release: 0.87.1 (bug/youtube-cookie-host)

A review round read yt-dlp's source and found the comment behind the previous commit's safety-net
marker did not match it. Measured in the worker with a real account cookie and
`player_client=android_vr`: yt-dlp logs `Skipping client "android_vr" since it does not support
cookies`, drops it, and the request left with no client fails with "Requested format is not
available" — not "No player clients have been requested". That raise sits EARLIER in yt-dlp, before
the cookie-capability removal, so the cookie path can never reach it; and an unknown or renamed
client is skipped with a warning and replaced by yt-dlp's defaults, so the other scenario the
comment named cannot reach it either.

So the marker bought nothing: the symptom that does occur was already retriable here before this
branch. It is dropped, the comment now states what was measured, and the test asserts the real
symptom instead of a message the code cannot produce. The cookie-capability filter itself is
vindicated by the same measurement — without it every signed-in download would burn its first
attempt on a client yt-dlp discards.

Also from the round: an enqueue test for a `source_kind="youtube"` job, the one join nothing else
made (a YouTube job stores a bare 11-char ref and the URL the cookie gate keys on is rebuilt by the
adapter — both ends were pinned apart, the join was not, and a break there would stop every YouTube
cookie silently while signed-out downloads kept working). And copy corrections: the group's only
unhedged claim is hedged, "described the video" loses the pipeline vocabulary, and four Hungarian
phrasings that read as translated English are rewritten.

CHANGELOG.md

@@ -7,6 +7,71 @@ edit the release notes and re-run the generator.
 
 Upgrading, pinning a version and rolling back: [docs/self-hosting.md](docs/self-hosting.md#upgrading).
 
+## 0.87.1 — 2026-09-16
+
+A YouTube video that YouTube will only show to a signed-in viewer can now be downloaded: paste your YouTube cookies in Settings the way the failure message already told you to — until now that list had no YouTube in it.
+
+### Features
+
+- YouTube joins the sites you can store download cookies for (Settings → Account → Download authentication). A signed-in YouTube download automatically uses the players that accept your login.
+
+### Fixes
+
+- A YouTube download that stops at “Sign in to confirm you’re not a bot” says so in your language and points at a setting that now exists. If you had already added cookies, it tells you they were refused instead of asking for them again.
+- A video YouTube describes but then refuses to hand over is tried again with another player instead of failing at once, and it is no longer called a network error — nothing was wrong with the network.
+
+### Internal
+
+- The gated video was measured end to end on an isolated stack before and after the fix: every player client, two yt-dlp versions, and finally the real download (519 MB) with cookies attached. One deep-review round — 25 findings raised, none survived adversarial verification, and the one real defect came out of the verification itself: a comment of mine named an error yt-dlp does not raise there. Running it settled what reading it could not.
+
+## 0.87.0 — 2026-09-15
+
+A shared or library video keeps playing when you switch apps on an iPad, and a new tab opens as the account it belongs to without flashing another page first. Facebook reels keep their titles and an mp3 stays an mp3.
+
+### Features
+
+- Background play on iPad (Brave): the shared-video page, the library player and the Plex player keep playing in another app and on the locked screen.
+- The shared-video page has a Repeat toggle, on by default.
+- Switching modules no longer flashes a loading screen: the pages load quietly in the background, and a slow answer shows its spinner only after a moment.
+
+### Fixes
+
+- A new tab honours your Startup choice and opens as its own account — no Home page flash, no other account's language or settings on the first frame.
+- A signed-in Facebook reel keeps its real title instead of “Video” or “Facebook”, and an mp3 download stays an mp3 (it used to be wrapped into an mp4 an iPad would not play).
+- A tab whose account was signed out, suspended or signed out everywhere acts as nobody and comes back as the account still signed in, instead of writing into another account or sticking on the sign-in page.
+- Switching or adding an account no longer saves the video you were watching into the other account's resume position.
+- A new tab keeps the account's notification history instead of replacing it with its own first notice.
+- The shared-video page tells a failed load, a wrong password, too many attempts and an unreachable server apart, with Retry where it helps. Its password limit counts per viewer, so one person guessing cannot lock everyone else out.
+- Form errors on sign-in, the message passphrase, password change and setup are read out by screen readers — again on a second identical failure — and the setup wizard names what is wrong instead of a generic error.
+
+### Internal
+
+- WebKit and iPad projects in the Playwright suite; the Vite dev proxy forwards websockets.
+- Four deep-review rounds (12 → 8 → 8 → 8, the last one targeted), every regression test mutation-checked; half of the later rounds' findings were older defects, fixed here.
+
+## 0.86.0 — 2026-09-14
+
+A failed download now tells you why it failed and what you can do about it, instead of repeating yt-dlp's raw error. Facebook comes first: downloads that used to die on “Cannot parse data” go through, and a Facebook group post downloads its own video instead of a different one from the page.
+
+### Features
+
+- A failure says why, in your language: the row names the cause (“Facebook needs you to be signed in”, “Facebook did not accept your cookies”, “No video found in this post”) and its details window says what to do next. The raw error text is still there below it.
+- A Facebook download with your cookies that stops at “Cannot parse data” is tried again as Chrome, which gets past it.
+- A Facebook group post link downloads the post's own video. Before, yt-dlp either found nothing or quietly downloaded another video from the page; a post without a video now says so.
+- Retry and Re-download use a cookie you added after the failure, so the Retry the message asks for actually goes out signed in.
+
+### Fixes
+
+- A Re-download of a download that needed your cookies used to rebuild without them.
+- A job queued behind a download that already failed shows that failure's explanation instead of a bare “Download failed”.
+- A download yt-dlp reports no length for takes its length from the file, so its Edit / trim action appears.
+- Pressing Pause, Stop or Remove twice, or in two tabs, can no longer free a file another download still uses.
+- The confirm buttons in Downloads name the action (Stop download, Re-download, Remove) instead of repeating the question.
+
+### Internal
+
+- Four sprints, each Facebook behaviour measured on the development server with a real cookie before it was built. Two epic-end review rounds (20 → 17 fixed, then a targeted 4 → 4), every regression test mutation-checked.
+
 ## 0.85.0 — 2026-09-13
 
 Siftlode can now be driven from the keyboard, and Back, dialogs and menus stop losing your place. j/k and the arrow keys walk every list and grid, Enter opens what you are on, and Back puts you on the item you opened a view from instead of at the top of the page.

VERSION

@@ -1 +1 @@
-0.85.0
+0.87.1

backend/Dockerfile

@@ -1,19 +0,0 @@
-FROM python:3.12-slim
-
-ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1 \
-    PIP_NO_CACHE_DIR=1 \
-    PIP_DISABLE_PIP_VERSION_CHECK=1
-
-WORKDIR /app
-
-COPY requirements.txt .
-RUN pip install -r requirements.txt
-
-COPY . .
-
-RUN adduser --disabled-password --gecos "" appuser && chown -R appuser /app
-USER appuser
-
-EXPOSE 8000
-CMD ["sh", "entrypoint.sh"]

backend/alembic/versions/0084_dl_job_error_detail.py

@@ -0,0 +1,41 @@
+"""add download_jobs.error_detail — the domain-specific entry of the failure catalog (E11.5 S1)
+
+Revision ID: 0084_dl_job_error_detail
+Revises: 0083_comfort_pins
+Create Date: 2026-09-13
+
+`error_code` is the generic category (it decides whether a Retry is offered). `error_detail` names
+the host-specific catalog entry `downloads.errors.classify` matched on top of it — `facebook.login_wall`
+and its siblings — so the UI can say what went wrong ON THAT SITE and what to do about it, instead of
+the category's generic sentence. Nullable: most failures have no host-specific entry.
+
+Backfill: a job's code is written once, at failure time, so a new rule never reaches the rows that
+failed before it. The one shape measured on prod (2026-09-13, jobs 9/66/75/145/156/157/182/256/257) is
+yt-dlp's `[facebook] <id>: Cannot parse data`, stored as `unknown`. Without a cookie that is Facebook's
+login wall. Whether a cookie was attached at the time is not recorded anywhere, so every old row gets
+the no-cookie entry — on prod no account had a Facebook cookie, so that is what they all were.
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0084_dl_job_error_detail"
+down_revision: str | None = "0083_comfort_pins"
+branch_labels: str | None = None
+depends_on: str | None = None
+
+
+def upgrade() -> None:
+    op.add_column("download_jobs", sa.Column("error_detail", sa.String(length=48), nullable=True))
+    op.execute(
+        sa.text(
+            "UPDATE download_jobs SET error_code = 'login_required', "
+            "error_detail = 'facebook.login_wall' "
+            "WHERE (error_code IS NULL OR error_code = 'unknown') "
+            "AND error ILIKE '%[facebook]%cannot parse data%'"
+        )
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("download_jobs", "error_detail")

backend/app/auth.py

@@ -269,21 +269,29 @@ def purge_user(db: Session, user: User, background: BackgroundTasks) -> None:
 ACTIVE_ACCOUNT_HEADER = "x-siftlode-account"
 
 
-def resolved_user_id(conn: HTTPConnection) -> tuple[int | None, bool]:
+def resolved_user_id(conn: HTTPConnection, *, strict: bool = True) -> tuple[int | None, bool]:
     """Which account this connection acts as, and whether that's the session's default account.
     Takes any HTTPConnection — an HTTP Request OR a WebSocket — so the WS push channel shares this
     exact per-tab resolution instead of re-implementing it.
 
     The signed cookie holds the *wallet* (`account_ids`, every account signed into this browser)
-    plus a default `user_id`. A caller may override the default with the X-Siftlode-Account header,
-    but ONLY for an account already in the wallet — so a tab can't impersonate an account that never
-    authenticated here. Everything else (WebSocket, plain navigations) keeps using the cookie default.
+    plus a default `user_id`. A caller may name its account with the X-Siftlode-Account header (or
+    `?account=`), but ONLY an account in the wallet — so a tab can't impersonate an account that
+    never authenticated here. A connection that names no account acts as the cookie default.
+
+    A connection naming an account NOT in the wallet acts as nobody (`None`) — typically a tab still
+    pinned to an account that was signed out in another tab. It must not fall back to the default:
+    that tab would go on acting as an account it never showed, its player checkpoints and pref saves
+    landing there and its Sign out signing THAT account out. Only the bootstrap /api/me probe passes
+    `strict=False` and gets the default, which is how such a tab learns who it now is (the frontend
+    re-pins it and reloads). An account whose session ended while it stayed in the wallet (deleted,
+    suspended, revoked) leaves the wallet when it is refused (`_session_user`), so a tab pinned to it
+    takes the same way back.
     """
     default_id = conn.session.get("user_id")
     wallet = conn.session.get("account_ids") or []
     # Header for normal XHR; ?account= for contexts that can't set headers (WebSocket, and a
-    # plain <a> file download). Both are wallet-gated below, so neither can impersonate an
-    # account that never signed into this browser.
+    # plain <a> file download). Both are wallet-gated below.
     hdr = conn.headers.get(ACTIVE_ACCOUNT_HEADER) or conn.query_params.get("account")
     if hdr:
         try:
@@ -292,28 +300,46 @@ def resolved_user_id(conn: HTTPConnection) -> tuple[int | None, bool]:
             hid = None
         if hid is not None and hid in wallet:
             return hid, hid == default_id
+        if strict:
+            return None, False
     return default_id, True
 
 
+def drop_from_wallet(session: dict, user_id: int) -> None:
+    """Take one account out of this browser's wallet (`account_ids`); the session default is untouched."""
+    session["account_ids"] = [a for a in (session.get("account_ids") or []) if a != user_id]
+
+
+def _end_account_session(request: Request, user_id: int, is_default: bool) -> None:
+    """An account whose session here is no longer valid. Only nuke the whole session when it is the
+    SESSION DEFAULT; a per-tab account just leaves the wallet (other tabs' default may still be valid).
+    Leaving is what lets a tab pinned to it recover: its next /api/me names an account no longer signed
+    in here and gets the default. Left in, it answered "signed out" — the landing page, with the default
+    still signed in, and no way off it but closing the tab."""
+    if is_default:
+        request.session.clear()
+    else:
+        drop_from_wallet(request.session, user_id)
+
+
 def current_user(request: Request, db: Session = Depends(get_db)) -> User:
-    user_id, is_default = resolved_user_id(request)
+    return _session_user(request, db, *resolved_user_id(request))
+
+
+def _session_user(request: Request, db: Session, user_id: int | None, is_default: bool) -> User:
     if not user_id:
         raise HTTPException(status_code=401, detail="Not authenticated")
     user = db.get(User, user_id)
     if user is None or not user.is_active or user.is_suspended:
-        # Suspended/deactivated mid-session → drop the session so the block takes effect at once.
-        # But only nuke the whole session when the SESSION DEFAULT identity is gone; a stale
-        # per-tab header account just 401s that one tab (other tabs' default may still be valid).
-        if is_default:
-            request.session.clear()
+        # Suspended/deactivated mid-session → end it so the block takes effect at once.
+        _end_account_session(request, user_id, is_default)
         raise HTTPException(status_code=401, detail="Not authenticated")
     # SA4: reject a cookie whose recorded epoch is behind the account's current one (revoked by a
     # password reset/change or "log out everywhere"). A cookie with no recorded epoch (pre-SA4, or an
     # account signed in before this shipped) is treated as epoch 0 — so the FIRST bump revokes it too.
     epochs = request.session.get("epochs") or {}
     if int(epochs.get(str(user_id), 0)) != (user.session_epoch or 0):
-        if is_default:
-            request.session.clear()
+        _end_account_session(request, user_id, is_default)
         raise HTTPException(status_code=401, detail="Not authenticated")
     # Always keep the session default in the switchable list — covers sessions created before
     # multi-session existed (their account_ids was never seeded), so the switcher isn't empty.
@@ -328,9 +354,18 @@ def current_user(request: Request, db: Session = Depends(get_db)) -> User:
 def optional_current_user(request: Request, db: Session = Depends(get_db)) -> User | None:
     """Like `current_user` but returns None instead of raising 401 when there's no valid session.
     Used by the bootstrap /api/me probe so the logged-out landing doesn't log a failed request to
-    the browser console (a non-2xx fetch is a console error no matter how the app handles it)."""
+    the browser console (a non-2xx fetch is a console error no matter how the app handles it).
+    The one lenient resolution (`strict=False`): a tab naming an account no longer signed in here gets
+    the default account, which is how it learns who it now is — see `resolved_user_id`. That includes an
+    account refused right here, which `_session_user` has just taken out of the wallet."""
+    user_id, is_default = resolved_user_id(request, strict=False)
     try:
-        return current_user(request, db)
+        return _session_user(request, db, user_id, is_default)
+    except HTTPException:
+        if is_default:
+            return None
+    try:
+        return _session_user(request, db, *resolved_user_id(request, strict=False))
     except HTTPException:
         return None
 

backend/app/config.py

@@ -57,7 +57,7 @@ class Settings(BaseSettings):
     # VPS Caddy front door. A request from any other peer (someone hitting the app port directly)
     # is NOT trusted and its raw socket IP is used, so it can't spoof its rate-limit identity via
     # XFF. Empty = trust no proxy (use the direct peer) — correct for a directly-exposed / local-dev
-    # deploy. Comma-separated. See routes.auth._client_ip + the deploy docs.
+    # deploy. Comma-separated. See ratelimit.client_key + the deploy docs.
     trusted_proxy_ips: str = ""
 
     # --- Outbound email (onboarding: access-request + approval notices) ---
@@ -155,6 +155,9 @@ class Settings(BaseSettings):
     # per-client responses are flaky, and android_vr can get bot-flagged under heavy load) the
     # worker retries with the FALLBACK set — the POT-capable web clients (web needs the token +
     # Deno) plus android for audio. Both admin-tunable when YouTube shifts what works.
+    # A SIGNED-IN download (the user added YouTube cookies) keeps only the cookie-capable clients
+    # of these two sets — yt-dlp drops the rest, so android_vr / android / ios never run there.
+    # See adapters.YouTubeAdapter._COOKIE_CAPABLE.
     download_player_clients: str = "android_vr"
     download_player_clients_fallback: str = "web_safari,web,android"
 

backend/app/downloads/adapters.py

@@ -11,10 +11,22 @@ Resolution works both before extraction (from source_kind / URL host) and after
 `extractor_key` in the info dict), so a non-YouTube "url" job still lands on the right adapter.
 """
 
+import re
 from urllib.parse import urlparse
 
+import yt_dlp
+from yt_dlp.networking.impersonate import ImpersonateTarget
+
 from app.config import settings
 
+# Facebook's "Cannot parse data": the page yt-dlp got was a wall, not the content. Both the Chrome retry
+# below and the failure catalog (errors.py) decide on it, so the wording exists once.
+FACEBOOK_PARSE_WALL = "cannot parse data"
+# A source's own verdicts on a link, raised from `resolve_url`. errors.py classifies them; it imports
+# them from here because this module must not import errors (errors → credentials → adapters).
+POST_WITHOUT_VIDEO_MESSAGE = "No single video was found in this post."
+POST_NOT_SHOWN_MESSAGE = "Facebook did not show this post to the signed-in session."
+
 
 class SourceAdapter:
     """Generic source: yt-dlp handles everything and the ref is already a fetchable URL."""
@@ -22,9 +34,21 @@ class SourceAdapter:
     key = "generic"
 
     # --- extraction (worker._extract_with_fallback / backfill) ---------------------------------
-    def client_sets(self) -> list:
-        """Player-client sets to attempt, in order. A generic source needs no client override, so a
-        single default attempt (`[None]`) — the per-client fallback is a YouTube-only concept."""
+    def resolve_url(self, url: str, ydl_opts: dict) -> str:
+        """The link to hand yt-dlp for `url`, resolved BEFORE the first attempt. `ydl_opts` are the
+        download's own options (cookie, timeouts, address family) for any page this needs to read.
+
+        Raises a RuntimeError carrying one of this module's verdicts when the page read shows the
+        download cannot go ahead: the content is there but holds no single video
+        (`POST_WITHOUT_VIDEO_MESSAGE`), or the page is not the content at all — the login page a
+        refused cookie gets (`POST_NOT_SHOWN_MESSAGE`), never the no-video verdict. A failed page read
+        is raised as itself, so it is classified like any other download error. Generic: `url`."""
+        return url
+
+    def client_sets(self, authed: bool = False) -> list:
+        """Attempts to make, in order — each entry is handed back to `ydl_opts_extra`, and the next one
+        is tried when `retriable` says so. A generic source makes a single default attempt (`[None]`).
+        `authed` is whether the acting user's cookie file goes with the download."""
         return [None]
 
     def ydl_opts_extra(self, clients) -> dict:
@@ -37,6 +61,10 @@ class SourceAdapter:
         return False
 
     # --- metadata -----------------------------------------------------------------------------
+    def title(self, info: dict) -> str | None:
+        """The download's raw title, before `titles.normalize_title` cleans it. Generic: yt-dlp's."""
+        return info.get("title")
+
     def uploader_url(self, info: dict) -> str | None:
         """The channel/uploader page URL. Generic: whatever yt-dlp exposes directly (YouTube gives
         `channel_url`), else None (reddit / a raw media URL have no derivable channel page)."""
@@ -65,12 +93,46 @@ class YouTubeAdapter(SourceAdapter):
         "Requested format is not available",
         "Only images are available",
         "Sign in to confirm",
+        # Measured 2026-09-16: a gated video whose EXTRACTION succeeds and whose media fetch is then
+        # refused by the CDN ("unable to download video data: HTTP Error 403"). The wall moves
+        # between the player response and the stream, so this is the same per-client flakiness one
+        # step later — and it used to end the job on attempt 1, because the text classifies as
+        # `network` and nothing here matched it. The format URLs belong to the client that minted
+        # them, so the next client set is a real second chance.
+        "unable to download video data",
     )
+    # Measured in the worker against a REAL account cookie (2026-09-16, yt-dlp 2026.07.04): with
+    # `player_client=android_vr` yt-dlp logs `Skipping client "android_vr" since it does not support
+    # cookies`, drops it, and the request that is left with no client fails with "Requested format is
+    # not available" — which is already a retriable marker above, so the cost is a wasted attempt
+    # rather than a hard failure. Our primary set is android_vr ALONE, so without this filter every
+    # signed-in download would burn its first attempt that way before reaching the POT-backed web
+    # fallback the cookie exists for. The list is yt-dlp's own INNERTUBE_CLIENTS[...]
+    # ["SUPPORTS_COOKIES"], pinned by test_adapters against the installed yt-dlp, so a version bump
+    # that moves the table turns the gate red instead of silently un-authing every YouTube download.
+    _COOKIE_CAPABLE = frozenset(
+        {
+            "mweb",
+            "tv",
+            "tv_downgraded",
+            "web",
+            "web_creator",
+            "web_embedded",
+            "web_music",
+            "web_safari",
+        }
+    )
+    # Where a signed-in download lands when the admin's knobs hold no cookie-capable client at all.
+    # Both clients in ONE set: yt-dlp queries each and merges their formats, which is the cover for
+    # the per-client flakiness that the two-tier ladder gives a signed-out download.
+    _AUTHED_DEFAULT = ("web_safari", "web")
 
-    def client_sets(self) -> list:
-        return [
-            c for c in (settings.player_client_list, settings.player_client_fallback_list) if c
-        ] or [None]
+    def client_sets(self, authed: bool = False) -> list:
+        sets = [c for c in (settings.player_client_list, settings.player_client_fallback_list) if c]
+        if authed:
+            kept = [[c for c in s if c in self._COOKIE_CAPABLE] for s in sets]
+            return [s for s in kept if s] or [list(self._AUTHED_DEFAULT)]
+        return sets or [None]
 
     def ydl_opts_extra(self, clients) -> dict:
         # == --extractor-args "youtube:player_client=…;youtubepot-bgutilhttp:base_url=…" (list values).
@@ -93,6 +155,63 @@ class YouTubeAdapter(SourceAdapter):
 
 class FacebookAdapter(SourceAdapter):
     key = "facebook"
+    # Measured (E11.5, yt-dlp 2026.07.04): with the user's cookie, some reels answer a plain request
+    # with "Cannot parse data" and parse only when the request looks like Chrome. Impersonation is a
+    # SECOND attempt behind that one error, not the default: the links that already download with the
+    # cookie keep their proven path, and only the ones stuck at the wall go through curl_cffi. Without
+    # a cookie the same error is the login wall, which no disguise gets past.
+    _IMPERSONATE = "impersonate"
+    # A post page is ~4–5 MB of inline JSON; anything far past that is not a post page.
+    _POST_PAGE_MAX_BYTES = 16 * 1024 * 1024
+
+    def resolve_url(self, url: str, ydl_opts: dict) -> str:
+        # Measured (E11.5 S4): given a group post's link, yt-dlp either finds no formats or — worse —
+        # downloads ANOTHER video from the page's feed data. The post's own video is the one Video node
+        # in the page scripts that carry the post id; its watch link downloads (plain first, then the
+        # Chrome retry above). Needs the cookie: signed out, the page is the login wall.
+        post_id = facebook_group_post_id(url)
+        if post_id is None or not ydl_opts.get("cookiefile"):
+            return url
+        with yt_dlp.YoutubeDL(ydl_opts) as ydl:
+            raw = ydl.urlopen(url).read(self._POST_PAGE_MAX_BYTES)
+        page = raw.decode("utf-8", "replace")
+        # Measured (E11.5 review): a refused or expired cookie gets the login page (~450 KB, a login
+        # form, no post id at all), which is not a post without a video — the user's cookie is the cause.
+        if _quoted(post_id) not in page:
+            raise RuntimeError(POST_NOT_SHOWN_MESSAGE)
+        video_id = facebook_post_video_id(page, post_id)
+        if video_id is None:
+            # Never fall back to the post link: that is exactly where the wrong video comes from.
+            raise RuntimeError(POST_WITHOUT_VIDEO_MESSAGE)
+        return f"https://www.facebook.com/watch/?v={video_id}"
+
+    def client_sets(self, authed: bool = False) -> list:
+        return [None, self._IMPERSONATE] if authed else [None]
+
+    def ydl_opts_extra(self, clients) -> dict:
+        if clients == self._IMPERSONATE:
+            return {"impersonate": ImpersonateTarget.from_str("chrome")}
+        return {}
+
+    def retriable(self, error_text: str) -> bool:
+        return FACEBOOK_PARSE_WALL in error_text.lower()
+
+    # Measured (2026-09-14): a SIGNED-IN read gives the placeholder "Video" (plain and as Chrome), and an
+    # 18+ reel only readable as Chrome gives "Facebook"; the post's text is still in `description`. A
+    # signed-out read titles the page with that same text behind the engagement counts, cut short.
+    _PLACEHOLDER_TITLES = frozenset({"video", "facebook"})
+
+    def title(self, info: dict) -> str | None:
+        raw = info.get("title")
+        if (raw or "").strip().lower() not in self._PLACEHOLDER_TITLES:
+            return raw
+        line = next(
+            (ln.strip() for ln in (info.get("description") or "").splitlines() if ln.strip()), ""
+        )
+        # The whole first line, never cut here with an ellipsis: normalize_title's NFKC turns "…" into
+        # "..." and then collapses it to ".", which read as a finished sentence ("… live at."). The
+        # stored title is unbounded; display_name and the file name clip it themselves.
+        return line or raw  # no description either (the 18+ reel): nothing better on the page
 
     def uploader_url(self, info: dict) -> str | None:
         # Facebook gives neither channel_url nor uploader_url, but exposes a numeric `uploader_id`
@@ -107,6 +226,39 @@ class FacebookAdapter(SourceAdapter):
         return True
 
 
+_FB_GROUP_POST_PATH = re.compile(r"^/groups/[^/]+/(?:permalink|posts)/(\d+)/?$")
+_SCRIPT_BLOCK = re.compile(r"<script[^>]*>(.*?)</script>", re.S)
+_VIDEO_NODE = re.compile(r'"__typename":"Video","id":"(\d+)"')
+
+
+def _quoted(post_id: str) -> str:
+    # How the page JSON carries the id: quoted, so a longer id that merely starts with it never counts.
+    return f'"{post_id}"'
+
+
+def facebook_group_post_id(url: str) -> str | None:
+    """The post id of a Facebook group post link (`/groups/<group>/permalink|posts/<id>/`), else None."""
+    parsed = urlparse(url)
+    if not _host_is(parsed.netloc.lower(), "facebook.com"):
+        return None
+    match = _FB_GROUP_POST_PATH.match(parsed.path)
+    return match.group(1) if match else None
+
+
+def facebook_post_video_id(page: str, post_id: str) -> str | None:
+    """The id of the one video attached to `post_id`, read from its page: the Video nodes of the script
+    blocks that carry the post id (the page's other ~10 videos — feed, reels — sit in other blocks).
+    None for no video AND for more than one: guessing between two would be the wrong-video bug again."""
+    quoted = _quoted(post_id)
+    ids = {
+        vid
+        for block in _SCRIPT_BLOCK.findall(page)
+        if quoted in block
+        for vid in _VIDEO_NODE.findall(block)
+    }
+    return ids.pop() if len(ids) == 1 else None
+
+
 class RedditAdapter(SourceAdapter):
     key = "reddit"
 

backend/app/downloads/credentials.py

@@ -1,15 +1,17 @@
 """Per-user, per-host download cookies — the single source of truth for "does the acting user's
 cookie apply to this download, and how does that keep the result private".
 
-Two call sites depend on ONE consistent answer (house rule: an invariant lives in shared code, not
+Two sides depend on ONE consistent answer (house rule: an invariant lives in shared code, not
 in prose):
   * `enqueue` salts the MediaAsset cache signature with the user id WHEN a cookie applies, so the
-    authed download becomes a PRIVATE asset that is never cache-served to another user.
+    authed download becomes a PRIVATE asset that is never cache-served to another user. Retry
+    (`service.resume`) and Re-download (`service.redownload`) ask the same question again, so a
+    cookie the user added after a failure goes with the next attempt.
   * the worker attaches the cookie file to yt-dlp ONLY when a cookie still applies AND the asset it
     is downloading into is that private, salted identity — so a cookie can never poison a shared
     asset (the load-bearing cross-user privacy fix).
 
-Both go through `cookie_salt` / `authed_format_sig` / `host_key_for_url` here, so they can't drift.
+Both key the private identity on `cookie_salt` / `host_key_for_url` here, so they can't drift.
 
 Security controls enforced here:
   * **host scope (SEC-12)** — `host_key_for_url` matches the download URL's netloc against a curated
@@ -30,7 +32,7 @@ from sqlalchemy.orm import Session
 
 from app.downloads import formats
 from app.downloads.adapters import _host_is
-from app.models import DownloadCredential
+from app.models import DownloadCredential, MediaAsset
 from app.security import decrypt_optional, encrypt
 
 log = logging.getLogger("siftlode.downloads.credentials")
@@ -53,6 +55,11 @@ class HostSpec:
 # all derive from this, so there is nothing else to wire up.
 SUPPORTED_HOSTS: tuple[HostSpec, ...] = (
     HostSpec("facebook", "Facebook", ("facebook.com", "fb.watch")),
+    # YouTube gates INDIVIDUAL videos behind "Sign in to confirm you're not a bot" (measured on prod
+    # job 273: every player client fails on that one video while its neighbours download fine, and
+    # the newest yt-dlp fails the same way — a signed-in session is the only way through). Without a
+    # row here the `login_required` copy sent the user to a dropdown that could not help them.
+    HostSpec("youtube", "YouTube", ("youtube.com", "youtu.be", "youtube-nocookie.com")),
     HostSpec("instagram", "Instagram", ("instagram.com",)),
     HostSpec("twitter", "X (Twitter)", ("twitter.com", "x.com")),
     HostSpec("tiktok", "TikTok", ("tiktok.com",)),
@@ -99,11 +106,38 @@ def cookie_salt(user_id: int, host_key: str) -> str:
 
 
 def authed_format_sig(spec: dict, user_id: int, host_key: str) -> str:
-    """The salted `format_sig` an authed download for (user, host) resolves to — the private asset
-    identity. Both enqueue (to create it) and the worker (to recognise it) compute it HERE."""
+    """The salted `format_sig` an authed download for (user, host) resolves to under the current
+    signature version — the private asset enqueue creates, and one of the identities `is_authed_asset`
+    recognises. Neither calls it; the tests use it to hold the two to each other."""
     return formats.format_sig(spec, salt=cookie_salt(user_id, host_key))
 
 
+def rebuild_salt(asset_id: int, cookie: str | None) -> str:
+    """The salt of a Re-download's fresh asset: its OWN row id (so every rebuild is a new identity no
+    enqueue can ever compute), prefixed with the user's `cookie_salt` when a cookie applies. The id is
+    what makes it recognisable — the worker has the asset row, so `is_authed_asset` can recompute this
+    one, where a salt built from the job's previous asset id could not be."""
+    return f"{cookie}:rebuild:{asset_id}" if cookie else f"rebuild:{asset_id}"
+
+
+def is_authed_asset(asset: MediaAsset, spec: dict, user_id: int, url: str | None) -> bool:
+    """Whether an asset is `user_id`'s private, cookie-salted identity for `url`'s host — the one
+    kind of asset a cookie is ever attached to: the one enqueue creates (`authed_format_sig`), or a
+    Re-download's rebuild of it (`rebuild_salt`). The worker's cookie gate asks it before a download,
+    and the failure diagnosis asks it after one (a failure on this asset happened WITH the cookie).
+    Either signature version counts (`formats.format_sigs`): a job queued before a deploy that bumped
+    the version still downloads into the asset it was given."""
+    host_key = host_key_for_url(url)
+    if host_key is None:
+        return False
+    salt = cookie_salt(user_id, host_key)
+    if asset.format_sig in formats.format_sigs(spec, salt=salt):
+        return True
+    return asset.id is not None and asset.format_sig in formats.format_sigs(
+        spec, salt=rebuild_salt(asset.id, salt)
+    )
+
+
 def salt_for_enqueue(db: Session, user_id: int, url: str | None) -> str | None:
     """At enqueue: the cache salt to apply if this user has a cookie for `url`'s host, else None (a
     normal shared download). Returns the salt string so the caller passes it straight to
@@ -199,20 +233,19 @@ def status_list(db: Session, user_id: int) -> list[dict]:
 # --- worker: resolve + write the cookie file --------------------------------------------------
 
 
-def resolve_cookiefile(
-    db: Session,
-    user_id: int,
-    url: str | None,
-    asset_format_sig: str,
-    spec: dict,
-    staging: Path,
-) -> Path | None:
-    """In the worker child: the cookies.txt to hand yt-dlp for this download, or None.
+def usable_cookie(
+    db: Session, user_id: int, url: str | None, asset: MediaAsset, spec: dict
+) -> str | None:
+    """The user's cookie text a download of `url` into `asset` goes with, or None — the ONE decision
+    whether a download is signed in. The worker child writes it out for yt-dlp (`resolve_cookiefile`);
+    the worker asks it again for a job that inherits a failed asset. That second ask sees the
+    credential as it is when the job is claimed: a cookie the user removed or added since the failed
+    download changes this job's explanation to fit the cookie its Retry would go with.
 
     The double gate that prevents cross-user leakage:
       1. a credential must still exist for `url`'s host (host-scoped via `host_key_for_url`), AND
       2. the asset being downloaded into must BE this user's private, salted identity
-         (`asset_format_sig == authed_format_sig(...)`).
+         (`is_authed_asset`).
 
     If (2) fails the asset is the SHARED (unsalted) one — attaching the cookie would poison the
     global cache with a private-group video, so we attach nothing. An unreadable blob (rotated key →
@@ -224,18 +257,31 @@ def resolve_cookiefile(
     cred = get_credential(db, user_id, host_key)
     if cred is None:
         return None
-    if asset_format_sig != authed_format_sig(spec, user_id, host_key):
+    if not is_authed_asset(asset, spec, user_id, url):
         return None  # shared asset — never attach a cookie to a non-private identity
     raw = decrypt_optional(cred.cookies_enc)
     if not raw:
         log.warning(
             "download cookie for user %s host %s could not be decrypted (rotated key?) — "
-            "proceeding without it",
+            "treated as no cookie",
             user_id,
             host_key,
         )
         return None
-    return _write_cookiefile(raw, staging)
+    return raw
+
+
+def resolve_cookiefile(
+    db: Session,
+    user_id: int,
+    url: str | None,
+    asset: MediaAsset,
+    spec: dict,
+    staging: Path,
+) -> Path | None:
+    """In the worker child: the cookies.txt to hand yt-dlp for this download (`usable_cookie`), or None."""
+    raw = usable_cookie(db, user_id, url, asset, spec)
+    return _write_cookiefile(raw, staging) if raw else None
 
 
 def _write_cookiefile(raw: str, staging: Path) -> Path:

backend/app/downloads/errors.py

@@ -1,4 +1,5 @@
-"""Classify a raw yt-dlp / ffmpeg failure string into a stable category code.
+"""Classify a raw yt-dlp / ffmpeg failure string into a stable category code — and, where a site's
+failure has been measured, into that site's entry of the failure catalog.
 
 The worker stores the raw exception text (truncated) for technical detail, but a raw
 `ERROR: [youtube] <id>: Private video. Sign in…` is noise to a user. `classify()` maps that text
@@ -6,21 +7,51 @@ to one of a small set of category codes; the frontend turns the code into a loca
 explanation (and decides whether a retry makes sense). The raw text stays available behind a
 "details" disclosure. This is the same string-matching approach the worker already trusts for
 `_RETRIABLE_MARKERS` — kept here as the single source of truth for "what kind of failure is this".
+
+**The failure catalog** (`_CATALOG`, E11.5). A category is generic: "Sign-in required" cannot tell a
+Facebook user that the cookie they already gave was refused, and yt-dlp words several different
+Facebook walls identically (`Cannot parse data`). A catalog entry is scoped to ONE host and may also
+depend on whether a cookie was attached and on the kind of link, and names a `detail` code the UI has
+its own sentence for — why it failed on that site, and what the user can do. `diagnose()` tries the
+catalog first and falls back to the category. How an entry is added, every time a failure is reported:
+  1. reproduce it on dev (with and without the user's cookie) and keep the verbatim yt-dlp text;
+  2. add the entry below, scoped as narrowly as the measurement allows (a marker that is yt-dlp's
+     generic wording for every site must never match without its host; a marker another module also
+     decides on — the Facebook Chrome retry's FACEBOOK_PARSE_WALL — is imported, never retyped);
+  3. pin the real text in `tests/test_download_errors.py`;
+  4. add `downloads.errors.fail.catalog.<detail>.{short,body}` in EN and HU (a contract test checks it;
+     the group is not called `detail`, which `actionErrors.contract` reads as a raw `HttpError.detail`).
 """
 
-# Two worker-authored strings that this module owns because both are coupled to `_RULES`.
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import NamedTuple
+
+from app.downloads.adapters import (
+    FACEBOOK_PARSE_WALL,
+    POST_NOT_SHOWN_MESSAGE,
+    POST_WITHOUT_VIDEO_MESSAGE,
+    facebook_group_post_id,
+)
+from app.downloads.credentials import host_key_for_url
+
+# Worker-authored strings that this module owns because each is coupled to `_RULES`.
 #
 # QUOTA_FULL_MESSAGE is raised by the worker and must classify back to `quota_exceeded`; its rule
 # below matches a fragment of it, and test_download_errors pins the pair, because a message and its
 # rule drifting apart is exactly how a category silently becomes unreachable.
 #
-# NETWORK_REDACTED_MESSAGE is the opposite direction: it REPLACES a message after classification, so
-# it deliberately has no rule. Nothing re-classifies a stored `job.error` today; if anything ever
-# does, it must carry the original code rather than re-deriving one from this text.
+# NETWORK_REDACTED_MESSAGE REPLACES a message after classification (`user_error_text`). It is written
+# to the shared asset too, and a second job that inherits that failed asset re-diagnoses the stored
+# text (`worker._process_job`), so it has a rule of its own that gives the category back.
 #
 # Other worker-raised texts are still inline literals at their raise sites. The ffmpeg ones and
 # "produced no output file" have markers here; the urlguard refusal deliberately has none and
 # classifies as `unknown` — it is a refusal, not a diagnosis, and no category would say more.
+#
+# A source adapter's verdicts on a link (`SourceAdapter.resolve_url`, E11.5 S4) are adapters.py's
+# constants, imported above; each has a rule below that gives its category back, and a catalog entry
+# that gives the site's sentence.
 QUOTA_FULL_MESSAGE = "Your download storage is full — free up space, then try again."
 NETWORK_REDACTED_MESSAGE = "The server could not reach that address."
 
@@ -30,6 +61,12 @@ _RULES: tuple[tuple[str, str], ...] = (
     # Our own refusal: the worker found the user already at their storage cap (SEC-13). Placed
     # first — it is our wording, so it can never be a false match on an upstream message.
     ("download storage is full", "quota_exceeded"),
+    # Our own redaction of a transport failure (see NETWORK_REDACTED_MESSAGE) — our wording too.
+    (NETWORK_REDACTED_MESSAGE.lower(), "network"),
+    # Our own verdicts on a post link (adapters.py) — our wording too: its page holds no single video,
+    # or the site answered the signed-in read with something that is not the post at all.
+    (POST_WITHOUT_VIDEO_MESSAGE.lower(), "format_unavailable"),
+    (POST_NOT_SHOWN_MESSAGE.lower(), "login_required"),
     # Login / age / members / bot-check — the user must be signed in (we deliberately are not).
     ("sign in to confirm your age", "login_required"),
     ("confirm your age", "login_required"),
@@ -101,6 +138,120 @@ _RULES: tuple[tuple[str, str], ...] = (
 )
 
 
+class Diagnosis(NamedTuple):
+    """What a failure was: the generic `code` (category) and, when a catalog entry matched, its
+    host-specific `detail`."""
+
+    code: str
+    detail: str | None = None
+
+
+@dataclass(frozen=True)
+class _Entry:
+    """One measured failure of one site. It matches when the download URL belongs to `host`
+    (`credentials.SUPPORTED_HOSTS`), every one of `markers` is in the message, the cookie state is
+    `cookie` (None: either), and — when `link` is given — it recognises the URL (a truthy result). A
+    link predicate is the adapter's own, so the catalog and the download agree on what a link is."""
+
+    host: str
+    markers: tuple[str, ...]
+    code: str
+    detail: str
+    cookie: bool | None = None
+    link: Callable[[str], object] | None = None
+
+
+_CATALOG: tuple[_Entry, ...] = (
+    # Facebook answers a signed-out client with a page yt-dlp cannot parse — an 18+ reel, a closed
+    # group's post (measured 2026-09-13: prod jobs 145, 156, 256 download once the owner's cookie is
+    # attached). "Cannot parse data" is yt-dlp's generic wording for a broken extractor on EVERY site,
+    # which is why the entry is scoped to Facebook and never becomes a general rule.
+    _Entry(
+        host="facebook",
+        markers=("[facebook]", FACEBOOK_PARSE_WALL),
+        code="login_required",
+        detail="facebook.login_wall",
+        cookie=False,
+    ),
+    # The same text WITH a cookie: an expired / signed-out cookie, or a page that also needs
+    # impersonation (prod job 257). Telling this user to add cookies would be wrong — they have.
+    _Entry(
+        host="facebook",
+        markers=("[facebook]", FACEBOOK_PARSE_WALL),
+        code="login_required",
+        detail="facebook.cookie_rejected",
+        cookie=True,
+    ),
+    # A group post read with a cookie that Facebook answered with its login page (measured with a
+    # refused cookie: no post id anywhere on the page) — the same refused cookie, found by the adapter.
+    _Entry(
+        host="facebook",
+        markers=(POST_NOT_SHOWN_MESSAGE.lower(),),
+        code="login_required",
+        detail="facebook.cookie_rejected",
+        cookie=True,
+    ),
+    # A group post with no single video of its own. With a cookie the adapter reads the post's page
+    # and says so itself (POST_WITHOUT_VIDEO_MESSAGE); without one yt-dlp is given the post link and
+    # answers "No video formats found" (measured on prod jobs 66 and 145, whose videos are reshared
+    # clips). With a cookie yt-dlp only ever gets the post's VIDEO link, so the same text there is about
+    # that video, not the post — the category says it. Only for group post links (the adapter's own
+    # test of one): a reel with no formats is a different failure.
+    _Entry(
+        host="facebook",
+        markers=(POST_WITHOUT_VIDEO_MESSAGE.lower(),),
+        code="format_unavailable",
+        detail="facebook.group_post_video",
+        link=facebook_group_post_id,
+    ),
+    _Entry(
+        host="facebook",
+        markers=("[facebook]", "no video formats found"),
+        code="format_unavailable",
+        detail="facebook.group_post_video",
+        cookie=False,
+        link=facebook_group_post_id,
+    ),
+    # YouTube gates INDIVIDUAL videos behind "Sign in to confirm you're not a bot" (measured on prod
+    # job 273, a festival set: all 12 of yt-dlp's player clients fail on that one video while its
+    # neighbours download fine, the POT sidecar is live and answering, and the newest yt-dlp fails
+    # identically — so this is the video's own signed-out gate, not a broken stack or a stale yt-dlp).
+    # The marker is quote-agnostic on purpose: YouTube writes the apostrophe as U+2019, so
+    # "you're not a bot" with a straight quote never matches the real text.
+    _Entry(
+        host="youtube",
+        markers=("[youtube]", "not a bot"),
+        code="login_required",
+        detail="youtube.bot_wall",
+        cookie=False,
+    ),
+    # The same wall WITH a cookie. Not yet reproduced with a real YouTube cookie (this user's first
+    # one is being added now) — but "add cookies" is provably the wrong advice for someone who has,
+    # and yt-dlp names the likeliest cause itself: "The provided YouTube account cookies are no
+    # longer valid. They have likely been rotated in the browser as a security measure."
+    _Entry(
+        host="youtube",
+        markers=("[youtube]", "not a bot"),
+        code="login_required",
+        detail="youtube.cookie_rejected",
+        cookie=True,
+    ),
+    # The same gate one step later: the player response comes back, and then the CDN refuses the
+    # stream itself ("unable to download video data: HTTP Error 403"). Measured 2026-09-16 on the
+    # very same video, ~90 minutes after it was answering with the bot message — signed out it
+    # 403'd on every attempt; with the owner's cookie attached it downloaded in full (519 MB). So
+    # the category this text carries generically, `network`, is a lie here: nothing was wrong with
+    # the network. Scoped to a cookie-less YouTube download, where that is what we measured.
+    _Entry(
+        host="youtube",
+        markers=("unable to download video data", "403"),
+        code="login_required",
+        detail="youtube.media_forbidden",
+        cookie=False,
+    ),
+)
+
+
 def classify(msg: str | None) -> str:
     """Return a category code for a raw failure message (``"unknown"`` if nothing matches)."""
     if not msg:
@@ -112,6 +263,27 @@ def classify(msg: str | None) -> str:
     return "unknown"
 
 
+def diagnose(
+    msg: str | None, *, url: str | None = None, cookie_attached: bool = False
+) -> Diagnosis:
+    """The catalog entry for this failure of this link, else just its category (see the module doc).
+
+    `url` is the address yt-dlp was given; `cookie_attached` whether the acting user's cookie went
+    with it. Without a URL only the category can be known."""
+    host = host_key_for_url(url) if msg and url else None
+    if host is not None:
+        low = msg.lower()  # type: ignore[union-attr] — `host` is only set when `msg` is truthy
+        for e in _CATALOG:
+            if (
+                e.host == host
+                and all(m in low for m in e.markers)
+                and (e.cookie is None or e.cookie == cookie_attached)
+                and (e.link is None or e.link(url))  # type: ignore[arg-type] — as `msg` above
+            ):
+                return Diagnosis(e.code, e.detail)
+    return Diagnosis(classify(msg))
+
+
 def user_error_text(source_kind: str, msg: str, code: str) -> str:
     """The failure text to STORE on the job, given the raw message and its category.
 

backend/app/downloads/formats.py

@@ -57,6 +57,10 @@ _DEFAULTS = {
 # opt-out), so any asset cached under an old non-compat spec — or a stale non-H.264 mp4 that slipped
 # the v3 net — must re-derive through the current browser-safe guarantee.
 _SIG_VERSION = 4
+# Audio-only downloads version on their own, so a change to the audio bytes doesn't re-download every
+# cached video. v5: an extracted .mp3/.m4a is stored as itself instead of remuxed into an .mp4 that
+# iPad's WebKit refuses to play, so a cached remuxed audio asset must re-derive.
+_AUDIO_SIG_VERSION = 5
 
 _SPONSORBLOCK_CATEGORIES = ["sponsor", "selfpromo", "interaction"]
 
@@ -96,20 +100,34 @@ def normalize(spec: dict) -> dict:
     return s
 
 
-def format_sig(spec: dict, salt: str | None = None) -> str:
+def _sig_version(s: dict) -> int:
+    return _AUDIO_SIG_VERSION if s["mode"] == "a" else _SIG_VERSION
+
+
+def format_sig(spec: dict, salt: str | None = None, *, version: int | None = None) -> str:
     """Stable short hash of the output-affecting spec — the MediaAsset cache key component.
 
