Use this guide when changing shared queries, caches, scheduling, rendering or lifecycle ownership. Preserve required behavior and the approved UI; choose the smallest evidenced change in the owner already responsible for the work. Audit reports are evidence at recorded source/data epochs, not production guarantees.
The 22 October implementation and regression register records the queue/finalization fixes, read cancellation, action eligibility, status-only projection, image teardown and companion resource budgets. It includes real-data acceptance, rejected task-history work and exact remaining test requirements; use it before the older open-item counts.
The 21 October stable dependency pass updates the independent stable packages while retaining Bun canary and the reviewed navigation owner. Actual catalogue hashes and original comic-page bytes are verified; the separate Kit 3 migration records its native API changes, maintained runtime origin/navigation patches, drift checks and actual-data acceptance.
- Current evidence — 21 October 2026
- Acceptance and measurement
- Shared-owner map
- Query scope, projection and exact reuse
- Resources, navigation and bounded presentation
- Commands, provider jobs and persistence
- Permissions and concurrency
- Verification and runtime diagnosis
- Audit maintenance and deferred work
The physical reader rendering pass reduces redundant draws, geometry work and shadow regeneration while preserving actual comic raster bytes and visible geometry. Optional textures use a 192 MiB target with active faces pinned; decoded dimensions and current demand are checked before speculative uploads. Pixel, shadow and model equivalence, texture races and software-renderer measurements are recorded with hardware/mobile and memory limits.
The 21 October live-freeze investigation separates guest memory exhaustion, host-level recovery and the still-old deployed build. Its further actual-data research selects upstream Bun SQL fixes over the earlier unprepared/codec workaround. The tested official 1.4.4 canary retains native JSON and prepared queries, reduces repeated-batch backend allocation about 92%, and verifies a 1,024-statement cap on all ten pool sessions. Timing tradeoffs, ARM64-only coverage, prerelease status and full current-main acceptance are explicit. The user subsequently selected Bun 1.4.4: source adoption pins the official 6bb5dc195 canary image across Docker and CI, separately from the newer 963452075 research artifact. Pool/codec settings stay unchanged; the running installation has not been redeployed. The dependency inventory records stable/preview options without adopting them.
The 20 October task follow-up adds shared dependency selection, bounded admin controls and recovery/presentation fixes. Its exact-backlog timing, actual Jellyfin/Seerr acceptance and remaining unverified methods are recorded separately; it is not a live rollout.
The subsequent shared server-delivery implementation moves remote comic acquisition, extraction and dimension indexing into one temporary server cache for personal and party sessions. Its linked receipt separates real-file equality, authenticated actual-copy checks, normal-dev browser acceptance and supplemental boundary fixtures. Cold layout still waits for a complete verified manifest. This does not claim universal startup improvement or a browser/GPU memory plateau.
The later focused books/comics audit records 862 app passes, 717 guarded skips, zero failures and 123 lab passes, plus type/build/style/inventory gates. It adds direct shared Read, actual Jellyfin HEAD delivery, dimension-only raster inspection and construction-owned Three.js cleanup. Five actual comics verify complete raster/location preservation under the approved unprinted-face policy; 24 actual-copy cases and a signed-in desktop/mobile journey pass. Native batching was rejected after adverse entry results. Remaining large-file/resume/CORS/device checks are explicit in its follow-up table. These results do not complete the remaining app-wide audit.
The earlier app-wide closeout gates recorded 844 unit passes, 716 guarded skips and zero failures, alongside type/build/inventory/style checks. Guarded skips are not actual-data acceptance; native actual-data tests and normal signed-in browser journeys are recorded separately. Start with the app audit, next investigation checklist, implementation ledger and maintenance protocol.
The latest Activity repair compares the current audit branch before this Activity repair with the policy-key version, not the untouched original commit. Four alternating pairs preserve complete native outputs: all-media median 9.195→0.934s; normal For You screen Activity 9.404→0.654s. Direct item, artist, explicit-ID and populated-show outputs also match; populated show median 351.614→337.415ms has two cards but one event. The empty relationship scope is adverse, 208.362→224.723ms. Its 22-case native permission matrix, maintained admission oracle and signed-in browser navigation have separate receipts. The extra 4,997kB two-batch hash and 422 temporary blocks read/written are disclosed below.
