release: 0.87.0 (improvement/watch-background-audio)

Deep-review round 4, targeted at round 3's changes (f569b19c..e7f38396).

Accounts
- Switching, adding or signing out an account moved the tab's pin before
  the page unloaded, so the players' resume beacons fired on the way out
  under the NEW account: one account's playback position saved into the
  other. The pin is now handed to the next page (pinOnNextPage) and taken
  over at import; clearActiveAccount is gone.
- Switching to a suspended account was refused but left it in the
  switcher, refused on every click; a deactivated one was not refused at
  all, and made the default it signed every account in the browser out on
  the next request. Every account _session_user would refuse — gone,
  deactivated, suspended, revoked — is refused and dropped from the list.

Share page (/watch)
- An IPv6 client is limited by its /64 (client_ip becomes client_key, for
  every limiter): keyed on the full address, one subscriber could rotate
  through endless identities. The comments now state what the per-link
  ceiling costs: guessing from five networks can keep a link shut for its
  window, and guesses already running when it fills are still checked.
- The link is looked up before the limiter records the attempt, so made-up
  tokens no longer grow it by an entry each.

Forms
- Failing the same way twice is announced again: the sign-in, passphrase
  and setup errors are keyed on the attempt (a clear and a set in one
  handler left the alert node untouched).
- The install wizard's own validation showed the generic error — it threw
  plain objects its catch did not read. It sets the step's message.

Tests: a re-pin leaving the previous account's notices behind; the pin
hand-over; switching to an ended account; the /64 viewer; made-up tokens;
the repeated alerts. Each mutation-checked RED for its own reason.

CHANGELOG.md

@@ -7,6 +7,79 @@ edit the release notes and re-run the generator.
 
 Upgrading, pinning a version and rolling back: [docs/self-hosting.md](docs/self-hosting.md#upgrading).
 
+## 0.87.0 — 2026-09-15
+
+A shared or library video keeps playing when you switch apps on an iPad, and a new tab opens as the account it belongs to without flashing another page first. Facebook reels keep their titles and an mp3 stays an mp3.
+
+### Features
+
+- Background play on iPad (Brave): the shared-video page, the library player and the Plex player keep playing in another app and on the locked screen.
+- The shared-video page has a Repeat toggle, on by default.
+- Switching modules no longer flashes a loading screen: the pages load quietly in the background, and a slow answer shows its spinner only after a moment.
+
+### Fixes
+
+- A new tab honours your Startup choice and opens as its own account — no Home page flash, no other account's language or settings on the first frame.
+- A signed-in Facebook reel keeps its real title instead of “Video” or “Facebook”, and an mp3 download stays an mp3 (it used to be wrapped into an mp4 an iPad would not play).
+- A tab whose account was signed out, suspended or signed out everywhere acts as nobody and comes back as the account still signed in, instead of writing into another account or sticking on the sign-in page.
+- Switching or adding an account no longer saves the video you were watching into the other account's resume position.
+- A new tab keeps the account's notification history instead of replacing it with its own first notice.
+- The shared-video page tells a failed load, a wrong password, too many attempts and an unreachable server apart, with Retry where it helps. Its password limit counts per viewer, so one person guessing cannot lock everyone else out.
+- Form errors on sign-in, the message passphrase, password change and setup are read out by screen readers — again on a second identical failure — and the setup wizard names what is wrong instead of a generic error.
+
+### Internal
+
+- WebKit and iPad projects in the Playwright suite; the Vite dev proxy forwards websockets.
+- Four deep-review rounds (12 → 8 → 8 → 8, the last one targeted), every regression test mutation-checked; half of the later rounds' findings were older defects, fixed here.
+
+## 0.86.0 — 2026-09-14
+
+A failed download now tells you why it failed and what you can do about it, instead of repeating yt-dlp's raw error. Facebook comes first: downloads that used to die on “Cannot parse data” go through, and a Facebook group post downloads its own video instead of a different one from the page.
+
+### Features
+
+- A failure says why, in your language: the row names the cause (“Facebook needs you to be signed in”, “Facebook did not accept your cookies”, “No video found in this post”) and its details window says what to do next. The raw error text is still there below it.
+- A Facebook download with your cookies that stops at “Cannot parse data” is tried again as Chrome, which gets past it.
+- A Facebook group post link downloads the post's own video. Before, yt-dlp either found nothing or quietly downloaded another video from the page; a post without a video now says so.
+- Retry and Re-download use a cookie you added after the failure, so the Retry the message asks for actually goes out signed in.
+
+### Fixes
+
+- A Re-download of a download that needed your cookies used to rebuild without them.
+- A job queued behind a download that already failed shows that failure's explanation instead of a bare “Download failed”.
+- A download yt-dlp reports no length for takes its length from the file, so its Edit / trim action appears.
+- Pressing Pause, Stop or Remove twice, or in two tabs, can no longer free a file another download still uses.
+- The confirm buttons in Downloads name the action (Stop download, Re-download, Remove) instead of repeating the question.
+
+### Internal
+
+- Four sprints, each Facebook behaviour measured on the development server with a real cookie before it was built. Two epic-end review rounds (20 → 17 fixed, then a targeted 4 → 4), every regression test mutation-checked.
+
+## 0.85.0 — 2026-09-13
+
+Siftlode can now be driven from the keyboard, and Back, dialogs and menus stop losing your place. j/k and the arrow keys walk every list and grid, Enter opens what you are on, and Back puts you on the item you opened a view from instead of at the top of the page.
+
+### Features
+
+- j/k and the arrow keys walk the feed, the library, a channel page, the Home rails, every Plex grid and rail, the Channels, Playlists and Downloads tables and the conversation list; Enter opens the item you are on. After you hide or delete an item, the next j goes on from where it was.
+- Back returns you to the item a view was opened from — the Plex title you opened from a Home rail, the channel you opened from its row — with the keyboard still on it.
+- Shortcuts to get around: s jumps to the search field, g-chords jump to a module, and the cheat sheet (h) names every key in the language you are reading. PageUp/PageDown move a page at a time in the command palette and in every dropdown list.
+- The command palette ranks what you typed first: “theme” now puts the Theme rows above a channel whose handle happens to contain it.
+- A card reached with Tab or j shows one ring around the whole card, and a screen reader calls it by its title.
+
+### Fixes
+
+- Back and overlays keep their books straight: Back after navigating over About also closes About, a late clean-up no longer undoes the navigation you just made, and Shift+W on Home closes the player.
+- Dialogs and menus hand the keyboard back where it came from. Escape from a card’s context menu returns to the card, not its thumbnail link; closing the player under another dialog no longer leaves the page unscrollable; a button that is busy with a request keeps the focus instead of dropping it to the page.
+- A write that fails says so, with the reason — several saves, share links and admin actions used to fail silently or in English under the Hungarian interface.
+- A split video export that fails part-way (the job limit) tells you how many clips were added and leaves only the rest selected, so trying again does not queue the first ones twice.
+- “Feed” is called Feed everywhere, in both languages.
+
+### Internal
+
+- Five sprints: history integrity, one dialog/focus contract, palette ranking and accessibility, the keyboard layer, and a Hungarian/English keyboard-only pass. Focus and event-order questions were measured in a real browser before each fix, not argued.
+- Three epic-end review rounds — 19 → 14, 18 → 12 and a targeted 14 → 14 — each regression test mutation-checked. The last round's findings all sat inside the previous round's own fixes, which is where the loop was closed.
+
 ## 0.84.0 — 2026-09-12
 
 A bug-fix release, from a list you wrote while using Siftlode. Two of these were destroying your own data: a YouTube video rewound itself when you reopened it, and clearing a resume point on a half-watched Plex item told Plex nothing. Subtitles now appear in seconds instead of minutes, the Plex player's bitrate is a real measurement rather than a guess, and a channel you turn full history on for fills in front of you instead of looking frozen.

CLAUDE.md

@@ -63,8 +63,9 @@ Frontend: `main.tsx` provider tree → `App.tsx` shell → `moduleRegistry` rout
 components → the **platform layer `components/ui/`** (domain-free primitives: the popover engine and
 its menus, `Modal`/`Overlay`, `Button`/`form`, `DataTable`/`VirtualGrid`, `QueryState`, …). That
 boundary is one-way and **lint-enforced**, not just described: a platform component may not import a
-feature component or a domain API slice (`no-restricted-imports` in `eslint.config.js`, with its own
-test). A new generic component goes in `ui/`; see [`frontend/src/components/ui/README.md`](frontend/src/components/ui/README.md).
+feature component or a domain API slice, and one layer down `lib/` may not import from `components/` at
+all, not even a type (`no-restricted-imports` in `eslint.config.js`, with its own test). A new generic
+component goes in `ui/`; see [`frontend/src/components/ui/README.md`](frontend/src/components/ui/README.md).
 Data via react-query (`qk` factory), per-account `localStorage`, and server prefs; API through
 `lib/api/*` slices over `core.req<T>`.
 
@@ -89,8 +90,11 @@ CQRS, a repository/DI framework, a router library, a generic CRUD-router factory
 | FE per-account state    | `usePref`                                                    | raw `readAccount`/`writeAccount` or bespoke hooks      |
 | FE action button        | `ui/Button` — pick a `SIZES` rung                            | a hand-rolled `<button className="px-3 py-2 …">`       |
 | FE keyboard shortcut    | a row in `lib/keymap.ts` + `dispatch()`                      | a private `keydown` listener with its own key literals |
+| FE list/grid keys       | `NavGrid`/`keyboardNav` + `navItemAttrs` + `data-nav-open`   | a private arrow-key / roving-tabindex handler          |
+| FE view push (history)  | `rememberNavPosition()` right before `history.pushState`     | a push that forgets: Back strands focus on `<body>`    |
 | FE control              | the chip/segmented primitives (`Select` only for >6 options) | a native `<select>`                                    |
 | FE loading/empty/error  | `QueryState` / `StateMessage`                                | ad-hoc conditionals                                    |
+| FE failed write         | `meta.failTitle`, else `notifyActionError(err, title)`       | a bare `catch {}` or `notify()` with no error attached |
 
 ## House rules that bite (learned from real bugs)
 

VERSION

@@ -1 +1 @@
-0.84.0
+0.87.0

backend/Dockerfile

@@ -1,19 +0,0 @@
-FROM python:3.12-slim
-
-ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1 \
-    PIP_NO_CACHE_DIR=1 \
-    PIP_DISABLE_PIP_VERSION_CHECK=1
-
-WORKDIR /app
-
-COPY requirements.txt .
-RUN pip install -r requirements.txt
-
-COPY . .
-
-RUN adduser --disabled-password --gecos "" appuser && chown -R appuser /app
-USER appuser
-
-EXPOSE 8000
-CMD ["sh", "entrypoint.sh"]

backend/alembic/versions/0084_dl_job_error_detail.py

@@ -0,0 +1,41 @@
+"""add download_jobs.error_detail — the domain-specific entry of the failure catalog (E11.5 S1)
+
+Revision ID: 0084_dl_job_error_detail
+Revises: 0083_comfort_pins
+Create Date: 2026-09-13
+
+`error_code` is the generic category (it decides whether a Retry is offered). `error_detail` names
+the host-specific catalog entry `downloads.errors.classify` matched on top of it — `facebook.login_wall`
+and its siblings — so the UI can say what went wrong ON THAT SITE and what to do about it, instead of
+the category's generic sentence. Nullable: most failures have no host-specific entry.
+
+Backfill: a job's code is written once, at failure time, so a new rule never reaches the rows that
+failed before it. The one shape measured on prod (2026-09-13, jobs 9/66/75/145/156/157/182/256/257) is
+yt-dlp's `[facebook] <id>: Cannot parse data`, stored as `unknown`. Without a cookie that is Facebook's
+login wall. Whether a cookie was attached at the time is not recorded anywhere, so every old row gets
+the no-cookie entry — on prod no account had a Facebook cookie, so that is what they all were.
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0084_dl_job_error_detail"
+down_revision: str | None = "0083_comfort_pins"
+branch_labels: str | None = None
+depends_on: str | None = None
+
+
+def upgrade() -> None:
+    op.add_column("download_jobs", sa.Column("error_detail", sa.String(length=48), nullable=True))
+    op.execute(
+        sa.text(
+            "UPDATE download_jobs SET error_code = 'login_required', "
+            "error_detail = 'facebook.login_wall' "
+            "WHERE (error_code IS NULL OR error_code = 'unknown') "
+            "AND error ILIKE '%[facebook]%cannot parse data%'"
+        )
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("download_jobs", "error_detail")

backend/app/auth.py

@@ -269,21 +269,29 @@ def purge_user(db: Session, user: User, background: BackgroundTasks) -> None:
 ACTIVE_ACCOUNT_HEADER = "x-siftlode-account"
 
 
-def resolved_user_id(conn: HTTPConnection) -> tuple[int | None, bool]:
+def resolved_user_id(conn: HTTPConnection, *, strict: bool = True) -> tuple[int | None, bool]:
     """Which account this connection acts as, and whether that's the session's default account.
     Takes any HTTPConnection — an HTTP Request OR a WebSocket — so the WS push channel shares this
     exact per-tab resolution instead of re-implementing it.
 
     The signed cookie holds the *wallet* (`account_ids`, every account signed into this browser)
-    plus a default `user_id`. A caller may override the default with the X-Siftlode-Account header,
-    but ONLY for an account already in the wallet — so a tab can't impersonate an account that never
-    authenticated here. Everything else (WebSocket, plain navigations) keeps using the cookie default.
+    plus a default `user_id`. A caller may name its account with the X-Siftlode-Account header (or
+    `?account=`), but ONLY an account in the wallet — so a tab can't impersonate an account that
+    never authenticated here. A connection that names no account acts as the cookie default.
+
+    A connection naming an account NOT in the wallet acts as nobody (`None`) — typically a tab still
+    pinned to an account that was signed out in another tab. It must not fall back to the default:
+    that tab would go on acting as an account it never showed, its player checkpoints and pref saves
+    landing there and its Sign out signing THAT account out. Only the bootstrap /api/me probe passes
+    `strict=False` and gets the default, which is how such a tab learns who it now is (the frontend
+    re-pins it and reloads). An account whose session ended while it stayed in the wallet (deleted,
+    suspended, revoked) leaves the wallet when it is refused (`_session_user`), so a tab pinned to it
+    takes the same way back.
     """
     default_id = conn.session.get("user_id")
     wallet = conn.session.get("account_ids") or []
     # Header for normal XHR; ?account= for contexts that can't set headers (WebSocket, and a
-    # plain <a> file download). Both are wallet-gated below, so neither can impersonate an
-    # account that never signed into this browser.
+    # plain <a> file download). Both are wallet-gated below.
     hdr = conn.headers.get(ACTIVE_ACCOUNT_HEADER) or conn.query_params.get("account")
     if hdr:
         try:
@@ -292,28 +300,46 @@ def resolved_user_id(conn: HTTPConnection) -> tuple[int | None, bool]:
             hid = None
         if hid is not None and hid in wallet:
             return hid, hid == default_id
+        if strict:
+            return None, False
     return default_id, True
 
 
+def drop_from_wallet(session: dict, user_id: int) -> None:
+    """Take one account out of this browser's wallet (`account_ids`); the session default is untouched."""
+    session["account_ids"] = [a for a in (session.get("account_ids") or []) if a != user_id]
+
+
+def _end_account_session(request: Request, user_id: int, is_default: bool) -> None:
+    """An account whose session here is no longer valid. Only nuke the whole session when it is the
+    SESSION DEFAULT; a per-tab account just leaves the wallet (other tabs' default may still be valid).
+    Leaving is what lets a tab pinned to it recover: its next /api/me names an account no longer signed
+    in here and gets the default. Left in, it answered "signed out" — the landing page, with the default
+    still signed in, and no way off it but closing the tab."""
+    if is_default:
+        request.session.clear()
+    else:
+        drop_from_wallet(request.session, user_id)
+
+
 def current_user(request: Request, db: Session = Depends(get_db)) -> User:
-    user_id, is_default = resolved_user_id(request)
+    return _session_user(request, db, *resolved_user_id(request))
+
+
+def _session_user(request: Request, db: Session, user_id: int | None, is_default: bool) -> User:
     if not user_id:
         raise HTTPException(status_code=401, detail="Not authenticated")
     user = db.get(User, user_id)
     if user is None or not user.is_active or user.is_suspended:
-        # Suspended/deactivated mid-session → drop the session so the block takes effect at once.
-        # But only nuke the whole session when the SESSION DEFAULT identity is gone; a stale
-        # per-tab header account just 401s that one tab (other tabs' default may still be valid).
-        if is_default:
-            request.session.clear()
+        # Suspended/deactivated mid-session → end it so the block takes effect at once.
+        _end_account_session(request, user_id, is_default)
         raise HTTPException(status_code=401, detail="Not authenticated")
     # SA4: reject a cookie whose recorded epoch is behind the account's current one (revoked by a
     # password reset/change or "log out everywhere"). A cookie with no recorded epoch (pre-SA4, or an
     # account signed in before this shipped) is treated as epoch 0 — so the FIRST bump revokes it too.
     epochs = request.session.get("epochs") or {}
     if int(epochs.get(str(user_id), 0)) != (user.session_epoch or 0):
-        if is_default:
-            request.session.clear()
+        _end_account_session(request, user_id, is_default)
         raise HTTPException(status_code=401, detail="Not authenticated")
     # Always keep the session default in the switchable list — covers sessions created before
     # multi-session existed (their account_ids was never seeded), so the switcher isn't empty.
@@ -328,9 +354,18 @@ def current_user(request: Request, db: Session = Depends(get_db)) -> User:
 def optional_current_user(request: Request, db: Session = Depends(get_db)) -> User | None:
     """Like `current_user` but returns None instead of raising 401 when there's no valid session.
     Used by the bootstrap /api/me probe so the logged-out landing doesn't log a failed request to
-    the browser console (a non-2xx fetch is a console error no matter how the app handles it)."""
+    the browser console (a non-2xx fetch is a console error no matter how the app handles it).
+    The one lenient resolution (`strict=False`): a tab naming an account no longer signed in here gets
+    the default account, which is how it learns who it now is — see `resolved_user_id`. That includes an
+    account refused right here, which `_session_user` has just taken out of the wallet."""
+    user_id, is_default = resolved_user_id(request, strict=False)
     try:
-        return current_user(request, db)
+        return _session_user(request, db, user_id, is_default)
+    except HTTPException:
+        if is_default:
+            return None
+    try:
+        return _session_user(request, db, *resolved_user_id(request, strict=False))
     except HTTPException:
         return None
 

backend/app/config.py

@@ -57,7 +57,7 @@ class Settings(BaseSettings):
     # VPS Caddy front door. A request from any other peer (someone hitting the app port directly)
     # is NOT trusted and its raw socket IP is used, so it can't spoof its rate-limit identity via
     # XFF. Empty = trust no proxy (use the direct peer) — correct for a directly-exposed / local-dev
-    # deploy. Comma-separated. See routes.auth._client_ip + the deploy docs.
+    # deploy. Comma-separated. See ratelimit.client_key + the deploy docs.
     trusted_proxy_ips: str = ""
 
     # --- Outbound email (onboarding: access-request + approval notices) ---

backend/app/downloads/adapters.py

@@ -11,10 +11,22 @@ Resolution works both before extraction (from source_kind / URL host) and after
 `extractor_key` in the info dict), so a non-YouTube "url" job still lands on the right adapter.
 """
 
+import re
 from urllib.parse import urlparse
 
+import yt_dlp
+from yt_dlp.networking.impersonate import ImpersonateTarget
+
 from app.config import settings
 
+# Facebook's "Cannot parse data": the page yt-dlp got was a wall, not the content. Both the Chrome retry
+# below and the failure catalog (errors.py) decide on it, so the wording exists once.
+FACEBOOK_PARSE_WALL = "cannot parse data"
+# A source's own verdicts on a link, raised from `resolve_url`. errors.py classifies them; it imports
+# them from here because this module must not import errors (errors → credentials → adapters).
+POST_WITHOUT_VIDEO_MESSAGE = "No single video was found in this post."
+POST_NOT_SHOWN_MESSAGE = "Facebook did not show this post to the signed-in session."
+
 
 class SourceAdapter:
     """Generic source: yt-dlp handles everything and the ref is already a fetchable URL."""
@@ -22,9 +34,21 @@ class SourceAdapter:
     key = "generic"
 
     # --- extraction (worker._extract_with_fallback / backfill) ---------------------------------
-    def client_sets(self) -> list:
-        """Player-client sets to attempt, in order. A generic source needs no client override, so a
-        single default attempt (`[None]`) — the per-client fallback is a YouTube-only concept."""
+    def resolve_url(self, url: str, ydl_opts: dict) -> str:
+        """The link to hand yt-dlp for `url`, resolved BEFORE the first attempt. `ydl_opts` are the
+        download's own options (cookie, timeouts, address family) for any page this needs to read.
+
+        Raises a RuntimeError carrying one of this module's verdicts when the page read shows the
+        download cannot go ahead: the content is there but holds no single video
+        (`POST_WITHOUT_VIDEO_MESSAGE`), or the page is not the content at all — the login page a
+        refused cookie gets (`POST_NOT_SHOWN_MESSAGE`), never the no-video verdict. A failed page read
+        is raised as itself, so it is classified like any other download error. Generic: `url`."""
+        return url
+
+    def client_sets(self, authed: bool = False) -> list:
+        """Attempts to make, in order — each entry is handed back to `ydl_opts_extra`, and the next one
+        is tried when `retriable` says so. A generic source makes a single default attempt (`[None]`).
+        `authed` is whether the acting user's cookie file goes with the download."""
         return [None]
 
     def ydl_opts_extra(self, clients) -> dict:
@@ -37,6 +61,10 @@ class SourceAdapter:
         return False
 
     # --- metadata -----------------------------------------------------------------------------
+    def title(self, info: dict) -> str | None:
+        """The download's raw title, before `titles.normalize_title` cleans it. Generic: yt-dlp's."""
+        return info.get("title")
+
     def uploader_url(self, info: dict) -> str | None:
         """The channel/uploader page URL. Generic: whatever yt-dlp exposes directly (YouTube gives
         `channel_url`), else None (reddit / a raw media URL have no derivable channel page)."""
@@ -67,7 +95,7 @@ class YouTubeAdapter(SourceAdapter):
         "Sign in to confirm",
     )
 
-    def client_sets(self) -> list:
+    def client_sets(self, authed: bool = False) -> list:
         return [
             c for c in (settings.player_client_list, settings.player_client_fallback_list) if c
         ] or [None]
@@ -93,6 +121,63 @@ class YouTubeAdapter(SourceAdapter):
 
 class FacebookAdapter(SourceAdapter):
     key = "facebook"
+    # Measured (E11.5, yt-dlp 2026.07.04): with the user's cookie, some reels answer a plain request
+    # with "Cannot parse data" and parse only when the request looks like Chrome. Impersonation is a
+    # SECOND attempt behind that one error, not the default: the links that already download with the
+    # cookie keep their proven path, and only the ones stuck at the wall go through curl_cffi. Without
+    # a cookie the same error is the login wall, which no disguise gets past.
+    _IMPERSONATE = "impersonate"
+    # A post page is ~4–5 MB of inline JSON; anything far past that is not a post page.
+    _POST_PAGE_MAX_BYTES = 16 * 1024 * 1024
+
+    def resolve_url(self, url: str, ydl_opts: dict) -> str:
+        # Measured (E11.5 S4): given a group post's link, yt-dlp either finds no formats or — worse —
+        # downloads ANOTHER video from the page's feed data. The post's own video is the one Video node
+        # in the page scripts that carry the post id; its watch link downloads (plain first, then the
+        # Chrome retry above). Needs the cookie: signed out, the page is the login wall.
+        post_id = facebook_group_post_id(url)
+        if post_id is None or not ydl_opts.get("cookiefile"):
+            return url
+        with yt_dlp.YoutubeDL(ydl_opts) as ydl:
+            raw = ydl.urlopen(url).read(self._POST_PAGE_MAX_BYTES)
+        page = raw.decode("utf-8", "replace")
+        # Measured (E11.5 review): a refused or expired cookie gets the login page (~450 KB, a login
+        # form, no post id at all), which is not a post without a video — the user's cookie is the cause.
+        if _quoted(post_id) not in page:
+            raise RuntimeError(POST_NOT_SHOWN_MESSAGE)
+        video_id = facebook_post_video_id(page, post_id)
+        if video_id is None:
+            # Never fall back to the post link: that is exactly where the wrong video comes from.
+            raise RuntimeError(POST_WITHOUT_VIDEO_MESSAGE)
+        return f"https://www.facebook.com/watch/?v={video_id}"
+
+    def client_sets(self, authed: bool = False) -> list:
+        return [None, self._IMPERSONATE] if authed else [None]
+
+    def ydl_opts_extra(self, clients) -> dict:
+        if clients == self._IMPERSONATE:
+            return {"impersonate": ImpersonateTarget.from_str("chrome")}
+        return {}
+
+    def retriable(self, error_text: str) -> bool:
+        return FACEBOOK_PARSE_WALL in error_text.lower()
+
+    # Measured (2026-09-14): a SIGNED-IN read gives the placeholder "Video" (plain and as Chrome), and an
+    # 18+ reel only readable as Chrome gives "Facebook"; the post's text is still in `description`. A
+    # signed-out read titles the page with that same text behind the engagement counts, cut short.
+    _PLACEHOLDER_TITLES = frozenset({"video", "facebook"})
+
+    def title(self, info: dict) -> str | None:
+        raw = info.get("title")
+        if (raw or "").strip().lower() not in self._PLACEHOLDER_TITLES:
+            return raw
+        line = next(
+            (ln.strip() for ln in (info.get("description") or "").splitlines() if ln.strip()), ""
+        )
+        # The whole first line, never cut here with an ellipsis: normalize_title's NFKC turns "…" into
+        # "..." and then collapses it to ".", which read as a finished sentence ("… live at."). The
+        # stored title is unbounded; display_name and the file name clip it themselves.
+        return line or raw  # no description either (the 18+ reel): nothing better on the page
 
     def uploader_url(self, info: dict) -> str | None:
         # Facebook gives neither channel_url nor uploader_url, but exposes a numeric `uploader_id`
@@ -107,6 +192,39 @@ class FacebookAdapter(SourceAdapter):
         return True
 
 
+_FB_GROUP_POST_PATH = re.compile(r"^/groups/[^/]+/(?:permalink|posts)/(\d+)/?$")
+_SCRIPT_BLOCK = re.compile(r"<script[^>]*>(.*?)</script>", re.S)
+_VIDEO_NODE = re.compile(r'"__typename":"Video","id":"(\d+)"')
+
+
+def _quoted(post_id: str) -> str:
+    # How the page JSON carries the id: quoted, so a longer id that merely starts with it never counts.
+    return f'"{post_id}"'
+
+
+def facebook_group_post_id(url: str) -> str | None:
+    """The post id of a Facebook group post link (`/groups/<group>/permalink|posts/<id>/`), else None."""
+    parsed = urlparse(url)
+    if not _host_is(parsed.netloc.lower(), "facebook.com"):
+        return None
+    match = _FB_GROUP_POST_PATH.match(parsed.path)
+    return match.group(1) if match else None
+
+
+def facebook_post_video_id(page: str, post_id: str) -> str | None:
+    """The id of the one video attached to `post_id`, read from its page: the Video nodes of the script
+    blocks that carry the post id (the page's other ~10 videos — feed, reels — sit in other blocks).
+    None for no video AND for more than one: guessing between two would be the wrong-video bug again."""
+    quoted = _quoted(post_id)
+    ids = {
+        vid
+        for block in _SCRIPT_BLOCK.findall(page)
+        if quoted in block
+        for vid in _VIDEO_NODE.findall(block)
+    }
+    return ids.pop() if len(ids) == 1 else None
+
+
 class RedditAdapter(SourceAdapter):
     key = "reddit"
 

backend/app/downloads/credentials.py

@@ -1,15 +1,17 @@
 """Per-user, per-host download cookies — the single source of truth for "does the acting user's
 cookie apply to this download, and how does that keep the result private".
 
-Two call sites depend on ONE consistent answer (house rule: an invariant lives in shared code, not
+Two sides depend on ONE consistent answer (house rule: an invariant lives in shared code, not
 in prose):
   * `enqueue` salts the MediaAsset cache signature with the user id WHEN a cookie applies, so the
-    authed download becomes a PRIVATE asset that is never cache-served to another user.
+    authed download becomes a PRIVATE asset that is never cache-served to another user. Retry
+    (`service.resume`) and Re-download (`service.redownload`) ask the same question again, so a
+    cookie the user added after a failure goes with the next attempt.
   * the worker attaches the cookie file to yt-dlp ONLY when a cookie still applies AND the asset it
     is downloading into is that private, salted identity — so a cookie can never poison a shared
     asset (the load-bearing cross-user privacy fix).
 
-Both go through `cookie_salt` / `authed_format_sig` / `host_key_for_url` here, so they can't drift.
+Both key the private identity on `cookie_salt` / `host_key_for_url` here, so they can't drift.
 
 Security controls enforced here:
   * **host scope (SEC-12)** — `host_key_for_url` matches the download URL's netloc against a curated
@@ -30,7 +32,7 @@ from sqlalchemy.orm import Session
 
 from app.downloads import formats
 from app.downloads.adapters import _host_is
-from app.models import DownloadCredential
+from app.models import DownloadCredential, MediaAsset
 from app.security import decrypt_optional, encrypt
 
 log = logging.getLogger("siftlode.downloads.credentials")
@@ -99,11 +101,38 @@ def cookie_salt(user_id: int, host_key: str) -> str:
 
 
 def authed_format_sig(spec: dict, user_id: int, host_key: str) -> str:
-    """The salted `format_sig` an authed download for (user, host) resolves to — the private asset
-    identity. Both enqueue (to create it) and the worker (to recognise it) compute it HERE."""
+    """The salted `format_sig` an authed download for (user, host) resolves to under the current
+    signature version — the private asset enqueue creates, and one of the identities `is_authed_asset`
+    recognises. Neither calls it; the tests use it to hold the two to each other."""
     return formats.format_sig(spec, salt=cookie_salt(user_id, host_key))
 
 
+def rebuild_salt(asset_id: int, cookie: str | None) -> str:
+    """The salt of a Re-download's fresh asset: its OWN row id (so every rebuild is a new identity no
+    enqueue can ever compute), prefixed with the user's `cookie_salt` when a cookie applies. The id is
+    what makes it recognisable — the worker has the asset row, so `is_authed_asset` can recompute this
+    one, where a salt built from the job's previous asset id could not be."""
+    return f"{cookie}:rebuild:{asset_id}" if cookie else f"rebuild:{asset_id}"
+
+
+def is_authed_asset(asset: MediaAsset, spec: dict, user_id: int, url: str | None) -> bool:
+    """Whether an asset is `user_id`'s private, cookie-salted identity for `url`'s host — the one
+    kind of asset a cookie is ever attached to: the one enqueue creates (`authed_format_sig`), or a
+    Re-download's rebuild of it (`rebuild_salt`). The worker's cookie gate asks it before a download,
+    and the failure diagnosis asks it after one (a failure on this asset happened WITH the cookie).
+    Either signature version counts (`formats.format_sigs`): a job queued before a deploy that bumped
+    the version still downloads into the asset it was given."""
+    host_key = host_key_for_url(url)
+    if host_key is None:
+        return False
+    salt = cookie_salt(user_id, host_key)
+    if asset.format_sig in formats.format_sigs(spec, salt=salt):
+        return True
+    return asset.id is not None and asset.format_sig in formats.format_sigs(
+        spec, salt=rebuild_salt(asset.id, salt)
+    )
+
+
 def salt_for_enqueue(db: Session, user_id: int, url: str | None) -> str | None:
     """At enqueue: the cache salt to apply if this user has a cookie for `url`'s host, else None (a
     normal shared download). Returns the salt string so the caller passes it straight to
@@ -199,20 +228,19 @@ def status_list(db: Session, user_id: int) -> list[dict]:
 # --- worker: resolve + write the cookie file --------------------------------------------------
 
 
-def resolve_cookiefile(
-    db: Session,
-    user_id: int,
-    url: str | None,
-    asset_format_sig: str,
-    spec: dict,
-    staging: Path,
-) -> Path | None:
-    """In the worker child: the cookies.txt to hand yt-dlp for this download, or None.
+def usable_cookie(
+    db: Session, user_id: int, url: str | None, asset: MediaAsset, spec: dict
+) -> str | None:
+    """The user's cookie text a download of `url` into `asset` goes with, or None — the ONE decision
+    whether a download is signed in. The worker child writes it out for yt-dlp (`resolve_cookiefile`);
+    the worker asks it again for a job that inherits a failed asset. That second ask sees the
+    credential as it is when the job is claimed: a cookie the user removed or added since the failed
+    download changes this job's explanation to fit the cookie its Retry would go with.
 
     The double gate that prevents cross-user leakage:
       1. a credential must still exist for `url`'s host (host-scoped via `host_key_for_url`), AND
       2. the asset being downloaded into must BE this user's private, salted identity
-         (`asset_format_sig == authed_format_sig(...)`).
+         (`is_authed_asset`).
 
     If (2) fails the asset is the SHARED (unsalted) one — attaching the cookie would poison the
     global cache with a private-group video, so we attach nothing. An unreadable blob (rotated key →
@@ -224,18 +252,31 @@ def resolve_cookiefile(
     cred = get_credential(db, user_id, host_key)
     if cred is None:
         return None
-    if asset_format_sig != authed_format_sig(spec, user_id, host_key):
+    if not is_authed_asset(asset, spec, user_id, url):
         return None  # shared asset — never attach a cookie to a non-private identity
     raw = decrypt_optional(cred.cookies_enc)
     if not raw:
         log.warning(
             "download cookie for user %s host %s could not be decrypted (rotated key?) — "
-            "proceeding without it",
+            "treated as no cookie",
             user_id,
             host_key,
         )
         return None
-    return _write_cookiefile(raw, staging)
+    return raw
+
+
+def resolve_cookiefile(
+    db: Session,
+    user_id: int,
+    url: str | None,
+    asset: MediaAsset,
+    spec: dict,
+    staging: Path,
+) -> Path | None:
+    """In the worker child: the cookies.txt to hand yt-dlp for this download (`usable_cookie`), or None."""
+    raw = usable_cookie(db, user_id, url, asset, spec)
+    return _write_cookiefile(raw, staging) if raw else None
 
 
 def _write_cookiefile(raw: str, staging: Path) -> Path:

backend/app/downloads/errors.py

@@ -1,4 +1,5 @@
-"""Classify a raw yt-dlp / ffmpeg failure string into a stable category code.
+"""Classify a raw yt-dlp / ffmpeg failure string into a stable category code — and, where a site's
+failure has been measured, into that site's entry of the failure catalog.
 
 The worker stores the raw exception text (truncated) for technical detail, but a raw
 `ERROR: [youtube] <id>: Private video. Sign in…` is noise to a user. `classify()` maps that text
@@ -6,21 +7,51 @@ to one of a small set of category codes; the frontend turns the code into a loca
 explanation (and decides whether a retry makes sense). The raw text stays available behind a
 "details" disclosure. This is the same string-matching approach the worker already trusts for
 `_RETRIABLE_MARKERS` — kept here as the single source of truth for "what kind of failure is this".
+
+**The failure catalog** (`_CATALOG`, E11.5). A category is generic: "Sign-in required" cannot tell a
+Facebook user that the cookie they already gave was refused, and yt-dlp words several different
+Facebook walls identically (`Cannot parse data`). A catalog entry is scoped to ONE host and may also
+depend on whether a cookie was attached and on the kind of link, and names a `detail` code the UI has
+its own sentence for — why it failed on that site, and what the user can do. `diagnose()` tries the
+catalog first and falls back to the category. How an entry is added, every time a failure is reported:
+  1. reproduce it on dev (with and without the user's cookie) and keep the verbatim yt-dlp text;
+  2. add the entry below, scoped as narrowly as the measurement allows (a marker that is yt-dlp's
+     generic wording for every site must never match without its host; a marker another module also
+     decides on — the Facebook Chrome retry's FACEBOOK_PARSE_WALL — is imported, never retyped);
+  3. pin the real text in `tests/test_download_errors.py`;
+  4. add `downloads.errors.fail.catalog.<detail>.{short,body}` in EN and HU (a contract test checks it;
+     the group is not called `detail`, which `actionErrors.contract` reads as a raw `HttpError.detail`).
 """
 
-# Two worker-authored strings that this module owns because both are coupled to `_RULES`.
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import NamedTuple
+
+from app.downloads.adapters import (
+    FACEBOOK_PARSE_WALL,
+    POST_NOT_SHOWN_MESSAGE,
+    POST_WITHOUT_VIDEO_MESSAGE,
+    facebook_group_post_id,
+)
+from app.downloads.credentials import host_key_for_url
+
+# Worker-authored strings that this module owns because each is coupled to `_RULES`.
 #
 # QUOTA_FULL_MESSAGE is raised by the worker and must classify back to `quota_exceeded`; its rule
 # below matches a fragment of it, and test_download_errors pins the pair, because a message and its
 # rule drifting apart is exactly how a category silently becomes unreachable.
 #
-# NETWORK_REDACTED_MESSAGE is the opposite direction: it REPLACES a message after classification, so
-# it deliberately has no rule. Nothing re-classifies a stored `job.error` today; if anything ever
-# does, it must carry the original code rather than re-deriving one from this text.
+# NETWORK_REDACTED_MESSAGE REPLACES a message after classification (`user_error_text`). It is written
+# to the shared asset too, and a second job that inherits that failed asset re-diagnoses the stored
+# text (`worker._process_job`), so it has a rule of its own that gives the category back.
 #
 # Other worker-raised texts are still inline literals at their raise sites. The ffmpeg ones and
 # "produced no output file" have markers here; the urlguard refusal deliberately has none and
 # classifies as `unknown` — it is a refusal, not a diagnosis, and no category would say more.
+#
+# A source adapter's verdicts on a link (`SourceAdapter.resolve_url`, E11.5 S4) are adapters.py's
+# constants, imported above; each has a rule below that gives its category back, and a catalog entry
+# that gives the site's sentence.
 QUOTA_FULL_MESSAGE = "Your download storage is full — free up space, then try again."
 NETWORK_REDACTED_MESSAGE = "The server could not reach that address."
 
@@ -30,6 +61,12 @@ _RULES: tuple[tuple[str, str], ...] = (
     # Our own refusal: the worker found the user already at their storage cap (SEC-13). Placed
     # first — it is our wording, so it can never be a false match on an upstream message.
     ("download storage is full", "quota_exceeded"),
+    # Our own redaction of a transport failure (see NETWORK_REDACTED_MESSAGE) — our wording too.
+    (NETWORK_REDACTED_MESSAGE.lower(), "network"),
+    # Our own verdicts on a post link (adapters.py) — our wording too: its page holds no single video,
+    # or the site answered the signed-in read with something that is not the post at all.
+    (POST_WITHOUT_VIDEO_MESSAGE.lower(), "format_unavailable"),
+    (POST_NOT_SHOWN_MESSAGE.lower(), "login_required"),
     # Login / age / members / bot-check — the user must be signed in (we deliberately are not).
     ("sign in to confirm your age", "login_required"),
     ("confirm your age", "login_required"),
@@ -101,6 +138,83 @@ _RULES: tuple[tuple[str, str], ...] = (
 )
 
 
+class Diagnosis(NamedTuple):
+    """What a failure was: the generic `code` (category) and, when a catalog entry matched, its
+    host-specific `detail`."""
+
+    code: str
+    detail: str | None = None
+
+
+@dataclass(frozen=True)
+class _Entry:
+    """One measured failure of one site. It matches when the download URL belongs to `host`
+    (`credentials.SUPPORTED_HOSTS`), every one of `markers` is in the message, the cookie state is
+    `cookie` (None: either), and — when `link` is given — it recognises the URL (a truthy result). A
+    link predicate is the adapter's own, so the catalog and the download agree on what a link is."""
+
+    host: str
+    markers: tuple[str, ...]
+    code: str
+    detail: str
+    cookie: bool | None = None
+    link: Callable[[str], object] | None = None
+
+
+_CATALOG: tuple[_Entry, ...] = (
+    # Facebook answers a signed-out client with a page yt-dlp cannot parse — an 18+ reel, a closed
+    # group's post (measured 2026-09-13: prod jobs 145, 156, 256 download once the owner's cookie is
+    # attached). "Cannot parse data" is yt-dlp's generic wording for a broken extractor on EVERY site,
+    # which is why the entry is scoped to Facebook and never becomes a general rule.
+    _Entry(
+        host="facebook",
+        markers=("[facebook]", FACEBOOK_PARSE_WALL),
+        code="login_required",
+        detail="facebook.login_wall",
+        cookie=False,
+    ),
+    # The same text WITH a cookie: an expired / signed-out cookie, or a page that also needs
+    # impersonation (prod job 257). Telling this user to add cookies would be wrong — they have.
+    _Entry(
+        host="facebook",
+        markers=("[facebook]", FACEBOOK_PARSE_WALL),
+        code="login_required",
+        detail="facebook.cookie_rejected",
+        cookie=True,
+    ),
+    # A group post read with a cookie that Facebook answered with its login page (measured with a
+    # refused cookie: no post id anywhere on the page) — the same refused cookie, found by the adapter.
+    _Entry(
+        host="facebook",
+        markers=(POST_NOT_SHOWN_MESSAGE.lower(),),
+        code="login_required",
+        detail="facebook.cookie_rejected",
+        cookie=True,
+    ),
+    # A group post with no single video of its own. With a cookie the adapter reads the post's page
+    # and says so itself (POST_WITHOUT_VIDEO_MESSAGE); without one yt-dlp is given the post link and
+    # answers "No video formats found" (measured on prod jobs 66 and 145, whose videos are reshared
+    # clips). With a cookie yt-dlp only ever gets the post's VIDEO link, so the same text there is about
+    # that video, not the post — the category says it. Only for group post links (the adapter's own
+    # test of one): a reel with no formats is a different failure.
+    _Entry(
+        host="facebook",
+        markers=(POST_WITHOUT_VIDEO_MESSAGE.lower(),),
+        code="format_unavailable",
+        detail="facebook.group_post_video",
+        link=facebook_group_post_id,
+    ),
+    _Entry(
+        host="facebook",
+        markers=("[facebook]", "no video formats found"),
+        code="format_unavailable",
+        detail="facebook.group_post_video",
+        cookie=False,
+        link=facebook_group_post_id,
+    ),
+)
+
+
 def classify(msg: str | None) -> str:
     """Return a category code for a raw failure message (``"unknown"`` if nothing matches)."""
     if not msg:
@@ -112,6 +226,27 @@ def classify(msg: str | None) -> str:
     return "unknown"
 
 
+def diagnose(
+    msg: str | None, *, url: str | None = None, cookie_attached: bool = False
+) -> Diagnosis:
+    """The catalog entry for this failure of this link, else just its category (see the module doc).
+
+    `url` is the address yt-dlp was given; `cookie_attached` whether the acting user's cookie went
+    with it. Without a URL only the category can be known."""
+    host = host_key_for_url(url) if msg and url else None
+    if host is not None:
+        low = msg.lower()  # type: ignore[union-attr] — `host` is only set when `msg` is truthy
+        for e in _CATALOG:
+            if (
+                e.host == host
+                and all(m in low for m in e.markers)
+                and (e.cookie is None or e.cookie == cookie_attached)
+                and (e.link is None or e.link(url))  # type: ignore[arg-type] — as `msg` above
+            ):
+                return Diagnosis(e.code, e.detail)
+    return Diagnosis(classify(msg))
+
+
 def user_error_text(source_kind: str, msg: str, code: str) -> str:
     """The failure text to STORE on the job, given the raw message and its category.
 

backend/app/downloads/formats.py

@@ -57,6 +57,10 @@ _DEFAULTS = {
 # opt-out), so any asset cached under an old non-compat spec — or a stale non-H.264 mp4 that slipped
 # the v3 net — must re-derive through the current browser-safe guarantee.
 _SIG_VERSION = 4
+# Audio-only downloads version on their own, so a change to the audio bytes doesn't re-download every
+# cached video. v5: an extracted .mp3/.m4a is stored as itself instead of remuxed into an .mp4 that
+# iPad's WebKit refuses to play, so a cached remuxed audio asset must re-derive.
+_AUDIO_SIG_VERSION = 5
 
 _SPONSORBLOCK_CATEGORIES = ["sponsor", "selfpromo", "interaction"]
 
@@ -96,20 +100,34 @@ def normalize(spec: dict) -> dict:
     return s
 
 
-def format_sig(spec: dict, salt: str | None = None) -> str:
+def _sig_version(s: dict) -> int:
+    return _AUDIO_SIG_VERSION if s["mode"] == "a" else _SIG_VERSION
+
+
+def format_sig(spec: dict, salt: str | None = None, *, version: int | None = None) -> str:
     """Stable short hash of the output-affecting spec — the MediaAsset cache key component.
 
