19 Commits

Include renames

Author	SHA1	Message	Date
4grayandClaude Opus 5	c741815b97	fix(build): include shared UI stylesheets in Nx cache inputs (#1360) ... * fix(build): include shared UI stylesheets in Nx cache inputs `libs/ui/styles` held shared SCSS partials but had no `project.json`, so its files belonged to no Nx project and were absent from every task hash. Editing a partial and running `pnpm nx build web` reported 4 of 4 tasks cached and shipped the previous CSS — a silent wrong build rather than a failure. Nx derives its project graph from TypeScript imports only, so a relative Sass `@use` that crosses a project root creates no edge. Verified directly: after adding the project but before declaring anything, `ui-styles` still had zero dependents in the graph. Make it the `ui-styles` project (no targets — it exists to be hashed) and declare `implicitDependencies` on the 8 consumers. Chosen over adding the path to `sharedGlobals`, which would put shared styles into every project's hash and make a one-line SCSS tweak mark the whole workspace affected. A styles edit now marks 15 projects affected and leaves electron-backend, website, the mock servers and the shared libs alone. `libs/ui/styles` was the only projectless directory holding files under `libs/` or `apps/`. Add `pnpm run styles:inputs:validate` to keep it closed: it resolves every relative stylesheet import against Nx's real project graph and fails when one escapes the input closure of a build that compiles it, naming the project to declare. It exits 1 with 21 diagnostics on the pre-fix tree. Imports of `apps/web/src/nav-list.scss` are deliberately accepted — `web` already hashes that file, and a lib -> app edge would make the graph cyclic. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(build): spawn git without a shell in the stylesheet check `execSync("git ls-files '*.scss'")` runs through `cmd.exe` on Windows, where single quotes are literal characters rather than quoting. Git received the pathspec with the quotes intact, matched nothing and exited 0, so `styles:inputs:validate` reported success after checking zero stylesheets — silently disabling the check for Windows developers while staying green. Spawn with `execFileSync` so no shell is involved and git expands its own pathspec; verified to return the identical 133 files. Both this and the eslint glob trap next to it in the docs report success while covering nothing, so also make an empty scan fail rather than pass: the workspace always contains SCSS, and a listing that returns none means the scan broke. Reported by Codex review on #1360. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(styles): move nav-list partial into ui-styles (#1361) * fix(build): count every target of a comma-separated Sass @import `@import` is the only rule that takes a list, and the scan read just its first target. A later entry crossing an Nx project boundary escaped the cache key while the check still reported success — the same silent-pass failure the tool exists to prevent. Parse every target of an `@import` list. The obvious "read all quoted strings" fix trades one silent gap for a phantom one, so the rule decides: `@use`/`@forward` load exactly one module and a quoted string after it is `with (...)` configuration, and `url(...)` stays a plain CSS import the browser resolves at runtime. Neither is a module Sass compiles. The workspace has no relative `@import` at all today, so the scan still finds the same 42 imports across 133 files; this closes the gap before someone writes one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-08-02 23:18:37 +02:00
4grayandClaude Fable 5	e86e988e72	feat(ui): turn the phone context panel into an off-canvas drawer (#1332) ... * feat(ui): turn the phone context panel into an off-canvas drawer On ≤640px viewports the workspace context panel (categories, filters, settings sections, collection filters) no longer stacks above the route content capped at 30vh — it is a hidden-by-default drawer that slides in from the left over a backdrop, opened via a new header toggle (phone-only, CSS-gated) and closed by selection, backdrop tap, Escape, or any navigation. State lives in the new WorkspaceShellContextDrawerService provided by the shell component; panels close it explicitly after selections that do not navigate (Stalker ITV/radio categories, settings sections, sources filters, collection filters), since NavigationEnd alone cannot cover those. Desktop behavior is untouched, including the ResizableDirective inline width. Closes the drawer follow-up deferred from #1100 / PR #1326. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): make the phone context drawer modal for keyboard users Addresses Greptile P1 and Codex P2 review feedback on #1332: - CdkTrapFocus on the sidebar captures focus into the drawer on open and contains it while the drawer is modal; the shell restores focus to the header toggle on close, since the closed drawer is visibility: hidden and focus left inside it would silently drop to <body>. - The drawer service closes the drawer when the viewport leaves the phone breakpoint (matchMedia), so the trap can never hold the in-flow desktop sidebar after a resize. - The toggle's tooltip and aria-label are now variant-aware — categories on portal routes, filters on sources/collection routes, settings sections on the settings route — instead of a fixed 'Categories & filters' that misdescribed two of the three; the two generic i18n keys are replaced by six variant keys across all 19 locales. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): remove background content from the a11y tree while the drawer is open Round-2 review feedback on #1332 (Greptile P1, Codex P2): - The rail, header, route content and playback footer are marked inert while the phone drawer is open — CdkTrapFocus constrains Tab focus, but a screen reader's virtual cursor could still reach and activate the visually obscured controls behind the backdrop. - The drawer panel itself is the trap's initial focus target (tabindex=-1 + cdkFocusInitial), so focus capture still works when a category list is loading, empty, or failed and renders no focusable rows. - Focus restore on close is deferred one tick: the toggle lives in the inert header, and focus() on a still-inert element is silently ignored. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playback): gate global shortcuts and Escape behind the open phone drawer Round-3 review feedback on #1332 (Codex P2s): - The shell consumes Escape while the drawer is open: downstream Escape consumers (the portal detail shell's inline player close, the shared controls shortcuts) check defaultPrevented, so one keypress no longer closes both the drawer and the obscured playback surface. - inert does not silence document-level keydown listeners, so players opt out themselves while inside an inert region: ControlsShortcuts gains an optional hostElement handler and ignores every shortcut (including Escape) when that host has an inert ancestor, and the radio audio player applies the same check to its volume/mute keys. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): close control, Cmd+F gate, and Embedded MPV inert guard for the drawer Round-4 review feedback on #1332 (Greptile P1, Codex P2s): - The drawer carries its own phone-only close button: touch screen-reader users have no hardware Escape and cannot reach the inert header toggle or the aria-hidden backdrop, so the trapped surface must offer dismissal itself — even when a category list is loading or empty and renders no actionable entries. - Ctrl/Cmd+F no longer opens global search while the drawer is modal; the shortcut would have navigated and focused an input inside the inert header. - EmbeddedMpvShortcuts (native-view legacy dock) gains the same hostElement/inert-ancestor guard as the shared controls shortcuts, so the obscured player cannot react to Space/arrows/M/Escape behind the drawer. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): round-5 drawer feedback + update phone-layout e2e for the drawer Merges master (#1333 landed mobile-layout.e2e.ts pinning the #1326 stacked-panel behavior this PR replaces) and updates that spec to pin the drawer contract instead: panel hidden by default with full-width content, header toggle opens it over a backdrop, category selection and backdrop tap close it. Verified locally on Chromium, Firefox and WebKit (12/12). The spec's getByTestId calls needed plain [data-test-id=...] locators — the web-e2e Playwright config never mapped testIdAttribute. Also addresses Codex round-5 P2s: - Focus restore now reports whether the toggle received focus; when a drawer selection navigated to a route without a context panel (toggle gone), focus falls back to the route content instead of dropping to <body>. - The Xtream and Stalker live layouts' Ctrl/Cmd+B sidebar shortcut opts out while their host sits inside an inert region, matching the other document-level listeners. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): suppress command palette and shortcuts dialog behind the open drawer Greptile round-6 finding on #1332: the document-level Ctrl/Cmd+K handler in WorkspaceShellFacade and the '?' help-key handler in WorkspaceKeyboardShortcutsService still opened their dialogs while the phone context drawer was modal, stacking a second focus-trapped surface on top of it. Both now check the drawer service (injected optionally, same shell-component providers) and stay quiet while it is open, like the Ctrl/Cmd+F global-search gate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): round-7 drawer feedback — Cmd+R gate and native MPV surface hiding Addresses the two Codex round-7 P2s on #1332: - WorkspaceShellContextDrawerService moves to @iptvnator/workspace/shell/util and becomes root-provided, so AppComponent's document-level Ctrl/Cmd+R global-recent shortcut can observe the modal drawer without pulling the lazy shell chunk into the eager bundle. Cmd+R is now suppressed while the drawer is open, like Cmd+F/Cmd+K/'?'