Activity is one social shelf, not the whole For You page or the Profile journal. Earlier original-versus-pre-policy attribution is distinct: all-media median 9.960→8.431s and screen 8.644→10.309s. Tasks source and native SQL/parameters are unchanged; a 32-call matched comparison gives original/current medians 56.875/45.143ms with identical outputs, so no Tasks query/index change is adopted. The original application comparison, subsequent attribution and every adverse result remain available. None establishes universal speedup, production p95, live-provider latency or a browser memory plateau.
An optimisation is complete only when it reduces evidenced work or fixes a demonstrated resource/lifecycle defect, preserves required behaviour, and uses the shared implementation that owns that work. A smaller diff or a faster isolated query alone is insufficient.
| Gate | Required evidence |
|---|---|
| Work and scale | Identify the input that grows (titles, users, pages, events, concurrent viewers), the work per request and the bound. Measure at multiple input sizes where scale is the finding. Count queries, rows, bytes, requests or writes as well as time. |
| Correctness | Compare complete identities, order, counts and state, including privacy, availability, enabled media, account generations and retry semantics. Do not optimise by omitting authorised results or weakening checks. |
| Demand | Opening a route/panel activates only necessary resources. Offscreen work follows the existing Shelf/row policy; hidden or closed renderers stop optional work. Essential playback/party/heartbeat work has an explicit owner and cadence. |
| Lifetime | Test open → use → replace/close → reopen and cancelled/superseded work. Timers, observers, listeners, workers, object URLs, pending requests and sessions have bounded lifetimes. After repeated cycles, retained state reaches a justified plateau rather than growing per cycle. |
| Concurrency and failure | Exercise relevant concurrent users/lanes, slow/failed/aborted requests, retries and permission/account changes. Check no duplicate delivery, stale publication, starvation, unbounded queues or pool/lock deadlock. |
| Resources | Separate process CPU/heap/external memory from PostgreSQL, filesystem cache and container limits. Include idle and active observations. A lower wall time that causes disproportionate CPU, memory, network or write amplification is a tradeoff to report, not an automatic win. |
| Integration | Fix the common owner so every consumer benefits. Keep feature adapters thin; do not add a private scheduler, cache, loader or alternate renderer to mask a shared problem. Preserve the approved UI. |
| Verification | Reproduce the issue, verify the smallest fix against the same workload, run focused regressions and the relevant integration/build gates. Runtime behavior tests take precedence over source-string assertions. Route fixtures must supply genuine Request objects and signals; do not weaken runtime cancellation for an incomplete fixture. Raw database assertions must preserve the native driver value representation while independently verifying complete logical membership/order. Report untested cases and synthetic/live boundaries. |
For each finding retain its ID, affected shared owner/consumers, severity, confidence, reproduction, baseline commit/runtime/dataset, raw observations, proposed cost/bound, smallest fix, correctness checks and before/after results. A hypothesis or unmeasured opportunity is not a confirmed defect. Deduplicate findings by root cause and keep all affected consumer references.
Use stable workloads with an untimed warm-up and alternating/repeated before/after samples. Label cold/warm cache, foreground/background load, concurrency and measurement boundaries. Report median plus samples/spread; small-sample p95 is descriptive, not production tail latency. Build size is not page transfer size: check actual entry imports and demand-loaded modules. Avoid averaging away failed operations, hiding provider errors or loosening assertions to make a timing threshold pass.
Measure one resource-intensive workload at a time. Prefer structural budgets and meaningful operation-count assertions over machine-dependent millisecond limits. Use disposable databases/files/providers; restore test services to their initial state and remove task-owned resources. Real-server tests, migrations, deployment and new production dependencies need the applicable user authorization. Never publish credentials, raw private payloads or diagnostic URLs as evidence.
Database caches belong in the lifetime budget. A small JS heap does not bound PostgreSQL private memory or its retained plans. Compare prepared-statement count with distinct SQL-text count, backend memory-context totals, private/PSS memory and whole-guest anonymous/file memory. Do not sum backend RSS as private memory: PostgreSQL processes also map shared buffers. Varied-length IN parameter lists need comparison with a stable typed ANY array using the same complete actual membership/order. A prepared/unprepared comparison must preserve native JSON objects/scalars/nulls, arrays, dates, transactions and reserved advisory leases; the pool-wide prepare: false switch alone failed actual JSON acceptance on deployed Bun 1.4.3. Do not reinstate idle/maximum connection expiry without proving that active reservations retain their locks. Application shutdown deadlines require a schedulable guest; they do not establish host VM recovery under kernel memory starvation.
