@ -237,6 +245,7 @@ def unified_library(
                         "duration_seconds": r.duration_s,
                         "thumb": f"/api/plex/image/{r.rk}",
                         "playable": r.playable,
+                        "transcode_hw": r.transcode_hw,
                         "status": r.status,
                         "position_seconds": r.position_seconds,
                     }
@@ -312,6 +321,7 @@ def facets(
         "genres": [],
         "content_ratings": [],
         "studios": [],
+        "playable": [],
         "year_min": None,
         "year_max": None,
         "rating_max": None,
@@ -338,6 +348,9 @@ def facets(
                 query = query.where(model.duration_s >= pp["duration_min"])
             if with_dur and pp.get("duration_max") is not None:
                 query = query.where(model.duration_s <= pp["duration_max"])
+            # Playback-class filter (movie-only) — applied for the OTHER groups so an active class
+            # narrows them; the playable facet itself passes pp with playable=None (self-exclusion).
+            query = query.where(*playable_conds(split_csv(pp.get("playable"))))
             # Join watch-state and reuse the grid's exact movie state filter (unified_library) —
             # hidden movies never appear in the grid, so they must not inflate facet counts/bounds either.
             st = aliased(PlexState)
@@ -356,6 +369,7 @@ def facets(
     genre_counts: dict[str, int] = {}
     cr_counts: dict[str, int] = {}
     studio_counts: dict[str, int] = {}
+    playable_counts: dict[str, int] = {}
     years: list[int] = []
     ratings: list[float] = []
     durs: list[int] = []
@@ -420,6 +434,23 @@ def facets(
         )
         for s, c in db.execute(stq).all():
             studio_counts[s] = studio_counts.get(s, 0) + c
+        # Playback class (movie-only) — exclude its own so each class stays an addable OR option.
+        if kind_movie:
+            pcls = playback_class_expr()
+            pcq = (
+                wsq(
+                    select(pcls.label("cls"), func.count()),
+                    model,
+                    ids,
+                    {**p, "playable": None},
+                    kind_movie,
+                    True,
+                )
+                .where(pcls.isnot(None))
+                .group_by(pcls)
+            )
+            for cls, c in db.execute(pcq).all():
+                playable_counts[cls] = playable_counts.get(cls, 0) + c
         # Year bounds — exclude the year filter.
         by = db.execute(
             wsq(
@@ -477,6 +508,11 @@ def facets(
     # Same for the actively-selected studios, so a selected studio stays removable even at zero matches.
     for s in split_csv(f.studios):
         studio_counts.setdefault(s, 0)
+    # Keep an actively-selected playback class visible even at zero matches (the sidebar hides the whole
+    # section when its facet list is empty, which would trap a zero-result selection with no way to undo).
+    for c in split_csv(f.playable):
+        if c in PLAYBACK_CLASSES:
+            playable_counts.setdefault(c, 0)
     return {
         "genres": [
             {"value": g, "count": c} for g, c in sorted(genre_counts.items(), key=lambda kv: kv[0])
@@ -488,6 +524,12 @@ def facets(
             {"value": s, "count": c}
             for s, c in sorted(studio_counts.items(), key=lambda kv: (-kv[1], kv[0]))
         ],
+        # Fixed good→heavy order (not by count), so the class list reads as a severity scale.
+        "playable": [
+            {"value": c, "count": playable_counts[c]}
+            for c in PLAYBACK_CLASSES
+            if c in playable_counts
+        ],
         "year_min": min(years) if years else None,
         "year_max": max(years) if years else None,
         "rating_max": max(ratings) if ratings else None,

backend/app/routes/plex/detail.py

@@ -411,6 +411,10 @@ def item_detail(
         "year": it.year,
         "duration_seconds": it.duration_s,
         "playable": it.playable,
+        # Playback-class detail: HW/SW transcode split + the codec/bit-depth the info-page chip shows.
+        "transcode_hw": it.transcode_hw,
+        "codec_video": it.codec_video,
+        "video_bit_depth": it.video_bit_depth,
         "thumb": f"/api/plex/image/{it.rating_key}",
         "art": f"/api/plex/image/{it.rating_key}?variant=art",
         "library": _lib_key(db, it.library_id),

backend/app/routes/plex/playback.py

@@ -554,14 +554,16 @@ def stream_session(
         raise HTTPException(status_code=404, detail="Media file not found on disk")
     # Report the REAL media start (the keyframe ffmpeg landed on, which hls.js zero-bases to), not the
     # requested offset — the client's absolute clock and the subtitle cue-shift both key off this.
-    # `transcode`/`hw` let the player show an honest cold-start ("Preparing stream…") and surface the
-    # active mode + encoder in the stats overlay; both segment streams are otherwise identical.
+    # `transcode`/`hw`/`tonemap` let the player show an honest cold-start ("Preparing stream…") and
+    # surface the active mode + encoder in the stats overlay (`tonemap` = the HW HDR→SDR path); both
+    # segment streams are otherwise identical.
     return {
         "mode": "hls",
         "start_s": s.media_start_s,
         "url": f"/api/plex/stream/{it.rating_key}/hls/{s.entry}",
         "transcode": s.transcode,
         "hw": s.hw,
+        "tonemap": s.tonemap,
     }
 
 

backend/tests/conftest.py

@@ -189,3 +189,24 @@ def as_user(db, override_dep, _configured):
         return TestClient(app, headers={"x-test-user": str(user.id)})
 
     return _as
+
+
+@pytest.fixture(autouse=True)
+def _reset_rate_limiters():
+    """Every RateLimiter is a module-level singleton keyed by client IP, and TestClient always
+    presents the same host — so without this the whole suite's login/register attempts pool into one
+    300s window and, past the cap, some unrelated test starts failing with a 429 depending on order.
+    Cleared before each test; a test that wants to exercise throttling can still exhaust one itself.
+
+    Sweeps every loaded `app.*` module rather than a hand-kept list, so a limiter added in a new
+    module is covered the day it lands instead of silently pooling until something fails."""
+    import sys
+
+    from app.ratelimit import RateLimiter
+
+    for name, mod in list(sys.modules.items()):
+        if name != "app" and not name.startswith("app."):
+            continue
+        for obj in vars(mod).values():
+            if isinstance(obj, RateLimiter):
+                obj.reset()

backend/tests/test_admin_invites.py

@@ -0,0 +1,170 @@
+"""Deleting a whitelist / access-request entry (admin).
+
+Deny records an auditable decision and keeps the row; delete forgets the address outright, for an
+approval added by mistake or one that is no longer wanted. Neither stops the person asking again —
+`upsert_pending_invite` reopens a denied row as pending, and a deleted one comes back as a fresh
+request. The one hard rule is that an entry backed by an account is NOT deletable here: this row is
+that account's approval gate, and orphaning it would strand someone who could then neither sign in
+nor be approved.
+"""
+
+from sqlalchemy import select
+
+from app.models import Invite, User
+
+
+def _invites(client):
+    r = client.get("/api/admin/invites")
+    assert r.status_code == 200
+    return {i["email"]: i for i in r.json()}
+
+
+def test_admin_deletes_a_whitelist_entry_that_never_became_an_account(db, make_user, as_user):
+    admin = make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="mistake@example.com", status="approved", decided_by=admin.email))
+    db.commit()
+    client = as_user(admin)
+    listed = _invites(client)["mistake@example.com"]
+    assert listed["has_account"] is False  # drives the delete affordance in the UI
+
+    r = client.delete(f"/api/admin/invites/{listed['id']}")
+
+    assert r.status_code == 200 and r.json()["deleted"] == listed["id"]
+    db.expire_all()
+    assert (
+        db.execute(select(Invite).where(Invite.email == "mistake@example.com")).scalar_one_or_none()
+        is None
+    )
+
+
+def test_deleting_an_entry_that_has_an_account_is_refused(db, make_user, as_user):
+    # The guard that matters: this row is what is_allowed() reads, so deleting it would revoke the
+    # user's access without touching the account or saying so.
+    admin = make_user(email="admin@example.com", role="admin")
+    member = make_user(email="member@example.com")
+    db.add(Invite(email=member.email, status="approved", decided_by=admin.email))
+    db.commit()
+    client = as_user(admin)
+    listed = _invites(client)[member.email]
+    assert listed["has_account"] is True
+
+    r = client.delete(f"/api/admin/invites/{listed['id']}")
+
+    assert r.status_code == 409
+    db.expire_all()
+    assert (
+        db.execute(select(Invite).where(Invite.email == member.email)).scalar_one_or_none()
+        is not None
+    )
+
+
+def test_a_pending_request_from_a_registration_is_not_deletable(db, make_user, as_user):
+    # The shape the ordinary sign-up produces: _register_account writes the User (inactive) AND the
+    # pending Invite together. The invite is that account's approval gate, so deleting it would
+    # strand the person — they could neither sign in nor be approved, and re-registering is a silent
+    # no-op. Managed from Users & roles instead, which is what the UI and the 409 both say.
+    admin = make_user(email="admin@example.com", role="admin")
+    make_user(email="signup@example.com", is_active=False, email_verified=False)
+    db.add(Invite(email="signup@example.com", status="pending"))
+    db.commit()
+    client = as_user(admin)
+    listed = _invites(client)["signup@example.com"]
+    assert listed["has_account"] is True  # the UI shows a disabled control, not a missing one
+
+    r = client.delete(f"/api/admin/invites/{listed['id']}")
+
+    assert r.status_code == 409
+    db.expire_all()
+    assert (
+        db.execute(select(Invite).where(Invite.email == "signup@example.com")).scalar_one_or_none()
+        is not None
+    )
+
+
+def test_deleting_an_env_allow_listed_address_reports_that_it_kept_access(
+    db, make_user, as_user, monkeypatch
+):
+    # Removing the row is NOT always a revoke: is_allowed falls back to the env bootstrap lists once
+    # no invite exists. The admin has to be told, or they think they removed access and did not.
+    from app.config import settings
+
+    # Patch the raw env field, not the derived property: that keeps the split/strip/lower parsing
+    # under test, and matches how the rest of the suite stubs settings.
+    monkeypatch.setattr(settings, "allowed_emails", " OPS@Example.com , someone@else.test ")
+    admin = make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="ops@example.com", status="approved", decided_by=admin.email))
+    db.commit()
+    client = as_user(admin)
+    listed = _invites(client)["ops@example.com"]
+    # The LIST carries it too, so the confirm dialog can warn before the delete happens.
+    assert listed["still_allowed_by_env"] is True
+
+    r = client.delete(f"/api/admin/invites/{listed['id']}")
+
+    assert r.status_code == 200
+    assert r.json()["still_allowed_by_env"] is True
+
+
+def test_an_admin_emails_address_is_also_reported(db, make_user, as_user, monkeypatch):
+    # ADMIN_EMAILS is the sharper case: deleting the row not only keeps access, the next Google
+    # sign-in re-promotes the address to admin.
+    from app.config import settings
+
+    monkeypatch.setattr(settings, "admin_emails", "boss@example.com")
+    admin = make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="boss@example.com", status="approved", decided_by=admin.email))
+    db.commit()
+    client = as_user(admin)
+
+    assert _invites(client)["boss@example.com"]["still_allowed_by_env"] is True
+
+
+def test_deleting_a_pending_request_forgets_it(db, make_user, as_user):
+    # A pending row is deletable too — "drop this without recording a decision" is a different
+    # choice from Deny, which stores a decision (status, decided_by) and mails the requester.
+    admin = make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="asker@example.com", status="pending"))
+    db.commit()
+    client = as_user(admin)
+
+    r = client.delete(f"/api/admin/invites/{_invites(client)['asker@example.com']['id']}")
+
+    assert r.status_code == 200
+    assert r.json()["still_allowed_by_env"] is False  # nothing in the env allow-lists
+    assert "asker@example.com" not in _invites(client)
+
+
+def test_deleting_a_missing_invite_is_404(db, make_user, as_user):
+    admin = make_user(email="admin@example.com", role="admin")
+    assert as_user(admin).delete("/api/admin/invites/9999").status_code == 404
+
+
+def test_a_regular_user_cannot_delete_an_invite(db, make_user, as_user):
+    make_user(email="admin@example.com", role="admin")
+    plain = make_user(email="plain@example.com")
+    db.add(Invite(email="mistake@example.com", status="approved"))
+    db.commit()
+    inv_id = db.execute(select(Invite.id).where(Invite.email == "mistake@example.com")).scalar_one()
+
+    assert as_user(plain).delete(f"/api/admin/invites/{inv_id}").status_code == 403
+
+    db.expire_all()
+    assert db.get(Invite, inv_id) is not None
+
+
+def test_deleting_the_user_also_clears_the_way_to_re_invite(db, make_user, as_user):
+    # The refusal above tells the admin to delete the account instead; purge_user takes the invite
+    # with it, so the address really is forgotten and a fresh request starts over as pending.
+    admin = make_user(email="admin@example.com", role="admin")
+    member = make_user(email="member@example.com")
+    db.add(Invite(email=member.email, status="approved", decided_by=admin.email))
+    db.commit()
+    client = as_user(admin)
+
+    assert client.delete(f"/api/admin/users/{member.id}").status_code == 200
+
+    db.expire_all()
+    assert db.execute(select(User).where(User.email == member.email)).scalar_one_or_none() is None
+    assert (
+        db.execute(select(Invite).where(Invite.email == member.email)).scalar_one_or_none() is None
+    )

backend/tests/test_auth_session.py

@@ -127,3 +127,348 @@ def test_activating_a_verified_account_keeps_its_password(db, make_user):
     _activate_user_by_email(db, "legit@example.com")
     assert user.is_active is True
     assert user.password_hash is not None
+
+
+def _register_and_fetch(db, email: str):
+    """Run the /register background worker, then read the users/invites rows back through a FRESH
+    query. The worker owns its own session, so anything it failed to commit is simply not there."""
+    from sqlalchemy import select as _select
+
+    from app.models import Invite, User
+    from app.routes.auth import _register_account
+
+    _register_account(email, _PW)
+    db.expire_all()
+    user = db.execute(_select(User).where(User.email == email)).scalar_one_or_none()
+    invite = db.execute(_select(Invite).where(Invite.email == email)).scalar_one_or_none()
+    return user, invite
+
+
+def _no_smtp(monkeypatch):
+    """Put the worker on the no-SMTP path and capture the admin notice instead of sending it."""
+    from app.routes import auth as auth_mod
+
+    notified: list[str] = []
+    monkeypatch.setattr(auth_mod.email_mod, "email_enabled", lambda: False)
+    monkeypatch.setattr(
+        auth_mod.email_mod, "send_admin_new_request", lambda admins, to: notified.append(to) or True
+    )
+    return notified
+
+
+def test_registration_of_a_pre_approved_email_persists_the_account_without_smtp(
+    db, make_user, monkeypatch
+):
+    # THE regression. An admin whitelists an address, the person registers, and the account silently
+    # never existed: upsert_pending_invite leaves an already-approved row alone and returns WITHOUT
+    # committing, and the only other commit on this path (_issue_token) is gated on SMTP — so with no
+    # working mail the flushed user was rolled back at session close. The sign-up answered "ok",
+    # created nothing, and re-registering did the same again.
+    from app.models import Invite
+
+    notified = _no_smtp(monkeypatch)
+    make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="roland@example.com", status="approved", decided_by="admin@example.com"))
+    db.commit()
+
+    user, invite = _register_and_fetch(db, "roland@example.com")
+
+    assert user is not None, "pre-approved registration was rolled back — the account is gone"
+    assert user.password_hash is not None
+    assert user.email_verified is True  # no SMTP => ownership can't be proven by link
+    assert (
+        user.is_active is False
+    )  # approval is bound to the account by an admin, not by signing up
+    # The admin's standing decision is left exactly as it was — is_allowed() still reads "approved",
+    # so their Google sign-in keeps working and an anonymous sign-up cannot revoke access.
+    assert invite.status == "approved"
+    assert invite.decided_by == "admin@example.com"
+    # The notify path still fires for an already-approved address — nothing lands in the queue, so
+    # it is the only announcement there is. (Whether it is DELIVERED is separate: on a real no-SMTP
+    # instance `_send` drops it, which is the open half of the problem, roadmap UX-25.)
+    assert notified == ["roland@example.com"]
+
+
+def test_registration_with_an_already_pending_request_persists_the_account(
+    db, make_user, monkeypatch
+):
+    # The same rollback, reached the other way: someone uses Request access, then registers before
+    # the admin has decided. upsert_pending_invite leaves the pending row alone and does not commit.
+    from app.models import Invite
+
+    notified = _no_smtp(monkeypatch)
+    make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="pia@example.com", status="pending"))
+    db.commit()
+
+    user, invite = _register_and_fetch(db, "pia@example.com")
+
+    assert user is not None, "registration was rolled back — the account is gone"
+    assert user.is_active is False
+    assert invite.status == "pending"
+    assert notified == ["pia@example.com"]
+
+
+def test_an_admin_can_activate_a_pre_approved_registrant(db, monkeypatch):
+    # The recovery path for the account above, pinned so it cannot quietly break: re-entering the
+    # address in the Access-requests whitelist box (POST /api/admin/invites) runs
+    # _activate_user_by_email, which is also what keeps the SEC-10 preset-password guard in play.
+    from app.models import Invite
+    from app.routes.admin import _activate_user_by_email
+
+    _no_smtp(monkeypatch)
+    db.add(Invite(email="roland@example.com", status="approved", decided_by="admin@example.com"))
+    db.commit()
+    user, _ = _register_and_fetch(db, "roland@example.com")
+
+    _activate_user_by_email(db, "roland@example.com")
+
+    db.expire_all()
+    assert user.is_active is True
+    assert user.password_hash is not None  # a verified account keeps its own password
+
+
+def test_registration_of_an_unknown_email_still_persists_account_and_pending_invite(
+    db, make_user, monkeypatch
+):
+    # Guard, not a regression test: this branch always worked (upsert INSERTs the invite and commits
+    # the same transaction). It must keep working — and it is the case that DOES notify the admin.
+    notified = _no_smtp(monkeypatch)
+    make_user(email="admin@example.com", role="admin")
+
+    user, invite = _register_and_fetch(db, "stranger@example.com")
+
+    assert user is not None
+    assert user.is_active is False
+    assert invite is not None and invite.status == "pending"
+    assert notified == ["stranger@example.com"]
+
+
+def test_registration_of_a_previously_denied_email_revives_the_request(db, make_user, monkeypatch):
+    # Guard: a denied person may ask again — the invite flips back to pending (and commits) so the
+    # admin sees a fresh request. The stale decision must not leak into the new account's state.
+    from app.models import Invite
+
+    notified = _no_smtp(monkeypatch)
+    make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="denis@example.com", status="denied", decided_by="admin@example.com"))
+    db.commit()
+
+    user, invite = _register_and_fetch(db, "denis@example.com")
+
+    assert user is not None
+    assert user.is_active is False
+    assert invite.status == "pending"
+    assert invite.decided_at is None and invite.decided_by is None
+    assert notified == ["denis@example.com"]
+
+
+def test_registration_of_a_pre_approved_email_persists_the_account_with_smtp(db, monkeypatch):
+    # Guard, not a regression test: with SMTP on, _issue_token's own commit already persisted the
+    # user, so this branch was never broken and must stay unbroken.
+    from app.models import Invite
+    from app.routes import auth as auth_mod
+
+    sent: list[str] = []
+    monkeypatch.setattr(auth_mod.email_mod, "email_enabled", lambda: True)
+    monkeypatch.setattr(auth_mod.email_mod, "send_verify_email", lambda to, link: sent.append(to))
+    monkeypatch.setattr(auth_mod.email_mod, "send_admin_new_request", lambda admins, to: True)
+    db.add(Invite(email="rita@example.com", status="approved", decided_by="admin@example.com"))
+    db.commit()
+
+    user, invite = _register_and_fetch(db, "rita@example.com")
+
+    assert user is not None
+    assert user.email_verified is False  # must confirm the address
+    assert user.is_active is False
+    assert invite.status == "approved"
+    assert sent == ["rita@example.com"]
+
+
+def test_verifying_an_email_never_grants_access_on_its_own(client, db, make_user):
+    # Verification attests the address; it does not decide access. The two gates stay separate.
+    from app.models import Invite
+    from app.routes.auth import _issue_token
+
+    user = make_user(email="rita@example.com", password=_PW, email_verified=False, is_active=False)
+    db.add(Invite(email="rita@example.com", status="approved", decided_by="admin@example.com"))
+    db.commit()
+    raw = _issue_token(db, user, "verify", timedelta(hours=1))
+
+    assert client.post("/auth/verify", json={"token": raw}).status_code == 200
+
+    db.expire_all()
+    assert user.email_verified is True
+    assert user.is_active is False
+    assert _login(client, "rita@example.com", _PW).status_code == 403
+
+
+def test_register_route_creates_the_account_end_to_end(client, db, monkeypatch):
+    # The tests above call _register_account directly, so nothing covered the ROUTE: its
+    # allow_registration gate, its rate limiter and the background.add_task wiring that makes the
+    # whole flow reachable at all. TestClient runs BackgroundTasks after the response, so a single
+    # POST exercises the real path end to end.
+    from sqlalchemy import select as _select
+
+    from app.models import User
+
+    _no_smtp(monkeypatch)
+
+    r = client.post("/auth/register", json={"email": "newbie@example.com", "password": _PW})
+
+    assert r.status_code == 200 and r.json() == {"status": "ok"}
+    db.expire_all()
+    user = db.execute(_select(User).where(User.email == "newbie@example.com")).scalar_one_or_none()
+    assert user is not None, "POST /auth/register answered ok but created nothing"
+    assert user.password_hash is not None
+
+
+def test_register_route_is_refused_when_registration_is_closed(client, db, monkeypatch):
+    # The gate is an explicit 403 with nothing created — not a uniform "ok" that silently drops it.
+    from sqlalchemy import select as _select
+
+    from app import sysconfig
+    from app.models import User
+
+    _no_smtp(monkeypatch)
+    sysconfig.set_value(db, "allow_registration", False)
+
+    r = client.post("/auth/register", json={"email": "closed@example.com", "password": _PW})
+
+    assert r.status_code == 403
+    db.expire_all()
+    assert (
+        db.execute(_select(User).where(User.email == "closed@example.com")).scalar_one_or_none()
+        is None
+    )
+
+
+# --- SEC-10 lockout: a revoked preset password must stay RECOVERABLE ---------------------------
+#
+# Regression pack for the prod incident of 2026-09-02. An account registered with a password, then
+# approved by an admin BEFORE its email was verified, ended up with password_hash = NULL. That is
+# also what a Google-only account looks like, and reset eligibility keyed off `password_hash` alone —
+# so the account could neither sign in (no password) nor obtain a reset link, and every response on
+# the way was a deliberately uniform "ok"/401. `password_revoked_at` is the trace that tells the two
+# apart; these pin each step of the way back in.
+
+
+def _capture_reset_links(monkeypatch) -> list[str]:
+    """Patch the reset mailer and collect the recipients it is asked to write to."""
+    from app.routes import auth as auth_mod
+
+    sent: list[str] = []
+    monkeypatch.setattr(auth_mod.email_mod, "send_password_reset", lambda to, link: sent.append(to))
+    return sent
+
+
+def test_the_approval_revoke_stamps_password_revoked_at(db, make_user):
+    from app.routes.admin import _activate_user_by_email
+
+    victim = make_user(
+        email="stamped@example.com",
+        password="attacker-chosen",
+        email_verified=False,
+        is_active=False,
+    )
+    assert victim.password_revoked_at is None
+
+    _activate_user_by_email(db, "stamped@example.com")
+
+    assert victim.password_hash is None
+    assert victim.password_revoked_at is not None  # …so the reset flow can tell it HAD a password
+
+
+def test_an_account_whose_password_was_revoked_can_still_get_a_reset_link(
+    db, make_user, monkeypatch
+):
+    # THE lockout bug: without the stamp this sent nothing, and the account was unrecoverable.
+    from app.routes.admin import _activate_user_by_email
+    from app.routes.auth import _send_reset_if_eligible
+
+    make_user(
+        email="lockedout@example.com",
+        password="chosen at registration",
+        email_verified=False,
+        is_active=False,
+    )
+    _activate_user_by_email(db, "lockedout@example.com")
+    sent = _capture_reset_links(monkeypatch)
+
+    _send_reset_if_eligible("lockedout@example.com")
+
+    assert sent == ["lockedout@example.com"]
+
+
+def test_a_google_only_account_is_still_not_reset_eligible(db, make_user, monkeypatch):
+    # The other side of the rule: an account that NEVER had a password gets no reset link — its owner
+    # adds one from Settings while signed in (/auth/set-password), which proves identity by session.
+    from app.routes.auth import _send_reset_if_eligible
+
+    make_user(email="googler@example.com", password=None, google_sub="sub-123")
+    sent = _capture_reset_links(monkeypatch)
+
+    _send_reset_if_eligible("googler@example.com")
+
+    assert sent == []
+
+
+def test_completing_a_reset_clears_the_revocation_stamp(client, db, make_user):
+    from app.routes.admin import _activate_user_by_email
+    from app.routes.auth import _issue_token
+
+    user = make_user(
+        email="recovered@example.com",
+        password="chosen at registration",
+        email_verified=False,
+        is_active=False,
+    )
+    _activate_user_by_email(db, "recovered@example.com")
+    raw = _issue_token(db, user, "reset", timedelta(hours=1))
+    db.commit()
+
+    ok = client.post(
+        "/auth/password-reset/confirm", json={"token": raw, "password": "a brand new one"}
+    )
+
+    assert ok.status_code == 200
+    db.expire_all()
+    assert user.password_hash is not None
+    assert user.password_revoked_at is None  # spent — not a permanently reset-eligible account
+    assert _login(client, "recovered@example.com", "a brand new one").status_code == 200
+
+
+def test_verify_tells_a_revoked_account_that_it_needs_a_new_password(client, db, make_user):
+    # The banner's input. Saying so leaks nothing: the caller just proved mailbox control by holding a
+    # valid single-use verify token. Without it the user meets only the uniform "Invalid email or
+    # password" and has no way to learn why the password they chose stopped working.
+    from app.routes.admin import _activate_user_by_email
+    from app.routes.auth import _issue_token
+
+    user = make_user(
+        email="needspw@example.com",
+        password="chosen at registration",
+        email_verified=False,
+        is_active=False,
+    )
+    _activate_user_by_email(db, "needspw@example.com")
+    raw = _issue_token(db, user, "verify", timedelta(hours=1))
+    db.commit()
+
+    r = client.post("/auth/verify", json={"token": raw})
+
+    assert r.status_code == 200
+    assert r.json() == {"ok": True, "password_reset_required": True}
+
+
+def test_verify_reports_no_reset_needed_for_an_intact_account(client, db, make_user):
+    from app.routes.auth import _issue_token
+
+    user = make_user(email="intact@example.com", email_verified=False, is_active=False)
+    raw = _issue_token(db, user, "verify", timedelta(hours=1))
+    db.commit()
+
+    r = client.post("/auth/verify", json={"token": raw})
+
+    assert r.status_code == 200
+    assert r.json() == {"ok": True, "password_reset_required": False}

