allstarr/agent_docs/latest_session_work.md

Latest Session Work

Active execution — 2026-08-19

• Completed the rich-dashboard package through Phase 5 in four reviewed commits plus the current verified slice: Signal Boot/shared geometry, unified Integrations, Intelligence/imports, Home/Activity, and Mappings/Cached/Kept.

• Matching now searches title+artist, title+album, title, artist, and album concurrently, deduplicates provider identities, and ranks the union through the existing decision engine. Crush by Selena Gomez & The Scene is the regression fixture.

• Matcher normalized-v13 keeps weak-artist results unresolved. The mapping UI exposes every credible candidate and its complete IDs, raw confidence, component scores, reasons, warnings, and route; accepted/rejected rows leave active queues while History retains decisions.

• Cached/Kept now distinguish indexed, referenced, and diagnostic files; expose access, expiry, quality, and reference facts; and only offer destructive/promote actions for unreferenced indexed ownership. Unknown files remain visible but untouched.

• Home now includes indexed cache/kept totals and a completed-listen seven-day comparison from existing durable owners.

• Current Phase 5 verification: focused .NET matching/storage lane 99/99, WebUI unit 46/46, Svelte check zero diagnostics, production build and budget pass at 46.2 KiB initial JavaScript and 22.7 KiB CSS, Impeccable detector empty, focused browser 4/4, full browser 92/92, and git diff --check clean.

• Completed Phase 6 locally. The shared lyrics resolver now translates any supported source URL through Odesli for each distinct configured fallback, so Deezer/Qobuz/etc. can try Spotify and Apple identities before metadata-based LRCLib without downloading audio. The duplicate Jellyfin-only Odesli path was deleted.

• Subsonic external artist details now use the same typed provider gateway as Jellyfin, restoring extension-backed album traversal instead of bypassing extensions through the legacy metadata service.

• Phase 6 verification passes 91/91 provider/CTS/extension/stream/lyrics checks and 208/208 protocol route, object-shape, relationship, playback, and lyrics checks. The new Deezer fixture proves Spotify miss → Apple synced lyrics success; the new Subsonic fixture proves an Amazon extension artist returns its typed album relationship.

• Established a truthful baseline: 2,354 discovered .NET tests; main PostgreSQL lane 2,282/2,282; state transfer 90/90; WebUI check/unit/build/budget and 130-case original browser matrix; Apple 19/19; all Compose profiles valid.

• Added machine-readable Playwright timings and a 600-second configurable timing-wrapper watchdog. The self-test and a live one-case timing proof pass.

• Deleted the complete retired SquidWTF slice plus its endpoint discovery/racing helpers and direct tests. Focused deletion coverage passes 94/94 and the application/test projects compile cleanly.

• Removed false provider tests, merged duplicate Jellyfin DTO assertions, and reduced repeated E2E viewport work while preserving explicit responsive and interaction coverage.

• Removed the hand-built playlist glass CSS/hooks.

• Added official shadcn-svelte shared controls and migrated dashboard checkboxes, progress, skeletons, all 56 status pills, and normal dashboard actions to shared accessible components. Deleted the superseded global CSS and removed unused generated Card, Table, Tabs, and ScrollArea source instead of carrying it as dead code. A measured Bits Tabs attempt was reverted because it added 7.8 KiB initial gzip without useful deletion.

• Consolidated six relative-time formatters, the duplicate humanizer, provider lookup/labels, eight refresh timers, and shared surface gutters. Replaced a Spotify Pathfinder source-text test with emitted HTTP-query assertions.

• Deleted the six source-reading protocol-gateway tests after observable replacement lanes passed 116/116, plus six low-value operational source assertions with real behavior coverage elsewhere. Deleted the one-implementation IAudioContentStream and IListeningProfileService abstractions while retaining real protocol/provider/test seams.

• WebUI check is clean with zero diagnostics, unit tests pass 45/45, build/budgets pass, and the complete browser matrix passes 84/84. Initial JavaScript is 45.5 KiB gzip, CSS is 21.6 KiB gzip, and app.css is 6,874 lines. The focused PostgreSQL intelligence lane passes 15/15 against OrbStack.

• Canvas UI remains blocked from vendoring: the reviewed commit and the current upstream license rechecked on 2026-08-17 use MIT plus Commons Clause, whose redistribution restriction is not established as GPL-3.0-compatible. No Canvas UI source was copied.

• Consolidated Sources and playlist detail onto the shared Bits dialog geometry; all modal focus/portal behavior remains library-owned and the Svelte check remains clean.

• Made generic download-only extensions use the existing typed download-backed streaming adapter, so readiness and CTS treat them as playable providers while explicit streaming hooks retain their own adapter.

• Added managed track-cache publication for completed full provider streams in Cache mode and moved the related settings beside Cached content; interrupted and partial responses do not publish. The focused cache/path/archive lane passes 12/12.