Document the existing bound in the owning module and test it at the boundary: current catalogue pages hydrate 60 cards, Shelf social enrichment runs at most two 60-ID requests, visible artwork is sequenced per rail, a chart preview retains one renderer, native text readers retain one view, physical readers use the bounded working set described below, and imports yield after five committed boundaries or ten seconds at a safe boundary. These are separate budgets, not permission to add them as competing page-wide queues. Inputs exceeding a cap must produce the existing bounded pagination, backpressure or explicit error—not silent truncation.
User-visible operations should not wait on avoidable background work. No provider request or slow external callback should hold a database transaction or lock unless a documented correctness requirement makes it unavoidable. Cancellation must propagate through owned work and cleanup; abandoning a promise is not cancellation. Permission and generation checks remain authoritative across caches and single-flight results.
For actual-data acceptance, follow the current native-copy guards and evidence protocol. Ordinary unit/fixture results stay supplementary.
Use the existing authored harness for reproducible Collection query and revision regressions:
export TEST_DATABASE_URL='postgresql://postgres:password@localhost:5432/postgres'
export COAST_PERFORMANCE_BASELINE_REF='c771fb92f46ccbc173994b39b6885a96bf6a6dec'
bun scripts/performance-verification.ts /tmp/coast-performance-verification.jsonThe account must be allowed to create/drop databases. The harness creates its own database and temporary data, migrates it, seeds synthetic users/media and cleans up afterward. It does not benchmark against the database named in TEST_DATABASE_URL. Do not substitute a direct production fixture invocation.
The baseline is an immutable Git ref. The harness extracts the baseline Collection query implementation; it does not rebuild or compare the entire historical application. Its fixture/import contract must be compatible with that implementation. Changing the baseline requires checking compatibility rather than assuming any commit is valid.
The fixture contains 22,400 works and 12,400 tracking rows. It alternates five warm before/after query rounds, compares complete normalized results and reasons across privacy cases, captures EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON), exercises concurrent pages, checks revision reads/expiry indexing and tests opposite-order concurrent imports. It also runs the administrator benchmark. See the implementation report for exact scope and results.
For new workloads, record:
- Commit/build, Bun/PostgreSQL versions, hardware, container limits and database settings.
- Dataset shape and counts, permission/source context, cache state and concurrent traffic.
- Warm-up, sample count, execution order, raw samples and measurement boundaries.
- Exact result equivalence, errors, query plans and relevant resource observations.
Compare like with like. Separate database execution, hydration, response transfer and browser rendering. A faster query with different privacy, counts, ordering or availability is a failed optimisation. Do not claim pool starvation, leaks or OOM from elapsed time or RSS alone; reproduce and capture the relevant evidence first.
Use the existing actual catalogue and admin account to construct isolated, reversible list/queue/pending states needed by a prescribed acceptance test. Real data does not require every test state to exist naturally already. Follow the actual-data test policy. Keep fabricated users, catalogue and provider responses out of actual-data evidence; label controlled scenarios separately from observed workloads and production performance.
Bind every native read and mutation in a rollback probe to its held transaction/session. Patching only transaction callbacks can deadlock a single-connection pool when a native read requests another connection. Preserve an interrupted attempt and restoration evidence, correct the test wiring, and rerun the same prescribed method. An instrumentation failure is not proof that the optimization failed.
When comparing a multi-query planner with a combined SQL candidate, include every baseline eligibility query and stop the native timer before running EXPLAIN. Keep row/JSON/binding savings separate from elapsed, buffers and WAL. The admin acceptance batch rejects smaller recommendation transfer because the finite large-case timings are adverse; discarded diagnostic boundaries remain retained. List statement/changed-row savings do not imply WAL savings: observed global WAL deltas increased and are not transaction-attributable.
Exercise competing commands on independent native sessions rather than assuming an advisory lock covers every mutator. Preserve baseline equivalence and flag a preexisting functional race separately: concurrent post-snapshot enqueue can be consumed without restoration by Undo in both variants. The performance snapshot guard is not a lossless-Undo repair.
A passing test suite proves its behavior checks, not faster execution. For a final comparison, freeze the original audited Git tree and the entire current application separately, install each exact frozen lockfile (including the current registered patch), and import native owners only from their own root. Admit actual admin/catalogue inputs once, keep complete ordered DTOs private, and compare their hashes without removing changed values or dates. Use matched disposable copies, verify read-only settings, serialize alternating trials, and retain every timing/error/adverse result. Record database object epoch, pool/instrumentation differences and migration boundaries; do not call native-owner timings authenticated HTTP or browser performance.