backend/tests/test_download_output.py

@@ -144,7 +144,7 @@ class TestCodecsFromStreams:
 
 
 class TestRunFfprobeJson:
-    """The single ffprobe-JSON invocation point (shared by probe_codecs + upload._probe). A failed
+    """The single ffprobe-JSON invocation point (shared by probe_codecs + probe.probe_media). A failed
     probe or unparseable output must degrade to None, not raise — the malformed-input safety the old
     parse_probe_streams string parser used to own now lives here."""
 

backend/tests/test_email_alerts.py

@@ -0,0 +1,149 @@
+"""An undelivered email leaves a trace in the admins' inbox.
+
+Sending is deliberately fail-soft — a missing SMTP setting or a rejecting relay logs and returns
+False so nothing user-facing breaks. The cost of that used to be total silence: an instance whose
+SMTP was never filled in swallowed verification links, password resets and access-request notices,
+and the operator's first clue was somebody saying nothing arrived.
+"""
+
+import smtplib
+
+import pytest
+from sqlalchemy import select
+
+from app import email as email_mod
+from app.models import Notification
+
+
+@pytest.fixture(autouse=True)
+def _no_smtp_config(monkeypatch):
+    """Every test here drives the real `_send`, so make sure it never reaches a socket."""
+    monkeypatch.setattr(
+        email_mod,
+        "_smtp",
+        lambda: {"host": "", "port": 587, "user": "", "password": "", "from": ""},
+    )
+
+
+def _notifications(db, user_id: int) -> list[Notification]:
+    return list(
+        db.execute(
+            select(Notification)
+            .where(Notification.user_id == user_id, Notification.type == "email_undelivered")
+            .order_by(Notification.id)
+        )
+        .scalars()
+        .all()
+    )
+
+
+def test_a_skipped_email_notifies_every_admin(db, make_user):
+    admin_a = make_user(email="admin-a@example.com", role="admin")
+    admin_b = make_user(email="admin-b@example.com", role="admin")
+    plain = make_user(email="plain@example.com")
+
+    assert email_mod.send_test("someone@example.com") is False  # fail-soft, as before
+
+    db.expire_all()
+    for admin in (admin_a, admin_b):
+        (n,) = _notifications(db, admin.id)
+        assert n.data["reason"] == "not_configured"
+        assert n.data["subject"] == "Siftlode SMTP test"
+        assert n.data["recipients"] == ["someone@example.com"]
+    assert _notifications(db, plain.id) == []  # not an operator's problem to see
+
+
+def test_the_notice_is_throttled_so_a_dead_relay_cannot_flood_the_inbox(db, make_user):
+    admin = make_user(email="admin@example.com", role="admin")
+
+    for _ in range(5):
+        email_mod.send_test("someone@example.com")
+
+    db.expire_all()
+    assert len(_notifications(db, admin.id)) == 1
+
+
+def test_a_send_failure_is_reported_separately_from_a_missing_config(db, make_user, monkeypatch):
+    # A configured-but-rejecting relay is a different operator problem from an empty config, and the
+    # inbox copy differs — so the reason has to survive to the notification.
+    admin = make_user(email="admin@example.com", role="admin")
+    monkeypatch.setattr(
+        email_mod,
+        "_smtp",
+        lambda: {
+            "host": "smtp.example.com",
+            "port": 587,
+            "user": "u",
+            "password": "p",
+            "from": "Siftlode <u@example.com>",
+        },
+    )
+
+    def _boom(*a, **kw):
+        raise smtplib.SMTPException("nope")
+
+    monkeypatch.setattr(email_mod.smtplib, "SMTP", _boom)
+
+    assert email_mod.send_test("someone@example.com") is False
+
+    db.expire_all()
+    (n,) = _notifications(db, admin.id)
+    assert n.data["reason"] == "send_failed"
+
+
+def test_no_admins_means_no_notification_and_no_error(db, make_user):
+    # A fresh instance can have no admin yet (the wizard has not run). The alert must stay silent
+    # rather than blowing up inside the fail-soft path it is supposed to make visible.
+    plain = make_user(email="plain@example.com")
+
+    assert email_mod.send_test("someone@example.com") is False
+
+    db.expire_all()
+    assert _notifications(db, plain.id) == []
+
+
+def test_a_drop_with_nobody_to_tell_does_not_burn_the_hour(db, make_user):
+    # The throttle window must only be spent on a notice that was actually written. Otherwise a drop
+    # during setup — before any admin exists — silences the next hour for the admin created a minute
+    # later, which is exactly the blind spot this alert exists to remove.
+    email_mod.send_test("someone@example.com")  # no admins yet
+    admin = make_user(email="admin@example.com", role="admin")
+
+    assert email_mod.send_test("someone@example.com") is False
+
+    db.expire_all()
+    assert len(_notifications(db, admin.id)) == 1
+
+
+def test_a_failed_alert_does_not_burn_the_hour_either(db, make_user, monkeypatch):
+    admin = make_user(email="admin@example.com", role="admin")
+    boom = {"on": True}
+
+    def _maybe_boom(*a, **kw):
+        if boom["on"]:
+            raise RuntimeError("notification store is down")
+        from app.notifications import create_notification as real
+
+        return real(*a, **kw)
+
+    monkeypatch.setattr(email_mod, "create_notification", _maybe_boom)
+    email_mod.send_test("someone@example.com")  # the write blows up; nothing recorded
+    boom["on"] = False
+
+    assert email_mod.send_test("someone@example.com") is False
+
+    db.expire_all()
+    assert len(_notifications(db, admin.id)) == 1
+
+
+def test_a_broken_alert_never_breaks_the_send(db, make_user, monkeypatch):
+    # The alert is the fallback path; if IT fails, the caller must still get the ordinary fail-soft
+    # False rather than an exception surfacing from a background task.
+    make_user(email="admin@example.com", role="admin")
+
+    def _boom(*a, **kw):
+        raise RuntimeError("notification store is down")
+
+    monkeypatch.setattr(email_mod, "create_notification", _boom)
+
+    assert email_mod.send_test("someone@example.com") is False

backend/tests/test_me_email_flag.py

@@ -0,0 +1,58 @@
+"""/api/me carries whether this instance can actually send email.
+
+It drives the operator warnings on the Configuration and Access-requests screens. Admin-only,
+because it is an operator concern and a regular user has nothing to do with it.
+"""
+
+from app import email as email_mod
+
+_PW = "correct horse battery"
+
+
+def _signed_in(client, make_user, **kw):
+    """/api/me resolves its user through optional_current_user, which the as_user override does not
+    cover — so sign in for real and read the bootstrap payload the SPA actually gets."""
+    user = make_user(password=_PW, **kw)
+    assert (
+        client.post("/auth/password-login", json={"email": user.email, "password": _PW}).status_code
+        == 200
+    )
+    r = client.get("/api/me")
+    assert r.status_code == 200 and r.json()["authenticated"] is True
+    return r.json()
+
+
+def test_an_admin_is_told_when_email_is_not_configured(client, make_user, monkeypatch):
+    monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: False)
+
+    me = _signed_in(client, make_user, email="admin@example.com", role="admin")
+
+    assert me["email_configured"] is False
+
+
+def test_an_admin_sees_nothing_wrong_when_email_works(client, make_user, monkeypatch):
+    monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: True)
+
+    me = _signed_in(client, make_user, email="admin@example.com", role="admin")
+
+    assert me["email_configured"] is True
+
+
+def test_a_regular_user_is_never_warned_about_the_mail_setup(client, make_user, monkeypatch):
+    # Not their problem, and the flag must not become a way to probe the instance's configuration.
+    monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: False)
+
+    me = _signed_in(client, make_user, email="plain@example.com")
+
+    assert me["email_configured"] is True
+
+
+def test_the_flag_reuses_the_request_session(client, make_user, monkeypatch):
+    # /api/me is polled once a minute per open tab; reading the SMTP settings decrypts a Fernet
+    # value, so it must not also check out a second pooled connection each time.
+    seen: list[object] = []
+    monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: seen.append(db) or True)
+
+    _signed_in(client, make_user, email="admin@example.com", role="admin")
+
+    assert seen and seen[0] is not None