     `salt` forks a distinct, non-dedup identity for the same spec (used by force-redownload so it
-    always re-fetches into its own asset instead of sharing a cached file with other jobs)."""
+    always re-fetches into its own asset instead of sharing a cached file with other jobs).
+    `version` hashes under a signature version other than the current one (see `format_sigs`)."""
     s = normalize(spec)
     data = {k: s[k] for k in _SIG_KEYS}
-    data["_v"] = _SIG_VERSION
+    data["_v"] = _sig_version(s) if version is None else version
     if salt is not None:
         data["_salt"] = salt
     payload = json.dumps(data, sort_keys=True, separators=(",", ":"))
     return hashlib.sha256(payload.encode()).hexdigest()[:24]
 
 
+def format_sigs(spec: dict, salt: str | None = None) -> tuple[str, str]:
+    """`format_sig` under the current signature version and under the one before it. An asset keeps
+    the signature it was created with, so a job queued before a deploy that bumped the version and
+    run after it downloads into an asset carrying the previous one — which must still be recognised
+    as that user's private asset (`credentials.is_authed_asset`), or it downloads without its cookie."""
+    previous = _sig_version(normalize(spec)) - 1
+    return format_sig(spec, salt), format_sig(spec, salt, version=previous)
+
+
 def build_ydl_opts(
     spec: dict,
     outtmpl: str,

backend/app/downloads/pipeline.py

@@ -8,7 +8,6 @@ from datetime import date, datetime, timedelta, timezone
 from pathlib import Path
 
 import yt_dlp
-from sqlalchemy import select
 
 from app import sysconfig
 from app.config import settings
@@ -114,9 +113,10 @@ def _fill_asset_meta_early(asset_id: int, info: dict) -> None:
         # `or info.get("id")` avoids a blank card while downloading when the cleaned title is empty
         # (e.g. a title that was only a social engagement prefix); the completion path later sets
         # the final title with its own source_ref fallback.
-        asset.title = normalize_title(info.get("title")) or info.get("id")
+        adapter = adapters.resolve_adapter(None, None, info)
+        asset.title = normalize_title(adapter.title(info)) or info.get("id")
         asset.uploader = info.get("uploader") or info.get("channel")
-        asset.uploader_url = adapters.resolve_adapter(None, None, info).uploader_url(info)
+        asset.uploader_url = adapter.uploader_url(info)
         asset.thumbnail_url = info.get("thumbnail")
         asset.duration_s = int(info["duration"]) if info.get("duration") else None
         asset.upload_date = _parse_upload_date(info.get("upload_date"))
@@ -323,14 +323,33 @@ def _extract_with_fallback(
 ):
     """Download via yt-dlp using the source `adapter`'s client sets + options. For YouTube the adapter
     supplies the primary player-client set then a POT-backed fallback (retried on a bot/DRM/format
-    error); other sources make a single attempt. Returns the info dict of the successful attempt.
+    error); a Facebook download WITH a cookie is retried as Chrome behind "Cannot parse data"; other
+    sources make a single attempt. Returns the info dict of the successful attempt.
+
+    Before the first attempt the adapter may resolve `url` to the link that really holds the video (a
+    Facebook group post → its video's watch link); when the page shows no single video there, or is not
+    the post at all (a refused cookie's login page), the adapter raises its own verdict
+    (adapters.POST_*_MESSAGE) instead of letting yt-dlp guess, and a failed page read fails the
+    download as itself.
 
     `cookiefile` (S6) is the acting user's per-host cookies.txt, already gated by
     `credentials.resolve_cookiefile`; passed to every attempt so the fallback stays authenticated.
 
     `max_bytes` (SEC-13) is the owner's remaining storage budget, applied to every attempt."""
-    client_sets = adapter.client_sets()
+    client_sets = adapter.client_sets(authed=cookiefile is not None)
     outtmpl = str(staging / "%(id)s.%(ext)s")
+    # Resolving may read a page first — network time the stall watchdog must not see as a stall.
+    _touch_job(job_id)
+    target = adapter.resolve_url(
+        url,
+        formats.build_ydl_opts(
+            spec,
+            outtmpl,
+            _make_progress_hook(job_id, asset_id),
+            cookiefile=cookiefile,
+            max_bytes=max_bytes,
+        ),
+    )
     last_exc: Exception | None = None
     for i, clients in enumerate(client_sets):
         opts = formats.build_ydl_opts(
@@ -348,7 +367,7 @@ def _extract_with_fallback(
         # killed — acceptable, as socket_timeout + extractor_retries bound one attempt well under it.)
         try:
             with yt_dlp.YoutubeDL(opts) as ydl:
-                return ydl.extract_info(url, download=True)
+                return ydl.extract_info(target, download=True)
         except yt_dlp.utils.DownloadError as exc:
             last_exc = exc
             if i < len(client_sets) - 1 and adapter.retriable(str(exc)):
@@ -385,8 +404,12 @@ def _ensure_browser_playable(job_id: int, produced: Path, spec: dict, info: dict
     or just remux when the codecs are fine but the container isn't. **Scope:** only the mp4 compat
     profile is normalized; an explicit `vcodec` or a non-mp4 custom profile is the user opting out
     of the guarantee and is left as-is (so a `webm` profile can still ship VP9/Opus). Returns the
-    file to store (converted, or the original) and corrects `info`'s codec fields to match disk."""
-    if spec.get("container") != "mp4" or spec.get("vcodec"):
+    file to store (converted, or the original) and corrects `info`'s codec fields to match disk.
+
+    An audio download (mode "a") is never touched: yt-dlp already extracted it to .mp3 / .m4a, which
+    every browser plays as audio/mpeg / audio/mp4. Remuxing it into .mp4 served an mp3 as video/mp4,
+    which iPad's WebKit refuses to play (prod job 268)."""
+    if spec.get("mode") == "a" or spec.get("container") != "mp4" or spec.get("vcodec"):
         return produced
     vcodec, acodec = editmod.probe_codecs(produced)
     is_mp4 = produced.suffix.lower() == ".mp4"
@@ -425,6 +448,7 @@ def _download(
 ) -> None:
     staging = _staging_dir(asset_id)
     cookiefile: Path | None = None
+    url: str | None = None  # read by the failure branch, which can run before it is resolved
     try:
         if staging.exists():
             shutil.rmtree(staging, ignore_errors=True)
@@ -445,12 +469,10 @@ def _download(
         # this asset is that user's private, salted identity (the double gate lives in credentials).
         remaining_bytes: int | None = None
         with SessionLocal() as cdb:
-            asset_sig = cdb.execute(
-                select(MediaAsset.format_sig).where(MediaAsset.id == asset_id)
-            ).scalar_one_or_none()
-            if asset_sig is not None:
+            target = cdb.get(MediaAsset, asset_id)
+            if target is not None:
                 cookiefile = credentials.resolve_cookiefile(
-                    cdb, user_id, url, asset_sig, spec, staging
+                    cdb, user_id, url, target, spec, staging
                 )
             # SEC-13: what this user has left. `check_enqueue` only compared the footprint as it
             # stood when the job was QUEUED — a download's size is unknown until it finishes, so a
@@ -484,13 +506,19 @@ def _download(
         produced = _produced_file(info, staging)
         produced = _ensure_browser_playable(job_id, produced, spec, info)
         ext = produced.suffix.lstrip(".").lower()
+        # Codecs/dims/duration come from a PROBE of the produced file — the ground truth — NOT yt-dlp's
+        # `info` dict, whose fields are absent for some sources (Facebook among them): deriving
+        # media_kind from those nulls misclassified a real H.264 video as a download-only 'file', and a
+        # missing duration hid the trim action. Probed before the sidecars so the .nfo runtime has it
+        # too. Same probe the upload ingest uses.
+        vcodec, acodec, width, height, duration_s = probe.resolve_media_facts(produced, info)
         meta = storage.MediaMeta(
             video_id=info.get("id") or source_ref,
-            title=normalize_title(info.get("title")) or source_ref,
+            title=normalize_title(adapter.title(info)) or source_ref,
             uploader=info.get("uploader") or info.get("channel") or "Unknown Channel",
             upload_date=_parse_upload_date(info.get("upload_date")),
             uniqueid_type=adapter.nfo_uniqueid_type(),
-            duration_s=int(info["duration"]) if info.get("duration") else None,
+            duration_s=duration_s,
             description=info.get("description"),
             thumbnail_url=info.get("thumbnail"),
         )
@@ -516,12 +544,11 @@ def _download(
                 asset.rel_path = rel
                 asset.size_bytes = size
                 asset.duration_s = meta.duration_s
-                # Codecs/dims come from a PROBE of the finished file — the ground truth — NOT yt-dlp's
-                # `info` dict, whose codec fields are absent for some sources (Facebook among them):
-                # deriving media_kind from those nulls misclassified a real H.264 video as a
-                # download-only 'file' with no in-app play/edit. Same probe the upload ingest uses.
-                asset.vcodec, asset.acodec, asset.width, asset.height = probe.resolve_media_facts(
-                    final, info
+                asset.vcodec, asset.acodec, asset.width, asset.height = (
+                    vcodec,
+                    acodec,
+                    width,
+                    height,
                 )
                 asset.container = ext
                 asset.media_kind = mediakind.derive(asset.vcodec, asset.acodec)
@@ -578,6 +605,7 @@ def _download(
                 status=JobStatus.ERROR,
                 error=msg,
                 error_code=dlerrors.classify(msg),
+                error_detail=None,
                 phase=None,
             )
             db.commit()
@@ -588,9 +616,11 @@ def _download(
         log.info("job %s refused for its owner: %s", job_id, msg)
     except Exception as exc:  # noqa: BLE001 — surface any failure to the user, keep worker alive
         msg = str(exc)[:500]
-        code = dlerrors.classify(msg)
+        # The catalog needs the link and whether the user's cookie went with it: the same yt-dlp
+        # text is Facebook's login wall without one and a refused cookie with one.
+        diagnosis = dlerrors.diagnose(msg, url=url, cookie_attached=cookiefile is not None)
         # SEC-12: redact a transport-level readout for user-supplied URLs (see user_error_text).
-        msg = dlerrors.user_error_text(source_kind, msg, code)
+        msg = dlerrors.user_error_text(source_kind, msg, diagnosis.code)
         with SessionLocal() as db:
             asset = db.get(MediaAsset, asset_id)
             if asset:
@@ -603,7 +633,8 @@ def _download(
                 job_id,
                 status=JobStatus.ERROR,
                 error=msg,
-                error_code=code,
+                error_code=diagnosis.code,
+                error_detail=diagnosis.detail,
                 phase=None,
             )
             db.commit()

backend/app/downloads/probe.py

@@ -81,10 +81,12 @@ def probe_media(path: Path) -> tuple[str | None, str | None, int | None, int | N
 
 def resolve_media_facts(
     path: Path, info: dict
-) -> tuple[str | None, str | None, int | None, int | None]:
-    """(vcodec, acodec, width, height) for the stored download asset: PROBE the finished file on disk
-    (the ground truth). yt-dlp's `info` omits codec/dimension fields for some sources (Facebook among
-    them), so deriving media_kind from it there labelled a real H.264 video a download-only 'file'.
+) -> tuple[str | None, str | None, int | None, int | None, int | None]:
+    """(vcodec, acodec, width, height, duration_s) for the stored download asset: PROBE the finished
+    file on disk (the ground truth). yt-dlp's `info` omits codec/dimension fields for some sources
+    (Facebook among them), so deriving media_kind from it there labelled a real H.264 video a
+    download-only 'file'. It omits the duration too (a Facebook reel, an Instagram reel), and a NULL
+    duration hides the Library row's trim action although the file plays for minutes.
 
     Precedence is by whether the probe RAN, not per-field: if ffprobe read the file, its codec verdict
     is authoritative — INCLUDING a deliberate None (cover-art-only audio, a still image). A per-field
@@ -92,16 +94,23 @@ def resolve_media_facts(
     have (yt-dlp reports a progressive `vcodec` for an audio-mode download whose video it then strips),
     mislabelling an audio download as a broken in-app 'video'. Only when ffprobe could NOT read the
     file at all do we fall back to `info` (the pre-probe behaviour, a safety net); the cosmetic
-    dimensions still gap-fill from `info` in either case."""
+    dimensions and the duration still gap-fill from `info` in either case."""
     data = editmod.run_ffprobe_json(path, show_streams=True, show_format=True)
     info_v = info.get("vcodec") if info.get("vcodec") not in (None, "none") else None
     info_a = info.get("acodec") if info.get("acodec") not in (None, "none") else None
     info_w = int(info["width"]) if info.get("width") else None
     info_h = int(info["height"]) if info.get("height") else None
+    info_d = int(info["duration"]) if info.get("duration") else None
     if data is None:
         # ffprobe could not read the file — fall back to the extractor's info entirely.
-        return info_v, info_a, info_w, info_h
-    pv, pa, pw, ph, _dur = _facts_from_probe(data)
+        return info_v, info_a, info_w, info_h, info_d
+    pv, pa, pw, ph, pd = _facts_from_probe(data)
     # Probe ran → its codecs win outright (a None means "no such track", not "unknown"); info only
-    # gap-fills the cosmetic width/height the probe couldn't read.
-    return pv, pa, pw if pw is not None else info_w, ph if ph is not None else info_h
+    # gap-fills the width/height/duration the probe couldn't read.
+    return (
+        pv,
+        pa,
+        pw if pw is not None else info_w,
+        ph if ph is not None else info_h,
+        pd if pd is not None else info_d,
+    )

backend/app/downloads/service.py

@@ -7,6 +7,7 @@ handles everything else. State transitions used by the routes (pause/resume/canc
 the worker live in `worker.py` / the routes; this module owns enqueue + asset bookkeeping.
 """
 
+import uuid
 from datetime import datetime, timezone
 
 from sqlalchemy import func, select, update
@@ -80,11 +81,13 @@ def get_or_create_asset(
         status="pending",
         ref_count=0,
     )
-    db.add(asset)
     try:
-        db.flush()
+        # A SAVEPOINT: losing the race undoes only this insert, never the caller's own pending writes
+        # (Retry clears the job's error before it gets here; a whole-session rollback threw that away).
+        with db.begin_nested():
+            db.add(asset)
+            db.flush()
     except IntegrityError:
-        db.rollback()
         asset = db.execute(stmt).scalar_one()
     return asset
 
@@ -341,13 +344,20 @@ def pause(db: Session, job: DownloadJob) -> None:
 def resume(db: Session, job: DownloadJob) -> None:
     """Requeue a paused/errored job for a fresh attempt, clearing its error. If the SHARED asset itself
     failed, reset it to pending so the worker actually re-downloads — otherwise the requeued job would
-    instantly re-inherit the asset's stale error (the worker short-circuits an errored asset)."""
+    instantly re-inherit the asset's stale error (the worker short-circuits an errored asset).
+
+    A cookie the user added AFTER the job was queued moves the job onto their private asset first
+    (`_follow_the_cookie`): the worker only ever attaches a cookie to that identity, so without the move
+    the Retry a login-wall message asks for would fail on the same wall."""
     if job.status in (JobStatus.PAUSED, JobStatus.ERROR):
         job.progress = 0
         job.error = None
         job.error_code = None
+        job.error_detail = None
         if job.asset_id:
             asset = db.get(MediaAsset, job.asset_id)
+            if asset is not None:
+                asset = _follow_the_cookie(db, job, asset)
             if asset and asset.status == "error":  # MediaAsset.status (no enum), not a JobStatus
                 asset.status = "pending"
                 asset.error = None
@@ -355,6 +365,32 @@ def resume(db: Session, job: DownloadJob) -> None:
         db.commit()
 
 
+def _follow_the_cookie(db: Session, job: DownloadJob, asset: MediaAsset) -> MediaAsset:
+    """Re-point a requeued job at the asset enqueue would pick NOW, when the user has a cookie for the
+    link's host but the job still holds an asset the worker won't attach it to (queued before the
+    cookie existed). Returns the asset the job holds afterwards.
+
+    Only a `pending` / `error` asset moves — neither has a file nor a download in flight. A `ready` one
+    already has the file, and a `downloading` one may be this job's own child still being stopped by
+    the pause; the next Retry after it settles moves the job then. Removing a cookie never moves a job
+    back: the worker attaches nothing without a credential, so the private asset is as good as any."""
+    if asset.status not in ("pending", "error"):
+        return asset
+    url = source_url(job.source_kind, job.source_ref)
+    salt = credentials.salt_for_enqueue(db, job.user_id, url)
+    spec = formats.normalize(job.profile_snapshot)
+    if salt is None or credentials.is_authed_asset(asset, spec, job.user_id, url):
+        return asset
+    target = get_or_create_asset(
+        db, job.source_kind, job.source_ref, formats.format_sig(spec, salt=salt)
+    )
+    populate_from_catalog(db, target)
+    release_asset(db, job)  # drop the old hold BEFORE re-pointing — it keys off job.asset_id
+    incr_ref_count(db, target.id)
+    job.asset_id = target.id
+    return target
+
+
 def cancel(db: Session, job: DownloadJob) -> None:
     """Cancel a job unless it's already done/canceled, releasing its asset hold WHILE it still counts
     as holding — `canceled` ∉ HOLDING, so a later delete won't double-release."""
@@ -373,13 +409,31 @@ def delete(db: Session, job: DownloadJob) -> None:
 
 def redownload(db: Session, job: DownloadJob) -> None:
     """Rebuild a finished/failed job's file into a FRESH, private asset (the cache sig is salted with
-    the job id + current asset id, so it never reuses the dedup pool) and requeue the SAME job row —
+    the new asset's own id, so it never reuses the dedup pool) and requeue the SAME job row —
     so any public share link (DownloadLink -> job_id) keeps resolving to the newly-downloaded file.
     The old hold is dropped first (freeing the old file iff this job was its last holder). The caller
-    has already rejected edit clips + still-in-progress jobs (HTTP 409)."""
+    has already rejected edit clips + still-in-progress jobs (HTTP 409).
+
+    When the user has a cookie for the link's host, the salt carries it (`credentials.rebuild_salt`),
+    so the worker recognises the rebuild as their private identity and attaches the cookie — a cookie
+    download, or one the user added after a failure, rebuilds with the cookie."""
     spec = formats.normalize(job.profile_snapshot)
-    sig = formats.format_sig(spec, salt=f"{job.id}:{job.asset_id}")
-    asset = get_or_create_asset(db, job.source_kind, job.source_ref, sig)
+    cookie = credentials.salt_for_enqueue(
+        db, job.user_id, source_url(job.source_kind, job.source_ref)
+    )
+    # The salt names the row's own id, which exists only once the row does: insert it under a unique
+    # placeholder, then write the real signature in the same transaction (nobody sees the placeholder).
+    asset = MediaAsset(
+        source_kind=job.source_kind,
+        source_ref=job.source_ref,
+        format_sig=f"rebuild:{uuid.uuid4().hex}",
+        status="pending",
+        ref_count=0,
+    )
+    db.add(asset)
+    db.flush()
+    asset.format_sig = formats.format_sig(spec, salt=credentials.rebuild_salt(asset.id, cookie))
+    db.flush()
     populate_from_catalog(db, asset)
     # Drop the old hold BEFORE re-pointing the job — release_asset keys off the job's current asset.
     release_asset(db, job)
@@ -389,6 +443,8 @@ def redownload(db: Session, job: DownloadJob) -> None:
     job.progress = 0
     job.phase = None
     job.error = None
+    job.error_code = None  # a rebuild that fails again gets its own diagnosis, never the old one
+    job.error_detail = None
     job.speed_bps = None
     job.eta_s = None
     # Re-derive the display name from the freshly cleaned title on completion (else an older, un-cleaned

backend/app/mailtext.py

@@ -175,7 +175,7 @@ MAIL_TEXT: dict[str, dict[str, str]] = {
         "en": (
             "Hi,\n\n"
             "Someone has opened up Siftlode for you — a quiet, self-hosted reader for your YouTube "
-            "subscriptions. Every upload from the channels you follow lands in one feed you can "
+            "subscriptions. Every upload from the channels you follow lands in one Feed you can "
             "actually filter and sort, with no algorithm deciding what you see, and no Shorts or "
             "livestreams unless you want them.\n\n"
             "{next_step}\n\n"
@@ -186,7 +186,7 @@ MAIL_TEXT: dict[str, dict[str, str]] = {
             "Szia,\n\n"
             "Valaki megnyitotta előtted a Siftlode-ot — ez egy csendes, saját üzemeltetésű olvasó "
             "a YouTube-feliratkozásaidhoz. A követett csatornák minden feltöltése egyetlen "
-            "hírfolyamba érkezik, amit tényleg tudsz szűrni és rendezni; nincs algoritmus, ami "
+            "Feedbe érkezik, amit tényleg tudsz szűrni és rendezni; nincs algoritmus, ami "
             "eldönti, mit látsz, és nincs Shorts vagy élő adás, hacsak nem kéred.\n\n"
             "{next_step}\n\n"
             "Nem sürget semmi — az ajtó nyitva marad.\n\n"

backend/app/models.py

@@ -871,6 +871,8 @@ class DownloadJob(Base, TimestampMixin, UpdatedAtMixin):
     error_code: Mapped[str | None] = mapped_column(
         String(24)
     )  # category, see downloads.errors.classify
+    # The host-specific failure-catalog entry on top of the category (`facebook.login_wall`), or NULL.
+    error_detail: Mapped[str | None] = mapped_column(String(48))  # see downloads.errors.diagnose
     queue_pos: Mapped[int] = mapped_column(Integer, default=0, server_default="0")
 
 

backend/app/ratelimit.py

@@ -1,15 +1,20 @@
 """A tiny in-process sliding-window rate limiter.
 
-Generic groundwork: keyed by an arbitrary string (e.g. a client IP), so it can throttle any
+Generic groundwork: keyed by an arbitrary string (e.g. a client — `client_key`), so it can throttle any
 endpoint. Single-worker uvicorn → in-memory state is sufficient; it resets on restart, which
 is fine for abuse throttling (not for anything that must survive a deploy). Not shared across
 processes — if we ever run multiple workers, swap the backing store for Redis behind the same
 ``allow()`` interface.
 """
 
+import ipaddress
 import threading
 import time
 
+from fastapi import Request
+
+from app.config import settings
+
 
 class RateLimiter:
     def __init__(self, max_events: int, window_seconds: float):
@@ -25,6 +30,14 @@ class RateLimiter:
         with self._lock:
             self._hits.clear()
 
+    def exhausted(self, key: str) -> bool:
+        """Whether ``key``'s window is already full (``allow`` would refuse it), WITHOUT counting an
+        attempt — for a limit that counts only some outcomes: ask it first, ``allow`` the ones that
+        count."""
+        cutoff = time.monotonic() - self.window
+        with self._lock:
+            return sum(1 for t in self._hits.get(key, []) if t > cutoff) >= self.max_events
+
     def allow(self, key: str) -> bool:
         """Record an attempt for ``key`` and return whether it is within the limit.
 
@@ -49,3 +62,40 @@ class RateLimiter:
                     else:
                         del self._hits[k]
             return True
+
+
+def _norm_ip(s: str) -> ipaddress.IPv4Address | ipaddress.IPv6Address | None:
+    """Parse an IP for comparison, unwrapping IPv4-mapped IPv6 (`::ffff:10.0.0.1` → `10.0.0.1`) so a
+    plain-IPv4 allowlist still matches a peer that surfaces in mapped form. None for a non-IP string."""
+    try:
+        ip = ipaddress.ip_address(s.strip())
+    except ValueError:
+        return None
+    return ip.ipv4_mapped if getattr(ip, "ipv4_mapped", None) else ip
+
+
+def client_key(request: Request) -> str:
+    """Best-effort client identity for rate limiting: its IP, or for IPv6 the /64 the address sits in — a
+    subscriber is handed a whole /64, so keyed on the full address one client would have endless identities
+    to spread its attempts over. X-Forwarded-For is client-controlled, so we trust it
+    ONLY when the request actually arrived from a configured reverse proxy (settings.trusted_proxy_ips
+    — the address the proxy connects FROM, e.g. the VPS Caddy's WireGuard peer IP). Our proxy APPENDS
+    the client it saw to XFF, so the RIGHTMOST entry is the real client and can't be forged by a
+    client pre-seeding the header. Any other peer (someone hitting the app port directly, bypassing the
+    proxy) is untrusted — we use its real socket IP, so it can't spoof its rate-limit identity.
+
+    SAFETY: this relies on `request.client` being the TRUE socket peer. uvicorn is started WITHOUT
+    `--proxy-headers` (see entrypoint.sh) precisely so it never rewrites `request.client` from XFF —
+    do NOT add that flag, or the trust check below would compare against a forgeable value."""
+    peer = request.client.host if request.client else "unknown"
+    client = peer
+    trusted = {_norm_ip(p) for p in settings.trusted_proxy_ip_set} - {None}
+    if _norm_ip(peer) in trusted:
+        xff = request.headers.get("x-forwarded-for")
+        parts = [p.strip() for p in (xff or "").split(",") if p.strip()]
+        if parts:
+            client = parts[-1]
+    ip = _norm_ip(client)
+    if isinstance(ip, ipaddress.IPv6Address):
+        return str(ipaddress.IPv6Network((ip, 64), strict=False))
+    return client

backend/app/routes/auth.py

@@ -3,7 +3,6 @@
 Split out of app/auth.py (R12 S2); the core auth surface (current_user, scopes, token
 helpers) stays in app/auth.py, imported below."""
 
-import ipaddress
 import secrets
 from datetime import datetime, timedelta, timezone
 from typing import NamedTuple
@@ -40,7 +39,7 @@ from app.auth import (
 from app.config import settings
 from app.db import SessionLocal, get_db
 from app.models import AuthToken, DemoWhitelist, Invite, OAuthToken, User
-from app.ratelimit import RateLimiter
+from app.ratelimit import RateLimiter, client_key
 from app.security import encrypt, hash_password, hash_token, verify_password
 from app.utils import canonical_email, valid_email
 
@@ -172,37 +171,6 @@ def is_demo_allowed(db: Session, email: str) -> bool:
     )
 
 
-def _norm_ip(s: str) -> ipaddress.IPv4Address | ipaddress.IPv6Address | None:
-    """Parse an IP for comparison, unwrapping IPv4-mapped IPv6 (`::ffff:10.0.0.1` → `10.0.0.1`) so a
-    plain-IPv4 allowlist still matches a peer that surfaces in mapped form. None for a non-IP string."""
-    try:
-        ip = ipaddress.ip_address(s.strip())
-    except ValueError:
-        return None
-    return ip.ipv4_mapped if getattr(ip, "ipv4_mapped", None) else ip
-
-
-def _client_ip(request: Request) -> str:
-    """Best-effort client IP for rate limiting. X-Forwarded-For is client-controlled, so we trust it
-    ONLY when the request actually arrived from a configured reverse proxy (settings.trusted_proxy_ips
-    — the address the proxy connects FROM, e.g. the VPS Caddy's WireGuard peer IP). Our proxy APPENDS
-    the client it saw to XFF, so the RIGHTMOST entry is the real client and can't be forged by a
-    client pre-seeding the header. Any other peer (someone hitting the app port directly, bypassing the
-    proxy) is untrusted — we use its real socket IP, so it can't spoof its rate-limit identity.
-
-    SAFETY: this relies on `request.client` being the TRUE socket peer. uvicorn is started WITHOUT
-    `--proxy-headers` (see entrypoint.sh) precisely so it never rewrites `request.client` from XFF —
-    do NOT add that flag, or the trust check below would compare against a forgeable value."""
-    peer = request.client.host if request.client else "unknown"
-    trusted = {_norm_ip(p) for p in settings.trusted_proxy_ip_set} - {None}
-    if _norm_ip(peer) in trusted:
-        xff = request.headers.get("x-forwarded-for")
-        parts = [p.strip() for p in (xff or "").split(",") if p.strip()]
-        if parts:
-            return parts[-1]
-    return peer
-
-
 class InviteRequest(NamedTuple):
     """What an access request settled on.
 
@@ -631,6 +599,8 @@ async def logout(request: Request):
     out in one tab doesn't disturb another tab running a different account. If the account being
     removed was the session default, promote the most recent remaining account (or clear the
     session when none remain)."""
+    # A tab still pinned to an account already signed out in another tab resolves to nobody, so it
+    # signs nobody out — it used to fall back to the default and sign THAT account out in its place.
     active, is_default = resolved_user_id(request)
     remaining = [a for a in (request.session.get("account_ids") or []) if a != active]
     request.session["account_ids"] = remaining
@@ -672,7 +642,7 @@ async def request_access(
     email = (body.email or "").strip().lower()
     if not valid_email(email):
         raise HTTPException(status_code=400, detail="Enter a valid email address.")
-    if not _request_access_limiter.allow(_client_ip(request)):
+    if not _request_access_limiter.allow(client_key(request)):
         return {"status": "pending"}
     if is_allowed(db, email):
         return {"status": "pending"}  # already allowed — don't reveal it
@@ -689,7 +659,7 @@ def demo_login(body: EmailIn, request: Request, db: Session = Depends(get_db)) -
     so there is no visible 'demo login' button. Rate-limited per IP; when blocked it answers
     exactly like a non-match (authenticated=false) so the field can't be hammered as an
     enumeration oracle. On a match it sets the session and the client reloads into the app."""
-    if not _demo_limiter.allow(_client_ip(request)):
+    if not _demo_limiter.allow(client_key(request)):
         return {"authenticated": False}
     email = (body.email or "").strip().lower()
     if valid_email(email) and is_demo_allowed(db, email):
@@ -835,7 +805,7 @@ def register(
         )
     if not sysconfig.get_bool(db, "allow_registration"):
         raise HTTPException(status_code=403, detail="Registration is currently closed.")
-    if not _register_limiter.allow(_client_ip(request)):
+    if not _register_limiter.allow(client_key(request)):
         return {"status": "ok"}  # silently throttle; uniform response
 
     # Do the existence check + account creation OFF the response path (a background task with its own
@@ -1003,7 +973,7 @@ def verify_email_resend(
     and re-registering an already-registered email is a silent no-op, so a user who lost the first
     mail had no way back. Uniform response + timing regardless of whether the email has a pending
     account (the lookup runs off the response path), so it can't probe for registered emails."""
-    if not _verify_resend_limiter.allow(_client_ip(request)):
+    if not _verify_resend_limiter.allow(client_key(request)):
         return {"status": "ok"}  # silently throttle; uniform response
     email = (body.email or "").strip().lower()
     if valid_email(email):
@@ -1062,7 +1032,7 @@ def password_login(
     """Email+password sign-in. Wrong email/password give a single uniform 401 (no enumeration).
     Once the password is proven correct, the owner gets a specific reason if their account is
     still pending or suspended — that's not an enumeration leak (they already hold the password)."""
-    if not _login_limiter.allow(_client_ip(request)):
+    if not _login_limiter.allow(client_key(request)):
         raise _login_refused(429, "rate_limited")
     email = (body.email or "").strip().lower()
     password = body.password or ""
@@ -1093,7 +1063,7 @@ def password_reset_request(
 ) -> dict:
     """Request a password-reset link. Uniform response + timing regardless of whether the email has a
     password account (the lookup runs off the response path), so it can't probe for registered emails."""
-    if not _reset_limiter.allow(_client_ip(request)):
+    if not _reset_limiter.allow(client_key(request)):
         return {"status": "ok"}
     email = (body.email or "").strip().lower()
     # Do the account lookup + token issue + email OFF the response path (a background task with its
@@ -1142,7 +1112,7 @@ def password_reset_check(body: TokenIn, request: Request, db: Session = Depends(
     told `true`, never `false`: this check may only ever save a user a wasted form, so when it cannot
     answer it must degrade to the old behaviour instead of declaring a live link dead.
     """
-    if not _reset_check_limiter.allow(_client_ip(request)):
+    if not _reset_check_limiter.allow(client_key(request)):
         return {"ok": True}
     return {"ok": any(_peek_token(db, body.token, k) is not None for k in _PASSWORD_TOKEN_KINDS)}
 

backend/app/routes/downloads.py

@@ -107,6 +107,7 @@ def _serialize(job: DownloadJob, asset: MediaAsset | None) -> dict:
         "phase": job.phase,
         "error": job.error,
         "error_code": job.error_code,
+        "error_detail": job.error_detail,
         "queue_pos": job.queue_pos,
         "created_at": iso(job.created_at),
         "source_kind": job.source_kind,
@@ -172,6 +173,32 @@ def _own_job(db: Session, user: User, job_id: int) -> DownloadJob:
     return job
 
 
+def _own_job_for_update(db: Session, user: User, job_id: int) -> DownloadJob:
+    """`_own_job` for a transition that moves its asset's ref count (resume, cancel, delete, redownload)
+    or writes the status those decide on (pause). The job is re-read under a row lock, so two
+    overlapping requests for one job run one after the other and the second decides on the first's
+    committed result — never both releasing the same hold, and never a pause turning a job a cancel
+    just released back into a holder; either can free a file another job still holds.
+
+    The asset is locked BEFORE the job: the order a finishing worker child takes them in
+    (`service.finalize_if_running`), so the two can never deadlock."""
+    while True:
+        asset_id = _own_job(db, user, job_id).asset_id
+        if asset_id is not None:
+            db.execute(select(MediaAsset.id).where(MediaAsset.id == asset_id).with_for_update())
+        job = db.execute(
+            select(DownloadJob)
+            .where(DownloadJob.id == job_id)
+            .with_for_update()
+            .execution_options(populate_existing=True)
+        ).scalar_one_or_none()
+        if job is None:
+            raise HTTPException(status_code=404, detail="Unknown download")
+        if job.asset_id == asset_id:
+            return job
+        db.rollback()  # another request moved the job to another asset meanwhile: lock that one
+
+
 # --- profiles ------------------------------------------------------------------------------
 
 
@@ -605,7 +632,7 @@ def update_download_meta(
 def pause_download(
     job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
 ) -> dict:
-    job = _own_job(db, user, job_id)
+    job = _own_job_for_update(db, user, job_id)
     service.pause(db, job)
     return _serialize_job(db, job)
 
@@ -614,7 +641,7 @@ def pause_download(
 def resume_download(
     job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
 ) -> dict:
-    job = _own_job(db, user, job_id)
+    job = _own_job_for_update(db, user, job_id)
     service.resume(db, job)
     return _serialize_job(db, job)
 
@@ -629,12 +656,13 @@ def redownload_download(
     resolves to the newly-downloaded file — a re-download never breaks a link you already sent out
     (only a *failed* re-download leaves the job in `error`, which is the intended broken-link case).
 
-    The rebuild always re-fetches into a FRESH, private asset (the cache sig is salted with the job
-    id + current asset id) rather than the dedup pool. That means it (a) always genuinely rebuilds
+    The rebuild always re-fetches into a FRESH, private asset (the cache sig is salted with the new
+    asset's own id, and the user's cookie salt when one applies — `credentials.rebuild_salt`) rather
+    than the dedup pool. That means it (a) always genuinely rebuilds
     under the current format/naming rules — never silently reuses a shared cached file — and (b)
     never deletes a file another job/user still shares: the old asset is only removed if THIS job
     was its last holder."""
-    job = _own_job(db, user, job_id)
+    job = _own_job_for_update(db, user, job_id)
     if job.job_kind in ("edit", "upload"):
         # Neither has a re-fetchable source: an editor clip is derived locally, an upload IS the
         # source. Re-running yt-dlp against source_kind='upload'/'edit' would just fail.
@@ -649,7 +677,7 @@ def redownload_download(
 def cancel_download(
     job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
 ) -> dict:
-    job = _own_job(db, user, job_id)
+    job = _own_job_for_update(db, user, job_id)
     service.cancel(db, job)
     return _serialize_job(db, job)
 
@@ -658,7 +686,7 @@ def cancel_download(
 def delete_download(
     job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
 ) -> dict:
-    job = _own_job(db, user, job_id)
+    job = _own_job_for_update(db, user, job_id)
     service.delete(db, job)
     return {"deleted": job_id}
 

backend/app/routes/me.py

@@ -7,6 +7,7 @@ from app.auth import (
     count_admins,
     count_pending_activations,
     current_user,
+    drop_from_wallet,
     google_enabled,
     has_read_scope,
     has_write_scope,
@@ -65,24 +66,26 @@ def switch_account(
     target = body.user_id
     if target not in (request.session.get("account_ids") or []):
         raise HTTPException(status_code=403, detail="Not an account you've signed into here.")
+    # An account `_session_user` would refuse — gone, deactivated, suspended, or its session revoked — is
+    # refused here too, and dropped from the switch list the way `_session_user` drops it. Made the session
+    # default instead, the next request's current_user would refuse it as the DEFAULT and clear the whole
+    # wallet session, logging out every account here. (B-core-9)
     u = db.get(User, target)
     if u is None:
+        drop_from_wallet(request.session, target)
         raise HTTPException(status_code=404, detail="That account no longer exists.")
     if not is_allowed(db, u.email):
         raise HTTPException(status_code=403, detail="That account no longer has access.")
+    if not u.is_active:
+        drop_from_wallet(request.session, target)
+        raise HTTPException(status_code=403, detail="That account no longer has access.")
     if u.is_suspended:
-        # Don't make a suspended account the active one — the next request's current_user would
-        # see the suspension and clear the WHOLE wallet session, logging out every account here.
+        drop_from_wallet(request.session, target)
         raise HTTPException(status_code=403, detail="That account is suspended.")
-    # Same reasoning for a REVOKED session (a password reset/change or "log out everywhere" bumped the
-    # account's epoch): making it the session default would trip current_user's epoch check on the next
-    # request and clear the whole wallet. Mirror the suspend guard — drop the stale account from the
-    # switch list and refuse, rather than logging everyone out. (B-core-9)
+    # Revoked: a password reset/change or "log out everywhere" bumped the account's epoch.
     epochs = request.session.get("epochs") or {}
     if int(epochs.get(str(target), 0)) != (u.session_epoch or 0):
-        request.session["account_ids"] = [
-            a for a in (request.session.get("account_ids") or []) if a != target
-        ]
+        drop_from_wallet(request.session, target)
         raise HTTPException(
             status_code=403, detail="That account was signed out elsewhere — sign in again."
         )

backend/app/routes/messages.py

@@ -46,7 +46,7 @@ WELCOME = {
         "This is your private message inbox. Conversations with other members are end-to-end "
         "encrypted — only you and the person you're chatting with can read them, not even an "
         "admin. To start messaging someone, set up secure messaging with a passphrase first.\n\n"
-        "Enjoy your feed!"
+        "Enjoy your Feed!"
     ),
     "hu": (
         "Üdv a Siftlode-on! 👋\n\n"
@@ -423,9 +423,10 @@ async def messages_ws(ws: WebSocket) -> None:
     """Live push channel: authenticated by the session cookie, registers the connection so
     sent messages reach this user's open tabs instantly. We don't consume client→server frames
     (sending goes through POST /api/messages); the receive loop only detects disconnect."""
-    # Which signed-in account this socket acts as — the SHARED per-tab resolution (wallet-gated
-    # ?account= override, session default otherwise). A browser WebSocket can't send the
-    # X-Siftlode-Account header, so resolved_user_id falls through to the ?account= query param.
+    # Which signed-in account this socket acts as — the SHARED per-tab resolution (a wallet-gated
+    # ?account=, the session default when none is named, nobody for an account no longer signed in
+    # here). A browser WebSocket can't send the X-Siftlode-Account header, so resolved_user_id falls
+    # through to the ?account= query param.
     uid, _ = resolved_user_id(ws)
     if not uid:
         await ws.close(code=1008)

backend/app/routes/public.py

@@ -6,7 +6,7 @@ the app or any account data. Password-protected links exchange the password once
 a short-lived signed grant that the media URL carries (a `<video src>` can't send a header).
 """
 
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.responses import FileResponse
 from pydantic import BaseModel
 from sqlalchemy import select
@@ -17,13 +17,21 @@ from app.db import get_db
 from app.downloads import links as linksmod
 from app.downloads import storage
 from app.models import DownloadJob, DownloadLink, MediaAsset
-from app.ratelimit import RateLimiter
+from app.ratelimit import RateLimiter, client_key
 from app.security import verify_password
 
 router = APIRouter(prefix="/api/public", tags=["public"])
 
-# Slow password guessing per link (the token itself is 192-bit, so it needs no throttle).
+# Slow password guessing on a link (the token itself is 192-bit, so it needs no throttle). Counted per
+# viewer — the link AND the client (`client_key`) — so a client guessing wrong shuts out only itself, and a
+# busy link's own unlocks don't count against its next viewer.
 _unlock_limit = RateLimiter(max_events=10, window_seconds=300)
+# ...under a ceiling on WRONG passwords for the link from every client together, so guessing spread over
+# many addresses stays slow too; unlocking with the password never adds to it. The price of the ceiling:
+# someone with the link but not its password, guessing from 50 / 10 = 5 networks, can keep the link shut
+# for everyone until the window passes. It is checked before the password and counted after it, so guesses
+# already running when it fills are still checked — as many as the route's threadpool runs at once.
+_unlock_failures = RateLimiter(max_events=50, window_seconds=300)
 
 
 def _link_or_404(db: Session, token: str) -> DownloadLink:
@@ -83,11 +91,16 @@ class WatchUnlockIn(BaseModel):
 
 
 @router.post("/watch/{token}/unlock")
-def watch_unlock(token: str, body: WatchUnlockIn, db: Session = Depends(get_db)) -> dict:
+def watch_unlock(
+    token: str, body: WatchUnlockIn, request: Request, db: Session = Depends(get_db)
+) -> dict:
     """Exchange the link password for a signed grant carried by the media URL."""
-    if not _unlock_limit.allow(token):
-        raise HTTPException(status_code=429, detail="Too many attempts. Try again later.")
+    # The link first: a token naming none must leave no limiter entry behind, or posting made-up tokens
+    # would grow the limiter without bound.
     link = _link_or_404(db, token)
+    viewer = f"{token}|{client_key(request)}"
+    if _unlock_failures.exhausted(token) or not _unlock_limit.allow(viewer):
+        raise HTTPException(status_code=429, detail="Too many attempts. Try again later.")
     if not link.password_hash:
         # Not a password link — nothing to unlock; just hand back the plain meta.
         job, asset = _ready_target(db, link)
@@ -96,6 +109,7 @@ def watch_unlock(token: str, body: WatchUnlockIn, db: Session = Depends(get_db))
             **linksmod.public_meta(link, job, asset, _file_url(token), _poster_url(token, asset)),
         }
     if not verify_password(body.password, link.password_hash):
+        _unlock_failures.allow(token)
         raise HTTPException(status_code=403, detail="Wrong password.")
     job, asset = _ready_target(db, link)
     link.view_count += 1

backend/app/worker.py

@@ -32,12 +32,12 @@ from app import sysconfig
 from app.config import settings
 from app.db import SessionLocal
 from app.downloads import edit as editmod
-from app.downloads import quota, service
+from app.downloads import credentials, formats, quota, service
+from app.downloads import errors as dlerrors
 from app.downloads.jobdb import (
     _edit_staging_dir,
     _requeue_if_running,
     _reset_asset_pending,
-    _set_job,
     _staging_dir,
 )
 from app.downloads.status import STOPPED_BY_ROUTE, JobStatus
@@ -253,7 +253,27 @@ def _fail_after_kill(
     """`_stop_and_free` + mark the job errored — for the watchdog's stall/timeout kills and the
     supervisor-error fallback."""
     _stop_and_free(job_id, asset_id, proc, grace_s)
-    _set_job(job_id, status="error", error=error, error_code=error_code, phase=None)
+    _fail_running(job_id, error=error, error_code=error_code)
+
+
+def _fail_running(
+    job_id: int, *, error: str, error_code: str | None, error_detail: str | None = None
+) -> None:
+    """Fail a claimed job — only while it is still `running` (`service.finalize_if_running`), so a
+    cancel/pause a route landed first is never turned back into `error`, which holds the asset the
+    route already released. `error_detail` is written every time: a failure never shows an earlier
+    failure's explanation."""
+    with SessionLocal() as db:
+        service.finalize_if_running(
+            db,
+            job_id,
+            status=JobStatus.ERROR,
+            error=error,
+            error_code=error_code,
+            error_detail=error_detail,
+            phase=None,
+        )
+        db.commit()
 
 
 def _run_supervised(job_id: int, asset_id: int) -> None:
@@ -329,12 +349,10 @@ def _run_supervised(job_id: int, asset_id: int) -> None:
                 status, _ = _job_liveness(job_id)
                 if status == "running":
                     _cleanup_staging(asset_id)
-                    _set_job(
+                    _fail_running(
                         job_id,
-                        status="error",
-                        error_code="unknown",
-                        phase=None,
                         error=f"The download process exited unexpectedly (code {proc.returncode}).",
+                        error_code="unknown",
                     )
                     log.warning(
                         "job %s: child exited %s without finishing", job_id, proc.returncode
@@ -399,16 +417,32 @@ def _process_job(job_id: int) -> None:
         asset_id = asset.id if asset else None
         asset_status = asset.status if asset else None
         asset_error = asset.error if asset else None
+        if asset_status == "error":
+            # A job that meets an already-failed asset gets that failure's explanation — not a bare
+            # "Download failed". Only the text is on the asset, so it is diagnosed again, for this
+            # link, with whether a cookie goes with it asked of the same gate the download child
+            # used (`credentials.usable_cookie`) — as it stands now, so the advice fits this job's Retry.
+            url = service.source_url(job.source_kind, job.source_ref)
+            cookie = credentials.usable_cookie(
+                db, job.user_id, url, asset, formats.normalize(job.profile_snapshot)
+            )
+            diagnosis = dlerrors.diagnose(asset_error, url=url, cookie_attached=cookie is not None)
+            del cookie  # only whether there is one matters here
 
     if asset is None:
-        _set_job(job_id, status="error", error="No media asset", phase=None)
+        _fail_running(job_id, error="No media asset", error_code=None)
         return
 
     if asset_status == "ready":
         _finish_from_cache(job_id, asset_id)
         return
     if asset_status == "error":
-        _set_job(job_id, status="error", error=asset_error or "Download failed", phase=None)
+        _fail_running(
+            job_id,
+            error=asset_error or "Download failed",
+            error_code=diagnosis.code,
+            error_detail=diagnosis.detail,
+        )
         return
     if asset_status == "downloading":
         # Another worker won this asset between our claim and here (a narrow race — the claim SQL
@@ -461,7 +495,7 @@ def _worker_loop(idx: int) -> None:
             _process_job(job_id)
         except Exception:  # noqa: BLE001
             log.exception("processing job %s crashed", job_id)
-            _set_job(job_id, status="error", error="Worker error", phase=None)
+            _fail_running(job_id, error="Worker error", error_code=None)
 
 
 def main() -> None:

backend/entrypoint.sh

@@ -11,7 +11,7 @@ echo "Starting Siftlode API..."
 # on the next request -> 502. Non-idempotent POSTs (the player's progress/state writes,
 # fired every 5s) can't be auto-retried by the proxy, so those 502s reached the user.
 #
-# SECURITY: do NOT add --proxy-headers / --forwarded-allow-ips here. auth._client_ip trusts
+# SECURITY: do NOT add --proxy-headers / --forwarded-allow-ips here. ratelimit.client_key trusts
 # X-Forwarded-For only when the TRUE socket peer is a configured proxy (TRUSTED_PROXY_IPS); those
 # flags would make uvicorn overwrite request.client from the forgeable XFF, defeating that check and
 # reopening the rate-limit bypass (SA3).

backend/requirements.lock

@@ -7,6 +7,7 @@ Authlib==1.7.2
 Mako==1.4.1
 MarkupSafe==3.0.3
 PyYAML==6.0.3
+Pygments==2.21.0
 SQLAlchemy==2.0.52
 alembic==1.19.1
 annotated-doc==0.0.5
@@ -21,6 +22,7 @@ cffi==2.1.1
 charset-normalizer==3.5.1
 click==8.4.2
 cryptography==50.0.0
+curl_cffi==0.15.0
 fastapi==0.141.1
 feedparser-sgmllib==2.1.0
 feedparser==6.0.14
@@ -32,6 +34,8 @@ httpx==0.28.1
 idna==3.18
 itsdangerous==2.2.0
 joserfc==1.7.4
+markdown-it-py==4.2.0
+mdurl==0.1.2
 mutagen==1.48.1
 numpy==2.5.2
 psycopg-binary==3.3.4
@@ -45,6 +49,7 @@ pydantic_core==2.46.4
 python-dotenv==1.2.3
 python-multipart==0.0.32
 requests==2.34.2
+rich==15.0.0
 starlette==1.6.0
 typing-inspection==0.4.4
 typing_extensions==4.16.0

backend/requirements.txt

@@ -21,6 +21,13 @@ argon2-cffi>=23.1,<26
 # scripts Deno runs for YouTube's n-signature). yt-dlp is release-often (YouTube changes), so
 # keep the floor loose and bump it when extraction breaks.
 yt-dlp[default]>=2025.5.22
+# Browser impersonation (`impersonate`) for Facebook downloads made with the user's cookie: some
+# links answer a signed-in plain request with "Cannot parse data" and only parse as Chrome (E11.5,
+# measured). The range is YT-DLP's, not ours — yt-dlp 2026.07.04 imports curl_cffi only in
+# 0.10.x–0.15.x and silently reports every target "unavailable" outside it. Move it when bumping
+# yt-dlp; `tests/test_facebook_impersonation.py::test_the_locked_curl_cffi_can_impersonate_chrome`
+# fails the gate if the locked pair can no longer impersonate.
+curl_cffi>=0.10,<0.16
 # PO Token provider plugin: talks to the bgutil sidecar (brainicism/bgutil-ytdlp-pot-provider)
 # to mint YouTube Proof-of-Origin tokens on demand, bypassing "confirm you're not a bot" and
 # unlocking high-quality formats. Pin to match the sidecar image tag (versions must align).

backend/tests/test_adapters.py

@@ -1,6 +1,7 @@
 """Per-source adapter selection + the source-specific policy each one carries. These lock the
 behaviour that used to live inline in worker.build_uploader_url / backfill._should_refetch."""
 
