fix(xtream): render catch-up start times in the panel timezone (#1563)

* fix(xtream): render catch-up start times in the panel timezone

The `{Y-m-d:H-M}` segment of an Xtream timeshift URL is read by the panel
with `strtotime()` in ITS timezone (`server_info.timezone`), never the
viewer's. The timezone was learned in memory only, by the store's
`checkPortalStatus()`, so the Favorites / Recent catch-up resolver — which
reads the STORED playlist row — always fell back to the viewer's local
clock and asked the panel for the wrong programme (#1562).

- Normalize the panel's clock once (`resolveXtreamServerTimezone`): an
  ICU-resolvable name is kept, otherwise a `UTC±HH:MM` offset is derived
  from the `time_now` / `timestamp_now` clock pair, so spellings such as
  `UTC+3` no longer silently mean "local time".
- Persist it on the playlist row through `transformPlaylistMeta` (no-op
  when unchanged) and project it back from the payload in
  `DB_GET_PLAYLIST`, so both catch-up entry points and a restart see it.
- Format with `hourCycle: 'h23'` (server midnight is `00`, never `24`) and
  read timestamp-less EPG `start`/`end` strings in the panel's clock.
- Mock: `tzoffset:tzoffset` scenario with an unusable timezone name and a
  +03:00 clock pair; Electron e2e covers Live TV, Favorites, a restart into
  Global favorites, and the clock-pair derivation at a UTC-3 viewer.

Closes #1562

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(xtream): guard the account-info answer by playlist identity and reject rolled-over dates

Review follow-ups (Greptile):

- A source switch while `get_account_info` is in flight no longer hands
  playlist A's status or clock to playlist B: the store is patched only
  while the asking playlist is still selected, the timezone is persisted
  under the asking playlist's id regardless, and a late failure cannot mark
  the newly selected playlist unavailable.
- `parseNaiveUtcMs` reads the constructed date back, so out-of-range panel
  strings (`2026-13-01 25:00:00`) are rejected instead of silently rolling
  over into a real instant.
- Document that a clock-derived fixed offset is a DST-less snapshot, refreshed
  by every account-info check and only ever used for non-standard servers.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(xtream): drop a panel clock that no longer belongs to the source

Review follow-ups (Codex + Greptile):

- A metadata update or DB_UPDATE_PLAYLIST that points the source at another
  server drops the persisted `serverTimezone` (payload-only) until the next
  account-info check, so Favorites / Recent cannot keep rendering the OLD
  panel's clock; an update that supplies a clock keeps it.
- A late account-info answer is persisted only onto a row that still points
  at the panel it came from — an edit that moved the source during the
  request keeps the clock the edit flow dropped.
- The PWA data source and the route-session converter carry the persisted
  timezone into the store playlist, so a later response without a usable
  clock has a previous value to preserve.
- Mirror the catch-up timezone contract into AGENTS.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(xtream): drop the stale panel clock inside the UPDATE statement

Review follow-up (Codex): the database worker interleaves requests, so a
read-modify-write of the playlist payload could hand a concurrent upsert's
newer payload back to the past. The `serverTimezone` removal on a server
URL change is now one `CASE … json_remove(payload, '$.serverTimezone')`
expression inside the same UPDATE, guarded by `json_valid`; the spec runs
the real statement against Electron's SQLite on the actual `playlists`
table (moved, renamed, clock-less, malformed-payload and NULL-URL rows).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* refactor(xtream): split the server-clock primitives out of the timezone util

Review follow-up (Greptile): `xtream-server-timezone.util.ts` had grown past
the 300-line file guideline. The zone-agnostic wall-clock primitives (stored
forms, Intl parts, naive parsing) now live in `xtream-server-clock.util.ts`;
the timezone util keeps the Xtream policy and re-exports the public helpers,
so every import and the spec are unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(xtream): offer the learned panel clock to storage on every check

Review follow-up (Codex): a transient storage failure left the clock in the
store but not on the row, and the next check compared the answer with the
in-memory value and never retried. The resolved timezone is now always
handed to `transformPlaylistMeta`, whose row-level equality check keeps the
common case a read without a write; a failed write is retried by the next
account-info check.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(xtream): apply an account-info answer only to the panel it came from

Review follow-up (Codex): an in-place edit keeps the playlist id while
moving the source, so an answer already on the wire for the OLD panel
passed the id-only guard and patched the new panel's status and clock into
the store. One `answersFor(candidate, credentials)` predicate now gates the
store patch, the error path and the persisted-row transform alike.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(xtream): never report another panel's status for the selected playlist

Review follow-up (Greptile): callers gate content initialization on the
value `checkPortalStatus()` returns for whatever is selected NOW. When the
answer no longer describes the selected playlist (source switch or in-place
edit during the request), the store's own verdict about the current
selection is returned instead of the old panel's status — on success and on
failure alike.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(xtream): persist the panel clock with one conditional UPDATE

Review follow-up (Codex): `transformPlaylistMeta` reads the row and then
upserts it whole, while the Xtream edit dialog saves through
`DB_UPDATE_PLAYLIST` outside `PlaylistsService`'s queue and the database
worker interleaves requests — an edit landing between that read and the
upsert was silently undone.