backend/tests/test_plex_playback_class.py

@@ -0,0 +1,495 @@
+"""The playback-class filter (E7): filter the Plex feed by Direct Play / Direct Stream / Transcode·HW /
+Transcode·SW. Covers the shared classifier + Stream parsing (unit), the sync derivation + codec-change
+reset, the bit-depth backfill, and the /library filter + /facets counts (DB lane).
+
+The HW/SW split is derived from the stored `transcode_hw` facet (codec at sync, refined by the bit-depth
+backfill). These tests pin that a 10-bit/HDR HEVC lands in SW even though its codec is HW-decodable —
+the exact case the runtime VAAPI path (plex.stream) also special-cases.
+"""
+
+import re
+from pathlib import Path
+
+import app.state as state
+from app.auth import current_user
+from app.db import get_db
+from app.main import app
+from app.models import PlexItem, PlexLibrary, User
+from app.plex import sync
+from fastapi.testclient import TestClient
+
+
+class TestTranscodeHwCapable:
+    """The single classifier both the catalog facet and (by codec) the runtime encoder choice key off."""
+
+    def test_non_transcode_items_are_none(self):
+        assert sync.transcode_hw_capable("direct", "h264") is None
+        assert sync.transcode_hw_capable("remux", "h264") is None
+        assert sync.transcode_hw_capable(None, "hevc") is None
+
+    def test_hw_decodable_8bit_sdr_is_hw(self):
+        assert sync.transcode_hw_capable("transcode", "hevc") is True
+        assert sync.transcode_hw_capable("transcode", "vp9", bit_depth=8) is True
+
+    def test_non_decodable_codec_is_sw(self):
+        # AV1 / MPEG-4 ASP (XviD) can't be HW-decoded on Gen 9.5 → software regardless of bit depth.
+        assert sync.transcode_hw_capable("transcode", "av1") is False
+        assert sync.transcode_hw_capable("transcode", "mpeg4", bit_depth=8) is False
+
+    def test_10bit_or_hdr_hevc_is_sw(self):
+        # A HW-decodable codec that is 10-bit or HDR still breaks the VAAPI nv12 pipeline → software.
+        assert sync.transcode_hw_capable("transcode", "hevc", bit_depth=10) is False
+        assert sync.transcode_hw_capable("transcode", "hevc", bit_depth=8, hdr=True) is False
+
+
+class TestVideoStreamProps:
+    def test_reads_bit_depth_and_hdr_from_the_video_stream(self):
+        meta = {
+            "Media": [
+                {
+                    "Part": [
+                        {
+                            "Stream": [
+                                {"streamType": 2, "codec": "eac3"},  # audio — skipped
+                                {"streamType": 1, "bitDepth": 10, "colorTrc": "smpte2084"},
+                            ]
+                        }
+                    ]
+                }
+            ]
+        }
+        assert sync._video_stream_props(meta) == (10, True)
+
+    def test_8bit_sdr_stream(self):
+        meta = {"Media": [{"Part": [{"Stream": [{"streamType": 1, "bitDepth": 8}]}]}]}
+        assert sync._video_stream_props(meta) == (8, False)
+
+    def test_absent_stream_is_none_false(self):
+        assert sync._video_stream_props({}) == (None, False)
+        assert sync._video_stream_props({"Media": [{"Part": [{}]}]}) == (None, False)
+
+
+class TestSyncDerivation:
+    """`_apply_item` sets transcode_hw codec-only at sync (bit depth unknown from the listing), and a
+    changed video codec resets the probe watermark so a stale bit-depth can't linger."""
+
+    def _meta(self, vcodec, *, key="/parts/1/file.mkv", file="/m.mkv"):
+        return {
+            "title": "X",
+            "Media": [{"videoCodec": vcodec, "Part": [{"file": file, "key": key}]}],
+        }
+
+    def test_codec_only_derivation_at_sync(self):
+        row = PlexItem(rating_key="x", kind="movie")
+        sync._apply_item(row, lib_id=1, kind="movie", meta=self._meta("hevc"))
+        assert row.playable == "transcode" and row.transcode_hw is True  # decodable, 8-bit assumed
+        row2 = PlexItem(rating_key="y", kind="movie")
+        sync._apply_item(row2, lib_id=1, kind="movie", meta=self._meta("av1"))
+        assert row2.transcode_hw is False  # av1 not HW-decodable
+
+    def test_probed_value_survives_resync_when_codec_unchanged(self):
+        row = PlexItem(rating_key="x", kind="movie")
+        sync._apply_item(row, lib_id=1, kind="movie", meta=self._meta("hevc"))
+        # Simulate the backfill downgrading this 10-bit HEVC to software.
+        row.transcode_hw = False
+        row.video_bit_depth = 10
+        row.media_probed_at = sync.datetime.now(sync.timezone.utc)
+        sync._apply_item(row, lib_id=1, kind="movie", meta=self._meta("hevc"))
+        assert row.transcode_hw is False  # NOT re-derived back to True
+        assert row.video_bit_depth == 10 and row.media_probed_at is not None
+
+    def test_codec_change_resets_the_probe(self):
+        row = PlexItem(rating_key="x", kind="movie")
+        sync._apply_item(row, lib_id=1, kind="movie", meta=self._meta("hevc"))
+        row.transcode_hw = False
+        row.video_bit_depth = 10
+        row.media_probed_at = sync.datetime.now(sync.timezone.utc)
+        # The file was replaced with an h264 remux — the stale 10-bit probe must be cleared.
+        sync._apply_item(row, lib_id=1, kind="movie", meta=self._meta("h264"))
+        assert row.video_bit_depth is None and row.media_probed_at is None
+
+    def test_same_codec_reencode_with_a_new_part_resets_the_probe(self):
+        # A same-codec bit-depth re-encode (e.g. 8-bit→10-bit HEVC) keeps codec 'hevc' but replaces the
+        # physical file, so its Plex Part key changes. Codec-only reset would miss this and keep the stale
+        # 8-bit/HW verdict forever (the backfill only re-probes media_probed_at IS NULL rows) — the
+        # part-key move must reset the watermark so the new bit depth is re-probed.
+        row = PlexItem(rating_key="x", kind="movie")
+        sync._apply_item(row, lib_id=1, kind="movie", meta=self._meta("hevc", key="/parts/1/f.mkv"))
+        row.transcode_hw = True
+        row.video_bit_depth = 8
+        row.media_probed_at = sync.datetime.now(sync.timezone.utc)
+        # Re-encoded in place: same codec 'hevc', but a new Part key (new file).
+        sync._apply_item(row, lib_id=1, kind="movie", meta=self._meta("hevc", key="/parts/2/f.mkv"))
+        assert row.video_bit_depth is None and row.media_probed_at is None  # re-probe scheduled
+
+
+def test_migration_codec_set_matches_hw_decodable_codecs():
+    # Migration 0077 hardcodes the HW-decodable codec set in raw SQL and its comment mandates it stay
+    # identical to plex.sync.HW_DECODABLE_CODECS. A comment isn't enforcement (house rule) — pin the
+    # equality so adding/removing a codec from the frozenset without editing the migration fails here
+    # (else already-migrated prod rows keep a wrong transcode_hw the runtime derivation wouldn't catch).
+    mig = (
+        Path(__file__).resolve().parent.parent
+        / "alembic"
+        / "versions"
+        / "0077_plex_playback_class.py"
+    )
+    m = re.search(r"lower\(codec_video\)\s+IN\s+\(([^)]*)\)", mig.read_text())
+    assert m, "could not find the codec IN(...) list in migration 0077"
+    codecs = {c.strip().strip("'\"").lower() for c in m.group(1).split(",")}
+    assert codecs == {c.lower() for c in sync.HW_DECODABLE_CODECS}
+
+
+class _FakePlex:
+    """Stands in for PlexClient.metadata — returns a canned full-metadata dict per rating_key."""
+
+    def __init__(self, by_key):
+        self.by_key = by_key
+
+    def metadata(self, rating_key, markers=False):
+        return self.by_key.get(rating_key)
+
+
+def test_probe_media_batch_refines_hw_to_sw_for_10bit(db):
+    lib = PlexLibrary(plex_key="1", title="Movies", kind="movie", enabled=True)
+    db.add(lib)
+    db.flush()
+    hevc8 = PlexItem(
+        rating_key="h8",
+        library_id=lib.id,
+        kind="movie",
+        title="8bit",
+        playable="transcode",
+        codec_video="hevc",
+        transcode_hw=True,
+    )
+    hevc10 = PlexItem(
+        rating_key="h10",
+        library_id=lib.id,
+        kind="movie",
+        title="10bit",
+        playable="transcode",
+        codec_video="hevc",
+        transcode_hw=True,
+    )
+    xvid = PlexItem(
+        rating_key="xv",
+        library_id=lib.id,
+        kind="movie",
+        title="xvid",
+        playable="transcode",
+        codec_video="mpeg4",
+        transcode_hw=False,
+    )
+    db.add_all([hevc8, hevc10, xvid])
+    db.commit()
+    plex = _FakePlex(
+        {
+            "h8": {"Media": [{"Part": [{"Stream": [{"streamType": 1, "bitDepth": 8}]}]}]},
+            "h10": {"Media": [{"Part": [{"Stream": [{"streamType": 1, "bitDepth": 10}]}]}]},
+        }
+    )
+    probed = sync._probe_media_batch(db, plex)
+    db.refresh(hevc8)
+    db.refresh(hevc10)
+    db.refresh(xvid)
+    # Only the two HW-decodable HEVC items are probed; the XviD is SW-by-codec and never fetched.
+    assert probed == 2
+    assert hevc8.video_bit_depth == 8 and hevc8.transcode_hw is True and hevc8.media_probed_at
+    assert hevc10.video_bit_depth == 10 and hevc10.transcode_hw is False  # downgraded to software
+    assert xvid.media_probed_at is None  # not in the work-list
+    # A second run has nothing left to do (watermarks set).
+    assert sync._probe_media_batch(db, plex) == 0
+
+
+def test_probe_stamps_even_when_plex_has_no_stream(db):
+    lib = PlexLibrary(plex_key="1", title="Movies", kind="movie", enabled=True)
+    db.add(lib)
+    db.flush()
+    item = PlexItem(
+        rating_key="ns",
+        library_id=lib.id,
+        kind="movie",
+        title="nostream",
+        playable="transcode",
+        codec_video="hevc",
+        transcode_hw=True,
+    )
+    db.add(item)
+    db.commit()
+    plex = _FakePlex({"ns": {"Media": [{"Part": [{}]}]}})  # no Stream array
+    assert sync._probe_media_batch(db, plex) == 1
+    db.refresh(item)
+    # Probed (watermark set so it isn't re-fetched forever); bit depth unknown → stays codec-HW.
+    assert item.media_probed_at is not None and item.video_bit_depth is None
+    assert item.transcode_hw is True
+
+
+def test_probe_media_batch_is_bounded_and_oldest_first(db):
+    # The per-run bound (limit) caps Plex load; oldest-id-first means successive runs cover the whole
+    # backlog without starving any item. Seed 3 eligible items, probe with limit=2.
+    lib = PlexLibrary(plex_key="1", title="Movies", kind="movie", enabled=True)
+    db.add(lib)
+    db.flush()
+    items = [
+        PlexItem(
+            rating_key=f"h{i}",
+            library_id=lib.id,
+            kind="movie",
+            title=f"m{i}",
+            playable="transcode",
+            codec_video="hevc",
+            transcode_hw=True,
+        )
+        for i in range(3)
+    ]
+    db.add_all(items)  # inserted in order → ascending ids
+    db.commit()
+    plex = _FakePlex(
+        {
+            f"h{i}": {"Media": [{"Part": [{"Stream": [{"streamType": 1, "bitDepth": 8}]}]}]}
+            for i in range(3)
+        }
+    )
+    assert sync._probe_media_batch(db, plex, limit=2) == 2  # exactly the bound
+    for it in items:
+        db.refresh(it)
+    # The two LOWEST-id rows were probed; the third waits for the next run.
+    assert items[0].media_probed_at is not None and items[1].media_probed_at is not None
+    assert items[2].media_probed_at is None
+    # The next run continues with the remaining item.
+    assert sync._probe_media_batch(db, plex, limit=2) == 1
+    db.refresh(items[2])
+    assert items[2].media_probed_at is not None
+
+
+class _RaisingPlex:
+    """metadata() raises for `bad_key`, returns a canned dict otherwise — to exercise the transient
+    fetch-failure branch (leave the watermark NULL so the item retries next run)."""
+
+    def __init__(self, by_key, bad_key):
+        self.by_key = by_key
+        self.bad_key = bad_key
+
+    def metadata(self, rating_key, markers=False):
+        if rating_key == self.bad_key:
+            raise RuntimeError("plex timeout")
+        return self.by_key.get(rating_key)
+
+
+def test_probe_media_batch_leaves_a_transient_failure_unstamped_to_retry(db):
+    lib = PlexLibrary(plex_key="1", title="Movies", kind="movie", enabled=True)
+    db.add(lib)
+    db.flush()
+    good = PlexItem(
+        rating_key="g",
+        library_id=lib.id,
+        kind="movie",
+        title="good",
+        playable="transcode",
+        codec_video="hevc",
+        transcode_hw=True,
+    )
+    bad = PlexItem(
+        rating_key="b",
+        library_id=lib.id,
+        kind="movie",
+        title="bad",
+        playable="transcode",
+        codec_video="hevc",
+        transcode_hw=True,
+    )
+    db.add_all([good, bad])
+    db.commit()
+    plex = _RaisingPlex(
+        {"g": {"Media": [{"Part": [{"Stream": [{"streamType": 1, "bitDepth": 10}]}]}]}}, bad_key="b"
+    )
+    # The raise on 'b' must not abort the batch: 'g' is still probed and counted; 'b' stays NULL.
+    assert sync._probe_media_batch(db, plex) == 1
+    db.refresh(good)
+    db.refresh(bad)
+    assert good.media_probed_at is not None and good.transcode_hw is False  # 10-bit → SW
+    assert bad.media_probed_at is None  # transient failure → retried next run, not stamped
+
+
+def _seed_classes(db):
+    lib = PlexLibrary(plex_key="1", title="Movies", kind="movie", enabled=True)
+    db.add(lib)
+    db.flush()
+    db.add_all(
+        [
+            PlexItem(
+                rating_key="d1", library_id=lib.id, kind="movie", title="Direct", playable="direct"
+            ),
+            PlexItem(
+                rating_key="r1", library_id=lib.id, kind="movie", title="Remux", playable="remux"
+            ),
+            PlexItem(
+                rating_key="thw",
+                library_id=lib.id,
+                kind="movie",
+                title="HW",
+                playable="transcode",
+                codec_video="hevc",
+                transcode_hw=True,
+            ),
+            PlexItem(
+                rating_key="tsw",
+                library_id=lib.id,
+                kind="movie",
+                title="SW",
+                playable="transcode",
+                codec_video="mpeg4",
+                transcode_hw=False,
+            ),
+        ]
+    )
+    return lib
+
+
+def _client(db, user, monkeypatch):
+    monkeypatch.setattr(state, "_configured_cache", True)
+    app.dependency_overrides[get_db] = lambda: db
+    app.dependency_overrides[current_user] = lambda: user
+    return TestClient(app)
+
+
+def test_library_filters_by_playback_class(db, monkeypatch):
+    _seed_classes(db)
+    user = User(email="pclass@example.com")
+    db.add(user)
+    db.commit()
+    client = _client(db, user, monkeypatch)
+    try:
+        # Software-only transcodes.
+        sw = client.get("/api/plex/library?scope=movie&playable=transcode_sw")
+        assert sw.status_code == 200, sw.text
+        assert {i["id"] for i in sw.json()["items"]} == {"tsw"}
+        # HW transcode + Direct Play, OR-combined.
+        both = client.get("/api/plex/library?scope=movie&playable=transcode_hw,direct")
+        assert {i["id"] for i in both.json()["items"]} == {"thw", "d1"}
+        # The HW card carries the transcode_hw flag for the 4-way badge.
+        card = next(i for i in both.json()["items"] if i["id"] == "thw")
+        assert card["transcode_hw"] is True
+        # No filter → everything.
+        allm = client.get("/api/plex/library?scope=movie")
+        assert {i["id"] for i in allm.json()["items"]} == {"d1", "r1", "thw", "tsw"}
+    finally:
+        app.dependency_overrides.clear()
+
+
+def test_facets_count_playback_classes_in_severity_order(db, monkeypatch):
+    _seed_classes(db)
+    user = User(email="pclassfacet@example.com")
+    db.add(user)
+    db.commit()
+    client = _client(db, user, monkeypatch)
+    try:
+        resp = client.get("/api/plex/facets?scope=movie")
+    finally:
+        app.dependency_overrides.clear()
+    assert resp.status_code == 200, resp.text
+    playable = resp.json()["playable"]
+    # Fixed good→heavy order (not by count), one per seeded class.
+    assert [p["value"] for p in playable] == ["direct", "remux", "transcode_hw", "transcode_sw"]
+    assert {p["value"]: p["count"] for p in playable} == {
+        "direct": 1,
+        "remux": 1,
+        "transcode_hw": 1,
+        "transcode_sw": 1,
+    }
+
+
+def test_unprobed_transcode_folds_into_sw(db, monkeypatch):
+    # transcode_hw NULL is the COMMON initial state (before the bit-depth backfill runs). The query's
+    # CASE has no explicit NULL arm — it relies on the `playable=='transcode'` else folding NULL in with
+    # software. Pin that fold for BOTH the filter and the facet, so a reorder can't silently drop the
+    # item from the feed (an honest-state violation).
+    lib = PlexLibrary(plex_key="1", title="Movies", kind="movie", enabled=True)
+    db.add(lib)
+    db.flush()
+    db.add(
+        PlexItem(
+            rating_key="tnull",
+            library_id=lib.id,
+            kind="movie",
+            title="Unprobed",
+            playable="transcode",
+            codec_video="hevc",
+            transcode_hw=None,
+        )
+    )
+    user = User(email="pnull@example.com")
+    db.add(user)
+    db.commit()
+    client = _client(db, user, monkeypatch)
+    try:
+        sw = client.get("/api/plex/library?scope=movie&playable=transcode_sw")
+        assert {i["id"] for i in sw.json()["items"]} == {"tnull"}  # NULL → SW bucket
+        hw = client.get("/api/plex/library?scope=movie&playable=transcode_hw")
+        assert hw.json()["items"] == []  # never HW
+        facets = client.get("/api/plex/facets?scope=movie")
+        counts = {p["value"]: p["count"] for p in facets.json()["playable"]}
+        assert counts.get("transcode_sw") == 1 and counts.get("transcode_hw", 0) == 0
+    finally:
+        app.dependency_overrides.clear()
+
+
+def test_facet_playable_self_excludes_the_active_selection(db, monkeypatch):
+    # A selected playable class must NOT narrow the playable facet's OWN counts (facet self-exclusion),
+    # otherwise picking one class would collapse the list and you couldn't OR-add a second. Selecting
+    # 'direct' must still return all four classes at their full, unnarrowed counts.
+    _seed_classes(db)
+    user = User(email="pself@example.com")
+    db.add(user)
+    db.commit()
+    client = _client(db, user, monkeypatch)
+    try:
+        resp = client.get("/api/plex/facets?scope=movie&playable=direct")
+    finally:
+        app.dependency_overrides.clear()
+    assert resp.status_code == 200, resp.text
+    counts = {p["value"]: p["count"] for p in resp.json()["playable"]}
+    assert counts == {"direct": 1, "remux": 1, "transcode_hw": 1, "transcode_sw": 1}
+
+
+def test_active_playable_narrows_the_other_facets(db, monkeypatch):
+    # The flip side of self-exclusion: an active playable class DOES narrow the OTHER facet groups (so
+    # e.g. the year range reflects only the selected class). Seed a Direct movie (2000) and a
+    # software-transcode movie (2020); selecting playable=direct must collapse the year facet to 2000.
+    lib = PlexLibrary(plex_key="1", title="Movies", kind="movie", enabled=True)
+    db.add(lib)
+    db.flush()
+    db.add_all(
+        [
+            PlexItem(
+                rating_key="d2000",
+                library_id=lib.id,
+                kind="movie",
+                title="Direct2000",
+                playable="direct",
+                year=2000,
+            ),
+            PlexItem(
+                rating_key="s2020",
+                library_id=lib.id,
+                kind="movie",
+                title="SW2020",
+                playable="transcode",
+                codec_video="mpeg4",
+                transcode_hw=False,
+                year=2020,
+            ),
+        ]
+    )
+    user = User(email="pnarrow@example.com")
+    db.add(user)
+    db.commit()
+    client = _client(db, user, monkeypatch)
+    try:
+        wide = client.get("/api/plex/facets?scope=movie").json()
+        narrow = client.get("/api/plex/facets?scope=movie&playable=direct").json()
+    finally:
+        app.dependency_overrides.clear()
+    assert (wide["year_min"], wide["year_max"]) == (2000, 2020)  # both classes span the range
+    assert (narrow["year_min"], narrow["year_max"]) == (2000, 2000)  # narrowed to the Direct subset

backend/tests/test_plex_playback_session.py

@@ -58,7 +58,7 @@ def _post(db, user, monkeypatch, rating_key, *, captured):
     def fake_start(db_, it, start, audio, aoff, multi, transcode=False):
         captured["transcode"] = transcode
         return SimpleNamespace(
-            media_start_s=start, entry="index.m3u8", transcode=transcode, hw=False
+            media_start_s=start, entry="index.m3u8", transcode=transcode, hw=False, tonemap=False
         )
 
     monkeypatch.setattr(plex_stream, "start_session", fake_start)

backend/tests/test_plex_stream.py

@@ -267,50 +267,206 @@ class TestTranscodeCommand:
         )
         assert cmd[cmd.index("-vf") + 1] == "scale_vaapi=format=nv12"  # not a software scale
 
+    def test_hdr_tonemap_uses_the_opencl_graph(self):
+        # The HDR/10-bit HW path: VAAPI decode → OpenCL tonemap → VAAPI encode. Gen 9.5 can't tonemap in
+        # the VAAPI VPP, so this is the only HW route for a 10-bit/HDR source.
+        cmd = stream._ffmpeg_cmd(
+            self.SRC, 0.0, self.OUT, None, transcode=True, hw=True, tonemap=True
+        )
+        assert _venc(cmd) == "h264_vaapi"
+        assert "libx264" not in cmd
+        # Named devices + an OpenCL device DERIVED from the VAAPI one, all before -i.
+        assert cmd[cmd.index("-init_hw_device") + 1] == f"vaapi=va:{stream._VAAPI_DEVICE}"
+        assert "opencl=ocl@va" in cmd
+        assert cmd[cmd.index("-hwaccel_device") + 1] == "va"
+        assert cmd.index("-init_hw_device") < cmd.index("-i")
+        # The filter graph runs on the derived OpenCL device and tone-maps HDR→SDR to 8-bit nv12.
+        assert cmd[cmd.index("-filter_hw_device") + 1] == "ocl"
+        vf = cmd[cmd.index("-vf") + 1]
+        assert "hwmap=derive_device=opencl" in vf
+        assert "tonemap_opencl=" in vf and "format=nv12" in vf
+        assert "hwmap=derive_device=vaapi:reverse=1" in vf
+        assert "scale_vaapi" not in vf  # the plain 8-bit path's filter must NOT be used here
+        assert (
+            cmd[cmd.index("-force_key_frames") + 1] == f"expr:gte(t,n_forced*{stream._SEG_SECONDS})"
+        )
+
 
 class TestWantHw:
     """VAAPI is used only where the render node was passed in AND (in auto) the source is HW-decodable,
-    with an admin `plex_transcode_hw` policy (auto/on/off) on top."""
+    with an admin `plex_transcode_hw` policy (auto/on/off) on top. A HW session on a 10-bit/HDR source
+    tone-maps on the GPU via OpenCL (tonemap=True) when the OpenCL runtime is present, else drops to
+    software — see the `_select_encode` cases below."""
+
+    SRC = Path("/media/movie.mkv")
 
     @staticmethod
     def _policy(monkeypatch, mode):
         monkeypatch.setattr(stream.sysconfig, "get_str", lambda db, k: mode)
 
+    @staticmethod
+    def _kind(monkeypatch, kind):
+        # Pin the source classifier so the tests don't shell out to ffprobe. `kind` is one of
+        # stream._VK_HWSAFE / _VK_HDR / _VK_SDR10.
+        monkeypatch.setattr(stream, "_probe_video_kind", lambda src: kind)
+
+    @staticmethod
+    def _hwsafe(monkeypatch, safe):
+        # Back-compat convenience for the hw-gate tests that only care about 8-bit-SDR vs not: True →
+        # _VK_HWSAFE, False → _VK_SDR10 (a non-HDR non-hwsafe class, so the hw half still resolves).
+        monkeypatch.setattr(
+            stream, "_probe_video_kind", lambda src: stream._VK_HWSAFE if safe else stream._VK_SDR10
+        )
+
+    @staticmethod
+    def _opencl(monkeypatch, present):
+        # Pin the OpenCL-runtime probe so the routing doesn't depend on the CI box's /etc/OpenCL.
+        monkeypatch.setattr(stream, "_opencl_present", lambda: present)
+
     def test_no_hw_when_not_transcoding(self, monkeypatch):
         self._policy(monkeypatch, "auto")
         monkeypatch.setattr(stream, "_render_node_present", lambda: True)
-        assert stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=False) is False
+        assert (
+            stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=False, src=self.SRC)
+            is False
+        )
 
     def test_no_hw_without_a_render_node(self, monkeypatch):
         self._policy(monkeypatch, "auto")
         monkeypatch.setattr(stream, "_render_node_present", lambda: False)
-        assert stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=True) is False
+        assert (
+            stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=True, src=self.SRC)
+            is False
+        )
 
-    def test_auto_uses_hw_for_a_decodable_source_with_the_render_node(self, monkeypatch):
+    def test_auto_uses_hw_for_a_decodable_8bit_source_with_the_render_node(self, monkeypatch):
         self._policy(monkeypatch, "auto")
+        self._hwsafe(monkeypatch, True)
         monkeypatch.setattr(stream, "_render_node_present", lambda: True)
-        assert stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=True) is True
+        assert (
+            stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=True, src=self.SRC)
+            is True
+        )
 
     def test_auto_falls_back_to_software_for_a_non_decodable_source(self, monkeypatch):
         # AV1 / MPEG-4 ASP (XviD) aren't decodable on Gen 9.5 → the GPU can't feed its own encoder.
         self._policy(monkeypatch, "auto")
+        self._hwsafe(monkeypatch, True)  # decodability gate must fire BEFORE the probe
         monkeypatch.setattr(stream, "_render_node_present", lambda: True)
-        assert stream._want_hw(None, _FakeItem(codec_video="av1"), transcode=True) is False
-        assert stream._want_hw(None, _FakeItem(codec_video="mpeg4"), transcode=True) is False
+        assert (
+            stream._want_hw(None, _FakeItem(codec_video="av1"), transcode=True, src=self.SRC)
+            is False
+        )
+        assert (
+            stream._want_hw(None, _FakeItem(codec_video="mpeg4"), transcode=True, src=self.SRC)
+            is False
+        )
+
+    def test_auto_hdr_source_falls_back_to_software_without_opencl(self, monkeypatch):
+        # A decodable HEVC that is true-HDR (PQ/HLG) can't use scale_vaapi=format=nv12 (Gen 9.5), and with
+        # no OpenCL runtime to tonemap on the GPU it drops to software libx264 (BUG 1's behaviour).
+        self._policy(monkeypatch, "auto")
+        self._kind(monkeypatch, stream._VK_HDR)
+        self._opencl(monkeypatch, False)
+        monkeypatch.setattr(stream, "_render_node_present", lambda: True)
+        assert stream._select_encode(
+            None, _FakeItem(codec_video="hevc"), transcode=True, src=self.SRC
+        ) == (False, False)
+
+    def test_auto_hdr_source_uses_hw_tonemap_with_opencl(self, monkeypatch):
+        # With the OpenCL runtime present, a true-HDR HEVC tone-maps on the GPU (VAAPI decode → OpenCL
+        # tonemap → VAAPI encode) instead of dropping to CPU — the HW HDR path.
+        self._policy(monkeypatch, "auto")
+        self._kind(monkeypatch, stream._VK_HDR)
+        self._opencl(monkeypatch, True)
+        monkeypatch.setattr(stream, "_render_node_present", lambda: True)
+        assert stream._select_encode(
+            None, _FakeItem(codec_video="hevc"), transcode=True, src=self.SRC
+        ) == (True, True)
+
+    def test_auto_10bit_SDR_source_uses_software_not_tonemap(self, monkeypatch):
+        # F1 regression: a 10-bit *SDR* (bt709) source is NOT HDR, so it must NOT get the hable HDR tone
+        # curve even when the OpenCL runtime is present — that would visibly alter an SDR picture. It takes
+        # software libx264 (an exact 10→8-bit downconvert), never (True, True).
+        self._policy(monkeypatch, "auto")
+        self._kind(monkeypatch, stream._VK_SDR10)
+        self._opencl(monkeypatch, True)
+        monkeypatch.setattr(stream, "_render_node_present", lambda: True)
+        assert stream._select_encode(
+            None, _FakeItem(codec_video="hevc"), transcode=True, src=self.SRC
+        ) == (False, False)
+
+    def test_auto_8bit_source_uses_plain_hw_not_tonemap(self, monkeypatch):
+        # An 8-bit SDR source takes the plain full-GPU scale path — never the tonemap graph — even where
+        # OpenCL is available.
+        self._policy(monkeypatch, "auto")
+        self._kind(monkeypatch, stream._VK_HWSAFE)
+        self._opencl(monkeypatch, True)
+        monkeypatch.setattr(stream, "_render_node_present", lambda: True)
+        assert stream._select_encode(
+            None, _FakeItem(codec_video="hevc"), transcode=True, src=self.SRC
+        ) == (True, False)
 
     def test_off_forces_software_even_for_a_decodable_source(self, monkeypatch):
         self._policy(monkeypatch, "off")
         monkeypatch.setattr(stream, "_render_node_present", lambda: True)
-        assert stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=True) is False
+        assert (
+            stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=True, src=self.SRC)
+            is False
+        )
 
-    def test_on_forces_hw_even_for_a_non_decodable_source(self, monkeypatch):
-        # The admin override trusts the GPU to decode it; skips the decodability gate (render node still
-        # required — HW is impossible without it).
+    def test_on_forces_hw_and_skips_both_source_gates(self, monkeypatch):
+        # The admin override trusts the GPU; skips the decodability AND the bit-depth gate (the runtime
+        # HW→SW fallback still backstops it). Render node still required — HW is impossible without it.
         self._policy(monkeypatch, "on")
+        self._hwsafe(monkeypatch, False)  # would veto in auto; "on" ignores it
+        self._opencl(
+            monkeypatch, False
+        )  # pin: tonemap-half is irrelevant here, keep it deterministic
         monkeypatch.setattr(stream, "_render_node_present", lambda: True)
-        assert stream._want_hw(None, _FakeItem(codec_video="av1"), transcode=True) is True
+        assert (
+            stream._want_hw(None, _FakeItem(codec_video="av1"), transcode=True, src=self.SRC)
+            is True
+        )
         monkeypatch.setattr(stream, "_render_node_present", lambda: False)
-        assert stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=True) is False
+        assert (
+            stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=True, src=self.SRC)
+            is False
+        )
+
+    def test_on_still_picks_the_tonemap_graph_for_an_hdr_source(self, monkeypatch):
+        # "on" trusts the GPU but must still route a true-HDR source through the tonemap graph (plain
+        # scale_vaapi would hit the VPP wall) when OpenCL is present.
+        self._policy(monkeypatch, "on")
+        self._kind(monkeypatch, stream._VK_HDR)
+        self._opencl(monkeypatch, True)
+        monkeypatch.setattr(stream, "_render_node_present", lambda: True)
+        assert stream._select_encode(
+            None, _FakeItem(codec_video="hevc"), transcode=True, src=self.SRC
+        ) == (True, True)
+
+    def test_on_10bit_SDR_uses_plain_hw_not_tonemap(self, monkeypatch):
+        # F1 regression under "on": a 10-bit SDR source is NOT HDR, so even with OpenCL present "on" must
+        # pick plain HW (True, False) — the HDR tone curve must never touch an SDR picture.
+        self._policy(monkeypatch, "on")
+        self._kind(monkeypatch, stream._VK_SDR10)
+        self._opencl(monkeypatch, True)
+        monkeypatch.setattr(stream, "_render_node_present", lambda: True)
+        assert stream._select_encode(
+            None, _FakeItem(codec_video="hevc"), transcode=True, src=self.SRC
+        ) == (True, False)
+
+    def test_on_without_opencl_is_plain_hw(self, monkeypatch):
+        # "on" with no OpenCL runtime → plain HW, tonemap=False, regardless of source class (the runtime
+        # HW→SW fallback backstops a source the plain path can't actually handle). Pins the tonemap half
+        # of the "on" tuple, which test_on_forces_hw_and_skips_both_source_gates only checks via _want_hw.
+        self._policy(monkeypatch, "on")
+        self._kind(monkeypatch, stream._VK_HDR)  # even HDR: no runtime → can't tonemap on the GPU
+        self._opencl(monkeypatch, False)
+        monkeypatch.setattr(stream, "_render_node_present", lambda: True)
+        assert stream._select_encode(
+            None, _FakeItem(codec_video="hevc"), transcode=True, src=self.SRC
+        ) == (True, False)
 
 
 class TestColdStartWarmup:
@@ -333,7 +489,7 @@ class TestColdStartWarmup:
     def test_warmup_waits_for_the_first_few_segments(self, fake_env, monkeypatch):
         waited = []
 