+from app.titles import normalize_title
 from app.downloads.adapters import (
     FacebookAdapter,
     RedditAdapter,
@@ -103,12 +104,21 @@ def test_generic_source_url_is_passthrough_youtube_reconstructs():
     )
 
 
-def test_client_sets_and_retriable_are_youtube_only():
+def test_client_sets_and_retriable_are_per_source():
     # Generic sources make a single attempt and never retry on the YouTube per-client markers.
     assert SourceAdapter().client_sets() == [None]
+    assert SourceAdapter().client_sets(authed=True) == [None]
     assert SourceAdapter().retriable("Sign in to confirm you're not a bot") is False
     assert YouTubeAdapter().retriable("Sign in to confirm you're not a bot") is True
     assert YouTubeAdapter().retriable("some unrelated network blip") is False
+    # Facebook: a second, Chrome-impersonating attempt only WITH the user's cookie, and only behind
+    # the parse wall (without a cookie that wall is the login wall — no disguise gets past it).
+    fb = FacebookAdapter()
+    assert fb.client_sets() == [None]
+    assert len(fb.client_sets(authed=True)) == 2
+    assert fb.ydl_opts_extra(fb.client_sets(authed=True)[0]) == {}
+    assert fb.retriable("ERROR: [facebook] 1: Cannot parse data; please report this issue") is True
+    assert fb.retriable("ERROR: [facebook] 1: No video formats found!") is False
 
 
 def test_youtube_ydl_opts_extra_carries_player_client_and_pot():
@@ -130,3 +140,28 @@ def test_wants_metadata_backfill_matches_old_should_refetch():
 def test_nfo_uniqueid_type_is_the_adapter_key():
     assert YouTubeAdapter().nfo_uniqueid_type() == "youtube"
     assert SourceAdapter().nfo_uniqueid_type() == "generic"
+
+
+def test_title_is_yt_dlps_for_a_source_without_placeholders():
+    assert SourceAdapter().title({"title": "Video", "description": "text"}) == "Video"
+    assert SourceAdapter().title({}) is None
+
+
+def test_facebook_placeholder_title_takes_the_posts_text():
+    # Measured: signed in, yt-dlp titles every reel "Video" (an 18+ reel read as Chrome: "Facebook"),
+    # while the post's text is still in the description.
+    a = FacebookAdapter()
+    info = {"title": "Video", "description": "\n  Tune of The Day\nsecond line"}
+    assert a.title(info) == "Tune of The Day"
+    assert a.title({**info, "title": "Facebook"}) == "Tune of The Day"
+    # A real title (signed out) is left for normalize_title, engagement prefix and all.
+    assert a.title({**info, "title": "456K views | Tune"}) == "456K views | Tune"
+    # Nothing better on the page: keep what yt-dlp gave.
+    assert a.title({"title": "Facebook", "description": None}) == "Facebook"
+
+
+def test_facebook_title_from_a_long_description_is_the_whole_line_after_cleaning():
+    # Dev UAT: a cut with "…" came out of normalize_title as "… live at." (NFKC "..." collapsed to "."),
+    # a sentence that seemed to end. The whole first line survives the cleaning intact instead.
+    line = 'Tune of The Day, Argy playing his version of the classic "Resurrection" with Paul Oakenfold live at Space'
+    assert normalize_title(FacebookAdapter().title({"title": "Video", "description": line})) == line

backend/tests/test_auth_session.py

@@ -12,6 +12,7 @@ Note: `/api/me` is the bootstrap probe — it returns 200 `{authenticated: False
 
 from datetime import timedelta
 
+import pytest
 from fastapi.testclient import TestClient
 
 from app.auth import ACTIVE_ACCOUNT_HEADER
@@ -57,6 +58,75 @@ def test_a_non_wallet_account_header_falls_back_to_the_default(client, make_user
     assert me.json()["email"] == "alice2@example.com"  # still Alice, not Mallory
 
 
+def test_a_tab_pinned_to_an_account_signed_out_elsewhere_acts_as_nobody(client, make_user):
+    # Two accounts in one browser: a tab pinned to Alice, Bob the default. Alice signs out in another
+    # tab. The pinned tab used to go on acting as the default, Bob — its player checkpoints and pref
+    # saves landed in his account, and its own Sign out signed HIM out.
+    alice = make_user(email="alice3@example.com", password=_PW)
+    make_user(email="bob3@example.com", password=_PW)
+    assert _login(client, "alice3@example.com", _PW).status_code == 200
+    assert _login(client, "bob3@example.com", _PW).status_code == 200  # Bob is now the default
+    tab = {ACTIVE_ACCOUNT_HEADER: str(alice.id)}
+    assert client.get("/api/feed", headers=tab).status_code == 200
+    assert client.post("/auth/logout", headers=tab).status_code == 200  # Alice signs out
+
+    assert client.get("/api/feed", headers=tab).status_code == 401
+    assert client.post("/auth/logout", headers=tab).status_code == 200
+    assert client.get("/api/feed").status_code == 200  # Bob is still signed in, the session intact
+    # The bootstrap probe still answers as the default: how the stale tab learns who it is now.
+    assert client.get("/api/me", headers=tab).json()["email"] == "bob3@example.com"
+
+
+@pytest.mark.parametrize("ended", ["revoked", "suspended"])
+def test_a_tab_pinned_to_an_account_whose_session_ended_comes_back_as_the_default(
+    client, make_user, db, ended
+):
+    # A tab pinned to Alice, Bob the default. Alice's session then ends while she is still in this
+    # browser's wallet ("log out everywhere" on another device, or an admin suspends her). The tab's
+    # bootstrap probe used to answer "signed out": the landing page with Bob still signed in, and no way
+    # off it but closing the tab (signing in as anyone else there kept the tab pinned to Alice).
+    alice = make_user(email="alice4@example.com", password=_PW)
+    make_user(email="bob4@example.com", password=_PW)
+    assert _login(client, "alice4@example.com", _PW).status_code == 200
+    assert _login(client, "bob4@example.com", _PW).status_code == 200
+    tab = {ACTIVE_ACCOUNT_HEADER: str(alice.id)}
+    assert client.get("/api/feed", headers=tab).status_code == 200
+    if ended == "revoked":
+        alice.session_epoch = (alice.session_epoch or 0) + 1
+    else:
+        alice.is_suspended = True
+    db.commit()
+
+    assert client.get("/api/me", headers=tab).json()["email"] == "bob4@example.com"
+    assert client.get("/api/feed", headers=tab).status_code == 401  # still nobody, never Bob
+    assert client.get("/api/feed").status_code == 200  # Bob's session is intact
+
+
+@pytest.mark.parametrize("ended", ["revoked", "suspended", "deactivated"])
+def test_switching_to_an_account_whose_session_ended_refuses_it_and_drops_it_from_the_list(
+    client, make_user, db, monkeypatch, ended
+):
+    # The account switcher lists this browser's wallet. A revoked account was dropped from it on a refused
+    # switch, but a suspended one stayed, refused on every click; a deactivated one was not refused at all —
+    # made the default, the next request found it inactive and signed every account here out.
+    monkeypatch.setattr("app.routes.me.is_allowed", lambda _db, _email: True)  # both hold an invite
+    alice = make_user(email="alice5@example.com", password=_PW)
+    make_user(email="bob5@example.com", password=_PW)
+    assert _login(client, "alice5@example.com", _PW).status_code == 200
+    assert _login(client, "bob5@example.com", _PW).status_code == 200
+    if ended == "revoked":
+        alice.session_epoch = (alice.session_epoch or 0) + 1
+    elif ended == "suspended":
+        alice.is_suspended = True
+    else:
+        alice.is_active = False
+    db.commit()
+
+    assert client.post("/api/me/switch", json={"user_id": alice.id}).status_code == 403
+    assert [a["email"] for a in client.get("/api/me/accounts").json()] == ["bob5@example.com"]
+    assert client.get("/api/feed").status_code == 200  # Bob is still signed in
+
+
 def test_logout_others_revokes_the_other_session_but_keeps_the_caller(client, make_user):
     # Two independent cookie jars (browsers) signed into the same account. `logout-others` from one
     # bumps the account epoch so the OTHER's cookie is rejected on its next request, while the caller

backend/tests/test_download_credentials.py

@@ -18,7 +18,7 @@ from cryptography.fernet import Fernet
 
 from app import security
 from app.downloads import credentials, formats, service
-from app.models import DownloadCredential, MediaAsset, User
+from app.models import DownloadCredential, DownloadJob, MediaAsset, User
 
 
 @pytest.fixture(autouse=True)
@@ -72,6 +72,21 @@ def test_authed_sig_differs_per_user_and_from_the_shared_sig():
     assert a != shared and b != shared and a != b
 
 
+def test_an_authed_asset_queued_before_a_signature_version_bump_still_gets_its_cookie(monkeypatch):
+    # A job keeps the asset it was queued with. A deploy that bumps the signature version between the
+    # queueing and the download used to make the user's private asset stop counting as theirs, so the
+    # download went without its cookie and failed on the login wall.
+    spec = formats.normalize({"mode": "a"})
+    queued = MediaAsset(format_sig=credentials.authed_format_sig(spec, 1, "facebook"))
+    rebuild = credentials.rebuild_salt(7, credentials.cookie_salt(1, "facebook"))
+    rebuilt = MediaAsset(id=7, format_sig=formats.format_sig(spec, salt=rebuild))
+    monkeypatch.setattr(formats, "_AUDIO_SIG_VERSION", formats._AUDIO_SIG_VERSION + 1)  # the deploy
+
+    for asset in (queued, rebuilt):
+        assert credentials.is_authed_asset(asset, spec, 1, FB_URL)
+        assert not credentials.is_authed_asset(asset, spec, 2, FB_URL)  # still private to its user
+
+
 def test_write_cookiefile_is_private_and_survives_the_retry_wipe(tmp_path):
     staging = tmp_path / "staging"
     staging.mkdir()
@@ -189,7 +204,9 @@ class TestResolveCookiefile:
         db.commit()
         spec = formats.normalize({})
         salted = credentials.authed_format_sig(spec, u.id, "facebook")
-        path = credentials.resolve_cookiefile(db, u.id, FB_URL, salted, spec, tmp_path)
+        path = credentials.resolve_cookiefile(
+            db, u.id, FB_URL, self._asset_sig(salted), spec, tmp_path
+        )
         assert path is not None and Path(path).read_text() == COOKIES
 
     def test_never_attaches_to_a_shared_asset(self, db, tmp_path):
@@ -200,7 +217,12 @@ class TestResolveCookiefile:
         db.commit()
         spec = formats.normalize({})
         shared = formats.format_sig(spec)
-        assert credentials.resolve_cookiefile(db, u.id, FB_URL, shared, spec, tmp_path) is None
+        assert (
+            credentials.resolve_cookiefile(
+                db, u.id, FB_URL, self._asset_sig(shared), spec, tmp_path
+            )
+            is None
+        )
 
     def test_non_matching_host_gets_no_cookie(self, db, tmp_path):
         u = _user(db)
@@ -210,13 +232,154 @@ class TestResolveCookiefile:
         # A YouTube URL has no supported host_key -> no cookie regardless of what's stored.
         yt = "https://www.youtube.com/watch?v=abc"
         salted = credentials.authed_format_sig(spec, u.id, "facebook")
-        assert credentials.resolve_cookiefile(db, u.id, yt, salted, spec, tmp_path) is None
+        assert (
+            credentials.resolve_cookiefile(db, u.id, yt, self._asset_sig(salted), spec, tmp_path)
+            is None
+        )
 
     def test_no_credential_gets_no_cookie(self, db, tmp_path):
         u = _user(db)
         spec = formats.normalize({})
         salted = credentials.authed_format_sig(spec, u.id, "facebook")
-        assert credentials.resolve_cookiefile(db, u.id, FB_URL, salted, spec, tmp_path) is None
+        assert (
+            credentials.resolve_cookiefile(
+                db, u.id, FB_URL, self._asset_sig(salted), spec, tmp_path
+            )
+            is None
+        )
+
+
+# --- Retry / Re-download take a cookie added later (DB) -----------------------------------------
+# Measured on dev (E11.5): a Facebook reel failed on the login wall, the user added their cookie as
+# the failure copy tells them to, pressed Retry — and it failed again, because the job still held the
+# shared asset the worker never attaches a cookie to. Re-download forked a salt the gate could not
+# recognise, so even a job downloaded WITH a cookie rebuilt without it.
+
+
+def _held_job(db, u, *, sig, asset_status="error", job_status="error"):
+    a = MediaAsset(
+        source_kind="url", source_ref=FB_URL, format_sig=sig, status=asset_status, ref_count=1
+    )
+    db.add(a)
+    db.flush()
+    j = DownloadJob(
+        user_id=u.id,
+        asset_id=a.id,
+        source_kind="url",
+        source_ref=FB_URL,
+        status=job_status,
+        queue_pos=0,
+        profile_snapshot={},
+    )
+    db.add(j)
+    db.commit()
+    return a, j
+
+
+class TestRequeueTakesTheCookie:
+    spec = formats.normalize({})
+
+    @pytest.mark.parametrize(
+        ("asset_status", "job_status"),
+        # A failed download; and a job paused before it ever started (its asset never downloaded).
+        [("error", "error"), ("pending", "paused")],
+    )
+    def test_retry_after_adding_a_cookie_moves_the_job_to_the_private_asset(
+        self, db, tmp_path, asset_status, job_status
+    ):
+        u = _user(db)
+        shared, j = _held_job(
+            db,
+            u,
+            sig=formats.format_sig(self.spec),
+            asset_status=asset_status,
+            job_status=job_status,
+        )
+        credentials.upsert_credential(db, u.id, "facebook", COOKIES)
+        db.commit()
+
+        service.resume(db, j)
+
+        db.expire_all()
+        job = db.get(DownloadJob, j.id)
+        target = db.get(MediaAsset, job.asset_id)
+        assert job.status == "queued" and target.id != shared.id
+        assert target.format_sig == credentials.authed_format_sig(self.spec, u.id, "facebook")
+        assert (target.status, target.ref_count) == ("pending", 1)
+        assert db.get(MediaAsset, shared.id).ref_count == 0  # the old hold went with the move
+        assert credentials.resolve_cookiefile(db, u.id, FB_URL, target, self.spec, tmp_path)
+
+    def test_retry_without_a_cookie_keeps_the_shared_asset(self, db):
+        u = _user(db)
+        shared, j = _held_job(db, u, sig=formats.format_sig(self.spec))
+
+        service.resume(db, j)
+
+        db.expire_all()
+        assert db.get(DownloadJob, j.id).asset_id == shared.id
+        assert db.get(MediaAsset, shared.id).ref_count == 1
+
+    @pytest.mark.parametrize(
+        ("asset_status", "job_status"), [("ready", "error"), ("downloading", "paused")]
+    )
+    def test_retry_never_moves_off_a_file_or_a_download_in_flight(
+        self, db, asset_status, job_status
+    ):
+        u = _user(db)
+        shared, j = _held_job(
+            db,
+            u,
+            sig=formats.format_sig(self.spec),
+            asset_status=asset_status,
+            job_status=job_status,
+        )
+        credentials.upsert_credential(db, u.id, "facebook", COOKIES)
+        db.commit()
+
+        service.resume(db, j)
+
+        db.expire_all()
+        assert db.get(DownloadJob, j.id).asset_id == shared.id
+
+    def test_redownload_with_a_cookie_rebuilds_into_an_asset_the_cookie_goes_with(
+        self, db, tmp_path
+    ):
+        u = _user(db)
+        other = _user(db, "other@example.com")
+        credentials.upsert_credential(db, u.id, "facebook", COOKIES)
+        credentials.upsert_credential(db, other.id, "facebook", COOKIES)
+        authed = credentials.authed_format_sig(self.spec, u.id, "facebook")
+        first, j = _held_job(db, u, sig=authed, asset_status="ready", job_status="done")
+
+        seen = {first.id}
+        for _ in range(2):  # a rebuild of a rebuild is still recognised
+            service.redownload(db, j)
+            db.expire_all()
+            job = db.get(DownloadJob, j.id)
+            target = db.get(MediaAsset, job.asset_id)
+            assert target.id not in seen and target.format_sig != authed
+            seen.add(target.id)
+            assert credentials.resolve_cookiefile(db, u.id, FB_URL, target, self.spec, tmp_path)
+            # Private: another user's cookie is never attached to it.
+            assert not credentials.is_authed_asset(target, self.spec, other.id, FB_URL)
+
+        # A Retry of a failed rebuild keeps the rebuild — it is already the cookie's identity.
+        target.status, job.status = "error", "error"
+        db.commit()
+        service.resume(db, job)
+        db.expire_all()
+        assert db.get(DownloadJob, j.id).asset_id == target.id
+
+    def test_a_rebuild_made_without_a_cookie_is_no_cookie_identity(self, db, tmp_path):
+        u = _user(db)
+        _, j = _held_job(db, u, sig=formats.format_sig(self.spec))
+        service.redownload(db, j)
+        credentials.upsert_credential(db, u.id, "facebook", COOKIES)
+        db.commit()
+
+        db.expire_all()
+        target = db.get(MediaAsset, db.get(DownloadJob, j.id).asset_id)
+        assert not credentials.is_authed_asset(target, self.spec, u.id, FB_URL)
 
 
 # --- API: write-only, never echoes the blob (DB) ----------------------------------------------

backend/tests/test_download_errors.py

@@ -1,5 +1,6 @@
 """Category classification of raw yt-dlp / ffmpeg download-failure strings (S2)."""
 
+from app.downloads import adapters
 from app.downloads import errors as dlerrors
 from app.downloads.errors import classify
 
@@ -64,6 +65,98 @@ def test_our_own_worker_refusals_classify_as_themselves():
     assert classify(dlerrors.QUOTA_FULL_MESSAGE) == "quota_exceeded"
 
 
+def test_the_redacted_network_text_classifies_back_to_network():
+    # The redacted text is also what a failed asset keeps, and a second job that meets that asset is
+    # diagnosed from it — without its own rule it would read "Download failed".
+    assert classify(dlerrors.NETWORK_REDACTED_MESSAGE) == "network"
+
+
+# Verbatim yt-dlp 2026.07.04 output from prod jobs, measured on dev 2026-09-13 (E11.5).
+_FB_PARSE = (
+    "ERROR: [facebook] 1736360027626346: Cannot parse data; please report this issue on  "
+    "https://github.com/yt-dlp/yt-dlp/issues?q= , filling out the appropriate issue template."
+)
+_FB_NO_FORMATS = (
+    "ERROR: [facebook] 1755988225525547: No video formats found!; please report this issue on  "
+    "https://github.com/yt-dlp/yt-dlp/issues?q= , filling out the appropriate issue template."
+)
+_REEL = "https://www.facebook.com/reel/1736360027626346/?fs=e&fs=e"
+_GROUP_POST = "https://www.facebook.com/groups/983554479435596/permalink/1755988225525547/?"
+
+
+def test_facebook_cannot_parse_data_is_the_login_wall_without_a_cookie():
+    for url in (
+        _REEL,
+        _GROUP_POST,
+        "https://fb.watch/Ia_iJYI2Vw/?fs=e",
+        "https://m.facebook.com/x",
+    ):
+        assert dlerrors.diagnose(_FB_PARSE, url=url) == ("login_required", "facebook.login_wall")
+
+
+def test_facebook_cannot_parse_data_with_a_cookie_is_the_cookie_refused():
+    # Telling a user who already gave a cookie to add one is the failure this entry exists to avoid.
+    assert dlerrors.diagnose(_FB_PARSE, url=_REEL, cookie_attached=True) == (
+        "login_required",
+        "facebook.cookie_rejected",
+    )
+
+
+def test_a_facebook_group_post_without_formats_names_the_link():
+    # Without a cookie yt-dlp is given the post link itself (measured, prod jobs 66 and 145).
+    assert dlerrors.diagnose(_FB_NO_FORMATS, url=_GROUP_POST) == (
+        "format_unavailable",
+        "facebook.group_post_video",
+    )
+    # With one it is only ever given the post's VIDEO link, so the text is about that video: the adapter
+    # found it, and "this post has no video" would be false.
+    assert dlerrors.diagnose(_FB_NO_FORMATS, url=_GROUP_POST, cookie_attached=True) == (
+        "format_unavailable",
+        None,
+    )
+    # A reel, or a group link that is not a post, is another failure: only the category.
+    for url in (_REEL, "https://www.facebook.com/groups/983554479435596/"):
+        assert dlerrors.diagnose(_FB_NO_FORMATS, url=url) == ("format_unavailable", None), url
+
+
+def test_our_post_not_shown_verdict_is_the_refused_cookie():
+    # The adapter's text when a signed-in read of the post got a page without the post (the login page).
+    msg = adapters.POST_NOT_SHOWN_MESSAGE
+    assert classify(msg) == "login_required"
+    assert dlerrors.diagnose(msg, url=_GROUP_POST, cookie_attached=True) == (
+        "login_required",
+        "facebook.cookie_rejected",
+    )
+
+
+def test_our_post_without_a_video_verdict_names_the_group_link():
+    # The adapter's own text when the post page holds no single video (S4): the message and its rule and
+    # catalog entry are pinned together, or an edit to the wording orphans the copy.
+    msg = adapters.POST_WITHOUT_VIDEO_MESSAGE
+    assert classify(msg) == "format_unavailable"
+    assert dlerrors.diagnose(msg, url=_GROUP_POST, cookie_attached=True) == (
+        "format_unavailable",
+        "facebook.group_post_video",
+    )
+    assert dlerrors.diagnose(msg, url=_REEL, cookie_attached=True) == ("format_unavailable", None)
+
+
+def test_a_catalog_entry_never_leaves_its_host():
+    # "Cannot parse data" is yt-dlp's wording for a broken extractor on every site.
+    other = _FB_PARSE.replace("[facebook]", "[vimeo]")
+    assert dlerrors.diagnose(other, url="https://vimeo.com/1") == ("unknown", None)
+    # The Facebook text for a link that is not Facebook's (a look-alike host) is not the Facebook wall.
+    assert dlerrors.diagnose(_FB_PARSE, url="https://facebook.com.evil/reel/1") == ("unknown", None)
+    # No link known: the category only.
+    assert dlerrors.diagnose(_FB_PARSE) == ("unknown", None)
+
+
+def test_diagnose_falls_back_to_the_category():
+    msg = "ERROR: [facebook] 123: You must be logged in to see this post"
+    assert dlerrors.diagnose(msg, url=_REEL) == ("login_required", None)
+    assert dlerrors.diagnose(None, url=_REEL) == ("unknown", None)
+
+
 def test_a_url_jobs_network_failure_is_redacted_but_youtube_keeps_its_text():
     # SEC-12: the raw transport text for a user-chosen host:port is a port-scanner readout, so it is
     # replaced for `url` jobs. Everything else must survive verbatim, or a real diagnosis is lost.

backend/tests/test_download_failure_catalog.py

@@ -0,0 +1,444 @@
+"""DB-backed tests for the download failure catalog (E11.5 S1) at the places a failure is WRITTEN.
+
+`test_download_errors` pins which entry a message matches; these pin that every writer hands the
+matcher what it needs — the link and whether the user's cookie went with it — and that a stored entry
+never outlives the failure it describes:
+- the download child's failure branch (`pipeline._download`);
+- a second job meeting an already-failed asset (`worker._process_job`), which only has the text;
+- Retry / Re-download, which requeue the job;
+- the `0084` backfill of the rows that failed before the catalog existed;
+- the downloads list, which is how the entry reaches the UI.
+It also holds the one success-path check of the same child: the duration it stores (E11.5 S3).
+"""
+
+import shutil
+import subprocess
+
+import pytest
+from alembic import command
+from alembic.config import Config
+from cryptography.fernet import Fernet
+from sqlalchemy import text
+
+from app import security
+from app.config import settings
+from app.db import engine
+from app.downloads import credentials, formats, pipeline, service
+from app.models import DownloadJob, DownloadQuota, MediaAsset, User
+from app.worker import _process_job
+
+_REEL = "https://www.facebook.com/reel/1736360027626346/?fs=e&fs=e"
+# Verbatim yt-dlp 2026.07.04, prod job 256.
+_FB_PARSE = (
+    "ERROR: [facebook] 1736360027626346: Cannot parse data; please report this issue on  "
+    "https://github.com/yt-dlp/yt-dlp/issues?q= , filling out the appropriate issue template."
+)
+_COOKIES = "# Netscape HTTP Cookie File\n.facebook.com\tTRUE\t/\tTRUE\t0\tc_user\t123\n"
+
+
+@pytest.fixture
+def _fernet(monkeypatch):
+    # A throwaway key, so a stored credential encrypts and decrypts (mirrors test_download_credentials).
+    monkeypatch.setattr(security, "_fernet", Fernet(Fernet.generate_key()))
+
+
+def _user(db, email):
+    u = User(email=email)
+    db.add(u)
+    db.flush()
+    db.add(
+        DownloadQuota(
+            user_id=u.id, max_bytes=10**12, max_concurrent=5, max_jobs=10**6, unlimited=True
+        )
+    )
+    return u
+
+
+def _asset_and_job(db, user, *, sig, asset_status, job_status, error=None):
+    a = MediaAsset(
+        source_kind="url",
+        source_ref=_REEL,
+        format_sig=sig,
+        status=asset_status,
+        error=error,
+        ref_count=1,
+    )
+    db.add(a)
+    db.flush()
+    j = DownloadJob(
+        user_id=user.id,
+        asset_id=a.id,
+        source_kind="url",
+        source_ref=_REEL,
+        status=job_status,
+        queue_pos=0,
+        profile_snapshot={},
+    )
+    db.add(j)
+    db.commit()
+    return a, j
+
+
+def _fail_the_child(monkeypatch, tmp_path, *, cookie: bool):
+    monkeypatch.setattr(settings, "download_root", str(tmp_path))
+    monkeypatch.setattr(pipeline.urlguard, "check_url", lambda url: None)
+    cookiefile = tmp_path / "cookies.txt"
+    cookiefile.write_text("# Netscape HTTP Cookie File\n")
+    monkeypatch.setattr(
+        pipeline.credentials,
+        "resolve_cookiefile",
+        lambda *a, **k: cookiefile if cookie else None,
+    )
+
+    def extract(*a, **k):
+        raise RuntimeError(_FB_PARSE)
+
+    monkeypatch.setattr(pipeline, "_extract_with_fallback", extract)
+
+
+def test_the_download_child_diagnoses_with_the_link_and_no_cookie(db, monkeypatch, tmp_path):
+    u = _user(db, "fb-nocookie@example.com")
+    a, j = _asset_and_job(db, u, sig="shared", asset_status="downloading", job_status="running")
+    _fail_the_child(monkeypatch, tmp_path, cookie=False)
+
+    pipeline._download(j.id, a.id, "url", _REEL, {}, u.id)
+
+    db.expire_all()
+    job = db.get(DownloadJob, j.id)
+    assert (job.status, job.error_code, job.error_detail) == (
+        "error",
+        "login_required",
+        "facebook.login_wall",
+    )
+
+
+def test_the_download_child_knows_the_cookie_went_with_it(db, monkeypatch, tmp_path):
+    # The same text with the user's cookie attached: telling them to add cookies would be wrong.
+    u = _user(db, "fb-cookie@example.com")
+    a, j = _asset_and_job(db, u, sig="private", asset_status="downloading", job_status="running")
+    _fail_the_child(monkeypatch, tmp_path, cookie=True)
+
+    pipeline._download(j.id, a.id, "url", _REEL, {}, u.id)
+
+    db.expire_all()
+    job = db.get(DownloadJob, j.id)
+    assert (job.error_code, job.error_detail) == ("login_required", "facebook.cookie_rejected")
+
+
+def test_a_job_meeting_a_failed_shared_asset_gets_the_same_explanation(db):
+    # Before the catalog this path wrote the text and NO code: "Download failed" for the second
+    # job, "Facebook sign-in required" for the first.
+    u = _user(db, "fb-second@example.com")
+    _, j = _asset_and_job(
+        db, u, sig="shared", asset_status="error", job_status="running", error=_FB_PARSE
+    )
+
+    _process_job(j.id)
+
+    db.expire_all()
+    job = db.get(DownloadJob, j.id)
+    assert (job.status, job.error_code, job.error_detail) == (
+        "error",
+        "login_required",
+        "facebook.login_wall",
+    )
+
+
+def test_a_job_meeting_its_users_failed_private_asset_knows_the_cookie_was_used(db, _fernet):
+    u = _user(db, "fb-private@example.com")
+    credentials.upsert_credential(db, u.id, "facebook", _COOKIES)
+    sig = credentials.authed_format_sig(formats.normalize({}), u.id, "facebook")
+    _, j = _asset_and_job(
+        db, u, sig=sig, asset_status="error", job_status="running", error=_FB_PARSE
+    )
+
+    _process_job(j.id)
+
+    db.expire_all()
+    job = db.get(DownloadJob, j.id)
+    assert (job.error_code, job.error_detail) == ("login_required", "facebook.cookie_rejected")
+
+
+def test_a_private_asset_the_cookie_could_not_go_with_is_explained_as_the_download_had_it(db):
+    # The cookie was deleted (or can no longer be decrypted) after the jobs were queued: the download
+    # child had nothing to attach and said "add your cookies". The job meeting that failed asset must say
+    # the same — the asset's salt alone would have told it "your cookies were refused".
+    u = _user(db, "fb-gone@example.com")
+    sig = credentials.authed_format_sig(formats.normalize({}), u.id, "facebook")
+    _, j = _asset_and_job(
+        db, u, sig=sig, asset_status="error", job_status="running", error=_FB_PARSE
+    )
+
+    _process_job(j.id)
+
+    db.expire_all()
+    job = db.get(DownloadJob, j.id)
+    assert (job.error_code, job.error_detail) == ("login_required", "facebook.login_wall")
+
+
+def test_a_job_canceled_before_it_meets_a_failed_asset_stays_canceled(db):
+    # The cancel landed between the claim and this write. `error` would hold the asset again after the
+    # route already released it — a later delete releases twice.
+    u = _user(db, "fb-canceled@example.com")
+    _, j = _asset_and_job(
+        db, u, sig="shared", asset_status="error", job_status="canceled", error=_FB_PARSE
+    )
+
+    _process_job(j.id)
+
+    db.expire_all()
+    job = db.get(DownloadJob, j.id)
+    assert (job.status, job.error_code, job.error_detail) == ("canceled", None, None)
+
+
+def test_the_downloads_list_carries_the_catalog_entry(db, as_user):
+    # The whole explanation rides on this one field: without it every row falls back to the category.
+    u = _user(db, "fb-list@example.com")
+    _, j = _asset_and_job(
+        db, u, sig="shared", asset_status="error", job_status="error", error=_FB_PARSE
+    )
+    j.error_code, j.error_detail = "login_required", "facebook.login_wall"
+    db.commit()
+
+    [row] = as_user(u).get("/api/downloads").json()
+
+    assert (row["error_code"], row["error_detail"]) == ("login_required", "facebook.login_wall")
+
+
+@pytest.mark.skipif(shutil.which("ffmpeg") is None, reason="ffmpeg not available")
+def test_a_download_yt_dlp_gave_no_duration_stores_the_files_duration(db, monkeypatch, tmp_path):
+    # Facebook reel 257 (E11.5): yt-dlp's info had no duration, the asset stored NULL, and the Library
+    # row lost its trim action. Through the real finalize, with a real 3-second file.
+    u = _user(db, "fb-duration@example.com")
+    a, j = _asset_and_job(db, u, sig="shared", asset_status="downloading", job_status="running")
+    monkeypatch.setattr(settings, "download_root", str(tmp_path))
+    monkeypatch.setattr(pipeline.urlguard, "check_url", lambda url: None)
+
+    def extract(job_id, asset_id, url, spec, staging, adapter, **kwargs):
+        media = staging / "1736360027626346.mp4"
+        subprocess.run(
+            [
+                "ffmpeg",
+                "-y",
+                "-loglevel",
+                "error",
+                "-f",
+                "lavfi",
+                "-i",
+                "testsrc=size=64x64:rate=10",
+                "-f",
+                "lavfi",
+                "-i",
+                "sine=frequency=440",
+                "-t",
+                "3",
+                "-c:v",
+                "libx264",
+                "-pix_fmt",
+                "yuv420p",
+                "-c:a",
+                "aac",
+                str(media),
+            ],
+            check=True,
+        )
+        return {"id": "1736360027626346", "ext": "mp4", "title": "Reel", "filepath": str(media)}
+
+    monkeypatch.setattr(pipeline, "_extract_with_fallback", extract)
+
+    pipeline._download(j.id, a.id, "url", _REEL, {}, u.id)
+
+    db.expire_all()
+    assert db.get(DownloadJob, j.id).status == "done"
+    assert db.get(MediaAsset, a.id).duration_s == 3
+
+
+def test_retry_and_redownload_drop_the_old_explanation(db):
+    u = _user(db, "fb-requeue@example.com")
+    for requeue in (service.resume, service.redownload):
+        _, j = _asset_and_job(
+            db, u, sig=f"s-{requeue.__name__}", asset_status="error", job_status="error"
+        )
+        j.error, j.error_code, j.error_detail = _FB_PARSE, "login_required", "facebook.login_wall"
+        db.commit()
+
+        requeue(db, j)
+
+        db.refresh(j)
+        assert (j.status, j.error_code, j.error_detail) == ("queued", None, None), requeue.__name__
+
+
+def test_0084_backfills_only_the_facebook_parse_failures_it_measured(db):
+    cfg = Config("alembic.ini")
+    command.downgrade(cfg, "0083_comfort_pins")
+    upgraded = False
+    try:
+        with engine.begin() as conn:
+            uid = conn.execute(
+                text("INSERT INTO users (email) VALUES ('backfill@example.com') RETURNING id")
+            ).scalar_one()
+            rows = {
+                "fb_unknown": ("error", "unknown", _FB_PARSE),
+                "fb_null": ("canceled", None, _FB_PARSE),
+                "other_site": ("error", "unknown", _FB_PARSE.replace("[facebook]", "[vimeo]")),
+                "fb_other_code": ("error", "network", _FB_PARSE),
+            }
+            ids = {}
+            for name, (status, code, error) in rows.items():
+                ids[name] = conn.execute(
+                    text(
+                        "INSERT INTO download_jobs (user_id, source_kind, source_ref, "
+                        "profile_snapshot, status, error_code, error) "
+                        "VALUES (:u, 'url', :ref, '{}', :s, :c, :e) RETURNING id"
+                    ),
+                    {"u": uid, "ref": _REEL, "s": status, "c": code, "e": error},
+                ).scalar_one()
+        command.upgrade(cfg, "head")
+        upgraded = True
+        with engine.connect() as conn:
+            got = {
+                name: tuple(
+                    conn.execute(
+                        text("SELECT error_code, error_detail FROM download_jobs WHERE id = :i"),
+                        {"i": i},
+                    ).one()
+                )
+                for name, i in ids.items()
+            }
+        assert got == {
+            "fb_unknown": ("login_required", "facebook.login_wall"),
+            "fb_null": ("login_required", "facebook.login_wall"),
+            "other_site": ("unknown", None),
+            "fb_other_code": ("network", None),
+        }
+    finally:
+        if not upgraded:
+            command.upgrade(cfg, "head")
+
+
+def _ffmpeg_media(path, *codec_args):
+    subprocess.run(
+        ["ffmpeg", "-y", "-loglevel", "error", "-f", "lavfi", "-i", "sine=frequency=440"]
+        + list(codec_args)
+        + ["-t", "2", str(path)],
+        check=True,
+    )
+
+
+@pytest.mark.skipif(shutil.which("ffmpeg") is None, reason="ffmpeg not available")
+def test_a_signed_in_facebook_download_is_titled_with_its_posts_text(db, monkeypatch, tmp_path):
+    # Prod jobs 265–268 (2026-09-14): with a cookie yt-dlp titles every reel "Video", so the row, the
+    # file name and the share preview all said "Video". The post's text is in the description.
+    u = _user(db, "fb-title@example.com")
+    a, j = _asset_and_job(db, u, sig="shared", asset_status="downloading", job_status="running")
+    monkeypatch.setattr(settings, "download_root", str(tmp_path))
+    monkeypatch.setattr(pipeline.urlguard, "check_url", lambda url: None)
+
+    def extract(job_id, asset_id, url, spec, staging, adapter, **kwargs):
+        media = staging / "2131884261040652.m4a"
+        _ffmpeg_media(media, "-c:a", "aac")
+        return {
+            "id": "2131884261040652",
+            "ext": "m4a",
+            "title": "Video",
+            "description": "Tune of The Day, Argy playing his version",
+            "extractor_key": "Facebook",
+            "filepath": str(media),
+        }
+
+    monkeypatch.setattr(pipeline, "_extract_with_fallback", extract)
+
+    pipeline._download(j.id, a.id, "url", _REEL, {"mode": "a"}, u.id)
+
+    db.expire_all()
+    asset, job = db.get(MediaAsset, a.id), db.get(DownloadJob, j.id)
+    assert asset.title == job.display_name == "Tune of The Day, Argy playing his version"
+    assert "Tune_of_The_Day" in asset.rel_path
+
+
+def test_the_early_title_takes_the_posts_text_too(db):
+    u = _user(db, "fb-early-title@example.com")
+    a, _ = _asset_and_job(db, u, sig="shared", asset_status="downloading", job_status="running")
+    a.title = None
+    db.commit()
+
+    pipeline._fill_asset_meta_early(
+        a.id,
+        {
+            "id": "1",
+            "title": "Video",
+            "description": "Almás palacsinta",
+            "extractor_key": "Facebook",
+        },
+    )
+
+    db.expire_all()
+    assert db.get(MediaAsset, a.id).title == "Almás palacsinta"
+
+
+@pytest.mark.skipif(shutil.which("ffmpeg") is None, reason="ffmpeg not available")
+def test_an_mp3_download_is_stored_as_an_mp3(db, monkeypatch, tmp_path):
+    # Prod job 268: the "Audio (MP3)" profile's extracted .mp3 was remuxed into an .mp4 and served as
+    # video/mp4, which iPad's WebKit will not play. It stays an .mp3 (served as audio/mpeg).
+    u = _user(db, "fb-mp3@example.com")
+    a, j = _asset_and_job(db, u, sig="shared", asset_status="downloading", job_status="running")
+    monkeypatch.setattr(settings, "download_root", str(tmp_path))
+    monkeypatch.setattr(pipeline.urlguard, "check_url", lambda url: None)
+
+    def extract(job_id, asset_id, url, spec, staging, adapter, **kwargs):
+        media = staging / "2131884261040652.mp3"
+        _ffmpeg_media(media, "-c:a", "libmp3lame")
+        return {"id": "2131884261040652", "ext": "mp3", "title": "Reel", "filepath": str(media)}
+
+    monkeypatch.setattr(pipeline, "_extract_with_fallback", extract)
+
+    pipeline._download(
+        j.id, a.id, "url", _REEL, formats.normalize({"mode": "a", "audio_format": "mp3"}), u.id
+    )
+
+    db.expire_all()
+    asset = db.get(MediaAsset, a.id)
+    assert (asset.container, asset.acodec, asset.media_kind) == ("mp3", "mp3", "audio")
+    assert asset.rel_path.endswith(".mp3")
+
+
+@pytest.mark.skipif(shutil.which("ffmpeg") is None, reason="ffmpeg not available")
+@pytest.mark.parametrize("mode", ["av", "v"])
+def test_a_video_download_is_still_made_browser_playable(db, monkeypatch, tmp_path, mode):
+    # The mp3 fix skips the browser-playable pass for AUDIO only: a video that arrives in a container
+    # browsers won't play (an .mkv) is still remuxed into an .mp4.
+    u = _user(db, f"fb-mkv-{mode}@example.com")
+    a, j = _asset_and_job(
+        db, u, sig=f"mkv-{mode}", asset_status="downloading", job_status="running"
+    )
+    monkeypatch.setattr(settings, "download_root", str(tmp_path))
+    monkeypatch.setattr(pipeline.urlguard, "check_url", lambda url: None)
+
+    def extract(job_id, asset_id, url, spec, staging, adapter, **kwargs):
+        media = staging / "1736360027626346.mkv"
+        audio = ["-f", "lavfi", "-i", "sine=frequency=440", "-c:a", "aac"] if mode == "av" else []
+        subprocess.run(
+            [
+                "ffmpeg",
+                "-y",
+                "-loglevel",
+                "error",
+                "-f",
+                "lavfi",
+                "-i",
+                "testsrc=size=64x64:rate=10",
+            ]
+            + audio
+            + ["-t", "1", "-c:v", "libx264", "-pix_fmt", "yuv420p", str(media)],
+            check=True,
+        )
+        return {"id": "1736360027626346", "ext": "mkv", "title": "Reel", "filepath": str(media)}
+
+    monkeypatch.setattr(pipeline, "_extract_with_fallback", extract)
+
+    pipeline._download(j.id, a.id, "url", _REEL, formats.normalize({"mode": mode}), u.id)
+
+    db.expire_all()
+    asset = db.get(MediaAsset, a.id)
+    assert (asset.container, asset.vcodec) == ("mp4", "h264")
+    assert asset.rel_path.endswith(".mp4")