Persistence now goes through `IXtreamDataSource.rememberServerTimezone`:

- Electron: new `DB_SET_PLAYLIST_SERVER_TIMEZONE` worker op — one UPDATE
  that `json_set`s the payload only while the row still points at the
  request's connection and does not already carry the value; a malformed
  payload is never rewritten (CASE, not AND, so json_extract cannot run
  before json_valid). Wired through the worker types, main handler,
  preload, bridge interface, both IPC contract tables and
  `DatabaseService.setXtreamPlaylistServerTimezone`.
- PWA: `transformPlaylistMeta`, whose read and write share one IndexedDB
  readwrite cursor transaction, plus the localStorage copy.

The store no longer injects `PlaylistsService`; it offers the resolved clock
to the data source and keeps only its in-memory guards. Real-SQLite coverage
for the op (fresh / same / moved / NULL / malformed / missing rows),
delegation specs for both data sources, docs updated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(xtream): keep the stored panel clock across clockless full upserts

Review follow-up (Codex): a `PlaylistsService` mutation that read the row
before `DB_SET_PLAYLIST_SERVER_TIMEZONE` landed and upserted afterwards
replaced the payload with its clockless snapshot. `DB_UPSERT_APP_PLAYLIST(S)`
now carry the STORED clock into a snapshot that has none while the row still
points at the same connection (`playlistConflictUpdate`, nested CASE so the
json_* readers never run on a malformed payload); a snapshot with its own
clock, or one that moves the source, wins as is. Real-SQLite coverage for
kept / moved / own-clock / batch rows.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* refactor(release): split capture-navigation under the max-lines cap

`tools/release/capture-navigation.ts` had grown to 567 counted lines, past
the 400-line rule, which failed `release-tools:lint` and — because the file
was not in the baseline — the max-lines baseline test on master and on
every PR branched from it. The 19 named setup actions are now grouped by
subject over one leaf module of shared page helpers:

- `capture-navigation-helpers.ts`: playlist-id registry, dialog handling,
  navigation moves, `settleUi`
- `capture-navigation-setup-actions.ts`: add-playlist dialogs, settings
  sections, remote control
- `capture-navigation-portal-actions.ts`: portal catalogs, live lists,
  alternative sources (the two identical live-category flows share one
  helper)
- `capture-navigation-download-actions.ts`: the download manager shots
- `capture-navigation.ts`: the `runAction` dispatcher, theme switching and
  the re-exported API the seeding driver and the capture script import

Actions call their siblings directly instead of recursing through
`runAction`, so no module depends on the dispatcher. The action vocabulary
is unchanged (same 19 names, same waits and timeouts); every file is under
300 lines and the new modules are listed in the `release-tools` lint target.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* refactor(electron): move the panel-clock SQL into its own operations module

Review follow-up (Greptile): the timezone persistence, invalidation,
upsert-preservation and row projection had landed in
`playlist.operations.ts`, a baselined 1,000-line file. They now live in
`playlist-server-timezone.operations.ts` (155 lines) — the three SQL
shapes plus the payload projection — and the playlist operations compose
them; the baselined file shrinks by 107 lines. Behaviour and the
real-SQLite coverage are unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

libs/portal/shared/data-access/src/lib/collection/stream-resolver.catchup.spec.ts