-        def spy(path, timeout=20.0):
+        def spy(path, timeout=20.0, proc=None):
             waited.append(path.name)
             return True
 
@@ -346,7 +502,7 @@ class TestColdStartWarmup:
     def test_warmup_stops_at_the_first_segment_that_isnt_ready(self, fake_env, monkeypatch):
         waited = []
 
-        def spy(path, timeout=20.0):
+        def spy(path, timeout=20.0, proc=None):
             waited.append(path.name)
             return path.name != "seg_1.ts"  # seg_1 never appears → warm-up gives up there
 
@@ -360,7 +516,7 @@ class TestColdStartWarmup:
         # still returned so the client's own segment requests can drive it, as before.
         waited = []
 
-        def spy(path, timeout=20.0):
+        def spy(path, timeout=20.0, proc=None):
             waited.append(path.name)
             return False
 
@@ -398,7 +554,7 @@ class TestTranscodeStartSession:
             "get_str",
             lambda db, k: {"plex_transcode_preset": "slow"}.get(k, "auto"),
         )
-        monkeypatch.setattr(stream, "wait_for", lambda path, timeout=20.0: True)
+        monkeypatch.setattr(stream, "wait_for", lambda path, timeout=20.0, proc=None: True)
         _CapturingProc.calls = []
         monkeypatch.setattr(stream.subprocess, "Popen", _CapturingProc)
         return tmp_path
@@ -406,7 +562,9 @@ class TestTranscodeStartSession:
     def test_software_transcode_threads_the_knobs_into_the_command(
         self, capturing_env, monkeypatch
     ):
-        monkeypatch.setattr(stream, "_want_hw", lambda db, item, transcode: False)
+        monkeypatch.setattr(
+            stream, "_select_encode", lambda db, item, transcode, src: (False, False)
+        )
         s = stream.start_session(
             db=None, item=_FakeItem(codec_video="mpeg4"), start_s=0.0, transcode=True
         )
@@ -421,25 +579,292 @@ class TestTranscodeStartSession:
             assert kwargs.get("preexec_fn") is stream._sw_child_preexec
 
     def test_hardware_transcode_uses_the_gpu_and_never_nices(self, capturing_env, monkeypatch):
-        monkeypatch.setattr(stream, "_want_hw", lambda db, item, transcode: True)
+        monkeypatch.setattr(
+            stream, "_select_encode", lambda db, item, transcode, src: (True, False)
+        )
         s = stream.start_session(
             db=None, item=_FakeItem(codec_video="hevc"), start_s=0.0, transcode=True
         )
-        assert s is not None and s.transcode is True and s.hw is True
+        assert s is not None and s.transcode is True and s.hw is True and s.tonemap is False
+        assert len(_CapturingProc.calls) == 1  # first segment arrived — no HW→SW fallback respawn
         (cmd, *_), kwargs = _CapturingProc.calls[0]
         assert _venc(cmd) == "h264_vaapi"
         assert "libx264" not in cmd
-        assert (
-            "-vf" not in cmd or cmd[cmd.index("-vf") + 1] == "scale_vaapi=format=nv12"
-        )  # no SW cap
+        # Plain-HW path unconditionally emits the nv12 downconvert (a disjunction on "-vf not in cmd"
+        # would silently pass if the filter were dropped — assert it is actually present).
+        assert cmd[cmd.index("-vf") + 1] == "scale_vaapi=format=nv12"  # no SW cap
         assert kwargs.get("preexec_fn") is None  # GPU encode is cheap — never niced
 
+    def test_hdr_tonemap_transcode_threads_the_opencl_graph_and_flags_the_session(
+        self, capturing_env, monkeypatch
+    ):
+        # A HW tonemap session (10-bit/HDR + OpenCL) must build the OpenCL graph in the argv and carry
+        # tonemap=True on the session, still on the GPU (hw=True) and never niced.
+        monkeypatch.setattr(stream, "_select_encode", lambda db, item, transcode, src: (True, True))
+        s = stream.start_session(
+            db=None, item=_FakeItem(codec_video="hevc"), start_s=0.0, transcode=True
+        )
+        assert s is not None and s.transcode is True and s.hw is True and s.tonemap is True
+        (cmd, *_), kwargs = _CapturingProc.calls[0]
+        assert _venc(cmd) == "h264_vaapi"
+        assert "opencl=ocl@va" in cmd and cmd[cmd.index("-filter_hw_device") + 1] == "ocl"
+        assert "tonemap_opencl=" in cmd[cmd.index("-vf") + 1]
+        assert kwargs.get("preexec_fn") is None
+
+    def test_a_hw_session_that_produces_nothing_falls_back_to_software(
+        self, capturing_env, monkeypatch
+    ):
+        # BUG 1 backstop: _want_hw picked HW but the VAAPI session emits no first segment (a VAProfile
+        # refusal the gates didn't catch). start_session must respawn on libx264 and report hw=False so
+        # the item still plays and the route/player honestly show CPU.
+        monkeypatch.setattr(
+            stream, "_select_encode", lambda db, item, transcode, src: (True, False)
+        )
+        seen = {"n": 0}
+
+        def flaky_wait(path, timeout=20.0, proc=None):
+            seen["n"] += 1
+            return seen["n"] > 1  # the first seg-0 wait (HW) fails; every wait after succeeds (SW)
+
+        monkeypatch.setattr(stream, "wait_for", flaky_wait)
+        s = stream.start_session(
+            db=None, item=_FakeItem(codec_video="hevc"), start_s=0.0, transcode=True
+        )
+        assert (
+            s is not None and s.transcode is True and s.hw is False
+        )  # honest CPU after the fallback
+        assert len(_CapturingProc.calls) == 2  # the HW attempt, then the SW respawn
+        (hw_cmd, *_), _ = _CapturingProc.calls[0]
+        (sw_cmd, *_), sw_kwargs = _CapturingProc.calls[1]
+        assert _venc(hw_cmd) == "h264_vaapi"
+        assert _venc(sw_cmd) == "libx264"
+        if os.name == "posix":
+            assert sw_kwargs.get("preexec_fn") is stream._sw_child_preexec  # the SW child is niced
+
+    def test_a_hw_TONEMAP_session_that_produces_nothing_falls_back_to_software(
+        self, capturing_env, monkeypatch
+    ):
+        # The fallback gate is `not ready and s.hw`, shared by plain-HW and tonemap sessions — but only
+        # the plain-HW variant was covered. Pin the tonemap variant too: a (True, True) session that
+        # emits nothing (an OpenCL/tonemap init refusal) must respawn on libx264 and end hw=False,
+        # tonemap=False, so an HDR item still plays on CPU.
+        monkeypatch.setattr(stream, "_select_encode", lambda db, item, transcode, src: (True, True))
+        seen = {"n": 0}
+
+        def flaky_wait(path, timeout=20.0, proc=None):
+            seen["n"] += 1
+            return (
+                seen["n"] > 1
+            )  # the first seg-0 wait (HW tonemap) fails; every wait after succeeds
+
+        monkeypatch.setattr(stream, "wait_for", flaky_wait)
+        s = stream.start_session(
+            db=None, item=_FakeItem(codec_video="hevc"), start_s=0.0, transcode=True
+        )
+        assert s is not None and s.transcode is True and s.hw is False and s.tonemap is False
+        assert len(_CapturingProc.calls) == 2  # the HW tonemap attempt, then the SW respawn
+        (hw_cmd, *_), _ = _CapturingProc.calls[0]
+        (sw_cmd, *_), _ = _CapturingProc.calls[1]
+        assert (
+            "tonemap_opencl=" in hw_cmd[hw_cmd.index("-vf") + 1]
+        )  # first attempt built the OpenCL graph
+        assert _venc(sw_cmd) == "libx264"  # respawn is plain software, no tonemap
+
+    def test_a_superseded_hw_session_does_not_respawn_over_the_newer_one(
+        self, capturing_env, monkeypatch
+    ):
+        # F2/race: start_session waits on seg_0 OUTSIDE _lock. If a concurrent same-key start (a rapid
+        # seek-restart) or _enforce_cap replaces _sessions[key] while we wait, our proc dying must NOT
+        # trigger the SW fallback — that would tear down the NEWER session and breach the transcode cap.
+        # The identity guard must detect it's been superseded and yield the currently-registered session.
+        monkeypatch.setattr(
+            stream, "_select_encode", lambda db, item, transcode, src: (True, False)
+        )
+
+        class _Newer:  # stands in for the session a concurrent _spawn registered
+            hw = True
+            tonemap = False
+            transcode = True
+            last_access = 0.0
+
+        newer = _Newer()
+
+        def wait_then_supersede(path, timeout=20.0, proc=None):
+            # Simulate the concurrent replacement happening during our out-of-lock wait, then report the
+            # (now-killed) HW proc produced nothing.
+            stream._sessions["12345"] = newer
+            return False
+
+        monkeypatch.setattr(stream, "wait_for", wait_then_supersede)
+        s = stream.start_session(
+            db=None, item=_FakeItem(codec_video="hevc"), start_s=0.0, transcode=True
+        )
+        # No SW respawn — only the initial HW _spawn ran; the newer session was left intact.
+        assert len(_CapturingProc.calls) == 1
+        assert s is newer  # yielded the currently-registered session, did not clobber it
+        assert stream._sessions["12345"] is newer
+
+    def test_a_cap_culled_hw_session_does_not_respawn_and_is_not_reported_missing(
+        self, capturing_env, monkeypatch
+    ):
+        # F2/race, the cull sub-case: while we wait on seg_0 out of lock, cross-key cap pressure lets
+        # _enforce_cap evict THIS session's key entirely (no replacement). The fallback must still not
+        # respawn (that would re-breach the cap the cull just enforced), and must NOT return None — a None
+        # is turned by the route into a dishonest "file not found" 404 for a file that exists. It yields
+        # our own (now-dead) session instead, so the client's segment requests degrade to the retryable
+        # "not available yet" path.
+        monkeypatch.setattr(
+            stream, "_select_encode", lambda db, item, transcode, src: (True, False)
+        )
+        captured = {}
+
+        def wait_then_cull(path, timeout=20.0, proc=None):
+            captured["s"] = stream._sessions[
+                "12345"
+            ]  # the HW session the initial _spawn just registered
+            del stream._sessions[
+                "12345"
+            ]  # simulate _enforce_cap dropping the LRU under cap pressure
+            return False
+
+        monkeypatch.setattr(stream, "wait_for", wait_then_cull)
+        s = stream.start_session(
+            db=None, item=_FakeItem(codec_video="hevc"), start_s=0.0, transcode=True
+        )
+        assert (
+            len(_CapturingProc.calls) == 1
+        )  # no SW respawn — the cull is respected, cap not re-breached
+        assert (
+            s is captured["s"]
+        )  # our own session yielded, NOT None (which the route would 404 as missing)
+        assert "12345" not in stream._sessions  # the culled key stays gone
+
     def test_remux_reads_no_transcode_knobs_and_stream_copies(self, capturing_env, monkeypatch):
         # A remux start must stream-copy the video and spawn no niced child (the transcode knobs and
         # the preexec nice are gated behind `transcode=True`).
-        monkeypatch.setattr(stream, "_want_hw", lambda db, item, transcode: False)
+        monkeypatch.setattr(
+            stream, "_select_encode", lambda db, item, transcode, src: (False, False)
+        )
         s = stream.start_session(db=None, item=_FakeItem(), start_s=0.0)  # transcode defaults False
         assert s is not None and s.transcode is False
         (cmd, *_), kwargs = _CapturingProc.calls[0]
         assert _venc(cmd) == "copy"
         assert kwargs.get("preexec_fn") is None
+
+
+class TestProbeVideoKind:
+    """The ffprobe-based source classifier that routes the transcode pipeline: 8-bit SDR → plain VAAPI;
+    true-HDR (PQ/HLG) → the OpenCL tonemap graph; 10-bit *SDR* → software (an exact downconvert, NEVER
+    the HDR tone curve — the F1 distinction). Exercises the REAL function body (not a monkeypatch)."""
+
+    @staticmethod
+    def _probe(monkeypatch, stdout):
+        class _R:
+            def __init__(self):
+                self.stdout = stdout
+
+        monkeypatch.setattr(stream.subprocess, "run", lambda *a, **k: _R())
+
+    def test_8bit_sdr_is_hwsafe(self, monkeypatch):
+        self._probe(monkeypatch, "pix_fmt=yuv420p\nbits_per_raw_sample=8\ncolor_transfer=bt709\n")
+        assert stream._probe_video_kind(Path("/x")) == stream._VK_HWSAFE
+
+    def test_10bit_sdr_pix_fmt_is_sdr10(self, monkeypatch):
+        # yuv420p10le with a non-HDR transfer (bt2020-10 is NOT PQ/HLG) = 10-bit SDR → software, not
+        # tonemap. Signalled by the pix_fmt suffix even when bits_per_raw_sample is absent.
+        self._probe(monkeypatch, "pix_fmt=yuv420p10le\ncolor_transfer=bt2020-10\n")
+        assert stream._probe_video_kind(Path("/x")) == stream._VK_SDR10
+
+    def test_bits_per_raw_sample_over_8_sdr_is_sdr10(self, monkeypatch):
+        self._probe(monkeypatch, "pix_fmt=yuv420p\nbits_per_raw_sample=10\ncolor_transfer=bt709\n")
+        assert stream._probe_video_kind(Path("/x")) == stream._VK_SDR10
+
+    def test_pq_transfer_is_hdr(self, monkeypatch):
+        # PQ (smpte2084) is true HDR — needs a real tonemap, even if only 8-bit-tagged.
+        self._probe(
+            monkeypatch, "pix_fmt=yuv420p10le\nbits_per_raw_sample=10\ncolor_transfer=smpte2084\n"
+        )
+        assert stream._probe_video_kind(Path("/x")) == stream._VK_HDR
+
+    def test_hlg_transfer_is_hdr(self, monkeypatch):
+        # HLG (arib-std-b67) is the other HDR transfer — previously untested; it must classify as HDR.
+        self._probe(
+            monkeypatch,
+            "pix_fmt=yuv420p10le\nbits_per_raw_sample=10\ncolor_transfer=arib-std-b67\n",
+        )
+        assert stream._probe_video_kind(Path("/x")) == stream._VK_HDR
+
+    def test_empty_probe_output_is_hwsafe(self, monkeypatch):
+        # A probe that returns nothing (no streams / stripped metadata) → assume hwsafe; the runtime
+        # HW→SW fallback backstops a wrong guess.
+        self._probe(monkeypatch, "")
+        assert stream._probe_video_kind(Path("/x")) == stream._VK_HWSAFE
+
+    def test_probe_failure_assumes_hwsafe(self, monkeypatch):
+        # ffprobe missing/erroring → assume hwsafe; the runtime HW→SW fallback is the real backstop, so a
+        # probe miss costs at most one wasted HW attempt, never a stranded item.
+        def boom(*a, **k):
+            raise OSError("no ffprobe")
+
+        monkeypatch.setattr(stream.subprocess, "run", boom)
+        assert stream._probe_video_kind(Path("/x")) == stream._VK_HWSAFE
+
+
+class TestOpenclPresent:
+    """The OpenCL-runtime probe (_opencl_present) — the precondition for the HW HDR tonemap graph. Drives
+    the REAL glob against a temp ICD dir instead of monkeypatching the function, so a regression to the
+    ICD path / glob / OSError guard would be caught (this routes every HDR source on prod)."""
+
+    def test_true_when_an_icd_file_is_registered(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(stream, "_OPENCL_ICD_DIR", tmp_path)
+        (tmp_path / "intel.icd").write_text("libintelocl.so\n")
+        assert stream._opencl_present() is True
+
+    def test_false_when_the_dir_is_empty(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(stream, "_OPENCL_ICD_DIR", tmp_path)
+        assert stream._opencl_present() is False
+
+    def test_false_and_no_raise_when_the_dir_is_missing(self, tmp_path, monkeypatch):
+        # A missing dir: Path.glob yields nothing (no raise) → False.
+        monkeypatch.setattr(stream, "_OPENCL_ICD_DIR", tmp_path / "nope")
+        assert stream._opencl_present() is False
+
+    def test_false_when_glob_raises_oserror(self, monkeypatch):
+        # The `except OSError` guard proper: an unreadable ICD dir (permission denied) makes glob RAISE,
+        # not return empty. That must be swallowed to False, never propagated up through _select_encode
+        # into start_session (which would crash HDR routing).
+        class _BoomDir:
+            def glob(self, pattern):
+                raise OSError("permission denied")
+
+        monkeypatch.setattr(stream, "_OPENCL_ICD_DIR", _BoomDir())
+        assert stream._opencl_present() is False
+
+
+class TestWaitForProcFastFail:
+    """wait_for(proc=…) must stop as soon as the ffmpeg proc exits (a VAAPI init refusal dies in ~1s
+    producing nothing) instead of blocking the whole timeout — that fast-fail is what keeps the HW→SW
+    fallback from turning into a 25s stall. Exercises the REAL wait_for (every other test monkeypatches
+    it wholesale, so this branch would otherwise never run)."""
+
+    class _DeadProc:
+        def poll(self):
+            return 1  # already exited non-zero
+
+    def test_returns_true_when_the_segment_exists_despite_a_dead_proc(self, tmp_path):
+        seg = tmp_path / "seg_0.ts"
+        seg.write_bytes(b"x")
+        # The proc exited but DID write a first segment → ready. (The final existence re-check.)
+        assert stream.wait_for(seg, timeout=5.0, proc=self._DeadProc()) is True
+
+    def test_returns_false_fast_when_a_dead_proc_wrote_nothing(self, tmp_path):
+        # Missing segment + dead proc → give up immediately, not after `timeout`. Assert it's fast by
+        # using a long timeout the test would visibly hang on if the fast-fail branch regressed.
+        seg = tmp_path / "seg_0.ts"
+        assert stream.wait_for(seg, timeout=30.0, proc=self._DeadProc()) is False
+
+    def test_empty_segment_from_a_dead_proc_is_not_ready(self, tmp_path):
+        # A zero-byte segment is not a real segment (size > 0 required).
+        seg = tmp_path / "seg_0.ts"
+        seg.write_bytes(b"")
+        assert stream.wait_for(seg, timeout=30.0, proc=self._DeadProc()) is False

backend/tests/test_ratelimit.py

@@ -0,0 +1,65 @@
+"""The sliding-window limiter behind /auth/register, password-login, password-reset and demo.
+
+Pure logic, no DB. `reset()` in particular is only ever called by a test fixture (conftest clears
+the module-level limiters between tests), so without a test here a refactor could turn it into a
+no-op and nothing would notice until an unrelated test started failing with a 429.
+"""
+
+from app import ratelimit
+from app.ratelimit import RateLimiter
+
+
+def test_allow_trips_at_the_cap_and_stays_tripped():
+    lim = RateLimiter(max_events=2, window_seconds=300)
+
+    assert lim.allow("ip") is True
+    assert lim.allow("ip") is True
+    assert lim.allow("ip") is False
+    assert lim.allow("ip") is False
+
+
+def test_hammering_while_blocked_does_not_push_the_window_forward(monkeypatch):
+    # A blocked attempt must not be recorded, otherwise someone who keeps retrying holds their own
+    # window open forever — an indefinite lockout for anyone sharing that IP. Only observable across
+    # the window boundary, so drive the clock: two attempts fill the cap, ten blocked retries land
+    # just before it expires, and the caller must still be let back in on the far side.
+    clock = {"t": 1000.0}
+    monkeypatch.setattr(ratelimit.time, "monotonic", lambda: clock["t"])
+    lim = RateLimiter(max_events=2, window_seconds=60)
+
+    assert lim.allow("ip") is True
+    assert lim.allow("ip") is True
+    for _ in range(10):
+        clock["t"] += 5  # still inside the window; every one of these is refused
+        assert lim.allow("ip") is False
+
+    clock["t"] = 1000.0 + 61  # past the window of the two attempts that actually counted
+    assert lim.allow("ip") is True
+
+
+def test_keys_are_independent():
+    lim = RateLimiter(max_events=1, window_seconds=300)
+
+    assert lim.allow("a") is True
+    assert lim.allow("a") is False
+    assert lim.allow("b") is True
+
+
+def test_reset_clears_every_key():
+    lim = RateLimiter(max_events=1, window_seconds=300)
+    lim.allow("a")
+    lim.allow("b")
+    assert lim.allow("a") is False
+
+    lim.reset()
+
+    assert lim.allow("a") is True
+    assert lim.allow("b") is True
+
+
+def test_expired_attempts_fall_out_of_the_window():
+    # A zero-length window means every previous attempt is already outside it.
+    lim = RateLimiter(max_events=1, window_seconds=0)
+
+    assert lim.allow("ip") is True
+    assert lim.allow("ip") is True

backend/tests/test_upload.py

@@ -7,9 +7,9 @@ guards that keep an upload out of paths that assume a re-fetchable source (edit
 
 DB-backed (real Postgres) — skipped when no database is reachable. `settings.download_root` is
 pointed at a per-test tmp dir so ingest's on-disk moves are isolated. The ingest/route tests
-monkeypatch `_probe` so they don't shell out to ffprobe; the classifier's OWN parsing (image →
-file, cover-art skip, dims, duration) is covered directly by `TestProbeClassifier` below, which
-stubs one level down (`run_ffprobe_json`) and exercises the real `_probe`.
+monkeypatch the shared `probe.probe_media` so they don't shell out to ffprobe; the classifier's OWN
+parsing (image → file, cover-art skip, dims, duration) is covered directly by `TestProbeClassifier`
+below, which stubs one level down (`run_ffprobe_json`) and exercises the real `probe_media`.
 """
 
 from pathlib import Path
@@ -18,6 +18,7 @@ import pytest
 
 from app.config import settings
 from app.downloads import mediakind, quota, storage
+from app.downloads import probe as probemod
 from app.downloads import upload as uploadmod
 from app.models import DownloadQuota, MediaAsset
 
@@ -42,7 +43,9 @@ def _root(tmp_path, monkeypatch):
 
 
 def _probe(monkeypatch, result):
-    monkeypatch.setattr(uploadmod, "_probe", lambda _p: result)
+    # upload ingest now calls the shared `probe.probe_media` (same ground-truth ffprobe the download
+    # worker uses); patch it at that shared home.
+    monkeypatch.setattr(probemod, "probe_media", lambda _p: result)
 
 
 def test_ingest_generic_file_is_download_only(db, make_user, _root, monkeypatch):
@@ -325,16 +328,16 @@ def test_ingest_cleans_up_placed_files_on_commit_failure(db, make_user, _root, m
     assert db.query(MediaAsset).count() == 0  # the flushed asset rolled back — no dangling row
 