The 19 October original-versus-current check retains 52 complete output pairs across 13 actual scenarios. It predates the subsequent Activity policy-key repair; do not relabel its original/current timings as original/policy measurements. Library gains, adverse small-read observations and slightly larger generated output remain historical evidence. The dated overview above links the subsequent matched Activity and Tasks attribution. Four samples, lower query counts or an arbitrary summed workload cannot establish production p95, a memory plateau or universal improvement.
Open Settings → Benchmarks and select Run benchmark. Runs use benchmark.run in the existing outbox; an execution advisory lock prevents overlapping benchmark execution. History is retained for comparisons.
The workload uses a read-only transaction for local probes, with one untimed warm-up and five timed samples per probe; database round trips use ten samples. It measures Collection membership/page reads, availability assessment and a fixed journal workload. SQL statements have a five-second timeout. A thirty-second workload deadline is checked between operations; it is not a strict end-to-end termination timer.
Results include individual samples, median, nearest-rank p95, row counts, process CPU, RSS, heap and external memory. Memory is sampled every 50 ms, so observed peaks can miss shorter spikes. CPU/memory are process-wide and can include unrelated traffic. Five samples are useful for repeatable checks, not a reliable estimate of production tail latency.
Comparisons require compatible workload and environment evidence. Catalogue-dependent comparisons also require matching dataset evidence. Observed background jobs or changing data make a run unsuitable for a clean baseline. The UI’s compatibility checks do not eliminate unobserved load, filesystem cache effects or thermal variation. Preserve raw samples and repeat under comparable conditions before treating a difference as a regression.
This benchmark does not exercise browser rendering, network transport, live provider rate limits, audio/video decoding, cold caches or all application routes. It deliberately avoids provider calls and domain mutations; recording the run itself writes benchmark/outbox records. Implementation and regression checks live in src/lib/benchmarks/, tests/benchmarks.test.ts and tests/benchmarks-db.test.ts.
| Area | Method to preserve | Implementation reference |
|---|---|---|
| Collection and Library | Apply membership, privacy and availability filters before counts and pagination. Hydrate bounded pages of 60; preserve direct, inherited and member-derived reasons. | src/lib/collection/query.server.ts |
| Query planning | Separate independently indexed existence predicates; compute repeated visibility decisions once. Check actual plans and complete returned results before changing SQL. | Collection query; performance harness |
| Content invalidation | Use scoped durable content revisions rather than hashing whole histories or refetching on every session heartbeat. Keep clock-dependent availability expiry in the freshness calculation. | src/lib/server/content-revision.server.ts, src/lib/ui/content-revision.svelte.ts |
| Concurrent mutations | Revision writes are deferred and ordered consistently. Preserve transaction boundaries, monotonic revisions and bulk-owner deduplication. | Revision migrations and database fixtures |
| Client requests | Reuse the abortable resource loader. Only the current request can publish results; cancellation and stale responses must not replace current data. Clear withdrawn/private data when permission changes. | src/lib/ui/resource.svelte.ts |
| Shelf layout | Reuse observer-driven layout with animation-frame coalescing and teardown. Avoid per-card global listeners and repeated synchronous layout reads. Honour reduced motion. | src/lib/ui/shelves/layout.svelte.ts |
| Social badges | Fetch only unresolved IDs, including remembering empty results; batch at most 60 with at most two requests in flight. Invalidate on relevant revisions and cancel stale work. | src/lib/ui/components/Shelf.svelte |
| Journals | Use membership sets for finite visible ranges; skip filtering when the full journal is requested. | src/lib/ui/shelves/journal.svelte.ts |
| Provider requests | Use approved, pinned, bounded provider fetches and the per-origin priority lane. Retain pacing, cooldowns, cancellation and starvation prevention. | src/lib/server/security/provider-fetch.ts, request-priority.ts |
| Background jobs | Extend the existing durable outbox and scheduler. Preserve deduplication, lease checks, connection ordering and service serialization. Paginate traversals and yield only after committed replay-safe checkpoints. Retain a bounded durable census or staging records when complete evidence is required for sorting or removals; never treat a partial scan as authoritative absence. | src/lib/server/queue/ |
| Caches | Use existing bounded provider/artwork caches and paged cleanup. Scope personal data to account, permissions and sources; caching must not bypass authorization. | src/lib/server/utils/provider-cache.ts, src/lib/server/storage/image-cache.server.ts |
| Taste ranking | Refresh ten stale users per outbox run; cap evidence at 300 root works and candidates at 500 per medium. Use the GIN feature index, batched metadata reads and revision-checked writes. Page loads read scores rather than recalculating profiles or calling providers. | src/lib/social/taste-cache.server.ts, taste behavior |
| Charts | Lazy-load the gallery and selected renderer. Keep preview thumbnails static, one live gallery specimen, bounded exact-data pages and stable derived geometry. | Chart preview |
| UI reference | Mount only the selected playground editor/example and its scenario; lazy-load chart and material editors and dispose the previous owner on selection changes. Pinning or closing the inspector must not remount the preview or reset drafts. Each specimen owns its finite fixture transport/local playback state; no live provider, account, reader or party commands. Keep format engines demand-only and do not mount operational routes as fixtures. | src/routes/ui-preview/Workspace.svelte, PreviewExample.svelte, reference.ts |
Request priorities are initial imports, interactive delivery, live observations, then background maintenance. The lane chooses between requests; it cannot interrupt an in-flight call or bypass provider rate limits and Retry-After. Its oldest-waiting fallback prevents repeated urgent requests from starving maintenance. Task serialization and request pacing solve different problems; keep both.