@@ -0,0 +1,159 @@
+import { TestBed } from '@angular/core/testing';
+import { EpgRuntimeBridgeService } from '@iptvnator/epg/data-access';
+import {
+    XtreamApiService,
+    XtreamUrlService,
+} from '@iptvnator/portal/xtream/data-access';
+import { StalkerSessionService } from '@iptvnator/portal/stalker/data-access';
+import { UnifiedCollectionItem } from '@iptvnator/portal/shared/util';
+import {
+    DataService,
+    PlaylistsService,
+    SettingsStore,
+} from '@iptvnator/services';
+import { Playlist } from '@iptvnator/shared/interfaces';
+import { of } from 'rxjs';
+import { StreamResolverService } from './stream-resolver.service';
+
+/**
+ * Catch-up from Favorites / Recent resolves its credentials from the STORED
+ * playlist row, not from the Xtream store; the persisted server timezone
+ * must therefore reach the URL builder from that row (issue #1562).
+ */
+describe('StreamResolverService catch-up (issue #1562)', () => {
+    const item: UnifiedCollectionItem = {
+        uid: 'xtream::xtream-1::7',
+        name: 'Timezone News',
+        contentType: 'live',
+        sourceType: 'xtream',
+        playlistId: 'xtream-1',
+        playlistName: 'Xtream',
+        xtreamId: 7,
+        logo: '',
+    };
+    const storedRow = {
+        _id: 'xtream-1',
+        serverUrl: 'https://xtream.example.com',
+        username: 'user',
+        password: 'pass',
+        serverTimezone: 'Europe/London',
+    } satisfies Partial<Playlist>;
+
+    let service: StreamResolverService;
+    let playlistsService: { getPlaylistById: jest.Mock };
+    let xtreamUrl: { resolveCatchupUrl: jest.Mock };
+    let dbGetAppPlaylist: jest.Mock;
+    const originalElectron = window.electron;
+
+    beforeEach(() => {
+        playlistsService = { getPlaylistById: jest.fn(() => of(undefined)) };
+        xtreamUrl = {
+            resolveCatchupUrl: jest
+                .fn()
+                .mockResolvedValue(
+                    'https://xtream.example.com/timeshift/user/pass/60/2026-09-06:20-30/7.ts'
+                ),
+        };
+        dbGetAppPlaylist = jest.fn().mockResolvedValue(storedRow);
+        window.electron = {
+            dbGetAppPlaylist,
+        } as unknown as typeof window.electron;
+
+        TestBed.configureTestingModule({
+            providers: [
+                StreamResolverService,
+                { provide: PlaylistsService, useValue: playlistsService },
+                {
+                    provide: XtreamApiService,
+                    useValue: { getShortEpg: jest.fn(), getFullEpg: jest.fn() },
+                },
+                { provide: XtreamUrlService, useValue: xtreamUrl },
+                { provide: DataService, useValue: { sendIpcEvent: jest.fn() } },
+                {
+                    provide: SettingsStore,
+                    useValue: { resolvedEpgOffsetMinutes: () => 0 },
+                },
+                {
+                    provide: EpgRuntimeBridgeService,
+                    useValue: {
+                        getChannelPrograms: jest.fn(),
+                        getEpgMapping: jest.fn().mockResolvedValue(null),
+                        getEpgMappingsBatch: jest.fn().mockResolvedValue(null),
+                        supportsProgramLookup: true,
+                    },
+                },
+                {
+                    provide: StalkerSessionService,
+                    useValue: {
+                        getCachedToken: jest.fn(() => null),
+                        ensureToken: jest
+                            .fn()
+                            .mockResolvedValue({ token: null }),
+                        makeAuthenticatedRequest: jest.fn(),
+                    },
+                },
+            ],
+        });
+
+        service = TestBed.inject(StreamResolverService);
+    });
+
+    afterEach(() => {
+        window.electron = originalElectron;
+    });
+
+    it('hands the timezone persisted on the Electron playlist row to the catch-up URL builder', async () => {
+        const url = await service.resolveXtreamCatchupUrl(
+            item,
+            1_788_723_000,
+            1_788_726_600
+        );
+
+        expect(dbGetAppPlaylist).toHaveBeenCalledWith('xtream-1');
+        expect(xtreamUrl.resolveCatchupUrl).toHaveBeenCalledWith(
+            'xtream-1',
+            expect.objectContaining({
+                serverUrl: 'https://xtream.example.com',
+                username: 'user',
+                password: 'pass',
+                serverTimezone: 'Europe/London',
+            }),
+            7,
+            1_788_723_000,
+            1_788_726_600,
+            'Europe/London'
+        );
+        expect(url).toContain('/2026-09-06:20-30/');
+    });
+
+    it('reads the same timezone from the IndexedDB row in the PWA', async () => {
+        window.electron = undefined as unknown as typeof window.electron;
+        playlistsService.getPlaylistById.mockReturnValue(
+            of({ ...storedRow, serverTimezone: 'UTC+03:00' })
+        );
+
+        await service.resolveXtreamCatchupUrl(
+            item,
+            1_788_723_000,
+            1_788_726_600
+        );
+
+        expect(xtreamUrl.resolveCatchupUrl).toHaveBeenCalledWith(
+            'xtream-1',
+            expect.objectContaining({ serverTimezone: 'UTC+03:00' }),
+            7,
+            1_788_723_000,
+            1_788_726_600,
+            'UTC+03:00'
+        );
+    });
+
+    it('returns null instead of guessing when the row lacks credentials', async () => {
+        dbGetAppPlaylist.mockResolvedValue({ _id: 'xtream-1' });
+
+        await expect(
+            service.resolveXtreamCatchupUrl(item, 1_788_723_000, 1_788_726_600)
+        ).resolves.toBeNull();
+        expect(xtreamUrl.resolveCatchupUrl).not.toHaveBeenCalled();
+    });
+});

libs/portal/shared/data-access/src/lib/collection/stream-resolver.service.ts

@@ -1122,6 +1122,7 @@ export class StreamResolverService {
             serverUrl: string;
             username: string;
             password: string;
+            serverTimezone?: string;
         },
         streamId: number,
         limit: number,