backend/tests/test_download_job_locks.py

@@ -0,0 +1,139 @@
+"""Overlapping requests on ONE job (E11.5 review) — DB-backed, two real sessions.
+
+The routes that move a job's asset ref count (resume, cancel, delete, redownload) used to decide on an
+unlocked read: two overlapping requests for one job (a double-click, a second tab, a replay after a
+gateway timeout) both saw it holding its asset and both released the hold. The count then reaches 0
+while another job still holds the asset, and GC or the ready-file delete removes it under that job.
+A pause racing a cancel did the same one step later: its unlocked write turned the released job back
+into a holder, which a later delete releases again. `_own_job_for_update` makes the second request
+wait and decide on the first one's committed result.
+"""
+
+import threading
+
+import pytest
+from fastapi import HTTPException
+from sqlalchemy import select
+
+from app.db import SessionLocal
+from app.downloads import service
+from app.models import DownloadJob, MediaAsset, User
+from app.routes.downloads import (
+    _own_job_for_update,
+    cancel_download,
+    delete_download,
+    pause_download,
+)
+
+_REF = "https://example.com/video"
+
+
+def _asset_held_by_two_jobs(db, status="error"):
+    mine, theirs = User(email="lock-mine@example.com"), User(email="lock-theirs@example.com")
+    db.add_all([mine, theirs])
+    db.flush()
+    asset = MediaAsset(
+        source_kind="url", source_ref=_REF, format_sig="shared", status="error", ref_count=2
+    )
+    db.add(asset)
+    db.flush()
+    jobs = [
+        DownloadJob(
+            user_id=owner.id,
+            asset_id=asset.id,
+            source_kind="url",
+            source_ref=_REF,
+            status=status if owner is mine else "error",
+            queue_pos=0,
+            profile_snapshot={},
+        )
+        for owner in (mine, theirs)
+    ]
+    db.add_all(jobs)
+    db.commit()
+    return mine, asset, jobs[0]
+
+
+@pytest.mark.parametrize(
+    ("status", "transition", "route", "left"),
+    [
+        ("error", service.cancel, cancel_download, "canceled"),
+        ("error", service.delete, delete_download, None),
+        ("queued", service.cancel, pause_download, "canceled"),
+    ],
+)
+def test_overlapping_requests_for_one_job_release_its_hold_once(
+    db, status, transition, route, left
+):
+    user, asset, job = _asset_held_by_two_jobs(db, status)
+    job_id = job.id  # read before the delete case removes the row under the expired instance
+    first, second = SessionLocal(), SessionLocal()
+    finished = threading.Event()
+
+    def the_other_request():
+        try:
+            route(job_id, user=user, db=second)
+        except HTTPException:
+            pass  # a request after the delete: the job is gone, a 404
+        finally:
+            second.close()
+            finished.set()
+
+    try:
+        locked = _own_job_for_update(first, user, job_id)
+        other = threading.Thread(target=the_other_request)
+        other.start()
+        # The second request waits for the first one's locks instead of deciding on the same row.
+        assert not finished.wait(0.5), "the second request did not wait for the first"
+        transition(first, locked)
+        other.join(10)
+        assert finished.is_set()
+    finally:
+        first.close()
+
+    db.expire_all()
+    mine = select(DownloadJob.status).where(DownloadJob.id == job_id)
+    assert db.execute(mine).scalar_one_or_none() == left
+    assert db.get(MediaAsset, asset.id).ref_count == 1  # the other user's job still holds it
+
+
+def test_losing_the_asset_insert_race_keeps_the_callers_own_writes(db, monkeypatch):
+    # Retry clears the job's error, THEN may create the cookie asset. When another request inserted that
+    # asset first, the loser used to roll the whole session back — and requeue the job with its stale
+    # error, which a stall or crash later leaves showing under the new failure.
+    user = User(email="race@example.com")
+    db.add(user)
+    db.flush()
+    job = DownloadJob(
+        user_id=user.id,
+        source_kind="url",
+        source_ref=_REF,
+        status="error",
+        error="the old failure",
+        queue_pos=0,
+        profile_snapshot={},
+    )
+    db.add(job)
+    db.commit()
+    job.error = None  # the caller's pending write
+
+    real_flush, raced = db.flush, []
+
+    def flush_after_the_other_request_inserted(*args, **kwargs):
+        if not raced:  # the other request commits the same asset between our lookup and our insert
+            raced.append(True)
+            with SessionLocal() as other:
+                other.add(
+                    MediaAsset(source_kind="url", source_ref=_REF, format_sig="raced", ref_count=0)
+                )
+                other.commit()
+        return real_flush(*args, **kwargs)
+
+    monkeypatch.setattr(db, "flush", flush_after_the_other_request_inserted)
+
+    asset = service.get_or_create_asset(db, "url", _REF, "raced")
+    db.commit()
+
+    assert raced and asset.format_sig == "raced"
+    db.expire_all()
+    assert db.get(DownloadJob, job.id).error is None

backend/tests/test_facebook_impersonation.py

@@ -0,0 +1,243 @@
+"""E11.5 S3 + S4 — the Facebook download path with the user's cookie.
+
+S3, measured on dev (yt-dlp 2026.07.04, the owner's cookie): reel 806379462330494 fails with the cookie
+alone and extracts 2560p with `--impersonate chrome`; the reels that already download with the cookie
+keep their plain first attempt. These pin the attempt order through the real download loop
+(`pipeline._extract_with_fallback`, with yt-dlp faked at the `YoutubeDL` boundary), and that the
+LOCKED curl_cffi can actually impersonate — the pair only works inside yt-dlp's own version range, and
+outside it every target silently reports "unavailable".
+
+S4, measured on dev and in the owner's Chrome: given a group post's link, yt-dlp finds no formats or
+downloads another video from the page's feed. The post's own video is the single Video node in the
+page scripts that carry the post id (prod posts 66, 145, 140, 143, 221; text posts have none while the
+page holds ~10 other videos), and its watch link downloads.
+"""
+
+import pytest
+import yt_dlp
+from yt_dlp.networking.exceptions import TransportError
+from yt_dlp.networking.impersonate import ImpersonateTarget
+
+from app.downloads import adapters, pipeline
+from app.downloads import errors as dlerrors
+
+_URL = "https://www.facebook.com/reel/806379462330494/?fs=e&fs=e"
+_POST = "1755988225525547"
+_GROUP_LINK = f"https://www.facebook.com/groups/983554479435596/permalink/{_POST}/?"
+_POST_VIDEO = "1408015447857753"
+_FEED_VIDEO = "1056963063816966"  # what yt-dlp downloaded from this post's link: a feed video
+_CHROME = ImpersonateTarget.from_str("chrome")
+
+
+def _video_node(video_id: str) -> str:
+    # The measured shape of a post's attachment in the page JSON.
+    return '{"media":{"__typename":"Video","id":"%s","__isNode":"Video"},"styles":{}}' % video_id
+
+
+def _page(*post_videos: str, post: str = _POST) -> str:
+    attachments = ",".join(_video_node(v) for v in post_videos)
+    return (
+        '<html><script type="application/json" data-sjs>'
+        f'{{"post_id":"{post}","creation_time":1785084554,"attachments":[{attachments}]}}</script>'
+        '<script type="application/json" data-sjs>'
+        f'{{"feed":[{_video_node(_FEED_VIDEO)}]}}</script></html>'
+    )
+
+
+_WALL = (
+    "ERROR: [facebook] 806379462330494: Cannot parse data; please report this issue on  "
+    "https://github.com/yt-dlp/yt-dlp/issues?q= , filling out the appropriate issue template."
+)
+_NO_FORMATS = "ERROR: [facebook] 2541212983053999: No video formats found!"
+
+
+def test_the_locked_curl_cffi_can_impersonate_chrome():
+    # YoutubeDL refuses to start when the target is unavailable — the same check a download makes.
+    with yt_dlp.YoutubeDL({"impersonate": ImpersonateTarget.from_str("chrome"), "quiet": True}):
+        pass
+
+
+@pytest.fixture
+def ydl(monkeypatch):
+    """Fake `yt_dlp.YoutubeDL`: records each attempt's options and plays back `outcomes` in order;
+    `web["page"]` is what a page read returns (`web["fail"]`, when set, is raised instead), and `web`
+    records the pages opened, the byte cap each read asked for, and the links extracted."""
+    seen: list[dict] = []
+    outcomes: list = []
+    web: dict = {"page": "", "fail": None, "opened": [], "reads": [], "extracted": []}
+
+    class FakeYDL:
+        def __init__(self, opts):
+            seen.append(opts)
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *exc):
+            return False
+
+        def urlopen(self, url):
+            web["opened"].append(url)
+            if web["fail"] is not None:
+                raise web["fail"]
+            body = web["page"].encode()
+
+            class Response:
+                def read(self, amt=None):
+                    web["reads"].append(amt)
+                    return body
+
+            return Response()
+
+        def extract_info(self, url, download):
+            web["extracted"].append(url)
+            outcome = outcomes.pop(0)
+            if isinstance(outcome, str):
+                raise yt_dlp.utils.DownloadError(outcome)
+            return outcome
+
+    monkeypatch.setattr(pipeline.yt_dlp, "YoutubeDL", FakeYDL)
+    monkeypatch.setattr(pipeline, "_touch_job", lambda job_id: None)
+    monkeypatch.setattr(pipeline, "_set_job", lambda job_id, **fields: None)
+    return seen, outcomes, web
+
+
+def _run(tmp_path, cookiefile, url=_URL):
+    return pipeline._extract_with_fallback(
+        1, 1, url, {}, tmp_path, adapters.FacebookAdapter(), cookiefile=cookiefile
+    )
+
+
+def test_a_cookie_download_at_the_wall_is_retried_as_chrome(ydl, tmp_path):
+    seen, outcomes, web = ydl
+    outcomes += [_WALL, {"id": "806379462330494"}]
+
+    assert _run(tmp_path, "/cookies.txt") == {"id": "806379462330494"}
+
+    assert [o.get("impersonate") for o in seen] == [None, _CHROME]
+    assert all(o["cookiefile"] == "/cookies.txt" for o in seen)  # the retry stays signed in
+    assert web["opened"] == []  # a reel is not a group post: no page read
+
+
+def test_without_a_cookie_the_wall_is_the_login_wall_and_final(ydl, tmp_path):
+    seen, outcomes, _ = ydl
+    outcomes += [_WALL]
+
+    with pytest.raises(yt_dlp.utils.DownloadError):
+        _run(tmp_path, None)
+
+    assert len(seen) == 1 and "impersonate" not in seen[0]
+
+
+def test_other_facebook_failures_are_not_retried_as_chrome(ydl, tmp_path):
+    seen, outcomes, _ = ydl
+    outcomes += [_NO_FORMATS]
+
+    with pytest.raises(yt_dlp.utils.DownloadError):
+        _run(tmp_path, "/cookies.txt")
+
+    assert len(seen) == 1 and "impersonate" not in seen[0]
+
+
+# --- S4: a group post downloads ITS video, or fails saying it has none ----------------------------
+
+
+def test_a_cookie_group_post_downloads_the_posts_own_video(ydl, tmp_path):
+    seen, outcomes, web = ydl
+    web["page"] = _page(_POST_VIDEO)
+    outcomes += [_WALL, {"id": _POST_VIDEO}]  # the watch link needs Chrome too (measured)
+
+    assert _run(tmp_path, "/cookies.txt", _GROUP_LINK) == {"id": _POST_VIDEO}
+
+    assert web["opened"] == [_GROUP_LINK]
+    # Never an unbounded read.
+    assert web["reads"] == [adapters.FacebookAdapter._POST_PAGE_MAX_BYTES]
+    assert seen[0]["cookiefile"] == "/cookies.txt"  # the post page is read signed in
+    watch = f"https://www.facebook.com/watch/?v={_POST_VIDEO}"
+    # Never the post link: that is where the feed video comes from.
+    assert web["extracted"] == [watch, watch]
+    assert [o.get("impersonate") for o in seen[1:]] == [None, _CHROME]
+
+
+def test_a_group_post_without_a_single_video_fails_saying_so(ydl, tmp_path):
+    _, _, web = ydl
+    web["page"] = _page()  # a text post: the only video on the page is the feed's
+
+    with pytest.raises(RuntimeError) as exc:
+        _run(tmp_path, "/cookies.txt", _GROUP_LINK)
+
+    assert web["extracted"] == []  # yt-dlp is not left to guess from the post link
+    assert dlerrors.diagnose(str(exc.value), url=_GROUP_LINK, cookie_attached=True) == (
+        "format_unavailable",
+        "facebook.group_post_video",
+    )
+
+
+def test_a_group_post_page_without_the_post_is_the_refused_cookie(ydl, tmp_path):
+    # Measured with a refused cookie (E11.5 review): Facebook answers the post link with its login page —
+    # a login form, no post id anywhere. Saying "this post has no video" would blame the post.
+    _, _, web = ydl
+    web["page"] = '<html><title>ChatGPT magyarul</title><form id="login_form"></form></html>'
+
+    with pytest.raises(RuntimeError) as exc:
+        _run(tmp_path, "/cookies.txt", _GROUP_LINK)
+
+    assert web["extracted"] == []
+    assert dlerrors.diagnose(str(exc.value), url=_GROUP_LINK, cookie_attached=True) == (
+        "login_required",
+        "facebook.cookie_rejected",
+    )
+
+
+def test_a_failed_post_page_read_fails_the_download_as_itself(ydl, tmp_path):
+    # A read that failed says nothing about the post: it must not turn into "no video in this post".
+    _, _, web = ydl
+    web["fail"] = TransportError("Connection reset by peer")
+
+    with pytest.raises(TransportError) as exc:
+        _run(tmp_path, "/cookies.txt", _GROUP_LINK)
+
+    assert web["extracted"] == []
+    assert dlerrors.diagnose(str(exc.value), url=_GROUP_LINK, cookie_attached=True) == (
+        "network",
+        None,
+    )
+
+
+def test_without_a_cookie_the_group_post_link_goes_to_ytdlp_unchanged(ydl, tmp_path):
+    _, outcomes, web = ydl
+    outcomes += [_NO_FORMATS]
+
+    with pytest.raises(yt_dlp.utils.DownloadError):
+        _run(tmp_path, None, _GROUP_LINK)
+
+    assert web["opened"] == []  # signed out the page is the login wall: nothing to read
+    assert web["extracted"] == [_GROUP_LINK]
+
+
+def test_the_group_post_link_forms_are_recognised():
+    for url in (
+        _GROUP_LINK,
+        f"https://www.facebook.com/groups/983554479435596/posts/{_POST}/",
+        f"https://m.facebook.com/groups/983554479435596/permalink/{_POST}/?",
+        f"https://www.facebook.com/groups/chatgptmagyarul/posts/{_POST}",
+    ):
+        assert adapters.facebook_group_post_id(url) == _POST, url
+    for url in (
+        _URL,
+        f"https://www.facebook.com/watch/?v={_POST_VIDEO}",
+        f"https://facebook.com.evil/groups/x/permalink/{_POST}/",
+        "https://www.facebook.com/groups/983554479435596/",
+    ):
+        assert adapters.facebook_group_post_id(url) is None, url
+    assert adapters.SourceAdapter().resolve_url(_GROUP_LINK, {"cookiefile": "/c"}) == _GROUP_LINK
+
+
+def test_only_the_single_video_of_the_posts_own_blocks_counts():
+    assert adapters.facebook_post_video_id(_page(_POST_VIDEO), _POST) == _POST_VIDEO
+    # No video in the post, although the page has one elsewhere.
+    assert adapters.facebook_post_video_id(_page(), _POST) is None
+    # Two videos: guessing between them would be the wrong-video bug again.
+    assert adapters.facebook_post_video_id(_page(_POST_VIDEO, "2063302677911049"), _POST) is None
+    # A longer number that merely STARTS with the post id is another object.
+    assert adapters.facebook_post_video_id(_page(_POST_VIDEO, post=_POST + "0"), _POST) is None

backend/tests/test_formats.py

@@ -158,3 +158,24 @@ def test_a_normal_cut_list_is_untouched():
     segs = [{"start_s": 0, "end_s": 5}, {"start_s": 10, "end_s": 12}]
     out = editmod.normalize_edit_spec({"segments": segs})
     assert len(out["segments"]) == 2
+
+
+def test_audio_versions_its_cache_identity_apart_from_video(monkeypatch):
+    # The .mp3/.m4a-stays-itself fix must re-derive cached remuxed audio WITHOUT re-downloading every
+    # cached video: bumping one version moves only its own mode's signature.
+    audio, video = {"mode": "a", "audio_format": "mp3"}, {"mode": "av"}
+    before = formats.format_sig(audio), formats.format_sig(video)
+    monkeypatch.setattr(formats, "_AUDIO_SIG_VERSION", formats._AUDIO_SIG_VERSION + 1)
+    assert formats.format_sig(audio) != before[0]
+    assert formats.format_sig(video) == before[1]
+    monkeypatch.setattr(formats, "_SIG_VERSION", formats._SIG_VERSION + 1)
+    assert formats.format_sig(video) != before[1]
+
+
+def test_the_mp3_fix_moved_the_audio_cache_identity(monkeypatch):
+    # Before the fix every mode hashed with version 4, so an audio signature still at 4 would find the
+    # cached mp3-remuxed-into-mp4 assets iPad refuses (prod job 268) instead of re-deriving them.
+    audio = {"mode": "a", "audio_format": "mp3"}
+    current = formats.format_sig(audio)
+    monkeypatch.setattr(formats, "_AUDIO_SIG_VERSION", 4)
+    assert formats.format_sig(audio) != current

backend/tests/test_public_unlock_limit.py

@@ -0,0 +1,80 @@
+"""The password unlock of a shared /watch link (routes/public.py), DB-lane.
+
+Guesses are slowed per viewer (the link AND the client — an IPv6 client by its /64), under a per-link
+ceiling on wrong passwords, so a client guessing wrong shuts out only itself until it spreads its guesses
+over as many networks as the ceiling allows.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.config import settings
+from app.downloads import probe as probemod
+from app.main import app
+from app.ratelimit import RateLimiter
+from app.routes import public
+
+_PW = "open sesame"
+
+
+@pytest.fixture
+def unlock_url(as_user, make_user, tmp_path, monkeypatch):
+    monkeypatch.setattr(settings, "download_root", str(tmp_path))
+    monkeypatch.setattr(probemod, "probe_media", lambda _p: ("h264", "aac", 320, 240, 5))
+    owner = as_user(make_user())
+    job = owner.post(
+        "/api/downloads/upload", files={"file": ("clip.mp4", b"fake-video", "video/mp4")}
+    )
+    assert job.status_code == 200, job.text
+    link = owner.post(f"/api/downloads/{job.json()['id']}/links", json={"password": _PW})
+    assert link.status_code == 200, link.text
+    return f"/api/public/watch/{link.json()['token']}/unlock"
+
+
+def _from(ip: str) -> TestClient:
+    # Its own socket peer: with no trusted proxy configured, that is the client's IP.
+    return TestClient(app, client=(ip, 50000))
+
+
+def test_a_link_holder_without_the_password_cannot_lock_out_its_viewers(unlock_url):
+    # The limit used to be keyed on the link alone: ten wrong guesses every five minutes kept every
+    # viewer out, the ones with the password included.
+    guesser = _from("203.0.113.5")
+    for _ in range(10):
+        assert guesser.post(unlock_url, json={"password": "guess"}).status_code == 403
+    assert guesser.post(unlock_url, json={"password": "guess"}).status_code == 429
+
+    assert _from("198.51.100.7").post(unlock_url, json={"password": _PW}).status_code == 200
+
+
+def test_an_ipv6_client_is_one_viewer_across_its_64(unlock_url):
+    # One subscriber gets a whole /64: keyed on the full address, it could rotate through endless viewers.
+    for _ in range(10):
+        wrong = _from("2001:db8:1:2::5").post(unlock_url, json={"password": "guess"})
+        assert wrong.status_code == 403
+    assert _from("2001:db8:1:2::6").post(unlock_url, json={"password": _PW}).status_code == 429
+
+    assert _from("2001:db8:1:3::5").post(unlock_url, json={"password": _PW}).status_code == 200
+
+
+def test_a_token_naming_no_link_leaves_nothing_in_the_limiter(unlock_url):
+    # The limiter used to record the attempt before looking the link up: posting made-up tokens grew it by
+    # an entry each, kept for the whole window.
+    keys = len(public._unlock_limit._hits)
+    for n in range(5):
+        missing = _from("203.0.113.5").post(unlock_url.replace("/watch/", f"/watch/x{n}"), json={})
+        assert missing.status_code == 404
+    assert len(public._unlock_limit._hits) == keys
+
+
+def test_wrong_passwords_from_many_clients_still_reach_the_links_ceiling(unlock_url, monkeypatch):
+    monkeypatch.setattr(public, "_unlock_failures", RateLimiter(max_events=3, window_seconds=300))
+    viewer = _from("198.51.100.7")
+    for _ in range(5):  # unlocking with the password never adds to the ceiling
+        assert viewer.post(unlock_url, json={"password": _PW}).status_code == 200
+
+    for n in range(3):
+        wrong = _from(f"203.0.113.{n}").post(unlock_url, json={"password": "guess"})
+        assert wrong.status_code == 403
+    late = _from("203.0.113.9").post(unlock_url, json={"password": "guess"})
+    assert late.status_code == 429

backend/tests/test_ratelimit.py

@@ -57,6 +57,19 @@ def test_reset_clears_every_key():
     assert lim.allow("b") is True
 
 
+def test_exhausted_reports_a_full_window_without_counting_an_attempt():
+    # The asking half of a limit that counts only some outcomes (a share link's unlock counts only
+    # wrong passwords toward its ceiling): asking must never use up the window it asks about.
+    lim = RateLimiter(max_events=2, window_seconds=300)
+
+    for _ in range(5):
+        assert lim.exhausted("link") is False
+    assert lim.allow("link") is True
+    assert lim.exhausted("link") is False
+    assert lim.allow("link") is True
+    assert lim.exhausted("link") is True
+
+
 def test_expired_attempts_fall_out_of_the_window():
     # A zero-length window means every previous attempt is already outside it.
     lim = RateLimiter(max_events=1, window_seconds=0)

backend/tests/test_upload.py

@@ -424,10 +424,36 @@ class TestResolveMediaFacts:
                 ],
             },
         )
-        v, a, w, h = probemod.resolve_media_facts(Path("x"), {"width": None, "height": None})
+        v, a, w, h, _d = probemod.resolve_media_facts(Path("x"), {"width": None, "height": None})
         assert (v, a, w, h) == ("h264", "aac", 720, 1280)
         assert mediakind.derive(v, a) == mediakind.VIDEO  # NOT 'file'
 
+    def test_the_duration_comes_from_the_file_when_info_has_none(self, monkeypatch):
+        # Facebook reel 257 (E11.5): yt-dlp gave no duration, the file is 128.4 s. A NULL duration hid
+        # the Library row's trim action.
+        self._ffprobe(
+            monkeypatch,
+            {
+                "format": {"format_name": "mov,mp4,m4a", "duration": "128.400000"},
+                "streams": [{"codec_type": "video", "codec_name": "h264"}],
+            },
+        )
+        assert probemod.resolve_media_facts(Path("x"), {"duration": None})[4] == 128
+        # The file wins over a differing info duration, like its codecs do.
+        assert probemod.resolve_media_facts(Path("x"), {"duration": 300})[4] == 128
+
+    def test_info_fills_the_duration_the_probe_could_not_read(self, monkeypatch):
+        self._ffprobe(
+            monkeypatch,
+            {
+                "format": {"format_name": "mov,mp4,m4a"},
+                "streams": [{"codec_type": "video", "codec_name": "h264"}],
+            },
+        )
+        assert probemod.resolve_media_facts(Path("x"), {"duration": 61.7})[4] == 61
+        self._ffprobe(monkeypatch, None)
+        assert probemod.resolve_media_facts(Path("x"), {"duration": 61.7})[4] == 61
+
     def test_probe_wins_over_a_DIFFERING_populated_info(self, monkeypatch):
         # Both the probe AND info are populated but DISAGREE (info carries a pre-remux/pre-merge codec).
         # The finished file on disk is ground truth, so the probe wins outright — pins the precedence a
@@ -442,7 +468,7 @@ class TestResolveMediaFacts:
                 ],
             },
         )
-        v, a, w, h = probemod.resolve_media_facts(
+        v, a, w, h, _d = probemod.resolve_media_facts(
             Path("x"), {"vcodec": "vp9", "acodec": "opus", "width": 640, "height": 480}
         )
         assert (v, a, w, h) == ("h264", "aac", 1920, 1080)  # probe, not info
@@ -466,7 +492,7 @@ class TestResolveMediaFacts:
                 ],
             },
         )
-        v, a, w, h = probemod.resolve_media_facts(
+        v, a, w, h, _d = probemod.resolve_media_facts(
             Path("x"), {"vcodec": "avc1", "acodec": "mp4a", "width": 1280, "height": 720}
         )
         assert v is None and a == "mp3"  # info's avc1 did NOT win
@@ -482,7 +508,7 @@ class TestResolveMediaFacts:
                 "streams": [{"codec_type": "video", "codec_name": "png", "width": 8, "height": 8}],
             },
         )
-        v, a, w, h = probemod.resolve_media_facts(
+        v, a, w, h, _d = probemod.resolve_media_facts(
             Path("x"), {"vcodec": "png", "width": 8, "height": 8}
         )
         assert v is None and mediakind.derive(v, a) == mediakind.FILE
@@ -490,7 +516,7 @@ class TestResolveMediaFacts:
     def test_info_fills_in_only_when_ffprobe_could_not_read_the_file(self, monkeypatch):
         # ffprobe failed entirely (None) → fall back to info so we never regress the working path.
         self._ffprobe(monkeypatch, None)
-        v, a, w, h = probemod.resolve_media_facts(
+        v, a, w, h, _d = probemod.resolve_media_facts(
             Path("x"), {"vcodec": "vp9", "acodec": "opus", "width": 1920, "height": 1080}
         )
         assert (v, a, w, h) == ("vp9", "opus", 1920, 1080)
@@ -498,6 +524,8 @@ class TestResolveMediaFacts:
     def test_info_none_codec_string_is_treated_as_absent(self, monkeypatch):
         # yt-dlp writes the literal "none" for a missing stream — it must not become a codec name.
         self._ffprobe(monkeypatch, None)  # probe failed → info path, where the "none" scrub applies
-        v, a, w, h = probemod.resolve_media_facts(Path("x"), {"vcodec": "none", "acodec": "aac"})
+        v, a, w, h, _d = probemod.resolve_media_facts(
+            Path("x"), {"vcodec": "none", "acodec": "aac"}
+        )
         assert (v, a) == (None, "aac")
         assert mediakind.derive(v, a) == mediakind.AUDIO

backend/tests/test_worker_supervisor.py

@@ -51,7 +51,7 @@ def rec(monkeypatch):
 
     monkeypatch.setattr(worker, "_reset_asset_pending", record("reset_asset"))
     monkeypatch.setattr(worker, "_requeue_if_running", record("requeue"))
-    monkeypatch.setattr(worker, "_set_job", record("set_job"))
+    monkeypatch.setattr(worker, "_fail_running", record("fail"))
     monkeypatch.setattr(worker, "_cleanup_staging", record("cleanup"))
     monkeypatch.setattr(worker, "_stop_child", record("stop_child"))
     monkeypatch.setattr(worker._stop, "is_set", lambda: False)
@@ -84,9 +84,9 @@ def test_no_progress_stall_kills_and_fails_the_job(monkeypatch, rec):
     worker._run_supervised(1, 99)
     names = _names(rec)
     assert "stop_child" in names and "reset_asset" in names
-    set_job = next(c for c in rec if c[0] == "set_job")
-    assert set_job[2]["status"] == "error" and set_job[2]["error_code"] == "network"
-    assert "stalled" in set_job[2]["error"].lower()
+    fail = next(c for c in rec if c[0] == "fail")
+    assert fail[2]["error_code"] == "network"
+    assert "stalled" in fail[2]["error"].lower()
 
 
 def test_route_pause_kills_but_keeps_the_route_status(monkeypatch, rec):
@@ -97,7 +97,7 @@ def test_route_pause_kills_but_keeps_the_route_status(monkeypatch, rec):
     worker._run_supervised(1, 99)
     names = _names(rec)
     assert "stop_child" in names and "reset_asset" in names
-    assert "set_job" not in names and "requeue" not in names
+    assert "fail" not in names and "requeue" not in names
 
 
 def test_route_cancel_kills_but_keeps_the_route_status(monkeypatch, rec):
@@ -110,7 +110,7 @@ def test_route_cancel_kills_but_keeps_the_route_status(monkeypatch, rec):
     worker._run_supervised(1, 99)
     names = _names(rec)
     assert "stop_child" in names and "reset_asset" in names
-    assert "set_job" not in names and "requeue" not in names
+    assert "fail" not in names and "requeue" not in names
 
 
 def test_wall_clock_cap_kills_even_while_progressing(monkeypatch, rec):
@@ -118,9 +118,8 @@ def test_wall_clock_cap_kills_even_while_progressing(monkeypatch, rec):
     _spawn(monkeypatch, _FakeProc(["timeout"]))
     _liveness(monkeypatch, ("running", 1.0))  # fresh progress, but over the absolute cap
     worker._run_supervised(1, 99)
-    set_job = next(c for c in rec if c[0] == "set_job")
-    assert set_job[2]["status"] == "error"
-    assert "time limit" in set_job[2]["error"].lower()
+    fail = next(c for c in rec if c[0] == "fail")
+    assert "time limit" in fail[2]["error"].lower()
 
 
 def test_child_crash_without_finishing_is_failed(monkeypatch, rec):
@@ -130,8 +129,8 @@ def test_child_crash_without_finishing_is_failed(monkeypatch, rec):
     worker._run_supervised(1, 99)
     names = _names(rec)
     assert "reset_asset" in names
-    set_job = next(c for c in rec if c[0] == "set_job")
-    assert set_job[2]["status"] == "error" and "unexpectedly" in set_job[2]["error"].lower()
+    fail = next(c for c in rec if c[0] == "fail")
+    assert "unexpectedly" in fail[2]["error"].lower()
 
 
 def test_child_nonzero_exit_that_already_set_state_is_left_alone(monkeypatch, rec):
@@ -139,7 +138,7 @@ def test_child_nonzero_exit_that_already_set_state_is_left_alone(monkeypatch, re
     _spawn(monkeypatch, _FakeProc([("exit", 1)]))
     _liveness(monkeypatch, ("error", None))
     worker._run_supervised(1, 99)
-    assert "set_job" not in _names(rec)
+    assert "fail" not in _names(rec)
 
 
 def test_spawn_failure_frees_the_asset_and_requeues(monkeypatch, rec):
@@ -158,7 +157,7 @@ def test_shutdown_kills_and_requeues_for_next_boot(monkeypatch, rec):
     _liveness(monkeypatch, ("running", 1.0))
     worker._run_supervised(1, 99)
     names = _names(rec)
-    assert "stop_child" in names and "requeue" in names and "set_job" not in names
+    assert "stop_child" in names and "requeue" in names and "fail" not in names
 
 
 def test_a_long_download_survives_while_progress_stays_fresh(monkeypatch, rec):
@@ -191,7 +190,7 @@ def test_a_wedged_finished_child_is_killed_by_the_wall_clock(monkeypatch, rec):
     _liveness(monkeypatch, ("done", 1.0))  # finished, but the process lingers
     worker._run_supervised(1, 99)
     names = _names(rec)
-    assert "stop_child" in names and "set_job" not in names  # killed to free the slot, status kept
+    assert "stop_child" in names and "fail" not in names  # killed to free the slot, status kept
 
 
 def test_a_watchdog_error_still_stops_the_child(monkeypatch, rec):
@@ -206,7 +205,7 @@ def test_a_watchdog_error_still_stops_the_child(monkeypatch, rec):
     worker._run_supervised(1, 99)
     names = _names(rec)
     assert "stop_child" in names and "reset_asset" in names
-    assert next(c for c in rec if c[0] == "set_job")[2]["status"] == "error"
+    assert "fail" in _names(rec)
 
 
 # --- _stop_child escalation -----------------------------------------------------------------

frontend/e2e/README.md

@@ -17,6 +17,16 @@ siftlode e2e-seed       # (re)seed the test account only, no tests
 The localdev stack must be up (`siftlode dev`). `global.setup.ts` reseeds the account and logs in
 once, sharing the session via `e2e/.auth/state.json` (git-ignored).
 
+**Browsers** — every flow runs in three projects: `chromium` (Desktop Chrome), `webkit` (Desktop
+Safari) and `ipad` (iPad gen 7 landscape: 1080×810, touch, mobile). Install the engines once per
+machine with `npx playwright install chromium webkit`; run one project with
+`npx playwright test --project=ipad`. WebKit catches what every iOS browser inherits from the engine
+(JS, CSS/layout, event order). It does **not** reproduce iPad media refusals: Playwright's WebKit
+decodes through the host OS (Media Foundation on Windows, GStreamer on Linux), and measured on
+2026-09-14 it played an mp3-in-mp4 and an AV1 mp4 that a real iPad refuses. Check a media format
+on a real iPad against the dev stack over the LAN (`http://<desktop LAN IP>:8080`, e.g. a
+login-free `/watch/<token>` share link).
+
 **Target** — `PW_BASE_URL` (default `http://127.0.0.1:8080`):
 
 - **`:8080`** (baked SPA) is authoritative and same-origin. After a **frontend change you must

frontend/e2e/global.setup.ts

@@ -67,13 +67,17 @@ setup("seed + authenticate", async ({ page }) => {
   const me = await (await page.request.get("/api/me")).json();
   expect(me.authenticated, "session not established after login").toBeTruthy();
 
-  // 4. Pin the UI locale and suppress the first-login onboarding wizard (a full-screen overlay
+  // 4. Pin the UI locale, suppress the first-login onboarding wizard (a full-screen overlay
   //    that would intercept every click — the test account has no YouTube connection, so it
-  //    auto-opens). The dismissed flag is per-account: `siftlode.onboarding.dismissed.<id>`.
+  //    auto-opens), and opt the account out of starting on Home. Since E24 a bare URL lands on
+  //    Home, and the feed, channel and player flows this net locks all open "/" expecting the
+  //    feed; the opt-out is the one Settings → Appearance → Startup writes. Both flags are
+  //    per-account: `siftlode.onboarding.dismissed.<id>`, `siftlode.startOnHome.<id>`.
   await page.goto("/");
   await page.evaluate((id: number) => {
     localStorage.setItem("siftlode.lang", "en");
     localStorage.setItem(`siftlode.onboarding.dismissed.${id}`, "1");
+    localStorage.setItem(`siftlode.startOnHome.${id}`, "0");
   }, me.id);
   mkdirSync(dirname(STORAGE), { recursive: true });
   await page.context().storageState({ path: STORAGE });

frontend/eslint.config.js

@@ -109,5 +109,27 @@ export default tseslint.config(
       ],
     },
   },
+  {
+    // E11 S3: the same one-way rule one layer down. `lib/` is what components are built ON (hooks,
+    // the API slices, pure helpers), so it may not reach back UP into `components/` — not even for a
+    // type. That is how the `Column` contract came to be owned by a ui component that three lib
+    // helpers had to import from. A piece both layers need moves down into `lib/`.
+    files: ["src/lib/**/*.{ts,tsx}"],
+    rules: {
+      "no-restricted-imports": [
+        "error",
+        {
+          patterns: [
+            {
+              // Any depth (`lib/api/*` is one level deeper), and `(/|$)` so a bare barrel counts too.
+              regex: String.raw`^(\.\./)+components(/|$)`,
+              message:
+                "lib/ sits below components/: it may not import from components/, not even a type. Move the shared piece down into lib/.",
+            },
+          ],
+        },
+      ],
+    },
+  },
   prettier,
 );

frontend/playwright.config.ts

@@ -47,5 +47,19 @@ export default defineConfig({
       use: { ...devices["Desktop Chrome"], storageState: STORAGE_STATE },
       dependencies: ["setup"],
     },
+    // WebKit catches engine-level differences (JS, CSS/layout, event order) that every iOS browser
+    // inherits. It does NOT reproduce iPad MEDIA refusals: Playwright's WebKit decodes through the
+    // host OS (Media Foundation on Windows, GStreamer on Linux), and measured on 2026-09-14 it played
+    // an mp3-in-mp4 and an AV1 mp4 that iPad refuses. Media checks need a real iPad.
+    {
+      name: "webkit",
+      use: { ...devices["Desktop Safari"], storageState: STORAGE_STATE },
+      dependencies: ["setup"],
+    },
+    {
+      name: "ipad",
+      use: { ...devices["iPad (gen 7) landscape"], storageState: STORAGE_STATE },
+      dependencies: ["setup"],
+    },
   ],
 });

frontend/src/App.keymap.contract.test.ts

@@ -1,33 +0,0 @@
-// The global Shift+W wiring, pinned at its call site.
-//
-// What this is: a source contract, the same idiom as uiBoundary.contract.test.ts — a structural rule
-// asserted directly rather than left to prose. What it is NOT: a behaviour test. The behaviour lives
-// in history.dom.test.ts and history.burial.dom.test.ts, which drive `navigateOverOverlays` against
-// real overlay entries; the end-to-end gesture (Shift+W over an open player, then Back) is a browser
-// check, because jsdom reproduces history ordering only as bookkeeping.
-//
-// It exists because the composition line itself was unpinned: App.tsx is the one module no test
-// renders (main.tsx lazy-imports it and nothing else does), globalKeymap.dom.test.tsx drives the
-// hook with its OWN handler, and history.dom.test.ts drives the helper with its own navigate — so
-// dropping `navigateOverOverlays` from App left all 818 tests green while the user-visible bug came
-// straight back (round 2, verified by running that revert).
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-
-import { describe, expect, it } from "vitest";
-
-const APP = readFileSync(fileURLToPath(new URL("./App.tsx", import.meta.url)), "utf8");
-
-describe("App · global keymap wiring", () => {
-  it("routes the global home shortcut through navigateOverOverlays", () => {
-    const call = /useGlobalKeymap\(([\s\S]*?)\);/.exec(APP)?.[1];
-    // A rename or a move is a legitimate change — but then this test is the thing that has to be
-    // updated deliberately, which is the whole point of pinning it.
-    expect(
-      call,
-      "App.tsx no longer calls useGlobalKeymap in a shape this test can read",
-    ).toBeTypeOf("string");
-    expect(call).toContain("navigateOverOverlays");
-    expect(call).toContain('setPage("home")');
-  });
-});

frontend/src/App.tsx

@@ -2,15 +2,15 @@ import { lazy, Suspense, useEffect, useState } from "react";
 import { qk } from "./lib/queryKeys";
 import { useTranslation } from "react-i18next";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
-import { api, getActiveAccount, setActiveAccount, setUnauthorizedHandler } from "./lib/api";
-import { setLanguage, isSupported, type LangCode } from "./i18n";
+import { api, setUnauthorizedHandler, type Me } from "./lib/api";
+import { notifyActionError } from "./lib/actionErrors";
+import { setLanguage, type LangCode } from "./i18n";
 import { clearParams } from "./lib/urlState";
 import type { Page } from "./lib/urlState";
 import {
-  loadLayout,
-  normalizeLayout,
   PREF_KEY,
   saveLayoutLocal,
+  seedLayout,
   type PanelId,
   type PanelLayout,
 } from "./lib/panelLayout";
@@ -22,8 +22,10 @@ import { useNavigation, useNavigationActions } from "./components/NavigationProv
 import { useFeedFilters, useFeedFiltersActions } from "./components/FeedFiltersProvider";
 import { useChannelLayout } from "./components/ChannelsProvider";
 import { useFeedView, useFeedViewActions } from "./components/FeedViewProvider";
-import { moduleDef } from "./lib/modules";
-import { PAGE_CONTENT, PAGE_RAIL } from "./components/moduleRegistry";
+import { moduleDef, moduleOrder } from "./lib/modules";
+import { PAGE_CONTENT, PAGE_RAIL, preloadPages } from "./components/moduleRegistry";
+import { lazyWithPreload } from "./lib/lazyWithPreload";
+import { LoadingState } from "./components/ui/QueryState";
 // Persistent shell — always mounted, so eagerly imported.
 import Welcome from "./components/Welcome";
 import SetupWizard from "./components/SetupWizard";
@@ -37,8 +39,6 @@ import Toaster from "./components/ui/Toaster";
 import KeyboardHelp from "./components/ui/KeyboardHelp";
 import AppCommandPalette from "./components/AppCommandPalette";
 import { useGlobalKeymap } from "./lib/keymap";
-import { navigateOverOverlays } from "./lib/history";
-import { StateMessage } from "./components/ui/QueryState";
 import ErrorDialog from "./components/ErrorDialog";
 import VersionBanner from "./components/VersionBanner";
 import DemoBanner from "./components/DemoBanner";
@@ -52,7 +52,7 @@ import { FRONTEND_VERSION } from "./lib/version";
 // The page modules (and their side rails) are code-split per route via the module registry
 // (components/moduleRegistry). App keeps only the persistent-shell chunks + the channel page and the
 // two modals, which sit outside the registry-driven content column.
-const ChannelPage = lazy(() => import("./components/ChannelPage"));
+const ChannelPage = lazyWithPreload(() => import("./components/ChannelPage"));
 const About = lazy(() => import("./components/About"));
 const ReleaseNotes = lazy(() => import("./components/ReleaseNotes"));
 
@@ -79,13 +79,20 @@ export default function App() {
   // by the feed page and the channel page. App reads it only to hand to <Feed>/<ChannelPage>.
   const view = useFeedView();
   const { setView } = useFeedViewActions();
+  const queryClient = useQueryClient();
   // Per-panel "customize" layouts (order/collapsed/hidden of each side panel's group cards),
-  // persisted per-account. One record so feed/plex/playlists share the same mechanism.
-  const [panelLayouts, setPanelLayouts] = useState<Record<PanelId, PanelLayout>>(() => ({
-    feed: loadLayout("feed"),
-    plex: loadLayout("plex"),
-    playlists: loadLayout("playlists"),
-  }));
+  // persisted per-account. One record so feed/plex/playlists share the same mechanism. Seeded from
+  // the account's server preferences — BootGate mounts App only once `me` is cached — so a layout
+  // changed on another device is right on the first paint; the local copy covers a key the server
+  // has never stored.
+  const [panelLayouts, setPanelLayouts] = useState<Record<PanelId, PanelLayout>>(() => {
+    const prefs = queryClient.getQueryData<Me | null>(qk.me())?.preferences;
+    return {
+      feed: seedLayout("feed", prefs),
+      plex: seedLayout("plex", prefs),
+      playlists: seedLayout("playlists", prefs),
+    };
+  });
   const [aboutOpen, setAboutOpen] = useState(false);
   const [notesOpen, setNotesOpen] = useState(false);
   const [notesHighlight, setNotesHighlight] = useState<string | undefined>(undefined);
@@ -98,12 +105,14 @@ export default function App() {
   function setPanelLayout(panel: PanelId, next: PanelLayout) {
     setPanelLayouts((prev) => ({ ...prev, [panel]: next }));
     saveLayoutLocal(panel, next);
-    api.savePrefs({ [PREF_KEY[panel]]: next }).catch(() => {});
+    api
+      .savePrefs({ [PREF_KEY[panel]]: next })
+      .catch((e: unknown) => notifyActionError(e, t("errors.writeFailed.prefs")));
   }
 
   // Collapse state for the two full-height panels (left nav + filter sidebar). Persisted to the
-  // user's preferences (via usePref) so it follows the account across devices; the localStorage mirror
-  // seeds the initial render synchronously so nothing flashes open before the server prefs arrive.
+  // user's preferences (via usePref) so it follows the account across devices, seeded from the `me`
+  // cache at mount; the localStorage mirror covers an account whose server prefs never stored it.
   // Default unpinned (tab + hover-expand overlay); accounts that explicitly pin keep their choice.
   const [filterCollapsed, setFilterCollapsed] = usePref<boolean>("filterCollapsed", true, {
     localKey: LS.filterCollapsed,
@@ -117,47 +126,50 @@ export default function App() {
   // (The feed filters + page/channel now LIVE in the address bar — FeedFiltersProvider and
   // NavigationProvider read them on load and keep them mirrored — so there's no query to strip here.)
 