Use stable IDs and primitive revision keys for cache identity. Derive expensive geometry only from its actual inputs. Keep immutable payloads in raw state where appropriate; avoid deep reactive wrapping of large datasets. Local caches need an explicit lifetime or finite key space. Unmounting or changing context must release observers, timers, listeners and pending requests.
Route invalidation normally targets affected dependencies. SvelteKit’s invalidate resets shallow page state: while a shallow panel is open, refreshRouteDependencies uses the supported state-preserving refreshAll instead. That refresh reruns active route loads, so keep those loads bounded and lazy; content revision keys still prevent unchanged shelf refetches.
Keep provider logic in its existing adapter/service boundary. Public API and browser routes should reuse domain operations and bounded read models rather than create parallel tracking or availability implementations. Performance work must retain account-generation checks, privacy, history and delivery semantics.
Audit History materializes its recursive identity scope once for count/page, retaining the canonical recursive UNION, action/user predicates and count before the media join. Full audit activity reuses this owner with later bounded hydration. Preserve native timestamp/event-ID ordering, all applied/unapplied observations and empty-page sentinels. Sharing the scope does not remove deep-page sort spills.
Use exportIdentities at the canonical Trakt identity owner for captured ordered list/projection inputs. Its500-input statement chunks retain ordinal output, duplicate inputs, native UUID spelling/case, missing empty objects and exact existing provider/placeholder/safe-number/IMDB validation. Scalar export uses the same formatter. Never key native UUID results by unnormalized caller text, silently omit missing inputs, change alias precedence or transfer these screen identities to other providers/media. Batch snapshots replace per-identity snapshots; keep ownership/generation/remote conflict and uncertain-write contracts at their current owners.
Optional social enrichment follows currently near-viewport cards, not the whole retained Shelf array. Shared observeVisibility uses the existing300pxvertical artwork margin, one observer and one visibility listener; hidden documents withdraw this optional demand and the last card releases both owners. Existing enrichment cancellation/scope guards prevent stale publication. Native fallback, owner replacement and disposal need lifecycle controls. The data-shelf-visible marker permits actual DOM/geometry verification without exposing private request payloads. This bounds demanded IDs to near cards; it does not by itself bound retained DOM/data, active images or native browser caches.
See the actual/source/normal boundaries. Static delivery inventory includes changeMany; add new primitives to the maintained scanner when introducing them. Keep historical inventories immutable and generate a named current snapshot. Reverify complete outputs, alias cohorts, resource counters and actual viewport scroll/return after these owner contracts drift.
Library and Profile share libraryTrackingCondition: only the Progress branch gates completion behind dropped/started/rewatch evidence. Preserve SQL three-valued NULL semantics and exact episode/boundary/drop rules. A source CASE is not a measured win by itself; compare complete per-title truth values and both callers, then primary subplan work. Retain adverse kind-specific plans.
History count/page reuse materializes the canonical recorded-watch relation after its window/filter semantics. Overall totals precede explicit date bounds; only filtered total/page membership use from/to. Preserve native event fields, timestamp precision, known-date/time/event-ID ordering, empty-page sentinel and clamping. Full/narrow readers share it; insights/non-History remain count-only. Avoid a global history cache or moving filters inside recorded-watch windows. Include first/deep/empty plans and memory/spill growth in drift checks.