 
-# --- classifier: the REAL _probe parsing (stubs ffprobe one level down) ----------------------
-# The ingest/route tests above stub _probe wholesale; these exercise _probe's OWN logic — image
+# --- classifier: the REAL probe_media parsing (stubs ffprobe one level down) ------------------
+# The ingest/route tests above stub probe_media wholesale; these exercise its OWN logic — image
 # detection, the cover-art skip, dimension/duration parsing — by faking only run_ffprobe_json, so a
 # regression in the classifier the force-download guarantee leans on is actually caught.
 
 
 class TestProbeClassifier:
     def _probe_with(self, monkeypatch, data):
-        monkeypatch.setattr(uploadmod.editmod, "run_ffprobe_json", lambda *a, **k: data)
-        return uploadmod._probe(Path("x"))
+        monkeypatch.setattr(probemod.editmod, "run_ffprobe_json", lambda *a, **k: data)
+        return probemod.probe_media(Path("x"))
 
     def test_probe_failure_is_a_generic_file(self, monkeypatch):
         # run_ffprobe_json returns None (ffprobe failed / not media) → all None → derive() == FILE.
@@ -392,3 +395,109 @@ class TestProbeClassifier:
         }
         v, a, w, h, d = self._probe_with(monkeypatch, data)
         assert d is None and mediakind.derive(v, a) == mediakind.AUDIO
+
+
+# --- resolve_media_facts: probe-of-the-file wins over yt-dlp's info (the FB regression fix) ---------
+# The download worker's finalize must classify from the ACTUAL file, not the extractor's `info` dict.
+# yt-dlp omits vcodec/acodec/dims for some sources (Facebook), and deriving media_kind from those
+# nulls turned a real H.264 video into a download-only 'file' (no in-app play). These pin that the
+# probe is authoritative and `info` is only a gap-filler.
+
+
+class TestResolveMediaFacts:
+    # These stub run_ffprobe_json (one level below probe_media) so the REAL probe parsing + the
+    # probe-vs-info precedence are exercised together — the precedence keys off whether ffprobe RAN.
+    @staticmethod
+    def _ffprobe(monkeypatch, data):
+        monkeypatch.setattr(probemod.editmod, "run_ffprobe_json", lambda *a, **k: data)
+
+    def test_probe_wins_when_info_lacks_codecs(self, monkeypatch):
+        # THE original regression: info has no vcodec/acodec/dims (Facebook), but the file probes as
+        # h264/aac.
+        self._ffprobe(
+            monkeypatch,
+            {
+                "format": {"format_name": "mov,mp4,m4a"},
+                "streams": [
+                    {"codec_type": "video", "codec_name": "h264", "width": 720, "height": 1280},
+                    {"codec_type": "audio", "codec_name": "aac"},
+                ],
+            },
+        )
+        v, a, w, h = probemod.resolve_media_facts(Path("x"), {"width": None, "height": None})
+        assert (v, a, w, h) == ("h264", "aac", 720, 1280)
+        assert mediakind.derive(v, a) == mediakind.VIDEO  # NOT 'file'
+
+    def test_probe_wins_over_a_DIFFERING_populated_info(self, monkeypatch):
+        # Both the probe AND info are populated but DISAGREE (info carries a pre-remux/pre-merge codec).
+        # The finished file on disk is ground truth, so the probe wins outright — pins the precedence a
+        # `info or probe` inversion would silently break.
+        self._ffprobe(
+            monkeypatch,
+            {
+                "format": {"format_name": "mov,mp4,m4a"},
+                "streams": [
+                    {"codec_type": "video", "codec_name": "h264", "width": 1920, "height": 1080},
+                    {"codec_type": "audio", "codec_name": "aac"},
+                ],
+            },
+        )
+        v, a, w, h = probemod.resolve_media_facts(
+            Path("x"), {"vcodec": "vp9", "acodec": "opus", "width": 640, "height": 480}
+        )
+        assert (v, a, w, h) == ("h264", "aac", 1920, 1080)  # probe, not info
+
+    def test_cover_art_audio_download_is_not_resurrected_to_video_by_info(self, monkeypatch):
+        # THE bug this fix targets: an audio-mode download from a progressive source embeds cover art,
+        # and yt-dlp's info still carries the source's video codec. The probe correctly finds only audio
+        # (the attached_pic is skipped); info's vcodec must NOT resurrect a video track → media_kind
+        # stays audio, not a broken in-app 'video'.
+        self._ffprobe(
+            monkeypatch,
+            {
+                "format": {"format_name": "mp3", "duration": "180.0"},
+                "streams": [
+                    {
+                        "codec_type": "video",
+                        "codec_name": "mjpeg",
+                        "disposition": {"attached_pic": 1},
+                    },
+                    {"codec_type": "audio", "codec_name": "mp3"},
+                ],
+            },
+        )
+        v, a, w, h = probemod.resolve_media_facts(
+            Path("x"), {"vcodec": "avc1", "acodec": "mp4a", "width": 1280, "height": 720}
+        )
+        assert v is None and a == "mp3"  # info's avc1 did NOT win
+        assert mediakind.derive(v, a) == mediakind.AUDIO  # NOT VIDEO
+
+    def test_still_image_download_is_not_resurrected_to_video_by_info(self, monkeypatch):
+        # A downloaded still image: the probe returns no vcodec (image-format guard). info's image
+        # "vcodec" must not turn it into a broken 'video' → stays a generic file.
+        self._ffprobe(
+            monkeypatch,
+            {
+                "format": {"format_name": "png_pipe"},
+                "streams": [{"codec_type": "video", "codec_name": "png", "width": 8, "height": 8}],
+            },
+        )
+        v, a, w, h = probemod.resolve_media_facts(
+            Path("x"), {"vcodec": "png", "width": 8, "height": 8}
+        )
+        assert v is None and mediakind.derive(v, a) == mediakind.FILE
+
+    def test_info_fills_in_only_when_ffprobe_could_not_read_the_file(self, monkeypatch):
+        # ffprobe failed entirely (None) → fall back to info so we never regress the working path.
+        self._ffprobe(monkeypatch, None)
+        v, a, w, h = probemod.resolve_media_facts(
+            Path("x"), {"vcodec": "vp9", "acodec": "opus", "width": 1920, "height": 1080}
+        )
+        assert (v, a, w, h) == ("vp9", "opus", 1920, 1080)
+
+    def test_info_none_codec_string_is_treated_as_absent(self, monkeypatch):
+        # yt-dlp writes the literal "none" for a missing stream — it must not become a codec name.
+        self._ffprobe(monkeypatch, None)  # probe failed → info path, where the "none" scrub applies
+        v, a, w, h = probemod.resolve_media_facts(Path("x"), {"vcodec": "none", "acodec": "aac"})
+        assert (v, a) == (None, "aac")
+        assert mediakind.derive(v, a) == mediakind.AUDIO

frontend/src/components/AdminUsers.tsx

@@ -3,10 +3,11 @@ import { qk } from "../lib/queryKeys";
 import { useTranslation } from "react-i18next";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { Ban, Check, RotateCcw, Shield, Trash2, UserPlus, X } from "lucide-react";
-import { api, type AdminUserRow, type Invite, type Me } from "../lib/api";
+import { api, HttpError, type AdminUserRow, type Invite, type Me } from "../lib/api";
 import { notify } from "../lib/notifications";
 import { ADMIN_USERS_TAB_KEY } from "../lib/adminUsersTab";
 import Tooltip from "./Tooltip";
+import InlineNotice from "./InlineNotice";
 import { Section } from "./ui/form";
 import { LoadingState, StateMessage } from "./QueryState";
 import { useConfirm } from "./ConfirmProvider";
@@ -266,6 +267,7 @@ function AdminInvites() {
   const { t } = useTranslation();
   const qc = useQueryClient();
   const confirm = useConfirm();
+  const me = useMe();
   const invites = useQuery({ queryKey: qk.adminInvites(), queryFn: () => api.adminInvites() });
   const [newEmail, setNewEmail] = useState("");
   const refresh = () => {
@@ -297,6 +299,45 @@ function AdminInvites() {
     });
     if (ok) deny.mutate(i.id);
   };
+  const remove = useMutation({
+    mutationFn: (id: number) => api.deleteInvite(id),
+    onSuccess: (d) => {
+      refresh();
+      // Removing the row is not always a revoke: is_allowed falls back to the env allow-lists, so
+      // for an address on those the person keeps access. Saying "removed" alone would mislead.
+      if (d.still_allowed_by_env)
+        notify({ level: "warning", message: t("settings.invites.deletedStillAllowed") });
+      else notify({ level: "success", message: t("settings.invites.deleted") });
+    },
+    onError: (e) => {
+      // A 409 means the list was stale — someone registered on that address since it loaded. Say
+      // what to do instead of a generic failure, and refetch so the row re-renders as read-only.
+      const conflict = e instanceof HttpError && e.status === 409;
+      notify({
+        level: "error",
+        message: t(
+          conflict ? "settings.invites.deleteHasAccount" : "settings.invites.deleteFailed",
+        ),
+      });
+      if (conflict) refresh();
+    },
+  });
+  const onDelete = async (i: Invite) => {
+    const ok = await confirm({
+      title: t("settings.invites.deleteTitle"),
+      // Removing the row is not a revoke when the address is also in the server's env allow-lists —
+      // say so while the admin can still change their mind, not in a toast after the fact.
+      message: t(
+        i.still_allowed_by_env
+          ? "settings.invites.deleteConfirmStillAllowed"
+          : "settings.invites.deleteConfirm",
+        { email: i.email },
+      ),
+      confirmLabel: t("settings.invites.delete"),
+      danger: true,
+    });
+    if (ok) remove.mutate(i.id);
+  };
   const add = useMutation({
     mutationFn: (email: string) => api.addInvite(email),
     onSuccess: (_d, email) => {
@@ -313,6 +354,9 @@ function AdminInvites() {
 
   return (
     <Section card title={t("settings.invites.title")}>
+      {!me.email_configured && (
+        <InlineNotice className="mb-3">{t("settings.invites.emailOff")}</InlineNotice>
+      )}
       {invites.isError && !invites.data ? (
         <StateMessage tone="error" onRetry={() => invites.refetch()}>
           {t("common.loadError")}
@@ -329,7 +373,8 @@ function AdminInvites() {
               inv={i}
               onApprove={() => approve.mutate({ id: i.id, email: i.email })}
               onDeny={() => onDeny(i)}
-              busy={approve.isPending || deny.isPending}
+              onDelete={() => onDelete(i)}
+              busy={approve.isPending || deny.isPending || remove.isPending}
             />
           ))}
         </div>
@@ -364,11 +409,38 @@ function AdminInvites() {
           </summary>
           <div className="mt-2 space-y-1 text-xs text-muted">
             {decided.map((i) => (
-              <div key={i.id} className="flex items-center justify-between gap-2">
-                <span className="truncate">{i.email}</span>
+              <div key={i.id} className="flex items-center gap-2">
+                <span className="truncate flex-1">{i.email}</span>
                 <span className={i.status === "approved" ? "text-accent" : "text-danger"}>
                   {i.status}
                 </span>
+                {/* An entry with an account behind it stays read-only: deleting it would revoke that
+                    user's access, since is_allowed reads this row. Delete the user instead. */}
+                {i.has_account ? (
+                  // `disabled` would drop it from the tab order AND suppress the title, so the
+                  // reason reached nobody — same call as the Playlists drag handle.
+                  <button
+                    type="button"
+                    aria-disabled
+                    onClick={(e) => e.preventDefault()}
+                    title={t("settings.invites.deleteHasAccount")}
+                    aria-label={t("settings.invites.deleteHasAccount")}
+                    className="shrink-0 p-1 text-muted/50 cursor-not-allowed"
+                  >
+                    <Trash2 className="w-3.5 h-3.5" />
+                  </button>
+                ) : (
+                  <Tooltip hint={t("settings.invites.deleteHint")}>
+                    <button
+                      onClick={() => onDelete(i)}
+                      disabled={remove.isPending}
+                      className="shrink-0 p-1 rounded-md text-muted hover:text-danger disabled:opacity-50 transition"
+                      aria-label={t("settings.invites.deleteLabel", { email: i.email })}
+                    >
+                      <Trash2 className="w-3.5 h-3.5" />
+                    </button>
+                  </Tooltip>
+                )}
               </div>
             ))}
           </div>
@@ -506,11 +578,13 @@ function InviteRow({
   inv,
   onApprove,
   onDeny,
+  onDelete,
   busy,
 }: {
   inv: Invite;
   onApprove: () => void;
   onDeny: () => void;
+  onDelete: () => void;
   busy: boolean;
 }) {
   const { t } = useTranslation();
@@ -546,6 +620,34 @@ function InviteRow({
           <X className="w-4 h-4" />
         </button>
       </Tooltip>
+      {/* Deny records a decision and keeps the row; delete forgets the address. Once an account
+          exists for it the row is that account's approval gate, so it is managed from Users & roles
+          instead — shown as a disabled control rather than omitted, or the admin sees a row that is
+          silently missing a button their other rows have. */}
+      {inv.has_account ? (
+        // aria-disabled, not `disabled`: the reason has to stay reachable by keyboard.
+        <button
+          type="button"
+          aria-disabled
+          onClick={(e) => e.preventDefault()}
+          title={t("settings.invites.deleteHasAccount")}
+          aria-label={t("settings.invites.deleteHasAccount")}
+          className="shrink-0 p-1.5 rounded-lg border border-border/50 text-muted/50 cursor-not-allowed"
+        >
+          <Trash2 className="w-4 h-4" />
+        </button>
+      ) : (
+        <Tooltip hint={t("settings.invites.deleteHint")}>
+          <button
+            onClick={onDelete}
+            disabled={busy}
+            className="shrink-0 p-1.5 rounded-lg border border-border text-muted hover:text-danger disabled:opacity-50 transition"
+            aria-label={t("settings.invites.deleteLabel", { email: inv.email })}
+          >
+            <Trash2 className="w-4 h-4" />
+          </button>
+        </Tooltip>
+      )}
     </div>
   );
 }

frontend/src/components/ConfigPanel.tsx

@@ -6,6 +6,8 @@ import { Plug, RotateCcw, Send } from "lucide-react";
 import { api, type ConfigItem, type PlexTestResult } from "../lib/api";
 import { notify } from "../lib/notifications";
 import Tooltip from "./Tooltip";
+import InlineNotice from "./InlineNotice";
+import { useMe } from "../lib/useMe";
 import Tabs, { usePersistedTab } from "./Tabs";
 import { LoadingState, StateMessage } from "./QueryState";
 import { PageToolbar } from "./PageShell";
@@ -35,6 +37,7 @@ const GROUP_ORDER = [
 export default function ConfigPanel() {
   const { t } = useTranslation();
   const qc = useQueryClient();
+  const me = useMe();
   const q = useQuery({ queryKey: qk.adminConfig(), queryFn: api.adminConfig });
   const data = q.data;
 
@@ -100,6 +103,10 @@ export default function ConfigPanel() {
         }
       }
       await qc.invalidateQueries({ queryKey: qk.adminConfig() });
+      // The email-not-configured notice reads me.email_configured, which is otherwise only
+      // refetched on its own 60s interval — without this it keeps warning about fields the admin
+      // has just filled in, which reads as the save not having taken.
+      await qc.invalidateQueries({ queryKey: qk.me() });
       setReseedToken((n) => n + 1); // re-seed the draft from the saved server state
       setSaveState("saved");
       setTimeout(() => setSaveState((s) => (s === "saved" ? "idle" : s)), 2500);
@@ -204,7 +211,11 @@ export default function ConfigPanel() {
             </div>
 
             {activeGroup === "email" && (
-              <div className="mt-3 pt-3 border-t border-border/60">
+              <div className="mt-3 pt-3 border-t border-border/60 space-y-3">
+                {/* The one place an operator can see that mail is off. Sending is fail-soft, so a
+                    half-filled config costs verification links, resets and access-request notices
+                    with no error anywhere — say so next to the fields that fix it. */}
+                {!me.email_configured && <InlineNotice>{t("config.emailOff")}</InlineNotice>}
                 <Tooltip hint={t("config.testEmailHint")}>
                   <button
                     onClick={() => testEmail.mutate()}

frontend/src/components/InlineNotice.tsx

@@ -0,0 +1,26 @@
+import type { ReactNode } from "react";
+import type { LucideIcon } from "lucide-react";
+import { AlertTriangle } from "lucide-react";
+
+// An in-flow warning that sits INSIDE a panel, next to the thing it is about — as opposed to
+// Banner, which is the full-bleed top-of-app bar (border-b, app chrome) and looks wrong nested in a
+// card. Same warn tokens as Banner's warning tone so the two read as one system.
+export default function InlineNotice({
+  children,
+  icon: Icon = AlertTriangle,
+  className = "",
+}: {
+  children: ReactNode;
+  icon?: LucideIcon;
+  className?: string;
+}) {
+  return (
+    <div
+      role="status"
+      className={`flex items-start gap-2 rounded-xl border border-warn/30 bg-warn/15 px-3 py-2 text-sm text-fg ${className}`}
+    >
+      <Icon className="w-4 h-4 shrink-0 mt-0.5 text-warn" aria-hidden />
+      <span className="min-w-0">{children}</span>
+    </div>
+  );
+}

frontend/src/components/NotificationsPanel.tsx

@@ -243,6 +243,7 @@ function NotificationRow({
   const isMaintenance = n.type === "maintenance" && typeof n.data?.count === "number";
   const isScheduler = n.type === "scheduler" && typeof n.data?.job_id === "string";
   const isDownloadDone = n.type === "download_done";
+  const isEmailUndelivered = n.type === "email_undelivered" && typeof n.data?.reason === "string";
   let title = n.title;
   let body = n.body;
   if (isMaintenance) {
@@ -258,6 +259,17 @@ function NotificationRow({
       job,
     });
     body = d.summary || n.body;
+  } else if (isEmailUndelivered) {
+    // Email is fail-soft: a drop leaves no error anywhere else, so this notice IS the trace. Name
+    // the message that was lost, since that is what tells the operator what their users didn't get.
+    const d = n.data as { reason: string; subject?: string };
+    title = t("inbox.emailUndelivered.title");
+    body = t(
+      d.reason === "not_configured"
+        ? "inbox.emailUndelivered.notConfigured"
+        : "inbox.emailUndelivered.sendFailed",
+      { subject: d.subject || n.body || "" },
+    );
   } else if (isDownloadDone) {
     // "Download ready" / "Edit ready" per the producer's kind, with the video's title as the body
     // (shipped in data.title). Same notification type; the copy differs so an edit isn't mislabelled.

frontend/src/components/PlexInfo.tsx

@@ -19,6 +19,7 @@ import i18n from "../i18n";
 import { Carousel } from "./Carousel";
 import PlexCollectionEditor from "./PlexCollectionEditor";
 import PlexPlaylistAdd from "./PlexPlaylistAdd";
+import { PLAYABLE_TINT, playableClass } from "./plexCards";
 
 // The rich "media info" surface for a Plex item — poster/art, IMDb score + link, content rating,
 // genres, director, cast (with photos), summary. Reused in TWO places: a full-page view opened from
@@ -253,6 +254,33 @@ function CrewPanel({
   );
 }
 
+// The playback-class chip (dot + Plex-native label), with a muted codec · bit-depth subtitle when
+// known. Class + colour are derived through the SAME shared helper the browse-card corner dot uses,
+// so the two surfaces can't drift. `overlay` tints the label for the dark player background.
+function PlaybackChip({ detail, overlay }: { detail: PlexItemDetail; overlay: boolean }) {
+  const { t } = useTranslation();
+  if (!detail.playable) return null;
+  const cls = playableClass(detail.playable, detail.transcode_hw);
+  const sub = [
+    detail.codec_video ? detail.codec_video.toUpperCase() : null,
+    detail.video_bit_depth != null ? `${detail.video_bit_depth}-bit` : null,
+  ]
+    .filter(Boolean)
+    .join(" · ");
+  return (
+    <span
+      className={`inline-flex items-center gap-1.5 rounded-full px-2 py-0.5 text-xs ${
+        overlay ? "bg-white/10 text-white/90" : "bg-surface text-muted"
+      }`}
+      title={t(`plex.playable.${cls}`)}
+    >
+      <span className={`h-2 w-2 shrink-0 rounded-full ${PLAYABLE_TINT[cls] ?? "bg-gray-400"}`} />
+      <span className="font-medium">{t(`plex.filter.playableOpt.${cls}`)}</span>
+      {sub && <span className="opacity-70">{sub}</span>}
+    </span>
+  );
+}
+
 type Props = {
   detail: PlexItemDetail;
   variant: "page" | "overlay";
@@ -479,6 +507,7 @@ export default function PlexInfo({
                     {detail.studio}
                   </Filterable>
                 )}
+                <PlaybackChip detail={detail} overlay={overlay} />
               </div>
 