     `salt` forks a distinct, non-dedup identity for the same spec (used by force-redownload so it
-    always re-fetches into its own asset instead of sharing a cached file with other jobs)."""
+    always re-fetches into its own asset instead of sharing a cached file with other jobs).
+    `version` hashes under a signature version other than the current one (see `format_sigs`)."""
     s = normalize(spec)
     data = {k: s[k] for k in _SIG_KEYS}
-    data["_v"] = _SIG_VERSION
+    data["_v"] = _sig_version(s) if version is None else version
     if salt is not None:
         data["_salt"] = salt
     payload = json.dumps(data, sort_keys=True, separators=(",", ":"))
     return hashlib.sha256(payload.encode()).hexdigest()[:24]
 
 
+def format_sigs(spec: dict, salt: str | None = None) -> tuple[str, str]:
+    """`format_sig` under the current signature version and under the one before it. An asset keeps
+    the signature it was created with, so a job queued before a deploy that bumped the version and
+    run after it downloads into an asset carrying the previous one — which must still be recognised
+    as that user's private asset (`credentials.is_authed_asset`), or it downloads without its cookie."""
+    previous = _sig_version(normalize(spec)) - 1
+    return format_sig(spec, salt), format_sig(spec, salt, version=previous)
+
+
 def build_ydl_opts(
     spec: dict,
     outtmpl: str,

backend/app/downloads/pipeline.py

@@ -8,7 +8,6 @@ from datetime import date, datetime, timedelta, timezone
 from pathlib import Path
 
 import yt_dlp
-from sqlalchemy import select
 
 from app import sysconfig
 from app.config import settings
@@ -114,9 +113,10 @@ def _fill_asset_meta_early(asset_id: int, info: dict) -> None:
         # `or info.get("id")` avoids a blank card while downloading when the cleaned title is empty
         # (e.g. a title that was only a social engagement prefix); the completion path later sets
         # the final title with its own source_ref fallback.
-        asset.title = normalize_title(info.get("title")) or info.get("id")
+        adapter = adapters.resolve_adapter(None, None, info)
+        asset.title = normalize_title(adapter.title(info)) or info.get("id")
         asset.uploader = info.get("uploader") or info.get("channel")
-        asset.uploader_url = adapters.resolve_adapter(None, None, info).uploader_url(info)
+        asset.uploader_url = adapter.uploader_url(info)
         asset.thumbnail_url = info.get("thumbnail")
         asset.duration_s = int(info["duration"]) if info.get("duration") else None
         asset.upload_date = _parse_upload_date(info.get("upload_date"))
@@ -323,14 +323,33 @@ def _extract_with_fallback(
 ):
     """Download via yt-dlp using the source `adapter`'s client sets + options. For YouTube the adapter
     supplies the primary player-client set then a POT-backed fallback (retried on a bot/DRM/format
-    error); other sources make a single attempt. Returns the info dict of the successful attempt.
+    error); a Facebook download WITH a cookie is retried as Chrome behind "Cannot parse data"; other
+    sources make a single attempt. Returns the info dict of the successful attempt.
+
+    Before the first attempt the adapter may resolve `url` to the link that really holds the video (a
+    Facebook group post → its video's watch link); when the page shows no single video there, or is not
+    the post at all (a refused cookie's login page), the adapter raises its own verdict
+    (adapters.POST_*_MESSAGE) instead of letting yt-dlp guess, and a failed page read fails the
+    download as itself.
 
     `cookiefile` (S6) is the acting user's per-host cookies.txt, already gated by
     `credentials.resolve_cookiefile`; passed to every attempt so the fallback stays authenticated.
 
     `max_bytes` (SEC-13) is the owner's remaining storage budget, applied to every attempt."""
-    client_sets = adapter.client_sets()
+    client_sets = adapter.client_sets(authed=cookiefile is not None)
     outtmpl = str(staging / "%(id)s.%(ext)s")
+    # Resolving may read a page first — network time the stall watchdog must not see as a stall.
+    _touch_job(job_id)
+    target = adapter.resolve_url(
+        url,
+        formats.build_ydl_opts(
+            spec,
+            outtmpl,
+            _make_progress_hook(job_id, asset_id),
+            cookiefile=cookiefile,
+            max_bytes=max_bytes,
+        ),
+    )
     last_exc: Exception | None = None
     for i, clients in enumerate(client_sets):
         opts = formats.build_ydl_opts(
@@ -348,7 +367,7 @@ def _extract_with_fallback(
         # killed — acceptable, as socket_timeout + extractor_retries bound one attempt well under it.)
         try:
             with yt_dlp.YoutubeDL(opts) as ydl:
-                return ydl.extract_info(url, download=True)
+                return ydl.extract_info(target, download=True)
         except yt_dlp.utils.DownloadError as exc:
             last_exc = exc
             if i < len(client_sets) - 1 and adapter.retriable(str(exc)):
@@ -385,8 +404,12 @@ def _ensure_browser_playable(job_id: int, produced: Path, spec: dict, info: dict
     or just remux when the codecs are fine but the container isn't. **Scope:** only the mp4 compat
     profile is normalized; an explicit `vcodec` or a non-mp4 custom profile is the user opting out
     of the guarantee and is left as-is (so a `webm` profile can still ship VP9/Opus). Returns the
-    file to store (converted, or the original) and corrects `info`'s codec fields to match disk."""
-    if spec.get("container") != "mp4" or spec.get("vcodec"):
+    file to store (converted, or the original) and corrects `info`'s codec fields to match disk.
+
+    An audio download (mode "a") is never touched: yt-dlp already extracted it to .mp3 / .m4a, which
+    every browser plays as audio/mpeg / audio/mp4. Remuxing it into .mp4 served an mp3 as video/mp4,
+    which iPad's WebKit refuses to play (prod job 268)."""
+    if spec.get("mode") == "a" or spec.get("container") != "mp4" or spec.get("vcodec"):
         return produced
     vcodec, acodec = editmod.probe_codecs(produced)
     is_mp4 = produced.suffix.lower() == ".mp4"
@@ -425,6 +448,7 @@ def _download(
 ) -> None:
     staging = _staging_dir(asset_id)
     cookiefile: Path | None = None
+    url: str | None = None  # read by the failure branch, which can run before it is resolved
     try:
         if staging.exists():
             shutil.rmtree(staging, ignore_errors=True)
@@ -445,12 +469,10 @@ def _download(
         # this asset is that user's private, salted identity (the double gate lives in credentials).
         remaining_bytes: int | None = None
         with SessionLocal() as cdb:
-            asset_sig = cdb.execute(
-                select(MediaAsset.format_sig).where(MediaAsset.id == asset_id)
-            ).scalar_one_or_none()
-            if asset_sig is not None:
+            target = cdb.get(MediaAsset, asset_id)
+            if target is not None:
                 cookiefile = credentials.resolve_cookiefile(
-                    cdb, user_id, url, asset_sig, spec, staging
+                    cdb, user_id, url, target, spec, staging
                 )
             # SEC-13: what this user has left. `check_enqueue` only compared the footprint as it
             # stood when the job was QUEUED — a download's size is unknown until it finishes, so a
@@ -484,13 +506,19 @@ def _download(
         produced = _produced_file(info, staging)
         produced = _ensure_browser_playable(job_id, produced, spec, info)
         ext = produced.suffix.lstrip(".").lower()
+        # Codecs/dims/duration come from a PROBE of the produced file — the ground truth — NOT yt-dlp's
+        # `info` dict, whose fields are absent for some sources (Facebook among them): deriving
+        # media_kind from those nulls misclassified a real H.264 video as a download-only 'file', and a
+        # missing duration hid the trim action. Probed before the sidecars so the .nfo runtime has it
+        # too. Same probe the upload ingest uses.
+        vcodec, acodec, width, height, duration_s = probe.resolve_media_facts(produced, info)
         meta = storage.MediaMeta(
             video_id=info.get("id") or source_ref,
-            title=normalize_title(info.get("title")) or source_ref,
+            title=normalize_title(adapter.title(info)) or source_ref,
             uploader=info.get("uploader") or info.get("channel") or "Unknown Channel",
             upload_date=_parse_upload_date(info.get("upload_date")),
             uniqueid_type=adapter.nfo_uniqueid_type(),
-            duration_s=int(info["duration"]) if info.get("duration") else None,
+            duration_s=duration_s,
             description=info.get("description"),
             thumbnail_url=info.get("thumbnail"),
         )
@@ -516,12 +544,11 @@ def _download(
                 asset.rel_path = rel
                 asset.size_bytes = size
                 asset.duration_s = meta.duration_s
-                # Codecs/dims come from a PROBE of the finished file — the ground truth — NOT yt-dlp's
-                # `info` dict, whose codec fields are absent for some sources (Facebook among them):
-                # deriving media_kind from those nulls misclassified a real H.264 video as a
-                # download-only 'file' with no in-app play/edit. Same probe the upload ingest uses.
-                asset.vcodec, asset.acodec, asset.width, asset.height = probe.resolve_media_facts(
-                    final, info
+                asset.vcodec, asset.acodec, asset.width, asset.height = (
+                    vcodec,
+                    acodec,
+                    width,
+                    height,
                 )
                 asset.container = ext
                 asset.media_kind = mediakind.derive(asset.vcodec, asset.acodec)
@@ -578,6 +605,7 @@ def _download(
                 status=JobStatus.ERROR,
                 error=msg,
                 error_code=dlerrors.classify(msg),
+                error_detail=None,
                 phase=None,
             )
             db.commit()
@@ -588,9 +616,11 @@ def _download(
         log.info("job %s refused for its owner: %s", job_id, msg)
     except Exception as exc:  # noqa: BLE001 — surface any failure to the user, keep worker alive
         msg = str(exc)[:500]
-        code = dlerrors.classify(msg)
+        # The catalog needs the link and whether the user's cookie went with it: the same yt-dlp
+        # text is Facebook's login wall without one and a refused cookie with one.
+        diagnosis = dlerrors.diagnose(msg, url=url, cookie_attached=cookiefile is not None)
         # SEC-12: redact a transport-level readout for user-supplied URLs (see user_error_text).
-        msg = dlerrors.user_error_text(source_kind, msg, code)
+        msg = dlerrors.user_error_text(source_kind, msg, diagnosis.code)
         with SessionLocal() as db:
             asset = db.get(MediaAsset, asset_id)
             if asset:
@@ -603,7 +633,8 @@ def _download(
                 job_id,
                 status=JobStatus.ERROR,
                 error=msg,
-                error_code=code,
+                error_code=diagnosis.code,
+                error_detail=diagnosis.detail,
                 phase=None,
             )
             db.commit()

backend/app/downloads/probe.py

@@ -81,10 +81,12 @@ def probe_media(path: Path) -> tuple[str | None, str | None, int | None, int | N
 
 def resolve_media_facts(
     path: Path, info: dict
-) -> tuple[str | None, str | None, int | None, int | None]:
-    """(vcodec, acodec, width, height) for the stored download asset: PROBE the finished file on disk
-    (the ground truth). yt-dlp's `info` omits codec/dimension fields for some sources (Facebook among
-    them), so deriving media_kind from it there labelled a real H.264 video a download-only 'file'.
+) -> tuple[str | None, str | None, int | None, int | None, int | None]:
+    """(vcodec, acodec, width, height, duration_s) for the stored download asset: PROBE the finished
+    file on disk (the ground truth). yt-dlp's `info` omits codec/dimension fields for some sources
+    (Facebook among them), so deriving media_kind from it there labelled a real H.264 video a
+    download-only 'file'. It omits the duration too (a Facebook reel, an Instagram reel), and a NULL
+    duration hides the Library row's trim action although the file plays for minutes.
 
     Precedence is by whether the probe RAN, not per-field: if ffprobe read the file, its codec verdict
     is authoritative — INCLUDING a deliberate None (cover-art-only audio, a still image). A per-field
@@ -92,16 +94,23 @@ def resolve_media_facts(
     have (yt-dlp reports a progressive `vcodec` for an audio-mode download whose video it then strips),
     mislabelling an audio download as a broken in-app 'video'. Only when ffprobe could NOT read the
     file at all do we fall back to `info` (the pre-probe behaviour, a safety net); the cosmetic
-    dimensions still gap-fill from `info` in either case."""
+    dimensions and the duration still gap-fill from `info` in either case."""
     data = editmod.run_ffprobe_json(path, show_streams=True, show_format=True)
     info_v = info.get("vcodec") if info.get("vcodec") not in (None, "none") else None
     info_a = info.get("acodec") if info.get("acodec") not in (None, "none") else None
     info_w = int(info["width"]) if info.get("width") else None
     info_h = int(info["height"]) if info.get("height") else None
+    info_d = int(info["duration"]) if info.get("duration") else None
     if data is None:
         # ffprobe could not read the file — fall back to the extractor's info entirely.
-        return info_v, info_a, info_w, info_h
-    pv, pa, pw, ph, _dur = _facts_from_probe(data)
+        return info_v, info_a, info_w, info_h, info_d
+    pv, pa, pw, ph, pd = _facts_from_probe(data)
     # Probe ran → its codecs win outright (a None means "no such track", not "unknown"); info only
-    # gap-fills the cosmetic width/height the probe couldn't read.
-    return pv, pa, pw if pw is not None else info_w, ph if ph is not None else info_h
+    # gap-fills the width/height/duration the probe couldn't read.
+    return (
+        pv,
+        pa,
+        pw if pw is not None else info_w,
+        ph if ph is not None else info_h,
+        pd if pd is not None else info_d,
+    )

backend/app/downloads/service.py

@@ -7,6 +7,7 @@ handles everything else. State transitions used by the routes (pause/resume/canc
 the worker live in `worker.py` / the routes; this module owns enqueue + asset bookkeeping.
 """
 
+import uuid
 from datetime import datetime, timezone
 
 from sqlalchemy import func, select, update
@@ -80,11 +81,13 @@ def get_or_create_asset(
         status="pending",
         ref_count=0,
     )
-    db.add(asset)
     try:
-        db.flush()
+        # A SAVEPOINT: losing the race undoes only this insert, never the caller's own pending writes
+        # (Retry clears the job's error before it gets here; a whole-session rollback threw that away).
+        with db.begin_nested():
+            db.add(asset)
+            db.flush()
     except IntegrityError:
-        db.rollback()
         asset = db.execute(stmt).scalar_one()
     return asset
 
@@ -341,13 +344,20 @@ def pause(db: Session, job: DownloadJob) -> None:
 def resume(db: Session, job: DownloadJob) -> None:
     """Requeue a paused/errored job for a fresh attempt, clearing its error. If the SHARED asset itself
     failed, reset it to pending so the worker actually re-downloads — otherwise the requeued job would
-    instantly re-inherit the asset's stale error (the worker short-circuits an errored asset)."""
+    instantly re-inherit the asset's stale error (the worker short-circuits an errored asset).
+
+    A cookie the user added AFTER the job was queued moves the job onto their private asset first
+    (`_follow_the_cookie`): the worker only ever attaches a cookie to that identity, so without the move
+    the Retry a login-wall message asks for would fail on the same wall."""
     if job.status in (JobStatus.PAUSED, JobStatus.ERROR):
         job.progress = 0
         job.error = None
         job.error_code = None
+        job.error_detail = None
         if job.asset_id:
             asset = db.get(MediaAsset, job.asset_id)
+            if asset is not None:
+                asset = _follow_the_cookie(db, job, asset)
             if asset and asset.status == "error":  # MediaAsset.status (no enum), not a JobStatus
                 asset.status = "pending"
                 asset.error = None
@@ -355,6 +365,32 @@ def resume(db: Session, job: DownloadJob) -> None:
         db.commit()
 
 
+def _follow_the_cookie(db: Session, job: DownloadJob, asset: MediaAsset) -> MediaAsset:
+    """Re-point a requeued job at the asset enqueue would pick NOW, when the user has a cookie for the
+    link's host but the job still holds an asset the worker won't attach it to (queued before the
+    cookie existed). Returns the asset the job holds afterwards.
+
+    Only a `pending` / `error` asset moves — neither has a file nor a download in flight. A `ready` one
+    already has the file, and a `downloading` one may be this job's own child still being stopped by
+    the pause; the next Retry after it settles moves the job then. Removing a cookie never moves a job
+    back: the worker attaches nothing without a credential, so the private asset is as good as any."""
+    if asset.status not in ("pending", "error"):
+        return asset
+    url = source_url(job.source_kind, job.source_ref)
+    salt = credentials.salt_for_enqueue(db, job.user_id, url)
+    spec = formats.normalize(job.profile_snapshot)
+    if salt is None or credentials.is_authed_asset(asset, spec, job.user_id, url):
+        return asset
+    target = get_or_create_asset(
+        db, job.source_kind, job.source_ref, formats.format_sig(spec, salt=salt)
+    )
+    populate_from_catalog(db, target)
+    release_asset(db, job)  # drop the old hold BEFORE re-pointing — it keys off job.asset_id
+    incr_ref_count(db, target.id)
+    job.asset_id = target.id
+    return target
+
+
 def cancel(db: Session, job: DownloadJob) -> None:
     """Cancel a job unless it's already done/canceled, releasing its asset hold WHILE it still counts
     as holding — `canceled` ∉ HOLDING, so a later delete won't double-release."""
@@ -373,13 +409,31 @@ def delete(db: Session, job: DownloadJob) -> None:
 
 def redownload(db: Session, job: DownloadJob) -> None:
     """Rebuild a finished/failed job's file into a FRESH, private asset (the cache sig is salted with
-    the job id + current asset id, so it never reuses the dedup pool) and requeue the SAME job row —
+    the new asset's own id, so it never reuses the dedup pool) and requeue the SAME job row —
     so any public share link (DownloadLink -> job_id) keeps resolving to the newly-downloaded file.
     The old hold is dropped first (freeing the old file iff this job was its last holder). The caller
-    has already rejected edit clips + still-in-progress jobs (HTTP 409)."""
+    has already rejected edit clips + still-in-progress jobs (HTTP 409).
+
+    When the user has a cookie for the link's host, the salt carries it (`credentials.rebuild_salt`),
+    so the worker recognises the rebuild as their private identity and attaches the cookie — a cookie
+    download, or one the user added after a failure, rebuilds with the cookie."""
     spec = formats.normalize(job.profile_snapshot)
-    sig = formats.format_sig(spec, salt=f"{job.id}:{job.asset_id}")
-    asset = get_or_create_asset(db, job.source_kind, job.source_ref, sig)
+    cookie = credentials.salt_for_enqueue(
+        db, job.user_id, source_url(job.source_kind, job.source_ref)
+    )
+    # The salt names the row's own id, which exists only once the row does: insert it under a unique
+    # placeholder, then write the real signature in the same transaction (nobody sees the placeholder).
+    asset = MediaAsset(
+        source_kind=job.source_kind,
+        source_ref=job.source_ref,
+        format_sig=f"rebuild:{uuid.uuid4().hex}",
+        status="pending",
+        ref_count=0,
+    )
+    db.add(asset)
+    db.flush()
+    asset.format_sig = formats.format_sig(spec, salt=credentials.rebuild_salt(asset.id, cookie))
+    db.flush()
     populate_from_catalog(db, asset)
     # Drop the old hold BEFORE re-pointing the job — release_asset keys off the job's current asset.
     release_asset(db, job)
@@ -389,6 +443,8 @@ def redownload(db: Session, job: DownloadJob) -> None:
     job.progress = 0
     job.phase = None
     job.error = None
+    job.error_code = None  # a rebuild that fails again gets its own diagnosis, never the old one
+    job.error_detail = None
     job.speed_bps = None
     job.eta_s = None
     # Re-derive the display name from the freshly cleaned title on completion (else an older, un-cleaned

backend/app/models.py

@@ -871,6 +871,8 @@ class DownloadJob(Base, TimestampMixin, UpdatedAtMixin):
     error_code: Mapped[str | None] = mapped_column(
         String(24)
     )  # category, see downloads.errors.classify
+    # The host-specific failure-catalog entry on top of the category (`facebook.login_wall`), or NULL.
+    error_detail: Mapped[str | None] = mapped_column(String(48))  # see downloads.errors.diagnose
     queue_pos: Mapped[int] = mapped_column(Integer, default=0, server_default="0")
 
 

backend/app/ratelimit.py

@@ -1,15 +1,20 @@
 """A tiny in-process sliding-window rate limiter.
 
-Generic groundwork: keyed by an arbitrary string (e.g. a client IP), so it can throttle any
+Generic groundwork: keyed by an arbitrary string (e.g. a client — `client_key`), so it can throttle any
 endpoint. Single-worker uvicorn → in-memory state is sufficient; it resets on restart, which
 is fine for abuse throttling (not for anything that must survive a deploy). Not shared across
 processes — if we ever run multiple workers, swap the backing store for Redis behind the same
 ``allow()`` interface.
 """
 
+import ipaddress
 import threading
 import time
 
+from fastapi import Request
+
+from app.config import settings
+
 
 class RateLimiter:
     def __init__(self, max_events: int, window_seconds: float):
@@ -25,6 +30,14 @@ class RateLimiter:
         with self._lock:
             self._hits.clear()
 
+    def exhausted(self, key: str) -> bool:
+        """Whether ``key``'s window is already full (``allow`` would refuse it), WITHOUT counting an
+        attempt — for a limit that counts only some outcomes: ask it first, ``allow`` the ones that
+        count."""
+        cutoff = time.monotonic() - self.window
+        with self._lock:
+            return sum(1 for t in self._hits.get(key, []) if t > cutoff) >= self.max_events
+
     def allow(self, key: str) -> bool:
         """Record an attempt for ``key`` and return whether it is within the limit.
 
@@ -49,3 +62,40 @@ class RateLimiter:
                     else:
                         del self._hits[k]
             return True
+
+
+def _norm_ip(s: str) -> ipaddress.IPv4Address | ipaddress.IPv6Address | None:
+    """Parse an IP for comparison, unwrapping IPv4-mapped IPv6 (`::ffff:10.0.0.1` → `10.0.0.1`) so a
+    plain-IPv4 allowlist still matches a peer that surfaces in mapped form. None for a non-IP string."""
+    try:
+        ip = ipaddress.ip_address(s.strip())
+    except ValueError:
+        return None
+    return ip.ipv4_mapped if getattr(ip, "ipv4_mapped", None) else ip
+
+
+def client_key(request: Request) -> str:
+    """Best-effort client identity for rate limiting: its IP, or for IPv6 the /64 the address sits in — a
+    subscriber is handed a whole /64, so keyed on the full address one client would have endless identities
+    to spread its attempts over. X-Forwarded-For is client-controlled, so we trust it
+    ONLY when the request actually arrived from a configured reverse proxy (settings.trusted_proxy_ips
+    — the address the proxy connects FROM, e.g. the VPS Caddy's WireGuard peer IP). Our proxy APPENDS
+    the client it saw to XFF, so the RIGHTMOST entry is the real client and can't be forged by a
+    client pre-seeding the header. Any other peer (someone hitting the app port directly, bypassing the
+    proxy) is untrusted — we use its real socket IP, so it can't spoof its rate-limit identity.
+
+    SAFETY: this relies on `request.client` being the TRUE socket peer. uvicorn is started WITHOUT
+    `--proxy-headers` (see entrypoint.sh) precisely so it never rewrites `request.client` from XFF —
+    do NOT add that flag, or the trust check below would compare against a forgeable value."""
+    peer = request.client.host if request.client else "unknown"
+    client = peer
+    trusted = {_norm_ip(p) for p in settings.trusted_proxy_ip_set} - {None}
+    if _norm_ip(peer) in trusted:
+        xff = request.headers.get("x-forwarded-for")
+        parts = [p.strip() for p in (xff or "").split(",") if p.strip()]
+        if parts:
+            client = parts[-1]
+    ip = _norm_ip(client)
+    if isinstance(ip, ipaddress.IPv6Address):
+        return str(ipaddress.IPv6Network((ip, 64), strict=False))
+    return client

backend/app/routes/auth.py

@@ -3,7 +3,6 @@
 Split out of app/auth.py (R12 S2); the core auth surface (current_user, scopes, token
 helpers) stays in app/auth.py, imported below."""
 
-import ipaddress
 import secrets
 from datetime import datetime, timedelta, timezone
 from typing import NamedTuple
@@ -40,7 +39,7 @@ from app.auth import (
 from app.config import settings
 from app.db import SessionLocal, get_db
 from app.models import AuthToken, DemoWhitelist, Invite, OAuthToken, User
-from app.ratelimit import RateLimiter
+from app.ratelimit import RateLimiter, client_key
 from app.security import encrypt, hash_password, hash_token, verify_password
 from app.utils import canonical_email, valid_email
 
@@ -172,37 +171,6 @@ def is_demo_allowed(db: Session, email: str) -> bool:
     )
 
 
-def _norm_ip(s: str) -> ipaddress.IPv4Address | ipaddress.IPv6Address | None:
-    """Parse an IP for comparison, unwrapping IPv4-mapped IPv6 (`::ffff:10.0.0.1` → `10.0.0.1`) so a
-    plain-IPv4 allowlist still matches a peer that surfaces in mapped form. None for a non-IP string."""
-    try:
-        ip = ipaddress.ip_address(s.strip())
-    except ValueError:
-        return None
-    return ip.ipv4_mapped if getattr(ip, "ipv4_mapped", None) else ip
-
-
-def _client_ip(request: Request) -> str:
-    """Best-effort client IP for rate limiting. X-Forwarded-For is client-controlled, so we trust it
-    ONLY when the request actually arrived from a configured reverse proxy (settings.trusted_proxy_ips
-    — the address the proxy connects FROM, e.g. the VPS Caddy's WireGuard peer IP). Our proxy APPENDS
-    the client it saw to XFF, so the RIGHTMOST entry is the real client and can't be forged by a
-    client pre-seeding the header. Any other peer (someone hitting the app port directly, bypassing the
-    proxy) is untrusted — we use its real socket IP, so it can't spoof its rate-limit identity.
-
-    SAFETY: this relies on `request.client` being the TRUE socket peer. uvicorn is started WITHOUT
-    `--proxy-headers` (see entrypoint.sh) precisely so it never rewrites `request.client` from XFF —
-    do NOT add that flag, or the trust check below would compare against a forgeable value."""
-    peer = request.client.host if request.client else "unknown"
-    trusted = {_norm_ip(p) for p in settings.trusted_proxy_ip_set} - {None}
-    if _norm_ip(peer) in trusted:
-        xff = request.headers.get("x-forwarded-for")
-        parts = [p.strip() for p in (xff or "").split(",") if p.strip()]
-        if parts:
-            return parts[-1]
-    return peer
-
-
 class InviteRequest(NamedTuple):
     """What an access request settled on.
 
@@ -631,6 +599,8 @@ async def logout(request: Request):
     out in one tab doesn't disturb another tab running a different account. If the account being
     removed was the session default, promote the most recent remaining account (or clear the
     session when none remain)."""
+    # A tab still pinned to an account already signed out in another tab resolves to nobody, so it
+    # signs nobody out — it used to fall back to the default and sign THAT account out in its place.
     active, is_default = resolved_user_id(request)
     remaining = [a for a in (request.session.get("account_ids") or []) if a != active]
     request.session["account_ids"] = remaining
@@ -672,7 +642,7 @@ async def request_access(
     email = (body.email or "").strip().lower()
     if not valid_email(email):
         raise HTTPException(status_code=400, detail="Enter a valid email address.")
-    if not _request_access_limiter.allow(_client_ip(request)):
+    if not _request_access_limiter.allow(client_key(request)):
         return {"status": "pending"}
     if is_allowed(db, email):
         return {"status": "pending"}  # already allowed — don't reveal it
@@ -689,7 +659,7 @@ def demo_login(body: EmailIn, request: Request, db: Session = Depends(get_db)) -
     so there is no visible 'demo login' button. Rate-limited per IP; when blocked it answers
     exactly like a non-match (authenticated=false) so the field can't be hammered as an
     enumeration oracle. On a match it sets the session and the client reloads into the app."""
-    if not _demo_limiter.allow(_client_ip(request)):
+    if not _demo_limiter.allow(client_key(request)):
         return {"authenticated": False}
     email = (body.email or "").strip().lower()
     if valid_email(email) and is_demo_allowed(db, email):
@@ -835,7 +805,7 @@ def register(
         )
     if not sysconfig.get_bool(db, "allow_registration"):
         raise HTTPException(status_code=403, detail="Registration is currently closed.")
-    if not _register_limiter.allow(_client_ip(request)):
+    if not _register_limiter.allow(client_key(request)):
         return {"status": "ok"}  # silently throttle; uniform response
 
     # Do the existence check + account creation OFF the response path (a background task with its own
@@ -1003,7 +973,7 @@ def verify_email_resend(
     and re-registering an already-registered email is a silent no-op, so a user who lost the first
     mail had no way back. Uniform response + timing regardless of whether the email has a pending
     account (the lookup runs off the response path), so it can't probe for registered emails."""
-    if not _verify_resend_limiter.allow(_client_ip(request)):
+    if not _verify_resend_limiter.allow(client_key(request)):
         return {"status": "ok"}  # silently throttle; uniform response
     email = (body.email or "").strip().lower()
     if valid_email(email):
@@ -1062,7 +1032,7 @@ def password_login(
     """Email+password sign-in. Wrong email/password give a single uniform 401 (no enumeration).
     Once the password is proven correct, the owner gets a specific reason if their account is
     still pending or suspended — that's not an enumeration leak (they already hold the password)."""
-    if not _login_limiter.allow(_client_ip(request)):
+    if not _login_limiter.allow(client_key(request)):
         raise _login_refused(429, "rate_limited")
     email = (body.email or "").strip().lower()
     password = body.password or ""
@@ -1093,7 +1063,7 @@ def password_reset_request(
 ) -> dict:
     """Request a password-reset link. Uniform response + timing regardless of whether the email has a
     password account (the lookup runs off the response path), so it can't probe for registered emails."""
-    if not _reset_limiter.allow(_client_ip(request)):
+    if not _reset_limiter.allow(client_key(request)):
         return {"status": "ok"}
     email = (body.email or "").strip().lower()
     # Do the account lookup + token issue + email OFF the response path (a background task with its
@@ -1142,7 +1112,7 @@ def password_reset_check(body: TokenIn, request: Request, db: Session = Depends(
     told `true`, never `false`: this check may only ever save a user a wasted form, so when it cannot
     answer it must degrade to the old behaviour instead of declaring a live link dead.
     """
-    if not _reset_check_limiter.allow(_client_ip(request)):
+    if not _reset_check_limiter.allow(client_key(request)):
         return {"ok": True}
     return {"ok": any(_peek_token(db, body.token, k) is not None for k in _PASSWORD_TOKEN_KINDS)}
 

backend/app/routes/downloads.py

@@ -107,6 +107,7 @@ def _serialize(job: DownloadJob, asset: MediaAsset | None) -> dict:
         "phase": job.phase,
         "error": job.error,
         "error_code": job.error_code,
+        "error_detail": job.error_detail,
         "queue_pos": job.queue_pos,
         "created_at": iso(job.created_at),
         "source_kind": job.source_kind,
@@ -172,6 +173,32 @@ def _own_job(db: Session, user: User, job_id: int) -> DownloadJob:
     return job
 
 
+def _own_job_for_update(db: Session, user: User, job_id: int) -> DownloadJob:
+    """`_own_job` for a transition that moves its asset's ref count (resume, cancel, delete, redownload)
+    or writes the status those decide on (pause). The job is re-read under a row lock, so two
+    overlapping requests for one job run one after the other and the second decides on the first's
+    committed result — never both releasing the same hold, and never a pause turning a job a cancel
+    just released back into a holder; either can free a file another job still holds.
+
+    The asset is locked BEFORE the job: the order a finishing worker child takes them in
+    (`service.finalize_if_running`), so the two can never deadlock."""
+    while True:
+        asset_id = _own_job(db, user, job_id).asset_id
+        if asset_id is not None:
+            db.execute(select(MediaAsset.id).where(MediaAsset.id == asset_id).with_for_update())
+        job = db.execute(
+            select(DownloadJob)
+            .where(DownloadJob.id == job_id)
+            .with_for_update()
+            .execution_options(populate_existing=True)
+        ).scalar_one_or_none()
+        if job is None:
+            raise HTTPException(status_code=404, detail="Unknown download")
+        if job.asset_id == asset_id:
+            return job
+        db.rollback()  # another request moved the job to another asset meanwhile: lock that one
+
+
 # --- profiles ------------------------------------------------------------------------------
 
 
@@ -605,7 +632,7 @@ def update_download_meta(
 def pause_download(
     job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
 ) -> dict:
-    job = _own_job(db, user, job_id)
+    job = _own_job_for_update(db, user, job_id)
     service.pause(db, job)
     return _serialize_job(db, job)
 
@@ -614,7 +641,7 @@ def pause_download(
 def resume_download(
     job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
 ) -> dict:
-    job = _own_job(db, user, job_id)
+    job = _own_job_for_update(db, user, job_id)
     service.resume(db, job)
     return _serialize_job(db, job)
 
@@ -629,12 +656,13 @@ def redownload_download(
     resolves to the newly-downloaded file — a re-download never breaks a link you already sent out
     (only a *failed* re-download leaves the job in `error`, which is the intended broken-link case).
 
-    The rebuild always re-fetches into a FRESH, private asset (the cache sig is salted with the job
-    id + current asset id) rather than the dedup pool. That means it (a) always genuinely rebuilds
+    The rebuild always re-fetches into a FRESH, private asset (the cache sig is salted with the new
+    asset's own id, and the user's cookie salt when one applies — `credentials.rebuild_salt`) rather
+    than the dedup pool. That means it (a) always genuinely rebuilds
     under the current format/naming rules — never silently reuses a shared cached file — and (b)
     never deletes a file another job/user still shares: the old asset is only removed if THIS job
     was its last holder."""
-    job = _own_job(db, user, job_id)
+    job = _own_job_for_update(db, user, job_id)
     if job.job_kind in ("edit", "upload"):
         # Neither has a re-fetchable source: an editor clip is derived locally, an upload IS the
         # source. Re-running yt-dlp against source_kind='upload'/'edit' would just fail.
@@ -649,7 +677,7 @@ def redownload_download(
 def cancel_download(
     job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
 ) -> dict:
-    job = _own_job(db, user, job_id)
+    job = _own_job_for_update(db, user, job_id)
     service.cancel(db, job)
     return _serialize_job(db, job)
 
@@ -658,7 +686,7 @@ def cancel_download(
 def delete_download(
     job_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
 ) -> dict:
-    job = _own_job(db, user, job_id)
+    job = _own_job_for_update(db, user, job_id)
     service.delete(db, job)
     return {"deleted": job_id}
 

backend/app/routes/me.py

@@ -7,6 +7,7 @@ from app.auth import (
     count_admins,
     count_pending_activations,
     current_user,
+    drop_from_wallet,
     google_enabled,
     has_read_scope,
     has_write_scope,
@@ -65,24 +66,26 @@ def switch_account(
     target = body.user_id
     if target not in (request.session.get("account_ids") or []):
         raise HTTPException(status_code=403, detail="Not an account you've signed into here.")
+    # An account `_session_user` would refuse — gone, deactivated, suspended, or its session revoked — is
+    # refused here too, and dropped from the switch list the way `_session_user` drops it. Made the session
+    # default instead, the next request's current_user would refuse it as the DEFAULT and clear the whole
+    # wallet session, logging out every account here. (B-core-9)
     u = db.get(User, target)
     if u is None:
+        drop_from_wallet(request.session, target)
         raise HTTPException(status_code=404, detail="That account no longer exists.")
     if not is_allowed(db, u.email):
         raise HTTPException(status_code=403, detail="That account no longer has access.")
+    if not u.is_active:
+        drop_from_wallet(request.session, target)
+        raise HTTPException(status_code=403, detail="That account no longer has access.")
     if u.is_suspended:
-        # Don't make a suspended account the active one — the next request's current_user would
-        # see the suspension and clear the WHOLE wallet session, logging out every account here.
+        drop_from_wallet(request.session, target)
         raise HTTPException(status_code=403, detail="That account is suspended.")
-    # Same reasoning for a REVOKED session (a password reset/change or "log out everywhere" bumped the
-    # account's epoch): making it the session default would trip current_user's epoch check on the next
-    # request and clear the whole wallet. Mirror the suspend guard — drop the stale account from the
-    # switch list and refuse, rather than logging everyone out. (B-core-9)
+    # Revoked: a password reset/change or "log out everywhere" bumped the account's epoch.
     epochs = request.session.get("epochs") or {}
     if int(epochs.get(str(target), 0)) != (u.session_epoch or 0):
-        request.session["account_ids"] = [
-            a for a in (request.session.get("account_ids") or []) if a != target
-        ]
+        drop_from_wallet(request.session, target)
         raise HTTPException(
             status_code=403, detail="That account was signed out elsewhere — sign in again."
         )

backend/app/routes/messages.py

@@ -423,9 +423,10 @@ async def messages_ws(ws: WebSocket) -> None:
     """Live push channel: authenticated by the session cookie, registers the connection so
     sent messages reach this user's open tabs instantly. We don't consume client→server frames
     (sending goes through POST /api/messages); the receive loop only detects disconnect."""
-    # Which signed-in account this socket acts as — the SHARED per-tab resolution (wallet-gated
-    # ?account= override, session default otherwise). A browser WebSocket can't send the
-    # X-Siftlode-Account header, so resolved_user_id falls through to the ?account= query param.
+    # Which signed-in account this socket acts as — the SHARED per-tab resolution (a wallet-gated
+    # ?account=, the session default when none is named, nobody for an account no longer signed in
+    # here). A browser WebSocket can't send the X-Siftlode-Account header, so resolved_user_id falls
+    # through to the ?account= query param.
     uid, _ = resolved_user_id(ws)
     if not uid:
         await ws.close(code=1008)

backend/app/routes/public.py

@@ -6,7 +6,7 @@ the app or any account data. Password-protected links exchange the password once
 a short-lived signed grant that the media URL carries (a `<video src>` can't send a header).
 """
 
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.responses import FileResponse
 from pydantic import BaseModel
 from sqlalchemy import select
@@ -17,13 +17,21 @@ from app.db import get_db
 from app.downloads import links as linksmod
 from app.downloads import storage
 from app.models import DownloadJob, DownloadLink, MediaAsset
-from app.ratelimit import RateLimiter
+from app.ratelimit import RateLimiter, client_key
 from app.security import verify_password
 
 router = APIRouter(prefix="/api/public", tags=["public"])
 
-# Slow password guessing per link (the token itself is 192-bit, so it needs no throttle).
+# Slow password guessing on a link (the token itself is 192-bit, so it needs no throttle). Counted per
+# viewer — the link AND the client (`client_key`) — so a client guessing wrong shuts out only itself, and a
+# busy link's own unlocks don't count against its next viewer.
 _unlock_limit = RateLimiter(max_events=10, window_seconds=300)
+# ...under a ceiling on WRONG passwords for the link from every client together, so guessing spread over
+# many addresses stays slow too; unlocking with the password never adds to it. The price of the ceiling:
+# someone with the link but not its password, guessing from 50 / 10 = 5 networks, can keep the link shut
+# for everyone until the window passes. It is checked before the password and counted after it, so guesses
+# already running when it fills are still checked — as many as the route's threadpool runs at once.
+_unlock_failures = RateLimiter(max_events=50, window_seconds=300)
 
 
 def _link_or_404(db: Session, token: str) -> DownloadLink:
@@ -83,11 +91,16 @@ class WatchUnlockIn(BaseModel):
 
 
 @router.post("/watch/{token}/unlock")
-def watch_unlock(token: str, body: WatchUnlockIn, db: Session = Depends(get_db)) -> dict:
+def watch_unlock(
+    token: str, body: WatchUnlockIn, request: Request, db: Session = Depends(get_db)
+) -> dict:
     """Exchange the link password for a signed grant carried by the media URL."""
-    if not _unlock_limit.allow(token):
-        raise HTTPException(status_code=429, detail="Too many attempts. Try again later.")
+    # The link first: a token naming none must leave no limiter entry behind, or posting made-up tokens
+    # would grow the limiter without bound.
     link = _link_or_404(db, token)
+    viewer = f"{token}|{client_key(request)}"
+    if _unlock_failures.exhausted(token) or not _unlock_limit.allow(viewer):
+        raise HTTPException(status_code=429, detail="Too many attempts. Try again later.")
     if not link.password_hash:
         # Not a password link — nothing to unlock; just hand back the plain meta.
         job, asset = _ready_target(db, link)
@@ -96,6 +109,7 @@ def watch_unlock(token: str, body: WatchUnlockIn, db: Session = Depends(get_db))
             **linksmod.public_meta(link, job, asset, _file_url(token), _poster_url(token, asset)),
         }
     if not verify_password(body.password, link.password_hash):
+        _unlock_failures.allow(token)
         raise HTTPException(status_code=403, detail="Wrong password.")
     job, asset = _ready_target(db, link)
     link.view_count += 1

backend/app/worker.py

@@ -32,12 +32,12 @@ from app import sysconfig
 from app.config import settings
 from app.db import SessionLocal
 from app.downloads import edit as editmod
-from app.downloads import quota, service
+from app.downloads import credentials, formats, quota, service
+from app.downloads import errors as dlerrors
 from app.downloads.jobdb import (
     _edit_staging_dir,
     _requeue_if_running,
     _reset_asset_pending,
-    _set_job,
     _staging_dir,
 )
 from app.downloads.status import STOPPED_BY_ROUTE, JobStatus
@@ -253,7 +253,27 @@ def _fail_after_kill(
     """`_stop_and_free` + mark the job errored — for the watchdog's stall/timeout kills and the
     supervisor-error fallback."""
     _stop_and_free(job_id, asset_id, proc, grace_s)
-    _set_job(job_id, status="error", error=error, error_code=error_code, phase=None)
+    _fail_running(job_id, error=error, error_code=error_code)
+
+
+def _fail_running(
+    job_id: int, *, error: str, error_code: str | None, error_detail: str | None = None
+) -> None:
+    """Fail a claimed job — only while it is still `running` (`service.finalize_if_running`), so a
+    cancel/pause a route landed first is never turned back into `error`, which holds the asset the
+    route already released. `error_detail` is written every time: a failure never shows an earlier
+    failure's explanation."""
+    with SessionLocal() as db:
+        service.finalize_if_running(
+            db,
+            job_id,
+            status=JobStatus.ERROR,
+            error=error,
+            error_code=error_code,
+            error_detail=error_detail,
+            phase=None,
+        )
+        db.commit()
 
 
 def _run_supervised(job_id: int, asset_id: int) -> None:
@@ -329,12 +349,10 @@ def _run_supervised(job_id: int, asset_id: int) -> None:
                 status, _ = _job_liveness(job_id)
                 if status == "running":
                     _cleanup_staging(asset_id)
-                    _set_job(
+                    _fail_running(
                         job_id,
-                        status="error",
-                        error_code="unknown",
-                        phase=None,
                         error=f"The download process exited unexpectedly (code {proc.returncode}).",
+                        error_code="unknown",
                     )
                     log.warning(
                         "job %s: child exited %s without finishing", job_id, proc.returncode
@@ -399,16 +417,32 @@ def _process_job(job_id: int) -> None:
         asset_id = asset.id if asset else None
         asset_status = asset.status if asset else None
         asset_error = asset.error if asset else None
+        if asset_status == "error":
+            # A job that meets an already-failed asset gets that failure's explanation — not a bare
+            # "Download failed". Only the text is on the asset, so it is diagnosed again, for this
+            # link, with whether a cookie goes with it asked of the same gate the download child
+            # used (`credentials.usable_cookie`) — as it stands now, so the advice fits this job's Retry.
+            url = service.source_url(job.source_kind, job.source_ref)
+            cookie = credentials.usable_cookie(
+                db, job.user_id, url, asset, formats.normalize(job.profile_snapshot)
+            )
+            diagnosis = dlerrors.diagnose(asset_error, url=url, cookie_attached=cookie is not None)
+            del cookie  # only whether there is one matters here
 
     if asset is None:
-        _set_job(job_id, status="error", error="No media asset", phase=None)
+        _fail_running(job_id, error="No media asset", error_code=None)
         return
 
     if asset_status == "ready":
         _finish_from_cache(job_id, asset_id)
         return
     if asset_status == "error":
-        _set_job(job_id, status="error", error=asset_error or "Download failed", phase=None)
+        _fail_running(
+            job_id,
+            error=asset_error or "Download failed",
+            error_code=diagnosis.code,
+            error_detail=diagnosis.detail,
+        )
         return
     if asset_status == "downloading":
         # Another worker won this asset between our claim and here (a narrow race — the claim SQL
@@ -461,7 +495,7 @@ def _worker_loop(idx: int) -> None:
             _process_job(job_id)
         except Exception:  # noqa: BLE001
             log.exception("processing job %s crashed", job_id)
-            _set_job(job_id, status="error", error="Worker error", phase=None)
+            _fail_running(job_id, error="Worker error", error_code=None)
 
 
 def main() -> None:

backend/entrypoint.sh

@@ -11,7 +11,7 @@ echo "Starting Siftlode API..."
 # on the next request -> 502. Non-idempotent POSTs (the player's progress/state writes,
 # fired every 5s) can't be auto-retried by the proxy, so those 502s reached the user.
 #
-# SECURITY: do NOT add --proxy-headers / --forwarded-allow-ips here. auth._client_ip trusts
+# SECURITY: do NOT add --proxy-headers / --forwarded-allow-ips here. ratelimit.client_key trusts
 # X-Forwarded-For only when the TRUE socket peer is a configured proxy (TRUSTED_PROXY_IPS); those
 # flags would make uvicorn overwrite request.client from the forgeable XFF, defeating that check and
 # reopening the rate-limit bypass (SA3).

backend/requirements.lock

@@ -7,6 +7,7 @@ Authlib==1.7.2
 Mako==1.4.1
 MarkupSafe==3.0.3
 PyYAML==6.0.3
+Pygments==2.21.0
 SQLAlchemy==2.0.52
 alembic==1.19.1
 annotated-doc==0.0.5
@@ -21,6 +22,7 @@ cffi==2.1.1
 charset-normalizer==3.5.1
 click==8.4.2
 cryptography==50.0.0
+curl_cffi==0.15.0
 fastapi==0.141.1
 feedparser-sgmllib==2.1.0
 feedparser==6.0.14
@@ -32,6 +34,8 @@ httpx==0.28.1
 idna==3.18
 itsdangerous==2.2.0
 joserfc==1.7.4
+markdown-it-py==4.2.0
+mdurl==0.1.2
 mutagen==1.48.1
 numpy==2.5.2
 psycopg-binary==3.3.4
@@ -45,6 +49,7 @@ pydantic_core==2.46.4
 python-dotenv==1.2.3
 python-multipart==0.0.32
 requests==2.34.2
+rich==15.0.0
 starlette==1.6.0
 typing-inspection==0.4.4
 typing_extensions==4.16.0

backend/requirements.txt

@@ -21,6 +21,13 @@ argon2-cffi>=23.1,<26
 # scripts Deno runs for YouTube's n-signature). yt-dlp is release-often (YouTube changes), so
 # keep the floor loose and bump it when extraction breaks.
 yt-dlp[default]>=2025.5.22
+# Browser impersonation (`impersonate`) for Facebook downloads made with the user's cookie: some
+# links answer a signed-in plain request with "Cannot parse data" and only parse as Chrome (E11.5,
+# measured). The range is YT-DLP's, not ours — yt-dlp 2026.07.04 imports curl_cffi only in
+# 0.10.x–0.15.x and silently reports every target "unavailable" outside it. Move it when bumping
+# yt-dlp; `tests/test_facebook_impersonation.py::test_the_locked_curl_cffi_can_impersonate_chrome`
+# fails the gate if the locked pair can no longer impersonate.
+curl_cffi>=0.10,<0.16
 # PO Token provider plugin: talks to the bgutil sidecar (brainicism/bgutil-ytdlp-pot-provider)
 # to mint YouTube Proof-of-Origin tokens on demand, bypassing "confirm you're not a bot" and
 # unlocking high-quality formats. Pin to match the sidecar image tag (versions must align).

backend/tests/test_adapters.py

@@ -1,6 +1,8 @@
 """Per-source adapter selection + the source-specific policy each one carries. These lock the
 behaviour that used to live inline in worker.build_uploader_url / backfill._should_refetch."""
 
