feat(downloads): download completed Xtream catch-up programmes as TS (#1572)

* feat(epg): copy catch-up programme URLs without changing playback

* feat(downloads): save completed Xtream archive programmes as TS

* fix(epg): let newer archive copy requests supersede pending work

* fix(downloads): protect archive partials and independent submissions

* fix(downloads): verify archive identity through finalization

* fix(downloads): bound archive storage and capture cleanup entries

* fix(downloads): preserve archive ownership across failure paths

* fix(downloads): recover explicitly verified archive completions

* fix(downloads): journal archive promotion before publishing files

* fix(downloads): reset archive proof before an explicit restart

* fix(downloads): preserve archive recovery ownership and interruption

* fix(downloads): verify durable archive identity at resume open

* fix(downloads): fence archive commands during completion commit

* fix(downloads): persist archive ownership throughout its lifecycle

* fix(downloads): protect archive removal and missing-file recovery

* fix(downloads): journal private cleanup captures for recovery

* fix(downloads): journal active archive cleanup before removal

* fix(downloads): clean settled archives before deleting stale rows

* fix(downloads): preserve archive ownership on removal and resubmission

* fix(downloads): recover proven archive completions before retry

* fix(downloads): recover local archives before remote transfer checks

* test(downloads): resolve archive fixture from workspace root

* fix(downloads): distinguish reused archive inodes by creation time

* fix(downloads): bind fresh archive reservations to owned files

* fix(downloads): clean reservations when ownership writes fail

* fix(downloads): commit archive reservation and ownership atomically

* fix(downloads): retain captures until replacement restoration succeeds

* fix(downloads): require durable ownership before cleanup relocation

* fix(downloads): preserve 64-bit archive file identities on Windows

* refactor(release): keep capture fixture constants in their shared module

* fix(downloads): preserve the last link of captured foreign files

* fix(downloads): expose retained archive recovery files

* fix(downloads): keep recovery instructions open while copying

CLAUDE.md

@@ -1856,3 +1856,37 @@ Xtream/M3U archives, including Favorites/Recent. `EpgArchiveCopyService` owns
 clipboard feedback; hosts resolve URLs without mutating playback. Stalker and
 the currently non-catch-up M3U guide expose no action. See
 `docs/architecture/m3u-playlist-module.md` (Copy archive URL).
+
+## Xtream Archive Downloads
+
+Desktop Xtream Live TV programme details can enqueue completed catch-up as
+`contentType: catchup`. The queue uses the existing timeshift resolver, original
+timestamps and playback headers. `programme_start` plus playlist/channel provides
+identity; JSON `catchup` metadata retains channel, broadcast window and known
+expiry. `download-schema.ts` owns the transactional CHECK/index migration;
+`download-tables.ts` exports the download tables. The cascading
+`download_archive_finalizations` table records write-ahead file identity/size
+proof before promotion (before writing a fallback copy), allowing startup to
+recover completed unknown-length archives and clean only their owned partials.
+The same journal stores transfer-phase descriptor identity before truncation;
+Resume checks it at open, and rejected replacements are preserved and detached
+so Retry can reserve a fresh path. A synchronous completion-commit boundary
+rejects late pause/cancel commands before awaited cleanup and persistence.
+Archive ownership reads device/inode as BigInt and journals decimal strings
+without losing 64-bit Windows file references, alongside positive creation time to reject
+reused inodes after unlink; old proofs without creation time remain untrusted.
+Fresh reservations atomically commit their row path/name and captured ownership
+before the initial HTTP wait;
+no preexisting partial is truncated without matching expected ownership.
+Captured foreign files retain their recovery copy and journal even after public
+restoration, until the user explicitly removes the recovery copy. Remove/Clear
+show its full path and recovery instructions in a persistent dialog with Copy
+recovery path.
+Private cleanup captures are journaled before relocation, keeping failed
+Remove/Clear/cancel cleanup retryable across restarts without hardlinks. Active
+failures, promotion and startup share that cleanup; Remove waits for active
+archive cancellation to settle before deleting its row and journal.
+Archive transfers validate TS framing, restart from byte zero after interruption
+and check expiry again at transfer start. Completed cards play locally and never
+route to VOD details. Contract and EOF/duration limits:
+`docs/architecture/download-manager.md` (Xtream archive downloads).