               {/* Multi-source ratings row (E5 S5): IMDb / TMDb / audience, whichever are present. */}

frontend/src/components/PlexPlayer.tsx

@@ -101,6 +101,9 @@ export default function PlexPlayer({ itemId, onClose, queue }: Props) {
   // Which encoder the current transcode session ran: true=VAAPI hardware, false=libx264 software,
   // null=not a transcode. Feeds the stats overlay's mode row ("transcode · GPU" / "· CPU").
   const hwRef = useRef<boolean | null>(null);
+  // Whether the current HW transcode tone-mapped a 10-bit/HDR source on the GPU (OpenCL). Feeds the
+  // stats mode row's "· HDR→SDR" tag; null/false for an 8-bit HW, software, or non-transcode session.
+  const tonemapRef = useRef<boolean | null>(null);
   const durationRef = useRef(0);
   // ≥2 audio tracks → multi-rendition HLS: all tracks ship in one session and hls.js switches audio
   // client-side (no restart). Ref so the stable loadSession/changeAudio callbacks read it fresh.
@@ -234,6 +237,7 @@ export default function PlexPlayer({ itemId, onClose, queue }: Props) {
       // re-encodes the video (hw = which encoder), and its first segment is genuinely slower than remux.
       const isTranscode = sess.mode === "hls" && !!sess.transcode;
       hwRef.current = isTranscode ? (sess.hw ?? false) : null;
+      tonemapRef.current = isTranscode ? (sess.tonemap ?? false) : null;
       setSessionIsTranscode(isTranscode);
       // hls.js plays our non-zero-start copyts stream ~1s BEHIND the media clock (see HLS_SUB_LAG);
       // fold that into the session start so the seekbar clock, seeking AND the subtitle shift are all
@@ -257,7 +261,15 @@ export default function PlexPlayer({ itemId, onClose, queue }: Props) {
         hlsRef.current = null;
       }
       if (sess.mode === "hls" && Hls.isSupported()) {
-        const hls = new Hls({ maxBufferLength: 30, enableWorker: true });
+        // startPosition: 0 — our HLS is a growing EVENT playlist with no ENDLIST (see _HLS_TAIL in
+        // stream.py), which hls.js classifies as LIVE. Its default (startPosition: -1) then starts
+        // playback at the live edge and hugs it, so it never builds a forward buffer (rebuffer
+        // spinners), and on a resume/seek session the segments' absolute PTS (-copyts, offset by the
+        // server's -ss) don't line up with the live-edge timeline → 0 fragments load → permanent
+        // stall. But the seek-restart model means fragment 0 IS the requested content position
+        // (`?t=` positioned the server ffmpeg there), so we always want to start VOD-style at 0 and
+        // buffer forward up to maxBufferLength. Applies to remux + transcode alike (both use copyts).
+        const hls = new Hls({ maxBufferLength: 30, enableWorker: true, startPosition: 0 });
         hlsRef.current = hls;
         hls.loadSource(`${sess.url}?t=${Math.floor(startAt)}`);
         hls.attachMedia(video);
@@ -1206,6 +1218,7 @@ export default function PlexPlayer({ itemId, onClose, queue }: Props) {
           hlsRef={hlsRef}
           playable={detail?.playable ?? ""}
           hwRef={hwRef}
+          tonemapRef={tonemapRef}
           sessionStartRef={sessionStartRef}
           absRef={absRef}
           durationRef={durationRef}

frontend/src/components/PlexSidebar.tsx

@@ -296,6 +296,28 @@ export default function PlexSidebar({ layout, setLayout, collapsed, onToggleColl
           },
         ]
       : []),
+    // Playback class (Direct Play / Direct Stream / Transcode HW/SW) — movie-only (shows have no
+    // class), and dropped when the facet is empty. Labels are localized (the facet ships class keys).
+    ...(scope === "movie" && facets && facets.playable.length > 0
+      ? [
+          {
+            id: "playable",
+            title: t("plex.filter.playable"),
+            body: (
+              <Combobox
+                label={t("plex.filter.playable")}
+                options={facets.playable.map((p) => ({
+                  value: p.value,
+                  label: t(`plex.filter.playableOpt.${p.value}`),
+                  count: p.count,
+                }))}
+                selected={filters.playable}
+                onChange={(next) => patch({ playable: next })}
+              />
+            ),
+          },
+        ]
+      : []),
   ];
 
   return (

frontend/src/components/PlexStatsOverlay.tsx

@@ -13,6 +13,7 @@ export function PlexStatsOverlay({
   hlsRef,
   playable,
   hwRef,
+  tonemapRef,
   sessionStartRef,
   absRef,
   durationRef,
@@ -22,6 +23,7 @@ export function PlexStatsOverlay({
   hlsRef: RefObject<Hls | null>;
   playable: string;
   hwRef: RefObject<boolean | null>; // active transcode encoder: true=GPU, false=CPU, null=not transcode
+  tonemapRef: RefObject<boolean | null>; // HW HDR→SDR tonemap engaged (adds a "· HDR→SDR" mode tag)
   sessionStartRef: RefObject<number>;
   absRef: RefObject<number>;
   durationRef: RefObject<number>;
@@ -78,6 +80,7 @@ export function PlexStatsOverlay({
         buildStatRows({
           playable,
           hwEncoder: hwRef.current,
+          tonemap: tonemapRef.current,
           transport: hls ? "hls" : "direct",
           videoWidth: v?.videoWidth ?? 0,
           videoHeight: v?.videoHeight ?? 0,
@@ -94,7 +97,7 @@ export function PlexStatsOverlay({
     sample();
     const iv = setInterval(sample, 1000);
     return () => clearInterval(iv);
-  }, [videoRef, hlsRef, playable, hwRef, sessionStartRef, absRef, durationRef]);
+  }, [videoRef, hlsRef, playable, hwRef, tonemapRef, sessionStartRef, absRef, durationRef]);
 
   return (
     <div

frontend/src/components/Welcome.tsx

@@ -1,4 +1,5 @@
 import { useEffect, useRef, useState } from "react";
+import { useHistorySubview, type SubviewUrl } from "../lib/history";
 import { useTranslation } from "react-i18next";
 import {
   ArrowRight,
@@ -27,7 +28,19 @@ import { inputCls } from "./ui/form";
 const EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
 const PASSWORD_MIN = 10;
 
-type Mode = "signin" | "register" | "forgot" | "reset" | "resend";
+export type Mode = "signin" | "register" | "forgot" | "reset" | "resend";
+
+// The card's sub-views are real history entries, so browser/mouse Back leaves one the way it leaves
+// any other page — they used to be plain state, and Back silently changed only the address bar.
+// "signin" is the root (no param) and "reset" is deliberately NOT mirrored: that view is only
+// reachable with the one-time token from the #reset fragment, so a bookmarked ?m=reset would open a
+// form that cannot submit.
+export const MODE_URL: SubviewUrl<Mode> = {
+  key: "m",
+  encode: (m: Mode) => (m === "signin" || m === "reset" ? null : m),
+  decode: (raw: string) =>
+    raw === "register" || raw === "forgot" || raw === "resend" ? (raw as Mode) : null,
+};
 
 // Per-mode i18n keys for the card title and the submit button. A flat map (vs nested ternaries)
 // keeps adding a new mode a one-line change and makes a missing key a compile error.
@@ -296,7 +309,9 @@ function AuthCard() {
   // stay in the query string.
   const [params] = useState(() => new URLSearchParams(window.location.search));
   const [hashParams] = useState(() => new URLSearchParams(window.location.hash.replace(/^#/, "")));
-  const resetToken = hashParams.get("reset");
+  // State, not a const: once the token has been spent the reset view must stop being the card's
+  // root, or a Back from the "password changed" screen lands on a form whose token is already used.
+  const [resetToken, setResetToken] = useState<string | null>(() => hashParams.get("reset"));
   const verifyToken = hashParams.get("verify"); // raw token → POST to confirm (new flow)
   const bounced = params.get("access"); // Google denied → "requested" | "denied"
   const deleted = params.get("deleted"); // self-service account deletion just completed
@@ -324,11 +339,17 @@ function AuthCard() {
     verifyFired.current = true;
     api
       .verifyEmail(verifyToken)
-      .then(() => setVerify("ok"))
+      // "ok_reset": verified, but SEC-10 had dropped the password this account registered with (an
+      // admin approved it before it was verified). Sign-in would answer with the uniform credentials
+      // error, so point the user at the reset flow instead. Same value the legacy ?verify= redirect uses.
+      .then((r) => setVerify(r.password_reset_required ? "ok_reset" : "ok"))
       .catch(() => setVerify("invalid"));
   }, [verifyToken]);
 
-  const [mode, setMode] = useState<Mode>(resetToken ? "reset" : "signin");
+  const { view: mode, open: setMode } = useHistorySubview<Mode>(
+    resetToken ? "reset" : "signin",
+    MODE_URL,
+  );
   const [email, setEmail] = useState("");
   const [password, setPassword] = useState("");
   const [busy, setBusy] = useState(false);
@@ -344,6 +365,13 @@ function AuthCard() {
       .catch(() => {});
   }, []);
   const [done, setDone] = useState<string>(""); // success/info message replacing the form
+  // `done` and `error` belong to the view that produced them, and the render is `done ? msg : form`
+  // — without this, Back out of a submitted form would show the old success message under the
+  // previous view's title. Clearing on view change covers both Back/Forward and the mode links.
+  useEffect(() => {
+    setDone("");
+    setError("");
+  }, [mode]);
 
   // Explicit demo entry (replaces the old hidden probe): a labelled email field, still gated
   // by the demo whitelist server-side.
@@ -367,6 +395,13 @@ function AuthCard() {
     setMode("resend");
   };
 
+  // Used by the "verified, but your password was revoked" banner — the only way back into that
+  // account is a reset link, so put the user one click from it.
+  const goForgot = () => {
+    reset();
+    setMode("forgot");
+  };
+
   async function onSubmit(e: React.FormEvent) {
     e.preventDefault();
     reset();
@@ -400,6 +435,7 @@ function AuthCard() {
         setDone(t("welcome.auth.resendDone"));
       } else if (mode === "reset") {
         await api.confirmPasswordReset(resetToken ?? "", password);
+        setResetToken(null); // single-use: the reset view is no longer a place to come back to
         setDone(t("welcome.auth.resetDone"));
       }
     } catch (err) {
@@ -439,6 +475,14 @@ function AuthCard() {
 
       {/* One-time status banners from a redirect (Google-denied, email verification). */}
       {verify === "ok" && <Banner tone="ok">{t("welcome.auth.verifyOk")}</Banner>}
+      {verify === "ok_reset" && (
+        <Banner tone="warn">
+          {t("welcome.auth.verifyOkReset")}{" "}
+          <button onClick={goForgot} className="font-semibold text-accent hover:underline">
+            {t("welcome.auth.verifyOkResetCta")}
+          </button>
+        </Banner>
+      )}
       {verify === "invalid" && (
         <Banner tone="warn">
           {t("welcome.auth.verifyInvalid")}{" "}

frontend/src/components/adminInvites.dom.test.tsx

@@ -0,0 +1,216 @@
+// @vitest-environment jsdom
+//
+// The Access-requests panel's delete affordance and its three outcomes. The control's whole point is
+// that it explains itself: an entry backed by an account keeps a focusable, labelled control instead
+// of quietly missing one, and an address the server's env still allow-lists gets a warning BEFORE the
+// irreversible click, not a correction after it.
+//
+// i18n is a key-passthrough so assertions read stable keys; the API and the confirm/notify
+// singletons are stubbed so the panel can be driven without a server.
+import { describe, it, expect, afterEach, beforeEach, vi } from "vitest";
+import { render, screen, cleanup, waitFor, fireEvent } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return {
+    ...actual,
+    useTranslation: () => ({
+      // Echo the interpolation too, so a message that forgets its {{email}} is visible in the test.
+      t: (key: string, vars?: Record<string, unknown>) =>
+        vars?.email ? `${key}:${String(vars.email)}` : key,
+      i18n: { language: "en" },
+    }),
+  };
+});
+
+type ConfirmOpts = { title?: string; message?: string; confirmLabel?: string; danger?: boolean };
+const confirmMock = vi.fn(async (_opts: ConfirmOpts) => true);
+vi.mock("./ConfirmProvider", () => ({
+  useConfirm: () => confirmMock,
+  ConfirmProvider: ({ children }: { children: React.ReactNode }) => children,
+}));
+
+const notifyMock = vi.fn();
+vi.mock("../lib/notifications", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../lib/notifications")>();
+  return { ...actual, notify: (...a: unknown[]) => notifyMock(...a) };
+});
+
+const meMock = { pending_invites: 0, email_configured: true, id: 1, role: "admin" };
+vi.mock("../lib/useMe", () => ({ useMe: () => meMock }));
+
+// The tab strip is rendered into an app-level toolbar slot that does not exist here, so pin the
+// active tab directly — this file is about the Access-requests panel, not the tab chrome.
+vi.mock("./Tabs", () => ({
+  default: () => null,
+  usePersistedTab: () => ["access", () => {}],
+}));
+
+const listMock = vi.fn();
+const deleteMock = vi.fn();
+vi.mock("../lib/api", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../lib/api")>();
+  return {
+    ...actual,
+    api: {
+      ...actual.api,
+      adminInvites: () => listMock(),
+      deleteInvite: (id: number) => deleteMock(id),
+    },
+  };
+});
+
+import { HttpError } from "../lib/api";
+import AdminUsers from "./AdminUsers";
+
+const invite = (over: Partial<Record<string, unknown>> = {}) => ({
+  id: 1,
+  email: "asker@example.com",
+  status: "pending",
+  note: null,
+  requested_at: null,
+  decided_at: null,
+  decided_by: null,
+  has_account: false,
+  still_allowed_by_env: false,
+  ...over,
+});
+
+const renderPanel = () => {
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  return render(
+    <QueryClientProvider client={qc}>
+      <AdminUsers />
+    </QueryClientProvider>,
+  );
+};
+
+beforeEach(() => {
+  confirmMock.mockClear().mockResolvedValue(true);
+  notifyMock.mockClear();
+  deleteMock.mockReset().mockResolvedValue({ deleted: 1, still_allowed_by_env: false });
+  listMock.mockReset().mockResolvedValue([invite()]);
+  meMock.email_configured = true;
+});
+afterEach(cleanup);
+
+const openAccessTab = async () => {
+  await screen.findByText("settings.invites.title");
+};
+
+describe("Access requests — the delete affordance", () => {
+  it("offers a labelled delete on an entry with no account behind it", async () => {
+    renderPanel();
+    await openAccessTab();
+
+    const btn = await screen.findByLabelText("settings.invites.deleteLabel:asker@example.com");
+    expect(btn.getAttribute("aria-disabled")).toBeNull();
+  });
+
+  it("keeps the control present and focusable — not missing — when the address has an account", async () => {
+    listMock.mockResolvedValue([invite({ has_account: true })]);
+    renderPanel();
+    await openAccessTab();
+
+    const btn = await screen.findByLabelText("settings.invites.deleteHasAccount");
+    // aria-disabled, not `disabled`: a disabled button leaves the tab order and takes its
+    // explanation with it, which is the whole reason the control is shown at all.
+    expect(btn.getAttribute("aria-disabled")).toBe("true");
+    expect((btn as HTMLButtonElement).disabled).toBe(false);
+    expect(btn.getAttribute("title")).toBe("settings.invites.deleteHasAccount");
+    expect(screen.queryByLabelText(/deleteLabel/)).toBeNull();
+  });
+
+  it("keeps the same control on the previously-decided list, where the case is commonest", async () => {
+    // The affordance exists twice — the pending rows and the collapsed "decided" list — and an
+    // approved address that has since registered lands in the second one. Both must behave alike.
+    listMock.mockResolvedValue([invite({ status: "approved", has_account: true })]);
+    renderPanel();
+    await openAccessTab();
+
+    fireEvent.click(await screen.findByText(/settings\.invites\.decided/));
+    const btn = await screen.findByLabelText("settings.invites.deleteHasAccount");
+    expect(btn.getAttribute("aria-disabled")).toBe("true");
+    expect((btn as HTMLButtonElement).disabled).toBe(false);
+  });
+
+  it("offers a working delete on a decided entry with no account", async () => {
+    listMock.mockResolvedValue([invite({ status: "denied" })]);
+    renderPanel();
+    await openAccessTab();
+
+    fireEvent.click(await screen.findByText(/settings\.invites\.decided/));
+    fireEvent.click(await screen.findByLabelText("settings.invites.deleteLabel:asker@example.com"));
+
+    await waitFor(() => expect(deleteMock).toHaveBeenCalledWith(1));
+  });
+
+  it("warns in the confirmation — before the click is irreversible — when the env still allows it", async () => {
+    listMock.mockResolvedValue([invite({ still_allowed_by_env: true })]);
+    renderPanel();
+    await openAccessTab();
+
+    fireEvent.click(await screen.findByLabelText("settings.invites.deleteLabel:asker@example.com"));
+
+    expect(confirmMock).toHaveBeenCalledTimes(1);
+    expect(confirmMock.mock.calls[0]![0]).toMatchObject({
+      message: "settings.invites.deleteConfirmStillAllowed:asker@example.com",
+      danger: true,
+    });
+  });
+
+  it("uses the plain confirmation otherwise", async () => {
+    renderPanel();
+    await openAccessTab();
+
+    fireEvent.click(await screen.findByLabelText("settings.invites.deleteLabel:asker@example.com"));
+
+    expect(confirmMock.mock.calls[0]![0]).toMatchObject({
+      message: "settings.invites.deleteConfirm:asker@example.com",
+    });
+  });
+
+  it("says the entry kept its access when the server reports the env allow-list", async () => {
+    deleteMock.mockResolvedValue({ deleted: 1, still_allowed_by_env: true });
+    renderPanel();
+    await openAccessTab();
+
+    fireEvent.click(await screen.findByLabelText("settings.invites.deleteLabel:asker@example.com"));
+
+    await waitFor(() =>
+      expect(notifyMock).toHaveBeenCalledWith({
+        level: "warning",
+        message: "settings.invites.deletedStillAllowed",
+      }),
+    );
+  });
+
+  it("turns a 409 into the actionable reason rather than a generic failure", async () => {
+    // The stale-list case: someone registered on the address after the page loaded.
+    deleteMock.mockRejectedValue(new HttpError(409, "That address already has an account"));
+    renderPanel();
+    await openAccessTab();
+
+    fireEvent.click(await screen.findByLabelText("settings.invites.deleteLabel:asker@example.com"));
+
+    await waitFor(() =>
+      expect(notifyMock).toHaveBeenCalledWith({
+        level: "error",
+        message: "settings.invites.deleteHasAccount",
+      }),
+    );
+  });
+
+  it("shows the mail-is-off warning only while email is unconfigured", async () => {
+    renderPanel();
+    await openAccessTab();
+    expect(screen.queryByText("settings.invites.emailOff")).toBeNull();
+    cleanup();
+
+    meMock.email_configured = false;
+    renderPanel();
+    await openAccessTab();
+    expect(await screen.findByText("settings.invites.emailOff")).toBeTruthy();
+  });
+});

frontend/src/components/plexCards.tsx

@@ -8,14 +8,23 @@ import type { PlexCard, PlexCastMember, PlexFilters, PlexSeasonDetail } from "..
 // Presentational Plex cards + strips, split out of PlexBrowse (all purely prop-driven, no shared
 // state). Rendered by the browse grid, the person page, and the series show/season views.
 
-// Playback cost, escalating good→heavy: direct (green) → remux, a light repackage
-// (amber) → transcode, a full re-encode (red). Reuses the status trio as a gradient;
-// all three stay visually distinct.
-const PLAYABLE_TINT: Record<string, string> = {
+// Playback cost, escalating good→heavy: Direct Play (green) → Direct Stream / remux, a light
+// repackage (blue) → Transcode · HW, a hardware re-encode (amber) → Transcode · SW, a software
+// re-encode (red). transcode splits HW vs SW by card.transcode_hw. Reuses the semantic tokens as a
+// gradient; all four stay visually distinct in light + dark.
+export const PLAYABLE_TINT: Record<string, string> = {
   direct: "bg-success",
-  remux: "bg-warn",
-  transcode: "bg-danger",
+  remux: "bg-info",
+  transcode_hw: "bg-warn",
+  transcode_sw: "bg-danger",
 };
+// Collapse the wire `playable` (direct|remux|transcode) + transcode_hw flag into one of the 4 display
+// classes, so the corner dot's colour + tooltip can't drift from the sidebar filter's option keys.
+// Shared with the info-page playback chip (PlexInfo) so both surfaces derive the class identically.
+export function playableClass(playable: string, transcodeHw?: boolean | null): string {
+  if (playable === "transcode") return transcodeHw ? "transcode_hw" : "transcode_sw";
+  return playable; // direct | remux
+}
 
 // The reveal class for a status pill (watched / in-progress) that shares a corner with a hover-reveal
 // control (the watched-toggle). When that control is present it takes over on touch, so the pill yields
@@ -82,13 +91,22 @@ export function PlexPosterCard({
           decoding="async"
           className="w-full h-full object-cover group-hover:scale-105 transition-transform duration-200"
         />
-        {/* Playable-cost tint (always shown — a quick "will it direct-play" cue). */}
-        {card.playable && (
-          <span
-            className={`absolute top-1.5 left-1.5 w-2 h-2 rounded-full ring-2 ring-black/40 ${PLAYABLE_TINT[card.playable] ?? "bg-gray-400"}`}
-            title={t(`plex.playable.${card.playable}`)}
-          />
-        )}
+        {/* Playable-cost tint (always shown — a quick "will it direct-play" cue). z-20 keeps the dot
+            ABOVE the full-card hover-reveal overlay below (absolute inset-0, no pointer-events-none):
+            without it the overlay sits on top and swallows the cursor, so the dot's native `title`
+            tooltip never fired on hover (a regression once the reveal overlay was added). */}
+        {card.playable &&
+          (() => {
+            const cls = playableClass(card.playable, card.transcode_hw);
+            return (
+              <span
+                role="img"
+                aria-label={t(`plex.playable.${cls}`)}
+                className={`absolute top-1.5 left-1.5 z-20 w-2 h-2 rounded-full ring-2 ring-black/40 ${PLAYABLE_TINT[cls] ?? "bg-gray-400"}`}
+                title={t(`plex.playable.${cls}`)}
+              />
+            );
+          })()}
         {/* Rest-state watched badge (top-right). Yields to the hover quick-actions on a playable card
             (reveal-idle: gone on touch where the toggle is always shown); a watched show keeps it. */}
         {card.status === "watched" && (

frontend/src/components/usePlexActiveFilters.ts

@@ -110,6 +110,13 @@ export function buildPlexActiveFilters(
       remove: () => patch({ studios: filters.studios.filter((x) => x !== s) }),
     });
   }
+  for (const p of filters.playable) {
+    out.push({
+      key: `playable:${p}`,
+      label: t(`plex.filter.playableOpt.${p}`),
+      remove: () => patch({ playable: filters.playable.filter((x) => x !== p) }),
+    });
+  }
   for (const k of filters.keywords) {
     out.push({
       key: `keyword:${k}`,