+from app.config import settings
+from app.titles import normalize_title
 from app.downloads.adapters import (
     FacebookAdapter,
     RedditAdapter,
@@ -103,12 +105,74 @@ def test_generic_source_url_is_passthrough_youtube_reconstructs():
     )
 
 
-def test_client_sets_and_retriable_are_youtube_only():
+def test_client_sets_and_retriable_are_per_source():
     # Generic sources make a single attempt and never retry on the YouTube per-client markers.
     assert SourceAdapter().client_sets() == [None]
+    assert SourceAdapter().client_sets(authed=True) == [None]
     assert SourceAdapter().retriable("Sign in to confirm you're not a bot") is False
     assert YouTubeAdapter().retriable("Sign in to confirm you're not a bot") is True
     assert YouTubeAdapter().retriable("some unrelated network blip") is False
+    # A client list yt-dlp empties because none of its clients take cookies does NOT raise "No
+    # player clients have been requested" (that raise sits earlier in yt-dlp, before the
+    # cookie-capability removal). Measured with a real cookie: the emptied request fails with
+    # "Requested format is not available", which is retriable here already — so the wasted attempt
+    # is recoverable and `_COOKIE_CAPABLE` exists to avoid spending it at all.
+    assert (
+        YouTubeAdapter().retriable(
+            "ERROR: [youtube] abc: Requested format is not available. Use --list-formats"
+        )
+        is True
+    )
+    # The media fetch refused after a successful extraction: the format URLs belong to the client
+    # that minted them, so the next client set is a real second chance (it used to end the job).
+    assert (
+        YouTubeAdapter().retriable(
+            "ERROR: unable to download video data: HTTP Error 403: Forbidden"
+        )
+        is True
+    )
+    assert (
+        SourceAdapter().retriable("ERROR: unable to download video data: HTTP Error 403") is False
+    )
+    # Facebook: a second, Chrome-impersonating attempt only WITH the user's cookie, and only behind
+    # the parse wall (without a cookie that wall is the login wall — no disguise gets past it).
+    fb = FacebookAdapter()
+    assert fb.client_sets() == [None]
+    assert len(fb.client_sets(authed=True)) == 2
+    assert fb.ydl_opts_extra(fb.client_sets(authed=True)[0]) == {}
+    assert fb.retriable("ERROR: [facebook] 1: Cannot parse data; please report this issue") is True
+    assert fb.retriable("ERROR: [facebook] 1: No video formats found!") is False
+
+
+def test_a_signed_in_youtube_download_only_runs_cookie_capable_clients(monkeypatch):
+    yt = YouTubeAdapter()
+    monkeypatch.setattr(settings, "download_player_clients", "android_vr")
+    monkeypatch.setattr(settings, "download_player_clients_fallback", "web_safari,web,android")
+    # Signed out: the admin's ladder exactly as configured.
+    assert yt.client_sets() == [["android_vr"], ["web_safari", "web", "android"]]
+    # Signed in: yt-dlp REMOVES every client that takes no cookies, and a set it empties that way
+    # raises "No player clients have been requested" — which would fail the download on attempt 1,
+    # before the POT-backed web fallback the cookie exists for. So the adapter never asks for one:
+    # the android_vr-only set is gone and `android` is dropped out of the fallback.
+    assert yt.client_sets(authed=True) == [["web_safari", "web"]]
+
+
+def test_a_signed_in_download_still_has_clients_when_the_admin_configured_none(monkeypatch):
+    # Both knobs cookie-incapable: fall back to the POT-backed web pair rather than no attempt at all.
+    monkeypatch.setattr(settings, "download_player_clients", "android_vr")
+    monkeypatch.setattr(settings, "download_player_clients_fallback", "android,ios")
+    assert YouTubeAdapter().client_sets(authed=True) == [["web_safari", "web"]]
+
+
+def test_the_cookie_capable_clients_match_the_installed_ytdlp():
+    # The list is yt-dlp's, not ours (INNERTUBE_CLIENTS[...]["SUPPORTS_COOKIES"]). Pinned here so a
+    # yt-dlp bump that renames or re-flags a client turns the gate red, instead of silently sending
+    # a signed-in download to a client that drops the cookie.
+    from yt_dlp.extractor.youtube._base import INNERTUBE_CLIENTS
+
+    live = {k for k, v in INNERTUBE_CLIENTS.items() if v.get("SUPPORTS_COOKIES")}
+    assert live == set(YouTubeAdapter._COOKIE_CAPABLE)
+    assert set(YouTubeAdapter._AUTHED_DEFAULT) <= live
 
 
 def test_youtube_ydl_opts_extra_carries_player_client_and_pot():
@@ -130,3 +194,28 @@ def test_wants_metadata_backfill_matches_old_should_refetch():
 def test_nfo_uniqueid_type_is_the_adapter_key():
     assert YouTubeAdapter().nfo_uniqueid_type() == "youtube"
     assert SourceAdapter().nfo_uniqueid_type() == "generic"
+
+
+def test_title_is_yt_dlps_for_a_source_without_placeholders():
+    assert SourceAdapter().title({"title": "Video", "description": "text"}) == "Video"
+    assert SourceAdapter().title({}) is None
+
+
+def test_facebook_placeholder_title_takes_the_posts_text():
+    # Measured: signed in, yt-dlp titles every reel "Video" (an 18+ reel read as Chrome: "Facebook"),
+    # while the post's text is still in the description.
+    a = FacebookAdapter()
+    info = {"title": "Video", "description": "\n  Tune of The Day\nsecond line"}
+    assert a.title(info) == "Tune of The Day"
+    assert a.title({**info, "title": "Facebook"}) == "Tune of The Day"
+    # A real title (signed out) is left for normalize_title, engagement prefix and all.
+    assert a.title({**info, "title": "456K views | Tune"}) == "456K views | Tune"
+    # Nothing better on the page: keep what yt-dlp gave.
+    assert a.title({"title": "Facebook", "description": None}) == "Facebook"
+
+
+def test_facebook_title_from_a_long_description_is_the_whole_line_after_cleaning():
+    # Dev UAT: a cut with "…" came out of normalize_title as "… live at." (NFKC "..." collapsed to "."),
+    # a sentence that seemed to end. The whole first line survives the cleaning intact instead.
+    line = 'Tune of The Day, Argy playing his version of the classic "Resurrection" with Paul Oakenfold live at Space'
+    assert normalize_title(FacebookAdapter().title({"title": "Video", "description": line})) == line

backend/tests/test_auth_session.py

@@ -12,6 +12,7 @@ Note: `/api/me` is the bootstrap probe — it returns 200 `{authenticated: False
 
 from datetime import timedelta
 
+import pytest
 from fastapi.testclient import TestClient
 
 from app.auth import ACTIVE_ACCOUNT_HEADER
@@ -57,6 +58,75 @@ def test_a_non_wallet_account_header_falls_back_to_the_default(client, make_user
     assert me.json()["email"] == "alice2@example.com"  # still Alice, not Mallory
 
 
+def test_a_tab_pinned_to_an_account_signed_out_elsewhere_acts_as_nobody(client, make_user):
+    # Two accounts in one browser: a tab pinned to Alice, Bob the default. Alice signs out in another
+    # tab. The pinned tab used to go on acting as the default, Bob — its player checkpoints and pref
+    # saves landed in his account, and its own Sign out signed HIM out.
+    alice = make_user(email="alice3@example.com", password=_PW)
+    make_user(email="bob3@example.com", password=_PW)
+    assert _login(client, "alice3@example.com", _PW).status_code == 200
+    assert _login(client, "bob3@example.com", _PW).status_code == 200  # Bob is now the default
+    tab = {ACTIVE_ACCOUNT_HEADER: str(alice.id)}
+    assert client.get("/api/feed", headers=tab).status_code == 200
+    assert client.post("/auth/logout", headers=tab).status_code == 200  # Alice signs out
+
+    assert client.get("/api/feed", headers=tab).status_code == 401
+    assert client.post("/auth/logout", headers=tab).status_code == 200
+    assert client.get("/api/feed").status_code == 200  # Bob is still signed in, the session intact
+    # The bootstrap probe still answers as the default: how the stale tab learns who it is now.
+    assert client.get("/api/me", headers=tab).json()["email"] == "bob3@example.com"
+
+
+@pytest.mark.parametrize("ended", ["revoked", "suspended"])
+def test_a_tab_pinned_to_an_account_whose_session_ended_comes_back_as_the_default(
+    client, make_user, db, ended
+):
+    # A tab pinned to Alice, Bob the default. Alice's session then ends while she is still in this
+    # browser's wallet ("log out everywhere" on another device, or an admin suspends her). The tab's
+    # bootstrap probe used to answer "signed out": the landing page with Bob still signed in, and no way
+    # off it but closing the tab (signing in as anyone else there kept the tab pinned to Alice).
+    alice = make_user(email="alice4@example.com", password=_PW)
+    make_user(email="bob4@example.com", password=_PW)
+    assert _login(client, "alice4@example.com", _PW).status_code == 200
+    assert _login(client, "bob4@example.com", _PW).status_code == 200
+    tab = {ACTIVE_ACCOUNT_HEADER: str(alice.id)}
+    assert client.get("/api/feed", headers=tab).status_code == 200
+    if ended == "revoked":
+        alice.session_epoch = (alice.session_epoch or 0) + 1
+    else:
+        alice.is_suspended = True
+    db.commit()
+
+    assert client.get("/api/me", headers=tab).json()["email"] == "bob4@example.com"
+    assert client.get("/api/feed", headers=tab).status_code == 401  # still nobody, never Bob
+    assert client.get("/api/feed").status_code == 200  # Bob's session is intact
+
+
+@pytest.mark.parametrize("ended", ["revoked", "suspended", "deactivated"])
+def test_switching_to_an_account_whose_session_ended_refuses_it_and_drops_it_from_the_list(
+    client, make_user, db, monkeypatch, ended
+):
+    # The account switcher lists this browser's wallet. A revoked account was dropped from it on a refused
+    # switch, but a suspended one stayed, refused on every click; a deactivated one was not refused at all —
+    # made the default, the next request found it inactive and signed every account here out.
+    monkeypatch.setattr("app.routes.me.is_allowed", lambda _db, _email: True)  # both hold an invite
+    alice = make_user(email="alice5@example.com", password=_PW)
+    make_user(email="bob5@example.com", password=_PW)
+    assert _login(client, "alice5@example.com", _PW).status_code == 200
+    assert _login(client, "bob5@example.com", _PW).status_code == 200
+    if ended == "revoked":
+        alice.session_epoch = (alice.session_epoch or 0) + 1
+    elif ended == "suspended":
+        alice.is_suspended = True
+    else:
+        alice.is_active = False
+    db.commit()
+
+    assert client.post("/api/me/switch", json={"user_id": alice.id}).status_code == 403
+    assert [a["email"] for a in client.get("/api/me/accounts").json()] == ["bob5@example.com"]
+    assert client.get("/api/feed").status_code == 200  # Bob is still signed in
+
+
 def test_logout_others_revokes_the_other_session_but_keeps_the_caller(client, make_user):
     # Two independent cookie jars (browsers) signed into the same account. `logout-others` from one
     # bumps the account epoch so the OTHER's cookie is rejected on its next request, while the caller

backend/tests/test_download_credentials.py

@@ -18,7 +18,7 @@ from cryptography.fernet import Fernet
 
 from app import security
 from app.downloads import credentials, formats, service
-from app.models import DownloadCredential, MediaAsset, User
+from app.models import DownloadCredential, DownloadJob, MediaAsset, User
 
 
 @pytest.fixture(autouse=True)
@@ -39,13 +39,23 @@ class TestHostKeyForUrl:
         assert credentials.host_key_for_url("https://www.facebook.com/watch?v=1") == "facebook"
         assert credentials.host_key_for_url("https://fb.watch/abc/") == "facebook"
         assert credentials.host_key_for_url("https://x.com/i/status/1") == "twitter"
+        # YouTube gates individual videos behind its bot check; the cookie is the only way past it.
+        for url in (
+            "https://www.youtube.com/watch?v=abc",
+            "https://youtu.be/abc",
+            "https://music.youtube.com/watch?v=abc",
+            "https://www.youtube-nocookie.com/embed/abc",
+        ):
+            assert credentials.host_key_for_url(url) == "youtube", url
 
     def test_look_alike_host_never_matches(self):
         assert credentials.host_key_for_url("https://myfacebook.com/x") is None
         assert credentials.host_key_for_url("https://facebook.com.evil.test/x") is None
+        assert credentials.host_key_for_url("https://notyoutube.com/watch?v=abc") is None
+        assert credentials.host_key_for_url("https://youtube.com.evil.test/x") is None
 
     def test_unrelated_or_empty_url_has_no_host_key(self):
-        assert credentials.host_key_for_url("https://www.youtube.com/watch?v=abc") is None
+        assert credentials.host_key_for_url("https://vimeo.com/123456") is None
         assert credentials.host_key_for_url("") is None
         assert credentials.host_key_for_url(None) is None
 
@@ -72,6 +82,21 @@ def test_authed_sig_differs_per_user_and_from_the_shared_sig():
     assert a != shared and b != shared and a != b
 
 
+def test_an_authed_asset_queued_before_a_signature_version_bump_still_gets_its_cookie(monkeypatch):
+    # A job keeps the asset it was queued with. A deploy that bumps the signature version between the
+    # queueing and the download used to make the user's private asset stop counting as theirs, so the
+    # download went without its cookie and failed on the login wall.
+    spec = formats.normalize({"mode": "a"})
+    queued = MediaAsset(format_sig=credentials.authed_format_sig(spec, 1, "facebook"))
+    rebuild = credentials.rebuild_salt(7, credentials.cookie_salt(1, "facebook"))
+    rebuilt = MediaAsset(id=7, format_sig=formats.format_sig(spec, salt=rebuild))
+    monkeypatch.setattr(formats, "_AUDIO_SIG_VERSION", formats._AUDIO_SIG_VERSION + 1)  # the deploy
+
+    for asset in (queued, rebuilt):
+        assert credentials.is_authed_asset(asset, spec, 1, FB_URL)
+        assert not credentials.is_authed_asset(asset, spec, 2, FB_URL)  # still private to its user
+
+
 def test_write_cookiefile_is_private_and_survives_the_retry_wipe(tmp_path):
     staging = tmp_path / "staging"
     staging.mkdir()
@@ -160,6 +185,22 @@ class TestCachePrivacy:
         asset = db.get(MediaAsset, job.asset_id)
         assert asset.format_sig == formats.format_sig(formats.normalize({}))
 
+    def test_a_youtube_job_reaches_the_gate_through_its_rebuilt_watch_url(self, db):
+        # The one join nothing else makes. A YouTube job stores a bare 11-char ref, and the URL the
+        # cookie gate keys on is REBUILT by the adapter (service.source_url -> YouTubeAdapter). Both
+        # ends are pinned apart — the watch-URL shape in test_adapters, the host_key in
+        # TestHostKeyForUrl — so this welds them: an enqueue that ever handed the gate the raw ref
+        # would silently stop salting, every YouTube cookie would quietly stop being attached, and
+        # signed-out downloads would keep working, so nothing else here would go red.
+        u = _user(db)
+        credentials.upsert_credential(db, u.id, "youtube", COOKIES)
+        db.commit()
+        job = service.enqueue(db, u.id, "youtube", "VIDID12345_", {})
+        asset = db.get(MediaAsset, job.asset_id)
+        spec = formats.normalize({})
+        assert asset.format_sig == credentials.authed_format_sig(spec, u.id, "youtube")
+        assert asset.format_sig != formats.format_sig(spec)
+
     def test_two_users_never_share_the_authed_asset(self, db):
         a = _user(db, "a@example.com")
         b = _user(db, "b@example.com")
@@ -189,7 +230,9 @@ class TestResolveCookiefile:
         db.commit()
         spec = formats.normalize({})
         salted = credentials.authed_format_sig(spec, u.id, "facebook")
-        path = credentials.resolve_cookiefile(db, u.id, FB_URL, salted, spec, tmp_path)
+        path = credentials.resolve_cookiefile(
+            db, u.id, FB_URL, self._asset_sig(salted), spec, tmp_path
+        )
         assert path is not None and Path(path).read_text() == COOKIES
 
     def test_never_attaches_to_a_shared_asset(self, db, tmp_path):
@@ -200,23 +243,176 @@ class TestResolveCookiefile:
         db.commit()
         spec = formats.normalize({})
         shared = formats.format_sig(spec)
-        assert credentials.resolve_cookiefile(db, u.id, FB_URL, shared, spec, tmp_path) is None
+        assert (
+            credentials.resolve_cookiefile(
+                db, u.id, FB_URL, self._asset_sig(shared), spec, tmp_path
+            )
+            is None
+        )
 
     def test_non_matching_host_gets_no_cookie(self, db, tmp_path):
         u = _user(db)
         credentials.upsert_credential(db, u.id, "facebook", COOKIES)
         db.commit()
         spec = formats.normalize({})
-        # A YouTube URL has no supported host_key -> no cookie regardless of what's stored.
-        yt = "https://www.youtube.com/watch?v=abc"
+        # A URL of ANOTHER host (supported or not) never gets this credential's cookie. YouTube is
+        # a supported host in its own right now, so the case needs a host that is not.
+        other = "https://vimeo.com/123456"
         salted = credentials.authed_format_sig(spec, u.id, "facebook")
-        assert credentials.resolve_cookiefile(db, u.id, yt, salted, spec, tmp_path) is None
+        assert (
+            credentials.resolve_cookiefile(db, u.id, other, self._asset_sig(salted), spec, tmp_path)
+            is None
+        )
+        # ...and a YouTube link gets nothing either: the stored credential is Facebook's.
+        yt = "https://www.youtube.com/watch?v=abc"
+        assert (
+            credentials.resolve_cookiefile(db, u.id, yt, self._asset_sig(salted), spec, tmp_path)
+            is None
+        )
 
     def test_no_credential_gets_no_cookie(self, db, tmp_path):
         u = _user(db)
         spec = formats.normalize({})
         salted = credentials.authed_format_sig(spec, u.id, "facebook")
-        assert credentials.resolve_cookiefile(db, u.id, FB_URL, salted, spec, tmp_path) is None
+        assert (
+            credentials.resolve_cookiefile(
+                db, u.id, FB_URL, self._asset_sig(salted), spec, tmp_path
+            )
+            is None
+        )
+
+
+# --- Retry / Re-download take a cookie added later (DB) -----------------------------------------
+# Measured on dev (E11.5): a Facebook reel failed on the login wall, the user added their cookie as
+# the failure copy tells them to, pressed Retry — and it failed again, because the job still held the
+# shared asset the worker never attaches a cookie to. Re-download forked a salt the gate could not
+# recognise, so even a job downloaded WITH a cookie rebuilt without it.
+
+
+def _held_job(db, u, *, sig, asset_status="error", job_status="error"):
+    a = MediaAsset(
+        source_kind="url", source_ref=FB_URL, format_sig=sig, status=asset_status, ref_count=1
+    )
+    db.add(a)
+    db.flush()
+    j = DownloadJob(
+        user_id=u.id,
+        asset_id=a.id,
+        source_kind="url",
+        source_ref=FB_URL,
+        status=job_status,
+        queue_pos=0,
+        profile_snapshot={},
+    )
+    db.add(j)
+    db.commit()
+    return a, j
+
+
+class TestRequeueTakesTheCookie:
+    spec = formats.normalize({})
+
+    @pytest.mark.parametrize(
+        ("asset_status", "job_status"),
+        # A failed download; and a job paused before it ever started (its asset never downloaded).
+        [("error", "error"), ("pending", "paused")],
+    )
+    def test_retry_after_adding_a_cookie_moves_the_job_to_the_private_asset(
+        self, db, tmp_path, asset_status, job_status
+    ):
+        u = _user(db)
+        shared, j = _held_job(
+            db,
+            u,
+            sig=formats.format_sig(self.spec),
+            asset_status=asset_status,
+            job_status=job_status,
+        )
+        credentials.upsert_credential(db, u.id, "facebook", COOKIES)
+        db.commit()
+
+        service.resume(db, j)
+
+        db.expire_all()
+        job = db.get(DownloadJob, j.id)
+        target = db.get(MediaAsset, job.asset_id)
+        assert job.status == "queued" and target.id != shared.id
+        assert target.format_sig == credentials.authed_format_sig(self.spec, u.id, "facebook")
+        assert (target.status, target.ref_count) == ("pending", 1)
+        assert db.get(MediaAsset, shared.id).ref_count == 0  # the old hold went with the move
+        assert credentials.resolve_cookiefile(db, u.id, FB_URL, target, self.spec, tmp_path)
+
+    def test_retry_without_a_cookie_keeps_the_shared_asset(self, db):
+        u = _user(db)
+        shared, j = _held_job(db, u, sig=formats.format_sig(self.spec))
+
+        service.resume(db, j)
+
+        db.expire_all()
+        assert db.get(DownloadJob, j.id).asset_id == shared.id
+        assert db.get(MediaAsset, shared.id).ref_count == 1
+
+    @pytest.mark.parametrize(
+        ("asset_status", "job_status"), [("ready", "error"), ("downloading", "paused")]
+    )
+    def test_retry_never_moves_off_a_file_or_a_download_in_flight(
+        self, db, asset_status, job_status
+    ):
+        u = _user(db)
+        shared, j = _held_job(
+            db,
+            u,
+            sig=formats.format_sig(self.spec),
+            asset_status=asset_status,
+            job_status=job_status,
+        )
+        credentials.upsert_credential(db, u.id, "facebook", COOKIES)
+        db.commit()
+
+        service.resume(db, j)
+
+        db.expire_all()
+        assert db.get(DownloadJob, j.id).asset_id == shared.id
+
+    def test_redownload_with_a_cookie_rebuilds_into_an_asset_the_cookie_goes_with(
+        self, db, tmp_path
+    ):
+        u = _user(db)
+        other = _user(db, "other@example.com")
+        credentials.upsert_credential(db, u.id, "facebook", COOKIES)
+        credentials.upsert_credential(db, other.id, "facebook", COOKIES)
+        authed = credentials.authed_format_sig(self.spec, u.id, "facebook")
+        first, j = _held_job(db, u, sig=authed, asset_status="ready", job_status="done")
+
+        seen = {first.id}
+        for _ in range(2):  # a rebuild of a rebuild is still recognised
+            service.redownload(db, j)
+            db.expire_all()
+            job = db.get(DownloadJob, j.id)
+            target = db.get(MediaAsset, job.asset_id)
+            assert target.id not in seen and target.format_sig != authed
+            seen.add(target.id)
+            assert credentials.resolve_cookiefile(db, u.id, FB_URL, target, self.spec, tmp_path)
+            # Private: another user's cookie is never attached to it.
+            assert not credentials.is_authed_asset(target, self.spec, other.id, FB_URL)
+
+        # A Retry of a failed rebuild keeps the rebuild — it is already the cookie's identity.
+        target.status, job.status = "error", "error"
+        db.commit()
+        service.resume(db, job)
+        db.expire_all()
+        assert db.get(DownloadJob, j.id).asset_id == target.id
+
+    def test_a_rebuild_made_without_a_cookie_is_no_cookie_identity(self, db, tmp_path):
+        u = _user(db)
+        _, j = _held_job(db, u, sig=formats.format_sig(self.spec))
+        service.redownload(db, j)
+        credentials.upsert_credential(db, u.id, "facebook", COOKIES)
+        db.commit()
+
+        db.expire_all()
+        target = db.get(MediaAsset, db.get(DownloadJob, j.id).asset_id)
+        assert not credentials.is_authed_asset(target, self.spec, u.id, FB_URL)
 
 
 # --- API: write-only, never echoes the blob (DB) ----------------------------------------------

backend/tests/test_download_errors.py

@@ -1,5 +1,6 @@
 """Category classification of raw yt-dlp / ffmpeg download-failure strings (S2)."""
 
+from app.downloads import adapters
 from app.downloads import errors as dlerrors
 from app.downloads.errors import classify
 
@@ -64,6 +65,164 @@ def test_our_own_worker_refusals_classify_as_themselves():
     assert classify(dlerrors.QUOTA_FULL_MESSAGE) == "quota_exceeded"
 
 
+def test_the_redacted_network_text_classifies_back_to_network():
+    # The redacted text is also what a failed asset keeps, and a second job that meets that asset is
+    # diagnosed from it — without its own rule it would read "Download failed".
+    assert classify(dlerrors.NETWORK_REDACTED_MESSAGE) == "network"
+
+
+# Verbatim yt-dlp 2026.07.04 output from prod jobs, measured on dev 2026-09-13 (E11.5).
+_FB_PARSE = (
+    "ERROR: [facebook] 1736360027626346: Cannot parse data; please report this issue on  "
+    "https://github.com/yt-dlp/yt-dlp/issues?q= , filling out the appropriate issue template."
+)
+_FB_NO_FORMATS = (
+    "ERROR: [facebook] 1755988225525547: No video formats found!; please report this issue on  "
+    "https://github.com/yt-dlp/yt-dlp/issues?q= , filling out the appropriate issue template."
+)
+_REEL = "https://www.facebook.com/reel/1736360027626346/?fs=e&fs=e"
+_GROUP_POST = "https://www.facebook.com/groups/983554479435596/permalink/1755988225525547/?"
+
+
+# Verbatim from prod job 273 (2026-09-15). YouTube writes the apostrophe as U+2019, which is why
+# neither the rule nor the catalog entry may spell out "you’re" with a straight quote.
+_YT_BOT_WALL = (
+    "ERROR: [youtube] 7JPmS_bWjhI: Sign in to confirm you’re not a bot. Use "
+    "--cookies-from-browser or --cookies for the authentication. See  "
+    "https://github.com/yt-dlp/yt-dlp/wiki/FAQ#how-do-i-pass-cookies-to-yt-dlp  for how to manually "
+    "pass cookies."
+)
+_YT = "https://www.youtube.com/watch?v=7JPmS_bWjhI"
+
+
+def test_youtube_bot_wall_is_that_video_own_signed_out_gate():
+    # Measured on prod: all 12 player clients fail on this video while its neighbours download, the
+    # POT sidecar answers, and the newest yt-dlp fails identically — a cookie is the only way in.
+    assert classify(_YT_BOT_WALL) == "login_required"
+    for url in (
+        _YT,
+        "https://youtu.be/7JPmS_bWjhI",
+        "https://www.youtube-nocookie.com/embed/7JPmS_bWjhI",
+        "https://music.youtube.com/watch?v=7JPmS_bWjhI",
+    ):
+        assert dlerrors.diagnose(_YT_BOT_WALL, url=url) == (
+            "login_required",
+            "youtube.bot_wall",
+        ), url
+
+
+def test_youtube_bot_wall_with_a_cookie_is_the_cookie_refused():
+    # Telling a user who already gave a cookie to add one is what this entry exists to avoid.
+    assert dlerrors.diagnose(_YT_BOT_WALL, url=_YT, cookie_attached=True) == (
+        "login_required",
+        "youtube.cookie_rejected",
+    )
+
+
+# Verbatim from the isolated test stack (2026-09-16), the SAME video ~90 minutes later: yt-dlp got
+# the player response and picked formats, and the CDN then refused the stream.
+_YT_MEDIA_403 = "ERROR: unable to download video data: HTTP Error 403: Forbidden"
+
+
+def test_youtube_media_403_is_the_wall_one_step_later_not_a_network_fault():
+    # Generically this text is a network failure — and for every other host it stays one.
+    assert classify(_YT_MEDIA_403) == "network"
+    assert dlerrors.diagnose(_YT_MEDIA_403, url="https://vimeo.com/1") == ("network", None)
+    # On a signed-out YouTube download it is the gate: measured, the same video downloaded in full
+    # once the owner's cookie was attached. Calling that "network error" is the honest-states bug.
+    assert dlerrors.diagnose(_YT_MEDIA_403, url=_YT) == (
+        "login_required",
+        "youtube.media_forbidden",
+    )
+
+
+def test_youtube_media_403_with_a_cookie_is_not_claimed_as_the_gate():
+    # Only the cookie-less case was measured. With a cookie the same text keeps its bare category
+    # rather than telling a signed-in user to sign in.
+    assert dlerrors.diagnose(_YT_MEDIA_403, url=_YT, cookie_attached=True) == ("network", None)
+
+
+def test_the_youtube_entries_never_match_another_site():
+    # Host-scoped: the same words about a Facebook link stay the bare category.
+    assert dlerrors.diagnose(
+        "ERROR: [facebook] 1: Sign in to confirm you’re not a bot",
+        url="https://www.facebook.com/reel/1/",
+    ) == ("login_required", None)
+
+
+def test_facebook_cannot_parse_data_is_the_login_wall_without_a_cookie():
+    for url in (
+        _REEL,
+        _GROUP_POST,
+        "https://fb.watch/Ia_iJYI2Vw/?fs=e",
+        "https://m.facebook.com/x",
+    ):
+        assert dlerrors.diagnose(_FB_PARSE, url=url) == ("login_required", "facebook.login_wall")
+
+
+def test_facebook_cannot_parse_data_with_a_cookie_is_the_cookie_refused():
+    # Telling a user who already gave a cookie to add one is the failure this entry exists to avoid.
+    assert dlerrors.diagnose(_FB_PARSE, url=_REEL, cookie_attached=True) == (
+        "login_required",
+        "facebook.cookie_rejected",
+    )
+
+
+def test_a_facebook_group_post_without_formats_names_the_link():
+    # Without a cookie yt-dlp is given the post link itself (measured, prod jobs 66 and 145).
+    assert dlerrors.diagnose(_FB_NO_FORMATS, url=_GROUP_POST) == (
+        "format_unavailable",
+        "facebook.group_post_video",
+    )
+    # With one it is only ever given the post's VIDEO link, so the text is about that video: the adapter
+    # found it, and "this post has no video" would be false.
+    assert dlerrors.diagnose(_FB_NO_FORMATS, url=_GROUP_POST, cookie_attached=True) == (
+        "format_unavailable",
+        None,
+    )
+    # A reel, or a group link that is not a post, is another failure: only the category.
+    for url in (_REEL, "https://www.facebook.com/groups/983554479435596/"):
+        assert dlerrors.diagnose(_FB_NO_FORMATS, url=url) == ("format_unavailable", None), url
+
+
+def test_our_post_not_shown_verdict_is_the_refused_cookie():
+    # The adapter's text when a signed-in read of the post got a page without the post (the login page).
+    msg = adapters.POST_NOT_SHOWN_MESSAGE
+    assert classify(msg) == "login_required"
+    assert dlerrors.diagnose(msg, url=_GROUP_POST, cookie_attached=True) == (
+        "login_required",
+        "facebook.cookie_rejected",
+    )
+
+
+def test_our_post_without_a_video_verdict_names_the_group_link():
+    # The adapter's own text when the post page holds no single video (S4): the message and its rule and
+    # catalog entry are pinned together, or an edit to the wording orphans the copy.
+    msg = adapters.POST_WITHOUT_VIDEO_MESSAGE
+    assert classify(msg) == "format_unavailable"
+    assert dlerrors.diagnose(msg, url=_GROUP_POST, cookie_attached=True) == (
+        "format_unavailable",
+        "facebook.group_post_video",
+    )
+    assert dlerrors.diagnose(msg, url=_REEL, cookie_attached=True) == ("format_unavailable", None)
+
+
+def test_a_catalog_entry_never_leaves_its_host():
+    # "Cannot parse data" is yt-dlp's wording for a broken extractor on every site.
+    other = _FB_PARSE.replace("[facebook]", "[vimeo]")
+    assert dlerrors.diagnose(other, url="https://vimeo.com/1") == ("unknown", None)
+    # The Facebook text for a link that is not Facebook's (a look-alike host) is not the Facebook wall.
+    assert dlerrors.diagnose(_FB_PARSE, url="https://facebook.com.evil/reel/1") == ("unknown", None)
+    # No link known: the category only.
+    assert dlerrors.diagnose(_FB_PARSE) == ("unknown", None)
+
+
+def test_diagnose_falls_back_to_the_category():
+    msg = "ERROR: [facebook] 123: You must be logged in to see this post"
+    assert dlerrors.diagnose(msg, url=_REEL) == ("login_required", None)
+    assert dlerrors.diagnose(None, url=_REEL) == ("unknown", None)
+
+
 def test_a_url_jobs_network_failure_is_redacted_but_youtube_keeps_its_text():
     # SEC-12: the raw transport text for a user-chosen host:port is a port-scanner readout, so it is
     # replaced for `url` jobs. Everything else must survive verbatim, or a real diagnosis is lost.

backend/tests/test_download_failure_catalog.py

@@ -0,0 +1,444 @@
+"""DB-backed tests for the download failure catalog (E11.5 S1) at the places a failure is WRITTEN.
+
+`test_download_errors` pins which entry a message matches; these pin that every writer hands the
+matcher what it needs — the link and whether the user's cookie went with it — and that a stored entry
+never outlives the failure it describes:
+- the download child's failure branch (`pipeline._download`);
+- a second job meeting an already-failed asset (`worker._process_job`), which only has the text;
+- Retry / Re-download, which requeue the job;
+- the `0084` backfill of the rows that failed before the catalog existed;
+- the downloads list, which is how the entry reaches the UI.
+It also holds the one success-path check of the same child: the duration it stores (E11.5 S3).
+"""
+
+import shutil
+import subprocess
+
+import pytest
+from alembic import command
+from alembic.config import Config
+from cryptography.fernet import Fernet
+from sqlalchemy import text
+
+from app import security
+from app.config import settings
+from app.db import engine
+from app.downloads import credentials, formats, pipeline, service
+from app.models import DownloadJob, DownloadQuota, MediaAsset, User
+from app.worker import _process_job
+
+_REEL = "https://www.facebook.com/reel/1736360027626346/?fs=e&fs=e"
+# Verbatim yt-dlp 2026.07.04, prod job 256.
+_FB_PARSE = (
+    "ERROR: [facebook] 1736360027626346: Cannot parse data; please report this issue on  "
+    "https://github.com/yt-dlp/yt-dlp/issues?q= , filling out the appropriate issue template."
+)
+_COOKIES = "# Netscape HTTP Cookie File\n.facebook.com\tTRUE\t/\tTRUE\t0\tc_user\t123\n"
+
+
+@pytest.fixture
+def _fernet(monkeypatch):
+    # A throwaway key, so a stored credential encrypts and decrypts (mirrors test_download_credentials).
+    monkeypatch.setattr(security, "_fernet", Fernet(Fernet.generate_key()))
+
+
+def _user(db, email):
+    u = User(email=email)
+    db.add(u)
+    db.flush()
+    db.add(
+        DownloadQuota(
+            user_id=u.id, max_bytes=10**12, max_concurrent=5, max_jobs=10**6, unlimited=True
+        )
+    )
+    return u
+
+
+def _asset_and_job(db, user, *, sig, asset_status, job_status, error=None):
+    a = MediaAsset(
+        source_kind="url",
+        source_ref=_REEL,
+        format_sig=sig,
+        status=asset_status,
+        error=error,
+        ref_count=1,
+    )
+    db.add(a)
+    db.flush()
+    j = DownloadJob(
+        user_id=user.id,
+        asset_id=a.id,
+        source_kind="url",
+        source_ref=_REEL,
+        status=job_status,
+        queue_pos=0,
+        profile_snapshot={},
+    )
+    db.add(j)
+    db.commit()
+    return a, j
+
+
+def _fail_the_child(monkeypatch, tmp_path, *, cookie: bool):
+    monkeypatch.setattr(settings, "download_root", str(tmp_path))
+    monkeypatch.setattr(pipeline.urlguard, "check_url", lambda url: None)
+    cookiefile = tmp_path / "cookies.txt"
+    cookiefile.write_text("# Netscape HTTP Cookie File\n")
+    monkeypatch.setattr(
+        pipeline.credentials,
+        "resolve_cookiefile",
+        lambda *a, **k: cookiefile if cookie else None,
+    )
+
+    def extract(*a, **k):
+        raise RuntimeError(_FB_PARSE)
+
+    monkeypatch.setattr(pipeline, "_extract_with_fallback", extract)
+
+
+def test_the_download_child_diagnoses_with_the_link_and_no_cookie(db, monkeypatch, tmp_path):
+    u = _user(db, "fb-nocookie@example.com")
+    a, j = _asset_and_job(db, u, sig="shared", asset_status="downloading", job_status="running")
+    _fail_the_child(monkeypatch, tmp_path, cookie=False)
+
+    pipeline._download(j.id, a.id, "url", _REEL, {}, u.id)
+
+    db.expire_all()
+    job = db.get(DownloadJob, j.id)
+    assert (job.status, job.error_code, job.error_detail) == (
+        "error",
+        "login_required",
+        "facebook.login_wall",
+    )
+
+
+def test_the_download_child_knows_the_cookie_went_with_it(db, monkeypatch, tmp_path):
+    # The same text with the user's cookie attached: telling them to add cookies would be wrong.
+    u = _user(db, "fb-cookie@example.com")
+    a, j = _asset_and_job(db, u, sig="private", asset_status="downloading", job_status="running")
+    _fail_the_child(monkeypatch, tmp_path, cookie=True)
+
+    pipeline._download(j.id, a.id, "url", _REEL, {}, u.id)
+
+    db.expire_all()
+    job = db.get(DownloadJob, j.id)
+    assert (job.error_code, job.error_detail) == ("login_required", "facebook.cookie_rejected")
+
+
+def test_a_job_meeting_a_failed_shared_asset_gets_the_same_explanation(db):
+    # Before the catalog this path wrote the text and NO code: "Download failed" for the second
+    # job, "Facebook sign-in required" for the first.
+    u = _user(db, "fb-second@example.com")
+    _, j = _asset_and_job(
+        db, u, sig="shared", asset_status="error", job_status="running", error=_FB_PARSE
+    )
+
+    _process_job(j.id)
+
+    db.expire_all()
+    job = db.get(DownloadJob, j.id)
+    assert (job.status, job.error_code, job.error_detail) == (
+        "error",
+        "login_required",
+        "facebook.login_wall",
+    )
+
+
+def test_a_job_meeting_its_users_failed_private_asset_knows_the_cookie_was_used(db, _fernet):
+    u = _user(db, "fb-private@example.com")
+    credentials.upsert_credential(db, u.id, "facebook", _COOKIES)
+    sig = credentials.authed_format_sig(formats.normalize({}), u.id, "facebook")
+    _, j = _asset_and_job(
+        db, u, sig=sig, asset_status="error", job_status="running", error=_FB_PARSE
+    )
+
+    _process_job(j.id)
+
+    db.expire_all()
+    job = db.get(DownloadJob, j.id)
+    assert (job.error_code, job.error_detail) == ("login_required", "facebook.cookie_rejected")
+
+
+def test_a_private_asset_the_cookie_could_not_go_with_is_explained_as_the_download_had_it(db):
+    # The cookie was deleted (or can no longer be decrypted) after the jobs were queued: the download
+    # child had nothing to attach and said "add your cookies". The job meeting that failed asset must say
+    # the same — the asset's salt alone would have told it "your cookies were refused".
+    u = _user(db, "fb-gone@example.com")
+    sig = credentials.authed_format_sig(formats.normalize({}), u.id, "facebook")
+    _, j = _asset_and_job(
+        db, u, sig=sig, asset_status="error", job_status="running", error=_FB_PARSE
+    )
+
+    _process_job(j.id)
+
+    db.expire_all()
+    job = db.get(DownloadJob, j.id)
+    assert (job.error_code, job.error_detail) == ("login_required", "facebook.login_wall")
+
+
+def test_a_job_canceled_before_it_meets_a_failed_asset_stays_canceled(db):
+    # The cancel landed between the claim and this write. `error` would hold the asset again after the
+    # route already released it — a later delete releases twice.
+    u = _user(db, "fb-canceled@example.com")
+    _, j = _asset_and_job(
+        db, u, sig="shared", asset_status="error", job_status="canceled", error=_FB_PARSE
+    )
+
+    _process_job(j.id)
+
+    db.expire_all()
+    job = db.get(DownloadJob, j.id)
+    assert (job.status, job.error_code, job.error_detail) == ("canceled", None, None)
+
+
+def test_the_downloads_list_carries_the_catalog_entry(db, as_user):
+    # The whole explanation rides on this one field: without it every row falls back to the category.
+    u = _user(db, "fb-list@example.com")
+    _, j = _asset_and_job(
+        db, u, sig="shared", asset_status="error", job_status="error", error=_FB_PARSE
+    )
+    j.error_code, j.error_detail = "login_required", "facebook.login_wall"
+    db.commit()
+
+    [row] = as_user(u).get("/api/downloads").json()
+
+    assert (row["error_code"], row["error_detail"]) == ("login_required", "facebook.login_wall")
+
+
+@pytest.mark.skipif(shutil.which("ffmpeg") is None, reason="ffmpeg not available")
+def test_a_download_yt_dlp_gave_no_duration_stores_the_files_duration(db, monkeypatch, tmp_path):
+    # Facebook reel 257 (E11.5): yt-dlp's info had no duration, the asset stored NULL, and the Library
+    # row lost its trim action. Through the real finalize, with a real 3-second file.
+    u = _user(db, "fb-duration@example.com")
+    a, j = _asset_and_job(db, u, sig="shared", asset_status="downloading", job_status="running")
+    monkeypatch.setattr(settings, "download_root", str(tmp_path))
+    monkeypatch.setattr(pipeline.urlguard, "check_url", lambda url: None)
+
+    def extract(job_id, asset_id, url, spec, staging, adapter, **kwargs):
+        media = staging / "1736360027626346.mp4"
+        subprocess.run(
+            [
+                "ffmpeg",
+                "-y",
+                "-loglevel",
+                "error",
+                "-f",
+                "lavfi",
+                "-i",
+                "testsrc=size=64x64:rate=10",
+                "-f",
+                "lavfi",
+                "-i",
+                "sine=frequency=440",
+                "-t",
+                "3",
+                "-c:v",
+                "libx264",
+                "-pix_fmt",
+                "yuv420p",
+                "-c:a",
+                "aac",
+                str(media),
+            ],
+            check=True,
+        )
+        return {"id": "1736360027626346", "ext": "mp4", "title": "Reel", "filepath": str(media)}
+
+    monkeypatch.setattr(pipeline, "_extract_with_fallback", extract)
+
+    pipeline._download(j.id, a.id, "url", _REEL, {}, u.id)
+
+    db.expire_all()
+    assert db.get(DownloadJob, j.id).status == "done"
+    assert db.get(MediaAsset, a.id).duration_s == 3
+
+
+def test_retry_and_redownload_drop_the_old_explanation(db):
+    u = _user(db, "fb-requeue@example.com")
+    for requeue in (service.resume, service.redownload):
+        _, j = _asset_and_job(
+            db, u, sig=f"s-{requeue.__name__}", asset_status="error", job_status="error"
+        )
+        j.error, j.error_code, j.error_detail = _FB_PARSE, "login_required", "facebook.login_wall"
+        db.commit()
+
+        requeue(db, j)
+
+        db.refresh(j)
+        assert (j.status, j.error_code, j.error_detail) == ("queued", None, None), requeue.__name__
+
+
+def test_0084_backfills_only_the_facebook_parse_failures_it_measured(db):
+    cfg = Config("alembic.ini")
+    command.downgrade(cfg, "0083_comfort_pins")
+    upgraded = False
+    try:
+        with engine.begin() as conn:
+            uid = conn.execute(
+                text("INSERT INTO users (email) VALUES ('backfill@example.com') RETURNING id")
+            ).scalar_one()
+            rows = {
+                "fb_unknown": ("error", "unknown", _FB_PARSE),
+                "fb_null": ("canceled", None, _FB_PARSE),
+                "other_site": ("error", "unknown", _FB_PARSE.replace("[facebook]", "[vimeo]")),
+                "fb_other_code": ("error", "network", _FB_PARSE),
+            }
+            ids = {}
+            for name, (status, code, error) in rows.items():
+                ids[name] = conn.execute(
+                    text(
+                        "INSERT INTO download_jobs (user_id, source_kind, source_ref, "
+                        "profile_snapshot, status, error_code, error) "
+                        "VALUES (:u, 'url', :ref, '{}', :s, :c, :e) RETURNING id"
+                    ),
+                    {"u": uid, "ref": _REEL, "s": status, "c": code, "e": error},
+                ).scalar_one()
+        command.upgrade(cfg, "head")
+        upgraded = True
+        with engine.connect() as conn:
+            got = {
+                name: tuple(
+                    conn.execute(
+                        text("SELECT error_code, error_detail FROM download_jobs WHERE id = :i"),
+                        {"i": i},
+                    ).one()
+                )
+                for name, i in ids.items()
+            }
+        assert got == {
+            "fb_unknown": ("login_required", "facebook.login_wall"),
+            "fb_null": ("login_required", "facebook.login_wall"),
+            "other_site": ("unknown", None),
+            "fb_other_code": ("network", None),
+        }
+    finally:
+        if not upgraded:
+            command.upgrade(cfg, "head")
+
+
+def _ffmpeg_media(path, *codec_args):
+    subprocess.run(
+        ["ffmpeg", "-y", "-loglevel", "error", "-f", "lavfi", "-i", "sine=frequency=440"]
+        + list(codec_args)
+        + ["-t", "2", str(path)],
+        check=True,
+    )
+
+
+@pytest.mark.skipif(shutil.which("ffmpeg") is None, reason="ffmpeg not available")
+def test_a_signed_in_facebook_download_is_titled_with_its_posts_text(db, monkeypatch, tmp_path):
+    # Prod jobs 265–268 (2026-09-14): with a cookie yt-dlp titles every reel "Video", so the row, the
+    # file name and the share preview all said "Video". The post's text is in the description.
+    u = _user(db, "fb-title@example.com")
+    a, j = _asset_and_job(db, u, sig="shared", asset_status="downloading", job_status="running")
+    monkeypatch.setattr(settings, "download_root", str(tmp_path))
+    monkeypatch.setattr(pipeline.urlguard, "check_url", lambda url: None)
+
+    def extract(job_id, asset_id, url, spec, staging, adapter, **kwargs):
+        media = staging / "2131884261040652.m4a"
+        _ffmpeg_media(media, "-c:a", "aac")
+        return {
+            "id": "2131884261040652",
+            "ext": "m4a",
+            "title": "Video",
+            "description": "Tune of The Day, Argy playing his version",
+            "extractor_key": "Facebook",
+            "filepath": str(media),
+        }
+
+    monkeypatch.setattr(pipeline, "_extract_with_fallback", extract)
+
+    pipeline._download(j.id, a.id, "url", _REEL, {"mode": "a"}, u.id)
+
+    db.expire_all()
+    asset, job = db.get(MediaAsset, a.id), db.get(DownloadJob, j.id)
+    assert asset.title == job.display_name == "Tune of The Day, Argy playing his version"
+    assert "Tune_of_The_Day" in asset.rel_path
+
+
+def test_the_early_title_takes_the_posts_text_too(db):
+    u = _user(db, "fb-early-title@example.com")
+    a, _ = _asset_and_job(db, u, sig="shared", asset_status="downloading", job_status="running")
+    a.title = None
+    db.commit()
+
+    pipeline._fill_asset_meta_early(
+        a.id,
+        {
+            "id": "1",
+            "title": "Video",
+            "description": "Almás palacsinta",
+            "extractor_key": "Facebook",
+        },
+    )
+
+    db.expire_all()
+    assert db.get(MediaAsset, a.id).title == "Almás palacsinta"
+
+
+@pytest.mark.skipif(shutil.which("ffmpeg") is None, reason="ffmpeg not available")
+def test_an_mp3_download_is_stored_as_an_mp3(db, monkeypatch, tmp_path):
+    # Prod job 268: the "Audio (MP3)" profile's extracted .mp3 was remuxed into an .mp4 and served as
+    # video/mp4, which iPad's WebKit will not play. It stays an .mp3 (served as audio/mpeg).
+    u = _user(db, "fb-mp3@example.com")
+    a, j = _asset_and_job(db, u, sig="shared", asset_status="downloading", job_status="running")
+    monkeypatch.setattr(settings, "download_root", str(tmp_path))
+    monkeypatch.setattr(pipeline.urlguard, "check_url", lambda url: None)
+
+    def extract(job_id, asset_id, url, spec, staging, adapter, **kwargs):
+        media = staging / "2131884261040652.mp3"
+        _ffmpeg_media(media, "-c:a", "libmp3lame")
+        return {"id": "2131884261040652", "ext": "mp3", "title": "Reel", "filepath": str(media)}
+
+    monkeypatch.setattr(pipeline, "_extract_with_fallback", extract)
+
+    pipeline._download(
+        j.id, a.id, "url", _REEL, formats.normalize({"mode": "a", "audio_format": "mp3"}), u.id
+    )
+
+    db.expire_all()
+    asset = db.get(MediaAsset, a.id)
+    assert (asset.container, asset.acodec, asset.media_kind) == ("mp3", "mp3", "audio")
+    assert asset.rel_path.endswith(".mp3")
+
+
+@pytest.mark.skipif(shutil.which("ffmpeg") is None, reason="ffmpeg not available")
+@pytest.mark.parametrize("mode", ["av", "v"])
+def test_a_video_download_is_still_made_browser_playable(db, monkeypatch, tmp_path, mode):
+    # The mp3 fix skips the browser-playable pass for AUDIO only: a video that arrives in a container
+    # browsers won't play (an .mkv) is still remuxed into an .mp4.
+    u = _user(db, f"fb-mkv-{mode}@example.com")
+    a, j = _asset_and_job(
+        db, u, sig=f"mkv-{mode}", asset_status="downloading", job_status="running"
+    )
+    monkeypatch.setattr(settings, "download_root", str(tmp_path))
+    monkeypatch.setattr(pipeline.urlguard, "check_url", lambda url: None)
+
+    def extract(job_id, asset_id, url, spec, staging, adapter, **kwargs):
+        media = staging / "1736360027626346.mkv"
+        audio = ["-f", "lavfi", "-i", "sine=frequency=440", "-c:a", "aac"] if mode == "av" else []
+        subprocess.run(
+            [
+                "ffmpeg",
+                "-y",
+                "-loglevel",
+                "error",
+                "-f",
+                "lavfi",
+                "-i",
+                "testsrc=size=64x64:rate=10",
+            ]
+            + audio
+            + ["-t", "1", "-c:v", "libx264", "-pix_fmt", "yuv420p", str(media)],
+            check=True,
+        )
+        return {"id": "1736360027626346", "ext": "mkv", "title": "Reel", "filepath": str(media)}
+
+    monkeypatch.setattr(pipeline, "_extract_with_fallback", extract)
+
+    pipeline._download(j.id, a.id, "url", _REEL, formats.normalize({"mode": mode}), u.id)
+
+    db.expire_all()
+    asset = db.get(MediaAsset, a.id)
+    assert (asset.container, asset.vcodec) == ("mp4", "h264")
+    assert asset.rel_path.endswith(".mp4")