Queue snapshots and tracking deletion share consumedQueueCondition rather than duplicating graph scope or reading the whole queue. Snapshot before mutation under existing feature/user locks; retain the final removed-ID filter and Undo freshness checks. Do not broaden locks or public command results to save a read.
Use changeMany from the existing injected API client for a same-domain multi-command logical action. It keeps ordered individual acknowledgements, first-failure stopping and no automatic retry. Refresh once after any acknowledged prefix, including partial failure; do not refresh an empty or entirely rejected action. A failed refresh must preserve command acknowledgement. This is not an atomic server transaction. Preview consumers keep the same isolated transport. Compare positive real multi-target commands when available; symbolic transport/fault controls remain supplemental.
The implementation batch retains actual12Progress/25History comparisons, exact queue predicate transfer, resources/adverse plans, preflight stops and remaining natural-cohort gaps. Re-run affected proof when predicates, recorded-watch windows, native mapping, mutation acknowledgement or scope owners drift; do not promote old hashes to new runtime acceptance.
Selected-section detail loading follows the normalized presentation target through initial reads and enhancement rereads. Only an isolated section whose consumers do not use child membership may omit hydration. Default overview, locally switchable insights and collection rows still require complete membership for totals, filters, ordering and next/anchor behavior. An omitted array means unrequested data, so it must not become a capability or empty-membership decision. Paging requires independent complete facts; it cannot silently replace those facts with the first hydrated page.
Complete membership is different from a bounded browse page. Hydrate explicit guest/detail IDs in ordered batches without silently limiting a season or episode set. Social card projections return the displayed top three people plus an exact total and resolve presence for those displayed people only. Profile insight endpoints use shared card-free totals/summary projections instead of hydrating backgrounds or favourites they discard. Cursor-free next playback uses the bounded sequence-next projection; explicit sequence cursors preserve their existing complete traversal semantics.
One screen detail composition observes each base card or missing identity once. Reuse that observation across parents, children, related cards and expanded collection members, remapping the original ordered identities. Apply sequence state to fresh occurrence objects; repeated paths must retain their own entry/source/progress. The cache belongs to one detailsData invocation, and each enrichment reread starts fresh. Keep next-playable selection independent. This removes duplicate hydration without shrinking complete detail arrays or establishing a production-wide database snapshot. Verify complete DTOs and ordered occurrences, including a formerly missing identity becoming visible on the next invocation.
SQL fallback work should be admitted only when its earlier precedence branches are absent. Activity root-parent lookup must preserve episode/season show precedence, scoped/default parent ties, unknown dates and grouped cursors. Keep raw history complete before grouping. Recommendation genre scoring deduplicates each evidence root's genres while preserving every candidate genre occurrence; retain the current integer-valued weight domain, floating result type, clamps, candidate preselection and final ties. A future fractional weight or ranking change requires renewed all-score equivalence, rather than assuming regrouped floating arithmetic is exact. Measure plan loops and complete outputs before applying the same principle to another query owner.
Trakt list reconciliation builds one local alias index while preserving first remote occurrence, mixed media kinds, duplicate identity handling and exact order. Music canonical updates compare meaningful values and relationship inputs; avoid rewriting unchanged album membership or re-projecting it for a mere availability observation. Rich browsing still persists changed metadata and batches personal access observations through the existing account/lease fence.
Seerr scans retain a nullable internal request scan UUID, a constant-size task checkpoint and at most one hundred-record page snapshot. Commit each page's request effects, notifications, marker and cursor together under the account and active-attempt fence; a notification failure rolls the page back. Resume slow metadata pages without refetching or serializing an ever-growing census. Only an individual confirmed 404 can cancel a missing request, and the update must still match the captured external identity and scan marker. A failed/incomplete traversal cannot publish requestsVerifiedAt. A stale attempt yields before interpreting its saved page.
Notifications own one shared preference/level decision for both single notices and batches. Administrator broadcasts keyset-page enabled users/settings in batches of one hundred and insert bounded groups with one policy read, preserving complete delivery, social opt-outs, locked/silent behavior and source-key upserts. Transactional callers read policy and persist notices on their supplied connection; they must not open another pool connection while holding locks.