frontend/src/components/welcomeMode.dom.test.ts

@@ -0,0 +1,93 @@
+// @vitest-environment jsdom
+//
+// The login card's sub-views (Create an account / Forgot password / Didn't get the email) used to be
+// plain React state: clicking one changed nothing in history, so Back popped to whatever entry came
+// before the card and the address bar moved while the form on screen did not. They now ride
+// useHistorySubview, and this pins the wiring decisions that are specific to THIS card — which modes
+// are mirrored, and that Back walks the views. The hook's own mechanics live in
+// history.subview.dom.test.ts.
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { renderHook, act } from "@testing-library/react";
+
+import { useHistorySubview } from "../lib/history";
+import { MODE_URL, type Mode } from "./Welcome";
+
+const render = (root: Mode = "signin") => renderHook(() => useHistorySubview<Mode>(root, MODE_URL));
+
+// jsdom's history.back() is asynchronous and does not rewind location, so — as in
+// history.subview.dom.test.ts — a Back is simulated by landing on the target entry and firing
+// popstate. `open()` pushing a REAL entry is asserted separately via history.length.
+const popTo = (search: string, state: unknown = null) =>
+  act(() => {
+    window.history.replaceState(state, "", search || "/");
+    window.dispatchEvent(new PopStateEvent("popstate", { state }));
+  });
+
+// jsdom keeps one history across a file; land on a clean root entry before each test.
+beforeEach(() => window.history.replaceState(null, "", "/"));
+afterEach(() => window.history.replaceState(null, "", "/"));
+
+describe("login card mode ↔ URL", () => {
+  it("mirrors the three link-reachable views and leaves sign-in as the bare root", () => {
+    expect(MODE_URL.encode("signin")).toBeNull();
+    expect(MODE_URL.encode("register")).toBe("register");
+    expect(MODE_URL.encode("forgot")).toBe("forgot");
+    expect(MODE_URL.encode("resend")).toBe("resend");
+  });
+
+  it("never mirrors the reset view", () => {
+    // Reset is only reachable with the one-time token from the #reset fragment. Mirroring it would
+    // hand out a bookmark that opens a password form with no token behind it.
+    expect(MODE_URL.encode("reset")).toBeNull();
+    expect(MODE_URL.decode("reset")).toBeNull();
+  });
+
+  it("decodes only real views, so a hand-typed ?m= falls back to sign-in", () => {
+    expect(MODE_URL.decode("register")).toBe("register");
+    expect(MODE_URL.decode("")).toBeNull();
+    expect(MODE_URL.decode("nonsense")).toBeNull();
+  });
+
+  it("opening a view pushes a real history entry, and landing back on the root restores sign-in", () => {
+    const { result } = render();
+    const entries = window.history.length;
+    expect(result.current.view).toBe("signin");
+
+    act(() => result.current.open("forgot"));
+
+    // The whole point: a Back has somewhere to go. Before this the click changed state only.
+    expect(window.history.length).toBe(entries + 1);
+    expect(result.current.view).toBe("forgot");
+    expect(new URLSearchParams(window.location.search).get("m")).toBe("forgot");
+
+    popTo("/");
+
+    expect(result.current.view).toBe("signin");
+  });
+
+  it("walks back one view at a time when the user hops between them", () => {
+    const { result } = render();
+    const entries = window.history.length;
+    act(() => result.current.open("register"));
+    act(() => result.current.open("forgot"));
+    expect(window.history.length).toBe(entries + 2); // one entry per view, not one for the lot
+
+    popTo("/?m=register", { _sub: "register" });
+    expect(result.current.view).toBe("register");
+
+    popTo("/");
+    expect(result.current.view).toBe("signin");
+  });
+
+  it("opens on the reset view when a reset token seeded it, without putting it in the URL", () => {
+    const { result } = render("reset");
+    expect(result.current.view).toBe("reset");
+    expect(window.location.search).toBe("");
+  });
+
+  it("restores a bookmarked view from the URL alone", () => {
+    window.history.replaceState(null, "", "/?m=resend");
+    const { result } = render();
+    expect(result.current.view).toBe("resend");
+  });
+});

frontend/src/components/welcomeMode.render.dom.test.tsx

@@ -0,0 +1,78 @@
+// @vitest-environment jsdom
+//
+// The sign-in card's sub-views as the user meets them: clicking a link must leave a history entry,
+// so Back — including the mouse's back button — returns to the previous view. They used to be plain
+// React state, and Back moved only the address bar while the form on screen stayed put. The
+// encode/decode table lives in welcomeMode.dom.test.ts; this file renders the real card, so a revert
+// to useState fails here.
+//
+// i18n is mocked to a key-passthrough so queries read stable keys, and the API module is stubbed —
+// the card probes /auth/config on mount and must not reach the network.
+import { describe, it, expect, afterEach, beforeEach, vi } from "vitest";
+import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return {
+    ...actual,
+    useTranslation: () => ({ t: (key: string) => key, i18n: { language: "en" } }),
+  };
+});
+
+vi.mock("../lib/api", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../lib/api")>();
+  return {
+    ...actual,
+    api: { ...actual.api, authConfig: () => Promise.resolve({ google_enabled: false }) },
+  };
+});
+
+import Welcome from "./Welcome";
+
+const back = () =>
+  act(() => {
+    // jsdom's history.back() is async and does not rewind location, so land on the previous entry
+    // the way the browser would and fire popstate. The push itself is asserted via history.length.
+    window.history.replaceState(null, "", "/");
+    window.dispatchEvent(new PopStateEvent("popstate", { state: null }));
+  });
+
+beforeEach(() => window.history.replaceState(null, "", "/"));
+afterEach(() => {
+  cleanup();
+  window.history.replaceState(null, "", "/");
+});
+
+describe("sign-in card sub-views and the Back button", () => {
+  it("opens Forgot password as a history entry and comes back to sign in", async () => {
+    render(<Welcome />);
+    expect(await screen.findByText("welcome.auth.signinTitle")).toBeTruthy();
+    const entries = window.history.length;
+
+    fireEvent.click(screen.getByText("welcome.auth.forgotLink"));
+
+    expect(screen.getByText("welcome.auth.forgotTitle")).toBeTruthy();
+    expect(window.history.length).toBe(entries + 1); // a Back now has somewhere to go
+    expect(new URLSearchParams(window.location.search).get("m")).toBe("forgot");
+
+    back();
+
+    expect(screen.getByText("welcome.auth.signinTitle")).toBeTruthy();
+    expect(screen.queryByText("welcome.auth.forgotTitle")).toBeNull();
+  });
+
+  it("does the same for Create an account and the verification-email link", async () => {
+    render(<Welcome />);
+    await screen.findByText("welcome.auth.signinTitle");
+
+    fireEvent.click(screen.getByText("welcome.auth.createLink"));
+    expect(screen.getByText("welcome.auth.createTitle")).toBeTruthy();
+    back();
+    expect(screen.getByText("welcome.auth.signinTitle")).toBeTruthy();
+
+    fireEvent.click(screen.getByText("welcome.auth.resendLink"));
+    expect(screen.getByText("welcome.auth.resendTitle")).toBeTruthy();
+    back();
+    expect(screen.getByText("welcome.auth.signinTitle")).toBeTruthy();
+  });
+});

frontend/src/i18n/locales/en/auditActions.json

@@ -19,5 +19,6 @@
   "job_run": "Scheduler job run",
   "audit_clear": "Audit log cleared",
   "download_credential_set": "Download cookies set",
-  "download_credential_delete": "Download cookies removed"
+  "download_credential_delete": "Download cookies removed",
+  "invite_delete": "Whitelist entry deleted"
 }

frontend/src/i18n/locales/en/config.json

@@ -216,5 +216,6 @@
   "plexPickLibraries": "Libraries to expose:",
   "plexPickHint": "Unchecking all is the same as exposing every library. Remember to Save.",
   "plexMovies": "Movies",
-  "plexShows": "TV Shows"
+  "plexShows": "TV Shows",
+  "emailOff": "Email sending is not configured — Siftlode silently skips every message: verification links, password resets and access-request notices. Fill in the fields above, then send a test."
 }

frontend/src/i18n/locales/en/inbox.json

@@ -28,5 +28,10 @@
   "jobDone": {
     "titleOk": "{{job}} finished",
     "titleError": "{{job}} failed"
+  },
+  "emailUndelivered": {
+    "title": "Email is not going out",
+    "notConfigured": "SMTP is not configured, so nothing this instance sends is being delivered — verification links, password resets and access requests alike. One of them was “{{subject}}”. Set it up under Configuration → Email / SMTP.",
+    "sendFailed": "Sending failed, so messages are not being delivered. One of them was “{{subject}}”. Check Configuration → Email / SMTP and send a test; the server log has the reason."
   }
 }

frontend/src/i18n/locales/en/plex.json

@@ -104,6 +104,13 @@
     "collectionEmpty": "No collections",
     "matchLabel": "Match",
     "studio": "Studio",
+    "playable": "Playback",
+    "playableOpt": {
+      "direct": "Direct Play",
+      "remux": "Direct Stream",
+      "transcode_hw": "Transcode · HW",
+      "transcode_sw": "Transcode · SW"
+    },
     "moreRefine": "{{count}} more — refine with search"
   },
   "count": "{{count}} titles",
@@ -285,8 +292,9 @@
   },
   "playable": {
     "direct": "Plays directly in the browser",
-    "remux": "Needs a light remux (no video re-encode)",
-    "transcode": "Needs transcoding (heavier)"
+    "remux": "Direct Stream — a light remux (no video re-encode)",
+    "transcode_hw": "Transcoded on the hardware encoder",
+    "transcode_sw": "Transcoded in software (heaviest)"
   },
   "playlistAdd": {
     "manage": "Add to playlist",

frontend/src/i18n/locales/en/settings.json

@@ -164,6 +164,17 @@
     "deny": "Deny",
     "denied": "Request denied",
     "denyTitle": "Deny access request?",
-    "denyConfirm": "Deny the access request from {{email}}?"
+    "denyConfirm": "Deny the access request from {{email}}?",
+    "delete": "Delete",
+    "deleteLabel": "Delete {{email}} from the whitelist",
+    "deleteHint": "Forget this address. A later request from it comes back as a new one.",
+    "deleteTitle": "Delete whitelist entry?",
+    "deleteConfirm": "Forget {{email}}? Siftlode drops the record, so anyone at that address would have to ask again.",
+    "deleteHasAccount": "Someone has registered on this address — manage it under Users & roles, where deleting the account removes this entry too.",
+    "deleted": "Whitelist entry removed.",
+    "deleteFailed": "Could not remove the entry.",
+    "emailOff": "Email sending is not configured, so nobody gets a verification link and no request reaches you by email. Watch this list and your inbox instead, and fix it under Configuration → Email / SMTP.",
+    "deletedStillAllowed": "Entry removed, but this address is still allow-listed by the server's configuration, so it keeps access. Remove it from ALLOWED_EMAILS / ADMIN_EMAILS to change that.",
+    "deleteConfirmStillAllowed": "Forget {{email}}? Careful: this address is also allow-listed in the server's configuration (ALLOWED_EMAILS / ADMIN_EMAILS), so removing this row will NOT take its access away — and an ADMIN_EMAILS address is made an admin again on its next Google sign-in."
   }
 }

frontend/src/i18n/locales/en/welcome.json

@@ -86,6 +86,8 @@
     "forgotDone": "If that email has an account, we've sent a reset link. Check your inbox.",
     "resetDone": "Your password has been set — you can sign in now.",
     "verifyOk": "Email confirmed. Once an admin approves your account, you can sign in.",
+    "verifyOkReset": "Email confirmed. Your account was approved before you confirmed it, so the password you registered with was cleared for security — choose a new one to sign in.",
+    "verifyOkResetCta": "Set a new password",
     "verifyInvalid": "That verification link is invalid or has expired.",
     "resendCta": "Send a new link",
     "resendDone": "If that email has an unverified account, we've sent a new verification link. Check your inbox.",

frontend/src/i18n/locales/hu/auditActions.json

@@ -19,5 +19,6 @@
   "job_run": "Ütemező job lefutott",
   "audit_clear": "Napló ürítve",
   "download_credential_set": "Letöltési cookie-k beállítva",
-  "download_credential_delete": "Letöltési cookie-k eltávolítva"
+  "download_credential_delete": "Letöltési cookie-k eltávolítva",
+  "invite_delete": "Whitelista-bejegyzés törölve"
 }

frontend/src/i18n/locales/hu/config.json

@@ -216,5 +216,6 @@
   "plexPickLibraries": "Megjelenítendő könyvtárak:",
   "plexPickHint": "Ha egyiket sem jelölöd be, az az összes könyvtár megjelenítésével egyenértékű. Ne feledj menteni.",
   "plexMovies": "Filmek",
-  "plexShows": "Sorozatok"
+  "plexShows": "Sorozatok",
+  "emailOff": "Az e-mail-küldés nincs beállítva — a Siftlode némán kihagy minden üzenetet: megerősítő linkeket, jelszó-visszaállításokat és hozzáférés-kérés értesítőket. Töltsd ki a fenti mezőket, majd küldj tesztet."
 }

frontend/src/i18n/locales/hu/inbox.json

@@ -28,5 +28,10 @@
   "jobDone": {
     "titleOk": "{{job}} kész",
     "titleError": "{{job}} hibázott"
+  },
+  "emailUndelivered": {
+    "title": "Nem megy ki e-mail",
+    "notConfigured": "Az SMTP nincs beállítva, így semmi nem kézbesíthető, amit ez a példány küldene — megerősítő linkek, jelszó-visszaállítások és hozzáférés-kérelmek egyaránt. Az egyik ilyen: „{{subject}}”. Állítsd be a Konfiguráció → E-mail / SMTP fülön.",
+    "sendFailed": "A küldés nem sikerült, így az üzenetek nem kézbesíthetők. Az egyik ilyen: „{{subject}}”. Nézd meg a Konfiguráció → E-mail / SMTP fület, és küldj tesztet; az okot a szerver naplója tartalmazza."
   }
 }

frontend/src/i18n/locales/hu/plex.json

@@ -104,6 +104,13 @@
     "collectionEmpty": "Nincs kollekció",
     "matchLabel": "Egyezés",
     "studio": "Stúdió",
+    "playable": "Lejátszás",
+    "playableOpt": {
+      "direct": "Közvetlen lejátszás",
+      "remux": "Közvetlen streamelés",
+      "transcode_hw": "Átkódolás · HW",
+      "transcode_sw": "Átkódolás · SW"
+    },
     "moreRefine": "még {{count}} — finomíts kereséssel"
   },
   "count": "{{count}} cím",
@@ -285,8 +292,9 @@
   },
   "playable": {
     "direct": "Közvetlenül játszható a böngészőben",
-    "remux": "Könnyű remux kell (nincs videó-újrakódolás)",
-    "transcode": "Transcode kell (nehezebb)"
+    "remux": "Közvetlen streamelés — könnyű remux (nincs videó-újrakódolás)",
+    "transcode_hw": "Hardveres kódolóval átkódolva",
+    "transcode_sw": "Szoftveresen átkódolva (legnehezebb)"
   },
   "playlistAdd": {
     "manage": "Listához adás",

frontend/src/i18n/locales/hu/settings.json

@@ -164,6 +164,17 @@
     "deny": "Elutasítás",
     "denied": "Kérelem elutasítva",
     "denyTitle": "Elutasítod a hozzáférési kérelmet?",
-    "denyConfirm": "Elutasítod {{email}} hozzáférési kérelmét?"
+    "denyConfirm": "Elutasítod {{email}} hozzáférési kérelmét?",
+    "delete": "Törlés",
+    "deleteLabel": "{{email}} törlése a whitelistáról",
+    "deleteHint": "A cím elfelejtése. Egy későbbi kérelme új kérelemként jelenik meg.",
+    "deleteTitle": "Törlöd a whitelista-bejegyzést?",
+    "deleteConfirm": "Elfelejted {{email}} címet? A Siftlode eldobja a bejegyzést, így az adott címről újra kérelmezni kell.",
+    "deleteHasAccount": "Erre a címre már regisztrált valaki — a Felhasználók és szerepek fülön kezelhető, ahol a fiók törlése ezt a bejegyzést is eltávolítja.",
+    "deleted": "Whitelista-bejegyzés eltávolítva.",
+    "deleteFailed": "A bejegyzést nem sikerült eltávolítani.",
+    "emailOff": "Az e-mail-küldés nincs beállítva, így senki nem kap megerősítő linket, és e-mailben egy kérelem sem jut el hozzád. Ezt a listát és az értesítéseidet figyeld helyette, a javítás pedig a Konfiguráció → E-mail / SMTP fülön van.",
+    "deletedStillAllowed": "A bejegyzés törölve, de ezt a címet a szerver konfigurációja továbbra is engedélyezi, tehát megmarad a hozzáférése. Vedd ki az ALLOWED_EMAILS / ADMIN_EMAILS listából, ha ezen változtatnál.",
+    "deleteConfirmStillAllowed": "Elfelejted {{email}} címet? Figyelem: ezt a címet a szerver konfigurációja is engedélyezi (ALLOWED_EMAILS / ADMIN_EMAILS), így a bejegyzés törlése NEM veszi el a hozzáférését — sőt egy ADMIN_EMAILS cím a következő Google-belépéskor újra adminná válik."
   }
 }

frontend/src/i18n/locales/hu/welcome.json

@@ -86,6 +86,8 @@
     "forgotDone": "Ha ehhez az e-mailhez tartozik fiók, elküldtük a visszaállító linket. Nézd meg a postafiókod.",
     "resetDone": "A jelszavad be van állítva — most már beléphetsz.",
     "verifyOk": "E-mail megerősítve. Amint egy admin jóváhagyja a fiókodat, beléphetsz.",
+    "verifyOkReset": "E-mail megerősítve. A fiókodat még a megerősítés előtt jóváhagyták, ezért biztonsági okból töröltük a regisztrációkor megadott jelszavadat — válassz újat a belépéshez.",
+    "verifyOkResetCta": "Új jelszó beállítása",
     "verifyInvalid": "Ez a megerősítő link érvénytelen vagy lejárt.",
     "resendCta": "Új link küldése",
     "resendDone": "Ha ehhez az e-mailhez tartozik megerősítetlen fiók, elküldtünk egy új megerősítő linket. Nézd meg a postafiókod.",

frontend/src/lib/api/account.ts

@@ -16,6 +16,8 @@ export interface Me {
   can_read: boolean;
   can_write: boolean;
   pending_invites: number;
+  /** Admin-only: false when SMTP is incomplete, so every outbound message is silently skipped. */
+  email_configured: boolean;
   preferences: Record<string, unknown>;
 }
 

frontend/src/lib/api/admin.ts

@@ -19,6 +19,12 @@ export interface Invite {
   requested_at: string | null;
   decided_at: string | null;
   decided_by: string | null;
+  /** An account already exists for this address, so the entry can't be deleted from here — deleting
+   *  it would revoke that user's access (is_allowed reads this row). Delete the user instead. */
+  has_account: boolean;
+  /** The address stays allow-listed by the server's env ALLOWED_EMAILS / ADMIN_EMAILS, so removing
+   *  this row would NOT take access away. The delete confirmation says so. */
+  still_allowed_by_env: boolean;
 }
 
 // Admin Configuration page: one DB-overridable setting (registry entry on the backend).
@@ -169,4 +175,10 @@ export const adminApi = {
   denyInvite: (id: number) => req(`/api/admin/invites/${id}/deny`, { method: "POST" }),
   addInvite: (email: string) =>
     req("/api/admin/invites", { method: "POST", body: JSON.stringify({ email }) }),
+  /** `still_allowed_by_env` is true when the address stays allow-listed by the server's env
+   *  ALLOWED_EMAILS / ADMIN_EMAILS, i.e. removing the row did not actually revoke access. */
+  // quiet: a 409 here ("that address has an account") is a case the UI handles with a translated
+  // toast; without this the shared handler ALSO raises the server's English detail as a modal.
+  deleteInvite: (id: number): Promise<{ deleted: number; still_allowed_by_env: boolean }> =>
+    req(`/api/admin/invites/${id}`, { method: "DELETE" }, { quiet: true }),
 };

frontend/src/lib/api/auth.ts

@@ -37,7 +37,10 @@ export const authApi = {
       { quiet: true },
     ),
   // Confirm an email-verification token the SPA read from the URL fragment (SB3).
-  verifyEmail: (token: string): Promise<{ ok: boolean }> =>
+  // `password_reset_required` = SEC-10 dropped the password this account registered with (an admin
+  // approved it before it was verified), so signing in would fail with the uniform credentials error.
+  // The card sends the user to the reset flow instead of leaving them to guess.
+  verifyEmail: (token: string): Promise<{ ok: boolean; password_reset_required?: boolean }> =>
     req("/auth/verify", { method: "POST", body: JSON.stringify({ token }) }, { quiet: true }),
   // Re-issue a verification link (the first one expired, or was lost). Uniform response — never
   // reveals whether the email has a pending account.

frontend/src/lib/api/plex.dom.test.ts

@@ -3,6 +3,9 @@ import { describe, it, expect } from "vitest";
 import {
   coercePlexFilters,
   plexFiltersSignature,
+  plexFiltersToParams,
+  parsePlexFilters,
+  plexFilterCount,
   EMPTY_PLEX_FILTERS,
   type PlexFilters,
 } from "./plex";
@@ -54,12 +57,14 @@ describe("plexFiltersSignature", () => {
       directors: [],
       actors: [],
       studios: [],
+      playable: [],
       keywords: [],
       collections: ["A"],
     };
     const b: PlexFilters = {
       collections: ["A"],
       keywords: [],
+      playable: [],
       studios: [],
       actors: [],
       directors: [],
@@ -81,4 +86,28 @@ describe("plexFiltersSignature", () => {
     const b: PlexFilters = { ...base(), genres: ["Comedy"] };
     expect(plexFiltersSignature(a)).not.toBe(plexFiltersSignature(b));
   });
+
+  it("differs when the playback-class filter differs", () => {
+    const a = base();
+    const b: PlexFilters = { ...base(), playable: ["direct", "transcode_hw"] };
+    expect(plexFiltersSignature(a)).not.toBe(plexFiltersSignature(b));
+  });
+});
+
+describe("playable filter round-trip + count", () => {
+  it("serializes playable as a CSV param and parses it back", () => {
+    const f: PlexFilters = { ...EMPTY_PLEX_FILTERS, playable: ["direct", "transcode_sw"] };
+    const params = plexFiltersToParams(f);
+    expect(params.get("playable")).toBe("direct,transcode_sw");
+    expect(parsePlexFilters(params).playable).toEqual(["direct", "transcode_sw"]);
+  });
+
+  it("omits the playable param when empty", () => {
+    expect(plexFiltersToParams(EMPTY_PLEX_FILTERS).has("playable")).toBe(false);
+  });
+
+  it("counts each selected playback class like studios", () => {
+    const f: PlexFilters = { ...EMPTY_PLEX_FILTERS, playable: ["remux", "transcode_hw"] };
+    expect(plexFilterCount(f)).toBe(2);
+  });
 });

frontend/src/lib/api/plex.ts

@@ -45,6 +45,7 @@ export interface PlexCard {
   art?: string | null; // wide backdrop (movies/shows) for rails + crossfading hero; null when no art_key
   rating?: number | null; // Plex audience score (~IMDb), shown on the card hover-overview
   playable?: string; // direct | remux | transcode
+  transcode_hw?: boolean | null; // transcode items only: true = HW-capable, false = SW-only, null = n/a
   status?: string; // new | watched | hidden
   position_seconds?: number;
   season_count?: number | null; // show
@@ -139,6 +140,9 @@ export interface PlexItemDetail {
   year?: number | null;
   duration_seconds: number | null;
   playable: string; // direct | remux | transcode
+  transcode_hw?: boolean | null; // transcode items only: true = HW-capable, false = SW-only, null = n/a
+  codec_video?: string | null; // e.g. "hevc" / "h264" (info-chip subtitle)
+  video_bit_depth?: number | null; // e.g. 8 / 10 (info-chip subtitle)
   thumb: string;
   art: string;
   library?: string | null; // Plex section key (for the admin collection editor)
@@ -253,6 +257,7 @@ export interface PlexFilters {
   actors: string[]; // OR (any) by default, or AND (all) via actorMode
   actorMode?: "any" | "all"; // how multiple actors combine (default any = OR)
   studios: string[]; // OR — from any selected studio
+  playable: string[]; // OR — playback class (direct | remux | transcode_hw | transcode_sw); movie-only
   keywords: string[]; // AND — TMDB keyword chips from the detail page (E5 S5)
   collections: string[]; // Plex collection rating_keys; a title can be in several
   collectionMode?: "any" | "all"; // how multiple collections combine (default any = OR)
@@ -264,6 +269,7 @@ export const EMPTY_PLEX_FILTERS: PlexFilters = {
   directors: [],
   actors: [],
   studios: [],
+  playable: [],
   keywords: [],
   collections: [],
 };
@@ -309,6 +315,7 @@ export function plexFilterCount(f: PlexFilters): number {
     f.directors.length +
     f.actors.length +
     f.studios.length +
+    f.playable.length +
     f.keywords.length +
     f.collections.length
   );
@@ -330,6 +337,7 @@ function appendPlexFilters(u: URLSearchParams, f: PlexFilters): void {
   if (f.actors?.length) u.set("actors", f.actors.join(","));
   if (f.actorMode === "all") u.set("actor_mode", "all");
   if (f.studios?.length) u.set("studios", f.studios.join(","));
+  if (f.playable?.length) u.set("playable", f.playable.join(","));
   if (f.keywords?.length) u.set("keywords", f.keywords.join(","));
   if (f.collections?.length) u.set("collections", f.collections.join(","));
   if (f.collectionMode === "all") u.set("collection_mode", "all");
@@ -371,6 +379,7 @@ export function parsePlexFilters(p: URLSearchParams): PlexFilters {
   f.actors = csv("actors");
   if (p.get("actor_mode") === "all") f.actorMode = "all";
   f.studios = csv("studios");
+  f.playable = csv("playable");
   f.keywords = csv("keywords");
   f.collections = csv("collections");
   if (p.get("collection_mode") === "all") f.collectionMode = "all";
@@ -380,6 +389,8 @@ export interface PlexFacets {
   genres: { value: string; count: number }[];
   content_ratings: { value: string; count: number }[];
   studios: { value: string; count: number }[]; // studio vocabulary for the sidebar picker (E5 S7)
+  // Playback-class facet (movie-only): value ∈ direct|remux|transcode_hw|transcode_sw. Empty on shows.
+  playable: { value: string; count: number }[];
   year_min: number | null;
   year_max: number | null;
   rating_max: number | null;
@@ -392,6 +403,7 @@ export interface PlexPlaySession {
   start_s: number;
   transcode?: boolean; // hls only: video re-encoded (non-h264 source) vs stream-copied (remux)
   hw?: boolean; // hls transcode only: ran on the VAAPI hardware encoder (else libx264 software)
+  tonemap?: boolean; // hls HW transcode only: 10-bit/HDR source tone-mapped HDR→SDR on the GPU (OpenCL)
 }
 