backend/tests/test_download_job_locks.py

@@ -0,0 +1,139 @@
+"""Overlapping requests on ONE job (E11.5 review) — DB-backed, two real sessions.
+
+The routes that move a job's asset ref count (resume, cancel, delete, redownload) used to decide on an
+unlocked read: two overlapping requests for one job (a double-click, a second tab, a replay after a
+gateway timeout) both saw it holding its asset and both released the hold. The count then reaches 0
+while another job still holds the asset, and GC or the ready-file delete removes it under that job.
+A pause racing a cancel did the same one step later: its unlocked write turned the released job back
+into a holder, which a later delete releases again. `_own_job_for_update` makes the second request
+wait and decide on the first one's committed result.
+"""
+
+import threading
+
+import pytest
+from fastapi import HTTPException
+from sqlalchemy import select
+
+from app.db import SessionLocal
+from app.downloads import service
+from app.models import DownloadJob, MediaAsset, User
+from app.routes.downloads import (
+    _own_job_for_update,
+    cancel_download,
+    delete_download,
+    pause_download,
+)
+
+_REF = "https://example.com/video"
+
+
+def _asset_held_by_two_jobs(db, status="error"):
+    mine, theirs = User(email="lock-mine@example.com"), User(email="lock-theirs@example.com")
+    db.add_all([mine, theirs])
+    db.flush()
+    asset = MediaAsset(
+        source_kind="url", source_ref=_REF, format_sig="shared", status="error", ref_count=2
+    )
+    db.add(asset)
+    db.flush()
+    jobs = [
+        DownloadJob(
+            user_id=owner.id,
+            asset_id=asset.id,
+            source_kind="url",
+            source_ref=_REF,
+            status=status if owner is mine else "error",
+            queue_pos=0,
+            profile_snapshot={},
+        )
+        for owner in (mine, theirs)
+    ]
+    db.add_all(jobs)
+    db.commit()
+    return mine, asset, jobs[0]
+
+
+@pytest.mark.parametrize(
+    ("status", "transition", "route", "left"),
+    [
+        ("error", service.cancel, cancel_download, "canceled"),
+        ("error", service.delete, delete_download, None),
+        ("queued", service.cancel, pause_download, "canceled"),
+    ],
+)
+def test_overlapping_requests_for_one_job_release_its_hold_once(
+    db, status, transition, route, left
+):
+    user, asset, job = _asset_held_by_two_jobs(db, status)
+    job_id = job.id  # read before the delete case removes the row under the expired instance
+    first, second = SessionLocal(), SessionLocal()
+    finished = threading.Event()
+
+    def the_other_request():
+        try:
+            route(job_id, user=user, db=second)
+        except HTTPException:
+            pass  # a request after the delete: the job is gone, a 404
+        finally:
+            second.close()
+            finished.set()
+
+    try:
+        locked = _own_job_for_update(first, user, job_id)
+        other = threading.Thread(target=the_other_request)
+        other.start()
+        # The second request waits for the first one's locks instead of deciding on the same row.
+        assert not finished.wait(0.5), "the second request did not wait for the first"
+        transition(first, locked)
+        other.join(10)
+        assert finished.is_set()
+    finally:
+        first.close()
+
+    db.expire_all()
+    mine = select(DownloadJob.status).where(DownloadJob.id == job_id)
+    assert db.execute(mine).scalar_one_or_none() == left
+    assert db.get(MediaAsset, asset.id).ref_count == 1  # the other user's job still holds it
+
+
+def test_losing_the_asset_insert_race_keeps_the_callers_own_writes(db, monkeypatch):
+    # Retry clears the job's error, THEN may create the cookie asset. When another request inserted that
+    # asset first, the loser used to roll the whole session back — and requeue the job with its stale
+    # error, which a stall or crash later leaves showing under the new failure.
+    user = User(email="race@example.com")
+    db.add(user)
+    db.flush()
+    job = DownloadJob(
+        user_id=user.id,
+        source_kind="url",
+        source_ref=_REF,
+        status="error",
+        error="the old failure",
+        queue_pos=0,
+        profile_snapshot={},
+    )
+    db.add(job)
+    db.commit()
+    job.error = None  # the caller's pending write
+
+    real_flush, raced = db.flush, []
+
+    def flush_after_the_other_request_inserted(*args, **kwargs):
+        if not raced:  # the other request commits the same asset between our lookup and our insert
+            raced.append(True)
+            with SessionLocal() as other:
+                other.add(
+                    MediaAsset(source_kind="url", source_ref=_REF, format_sig="raced", ref_count=0)
+                )
+                other.commit()
+        return real_flush(*args, **kwargs)
+
+    monkeypatch.setattr(db, "flush", flush_after_the_other_request_inserted)
+
+    asset = service.get_or_create_asset(db, "url", _REF, "raced")
+    db.commit()
+
+    assert raced and asset.format_sig == "raced"
+    db.expire_all()
+    assert db.get(DownloadJob, job.id).error is None

backend/tests/test_facebook_impersonation.py

@@ -0,0 +1,243 @@
+"""E11.5 S3 + S4 — the Facebook download path with the user's cookie.
+
+S3, measured on dev (yt-dlp 2026.07.04, the owner's cookie): reel 806379462330494 fails with the cookie
+alone and extracts 2560p with `--impersonate chrome`; the reels that already download with the cookie
+keep their plain first attempt. These pin the attempt order through the real download loop
+(`pipeline._extract_with_fallback`, with yt-dlp faked at the `YoutubeDL` boundary), and that the
+LOCKED curl_cffi can actually impersonate — the pair only works inside yt-dlp's own version range, and
+outside it every target silently reports "unavailable".
+
+S4, measured on dev and in the owner's Chrome: given a group post's link, yt-dlp finds no formats or
+downloads another video from the page's feed. The post's own video is the single Video node in the
+page scripts that carry the post id (prod posts 66, 145, 140, 143, 221; text posts have none while the
+page holds ~10 other videos), and its watch link downloads.
+"""
+
+import pytest
+import yt_dlp
+from yt_dlp.networking.exceptions import TransportError
+from yt_dlp.networking.impersonate import ImpersonateTarget
+
+from app.downloads import adapters, pipeline
+from app.downloads import errors as dlerrors
+
+_URL = "https://www.facebook.com/reel/806379462330494/?fs=e&fs=e"
+_POST = "1755988225525547"
+_GROUP_LINK = f"https://www.facebook.com/groups/983554479435596/permalink/{_POST}/?"
+_POST_VIDEO = "1408015447857753"
+_FEED_VIDEO = "1056963063816966"  # what yt-dlp downloaded from this post's link: a feed video
+_CHROME = ImpersonateTarget.from_str("chrome")
+
+
+def _video_node(video_id: str) -> str:
+    # The measured shape of a post's attachment in the page JSON.
+    return '{"media":{"__typename":"Video","id":"%s","__isNode":"Video"},"styles":{}}' % video_id
+
+
+def _page(*post_videos: str, post: str = _POST) -> str:
+    attachments = ",".join(_video_node(v) for v in post_videos)
+    return (
+        '<html><script type="application/json" data-sjs>'
+        f'{{"post_id":"{post}","creation_time":1785084554,"attachments":[{attachments}]}}</script>'
+        '<script type="application/json" data-sjs>'
+        f'{{"feed":[{_video_node(_FEED_VIDEO)}]}}</script></html>'
+    )
+
+
+_WALL = (
+    "ERROR: [facebook] 806379462330494: Cannot parse data; please report this issue on  "
+    "https://github.com/yt-dlp/yt-dlp/issues?q= , filling out the appropriate issue template."
+)
+_NO_FORMATS = "ERROR: [facebook] 2541212983053999: No video formats found!"
+
+
+def test_the_locked_curl_cffi_can_impersonate_chrome():
+    # YoutubeDL refuses to start when the target is unavailable — the same check a download makes.
+    with yt_dlp.YoutubeDL({"impersonate": ImpersonateTarget.from_str("chrome"), "quiet": True}):
+        pass
+
+
+@pytest.fixture
+def ydl(monkeypatch):
+    """Fake `yt_dlp.YoutubeDL`: records each attempt's options and plays back `outcomes` in order;
+    `web["page"]` is what a page read returns (`web["fail"]`, when set, is raised instead), and `web`
+    records the pages opened, the byte cap each read asked for, and the links extracted."""
+    seen: list[dict] = []
+    outcomes: list = []
+    web: dict = {"page": "", "fail": None, "opened": [], "reads": [], "extracted": []}
+
+    class FakeYDL:
+        def __init__(self, opts):
+            seen.append(opts)
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *exc):
+            return False
+
+        def urlopen(self, url):
+            web["opened"].append(url)
+            if web["fail"] is not None:
+                raise web["fail"]
+            body = web["page"].encode()
+
+            class Response:
+                def read(self, amt=None):
+                    web["reads"].append(amt)
+                    return body
+
+            return Response()
+
+        def extract_info(self, url, download):
+            web["extracted"].append(url)
+            outcome = outcomes.pop(0)
+            if isinstance(outcome, str):
+                raise yt_dlp.utils.DownloadError(outcome)
+            return outcome
+
+    monkeypatch.setattr(pipeline.yt_dlp, "YoutubeDL", FakeYDL)
+    monkeypatch.setattr(pipeline, "_touch_job", lambda job_id: None)
+    monkeypatch.setattr(pipeline, "_set_job", lambda job_id, **fields: None)
+    return seen, outcomes, web
+
+
+def _run(tmp_path, cookiefile, url=_URL):
+    return pipeline._extract_with_fallback(
+        1, 1, url, {}, tmp_path, adapters.FacebookAdapter(), cookiefile=cookiefile
+    )
+
+
+def test_a_cookie_download_at_the_wall_is_retried_as_chrome(ydl, tmp_path):
+    seen, outcomes, web = ydl
+    outcomes += [_WALL, {"id": "806379462330494"}]
+
+    assert _run(tmp_path, "/cookies.txt") == {"id": "806379462330494"}
+
+    assert [o.get("impersonate") for o in seen] == [None, _CHROME]
+    assert all(o["cookiefile"] == "/cookies.txt" for o in seen)  # the retry stays signed in
+    assert web["opened"] == []  # a reel is not a group post: no page read
+
+
+def test_without_a_cookie_the_wall_is_the_login_wall_and_final(ydl, tmp_path):
+    seen, outcomes, _ = ydl
+    outcomes += [_WALL]
+
+    with pytest.raises(yt_dlp.utils.DownloadError):
+        _run(tmp_path, None)
+
+    assert len(seen) == 1 and "impersonate" not in seen[0]
+
+
+def test_other_facebook_failures_are_not_retried_as_chrome(ydl, tmp_path):
+    seen, outcomes, _ = ydl
+    outcomes += [_NO_FORMATS]
+
+    with pytest.raises(yt_dlp.utils.DownloadError):
+        _run(tmp_path, "/cookies.txt")
+
+    assert len(seen) == 1 and "impersonate" not in seen[0]
+
+
+# --- S4: a group post downloads ITS video, or fails saying it has none ----------------------------
+
+
+def test_a_cookie_group_post_downloads_the_posts_own_video(ydl, tmp_path):
+    seen, outcomes, web = ydl
+    web["page"] = _page(_POST_VIDEO)
+    outcomes += [_WALL, {"id": _POST_VIDEO}]  # the watch link needs Chrome too (measured)
+
+    assert _run(tmp_path, "/cookies.txt", _GROUP_LINK) == {"id": _POST_VIDEO}
+
+    assert web["opened"] == [_GROUP_LINK]
+    # Never an unbounded read.
+    assert web["reads"] == [adapters.FacebookAdapter._POST_PAGE_MAX_BYTES]
+    assert seen[0]["cookiefile"] == "/cookies.txt"  # the post page is read signed in
+    watch = f"https://www.facebook.com/watch/?v={_POST_VIDEO}"
+    # Never the post link: that is where the feed video comes from.
+    assert web["extracted"] == [watch, watch]
+    assert [o.get("impersonate") for o in seen[1:]] == [None, _CHROME]
+
+
+def test_a_group_post_without_a_single_video_fails_saying_so(ydl, tmp_path):
+    _, _, web = ydl
+    web["page"] = _page()  # a text post: the only video on the page is the feed's
+
+    with pytest.raises(RuntimeError) as exc:
+        _run(tmp_path, "/cookies.txt", _GROUP_LINK)
+
+    assert web["extracted"] == []  # yt-dlp is not left to guess from the post link
+    assert dlerrors.diagnose(str(exc.value), url=_GROUP_LINK, cookie_attached=True) == (
+        "format_unavailable",
+        "facebook.group_post_video",
+    )
+
+
+def test_a_group_post_page_without_the_post_is_the_refused_cookie(ydl, tmp_path):
+    # Measured with a refused cookie (E11.5 review): Facebook answers the post link with its login page —
+    # a login form, no post id anywhere. Saying "this post has no video" would blame the post.
+    _, _, web = ydl
+    web["page"] = '<html><title>ChatGPT magyarul</title><form id="login_form"></form></html>'
+
+    with pytest.raises(RuntimeError) as exc:
+        _run(tmp_path, "/cookies.txt", _GROUP_LINK)
+
+    assert web["extracted"] == []
+    assert dlerrors.diagnose(str(exc.value), url=_GROUP_LINK, cookie_attached=True) == (
+        "login_required",
+        "facebook.cookie_rejected",
+    )
+
+
+def test_a_failed_post_page_read_fails_the_download_as_itself(ydl, tmp_path):
+    # A read that failed says nothing about the post: it must not turn into "no video in this post".
+    _, _, web = ydl
+    web["fail"] = TransportError("Connection reset by peer")
+
+    with pytest.raises(TransportError) as exc:
+        _run(tmp_path, "/cookies.txt", _GROUP_LINK)
+
+    assert web["extracted"] == []
+    assert dlerrors.diagnose(str(exc.value), url=_GROUP_LINK, cookie_attached=True) == (
+        "network",
+        None,
+    )
+
+
+def test_without_a_cookie_the_group_post_link_goes_to_ytdlp_unchanged(ydl, tmp_path):
+    _, outcomes, web = ydl
+    outcomes += [_NO_FORMATS]
+
+    with pytest.raises(yt_dlp.utils.DownloadError):
+        _run(tmp_path, None, _GROUP_LINK)
+
+    assert web["opened"] == []  # signed out the page is the login wall: nothing to read
+    assert web["extracted"] == [_GROUP_LINK]
+
+
+def test_the_group_post_link_forms_are_recognised():
+    for url in (
+        _GROUP_LINK,
+        f"https://www.facebook.com/groups/983554479435596/posts/{_POST}/",
+        f"https://m.facebook.com/groups/983554479435596/permalink/{_POST}/?",
+        f"https://www.facebook.com/groups/chatgptmagyarul/posts/{_POST}",
+    ):
+        assert adapters.facebook_group_post_id(url) == _POST, url
+    for url in (
+        _URL,
+        f"https://www.facebook.com/watch/?v={_POST_VIDEO}",
+        f"https://facebook.com.evil/groups/x/permalink/{_POST}/",
+        "https://www.facebook.com/groups/983554479435596/",
+    ):
+        assert adapters.facebook_group_post_id(url) is None, url
+    assert adapters.SourceAdapter().resolve_url(_GROUP_LINK, {"cookiefile": "/c"}) == _GROUP_LINK
+
+
+def test_only_the_single_video_of_the_posts_own_blocks_counts():
+    assert adapters.facebook_post_video_id(_page(_POST_VIDEO), _POST) == _POST_VIDEO
+    # No video in the post, although the page has one elsewhere.
+    assert adapters.facebook_post_video_id(_page(), _POST) is None
+    # Two videos: guessing between them would be the wrong-video bug again.
+    assert adapters.facebook_post_video_id(_page(_POST_VIDEO, "2063302677911049"), _POST) is None
+    # A longer number that merely STARTS with the post id is another object.
+    assert adapters.facebook_post_video_id(_page(_POST_VIDEO, post=_POST + "0"), _POST) is None

backend/tests/test_formats.py

@@ -158,3 +158,24 @@ def test_a_normal_cut_list_is_untouched():
     segs = [{"start_s": 0, "end_s": 5}, {"start_s": 10, "end_s": 12}]
     out = editmod.normalize_edit_spec({"segments": segs})
     assert len(out["segments"]) == 2
+
+
+def test_audio_versions_its_cache_identity_apart_from_video(monkeypatch):
+    # The .mp3/.m4a-stays-itself fix must re-derive cached remuxed audio WITHOUT re-downloading every
+    # cached video: bumping one version moves only its own mode's signature.
+    audio, video = {"mode": "a", "audio_format": "mp3"}, {"mode": "av"}
+    before = formats.format_sig(audio), formats.format_sig(video)
+    monkeypatch.setattr(formats, "_AUDIO_SIG_VERSION", formats._AUDIO_SIG_VERSION + 1)
+    assert formats.format_sig(audio) != before[0]
+    assert formats.format_sig(video) == before[1]
+    monkeypatch.setattr(formats, "_SIG_VERSION", formats._SIG_VERSION + 1)
+    assert formats.format_sig(video) != before[1]
+
+
+def test_the_mp3_fix_moved_the_audio_cache_identity(monkeypatch):
+    # Before the fix every mode hashed with version 4, so an audio signature still at 4 would find the
+    # cached mp3-remuxed-into-mp4 assets iPad refuses (prod job 268) instead of re-deriving them.
+    audio = {"mode": "a", "audio_format": "mp3"}
+    current = formats.format_sig(audio)
+    monkeypatch.setattr(formats, "_AUDIO_SIG_VERSION", 4)
+    assert formats.format_sig(audio) != current

backend/tests/test_public_unlock_limit.py

@@ -0,0 +1,80 @@
+"""The password unlock of a shared /watch link (routes/public.py), DB-lane.
+
+Guesses are slowed per viewer (the link AND the client — an IPv6 client by its /64), under a per-link
+ceiling on wrong passwords, so a client guessing wrong shuts out only itself until it spreads its guesses
+over as many networks as the ceiling allows.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.config import settings
+from app.downloads import probe as probemod
+from app.main import app
+from app.ratelimit import RateLimiter
+from app.routes import public
+
+_PW = "open sesame"
+
+
+@pytest.fixture
+def unlock_url(as_user, make_user, tmp_path, monkeypatch):
+    monkeypatch.setattr(settings, "download_root", str(tmp_path))
+    monkeypatch.setattr(probemod, "probe_media", lambda _p: ("h264", "aac", 320, 240, 5))
+    owner = as_user(make_user())
+    job = owner.post(
+        "/api/downloads/upload", files={"file": ("clip.mp4", b"fake-video", "video/mp4")}
+    )
+    assert job.status_code == 200, job.text
+    link = owner.post(f"/api/downloads/{job.json()['id']}/links", json={"password": _PW})
+    assert link.status_code == 200, link.text
+    return f"/api/public/watch/{link.json()['token']}/unlock"
+
+
+def _from(ip: str) -> TestClient:
+    # Its own socket peer: with no trusted proxy configured, that is the client's IP.
+    return TestClient(app, client=(ip, 50000))
+
+
+def test_a_link_holder_without_the_password_cannot_lock_out_its_viewers(unlock_url):
+    # The limit used to be keyed on the link alone: ten wrong guesses every five minutes kept every
+    # viewer out, the ones with the password included.
+    guesser = _from("203.0.113.5")
+    for _ in range(10):
+        assert guesser.post(unlock_url, json={"password": "guess"}).status_code == 403
+    assert guesser.post(unlock_url, json={"password": "guess"}).status_code == 429
+
+    assert _from("198.51.100.7").post(unlock_url, json={"password": _PW}).status_code == 200
+
+
+def test_an_ipv6_client_is_one_viewer_across_its_64(unlock_url):
+    # One subscriber gets a whole /64: keyed on the full address, it could rotate through endless viewers.
+    for _ in range(10):
+        wrong = _from("2001:db8:1:2::5").post(unlock_url, json={"password": "guess"})
+        assert wrong.status_code == 403
+    assert _from("2001:db8:1:2::6").post(unlock_url, json={"password": _PW}).status_code == 429
+
+    assert _from("2001:db8:1:3::5").post(unlock_url, json={"password": _PW}).status_code == 200
+
+
+def test_a_token_naming_no_link_leaves_nothing_in_the_limiter(unlock_url):
+    # The limiter used to record the attempt before looking the link up: posting made-up tokens grew it by
+    # an entry each, kept for the whole window.
+    keys = len(public._unlock_limit._hits)
+    for n in range(5):
+        missing = _from("203.0.113.5").post(unlock_url.replace("/watch/", f"/watch/x{n}"), json={})
+        assert missing.status_code == 404
+    assert len(public._unlock_limit._hits) == keys
+
+
+def test_wrong_passwords_from_many_clients_still_reach_the_links_ceiling(unlock_url, monkeypatch):
+    monkeypatch.setattr(public, "_unlock_failures", RateLimiter(max_events=3, window_seconds=300))
+    viewer = _from("198.51.100.7")
+    for _ in range(5):  # unlocking with the password never adds to the ceiling
+        assert viewer.post(unlock_url, json={"password": _PW}).status_code == 200
+
+    for n in range(3):
+        wrong = _from(f"203.0.113.{n}").post(unlock_url, json={"password": "guess"})
+        assert wrong.status_code == 403
+    late = _from("203.0.113.9").post(unlock_url, json={"password": "guess"})
+    assert late.status_code == 429

backend/tests/test_ratelimit.py

@@ -57,6 +57,19 @@ def test_reset_clears_every_key():
     assert lim.allow("b") is True
 
 
+def test_exhausted_reports_a_full_window_without_counting_an_attempt():
+    # The asking half of a limit that counts only some outcomes (a share link's unlock counts only
+    # wrong passwords toward its ceiling): asking must never use up the window it asks about.
+    lim = RateLimiter(max_events=2, window_seconds=300)
+
+    for _ in range(5):
+        assert lim.exhausted("link") is False
+    assert lim.allow("link") is True
+    assert lim.exhausted("link") is False
+    assert lim.allow("link") is True
+    assert lim.exhausted("link") is True
+
+
 def test_expired_attempts_fall_out_of_the_window():
     # A zero-length window means every previous attempt is already outside it.
     lim = RateLimiter(max_events=1, window_seconds=0)

backend/tests/test_upload.py

@@ -424,10 +424,36 @@ class TestResolveMediaFacts:
                 ],
             },
         )
-        v, a, w, h = probemod.resolve_media_facts(Path("x"), {"width": None, "height": None})
+        v, a, w, h, _d = probemod.resolve_media_facts(Path("x"), {"width": None, "height": None})
         assert (v, a, w, h) == ("h264", "aac", 720, 1280)
         assert mediakind.derive(v, a) == mediakind.VIDEO  # NOT 'file'
 
+    def test_the_duration_comes_from_the_file_when_info_has_none(self, monkeypatch):
+        # Facebook reel 257 (E11.5): yt-dlp gave no duration, the file is 128.4 s. A NULL duration hid
+        # the Library row's trim action.
+        self._ffprobe(
+            monkeypatch,
+            {
+                "format": {"format_name": "mov,mp4,m4a", "duration": "128.400000"},
+                "streams": [{"codec_type": "video", "codec_name": "h264"}],
+            },
+        )
+        assert probemod.resolve_media_facts(Path("x"), {"duration": None})[4] == 128
+        # The file wins over a differing info duration, like its codecs do.
+        assert probemod.resolve_media_facts(Path("x"), {"duration": 300})[4] == 128
+
+    def test_info_fills_the_duration_the_probe_could_not_read(self, monkeypatch):
+        self._ffprobe(
+            monkeypatch,
+            {
+                "format": {"format_name": "mov,mp4,m4a"},
+                "streams": [{"codec_type": "video", "codec_name": "h264"}],
+            },
+        )
+        assert probemod.resolve_media_facts(Path("x"), {"duration": 61.7})[4] == 61
+        self._ffprobe(monkeypatch, None)
+        assert probemod.resolve_media_facts(Path("x"), {"duration": 61.7})[4] == 61
+
     def test_probe_wins_over_a_DIFFERING_populated_info(self, monkeypatch):
         # Both the probe AND info are populated but DISAGREE (info carries a pre-remux/pre-merge codec).
         # The finished file on disk is ground truth, so the probe wins outright — pins the precedence a
@@ -442,7 +468,7 @@ class TestResolveMediaFacts:
                 ],
             },
         )
-        v, a, w, h = probemod.resolve_media_facts(
+        v, a, w, h, _d = probemod.resolve_media_facts(
             Path("x"), {"vcodec": "vp9", "acodec": "opus", "width": 640, "height": 480}
         )
         assert (v, a, w, h) == ("h264", "aac", 1920, 1080)  # probe, not info
@@ -466,7 +492,7 @@ class TestResolveMediaFacts:
                 ],
             },
         )
-        v, a, w, h = probemod.resolve_media_facts(
+        v, a, w, h, _d = probemod.resolve_media_facts(
             Path("x"), {"vcodec": "avc1", "acodec": "mp4a", "width": 1280, "height": 720}
         )
         assert v is None and a == "mp3"  # info's avc1 did NOT win
@@ -482,7 +508,7 @@ class TestResolveMediaFacts:
                 "streams": [{"codec_type": "video", "codec_name": "png", "width": 8, "height": 8}],
             },
         )
-        v, a, w, h = probemod.resolve_media_facts(
+        v, a, w, h, _d = probemod.resolve_media_facts(
             Path("x"), {"vcodec": "png", "width": 8, "height": 8}
         )
         assert v is None and mediakind.derive(v, a) == mediakind.FILE
@@ -490,7 +516,7 @@ class TestResolveMediaFacts:
     def test_info_fills_in_only_when_ffprobe_could_not_read_the_file(self, monkeypatch):
         # ffprobe failed entirely (None) → fall back to info so we never regress the working path.
         self._ffprobe(monkeypatch, None)
-        v, a, w, h = probemod.resolve_media_facts(
+        v, a, w, h, _d = probemod.resolve_media_facts(
             Path("x"), {"vcodec": "vp9", "acodec": "opus", "width": 1920, "height": 1080}
         )
         assert (v, a, w, h) == ("vp9", "opus", 1920, 1080)
@@ -498,6 +524,8 @@ class TestResolveMediaFacts:
     def test_info_none_codec_string_is_treated_as_absent(self, monkeypatch):
         # yt-dlp writes the literal "none" for a missing stream — it must not become a codec name.
         self._ffprobe(monkeypatch, None)  # probe failed → info path, where the "none" scrub applies
-        v, a, w, h = probemod.resolve_media_facts(Path("x"), {"vcodec": "none", "acodec": "aac"})
+        v, a, w, h, _d = probemod.resolve_media_facts(
+            Path("x"), {"vcodec": "none", "acodec": "aac"}
+        )
         assert (v, a) == (None, "aac")
         assert mediakind.derive(v, a) == mediakind.AUDIO

backend/tests/test_worker_supervisor.py

@@ -51,7 +51,7 @@ def rec(monkeypatch):
 
     monkeypatch.setattr(worker, "_reset_asset_pending", record("reset_asset"))
     monkeypatch.setattr(worker, "_requeue_if_running", record("requeue"))
-    monkeypatch.setattr(worker, "_set_job", record("set_job"))
+    monkeypatch.setattr(worker, "_fail_running", record("fail"))
     monkeypatch.setattr(worker, "_cleanup_staging", record("cleanup"))
     monkeypatch.setattr(worker, "_stop_child", record("stop_child"))
     monkeypatch.setattr(worker._stop, "is_set", lambda: False)
@@ -84,9 +84,9 @@ def test_no_progress_stall_kills_and_fails_the_job(monkeypatch, rec):
     worker._run_supervised(1, 99)
     names = _names(rec)
     assert "stop_child" in names and "reset_asset" in names
-    set_job = next(c for c in rec if c[0] == "set_job")
-    assert set_job[2]["status"] == "error" and set_job[2]["error_code"] == "network"
-    assert "stalled" in set_job[2]["error"].lower()
+    fail = next(c for c in rec if c[0] == "fail")
+    assert fail[2]["error_code"] == "network"
+    assert "stalled" in fail[2]["error"].lower()
 
 
 def test_route_pause_kills_but_keeps_the_route_status(monkeypatch, rec):
@@ -97,7 +97,7 @@ def test_route_pause_kills_but_keeps_the_route_status(monkeypatch, rec):
     worker._run_supervised(1, 99)
     names = _names(rec)
     assert "stop_child" in names and "reset_asset" in names
-    assert "set_job" not in names and "requeue" not in names
+    assert "fail" not in names and "requeue" not in names
 
 
 def test_route_cancel_kills_but_keeps_the_route_status(monkeypatch, rec):
@@ -110,7 +110,7 @@ def test_route_cancel_kills_but_keeps_the_route_status(monkeypatch, rec):
     worker._run_supervised(1, 99)
     names = _names(rec)
     assert "stop_child" in names and "reset_asset" in names
-    assert "set_job" not in names and "requeue" not in names
+    assert "fail" not in names and "requeue" not in names
 
 
 def test_wall_clock_cap_kills_even_while_progressing(monkeypatch, rec):
@@ -118,9 +118,8 @@ def test_wall_clock_cap_kills_even_while_progressing(monkeypatch, rec):
     _spawn(monkeypatch, _FakeProc(["timeout"]))
     _liveness(monkeypatch, ("running", 1.0))  # fresh progress, but over the absolute cap
     worker._run_supervised(1, 99)
-    set_job = next(c for c in rec if c[0] == "set_job")
-    assert set_job[2]["status"] == "error"
-    assert "time limit" in set_job[2]["error"].lower()
+    fail = next(c for c in rec if c[0] == "fail")
+    assert "time limit" in fail[2]["error"].lower()
 
 
 def test_child_crash_without_finishing_is_failed(monkeypatch, rec):
@@ -130,8 +129,8 @@ def test_child_crash_without_finishing_is_failed(monkeypatch, rec):
     worker._run_supervised(1, 99)
     names = _names(rec)
     assert "reset_asset" in names
-    set_job = next(c for c in rec if c[0] == "set_job")
-    assert set_job[2]["status"] == "error" and "unexpectedly" in set_job[2]["error"].lower()
+    fail = next(c for c in rec if c[0] == "fail")
+    assert "unexpectedly" in fail[2]["error"].lower()
 
 
 def test_child_nonzero_exit_that_already_set_state_is_left_alone(monkeypatch, rec):
@@ -139,7 +138,7 @@ def test_child_nonzero_exit_that_already_set_state_is_left_alone(monkeypatch, re
     _spawn(monkeypatch, _FakeProc([("exit", 1)]))
     _liveness(monkeypatch, ("error", None))
     worker._run_supervised(1, 99)
-    assert "set_job" not in _names(rec)
+    assert "fail" not in _names(rec)
 
 
 def test_spawn_failure_frees_the_asset_and_requeues(monkeypatch, rec):
@@ -158,7 +157,7 @@ def test_shutdown_kills_and_requeues_for_next_boot(monkeypatch, rec):
     _liveness(monkeypatch, ("running", 1.0))
     worker._run_supervised(1, 99)
     names = _names(rec)
-    assert "stop_child" in names and "requeue" in names and "set_job" not in names
+    assert "stop_child" in names and "requeue" in names and "fail" not in names
 
 
 def test_a_long_download_survives_while_progress_stays_fresh(monkeypatch, rec):
@@ -191,7 +190,7 @@ def test_a_wedged_finished_child_is_killed_by_the_wall_clock(monkeypatch, rec):
     _liveness(monkeypatch, ("done", 1.0))  # finished, but the process lingers
     worker._run_supervised(1, 99)
     names = _names(rec)
-    assert "stop_child" in names and "set_job" not in names  # killed to free the slot, status kept
+    assert "stop_child" in names and "fail" not in names  # killed to free the slot, status kept
 
 
 def test_a_watchdog_error_still_stops_the_child(monkeypatch, rec):
@@ -206,7 +205,7 @@ def test_a_watchdog_error_still_stops_the_child(monkeypatch, rec):
     worker._run_supervised(1, 99)
     names = _names(rec)
     assert "stop_child" in names and "reset_asset" in names
-    assert next(c for c in rec if c[0] == "set_job")[2]["status"] == "error"
+    assert "fail" in _names(rec)
 
 
 # --- _stop_child escalation -----------------------------------------------------------------

frontend/e2e/README.md

@@ -17,6 +17,16 @@ siftlode e2e-seed       # (re)seed the test account only, no tests
 The localdev stack must be up (`siftlode dev`). `global.setup.ts` reseeds the account and logs in
 once, sharing the session via `e2e/.auth/state.json` (git-ignored).
 
+**Browsers** — every flow runs in three projects: `chromium` (Desktop Chrome), `webkit` (Desktop
+Safari) and `ipad` (iPad gen 7 landscape: 1080×810, touch, mobile). Install the engines once per
+machine with `npx playwright install chromium webkit`; run one project with
+`npx playwright test --project=ipad`. WebKit catches what every iOS browser inherits from the engine
+(JS, CSS/layout, event order). It does **not** reproduce iPad media refusals: Playwright's WebKit
+decodes through the host OS (Media Foundation on Windows, GStreamer on Linux), and measured on
+2026-09-14 it played an mp3-in-mp4 and an AV1 mp4 that a real iPad refuses. Check a media format
+on a real iPad against the dev stack over the LAN (`http://<desktop LAN IP>:8080`, e.g. a
+login-free `/watch/<token>` share link).
+
 **Target** — `PW_BASE_URL` (default `http://127.0.0.1:8080`):
 
 - **`:8080`** (baked SPA) is authoritative and same-origin. After a **frontend change you must

frontend/e2e/global.setup.ts

@@ -67,13 +67,17 @@ setup("seed + authenticate", async ({ page }) => {
   const me = await (await page.request.get("/api/me")).json();
   expect(me.authenticated, "session not established after login").toBeTruthy();
 
-  // 4. Pin the UI locale and suppress the first-login onboarding wizard (a full-screen overlay
+  // 4. Pin the UI locale, suppress the first-login onboarding wizard (a full-screen overlay
   //    that would intercept every click — the test account has no YouTube connection, so it
-  //    auto-opens). The dismissed flag is per-account: `siftlode.onboarding.dismissed.<id>`.
+  //    auto-opens), and opt the account out of starting on Home. Since E24 a bare URL lands on
+  //    Home, and the feed, channel and player flows this net locks all open "/" expecting the
+  //    feed; the opt-out is the one Settings → Appearance → Startup writes. Both flags are
+  //    per-account: `siftlode.onboarding.dismissed.<id>`, `siftlode.startOnHome.<id>`.
   await page.goto("/");
   await page.evaluate((id: number) => {
     localStorage.setItem("siftlode.lang", "en");
     localStorage.setItem(`siftlode.onboarding.dismissed.${id}`, "1");
+    localStorage.setItem(`siftlode.startOnHome.${id}`, "0");
   }, me.id);
   mkdirSync(dirname(STORAGE), { recursive: true });
   await page.context().storageState({ path: STORAGE });

frontend/playwright.config.ts

@@ -47,5 +47,19 @@ export default defineConfig({
       use: { ...devices["Desktop Chrome"], storageState: STORAGE_STATE },
       dependencies: ["setup"],
     },
+    // WebKit catches engine-level differences (JS, CSS/layout, event order) that every iOS browser
+    // inherits. It does NOT reproduce iPad MEDIA refusals: Playwright's WebKit decodes through the
+    // host OS (Media Foundation on Windows, GStreamer on Linux), and measured on 2026-09-14 it played
+    // an mp3-in-mp4 and an AV1 mp4 that iPad refuses. Media checks need a real iPad.
+    {
+      name: "webkit",
+      use: { ...devices["Desktop Safari"], storageState: STORAGE_STATE },
+      dependencies: ["setup"],
+    },
+    {
+      name: "ipad",
+      use: { ...devices["iPad (gen 7) landscape"], storageState: STORAGE_STATE },
+      dependencies: ["setup"],
+    },
   ],
 });

frontend/src/App.tsx

@@ -2,16 +2,15 @@ import { lazy, Suspense, useEffect, useState } from "react";
 import { qk } from "./lib/queryKeys";
 import { useTranslation } from "react-i18next";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
-import { api, getActiveAccount, setActiveAccount, setUnauthorizedHandler } from "./lib/api";
+import { api, setUnauthorizedHandler, type Me } from "./lib/api";
 import { notifyActionError } from "./lib/actionErrors";
-import { setLanguage, isSupported, type LangCode } from "./i18n";
+import { setLanguage, type LangCode } from "./i18n";
 import { clearParams } from "./lib/urlState";
 import type { Page } from "./lib/urlState";
 import {
-  loadLayout,
-  normalizeLayout,
   PREF_KEY,
   saveLayoutLocal,
+  seedLayout,
   type PanelId,
   type PanelLayout,
 } from "./lib/panelLayout";
@@ -24,7 +23,9 @@ import { useFeedFilters, useFeedFiltersActions } from "./components/FeedFiltersP
 import { useChannelLayout } from "./components/ChannelsProvider";
 import { useFeedView, useFeedViewActions } from "./components/FeedViewProvider";
 import { moduleDef, moduleOrder } from "./lib/modules";
-import { PAGE_CONTENT, PAGE_RAIL } from "./components/moduleRegistry";
+import { PAGE_CONTENT, PAGE_RAIL, preloadPages } from "./components/moduleRegistry";
+import { lazyWithPreload } from "./lib/lazyWithPreload";
+import { LoadingState } from "./components/ui/QueryState";
 // Persistent shell — always mounted, so eagerly imported.
 import Welcome from "./components/Welcome";
 import SetupWizard from "./components/SetupWizard";
@@ -38,7 +39,6 @@ import Toaster from "./components/ui/Toaster";
 import KeyboardHelp from "./components/ui/KeyboardHelp";
 import AppCommandPalette from "./components/AppCommandPalette";
 import { useGlobalKeymap } from "./lib/keymap";
-import { StateMessage } from "./components/ui/QueryState";
 import ErrorDialog from "./components/ErrorDialog";
 import VersionBanner from "./components/VersionBanner";
 import DemoBanner from "./components/DemoBanner";
@@ -52,7 +52,7 @@ import { FRONTEND_VERSION } from "./lib/version";
 // The page modules (and their side rails) are code-split per route via the module registry
 // (components/moduleRegistry). App keeps only the persistent-shell chunks + the channel page and the
 // two modals, which sit outside the registry-driven content column.
-const ChannelPage = lazy(() => import("./components/ChannelPage"));
+const ChannelPage = lazyWithPreload(() => import("./components/ChannelPage"));
 const About = lazy(() => import("./components/About"));
 const ReleaseNotes = lazy(() => import("./components/ReleaseNotes"));
 
@@ -79,13 +79,20 @@ export default function App() {
   // by the feed page and the channel page. App reads it only to hand to <Feed>/<ChannelPage>.
   const view = useFeedView();
   const { setView } = useFeedViewActions();
+  const queryClient = useQueryClient();
   // Per-panel "customize" layouts (order/collapsed/hidden of each side panel's group cards),
-  // persisted per-account. One record so feed/plex/playlists share the same mechanism.
-  const [panelLayouts, setPanelLayouts] = useState<Record<PanelId, PanelLayout>>(() => ({
-    feed: loadLayout("feed"),
-    plex: loadLayout("plex"),
-    playlists: loadLayout("playlists"),
-  }));
+  // persisted per-account. One record so feed/plex/playlists share the same mechanism. Seeded from
+  // the account's server preferences — BootGate mounts App only once `me` is cached — so a layout
+  // changed on another device is right on the first paint; the local copy covers a key the server
+  // has never stored.
+  const [panelLayouts, setPanelLayouts] = useState<Record<PanelId, PanelLayout>>(() => {
+    const prefs = queryClient.getQueryData<Me | null>(qk.me())?.preferences;
+    return {
+      feed: seedLayout("feed", prefs),
+      plex: seedLayout("plex", prefs),
+      playlists: seedLayout("playlists", prefs),
+    };
+  });
   const [aboutOpen, setAboutOpen] = useState(false);
   const [notesOpen, setNotesOpen] = useState(false);
   const [notesHighlight, setNotesHighlight] = useState<string | undefined>(undefined);
@@ -104,8 +111,8 @@ export default function App() {
   }
 
   // Collapse state for the two full-height panels (left nav + filter sidebar). Persisted to the
-  // user's preferences (via usePref) so it follows the account across devices; the localStorage mirror
-  // seeds the initial render synchronously so nothing flashes open before the server prefs arrive.
+  // user's preferences (via usePref) so it follows the account across devices, seeded from the `me`
+  // cache at mount; the localStorage mirror covers an account whose server prefs never stored it.
   // Default unpinned (tab + hover-expand overlay); accounts that explicitly pin keep their choice.
   const [filterCollapsed, setFilterCollapsed] = usePref<boolean>("filterCollapsed", true, {
     localKey: LS.filterCollapsed,
@@ -119,26 +126,15 @@ export default function App() {
   // (The feed filters + page/channel now LIVE in the address bar — FeedFiltersProvider and
   // NavigationProvider read them on load and keep them mirrored — so there's no query to strip here.)
 
