fix(playback): harden runtime guidance ownership

docs/architecture/embedded-inline-playback.md

@@ -55,6 +55,15 @@ short-lived exact pending-request snapshot/guard that locates the selected
 episode and rejects stale or out-of-order completion. This keeps token refreshes
 in one logical session while ensuring colliding tracking hashes cannot select a
 sibling episode.
+After a Stalker episode mounts, the host retains only a frozen structural
+identity (source, normalized parent, series mode, exact season key, season and
+episode coordinates, and the credential-free session key). Each metadata,
+navigation, or autoplay read resolves those coordinates against the current
+`mappedSeasons()` value. Same-owner provider or TMDB refreshes therefore update
+the mounted episode without changing its session key; if the episode disappears,
+or if multiple episodes claim the same structural coordinates, the mounted
+commands fail closed. The command/ID-bearing identity never outlives the pending
+playback request.
 Shared wrappers (`VodDetailsComponent` and `PortalInlinePlayerComponent`) pass
 the key unchanged to `WebPlayerViewComponent`.
 
@@ -629,13 +638,21 @@ nullable binding, both opaque tokens, and its live/VOD flag. A time update can
 change the resume position only while that exact capture still owns the current
 application, so a replaced source cannot repopulate cleared handoff state.
 
-Selecting a built-in recommendation records the target, clears the diagnostic,
-and installs a temporary local override ahead of the host override and saved
-player setting. The new engine receives the latest finite VOD position as a
-best-effort resume point; live playback starts at the live edge. Retry reloads
-the active target without clearing attempts. Selecting MPV or VLC records the
-external target before emitting the existing fallback request. The system does
-not infer whether the external process ultimately played the stream.
+A separate fieldless intent token invalidates on each new source, target, or
+reload intent. It clears the prior diagnostic from visible and actionable state
+before any asynchronous Electron header handoff completes, without retaining
+source material. False or rejected current handoffs leave it detached, and a
+stale success, false result, or rejection cannot restore the old diagnostic or
+mutate the newer application state.
+
+Selecting a built-in recommendation records the target, immediately detaches
+the diagnostic, and installs a temporary local override ahead of the host
+override and saved player setting. The new engine receives the latest finite
+VOD position as a best-effort resume point; live playback starts at the live
+edge. Retry reloads the active target without clearing attempts. Selecting MPV
+or VLC records the external target before emitting the existing fallback
+request. The system does not infer whether the external process ultimately
+played the stream.
 
 No recommendation mutates `Settings.player` or another persisted setting.
 Recovery recommendations never auto-switch a player or source and do not

docs/architecture/stalker-portal.md

@@ -1162,7 +1162,19 @@ Series inline playback behavior is shared across all three modes:
   blocks the action rather than binding regular, embedded, or lazy VOD content
   to another mode; an exact canonical episode id still wins.
 
-- `StalkerSeriesViewComponent` maps every mode into `mappedSeasons()` and derives the currently playing episode from `inlinePlayback.contentInfo.contentXtreamId`.
+- `StalkerSeriesViewComponent` maps every mode into `mappedSeasons()` and uses
+  two episode identities. A pending playback request keeps an exact,
+  request-local provider command or episode ID so command rotation and hash
+  collisions reject stale completion. Once mounted, the component freezes only
+  the credential-free structural identity and session key (source, normalized
+  parent, mode, season key, season number, and episode number).
+- The mounted structural identity is re-resolved against the current
+  `mappedSeasons()` for metadata, Previous/Next, and autoplay. Same-owner
+  provider and TMDB refreshes therefore expose current episode objects and
+  commands without remounting the player; if the episode is missing or its
+  structural coordinates are ambiguous, those surfaces and commands fail
+  closed. Provider commands and IDs are never retained in mounted session
+  state.
 - The inline player header shows the current episode metadata below the title, for example `S01E03 - Episode title`.
 - Embedded players receive previous/next episode state for the current season only.
 - Inline series autoplay is enabled by default. On player EOF (`ended`), Stalker starts the next episode only when it already exists in the current season's mapped episode list.