When one query uses the same dated history to rank genres, choose membership and compute exact counts/pages, share that input inside the SQL statement. The Profile summary owner now materializes the permission-filtered period events and distinct genre membership only when a genre is selected. Both the named-genre filter and Other use those same relations; Other still ranks the complete period's genres before query, activity kind, repeat and explicit date filters. The unfiltered SQL remains byte-for-byte identical. This is request-local read reuse, with fresh configuration/privacy decisions and no cross-request cache.
Keep count/page clamping, stable event tie-breaks, complete DTOs, unknown dates, metadata precedence and denied outcomes unchanged. Reuse this owner for full pages, section refresh and insight totals rather than adding per-card or route-private versions. Do not move a filter before genre ranking merely because it seems cheaper. Materialization has a memory/work cost; it is not a universal default. The actual-data verification includes every existing owner, complete page/section/insights comparisons and unfiltered controls, with read plans and adverse samples retained separately from browser smoke.
A correctness-equivalent candidate is not automatically a performance improvement. Three Collection continuation alternatives were tested against actual data and left unadopted after regressions or mixed timing. Their receipts remain beside the applied Profile change. Keep existing production behavior when the evidence does not establish a worthwhile overall tradeoff; do not promote reduced buffer counts alone into a CPU, heap or latency claim. Preserve failed alternatives and exact source epochs so future catalogue growth can justify revisiting them without repeating blind experimentation.
collectionCTE has three distinct demands: full inventory, personal relationships, and explicit work IDs. Explicit IDs determine their ancestors and complete descendants independently of personal evidence. Their direct reasons can therefore join scoped_works before evaluating personal preferences and drop predicates. Observed-show/album and next-episode/track parent candidates can use that same closure through the local scopedParent predicate. Each admitted parent still evaluates all relevant children; preserve specials, release eligibility, completion, availability, metadata/source freshness and exact reasons.
Personal roots depend on direct evidence. Applying this restriction to the personal path creates a dependency cycle and can drop membership; it must remain disabled there. Full inventory also retains its existing demand. The maintained probe checks full/personal SQL and bindings for exact identity and compares complete explicit-ID assessment rows across actual kinds, multi-item scopes, viewers and source filters. Future consumers needing global evidence must choose the appropriate existing scope instead of bypassing this owner or adding private caches.
This shared owner serves inbox media assessment, listening search, received-recommendation availability and music queue assessment. Consumer-specific missing cohorts remain acceptance gaps. Do not count the same query reduction again for each consumer. The actual scoped-evidence report preserves staged results, adverse timings and a rejected edge-inlining candidate. Fewer read-buffer visits are not a measured heap, CPU, network, frame or universal latency improvement. Global graph materialization and remaining broad helpers are separate work.
profileActivity prepares the exact permitted dated recorded-watch relation once in a materialized CTE for daily and genre aggregates. Ordered JSONB aggregates preserve every day and complete genre rank before the existing six-plus-Other presentation. Keep empty arrays, UTC dates, imported unknown-date behavior, metadata precedence, distinct-title genre counting and tie order. Ratings, completed seasons and previous-period history retain their existing owners and freshness; do not claim these are shared too. This owner serves initial Profile data and insight refreshes, so no per-route cache is needed.
The actual Profile activity report preserves 36 complete outcomes and twelve plan/sample families. Combining the two reads deliberately gives days and genres one SQL snapshot; concurrent mutation and pooled endpoint latency remain separate acceptance. Do not replace complete exact chart evidence with caps or reinterpret fewer buffer visits as CPU/heap/production speed proof.
Narrow the projection before a materialization boundary, while retaining every field its consumers require. An unused output expression can keep an otherwise unnecessary computation alive. The shared Profile activity owner now materializes only media identity, kind, occurrence time and date-known state. Its day/genre consumers need those four fields; the separate full history reader still retains its rewind/repeat metadata.
The actual Profile projection proof preserves 36 complete outputs/privacy errors and all query counts. All 12 plans remove an unused WindowAgg stage and change estimated materialized width 176→32. Buffers stay equal and neither plan spills; 11/12 warm medians improve, with the adverse case retained. This does not measure heap/RSS, CPU or whole-endpoint tails. Preserve the complete consumer contract and refresh the actual comparisons/plans when adding a required field or changing the canonical history calculation.
The Taste measurement demonstrates the opposite outcome for another reuse proposal: splitting a global/personal revision maximum adds read work in all six tested families, so it is rejected. Native ranking plans identify broader candidate/metadata admission work as the next investigation; no ranking, cache, freshness or worker-publication change is inferred from those read-only plans.