-  const queryClient = useQueryClient();
-  // First-run install gate: a fresh instance reports configured=false and runs in setup mode.
-  // We check this before anything else and render the wizard; `me` is held back until we know the
-  // instance is set up (otherwise it would 503 against the setup-mode lock).
+  // Passive observers (enabled:false) of the setup-status and `me` queries BootGate fetches, polls
+  // and waits for: App mounts only once both have answered, so their caches are always populated here.
   const setupQuery = useQuery({
     queryKey: qk.setupStatus(),
     queryFn: api.setupStatus,
-    staleTime: Infinity,
+    enabled: false,
   });
   const needsSetup = setupQuery.data?.configured === false;
-  // Poll the session so an account suspended/deleted by an admin is noticed even with no
-  // interaction (option 1): the refetch 401s → the 401 handler below drops to the login page.
-  // Only poll while signed in (data present) — polling on the public login page is pointless and
-  // its periodic refetch caused a visible flicker there.
-  const meQuery = useQuery({
-    queryKey: qk.me(),
-    queryFn: api.me,
-    enabled: setupQuery.isSuccess && !needsSetup,
-    refetchInterval: (query) => (query.state.data ? 60_000 : false),
-  });
+  const meQuery = useQuery({ queryKey: qk.me(), queryFn: api.me, enabled: false });
 
   // The `global` key scope: `h` opens the cheat sheet, Mod+K the jump-to palette, Shift+W jumps to
   // Home ("mit nézzek?"). Bound only once signed in, because that is where the overlays are mounted
@@ -155,14 +151,25 @@ export default function App() {
     meQuery.data ? [...moduleOrder(meQuery.data), "settings"] : [],
   );
 
-  // Pin this tab to whatever account it first loaded as. Without this, a tab that never picked
-  // an account (it was riding the session's default) would silently swap identity when ANOTHER
-  // tab changes the default — e.g. that other tab adds/switches an account. Once pinned, this
-  // tab always sends its own account header, so cross-tab changes can't reach it. An explicit
-  // switch on THIS tab sets the override itself (so this no-ops then).
+  // Fetch the code of every module this account can open — and the channel page — once the first page
+  // is on screen, so a module's first visit renders at once instead of flashing the chunk fallback.
+  // Idle-scheduled so it never competes with the first page's own requests (Safari has no
+  // requestIdleCallback, hence the timer).
   useEffect(() => {
-    if (meQuery.data && getActiveAccount() == null) setActiveAccount(meQuery.data.id);
-  }, [meQuery.data?.id]);
+    const me = meQuery.data;
+    if (!me) return;
+    const run = () => {
+      preloadPages([...moduleOrder(me), "settings"]);
+      ChannelPage.preload().catch(() => {});
+    };
+    const idle = window.requestIdleCallback as typeof window.requestIdleCallback | undefined;
+    if (idle) {
+      const id = idle(run, { timeout: 3000 });
+      return () => window.cancelIdleCallback(id);
+    }
+    const id = window.setTimeout(run, 1000);
+    return () => window.clearTimeout(id);
+  }, [meQuery.data?.id]); // eslint-disable-line react-hooks/exhaustive-deps
 
   // Measure the scrollbar's gutter width once and publish it as --sbw, so the floating header and the
   // toolbar band can pad their right edge to line up with the scrolled cards (the app scroller reserves
@@ -238,28 +245,6 @@ export default function App() {
     clearParams("admin");
   }, [adminDeepLink, meQuery.data?.id]); // eslint-disable-line react-hooks/exhaustive-deps
 
-  // On login, adopt the server-stored SHELL preferences (panel layouts + language). The rail-collapse
-  // flags (filterCollapsed / playlistsCollapsed) are adopted by their own usePref hooks, the
-  // Settings-page prefs (theme/perf/hints/notifications) by PrefsProvider, and the feed view by
-  // FeedViewProvider — each via its own passive qk.me() observer.
-  useEffect(() => {
-    const prefs = meQuery.data?.preferences;
-    if (!prefs) return;
-    (["feed", "plex", "playlists"] as PanelId[]).forEach((p) => {
-      const raw = prefs[PREF_KEY[p]];
-      if (raw) {
-        const l = normalizeLayout(p, raw);
-        setPanelLayouts((prev) => ({ ...prev, [p]: l }));
-        saveLayoutLocal(p, l);
-      }
-    });
-    const lang = prefs.language;
-    if (typeof lang === "string" && isSupported(lang)) setLanguage(lang);
-    // (Per-account filters — incl. the demo account's whole-library default — are loaded by the
-    // dedicated effect above, which also covers accounts that have no stored preferences.)
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [meQuery.data?.id]);
-
   // Nudge admins when access requests are waiting (in lieu of a server-push bell). Keyed on the
   // pending COUNT so it re-resolves the moment an approval/denial changes it — not only on a
   // fresh load (which is why the notice used to linger until F5 after an approval).
@@ -304,32 +289,14 @@ export default function App() {
   }
 
   // First-run: a fresh instance is in setup mode (all other routes are locked) → show the wizard.
-  if (setupQuery.isLoading)
-    return (
-      <div className="min-h-screen grid place-items-center text-muted">{t("common.loading")}</div>
-    );
   if (needsSetup) return <SetupWizard />;
-
-  if (meQuery.isLoading)
-    return (
-      <div className="min-h-screen grid place-items-center text-muted">{t("common.loading")}</div>
-    );
-  // /api/me answers 200 always now (null body = logged out), so a thrown error here is a real
-  // network/5xx failure, and no data means "not signed in" → the public landing.
-  if (meQuery.error)
-    return (
-      <div className="min-h-screen grid place-items-center">
-        <StateMessage tone="error" onRetry={() => meQuery.refetch()}>
-          {t("common.somethingWrong")}
-        </StateMessage>
-      </div>
-    );
+  // /api/me answers 200 always (null body = logged out), and BootGate has already handled a failed
+  // probe — so no data here means "not signed in" → the public landing.
   if (!meQuery.data) return <Welcome verify={verifyEntry} />;
 
-  // Shown briefly while a lazy page/module chunk loads (first visit to that page only).
-  const pageFallback = (
-    <div className="flex-1 grid place-items-center text-muted">{t("common.loading")}</div>
-  );
+  // Shown while a page's chunk is still on its way: only if its visit beats the preload above (or the
+  // preload failed), and like every loading state it stays invisible for a load that is quick anyway.
+  const pageFallback = <LoadingState className="flex-1 justify-center" />;
 
   // Scroll restore/reset key for the shared normal-page scroller (see PageScroller): the same
   // page/feed-filters returns you to where you were (bug 1); a changed feed filter is a new key, so

frontend/src/components/BootGate.dom.test.tsx

@@ -0,0 +1,208 @@
+// @vitest-environment jsdom
+//
+// BootGate settles the tab's identity BEFORE the app tree mounts. The bug it replaced: a new tab (no
+// pinned account in sessionStorage) built the app for "no account" first — so with Settings →
+// Appearance → Startup turned off, NavigationProvider's initializer could not read the opt-out and
+// landed on Home, mirrored ?page=home into the address bar, and then re-read its own mirror when the
+// account was pinned, staying on Home. Only a same-tab reload (account already pinned) was right.
+//
+// Real NavigationProvider, real storage and i18n; only the two boot probes are stubbed. The probe
+// records EVERY render, so "never showed the wrong page, not even for one render" is what is asserted.
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { render, screen, cleanup, act, fireEvent, waitFor } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { useEffect } from "react";
+import { useTranslation } from "react-i18next";
+import BootGate from "./BootGate";
+import { NavigationProvider, useNavigation } from "./NavigationProvider";
+import { api, type Me } from "../lib/api";
+import { ACTIVE_ACCOUNT_KEY } from "../lib/activeAccount";
+import { qk } from "../lib/queryKeys";
+import i18n from "../i18n";
+
+const renders: { page: string; lang: string }[] = [];
+let mounts = 0;
+function Probe() {
+  const { page } = useNavigation();
+  const { i18n: inst } = useTranslation();
+  renders.push({ page, lang: inst.language });
+  useEffect(() => {
+    mounts++;
+  }, []);
+  return <div data-testid="app">{page}</div>;
+}
+
+function mount() {
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  render(
+    <QueryClientProvider client={qc}>
+      <BootGate>
+        <NavigationProvider>
+          <Probe />
+        </NavigationProvider>
+      </BootGate>
+    </QueryClientProvider>,
+  );
+  return qc;
+}
+const account = (over: Partial<Me> = {}) => ({ id: 5, preferences: {}, ...over }) as Me;
+const retryButton = () => screen.findByRole("button", { name: i18n.t("common.retry") });
+
+beforeEach(async () => {
+  localStorage.clear();
+  sessionStorage.clear(); // a NEW tab: nothing pinned yet
+  window.history.replaceState(null, "", "/");
+  renders.length = 0;
+  mounts = 0;
+  await i18n.changeLanguage("en");
+  vi.spyOn(api, "setupStatus").mockResolvedValue({ configured: true });
+});
+afterEach(() => {
+  cleanup();
+  vi.restoreAllMocks();
+  vi.unstubAllGlobals();
+});
+
+describe("BootGate", () => {
+  it("a new tab with Startup off opens on the page the account left — never on Home first", async () => {
+    localStorage.setItem("siftlode.startOnHome.5", "0");
+    localStorage.setItem("siftlode.page.5", "downloads");
+    vi.spyOn(api, "me").mockResolvedValue(account());
+    mount();
+
+    expect((await screen.findByTestId("app")).textContent).toBe("downloads");
+    expect(renders.map((r) => r.page)).toEqual(renders.map(() => "downloads"));
+    expect(new URLSearchParams(window.location.search).get("page")).toBe("downloads");
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBe("5"); // the tab is pinned
+  });
+
+  it("renders the app in the account's language from its first render", async () => {
+    vi.spyOn(api, "me").mockResolvedValue(account({ preferences: { language: "hu" } }));
+    mount();
+
+    await screen.findByTestId("app");
+    expect(renders.map((r) => r.lang)).toEqual(renders.map(() => "hu"));
+  });
+
+  it("mounts nothing of the app while the identity is still unknown", async () => {
+    vi.spyOn(api, "me").mockReturnValue(new Promise<Me | null>(() => {}));
+    mount();
+    await act(async () => {}); // the setup probe resolves; `me` never does
+
+    expect(screen.queryByTestId("app")).toBeNull();
+    expect(renders).toHaveLength(0);
+  });
+
+  it("signed out: mounts the app (App shows the landing) without pinning an account", async () => {
+    vi.spyOn(api, "me").mockResolvedValue(null);
+    mount();
+
+    await screen.findByTestId("app");
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBeNull();
+  });
+
+  it("setup mode: mounts the app (App shows the wizard) without asking for the account", async () => {
+    vi.mocked(api.setupStatus).mockResolvedValue({ configured: false });
+    const me = vi.spyOn(api, "me").mockResolvedValue(account());
+    mount();
+
+    await screen.findByTestId("app");
+    expect(me).not.toHaveBeenCalled();
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBeNull();
+  });
+
+  it("an unanswered setup probe is an error with a retry — never the signed-out landing", async () => {
+    vi.mocked(api.setupStatus)
+      .mockRejectedValueOnce(new Error("502"))
+      .mockResolvedValue({ configured: true });
+    vi.spyOn(api, "me").mockResolvedValue(account());
+    mount();
+
+    fireEvent.click(await retryButton());
+    await screen.findByTestId("app");
+    expect(renders.length).toBeGreaterThan(0);
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBe("5"); // it mounted for the account
+  });
+
+  it("an unanswered first account probe is an error with a retry", async () => {
+    vi.spyOn(api, "me").mockRejectedValueOnce(new Error("502")).mockResolvedValue(account());
+    mount();
+
+    fireEvent.click(await retryButton());
+    await screen.findByTestId("app");
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBe("5");
+  });
+
+  it("a background refetch that fails keeps the app mounted, as it was", async () => {
+    const me = vi.spyOn(api, "me").mockResolvedValue(account());
+    const qc = mount();
+    await screen.findByTestId("app");
+
+    me.mockRejectedValue(new Error("502"));
+    await act(() => qc.refetchQueries({ queryKey: qk.me() }));
+    // react-query hands the error to its observers on a timer: let that render land before asserting.
+    await act(() => new Promise((r) => setTimeout(r, 20)));
+
+    expect(qc.getQueryState(qk.me())?.status).toBe("error");
+    expect(screen.getByTestId("app")).toBeTruthy();
+    expect(mounts).toBe(1);
+  });
+
+  it("a pin naming another account than the server answered as is corrected before the app reads it", async () => {
+    // Pinned to 9, but 9 was signed out in another tab: the server answers as the browser's default, 5.
+    sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, "9");
+    localStorage.setItem("siftlode.startOnHome.5", "0");
+    localStorage.setItem("siftlode.page.5", "downloads");
+    vi.spyOn(api, "me").mockResolvedValue(account());
+    mount();
+
+    expect((await screen.findByTestId("app")).textContent).toBe("downloads");
+    expect(renders.map((r) => r.page)).toEqual(renders.map(() => "downloads"));
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBe("5");
+  });
+
+  it("a mounted tab whose identity changes reloads rather than keep the previous account's tree", async () => {
+    const me = vi.spyOn(api, "me").mockResolvedValue(account());
+    const qc = mount();
+    await screen.findByTestId("app");
+    const reload = vi.fn();
+    vi.stubGlobal("location", { ...window.location, reload });
+
+    me.mockResolvedValue(null); // the session ended
+    await act(() => qc.refetchQueries({ queryKey: qk.me() }));
+
+    await waitFor(() => expect(reload).toHaveBeenCalled());
+  });
+
+  it("an identity change reloads without moving the pin first", async () => {
+    // The tree being torn down still runs its unmount saves before the page goes; with the pin already
+    // moved they would land under the NEW account's local keys (a player volume still pending, say).
+    const me = vi.spyOn(api, "me").mockResolvedValue(account());
+    const qc = mount();
+    await screen.findByTestId("app");
+    const reload = vi.fn();
+    vi.stubGlobal("location", { ...window.location, reload });
+
+    me.mockResolvedValue(account({ id: 6 })); // 5 was signed out elsewhere: the server answers as 6
+    await act(() => qc.refetchQueries({ queryKey: qk.me() }));
+
+    await waitFor(() => expect(reload).toHaveBeenCalled());
+    expect(sessionStorage.getItem(ACTIVE_ACCOUNT_KEY)).toBe("5");
+  });
+
+  it("a change to the account's data, not its identity, leaves the app as it is", async () => {
+    vi.spyOn(api, "me").mockResolvedValue(account());
+    const qc = mount();
+    await screen.findByTestId("app");
+    const reload = vi.fn();
+    vi.stubGlobal("location", { ...window.location, reload });
+
+    // What every pref save does to the cache (usePref's mergePrefsCache): a new `me` for the same account.
+    act(() => qc.setQueryData(qk.me(), account({ preferences: { language: "hu" } })));
+    await act(() => new Promise((r) => setTimeout(r, 20)));
+
+    expect(reload).not.toHaveBeenCalled();
+    expect(mounts).toBe(1);
+    expect(i18n.language).toBe("en"); // the language is adopted once, never over the user's own choice
+  });
+});

frontend/src/components/BootGate.tsx

@@ -0,0 +1,124 @@
+import { useLayoutEffect, useState, type ReactNode } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { useTranslation } from "react-i18next";
+import { api, getActiveAccount, setActiveAccount } from "../lib/api";
+import { qk } from "../lib/queryKeys";
+import i18n, { isSupported, setLanguage } from "../i18n";
+import { LoadingState, StateMessage } from "./ui/QueryState";
+
+// The boot sequence, in ONE place: nothing of the app renders until this tab knows WHO it is.
+//
+// Per-account state is everywhere — the landing page, the feed's filters, the Plex scope, the manager's
+// tab, the theme, the language — and all of it is read synchronously when its provider mounts. Those
+// providers used to mount before /api/me answered, so a new tab first built the app for "no account"
+// (defaults: Home instead of the page you left, the default theme, the browser language) and then
+// patched each piece once <App> pinned the account. Every patch was a visible jump at best, and at
+// worst it read a value the first pass had already written (the landing page mirrored ?page=home into
+// the address bar, then re-read its own mirror and stayed on Home). So the order is inverted instead:
+// settle the identity, adopt what must be adopted before a single pixel of the app is drawn, THEN mount
+// the provider tree — whose initializers are then simply right, with nothing to re-read.
+//
+// The per-account initializers read the tab's PIN (sessionStorage), not `me`, so the pin is made to
+// match the account the server answered as before they run. And the tree is only ever built for one
+// identity: if a mounted tab's identity changes without a reload (its session ended, or the account it
+// was pinned to was signed out in another tab and the server now answers as the browser's default),
+// the tab reloads, like every account switch does (NavSidebar) — which also drops the previous
+// account's query cache, whose keys are not per account.
+
+/** The quiet screen shown while the tab's identity (or the app chunk) is still on its way — the shared
+ * loading visual, full screen. Its reveal counts from navigation start, so the gate's screen, the
+ * Suspense fallback after it and the first page's own loading state keep one clock (see LoadingState). */
+export function BootScreen() {
+  return (
+    <div className="min-h-screen grid place-items-center">
+      <LoadingState since={0} delayMs={400} />
+    </div>
+  );
+}
+
+export default function BootGate({ children }: { children: ReactNode }) {
+  const { t } = useTranslation();
+  // First-run install gate: a fresh instance reports configured=false and runs in setup mode, where
+  // every other route is locked — so `me` is held back until the instance is known to be set up
+  // (otherwise it would 503 against the setup-mode lock).
+  const setupQuery = useQuery({
+    queryKey: qk.setupStatus(),
+    queryFn: api.setupStatus,
+    staleTime: Infinity,
+  });
+  const needsSetup = setupQuery.data?.configured === false;
+  // THE fetching `me` query; every other reader is a passive (enabled:false) observer of its cache.
+  // Polled while signed in so an ended session is noticed with no interaction: /api/me answers a
+  // signed-out (or suspended) caller with 200 and no account, the identity drops to "nobody", and the
+  // tab reloads to the login page. Not polled signed out — that refetch is pointless and used to
+  // flicker the public landing.
+  const meQuery = useQuery({
+    queryKey: qk.me(),
+    queryFn: api.me,
+    enabled: setupQuery.isSuccess && !needsSetup,
+    refetchInterval: (query) => (query.state.data ? 60_000 : false),
+  });
+  const me = meQuery.data;
+
+  // Who this tab is, once known: an account id, `null` for "nobody" (signed out, or setup mode — App
+  // renders the landing / the wizard for those), `undefined` while unknown or unanswerable.
+  // Keyed on the DATA, not the status: a background refetch that fails keeps the last answer, so a
+  // server blip never tears the whole app down to this screen.
+  const identity: number | null | undefined = !setupQuery.data
+    ? undefined
+    : needsSetup
+      ? null
+      : me === undefined
+        ? undefined
+        : (me?.id ?? null);
+
+  // Adopt the identity before the tree mounts. A layout effect, so the re-render it triggers happens
+  // before the browser paints: the frame that first shows the app already has the account pinned.
+  //   • Pin this tab to the account the server answered as. Without the pin, a tab riding the
+  //     session's default account would silently swap identity when ANOTHER tab changes that default
+  //     (adds or switches an account); once pinned it sends its own account header. The server honours
+  //     that header only for an account still signed in to this browser, so a pin naming one that is
+  //     not is corrected here — otherwise the tab would run as the default account on the server while
+  //     reading and writing the gone account's local state.
+  //   • Adopt the account's language, which follows the account across devices — the local copy only
+  //     knows what this browser last showed.
+  const [readyFor, setReadyFor] = useState<number | null | undefined>(undefined);
+  useLayoutEffect(() => {
+    if (identity === undefined) return;
+    if (readyFor !== undefined) {
+      // The tree was built for another identity — see the header. The pin stays as it is: the tree
+      // being torn down still runs its unmount saves before the page goes, and with the pin moved they
+      // would land under the new account's local keys. The reloaded page's first probe corrects it.
+      location.reload();
+      return;
+    }
+    if (me && getActiveAccount() !== me.id) setActiveAccount(me.id);
+    const lang = me?.preferences?.language;
+    if (typeof lang === "string" && isSupported(lang) && lang !== i18n.language) setLanguage(lang);
+    setReadyFor(identity);
+    // `me` is read for the identity it produced; a background refetch of the same account must not
+    // re-run the adoption over a language the user has just changed.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [identity]);
+
+  // No answer at all (a network or 5xx failure on the very first setup or account probe — past the
+  // one retry `req` already makes): say so, with a retry. An unanswered setup probe is NOT "signed
+  // out": rendering the login page to a signed-in user would be a lie. After a retry the identity
+  // lands and the tree mounts from scratch, like any first load.
+  const failed =
+    !setupQuery.data && setupQuery.isError
+      ? setupQuery
+      : me === undefined && meQuery.isError
+        ? meQuery
+        : null;
+  if (failed)
+    return (
+      <div className="min-h-screen grid place-items-center">
+        <StateMessage tone="error" onRetry={() => failed.refetch()}>
+          {t("common.somethingWrong")}
+        </StateMessage>
+      </div>
+    );
+  if (identity === undefined || readyFor !== identity) return <BootScreen />;
+  return <>{children}</>;
+}

frontend/src/components/ChannelsProvider.dom.test.tsx

@@ -17,7 +17,6 @@ vi.mock("./NavigationProvider", () => ({
 }));
 
 import { ChannelsProvider, useChannels, useChannelsActions } from "./ChannelsProvider";
-import { setActiveAccount } from "../lib/api/core";
 
 const wrapper = ({ children }: { children: ReactNode }) => (
   <ChannelsProvider>{children}</ChannelsProvider>
@@ -101,20 +100,17 @@ describe("ChannelsProvider — S8 shareable URL", () => {
     expect(new URLSearchParams(window.location.search).has("ctab")).toBe(false);
   });
 
-  it("a PARTIAL shared link (fresh tab) does not clobber the account's stored sort/filters", () => {
-    // Regression: on a fresh tab the account pins AFTER mount, so the seed's base for the OMITTED
-    // dimensions was read as defaults. Persisting the whole seed used to overwrite the account's real
-    // stored sort + filter map. The fix persists ONLY the URL-present dimensions.
+  it("a PARTIAL shared link does not clobber the account's stored sort/filters", () => {
+    // Regression: the seed's base for the OMITTED dimensions used to be read as defaults, and
+    // persisting the seed overwrote the account's real stored sort + filter map.
     localStorage.setItem(
       "siftlode.channelSort.1",
       JSON.stringify({ key: "subscribers", dir: "desc" }),
     );
     localStorage.setItem("siftlode.channelsFilterMap.1", JSON.stringify({ sync: "needsFull" }));
-    sessionStorage.removeItem("siftlode.activeAccount"); // account not pinned yet at mount
     window.history.replaceState({ sfPage: "channels" }, "", "/?ctab=hidden"); // only the tab in the URL
 
     const { result } = render();
-    act(() => setActiveAccount(1)); // App pins the account after /api/me
 
     // The present dim (tab) is adopted from the link...
     expect(result.current.view).toBe("hidden");

frontend/src/components/ChannelsProvider.tsx

@@ -9,12 +9,11 @@ import {
   useState,
   type ReactNode,
 } from "react";
-import { getAccountRaw, setAccountRaw, LS } from "../lib/storage";
+import { getAccountRaw, LS } from "../lib/storage";
 import { parseChannelLayout, type ChannelLayout } from "../lib/channelLayout";
 import { hydrateSort, type SortState } from "../lib/columnSort";
 import { useSortState } from "../lib/useSortState";
 import { useFilterState } from "../lib/useFilterState";
-import { useActiveAccountId } from "../lib/activeAccount";
 import { useUrlMirror } from "../lib/useUrlMirror";
 import { rememberNavPosition } from "../lib/history";
 import {
@@ -74,25 +73,16 @@ function readStoredFilters(): FilterMap {
 // present, the URL wins over this account's stored view — read once at mount and applied over the slice
 // hooks (see the provider). The keys are channels-unique, so their mere presence identifies a shared
 // manager view; no ?page check is needed (the mirror below is page-gated so it never pollutes others).
-// The seed = the URL-merged state PLUS which dimensions the URL actually carried. `present` matters
-// because the base below is read at MOUNT, before the account is pinned (getAccountRaw returns null),
-// so an OMITTED dimension's base is a default, not this account's stored value. The provider seeds and
-// persists only the PRESENT dimensions and lets the absent ones re-hydrate from storage normally —
-// otherwise a partial shared link silently resets the omitted stored sort / filter map.
-type ChannelsSeedPresent = { view: boolean; sort: boolean; filters: boolean };
-type ChannelsUrlSeed = { state: ChannelsUrlState; present: ChannelsSeedPresent };
-function readChannelsUrlSeed(): ChannelsUrlSeed | null {
+// The base is this account's stored view (BootGate pins the account before this provider mounts), so
+// a PARTIAL link — one carrying only the tab, say — keeps the stored sort and filter map for the rest.
+function readChannelsUrlSeed(): ChannelsUrlState | null {
   const params = new URLSearchParams(window.location.search);
   if (!hasChannelsParams(params)) return null;
-  const state = channelsParamsToState(params, {
+  return channelsParamsToState(params, {
     view: clampView(getAccountRaw(LS.channelsView)),
     sort: hydrateSort(getAccountRaw(LS.channelSort), [], null),
     filters: readStoredFilters(),
   });
-  return {
-    state,
-    present: { view: params.has("ctab"), sort: params.has("csort"), filters: params.has("cf") },
-  };
 }
 
 type ChannelsState = {
@@ -168,10 +158,9 @@ export function ChannelsProvider({ children }: { children: ReactNode }) {
   // The subscribed table's column-filter map, owned here (lifted out of DataTable) so the top status
   // chips, the Sync column funnel, and the card layout share one state; useFilterState persists it.
   const [filters, setFilters] = useFilterState(LS.channelsFilterMap, migrateSyncChip);
-  // view + layout are persisted tabs (usePersistedTab = the shared account-scoped tab-state hook), so
-  // they get init-from-storage AND the account-pin re-hydrate for free (this provider mounts above
-  // <App>, which pins the account only after /api/me). Stored un-clamped; clampView/parseChannelLayout
-  // heal them for display. setView layers the history logic (below) on top of the raw setter.
+  // view + layout are persisted tabs (usePersistedTab = the shared account-scoped tab-state hook).
+  // Stored un-clamped; clampView/parseChannelLayout heal them for display. setView layers the history
+  // logic (below) on top of the raw setter.
   const [viewRaw, setViewRaw] = usePersistedTab(LS.channelsView, "subscribed");
   const view = clampView(viewRaw);
   const [layoutRaw, setLayout] = usePersistedTab(LS.channelLayout, "table");
@@ -185,43 +174,20 @@ export function ChannelsProvider({ children }: { children: ReactNode }) {
 
   // S8 — shareable manager view. Captured once at mount (or null when no manager URL keys are present).
   const [urlSeed] = useState(readChannelsUrlSeed);
-  const accountId = useActiveAccountId();
   const seededRef = useRef(false);
-  const persistedRef = useRef(false);
 
-  // Apply the shared-link seed once, BEFORE paint, through the slice setters. Going through the setters
-  // (not raw state) is deliberate: each one calls its hook's markDirty, so the account-pin re-hydrate
-  // (which fires later on a fresh tab) sees the slice as user-edited and won't reload the stored view
-  // over the shared one. setViewRaw (not setView) restores the tab without pushing a phantom history
-  // entry. A normal load has urlSeed === null and this is a no-op.
+  // Apply the shared-link seed once, BEFORE paint, through the slice setters — which persist it, so the
+  // shared view also survives a later PLAIN reload (no URL). setViewRaw (not setView) restores the tab
+  // without pushing a phantom history entry. A normal load has urlSeed === null and this is a no-op.
   useLayoutEffect(() => {
     if (!urlSeed || seededRef.current) return;
     seededRef.current = true;
-    // Only apply the dimensions the URL actually carried. An omitted dimension must NOT go through its
-    // setter (which would markDirty and block the account-pin re-hydrate from loading the stored value)
-    // — leave it to hydrate from storage normally. Fixes a partial link wiping the stored sort/filters.
-    const { state, present } = urlSeed;
-    if (present.view && state.view !== view) setViewRaw(state.view);
-    if (present.filters) setFilters(state.filters);
-    if (present.sort) setSort(state.sort);
+    if (urlSeed.view !== view) setViewRaw(urlSeed.view);
+    setFilters(urlSeed.filters);
+    setSort(urlSeed.sort);
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
 
-  // On a fresh tab the account pins AFTER mount, so the seed's setter writes above no-op'd (no account
-  // yet). Persist the seed to the account once it's known, so the shared view also survives a later
-  // PLAIN reload (no URL) — mirrors PlexProvider's rehydrate-persist. The slice hooks' own re-hydrate
-  // already skips (marked dirty above), so this only touches storage, not state.
-  useEffect(() => {
-    if (!urlSeed || accountId == null || persistedRef.current) return;
-    persistedRef.current = true;
-    // Persist ONLY the URL-present dimensions — the omitted ones were seeded from mount-time defaults
-    // (no account yet), so writing them here would overwrite the account's real stored sort/filter map.
-    const { state, present } = urlSeed;
-    if (present.view) setAccountRaw(LS.channelsView, state.view);
-    if (present.filters) setAccountRaw(LS.channelsFilterMap, JSON.stringify(state.filters));
-    if (present.sort) setAccountRaw(LS.channelSort, JSON.stringify(state.sort));
-  }, [urlSeed, accountId]);
-
   // Latest-value ref so the STABLE setView can compare against the current tab without depending on
   // it (a dep would recreate the action on every switch and re-render every actions consumer).
   // Written during render — the sanctioned pattern NavigationProvider uses for `pageRef`.
@@ -237,7 +203,7 @@ export function ChannelsProvider({ children }: { children: ReactNode }) {
       // Re-selecting the tab you are already on is not a navigation — bail before pushing, or clicking
       // the active tab (and goToFullHistory forcing "subscribed") stacks Back entries that do nothing.
       if (v === viewRef.current) return;
-      setViewRaw(v); // persists + guards the account-pin re-hydrate (via usePersistedTab)
+      setViewRaw(v); // persists (via usePersistedTab)
       // Only own an entry while the manager is already on screen. Arriving from elsewhere
       // (focusChannel / goToFullHistory) lets setPage push the entry — the stamp effect labels it — so
       // one navigation never costs two Back presses.

frontend/src/components/ConfigPanel.tsx

@@ -18,7 +18,7 @@ import { notifyActionError } from "../lib/actionErrors";
 
 // Admin Configuration page: edit DB-overridable operational settings (registry-driven from the
 // backend — adding a key there makes it appear here automatically). Edits are drafted and
-// applied together via one Save/Discard bar (consistent with the Settings page); nothing hits
+// applied together via one Save/Discard bar; nothing hits
 // the server until Save. Group order is fixed where known so logically related settings (e.g.
 // Email/SMTP) stay together.
 const GROUP_ORDER = [

frontend/src/components/DownloadCenter.confirm.dom.test.tsx

@@ -0,0 +1,103 @@
+// @vitest-environment jsdom
+//
+// The Download Center's confirm dialogs name their ACTION on the confirm button (E11.5): the shared
+// `confirmThen` once labelled it with the dialog's question — "Re-download this file?" on the button,
+// and the cancel dialog's own "Cancel" beside "Cancel". i18n is key-passthrough, so labels read as keys.
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import type { DownloadJob } from "../lib/api";
+
+const mocks = vi.hoisted(() => ({
+  jobs: [] as unknown[],
+  confirm: vi.fn(async (_opts: { title: string; confirmLabel?: string }) => false),
+}));
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return { ...actual, useTranslation: () => ({ t: (key: string) => key }) };
+});
+vi.mock("./ConfirmProvider", () => ({ useConfirm: () => mocks.confirm }));
+vi.mock("../lib/useLiveQuery", () => ({
+  useLiveQuery: (key: readonly unknown[]) => ({
+    data: key[0] === "downloads" ? mocks.jobs : undefined,
+    isError: false,
+    isLoading: false,
+    refetch: vi.fn(),
+  }),
+}));
+vi.mock("../lib/useMe", () => ({ useMe: () => ({ role: "user" }) }));
+// The page toolbar (title + tabs) renders into the app shell's slot, which a bare render has none of.
+vi.mock("./ui/PageShell", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("./ui/PageShell")>()),
+  PageToolbar: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+}));
+
+import DownloadCenter from "./DownloadCenter";
+
+const job = (id: number, status: DownloadJob["status"]): DownloadJob => ({
+  id,
+  status,
+  progress: 0,
+  speed_bps: null,
+  eta_s: null,
+  phase: null,
+  error: null,
+  error_code: null,
+  error_detail: null,
+  queue_pos: 0,
+  created_at: null,
+  source_kind: "youtube",
+  source_ref: `v${id}`,
+  source_url: null,
+  poster_url: null,
+  profile_id: null,
+  spec: {
+    mode: "av",
+    max_height: null,
+    container: null,
+    audio_format: null,
+    vcodec: null,
+    embed_subs: false,
+    embed_chapters: false,
+    embed_thumbnail: false,
+    sponsorblock: false,
+  },
+  display_name: `Clip ${id}`,
+  display_uploader: null,
+  display_uploader_url: null,
+  extra_links: [],
+  can_download: status === "done",
+  expired: false,
+  asset: null,
+});
+
+afterEach(() => {
+  cleanup();
+  mocks.confirm.mockClear();
+});
+
+describe("DownloadCenter confirm dialogs", () => {
+  it("label the confirm button with the action, not the dialog's question", async () => {
+    mocks.jobs = [job(1, "running"), job(2, "done")];
+    render(
+      <QueryClientProvider client={new QueryClient()}>
+        <DownloadCenter />
+      </QueryClientProvider>,
+    );
+
+    fireEvent.click(screen.getByTitle("downloads.actions.cancel"));
+    await waitFor(() => expect(mocks.confirm).toHaveBeenCalledTimes(1));
+    // The tab's label shares its button with a count badge.
+    fireEvent.click(screen.getByRole("button", { name: /downloads\.tabs\.done/ }));
+    fireEvent.click(await screen.findByTitle("downloads.actions.redownload"));
+    fireEvent.click(screen.getByTitle("downloads.actions.delete"));
+    await waitFor(() => expect(mocks.confirm).toHaveBeenCalledTimes(3));
+
+    expect(mocks.confirm.mock.calls.map(([o]) => [o.title, o.confirmLabel])).toEqual([
+      ["downloads.confirm.cancelTitle", "downloads.confirm.cancelAction"],
+      ["downloads.confirm.redownloadTitle", "downloads.confirm.redownloadAction"],
+      ["downloads.confirm.deleteTitle", "downloads.actions.delete"],
+    ]);
+  });
+});

frontend/src/components/DownloadCenter.tsx

@@ -109,8 +109,10 @@ export default function DownloadCenter() {
     meta: { failTitle: "errors.writeFailed.removeShared" },
   });
 
-  const confirmThen = async (title: string, body: string, fn: () => void) => {
-    if (await confirm({ title, message: body, confirmLabel: title, danger: true })) fn();
+  // The confirm button names the ACTION ("Remove"), never the dialog's question: labelled with the title
+  // it read "Re-download this file?", and the cancel dialog's own "Cancel" would sit beside "Cancel".
+  const confirmThen = async (title: string, body: string, action: string, fn: () => void) => {
+    if (await confirm({ title, message: body, confirmLabel: action, danger: true })) fn();
   };
 
   // One-click share (E7 S3 · D2-A): ensure a downloadable link, copy it, toast with "open in new tab"
@@ -254,6 +256,7 @@ export default function DownloadCenter() {
                       confirmThen(
                         t("downloads.confirm.cancelTitle"),
                         t("downloads.confirm.cancelBody"),
+                        t("downloads.confirm.cancelAction"),
                         () => act.mutate({ id: job.id, op: "cancel" }),
                       )
                     }
@@ -327,6 +330,7 @@ export default function DownloadCenter() {
                           confirmThen(
                             t("downloads.confirm.redownloadTitle"),
                             t("downloads.confirm.redownloadBody"),
+                            t("downloads.confirm.redownloadAction"),
                             () => act.mutate({ id: job.id, op: "redownload" }),
                           )
                         }
@@ -340,6 +344,7 @@ export default function DownloadCenter() {
                         confirmThen(
                           t("downloads.confirm.deleteTitle"),
                           t("downloads.confirm.deleteBody"),
+                          t("downloads.actions.delete"),
                           () => act.mutate({ id: job.id, op: "delete" }),
                         )
                       }
@@ -394,6 +399,7 @@ export default function DownloadCenter() {
                       confirmThen(
                         t("downloads.confirm.removeSharedTitle"),
                         t("downloads.confirm.removeSharedBody"),
+                        t("downloads.actions.removeShared"),
                         () => removeShared.mutate(job.id),
                       )
                     }

frontend/src/components/FeedFiltersProvider.seed.dom.test.tsx

@@ -0,0 +1,68 @@
+// @vitest-environment jsdom
+//
+// The shared demo account has no subscriptions, so its feed opens on the whole library. The filters are
+// seeded from the `me` cache at mount — BootGate mounts the tree only once it is there. The adopt effect
+// this replaced applied the demo default after mounting; with it gone, a seed that did not read `me`
+// would open the demo account on its empty subscriptions scope.
+//
+// A share link's filters are written to the account once at mount too, so the view the link opened
+// survives a later plain reload (the state itself is seeded from the URL, so only storage shows it).
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { cleanup, render } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { NavigationProvider } from "./NavigationProvider";
+import { FeedFiltersProvider, useFeedFilters } from "./FeedFiltersProvider";
+import { ACTIVE_ACCOUNT_KEY } from "../lib/activeAccount";
+import { qk } from "../lib/queryKeys";
+import type { Me } from "../lib/api";
+
+const scopes: string[] = [];
+function Probe() {
+  scopes.push(useFeedFilters().scope);
+  return null;
+}
+
+function mount(me: Partial<Me>) {
+  const qc = new QueryClient();
+  qc.setQueryData(qk.me(), { id: 5, preferences: {}, ...me });
+  render(
+    <QueryClientProvider client={qc}>
+      <NavigationProvider>
+        <FeedFiltersProvider>
+          <Probe />
+        </FeedFiltersProvider>
+      </NavigationProvider>
+    </QueryClientProvider>,
+  );
+}
+
+beforeEach(() => {
+  localStorage.clear();
+  sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, "5");
+  scopes.length = 0;
+  window.history.replaceState(null, "", "/");
+});
+afterEach(() => {
+  cleanup();
+  window.history.replaceState(null, "", "/");
+});
+
+describe("FeedFiltersProvider seed", () => {
+  it("opens the shared demo account on the whole library from its first render", () => {
+    mount({ is_demo: true });
+    expect(scopes.length).toBeGreaterThan(0);
+    expect(scopes).toEqual(scopes.map(() => "all"));
+  });
+
+  it("opens any other account on its own scope", () => {
+    mount({ is_demo: false });
+    expect(scopes[0]).toBe("my");
+  });
+
+  it("keeps a share link's filters for the account, so a plain reload opens the same view", () => {
+    window.history.replaceState(null, "", "/?scope=all");
+    mount({ is_demo: false });
+    expect(scopes[0]).toBe("all");
+    expect(JSON.parse(localStorage.getItem("siftlode.filters.5") ?? "{}").scope).toBe("all");
+  });
+});

frontend/src/components/FeedFiltersProvider.tsx

@@ -8,14 +8,14 @@ import {
   type ReactNode,
 } from "react";
 import { qk } from "../lib/queryKeys";
-import { useQuery } from "@tanstack/react-query";
+import { useQueryClient } from "@tanstack/react-query";
 import {
-  api,
   getActiveAccount,
   coerceTagModes,
   coerceUntagged,
   DEFAULT_TAG_MODES,
   type FeedFilters,
+  type Me,
 } from "../lib/api";
 import { filterParamUpdates, hasFilterParams, paramsToFilters } from "../lib/urlState";
 import { useUrlMirror } from "../lib/useUrlMirror";
@@ -53,9 +53,8 @@ const DEFAULT_FILTERS: FeedFilters = {
 
 const FILTERS_KEY = LS.filters;
 
-// This account's own persisted filters (per-account keys — never another account's). When the
-// account isn't known yet (first load, before the tab is pinned), start from defaults; the post-login
-// effect loads the real ones once the id arrives.
+// This account's own persisted filters (per-account keys — never another account's). No account
+// (signed out) → defaults.
 export function loadAccountFilters(id: number | null): FeedFilters {
   // Your last-applied filters win, so a reload keeps whatever view you're on (a saved view you
   // picked, or manual tweaks) — setFilters persists them under LS.filters on every change. A starred
@@ -87,10 +86,12 @@ export function loadAccountFilters(id: number | null): FeedFilters {
 }
 
 // URL wins over localStorage so a pasted link reproduces the exact view.
-function loadInitialFilters(): FeedFilters {
+function loadInitialFilters(me: Me | null | undefined): FeedFilters {
   const params = new URLSearchParams(window.location.search);
   if (hasFilterParams(params)) return paramsToFilters(params, DEFAULT_FILTERS);
-  return loadAccountFilters(getActiveAccount());
+  const f = loadAccountFilters(getActiveAccount());
+  // The shared demo account has no subscriptions, so default it to the whole library.
+  return me?.is_demo ? { ...f, scope: "all" } : f;
 }
 
 interface FeedFiltersActions {
@@ -108,18 +109,18 @@ export function useFeedFiltersActions(): FeedFiltersActions {
 }
 
 export function FeedFiltersProvider({ children }: { children: ReactNode }) {
-  const [filters, setFiltersState] = useState<FeedFilters>(loadInitialFilters);
+  const qc = useQueryClient();
+  // Seeded for the account this tab is — BootGate mounts this provider only once the account is
+  // pinned and `me` is cached, so this is the account's own view from the first render.
+  const [filters, setFiltersState] = useState<FeedFilters>(() =>
+    loadInitialFilters(qc.getQueryData<Me | null>(qk.me())),
+  );
   // Whether this load arrived with feed-filter params in the URL (a bookmark/shared link). Captured
   // once at mount — such filters win over the account's stored view and are persisted to the account.
   const [initialHadUrlFilters] = useState(() =>
     hasFilterParams(new URLSearchParams(window.location.search)),
   );
 