 // Discover surface (E5 S4): the consolidated rail payload. Every rail is a plain PlexCard list the

frontend/src/lib/plexStats.test.ts

@@ -118,6 +118,11 @@ describe("buildStatRows", () => {
     expect(cpu.find((r) => r.key === "mode")?.value).toBe("transcode · CPU");
   });
 
+  it("tags the mode row with HDR→SDR for a HW tonemap session", () => {
+    const rows = buildStatRows({ ...base, playable: "transcode", hwEncoder: true, tonemap: true });
+    expect(rows.find((r) => r.key === "mode")?.value).toBe("transcode · GPU · HDR→SDR");
+  });
+
   it("shows an empty classification honestly as a dash", () => {
     expect(buildStatRows({ ...base, playable: "" }).find((r) => r.key === "mode")?.value).toBe(
       DASH,
@@ -133,5 +138,9 @@ describe("fmtMode", () => {
     expect(fmtMode("transcode")).toBe("transcode");
     expect(fmtMode("remux", true)).toBe("remux"); // not a transcode → no encoder suffix
     expect(fmtMode("")).toBe(DASH);
+    // The HDR→SDR tag rides on the GPU encoder token for a tonemap session.
+    expect(fmtMode("transcode", true, true)).toBe("transcode · GPU · HDR→SDR");
+    expect(fmtMode("transcode", true, false)).toBe("transcode · GPU");
+    expect(fmtMode("transcode", null, true)).toBe("transcode"); // no encoder → no tag either
   });
 });

frontend/src/lib/plexStats.ts

@@ -12,6 +12,9 @@ export interface PlexStatsInput {
   // software, null/undefined = not a transcode (or unknown) — so the mode row can read "transcode · GPU"
   // vs "transcode · CPU", the visible confirmation of which S1 path engaged.
   hwEncoder?: boolean | null;
+  // For a HW transcode of a 10-bit/HDR source: true = the GPU OpenCL tonemap path (HDR→SDR) engaged, so
+  // the mode row can read "transcode · GPU · HDR→SDR". Absent/false for an 8-bit HW or software session.
+  tonemap?: boolean | null;
   videoWidth: number; // intrinsic decoded dims (0 while the browser can't decode / pre-metadata)
   videoHeight: number;
   droppedFrames: number; // getVideoPlaybackQuality().droppedVideoFrames
@@ -94,20 +97,30 @@ export function fmtCodec(video: string | undefined, audio: string | undefined):
 }
 
 // Active mode, with the transcode encoder appended when known: "transcode · GPU" (VAAPI hardware) or
-// "transcode · CPU" (libx264 software) — the at-a-glance confirmation of which S1 path engaged. Non-
-// transcode modes (direct/remux) and an unknown encoder read as the bare mode. Raw tokens (not i18n'd),
-// consistent with the other technical values in this overlay (e.g. transport "hls").
-export function fmtMode(playable: string, hwEncoder?: boolean | null): string {
+// "transcode · CPU" (libx264 software) — the at-a-glance confirmation of which S1 path engaged — and a
+// "· HDR→SDR" tag when the GPU OpenCL tonemap path handled a 10-bit/HDR source ("transcode · GPU ·
+// HDR→SDR"). Non-transcode modes (direct/remux) and an unknown encoder read as the bare mode. Raw tokens
+// (not i18n'd), consistent with the other technical values in this overlay (e.g. transport "hls").
+export function fmtMode(
+  playable: string,
+  hwEncoder?: boolean | null,
+  tonemap?: boolean | null,
+): string {
   const mode = playable || DASH;
   if (playable !== "transcode" || hwEncoder == null) return mode;
-  return `${mode} · ${hwEncoder ? "GPU" : "CPU"}`;
+  const base = `${mode} · ${hwEncoder ? "GPU" : "CPU"}`;
+  return tonemap ? `${base} · HDR→SDR` : base;
 }
 
 // Build the ordered, i18n-keyed rows the overlay renders. Rows whose data is absent still show a dash
 // (honest "not available" beats a missing row) — except HLS-only rows, dropped entirely for direct play.
 export function buildStatRows(s: PlexStatsInput): StatRow[] {
   const rows: StatRow[] = [
-    { key: "mode", labelKey: "plex.player.stats.mode", value: fmtMode(s.playable, s.hwEncoder) },
+    {
+      key: "mode",
+      labelKey: "plex.player.stats.mode",
+      value: fmtMode(s.playable, s.hwEncoder, s.tonemap),
+    },
     { key: "transport", labelKey: "plex.player.stats.transport", value: s.transport },
     {
       key: "res",

frontend/src/lib/plexUrlState.dom.test.ts

@@ -24,6 +24,7 @@ const RICH_FILTERS: PlexFilters = {
   actors: ["Bale", "Caine"],
   actorMode: "all",
   studios: ["Warner"],
+  playable: ["direct", "transcode_hw"],
   keywords: ["heist"],
   collections: ["1234"],
   collectionMode: "all",

frontend/src/lib/releaseNotes.ts

@@ -14,6 +14,105 @@ export interface ReleaseEntry {
 }
 
 export const RELEASE_NOTES: ReleaseEntry[] = [
+  {
+    version: "0.78.7",
+    date: "2026-09-02",
+    summary:
+      "The verification link in your sign-up email did nothing — it opened a plain sign-in page. Accounts an admin approved before that link was clicked lost the password they registered with, and could not get a reset link either, which left them shut out with no way back.",
+    fixes: [
+      "Confirming your email works again. The link carries its token in the part of the address after the #, and the app was wiping that away as it started up, before the sign-in card ever read it — so the click looked like it had done nothing at all. Password-reset links arrived through the same door and were lost the same way.",
+      "If an admin approved your account before you confirmed your email, the password you chose at sign-up is deleted for security — someone else could have registered your address and chosen it. That part is intended, but it used to be a dead end: sign-in refused you, and Forgot password sent nothing, because the account no longer looked like a password account. It does now, so a reset link reaches you and you can choose a new password.",
+      "Confirming your email in that situation now says so, and offers the reset in the same breath, instead of leaving you to work out why a password you just typed correctly is being refused.",
+      "Existing accounts already stuck this way are repaired on upgrade — including those that had confirmed their email after the fact, who had the least way out. An account that has only ever signed in with Google is deliberately unaffected: it still adds a password from Settings while signed in, not by email.",
+    ],
+    chores: [
+      "urlWithParams/clearParams now carry window.location.hash. The nav-param mirrors (useUrlMirror in the FeedFilters/Playlists/Plex/Channels providers) mount ABOVE the lazily-loaded <App>, so their mount effect replaceState'd the fragment away before AuthCard snapshotted it — the emailed token never reached POST /auth/verify. New users.password_revoked_at (migration 0078) records SEC-10's revoke so _send_reset_if_eligible can tell a stripped account from a Google-only one; cleared on reset-confirm and set-password. POST /auth/verify returns password_reset_required, driving an ok_reset banner. The backfill stamps every local, non-demo, passwordless row — deliberately not also requiring email_verified=false, since the revoke leaves the verify token usable and those victims have no other route back. Deep-reviewed across seven dimensions: nine findings, one confirmed (that backfill predicate) and fixed; the rest logged.",
+    ],
+  },
+  {
+    version: "0.78.6",
+    date: "2026-09-01",
+    summary:
+      "Admins can delete a whitelist entry, and an instance that cannot send email finally says so — in the inbox when a message is dropped, and on the screens where it matters.",
+    features: [
+      "Delete an entry under Users → Access requests: an address you whitelisted earlier, or a request nobody has acted on. Deny records your decision and keeps the record; delete forgets the address, and a later request from it arrives as a new one. Entries that already have an account behind them show the control disabled — that row is the account's approval gate, so it is managed from Users & roles, where deleting the account removes the entry too. If the address is also allow-listed in the server's configuration, the confirmation warns you before you commit, because then removing the entry does not actually take access away.",
+      "When a message cannot go out, every admin gets it in their inbox, naming one of the messages that were lost — an access request, a verification link, a password reset — so you know what your users did not get. Sending is deliberately fail-soft so a mail problem never breaks sign-up, but that used to mean it left no trace anywhere. Throttled to one notice an hour, so a dead relay cannot bury the inbox; the log keeps the full list.",
+      "A standing warning where it can be acted on: on Configuration → Email / SMTP while the settings are incomplete, and above the access-request list, where it explains that nobody is getting a verification link and no request will reach you by email.",
+    ],
+    fixes: [
+      "On the sign-in card, Create an account / Forgot password / Didn't get the verification email are proper history steps now, so Back — including the mouse's back button — returns to the previous view. It used to move the address bar and leave the form on screen unchanged.",
+    ],
+    chores: [
+      "DELETE /api/admin/invites/{id}, refused with 409 while a User row exists for the address, whatever its state — orphaning an account from its invite would leave someone who can neither sign in nor be approved. The list carries has_account so the UI disables rather than hides the control, and the response reports still_allowed_by_env, since is_allowed falls back to ALLOWED_EMAILS / ADMIN_EMAILS once no row exists. Audited as invite_delete.",
+      "email._send() records an email_undelivered notification for every active admin on both the not-configured and the send-failed path, opening its own session and swallowing its own errors so the alert can never become a new way to break a send; a failed or unnecessary write releases the throttle rather than costing the next hour. /api/me carries email_configured for admins, read through the request's own session. The login card's mode moved to useHistorySubview, covered by a render test that fails if it goes back to useState, and the per-test rate-limiter reset now sweeps every loaded app.* module instead of a hand-kept list.",
+    ],
+  },
+  {
+    version: "0.78.5",
+    date: "2026-09-01",
+    summary:
+      "On an instance that cannot send email, signing up with an address that had already been whitelisted or had already requested access created no account at all. The sign-up said it worked, nothing existed, and trying again did the same.",
+    fixes: [
+      "Such a sign-up now creates the account. Before, there was nothing behind the request for an admin to approve, and every retry silently repeated the same nothing. Other sign-ups were unaffected — a brand-new address, one that had been denied and was asking again, and every sign-up on an instance with working email all created their account as expected.",
+      "Admins: a new account still starts inactive. If the person had merely requested access, approve their request as usual. If you had already whitelisted their address, there is no pending request to approve — re-enter the address in the whitelist box under Users → Access requests and that activates their account.",
+      "Operator note: an incomplete SMTP setting makes Siftlode skip every message silently by design — that is what left the sign-ups above with nothing to fall back on. If your instance has never delivered mail, check Configuration → Email / SMTP and use “Send test email”.",
+    ],
+    chores: [
+      "Registration commits the new account explicitly. upsert_pending_invite() commits only when it actually writes an invite row — not when the address already has a pending or approved one — and the only other commit on that path is gated on working SMTP, so with mail unavailable the flushed user row was rolled back when the background task's session closed. That one line is the whole behavioural change in production; the only other shipped edit is a test-only RateLimiter.reset() helper. Two attempts to also fix the pre-approved account's activation UX were reverted after review — roadmap UX-25 records both dead ends and the safe shape.",
+      "Tests: three that fail without the fix (pre-approved and already-pending sign-ups on a no-SMTP instance, and the admin-activation recovery that depends on the account existing), guards for the unknown-email, previously-denied and SMTP-on branches and for verification not granting access on its own, the first end-to-end tests of the /auth/register route and its allow_registration gate, unit tests for the rate limiter, and an autouse fixture resetting the module-level limiters between tests so their windows stop pooling across the suite.",
+    ],
+  },
+  {
+    version: "0.78.4",
+    date: "2026-08-30",
+    summary:
+      "A fix for stuttering and stalling when the Plex player transcodes a video — playback now starts cleanly and keeps a healthy buffer, whether you play from the start or resume/seek partway through.",
+    fixes: [
+      "A transcoded Plex video (any format your browser can't play natively) no longer rebuffers every second, and resuming or seeking into one no longer leaves it stuck on “Loading…” forever. The player now starts the stream at the position you asked for and buffers ahead, instead of chasing the live edge of an in-progress transcode.",
+    ],
+    chores: [
+      "The player builds its HLS client to start at the requested position (the transcode session already begins encoding there), which fixes both the every-second rebuffer and the resume/seek stall in one change. Verified against the HLS library's live-vs-VOD start logic and put through a multi-agent deep-review (correctness, player behaviour, test coverage) that came back clean.",
+    ],
+  },
+  {
+    version: "0.78.3",
+    date: "2026-08-30",
+    summary:
+      "A new Plex filter: narrow the movie library by how each title plays — Direct Play, Direct Stream, or Transcode (hardware or software). See at a glance which titles are light on the server and which need a re-encode.",
+    features: [
+      "Filter movies by playback class in the sidebar: Direct Play (plays as-is), Direct Stream (a light remux), Transcode · HW (re-encoded on the GPU) and Transcode · SW (re-encoded on the CPU — the heaviest). Pick several to combine them. A small coloured dot on each movie card shows its class at a glance.",
+    ],
+    chores: [
+      "The class is derived at sync from the codec, then refined by a bounded background probe that reads each transcode title's real bit depth/HDR — so a 10-bit HEVC that needs the heavier software path is labelled correctly. Went through several multi-agent deep-review rounds (probe-freshness on file replacement, facet self-exclusion, HU/EN parity, an accessibility label on the class dot) — re-reviewed until a round came back clean.",
+    ],
+  },
+  {
+    version: "0.78.2",
+    date: "2026-08-30",
+    summary:
+      "HDR and 10-bit videos in the Plex player now transcode on the server GPU instead of falling back to the CPU. HDR is tone-mapped to SDR on the GPU so the picture looks right in the browser, at a fraction of the CPU cost.",
+    features: [
+      "A 10-bit / HDR video (HDR10, HLG — common on 4K and modern HEVC files) that needs transcoding now runs on the Intel GPU, tone-mapping HDR→SDR on-device so colours look right in the browser and the CPU is barely touched. Previously these fell back to a heavy software encode; now the GPU does the work. If the GPU path can't start for any reason, playback still falls back to software automatically, so a video never fails to play.",
+    ],
+    fixes: [
+      "A 10-bit video that is NOT HDR (standard-range 10-bit, common in anime and some HEVC encodes) is no longer run through the HDR tone-curve — it gets a plain down-convert, so its colours are preserved exactly instead of being subtly darkened.",
+    ],
+    chores: [
+      "The transcode pipeline now decides hardware vs software (and HDR tone-mapping) from a real probe of the source, and the GPU HDR path uses the Intel OpenCL runtime baked into the image. The whole change went through several multi-agent deep-review rounds — including an adversarially-verified fix to a start/seek race in the session fallback — re-reviewed until a round came back clean.",
+    ],
+  },
+  {
+    version: "0.78.1",
+    date: "2026-08-30",
+    summary:
+      "A fix for how downloads and uploads are recognised: an audio file with embedded cover art (or a still image) is no longer mistaken for a video, so it gets the right player and the right controls.",
+    fixes: [
+      "A downloaded audio track that carries album art — and some files from sites that report a video stream that isn't really there — were sometimes classified as video, giving a Play button that opened a broken, picture-less player. Siftlode now decides what a finished file actually is by inspecting the file itself, so audio stays audio, images stay files, and only real videos get the video player.",
+    ],
+    chores: [
+      "The media-kind classifier now trusts the on-disk probe over the source site's metadata whenever the probe could read the file, so stale metadata can't resurrect a video track the file doesn't have. Went through multi-agent deep-review, findings fixed and re-reviewed until clean.",
+    ],
+  },
   {
     version: "0.78.0",
     date: "2026-08-30",

frontend/src/lib/urlState.dom.test.ts

@@ -64,6 +64,19 @@ describe("urlWithParams", () => {
     setLocation("?page=channels");
     expect(urlWithParams({ page: null })).toBe("/app");
   });
+
+  it("carries the fragment over — the one-time auth tokens ride it", () => {
+    // Regression (prod, 2026-09-02): the providers that mirror nav params mount ABOVE the lazy <App>,
+    // so this URL was replaceState'd before the auth card's chunk loaded. Dropping the hash ate the
+    // #verify= token and the verification link opened a bare sign-in page.
+    window.history.replaceState(null, "", "/app?page=plex#verify=tok123");
+    expect(urlWithParams({ v: "show:1" })).toBe("/app?page=plex&v=show%3A1#verify=tok123");
+  });
+
+  it("carries the fragment over even when the query empties out", () => {
+    window.history.replaceState(null, "", "/app?page=channels#reset=tok456");
+    expect(urlWithParams({ page: null })).toBe("/app#reset=tok456");
+  });
 });
 
 describe("clearParams", () => {

frontend/src/lib/urlState.ts

@@ -146,10 +146,16 @@ export function readPage(): Page {
   return isPage(p) ? p : "feed";
 }
 
-/** Build a URL (path + query) from the CURRENT location's query with `updates` applied — a null value
- * deletes that key, any other string sets it. Lets each provider own its own nav key(s) — page / chan /
- * v / pl / the feed-filter keys — and update the address bar without clobbering the others (read-modify-
- * write on the live query). The caller decides pushState vs replaceState with the returned string. */
+/** Build a URL (path + query + fragment) from the CURRENT location with `updates` applied to the query —
+ * a null value deletes that key, any other string sets it. Lets each provider own its own nav key(s) —
+ * page / chan / v / pl / the feed-filter keys — and update the address bar without clobbering the others
+ * (read-modify-write on the live query). The caller decides pushState vs replaceState with the string.
+ *
+ * ⚠️ The FRAGMENT must be carried over. The one-time auth tokens ride it (`#verify=…` / `#reset=…`, SB3),
+ * and the providers that mirror nav params (useUrlMirror in FeedFilters/Playlists/Plex/Channels) sit ABOVE
+ * the lazily-loaded <App> in main.tsx — their mount effect replaceState's this URL before the auth card's
+ * chunk has even loaded. Dropping the hash here silently ate the token: the verification link opened a
+ * bare sign-in page and the account could never be verified. */
 export function urlWithParams(updates: Record<string, string | null>): string {
   const params = new URLSearchParams(window.location.search);
   for (const [k, v] of Object.entries(updates)) {
@@ -157,7 +163,7 @@ export function urlWithParams(updates: Record<string, string | null>): string {
     else params.set(k, v);
   }
   const qs = params.toString();
-  return `${window.location.pathname}${qs ? `?${qs}` : ""}`;
+  return `${window.location.pathname}${qs ? `?${qs}` : ""}${window.location.hash}`;
 }
 
 /** Remove specific TRANSIENT params (one-time auth/admin links: ?link, ?oauth, ?admin, ?access, ?verify,
@@ -178,6 +184,8 @@ export function clearParams(...keys: string[]): void {
   window.history.replaceState(
     window.history.state,
     "",
-    `${window.location.pathname}${qs ? `?${qs}` : ""}`,
+    // Same fragment rule as urlWithParams: this strips QUERY keys only, so a `#verify=…`/`#reset=…`
+    // token that has not been consumed yet must survive. Welcome's own cleanup is what clears it.
+    `${window.location.pathname}${qs ? `?${qs}` : ""}${window.location.hash}`,
   );
 }

frontend/src/lib/useUrlMirror.dom.test.ts

@@ -48,4 +48,14 @@ describe("useUrlMirror", () => {
     renderHook(() => useUrlMirror({ pl: "5" }));
     expect(window.location.search).toBe("?page=playlists&pl=5");
   });
+
+  it("leaves an unconsumed auth token in the fragment alone", () => {
+    // This hook's mount effect is what ran before <App> (and therefore before the auth card) had even
+    // loaded, so whatever it writes to the address bar is what the card later reads. It must not eat
+    // the #verify=/#reset= token that the emailed link carries.
+    window.history.replaceState(null, "", "/?page=playlists#verify=tok123");
+    renderHook(() => useUrlMirror({ pl: "5" }));
+    expect(window.location.hash).toBe("#verify=tok123");
+    expect(window.location.search).toBe("?page=playlists&pl=5");
+  });
 });