. - The shell registers the open drawer with a new EmbeddedMpvOverlayVisibilityService.acquireExternalModalSurface() API: the native-view video surface is composited outside DOM stacking and would paint straight over the drawer regardless of z-index. The service treats registered external modal surfaces exactly like open Material dialogs. - The service's recompute no longer reads overlayActive back before setting it: signals already skip notification on equal values, and that hidden read registered overlayActive as a dependency of any reactive context calling into the service — the shell's acquire/release effect looped forever on exactly that (caught by a live browser probe; the unit suite mocked the service). The effect also wraps the acquire in untracked() for caller-side hygiene. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): expose the phone drawer as a named modal dialog Round-8 review feedback on #1332 (Codex P2s): - While open, the drawer carries role=dialog, aria-modal=true, and a variant-appropriate accessible name (categories / filters / settings sections) — assistive technology now hears that a named modal surface opened instead of an unnamed complementary landmark. Closed (and the always-visible desktop sidebar) stays a plain landmark. - The UI-guidelines drawer section no longer claims the drawer service is component-provided; it is root-provided from workspace/shell/util since the round-7 move, and the stale claim could have led a future change to re-scope it and silently break the AppComponent shortcut gate and the Embedded MPV overlay observer. Matching code comments updated everywhere. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): round-9 — gate M3U player keys behind the drawer, raise drawer stacking Greptile round-9 P1 + Codex round-9 P2 on #1332: - The M3U video player's document-level digit-key channel switching and Ctrl/Cmd+B sidebar toggle now apply the same inert-ancestor guard as every other routed-content key listener. A codebase sweep confirms this closes the class: every document-level key listener on routed content is now either gated by the shell (Escape, Cmd+F/K/R, '?') or opts out via closest('[inert]'); the guidelines now require the guard for any new listener. - The drawer moves from z-index 99/98 to 951/950: above the settings action bar (100) and the root EPG/update panels (900/901), which inert removes from interaction but not from paint order — below the CDK overlay container (1000), since dialogs opened from inside the drawer (Manage categories) must stack on top of it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-02 09:11:11 +02:00
4grayandClaude Fable 5	8f861a3a1b	fix(ui): make the workspace usable on phone-sized screens (#1326) ... * fix(ui): make the workspace usable on phone-sized screens The shell was half-adapted below 640px: the rail flipped to a horizontal bar but the link lists inside it kept stacking downwards, so the navigation was drawn outside the bar and over the header (#1100). Three resizable rails — the shell context panel, the live-layout channel sidebar and the M3U channel drawer — kept their persisted desktop width, which left the content around 50px on a 375px screen. They now span the full width and stack above the content. The inline width written by ResizableDirective is why these rules need `!important`. Found while walking the rest of the UI at 375px and 768px: - The detail hero kept poster and details side by side, squeezing the action row below its own labels until "Play" was clipped to its icon. - The settings section list did not scroll and painted over the footer, which also affected short desktop windows. - Hiding the M3U channel list on a phone was one-way: the restore handle was hidden and only Cmd/Ctrl+B could bring it back. - The live header drew the channel count and the paginator on top of each other up to tablet width, because the paginator does not shrink and the meta collapsed to zero width and overflowed its box. - The search scope checkbox was pushed off the right edge. Live TV states a floor for the player instead of a ceiling for the lists, so the video keeps a usable share of the screen under the categories panel and the channel list. Closes #1100 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): address review — keep the palette reachable and the video visible Two findings from the Codex review on #1326. Hiding the command-palette trigger on phones removed the only pointer-driven way to open it: the rail renders route links plus Settings and emits nothing, so `commandPaletteRequested` had exactly one source. The button stays and its keyboard-shortcut label is swapped for an icon instead. Doing that exposed a latent flex trap in the same row — an <input> keeps an intrinsic min-width from its `size`, and `min-width: auto` honours it, so the field refused to shrink and pushed the trigger out onto the buttons beside it. The M3U drawer released the shared player floor, which on a short landscape phone (600-640px wide) left the content container at half the shell body. The inline guide inside it is `flex: 0 0 <basis>` and took its full 180px out of a container that no longer had it, so the video could reach zero height. The floor is restored and now yields on short viewports, the video states its own minimum, and the guide is what gives way. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): let the channel list keep its height on a landscape phone Follow-up to the review: the player floor added in the previous commit was measured against the viewport, not against what the shell had left. On a 640x360 landscape phone the stacked categories panel already takes 30vh, so claiming another 50vh here drove the channel sidebar to zero height while it was still marked expanded — no way to pick another channel — and pushed the layout past the viewport. The floor now applies only where the screen can afford it (`min-height: 600px`), the sidebar states a floor of its own so it cannot be squeezed out, and the collapsed rule clears that floor so hiding the list still works. Below that height the two panes simply share what is left. Portrait is unchanged: categories 244px, channel list 220px, player 240px on a 375x812 screen. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): address review — settings nav on landscape, poster dead space Two more findings from the Codex review. The stacked settings context panel capped itself at 30vh, which on a 360px screen is 108px — less than the panel's own title and footer, so the seven section rows collapsed to nothing behind an overlapping footer. On short screens the caption gives way (the rail already labels the page), the footer sheds its tall-screen padding, and the settings variant gets a slightly larger cap: unlike the live routes there is no player below competing for height, only a scrollable form. The poster kept a 330px minimum from the skeleton fallback at the bottom of the file — sized for the 220px desktop poster — while the stacked phone hero renders it 140px wide with a ~210px aspect-ratio height. Every loaded detail page carried ~120px of empty space between the poster and the title. The override sits after that rule because it wins on source order, not specificity. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): let the playlist switcher yield to the search field on narrow phones Codex review of d6133da9: on a 320px header a route that contributes its shortcut button left the search field less than its own chrome needs (~74px of icon, palette trigger, gaps and padding), so the field's contents spilled onto the buttons beside it. The switcher is the one header region whose content can ellipsize, so it is what shrinks — down to an 88px floor — while the field states its chrome as a minimum. The field's basis moves from auto to zero so the input's intrinsic size stops counting as content: with basis auto the field claimed its intrinsic width even when room was ample and squeezed the switcher to ~115px on a 375px screen that could fit all 140. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): fit the switcher's own chrome inside its phone floor Follow-up to the Codex note that the trigger's fixed chrome (type icon, refresh, chevron, gaps, padding) exceeds the 88px floor the shell now allows the switcher to shrink to. The flagged scenario itself cannot occur — the Multi-EPG shortcut needs Electron bridge methods the PWA lacks, and Electron enforces a 900px minimum window width so it never sees the phone breakpoint — but the floor should hold on its own terms rather than by accident of which buttons happen to render. Dropping the decorative type icon on phones brings the fixed chrome under the floor, and the name gets the space instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-01 19:23:20 +02:00
4gray	46c7713841	fix(ui): preserve EPG in narrow channel rows (#1312) ... Preserve current-program context and enabled actions in narrow channel rows while aligning loaded rows, skeletons, and virtual-scroll geometry across M3U, Xtream, Stalker, Favorites, and Recent views.	2026-07-31 08:27:36 +02:00
4gray	2ac0de752f	fix(skills): align repository guidance with implementation (#1315) ... * docs(skills): design implementation synchronization * docs(skills): plan implementation synchronization * fix(release): filter internal notes from public body * docs(release): synchronize release workflow guidance * fix(stalker): normalize catalog series flags * fix(stalker): preserve progress with scoped episode IDs * fix(playback): expose strict position persistence * docs(stalker): record series position compatibility * test(skills): validate repository skill contracts * fix(database): keep SQL trace values private * docs(skills): refresh Nx and SQLite ownership * docs(skills): align provider and UI guidance * docs(skills): tighten validated guidance * docs(release): require exact release pushes * style(electron): remove trailing blank line * fix(ci): classify repository skills coverage	2026-07-31 08:00:59 +02:00