-  // Passive observer: App owns the fetching `qk.me()` query (gated on setup state); enabled:false
-  // here reads its cache and re-renders when it lands, without triggering a second fetch (which
-  // could 503 in setup mode). We only need id + is_demo, which don't change on background refetch.
-  const meQuery = useQuery({ queryKey: qk.me(), queryFn: api.me, enabled: false });
-
   const setFilters = useCallback((next: FeedFilters) => {
     setFiltersState(next);
     // Persist under THIS tab's active account so filters don't bleed between accounts.
@@ -135,25 +136,12 @@ export function FeedFiltersProvider({ children }: { children: ReactNode }) {
   const { page } = useNavigation();
   useUrlMirror(filterParamUpdates(page === "feed" ? filters : null));
 
-  // Load THIS account's own filters when the account first resolves or changes (login / switch /
-  // add). Filters are per-account localStorage state, so another account's last view (incl. its
-  // default saved view) must never carry over. A share link's filters (captured at mount) win and
-  // are persisted to the account instead. Runs on id change only, so a 60s background refetch of
-  // the same account never clobbers the filters you're editing.
+  // A share link's filters (captured at mount) win over the account's stored view and are persisted
+  // to it once, so the view the link opened also survives a later plain reload.
   useEffect(() => {
-    const id = meQuery.data?.id;
-    if (id == null) return;
-    if (initialHadUrlFilters) {
-      const key = accountKey(FILTERS_KEY, id);
-      if (key) writeJSON(key, filters);
-      return;
-    }
-    let f = loadAccountFilters(id);
-    // The shared demo account has no subscriptions, so default it to the whole library.
-    if (meQuery.data?.is_demo) f = { ...f, scope: "all" };
-    setFiltersState(f);
+    if (initialHadUrlFilters) setFilters(filters);
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [meQuery.data?.id]);
+  }, []);
 
   const actions = useMemo<FeedFiltersActions>(() => ({ setFilters }), [setFilters]);
 

frontend/src/components/FeedViewProvider.tsx

@@ -7,9 +7,9 @@ import { usePref } from "../lib/usePref";
 // page and the channel page read it via hooks instead of prop-drilling `view`/`setView` through App.
 // Split State + Actions contexts, mirroring the other providers; composed in main.tsx around <App/>.
 //
-// The view mode is an account PREFERENCE, not a filter: it persists to the server on pick and is
-// adopted from server prefs on login. usePref carries that server-sync (plus the localStorage mirror
-// that seeds the first render synchronously) so this provider is just the two contexts over it.
+// The view mode is an account PREFERENCE, not a filter: it persists to the server on pick and follows
+// the account across devices. usePref carries that server-sync (seeded from the server pref, with the
+// localStorage mirror as the fallback) so this provider is just the two contexts over it.
 
 interface FeedViewActions {
   setView: (v: FeedView) => void;

frontend/src/components/KeyGate.tsx

@@ -22,8 +22,8 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
   });
   const configured = keyQ.data?.configured ?? false;
   // Password accounts must re-verify to reset (guards a hijacked session); Google-only accounts
-  // have no password to check. Reactive passive observer of the App-owned qk.me() query (enabled:
-  // false — App does the fetching), so hasPassword stays correct even if me resolves after mount.
+  // have no password to check. Passive observer of the qk.me() query BootGate fetches (enabled:false),
+  // so hasPassword follows the cache when a refetch changes it.
   const meQ = useQuery({ queryKey: qk.me(), queryFn: api.me, enabled: false });
   const hasPassword = meQ.data?.has_password ?? false;
 
@@ -32,9 +32,13 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
   const [confirm, setConfirm] = useState("");
   const [curPass, setCurPass] = useState("");
   const [err, setErr] = useState<string | null>(null);
+  // Keys the error: failing the same way twice is a new node, so a screen reader announces it again (a clear
+  // and a set in one handler commit together, leaving the node untouched).
+  const [attempt, setAttempt] = useState(0);
   const [busy, setBusy] = useState(false);
 
   async function submit() {
+    setAttempt((n) => n + 1);
     setErr(null);
     if (pass.length < 6) return setErr(t("messages.passTooShort"));
     if (!configured && pass !== confirm) return setErr(t("messages.passMismatch"));
@@ -67,6 +71,7 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
   }
 
   async function doReset() {
+    setAttempt((n) => n + 1);
     setErr(null);
     if (hasPassword && !curPass) return setErr(t("messages.resetNeedPass"));
     setBusy(true);
@@ -106,7 +111,11 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
             className={inputCls}
           />
         )}
-        {err && <div className="text-sm text-danger">{err}</div>}
+        {err && (
+          <div key={attempt} role="alert" className="text-sm text-danger">
+            {err}
+          </div>
+        )}
         <div className="flex gap-2">
           <Button variant="outline" onClick={cancelReset} disabled={busy}>
             {t("common.cancel")}
@@ -153,7 +162,11 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
           className={inputCls}
         />
       )}
-      {err && <div className="text-sm text-danger">{err}</div>}
+      {err && (
+        <div key={attempt} role="alert" className="text-sm text-danger">
+          {err}
+        </div>
+      )}
       <Button variant="primary" size="md" onClick={submit} disabled={busy || !pass}>
         <Lock className="w-4 h-4" />
         {configured ? t("messages.unlock") : t("messages.setUp")}

frontend/src/components/LibraryPlayer.dom.test.tsx

@@ -11,6 +11,8 @@ vi.mock("react-i18next", async (importOriginal) => {
   const actual = await importOriginal<typeof import("react-i18next")>();
   return { ...actual, useTranslation: () => ({ t: (key: string) => key }) };
 });
+const expose = vi.hoisted(() => vi.fn());
+vi.mock("../lib/browserBackgroundPlay", () => ({ exposeVideoToBackgroundPlay: expose }));
 
 import LibraryPlayer from "./LibraryPlayer";
 import type { DownloadJob } from "../lib/api";
@@ -24,6 +26,7 @@ const baseJob: DownloadJob = {
   phase: null,
   error: null,
   error_code: null,
+  error_detail: null,
   queue_pos: 0,
   created_at: null,
   source_kind: "youtube",
@@ -89,6 +92,11 @@ describe("LibraryPlayer", () => {
     expect(document.body.querySelector("audio")).toBeNull();
   });
 
+  it("hands its <video> to the background-play hook, so Brave iOS keeps it playing", () => {
+    render(<LibraryPlayer job={withAsset({ width: 1280, height: 720 })} onClose={() => {}} />);
+    expect(expose).toHaveBeenCalledWith(document.body.querySelector("video"));
+  });
+
   it("plays an audio-only asset (media_kind='audio') in an <audio> element", () => {
     render(
       <LibraryPlayer

frontend/src/components/LibraryPlayer.tsx

@@ -3,6 +3,7 @@ import { useTranslation } from "react-i18next";
 import Modal from "./ui/Modal";
 import { api, type DownloadJob } from "../lib/api";
 import { jobTitle } from "./downloadRow";
+import { exposeVideoToBackgroundPlay } from "../lib/browserBackgroundPlay";
 
 // E7 S4b — in-app player for a completed library item. We do NOT reuse PlayerModal (a cross-origin
 // YouTube IFrame shell) or PlexPlayer (a Plex HLS/session shell): both are bound to their own domain
@@ -47,6 +48,7 @@ export default function LibraryPlayer({ job, onClose }: { job: DownloadJob; onCl
         </div>
       ) : (
         <video
+          ref={exposeVideoToBackgroundPlay}
           src={fileUrl}
           poster={poster}
           controls

frontend/src/components/NavSidebar.tsx

@@ -4,7 +4,8 @@ import { useTranslation } from "react-i18next";
 import { useQuery } from "@tanstack/react-query";
 import { useNavigation, useNavigationActions } from "./NavigationProvider";
 import { Info, LogOut, Settings, Shield, UserPlus, type LucideIcon } from "lucide-react";
-import { api, clearActiveAccount, setActiveAccount, type Me } from "../lib/api";
+import { api, type Me } from "../lib/api";
+import { pinOnNextPage } from "../lib/activeAccount";
 import * as e2ee from "../lib/e2ee";
 import { useLiveQuery } from "../lib/useLiveQuery";
 import { getUnreadCount, subscribe } from "../lib/notifications";
@@ -71,7 +72,7 @@ export default function NavSidebar({
     } catch {
       /* IndexedDB unavailable (e.g. private mode) — never let it block the logout + reload */
     }
-    clearActiveAccount();
+    pinOnNextPage(null);
     location.reload();
   }
 
@@ -86,8 +87,9 @@ export default function NavSidebar({
   function switchTo(id: number) {
     // Per-tab switch: point THIS tab at the account and reload; other tabs keep their own
     // identity. No server round-trip — req() sends the account header (validated against the
-    // browser wallet server-side), so the cookie's default account is left untouched.
-    setActiveAccount(id);
+    // browser wallet server-side), so the cookie's default account is left untouched. The pin moves with
+    // the reload, not before it: the page going away still unloads as the account it was built for.
+    pinOnNextPage(id);
     // Drop the previous account's in-module sub-view/overlay before the reload (which would
     // otherwise preserve history.state across the swap). Otherwise the new account lands on a
     // stale sub-view — e.g. an open chat thread whose partnerId belongs to the OLD identity
@@ -334,7 +336,7 @@ export default function NavSidebar({
                     // Adding an account switches THIS tab to it: drop the tab's pin so that on
                     // return from Google it adopts the freshly-added account (the new default)
                     // and pins that. Other tabs keep their own pinned account.
-                    clearActiveAccount();
+                    pinOnNextPage(null);
                     window.location.href = "/auth/login";
                   }}
                   className="selectable w-full flex items-center gap-2 text-sm px-2 py-2 rounded-lg text-muted hover:text-fg hover:bg-card transition"

frontend/src/components/NavigationProvider.tsx

@@ -12,7 +12,6 @@ import { useTranslation } from "react-i18next";
 import { urlWithParams, type Page } from "../lib/urlState";
 import { pageTitleKey } from "../lib/pageMeta";
 import { setAccountRaw } from "../lib/storage";
-import { useAccountRehydrate } from "../lib/useAccountRehydrate";
 import { setNavigator } from "../lib/nav";
 import {
   closeOverlaysThenNavigate,
@@ -102,27 +101,6 @@ export function NavigationProvider({ children }: { children: ReactNode }) {
   const channelViewRef = useRef(channelView);
   channelViewRef.current = channelView;
 
-  // The landing page is per-account (PAGE_KEY), but this provider mounts above <App>, which pins the
-  // tab's account only after /api/me — so on a fresh tab `loadInitialPage` reads an unknown account and
-  // falls back to "feed". Re-read once the account is pinned and correct the CURRENT history entry
-  // (replaceState, not push) so Back isn't given a phantom "feed" step. markDirty (set by setPage)
-  // skips this if the user already navigated in the pre-pin window.
-  const markDirty = useAccountRehydrate(() => {
-    const stored = loadInitialPage();
-    if (stored === pageRef.current) return;
-    setPageState(stored);
-    setAccountRaw(PAGE_KEY, stored); // no-op re-write, keeps storage authoritative
-    // Correct the CURRENT entry (replace, not push) and PRESERVE any markers already on it — a channel
-    // (_chan) or YT search (_yt) opened in the pre-pin window survives on top of the restored page,
-    // rather than being orphaned from history so Back can't close it. Mirror the corrected page to the
-    // address bar too (urlWithParams keeps any ?chan/filter params already there).
-    window.history.replaceState(
-      { ...(window.history.state || {}), sfPage: stored },
-      "",
-      urlWithParams({ page: stored === "feed" ? null : stored }),
-    );
-  });
-
   const setPage = useCallback(
     (next: Page) =>
       // Never under an open overlay — see the interface doc. The refs are read when the push
@@ -131,7 +109,6 @@ export function NavigationProvider({ children }: { children: ReactNode }) {
         // A channel page overlays the content column, so a nav click must close it even when the
         // underlying page is unchanged (e.g. "Feed" while a channel opened from the feed).
         if (next === pageRef.current && !channelViewRef.current) return;
-        markDirty();
         setChannelView(null); // leave any open channel page when navigating via the rail
         setPageState(next);
         setAccountRaw(PAGE_KEY, next);
@@ -163,15 +140,12 @@ export function NavigationProvider({ children }: { children: ReactNode }) {
         );
         notifyNav();
       }),
-    [markDirty],
+    [],
   );
 
-  // A sub-view (channel / YT search) is an OVERLAY, not a page change, so it does NOT markDirty: a
-  // pre-pin account re-hydrate should still restore the stored page underneath — the re-hydrate's
-  // replaceState spreads the _chan/_yt markers, so the overlay survives on top of the restored page.
-  //
-  // Like setPage it never lands under an open overlay: the player's channel link and the palette's
-  // channel rows call it from inside one.
+  // A sub-view (channel / YT search) is an OVERLAY, not a page change. Like setPage it never lands
+  // under an open overlay: the player's channel link and the palette's channel rows call it from
+  // inside one.
   const openChannel = useCallback((id: string, name?: string) => {
     closeOverlaysThenNavigate(() => {
       const url = urlWithParams({ chan: id });
@@ -197,7 +171,6 @@ export function NavigationProvider({ children }: { children: ReactNode }) {
   }, []);
 
   const enterYtSearch = useCallback((q: string) => {
-    // Overlay, not a page change — see openChannel: no markDirty, the re-hydrate preserves _yt.
     setYtSearch(q);
     // Drop any prior _ytScrape marker — the new search's source isn't known yet; Feed re-stamps it
     // once the results resolve, so a reload only restores a confirmed scrape-sourced search.

frontend/src/components/PlaylistsProvider.tsx

@@ -1,6 +1,5 @@
 import { createContext, useCallback, useContext, useMemo, useState, type ReactNode } from "react";
 import { LS, setAccountRaw } from "../lib/storage";
-import { useAccountRehydrate } from "../lib/useAccountRehydrate";
 import { useUrlMirror } from "../lib/useUrlMirror";
 import { useNavigation } from "./NavigationProvider";
 import { readSelectedId } from "./playlistsInit";
@@ -43,19 +42,11 @@ export function PlaylistsProvider({ children }: { children: ReactNode }) {
   const [search, setSearchState] = useState("");
   const [selectedId, setSelectedIdState] = useState<number | null>(readSelectedId);
 
-  // Re-read the selected playlist once the account is pinned after mount (first load on a fresh tab):
-  // this provider mounts above <App>, which pins the account only after /api/me.
-  const markDirty = useAccountRehydrate(() => setSelectedIdState(readSelectedId()));
-
   const setSearch = useCallback((q: string) => setSearchState(q), []);
-  const setSelectedId = useCallback(
-    (id: number | null) => {
-      markDirty();
-      setSelectedIdState(id);
-      if (id != null) setAccountRaw(LS.playlist, String(id));
-    },
-    [markDirty],
-  );
+  const setSelectedId = useCallback((id: number | null) => {
+    setSelectedIdState(id);
+    if (id != null) setAccountRaw(LS.playlist, String(id));
+  }, []);
 
   // Mirror the selected playlist to ?pl on the Playlists page so it's bookmarkable; clear it elsewhere
   // (the localStorage copy still restores it on return). useUrlMirror keeps ?page and the other nav

frontend/src/components/PlexPlayer.strictmode.dom.test.tsx

@@ -21,6 +21,9 @@ vi.mock("react-i18next", async (importOriginal) => {
   };
 });
 
+const expose = vi.hoisted(() => vi.fn());
+vi.mock("../lib/browserBackgroundPlay", () => ({ exposeVideoToBackgroundPlay: expose }));
+
 import PlexPlayer from "./PlexPlayer";
 import { api, type PlexItemDetail } from "../lib/api";
 
@@ -98,4 +101,21 @@ describe("PlexPlayer under StrictMode", () => {
     video.dispatchEvent(new Event("loadedmetadata"));
     await waitFor(() => expect(played).toContain("/api/plex/direct/99079"));
   });
+
+  it("hands its <video> to the background-play hook, so Brave iOS keeps it playing", async () => {
+    vi.spyOn(api, "plexItem").mockResolvedValue(detail);
+    vi.spyOn(api, "plexSession").mockResolvedValue({
+      mode: "direct",
+      url: "/api/plex/direct/99079",
+      start_s: 0,
+    } as never);
+    const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    render(
+      <QueryClientProvider client={qc}>
+        <PlexPlayer itemId="99079" onClose={() => {}} />
+      </QueryClientProvider>,
+    );
+    const video = await waitFor(() => document.querySelector("video")!);
+    expect(expose).toHaveBeenCalledWith(video);
+  });
 });

frontend/src/components/PlexPlayer.tsx

@@ -3,6 +3,7 @@ import { qk } from "../lib/queryKeys";
 import { createPortal } from "react-dom";
 import { useTranslation } from "react-i18next";
 import { plexLang } from "../i18n";
+import { exposeVideoToBackgroundPlay } from "../lib/browserBackgroundPlay";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import Hls from "hls.js";
 import {
@@ -115,7 +116,7 @@ export default function PlexPlayer({ itemId, onClose, queue }: Props) {
   const detail = detailQ.data;
   const duration = detail?.duration_seconds ?? 0;
 
-  const videoRef = useRef<HTMLVideoElement>(null);
+  const videoRef = useRef<HTMLVideoElement | null>(null);
   const hlsRef = useRef<Hls | null>(null);
   // False once unmounted, so a late play() (from MANIFEST_PARSED / loadedmetadata firing after Back)
   // can't start a detached <video> playing audio in the background.
@@ -1048,7 +1049,11 @@ export default function PlexPlayer({ itemId, onClose, queue }: Props) {
         prefs.subShadowColor,
       )}}`}</style>
       <video
-        ref={videoRef}
+        ref={(el) => {
+          videoRef.current = el;
+          // So Brave iOS's background play keeps it going when the app is left (lib/browserBackgroundPlay).
+          exposeVideoToBackgroundPlay(el);
+        }}
         // Fill the wrapper (which is sized to the viewport / screen) and letterbox by aspect via
         // object-contain. NOT `w-auto h-auto max-*`: that caps the video at its intrinsic resolution
         // (a 720p stream → 1280×720) and never scales it UP, so in fullscreen it sat tiny and centred.

frontend/src/components/PlexProvider.dom.test.tsx

@@ -0,0 +1,45 @@
+// @vitest-environment jsdom
+//
+// A shared Plex link is persisted to the account, but only the dimensions it CARRIES. The bug it
+// replaced: a link with only a scope also wrote the (empty) default filters, and a stored Plex filters
+// value at all is what tells SavedViewsProvider the account has picked filters — so the account's
+// default saved view was never applied again.
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { render, cleanup } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { NavigationProvider } from "./NavigationProvider";
+import { PlexProvider } from "./PlexProvider";
+import { ACTIVE_ACCOUNT_KEY } from "../lib/activeAccount";
+
+function mount() {
+  render(
+    <QueryClientProvider client={new QueryClient()}>
+      <NavigationProvider>
+        <PlexProvider>
+          <div />
+        </PlexProvider>
+      </NavigationProvider>
+    </QueryClientProvider>,
+  );
+}
+
+beforeEach(() => {
+  localStorage.clear();
+  sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, "5");
+});
+afterEach(() => {
+  cleanup();
+  window.history.replaceState(null, "", "/");
+});
+
+describe("PlexProvider shared link", () => {
+  it("persists the scope a link carries and leaves the dimensions it omits unwritten", () => {
+    window.history.replaceState(null, "", "/?page=plex&pscope=movie");
+    mount();
+
+    expect(localStorage.getItem("siftlode.plexLibrary.5")).toBe("movie");
+    expect(localStorage.getItem("siftlode.plexFilters.5")).toBeNull();
+    expect(localStorage.getItem("siftlode.plexSort.5")).toBeNull();
+    expect(localStorage.getItem("siftlode.plexShow.5")).toBeNull();
+  });
+});

frontend/src/components/PlexProvider.tsx

@@ -1,4 +1,12 @@
-import { createContext, useCallback, useContext, useMemo, useState, type ReactNode } from "react";
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useState,
+  type ReactNode,
+} from "react";
 import { coercePlexFilters, EMPTY_PLEX_FILTERS, type PlexFilters } from "../lib/api";
 import { parseSortState, type SortState } from "../lib/columnSort";
 import { parsePlexField, type PlexSearchField } from "../lib/plexSearch";
@@ -10,7 +18,6 @@ import {
   type PlexUrlState,
 } from "../lib/plexUrlState";
 import { getAccountRaw, LS, setAccountRaw } from "../lib/storage";
-import { useAccountRehydrate } from "../lib/useAccountRehydrate";
 import { useUrlMirror } from "../lib/useUrlMirror";
 import { useNavigation } from "./NavigationProvider";
 
@@ -20,10 +27,8 @@ import { useNavigation } from "./NavigationProvider";
 // instead of prop-drilling through App. Mirrors FeedFiltersProvider (split State + Actions contexts,
 // stable useCallback setters, one-line hooks; composed in main.tsx around <App/>).
 //
-// scope / show / sort / filters / q are per-account persisted (localStorage). init-from-storage seeds
-// them, and useAccountRehydrate re-reads once the tab's account is pinned — this provider mounts above
-// <App>, which pins it only after /api/me, so a fresh tab would otherwise show defaults until a reload
-// (an account SWITCH does full-reload, but the FIRST load does not). `playlistOpen` is an ephemeral
+// scope / show / sort / filters / q are per-account persisted (localStorage) and seeded from it at mount
+// (BootGate pins the tab's account first; an account switch reloads). `playlistOpen` is an ephemeral
 // hand-off (the rail sets it, PlexBrowse consumes it into a history subview then clears it). The Plex
 // search term is deliberately its OWN state, NOT the feed's `filters.q`, so a Plex search never leaks
 // into (and is never greeted by a stale value from) the feed.
@@ -95,7 +100,7 @@ export function usePlexActions(): PlexActions {
   return useContext(ActionsContext);
 }
 
-// The per-account init readers, shared by the initial useState seed AND the account-pin re-hydrate.
+// The per-account init readers, shared by the useState seeds and the shared-link seed's base.
 function readPlexScope(): string {
   const v = getAccountRaw(LS.plexLibrary) ?? "both";
   return ["movie", "show", "both"].includes(v) ? v : "both";
@@ -144,13 +149,11 @@ function readPlexFilters(): PlexFilters {
     return EMPTY_PLEX_FILTERS;
   }
 }
-// A shared-link seed = the URL-merged state PLUS which dimensions the URL actually carried. `present`
-// matters because the base below is read at MOUNT, before the account is pinned (getAccountRaw returns
-// null then), so the base for an OMITTED dimension is a hard default, NOT this account's stored value.
-// The provider must therefore persist/keep only the PRESENT dimensions on account-pin and re-read the
-// account's real stored value for the absent ones — otherwise a partial link silently resets them.
+// The base is this account's stored view (BootGate pins the account before this provider mounts), so a
+// PARTIAL link — one carrying only the scope, say — keeps the stored sort, show and filters for the rest.
+// `present` records which dimensions the link actually carried: only those are persisted (below).
 type PlexSeedPresent = { scope: boolean; sort: boolean; show: boolean; filters: boolean };
-type PlexUrlSeed = { state: PlexUrlState; present: PlexSeedPresent };
+type PlexUrlSeed = PlexUrlState & { present: PlexSeedPresent };
 function readPlexUrlSeed(): PlexUrlSeed | null {
   const params = new URLSearchParams(window.location.search);
   if (!hasPlexParams(params)) return null;
@@ -160,29 +163,27 @@ function readPlexUrlSeed(): PlexUrlSeed | null {
     show: readPlexShow(),
     filters: readPlexFilters(),
   });
-  return {
-    state,
-    present: {
-      scope: params.has("pscope"),
-      sort: params.has("psort"),
-      show: params.has("pshow"),
-      filters: params.has("pf"),
-    },
+  const present = {
+    scope: params.has("pscope"),
+    sort: params.has("psort"),
+    show: params.has("pshow"),
+    filters: params.has("pf"),
   };
+  return { ...state, present };
 }
 
 export function PlexProvider({ children }: { children: ReactNode }) {
-  // Captured once: the shared-link content state (or null). Seeds the slices below and, on account pin,
-  // is persisted to the account instead of being clobbered by the stored view (see the rehydrate).
+  // Captured once: the shared-link content state (or null). Seeds the slices below and is persisted to
+  // the account (the effect further down), so the shared view also survives a later plain reload.
   const [urlSeed] = useState(readPlexUrlSeed);
   // The former per-library picker is now a cross-library SCOPE: movie | show | both (unified library).
   // (Reuses the old LS.plexLibrary key; an old stored library-id value falls back to "both".)
-  const [scope, setScopeState] = useState<string>(() => urlSeed?.state.scope ?? readPlexScope());
-  const [show, setShowState] = useState<string>(() => urlSeed?.state.show ?? readPlexShow());
-  const [sort, setSortState] = useState<SortState>(() => urlSeed?.state.sort ?? readPlexSort());
+  const [scope, setScopeState] = useState<string>(() => urlSeed?.scope ?? readPlexScope());
+  const [show, setShowState] = useState<string>(() => urlSeed?.show ?? readPlexShow());
+  const [sort, setSortState] = useState<SortState>(() => urlSeed?.sort ?? readPlexSort());
   // The expanded Plex filters live as one JSON blob (the string-only account store serializes it).
   const [filtersRaw, setFiltersRaw] = useState<string>(() =>
-    urlSeed ? JSON.stringify(urlSeed.state.filters) : readPlexFiltersRaw(),
+    urlSeed ? JSON.stringify(urlSeed.filters) : readPlexFiltersRaw(),
   );
   const filters = useMemo<PlexFilters>(() => {
     try {
@@ -203,87 +204,45 @@ export function PlexProvider({ children }: { children: ReactNode }) {
   // PlexBrowse consumes it into an info/show history subview then clears it.
   const [jumpTo, setJumpTo] = useState<PlexJumpTarget | null>(null);
 
-  // Re-read every per-account slice once the account is pinned after mount (first load on a fresh tab).
-  // A shared-link seed is the exception: instead of reloading the account's stored view, PERSIST the URL
-  // state to this account (so the shared view wins and survives a later plain reload), and adopt only the
-  // non-shared slices (q/field) from storage. Mirrors FeedFiltersProvider's initialHadUrlFilters branch.
-  const markDirty = useAccountRehydrate(() => {
-    if (urlSeed) {
-      // Per dimension: a dimension the URL carried (present) is the shared view — adopt it and persist
-      // it to this now-pinned account (so it wins and survives a later plain reload). A dimension the
-      // URL OMITTED was seeded from a mount-time default (no account yet), so do NOT persist that
-      // default over the account's real stored value — re-read the stored value instead, exactly like a
-      // normal load. This is the fix for a partial shared link silently resetting the omitted slices.
-      const { state, present } = urlSeed;
-      if (present.scope) setAccountRaw(LS.plexLibrary, state.scope);
-      else setScopeState(readPlexScope());
-      if (present.show) setAccountRaw(LS.plexShow, state.show);
-      else setShowState(readPlexShow());
-      if (present.sort) setAccountRaw(LS.plexSort, JSON.stringify(state.sort));
-      else setSortState(readPlexSort());
-      if (present.filters) setAccountRaw(LS.plexFilters, JSON.stringify(state.filters));
-      else setFiltersRaw(readPlexFiltersRaw());
-      setQState(readPlexQ());
-      setFieldState(readPlexField());
-      return;
-    }
-    setScopeState(readPlexScope());
-    setShowState(readPlexShow());
-    setSortState(readPlexSort());
-    setFiltersRaw(readPlexFiltersRaw());
-    setQState(readPlexQ());
-    setFieldState(readPlexField());
-  });
+  // Persist a shared link's view to the account once, so it wins over the stored view and survives a
+  // later plain reload. Mirrors FeedFiltersProvider's initialHadUrlFilters branch. Only the dimensions
+  // the link CARRIED are written: an omitted one already reads from storage, and writing its default
+  // would not be a no-op — a stored Plex filters value at all is what tells SavedViewsProvider the
+  // account has picked filters, so the account's default saved view would never be applied again.
+  useEffect(() => {
+    if (!urlSeed) return;
+    const { present } = urlSeed;
+    if (present.scope) setAccountRaw(LS.plexLibrary, urlSeed.scope);
+    if (present.show) setAccountRaw(LS.plexShow, urlSeed.show);
+    if (present.sort) setAccountRaw(LS.plexSort, JSON.stringify(urlSeed.sort));
+    if (present.filters) setAccountRaw(LS.plexFilters, JSON.stringify(urlSeed.filters));
+  }, [urlSeed]);
 
-  const setScope = useCallback(
-    (v: string) => {
-      markDirty();
-      setScopeState(v);
-      setAccountRaw(LS.plexLibrary, v);
-    },
-    [markDirty],
-  );
-  const setShow = useCallback(
-    (v: string) => {
-      markDirty();
-      setShowState(v);
-      setAccountRaw(LS.plexShow, v);
-    },
-    [markDirty],
-  );
-  const setSort = useCallback(
-    (v: SortState) => {
-      markDirty();
-      setSortState(v);
-      setAccountRaw(LS.plexSort, JSON.stringify(v));
-    },
-    [markDirty],
-  );
-  const setFilters = useCallback(
-    (f: PlexFilters) => {
-      markDirty();
-      const s = JSON.stringify(f);
-      setFiltersRaw(s);
-      setAccountRaw(LS.plexFilters, s);
-    },
-    [markDirty],
-  );
-  const setQ = useCallback(
-    (v: string) => {
-      markDirty();
-      setQState(v);
-      setAccountRaw(LS.plexQ, v);
-    },
-    [markDirty],
-  );
-  const setField = useCallback(
-    (v: PlexSearchField) => {
-      markDirty();
-      setFieldState(v);
-      setAccountRaw(LS.plexField, v);
-    },
-    [markDirty],
-  );
+  const setScope = useCallback((v: string) => {
+    setScopeState(v);
+    setAccountRaw(LS.plexLibrary, v);
+  }, []);
+  const setShow = useCallback((v: string) => {
+    setShowState(v);
+    setAccountRaw(LS.plexShow, v);
+  }, []);
+  const setSort = useCallback((v: SortState) => {
+    setSortState(v);
+    setAccountRaw(LS.plexSort, JSON.stringify(v));
+  }, []);
+  const setFilters = useCallback((f: PlexFilters) => {
+    const s = JSON.stringify(f);
+    setFiltersRaw(s);
+    setAccountRaw(LS.plexFilters, s);
+  }, []);
+  const setQ = useCallback((v: string) => {
+    setQState(v);
+    setAccountRaw(LS.plexQ, v);
+  }, []);
+  const setField = useCallback((v: PlexSearchField) => {
+    setFieldState(v);
+    setAccountRaw(LS.plexField, v);
+  }, []);
 
   const state = useMemo<PlexState>(
     () => ({ scope, show, sort, filters, q, field, playlistOpen, jumpTo }),

frontend/src/components/PrefsProvider.dom.test.tsx

@@ -0,0 +1,54 @@
+// @vitest-environment jsdom
+//
+// The Settings prefs are seeded from the account's server prefs in the `me` cache — BootGate mounts the
+// tree only once it is there. The adopt effect this replaced corrected them AFTER mounting; with it
+// gone, a seed that read only this browser's copy would never show a performance mode or hints setting
+// changed on another device. And the seed is not an edit: it must not be saved straight back.
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { act, cleanup, render } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { PrefsProvider, usePrefs } from "./PrefsProvider";
+import { api } from "../lib/api";
+import { ACTIVE_ACCOUNT_KEY } from "../lib/activeAccount";
+import { accountKey, LS } from "../lib/storage";
+import { qk } from "../lib/queryKeys";
+
+const seen: { perf: boolean; hints: boolean }[] = [];
+function Probe() {
+  const { perf, hints } = usePrefs();
+  seen.push({ perf, hints });
+  return null;
+}
+
+beforeEach(() => {
+  localStorage.clear();
+  sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, "5");
+  seen.length = 0;
+  vi.useFakeTimers();
+});
+afterEach(() => {
+  cleanup();
+  vi.useRealTimers();
+  vi.restoreAllMocks();
+});
+
+describe("PrefsProvider seed", () => {
+  it("renders the account's server prefs from the first render, and does not save them back", () => {
+    localStorage.setItem(accountKey(LS.perfMode, 5)!, "0"); // this browser last had it off
+    localStorage.setItem(accountKey(LS.hints, 5)!, "1");
+    const save = vi.spyOn(api, "savePrefs").mockResolvedValue(undefined as never);
+    const qc = new QueryClient();
+    qc.setQueryData(qk.me(), { id: 5, preferences: { performanceMode: true, hints: false } });
+    render(
+      <QueryClientProvider client={qc}>
+        <PrefsProvider>
+          <Probe />
+        </PrefsProvider>
+      </QueryClientProvider>,
+    );
+
+    expect(seen[0]).toEqual({ perf: true, hints: false });
+    act(() => vi.advanceTimersByTime(1000)); // past the auto-save debounce
+    expect(save).not.toHaveBeenCalled();
+  });
+});

frontend/src/components/PrefsProvider.tsx

@@ -3,14 +3,15 @@ import {
   useCallback,
   useContext,
   useEffect,
+  useLayoutEffect,
   useMemo,
   useRef,
   useState,
   type ReactNode,
 } from "react";
 import { qk } from "../lib/queryKeys";
-import { useQuery } from "@tanstack/react-query";
-import { api } from "../lib/api";
+import { useQueryClient } from "@tanstack/react-query";
+import { api, type Me } from "../lib/api";
 import {
   applyTheme,
   DEFAULT_THEME,
@@ -27,8 +28,8 @@ const PERF_KEY = LS.perfMode;
 
 // The four Settings-page preferences. They apply locally for instant preview and auto-save (debounced)
 // to the server — there is no draft or Save button. This provider owns them (lifted out of the App god
-// component) plus the last-saved "baseline" used to suppress the echo when a change came from adopting
-// server prefs on login. Consumers (SettingsPanel, GlassTuner) read the PrefsController via usePrefs().
+// component) plus the last-saved "baseline" (the server values it was seeded with, then each successful
+// save) used to suppress saving what the server already holds. Consumers (SettingsPanel, GlassTuner) read the PrefsController via usePrefs().
 type EditablePrefs = {
   theme: ThemePrefs;
   performanceMode: boolean;
@@ -53,35 +54,47 @@ export function usePrefs(): PrefsController {
 }
 
 export function PrefsProvider({ children }: { children: ReactNode }) {
-  const [theme, setThemeState] = useState<ThemePrefs>(() => loadLocalTheme());
-  const [perf, setPerf] = useState(() => getAccountRaw(PERF_KEY) === "1");
-  const [hints, setHints] = useState(() => hintsEnabled());
-  const [notif, setNotif] = useState<NotifSettings>(() => getNotifSettings());
-  // The last server-known prefs. Written on adopt + after each save so the auto-save effect can
-  // compare against it and avoid echoing a server-adopted value straight back. A ref (drives no UI).
-  const baselineRef = useRef<EditablePrefs>({
-    theme: loadLocalTheme(),
-    performanceMode: getAccountRaw(PERF_KEY) === "1",
-    hints: hintsEnabled(),
-    notifications: getNotifSettings(),
+  const qc = useQueryClient();
+  // The account's prefs, seeded straight from the `me` cache — BootGate mounts this only once /api/me
+  // has answered, so a theme changed on another device is right on the first paint instead of
+  // switching after it. This browser's copy fills any key the server has never stored.
+  const [seed] = useState<EditablePrefs>(() => {
+    const prefs = qc.getQueryData<Me | null>(qk.me())?.preferences;
+    return {
+      theme: prefs?.theme ? { ...DEFAULT_THEME, ...prefs.theme } : loadLocalTheme(),
+      performanceMode:
+        typeof prefs?.performanceMode === "boolean"
+          ? prefs.performanceMode
+          : getAccountRaw(PERF_KEY) === "1",
+      hints: typeof prefs?.hints === "boolean" ? prefs.hints : hintsEnabled(),
+      notifications: prefs?.notifications
+        ? { ...getNotifSettings(), ...prefs.notifications }
+        : getNotifSettings(),
+    };
   });
+  const [theme, setThemeState] = useState<ThemePrefs>(seed.theme);
+  const [perf, setPerf] = useState(seed.performanceMode);
+  const [hints, setHints] = useState(seed.hints);
+  const [notif, setNotif] = useState<NotifSettings>(seed.notifications);
+  // The last server-known prefs: the seed, then each successful save. The auto-save effect compares
+  // against it, so the seed itself is never echoed back as a save. A ref (drives no UI).
+  const baselineRef = useRef<EditablePrefs>(seed);
   const [saveState, setSaveState] = useState<PrefsController["saveState"]>("idle");
   const saveMsgTimer = useRef<number | undefined>(undefined);
   const saveTimer = useRef<number | undefined>(undefined);
-  // Passive observer of the account App fetches (enabled:false → reads cache, re-renders on update).
-  const { data: me } = useQuery({ queryKey: qk.me(), queryFn: api.me, enabled: false });
-
   // Live-apply the prefs locally for instant preview (their localStorage mirrors update via the
-  // stores too); persistence to the server is the auto-save effect below.
-  useEffect(() => applyTheme(theme), [theme]);
-  useEffect(() => {
+  // stores too); persistence to the server is the auto-save effect below. The look is applied in
+  // LAYOUT effects, before the browser paints, so the app's first frame is already in the account's
+  // theme rather than in the baseline one main.tsx sets for the boot screen.
+  useLayoutEffect(() => applyTheme(theme), [theme]);
+  useLayoutEffect(() => {
     document.documentElement.dataset.perf = perf ? "1" : "";
     setAccountRaw(PERF_KEY, perf ? "1" : "0");
   }, [perf]);
   // The per-scheme background image (the "glass over image" look) is on when the user hasn't opted
   // out and we're not in perf mode. Drives `html[data-backdrop]` (see index.css), which paints the
   // theme-appropriate image on <body> and switches the glass to translucent.
-  useEffect(() => {
+  useLayoutEffect(() => {
     const on = theme.bgImage && !perf;
     document.documentElement.dataset.backdrop = on ? "on" : "off";
   }, [theme.bgImage, perf]);
@@ -89,8 +102,8 @@ export function PrefsProvider({ children }: { children: ReactNode }) {
   useEffect(() => configureNotifications(notif), [notif]);
 
   // Auto-save on change (debounced ~500ms so a slider drag coalesces into one PUT). Live-apply is the
-  // effects above; this is the only persistence path. `baselineRef` suppresses the echo when the
-  // change came from adopting server prefs on login (`/me` merges, so a full payload is fine).
+  // effects above; this is the only persistence path. `baselineRef` keeps the mount seed from being
+  // saved straight back (`/me` merges, so a full payload is fine).
   const editablePrefs = useMemo<EditablePrefs>(
     () => ({ theme, performanceMode: perf, hints, notifications: notif }),
     [theme, perf, hints, notif],
@@ -98,7 +111,7 @@ export function PrefsProvider({ children }: { children: ReactNode }) {
   useEffect(() => {
     window.clearTimeout(saveTimer.current);
     if (JSON.stringify(editablePrefs) === JSON.stringify(baselineRef.current)) {
-      // Back at the last-saved value (initial load, server adopt, or an edit undone) — nothing to
+      // Back at the last-saved value (the mount seed, or an edit undone) — nothing to
       // save; clear any "Saving…" left from a change that was reverted before it flushed.
       setSaveState((s) => (s === "saving" ? "idle" : s));
       return;
@@ -132,31 +145,6 @@ export function PrefsProvider({ children }: { children: ReactNode }) {
     [],
   );
 
-  // On login / account switch, adopt the server-stored prefs into the live states AND the auto-save
-  // baseline (so adopting them doesn't echo a save back).
-  useEffect(() => {
-    const prefs = me?.preferences;
-    if (!prefs) return;
-    const adopted: EditablePrefs = {
-      theme: prefs.theme ? { ...DEFAULT_THEME, ...prefs.theme } : loadLocalTheme(),
-      performanceMode:
-        typeof prefs.performanceMode === "boolean"
-          ? prefs.performanceMode
-          : getAccountRaw(PERF_KEY) === "1",
-      hints: typeof prefs.hints === "boolean" ? prefs.hints : hintsEnabled(),
-      notifications: prefs.notifications
-        ? { ...getNotifSettings(), ...prefs.notifications }
-        : getNotifSettings(),
-    };
-    setThemeState(adopted.theme);
-    saveLocalTheme(adopted.theme);
-    setPerf(adopted.performanceMode);
-    setHints(adopted.hints);
-    setNotif(adopted.notifications);
-    baselineRef.current = adopted;
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [me?.id]);
-
   // Theme applies live (and caches to localStorage); the auto-save effect persists it to the server.
   const setTheme = useCallback((next: ThemePrefs) => {
     setThemeState(next);

frontend/src/components/SavedViewsProvider.dom.test.tsx

@@ -43,7 +43,7 @@ vi.mock("./PlexProvider", () => ({
 vi.mock("./ConfirmProvider", () => ({ useConfirm: () => async () => true }));
 
 import { SavedViewsProvider, useSavedViews } from "./SavedViewsProvider";
-import { api, setActiveAccount, type SavedView } from "../lib/api";
+import { api, type SavedView } from "../lib/api";
 import { LS, accountKey } from "../lib/storage";
 import { ACTIVE_ACCOUNT_KEY } from "../lib/activeAccount";
 import { qk } from "../lib/queryKeys";
@@ -109,21 +109,6 @@ describe("SavedViewsProvider — default-view seeding on first resolve", () => {
     expect(h.setFeedFilters.mock.calls[0]![0]).toMatchObject({ scope: "all", show: "watched" });
   });
 
-  it("feed: on a fresh tab the query resolves before the account pins — defers, then seeds on the pin", async () => {
-    // The provider mounts above <App>, which pins the tab-account only after /api/me; the ungated
-    // views query resolves first. Seeding must WAIT for the account (not seed nothing and burn its
-    // one-shot — the pre-fix regression that left a fresh tab on DEFAULT_FILTERS until a reload).
-    sessionStorage.removeItem(ACTIVE_ACCOUNT_KEY);
-    await mountResolved([
-      view({ id: 2, is_default: true, filters: { scope: "all", show: "watched" } }),
-    ]);
-    expect(h.setFeedFilters).not.toHaveBeenCalled();
-    // App pins the account; the reactive id re-fires the effect and the deferred seed lands.
-    act(() => setActiveAccount(ID));
-    await waitFor(() => expect(h.setFeedFilters).toHaveBeenCalledTimes(1));
-    expect(h.setFeedFilters.mock.calls[0]![0]).toMatchObject({ scope: "all", show: "watched" });
-  });
-
   it("feed: does NOT seed when the account already has stored filters", async () => {
     localStorage.setItem(accountKey(LS.filters, ID)!, JSON.stringify({ scope: "my" }));
     await mountResolved([view({ id: 2, is_default: true, filters: { scope: "all" } })]);

frontend/src/components/SavedViewsProvider.tsx

@@ -25,7 +25,6 @@ import { filtersToParams, hasFilterParams } from "../lib/urlState";
 import { pickDefaultToSeed, preferSticky } from "../lib/savedViews";
 import { notifyActionError } from "../lib/actionErrors";
 import { accountKey, LS } from "../lib/storage";
-import { useActiveAccountId } from "../lib/activeAccount";
 import { useConfirm } from "./ConfirmProvider";
 import { useNavigation } from "./NavigationProvider";
 import { useFeedFilters, useFeedFiltersActions } from "./FeedFiltersProvider";
@@ -179,19 +178,13 @@ export function SavedViewsProvider({ children }: { children: ReactNode }) {
   // semantics document. This replaced the feed-only localStorage mirror that raced FeedFiltersProvider's
   // login effect (on a fresh browser the feed could seed DEFAULT_FILTERS and never re-apply until a
   // reload) — and it gives Plex the default it previously never applied at all. Per-source guard so a
-  // 60s background refetch never re-seeds over the filters you're editing.
-  //
-  // WAIT FOR THE ACCOUNT PIN. This provider mounts above <App>, which pins the tab-account only after
-  // /api/me — but viewsQuery is ungated, so on a fresh tab it resolves FIRST, while the account is null.
-  // canSeedDefault() reads the per-account stored-filters key, which is indeterminate (→ "assume stored")
-  // with no account, so evaluating it too early would decline to seed AND burn the one-shot guard, never
-  // re-running once the account pins. Gating on the reactive account id makes the effect re-fire on the
-  // pin (useActiveAccountId subscribes), and defers consuming the guard until canSeedDefault is real.
-  const accountId = useActiveAccountId();
+  // 60s background refetch never re-seeds over the filters you're editing. canSeedDefault() reads the
+  // per-account stored-filters key, which is always readable here: BootGate pins the tab's account
+  // before this provider mounts.
   const seededRef = useRef<Set<ViewSource>>(new Set());
   useEffect(() => {
     const data = viewsQuery.data;
-    if (!data || accountId == null || seededRef.current.has(source)) return;
+    if (!data || seededRef.current.has(source)) return;
     seededRef.current.add(source);
     const def = pickDefaultToSeed(data, cfg.canSeedDefault());
     if (!def) return;
@@ -200,7 +193,7 @@ export function SavedViewsProvider({ children }: { children: ReactNode }) {
     // cfg is read fresh on this resolve and the per-source guard makes the body run once, so cfg
     // (which re-memoizes on every filter edit) is deliberately kept out of the deps.
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [viewsQuery.data, source, accountId]);
+  }, [viewsQuery.data, source]);
 
   const currentKey = cfg.keyOf(cfg.filters);
   const activeView = useMemo(

frontend/src/components/SettingsPanel.tsx

@@ -24,8 +24,8 @@ import { useMe } from "../lib/useMe";
 