-  const queryClient = useQueryClient();
-  // First-run install gate: a fresh instance reports configured=false and runs in setup mode.
-  // We check this before anything else and render the wizard; `me` is held back until we know the
-  // instance is set up (otherwise it would 503 against the setup-mode lock).
+  // Passive observers (enabled:false) of the setup-status and `me` queries BootGate fetches, polls
+  // and waits for: App mounts only once both have answered, so their caches are always populated here.
   const setupQuery = useQuery({
     queryKey: qk.setupStatus(),
     queryFn: api.setupStatus,
-    staleTime: Infinity,
+    enabled: false,
   });
   const needsSetup = setupQuery.data?.configured === false;
-  // Poll the session so an account suspended/deleted by an admin is noticed even with no
-  // interaction (option 1): the refetch 401s → the 401 handler below drops to the login page.
-  // Only poll while signed in (data present) — polling on the public login page is pointless and
-  // its periodic refetch caused a visible flicker there.
-  const meQuery = useQuery({
-    queryKey: qk.me(),
-    queryFn: api.me,
-    enabled: setupQuery.isSuccess && !needsSetup,
-    refetchInterval: (query) => (query.state.data ? 60_000 : false),
-  });
+  const meQuery = useQuery({ queryKey: qk.me(), queryFn: api.me, enabled: false });
 
   // The `global` key scope: `h` opens the cheat sheet, Mod+K the jump-to palette, Shift+W jumps to
   // Home ("mit nézzek?"). Bound only once signed in, because that is where the overlays are mounted
   // (bottom of this tree) and where the modules exist at all — see useGlobalKeymap on why binding it
   // above the signed-out branch is worse than not binding it.
-  // Through `navigateOverOverlays`, because a global key can fire while an overlay is open and does
-  // not know it: the page change unmounts the player (it lives inside the module), whose reconcile
-  // then reclaimed the entry this push had just made — Shift+W over a playing video closed the
-  // player and snapped straight back to the feed. `setPage`'s boolean is load-bearing here, not
-  // decoration: pressed while ALREADY on Home (the default landing page) it navigates nowhere, and
-  // burying the open player's entry under a push that never happened orphaned it — see `buryUnder`.
-  useGlobalKeymap(!!meQuery.data, () => navigateOverOverlays(() => setPage("home")));
+  // A global key can fire while an overlay is open; `setPage` closes every overlay before it pushes,
+  // so Shift+W over the player lands on Home with the player closed — also when Home is already the
+  // page underneath (owner decision 2026-09-09: the key always ends with the answer on screen).
+  // The `page` scope rides the same binding: the `g` chords jump to a module, but only to one this
+  // account can reach (the nav rail's own list, plus Settings, which is not in the rail's order).
+  useGlobalKeymap(
+    !!meQuery.data,
+    setPage,
+    meQuery.data ? [...moduleOrder(meQuery.data), "settings"] : [],
+  );
 
-  // Pin this tab to whatever account it first loaded as. Without this, a tab that never picked
-  // an account (it was riding the session's default) would silently swap identity when ANOTHER
-  // tab changes the default — e.g. that other tab adds/switches an account. Once pinned, this
-  // tab always sends its own account header, so cross-tab changes can't reach it. An explicit
-  // switch on THIS tab sets the override itself (so this no-ops then).
+  // Fetch the code of every module this account can open — and the channel page — once the first page
+  // is on screen, so a module's first visit renders at once instead of flashing the chunk fallback.
+  // Idle-scheduled so it never competes with the first page's own requests (Safari has no
+  // requestIdleCallback, hence the timer).
   useEffect(() => {
-    if (meQuery.data && getActiveAccount() == null) setActiveAccount(meQuery.data.id);
-  }, [meQuery.data?.id]);
+    const me = meQuery.data;
+    if (!me) return;
+    const run = () => {
+      preloadPages([...moduleOrder(me), "settings"]);
+      ChannelPage.preload().catch(() => {});
+    };
+    const idle = window.requestIdleCallback as typeof window.requestIdleCallback | undefined;
+    if (idle) {
+      const id = idle(run, { timeout: 3000 });
+      return () => window.cancelIdleCallback(id);
+    }
+    const id = window.setTimeout(run, 1000);
+    return () => window.clearTimeout(id);
+  }, [meQuery.data?.id]); // eslint-disable-line react-hooks/exhaustive-deps
 
   // Measure the scrollbar's gutter width once and publish it as --sbw, so the floating header and the
   // toolbar band can pad their right edge to line up with the scrolled cards (the app scroller reserves
@@ -233,28 +245,6 @@ export default function App() {
     clearParams("admin");
   }, [adminDeepLink, meQuery.data?.id]); // eslint-disable-line react-hooks/exhaustive-deps
 
-  // On login, adopt the server-stored SHELL preferences (panel layouts + language). The rail-collapse
-  // flags (filterCollapsed / playlistsCollapsed) are adopted by their own usePref hooks, the
-  // Settings-page prefs (theme/perf/hints/notifications) by PrefsProvider, and the feed view by
-  // FeedViewProvider — each via its own passive qk.me() observer.
-  useEffect(() => {
-    const prefs = meQuery.data?.preferences;
-    if (!prefs) return;
-    (["feed", "plex", "playlists"] as PanelId[]).forEach((p) => {
-      const raw = prefs[PREF_KEY[p]];
-      if (raw) {
-        const l = normalizeLayout(p, raw);
-        setPanelLayouts((prev) => ({ ...prev, [p]: l }));
-        saveLayoutLocal(p, l);
-      }
-    });
-    const lang = prefs.language;
-    if (typeof lang === "string" && isSupported(lang)) setLanguage(lang);
-    // (Per-account filters — incl. the demo account's whole-library default — are loaded by the
-    // dedicated effect above, which also covers accounts that have no stored preferences.)
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [meQuery.data?.id]);
-
   // Nudge admins when access requests are waiting (in lieu of a server-push bell). Keyed on the
   // pending COUNT so it re-resolves the moment an approval/denial changes it — not only on a
   // fresh load (which is why the notice used to linger until F5 after an approval).
@@ -279,8 +269,8 @@ export default function App() {
           label: t("common.accessRequestsReview"),
           onClick: () => {
             focusAccessRequestsTab();
-            // Over whatever overlay the toast was clicked in — as navigateTo does (see lib/nav).
-            navigateOverOverlays(() => setPage("users"));
+            // Clicked inside whatever overlay hosts the toast; setPage closes it before pushing.
+            setPage("users");
           },
         },
       });
@@ -291,36 +281,22 @@ export default function App() {
   // Language is edited outside the Settings page (sidebar/login), so it stays instant.
   function changeLanguage(code: LangCode) {
     setLanguage(code);
-    api.savePrefs({ language: code }).catch(() => {});
+    // Also from the signed-out login page, where the save 401s — `req` marks that as handled, so
+    // the reporter stays quiet there.
+    api
+      .savePrefs({ language: code })
+      .catch((e: unknown) => notifyActionError(e, t("errors.writeFailed.prefs")));
   }
 
   // First-run: a fresh instance is in setup mode (all other routes are locked) → show the wizard.
-  if (setupQuery.isLoading)
-    return (
-      <div className="min-h-screen grid place-items-center text-muted">{t("common.loading")}</div>
-    );
   if (needsSetup) return <SetupWizard />;
-
-  if (meQuery.isLoading)
-    return (
-      <div className="min-h-screen grid place-items-center text-muted">{t("common.loading")}</div>
-    );
-  // /api/me answers 200 always now (null body = logged out), so a thrown error here is a real
-  // network/5xx failure, and no data means "not signed in" → the public landing.
-  if (meQuery.error)
-    return (
-      <div className="min-h-screen grid place-items-center">
-        <StateMessage tone="error" onRetry={() => meQuery.refetch()}>
-          {t("common.somethingWrong")}
-        </StateMessage>
-      </div>
-    );
+  // /api/me answers 200 always (null body = logged out), and BootGate has already handled a failed
+  // probe — so no data here means "not signed in" → the public landing.
   if (!meQuery.data) return <Welcome verify={verifyEntry} />;
 
-  // Shown briefly while a lazy page/module chunk loads (first visit to that page only).
-  const pageFallback = (
-    <div className="flex-1 grid place-items-center text-muted">{t("common.loading")}</div>
-  );
+  // Shown while a page's chunk is still on its way: only if its visit beats the preload above (or the
+  // preload failed), and like every loading state it stays invisible for a load that is quick anyway.
+  const pageFallback = <LoadingState className="flex-1 justify-center" />;
 
   // Scroll restore/reset key for the shared normal-page scroller (see PageScroller): the same
   // page/feed-filters returns you to where you were (bug 1); a changed feed filter is a new key, so

frontend/src/components/AboutCell.tsx

@@ -49,7 +49,7 @@ export default function AboutCell({ text, channelId }: { text: string | null; ch
         ref={pop.refs.setReference}
         {...pop.getReferenceProps()}
         tabIndex={0}
-        className="block max-w-88 truncate text-muted cursor-help rounded-sm outline-hidden focus-visible:outline-2 focus-visible:outline-accent/60 focus-visible:outline-offset-2"
+        className="block max-w-88 truncate text-muted cursor-help rounded-sm outline-hidden focus-visible:outline-2 focus-visible:outline-accent focus-visible:outline-offset-2"
       >
         {preview}
       </span>

frontend/src/components/AccountPanel.tsx

@@ -7,8 +7,9 @@ import { LoadingState, StateMessage } from "./ui/QueryState";
 import { api } from "../lib/api";
 import { qk } from "../lib/queryKeys";
 import { notify } from "../lib/notifications";
+import { notifyActionError } from "../lib/actionErrors";
 import { copyText } from "../lib/clipboard";
-import { invalidateUserAccess, isEmailOff } from "../lib/adminUsers";
+import { invalidateUserAccess } from "../lib/adminUsers";
 import type { AdminUserAccess, AdminUserRow } from "../lib/api/admin";
 
 // The admin's answer to "why can this person not get in?", and the place every recovery action for
@@ -66,25 +67,19 @@ export default function AccountPanel({
   const issue = useMutation({
     mutationFn: () => api.createSetPasswordLink(user.id),
     onSuccess: (r) => setLink({ url: r.url, expires_at: r.expires_at }),
-    onError: () => notify({ level: "error", message: t("users.account.linkFailed") }),
+    onError: (err) => notifyActionError(err, t("users.account.linkFailed")),
   });
 
   const resend = useMutation({
     mutationFn: () => api.resendUserVerification(user.id),
     onSuccess: () => notify({ level: "success", message: t("users.account.resendSent") }),
-    onError: (err) =>
-      notify({
-        level: "error",
-        message: isEmailOff(err)
-          ? t("users.pendingAccess.resendEmailOff")
-          : t("users.pendingAccess.resendFailed"),
-      }),
+    onError: (err) => notifyActionError(err, t("users.pendingAccess.resendFailed")),
   });
 
   const activate = useMutation({
     mutationFn: () => api.activateUser(user.id),
     onSuccess: () => invalidateUserAccess(qc, user.id),
-    onError: () => notify({ level: "error", message: t("users.pendingAccess.activateFailed") }),
+    onError: (err) => notifyActionError(err, t("users.pendingAccess.activateFailed")),
   });
 
   const copy = async () => {
@@ -201,7 +196,9 @@ export default function AccountPanel({
 
             <button
               onClick={() => resend.mutate()}
-              disabled={!a.email_configured || a.email_verified || resend.isPending}
+              // The demo account's address is never confirmed, and the server refuses to mail it — as
+              // it refuses it a set-password link below (deep-review E11 round 3).
+              disabled={user.is_demo || !a.email_configured || a.email_verified || resend.isPending}
               className="w-full glass-card glass-hover flex items-center gap-2 px-3 py-2.5 rounded-lg text-xs disabled:opacity-45 transition"
             >
               <Send className="w-4 h-4 shrink-0" />

frontend/src/components/AdminUsers.dom.test.tsx

@@ -86,7 +86,8 @@ describe("a user action that fails", () => {
     await waitFor(() =>
       expect(notify).toHaveBeenCalledWith({
         level: "error",
-        message: i18n.t("errors.notFound.user"), // the request layer localizes a structured detail
+        title: "users.roles.failed", // what failed…
+        message: i18n.t("errors.notFound.user"), // …and why: the request layer localizes a structured detail
       }),
     );
     await waitFor(() => expect(users).toHaveBeenCalledTimes(2));

frontend/src/components/AdminUsers.tsx

@@ -24,7 +24,7 @@ import {
   type PendingAccessRow,
 } from "../lib/api";
 import { notify } from "../lib/notifications";
-import { invalidateUserAccess, isEmailOff } from "../lib/adminUsers";
+import { invalidateUserAccess } from "../lib/adminUsers";
 import { ADMIN_USERS_TAB_KEY } from "../lib/adminUsersTab";
 import { Button } from "./ui/Button";
 import Tooltip from "./ui/Tooltip";
@@ -38,7 +38,7 @@ import { useConfirm } from "./ConfirmProvider";
 import Tabs, { usePersistedTab } from "./ui/Tabs";
 import { PageToolbar } from "./ui/PageShell";
 import { useMe } from "../lib/useMe";
-import { notifyActionError } from "../lib/actionErrors";
+import { notifyActionError, notifyKnownFailure } from "../lib/actionErrors";
 
 // Admin-only user & access management: roles, access requests (the Invite whitelist), and the
 // demo whitelist + reset. Each section is its own tab (persisted across reloads); the Access tab
@@ -319,12 +319,6 @@ function UsersRoles({ me }: { me: Me }) {
   );
 }
 
-/** Did the invitation fail because this instance has no working SMTP? */
-function inviteEmailOff(err: HttpError): boolean {
-  const d = err.detailData as { code?: string; reason?: string } | null | undefined;
-  return d?.code === "invite_send" && d.reason === "email_off";
-}
-
 // --- Sign-ups that are still outside (roadmap UX-25) --------------------------------------------
 //
 // The gap this closes: approve an address BEFORE the person registers and their sign-up produces no
@@ -351,7 +345,7 @@ function PendingAccess() {
       refresh();
       notify({ level: "success", message: t("users.pendingAccess.activated", { email: u.email }) });
     },
-    onError: () => notify({ level: "error", message: t("users.pendingAccess.activateFailed") }),
+    onError: (err) => notifyActionError(err, t("users.pendingAccess.activateFailed")),
   });
 
   const resend = useMutation({
@@ -360,15 +354,9 @@ function PendingAccess() {
       refresh();
       notify({ level: "success", message: t("users.pendingAccess.resent", { email: u.email }) });
     },
-    // The public resend is deliberately silent; this one is not, so say WHY it failed — an instance
-    // with no working SMTP would otherwise show a success toast for a mail that was never sent.
-    onError: (err) =>
-      notify({
-        level: "error",
-        message: isEmailOff(err)
-          ? t("users.pendingAccess.resendEmailOff")
-          : t("users.pendingAccess.resendFailed"),
-      }),
+    // The public resend is deliberately silent; this one is not, and the server's reason says WHY
+    // (no working SMTP, a refused send) — a success toast for a mail never sent would be the lie.
+    onError: (err) => notifyActionError(err, t("users.pendingAccess.resendFailed")),
   });
 
   const list = rows.data ?? [];
@@ -563,12 +551,8 @@ function AdminInvites() {
       // A 409 means the list was stale — someone registered on that address since it loaded. Say
       // what to do instead of a generic failure, and refetch so the row re-renders as read-only.
       const conflict = e instanceof HttpError && e.status === 409;
-      notify({
-        level: "error",
-        message: t(
-          conflict ? "settings.invites.deleteHasAccount" : "settings.invites.deleteFailed",
-        ),
-      });
+      if (conflict) notifyKnownFailure(e, t("settings.invites.deleteHasAccount"));
+      else notifyActionError(e, t("settings.invites.deleteFailed"));
       if (conflict) refresh();
     },
   });
@@ -598,14 +582,7 @@ function AdminInvites() {
       refresh();
       notify({ level: "success", message: t("settings.invites.invited", { email: v.inv.email }) });
     },
-    onError: (err) =>
-      notify({
-        level: "error",
-        message:
-          err instanceof HttpError && inviteEmailOff(err)
-            ? t("settings.invites.inviteEmailOff")
-            : t("settings.invites.inviteFailed"),
-      }),
+    onError: (err) => notifyActionError(err, t("settings.invites.inviteFailed")),
   });
   // The one recipient the app has no language signal about: the admin typed this address in, so
   // nobody ever told us how to write to its owner. The dialog is where that gets decided — and it

frontend/src/components/BootGate.dom.test.tsx

@@ -0,0 +1,208 @@
+// @vitest-environment jsdom
+//
+// BootGate settles the tab's identity BEFORE the app tree mounts. The bug it replaced: a new tab (no
+// pinned account in sessionStorage) built the app for "no account" first — so with Settings →
+// Appearance → Startup turned off, NavigationProvider's initializer could not read the opt-out and
+// landed on Home, mirrored ?page=home into the address bar, and then re-read its own mirror when the
+// account was pinned, staying on Home. Only a same-tab reload (account already pinned) was right.
+//
+// Real NavigationProvider, real storage and i18n; only the two boot probes are stubbed. The probe
+// records EVERY render, so "never showed the wrong page, not even for one render" is what is asserted.
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { render, screen, cleanup, act, fireEvent, waitFor } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { useEffect } from "react";
+import { useTranslation } from "react-i18next";
+import BootGate from "./BootGate";
+import { NavigationProvider, useNavigation } from "./NavigationProvider";
+import { api, type Me } from "../lib/api";
+import { ACTIVE_ACCOUNT_KEY } from "../lib/activeAccount";
+import { qk } from "../lib/queryKeys";
+import i18n from "../i18n";
+
+const renders: { page: string; lang: string }[] = [];
+let mounts = 0;
+function Probe() {
+  const { page } = useNavigation();
+  const { i18n: inst } = useTranslation();
+  renders.push({ page, lang: inst.language });
+  useEffect(() => {
+    mounts++;
+  }, []);
+  return <div data-testid="app">{page}</div>;
+}
+
+function mount() {
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  render(
+    <QueryClientProvider client={qc}>
+      <BootGate>
+        <NavigationProvider>
+          <Probe />
+        </NavigationProvider>
+      </BootGate>
+    </QueryClientProvider>,
+  );
+  return qc;
+}
+const account = (over: Partial<Me> = {}) => ({ id: 5, preferences: {}, ...over }) as Me;
+const retryButton = () => screen.findByRole("button", { name: i18n.t("common.retry") });
+
+beforeEach(async () => {
+  localStorage.clear();
+  sessionStorage.clear(); // a NEW tab: nothing pinned yet
+  window.history.replaceState(null, "", "/");
+  renders.length = 0;
+  mounts = 0;
+  await i18n.changeLanguage("en");
+  vi.spyOn(api, "setupStatus").mockResolvedValue({ configured: true });
+});
+afterEach(() => {
+  cleanup();
+  vi.restoreAllMocks();
+  vi.unstubAllGlobals();
+});
+
+describe("BootGate", () => {
+  it("a new tab with Startup off opens on the page the account left — never on Home first", async () => {
+    localStorage.setItem("siftlode.startOnHome.5", "0");
+    localStorage.setItem("siftlode.page.5", "downloads");
+    vi.spyOn(api, "me").mockResolvedValue(account());
+    mount();
+
+    expect((await screen.findByTestId("app")).textContent).toBe("downloads");
+    expect(renders.map((r) => r.page)).toEqual(renders.map(() => "downloads"));
+    expect(new URLSearchParams(window.location.search).get("page")).toBe("downloads");
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBe("5"); // the tab is pinned
+  });
+
+  it("renders the app in the account's language from its first render", async () => {
+    vi.spyOn(api, "me").mockResolvedValue(account({ preferences: { language: "hu" } }));
+    mount();
+
+    await screen.findByTestId("app");
+    expect(renders.map((r) => r.lang)).toEqual(renders.map(() => "hu"));
+  });
+
+  it("mounts nothing of the app while the identity is still unknown", async () => {
+    vi.spyOn(api, "me").mockReturnValue(new Promise<Me | null>(() => {}));
+    mount();
+    await act(async () => {}); // the setup probe resolves; `me` never does
+
+    expect(screen.queryByTestId("app")).toBeNull();
+    expect(renders).toHaveLength(0);
+  });
+
+  it("signed out: mounts the app (App shows the landing) without pinning an account", async () => {
+    vi.spyOn(api, "me").mockResolvedValue(null);
+    mount();
+
+    await screen.findByTestId("app");
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBeNull();
+  });
+
+  it("setup mode: mounts the app (App shows the wizard) without asking for the account", async () => {
+    vi.mocked(api.setupStatus).mockResolvedValue({ configured: false });
+    const me = vi.spyOn(api, "me").mockResolvedValue(account());
+    mount();
+
+    await screen.findByTestId("app");
+    expect(me).not.toHaveBeenCalled();
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBeNull();
+  });
+
+  it("an unanswered setup probe is an error with a retry — never the signed-out landing", async () => {
+    vi.mocked(api.setupStatus)
+      .mockRejectedValueOnce(new Error("502"))
+      .mockResolvedValue({ configured: true });
+    vi.spyOn(api, "me").mockResolvedValue(account());
+    mount();
+
+    fireEvent.click(await retryButton());
+    await screen.findByTestId("app");
+    expect(renders.length).toBeGreaterThan(0);
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBe("5"); // it mounted for the account
+  });
+
+  it("an unanswered first account probe is an error with a retry", async () => {
+    vi.spyOn(api, "me").mockRejectedValueOnce(new Error("502")).mockResolvedValue(account());
+    mount();
+
+    fireEvent.click(await retryButton());
+    await screen.findByTestId("app");
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBe("5");
+  });
+
+  it("a background refetch that fails keeps the app mounted, as it was", async () => {
+    const me = vi.spyOn(api, "me").mockResolvedValue(account());
+    const qc = mount();
+    await screen.findByTestId("app");
+
+    me.mockRejectedValue(new Error("502"));
+    await act(() => qc.refetchQueries({ queryKey: qk.me() }));
+    // react-query hands the error to its observers on a timer: let that render land before asserting.
+    await act(() => new Promise((r) => setTimeout(r, 20)));
+
+    expect(qc.getQueryState(qk.me())?.status).toBe("error");
+    expect(screen.getByTestId("app")).toBeTruthy();
+    expect(mounts).toBe(1);
+  });
+
+  it("a pin naming another account than the server answered as is corrected before the app reads it", async () => {
+    // Pinned to 9, but 9 was signed out in another tab: the server answers as the browser's default, 5.
+    sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, "9");
+    localStorage.setItem("siftlode.startOnHome.5", "0");
+    localStorage.setItem("siftlode.page.5", "downloads");
+    vi.spyOn(api, "me").mockResolvedValue(account());
+    mount();
+
+    expect((await screen.findByTestId("app")).textContent).toBe("downloads");
+    expect(renders.map((r) => r.page)).toEqual(renders.map(() => "downloads"));
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBe("5");
+  });
+
+  it("a mounted tab whose identity changes reloads rather than keep the previous account's tree", async () => {
+    const me = vi.spyOn(api, "me").mockResolvedValue(account());
+    const qc = mount();
+    await screen.findByTestId("app");
+    const reload = vi.fn();
+    vi.stubGlobal("location", { ...window.location, reload });
+
+    me.mockResolvedValue(null); // the session ended
+    await act(() => qc.refetchQueries({ queryKey: qk.me() }));
+
+    await waitFor(() => expect(reload).toHaveBeenCalled());
+  });
+
+  it("an identity change reloads without moving the pin first", async () => {
+    // The tree being torn down still runs its unmount saves before the page goes; with the pin already
+    // moved they would land under the NEW account's local keys (a player volume still pending, say).
+    const me = vi.spyOn(api, "me").mockResolvedValue(account());
+    const qc = mount();
+    await screen.findByTestId("app");
+    const reload = vi.fn();
+    vi.stubGlobal("location", { ...window.location, reload });
+
+    me.mockResolvedValue(account({ id: 6 })); // 5 was signed out elsewhere: the server answers as 6
+    await act(() => qc.refetchQueries({ queryKey: qk.me() }));
+
+    await waitFor(() => expect(reload).toHaveBeenCalled());
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBe("5");
+  });
+
+  it("a change to the account's data, not its identity, leaves the app as it is", async () => {
+    vi.spyOn(api, "me").mockResolvedValue(account());
+    const qc = mount();
+    await screen.findByTestId("app");
+    const reload = vi.fn();
+    vi.stubGlobal("location", { ...window.location, reload });
+
+    // What every pref save does to the cache (usePref's mergePrefsCache): a new `me` for the same account.
+    act(() => qc.setQueryData(qk.me(), account({ preferences: { language: "hu" } })));
+    await act(() => new Promise((r) => setTimeout(r, 20)));
+
+    expect(reload).not.toHaveBeenCalled();
+    expect(mounts).toBe(1);
+    expect(i18n.language).toBe("en"); // the language is adopted once, never over the user's own choice
+  });
+});

frontend/src/components/BootGate.tsx

@@ -0,0 +1,124 @@
+import { useLayoutEffect, useState, type ReactNode } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { useTranslation } from "react-i18next";
+import { api, getActiveAccount, setActiveAccount } from "../lib/api";
+import { qk } from "../lib/queryKeys";
+import i18n, { isSupported, setLanguage } from "../i18n";
+import { LoadingState, StateMessage } from "./ui/QueryState";
+
+// The boot sequence, in ONE place: nothing of the app renders until this tab knows WHO it is.
+//
+// Per-account state is everywhere — the landing page, the feed's filters, the Plex scope, the manager's
+// tab, the theme, the language — and all of it is read synchronously when its provider mounts. Those
+// providers used to mount before /api/me answered, so a new tab first built the app for "no account"
+// (defaults: Home instead of the page you left, the default theme, the browser language) and then
+// patched each piece once <App> pinned the account. Every patch was a visible jump at best, and at
+// worst it read a value the first pass had already written (the landing page mirrored ?page=home into
+// the address bar, then re-read its own mirror and stayed on Home). So the order is inverted instead:
+// settle the identity, adopt what must be adopted before a single pixel of the app is drawn, THEN mount
+// the provider tree — whose initializers are then simply right, with nothing to re-read.
+//
+// The per-account initializers read the tab's PIN (sessionStorage), not `me`, so the pin is made to
+// match the account the server answered as before they run. And the tree is only ever built for one
+// identity: if a mounted tab's identity changes without a reload (its session ended, or the account it
+// was pinned to was signed out in another tab and the server now answers as the browser's default),
+// the tab reloads, like every account switch does (NavSidebar) — which also drops the previous
+// account's query cache, whose keys are not per account.
+
+/** The quiet screen shown while the tab's identity (or the app chunk) is still on its way — the shared
+ * loading visual, full screen. Its reveal counts from navigation start, so the gate's screen, the
+ * Suspense fallback after it and the first page's own loading state keep one clock (see LoadingState). */
+export function BootScreen() {
+  return (
+    <div className="min-h-screen grid place-items-center">
+      <LoadingState since={0} delayMs={400} />
+    </div>
+  );
+}
+
+export default function BootGate({ children }: { children: ReactNode }) {
+  const { t } = useTranslation();
+  // First-run install gate: a fresh instance reports configured=false and runs in setup mode, where
+  // every other route is locked — so `me` is held back until the instance is known to be set up
+  // (otherwise it would 503 against the setup-mode lock).
+  const setupQuery = useQuery({
+    queryKey: qk.setupStatus(),
+    queryFn: api.setupStatus,
+    staleTime: Infinity,
+  });
+  const needsSetup = setupQuery.data?.configured === false;
+  // THE fetching `me` query; every other reader is a passive (enabled:false) observer of its cache.
+  // Polled while signed in so an ended session is noticed with no interaction: /api/me answers a
+  // signed-out (or suspended) caller with 200 and no account, the identity drops to "nobody", and the
+  // tab reloads to the login page. Not polled signed out — that refetch is pointless and used to
+  // flicker the public landing.
+  const meQuery = useQuery({
+    queryKey: qk.me(),
+    queryFn: api.me,
+    enabled: setupQuery.isSuccess && !needsSetup,
+    refetchInterval: (query) => (query.state.data ? 60_000 : false),
+  });
+  const me = meQuery.data;
+
+  // Who this tab is, once known: an account id, `null` for "nobody" (signed out, or setup mode — App
+  // renders the landing / the wizard for those), `undefined` while unknown or unanswerable.
+  // Keyed on the DATA, not the status: a background refetch that fails keeps the last answer, so a
+  // server blip never tears the whole app down to this screen.
+  const identity: number | null | undefined = !setupQuery.data
+    ? undefined
+    : needsSetup
+      ? null
+      : me === undefined
+        ? undefined
+        : (me?.id ?? null);
+
+  // Adopt the identity before the tree mounts. A layout effect, so the re-render it triggers happens
+  // before the browser paints: the frame that first shows the app already has the account pinned.
+  //   • Pin this tab to the account the server answered as. Without the pin, a tab riding the
+  //     session's default account would silently swap identity when ANOTHER tab changes that default
+  //     (adds or switches an account); once pinned it sends its own account header. The server honours
+  //     that header only for an account still signed in to this browser, so a pin naming one that is
+  //     not is corrected here — otherwise the tab would run as the default account on the server while
+  //     reading and writing the gone account's local state.
+  //   • Adopt the account's language, which follows the account across devices — the local copy only
+  //     knows what this browser last showed.
+  const [readyFor, setReadyFor] = useState<number | null | undefined>(undefined);
+  useLayoutEffect(() => {
+    if (identity === undefined) return;
+    if (readyFor !== undefined) {
+      // The tree was built for another identity — see the header. The pin stays as it is: the tree
+      // being torn down still runs its unmount saves before the page goes, and with the pin moved they
+      // would land under the new account's local keys. The reloaded page's first probe corrects it.
+      location.reload();
+      return;
+    }
+    if (me && getActiveAccount() !== me.id) setActiveAccount(me.id);
+    const lang = me?.preferences?.language;
+    if (typeof lang === "string" && isSupported(lang) && lang !== i18n.language) setLanguage(lang);
+    setReadyFor(identity);
+    // `me` is read for the identity it produced; a background refetch of the same account must not
+    // re-run the adoption over a language the user has just changed.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [identity]);
+
+  // No answer at all (a network or 5xx failure on the very first setup or account probe — past the
+  // one retry `req` already makes): say so, with a retry. An unanswered setup probe is NOT "signed
+  // out": rendering the login page to a signed-in user would be a lie. After a retry the identity
+  // lands and the tree mounts from scratch, like any first load.
+  const failed =
+    !setupQuery.data && setupQuery.isError
+      ? setupQuery
+      : me === undefined && meQuery.isError
+        ? meQuery
+        : null;
+  if (failed)
+    return (
+      <div className="min-h-screen grid place-items-center">
+        <StateMessage tone="error" onRetry={() => failed.refetch()}>
+          {t("common.somethingWrong")}
+        </StateMessage>
+      </div>
+    );
+  if (identity === undefined || readyFor !== identity) return <BootScreen />;
+  return <>{children}</>;
+}

frontend/src/components/ChannelDiscovery.tsx

@@ -108,9 +108,13 @@ export default function ChannelDiscovery({
           }
         >
           <button
-            onClick={() => onSubscribe(c)}
-            disabled={!canWrite || subscribe.isPending}
-            className="glass-card glass-hover inline-flex items-center gap-1.5 px-2.5 py-1.5 rounded-lg text-xs disabled:opacity-50 transition"
+            // Busy blocks the click, not the focus: a focused button that turns natively `disabled`
+            // drops the keyboard to <body> (the rule and its measurement: ui/Button).
+            onClick={() => !subscribe.isPending && onSubscribe(c)}
+            disabled={!canWrite}
+            aria-disabled={subscribe.isPending || undefined}
+            aria-busy={subscribe.isPending || undefined}
+            className="glass-card glass-hover inline-flex items-center gap-1.5 px-2.5 py-1.5 rounded-lg text-xs disabled:opacity-50 aria-disabled:opacity-50 transition"
           >
             <UserPlus className="w-3.5 h-3.5" />
             {t("channels.discovery.subscribe")}
@@ -238,6 +242,7 @@ export default function ChannelDiscovery({
             sort={sort}
             onSortChange={setSort}
             emptyText={t("channels.discovery.empty")}
+            keyboardNav
           />
         ) : (
           <ChannelLayoutGrid

frontend/src/components/ChannelLayoutGrid.dom.test.tsx

@@ -0,0 +1,87 @@
+// @vitest-environment jsdom
+//
+// The channel manager's card layout as a keyboard list (E11 S4c): each card is an item, and Enter opens
+// the channel through the name ChannelLink renders. VirtualGrid is replaced by a stand-in that mounts
+// every item — jsdom has no layout for the virtualizer to measure — and registers with listNav exactly
+// when the real one would: when it is asked to (`keyboardNav`).
+import { Fragment, useRef } from "react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { act, cleanup, render } from "@testing-library/react";
+import type { VirtualGridProps } from "./ui/VirtualGrid";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return { ...actual, useTranslation: () => ({ t: (key: string) => key }) };
+});
+vi.mock("./ui/VirtualGrid", async () => {
+  const { useListNav } = await import("../lib/listNav");
+  return {
+    default: function GridStandIn({
+      items,
+      getKey,
+      renderItem,
+      keyboardNav,
+    }: VirtualGridProps<unknown>) {
+      const ref = useRef<HTMLDivElement>(null);
+      useListNav(ref, { enabled: !!keyboardNav });
+      return (
+        <div ref={ref}>
+          {items.map((item, i) => (
+            <Fragment key={getKey(item)}>{renderItem(item, 0, i)}</Fragment>
+          ))}
+        </div>
+      );
+    },
+  };
+});
+
+import ChannelLayoutGrid from "./ChannelLayoutGrid";
+import ChannelLink from "./ChannelLink";
+import { type Column } from "./ui/DataTable";
+
+afterEach(cleanup);
+
+type Ch = { id: string; title: string };
+const rows: Ch[] = [
+  { id: "UCa", title: "Alpha" },
+  { id: "UCb", title: "Beta" },
+];
+
+function press(key: string) {
+  act(() => {
+    (document.activeElement ?? document.body).dispatchEvent(
+      new KeyboardEvent("keydown", { key, bubbles: true, cancelable: true }),
+    );
+  });
+}
+
+const focusedTitle = () =>
+  (document.activeElement as HTMLElement).querySelector("[data-nav-open]")?.textContent;
+
+describe("ChannelLayoutGrid · keyboard", () => {
+  it("walks the cards with j/k and opens the channel on Enter", () => {
+    const opened: string[] = [];
+    const columns: Column<Ch>[] = [
+      {
+        key: "channel",
+        header: "Channel",
+        cardPrimary: true,
+        render: (c) => (
+          <ChannelLink
+            id={c.id}
+            title={c.title}
+            thumbnailUrl={null}
+            onView={() => opened.push(c.id)}
+          />
+        ),
+      },
+    ];
+    render(<ChannelLayoutGrid rows={rows} columns={columns} rowKey={(c) => c.id} />);
+    press("j");
+    expect(focusedTitle()).toBe("Alpha");
+    press("j");
+    expect(focusedTitle()).toBe("Beta");
+    press("Enter");
+    expect(opened).toEqual(["UCb"]);
+  });
+});

frontend/src/components/ChannelLayoutGrid.tsx

@@ -3,6 +3,7 @@ import { useTranslation } from "react-i18next";
 import { type Column } from "./ui/DataTable";
 import VirtualGrid from "./ui/VirtualGrid";
 import { CHANNEL_LAYOUT_SPEC } from "../lib/channelLayout";
+import { navItemAttrs } from "../lib/listNav";
 
 // The channel manager's `cards` layout (E4 S3), built by reusing the SAME `Column<T>` render closures
 // the DataTable draws — so the subscribed and discovery tables (which have different columns) both get
@@ -12,6 +13,9 @@ import { CHANNEL_LAYOUT_SPEC } from "../lib/channelLayout";
 // Named slots place the columns that need bespoke positions; everything else flows in the meta line.
 // Unlike DataTable's cramped narrow-screen card fallback, the desktop card is roomy, so it shows the
 // `hideInCard` columns too (About, priority) — the user wants those affordances in every layout.
+//
+// Each card is a keyboard item (lib/listNav): `j`/`k` and the arrows walk the cards, and Enter opens
+// the channel — the name ChannelLink renders is the card's open element.
 
 interface ChannelLayoutGridProps<T> {
   rows: T[];
@@ -52,9 +56,10 @@ export default function ChannelLayoutGrid<T>({
   // Everything else flows in the meta line: not the heading, not a slotted column.
   const meta = columns.filter((c) => !c.cardPrimary && !slotted.has(c.key));
 
-  const renderCard = (row: T) => (
+  const renderCard = (row: T, index: number) => (
     <div
       {...rowProps?.(row)}
+      {...navItemAttrs(index)}
       className={`glass-card rounded-xl p-3 h-full flex flex-col gap-2 ${rowClassName?.(row) ?? ""}`}
     >
       <div className="flex items-start justify-between gap-2">
@@ -91,7 +96,8 @@ export default function ChannelLayoutGrid<T>({
       minCol={spec.minCol}
       colMaxWidth={null}
       rowEst={spec.rowEst}
-      renderItem={renderCard}
+      keyboardNav
+      renderItem={(row, _itemWidth, index) => renderCard(row, index)}
     />
   );
 }

frontend/src/components/ChannelLink.tsx

@@ -30,6 +30,9 @@ export default function ChannelLink({
       {onView ? (
         <button
           onClick={onView}
+          // The channel's "open" element: in a keyboard-walkable list (lib/listNav) Enter on the row or
+          // card clicks this.
+          data-nav-open=""
           onAuxClick={(e) => {
             // Middle-click opens the channel's YouTube page in a new tab; left-click keeps
             // opening the in-app channel detail.

frontend/src/components/ChannelNameLink.tsx

@@ -11,7 +11,7 @@ import { urlWithParams } from "../lib/urlState";
 // The href is the same URL `openChannel` pushes — `?chan=<id>` on the current page — so a new tab
 // lands where the in-app navigation would have. A plain left click is still handled in-app, because
 // the SPA path does more than navigate (the player has to close first and reclaim its own
-// Back-to-close history entry; see closeThenNavigate).
+// Back-to-close history entry; see lib/history.closeOverlaysThenNavigate).
 type Props = Omit<AnchorHTMLAttributes<HTMLAnchorElement>, "href" | "onClick" | "title"> & {
   channelId: string;
   title: string | null | undefined;

frontend/src/components/ChannelPage.busyFocus.dom.test.tsx

@@ -0,0 +1,99 @@
+// @vitest-environment jsdom
+//
+// The channel page's Block and Hide toggles (deep-review E11 round 2) and its Subscribe / Unsubscribe
+// button (round 3: the same row, missed) while their request runs. A
+// focused button that turns natively `disabled` drops the keyboard to <body> in Chrome (measured for
+// ui/Button in E11 S2), so a busy toggle blocks the click with aria-disabled instead — focusable, and
+// still pressed only once.
+import type { ReactNode } from "react";
+import { describe, it, expect, vi, beforeAll, afterEach } from "vitest";
+import { render, screen, fireEvent, waitFor, cleanup, act } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+
+vi.mock("react-i18next", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("react-i18next")>()),
+  useTranslation: () => ({ t: (key: string) => key, i18n: { language: "en" } }),
+}));
+vi.mock("./NavigationProvider", () => ({
+  useNavigationActions: () => ({ closeChannel: vi.fn(), openChannel: vi.fn() }),
+}));
+vi.mock("./ConfirmProvider", () => ({ useConfirm: () => async () => true }));
+vi.mock("./FeedFiltersProvider", () => ({
+  useFeedFilters: () => ({ includeNormal: true, includeShorts: false, includeLive: false }),
+}));
+vi.mock("./Feed", () => ({ default: () => null }));
+vi.mock("./ChannelAbout", () => ({ default: () => null }));
+// The page's chrome portals into the shell's fixed toolbar band, which this test has no shell for.
+vi.mock("./ui/PageShell", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("./ui/PageShell")>()),
+  PageToolbar: ({ children }: { children?: ReactNode }) => <>{children}</>,
+}));
+
+import ChannelPage from "./ChannelPage";
+import { api, type ChannelDetail, type Me } from "../lib/api";
+
+beforeAll(() => {
+  class Stub {
+    observe() {}
+    unobserve() {}
+    disconnect() {}
+    takeRecords() {
+      return [];
+    }
+  }
+  globalThis.ResizeObserver ??= Stub as unknown as typeof ResizeObserver;
+  globalThis.IntersectionObserver ??= Stub as unknown as typeof IntersectionObserver;
+});
+afterEach(() => {
+  cleanup();
+  vi.restoreAllMocks();
+});
+
+const CH = "UCsXVk37bltHxD1rDPwtNM8Q";
+
+describe("ChannelPage — a busy toggle keeps the keyboard", () => {
+  it.each([
+    ["channel.block", "blockChannel", true],
+    ["channel.hide", "updateChannel", true],
+    ["channel.subscribe", "subscribeChannel", false],
+    ["channel.subscribedState", "unsubscribeChannel", true],
+  ] as const)(
+    "%s stays focusable and fires once while its request runs",
+    async (label, call, subscribed) => {
+      vi.spyOn(api, "channelDetail").mockResolvedValue({
+        id: CH,
+        title: "LEMMiNO",
+        subscribed,
+        blocked: false,
+        hidden: false,
+        deep_requested: false,
+        backfill_done: true,
+        stored_videos: 10,
+      } as unknown as ChannelDetail);
+      vi.spyOn(api, "tags").mockResolvedValue([] as never);
+      const pending = vi.spyOn(api, call).mockReturnValue(new Promise(() => {}) as never);
+      render(
+        <QueryClientProvider
+          client={new QueryClient({ defaultOptions: { queries: { retry: false } } })}
+        >
+          <ChannelPage
+            channelId={CH}
+            initialName="LEMMiNO"
+            me={{ id: 1, can_write: true } as unknown as Me}
+            view="cards"
+            setView={() => {}}
+            onShowInFeed={() => {}}
+          />
+        </QueryClientProvider>,
+      );
+      const button = await screen.findByRole("button", { name: label });
+      act(() => button.focus());
+      fireEvent.click(button);
+      await waitFor(() => expect(button.getAttribute("aria-disabled")).toBe("true"));
+      expect(button.hasAttribute("disabled")).toBe(false);
+      expect(document.activeElement).toBe(button);
+      fireEvent.click(button);
+      expect(pending).toHaveBeenCalledTimes(1);
+    },
+  );
+});

frontend/src/components/ChannelPage.tsx

@@ -29,6 +29,7 @@ import { useFeedFilters } from "./FeedFiltersProvider";
 import { useConfirm } from "./ConfirmProvider";
 import { notify } from "../lib/notifications";
 import { notifyYouTubeActionError } from "../lib/youtubeErrors";
+import { notifyActionError } from "../lib/actionErrors";
 import { api, DEFAULT_TAG_MODES, type FeedFilters, type Me, type ChannelDetail } from "../lib/api";
 import type { FeedView } from "../lib/feedView";
 import { channelYouTubeUrl, formatViews } from "../lib/format";
@@ -106,18 +107,23 @@ export default function ChannelPage({
   const runExplore = useCallback(
     (token?: string | null) => {
       setExploring(true);
-      return api
-        .exploreChannel(channelId, token ?? undefined)
-        .then((r) => {
-          setNextToken(r.next_page_token);
-          qc.invalidateQueries({ queryKey: qk.feed() });
-          // Refetch the detail so `explored` flips true → the "Exploring" badge shows on the
-          // first visit (the GET that drove this render predated the explore that just ran).
-          qc.invalidateQueries({ queryKey: qk.channel(channelId) });
-        })
-        .finally(() => setExploring(false));
+      return (
+        api
+          .exploreChannel(channelId, token ?? undefined)
+          .then((r) => {
+            setNextToken(r.next_page_token);
+            qc.invalidateQueries({ queryKey: qk.feed() });
+            // Refetch the detail so `explored` flips true → the "Exploring" badge shows on the
+            // first visit (the GET that drove this render predated the explore that just ran).
+            qc.invalidateQueries({ queryKey: qk.channel(channelId) });
+          })
+          // Both the automatic first-visit explore and "load more" used to fail in silence: an empty
+          // channel page that looked like a channel with no videos (E11 S2b).
+          .catch((err: unknown) => notifyActionError(err, t("errors.writeFailed.exploreChannel")))
+          .finally(() => setExploring(false))
+      );
     },
-    [channelId, qc],
+    [channelId, qc, t],
   );
 
   // First visit of an un-subscribed channel → ingest its recent uploads. Skipped for the demo
@@ -129,7 +135,7 @@ export default function ChannelPage({
     if (ch.subscribed || ch.blocked) return;
     if (ch.explored && ch.stored_videos > 0) return;
     autoTried.current = channelId;
-    runExplore().catch(() => {});
+    void runExplore();
   }, [ch, channelId, me.is_demo, runExplore]);
 
   const block = useMutation({
@@ -139,15 +145,16 @@ export default function ChannelPage({
       qc.invalidateQueries({ queryKey: qk.feed() });
       qc.invalidateQueries({ queryKey: qk.blockedChannels() });
     },
-    // No onError: block/unblock is a local DB op (not a YouTube write, so no 403 "connect" case),
-    // and its 400/409/422/500 are already surfaced by the global error modal (see api.ts req) —
-    // a caller toast here would just double it.
+    // No onError: a local DB op (not a YouTube write, so no 403 "connect" case). The app-wide
+    // reporter names the failure the error dialog does not cover (a 404 for a channel gone).
+    meta: { failTitle: "errors.writeFailed.blockChannel" },
   });
 