• Fixed provider-agnostic track URL translation at one shared Odesli owner, including Qobuz's /track/ route and SpotiFLAC aliases. Deezer-to-LRCLib metadata fallback and external artist primary/appearance relationships have focused passing coverage.

• Replaced the Spotify playlist-filter source assertion with an emitted Pathfinder request assertion and removed stale references to the deleted protocol-gateway contract; the focused support/catalog lane passes 18/18.

• Finished the shared Button pass for retries, pagination, destructive list actions, recommendation actions, and routing controls, then removed their duplicate CSS plus dead Accounts/extension-handoff/maintenance selectors. A measured eager RouteError Button attempt was reverted because it increased initial JavaScript from 45.5 KiB to 59.5 KiB.

• Deleted the unreachable SafeJsonProxyClient stack, its five DI registrations, and three tests that could not represent a production route. The real outbound-request guard remains; the focused safety lane passes 27/27 and the rebuilt final .NET fast lane passes 2,205/2,205.

• Final local gates pass: .NET fast 2,205/2,205, release-critical 100/100, WebUI check 0 diagnostics, unit 45/45, build and budgets, browser 84/84, Apple gateway 19/19, all three Compose profiles, dotnet format, shell syntax, and git diff --check.

• Current measured WebUI output is 45.5 KiB initial JavaScript and 21.2 KiB CSS. app.css is 6,683 lines, down from 7,124. The exact staged revision is net -3,297 production lines, -2,082 test lines, +78 WebUI lines, +168 tooling/CI lines, and +173 durable documentation lines: 2,393 additions versus 7,353 deletions overall (net -4,960). No Canvas UI or generated migration/model source is vendored.

• Committed, pushed, and source-deployed 73ce04a18b0daa35f0af56f9f3072cbd575815e8 to the clean .116 stack. All five containers are healthy; readiness and Jellyfin ping return 200.

• The first authenticated LAN Jellyfin smoke completed 189 checks with 14 failures and 6 explicit blocks. Native list/detail/search, artist/album detail, playback bitrate, similar/mix items, playlist DTOs, 64 KiB stream bytes, concurrency, cancellation, external provider matrices, artwork, and Apple extension lyrics passed. The in-app browser itself crashed on both LAN and public URLs, so responsive live visual smoke remains blocked by the browser tool rather than server readiness.

• Traced the four Apple GAMDL artist 502s to three over-limit artist-credit rows poisoning otherwise valid 100-item pages. The shared typed adapter now drops only invalid provider rows, and the external instant-mix failure path uses the standard Jellyfin envelope. The harness compares music-constrained filters against the same direct query and treats identical native 404s as unavailable parity instead of demanding a route Jellyfin itself does not serve.

• Fixed native root, HEAD, linked-alias, and paged-playlist parity in 58c9e285d81982fef93bf0d4a82fcc5758c4ffca and 2428223fed6affd2e7cbf9a6cd7184bc48263fcd; both were pushed and the latter is deployed on .116 with all five services healthy.

• Final local gates pass: focused protocol 148/148, PostgreSQL fast 2,210/2,210 in 77 seconds, format, shell syntax, and diff checks. The authenticated read-only LAN smoke passes 201/201 with four declared fixture/stateful blocks. Repeated direct requests proved Jellyfin's root ChildCount is volatile, while every stable root field remains exact.

• Hardened throwaway-playlist cleanup by recording the returned ID before eventual-consistency checks. After explicit approval, the live mutation exposed a second harness defect: the joshp token selected saibalp because that user had the largest library, then created a private playlist that the token could not rename or delete. The test stopped with one exact recorded throwaway playlist under saibalp; one later exact delete retry returned 404. A final admin-key read-only scan across every Jellyfin user now finds zero playlists with the harness's exact Allstarr smoke prefix, so the orphan no longer exists and no additional delete was issued.

• The harness now selects /Users/Me for user-bound credentials and refuses playlist writes unless Allstarr confirms the same actor. A corrected read-only run proves actor_bound=1 and passes 201/201 with four declared fixture/stateful blocks; the prior Finer File mismatch also disappears with the correct actor.

• Deleted legacy Deezer enrichment from native Subsonic artist/album detail paths so native objects relay exactly. The dedicated live comparison passes 67/67; artist detail improved from about 2.1 seconds to 28.6 ms and album detail from about 227 ms to 21.9 ms. Revision d54109c5817e899a6d5666b38e6e3b5cc4264d92 is deployed on both clean .116 stacks.

• Added the dependency-free live Jellyfin WebSocket qualification script. Direct Jellyfin and Allstarr both pass header authentication, ping/pong, ForceKeepAlive/SessionsStart/Sessions flow, and invalid-token rejection: 5/5. Deliberately denied remote control remains closed.

• Removed Jellyfin search's duplicated recursive JSON converter and stale rebuild marker in favor of System.Text.Json at 63c5b0d; 13 focused search/artist protocol checks and format verification pass, deleting 67 net lines.

• Completed the route and large-owner evidence review. The Impeccable detector reports zero findings. Two fresh in-app-browser LAN attempts still time out, so live visual verification remains tool-blocked; no alternate browser-control framework was added.