 // The Settings page edits server-persisted preferences. Each change applies locally for instant
 // preview AND auto-saves (debounced) — no draft, no Save button; a small indicator flashes the
-// outcome. App owns the state + the save; this controller is
-// how the panel reads/writes it. See App.tsx.
+// outcome. PrefsProvider owns the state + the save; this controller
+// is how the panel reads/writes it.
 export type PrefsSaveState = SaveState;
 export interface PrefsController {
   theme: ThemePrefs;
@@ -128,13 +128,11 @@ function SaveIndicator({ state }: { state: PrefsSaveState }) {
 
 function Appearance({ prefs }: { prefs: PrefsController }) {
   const { t } = useTranslation();
-  // Controlled by App's prefs draft: each change applies locally for preview but is only
-  // persisted on an explicit Save (handled by the panel's Save/Discard bar).
+  // Controlled by PrefsProvider: each change applies locally at once and auto-saves (debounced).
   const { theme, setTheme, perf, setPerf, hints, setHints } = prefs;
-  // The landing page (E24). NOT a server preference like the rest of this tab: `loadInitialPage`
-  // has to answer before /api/me lands, so the value must be readable synchronously from
-  // localStorage — a landing module decided after the first paint would be a visible jump. The two
-  // stored values come from navigationInit, which is what reads them back at boot.
+  // The landing page (E24). Per-account localStorage, not a server preference like the rest of this
+  // tab: `loadInitialPage` reads it synchronously in NavigationProvider's initializer. The two stored
+  // values come from navigationInit, which is what reads them back at boot.
   const [startOnHome, setStartOnHome] = useAccountPersistedState(LS.startOnHome, START_ON_HOME.on);
 
   return (
@@ -253,8 +251,8 @@ function Appearance({ prefs }: { prefs: PrefsController }) {
 
 function Notifications({ prefs }: { prefs: PrefsController }) {
   const { t } = useTranslation();
-  // Controlled by App's prefs draft (live preview via configureNotifications there); the
-  // panel's Save bar persists it. The "send test" button below still fires immediately.
+  // Controlled by PrefsProvider (live preview via configureNotifications there), which auto-saves
+  // it. The "send test" button below fires immediately.
   const { notif: cfg, setNotif } = prefs;
   const update = (p: Partial<NotifSettings>) => setNotif({ ...cfg, ...p });
   const autoOn = cfg.durationMs > 0;
@@ -499,7 +497,11 @@ function SignInMethods({ me }: { me: Me }) {
               autoComplete="new-password"
               className={inputCls}
             />
-            {err && <p className="text-xs text-danger">{err}</p>}
+            {err && (
+              <p role="alert" className="text-xs text-danger">
+                {err}
+              </p>
+            )}
             <Button type="submit" variant="primary" size="sm" disabled={busy || !next}>
               {busy ? t("settings.account.password.saving") : t("settings.account.password.save")}
             </Button>

frontend/src/components/SetupWizard.tsx

@@ -36,6 +36,9 @@ export default function SetupWizard() {
   const [stepIdx, setStepIdx] = useState(0);
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState("");
+  // Keys the error: failing the same way twice is a new node, so a screen reader announces it again (a clear
+  // and a set in one handler commit together, leaving the node untouched).
+  const [attempt, setAttempt] = useState(0);
   // Admin account.
   const [email, setEmail] = useState("");
   const [password, setPassword] = useState("");
@@ -74,19 +77,21 @@ export default function SetupWizard() {
   };
 
   // Each step's "Next" action persists what it collected, then advances. Optional steps with empty
-  // fields just advance (skip). Errors surface inline (the setup calls use the quiet flag).
+  // fields just advance (skip). Errors surface inline (the setup calls use the quiet flag); a step's own
+  // validation sets its message and stays.
   async function next() {
+    setAttempt((n) => n + 1);
     setError("");
     setBusy(true);
     try {
       if (step === "admin") {
         if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email))
-          throw { detail: t("setup.admin.invalidEmail") };
+          return setError(t("setup.admin.invalidEmail"));
         if (password.length < PASSWORD_MIN)
-          throw { detail: t("setup.admin.shortPassword", { n: PASSWORD_MIN }) };
+          return setError(t("setup.admin.shortPassword", { n: PASSWORD_MIN }));
         await api.setupAdmin(token, email, password);
       } else if (step === "google" && (gid.trim() || gsecret.trim())) {
-        if (!gid.trim() || !gsecret.trim()) throw { detail: t("setup.google.bothRequired") };
+        if (!gid.trim() || !gsecret.trim()) return setError(t("setup.google.bothRequired"));
         await api.setupConfig(token, {
           google_client_id: gid.trim(),
           google_client_secret: gsecret.trim(),
@@ -267,7 +272,11 @@ export default function SetupWizard() {
             <Section title={t("setup.finish.title")} desc={t("setup.finish.body")} />
           )}
 
-          {error && <p className="text-sm text-danger mt-3">{error}</p>}
+          {error && (
+            <p key={attempt} role="alert" className="text-sm text-danger mt-3">
+              {error}
+            </p>
+          )}
 
           <div className="flex items-center justify-between mt-6">
             <button

frontend/src/components/WatchPage.dom.test.tsx

@@ -5,7 +5,10 @@
 // mp3 inside a <video>, which is exactly why the branch exists — this locks it so a refactor can't
 // silently drop the audio player and reintroduce the iPad-broken behavior.
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { render, waitFor, cleanup } from "@testing-library/react";
+import { render, waitFor, cleanup, fireEvent } from "@testing-library/react";
+const expose = vi.hoisted(() => vi.fn());
+vi.mock("../lib/browserBackgroundPlay", () => ({ exposeVideoToBackgroundPlay: expose }));
+
 import WatchPage from "./WatchPage";
 
 function mockMeta(meta: Record<string, unknown>) {
@@ -18,6 +21,50 @@ function mockMeta(meta: Record<string, unknown>) {
 afterEach(() => {
   cleanup();
   vi.unstubAllGlobals();
+  localStorage.clear();
+});
+
+describe("WatchPage background play", () => {
+  it("hands its <video> to the background-play hook, so Brave iOS keeps it playing", async () => {
+    window.history.replaceState({}, "", "/watch/tok-bg");
+    mockMeta({ needs_password: false, audio: false, file_url: "/f.mp4", title: "A clip" });
+    const { container } = render(<WatchPage />);
+    await waitFor(() => expect(container.querySelector("video")).not.toBeNull());
+    expect(expose).toHaveBeenCalledWith(container.querySelector("video"));
+  });
+});
+
+describe("WatchPage repeat", () => {
+  it("repeats by default, for a video and for an audio-only asset", async () => {
+    window.history.replaceState({}, "", "/watch/tok-repeat-video");
+    mockMeta({ needs_password: false, audio: false, file_url: "/f.mp4", title: "A clip" });
+    const video = render(<WatchPage />);
+    await waitFor(() => expect(video.container.querySelector("video")).not.toBeNull());
+    expect(video.container.querySelector("video")!.loop).toBe(true);
+    cleanup();
+
+    window.history.replaceState({}, "", "/watch/tok-repeat-audio");
+    mockMeta({ needs_password: false, audio: true, file_url: "/f.mp3", title: "A song" });
+    const audio = render(<WatchPage />);
+    await waitFor(() => expect(audio.container.querySelector("audio")).not.toBeNull());
+    expect(audio.container.querySelector("audio")!.loop).toBe(true);
+  });
+
+  it("the toggle turns it off, and the choice is remembered for the next visit", async () => {
+    window.history.replaceState({}, "", "/watch/tok-repeat-toggle");
+    mockMeta({ needs_password: false, audio: false, file_url: "/f.mp4", title: "A clip" });
+    const first = render(<WatchPage />);
+    const toggle = await first.findByRole("button", { name: "Repeat" });
+    expect(toggle.getAttribute("aria-pressed")).toBe("true");
+    fireEvent.click(toggle);
+    expect(toggle.getAttribute("aria-pressed")).toBe("false");
+    expect(first.container.querySelector("video")!.loop).toBe(false);
+    cleanup();
+
+    const second = render(<WatchPage />);
+    await waitFor(() => expect(second.container.querySelector("video")).not.toBeNull());
+    expect(second.container.querySelector("video")!.loop).toBe(false);
+  });
 });
 
 describe("WatchPage media element (S3 · 5a)", () => {
@@ -74,3 +121,86 @@ describe("WatchPage media element (S3 · 5a)", () => {
     expect(container.querySelector('a[href="/f.zip"]')).toBeNull();
   });
 });
+
+// Only a 404 means a link is gone. Every other failure used to render the permanent "no longer
+// available" state too: a server restart, a dropped connection, and the unlock's own rate limit told a
+// viewer with a valid link that it had expired or been revoked, with no way to try again.
+describe("WatchPage honest failures", () => {
+  const res = (status: number, body: unknown = {}) => ({
+    ok: status < 400,
+    status,
+    json: async () => body,
+  });
+  const GONE = "This link is no longer available.";
+
+  it("a server error is a failure with a retry, not a dead link", async () => {
+    window.history.replaceState({}, "", "/watch/tok-5xx");
+    vi.stubGlobal(
+      "fetch",
+      vi
+        .fn()
+        .mockResolvedValueOnce(res(503))
+        .mockResolvedValue(
+          res(200, { needs_password: false, file_url: "/f.mp4", title: "A clip" }),
+        ),
+    );
+    const page = render(<WatchPage />);
+    const retry = await page.findByRole("button", { name: "Try again" });
+    expect(page.queryByText(GONE)).toBeNull();
+    expect(page.getByRole("alert").textContent).toContain("Couldn't load this link.");
+
+    fireEvent.click(retry);
+    await waitFor(() => expect(page.container.querySelector("video")).not.toBeNull());
+  });
+
+  it("a dropped connection is a failure with a retry too", async () => {
+    window.history.replaceState({}, "", "/watch/tok-offline");
+    vi.stubGlobal("fetch", vi.fn().mockRejectedValue(new TypeError("Failed to fetch")));
+    const page = render(<WatchPage />);
+    await page.findByRole("button", { name: "Try again" });
+    expect(page.queryByText(GONE)).toBeNull();
+  });
+
+  it("a 404 says the link is gone", async () => {
+    window.history.replaceState({}, "", "/watch/tok-404");
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(res(404)));
+    const page = render(<WatchPage />);
+    await page.findByText(GONE);
+    expect(page.queryByRole("button", { name: "Try again" })).toBeNull();
+  });
+
+  async function tryPassword(second: () => Promise<unknown>) {
+    vi.stubGlobal(
+      "fetch",
+      vi
+        .fn()
+        .mockResolvedValueOnce(res(200, { needs_password: true }))
+        .mockImplementationOnce(second),
+    );
+    const page = render(<WatchPage />);
+    fireEvent.change(await page.findByPlaceholderText("Enter password"), {
+      target: { value: "guess" },
+    });
+    fireEvent.click(page.getByRole("button", { name: "Watch" }));
+    return page;
+  }
+
+  it("too many password tries says so, and keeps the form", async () => {
+    window.history.replaceState({}, "", "/watch/tok-429");
+    const page = await tryPassword(async () => res(429));
+    await page.findByText("Too many attempts. Try again in a few minutes.");
+    const alert = page.getByRole("alert");
+    expect(alert.textContent).toBe("Too many attempts. Try again in a few minutes.");
+    expect(page.getByPlaceholderText("Enter password").getAttribute("aria-describedby")).toBe(
+      alert.id,
+    );
+  });
+
+  it("an unlock that gets no answer says so instead of doing nothing", async () => {
+    window.history.replaceState({}, "", "/watch/tok-unlock-offline");
+    const page = await tryPassword(() => Promise.reject(new TypeError("Failed to fetch")));
+    expect((await page.findByRole("alert")).textContent).toBe(
+      "Couldn't check the password. Try again.",
+    );
+  });
+});

frontend/src/components/WatchPage.tsx

@@ -1,7 +1,9 @@
-import { useEffect, useRef, useState } from "react";
-import { Download, File as FileIcon, Link2, Lock, PlayCircle } from "lucide-react";
+import { useEffect, useId, useRef, useState } from "react";
+import { Download, File as FileIcon, Link2, Lock, PlayCircle, Repeat } from "lucide-react";
 import { Button } from "./ui/Button";
 import { formatBytes } from "../lib/format";
+import { exposeVideoToBackgroundPlay } from "../lib/browserBackgroundPlay";
+import { LS, readJSON, writeJSON } from "../lib/storage";
 
 // Standalone, login-free video page for a shared /watch/<token> link. Rendered OUTSIDE the app
 // tree (no auth, no providers) — like the /privacy and /terms pages. Uses plain fetch and a tiny
@@ -80,6 +82,12 @@ const STR = {
     file: "File",
     links: "Links",
     brand: "Shared via Siftlode",
+    repeat: "Repeat",
+    failed: "Couldn't load this link.",
+    failedHint: "Check your connection and try again.",
+    retry: "Try again",
+    tooMany: "Too many attempts. Try again in a few minutes.",
+    unlockFailed: "Couldn't check the password. Try again.",
   },
   hu: {
     loading: "Betöltés…",
@@ -93,6 +101,12 @@ const STR = {
     file: "Fájl",
     links: "Linkek",
     brand: "Megosztva a Siftlode-dal",
+    repeat: "Ismétlés",
+    failed: "Nem sikerült betölteni a linket.",
+    failedHint: "Ellenőrizd a kapcsolatot, és próbáld újra.",
+    retry: "Újrapróbálás",
+    tooMany: "Túl sok próbálkozás. Próbáld újra pár perc múlva.",
+    unlockFailed: "Nem sikerült ellenőrizni a jelszót. Próbáld újra.",
   },
   de: {
     loading: "Wird geladen…",
@@ -106,6 +120,12 @@ const STR = {
     file: "Datei",
     links: "Links",
     brand: "Geteilt über Siftlode",
+    repeat: "Wiederholen",
+    failed: "Der Link konnte nicht geladen werden.",
+    failedHint: "Prüfe deine Verbindung und versuche es erneut.",
+    retry: "Erneut versuchen",
+    tooMany: "Zu viele Versuche. Versuche es in ein paar Minuten erneut.",
+    unlockFailed: "Das Passwort konnte nicht geprüft werden. Versuche es erneut.",
   },
 } as const;
 
@@ -117,10 +137,13 @@ const T = STR[lang];
 
 export default function WatchPage() {
   const token = window.location.pathname.split("/watch/")[1]?.split(/[/?#]/)[0] ?? "";
-  const [status, setStatus] = useState<"loading" | "ready" | "password" | "gone">("loading");
+  const [status, setStatus] = useState<"loading" | "ready" | "password" | "gone" | "error">(
+    "loading",
+  );
   const [meta, setMeta] = useState<Meta | null>(null);
   const [password, setPassword] = useState("");
   const [error, setError] = useState<string | null>(null);
+  const errorId = useId();
   const [unlocking, setUnlocking] = useState(false);
   // One ref for whichever element renders (video or audio-only) — a callback ref so it can bind to
   // both without a per-element typed ref.
@@ -130,22 +153,45 @@ export default function WatchPage() {
   };
   useMediaSession(mediaRef, meta, status === "ready");
 
+  // Repeat the shared media when it ends — on unless the viewer turned it off. Remembered per browser
+  // (this page has no account); an unreadable storage just means the default.
+  const [repeat, setRepeat] = useState(() => readJSON<boolean>(LS.watchRepeat, true) !== false);
+  const toggleRepeat = () => {
+    const next = !repeat;
+    setRepeat(next);
+    writeJSON(LS.watchRepeat, next);
+  };
+
+  // Bumped by Retry, which asks again.
+  const [attempt, setAttempt] = useState(0);
   useEffect(() => {
     if (!token) {
       setStatus("gone");
       return;
     }
     fetch(`/api/public/watch/${encodeURIComponent(token)}`)
-      .then((r) => (r.ok ? r.json() : Promise.reject(r.status)))
-      .then((m: Meta) => {
-        if (m.needs_password) setStatus("password");
+      .then((r) => {
+        // Only a 404 says the link is gone (unknown, expired, revoked, or its file removed). Anything
+        // else — a 5xx while the server restarts, a dropped connection — is a failure worth retrying,
+        // not a dead link.
+        if (r.status === 404) return null;
+        if (!r.ok) throw new Error(`HTTP ${r.status}`);
+        return r.json() as Promise<Meta>;
+      })
+      .then((m) => {
+        if (!m) setStatus("gone");
+        else if (m.needs_password) setStatus("password");
         else {
           setMeta(m);
           setStatus("ready");
         }
       })
-      .catch(() => setStatus("gone"));
-  }, [token]);
+      .catch(() => setStatus("error"));
+  }, [token, attempt]);
+  const retry = () => {
+    setStatus("loading");
+    setAttempt((n) => n + 1);
+  };
 
   const unlock = async () => {
     setUnlocking(true);
@@ -160,12 +206,20 @@ export default function WatchPage() {
         setError(T.wrong);
         return;
       }
-      if (!r.ok) {
+      // Unlocking is rate-limited per link: too many tries is not a dead link either.
+      if (r.status === 429) {
+        setError(T.tooMany);
+        return;
+      }
+      if (r.status === 404) {
         setStatus("gone");
         return;
       }
+      if (!r.ok) throw new Error(`HTTP ${r.status}`);
       setMeta(await r.json());
       setStatus("ready");
+    } catch {
+      setError(T.unlockFailed);
     } finally {
       setUnlocking(false);
     }
@@ -180,7 +234,9 @@ export default function WatchPage() {
         </div>
 
         {status === "loading" && (
-          <div className="flex-1 grid place-items-center text-muted">{T.loading}</div>
+          <div role="status" className="flex-1 grid place-items-center text-muted">
+            {T.loading}
+          </div>
         )}
 
         {status === "gone" && (
@@ -192,6 +248,19 @@ export default function WatchPage() {
           </div>
         )}
 
+        {status === "error" && (
+          <div className="flex-1 grid place-items-center text-center">
+            {/* Announced: it replaces the loading line, and this page has no live region of its own. */}
+            <div role="alert">
+              <div className="text-lg font-semibold">{T.failed}</div>
+              <div className="text-sm text-muted mt-1">{T.failedHint}</div>
+              <Button variant="primary" size="md" onClick={retry} className="mt-4">
+                {T.retry}
+              </Button>
+            </div>
+          </div>
+        )}
+
         {status === "password" && (
           <div className="flex-1 grid place-items-center">
             <div className="w-full max-w-sm rounded-2xl glass p-6">
@@ -205,9 +274,15 @@ export default function WatchPage() {
                 onChange={(e) => setPassword(e.target.value)}
                 onKeyDown={(e) => e.key === "Enter" && password && unlock()}
                 placeholder={T.passwordPlaceholder}
+                aria-describedby={error ? errorId : undefined}
                 className="w-full rounded-lg bg-surface border border-border px-3 py-2 text-sm outline-hidden focus:ring-2 focus:ring-accent/40"
               />
-              {error && <div className="text-sm text-danger mt-2">{error}</div>}
+              {/* Announced: focus stays in the input, so a silent message reads as a submit that did nothing. */}
+              {error && (
+                <div id={errorId} role="alert" className="text-sm text-danger mt-2">
+                  {error}
+                </div>
+              )}
               <Button
                 variant="primary"
                 size="md"
@@ -259,25 +334,40 @@ export default function WatchPage() {
                  <audio>. No poster exists for these, so present it as a deliberate padded bar on
                  the surface (not the black video box) so it looks intentional without artwork. */
               <div className="rounded-xl border border-border bg-surface p-4">
-                <audio ref={setMedia} controls src={meta.file_url} className="w-full block" />
+                <audio
+                  ref={setMedia}
+                  controls
+                  loop={repeat}
+                  src={meta.file_url}
+                  className="w-full block"
+                />
               </div>
             ) : (
               /* Shrink-wrap the player to the video so a vertical/short clip renders as a narrow
                  player instead of a wide box with black bars; a landscape clip fills the width. */
               <div className="rounded-xl overflow-hidden bg-black border border-border w-fit max-w-full mx-auto">
                 <video
-                  ref={setMedia}
+                  ref={(el) => {
+                    setMedia(el);
+                    // So Brave iOS's background play keeps it going when the app is left.
+                    exposeVideoToBackgroundPlay(el);
+                  }}
                   controls
                   playsInline
+                  loop={repeat}
                   src={meta.file_url}
                   poster={meta.poster_url || undefined}
                   className="max-h-[80vh] max-w-full mx-auto block"
                 />
               </div>
             )}
-            <div className="mt-3 flex items-start gap-3">
-              <div className="min-w-0 flex-1">
-                <h1 className="text-lg font-semibold leading-snug">{meta.title || "Video"}</h1>
+            {/* The actions wrap under the title when the row is too narrow for both (a phone), rather
+                than squeezing the title into a column a word wide. */}
+            <div className="mt-3 flex flex-wrap items-start gap-x-3 gap-y-2">
+              <div className="min-w-0 flex-1 basis-60">
+                <h1 className="text-lg font-semibold leading-snug break-words">
+                  {meta.title || "Video"}
+                </h1>
                 {meta.uploader &&
                   (meta.uploader_url ? (
                     <a
@@ -292,14 +382,26 @@ export default function WatchPage() {
                     <div className="text-sm text-muted">{meta.uploader}</div>
                   ))}
               </div>
-              {meta.allow_download && (
-                <a
-                  href={meta.file_url}
-                  className="shrink-0 inline-flex items-center gap-1.5 rounded-lg bg-surface hover:bg-card px-3 py-2 text-sm font-medium transition"
+              <div className="flex shrink-0 items-center gap-2">
+                {/* An on/off toggle, so the shared pressed-pill paint (a solid fill when on) — not a
+                    Button, whose variants differ only in colour. */}
+                <button
+                  type="button"
+                  aria-pressed={repeat}
+                  onClick={toggleRepeat}
+                  className="pill inline-flex items-center gap-1.5 rounded-lg border px-3 py-2 text-sm font-medium"
                 >
-                  <Download className="w-4 h-4" /> {T.download}
-                </a>
-              )}
+                  <Repeat className="w-4 h-4" aria-hidden /> {T.repeat}
+                </button>
+                {meta.allow_download && (
+                  <a
+                    href={meta.file_url}
+                    className="inline-flex items-center gap-1.5 rounded-lg bg-surface hover:bg-card px-3 py-2 text-sm font-medium transition"
+                  >
+                    <Download className="w-4 h-4" /> {T.download}
+                  </a>
+                )}
+              </div>
             </div>
             {(meta.source_url || (meta.extra_links && meta.extra_links.length > 0)) && (
               <div className="mt-3 flex flex-col gap-1.5">

frontend/src/components/Welcome.tsx

@@ -398,6 +398,9 @@ function AuthCard({ verify }: { verify: VerifyEntry }) {
   const [password, setPassword] = useState("");
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState("");
+  // Keys the error: failing the same way twice is a new node, so a screen reader announces it again (a clear
+  // and a set in one handler commit together, leaving the node untouched).
+  const [attempt, setAttempt] = useState(0);
   // Whether to offer "Continue with Google" — hidden when the instance has no Google OAuth
   // configured. Optimistic (most instances have it); the rare Google-less instance just sees it
   // disappear once the config loads.
@@ -481,6 +484,7 @@ function AuthCard({ verify }: { verify: VerifyEntry }) {
 
   async function onSubmit(e: React.FormEvent) {
     e.preventDefault();
+    setAttempt((n) => n + 1);
     reset();
     const mail = email.trim().toLowerCase();
     if (
@@ -686,7 +690,11 @@ function AuthCard({ verify }: { verify: VerifyEntry }) {
                 className={inputCls}
               />
             )}
-            {error && <p className="text-xs text-danger">{error}</p>}
+            {error && (
+              <p key={attempt} role="alert" className="text-xs text-danger">
+                {error}
+              </p>
+            )}
             <button
               type="submit"
               disabled={busy}

frontend/src/components/WizardProvider.tsx

@@ -22,8 +22,8 @@ const OnboardingWizard = lazy(() => import("./OnboardingWizard"));
 //
 // The wizard auto-opens on first login for accounts that still need to connect YouTube (derived from
 // granted scopes + storage flags, so it's stable across the OAuth round-trip) and is reopenable from
-// Settings / the notify "reconnect" action. It reads `me` as a passive qk.me() observer (App owns the
-// fetching query), so it re-runs the auto-open check when the account resolves or its grants change.
+// Settings / the notify "reconnect" action. It reads `me` as a passive qk.me() observer (BootGate owns
+// the fetching query), so it re-runs the auto-open check when the account's grants change.
 
 interface WizardActions {
   openWizard: () => void;
@@ -43,7 +43,7 @@ export function useWizard(): WizardActions {
 
 export function WizardProvider({ children }: { children: ReactNode }) {
   const [open, setOpen] = useState(false);
-  // Passive observer of the account App fetches (enabled:false → reads cache, re-renders on update).
+  // Passive observer of the account BootGate fetches (enabled:false → reads cache, re-renders on update).
   const { data: me } = useQuery({ queryKey: qk.me(), queryFn: api.me, enabled: false });
 
   const openWizard = useCallback(() => setOpen(true), []);

frontend/src/components/downloadModals.tsx

@@ -8,6 +8,7 @@ import { api, type DownloadJob } from "../lib/api";
 import { inputCls } from "./ui/form";
 import { Button } from "./ui/Button";
 import { IconBtn } from "./downloadRow";
+import { failCopyKeys } from "../lib/downloadFailure";
 
 // Per-item user modals split out of DownloadCenter (self-contained, prop-driven): rename/metadata
 // editing and the failure-detail window.
@@ -118,8 +119,9 @@ export function MetaEditModal({ job, onClose }: { job: DownloadJob; onClose: ()
 }
 
 // Transient failures worth an in-modal Retry button; the rest are permanent (private/geo/DRM/
-// sign-in/unsupported-host/…), where a retry can't help — the queue row still keeps its own retry
-// control regardless. `unknown` is deliberately NOT here: an unclassified failure is most often an
+// unsupported-host/…), where a retry can't help, or need a fix outside this window first (sign-in: a
+// cookie in Settings — its copy then sends the user to the row) — the queue row still keeps its own
+// retry control regardless. `unknown` is deliberately NOT here: an unclassified failure is most often an
 // auth wall we couldn't parse (a login-walled Facebook post reads as a bare "no format"), so a
 // prominent Retry would mislead; force-retrying from the row stays available for genuine transients.
 const RETRYABLE_ERRORS = ["postprocess", "network"];
@@ -142,8 +144,8 @@ export function ErrorModal({
   return (
     <Modal title={t("downloads.errors.fail.title")} onClose={onClose}>
       <div className="space-y-3">
-        <div className="font-medium">{t(`downloads.errors.fail.cat.${code}.short`)}</div>
-        <p className="text-sm text-muted">{t(`downloads.errors.fail.cat.${code}.body`)}</p>
+        <div className="font-medium">{t(failCopyKeys(job, "short"))}</div>
+        <p className="text-sm text-muted">{t(failCopyKeys(job, "body"))}</p>
         {job.error && (
           <div>
             <button

frontend/src/components/downloadRow.dom.test.tsx

@@ -24,6 +24,7 @@ const baseJob: DownloadJob = {
   phase: null,
   error: null,
   error_code: null,
+  error_detail: null,
   queue_pos: 0,
   created_at: null,
   source_kind: "youtube",

frontend/src/components/downloadRow.tsx

@@ -9,6 +9,7 @@ import { notify } from "../lib/notifications";
 import { copyText } from "../lib/clipboard";
 import { formatBytes, formatDuration, formatEta, formatSpeed, relativeTime } from "../lib/format";
 import { navItemAttrs } from "../lib/listNav";
+import { failCopyKeys } from "../lib/downloadFailure";
 
 // Download-row presentation + the small shared primitives (status pill, icon button, usage bar),
 // split out of DownloadCenter (all purely prop-driven, no shared state). Rendered by the queue,
@@ -260,7 +261,7 @@ export function DownloadRow({
               className="text-danger hover:opacity-80 inline-flex items-center gap-1 truncate"
               title={t("downloads.errors.fail.title")}
             >
-              · {t(`downloads.errors.fail.cat.${job.error_code || "unknown"}.short`)}
+              · {t(failCopyKeys(job, "short"))}
               <span className="text-muted underline">{t("downloads.errors.fail.detailsLink")}</span>
             </button>
           ) : null}

frontend/src/components/formAlerts.dom.test.tsx

@@ -0,0 +1,91 @@
+// @vitest-environment jsdom
+//
+// A form's error is announced (role="alert"), and failing the same way again must be announced again. The
+// clear and the set of a validation failure commit together, so the alert node used to stay untouched on
+// the second attempt and a screen reader said nothing — a press that seemed to do nothing.
+//
+// i18n is mocked to a key-passthrough; the API and the E2EE module are stubbed so nothing reaches out.
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { cleanup, fireEvent, render, screen } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return {
+    ...actual,
+    useTranslation: () => ({ t: (key: string) => key, i18n: { language: "en" } }),
+  };
+});
+
+vi.mock("../lib/api", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../lib/api")>();
+  return {
+    ...actual,
+    api: {
+      ...actual.api,
+      authConfig: () => Promise.resolve({ google_enabled: false }),
+      messageMyKey: () => Promise.resolve({ configured: true }),
+      me: () => Promise.resolve({ authenticated: false }),
+      setupInfo: () => Promise.resolve({ secrets_manageable: false }),
+    },
+  };
+});
+
+vi.mock("../lib/e2ee", () => ({ unlock: vi.fn(), setup: vi.fn(), clearDevice: vi.fn() }));
+
+import KeyGate from "./KeyGate";
+import SetupWizard from "./SetupWizard";
+import Welcome from "./Welcome";
+
+afterEach(() => {
+  cleanup();
+  window.history.replaceState(null, "", "/");
+});
+
+// Fails twice the same way; the second alert must be a new node carrying the same message.
+async function failTwice(fail: () => void, message: string) {
+  fail();
+  const first = await screen.findByRole("alert");
+  expect(first.textContent).toBe(message);
+  fail();
+  const second = screen.getByRole("alert");
+  expect(second.textContent).toBe(message);
+  expect(second).not.toBe(first);
+}
+
+describe("a form failing the same way twice announces it twice", () => {
+  it("the message passphrase gate", async () => {
+    render(
+      <QueryClientProvider client={new QueryClient()}>
+        <KeyGate meId={1} />
+      </QueryClientProvider>,
+    );
+    const unlock = await screen.findByText("messages.unlock");
+    fireEvent.change(screen.getByPlaceholderText("messages.passphrase"), {
+      target: { value: "abc" },
+    });
+    await failTwice(() => fireEvent.click(unlock), "messages.passTooShort");
+  });
+
+  it("the sign-in card", async () => {
+    render(
+      <Welcome verify={{ outcome: null, email: null, resetPending: false, dismiss: () => {} }} />,
+    );
+    const email = await screen.findByPlaceholderText("welcome.auth.email");
+    fireEvent.change(email, { target: { value: "not-an-address" } });
+    await failTwice(() => fireEvent.submit(email.closest("form")!), "welcome.auth.invalidEmail");
+  });
+
+  it("the install wizard, with the step's own message rather than the generic one", async () => {
+    window.history.replaceState(null, "", "/?token=setup-token");
+    render(<SetupWizard />);
+    fireEvent.click(await screen.findByText("setup.nav.next")); // past the intro
+    fireEvent.change(await screen.findByPlaceholderText("setup.admin.email"), {
+      target: { value: "not-an-address" },
+    });
+    await failTwice(
+      () => fireEvent.click(screen.getByText("setup.nav.next")),
+      "setup.admin.invalidEmail",
+    );
+  });
+});

frontend/src/components/moduleRegistry.tsx

@@ -1,4 +1,5 @@
-import { lazy, type ComponentType } from "react";
+import type { ComponentType } from "react";
+import { lazyWithPreload, type PreloadableComponent } from "../lib/lazyWithPreload";
 import type { Page } from "../lib/urlState";
 import type { PanelId, PanelLayout } from "../lib/panelLayout";
 import { useMe } from "../lib/useMe";
@@ -21,22 +22,24 @@ import { useSavedViews } from "./SavedViewsProvider";
 // its own isolated scope to <Feed> directly — see the scope note in FeedFiltersProvider).
 
 // Route-level code splitting: each page is its own lazy chunk (admin-only pages never reach
-// non-admins; the logged-out landing pulls only the shell). Rendered inside App's <Suspense>.
-const Home = lazy(() => import("./Home"));
-const Feed = lazy(() => import("./Feed"));
-const Channels = lazy(() => import("./Channels"));
-const Playlists = lazy(() => import("./Playlists"));
-const PlexBrowse = lazy(() => import("./PlexBrowse"));
-const PlexSidebar = lazy(() => import("./PlexSidebar"));
-const NotificationsPanel = lazy(() => import("./NotificationsPanel"));
-const Messages = lazy(() => import("./Messages"));
-const DownloadCenter = lazy(() => import("./DownloadCenter"));
-const Stats = lazy(() => import("./Stats"));
-const Scheduler = lazy(() => import("./Scheduler"));
-const ConfigPanel = lazy(() => import("./ConfigPanel"));
-const AdminUsers = lazy(() => import("./AdminUsers"));
-const AuditLog = lazy(() => import("./AuditLog"));
-const SettingsPanel = lazy(() => import("./SettingsPanel"));
+// non-admins; the logged-out landing pulls only the shell). Rendered inside App's <Suspense>. Each
+// one is preloadable: App fetches the chunks of every page the account can reach once the first page
+// is on screen (preloadPages below), so switching modules never shows the chunk fallback.
+const Home = lazyWithPreload(() => import("./Home"));
+const Feed = lazyWithPreload(() => import("./Feed"));
+const Channels = lazyWithPreload(() => import("./Channels"));
+const Playlists = lazyWithPreload(() => import("./Playlists"));
+const PlexBrowse = lazyWithPreload(() => import("./PlexBrowse"));
+const PlexSidebar = lazyWithPreload(() => import("./PlexSidebar"));
+const NotificationsPanel = lazyWithPreload(() => import("./NotificationsPanel"));
+const Messages = lazyWithPreload(() => import("./Messages"));
+const DownloadCenter = lazyWithPreload(() => import("./DownloadCenter"));
+const Stats = lazyWithPreload(() => import("./Stats"));
+const Scheduler = lazyWithPreload(() => import("./Scheduler"));
+const ConfigPanel = lazyWithPreload(() => import("./ConfigPanel"));
+const AdminUsers = lazyWithPreload(() => import("./AdminUsers"));
+const AuditLog = lazyWithPreload(() => import("./AuditLog"));
+const SettingsPanel = lazyWithPreload(() => import("./SettingsPanel"));
 
 // The GLOBAL feed page: wires <Feed> to the app-wide feed filters / view / live-search. (The channel
 // page renders <Feed> itself with its own channel-scoped filters, so those two never share state.)
@@ -80,8 +83,9 @@ function MessagesPage() {
 }
 
 export type PageDef = {
-  // Prop-free by construction: reads `me` + module state from hooks/providers.
-  Component: ComponentType;
+  // Prop-free by construction: reads `me` + module state from hooks/providers. Preloadable by type, so
+  // a new page cannot silently opt out of preloadPages.
+  Component: PreloadableComponent<object>;
   // Channels + Audit render a table with a sticky header at the scroller top; the shell's top fade
   // would sit on it and flip on with the first scroll, so they turn it off. Defaults to on.
   fadeTop?: boolean;
@@ -94,12 +98,13 @@ export type PageDef = {
 // page id → the component App renders in the content column (+ its shell chrome config).
 export const PAGE_CONTENT: Record<Page, PageDef> = {
   home: { Component: Home, maxWidth: "80rem" },
-  feed: { Component: FeedPage },
+  // The two wrappers preload the lazy chunk they render.
+  feed: { Component: Object.assign(FeedPage, { preload: Feed.preload }) },
   channels: { Component: Channels, fadeTop: false, maxWidth: "96rem" },
   playlists: { Component: Playlists, fadeTop: false, maxWidth: "64rem" },
   plex: { Component: PlexBrowse, maxWidth: "1600px" },
   notifications: { Component: NotificationsPanel, maxWidth: "48rem" },
-  messages: { Component: MessagesPage },
+  messages: { Component: Object.assign(MessagesPage, { preload: Messages.preload }) },
   downloads: { Component: DownloadCenter, maxWidth: "56rem" },
   stats: { Component: Stats },
   scheduler: { Component: Scheduler },
@@ -134,3 +139,13 @@ export const PAGE_RAIL: Partial<Record<Page, RailDef>> = {
   plex: { Rail: PlexSidebar, panelId: "plex", collapse: "filter" },
   playlists: { Rail: PlaylistsRail, panelId: "playlists", collapse: "playlists" },
 };
+
+/** Fetch the code of these pages and of their side rails now, ahead of their first visit. Errors are
+ *  swallowed: a chunk that fails to preload is simply fetched (and its failure surfaced) on visit. */
+export function preloadPages(pages: Page[]): void {
+  for (const p of pages) {
+    PAGE_CONTENT[p].Component.preload().catch(() => {});
+    const rail = PAGE_RAIL[p]?.Rail as Partial<PreloadableComponent<RailProps>> | undefined;
+    rail?.preload?.().catch(() => {});
+  }
+}

frontend/src/components/ui/QueryState.dom.test.tsx

@@ -0,0 +1,74 @@
+// @vitest-environment jsdom
+//
+// A loading state fades in only after a delay, and loading states that hand over to each other share
+// ONE clock. The bug it replaced: every LoadingState restarted its own 300 ms CSS delay, so a slow
+// first load went spinner → blank → spinner when the page chunk's Suspense fallback handed over to
+// the page's own "fetching" state. The clock is module state, so each test runs at its own time.
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { render, cleanup } from "@testing-library/react";
+import { LoadingState } from "./QueryState";
+
+let now = 0;
+beforeEach(() => {
+  vi.spyOn(performance, "now").mockImplementation(() => now);
+});
+afterEach(() => {
+  cleanup();
+  vi.restoreAllMocks();
+});
+
+/** The reveal delay the rendered loading state waits, in ms (0 = shown at once). */
+function revealDelay(container: HTMLElement): number {
+  const el = container.querySelector<HTMLElement>("[role=status]")!;
+  const m = /ease (\d+)ms/.exec(el.style.animation);
+  return m ? Number(m[1]) : 0;
+}
+
+describe("LoadingState reveal", () => {
+  it("a loading state on its own waits the full delay", () => {
+    now = 10_000;
+    const { container } = render(<LoadingState />);
+    expect(revealDelay(container)).toBe(300);
+  });
+
+  it("one that takes over from a loading state on screen keeps that one's clock", () => {
+    now = 20_000;
+    const { container, rerender } = render(<LoadingState key="fallback" />);
+    now = 20_200;
+    rerender(<LoadingState key="page" />); // a new element: the fallback leaves as it mounts
+    expect(revealDelay(container)).toBe(100);
+  });
+
+  it("once the shared clock has run out, the next one in the hand-off shows at once", () => {
+    now = 30_000;
+    const { container, rerender } = render(<LoadingState key="fallback" />);
+    now = 30_400;
+    rerender(<LoadingState key="page" />);
+    expect(revealDelay(container)).toBe(0);
+  });
+
+  it("a loading state after a pause starts a new clock", () => {
+    now = 40_000;
+    const first = render(<LoadingState />);
+    first.unmount();
+    now = 40_500;
+    const { container } = render(<LoadingState />);
+    expect(revealDelay(container)).toBe(300);
+  });
+
+  it("one that mounts just after another left, in a later commit, keeps that one's clock", () => {
+    now = 45_000;
+    const first = render(<LoadingState />);
+    now = 45_050;
+    first.unmount(); // a Suspense fallback leaves a commit before the page's own loading state mounts
+    now = 45_080;
+    const { container } = render(<LoadingState />);
+    expect(revealDelay(container)).toBe(220);
+  });
+
+  it("`since` counts the wait from an earlier start (the boot screen: navigation start)", () => {
+    now = 50_250;
+    const { container } = render(<LoadingState since={50_000} delayMs={400} />);
+    expect(revealDelay(container)).toBe(150);
+  });
+});

frontend/src/components/ui/QueryState.tsx

@@ -1,16 +1,55 @@
-import type { ReactNode } from "react";
+import { useEffect, useState, type ReactNode } from "react";
 import { useTranslation } from "react-i18next";
 import { AlertTriangle, Loader2 } from "lucide-react";
 import { Button } from "./Button";
 
+// A loading state fades in only after a delay: most loads here answer in tens of milliseconds, and a
+// spinner shown for two frames before the content replaces it reads as a flicker, not as feedback. A
+// load that really takes a while still gets the spinner, a third of a second in.
+//
+// The delay is ONE clock across loading states that hand over to each other, not a per-element CSS
+// delay. One wait is often several elements in a row — the boot screen, then the page chunk's
+// Suspense fallback, then the page's own "fetching" state — and a delay restarted by each would blank
+// an already-visible spinner for another 300 ms at every hand-off. A loading state that mounts while
+// another is still on screen (or has just left it) continues that one's clock instead.
+const LOADING_REVEAL_MS = 300;
+const HANDOFF_MS = 100;
+const reveal = { live: 0, at: 0, lastGone: -Infinity };
+function revealWait(since: number | undefined, delayMs: number): number {
+  const now = performance.now();
+  if (reveal.live === 0 && now - reveal.lastGone > HANDOFF_MS) reveal.at = (since ?? now) + delayMs;
+  return reveal.at - now;
+}
+
 // Centered loading state: a spinning accent ring + an optional label. The single shared loading
 // visual for a page/section's first load, so all of them read the same (and can be swapped for
 // skeletons later in one place). `role=status`/`aria-live` announces it to screen readers.
-export function LoadingState({ label, className = "" }: { label?: ReactNode; className?: string }) {
+export function LoadingState({
+  label,
+  className = "",
+  since,
+  delayMs = LOADING_REVEAL_MS,
+}: {
+  label?: ReactNode;
+  className?: string;
+  /** When the wait began (a `performance.now()` time), if earlier than this mount — the boot screen
+   *  passes 0, navigation start. Only used when this state starts a new clock. */
+  since?: number;
+  delayMs?: number;
+}) {
   const { t } = useTranslation();
+  const [wait] = useState(() => revealWait(since, delayMs));
+  useEffect(() => {
+    reveal.live++;
+    return () => {
+      reveal.live--;
+      reveal.lastGone = performance.now();
+    };
+  }, []);
   return (
     <div
       className={`flex flex-col items-center gap-3 py-10 text-sm text-muted ${className}`}
+      style={wait > 0 ? { animation: `fadeIn 0.2s ease ${Math.round(wait)}ms both` } : undefined}
       role="status"
       aria-live="polite"
     >

frontend/src/i18n/backendIds.contract.test.ts

@@ -67,6 +67,13 @@ const adminRefusals = [
   ...backend("routes/admin.py").matchAll(/\{\s*"code":\s*"(\w+)",\s*"reason":\s*"(\w+)"/g),
 ].filter((m) => adminCodes.includes(m[1]!));
 const adminReasons = [...new Set(adminRefusals.map((m) => m[2]!))];
+// The download failure catalog's host-specific entries → `downloads.errors.fail.catalog.<detail>`.
+// A code holds a dot (`facebook.login_wall`), so the reverse check strips the prefix and the part
+// rather than splitting on dots.
+const failDetails = [
+  ...new Set([...backend("downloads/errors.py").matchAll(/detail="([\w.]+)"/g)].map((m) => m[1]!)),
+];
+const DETAIL = "downloads.errors.fail.catalog.";
 
 /** The ids under `prefix` a locale names, `prefix.<id>` or `prefix.<id>.<anything>`. */
 const idsUnder = (keys: Set<string>, prefix: string) =>
@@ -83,6 +90,7 @@ describe("backend ids have their names in both languages", () => {
     expect(auditActions).toEqual(expect.arrayContaining(["config_set", "audit_clear"]));
     expect(quotaActions.length).toBeGreaterThan(0);
     expect(adminCodes).toEqual(expect.arrayContaining(["activate", "setpw"]));
+    expect(failDetails).toEqual(expect.arrayContaining(["facebook.login_wall"]));
     // Every code the frontend localizes is raised somewhere the scan can see.
     expect(adminCodes.filter((c) => !adminRefusals.some((m) => m[1] === c))).toEqual([]);
   });
@@ -117,6 +125,18 @@ describe("backend ids have their names in both languages", () => {
       expect(quotaActions.filter((a) => !idsUnder(keys, "quotaActions").has(a))).toEqual([]);
     });
 
+    it(`${lang}: every download failure-catalog entry`, () => {
+      expect(
+        missing(failDetails.flatMap((d) => [`${DETAIL}${d}.short`, `${DETAIL}${d}.body`])),
+      ).toEqual([]);
+      const named = new Set(
+        [...keys]
+          .filter((k) => k.startsWith(DETAIL))
+          .map((k) => k.slice(DETAIL.length).replace(/\.(short|body)$/, "")),
+      );
+      expect([...named].filter((d) => !failDetails.includes(d))).toEqual([]);
+    });
+
     it(`${lang}: every admin refusal reason`, () => {
       expect(missing(adminReasons.map((r) => `errors.admin.${r}`))).toEqual([]);
       expect([...idsUnder(keys, "errors.admin")].filter((r) => !adminReasons.includes(r))).toEqual(

frontend/src/i18n/index.ts

@@ -32,7 +32,7 @@ export function isSupported(code: string | null | undefined): code is LangCode {
 }
 