   // "Hide from feed": the same per-subscription flag the manager toggles (updateChannel {hidden}).
   // Local DB op — keeps the subscription, only drops the channel's videos from the feed/explore.
   const toggleHidden = useMutation({
     mutationFn: () => api.updateChannel(channelId, { hidden: !ch?.hidden }),
+    meta: { failTitle: "errors.writeFailed.hideChannel" },
     onSuccess: () => {
       qc.invalidateQueries({ queryKey: qk.channel(channelId) });
       qc.invalidateQueries({ queryKey: qk.feed() });
@@ -472,14 +479,18 @@ export default function ChannelPage({
               )}
               {!me.is_demo && (
                 <button
-                  onClick={() => block.mutate()}
-                  disabled={block.isPending}
+                  // Busy blocks the click, not the focus: a focused button that turns natively
+                  // `disabled` drops the keyboard to <body> (the rule and its measurement: ui/Button).
+                  // Nor does a busy toggle light up on hover, as if a click would do something.
+                  onClick={() => !block.isPending && block.mutate()}
+                  aria-disabled={block.isPending || undefined}
+                  aria-busy={block.isPending || undefined}
                   title={ch?.blocked ? t("channel.unblock") : t("channel.block")}
                   aria-label={ch?.blocked ? t("channel.unblock") : t("channel.block")}
-                  className={`inline-flex items-center justify-center w-9 h-9 rounded-lg border disabled:opacity-50 transition ${
+                  className={`inline-flex items-center justify-center w-9 h-9 rounded-lg border aria-disabled:opacity-50 transition ${
                     ch?.blocked
                       ? "border-danger text-danger"
-                      : "border-border text-muted hover:text-danger hover:border-danger"
+                      : "border-border text-muted not-aria-disabled:hover:text-danger not-aria-disabled:hover:border-danger"
                   }`}
                 >
                   <Ban className="w-4 h-4" />
@@ -490,14 +501,15 @@ export default function ChannelPage({
                   from the feed. EyeOff = currently hidden (click to unhide). */}
               {ch?.subscribed && !me.is_demo && (
                 <button
-                  onClick={() => toggleHidden.mutate()}
-                  disabled={toggleHidden.isPending}
+                  onClick={() => !toggleHidden.isPending && toggleHidden.mutate()}
+                  aria-disabled={toggleHidden.isPending || undefined}
+                  aria-busy={toggleHidden.isPending || undefined}
                   title={ch.hidden ? t("channel.hiddenHint") : t("channel.hideHint")}
                   aria-label={ch.hidden ? t("channel.unhide") : t("channel.hide")}
-                  className={`inline-flex items-center justify-center w-9 h-9 rounded-lg border disabled:opacity-50 transition ${
+                  className={`inline-flex items-center justify-center w-9 h-9 rounded-lg border aria-disabled:opacity-50 transition ${
                     ch.hidden
                       ? "border-accent text-accent"
-                      : "border-border text-muted hover:text-fg hover:border-fg/40"
+                      : "border-border text-muted not-aria-disabled:hover:text-fg not-aria-disabled:hover:border-fg/40"
                   }`}
                 >
                   {ch.hidden ? <EyeOff className="w-4 h-4" /> : <Eye className="w-4 h-4" />}
@@ -509,7 +521,7 @@ export default function ChannelPage({
                   <Button
                     variant="outline"
                     onClick={onUnsubscribe}
-                    disabled={unsubscribe.isPending}
+                    loading={unsubscribe.isPending}
                     title={t("channel.unsubscribe")}
                     icon={<Check className="w-4 h-4" />}
                   >
@@ -519,7 +531,7 @@ export default function ChannelPage({
                   <Button
                     variant="outline"
                     onClick={() => subscribe.mutate()}
-                    disabled={subscribe.isPending}
+                    loading={subscribe.isPending}
                     icon={<Plus className="w-4 h-4" />}
                   >
                     {t("channel.subscribe")}
@@ -566,9 +578,11 @@ export default function ChannelPage({
             {!ch?.subscribed && nextToken && (
               <div className="flex justify-center pb-6">
                 <button
-                  onClick={() => runExplore(nextToken)}
-                  disabled={exploring}
-                  className="inline-flex items-center gap-2 px-4 py-2 rounded-lg text-sm border border-border hover:bg-surface disabled:opacity-50"
+                  // Busy blocks the click, not the focus (see Block above).
+                  onClick={() => !exploring && runExplore(nextToken)}
+                  aria-disabled={exploring || undefined}
+                  aria-busy={exploring || undefined}
+                  className="inline-flex items-center gap-2 px-4 py-2 rounded-lg text-sm border border-border not-aria-disabled:hover:bg-surface aria-disabled:opacity-50"
                 >
                   {exploring ? (
                     <Loader2 className="w-4 h-4 animate-spin" />

frontend/src/components/Channels.tsx

@@ -6,7 +6,6 @@ import { Ban, Eye, EyeOff, History, LayoutGrid, Pencil, RefreshCw, Table, X } fr
 import ExcludedChannelList from "./ExcludedChannelList";
 import { api, NO_TAG_SENTINEL, type ManagedChannel } from "../lib/api";
 import { Sparkles } from "lucide-react";
-import { notifyActionError } from "../lib/actionErrors";
 import { notifyYouTubeActionError } from "../lib/youtubeErrors";
 import { accountKey, LS } from "../lib/storage";
 import { buildChannelColumns, applySyncFilter } from "./channelColumns";
@@ -32,7 +31,7 @@ import ChannelStatsPopover from "./ChannelStatsPopover";
 import Pager from "./ui/Pager";
 import { CHANNEL_LAYOUTS, type ChannelLayout } from "../lib/channelLayout";
 import { sortRows } from "../lib/columnSort";
-import { filterRows } from "./ui/tableHeader";
+import { filterRows } from "../lib/tableColumns";
 import { useCardPager } from "../lib/useCardPager";
 import { PageToolbar } from "./ui/PageShell";
 import ChannelDiscovery from "./ChannelDiscovery";
@@ -110,6 +109,7 @@ export default function Channels() {
   const [tagManagerOpen, setTagManagerOpen] = useState(false);
   const unblock = useMutation({
     mutationFn: (id: string) => api.unblockChannel(id),
+    meta: { failTitle: "errors.writeFailed.unblockChannel" },
     onSuccess: () => {
       qc.invalidateQueries({ queryKey: qk.blockedChannels() });
       qc.invalidateQueries({ queryKey: qk.feed() });
@@ -133,6 +133,7 @@ export default function Channels() {
       id: string;
       body: { priority?: number; hidden?: boolean; deep_requested?: boolean };
     }) => api.updateChannel(v.id, v.body),
+    meta: { failTitle: "errors.writeFailed.channelSettings" },
     // Requesting full history may have just pulled in a channel's recent uploads, so
     // refresh the per-user status and feed too — not only the channel list.
     onSuccess: () => {
@@ -182,11 +183,10 @@ export default function Channels() {
     // A failed attach/detach reverts the optimistic change by refetching the list. Also refetch
     // suggestions: acceptSuggestion optimistically dropped the channel from that cache, and on
     // failure the tag never actually attached — so the server still suggests it and the ghost chips
-    // must come back rather than leaving an empty cell (honest states). Surface the write failure too.
-    onError: (e) => {
+    // must come back rather than leaving an empty cell (honest states). The hook reports the failure.
+    onError: () => {
       qc.invalidateQueries({ queryKey: qk.channels() });
       qc.invalidateQueries({ queryKey: qk.tagSuggestions() });
-      notifyActionError(e, t("channels.tags.updateFailed"));
     },
   });
   // --- Suggested tags (E8·S4): learned from the user's own manual-tag pattern, shown as accept/dismiss
@@ -623,6 +623,7 @@ export default function Channels() {
               fixedLayout
               emptyText={t("channels.empty")}
               rowProps={pinMenu.triggerProps}
+              keyboardNav
             />
           ) : (
             <ChannelLayoutGrid

frontend/src/components/ChannelsProvider.dom.test.tsx

@@ -17,7 +17,6 @@ vi.mock("./NavigationProvider", () => ({
 }));
 
 import { ChannelsProvider, useChannels, useChannelsActions } from "./ChannelsProvider";
-import { setActiveAccount } from "../lib/api/core";
 
 const wrapper = ({ children }: { children: ReactNode }) => (
   <ChannelsProvider>{children}</ChannelsProvider>
@@ -101,20 +100,17 @@ describe("ChannelsProvider — S8 shareable URL", () => {
     expect(new URLSearchParams(window.location.search).has("ctab")).toBe(false);
   });
 
-  it("a PARTIAL shared link (fresh tab) does not clobber the account's stored sort/filters", () => {
-    // Regression: on a fresh tab the account pins AFTER mount, so the seed's base for the OMITTED
-    // dimensions was read as defaults. Persisting the whole seed used to overwrite the account's real
-    // stored sort + filter map. The fix persists ONLY the URL-present dimensions.
+  it("a PARTIAL shared link does not clobber the account's stored sort/filters", () => {
+    // Regression: the seed's base for the OMITTED dimensions used to be read as defaults, and
+    // persisting the seed overwrote the account's real stored sort + filter map.
     localStorage.setItem(
       "siftlode.channelSort.1",
       JSON.stringify({ key: "subscribers", dir: "desc" }),
     );
     localStorage.setItem("siftlode.channelsFilterMap.1", JSON.stringify({ sync: "needsFull" }));
-    sessionStorage.removeItem("siftlode.activeAccount"); // account not pinned yet at mount
     window.history.replaceState({ sfPage: "channels" }, "", "/?ctab=hidden"); // only the tab in the URL
 
     const { result } = render();
-    act(() => setActiveAccount(1)); // App pins the account after /api/me
 
     // The present dim (tab) is adopted from the link...
     expect(result.current.view).toBe("hidden");

frontend/src/components/ChannelsProvider.tsx

@@ -9,13 +9,13 @@ import {
   useState,
   type ReactNode,
 } from "react";
-import { getAccountRaw, setAccountRaw, LS } from "../lib/storage";
+import { getAccountRaw, LS } from "../lib/storage";
 import { parseChannelLayout, type ChannelLayout } from "../lib/channelLayout";
 import { hydrateSort, type SortState } from "../lib/columnSort";
 import { useSortState } from "../lib/useSortState";
 import { useFilterState } from "../lib/useFilterState";
-import { useActiveAccountId } from "../lib/activeAccount";
 import { useUrlMirror } from "../lib/useUrlMirror";
+import { rememberNavPosition } from "../lib/history";
 import {
   channelsParamsToState,
   channelsParamUpdates,
@@ -23,7 +23,7 @@ import {
   type ChannelsUrlState,
 } from "../lib/channelsUrlState";
 import { usePersistedTab } from "./ui/Tabs";
-import type { FilterMap } from "./ui/tableHeader";
+import type { FilterMap } from "../lib/tableColumns";
 import { useNavigation, useNavigationActions } from "./NavigationProvider";
 import type { ChannelsView } from "./Channels";
 
@@ -73,25 +73,16 @@ function readStoredFilters(): FilterMap {
 // present, the URL wins over this account's stored view — read once at mount and applied over the slice
 // hooks (see the provider). The keys are channels-unique, so their mere presence identifies a shared
 // manager view; no ?page check is needed (the mirror below is page-gated so it never pollutes others).
-// The seed = the URL-merged state PLUS which dimensions the URL actually carried. `present` matters
-// because the base below is read at MOUNT, before the account is pinned (getAccountRaw returns null),
-// so an OMITTED dimension's base is a default, not this account's stored value. The provider seeds and
-// persists only the PRESENT dimensions and lets the absent ones re-hydrate from storage normally —
-// otherwise a partial shared link silently resets the omitted stored sort / filter map.
-type ChannelsSeedPresent = { view: boolean; sort: boolean; filters: boolean };
-type ChannelsUrlSeed = { state: ChannelsUrlState; present: ChannelsSeedPresent };
-function readChannelsUrlSeed(): ChannelsUrlSeed | null {
+// The base is this account's stored view (BootGate pins the account before this provider mounts), so
+// a PARTIAL link — one carrying only the tab, say — keeps the stored sort and filter map for the rest.
+function readChannelsUrlSeed(): ChannelsUrlState | null {
   const params = new URLSearchParams(window.location.search);
   if (!hasChannelsParams(params)) return null;
-  const state = channelsParamsToState(params, {
+  return channelsParamsToState(params, {
     view: clampView(getAccountRaw(LS.channelsView)),
     sort: hydrateSort(getAccountRaw(LS.channelSort), [], null),
     filters: readStoredFilters(),
   });
-  return {
-    state,
-    present: { view: params.has("ctab"), sort: params.has("csort"), filters: params.has("cf") },
-  };
 }
 
 type ChannelsState = {
@@ -167,10 +158,9 @@ export function ChannelsProvider({ children }: { children: ReactNode }) {
   // The subscribed table's column-filter map, owned here (lifted out of DataTable) so the top status
   // chips, the Sync column funnel, and the card layout share one state; useFilterState persists it.
   const [filters, setFilters] = useFilterState(LS.channelsFilterMap, migrateSyncChip);
-  // view + layout are persisted tabs (usePersistedTab = the shared account-scoped tab-state hook), so
-  // they get init-from-storage AND the account-pin re-hydrate for free (this provider mounts above
-  // <App>, which pins the account only after /api/me). Stored un-clamped; clampView/parseChannelLayout
-  // heal them for display. setView layers the history logic (below) on top of the raw setter.
+  // view + layout are persisted tabs (usePersistedTab = the shared account-scoped tab-state hook).
+  // Stored un-clamped; clampView/parseChannelLayout heal them for display. setView layers the history
+  // logic (below) on top of the raw setter.
   const [viewRaw, setViewRaw] = usePersistedTab(LS.channelsView, "subscribed");
   const view = clampView(viewRaw);
   const [layoutRaw, setLayout] = usePersistedTab(LS.channelLayout, "table");
@@ -184,43 +174,20 @@ export function ChannelsProvider({ children }: { children: ReactNode }) {
 
   // S8 — shareable manager view. Captured once at mount (or null when no manager URL keys are present).
   const [urlSeed] = useState(readChannelsUrlSeed);
-  const accountId = useActiveAccountId();
   const seededRef = useRef(false);
-  const persistedRef = useRef(false);
 
-  // Apply the shared-link seed once, BEFORE paint, through the slice setters. Going through the setters
-  // (not raw state) is deliberate: each one calls its hook's markDirty, so the account-pin re-hydrate
-  // (which fires later on a fresh tab) sees the slice as user-edited and won't reload the stored view
-  // over the shared one. setViewRaw (not setView) restores the tab without pushing a phantom history
-  // entry. A normal load has urlSeed === null and this is a no-op.
+  // Apply the shared-link seed once, BEFORE paint, through the slice setters — which persist it, so the
+  // shared view also survives a later PLAIN reload (no URL). setViewRaw (not setView) restores the tab
+  // without pushing a phantom history entry. A normal load has urlSeed === null and this is a no-op.
   useLayoutEffect(() => {
     if (!urlSeed || seededRef.current) return;
     seededRef.current = true;
-    // Only apply the dimensions the URL actually carried. An omitted dimension must NOT go through its
-    // setter (which would markDirty and block the account-pin re-hydrate from loading the stored value)
-    // — leave it to hydrate from storage normally. Fixes a partial link wiping the stored sort/filters.
-    const { state, present } = urlSeed;
-    if (present.view && state.view !== view) setViewRaw(state.view);
-    if (present.filters) setFilters(state.filters);
-    if (present.sort) setSort(state.sort);
+    if (urlSeed.view !== view) setViewRaw(urlSeed.view);
+    setFilters(urlSeed.filters);
+    setSort(urlSeed.sort);
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
 
-  // On a fresh tab the account pins AFTER mount, so the seed's setter writes above no-op'd (no account
-  // yet). Persist the seed to the account once it's known, so the shared view also survives a later
-  // PLAIN reload (no URL) — mirrors PlexProvider's rehydrate-persist. The slice hooks' own re-hydrate
-  // already skips (marked dirty above), so this only touches storage, not state.
-  useEffect(() => {
-    if (!urlSeed || accountId == null || persistedRef.current) return;
-    persistedRef.current = true;
-    // Persist ONLY the URL-present dimensions — the omitted ones were seeded from mount-time defaults
-    // (no account yet), so writing them here would overwrite the account's real stored sort/filter map.
-    const { state, present } = urlSeed;
-    if (present.view) setAccountRaw(LS.channelsView, state.view);
-    if (present.filters) setAccountRaw(LS.channelsFilterMap, JSON.stringify(state.filters));
-    if (present.sort) setAccountRaw(LS.channelSort, JSON.stringify(state.sort));
-  }, [urlSeed, accountId]);
-
   // Latest-value ref so the STABLE setView can compare against the current tab without depending on
   // it (a dep would recreate the action on every switch and re-render every actions consumer).
   // Written during render — the sanctioned pattern NavigationProvider uses for `pageRef`.
@@ -236,13 +203,14 @@ export function ChannelsProvider({ children }: { children: ReactNode }) {
       // Re-selecting the tab you are already on is not a navigation — bail before pushing, or clicking
       // the active tab (and goToFullHistory forcing "subscribed") stacks Back entries that do nothing.
       if (v === viewRef.current) return;
-      setViewRaw(v); // persists + guards the account-pin re-hydrate (via usePersistedTab)
+      setViewRaw(v); // persists (via usePersistedTab)
       // Only own an entry while the manager is already on screen. Arriving from elsewhere
       // (focusChannel / goToFullHistory) lets setPage push the entry — the stamp effect labels it — so
       // one navigation never costs two Back presses.
       if (window.history.state?.sfPage === "channels") {
         // A FRESH state, like setPage's: carrying the old entry's `_chan`/`_yt` markers over would make
         // Back re-open the channel overlay or a spent search on top of the tab.
+        rememberNavPosition();
         window.history.pushState({ sfPage: "channels", _chTab: v }, "");
       }
     },

frontend/src/components/ConfigPanel.tsx

@@ -18,7 +18,7 @@ import { notifyActionError } from "../lib/actionErrors";
 
 // Admin Configuration page: edit DB-overridable operational settings (registry-driven from the
 // backend — adding a key there makes it appear here automatically). Edits are drafted and
-// applied together via one Save/Discard bar (consistent with the Settings page); nothing hits
+// applied together via one Save/Discard bar; nothing hits
 // the server until Save. Group order is fixed where known so logically related settings (e.g.
 // Email/SMTP) stay together.
 const GROUP_ORDER = [
@@ -30,9 +30,11 @@ const GROUP_ORDER = [
   "backfill",
   "shorts",
   "batch",
+  "maintenance",
   "downloads",
   "audit",
   "plex",
+  "tmdb",
 ];
 
 export default function ConfigPanel() {
@@ -111,9 +113,9 @@ export default function ConfigPanel() {
       setReseedToken((n) => n + 1); // re-seed the draft from the saved server state
       setSaveState("saved");
       setTimeout(() => setSaveState((s) => (s === "saved" ? "idle" : s)), 2500);
-    } catch {
+    } catch (e) {
       setSaveState("error");
-      notify({ level: "error", message: t("config.saveFailed") });
+      notifyActionError(e, t("config.saveFailed"));
     }
   }
 

frontend/src/components/DownloadCenter.confirm.dom.test.tsx

@@ -0,0 +1,103 @@
+// @vitest-environment jsdom
+//
+// The Download Center's confirm dialogs name their ACTION on the confirm button (E11.5): the shared
+// `confirmThen` once labelled it with the dialog's question — "Re-download this file?" on the button,
+// and the cancel dialog's own "Cancel" beside "Cancel". i18n is key-passthrough, so labels read as keys.
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import type { DownloadJob } from "../lib/api";
+
+const mocks = vi.hoisted(() => ({
+  jobs: [] as unknown[],
+  confirm: vi.fn(async (_opts: { title: string; confirmLabel?: string }) => false),
+}));
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return { ...actual, useTranslation: () => ({ t: (key: string) => key }) };
+});
+vi.mock("./ConfirmProvider", () => ({ useConfirm: () => mocks.confirm }));
+vi.mock("../lib/useLiveQuery", () => ({
+  useLiveQuery: (key: readonly unknown[]) => ({
+    data: key[0] === "downloads" ? mocks.jobs : undefined,
+    isError: false,
+    isLoading: false,
+    refetch: vi.fn(),
+  }),
+}));
+vi.mock("../lib/useMe", () => ({ useMe: () => ({ role: "user" }) }));
+// The page toolbar (title + tabs) renders into the app shell's slot, which a bare render has none of.
+vi.mock("./ui/PageShell", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("./ui/PageShell")>()),
+  PageToolbar: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+}));
+
+import DownloadCenter from "./DownloadCenter";
+
+const job = (id: number, status: DownloadJob["status"]): DownloadJob => ({
+  id,
+  status,
+  progress: 0,
+  speed_bps: null,
+  eta_s: null,
+  phase: null,
+  error: null,
+  error_code: null,
+  error_detail: null,
+  queue_pos: 0,
+  created_at: null,
+  source_kind: "youtube",
+  source_ref: `v${id}`,
+  source_url: null,
+  poster_url: null,
+  profile_id: null,
+  spec: {
+    mode: "av",
+    max_height: null,
+    container: null,
+    audio_format: null,
+    vcodec: null,
+    embed_subs: false,
+    embed_chapters: false,
+    embed_thumbnail: false,
+    sponsorblock: false,
+  },
+  display_name: `Clip ${id}`,
+  display_uploader: null,
+  display_uploader_url: null,
+  extra_links: [],
+  can_download: status === "done",
+  expired: false,
+  asset: null,
+});
+
+afterEach(() => {
+  cleanup();
+  mocks.confirm.mockClear();
+});
+
+describe("DownloadCenter confirm dialogs", () => {
+  it("label the confirm button with the action, not the dialog's question", async () => {
+    mocks.jobs = [job(1, "running"), job(2, "done")];
+    render(
+      <QueryClientProvider client={new QueryClient()}>
+        <DownloadCenter />
+      </QueryClientProvider>,
+    );
+
+    fireEvent.click(screen.getByTitle("downloads.actions.cancel"));
+    await waitFor(() => expect(mocks.confirm).toHaveBeenCalledTimes(1));
+    // The tab's label shares its button with a count badge.
+    fireEvent.click(screen.getByRole("button", { name: /downloads\.tabs\.done/ }));
+    fireEvent.click(await screen.findByTitle("downloads.actions.redownload"));
+    fireEvent.click(screen.getByTitle("downloads.actions.delete"));
+    await waitFor(() => expect(mocks.confirm).toHaveBeenCalledTimes(3));
+
+    expect(mocks.confirm.mock.calls.map(([o]) => [o.title, o.confirmLabel])).toEqual([
+      ["downloads.confirm.cancelTitle", "downloads.confirm.cancelAction"],
+      ["downloads.confirm.redownloadTitle", "downloads.confirm.redownloadAction"],
+      ["downloads.confirm.deleteTitle", "downloads.actions.delete"],
+    ]);
+  });
+});

frontend/src/components/DownloadCenter.tsx

@@ -34,6 +34,7 @@ import { useConfirm } from "./ConfirmProvider";
 import { useLiveQuery } from "../lib/useLiveQuery";
 import { useMe } from "../lib/useMe";
 import { api, type DownloadJob } from "../lib/api";
+import { notifyActionError } from "../lib/actionErrors";
 import { invalidateDownloads, quickShareLink } from "../lib/downloads";
 import { libraryRowActions, sharedRowActions } from "../lib/downloadActions";
 import { inputCls } from "./ui/form";
@@ -41,6 +42,7 @@ import { Button } from "./ui/Button";
 import { DownloadRow, IconBtn, UsageBar } from "./downloadRow";
 import { MetaEditModal, ErrorModal } from "./downloadModals";
 import { AdminSystem } from "./downloadAdmin";
+import NavGrid from "./ui/NavGrid";
 
 export default function DownloadCenter() {
   const me = useMe();
@@ -95,18 +97,22 @@ export default function DownloadCenter() {
               ? api.redownloadDownload(id)
               : api.deleteDownload(id),
     onSuccess: invalidate,
-    // No onError: a failed job action returns 400/409/422/500, already surfaced by the global
-    // error modal (api.ts req) with the backend's specific message — a caller toast would double it.
+    // A 400/409/422/500 opens the global error dialog with the backend's own message (and is then
+    // skipped here); a job that is gone (404) or a lost connection is said here, naming the action.
+    onError: (e, v) => notifyActionError(e, t(`errors.writeFailed.job.${v.op}`)),
   });
 
   // Remove a shared-with-me item from your list (only your grant; the owner's file is untouched).
   const removeShared = useMutation({
     mutationFn: (id: number) => api.removeSharedDownload(id),
     onSuccess: () => qc.invalidateQueries({ queryKey: qk.downloadsShared() }),
+    meta: { failTitle: "errors.writeFailed.removeShared" },
   });
 
-  const confirmThen = async (title: string, body: string, fn: () => void) => {
-    if (await confirm({ title, message: body, confirmLabel: title, danger: true })) fn();
+  // The confirm button names the ACTION ("Remove"), never the dialog's question: labelled with the title
+  // it read "Re-download this file?", and the cancel dialog's own "Cancel" would sit beside "Cancel".
+  const confirmThen = async (title: string, body: string, action: string, fn: () => void) => {
+    if (await confirm({ title, message: body, confirmLabel: action, danger: true })) fn();
   };
 
   // One-click share (E7 S3 · D2-A): ensure a downloadable link, copy it, toast with "open in new tab"
@@ -222,9 +228,9 @@ export default function DownloadCenter() {
                 {t("downloads.page.upload")}
               </Button>
             </div>
-            <div className="space-y-2">
-              {queue.map((job) => (
-                <DownloadRow key={job.id} job={job} onShowError={setErrorJob}>
+            <NavGrid className="space-y-2">
+              {queue.map((job, i) => (
+                <DownloadRow key={job.id} job={job} navIndex={i} onShowError={setErrorJob}>
                   {(job.status === "queued" || job.status === "running") && (
                     <IconBtn
                       onClick={() => act.mutate({ id: job.id, op: "pause" })}
@@ -250,6 +256,7 @@ export default function DownloadCenter() {
                       confirmThen(
                         t("downloads.confirm.cancelTitle"),
                         t("downloads.confirm.cancelBody"),
+                        t("downloads.confirm.cancelAction"),
                         () => act.mutate({ id: job.id, op: "cancel" }),
                       )
                     }
@@ -272,21 +279,25 @@ export default function DownloadCenter() {
                     {t("downloads.empty.queue")}
                   </div>
                 ))}
-            </div>
+            </NavGrid>
           </>
         )}
 
         {tab === "done" && (
           <>
             <UsageBar />
-            <div className="space-y-2">
-              {library.map((job) => {
+            <NavGrid className="space-y-2">
+              {library.map((job, i) => {
                 // Row actions gated on the stored media_kind + job_kind (see downloadActions).
                 const a = libraryRowActions(job);
                 return (
-                  <DownloadRow key={job.id} job={job}>
+                  <DownloadRow key={job.id} job={job} navIndex={i}>
                     {a.play && (
-                      <IconBtn onClick={() => setPlayJob(job)} title={t("downloads.actions.play")}>
+                      <IconBtn
+                        open
+                        onClick={() => setPlayJob(job)}
+                        title={t("downloads.actions.play")}
+                      >
                         <PlayCircle className="w-4 h-4" />
                       </IconBtn>
                     )}
@@ -319,6 +330,7 @@ export default function DownloadCenter() {
                           confirmThen(
                             t("downloads.confirm.redownloadTitle"),
                             t("downloads.confirm.redownloadBody"),
+                            t("downloads.confirm.redownloadAction"),
                             () => act.mutate({ id: job.id, op: "redownload" }),
                           )
                         }
@@ -332,6 +344,7 @@ export default function DownloadCenter() {
                         confirmThen(
                           t("downloads.confirm.deleteTitle"),
                           t("downloads.confirm.deleteBody"),
+                          t("downloads.actions.delete"),
                           () => act.mutate({ id: job.id, op: "delete" }),
                         )
                       }
@@ -355,19 +368,23 @@ export default function DownloadCenter() {
                     {t("downloads.empty.done")}
                   </div>
                 ))}
-            </div>
+            </NavGrid>
           </>
         )}
 
         {tab === "shared" && (
-          <div className="space-y-2">
-            {(sharedQ.data ?? []).map((job) => {
+          <NavGrid className="space-y-2">
+            {(sharedQ.data ?? []).map((job, i) => {
               // Same media_kind + can_download gate as the library, via the shared helper (S5b).
               const a = sharedRowActions(job);
               return (
-                <DownloadRow key={job.id} job={job}>
+                <DownloadRow key={job.id} job={job} navIndex={i}>
                   {a.play && (
-                    <IconBtn onClick={() => setPlayJob(job)} title={t("downloads.actions.play")}>
+                    <IconBtn
+                      open
+                      onClick={() => setPlayJob(job)}
+                      title={t("downloads.actions.play")}
+                    >
                       <PlayCircle className="w-4 h-4" />
                     </IconBtn>
                   )}
@@ -382,6 +399,7 @@ export default function DownloadCenter() {
                       confirmThen(
                         t("downloads.confirm.removeSharedTitle"),
                         t("downloads.confirm.removeSharedBody"),
+                        t("downloads.actions.removeShared"),
                         () => removeShared.mutate(job.id),
                       )
                     }
@@ -405,7 +423,7 @@ export default function DownloadCenter() {
                   {t("downloads.empty.shared")}
                 </div>
               ))}
-          </div>
+          </NavGrid>
         )}
 
         {tab === "system" && me.role === "admin" && <AdminSystem />}

frontend/src/components/DownloadDialog.tsx

@@ -10,6 +10,7 @@ import { invalidateDownloads } from "../lib/downloads";
 // Lazy: the full profile editor only opens from the dialog's "manage presets" affordance.
 const ProfileEditor = lazy(() => import("./ProfileEditor"));
 import { notify } from "../lib/notifications";
+import { notifyActionError } from "../lib/actionErrors";
 import { navigateTo } from "../lib/nav";
 import { inputCls } from "./ui/form";
 
@@ -51,8 +52,11 @@ export default function DownloadDialog({
         action: { label: t("downloads.dialog.view"), onClick: () => navigateTo("downloads") },
       });
       onClose();
-    } catch {
-      // Non-quiet request: the global error dialog already surfaced the reason (e.g. quota).
+    } catch (e) {
+      // A quota or validation refusal (422/409) is already in the global error dialog, which the
+      // reporter skips; a 403/404/429 or a lost connection is not, and used to leave the dialog
+      // open with nothing said (E11 S2b).
+      notifyActionError(e, t("errors.writeFailed.enqueueDownload"));
       setBusy(false);
     }
   };

frontend/src/components/ExcludedChannelList.dom.test.tsx

@@ -0,0 +1,56 @@
+// @vitest-environment jsdom
+//
+// The Hidden / Blocked channel cards as a keyboard list (E11 S4c): `j`/`k` walk the cards, Enter opens
+// the channel — the ChannelLink name is the card's open element — and the card's own action button
+// keeps its Enter.
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { act, cleanup, render, screen } from "@testing-library/react";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return { ...actual, useTranslation: () => ({ t: (key: string) => key }) };
+});
+
+import ExcludedChannelList from "./ExcludedChannelList";
+
+afterEach(cleanup);
+
+function press(key: string) {
+  act(() => {
+    (document.activeElement ?? document.body).dispatchEvent(
+      new KeyboardEvent("keydown", { key, bubbles: true, cancelable: true }),
+    );
+  });
+}
+
+const channels = [
+  { id: "UCa", title: "Alpha", thumbnail_url: null },
+  { id: "UCb", title: "Beta", thumbnail_url: null },
+];
+
+describe("ExcludedChannelList · keyboard", () => {
+  it("walks the cards with j/k and opens the channel on Enter", () => {
+    const onView = vi.fn();
+    render(
+      <ExcludedChannelList
+        channels={channels}
+        icon={null}
+        title="Hidden"
+        hint=""
+        emptyText=""
+        actionLabel="Unhide"
+        actionIcon={null}
+        onAction={() => {}}
+        onView={onView}
+      />,
+    );
+    press("j");
+    press("j");
+    expect(document.activeElement?.textContent).toContain("Beta");
+    press("k");
+    expect(document.activeElement?.textContent).toContain("Alpha");
+    press("Enter");
+    expect(onView).toHaveBeenCalledWith(channels[0]);
+    expect(screen.getAllByRole("button", { name: "Unhide" })).toHaveLength(2);
+  });
+});

frontend/src/components/ExcludedChannelList.tsx

@@ -1,5 +1,7 @@
 import { type ReactNode } from "react";
 import ChannelLink from "./ChannelLink";
+import NavGrid from "./ui/NavGrid";
+import { navItemAttrs } from "../lib/listNav";
 
 // The presentation shared by the channel manager's "excluded channel" tabs — Hidden and Blocked.
 // A responsive grid of proper channel cards (avatar + name + open-on-YouTube, via ChannelLink) each
@@ -40,9 +42,13 @@ export default function ExcludedChannelList({
         {icon}
         <span className="text-xs uppercase tracking-wide text-muted">{title}</span>
       </div>
-      <div className="grid grid-cols-1 gap-2 sm:grid-cols-2 lg:grid-cols-3">
-        {channels.map((c) => (
-          <div key={c.id} className="glass-card flex items-center gap-2 rounded-xl px-3 py-2">
+      <NavGrid className="grid grid-cols-1 gap-2 sm:grid-cols-2 lg:grid-cols-3">
+        {channels.map((c, i) => (
+          <div
+            key={c.id}
+            {...navItemAttrs(i)}
+            className="glass-card flex items-center gap-2 rounded-xl px-3 py-2"
+          >
             <div className="min-w-0 flex-1">
               <ChannelLink
                 id={c.id}
@@ -63,7 +69,7 @@ export default function ExcludedChannelList({
             </button>
           </div>
         ))}
-      </div>
+      </NavGrid>
       <p className="text-2xs text-muted mt-3">{hint}</p>
     </>
   );

frontend/src/components/Feed.tsx

@@ -23,6 +23,7 @@ import {
 } from "lucide-react";
 import { api, HttpError, type FeedFilters, type Video, type VideoStatus } from "../lib/api";
 import i18n from "../i18n";
+import { notifyActionError } from "../lib/actionErrors";
 import { notify, resolveVideo } from "../lib/notifications";
 import { useDebounced } from "../lib/useDebounced";
 import {
@@ -145,7 +146,7 @@ export default function Feed({
     (video: Video, startAt: number | null = null) => setActiveVideo({ video, startAt }),
     [],
   );
-  // Stable identity, like Playlists' `closePlayer`: PlayerModal's keydown/scroll-lock effect
+  // Stable identity, like Playlists' `closePlayer`: PlayerModal's keydown effect
   // depends on `onClose`, so a fresh closure every Feed render re-subscribed those listeners,
   // re-ran focusModal() under the open player, dropped its in-flight timers and flushed the
   // debounced volume write on each pass.
@@ -308,15 +309,17 @@ export default function Feed({
             resolveVideo(id);
           }
         })
-        .catch(() =>
+        .catch((e: unknown) => {
           // Server rejected the change — drop the optimistic override so the card
-          // reverts to the real (unchanged) state instead of staying phantom-hidden.
+          // reverts to the real (unchanged) state instead of staying phantom-hidden, and say so:
+          // a card that silently snaps back reads as a misclick.
+          notifyActionError(e, i18n.t("errors.writeFailed.videoState"));
           setOverrides((o) => {
             const next = { ...o };
             delete next[id];
             return next;
-          }),
-        );
+          });
+        });
     },
     [qc],
   );
@@ -330,13 +333,14 @@ export default function Feed({
         .clearState(id)
         // Stale-mark only (see setState above): the optimistic override already reset the card.
         .then(() => qc.invalidateQueries({ queryKey: qk.feed(), refetchType: "none" }))
-        .catch(() =>
+        .catch((e: unknown) => {
+          notifyActionError(e, i18n.t("errors.writeFailed.videoReset"));
           setOverrides((o) => {
             const next = { ...o };
             delete next[id];
             return next;
-          }),
-        );
+          });
+        });
     },
     [qc],
   );
@@ -349,7 +353,15 @@ export default function Feed({
           qc.invalidateQueries({ queryKey: qk.playlists() });
           qc.invalidateQueries({ queryKey: qk.playlist() });
         })
-        .catch(() => setSavedOverrides((o) => ({ ...o, [id]: !saved })));
+        .catch((e: unknown) => {
+          notifyActionError(
+            e,
+            i18n.t(
+              saved ? "errors.writeFailed.watchLaterAdd" : "errors.writeFailed.watchLaterRemove",
+            ),
+          );
+          setSavedOverrides((o) => ({ ...o, [id]: !saved }));
+        });
     },
     [qc],
   );
@@ -466,7 +478,9 @@ export default function Feed({
                     .then((r) =>
                       notify({ message: i18n.t("feed.yt.cleared", { count: r.removed }) }),
                     )
-                    .catch(() => {});
+                    .catch((e: unknown) =>
+                      notifyActionError(e, i18n.t("errors.writeFailed.clearSearch")),
+                    );
                   setFilters({ ...filters, librarySource: "organic", sort: "newest" });
                   onExitYtSearch();
                   dropFeedCaches();

frontend/src/components/FeedFiltersProvider.seed.dom.test.tsx

@@ -0,0 +1,68 @@
+// @vitest-environment jsdom
+//
+// The shared demo account has no subscriptions, so its feed opens on the whole library. The filters are
+// seeded from the `me` cache at mount — BootGate mounts the tree only once it is there. The adopt effect
+// this replaced applied the demo default after mounting; with it gone, a seed that did not read `me`
+// would open the demo account on its empty subscriptions scope.
+//
+// A share link's filters are written to the account once at mount too, so the view the link opened
+// survives a later plain reload (the state itself is seeded from the URL, so only storage shows it).
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { cleanup, render } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { NavigationProvider } from "./NavigationProvider";
+import { FeedFiltersProvider, useFeedFilters } from "./FeedFiltersProvider";
+import { ACTIVE_ACCOUNT_KEY } from "../lib/activeAccount";
+import { qk } from "../lib/queryKeys";
+import type { Me } from "../lib/api";
+
+const scopes: string[] = [];
+function Probe() {
+  scopes.push(useFeedFilters().scope);
+  return null;
+}
+
+function mount(me: Partial<Me>) {
+  const qc = new QueryClient();
+  qc.setQueryData(qk.me(), { id: 5, preferences: {}, ...me });
+  render(
+    <QueryClientProvider client={qc}>
+      <NavigationProvider>
+        <FeedFiltersProvider>
+          <Probe />
+        </FeedFiltersProvider>
+      </NavigationProvider>
+    </QueryClientProvider>,
+  );
+}
+
+beforeEach(() => {
+  localStorage.clear();
+  sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, "5");
+  scopes.length = 0;
+  window.history.replaceState(null, "", "/");
+});
+afterEach(() => {
+  cleanup();
+  window.history.replaceState(null, "", "/");
+});
+
+describe("FeedFiltersProvider seed", () => {
+  it("opens the shared demo account on the whole library from its first render", () => {
+    mount({ is_demo: true });
+    expect(scopes.length).toBeGreaterThan(0);
+    expect(scopes).toEqual(scopes.map(() => "all"));
+  });
+
+  it("opens any other account on its own scope", () => {
+    mount({ is_demo: false });
+    expect(scopes[0]).toBe("my");
+  });
+
+  it("keeps a share link's filters for the account, so a plain reload opens the same view", () => {
+    window.history.replaceState(null, "", "/?scope=all");
+    mount({ is_demo: false });
+    expect(scopes[0]).toBe("all");
+    expect(JSON.parse(localStorage.getItem("siftlode.filters.5") ?? "{}").scope).toBe("all");
+  });
+});

frontend/src/components/FeedFiltersProvider.tsx

@@ -8,14 +8,14 @@ import {
   type ReactNode,
 } from "react";
 import { qk } from "../lib/queryKeys";
-import { useQuery } from "@tanstack/react-query";
+import { useQueryClient } from "@tanstack/react-query";
 import {
-  api,
   getActiveAccount,
   coerceTagModes,
   coerceUntagged,
   DEFAULT_TAG_MODES,
   type FeedFilters,
+  type Me,
 } from "../lib/api";
 import { filterParamUpdates, hasFilterParams, paramsToFilters } from "../lib/urlState";
 import { useUrlMirror } from "../lib/useUrlMirror";
@@ -53,9 +53,8 @@ const DEFAULT_FILTERS: FeedFilters = {
 
 const FILTERS_KEY = LS.filters;
 
-// This account's own persisted filters (per-account keys — never another account's). When the
-// account isn't known yet (first load, before the tab is pinned), start from defaults; the post-login
-// effect loads the real ones once the id arrives.
+// This account's own persisted filters (per-account keys — never another account's). No account
+// (signed out) → defaults.
 export function loadAccountFilters(id: number | null): FeedFilters {
   // Your last-applied filters win, so a reload keeps whatever view you're on (a saved view you
   // picked, or manual tweaks) — setFilters persists them under LS.filters on every change. A starred
@@ -87,10 +86,12 @@ export function loadAccountFilters(id: number | null): FeedFilters {
 }
 
 // URL wins over localStorage so a pasted link reproduces the exact view.
-function loadInitialFilters(): FeedFilters {
+function loadInitialFilters(me: Me | null | undefined): FeedFilters {
   const params = new URLSearchParams(window.location.search);
   if (hasFilterParams(params)) return paramsToFilters(params, DEFAULT_FILTERS);
-  return loadAccountFilters(getActiveAccount());
+  const f = loadAccountFilters(getActiveAccount());
+  // The shared demo account has no subscriptions, so default it to the whole library.
+  return me?.is_demo ? { ...f, scope: "all" } : f;
 }
 
 interface FeedFiltersActions {
@@ -108,18 +109,18 @@ export function useFeedFiltersActions(): FeedFiltersActions {
 }
 
 export function FeedFiltersProvider({ children }: { children: ReactNode }) {
-  const [filters, setFiltersState] = useState<FeedFilters>(loadInitialFilters);
+  const qc = useQueryClient();
+  // Seeded for the account this tab is — BootGate mounts this provider only once the account is
+  // pinned and `me` is cached, so this is the account's own view from the first render.
+  const [filters, setFiltersState] = useState<FeedFilters>(() =>
+    loadInitialFilters(qc.getQueryData<Me | null>(qk.me())),
+  );
   // Whether this load arrived with feed-filter params in the URL (a bookmark/shared link). Captured
   // once at mount — such filters win over the account's stored view and are persisted to the account.
   const [initialHadUrlFilters] = useState(() =>
     hasFilterParams(new URLSearchParams(window.location.search)),
   );
 
-  // Passive observer: App owns the fetching `qk.me()` query (gated on setup state); enabled:false
-  // here reads its cache and re-renders when it lands, without triggering a second fetch (which
-  // could 503 in setup mode). We only need id + is_demo, which don't change on background refetch.
-  const meQuery = useQuery({ queryKey: qk.me(), queryFn: api.me, enabled: false });
-
   const setFilters = useCallback((next: FeedFilters) => {
     setFiltersState(next);
     // Persist under THIS tab's active account so filters don't bleed between accounts.
@@ -135,25 +136,12 @@ export function FeedFiltersProvider({ children }: { children: ReactNode }) {
   const { page } = useNavigation();
   useUrlMirror(filterParamUpdates(page === "feed" ? filters : null));
 
-  // Load THIS account's own filters when the account first resolves or changes (login / switch /
-  // add). Filters are per-account localStorage state, so another account's last view (incl. its
-  // default saved view) must never carry over. A share link's filters (captured at mount) win and
-  // are persisted to the account instead. Runs on id change only, so a 60s background refetch of
-  // the same account never clobbers the filters you're editing.
+  // A share link's filters (captured at mount) win over the account's stored view and are persisted
+  // to it once, so the view the link opened also survives a later plain reload.
   useEffect(() => {
-    const id = meQuery.data?.id;
-    if (id == null) return;
-    if (initialHadUrlFilters) {
-      const key = accountKey(FILTERS_KEY, id);
-      if (key) writeJSON(key, filters);
-      return;
-    }
-    let f = loadAccountFilters(id);
-    // The shared demo account has no subscriptions, so default it to the whole library.
-    if (meQuery.data?.is_demo) f = { ...f, scope: "all" };
-    setFiltersState(f);
+    if (initialHadUrlFilters) setFilters(filters);
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [meQuery.data?.id]);
+  }, []);
 
   const actions = useMemo<FeedFiltersActions>(() => ({ setFilters }), [setFilters]);
 

frontend/src/components/FeedViewProvider.tsx

@@ -7,9 +7,9 @@ import { usePref } from "../lib/usePref";
 // page and the channel page read it via hooks instead of prop-drilling `view`/`setView` through App.
 // Split State + Actions contexts, mirroring the other providers; composed in main.tsx around <App/>.
 //
-// The view mode is an account PREFERENCE, not a filter: it persists to the server on pick and is
-// adopted from server prefs on login. usePref carries that server-sync (plus the localStorage mirror
-// that seeds the first render synchronously) so this provider is just the two contexts over it.
+// The view mode is an account PREFERENCE, not a filter: it persists to the server on pick and follows
+// the account across devices. usePref carries that server-sync (seeded from the server pref, with the
+// localStorage mirror as the fallback) so this provider is just the two contexts over it.
 
 interface FeedViewActions {
   setView: (v: FeedView) => void;

frontend/src/components/Home.dom.test.tsx

@@ -372,8 +372,8 @@ describe("Home", () => {
   it("an unrelated mutation does not put the reroll button into a spinner", async () => {
     // The other edge of the test above. Because the pick key sits under the `["discover"]` prefix,
     // every mark-watched, bookmark, pin and shelf move on this page refetches it in the BACKGROUND —
-    // so binding the button's `loading` to raw `isFetching` made it spin and, since `ui/Button` turns
-    // `loading` into `disabled`, swallow clicks after actions the user never associated with a
+    // so binding the button's `loading` to raw `isFetching` made it spin and, since a `loading`
+    // `ui/Button` swallows its clicks, ignore presses after actions the user never associated with a
     // reroll (round 2). A press is outstanding only while THIS key has no answer of its own.
     const rerollBtn = () =>
       screen.getByText("home.hero.reroll").closest("button") as HTMLButtonElement;
@@ -391,7 +391,6 @@ describe("Home", () => {
     // The positive control, and it is the half most easily broken while fixing the other: this is the
     // FIRST press, so there is no previous pick for the placeholder to hold, and a predicate resting
     // on `isPlaceholderData` alone would drop the spinner from exactly the press that needs it.
-    expect(rerollBtn().disabled).toBe(true);
     expect(rerollBtn().getAttribute("aria-busy")).toBe("true");
 
     await act(async () => {
@@ -409,7 +408,6 @@ describe("Home", () => {
     });
     await waitFor(() => expect(discoverPick).toHaveBeenCalledTimes(2));
 
-    expect(rerollBtn().disabled).toBe(false);
     expect(rerollBtn().getAttribute("aria-busy")).toBeNull();
   });
 
@@ -434,7 +432,7 @@ describe("Home", () => {
     // `notifyManager`'s own `setTimeout(0)`, registered AFTER any timer this test schedules, so
     // "await one macrotask then assert" races it. Round 4 measured that race as an intermittent red.
     failPick(new Error("boom"));
-    await waitFor(() => expect(rerollBtn().disabled).toBe(false)); // the failure releases the button
+    await waitFor(() => expect(rerollBtn().getAttribute("aria-busy")).toBeNull()); // the failure releases the button
 
     // Now an unrelated action refetches that errored key in the background.
     discoverPick.mockReturnValue(new Promise(() => {}));
@@ -442,7 +440,6 @@ describe("Home", () => {
       void qc.invalidateQueries({ queryKey: qk.discover() });
     });
     await waitFor(() => expect(discoverPick).toHaveBeenCalledTimes(2));
-    expect(rerollBtn().disabled).toBe(false);
     expect(rerollBtn().getAttribute("aria-busy")).toBeNull();
   });
 