• Reclassified four measured PostgreSQL safety contracts into the mandatory release-critical lane instead of weakening or deleting them. At 61d97d4, the fast lane passes 2,208/2,208 in 66.1 seconds with no individual test above three seconds; release-critical passes 104/104 in 121.8 seconds and retains the measured migration, rollback, lineage, state-transfer, backup/restore, corruption, credential-migration, clone-pool, portable-import, and 10,000-track contracts.

• Replaced the deprecated lucide-svelte package with official @lucide/svelte, patched SvelteKit to 2.70.2, and pinned Nano ID to 3.3.18 in 0d635b0. On that exact WebUI revision, check reports zero diagnostics, unit passes 45/45, build/budgets pass at 45.3 KiB initial JavaScript and 21.2 KiB CSS, the Impeccable detector is empty, and Playwright passes 84/84 without retries. Npm reports no moderate/high/critical advisory; one upstream low-severity cookie advisory remains through current SvelteKit and was not forced across its declared range.

• Final lightweight qualification at 0d635b0 passes release-manifest tests 2/2, deterministic Subsonic smoke tests 5/5, and shell syntax. The backend/release matrix remains valid at its direct parent because the final child changes only WebUI package metadata and import paths.

• Rechecked live browser access after the external network block was removed. Both LAN and public Allstarr roots return HTTP 200 in about 11 ms and 97 ms, but the in-app browser still times out and resets on each URL. The responsive live visual gate is therefore browser-tool blocked, not server blocked; no Computer Use fallback was used.

• Pushed exact revision 0d635b04dd7af26da6def5219f484f370656a795 to origin/dev. CI run 1237 exposed two browser failures after every earlier WebUI gate passed. The two-file fix at 01c410597817e3e016937873fecd3e041cde64c3 closes a portaled rejection confirmation before cross-route navigation and adds explicit shrink/wrap constraints to AudioMuse results. Check, build, budgets, the Impeccable detector, 40 repeated focused browser cases, and the full 84-case matrix pass locally. The same run's isolated release-critical lane failed without a public test annotation; its exact 104-test command passes 104/104 in 2 minutes 17 seconds both on macOS and in a disposable Linux ARM64 container matching CI's .NET 10.0.301 and PostgreSQL 18 tooling, so the unreproduced runner failure did not justify weakening a safety contract.

• CI run 1238 reproduced both browser failures. Trace-level evidence showed the cache action outside its clipped desktop grid and overlapping sibling modal locks in the match rejection flow. Revision b5936d996dbb148eace76bd0352eb47e1941fe64 fixes the shared dialog layering/scroll ownership, removes a dead download breakpoint, and makes the desktop grid fit before the card breakpoint. The focused cases pass 20/20 repeated runs; Svelte check, unit 45/45, build, budgets, and the complete browser matrix 84/84 pass.

• The release-critical CI failure is now exact and closed: a disposable Linux x64 container matching .NET 10.0.301 failed 103/104 because pg_dump was absent. The release-critical job now installs the same PostgreSQL 18 client as the main lane, and the exact x64 lane passes 104/104 in 2 minutes 10 seconds.

• Preserved the configured Apple playback quality and moved cold GAMDL preparation behind an immediate streaming response. The focused Apple adapter lane passes 13/13 and the Apple gateway passes 20/20.

• Closed the Linux-only mobile overflow at the route boundary. Svelte check has zero diagnostics, unit tests pass 46/46, build/budgets pass at 45.3 KiB initial JavaScript and 21.3 KiB CSS, and Playwright passes 84/84. CI run 32060322801 is fully green, including release-critical and release-manifest.

• Pushed and deployed exact revision 07bc3c45124beebbe28b9b7131988fd75883e15c to both clean .116 checkouts. CI run 32064966557 is fully green and all main and Subsonic services are healthy. The in-app browser opens the deployed Intelligence and Sources routes, and Apple Music – GAMDL reports four healthy capabilities plus a logged-in gateway.

• A live configured CD-quality Apple stream returned FLAC headers in 0.7 ms, completed 35.9 MB in 5.87 seconds, and cleaned its temporary artifact. The exact-revision server-key Jellyfin run passes 150/152 checks; its only failures are the configured-library root checks returning upstream 404 because the server key has no user actor able to access that user-scoped root. The route now preserves UserId exactly, while native objects, search, artwork, streams, cancellation, external routes, and denials pass. The actor-bound run remains 201/201.

• The in-app Browser viewport capability completed the previously blocked live responsive gate: 36/36 checks pass at 320px, 390px, tablet, and desktop across nine primary routes, with no horizontal overflow, route errors, or console errors. Three representative live layouts were visually inspected and the temporary viewport override was reset.

Next entry point

Keep Canvas UI effects queued until a GPL-compatible grant exists. The current revision is already pushed, fully green, deployed, live-responsive across mobile, tablet, and desktop, and free of the prior throwaway playlist.