 // Initial language before the server preference is known: stored choice, else the browser
-// language, else English. (After login, App adopts the server-persisted preference.)
+// language, else English. (Signed in, BootGate adopts the account's preference before the app renders.)
 function detectInitialLang(): LangCode {
   const stored = localStorage.getItem(LANG_KEY);
   if (isSupported(stored)) return stored;

frontend/src/i18n/locales/en/downloads.json

@@ -152,12 +152,14 @@
   "confirm": {
     "cancelTitle": "Cancel download?",
     "cancelBody": "This stops the download and removes it from your queue.",
+    "cancelAction": "Stop download",
     "deleteTitle": "Remove download?",
     "deleteBody": "This removes it from your list. The file may stay cached for other users until it expires.",
     "removeSharedTitle": "Remove from your list?",
     "removeSharedBody": "This removes it from your shared list only — it won't delete the owner's file.",
     "redownloadTitle": "Re-download this file?",
-    "redownloadBody": "The current file is deleted and downloaded again under the latest format and naming rules. Any share links you've sent keep working and will point to the new file (a failed re-download leaves the link broken)."
+    "redownloadBody": "The current file is deleted and downloaded again under the latest format and naming rules. Any share links you've sent keep working and will point to the new file (a failed re-download leaves the link broken).",
+    "redownloadAction": "Re-download"
   },
   "profiles": {
     "manage": "Manage formats",
@@ -287,6 +289,36 @@
           "short": "Storage full",
           "body": "This download was stopped because your storage quota is already used up. Delete something from your library, then try again."
         }
+      },
+      "catalog": {
+        "facebook": {
+          "login_wall": {
+            "short": "Facebook sign-in required",
+            "body": "Facebook only shows this to signed-in users (e.g. 18+ content or a closed group). Add your Facebook cookies under Settings → Account → Download authentication, then retry the download from the list."
+          },
+          "cookie_rejected": {
+            "short": "Facebook didn't accept the cookies",
+            "body": "The cookies have probably expired, or you signed out in that browser. Export them again, paste them in under Settings → Account → Download authentication, then retry the download from the list. If it still fails, the content has been removed or isn't visible to you."
+          },
+          "group_post_video": {
+            "short": "No video found in this post",
+            "body": "We couldn't find a single downloadable video in this group post. If it does have one, open the video on Facebook and paste its link."
+          }
+        },
+        "youtube": {
+          "bot_wall": {
+            "short": "YouTube sign-in required",
+            "body": "YouTube only serves this video to a signed-in viewer — it asks the downloader to confirm it isn't a bot. Other YouTube videos are usually unaffected. Add your YouTube cookies under Settings → Account → Download authentication, then retry the download from the list."
+          },
+          "cookie_rejected": {
+            "short": "YouTube didn't accept the cookies",
+            "body": "YouTube rotates exported cookies as a security measure, so yours have probably expired. Export them again from a private browsing window, close that window without browsing on, paste them in under Settings → Account → Download authentication, then retry the download from the list."
+          },
+          "media_forbidden": {
+            "short": "YouTube refused the video stream",
+            "body": "YouTube found the video but refused to send the file to a signed-out download. It comes and goes, so a retry from the list is worth one try — and adding your YouTube cookies under Settings → Account → Download authentication is what gets a stubborn one through."
+          }
+        }
       }
     },
     "cookies": {

frontend/src/i18n/locales/hu/downloads.json

@@ -152,12 +152,14 @@
   "confirm": {
     "cancelTitle": "Megszakítod a letöltést?",
     "cancelBody": "Ez leállítja a letöltést és eltávolítja a sorból.",
+    "cancelAction": "Letöltés leállítása",
     "deleteTitle": "Eltávolítod a letöltést?",
     "deleteBody": "Ez eltávolítja a listádról. A fájl a lejáratáig még a gyorsítótárban maradhat mások számára.",
     "removeSharedTitle": "Eltávolítod a listádból?",
     "removeSharedBody": "Csak a te megosztott listádból tűnik el — a tulajdonos fájlját nem törli.",
-    "redownloadTitle": "Újratöltöd ezt a fájlt?",
-    "redownloadBody": "A jelenlegi fájl törlődik és újra letöltődik a legfrissebb formátum- és elnevezési szabályokkal. A már elküldött megosztási linkek működnek tovább, és az új fájlra fognak mutatni (sikertelen újratöltés esetén a link törötten marad)."
+    "redownloadTitle": "Újraletöltöd ezt a fájlt?",
+    "redownloadBody": "A jelenlegi fájl törlődik és újra letöltődik a legfrissebb formátum- és elnevezési szabályokkal. A már elküldött megosztási linkek működnek tovább, és az új fájlra fognak mutatni (sikertelen újraletöltés esetén a link törötten marad).",
+    "redownloadAction": "Újraletöltés"
   },
   "profiles": {
     "manage": "Formátumok kezelése",
@@ -249,7 +251,7 @@
         },
         "login_required": {
           "short": "Bejelentkezés szükséges",
-          "body": "Ehhez a videóhoz bejelentkezett fiók kell (korhatáros, csak tagoknak szóló vagy zárt csoport). Töltsd fel a cookie-kat ehhez az oldalhoz a Beállítások → Fiók → Letöltés-hitelesítés alatt a letöltéshez."
+          "body": "Ehhez a videóhoz bejelentkezett fiók kell (korhatáros, csak tagoknak szóló vagy zárt csoport). Illeszd be a cookie-kat ehhez az oldalhoz a Beállítások → Fiók → Letöltés-hitelesítés alatt a letöltéshez."
         },
         "unsupported_host": {
           "short": "Nem támogatott oldal",
@@ -287,6 +289,36 @@
           "short": "Betelt a tárhely",
           "body": "Ez a letöltés leállt, mert a tárhelykereted már elfogyott. Törölj valamit a könyvtáradból, aztán próbáld újra."
         }
+      },
+      "catalog": {
+        "facebook": {
+          "login_wall": {
+            "short": "Facebook-bejelentkezés szükséges",
+            "body": "A Facebook ezt csak bejelentkezve mutatja (pl. 18+ tartalom vagy zárt csoport). Illeszd be a Facebook-cookie-kat a Beállítások → Fiók → Letöltés-hitelesítés alatt, majd a listában indítsd újra a letöltést."
+          },
+          "cookie_rejected": {
+            "short": "A Facebook nem fogadta el a cookie-kat",
+            "body": "A cookie-k valószínűleg lejártak, vagy kijelentkeztél abban a böngészőben. Exportáld újra őket, illeszd be a Beállítások → Fiók → Letöltés-hitelesítés alatt, majd a listában indítsd újra a letöltést. Ha így sem megy, a tartalmat törölték, vagy nem látható számodra."
+          },
+          "group_post_video": {
+            "short": "Ebben a posztban nem található videó",
+            "body": "Nem találtunk egyértelműen letölthető videót ebben a csoportposztban. Ha mégis van benne, nyisd meg a videót a Facebookon, és annak a linkjét másold be."
+          }
+        },
+        "youtube": {
+          "bot_wall": {
+            "short": "YouTube-bejelentkezés szükséges",
+            "body": "A YouTube ezt a videót csak bejelentkezett nézőnek adja ki — a letöltőprogramtól azt kéri, igazolja, hogy nem robot. A többi YouTube-videót ez általában nem érinti. Illeszd be a YouTube-cookie-kat a Beállítások → Fiók → Letöltés-hitelesítés alatt, majd a listában indítsd újra a letöltést."
+          },
+          "cookie_rejected": {
+            "short": "A YouTube nem fogadta el a cookie-kat",
+            "body": "A YouTube biztonsági okból lecseréli az exportált cookie-kat, ezért a tiéid valószínűleg lejártak. Exportáld őket újra egy privát böngészőablakból, majd zárd be azt az ablakot további böngészés nélkül, illeszd be a Beállítások → Fiók → Letöltés-hitelesítés alatt, majd a listában indítsd újra a letöltést."
+          },
+          "media_forbidden": {
+            "short": "A YouTube nem adta ki a videófájlt",
+            "body": "A YouTube visszaadta a videó adatait, de a fájlt már nem adta ki bejelentkezés nélkül. Ez hol van, hol nincs, ezért érdemes újrapróbálni a listából — a makacs eseteken pedig a YouTube-cookie-k segítenek, a Beállítások → Fiók → Letöltés-hitelesítés alatt."
+          }
+        }
       }
     },
     "cookies": {

frontend/src/lib/accountPinnedStores.dom.test.ts

@@ -0,0 +1,75 @@
+// @vitest-environment jsdom
+//
+// The notification and hints stores read their per-account localStorage when they are imported. In a new
+// tab (bookmark, typed URL: no pin in sessionStorage) that is before BootGate pins the account, so they
+// read as nobody's; they must read again on the pin. The notification store used to keep its empty,
+// nobody's history, and the tab's first notice replaced the account's stored history with it.
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const entry = (id: number, message: string) => ({
+  id,
+  level: "info",
+  message,
+  ts: 1,
+  read: true,
+  dismissed: true,
+  transient: false,
+  repeat: 1,
+  requiresInteraction: false,
+});
+const storedMessages = (account: number) =>
+  (
+    JSON.parse(localStorage.getItem(`siftlode.notifications.${account}`) ?? "[]") as {
+      message: string;
+    }[]
+  ).map((n) => n.message);
+
+beforeEach(() => {
+  localStorage.clear();
+  sessionStorage.clear();
+  vi.resetModules(); // both stores load at import: each test needs a fresh one
+});
+
+describe("stores read at import, in a tab not yet pinned", () => {
+  it("keep the account's notification history and settings once the tab is pinned", async () => {
+    localStorage.setItem("siftlode.notifications.5", JSON.stringify([entry(7, "older")]));
+    localStorage.setItem("siftlode.notifSettings.5", JSON.stringify({ durationMs: 0 }));
+    const notifications = await import("./notifications");
+    const { setActiveAccount } = await import("./api/core");
+
+    notifications.notify({ message: "before the pin" }); // e.g. a failed boot probe
+    setActiveAccount(5);
+    notifications.notify({ message: "after the pin" });
+
+    expect(storedMessages(5)).toEqual(["older", "before the pin", "after the pin"]);
+    expect(notifications.getNotifSettings().durationMs).toBe(0);
+  });
+
+  it("read the account's hints choice once the tab is pinned", async () => {
+    localStorage.setItem("siftlode.hints.5", "0");
+    const hints = await import("./hints");
+    const { setActiveAccount } = await import("./api/core");
+
+    expect(hints.hintsEnabled()).toBe(true); // nobody's: the default
+    setActiveAccount(5);
+    expect(hints.hintsEnabled()).toBe(false);
+  });
+});
+
+describe("a pinned tab pinned to another account", () => {
+  it("leaves the previous account's notices with that account", async () => {
+    // BootGate moves a tab whose account was signed out elsewhere onto the one the server answers as.
+    sessionStorage.setItem("siftlode.activeAccount", "4");
+    localStorage.setItem("siftlode.notifications.4", JSON.stringify([entry(7, "four's")]));
+    localStorage.setItem("siftlode.notifications.5", JSON.stringify([entry(8, "five's")]));
+    const notifications = await import("./notifications");
+    const { setActiveAccount } = await import("./api/core");
+
+    notifications.notify({ message: "as four" });
+    setActiveAccount(5);
+    notifications.notify({ message: "as five" });
+
+    expect(storedMessages(5)).toEqual(["five's", "as five"]);
+    expect(storedMessages(4)).toEqual(["four's", "as four"]);
+  });
+});

frontend/src/lib/activeAccount.dom.test.ts

@@ -0,0 +1,37 @@
+// @vitest-environment jsdom
+//
+// A switch or sign-out hands the tab's next page its account instead of moving the pin: the page being left
+// still unloads as its own account. The players' resume beacons read the pin as they fire on the way out,
+// and with the pin already moved they saved one account's playback position into the other.
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+beforeEach(() => {
+  sessionStorage.clear();
+  sessionStorage.setItem("siftlode.activeAccount", "3");
+  vi.resetModules(); // the hand-over is taken at import: each import below is a page load
+});
+
+describe("pinOnNextPage", () => {
+  it("leaves the pin alone until the next page, which takes the account over once", async () => {
+    const leaving = await import("./activeAccount");
+    leaving.pinOnNextPage(7);
+    expect(leaving.activeAccountId()).toBe(3); // the unload still acts as 3
+
+    vi.resetModules();
+    const next = await import("./activeAccount");
+    expect(next.activeAccountId()).toBe(7);
+
+    next.pinActiveAccount(9); // BootGate corrects it
+    vi.resetModules(); // and an F5 keeps the correction
+    expect((await import("./activeAccount")).activeAccountId()).toBe(9);
+  });
+
+  it("hands over no account at all, so the next page adopts the session's default", async () => {
+    const leaving = await import("./activeAccount");
+    leaving.pinOnNextPage(null);
+    expect(leaving.activeAccountId()).toBe(3);
+
+    vi.resetModules();
+    expect((await import("./activeAccount")).activeAccountId()).toBeNull();
+  });
+});

frontend/src/lib/activeAccount.ts

@@ -1,13 +1,60 @@
-import { useSyncExternalStore } from "react";
-
-// The account a browser TAB is acting as (per-tab, in sessionStorage — see api.ts), plus its reactive
-// wrapper. Its OWN module (imports nothing internal) so it can be shared by both `storage.ts` (which
-// keys per-account localStorage on it) and `useAccountRehydrate.ts` without a circular import — the
-// account id is a lower-level primitive than the storage helpers that consume it.
+// The account a browser TAB is acting as (per-tab, in sessionStorage — see api.ts). Its OWN module
+// (imports nothing internal) so it can be shared by `storage.ts`, which keys per-account localStorage
+// on it, without a circular import — the account id is a lower-level primitive than the storage
+// helpers that consume it.
+//
+// Deliberately NOT reactive: BootGate pins the account before any provider mounts, and a switch reloads
+// the page (handing the new pin over through `pinOnNextPage`), so nothing mounted ever sees the id change
+// underneath it. The one exception is state read at
+// module import (the notification and hints stores), which in a new tab runs before the pin: it reads
+// again through `onAccountPinned`.
 //
 // ACTIVE_ACCOUNT_KEY is duplicated here rather than imported from api.ts so this stays dependency-free.
 export const ACTIVE_ACCOUNT_KEY = "siftlode.activeAccount";
 
+// Re-readers for module-level per-account state, run each time the tab is pinned.
+const pinListeners = new Set<() => void>();
+
+export function onAccountPinned(reload: () => void): void {
+  pinListeners.add(reload);
+}
+
+export function pinActiveAccount(id: number): void {
+  try {
+    sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, String(id));
+  } catch {
+    /* ignore */
+  }
+  pinListeners.forEach((reload) => reload());
+}
+
+// The account the tab's NEXT page is pinned to, handed over by a switch or sign-out that is about to leave.
+// The pin itself stays until the page is gone: the unload still runs as the account the page was built for
+// (the players' resume beacons read the pin as they fire), and with the pin already moved it would save one
+// account's position into the other.
+const NEXT_ACCOUNT_KEY = "siftlode.nextAccount";
+
+/** Pin the tab's next page to `id` — or to none, so it adopts the session's default account. */
+export function pinOnNextPage(id: number | null): void {
+  try {
+    sessionStorage.setItem(NEXT_ACCOUNT_KEY, id == null ? "" : String(id));
+  } catch {
+    /* ignore */
+  }
+}
+
+// Taken over at import, before anything reads the pin.
+try {
+  const next = sessionStorage.getItem(NEXT_ACCOUNT_KEY);
+  if (next != null) {
+    sessionStorage.removeItem(NEXT_ACCOUNT_KEY);
+    if (next) sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, next);
+    else sessionStorage.removeItem(ACTIVE_ACCOUNT_KEY);
+  }
+} catch {
+  /* ignore */
+}
+
 export function activeAccountId(): number | null {
   try {
     const raw = sessionStorage.getItem(ACTIVE_ACCOUNT_KEY);
@@ -29,22 +76,3 @@ export function withActiveAccount(path: string): string {
   if (id == null) return path;
   return `${path}${path.includes("?") ? "&" : "?"}account=${id}`;
 }
-
-// Reactive active-account. setActiveAccount/clearActiveAccount write sessionStorage — a silent op that
-// triggers no React render — so this tab's per-account state (sort/filter/view/layout, all keyed by the
-// account) would never re-read once the account is finally known. That bites exactly once, on first
-// load: the provider tree above <App> mounts with NO account, then <App> pins it after /api/me resolves.
-// The account setters call notifyActiveAccountChange() so useActiveAccountId subscribers can re-hydrate.
-const accountListeners = new Set<() => void>();
-function subscribeActiveAccount(cb: () => void): () => void {
-  accountListeners.add(cb);
-  return () => accountListeners.delete(cb);
-}
-export function notifyActiveAccountChange(): void {
-  for (const cb of [...accountListeners]) cb();
-}
-/** The current tab's active account id, as reactive state — re-renders when it is (re)pinned. The
- * snapshot is a primitive (number | null), so useSyncExternalStore's Object.is check is stable. */
-export function useActiveAccountId(): number | null {
-  return useSyncExternalStore(subscribeActiveAccount, activeAccountId, activeAccountId);
-}

frontend/src/lib/api.ts

@@ -11,19 +11,11 @@ import {
   getActiveAccount,
   HttpError,
   setActiveAccount,
-  clearActiveAccount,
   setUnauthorizedHandler,
 } from "./api/core";
 
 // Re-export the shared HTTP machinery so consumers keep importing these from "./api" unchanged.
-export {
-  alreadyReported,
-  HttpError,
-  getActiveAccount,
-  setActiveAccount,
-  clearActiveAccount,
-  setUnauthorizedHandler,
-};
+export { alreadyReported, HttpError, getActiveAccount, setActiveAccount, setUnauthorizedHandler };
 
 import { accountApi } from "./api/account";
 export type * from "./api/account";

frontend/src/lib/api/core.test.ts

@@ -19,7 +19,7 @@ vi.mock("../../i18n", () => ({ default: { t: (k: string) => k, language: "en" }
 vi.mock("../activeAccount", () => ({
   activeAccountId: () => null,
   ACTIVE_ACCOUNT_KEY: "k",
-  notifyActiveAccountChange: vi.fn(),
+  pinActiveAccount: () => {},
 }));
 
 import {

frontend/src/lib/api/core.ts

@@ -6,7 +6,7 @@ import { getActiveToasts, notify, remove } from "../notifications";
 import i18n from "../../i18n";
 import { formatBytes } from "../format";
 import { reportError } from "../errorDialog";
-import { activeAccountId, ACTIVE_ACCOUNT_KEY, notifyActiveAccountChange } from "../activeAccount";
+import { activeAccountId, pinActiveAccount } from "../activeAccount";
 
 /** The active UI language, as a bare code the server understands ("en"/"hu" — never "en-GB").
  *  Lives here so the request builders can stamp it themselves: a signal that has to be passed in by
@@ -262,23 +262,7 @@ export function beacon(url: string, body: Record<string, unknown>): void {
   }
 }
 
-export function setActiveAccount(id: number): void {
-  try {
-    sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, String(id));
-  } catch {
-    /* ignore */
-  }
-  // Let per-account UI state re-hydrate now the account is known (see notifyActiveAccountChange).
-  notifyActiveAccountChange();
-}
-export function clearActiveAccount(): void {
-  try {
-    sessionStorage.removeItem(ACTIVE_ACCOUNT_KEY);
-  } catch {
-    /* ignore */
-  }
-  notifyActiveAccountChange();
-}
+export const setActiveAccount = pinActiveAccount;
 
 export async function req<T = unknown>(
   url: string,

frontend/src/lib/api/downloads.ts

@@ -76,6 +76,7 @@ export interface DownloadJob {
   phase: string | null;
   error: string | null; // raw yt-dlp/ffmpeg text (technical detail)
   error_code: string | null; // failure category, see backend downloads.errors.classify
+  error_detail: string | null; // host-specific failure-catalog entry, see downloads.errors.diagnose
   queue_pos: number;
   created_at: string | null;
   source_kind: string;

frontend/src/lib/browserBackgroundPlay.dom.test.ts

@@ -0,0 +1,59 @@
+// @vitest-environment jsdom
+//
+// exposeVideoToBackgroundPlay: Brave iOS's background play hooks only a <video> that shows up as a
+// MutationObserver addedNode itself. A video mounted inside a new wrapper in one go never does — this
+// locks that the helper makes it one, once per element, without moving it.
+import { describe, it, expect } from "vitest";
+import { exposeVideoToBackgroundPlay } from "./browserBackgroundPlay";
+
+// Brave's detection rule, re-implemented: count addedNodes that ARE a <video>.
+async function videosSeenWhile(act: () => void): Promise<number> {
+  let seen = 0;
+  const observer = new MutationObserver((records) => {
+    for (const r of records) r.addedNodes.forEach((n) => n instanceof HTMLVideoElement && seen++);
+  });
+  observer.observe(document, { childList: true, subtree: true });
+  act();
+  await Promise.resolve(); // MutationObserver callbacks are microtasks
+  observer.disconnect();
+  return seen;
+}
+
+function mountWrapped(): { wrapper: HTMLDivElement; video: HTMLVideoElement } {
+  const wrapper = document.createElement("div");
+  const before = document.createElement("span");
+  const video = document.createElement("video");
+  const after = document.createElement("span");
+  wrapper.append(before, video, after);
+  return { wrapper, video };
+}
+
+describe("exposeVideoToBackgroundPlay", () => {
+  it("a video mounted inside its wrapper is invisible to the rule until exposed", async () => {
+    const { wrapper, video } = mountWrapped();
+    expect(await videosSeenWhile(() => document.body.append(wrapper))).toBe(0);
+    expect(await videosSeenWhile(() => exposeVideoToBackgroundPlay(video))).toBe(1);
+    wrapper.remove();
+  });
+
+  it("keeps the video exactly where it was", () => {
+    const { wrapper, video } = mountWrapped();
+    document.body.append(wrapper);
+    exposeVideoToBackgroundPlay(video);
+    expect([...wrapper.children].map((c) => c.tagName)).toEqual(["SPAN", "VIDEO", "SPAN"]);
+    wrapper.remove();
+  });
+
+  it("acts once per element, so a ref callback running on every render adds nothing", async () => {
+    const { wrapper, video } = mountWrapped();
+    document.body.append(wrapper);
+    exposeVideoToBackgroundPlay(video);
+    expect(await videosSeenWhile(() => exposeVideoToBackgroundPlay(video))).toBe(0);
+    wrapper.remove();
+  });
+
+  it("ignores null and a detached element", () => {
+    expect(() => exposeVideoToBackgroundPlay(null)).not.toThrow();
+    expect(() => exposeVideoToBackgroundPlay(document.createElement("video"))).not.toThrow();
+  });
+});

frontend/src/lib/browserBackgroundPlay.ts

@@ -0,0 +1,23 @@
+// Brave iOS keeps a web <video> playing when the browser leaves the foreground (Settings → Media → "Enable
+// Background Audio") by re-playing a video the OS paused. But it only hooks the <video> elements it SEES:
+// those present at document start, or a MutationObserver addedNode that IS a <video> (brave-core
+// ios/browser/web/media/resources/media_backgrounding.ts). React inserts a player's <video> inside its
+// freshly mounted wrapper in one go, so the video itself is never an added node and Brave never hooks it —
+// measured on iPad Brave 2026-09-14: the shared video stopped the moment the app was left; inserted as a
+// node of its own it kept playing, locked screen included.
+//
+// Re-inserting the element at its own position makes it an added node without changing the DOM React
+// manages. Playback is not interrupted: a media element removed and re-inserted within the same task is
+// back in the document by the next stable state, so the spec's pause-on-removal never runs.
+//
+// Only a <video> needs this: an <audio> already keeps playing in the background on its own.
+
+const exposed = new WeakSet<HTMLVideoElement>();
+
+/** Make a mounted <video> visible to the browser's background-play hook. Idempotent per element, so it is
+ *  safe from a ref callback that React calls on every render. */
+export function exposeVideoToBackgroundPlay(video: HTMLVideoElement | null): void {
+  if (!video || exposed.has(video) || !video.parentNode) return;
+  exposed.add(video);
+  video.parentNode.insertBefore(video, video.nextSibling);
+}

frontend/src/lib/downloadFailure.test.ts

@@ -0,0 +1,49 @@
+// @vitest-environment jsdom
+//
+// A failed download's explanation: the failure-catalog entry first, its category as the fallback
+// (E11.5 S1). The second case runs the REAL i18next with the real locales, because the fallback is
+// i18next's list-key lookup, not code of ours — an older client meeting a detail it has no copy for
+// must still say the category, not print a key.
+import { describe, expect, it } from "vitest";
+import i18n from "../i18n";
+import { failCopyKeys } from "./downloadFailure";
+
+describe("failCopyKeys", () => {
+  it("puts a catalog entry before its category, and is the category alone without one", () => {
+    expect(
+      failCopyKeys({ error_code: "login_required", error_detail: "facebook.login_wall" }, "body"),
+    ).toEqual([
+      "downloads.errors.fail.catalog.facebook.login_wall.body",
+      "downloads.errors.fail.cat.login_required.body",
+      "downloads.errors.fail.cat.unknown.body",
+    ]);
+    expect(failCopyKeys({ error_code: "network", error_detail: null }, "short")).toEqual([
+      "downloads.errors.fail.cat.network.short",
+      "downloads.errors.fail.cat.unknown.short",
+    ]);
+    expect(failCopyKeys({ error_code: null, error_detail: null }, "short")).toEqual([
+      "downloads.errors.fail.cat.unknown.short",
+    ]);
+  });
+
+  it("reads the entry's copy, and the category's for an entry this client does not know", async () => {
+    await i18n.changeLanguage("en");
+    expect(
+      i18n.t(
+        failCopyKeys(
+          { error_code: "login_required", error_detail: "facebook.login_wall" },
+          "short",
+        ),
+      ),
+    ).toBe("Facebook sign-in required");
+    expect(
+      i18n.t(
+        failCopyKeys({ error_code: "login_required", error_detail: "facebook.newer" }, "short"),
+      ),
+    ).toBe("Sign-in required");
+    // A category this client has no copy for (a newer backend): the generic sentence, never a key.
+    expect(i18n.t(failCopyKeys({ error_code: "rate_limited", error_detail: null }, "short"))).toBe(
+      "Download failed",
+    );
+  });
+});

frontend/src/lib/downloadFailure.ts

@@ -0,0 +1,20 @@
+import type { DownloadJob } from "./api";
+
+// The i18n keys that explain a failed download, most specific first — the list form `t()` takes, so
+// the first key a locale has wins. A failure-catalog entry (`error_detail`, e.g. `facebook.login_wall`)
+// names what went wrong on that site and what to do; the category (`error_code`) is the generic
+// sentence, and the fallback when an older client meets a detail it has no copy for; a category it has
+// no copy for falls back to the unknown one, so the row never prints a key. One helper for the queue
+// row's headline and the failure window, so the two can never explain the same job differently.
+export function failCopyKeys(
+  job: Pick<DownloadJob, "error_code" | "error_detail">,
+  part: "short" | "body",
+): string[] {
+  const category = (code: string) => `downloads.errors.fail.cat.${code}.${part}`;
+  const code = job.error_code || "unknown";
+  return [
+    ...(job.error_detail ? [`downloads.errors.fail.catalog.${job.error_detail}.${part}`] : []),
+    category(code),
+    ...(code === "unknown" ? [] : [category("unknown")]),
+  ];
+}

frontend/src/lib/hints.ts

@@ -1,6 +1,7 @@
 // App-wide "hints" toggle: when on, Tooltip components reveal short explanatory
 // captions on hover so the UI is somewhat self-documenting for new users. Experienced
 // users can turn it off in Settings. Persisted to localStorage (+ server preferences).
+import { onAccountPinned } from "./activeAccount";
 import { createStore } from "./store";
 import { getAccountRaw, LS, setAccountRaw } from "./storage";
 
@@ -9,6 +10,8 @@ function load(): boolean {
 }
 
 const store = createStore<boolean>(load());
+// Read at import — in a new tab, before BootGate pins the account — so read again once it is pinned.
+onAccountPinned(() => store.set(load()));
 
 export const hintsEnabled = store.get;
 export const subscribeHints = store.subscribe;

frontend/src/lib/lazyWithPreload.dom.test.tsx

@@ -0,0 +1,69 @@
+// @vitest-environment jsdom
+//
+// lazyWithPreload: once preloaded, a page renders synchronously — no Suspense fallback, which on a module
+// switch is a "Loading…" flash in place of the page. And a page that mounted through the lazy path is
+// not remounted (its state kept) once the module is loaded.
+import { describe, it, expect, afterEach } from "vitest";
+import { Suspense, useState, type ComponentType } from "react";
+import { render, screen, act, fireEvent, cleanup } from "@testing-library/react";
+import { lazyWithPreload } from "./lazyWithPreload";
+
+function Counter() {
+  const [n, setN] = useState(0);
+  return <button onClick={() => setN(n + 1)}>count {n}</button>;
+}
+const module = (): Promise<{ default: ComponentType<object> }> =>
+  Promise.resolve({ default: Counter });
+const inSuspense = (C: ComponentType) => (
+  <Suspense fallback={<span>fallback</span>}>
+    <C />
+  </Suspense>
+);
+
+afterEach(cleanup);
+
+describe("lazyWithPreload", () => {
+  it("renders a preloaded page on its first render, without the fallback", async () => {
+    const Page = lazyWithPreload(module);
+    await Page.preload();
+    render(inSuspense(Page));
+    // Synchronously after render — no act/await, so a suspension would still be showing its fallback.
+    expect(screen.queryByText("fallback")).toBeNull();
+    expect(screen.getByText("count 0")).toBeTruthy();
+  });
+
+  it("without a preload it suspends once, then renders", async () => {
+    const Page = lazyWithPreload(module);
+    render(inSuspense(Page));
+    expect(screen.getByText("fallback")).toBeTruthy();
+    expect(await screen.findByText("count 0")).toBeTruthy();
+  });
+
+  it("a page mounted through the lazy path keeps its state across later renders", async () => {
+    // Mounted into a boundary that is ALREADY showing content — how a module switch mounts a page.
+    const Page = lazyWithPreload(module);
+    const shell = (show: boolean, tick: number) => (
+      <Suspense fallback={<span>fallback</span>}>
+        <i>shell {tick}</i>
+        {show && <Page />}
+      </Suspense>
+    );
+    const { rerender } = render(shell(false, 0));
+    rerender(shell(true, 0));
+    fireEvent.click(await screen.findByText("count 0")); // the module has loaded by now
+    rerender(shell(true, 1)); // a later render of the same mount
+    expect(screen.getByText("count 1")).toBeTruthy(); // not remounted as the loaded component
+  });
+
+  it("retries a preload that failed", async () => {
+    let calls = 0;
+    const Page = lazyWithPreload(() =>
+      ++calls === 1
+        ? Promise.reject<{ default: ComponentType<object> }>(new Error("offline"))
+        : module(),
+    );
+    await expect(Page.preload()).rejects.toThrow("offline");
+    await act(() => Page.preload());
+    expect(calls).toBe(2);
+  });
+});

frontend/src/lib/lazyWithPreload.ts

@@ -0,0 +1,43 @@
+import { createElement, lazy, type ComponentType } from "react";
+
+// A route-level lazy component whose code can be fetched BEFORE its first render.
+//
+// React.lazy alone suspends on every first render, even when the chunk is already in the browser: the
+// module promise settles a tick later, so the Suspense fallback is committed and painted for a frame or
+// several. On a module switch that is a "Loading…" flash in place of the page, on every first visit.
+// Here, once `preload()` has resolved, the component renders the loaded module synchronously and never
+// suspends at all.
+//
+// Choosing per render (`loaded ?? Lazy`) cannot swap a mounted page's component type and remount it:
+// a render that suspends on `Lazy` is never committed (React discards a suspended new mount), and
+// `loaded` is set before `Lazy`'s own promise resolves — so every committed render of a mount sees the
+// loaded module. Measured, not assumed: the state test in lazyWithPreload.dom.test.tsx stayed green
+// with a per-mount pin removed, in a boundary that was already showing content.
+
+export type PreloadableComponent<P extends object> = ComponentType<P> & {
+  /** Fetch the component's code now. Idempotent; a failed fetch is retried by the next call. */
+  preload: () => Promise<void>;
+};
+
+export function lazyWithPreload<P extends object>(
+  factory: () => Promise<{ default: ComponentType<P> }>,
+): PreloadableComponent<P> {
+  let loaded: ComponentType<P> | null = null;
+  let pending: Promise<void> | null = null;
+  const preload = () =>
+    (pending ??= factory().then(
+      (m) => {
+        loaded = m.default;
+      },
+      (err: unknown) => {
+        pending = null;
+        throw err;
+      },
+    ));
+  const Lazy = lazy(() => preload().then(() => ({ default: loaded as ComponentType<P> })));
+
+  function Preloadable(props: P) {
+    return createElement(loaded ?? (Lazy as unknown as ComponentType<P>), props);
+  }
+  return Object.assign(Preloadable, { preload });
+}

frontend/src/lib/notifications.ts

@@ -2,6 +2,7 @@
 // the Notification Center shows (info events, actions awaiting interaction, and app
 // errors). History is persisted to localStorage so it survives reloads; action
 // callbacks are live-only and dropped on reload.
+import { activeAccountId, onAccountPinned } from "./activeAccount";
 import { LS, readAccount, readAccountMerged, writeAccount } from "./storage";
 
 export type NotifLevel = "info" | "success" | "warning" | "error" | "fatal";
@@ -205,6 +206,22 @@ function emit() {
 
 recompute();
 
+// The history and settings above are read at import, which in a new tab is before BootGate pins its
+// account — so they read as nobody's. Read them again for the account once it is pinned: otherwise the
+// tab's first write would replace the account's stored history with its own empty one. A notice raised
+// before the pin (a failed boot probe) belongs to no account, so it stays, after the history.
+let loadedFor = activeAccountId();
+onAccountPinned(() => {
+  const unpinned = loadedFor == null ? items : [];
+  loadedFor = activeAccountId();
+  config = loadSettings();
+  // Fresh ids for the history: the notices kept may already hold the low ones (a timer, a producer).
+  const history = load().map((n) => ({ ...n, id: counter++ }));
+  items = [...history, ...unpinned].slice(-MAX_HISTORY);
+  recompute();
+  listeners.forEach((l) => l());
+});
+
 export function subscribe(listener: () => void): () => void {
   listeners.push(listener);
   return () => {

frontend/src/lib/panelLayout.dom.test.ts

@@ -0,0 +1,32 @@
+// @vitest-environment jsdom
+//
+// A panel's layout is seeded from the account's server prefs when the app mounts. The adopt effect this
+// replaced corrected it after mounting; with it gone, a seed that read only this browser's copy would
+// never show a layout changed on another device.
+import { beforeEach, describe, expect, it } from "vitest";
+import { seedLayout } from "./panelLayout";
+import { ACTIVE_ACCOUNT_KEY } from "./activeAccount";
+import { accountKey, LS } from "./storage";
+
+const local = { order: [], collapsed: { genre: true }, hidden: {} };
+
+beforeEach(() => {
+  localStorage.clear();
+  sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, "5");
+  localStorage.setItem(accountKey(LS.plexLayout, 5)!, JSON.stringify(local));
+});
+
+describe("seedLayout", () => {
+  it("takes the account's server layout over this browser's copy", () => {
+    const l = seedLayout("plex", {
+      plexLayout: { order: [], collapsed: {}, hidden: { year: true } },
+    });
+    expect(l.hidden).toEqual({ year: true });
+    expect(l.collapsed).toEqual({});
+  });
+
+  it("uses this browser's copy for a layout the server has never stored", () => {
+    expect(seedLayout("plex", {}).collapsed).toEqual({ genre: true });
+    expect(seedLayout("plex", undefined).collapsed).toEqual({ genre: true });
+  });
+});

frontend/src/lib/panelLayout.ts

@@ -50,7 +50,7 @@ export function defaultLayout(panel: PanelId): PanelLayout {
   return { order: [...PANEL_ORDER[panel]], collapsed: {}, hidden: {} };
 }
 
-export function normalizeLayout(panel: PanelId, raw: unknown): PanelLayout {
+function normalizeLayout(panel: PanelId, raw: unknown): PanelLayout {
   const all = PANEL_ORDER[panel];
   const r = (raw ?? {}) as Partial<PanelLayout>;
   const order = Array.isArray(r.order) ? r.order.filter((x) => all.includes(x)) : [];
@@ -62,10 +62,20 @@ export function normalizeLayout(panel: PanelId, raw: unknown): PanelLayout {
   };
 }
 
-export function loadLayout(panel: PanelId): PanelLayout {
+function loadLayout(panel: PanelId): PanelLayout {
   return normalizeLayout(panel, readAccount<unknown>(LS_KEY[panel], {}));
 }
 
+// A panel's layout when the app mounts: the account's server copy (the `me` cache's preferences) when
+// it has one — so a layout changed on another device is right on the first paint — else this browser's.
+export function seedLayout(
+  panel: PanelId,
+  prefs: Record<string, unknown> | undefined,
+): PanelLayout {
+  const raw = prefs?.[PREF_KEY[panel]];
+  return raw ? normalizeLayout(panel, raw) : loadLayout(panel);
+}
+
 export function saveLayoutLocal(panel: PanelId, l: PanelLayout): void {
   writeAccount(LS_KEY[panel], l);
 }

frontend/src/lib/releaseNotes.ts

@@ -14,6 +14,68 @@ export interface ReleaseEntry {
 }
 
 export const RELEASE_NOTES: ReleaseEntry[] = [
+  {
+    version: "0.87.1",
+    date: "2026-09-16",
+    summary:
+      "A YouTube video that YouTube will only show to a signed-in viewer can now be downloaded: paste your YouTube cookies in Settings the way the failure message already told you to — until now that list had no YouTube in it.",
+    features: [
+      "YouTube joins the sites you can store download cookies for (Settings → Account → Download authentication). A signed-in YouTube download automatically uses the players that accept your login.",
+    ],
+    fixes: [
+      "A YouTube download that stops at “Sign in to confirm you’re not a bot” says so in your language and points at a setting that now exists. If you had already added cookies, it tells you they were refused instead of asking for them again.",
+      "A video YouTube describes but then refuses to hand over is tried again with another player instead of failing at once, and it is no longer called a network error — nothing was wrong with the network.",
+    ],
+    chores: [
+      "The gated video was measured end to end on an isolated stack before and after the fix: every player client, two yt-dlp versions, and finally the real download (519 MB) with cookies attached. One deep-review round — 25 findings raised, none survived adversarial verification, and the one real defect came out of the verification itself: a comment of mine named an error yt-dlp does not raise there. Running it settled what reading it could not.",
+    ],
+  },
+  {
+    version: "0.87.0",
+    date: "2026-09-15",
+    summary:
+      "A shared or library video keeps playing when you switch apps on an iPad, and a new tab opens as the account it belongs to without flashing another page first. Facebook reels keep their titles and an mp3 stays an mp3.",
+    features: [
+      "Background play on iPad (Brave): the shared-video page, the library player and the Plex player keep playing in another app and on the locked screen.",
+      "The shared-video page has a Repeat toggle, on by default.",
+      "Switching modules no longer flashes a loading screen: the pages load quietly in the background, and a slow answer shows its spinner only after a moment.",
+    ],
+    fixes: [
+      "A new tab honours your Startup choice and opens as its own account — no Home page flash, no other account's language or settings on the first frame.",
+      "A signed-in Facebook reel keeps its real title instead of “Video” or “Facebook”, and an mp3 download stays an mp3 (it used to be wrapped into an mp4 an iPad would not play).",
+      "A tab whose account was signed out, suspended or signed out everywhere acts as nobody and comes back as the account still signed in, instead of writing into another account or sticking on the sign-in page.",
+      "Switching or adding an account no longer saves the video you were watching into the other account's resume position.",
+      "A new tab keeps the account's notification history instead of replacing it with its own first notice.",
+      "The shared-video page tells a failed load, a wrong password, too many attempts and an unreachable server apart, with Retry where it helps. Its password limit counts per viewer, so one person guessing cannot lock everyone else out.",
+      "Form errors on sign-in, the message passphrase, password change and setup are read out by screen readers — again on a second identical failure — and the setup wizard names what is wrong instead of a generic error.",
+    ],
+    chores: [
+      "WebKit and iPad projects in the Playwright suite; the Vite dev proxy forwards websockets.",
+      "Four deep-review rounds (12 → 8 → 8 → 8, the last one targeted), every regression test mutation-checked; half of the later rounds' findings were older defects, fixed here.",
+    ],
+  },
+  {
+    version: "0.86.0",
+    date: "2026-09-14",
+    summary:
+      "A failed download now tells you why it failed and what you can do about it, instead of repeating yt-dlp's raw error. Facebook comes first: downloads that used to die on “Cannot parse data” go through, and a Facebook group post downloads its own video instead of a different one from the page.",
+    features: [
+      "A failure says why, in your language: the row names the cause (“Facebook needs you to be signed in”, “Facebook did not accept your cookies”, “No video found in this post”) and its details window says what to do next. The raw error text is still there below it.",
+      "A Facebook download with your cookies that stops at “Cannot parse data” is tried again as Chrome, which gets past it.",
+      "A Facebook group post link downloads the post's own video. Before, yt-dlp either found nothing or quietly downloaded another video from the page; a post without a video now says so.",
+      "Retry and Re-download use a cookie you added after the failure, so the Retry the message asks for actually goes out signed in.",
+    ],
+    fixes: [
+      "A Re-download of a download that needed your cookies used to rebuild without them.",
+      "A job queued behind a download that already failed shows that failure's explanation instead of a bare “Download failed”.",
+      "A download yt-dlp reports no length for takes its length from the file, so its Edit / trim action appears.",
+      "Pressing Pause, Stop or Remove twice, or in two tabs, can no longer free a file another download still uses.",
+      "The confirm buttons in Downloads name the action (Stop download, Re-download, Remove) instead of repeating the question.",
+    ],
+    chores: [
+      "Four sprints, each Facebook behaviour measured on the development server with a real cookie before it was built. Two epic-end review rounds (20 → 17 fixed, then a targeted 4 → 4), every regression test mutation-checked.",
+    ],
+  },
   {
     version: "0.85.0",
     date: "2026-09-13",

frontend/src/lib/storage.ts

@@ -1,6 +1,5 @@
 import { useCallback, useState } from "react";
 import { activeAccountId } from "./activeAccount";
-import { useAccountRehydrate } from "./useAccountRehydrate";
 
 // Central registry of every localStorage key the app uses. One place to see them all, rename
 // safely, and avoid collisions — instead of `"siftlode.x"` string literals scattered across
@@ -16,15 +15,13 @@ export const LS = {
   filters: "siftlode.filters",
   page: "siftlode.page",
   // E24: start every session on the Home surface rather than on the module you happened to leave
-  // open. Per-account, "0" = opt out and go back to remembering the last module. It has to be
-  // localStorage rather than a server pref because `loadInitialPage` runs before /api/me lands —
-  // a landing page decided after the first paint would be a visible jump.
+  // open. Per-account, "0" = opt out and go back to remembering the last module. Read by
+  // `loadInitialPage` in NavigationProvider's initializer, which BootGate runs only once the tab's
+  // account is pinned — so the landing is decided right before the first paint, never corrected after.
   startOnHome: "siftlode.startOnHome",
   perfMode: "siftlode.perfMode",
-  // The feed's view mode (see lib/feedView.ts) — a cache of the server pref, so a reload of an
-  // established tab paints your view straight away. A brand-new tab still starts on the default
-  // until /api/me lands: the account isn't pinned yet (App pins it once meQuery resolves), so
-  // the per-account key can't be read.
+  // The feed's view mode (see lib/feedView.ts) — a local copy of the server pref, which usePref seeds
+  // from only when the server has never stored the key.
   feedView: "siftlode.feedView",
   // The subscribed table's column filters (a FilterMap), lifted out of the table so the top status
   // chips, the Sync column funnel, and the card layout all share ONE state (per-account). Supersedes
@@ -68,11 +65,14 @@ export const LS = {
   notifSettings: "siftlode.notifSettings",
   onboardingDismissed: "siftlode.onboarding.dismissed",
   seenVersion: "siftlode.seenVersion",
+  // The public /watch page's repeat toggle (JSON boolean; on by default). Browser-wide, NOT per account:
+  // that page runs outside the app, with no account at all.
+  watchRepeat: "siftlode.watchRepeat",
   chatDock: (userId: number) => `siftlode.chatDock.${userId}`,
 } as const;
 
 // --- per-account scoping -----------------------------------------------------------------
-// The active-account primitive (activeAccountId / useActiveAccountId / notify) lives in ./activeAccount
+// The active-account primitive (activeAccountId) lives in ./activeAccount
 // so it can be shared without a cycle; the helpers below key localStorage on it.
 
 /** Suffix a base localStorage key with an account id so per-account UI state (filters, selected
@@ -154,24 +154,21 @@ export function writeJSON(key: string, value: unknown): void {
 /** A `useState` whose string value is mirrored to localStorage, scoped to the current account (see
  * accountKey), so one account's persisted tab/view position doesn't carry over to another in the
  * same browser. Survives reload (F5); validation is deferred to the caller (clamp at render) so it
- * can be used before an async-loaded option list is known, keeping hook order stable. Consumers
- * usually mount only once signed in (account known), but re-read on the account-pin transition too so
- * one that mounts before the pin (a fresh tab's first paint) still restores. */
+ * can be used before an async-loaded option list is known, keeping hook order stable. Read once, at
+ * mount: BootGate mounts every consumer after the account is pinned. */
 export function useAccountPersistedState(
   base: string,
   fallback = "",
 ): [string, (value: string) => void] {
   const [value, setValue] = useState<string>(() => getAccountRaw(base) ?? fallback);
-  const markDirty = useAccountRehydrate(() => setValue(getAccountRaw(base) ?? fallback));
-  // Stable setter (base + markDirty are both stable) so a provider can build a stable action on top
-  // of it — e.g. ChannelsProvider's setView, which must not change identity on every tab switch.
+  // Stable setter (base is stable) so a provider can build a stable action on top of it — e.g.
+  // ChannelsProvider's setView, which must not change identity on every tab switch.
   const set = useCallback(
     (next: string) => {
-      markDirty();
       setValue(next);
       setAccountRaw(base, next);
     },
-    [base, markDirty],
+    [base],
   );
   return [value, set];
 }
@@ -184,17 +181,15 @@ export function useAccountPersistedObject<T extends object>(
   defaults: T,
 ): [T, (patch: Partial<T>) => void] {
   const [value, setValue] = useState<T>(() => readAccountMerged(base, defaults));
-  const markDirty = useAccountRehydrate(() => setValue(readAccountMerged(base, defaults)));
   const patch = useCallback(
     (p: Partial<T>) => {
-      markDirty();
       setValue((prev) => {
         const next = { ...prev, ...p };
         writeAccount(base, next);
         return next;
       });
     },
-    [base, markDirty],
+    [base],
   );
   return [value, patch];
 }