@@ -479,14 +476,14 @@ describe("Home", () => {
       screen.getByText("home.hero.reroll").closest("button") as HTMLButtonElement;
     fireEvent.click(screen.getByText("home.hero.reroll"));
     await waitFor(() => expect(discoverPick).toHaveBeenCalledTimes(2));
-    expect(rerollBtn().disabled).toBe(true); // the press is outstanding
+    expect(rerollBtn().getAttribute("aria-busy")).toBe("true"); // the press is outstanding
 
     failPick(new Error("boom"));
     // Wait for a signal that the REJECTION has landed, not for a fixed tick: react-query notifies
     // the observer through its own `setTimeout(0)`, and the empty state is already on screen while
     // the press is in flight — so asserting it straight away would pass with or without the fix.
     // The button releasing is that signal (`isFetched` flips once the key settles, error included).
-    await waitFor(() => expect(rerollBtn().disabled).toBe(false));
+    await waitFor(() => expect(rerollBtn().getAttribute("aria-busy")).toBeNull());
     expect(screen.getByText("home.hero.emptyBudget")).toBeTruthy();
     expect(screen.queryByText("Hero v1")).toBeNull();
   });
@@ -674,3 +671,47 @@ describe("Home", () => {
     );
   });
 });
+
+// E11 S4b, owner decision D4: the rails are one keyboard page — `j` walks a rail's cards and goes on
+// into the next rail, whichever order the page stacks them in.
+describe("Home · keyboard", () => {
+  it("walks the rails with j, from one rail on into the next", async () => {
+    discover.mockResolvedValue({
+      ...payload("v1"),
+      continue_watching: [
+        ytCard("v1", "Hero v1"),
+        ytCard("v2", "Second thing"),
+        ytCard("v3", "Third thing"),
+      ],
+      // A pinned channel has no card of its own: the shelf draws it as a ShelfTile.
+      comfort: [
+        ytCard("v4", "Comfort thing"),
+        {
+          ...ytCard("UC9", "Pinned channel"),
+          kind: "channel",
+          video: null,
+          next: null,
+          unwatched_count: 3,
+        },
+      ],
+    });
+    mount();
+    await screen.findByText("Comfort thing");
+    const titles = ["Comfort thing", "Pinned channel", "Second thing", "Third thing"];
+    const seen: (string | undefined)[] = [];
+    for (let i = 0; i < titles.length; i++) {
+      act(() => {
+        (document.activeElement ?? document.body).dispatchEvent(
+          new KeyboardEvent("keydown", { key: "j", bubbles: true, cancelable: true }),
+        );
+      });
+      const item = (document.activeElement as HTMLElement).closest("[data-nav-index]");
+      seen.push(titles.find((title) => item?.textContent?.includes(title)));
+    }
+    // Every card once, across both rails: the shelf tile, and on from one rail into the next.
+    expect(new Set(seen)).toEqual(new Set(titles));
+    // Every card of every rail is an item of it — the shelf tile too, not only the native cards.
+    const rails = [...document.querySelectorAll("[data-nav-list]")];
+    expect(rails.map((rail) => rail.querySelectorAll("[data-nav-index]").length)).toEqual([2, 2]);
+  });
+});

frontend/src/components/Home.tsx

@@ -40,6 +40,7 @@ import VideoCard from "./VideoCard";
 import { PlexPosterCard } from "./plexCards";
 import { useNavigationActions } from "./NavigationProvider";
 import { usePlexActions } from "./PlexProvider";
+import { navItemAttrs } from "../lib/listNav";
 
 // The Home surface (E24) — "Mit nézzek most?".
 //
@@ -172,8 +173,9 @@ function Rail({
       <Carousel
         title={<span className="text-sm font-semibold">{title}</span>}
         ariaLabel={ariaLabel}
+        keyboardNav
       >
-        {cards.map((c) => (
+        {cards.map((c, i) => (
           <div
             key={`${c.source}:${c.kind}:${c.id}`}
             className={c.aspect === "poster" ? "w-[150px] shrink-0" : "shrink-0"}
@@ -184,6 +186,7 @@ function Rail({
                 video={c.video}
                 view="cardsSmall"
                 width={YT_SLOT}
+                navIndex={i}
                 onState={onState}
                 onToggleSave={onToggleSave}
                 onOpen={(v, startAt) => onPlay({ ...c, video: v }, startAt)}
@@ -195,13 +198,14 @@ function Rail({
             ) : c.plex ? (
               <PlexPosterCard
                 card={c.plex}
+                navIndex={i}
                 onOpen={() => onPlay(c)}
                 onInfo={() => onInfo(c)}
                 onToggleWatched={onToggleWatched}
                 menuProps={() => menu.triggerProps(c)}
               />
             ) : (
-              <ShelfTile card={c} onPlay={onPlay} menuProps={menu.triggerProps} />
+              <ShelfTile card={c} onPlay={onPlay} menuProps={menu.triggerProps} navIndex={i} />
             )}
           </div>
         ))}
@@ -218,10 +222,12 @@ function ShelfTile({
   card,
   onPlay,
   menuProps,
+  navIndex,
 }: {
   card: DiscoverCard;
   onPlay: (card: DiscoverCard) => void;
   menuProps?: (c: DiscoverCard) => Record<string, unknown>;
+  navIndex?: number;
 }) {
   const { t } = useTranslation();
   const count = card.kind === "channel" ? card.unwatched_count : card.item_count;
@@ -234,6 +240,7 @@ function ShelfTile({
       type="button"
       onClick={() => card.next && onPlay(card)}
       {...menuProps?.(card)}
+      {...(navIndex !== undefined && navItemAttrs(navIndex))}
       // `aria-disabled`, not `disabled`: a pinned channel with nothing unwatched left is not
       // playable, but it IS the tile you most want to take off the shelf, and the only way to do
       // that is its context menu. MEASURED in Chromium (2026-09-06), because the reason is narrower

frontend/src/components/KeyGate.tsx

@@ -22,8 +22,8 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
   });
   const configured = keyQ.data?.configured ?? false;
   // Password accounts must re-verify to reset (guards a hijacked session); Google-only accounts
-  // have no password to check. Reactive passive observer of the App-owned qk.me() query (enabled:
-  // false — App does the fetching), so hasPassword stays correct even if me resolves after mount.
+  // have no password to check. Passive observer of the qk.me() query BootGate fetches (enabled:false),
+  // so hasPassword follows the cache when a refetch changes it.
   const meQ = useQuery({ queryKey: qk.me(), queryFn: api.me, enabled: false });
   const hasPassword = meQ.data?.has_password ?? false;
 
@@ -32,9 +32,13 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
   const [confirm, setConfirm] = useState("");
   const [curPass, setCurPass] = useState("");
   const [err, setErr] = useState<string | null>(null);
+  // Keys the error: failing the same way twice is a new node, so a screen reader announces it again (a clear
+  // and a set in one handler commit together, leaving the node untouched).
+  const [attempt, setAttempt] = useState(0);
   const [busy, setBusy] = useState(false);
 
   async function submit() {
+    setAttempt((n) => n + 1);
     setErr(null);
     if (pass.length < 6) return setErr(t("messages.passTooShort"));
     if (!configured && pass !== confirm) return setErr(t("messages.passMismatch"));
@@ -67,6 +71,7 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
   }
 
   async function doReset() {
+    setAttempt((n) => n + 1);
     setErr(null);
     if (hasPassword && !curPass) return setErr(t("messages.resetNeedPass"));
     setBusy(true);
@@ -106,7 +111,11 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
             className={inputCls}
           />
         )}
-        {err && <div className="text-sm text-danger">{err}</div>}
+        {err && (
+          <div key={attempt} role="alert" className="text-sm text-danger">
+            {err}
+          </div>
+        )}
         <div className="flex gap-2">
           <Button variant="outline" onClick={cancelReset} disabled={busy}>
             {t("common.cancel")}
@@ -153,7 +162,11 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
           className={inputCls}
         />
       )}
-      {err && <div className="text-sm text-danger">{err}</div>}
+      {err && (
+        <div key={attempt} role="alert" className="text-sm text-danger">
+          {err}
+        </div>
+      )}
       <Button variant="primary" size="md" onClick={submit} disabled={busy || !pass}>
         <Lock className="w-4 h-4" />
         {configured ? t("messages.unlock") : t("messages.setUp")}

frontend/src/components/LibraryPlayer.dom.test.tsx

@@ -11,6 +11,8 @@ vi.mock("react-i18next", async (importOriginal) => {
   const actual = await importOriginal<typeof import("react-i18next")>();
   return { ...actual, useTranslation: () => ({ t: (key: string) => key }) };
 });
+const expose = vi.hoisted(() => vi.fn());
+vi.mock("../lib/browserBackgroundPlay", () => ({ exposeVideoToBackgroundPlay: expose }));
 
 import LibraryPlayer from "./LibraryPlayer";
 import type { DownloadJob } from "../lib/api";
@@ -24,6 +26,7 @@ const baseJob: DownloadJob = {
   phase: null,
   error: null,
   error_code: null,
+  error_detail: null,
   queue_pos: 0,
   created_at: null,
   source_kind: "youtube",
@@ -89,6 +92,11 @@ describe("LibraryPlayer", () => {
     expect(document.body.querySelector("audio")).toBeNull();
   });
 
+  it("hands its <video> to the background-play hook, so Brave iOS keeps it playing", () => {
+    render(<LibraryPlayer job={withAsset({ width: 1280, height: 720 })} onClose={() => {}} />);
+    expect(expose).toHaveBeenCalledWith(document.body.querySelector("video"));
+  });
+
   it("plays an audio-only asset (media_kind='audio') in an <audio> element", () => {
     render(
       <LibraryPlayer

frontend/src/components/LibraryPlayer.tsx

@@ -3,6 +3,7 @@ import { useTranslation } from "react-i18next";
 import Modal from "./ui/Modal";
 import { api, type DownloadJob } from "../lib/api";
 import { jobTitle } from "./downloadRow";
+import { exposeVideoToBackgroundPlay } from "../lib/browserBackgroundPlay";
 
 // E7 S4b — in-app player for a completed library item. We do NOT reuse PlayerModal (a cross-origin
 // YouTube IFrame shell) or PlexPlayer (a Plex HLS/session shell): both are bound to their own domain
@@ -47,6 +48,7 @@ export default function LibraryPlayer({ job, onClose }: { job: DownloadJob; onCl
         </div>
       ) : (
         <video
+          ref={exposeVideoToBackgroundPlay}
           src={fileUrl}
           poster={poster}
           controls

frontend/src/components/Messages.keyboard.dom.test.tsx

@@ -0,0 +1,67 @@
+// @vitest-environment jsdom
+//
+// The conversation list as a keyboard list (E11 S5): `j`/`k` walk the conversations and Enter opens
+// the one the row's name button opens — not the pop-out button beside it. The live query, the key
+// state and the thread are stubbed: the list itself is what is under test.
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { act, cleanup, render, screen } from "@testing-library/react";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return { ...actual, useTranslation: () => ({ t: (key: string) => key }) };
+});
+
+const conversation = (id: number, name: string) => ({
+  partner: { id, name, avatar_url: null },
+  last_message: { kind: "system", body: `hello from ${name}`, created_at: "2026-09-13T00:00:00Z" },
+  unread: 0,
+});
+const items = [conversation(0, "Siftlode"), conversation(7, "Anna"), conversation(9, "Bence")];
+
+vi.mock("../lib/useLiveQuery", () => ({
+  useLiveQuery: () => ({ data: { items }, isError: false, isLoading: false, refetch: () => {} }),
+}));
+vi.mock("../lib/messaging", () => ({
+  SYSTEM_ID: 0,
+  POLL_MS: 20000,
+  partnerPub: async () => "",
+  useKeyState: () => "ready",
+}));
+const openChat = vi.fn();
+vi.mock("../lib/chatDock", () => ({ openChat: (...a: unknown[]) => openChat(...a) }));
+vi.mock("./ChatThread", () => ({
+  default: ({ partnerId }: { partnerId: number }) => <div data-testid="thread">{partnerId}</div>,
+}));
+
+import Messages from "./Messages";
+
+afterEach(() => {
+  cleanup();
+  history.replaceState(null, "");
+});
+
+function press(key: string) {
+  act(() => {
+    (document.activeElement ?? document.body).dispatchEvent(
+      new KeyboardEvent("keydown", { key, bubbles: true, cancelable: true }),
+    );
+  });
+}
+
+describe("Messages · the conversation list is a keyboard list", () => {
+  it("walks the conversations with j/k and opens the focused one on Enter", () => {
+    render(<Messages meId={1} />);
+    const focusedRow = () => document.activeElement?.getAttribute("data-nav-index");
+    press("j");
+    press("j");
+    press("j");
+    expect(focusedRow()).toBe("2");
+    expect(document.activeElement?.textContent).toContain("Bence");
+    press("k");
+    expect(focusedRow()).toBe("1");
+    expect(document.activeElement?.textContent).toContain("Anna");
+    press("Enter");
+    expect(screen.getByTestId("thread").textContent).toBe("7");
+    expect(openChat).not.toHaveBeenCalled();
+  });
+});

frontend/src/components/Messages.tsx

@@ -16,6 +16,8 @@ import Avatar from "./ui/Avatar";
 import KeyGate from "./KeyGate";
 import { inputCls } from "./ui/form";
 import ChatThread from "./ChatThread";
+import NavGrid from "./ui/NavGrid";
+import { navItemAttrs } from "../lib/listNav";
 
 type View =
   | "list"
@@ -140,15 +142,19 @@ function ConversationList({
       ) : items.length === 0 ? (
         <div className="glass rounded-2xl p-10 text-center text-muted">{t("messages.empty")}</div>
       ) : (
-        <div className="flex flex-col gap-1.5">
-          {items.map((c) => {
+        // A keyboard list (E11): `j`/`k` walk the conversations, Enter opens the one the name button
+        // opens; the pop-out button beside it keeps its own Enter.
+        <NavGrid className="flex flex-col gap-1.5">
+          {items.map((c, i) => {
             const isSystem = c.partner.id === SYSTEM_ID;
             return (
               <div
                 key={c.partner.id}
+                {...navItemAttrs(i, c.partner.name)}
                 className="group flex items-center gap-1 rounded-xl hover:bg-card transition"
               >
                 <button
+                  data-nav-open=""
                   onClick={() => onOpen(c)}
                   className="flex items-center gap-3 p-2.5 text-left min-w-0 flex-1"
                 >
@@ -195,7 +201,7 @@ function ConversationList({
               </div>
             );
           })}
-        </div>
+        </NavGrid>
       )}
     </div>
   );

frontend/src/components/NavSidebar.tsx

@@ -4,7 +4,8 @@ import { useTranslation } from "react-i18next";
 import { useQuery } from "@tanstack/react-query";
 import { useNavigation, useNavigationActions } from "./NavigationProvider";
 import { Info, LogOut, Settings, Shield, UserPlus, type LucideIcon } from "lucide-react";
-import { api, clearActiveAccount, setActiveAccount, type Me } from "../lib/api";
+import { api, type Me } from "../lib/api";
+import { pinOnNextPage } from "../lib/activeAccount";
 import * as e2ee from "../lib/e2ee";
 import { useLiveQuery } from "../lib/useLiveQuery";
 import { getUnreadCount, subscribe } from "../lib/notifications";
@@ -71,7 +72,7 @@ export default function NavSidebar({
     } catch {
       /* IndexedDB unavailable (e.g. private mode) — never let it block the logout + reload */
     }
-    clearActiveAccount();
+    pinOnNextPage(null);
     location.reload();
   }
 
@@ -86,8 +87,9 @@ export default function NavSidebar({
   function switchTo(id: number) {
     // Per-tab switch: point THIS tab at the account and reload; other tabs keep their own
     // identity. No server round-trip — req() sends the account header (validated against the
-    // browser wallet server-side), so the cookie's default account is left untouched.
-    setActiveAccount(id);
+    // browser wallet server-side), so the cookie's default account is left untouched. The pin moves with
+    // the reload, not before it: the page going away still unloads as the account it was built for.
+    pinOnNextPage(id);
     // Drop the previous account's in-module sub-view/overlay before the reload (which would
     // otherwise preserve history.state across the swap). Otherwise the new account lands on a
     // stale sub-view — e.g. an open chat thread whose partnerId belongs to the OLD identity
@@ -334,7 +336,7 @@ export default function NavSidebar({
                     // Adding an account switches THIS tab to it: drop the tab's pin so that on
                     // return from Google it adopts the freshly-added account (the new default)
                     // and pins that. Other tabs keep their own pinned account.
-                    clearActiveAccount();
+                    pinOnNextPage(null);
                     window.location.href = "/auth/login";
                   }}
                   className="selectable w-full flex items-center gap-2 text-sm px-2 py-2 rounded-lg text-muted hover:text-fg hover:bg-card transition"

frontend/src/components/NavigationProvider.dom.test.tsx

@@ -1,16 +1,14 @@
 // @vitest-environment jsdom
 //
-// `setPage`'s no-op contract — the PRODUCER side of the history-burial fix, which nothing rendered
-// before this. `setPage` early-returns when the requested page is already current with no channel
-// page over it, and reports that by returning `false`; `lib/history.buryUnder` reads the boolean to
-// decide whether the overlay entries beneath a navigation are still reclaimable. Get it wrong and
-// the round-2 bug is back: Shift+W over the player on Home buries an entry nothing pushed past, and
-// the user's next browser Back does nothing.
+// The navigation actions against the overlay history stack: `setPage` and `openChannel` never push
+// under an open overlay — they close it and push once its Back-to-close entry is reclaimed — and
+// `setPage`'s same-page guard, which decides whether anything is pushed at all.
 //
-// The type does NOT fence this. `NavigationActions` pins the SHAPE (`=> boolean`), so deleting one
-// `return` fails tsc — but round 3 measured that swapping the two values (early return `true`, tail
-// `false`) passes typecheck and all 822 tests. Hence assertions on the value AND on the effects the
-// early return skips, which is what the boolean actually stands for.
+// The overlay half is what used to live at each call site (Shift+W in App, a toast's "View", the
+// palette, the player's channel link) and could be forgotten at any of them; it now lives in the two
+// actions, so this file is where it is pinned. The end-to-end gesture — Shift+W over the player,
+// then browser Back — is still checked in a real browser: jsdom reproduces history ordering only as
+// bookkeeping.
 import { describe, it, expect, afterEach, beforeEach, vi } from "vitest";
 import { renderHook, act, cleanup } from "@testing-library/react";
 import type { ReactNode } from "react";
@@ -27,6 +25,7 @@ vi.mock("react-i18next", async (importOriginal) => {
 });
 
 import { NavigationProvider, useNavigation, useNavigationActions } from "./NavigationProvider";
+import { useBackToClose } from "../lib/history";
 
 const wrapper = ({ children }: { children: ReactNode }) => (
   <NavigationProvider>{children}</NavigationProvider>
@@ -34,6 +33,25 @@ const wrapper = ({ children }: { children: ReactNode }) => (
 const render = () =>
   renderHook(() => ({ ...useNavigation(), ...useNavigationActions() }), { wrapper });
 
+const settle = () =>
+  act(async () => {
+    await new Promise((r) => setTimeout(r, 0));
+  });
+
+/** An open overlay (the player) whose close really unmounts it; its reclaiming back() is stubbed to
+ *  land its popstate at once. */
+async function openOverlay() {
+  const back = vi.spyOn(window.history, "back").mockImplementation(() => {
+    window.dispatchEvent(new PopStateEvent("popstate", { state: window.history.state }));
+  });
+  const holder: { unmount?: () => void } = {};
+  const onClose = vi.fn(() => holder.unmount?.());
+  const layer = renderHook(() => useBackToClose(onClose));
+  holder.unmount = layer.unmount;
+  await settle();
+  return { back, onClose };
+}
+
 beforeEach(() => {
   localStorage.clear();
   sessionStorage.setItem("siftlode.activeAccount", "1"); // account-scoped page memory
@@ -41,46 +59,29 @@ beforeEach(() => {
 });
 // Not automatic: vitest runs without `globals`, so RTL never registers its own afterEach — leaving a
 // provider (and its popstate listener) mounted for the next case. Same reason Home.dom.test.tsx does.
-afterEach(cleanup);
+afterEach(() => {
+  cleanup();
+  vi.restoreAllMocks();
+});
 
-describe("NavigationProvider · setPage reports whether it navigated", () => {
-  it("returns true and pushes an entry for a real page change", () => {
+describe("NavigationProvider · setPage's same-page guard", () => {
+  it("pushes an entry for a real page change", () => {
     const { result } = render();
     const push = vi.spyOn(window.history, "pushState");
-    try {
-      let reported: boolean | undefined;
-      act(() => {
-        reported = result.current.setPage("plex");
-      });
-      expect(reported).toBe(true);
-      expect(push).toHaveBeenCalledTimes(1);
-      expect(result.current.page).toBe("plex");
-    } finally {
-      push.mockRestore();
-    }
+    act(() => result.current.setPage("plex"));
+    expect(push).toHaveBeenCalledTimes(1);
+    expect(result.current.page).toBe("plex");
   });
 
-  it("returns false and pushes nothing when it is already that page", () => {
+  it("pushes nothing when it is already that page", () => {
     const { result } = render();
-    act(() => {
-      result.current.setPage("plex");
-    });
+    act(() => result.current.setPage("plex"));
     const push = vi.spyOn(window.history, "pushState");
-    try {
-      let reported: boolean | undefined;
-      act(() => {
-        reported = result.current.setPage("plex");
-      });
-      // Both halves matter: `false` is what `buryUnder` reads, and "pushed nothing" is what makes
-      // that answer true. A value-only assertion would pass against an inverted pair.
-      expect(reported).toBe(false);
-      expect(push).not.toHaveBeenCalled();
-    } finally {
-      push.mockRestore();
-    }
+    act(() => result.current.setPage("plex"));
+    expect(push).not.toHaveBeenCalled();
   });
 
-  it("returns true even for the current page when a channel page is over it", () => {
+  it("still navigates to the current page when a channel page is over it", () => {
     // The nav rail's own module while a channel page is open over it is a real navigation: it closes
     // the channel page. The `&& !channelViewRef.current` half of the guard is what makes it one.
     const { result } = render();
@@ -90,22 +91,64 @@ describe("NavigationProvider · setPage reports whether it navigated", () => {
     // asking for "feed" was just an ordinary page change and deleting the clause left it green.
     const current = result.current.page;
     expect(current).toBe("home");
-    act(() => {
-      result.current.openChannel("UC1", "A channel");
-    });
+    act(() => result.current.openChannel("UC1", "A channel"));
     expect(result.current.channelView).not.toBeNull();
 
     const push = vi.spyOn(window.history, "pushState");
-    try {
-      let reported: boolean | undefined;
-      act(() => {
-        reported = result.current.setPage(current);
-      });
-      expect(reported).toBe(true);
-      expect(push).toHaveBeenCalledTimes(1);
-      expect(result.current.channelView).toBeNull();
-    } finally {
-      push.mockRestore();
-    }
+    act(() => result.current.setPage(current));
+    expect(push).toHaveBeenCalledTimes(1);
+    expect(result.current.channelView).toBeNull();
+  });
+});
+
+describe("NavigationProvider · never under an open overlay", () => {
+  it("setPage closes the overlay first and pushes only once its entry is reclaimed", async () => {
+    const { result } = render();
+    const { back, onClose } = await openOverlay();
+    const push = vi.spyOn(window.history, "pushState");
+
+    act(() => result.current.setPage("plex"));
+    expect(onClose).toHaveBeenCalledTimes(1);
+    expect(push).not.toHaveBeenCalled(); // not while the player's entry is still current
+
+    await settle();
+    await settle();
+    expect(back).toHaveBeenCalledTimes(1);
+    expect(push).toHaveBeenCalledTimes(1);
+    expect(result.current.page).toBe("plex");
+    expect(window.history.state).toMatchObject({ sfPage: "plex" });
+  });
+
+  // Shift+W on Home with the player open (owner decision 2026-09-09): nothing to push, but the player
+  // closes, and its entry is reclaimed rather than orphaned under a push that never happened.
+  it("setPage to the current page closes the overlay and pushes nothing", async () => {
+    const { result } = render();
+    const { back, onClose } = await openOverlay();
+    const push = vi.spyOn(window.history, "pushState");
+
+    act(() => result.current.setPage(result.current.page));
+    await settle();
+    await settle();
+    expect(onClose).toHaveBeenCalledTimes(1);
+    expect(back).toHaveBeenCalledTimes(1);
+    expect(push).not.toHaveBeenCalled();
+  });
+
+  // The player's channel link and the palette's channel rows.
+  it("openChannel closes the overlay first and pushes the channel once its entry is reclaimed", async () => {
+    const { result } = render();
+    const { back, onClose } = await openOverlay();
+    const push = vi.spyOn(window.history, "pushState");
+
+    act(() => result.current.openChannel("UC1", "A channel"));
+    expect(onClose).toHaveBeenCalledTimes(1);
+    expect(push).not.toHaveBeenCalled();
+
+    await settle();
+    await settle();
+    expect(back).toHaveBeenCalledTimes(1);
+    expect(push).toHaveBeenCalledTimes(1);
+    expect(result.current.channelView).toEqual({ id: "UC1", name: "A channel" });
+    expect(window.history.state).toMatchObject({ _chan: "UC1" });
   });
 });

frontend/src/components/NavigationProvider.tsx

@@ -12,9 +12,13 @@ import { useTranslation } from "react-i18next";
 import { urlWithParams, type Page } from "../lib/urlState";
 import { pageTitleKey } from "../lib/pageMeta";
 import { setAccountRaw } from "../lib/storage";
-import { useAccountRehydrate } from "../lib/useAccountRehydrate";
 import { setNavigator } from "../lib/nav";
-import { nextNavId, notifyNav } from "../lib/history";
+import {
+  closeOverlaysThenNavigate,
+  nextNavId,
+  notifyNav,
+  rememberNavPosition,
+} from "../lib/history";
 import { channelViewFrom, loadInitialPage, PAGE_KEY, type ChannelView } from "./navigationInit";
 
 // Owns the app's navigation + browser-history state, lifted out of the App god component so pages
@@ -37,10 +41,11 @@ export interface NavigationState {
 }
 
 export interface NavigationActions {
-  /** Switch modules. Returns whether it actually navigated — it is a no-op when the requested page
-   *  is already current with no channel page over it, and a caller that buries overlay history
-   *  entries under the push has to know that (see `lib/history.navigateOverOverlays`). */
-  setPage: (next: Page) => boolean;
+  /** Switch modules. Closes every open overlay first and pushes only once their history entries are
+   *  back (`lib/history.closeOverlaysThenNavigate`), so over an open player the push lands a moment
+   *  after the call; with nothing open it is synchronous. The requested page being already current
+   *  (with no channel page over it) pushes nothing — but the overlays still close. */
+  setPage: (next: Page) => void;
   openChannel: (id: string, name?: string) => void;
   closeChannel: () => void;
   enterYtSearch: (q: string) => void;
@@ -53,7 +58,7 @@ const StateContext = createContext<NavigationState>({
   ytSearch: null,
 });
 const ActionsContext = createContext<NavigationActions>({
-  setPage: () => false,
+  setPage: () => {},
   openChannel: () => {},
   closeChannel: () => {},
   enterYtSearch: () => {},
@@ -96,75 +101,63 @@ export function NavigationProvider({ children }: { children: ReactNode }) {
   const channelViewRef = useRef(channelView);
   channelViewRef.current = channelView;
 
-  // The landing page is per-account (PAGE_KEY), but this provider mounts above <App>, which pins the
-  // tab's account only after /api/me — so on a fresh tab `loadInitialPage` reads an unknown account and
-  // falls back to "feed". Re-read once the account is pinned and correct the CURRENT history entry
-  // (replaceState, not push) so Back isn't given a phantom "feed" step. markDirty (set by setPage)
-  // skips this if the user already navigated in the pre-pin window.
-  const markDirty = useAccountRehydrate(() => {
-    const stored = loadInitialPage();
-    if (stored === pageRef.current) return;
-    setPageState(stored);
-    setAccountRaw(PAGE_KEY, stored); // no-op re-write, keeps storage authoritative
-    // Correct the CURRENT entry (replace, not push) and PRESERVE any markers already on it — a channel
-    // (_chan) or YT search (_yt) opened in the pre-pin window survives on top of the restored page,
-    // rather than being orphaned from history so Back can't close it. Mirror the corrected page to the
-    // address bar too (urlWithParams keeps any ?chan/filter params already there).
-    window.history.replaceState(
-      { ...(window.history.state || {}), sfPage: stored },
-      "",
-      urlWithParams({ page: stored === "feed" ? null : stored }),
-    );
-  });
-
   const setPage = useCallback(
-    (next: Page) => {
-      // A channel page overlays the content column, so a nav click must close it even when the
-      // underlying page is unchanged (e.g. "Feed" while a channel opened from the feed).
-      if (next === pageRef.current && !channelViewRef.current) return false;
-      markDirty();
-      setChannelView(null); // leave any open channel page when navigating via the rail
-      setPageState(next);
-      setAccountRaw(PAGE_KEY, next);
-      // Push an in-app history entry so browser/mouse Back steps through pages instead of leaving the
-      // app. A fresh { sfPage } (no carried-over _yt/_chan markers) so each page starts at its root, and
-      // the address bar reflects the page (feed is implicit) while clearing the view-specific params
-      // (chan/v/pl and the plex content keys pscope/psort/pshow/pf) — a page switch resets to that
-      // module's root. Feed filters (owned by FeedFiltersProvider) are left intact; the plex/channels
-      // keys re-mirror from PlexProvider / ChannelsProvider on return to their page.
-      window.history.pushState(
-        { sfPage: next, sfScroll: nextNavId() },
-        "",
-        urlWithParams({
-          page: next === "feed" ? null : next,
-          chan: null,
-          v: null,
-          pl: null,
-          pscope: null,
-          psort: null,
-          pshow: null,
-          pf: null,
-          ctab: null,
-          csort: null,
-          cf: null,
-        }),
-      );
-      notifyNav();
-      return true;
-    },
-    [markDirty],
+    (next: Page) =>
+      // Never under an open overlay — see the interface doc. The refs are read when the push
+      // actually happens, which over an open player is a moment after this call.
+      closeOverlaysThenNavigate(() => {
+        // A channel page overlays the content column, so a nav click must close it even when the
+        // underlying page is unchanged (e.g. "Feed" while a channel opened from the feed).
+        if (next === pageRef.current && !channelViewRef.current) return;
+        setChannelView(null); // leave any open channel page when navigating via the rail
+        setPageState(next);
+        setAccountRaw(PAGE_KEY, next);
+        // Push an in-app history entry so browser/mouse Back steps through pages instead of leaving
+        // the app. A fresh { sfPage } (no carried-over _yt/_chan markers) so each page starts at its
+        // root, and the address bar reflects the page (feed is implicit) while clearing the
+        // view-specific params (chan/v/pl and the plex content keys pscope/psort/pshow/pf) — a page
+        // switch resets to that module's root. Feed filters (owned by FeedFiltersProvider) are left
+        // intact; the plex/channels keys re-mirror from PlexProvider / ChannelsProvider on return to
+        // their page. The item it was opened from is still focused: the state setters above have not
+        // re-rendered anything yet.
+        rememberNavPosition();
+        window.history.pushState(
+          { sfPage: next, sfScroll: nextNavId() },
+          "",
+          urlWithParams({
+            page: next === "feed" ? null : next,
+            chan: null,
+            v: null,
+            pl: null,
+            pscope: null,
+            psort: null,
+            pshow: null,
+            pf: null,
+            ctab: null,
+            csort: null,
+            cf: null,
+          }),
+        );
+        notifyNav();
+      }),
+    [],
   );
 
-  // A sub-view (channel / YT search) is an OVERLAY, not a page change, so it does NOT markDirty: a
-  // pre-pin account re-hydrate should still restore the stored page underneath — the re-hydrate's
-  // replaceState spreads the _chan/_yt markers, so the overlay survives on top of the restored page.
+  // A sub-view (channel / YT search) is an OVERLAY, not a page change. Like setPage it never lands
+  // under an open overlay: the player's channel link and the palette's channel rows call it from
+  // inside one.
   const openChannel = useCallback((id: string, name?: string) => {
-    setChannelView({ id, name });
-    const st = window.history.state || {};
-    const url = urlWithParams({ chan: id });
-    if (st._chan)
-      window.history.replaceState({ ...st, _chan: id, _chanName: name ?? null }, "", url);
-    else window.history.pushState({ ...st, _chan: id, _chanName: name ?? null }, "", url);
+    closeOverlaysThenNavigate(() => {
+      const url = urlWithParams({ chan: id });
+      if (window.history.state?._chan) {
+        const st = window.history.state;
+        window.history.replaceState({ ...st, _chan: id, _chanName: name ?? null }, "", url);
+      } else {
+        const st = rememberNavPosition();
+        window.history.pushState({ ...st, _chan: id, _chanName: name ?? null }, "", url);
+      }
+      setChannelView({ id, name });
+    });
   }, []);
 
   const closeChannel = useCallback(() => {
@@ -178,14 +171,17 @@ export function NavigationProvider({ children }: { children: ReactNode }) {
   }, []);
 
   const enterYtSearch = useCallback((q: string) => {
-    // Overlay, not a page change — see openChannel: no markDirty, the re-hydrate preserves _yt.
     setYtSearch(q);
     // Drop any prior _ytScrape marker — the new search's source isn't known yet; Feed re-stamps it
     // once the results resolve, so a reload only restores a confirmed scrape-sourced search.
     const { _ytScrape: _drop, ...st } = window.history.state || {};
     if (st._yt)
       window.history.replaceState({ ...st, _yt: q }, ""); // refine current search
-    else window.history.pushState({ ...st, sfPage: "feed", _yt: q }, ""); // new sub-view entry
+    else {
+      // New sub-view entry.
+      const { _ytScrape: _dropToo, ...left } = rememberNavPosition();
+      window.history.pushState({ ...left, sfPage: "feed", _yt: q }, "");
+    }
   }, []);
 
   const exitYtSearch = useCallback(() => {

frontend/src/components/NotificationsPanel.tsx

@@ -79,10 +79,26 @@ export default function NotificationsPanel() {
     qc.invalidateQueries({ queryKey: qk.notifications() });
     qc.invalidateQueries({ queryKey: qk.notifUnread() });
   };
-  const readMut = useMutation({ mutationFn: api.markNotificationRead, onSuccess: refresh });
-  const readAllMut = useMutation({ mutationFn: api.markAllNotificationsRead, onSuccess: refresh });
-  const dismissMut = useMutation({ mutationFn: api.dismissNotification, onSuccess: refresh });
-  const clearMut = useMutation({ mutationFn: api.clearNotifications, onSuccess: refresh });
+  const readMut = useMutation({
+    mutationFn: api.markNotificationRead,
+    onSuccess: refresh,
+    meta: { failTitle: "errors.writeFailed.notifRead" },
+  });
+  const readAllMut = useMutation({
+    mutationFn: api.markAllNotificationsRead,
+    onSuccess: refresh,
+    meta: { failTitle: "errors.writeFailed.notifReadAll" },
+  });
+  const dismissMut = useMutation({
+    mutationFn: api.dismissNotification,
+    onSuccess: refresh,
+    meta: { failTitle: "errors.writeFailed.notifDismiss" },
+  });
+  const clearMut = useMutation({
+    mutationFn: api.clearNotifications,
+    onSuccess: refresh,
+    meta: { failTitle: "errors.writeFailed.notifClear" },
+  });
 
   const serverUnread = serverItems.some((n) => !n.read);
   const hasAny = serverItems.length > 0 || clientItems.length > 0;

frontend/src/components/OnboardingWizard.tsx

@@ -82,6 +82,8 @@ export default function OnboardingWizard({ me, onClose }: { me: Me; onClose: ()
       qc.invalidateQueries({ queryKey: qk.channels() });
       qc.invalidateQueries({ queryKey: qk.myStatus() });
     },
+    // The step itself says the import failed and offers a retry button — no toast on top.
+    meta: { errorShownInline: true },
   });
 
   // First time we see read access with zero imported channels, pull the user's
@@ -123,8 +125,9 @@ export default function OnboardingWizard({ me, onClose }: { me: Me; onClose: ()
   useDialogChrome(panelRef, rootRef);
   useEffect(() => {
     const onKey = (e: KeyboardEvent) => {
-      // Only while nothing is above us: an error dialog opened from inside the wizard owns the Tab.
-      if (e.key !== "Tab" || !layer.isTopmost()) return;
+      // Only while nothing that owns the keyboard is above us: an error dialog opened from inside the
+      // wizard owns the Tab, a hover card under the pointer does not.
+      if (e.key !== "Tab" || layer.blockingAbove()) return;
       const panel = panelRef.current;
       // The SAME three arguments `ui/Modal` passes, for the same two reasons — and this call had
       // neither of them (round 6, on the commit that extracted the helper so the two shells could

frontend/src/components/PlayerModal.dom.test.tsx

@@ -290,3 +290,63 @@ describe("PlayerModal — toasts raised while it is open", () => {
     }
   });
 });
+
+// --- the dialog contract it now shares (ui/dialogFocus) -----------------------------------------
+// Until E11 this was the one `aria-modal` shell with no accessible name, no Tab trap and no focus
+// restore: Tab walked out of an open player into the page behind the scrim, and closing it with
+// Escape left a keyboard user on <body>, their place in a long feed lost (deep-review round 7).
+describe("PlayerModal — the dialog contract", () => {
+  const open = (onClose = () => {}) => {
+    vi.spyOn(api, "videoDetail").mockReturnValue(new Promise(() => {}));
+    const A = vid("A", 0);
+    return renderModal(
+      <PlayerModal video={A} queue={[A]} startIndex={0} onClose={onClose} onState={() => {}} />,
+    );
+  };
+
+  it("is named by the video's title", () => {
+    open();
+    expect(screen.getByRole("dialog", { name: "Video A" })).toBeTruthy();
+  });
+
+  it("opens focused on its card, not on a control, so its shortcuts keep working", () => {
+    open();
+    const active = document.activeElement as HTMLElement;
+    expect(active.tagName).not.toBe("BUTTON");
+    expect(screen.getByTestId("player-modal").contains(active)).toBe(true);
+  });
+
+  it("gives the focus back to what opened it when it closes", () => {
+    const opener = document.createElement("button");
+    document.body.appendChild(opener);
+    opener.focus();
+    try {
+      const view = open();
+      expect(document.activeElement).not.toBe(opener);
+      view.unmount();
+      expect(document.activeElement).toBe(opener);
+    } finally {
+      opener.remove();
+    }
+  });
+
+  it("keeps Tab inside the player", () => {
+    open();
+    const dialog = screen.getByTestId("player-modal");
+    const tabbables = [...dialog.querySelectorAll<HTMLElement>("button:not([disabled]), a[href]")];
+    const last = tabbables[tabbables.length - 1]!;
+    last.focus();
+    // jsdom has no layout, so the trap's visibility filter would see nothing tabbable; give every
+    // element an offsetParent for the duration of this check.
+    const spy = vi
+      .spyOn(HTMLElement.prototype, "offsetParent", "get")
+      .mockReturnValue(document.body);
+    try {
+      fireEvent.keyDown(window, { key: "Tab" });
+      expect(dialog.contains(document.activeElement)).toBe(true);
+      expect(document.activeElement).not.toBe(last);
+    } finally {
+      spy.mockRestore();
+    }
+  });
+});

frontend/src/components/PlayerModal.tsx

@@ -1,17 +1,12 @@
-import { useEffect, useRef, useState } from "react";
+import { useEffect, useId, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { createPortal } from "react-dom";
 import { useNavigationActions } from "./NavigationProvider";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { qk } from "../lib/queryKeys";
 import { usePref } from "../lib/usePref";
-import {
-  AUTO_MODES,
-  LOOP_MODES,
-  PlayerTransportControls,
-  type AutoMode,
-  type LoopMode,
-} from "./playerModalControls";
+import { PlayerTransportControls } from "./playerModalControls";
+import { AUTO_MODES, LOOP_MODES, type AutoMode, type LoopMode } from "../lib/playerModes";
 import {
   AlertTriangle,
   ArrowLeft,
@@ -32,7 +27,14 @@ import {
 import Avatar from "./ui/Avatar";
 import AddToPlaylist from "./AddToPlaylist";
 import { PopoverSurface, useAnchoredPopover } from "./ui/AnchoredPopover";
-import { pushLayer, removeLayer, anyLayerAbove, escapeHandled } from "../lib/layerStack";
+import {
+  pushLayer,
+  removeLayer,
+  anyBlockingLayerAbove,
+  anyLayerAbove,
+  escapeHandled,
+} from "../lib/layerStack";
+import { trapTab, useDialogChrome } from "./ui/dialogFocus";
 import DownloadButton from "./DownloadButton";
 import { api, type Video, type VideoStatus } from "../lib/api";
 import type { YTPlayer } from "../lib/youtube";
@@ -46,7 +48,7 @@ import {
 import { renderDescription } from "../lib/descriptionLinks";
 import { fullscreenElement } from "../lib/fullscreen";
 import { dispatch, isActivationTarget, useKeyScope } from "../lib/keymap";
-import { closeThenNavigate, useBackToClose } from "../lib/history";
+import { useBackToClose } from "../lib/history";
 import ChannelNameLink from "./ChannelNameLink";
 import Toaster, { useOverlayOrder } from "./ui/Toaster";
 import { afterRemoval } from "../lib/playerQueue";
@@ -166,6 +168,12 @@ export default function PlayerModal({
   // modal adjusts volume (not just the small player area).
   const dialogRef = useRef<HTMLDivElement | null>(null);
   const focusModal = () => cardRef.current?.focus();
+  // The dialog contract every other `aria-modal` shell shares (ui/dialogFocus): the focus goes back
+  // to whatever opened the player, and the page lock is the one counted lock. It opens focused on the
+  // CARD, not its first button, so Space/F/arrows reach the shortcuts. Until E11 this was the one
+  // hand-rolled shell — no accessible name, no Tab trap, no restore (deep-review round 7).
+  useDialogChrome(cardRef, dialogRef, { focusScope: true });
+  const titleId = useId();
   const togglePlay = () => {
     const p = playerRef.current;
     if (!p || typeof p.getPlayerState !== "function") return;
@@ -397,7 +405,7 @@ export default function PlayerModal({
 
   useKeyScope("ytPlayer");
 
-  // Keyboard shortcuts + background scroll lock. The chords live in the shared keymap (`ytPlayer`
+  // Keyboard shortcuts. The chords live in the shared keymap (`ytPlayer`
   // scope) so the help sheet lists them; only the behaviour behind each id is here.
   // These fire only while focus is on our page, not inside the cross-origin player iframe — so
   // we focus the modal card on open and again on player-ready (autoplay can grab focus).
@@ -422,6 +430,14 @@ export default function PlayerModal({
       nudgeSeek(secs);
     };
     const onKey = (e: KeyboardEvent) => {
+      // The shared dialog Tab trap — only while nothing that owns the keyboard is layered above the
+      // player: a Modal opened over it (the download dialog) traps for itself. The title's hover card
+      // does not, so it must not switch the trap off.
+      if (e.key === "Tab") {
+        if (layerIdRef.current != null && anyBlockingLayerAbove(layerIdRef.current)) return;
+        if (dialogRef.current) trapTab(e, dialogRef.current, cardRef.current);
+        return;
+      }
       dispatch(e, "ytPlayer", {
         close: (ev) => {
           // Defer to any layer opened above the player FIRST (a Modal like the download dialog, or an
@@ -468,11 +484,9 @@ export default function PlayerModal({
     };
     window.addEventListener("keydown", onKey);
     focusModal();
-    const prevOverflow = document.body.style.overflow;
-    document.body.style.overflow = "hidden";
+    // (The scroll lock is the shared, counted one in useDialogChrome.)
     return () => {
       window.removeEventListener("keydown", onKey);
-      document.body.style.overflow = prevOverflow;
       // (The debounced volume write is flushed by useYtVolume's own unmount cleanup.)
     };
   }, [onClose]);
@@ -511,6 +525,7 @@ export default function PlayerModal({
       onClick={onClose}
       role="dialog"
       aria-modal="true"
+      aria-labelledby={titleId}
     >
       {/* The card, flanked by full-height glassy strips that step through the feed's order (or a
           playlist). Each strip sits just outside the card, spans its full height, and fades out at
@@ -735,7 +750,7 @@ export default function PlayerModal({
           <div className="p-4 sm:p-5">
             {/* Title row — title (with hover description) on the left, Close on the right. */}
             <div className="flex items-start gap-3">
-              <h2 className="min-w-0 flex-1 text-lg font-semibold leading-snug">
+              <h2 id={titleId} className="min-w-0 flex-1 text-lg font-semibold leading-snug">
                 {/* Hover target is the text itself (inline), not the whole row. */}
                 <span
                   ref={descPop.refs.setReference}
@@ -822,13 +837,11 @@ export default function PlayerModal({
                     channelId={active.channel_id}
                     title={active.channel_title}
                     onOpenInApp={() => {
-                      const cid = active.channel_id;
-                      const cname = active.channel_title ?? undefined;
-                      // Close first, open the channel only once this player's own Back-to-close
-                      // entry has been reclaimed — otherwise that reclaim undoes the push and
-                      // clicking the name merely closes the player. The rule lives in history.ts
-                      // now; the command palette needs exactly the same one.
-                      closeThenNavigate(onClose, () => openChannel(cid, cname));
+                      // openChannel closes this player first and pushes only once its
+                      // Back-to-close entry is reclaimed — otherwise that reclaim undoes the push
+                      // and clicking the name merely closes the player
+                      // (lib/history.closeOverlaysThenNavigate).
+                      openChannel(active.channel_id, active.channel_title ?? undefined);
                     }}
                     className="font-medium hover:text-accent truncate text-left"
                   />

frontend/src/components/Playlists.dom.test.tsx

@@ -380,7 +380,26 @@ describe("Playlists — a change the server refused is taken back on screen", ()
     await act(async () => void (await new Promise((r) => setTimeout(r, 20))));
     expect(rowsOnScreen()).toEqual(["Video V", "Video W"]);
     expect(h.notify).toHaveBeenCalledWith(
-      expect.objectContaining({ level: "error", message: "playlists.removeFailed" }),
+      expect.objectContaining({ level: "error", title: "playlists.removeFailed" }),
     );
   });
 });
+
+describe("Playlists — the rows are a keyboard list", () => {
+  it("walks the rows with j and plays the focused one on Enter", async () => {
+    mount({ 1: [vid("A", 0), vid("B", 0)] });
+    await screen.findByRole("button", { name: "card.play — Video B" });
+    const press = (key: string) =>
+      act(() => {
+        (document.activeElement ?? document.body).dispatchEvent(
+          new KeyboardEvent("keydown", { key, bubbles: true, cancelable: true }),
+        );
+      });
+    press("j");
+    press("j");
+    expect(document.activeElement?.tagName).toBe("TR");
+    expect(document.activeElement?.textContent).toContain("Video B");
+    press("Enter");
+    await waitFor(() => expect(h.player?.video.id).toBe("B"));
+  });
+});

frontend/src/components/Playlists.tsx

@@ -56,20 +56,16 @@ import { useComfortPin, pinVideo } from "./comfortPin";
 import { ContextMenu } from "./ui/ContextMenu";
 import { useContextMenu } from "./ui/useContextMenu";
 import UndoToolbar from "./ui/UndoToolbar";
+import NavGrid from "./ui/NavGrid";
 import { PageToolbar } from "./ui/PageShell";
 import { useConfirm } from "./ConfirmProvider";
 import { usePlaylistActions } from "./usePlaylistActions";
 import { usePlaylists } from "./PlaylistsProvider";
 import { useMe } from "../lib/useMe";
 import { usePref } from "../lib/usePref";
-import {
-  ColumnHead,
-  alignClass,
-  filterRows,
-  isActive,
-  type Column,
-  type FilterMap,
-} from "./ui/tableHeader";
+import { navItemAttrs } from "../lib/listNav";
+import { ColumnHead, alignClass } from "./ui/tableHeader";
+import { filterRows, isActive, type Column, type FilterMap } from "../lib/tableColumns";
 import { GRIP_KEY, playlistColumns } from "./playlistColumns";
 