4grayandClaude Opus 5	063662028a	feat(portals): find the same movie in your other playlists (#1286) ... * feat(portals): find the same movie in your other playlists A movie that exists in several imported Xtream playlists now shows a "Sources N" chip on its detail page and in the player. Switching playlist mid-film keeps the timecode, a preferred source can be pinned per movie, and a failed stream offers the alternatives instead of a dead end. The governing rule is that a guess is never presented as a fact. Every metadata value carries where it came from — `api` (the provider said so), `parsed` (inferred from the title) or `probe` (we contacted the stream). Facts render as plain tags, guesses are prefixed `~` in a warning colour, and an unknown value renders no tag at all plus a "check" affordance. Ranking and failover read through `factualOnly()`, so a filename claiming 4K is structurally unable to outrank a source that was actually reached. A probe that could not complete reports "unknown", never "unavailable". Scope is deliberately narrow: Xtream to Xtream, movies only, Electron only. Stalker never reaches the `content` table and M3U is a JSON blob whose search forces live content; both are additive later, since the candidate type already carries all three portal kinds. In the PWA every entry point is gated off and the chip renders nothing. Auto-failover is opt-in and off by default. Each source is tried at most once per session, so it terminates structurally, and the switch is never silent — the toast names the new playlist, offers an undo, and warns that the dub may differ only when both sides state an audio track as fact. Notable details: - Playlist names are routinely the pasted URL, credentials included. They are never rendered raw; a short host-only label is derived instead. - Quality is derived from pixel width, not height: a 2.39:1 1080p master is 1920x800, and bucketing that by height would publish "720p" as a fact. - Switching is a single `inlinePlayback.set()` so the player and engine survive and re-seek; the carried position is read before the 15s persistence throttle so it does not rewind. - Sources from one playlist collapse into a group, since the same film often appears there several times under different stream ids. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop stale source resolutions from committing Addresses three defects Greptile found in the multi-source review. **Concurrent switches committed out of order.** Selecting a second source before the first resolution returned let the slower request overwrite the newer selection and repoint Undo at itself. `switchTo` now takes a sequence number and drops its result if a newer switch already committed. **Stale switches crossed movie sessions.** Navigating to another film while a resolution was in flight let the continuation activate the old film's source inside the new controller — and restart it from that session's zero resume position. The controller is now snapshotted per operation and the movie session is revalidated after every await. `check()` had the same hazard across its two awaits and is guarded the same way. **Short titles skipped discovery entirely.** The trigram tokenizer cannot index tokens under three characters, so "Up", "It" or "Us" produced an empty MATCH expression and the query was discarded before SQLite was consulted — the chip could never appear for those films. Discovery now falls back to a bounded scan when FTS structurally cannot serve the title; the existing two-tier normalized confirmation still rejects loose hits like "Upgrade". Each fix carries a regression test; all three were mutation-checked by removing the guard and confirming exactly those tests fail. The previous test asserting that short titles return nothing encoded the bug and has been replaced. The host spec passed 400 lines, so its fixtures moved to a shared module and the race suite into its own file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): make the pin decide playback and keep failover going Second round of Greptile review findings. **A pin had no behavioural effect.** Loading a stored pin only decorated the row: Play still started the route's playlist and failover ranking ignored `isPinned`, so "make this the main source" survived a restart as an icon and nothing else. The primary action now starts from the pinned source when one is set, and the pin outranks everything else in failover ranking. **Failover stopped at the first unresolvable candidate.** An expired account or a failing `get_vod_info` on the top-ranked source ended the attempt, and since production calls `failover()` only once — on the original playback failure — a healthy lower-ranked source was never reached. It now continues through untried candidates. `switchTo` reports why it stopped so the loop can tell "could not resolve, try the next one" from "something newer owns the screen"; without that distinction a superseded switch would have spun forever, because only the former marks the candidate tried. **Identity ignored enrichment.** The key was `playlistId:contentId:title`, so when `get_vod_info` added a TMDB id and release year to an unchanged title the host saw no change, never reloaded, and kept yearless discovery and title-only pin keys — a `tmdb:`-keyed pin could never be found. The key now covers every field that affects matching. **A server refusing HEAD read as unavailable.** Some stream hosts answer 405 or 501 to HEAD yet serve the media over GET. The probe now retries once with the ranged GET the main process already supported, instead of caching a working source as failed and penalising it during failover. Greptile also flagged a missing token check after the resolve await in `switchTo`; that guard landed in 4db3a2fd and sits on the line directly below. Answered on the thread rather than changed. The host service passed 400 lines again, so the pin, probe, switch-notice and current-row concerns moved into focused modules beside it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(portals): record the behaviour the review rounds changed The architecture doc and CLAUDE.md described the feature as first written, not as it now behaves: pins were documented as a stored preference without saying they decide playback, failover was described as stopping at the first unresolvable candidate, the probe as HEAD-only, and discovery as pure FTS with no mention that short titles cannot be tokenized at all. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): invalidate the session while the movie identity is empty The staleness guard added in 4db3a2fd bumped the session only inside `load()`, which leaves a window the guard does not cover: route navigation empties the movie identity first, and `load()` for the replacement runs only once a title is knowable again. A resolution completing in that interval still carried a session number that matched, so it passed the check and started the previous movie's source over the page the user was navigating to. The binding effect now bumps the session as soon as the identity goes null, so anything already in flight is invalidated at the moment the old movie stops being the one on screen rather than when the next one finishes loading. `lastMovieKey` is deliberately left alone: returning to the same movie should not re-run discovery, and the controller's state is still correct — only the in-flight operations needed invalidating. Regression test added and mutation-checked: removing the bump fails exactly that test. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop the source list from losing the real alternatives Six review findings, all in how multi-source decides what to show and what it is playing. Discovery: the current playlist is now excluded in SQL rather than after the fact, so its own duplicate rows can no longer spend the whole row budget before a single alternative is read. The short-title scan matches the token as a word instead of a substring and orders by title length in a wider window, so "Titanic" and "The Italian Job" cannot push the real "It" out of it. Session: metadata enrichment re-runs discovery for the film already on screen. That is a refresh, not a new session — a second identity key (playlistId:contentId) now separates the two, so the source the user switched to keeps playing and stays named, the tried set stays burned, the position survives and a switch in flight still commits. Resume: the multi-source controller no longer records the engine's pre-seek timeupdate at ~0. The playback service's one-shot latch now reports whether the position can be believed, and until it can, the requested start time stands in — so a switch during the initial seek does not restart the film. UI: the in-player sources picker gets the same auto-failover setting and match kind as the detail page's, instead of always rendering the default and dropping the toggle. The caption counts distinct playlists, not stream variants, since the popover groups a portal's copies under that portal. Session mechanics and the pin toggle move into their own modules to keep the host service inside the line budget. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): keep the playing row when the refined year rejects it Follow-on from keeping the session across a rediscovery. The rerun can legitimately drop the row that is playing: enrichment supplies the release year, and the year gate then rejects a copy the yearless search had admitted — "Dune" 1984 while the user is watching the 2021 film. Off the list is right; it is not the same film. Off the screen is not. It is what is streaming, so it stays as a row and keeps the playing badge, rather than letting the caption name a playlist that is not sending any bytes. Also covers the new session key directly in the identity spec. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop a pin write from landing on the next movie Two findings from the review of the previous round. A pin write is an IPC round-trip, and the user can navigate during it. The continuation then applied one film's answer to another film's controller — and because unpinning returns "nothing pinned", it would clear the pin the new movie had just loaded and its Play action would quietly stop starting from the preferred source. It now commits only while the same film is still on screen, like every other async path here. The short-title scan drops its row limit. FTS keeps its window because it ranks by relevance, so what it keeps is what matters; a scan cannot rank, so a window there silently decides which valid sources the user is allowed to see. It also bought nothing: the GLOB cannot use an index, so SQLite reads every row either way and the limit only truncated the answer. What bounds the scan is its predicate — reaching it means the whole title is one or two characters. The switch-notice type moves to the module that builds it, which also removes a circular type import between the two. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): keep external playback, the pin and the resume point honest Five findings from the round-5 review. An external player launched for an alternative carries that playlist's ids, so the page disowned its own session: the primary button never became Stop, stopping found nothing to stop, and another click opened a second player. Multi-source now tells playback which source is actually active, and the matcher accepts either that or the route's own stream. Stop also has to beat the pin. The primary action consults the pin first — that is what makes a pin decide where playback starts — but while a session is running the same button reads Stop, and consulting the pin there made the control do the opposite of its label. A pinned source started from the Resume button resolved at zero, because nothing reports a live position until the first timeupdate. The controller is now seeded from the persisted position, one-way: a live value always wins, since the stored one lags it and applying it would rewind. A pin whose write failed was still shown as pinned, promising a preference that reopening the movie would not have. Portal failures in this path logged raw errors. An Xtream error message carries the stream URL, and that URL is built out of the username and password, so they now go through the redacting logger. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): make every alias of a pin agree, and stop losing rows Four findings from the latest review pass. A pin lookup accepts several aliases of the same movie, but a write only touched the most-trusted one — so after enrichment the title alias still pointed at whatever was pinned before, and a reopen that read it (because TMDB had not landed yet, or its request failed) started the source the user had just replaced. Writes now go to every alias. That alias set was also missing one. Enrichment supplies the year as well as the id, so a pin set before either existed is stored yearless; the candidate list skipped that form entirely and orphaned the row. Discovery could lose whole playlists: one playlist listing a film in dozens of categories produces identically ranked rows that fill the window before another playlist is read. The collapse now happens in SQL, before the limit, rather than in TypeScript afterwards where the missing rows are already gone. And an abandoned source pick finishing late cleared the spinner from the row the user was actually waiting on. Removes `isExhausted()` from the host service — no caller outside its own tests, where the assertion above it already proved the same thing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): probe like playback, and stop the pin answering for a remake Five findings from the latest review pass. Writing a pin to every alias — last round's fix for stale aliases — was wrong in the other direction: `title:{base}:` is shared by every remake, so a known-year decision stored there answers for a different film. Pin Dune (2021), open Dune (1984) before its year arrives, and it would start the 2021 source. A write now clears every alias and stores only the canonical key, which retires the stale ones without making any of them ambiguous. The probe checked a bare URL while playback sends the playlist's User-Agent, Referer and Origin. A panel that requires them answers 401/403, so a stream that plays perfectly was reported dead and penalised in failover ranking. The switch toast interpolated the raw playlist name. Users routinely name a playlist after the URL they pasted, so that line could put credentials over the video; the notice now carries the same safe label the rows use. External players have no timeupdate, so their polled position IS the live one. Feeding it through the seed — which stops at the first value — froze the resume point where playback started, and a switch an hour in rewound to the beginning. And auto-failover concluded "nowhere to go" when a stream failed before discovery answered, stranding the user on the error screen. Moves `switchTo` into the session module, which is where the rest of the switch mechanics already live, and splits the route spec along the same rendering/behaviour seam the other suites use. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): re-check the movie after waiting, and follow the alternative Three findings, two of them regressions from the previous round. Awaiting a pending discovery before failover let the user navigate during that wait: the continuation then ran against whatever controller was current and could answer one film's playback failure by starting another film's alternative. Both waits — failover and pinned Play — now re-check that the same movie still owns the screen. Pinned Play also needed the wait it did not have. Pressing Play while the pin lookup was still out concluded "nothing is pinned" and started the route's own source, making a persisted preference depend on worker latency. And the position bridge still accepted only the route's ids, so an external player running an alternative had every progress update discarded: the resume point stayed where playback began and a switch an hour in rewound the lot. The session matcher and the bridge now share one ownership predicate, since a page that shows Stop for a session whose progress it throws away is the bug in two halves. The test for the external case previously set the position signal directly, which bypassed the very filter that was broken; it now drives the bridge. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop a remake matching, and let a pin survive its own playlist Three findings from the latest review pass. `normalizeTitleKeys` strips bracketed segments as tag noise, so "Dune (1984)" normalizes to exactly "dune" — an EXACT match for the 2021 film, ranked above every fuzzy one, with the year never consulted because that tier skipped the gate. Auto-failover could switch the user to the other film entirely. The year is now read out of brackets too, and a stated disagreement rejects the row on either tier. Playback positions are keyed by (playlist, stream), so watching through a pinned alternative stores progress under ITS ids while the page loads the route copy's row. Starting the pin therefore resumed from a position belonging to a different copy — usually zero. It now loads its own. And a pin can point at another copy of the film inside the playlist being viewed, which discovery excludes wholesale: the pinned row was absent from the list, so nothing showed as pinned and Play ignored the preference. The pin is now read before discovery, which keeps that one row. Moves the pin-shaped decisions into the pin module, where the persistence helpers already live. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): keep a pinned play, a same-playlist copy and Check honest Five findings from the latest review pass. Reading a pinned source's own position is a database round-trip, and the user can navigate across it — the continuation then handed one film's source id to whichever movie now owned the screen. Guarded, like every other await here. Allowing a pinned copy to live in the current playlist made "is this the route's own source?" a two-part question, and the ownership check still asked only about the playlist: an external session for that copy was disowned, so Stop vanished and its progress was dropped. The yearless title alias is shared by every remake, so clearing every alias before a write could delete a different film's pin. Writes and unpins now touch only keys that name one film — plus the ambiguous row this session actually read, which is the one the user is looking at and the one whose absence would make an unpin come back. Restart left the seeded position in the controller, so a failure before the first timeupdate resolved the next source back at it. And the alternative rows on the playback-error screen had a Check button wired to nothing at all. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop a rediscovery restoring the pin it started with A same-movie rediscovery read the pin, then held that snapshot across its source lookup and applied it afterwards. A pin made while the lookup was out was therefore overwritten by the older value: the row and the primary Play action named a source the database no longer held. The snapshot is now applied as soon as it is read, so a later write simply wins on ordering rather than needing to be detected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): write the pin before retiring it, and keep the badge honest Three findings from the latest review pass. Repinning cleared the old rows and then wrote the new one, so a write that failed after the clear left nothing persisted while the row still showed the old pin. The order is reversed: the new key is stored first and the stale ones retired only once it landed. Lookups are most-trusted-first, so a leftover alias never outranks what was just written. Starting a source from the picker, or letting a pin decide the primary Play, never recorded the movie as recently viewed — unlike every other way of playing it. And closing an alternative's player and pressing Play started the route stream while the controller still marked the alternative active, so the picker and caption named a source that was not running. Moves the discovery pass into the session module beside the switch and failover mechanics, and splits the pin spec along the persistence/playback seam, both to stay inside the file-size rule. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop claiming playback, a cached answer and a resolution Three findings, all of them the same rule: never state as fact something the app has not established. The "Playing from …" caption appeared as soon as discovery marked a source active — before Play was pressed, and again after the player was closed. It now requires a player that is actually running. Probe answers were cached by URL alone, but the request now carries the playlist's headers. Two playlists sharing a stream URL could therefore be told the other's answer, marking a source dead without ever asking it. And any width below 900 was labelled 480p, published with `api` provenance: a 640x360 stream stated 480p as a fact, and a 720x576 PAL source likewise. Widths below HD only resolve with the height — 720 is NTSC 480p or PAL 576p — so an unrecognised shape now carries no quality tag at all. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): match the sub-HD formats, and drop the caption on failure Two follow-ups to the previous round, both the same rule again. The 800-wide band still answered from the width alone, so 800x600 and 800x450 were labelled 480p — published with `api` provenance, so read as a measurement. Sub-HD formats are now matched against known shapes with the same 5% tolerance the height path uses, and anything unrecognised carries no tag at all. And "Playing from ..." survived a playback failure: the inline host stays mounted while the diagnostic is on screen, so the page named a source for a stream it had just reported it could not play. The caption now clears on failure and returns when the engine produces time again. Splits the route playback spec along the "what it does" / "what it claims" seam and lifts the repeated active-source stub into one helper. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): let the height veto a width match, and hold the failure state Two follow-ups to the previous round, both in code it introduced. A width that matched exactly one sub-HD format ignored the height entirely, so 640x480 came back as 360p — a measurement the numbers contradict. The height now vetoes, but only in the direction that can be wrong: cropping removes lines, so a SHORTER frame is a letterboxed master of that format and the width still names it, while a taller one is a different shape and gets no tag. That keeps the reason width is preferred in the first place. And picking a source off the error screen cleared the failure state before the switch resolved, so an alternative that could not be resolved left the diagnostic on screen while the caption went back to claiming playback. The flag now clears only once a switch actually starts something. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): release the resume latch when the target cannot be reached Carrying a position into a shorter cut of the same film — two hours into a 90-minute source — leaves the engine unable to ever report that time, so the one-shot latch never released: every position save was suppressed for the rest of the session, and the impossible start time kept being reported to multi-source for the next switch. The latch now also opens when a known duration puts the requested point out of reach, while a reachable one still waits as before. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): say "Playing" only while something is playing `isActive` means "the source a switch or Play would use". Discovery sets it the moment the page opens and it survives closing the player, so it could not back the two claims the UI made in the present tense: the "Playing from" caption and the source row's Playing badge. Both appeared on a page where nothing had started, and came back after the player was closed. `playbackLive` is now that statement, and both read it. Inline it needs a timeupdate — `inlinePlayback()` is only the REQUEST to play, non-null while the engine is still opening the stream and still non-null after it fails — and external it needs the session past `launching`. A row that is merely selected reads "Current" (new key, filled for all 19 locales). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): start a never-watched pinned source from the beginning Positions are keyed by (playlist, stream). When the pin points at a copy the user has never opened, the lookup returns nothing and the controller was left holding the ROUTE copy's position — so Play dropped them 42 minutes into an unstarted film, and the first save wrote that timecode back under the pinned source's key, making it permanent. The spec asserted the old behaviour, so it is flipped rather than extended; a second case covers the host that supplies no lookup at all, where "never watched" was never established and the position must be left alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): describe the copy the primary button will actually play Two gaps found by review. A pin makes the primary button play a copy the page never loaded a position for — positions are keyed by (playlist, stream). The label, timecode and Restart affordance still came from the route copy's row, so the button could read "Resume 42:18" and start an unwatched copy at zero, or read "Play" and jump into the middle of one already watched. `createPrimaryActionPosition` lets the pinned copy's row govern, including when that row is absent: never watched is an answer, not a fallback to someone else's progress. A manual source switch also mounts a DIFFERENT stream in the same host while marking the new source active at once, so the previous stream's timeupdate was still vouching for it — the caption and the badge claimed the new source while it was still opening. That path now clears the latch like Play and Restart do. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): keep the route's own resume point, and honour a closed pin Two more from review, both variations on "selected is not playing". `vodPlaybackPosition` followed whichever copy last reported — so after an alternative played, Resume and its label described that copy's row while starting the route's stream, jumping it to a timecode nobody reached in it. It now splits: `vodPlaybackPosition` stays the last position seen (the progress bar and the switch handoff want the stream on screen), and `routePlaybackPosition` holds the route copy's own row for everything that acts on the route's stream. `pinnedSourceAwaitingPlay` skipped the pin whenever its row was active, but `isActive` means selected — the pinned row stays selected after its player is closed, so the next Play went to the route copy and ignored the stored preference until the page was reopened. It now takes `playbackLive` too. The host service crossed the 400-line cap on the way, so the four derived alternative counts moved into `vod-multi-source-counts.ts`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): keep the primary button honest across navigation and pins Four follow-ups from review, all consequences of splitting the position signals. - Route reuse (the Similar rail) cleared only `vodPlaybackPosition`, so the button kept the previous movie's Resume label — and start point — until the new lookup landed. Both signals and the playback latch now reset together. - The primary button's fall-through past an unresolvable pin reached the service directly, skipping the bookkeeping a route start needs: the controller kept the alternative's timecode and the old stream's timeupdate still vouched for the new one. It now goes through the route's own wrappers, and Resume seeds the controller with the ROUTE copy's position. - `alternativePlaylistCount` counted the playlist being watched whenever it held a second copy, so "also found in 2 other playlists" could mean one. - The pinned copy's stored row went stale the moment the user watched it; its live position now wins while it is the one playing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): do not spend a source's failover turn on mere selection `setActiveSource` marked the source tried, but discovery calls it the moment the page opens and a pin or the picker can call it before anything plays. So opening a movie burned the route copy's turn: if a pinned alternative then failed, failover skipped a healthy untouched source — and with only one alternative, reported the options exhausted. Selection and attempt are now separate. `setActiveSource` selects; `markPlaying` also spends the turn, and only the three places that really start playback call it. `runFailover` additionally retires whatever is on screen before picking, so the failing source is spent however it got there — relying on the start paths alone would leave one hole per path, and the cost of missing it is a ping-pong between two sources. One existing spec asserted the old behaviour (a route copy burned by a switch it never played); it now plays first, so it still covers what it meant to — that the tried set survives a rediscovery. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(portals): carry VOD source pins through playlist backup The new pins table was invisible to backup: exporting a playlist and re-importing it on a new machine silently dropped every "main source" choice, with nothing in the archive to say the choice had ever been made. Pins now ride along under the playlist they point AT — carrying them anywhere else would restore a preference for a portal the archive never contained. `matchKey` names the film rather than the portal, so it survives untouched and only the playlist id is remapped to the imported copy. `sourcePins` is the one optional collection in the Xtream user state: archives written before multi-source existed simply do not have it, so its absence is age rather than damage. Only a wrong type is rejected, and pins without a usable match key or content id are dropped, since writing one would occupy the unique key of a film it does not describe. Adds `DB_LIST_VOD_SOURCE_PINS` through the usual six seams (operation, worker case, event, preload, bridge contract, service). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(portals): follow the normalized restore state's new collection `normalizeXtreamPendingRestoreState` now always emits `sourcePins`, like every other collection it canonicalizes, so three specs that assert the exact normalized shape had to follow. Adds coverage for the sanitizing itself: a pin without a usable match key or content id is dropped, and a non-string `updatedAt` is discarded rather than carried. Caught by CI, not locally — the earlier full run served `playlist-shared-ui` from the Nx cache, so it reported green on a stale result. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(portals): lift the VOD route's orchestration out of the component The details route had grown to 864 lines — the repository's hard maximum is 400, and while the file predates the rule, a baselined exemption is not a budget to spend. Three component-provided services now hold what the component was accumulating: `VodDetailsMultiSourceUiService` (the playback-evidence latch, the caption, the primary button's position, source actions and the failover toast), `VodDetailsSimilarService` (the rail and its cross-portal lookup), and `VodDetailsDownloadsService`. The component keeps its public API, so the template and the existing specs are untouched. 864 -> 566 lines. The downloads move also fixes a latent bug: `downloadVod` and `playFromLocal` read `route.snapshot.params`, which is stale once the router reuses this component for detail-to-detail navigation (the Similar rail) — so a download started from a film reached that way fetched the previous one. They now read the same route-params signal everything else uses, with a regression test. Also from review: pins are applied on the FRESH-import path too. A new playlist has no content when the archive is read, so its user state is parked and replayed after the import — the merge path I wired first never ran there, and every pin was dropped. A failed pin write now propagates instead of being ignored: the backup entry is reported failed, and the parked state is kept so a transient failure can be retried rather than silently losing the preference. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): read array-shaped codecs, bound short-title scans, honour alias clears Three from review. `info.video`/`info.audio` are declared — and sent by the mock server and many panels — as string arrays, but the resolver only read the ffprobe object shape. Every array response therefore lost the provider's codec, so those source rows showed no codec fact and the "dub may differ" warning could never fire. `readStreamInfo` now accepts both, and states nothing when the provider stated nothing. The FTS-empty fallback scan matched only the FIRST token, which is fine for a one-word short title but not for "I Am": every catalog row containing the word "i" came back for TypeScript to throw away — a full scan of a large catalog on the single database worker, just to open a detail page. Every token must now appear. `writePin` reported success when the canonical write landed but retiring the old alias failed. Lookups read aliases before the canonical key, so reopening the movie before enrichment would start the source the user just replaced, with the icon promising otherwise. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): write a pin and retire its aliases in one transaction Split across two calls, a half-failure had no honest outcome. Reporting success left a surviving alias to win the next lookup and start the source the user had just replaced; reporting failure — which the previous round changed it to — left the canonical row durable while the UI showed a pin that was no longer the stored one. Review was right both times, which is the tell that the two-step shape was the problem. `setVodSourcePin` now takes the keys to retire and does both inside one `db.transaction()`, with the synchronous `.run()` form the better-sqlite3 driver requires there (issue #1137's lesson). `retireKeys` rides through the worker op, the IPC contract, the preload bridge and the service, so there is one call and one outcome. Also corrects the architecture doc: the scan path is reached whenever no token clears the trigram minimum, not only when the whole title is one or two characters — the claim the previous commit's code change had already falsified. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): tell a superseded pinned play from an unusable pin Double-clicking Play while a pinned source resolves put both handlers into `playPinnedSource()`. The second supersedes the first, so the first returned `false` — which the route read as "no usable pin" and answered by starting the route source over the playback the second click had just begun. `playPinnedSource` now reports `played` / `superseded` / `unavailable`, and only `unavailable` falls through. This is the same distinction `runFailover` already draws between "keep going" and "stop, something newer owns the screen"; the pinned path simply never had it. The host crossed the 400-line cap again on the way, so the pinned-play errand (wait out an in-flight discovery, re-check the session, start the source) moved into the pin module beside `playPinned`, and the pin-toggle commit went with it. 388 lines. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): restart honours the pin, and a switch replaces the player Three from review, all in the pinned-playback seam. A pinned copy watched through resolved to its stored seconds, so the button read Play — the label uses the in-progress rule — and then started near the end. Both now go through one `isResumablePosition`, so the label and the start point cannot disagree. Restart sat beside a Resume that honours a foreign pin, but called `playVod` and started the ROUTE copy — silently switching the user's playlist. It now restarts whatever the primary button acts on, falling back to the route source only when there is no usable pin. Switching sources left a running external player alone. With MPV or VLC and instance reuse off the backend spawns a second detached process, so both sources kept playing and Stop owned only the newer one. Also merges master, and puts the five host specs on a shared harness — they each carried the same 31-line TestBed, which is what pushed two of them over the file-size cap as cases were added. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): find short Unicode titles, and stop two pickers racing Five from review. Greptile's P1: a short non-ASCII title was undiscoverable. SQLite's `LOWER()` and GLOB classes are ASCII-only, so "он" never matched a stored "Он" and the source simply never appeared. ASCII tokens keep the word-boundary GLOB; a non-ASCII token falls back to a substring test against both the folded and the as-typed form, which the normalized confirmation afterwards makes safe. A probe now retries the ranged GET for 400 and 403, not just 405/501 — those are what a WAF returns for an unexpected HEAD on a URL it serves happily over GET, and calling that source dead also ranked it below worse ones. Three races, all the same shape as ones fixed earlier in this branch: - a pinned play awaiting its resume lookup did not notice a source picked across it, and finished last, replacing the user's choice; - two overlapping switches both saw the same external session, both awaited its close, and both launched — two detached players again; - the primary button showed the ROUTE copy's Resume while the pinned copy's row was still loading, so a click started somewhere else entirely. Also puts the races spec on the shared host harness, which is what keeps it inside the file-size rule now that it carries two more cases. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): close the player we launched, not the one we now own Three follow-ups, two of them to last round's own fixes. The external-session close was defeated in exactly the case it was written for: `switchToSource` marks the DESTINATION active before handing playback over, so by the time the service ran, the process still playing no longer looked like ours and was left running beside its replacement. The service now remembers the ids it launched with, independently of what is active. The ASCII/Unicode branch was decided from the NORMALIZED token, which folds diacritics — "Ça" arrived as "ca", looked like plain ASCII, and took the GLOB path while the stored title still read "Ça". Decided from the raw token now. Backup restore upserted archived pins but never removed the playlist's existing ones, so a present-but-empty collection left stale preferences alive — unlike the playback positions cleared beside it. An absent collection (an older archive) still means "no opinion" and is left alone. Four files crossed the size cap on the way; the split ones now share `title-sources.spec-data.ts` and `playlist-backup.xtream-fixtures.ts`, and the external-session ownership moved to its own module. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): absent is not empty, and every start claims the generation Four more from review, three of them defects in last round's fixes. The restore normalizer materialized `sourcePins: []` for archives that never had the field, so "absent means no opinion" became "this archive says there are no pins" and a merge cleared the user's. Absent now stays absent. My test for that behaviour had passed for the wrong reason — it stubbed an empty pin list, so the clear was skipped whether or not the guard worked. `startGeneration` was claimed only by the switch path, so a plain Play, Resume or Restart could be overtaken by a switch still awaiting its close. Every start claims it now. Raw and normalized tokens were paired by position, which breaks when normalization drops a whole word: "FR: Ça" normalizes to "ca" and got handed the raw token "FR:", sending it down the ASCII branch it cannot match from. They are paired by normalized form instead. And the ambiguous yearless alias (`title:dune:`) is no longer written or retired beside a precise key — it may hold another remake's pre-enrichment pin. It stays available when it is the only key there is, since refusing to pin at all would be worse. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): a failed close must not leave the page claiming a dead source When `closeSession()` rejected, `startResolvedPlayback` rejected with it and never launched — while `switchToSource` had already marked the destination active and reported the switch as successful. The page then named a source that nothing was playing. The close failure is logged and the replacement starts anyway. A close that rejects usually means the session was already gone, and a possibly-lingering process is the lesser of the two evils: the alternative is a UI that lies about what is on screen. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(portals): split the external-playback handoff out of the service Both the service and its spec crossed the 400-line cap with the close-failure handling, so the handoff — deciding which process is ours, closing it, and surviving a close that rejects — now lives in `vod-details-external-session.ts` with its own spec file. Two tests had to start awaiting: replacing a running external player is a round-trip, and the handoff now yields once even when there is nothing to close, so the new playback is mounted a microtask later than before. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * style(portals): format the extracted external-session module Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): fold diacritics in the title index Cross-playlist matching compares normalized titles ("Amélie" -> "amelie") against an index built from the raw title, and the trigram tokenizer does not fold diacritics by default. Every accented title was therefore invisible to the FTS path: two identical `Amélie` entries produced no candidates at all. That is the broadest of the Unicode gaps review found, and it predates the short-title work. The tokenizer is fixed at CREATE time, so existing databases recreate and rebuild the index once behind a migration marker. `remove_diacritics` needs SQLite 3.45+, so support is probed on a temp table first: an older runtime keeps its working index untouched and the migration is not recorded as done, leaving a later version free to upgrade it. Case folding for non-ASCII remains impossible in stock SQLite — "ОН" cannot find "Он" by any available predicate — and is documented as the known limit rather than patched around again. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): clear a playlist's pins by playlist, not by key list Restoring over a playlist reused the keyed clear, which caps its input at MAX_KEYS_PER_LOOKUP to bound an IN clause. A playlist with more than eight pinned movies therefore kept the surplus while the call still reported success, and the restore then wrote the archive's pins on top — leaving the union of two states, which is neither the one the user asked for. Clearing is now a dedicated delete-by-playlist operation with no key list to truncate, and it refuses a blank playlist id rather than deleting everything. A failure fails the entry instead of being swallowed: `listForPlaylist` returns `[]` on error and `clear` returns `false`, so ignoring the result made a failed read indistinguishable from "there was nothing to clear". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): keep a pin readable under every identity of its film Two defects in the pin/position subsystem, both reported in review. A pin was stored under the movie's most-trusted key alone and its other keys retired. But a movie's identity GROWS: the film keyed `tmdb:438631` today was `title:dune:2021` before enrichment, and reopening it cold asks for the poorer key first. The preference was therefore ignored until enrichment landed — and permanently when enrichment is off or never answers. The decision is now written under every key in `write` (never the yearless form, which every remake shares), one upsert per key plus the leftover retirement in the same transaction. `setVodSourcePin` also reports failure for a pin with no usable key instead of claiming a write it never made. The primary button asked whether the pinned copy's position had loaded by testing presence rather than identity, so re-pinning left it wearing the previous copy's timecode until the new lookup returned. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(portals): record the key-addressing limit a pin write cannot close Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): fold non-ASCII case in the scan, and read years as tags I was wrong about SQLite twice over, and both errors cost matches. GLOB character classes are NOT ASCII-only. `patternCompare` reads them as UTF-8 code points, so `'Он' GLOB '*[Оо][Нн]*'` is true — only `LOWER()` is ASCII-only. The scan tier now folds the case in JavaScript, where Unicode case mapping is real, and hands SQLite one class per character. A short Cyrillic or Greek title stored in a different case is found instead of being silently absent from the Sources chip. The builder returns `null`, leaving the substring tests as the whole answer, for a token holding a GLOB metacharacter (GLOB has no escape character) or a case mapping that changes length. The FTS tier is untouched and still cannot fold — that needs a stored normalized-title column. The movie's own year came from `extractYear`, which reads a year from anywhere in the title. That is right where a year is a search hint, wrong where it is an identity: `2001: A Space Odyssey` was treated as a 2001 film, so every genuine 1968 copy failed the year gate and the movie had no alternatives at all — and its pin key moved the moment enrichment supplied the real year. `releaseTagYear` accepts only bracketed and trailing forms; the repo's own TRAILING_YEAR_PATTERN already documented this exact hazard. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): cover a letter spelled two ways in lower case Greek Σ lowercases to σ, but a word-final sigma is written ς and is equally a lowercase of it, so a class built only from the character in hand knew one spelling of two. Each class now also carries the uppercase form's own lowercase, which reaches the other one. One-way on purpose: σ → Σ → σ never arrives at ς. Left so because ς is only correct at the end of a word, which is exactly where the request's last character sits — the pair that occurs in real titles is covered, and closing the other direction needs a fold table. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): let an exact title keep a number that is part of its name Both match tiers weighed the same year, taken from a trailing four-digit tail or a bracketed tag. On the exact tier that rejects the very copy it was meant to confirm: reaching it means both titles are the SAME string, so the trailing digits belong to both, and comparing them against a release year out of metadata makes "Blade Runner 2049" disagree with its own stated 2017 — the genuine alternative disappears at the moment enrichment lands, which is when the user has most reason to expect it. The exact tier now reads the bracketed form only. Brackets are never part of a name, so "Dune (1984)" is still rejected against 2021. The base tier is unchanged: it has just stripped a trailing year, and that year is the only thing separating "Dune 1984" from "Dune 2021". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(database): verify the title index folds, rather than trust the marker `createTables` declares content_title_fts with the plain trigram tokenizer, and the diacritics migration declares it again with folding. Two sources of truth for one tokenizer: if the table ever went missing after the marker was written, `CREATE TABLE IF NOT EXISTS` would restore the unfolded form and the migration would skip it on the marker alone. The upgrade now reads the live table's own DDL from sqlite_master and rebuilds unless it really folds. A degraded index is invisible from the outside — discovery just stops finding "Pokémon" for "pokemon" — so the record has to be checked against the thing it describes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): give the route's own row the facts the page already has Two provenance defects found in review. The current-source row is never resolved — nothing needs to fetch a URL for the stream already playing — so it carried no provider metadata at all, while every alternative got its facts from the resolve preceding playback. `audioDiffersFactually` requires a fact on BOTH sides, so the "dub may differ" warning was structurally unreachable on the commonest switch there is: route to alternative. It could only ever fire between two alternatives that had both been resolved. The row now carries what `get_vod_info` already told the page, via a `providerVodMetadataOf` mapper shared with the resolver so the two cannot describe one movie differently. Quality bucketed every width from 900 to 1199 as 576p, so a 960x540 stream — an ordinary 540p encode — was published as "576p" with `api` provenance: a measurement its own pixels contradict, from the one field that is supposed to mean the provider said so. That range holds two standard formats, so it is matched now rather than bucketed, exactly as the sub-HD sizes already were. A width matching no known format yields no tag and a check chip, which is the honest answer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): let the height veto a width-derived quality, and refresh route facts Both of these are gaps I saw and chose not to close last round; a reviewer was right that neither survives its own reasoning. The shape check only ran below 1200, so the HD ranges kept publishing wrong-but-confident labels: 1440x1080 is anamorphic 1080 and 1600x900 is 900p, and both were "720p" with `api` provenance — the provenance that means the provider said so. Ranges are fine up there, the standard widths really are far apart, but only once a known height can veto the answer. Same rule the matched formats already used: a shorter frame is a letterboxed master, a taller one is a different shape and gets no tag. And the route row picked up provider facts only when discovery reran. On a sparse panel `get_vod_info` can answer with no year and no TMDB id, so the movie key is unchanged, nothing reruns, and the row keeps stating nothing — leaving `audioDiffersFactually` one-sided and the dub warning unreachable on exactly the switch it exists for. It now takes those facts on without rediscovering, merged onto the existing row so a probe result already sitting there survives. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): a codec is not a dub, and two waits needed a switch guard Three findings from review. The "dub may differ" warning compared audio CODECS. AAC and AC3 routinely carry the same dub, and two AC3 tracks can carry different ones, so it fired on every identical-language re-encode and stayed silent on the dub changes it exists for — wrong in both directions, which is worse than absent, because a warning people learn to ignore is not a warning. Worse, the previous commit made it reach the common route-to-alternative switch for the first time, so the false claim was about to get louder. It now reads a new `audioLanguage`, taken from the track's language tag and never from the codec. `audio` stays as a display fact. Few panels tag a language, so the warning is usually silent — the same answer the rest of this feature gives when it does not know. `failover()` validated only the session across its wait for a discovery in flight. The session moves when the FILM does, so a source the user picked — or the route stream they restarted — during that wait was then treated as the thing that failed and switched away from. It claims and rechecks a switch generation, as the pinned path already did. And the scan's ASCII branch could not find "Ça" from a folded "ca", while the non-ASCII branch found "Ca" from "Ça" — so whether two playlists could see each other depended on which one was open. Each ASCII letter now carries its accented forms, derived by decomposition rather than tabulated, so it cannot drift from the normalizer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(portals): pin what the declared audio shape can and cannot say The array shape the mock server and many panels send carries a codec and no language, so the dub warning is silent for every source arriving that way. Asserted rather than assumed, alongside the ffprobe shapes that do carry one — otherwise a later reader sees an unused field and wires the codec back into the warning. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): a failed pin read must not export as "no pins" Three findings, all in code from this session. Backup called the lenient `listForPlaylist`, which turns a failed read into `[]`. Since `e0ebbeaf` made restore treat `sourcePins` as authoritative — clearing the playlist's pins before applying it — an export whose read failed produced a file that looks complete and wipes every pin on restore. Losing them is bad; losing them through the one feature meant to protect them is worse. Backup now uses a strict listing that throws, so the export fails instead. The diacritic map stopped at U+024F, which is tidy and leaves Vietnamese out: `ố` is U+1ED1, the normalizer folds it to `o`, and the scan filtered those rows out before confirmation. Latin Extended Additional is included now; the filter decides what belongs, so the range only has to be wide. And two panels spelling one language differently (`eng` vs `en`, or `en-US`) raised a dub warning between identical tracks. Tags are canonicalized before comparison — 639-2 collapses to 639-1, both German forms meet at `de`, regions drop, and `und` becomes nothing. Anything that survives longer than three characters is not a language code, so the comparison is declined rather than guessed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop two backup paths from deleting pins they never read Two data-loss paths, both P1, both mine. A web export wrote `sourcePins: []`. Pins are Electron-only, so out there we cannot read them — which is not the same as knowing there are none, and restore treats the collection as authoritative. A backup made in the browser was therefore an instruction to delete every pin the moment it was imported on the desktop. There are three answers here, not two: pins exist, there are none, and "could not look". The last omits the field, exactly as an archive written before pins existed does. The same rule now covers Electron with the bridge method missing. I had written a test asserting the unreachable-store case resolves to an empty list "because a backup made there is complete". That reasoning was wrong: empty was true of what the runtime could see, never of the playlist. Restore also cleared the playlist's pins and then wrote the archive's one by one. A write failing partway left the previous pins already gone and only a prefix applied — a state belonging to neither, reported as a failure the user could not undo. `DB_REPLACE_VOD_SOURCE_PINS` does the clear and every write in one transaction, so the playlist ends up as the archive describes it or exactly as it was. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-07-29 21:53:42 +02:00
4grayandClaude Fable 5	59c15493a7	docs: sync CLAUDE.md, AGENTS.md and architecture docs with actual code ... Full audit of CLAUDE.md, AGENTS.md, README.md and docs/architecture/ against the codebase; every fix is backed by current code: - remove documented-but-unimplemented IPTVNATOR_DISABLE_HARDWARE_ACCELERATION flag (no reads anywhere in apps/, libs/, tools/) - CLAUDE.md: add epg_channel_mappings to the schema table list - m3u-playlist-module: *-tab dirs -> *-view (+recent-view), selectActivePlaylist, real PlaylistState shape, ChannelEpgMetadata instead of removed EnrichedChannel, actual /workspace/playlists routes, per-view outputs, live-epg-panel-state key - workspace-dashboard: per-rail Settings.dashboardRails toggles, three missing rails in the diagram, split live-favorites/recent-live rails, welcome-dashboard empty-state type, RECENTLY_WATCHED_LIVE_TV title key - stalker-portal: CategoryContentViewComponent for vod/series, collection-route components for favorites/recent, corrected series-view/favorites-button paths, actor/:personId route, epg panel selectors - category-management: reloadCategories lives in with-content.feature.ts, workspace-context-panel owns the dialog, XtreamPendingRestoreService flow - stalker-mock-server (+app README): scenario-seeded faker, resetAll() clears content cache too, ordinal season episode ids, handlers/ dir location - sqlite-db-worker: cancellation shipped (drop from out-of-scope), full operations module list - portal-detail-navigation: replace three removed component paths - tmdb-metadata-enrichment: details cache keys are id:<tmdbId>|v2 - electron-security: CSP frame-src youtube-nocookie exception, sandbox: !frameCopyExperiment nuance - download-manager: libs/portal/xtream instead of xtream-electron folder, data-driven downloads nav, drop removed app-search-result-item note - playlist-backup-restore: settings-backup facade owns the import handoff - workspace-shell: functional workspaceEntryRedirect, playlists route children - iptvnator-ui-guidelines: EPG card radius 11px, detail-view mixin is `base` - embedded-mpv-native, player-controls-contract: minor precision fixes Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-24 08:16:33 +02:00
4grayandClaude Fable 5	1c710d69ef	chore(cleanup): delete nine dead components, orphaned i18n keys and unused deps (#1116) ... * chore(cleanup): delete nine dead components, orphaned i18n keys and unused deps Removes verified-dead components (0 class/selector references outside their own files): EpgListComponent (+ epg-list-item), EpgViewComponent, LiveEpgPanelComponent, StalkerCollectionChannelsListComponent, NavigationComponent, FilterSortMenuComponent, video-player ToolbarComponent, PortalCollectionShellComponent and LoadingOverlayComponent, together with their barrel exports. Alive code extracted from the deleted trees: - LiveEpgPanelSummary -> libs/ui/shared-portals/src/lib/live-epg-panel-summary.ts - EpgProgramActivationEvent -> libs/ui/epg/src/lib/epg-program-activation-event.ts - epg-list.utils.ts trimmed to the three timeline-used helpers and moved to libs/ui/epg/src/lib/epg-program.utils.ts - epg-item-description/ moved up out of the deleted epg-list/ folder Also removes 18 i18n keys now unused (from all 18 locales), dead CSS selectors targeting the deleted elements, and unused dependencies: lodash (+ @types/lodash), semver, @ngrx/component-store and @videojs/http-streaming (videojs-quality-selector-hls declares no peer dependency on it; video.js 8 bundles VHS). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(coverage): move shared-portals to Tier C, fix stale doc references The Tier A gate failed in CI because deleting the dead epg-view and live-epg-panel components removed the only specs in libs/ui/shared-portals. The lib now contains a single type-only interface (LiveEpgPanelSummary), so there is no runtime code to unit test; reclassify it to Tier C with a documented reason, matching the gate's own guidance. Also update remaining doc references to the deleted components in docs/architecture/stalker-epg.md, iptvnator-ui-guidelines.md and CLAUDE.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 11:09:50 +02:00
4gray	2edc430935	feat(xtream): add live all-items grid	2026-06-20 09:36:34 +02:00
4gray	6ad5f5e207	fix(xtream): address live recents review feedback	2026-06-19 20:50:14 +02:00
4gray	210f0ebabc	feat(xtream): show recently added live channels	2026-06-19 19:59:42 +02:00
4gray	5e5a89a300	refactor(ui): remove dead portal code and share detail styles (#946)	2026-05-16 00:09:29 +02:00
4gray	ab905af285	feat(stalker): add radio support ... Entire-Checkpoint: f957cd9849e0	2026-05-09 01:28:39 +02:00
4gray	e36c953865	feat(sidebar): implement shared collapse state for live-TV sidebar across components ... Entire-Checkpoint: f957cd9849e0	2026-05-03 23:26:52 +02:00
4gray	15b6ba985a	feat(live-tv): collapsible sidebar in live tv views ... Entire-Checkpoint: f957cd9849e0	2026-05-02 23:53:05 +02:00
4gray	0babd92304	feat: add live epg panel to collections ... Entire-Checkpoint: c2cea9c530e6	2026-04-29 01:23:42 +02:00
4gray	31258624b5	feat: unify live epg toolbar ... Entire-Checkpoint: 978eaff2e478	2026-04-29 00:20:34 +02:00
4gray	51347fc226	feat: add collapsible live epg panel ... Entire-Checkpoint: 0518c49b948d	2026-04-28 19:56:41 +02:00
4gray	d366672506	docs: refactor and document architecture for Stalker and Workspace components ... - Moved Stalker-related components and services from apps/web to libs/portal for better modularity. - Introduced SQLite DB Worker to handle non-EPG database operations, improving UI responsiveness. - Updated documentation for the Workspace Dashboard and Shell, detailing current implementation and routing structure. - Added new EPG fixture scenarios to the Xtream mock server for testing purposes. - Enhanced the overall architecture documentation to reflect recent changes and improvements.	2026-04-05 19:05:07 +02:00