 // The playlist detail is a HYBRID table (E4 S4): real sortable/filterable column headers over a
@@ -99,12 +95,15 @@ const idsKey = (items: Video[]) =>
 
 function Row({
   video,
+  index,
   columns,
   dragDisabled,
   dragHint,
   menuProps,
 }: {
   video: Video;
+  /** Its position among the rows shown — the row is a keyboard item (lib/listNav). */
+  index: number;
   columns: Column<Video>[];
   dragDisabled: boolean;
   dragHint: string;
@@ -131,6 +130,7 @@ function Row({
       // transition-COLORS, not `transition` — the bare utility animates transform too, which is
       // the same lag by another route (150ms behind the pointer, on every row).
       className="border-b border-border/50 hover:bg-card/40 transition-colors"
+      {...navItemAttrs(index)}
       {...menuProps}
     >
       {columns.map((col) => (
@@ -676,16 +676,20 @@ export default function Playlists() {
   }
 
   function playerState(id: string, status: string) {
-    api.setState(id, status).then(() => {
-      // Every cached list, not `qk.playlist(selectedId)`: the player may have been launched from a
-      // list that is no longer the selected one (see `playing`), and that list holds the row whose
-      // status just changed. Only lists actually on screen refetch.
-      qc.invalidateQueries({ queryKey: qk.playlist() });
-      qc.invalidateQueries({ queryKey: qk.feed() });
-    });
+    api
+      .setState(id, status)
+      .then(() => {
+        // Every cached list, not `qk.playlist(selectedId)`: the player may have been launched from a
+        // list that is no longer the selected one (see `playing`), and that list holds the row whose
+        // status just changed. Only lists actually on screen refetch.
+        qc.invalidateQueries({ queryKey: qk.playlist() });
+        qc.invalidateQueries({ queryKey: qk.feed() });
+      })
+      // No catch used to mean an unhandled rejection and nothing said (E11 S2b).
+      .catch((e: unknown) => notifyActionError(e, t("errors.writeFailed.videoState")));
   }
 
-  // Stable identity: PlayerModal's keydown/scroll-lock effect depends on it, so a fresh closure
+  // Stable identity: PlayerModal's keydown effect depends on it, so a fresh closure
   // every render re-subscribed those listeners and re-ran focusModal() under the open player.
   const closePlayer = useCallback(() => setPlaying(null), []);
 
@@ -1089,10 +1093,14 @@ export default function Playlists() {
                   items={shown.map((v) => v.id)}
                   strategy={verticalListSortingStrategy}
                 >
-                  <tbody>
-                    {shown.map((v) => (
+                  {/* The rows are a keyboard list: `j`/`k` and the arrows walk them, Enter plays. The grip
+                    keeps Space/Enter, and during a keyboard drag the arrows too (listNav leaves a key
+                    dnd-kit has handled). */}
+                  <NavGrid as="tbody">
+                    {shown.map((v, i) => (
                       <Row
                         key={v.id}
+                        index={i}
                         video={v}
                         columns={columns}
                         dragDisabled={!canEdit || viewActive}
@@ -1100,7 +1108,7 @@ export default function Playlists() {
                         menuProps={rowMenu.triggerProps(v)}
                       />
                     ))}
-                  </tbody>
+                  </NavGrid>
                 </SortableContext>
               </table>
               {shown.length === 0 && (

frontend/src/components/PlaylistsProvider.tsx

@@ -1,6 +1,5 @@
 import { createContext, useCallback, useContext, useMemo, useState, type ReactNode } from "react";
 import { LS, setAccountRaw } from "../lib/storage";
-import { useAccountRehydrate } from "../lib/useAccountRehydrate";
 import { useUrlMirror } from "../lib/useUrlMirror";
 import { useNavigation } from "./NavigationProvider";
 import { readSelectedId } from "./playlistsInit";
@@ -43,19 +42,11 @@ export function PlaylistsProvider({ children }: { children: ReactNode }) {
   const [search, setSearchState] = useState("");
   const [selectedId, setSelectedIdState] = useState<number | null>(readSelectedId);
 
-  // Re-read the selected playlist once the account is pinned after mount (first load on a fresh tab):
-  // this provider mounts above <App>, which pins the account only after /api/me.
-  const markDirty = useAccountRehydrate(() => setSelectedIdState(readSelectedId()));
-
   const setSearch = useCallback((q: string) => setSearchState(q), []);
-  const setSelectedId = useCallback(
-    (id: number | null) => {
-      markDirty();
-      setSelectedIdState(id);
-      if (id != null) setAccountRaw(LS.playlist, String(id));
-    },
-    [markDirty],
-  );
+  const setSelectedId = useCallback((id: number | null) => {
+    setSelectedIdState(id);
+    if (id != null) setAccountRaw(LS.playlist, String(id));
+  }, []);
 
   // Mirror the selected playlist to ?pl on the Playlists page so it's bookmarkable; clear it elsewhere
   // (the localStorage copy still restores it on return). useUrlMirror keeps ?page and the other nav

frontend/src/components/PlaylistsRail.rename.dom.test.tsx

@@ -0,0 +1,118 @@
+// @vitest-environment jsdom
+//
+// The rail's in-row rename, from the keyboard. Enter and Escape unmount the focused field and render
+// the row as a NEW button; without a refocus the keyboard user was dropped on <body> and lost their
+// place (E10 review round 1, measured again in Chrome in E11 S2). Everything around the rail that is
+// not the rename path is stubbed.
+import { describe, it, expect, vi, afterEach, beforeAll } from "vitest";
+import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
+import { FloatingTree } from "@floating-ui/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import type { ReactNode } from "react";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return { ...actual, useTranslation: () => ({ t: (k: string) => k, i18n: { language: "en" } }) };
+});
+vi.mock("./PlaylistsProvider", () => ({
+  usePlaylists: () => ({ search: "", selectedId: 1 }),
+  usePlaylistsActions: () => ({ setSelectedId: vi.fn() }),
+}));
+vi.mock("../lib/useMe", () => ({ useMe: () => ({ can_write: true }) }));
+vi.mock("./comfortPin", () => ({
+  useComfortPin: () => ({ item: () => [] }),
+  pinPlaylist: (id: number) => id,
+}));
+const rename = vi.fn(async () => {});
+vi.mock("./usePlaylistActions", () => ({
+  usePlaylistActions: () => ({ rename, remove: vi.fn() }),
+}));
+// The SidePanel/PanelGroups chrome is not what is under test: render the rail's bodies directly.
+vi.mock("./FilterRail", () => ({
+  default: ({ items }: { items: { id: string; body: ReactNode }[] }) => (
+    <>
+      {items.map((i) => (
+        <div key={i.id}>{i.body}</div>
+      ))}
+    </>
+  ),
+}));
+
+import PlaylistsRail from "./PlaylistsRail";
+import { api, type Playlist } from "../lib/api";
+
+beforeAll(() => {
+  class Stub {
+    observe() {}
+    unobserve() {}
+    disconnect() {}
+    takeRecords() {
+      return [];
+    }
+  }
+  globalThis.ResizeObserver ??= Stub as unknown as typeof ResizeObserver;
+  globalThis.IntersectionObserver ??= Stub as unknown as typeof IntersectionObserver;
+  Element.prototype.scrollIntoView ??= () => {};
+});
+
+afterEach(() => {
+  cleanup();
+  vi.restoreAllMocks();
+  rename.mockClear();
+});
+
+const alpha = {
+  id: 1,
+  name: "alpha",
+  kind: "custom",
+  source: "local",
+  item_count: 3,
+  total_duration_seconds: 0,
+  cover_thumbnail: null,
+  dirty: false,
+} as unknown as Playlist;
+
+async function openRename() {
+  vi.spyOn(api, "playlists").mockResolvedValue([alpha]);
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  render(
+    <QueryClientProvider client={qc}>
+      <FloatingTree>
+        <PlaylistsRail
+          layout={{} as never}
+          setLayout={() => {}}
+          collapsed={false}
+          onToggleCollapse={() => {}}
+        />
+      </FloatingTree>
+    </QueryClientProvider>,
+  );
+  const row = (await screen.findByText("alpha")).closest("button")!;
+  act(() => row.focus());
+  fireEvent.keyDown(row, { key: "F10", shiftKey: true });
+  fireEvent.click(await screen.findByText("playlists.rename"));
+  // The menu runs its action a task after it closes (see ui/ActionMenu).
+  const field = await screen.findByRole("textbox", { name: "playlists.rename" });
+  await vi.waitFor(() => expect(document.activeElement).toBe(field));
+  return field as HTMLInputElement;
+}
+
+const rowButton = () => screen.getByText("alpha").closest("button");
+
+describe("PlaylistsRail · rename from the keyboard", () => {
+  it("Escape cancels and puts the focus back on the row", async () => {
+    const field = await openRename();
+    fireEvent.change(field, { target: { value: "alpha2" } });
+    fireEvent.keyDown(field, { key: "Escape" });
+    await vi.waitFor(() => expect(document.activeElement).toBe(rowButton()));
+    expect(rename).not.toHaveBeenCalled();
+  });
+
+  it("Enter commits and puts the focus back on the row", async () => {
+    const field = await openRename();
+    fireEvent.change(field, { target: { value: "beta" } });
+    fireEvent.keyDown(field, { key: "Enter" });
+    expect(rename).toHaveBeenCalledWith(1, "beta");
+    await vi.waitFor(() => expect(document.activeElement).toBe(rowButton()));
+  });
+});

frontend/src/components/PlaylistsRail.tsx

@@ -160,6 +160,7 @@ export default function PlaylistsRail({
 
   const createMut = useMutation({
     mutationFn: (name: string) => api.createPlaylist(name),
+    meta: { failTitle: "errors.writeFailed.createPlaylist" },
     onSuccess: (pl: Playlist) => {
       setNewName("");
       qc.invalidateQueries({ queryKey: qk.playlists() });
@@ -167,35 +168,20 @@ export default function PlaylistsRail({
     },
   });
 
-  // KNOWN GAP: Enter and Escape unmount the focused <input> and re-render the row as a <button> that
-  // nothing focuses, so a keyboard user is dropped on <body> and loses their place in the rail (E10
-  // review round 1). A refocus-the-row fix was written in round 1 and REMOVED in round 3 because a
-  // real-browser check showed it never worked: Escape's handler does run (typing then Escape leaves
-  // the name unchanged, i.e. it cancels rather than blur-commits) and the row button is focusable
-  // when focused from outside — yet activeElement is still BODY afterwards. Three explanations were
-  // tried and none survived contact, so the machinery went rather than a fourth guess. Whoever picks
-  // this up: instrument the effect in a real browser first, do not reason about the commit order.
+  // Enter and Escape unmount the focused <input> and re-render the row as a NEW <button>, so without
+  // this a keyboard user was dropped on <body> and lost their place in the rail (E10 review round 1).
+  // The row is focused from its ref callback, i.e. as that button attaches: measured in Chrome (E11
+  // S2), a focus issued after the commit sticks and nothing takes it back — the round-1 attempt that
+  // "never worked" focused before the replacement button existed. Set by Enter/Escape only: a
+  // blur-commit means the user put the focus somewhere else on purpose.
+  const refocusRowRef = useRef<number | null>(null);
   const renameInputRef = useRef<HTMLInputElement | null>(null);
 
-  // UNRESOLVED — do not "simplify" this back to `autoFocus` without reading the whole story.
-  //
-  // Opening this field from the context menu is a focus race: `MenuItemList` runs `onSelect()` and
-  // `onClose()` in one batch, so the field mounts in the same commit that unmounts the popover, and
-  // floating-ui's FloatingFocusManager hands focus back from a `queueMicrotask` queued in its
-  // layout-effect cleanup. If that microtask wins, the field is blurred straight back out and its
-  // own onBlur commits and closes it — "the rename field flashes and vanishes" (E10 review round 1).
-  //
-  // Three answers have been tried and none is VERIFIED. Round 1 turned floating-ui's returnFocus off
-  // platform-wide and broke two other surfaces (a non-focusable <tr> trigger; a scroll-dismiss that
-  // scrolled the list back). Round 2 replaced it with this effect, on the reasoning that a passive
-  // effect is scheduled after the microtask. Round 3 disputed that (React flushes passive effects
-  // synchronously at the end of a SyncLane commit, which would put the microtask LAST) — and a jsdom
-  // harness built to settle it reproduced no failure for ANY of autoFocus / this effect / a
-  // microtask, i.e. jsdom does not exercise the race, because focus never enters the menu there.
-  //
-  // So: this is the shape that is deliberate rather than accidental, and the question is open. It
-  // needs ONE real-browser check (open the rail's context menu, pick Rename, see whether the field
-  // survives) — not a fourth guess. Logged in the E10 plan.
+  // Opening this field from the context menu used to race the menu's own focus return (floating-ui
+  // hands the focus back to the trigger from a microtask queued as the popover unmounts, and the field
+  // mounted in that same commit). `MenuItemList` now runs the item's action on a fresh task AFTER that
+  // return, so the field simply mounts and is focused here; measured in Chrome (E11 S2), the field is
+  // focused and survives.
   useEffect(() => {
     if (renamingId !== null) renameInputRef.current?.focus();
   }, [renamingId]);
@@ -338,9 +324,15 @@ export default function PlaylistsRail({
                     onChange={(e) => setRenameValue(e.target.value)}
                     onBlur={() => void commitRename(pl)}
                     onKeyDown={(e) => {
-                      if (e.key === "Enter") void commitRename(pl);
+                      if (e.key === "Enter") {
+                        refocusRowRef.current = pl.id;
+                        void commitRename(pl);
+                      }
                       // Unmounting the input fires no blur in React, so Escape really does cancel.
-                      if (e.key === "Escape") setRenamingId(null);
+                      if (e.key === "Escape") {
+                        refocusRowRef.current = pl.id;
+                        setRenamingId(null);
+                      }
                     }}
                     aria-label={t("playlists.rename")}
                     className="flex-1 min-w-0 bg-surface border border-border rounded-md px-2 py-1 text-xs focus:outline-hidden focus:ring-2 focus:ring-accent/40"
@@ -349,7 +341,14 @@ export default function PlaylistsRail({
               ) : (
                 <button
                   key={pl.id}
-                  ref={pl.id === selectedId ? selectedRef : null}
+                  ref={(el) => {
+                    if (pl.id === selectedId) selectedRef.current = el;
+                    // Back from the rename field by Enter/Escape — see refocusRowRef.
+                    if (el && refocusRowRef.current === pl.id) {
+                      refocusRowRef.current = null;
+                      el.focus();
+                    }
+                  }}
                   onClick={() => setSelectedId(pl.id)}
                   {...railMenu.triggerProps(pl)}
                   className={`${ROW_BASE} text-left ${

frontend/src/components/PlexBrowse.tsx

@@ -42,6 +42,7 @@ import { PlexPinMenu } from "./ComfortPinMenu";
 import { useContextMenu } from "./ui/useContextMenu";
 import { PlexInfoView, PlexPersonView, PlexSeasonView, PlexShowView } from "./plexViews";
 import { dispatch, useKeyScope } from "../lib/keymap";
+import NavGrid from "./ui/NavGrid";
 
 // Lazy: the rich player (pulls in hls.js) loads only when something is first played.
 const PlexPlayer = lazy(() => import("./PlexPlayer"));
@@ -607,10 +608,11 @@ export default function PlexBrowse() {
               {episodes.length > 0 && (
                 <h2 className="text-sm font-semibold mb-2">{t("plex.unified.titles")}</h2>
               )}
-              <div className="grid grid-cols-[repeat(auto-fill,minmax(150px,1fr))] gap-3">
-                {items.map((c) => (
+              <NavGrid className="grid grid-cols-[repeat(auto-fill,minmax(150px,1fr))] gap-3">
+                {items.map((c, i) => (
                   <PlexPosterCard
                     key={c.id}
+                    navIndex={i}
                     card={c}
                     onOpen={() => onCard(c)}
                     onInfo={() => onInfo(c)}
@@ -618,24 +620,25 @@ export default function PlexBrowse() {
                     menuProps={pinMenu.triggerProps}
                   />
                 ))}
-              </div>
+              </NavGrid>
             </>
           )}
           {/* Episodes section (Proposal 3) — matching episodes on a search, kept out of the title grid. */}
           {episodes.length > 0 && (
             <section className="mt-8">
               <h2 className="text-sm font-semibold mb-3">{t("plex.unified.episodes")}</h2>
-              <div className="grid grid-cols-[repeat(auto-fill,minmax(230px,1fr))] gap-x-3 gap-y-4">
-                {episodes.map((ep) => (
+              <NavGrid className="grid grid-cols-[repeat(auto-fill,minmax(230px,1fr))] gap-x-3 gap-y-4">
+                {episodes.map((ep, i) => (
                   <EpisodeCard
                     key={ep.id}
+                    navIndex={i}
                     ep={ep}
                     withShowTitle
                     onPlay={() => onCard(ep)}
                     onToggleWatched={() => toggleWatched(ep)}
                   />
                 ))}
-              </div>
+              </NavGrid>
             </section>
           )}
         </>

frontend/src/components/PlexCollectionView.tsx

@@ -20,6 +20,7 @@ import { useContextMenu } from "./ui/useContextMenu";
 import PlexLibraryPicker from "./PlexLibraryPicker";
 import { toggleWatchState } from "../lib/plexWatch";
 import { LoadingState, StateMessage } from "./ui/QueryState";
+import NavGrid from "./ui/NavGrid";
 
 // The Collection info page (ask B): a hero (art/title/cert/year-range/count/runtime/summary) + the
 // ordered member grid, a Play-all / Shuffle over the playable leaves, and — for a NON-external,
@@ -398,11 +399,12 @@ export default function PlexCollectionView({
                   />
                 </div>
               </div>
-              <div className="grid grid-cols-3 gap-3 sm:grid-cols-4 md:grid-cols-5 lg:grid-cols-6">
-                {items.map((c) => (
+              <NavGrid className="grid grid-cols-3 gap-3 sm:grid-cols-4 md:grid-cols-5 lg:grid-cols-6">
+                {items.map((c, i) => (
                   <div key={c.id} className="relative">
                     <PlexPosterCard
                       card={c}
+                      navIndex={i}
                       onOpen={() => onOpenCard(c)}
                       onInfo={() => onInfoCard(c)}
                       onToggleWatched={toggleWatched}
@@ -421,7 +423,7 @@ export default function PlexCollectionView({
                     )}
                   </div>
                 ))}
-              </div>
+              </NavGrid>
             </>
           )}
         </>

frontend/src/components/PlexDiscover.dom.test.tsx

@@ -6,7 +6,7 @@
 // payload shows the empty message. i18n is key-passthrough; the api is mocked so queries resolve
 // synchronously. The rails scroll inside a Carousel (useHScroll → ResizeObserver), stubbed for jsdom.
 import { describe, it, expect, afterEach, beforeAll, vi } from "vitest";
-import { render, screen, fireEvent, cleanup, waitFor } from "@testing-library/react";
+import { act, render, screen, fireEvent, cleanup, waitFor } from "@testing-library/react";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 
 beforeAll(() => {
@@ -263,3 +263,40 @@ describe("PlexDiscover", () => {
     expect(screen.queryByLabelText("plex.markUnwatched")).toBeNull();
   });
 });
+
+// E11 S4b: every rail and the genre grid are lists the keyboard walks (lib/listNav), so `j` goes on
+// from one to the next in page order (owner decision D4).
+describe("PlexDiscover · keyboard", () => {
+  it("registers every rail and the genre grid, and j walks on from rail to rail", async () => {
+    plexDiscover.mockResolvedValue(fullPayload);
+    plexSurprise.mockResolvedValue({ scope: "both", items: [card("sp1", "Random Pick")] });
+    wrap(
+      <PlexDiscover
+        scope="both"
+        onOpenCard={noop}
+        onInfoCard={noop}
+        onGenre={noop}
+        onSeeAllRecent={noop}
+      />,
+    );
+    await screen.findAllByText("Random Pick");
+    // Five rails (continue, recently watched, recently added, because-you-watched, surprise) + genres.
+    const lists = [...document.querySelectorAll("[data-nav-list]")];
+    expect(lists.length).toBe(6);
+    // …and each holds its cards as items: the genre tiles too, not only the posters.
+    expect(lists.every((list) => list.querySelector("[data-nav-index]"))).toBe(true);
+    const step = () => {
+      act(() => {
+        (document.activeElement ?? document.body).dispatchEvent(
+          new KeyboardEvent("keydown", { key: "j", bubbles: true, cancelable: true }),
+        );
+      });
+      return (document.activeElement as HTMLElement).closest("[data-nav-index]")?.textContent;
+    };
+    const first = step();
+    const second = step();
+    expect(first).toBeTruthy();
+    expect(second).toBeTruthy();
+    expect(second).not.toBe(first); // one card per rail: the second press crossed into the next rail
+  });
+});

frontend/src/components/PlexDiscover.tsx

@@ -13,6 +13,7 @@ import { PlexPosterCard } from "./plexCards";
 import { PlexPinMenu } from "./ComfortPinMenu";
 import { useContextMenu } from "./ui/useContextMenu";
 import { LoadingState, StateMessage } from "./ui/QueryState";
+import NavGrid from "./ui/NavGrid";
 
 // The Plex "Discover" landing (E5 S4): a stack of horizontal Carousel rails served from ONE
 // /api/plex/discover call — Continue watching, Recently added, Browse by genre (tiles), Because you
@@ -55,11 +56,18 @@ function CardRail({
     );
   return (
     <section className="mb-5">
-      <Carousel title={heading} ariaLabel={ariaLabel} onSeeAll={onSeeAll} seeAllLabel={seeAllLabel}>
-        {cards.map((c) => (
+      <Carousel
+        title={heading}
+        ariaLabel={ariaLabel}
+        onSeeAll={onSeeAll}
+        seeAllLabel={seeAllLabel}
+        keyboardNav
+      >
+        {cards.map((c, i) => (
           <div key={c.id} className="w-[150px] shrink-0">
             <PlexPosterCard
               card={c}
+              navIndex={i}
               onOpen={() => onOpenCard(c)}
               onInfo={() => onInfoCard(c)}
               onToggleWatched={onToggleWatched}
@@ -222,17 +230,18 @@ export default function PlexDiscover({
       {d.genres.length > 0 && (
         <section className="mb-5">
           <h2 className="mb-3 text-sm font-semibold">{t("plex.discover.byGenre")}</h2>
-          <div className="grid grid-cols-2 gap-3 sm:grid-cols-3 md:grid-cols-4 lg:grid-cols-6">
-            {d.genres.map((g) => (
+          <NavGrid className="grid grid-cols-2 gap-3 sm:grid-cols-3 md:grid-cols-4 lg:grid-cols-6">
+            {d.genres.map((g, i) => (
               <PosterTile
                 key={g.value}
+                navIndex={i}
                 title={g.value}
                 art={g.art}
                 onClick={() => onGenre(g.value)}
                 className="h-24"
               />
             ))}
-          </div>
+          </NavGrid>
         </section>
       )}
 

frontend/src/components/PlexInfo.tsx

@@ -20,6 +20,7 @@ import { Carousel } from "./ui/Carousel";
 import PlexCollectionEditor from "./PlexCollectionEditor";
 import PlexPlaylistAdd from "./PlexPlaylistAdd";
 import { PLAYABLE_TINT, playableClass } from "./plexCards";
+import { navItemAttrs } from "../lib/listNav";
 
 // The rich "media info" surface for a Plex item — poster/art, IMDb score + link, content rating,
 // genres, director, cast (with photos), summary. Reused in TWO places: a full-page view opened from
@@ -649,7 +650,11 @@ export default function PlexInfo({
             <h2 className={`mb-2 text-sm font-semibold ${overlay ? "text-white/80" : ""}`}>
               {t("plex.info.cast")}
             </h2>
-            <Carousel ariaLabel={t("plex.info.cast")} gap="gap-3">
+            <Carousel
+              ariaLabel={t("plex.info.cast")}
+              gap="gap-3"
+              keyboardNav={!!(onOpenPerson || onFilter)}
+            >
               {cast.map((c, i) => {
                 const clickable = !!(onOpenPerson || onFilter);
                 const inner = (
@@ -686,6 +691,7 @@ export default function PlexInfo({
                 return clickable ? (
                   <button
                     key={i}
+                    {...navItemAttrs(i)}
                     onClick={() =>
                       onOpenPerson ? onOpenPerson(c.name) : onFilter?.({ actors: [c.name] })
                     }
@@ -734,10 +740,11 @@ export default function PlexInfo({
                   </button>
                 )}
               </div>
-              <Carousel ariaLabel={col.title} gap="gap-3">
-                {col.items.map((m) => (
+              <Carousel ariaLabel={col.title} gap="gap-3" keyboardNav={!!onPlayItem}>
+                {col.items.map((m, i) => (
                   <button
                     key={m.id}
+                    {...navItemAttrs(i)}
                     onClick={() => onPlayItem?.(m.id)}
                     disabled={!onPlayItem}
                     className="group/col w-28 shrink-0 text-left"

frontend/src/components/PlexPlayer.strictmode.dom.test.tsx

@@ -21,6 +21,9 @@ vi.mock("react-i18next", async (importOriginal) => {
   };
 });
 
+const expose = vi.hoisted(() => vi.fn());
+vi.mock("../lib/browserBackgroundPlay", () => ({ exposeVideoToBackgroundPlay: expose }));
+
 import PlexPlayer from "./PlexPlayer";
 import { api, type PlexItemDetail } from "../lib/api";
 
@@ -98,4 +101,21 @@ describe("PlexPlayer under StrictMode", () => {
     video.dispatchEvent(new Event("loadedmetadata"));
     await waitFor(() => expect(played).toContain("/api/plex/direct/99079"));
   });
+
+  it("hands its <video> to the background-play hook, so Brave iOS keeps it playing", async () => {
+    vi.spyOn(api, "plexItem").mockResolvedValue(detail);
+    vi.spyOn(api, "plexSession").mockResolvedValue({
+      mode: "direct",
+      url: "/api/plex/direct/99079",
+      start_s: 0,
+    } as never);
+    const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    render(
+      <QueryClientProvider client={qc}>
+        <PlexPlayer itemId="99079" onClose={() => {}} />
+      </QueryClientProvider>,
+    );
+    const video = await waitFor(() => document.querySelector("video")!);
+    expect(expose).toHaveBeenCalledWith(video);
+  });
 });

frontend/src/components/PlexPlayer.tsx

@@ -3,6 +3,7 @@ import { qk } from "../lib/queryKeys";
 import { createPortal } from "react-dom";
 import { useTranslation } from "react-i18next";
 import { plexLang } from "../i18n";
+import { exposeVideoToBackgroundPlay } from "../lib/browserBackgroundPlay";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import Hls from "hls.js";
 import {
@@ -115,7 +116,7 @@ export default function PlexPlayer({ itemId, onClose, queue }: Props) {
   const detail = detailQ.data;
   const duration = detail?.duration_seconds ?? 0;
 
-  const videoRef = useRef<HTMLVideoElement>(null);
+  const videoRef = useRef<HTMLVideoElement | null>(null);
   const hlsRef = useRef<Hls | null>(null);
   // False once unmounted, so a late play() (from MANIFEST_PARSED / loadedmetadata firing after Back)
   // can't start a detached <video> playing audio in the background.
@@ -915,7 +916,8 @@ export default function PlexPlayer({ itemId, onClose, queue }: Props) {
         info: () => setInfoOpen((v) => !v),
         stats: () => setStatsOpen((v) => !v),
         back: (ev) => {
-          // HTPC-style "stop & back to the feed" — mirrors the mouse Back button (shared cascade).
+          // HTPC-style "stop & go back" to wherever the player was opened from — mirrors the mouse
+          // Back button (shared cascade).
           // Who owns ⌫ when something is open over the player. Modal stopPropagation()s Escape ONLY
           // and its focused close button is not a typing target, so the key reaches us regardless.
           // Two wrong answers so far: deferring to nothing at all (round 1's bug — the cheat sheet
@@ -1047,7 +1049,11 @@ export default function PlexPlayer({ itemId, onClose, queue }: Props) {
         prefs.subShadowColor,
       )}}`}</style>
       <video
-        ref={videoRef}
+        ref={(el) => {
+          videoRef.current = el;
+          // So Brave iOS's background play keeps it going when the app is left (lib/browserBackgroundPlay).
+          exposeVideoToBackgroundPlay(el);
+        }}
         // Fill the wrapper (which is sized to the viewport / screen) and letterbox by aspect via
         // object-contain. NOT `w-auto h-auto max-*`: that caps the video at its intrinsic resolution
         // (a 720p stream → 1280×720) and never scales it UP, so in fullscreen it sat tiny and centred.

frontend/src/components/PlexProvider.dom.test.tsx

@@ -0,0 +1,45 @@
+// @vitest-environment jsdom
+//
+// A shared Plex link is persisted to the account, but only the dimensions it CARRIES. The bug it
+// replaced: a link with only a scope also wrote the (empty) default filters, and a stored Plex filters
+// value at all is what tells SavedViewsProvider the account has picked filters — so the account's
+// default saved view was never applied again.
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { render, cleanup } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { NavigationProvider } from "./NavigationProvider";
+import { PlexProvider } from "./PlexProvider";
+import { ACTIVE_ACCOUNT_KEY } from "../lib/activeAccount";
+
+function mount() {
+  render(
+    <QueryClientProvider client={new QueryClient()}>
+      <NavigationProvider>
+        <PlexProvider>
+          <div />
+        </PlexProvider>
+      </NavigationProvider>
+    </QueryClientProvider>,
+  );
+}
+
+beforeEach(() => {
+  localStorage.clear();
+  sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, "5");
+});
+afterEach(() => {
+  cleanup();
+  window.history.replaceState(null, "", "/");
+});
+
+describe("PlexProvider shared link", () => {
+  it("persists the scope a link carries and leaves the dimensions it omits unwritten", () => {
+    window.history.replaceState(null, "", "/?page=plex&pscope=movie");
+    mount();
+
+    expect(localStorage.getItem("siftlode.plexLibrary.5")).toBe("movie");
+    expect(localStorage.getItem("siftlode.plexFilters.5")).toBeNull();
+    expect(localStorage.getItem("siftlode.plexSort.5")).toBeNull();
+    expect(localStorage.getItem("siftlode.plexShow.5")).toBeNull();
+  });
+});

frontend/src/components/PlexProvider.tsx

@@ -1,4 +1,12 @@
-import { createContext, useCallback, useContext, useMemo, useState, type ReactNode } from "react";
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useState,
+  type ReactNode,
+} from "react";
 import { coercePlexFilters, EMPTY_PLEX_FILTERS, type PlexFilters } from "../lib/api";
 import { parseSortState, type SortState } from "../lib/columnSort";
 import { parsePlexField, type PlexSearchField } from "../lib/plexSearch";
@@ -10,7 +18,6 @@ import {
   type PlexUrlState,
 } from "../lib/plexUrlState";
 import { getAccountRaw, LS, setAccountRaw } from "../lib/storage";
-import { useAccountRehydrate } from "../lib/useAccountRehydrate";
 import { useUrlMirror } from "../lib/useUrlMirror";
 import { useNavigation } from "./NavigationProvider";
 
@@ -20,10 +27,8 @@ import { useNavigation } from "./NavigationProvider";
 // instead of prop-drilling through App. Mirrors FeedFiltersProvider (split State + Actions contexts,
 // stable useCallback setters, one-line hooks; composed in main.tsx around <App/>).
 //
-// scope / show / sort / filters / q are per-account persisted (localStorage). init-from-storage seeds
-// them, and useAccountRehydrate re-reads once the tab's account is pinned — this provider mounts above
-// <App>, which pins it only after /api/me, so a fresh tab would otherwise show defaults until a reload
-// (an account SWITCH does full-reload, but the FIRST load does not). `playlistOpen` is an ephemeral
+// scope / show / sort / filters / q are per-account persisted (localStorage) and seeded from it at mount
+// (BootGate pins the tab's account first; an account switch reloads). `playlistOpen` is an ephemeral
 // hand-off (the rail sets it, PlexBrowse consumes it into a history subview then clears it). The Plex
 // search term is deliberately its OWN state, NOT the feed's `filters.q`, so a Plex search never leaks
 // into (and is never greeted by a stale value from) the feed.
@@ -95,7 +100,7 @@ export function usePlexActions(): PlexActions {
   return useContext(ActionsContext);
 }
 
-// The per-account init readers, shared by the initial useState seed AND the account-pin re-hydrate.
+// The per-account init readers, shared by the useState seeds and the shared-link seed's base.
 function readPlexScope(): string {
   const v = getAccountRaw(LS.plexLibrary) ?? "both";
   return ["movie", "show", "both"].includes(v) ? v : "both";
@@ -144,13 +149,11 @@ function readPlexFilters(): PlexFilters {
     return EMPTY_PLEX_FILTERS;
   }
 }
-// A shared-link seed = the URL-merged state PLUS which dimensions the URL actually carried. `present`
-// matters because the base below is read at MOUNT, before the account is pinned (getAccountRaw returns
-// null then), so the base for an OMITTED dimension is a hard default, NOT this account's stored value.
-// The provider must therefore persist/keep only the PRESENT dimensions on account-pin and re-read the
-// account's real stored value for the absent ones — otherwise a partial link silently resets them.
+// The base is this account's stored view (BootGate pins the account before this provider mounts), so a
+// PARTIAL link — one carrying only the scope, say — keeps the stored sort, show and filters for the rest.
+// `present` records which dimensions the link actually carried: only those are persisted (below).
 type PlexSeedPresent = { scope: boolean; sort: boolean; show: boolean; filters: boolean };
-type PlexUrlSeed = { state: PlexUrlState; present: PlexSeedPresent };
+type PlexUrlSeed = PlexUrlState & { present: PlexSeedPresent };
 function readPlexUrlSeed(): PlexUrlSeed | null {
   const params = new URLSearchParams(window.location.search);
   if (!hasPlexParams(params)) return null;
@@ -160,29 +163,27 @@ function readPlexUrlSeed(): PlexUrlSeed | null {
     show: readPlexShow(),
     filters: readPlexFilters(),
   });
-  return {
-    state,
-    present: {
-      scope: params.has("pscope"),
-      sort: params.has("psort"),
-      show: params.has("pshow"),
-      filters: params.has("pf"),
-    },
+  const present = {
+    scope: params.has("pscope"),
+    sort: params.has("psort"),
+    show: params.has("pshow"),
+    filters: params.has("pf"),
   };
+  return { ...state, present };
 }
 
 export function PlexProvider({ children }: { children: ReactNode }) {
-  // Captured once: the shared-link content state (or null). Seeds the slices below and, on account pin,
-  // is persisted to the account instead of being clobbered by the stored view (see the rehydrate).
+  // Captured once: the shared-link content state (or null). Seeds the slices below and is persisted to
+  // the account (the effect further down), so the shared view also survives a later plain reload.
   const [urlSeed] = useState(readPlexUrlSeed);
   // The former per-library picker is now a cross-library SCOPE: movie | show | both (unified library).
   // (Reuses the old LS.plexLibrary key; an old stored library-id value falls back to "both".)
-  const [scope, setScopeState] = useState<string>(() => urlSeed?.state.scope ?? readPlexScope());
-  const [show, setShowState] = useState<string>(() => urlSeed?.state.show ?? readPlexShow());
-  const [sort, setSortState] = useState<SortState>(() => urlSeed?.state.sort ?? readPlexSort());
+  const [scope, setScopeState] = useState<string>(() => urlSeed?.scope ?? readPlexScope());
+  const [show, setShowState] = useState<string>(() => urlSeed?.show ?? readPlexShow());
+  const [sort, setSortState] = useState<SortState>(() => urlSeed?.sort ?? readPlexSort());
   // The expanded Plex filters live as one JSON blob (the string-only account store serializes it).
   const [filtersRaw, setFiltersRaw] = useState<string>(() =>
-    urlSeed ? JSON.stringify(urlSeed.state.filters) : readPlexFiltersRaw(),
+    urlSeed ? JSON.stringify(urlSeed.filters) : readPlexFiltersRaw(),
   );
   const filters = useMemo<PlexFilters>(() => {
     try {
@@ -203,87 +204,45 @@ export function PlexProvider({ children }: { children: ReactNode }) {
   // PlexBrowse consumes it into an info/show history subview then clears it.
   const [jumpTo, setJumpTo] = useState<PlexJumpTarget | null>(null);
 
-  // Re-read every per-account slice once the account is pinned after mount (first load on a fresh tab).
-  // A shared-link seed is the exception: instead of reloading the account's stored view, PERSIST the URL
-  // state to this account (so the shared view wins and survives a later plain reload), and adopt only the
-  // non-shared slices (q/field) from storage. Mirrors FeedFiltersProvider's initialHadUrlFilters branch.
-  const markDirty = useAccountRehydrate(() => {
-    if (urlSeed) {
-      // Per dimension: a dimension the URL carried (present) is the shared view — adopt it and persist
-      // it to this now-pinned account (so it wins and survives a later plain reload). A dimension the
-      // URL OMITTED was seeded from a mount-time default (no account yet), so do NOT persist that
-      // default over the account's real stored value — re-read the stored value instead, exactly like a
-      // normal load. This is the fix for a partial shared link silently resetting the omitted slices.
-      const { state, present } = urlSeed;
-      if (present.scope) setAccountRaw(LS.plexLibrary, state.scope);
-      else setScopeState(readPlexScope());
-      if (present.show) setAccountRaw(LS.plexShow, state.show);
-      else setShowState(readPlexShow());
-      if (present.sort) setAccountRaw(LS.plexSort, JSON.stringify(state.sort));
-      else setSortState(readPlexSort());
-      if (present.filters) setAccountRaw(LS.plexFilters, JSON.stringify(state.filters));
-      else setFiltersRaw(readPlexFiltersRaw());
-      setQState(readPlexQ());
-      setFieldState(readPlexField());
-      return;
-    }
-    setScopeState(readPlexScope());
-    setShowState(readPlexShow());
-    setSortState(readPlexSort());
-    setFiltersRaw(readPlexFiltersRaw());
-    setQState(readPlexQ());
-    setFieldState(readPlexField());
-  });
+  // Persist a shared link's view to the account once, so it wins over the stored view and survives a
+  // later plain reload. Mirrors FeedFiltersProvider's initialHadUrlFilters branch. Only the dimensions
+  // the link CARRIED are written: an omitted one already reads from storage, and writing its default
+  // would not be a no-op — a stored Plex filters value at all is what tells SavedViewsProvider the
+  // account has picked filters, so the account's default saved view would never be applied again.
+  useEffect(() => {
+    if (!urlSeed) return;
+    const { present } = urlSeed;
+    if (present.scope) setAccountRaw(LS.plexLibrary, urlSeed.scope);
+    if (present.show) setAccountRaw(LS.plexShow, urlSeed.show);
+    if (present.sort) setAccountRaw(LS.plexSort, JSON.stringify(urlSeed.sort));
+    if (present.filters) setAccountRaw(LS.plexFilters, JSON.stringify(urlSeed.filters));
+  }, [urlSeed]);
 
-  const setScope = useCallback(
-    (v: string) => {
-      markDirty();
-      setScopeState(v);
-      setAccountRaw(LS.plexLibrary, v);
-    },
-    [markDirty],
-  );
-  const setShow = useCallback(
-    (v: string) => {
-      markDirty();
-      setShowState(v);
-      setAccountRaw(LS.plexShow, v);
-    },
-    [markDirty],
-  );
-  const setSort = useCallback(
-    (v: SortState) => {
-      markDirty();
-      setSortState(v);
-      setAccountRaw(LS.plexSort, JSON.stringify(v));
-    },
-    [markDirty],
-  );
-  const setFilters = useCallback(
-    (f: PlexFilters) => {
-      markDirty();
-      const s = JSON.stringify(f);
-      setFiltersRaw(s);
-      setAccountRaw(LS.plexFilters, s);
-    },
-    [markDirty],
-  );
-  const setQ = useCallback(
-    (v: string) => {
-      markDirty();
-      setQState(v);
-      setAccountRaw(LS.plexQ, v);
-    },
-    [markDirty],
-  );
-  const setField = useCallback(
-    (v: PlexSearchField) => {
-      markDirty();
-      setFieldState(v);
-      setAccountRaw(LS.plexField, v);
-    },
-    [markDirty],
-  );
+  const setScope = useCallback((v: string) => {
+    setScopeState(v);
+    setAccountRaw(LS.plexLibrary, v);
+  }, []);
+  const setShow = useCallback((v: string) => {
+    setShowState(v);
+    setAccountRaw(LS.plexShow, v);
+  }, []);
+  const setSort = useCallback((v: SortState) => {
+    setSortState(v);
+    setAccountRaw(LS.plexSort, JSON.stringify(v));
+  }, []);
+  const setFilters = useCallback((f: PlexFilters) => {
+    const s = JSON.stringify(f);
+    setFiltersRaw(s);
+    setAccountRaw(LS.plexFilters, s);
+  }, []);
+  const setQ = useCallback((v: string) => {
+    setQState(v);
+    setAccountRaw(LS.plexQ, v);
+  }, []);
+  const setField = useCallback((v: PlexSearchField) => {
+    setFieldState(v);
+    setAccountRaw(LS.plexField, v);
+  }, []);
 
   const state = useMemo<PlexState>(
     () => ({ scope, show, sort, filters, q, field, playlistOpen, jumpTo }),

frontend/src/components/PlexSearchBox.dom.test.tsx

@@ -180,6 +180,25 @@ describe("PlexSearchBox — typeahead", () => {
     );
   });
 
+  // E11 S4: SearchBar's Escape hands the keyboard back to the page (blur). With the panel open, the
+  // first Escape belongs to the panel: it must close it and leave the caret in the field; only the
+  // next Escape leaves.
+  it("spends the first Escape on the panel and only the second on leaving the field", async () => {
+    plexState.q = "matrix";
+    plexLibrary.mockResolvedValue(result([card("m1", "The Matrix")]));
+    renderBox();
+    const input = screen.getByRole("combobox");
+    input.focus();
+    await screen.findByRole("listbox");
+
+    fireEvent.keyDown(input, { key: "Escape" });
+    await waitFor(() => expect(screen.queryByRole("listbox")).toBeNull());
+    expect(document.activeElement).toBe(input);
+
+    fireEvent.keyDown(input, { key: "Escape" });
+    expect(document.activeElement).not.toBe(input);
+  });
+
   it("marks the input as a combobox and toggles aria-expanded with the panel", async () => {
     plexState.q = "matrix";
     plexLibrary.mockResolvedValue(result([card("m1", "The Matrix")]));

frontend/src/components/PlexSearchBox.tsx

@@ -96,6 +96,7 @@ export default function PlexSearchBox() {
           e.preventDefault(); // suppress SearchBar's Go; open the highlighted title instead
           pick(hi);
         } else if (e.key === "Escape") {
+          e.preventDefault(); // close the panel only; SearchBar's Escape-to-blur waits for the next press
           setDismissed(true);
           setHi(-1); // don't leave a stale highlight to flash on the next reopen
         }