The shared Profile activity owner materializes one union history for adjacent current/previous Month/Year aggregates. Reuse requires identical visibility, date-known and end-time admission. Preserve the exact previous period endpoint generated by the original timestamp code, including its millisecond gap; < currentStart is not interchangeable for higher precision rows. All-time remains its original query. Actual proof: 36 complete outputs/privacy outcomes, eight changed plan families with fewer read buffers and lower alternating warm medians; unchanged-query observations stay separate.
Profile summary reuses its favourite-membership aggregate for the total only when kind === 'all' && scope === 'all'. Add the exact count(*) to that existing aggregate and omit the duplicate count statement. Insights-visible favourites remain their own filtered count; they cannot stand in for all favourites when privacy differs. Other kinds/availability scopes keep their original two count SQL statements and bindings exactly. Do not inject every filtered availability predicate into one large aggregate simply to reduce query count: the rejected actual candidate caused expensive recursive source checks on unrelated favourites.
The guarded count report preserves 192 complete actual outputs/privacy errors, four improved default count families and sixty unchanged filtered SQL families, alongside the regressed unconditional alternative. This is shared profileSummary behavior for initial pages, sections and insight totals. Keep counts and page eligibility aligned, respect privacy/category/source freshness, and distinguish local read-work evidence from whole-endpoint CPU/heap/latency. No cache, persistent snapshot, index or provider policy is added.
A completed-season candidate admits watched, dated tracking states before grouping, while requiring equality to every non-special episode and retaining the aggregate completion-date fence. This depends on watched NOT NULL and unique user/media identity. Do not filter episodes to the requested period before computing the season maximum, or assume that removing HAVING predicates is generally equivalent. Actual proof compares complete Profile outputs/privacy plus all twelve ordered season membership/date lists. Schema or count semantics drift requires repeating that proof. The candidate is not adopted: warm medians improve 12/12 but buffers increase 11/12 and are unchanged once. The original season query remains until the cold resource tradeoff is established. Keep these comparisons in shared query owners so pages, sections and panels use the same behavior.
Combining separate all-true boolean aggregates into an aggregate of their conjunction requires explicit NULL semantics. Two nullable inputs can differ because aggregates skip NULL. The completed-season candidate has a live watched NOT NULL constraint plus an IS NOT NULL expression and preserves all actual Profile results, privacy and season memberships without moving row admission or date fences.
It remains unapplied: read buffers are equal and warm medians improve eight families but worsen four. Fewer aggregate expressions are not an observed CPU/heap or consistent query-speed gain. Keep correctness equivalence, source simplification and resource/performance acceptance separate; no fabricated history is used to fill absent actual cohorts.
When a shared query needs only whether a matching row exists, express the witness with EXISTS rather than joining every witness and discarding duplicates afterward. Preserve any distinct outer identities: Taste keeps distinct work IDs across metadata providers, the exact medium/JSON containment predicate, ranking precedence and cap. A witness multiplicity/count or ordered witness payload cannot use this replacement unchanged.
The Taste feature-admission repair preserves complete actual inputs/profiles, ordered candidates and every computed score for all four actual owners. Two schedules retain all plans/samples, including adverse observations. Adopted-source reproduction shows three lower/equal-one root read-buffer totals, lower warm medians for four owners and no observed spill. This does not establish whole-worker publication/lease/restart/concurrency or CPU/heap/tail performance. Retain native/bound replay and pure-score equivalence when this shared admission changes; no provider fetch or synthetic catalogue may stand in for actual candidate acceptance.
An existing index and an apparently selective predicate do not prove that a rewrite uses an efficient access path. Inspect live index definitions/validity/readiness, actual joins/scans, parameter behavior, root read buffers, temporary work and alternating timings. Compare complete outputs as well. A lower buffer total with consistently slower work is a tradeoff; preserve it explicitly rather than reporting a blanket gain.
The four rejected Taste options preserve every actual candidate/score but lose on all four owners' warm medians. Grouped arrays, early DISTINCT, a planner-fenced lateral read and a redundant bound coarse filter all fail to select the existing GIN path in these observations. The fence adds roughly tenfold read work and temporary spills. Keep the simpler adopted EXISTS owner; these tests do not justify global planner settings, another index or a normal-data maintenance action. Reassess the exact plans, input distribution, read/write/storage costs and publication contracts before adopting a larger access design. Rejected source epochs and adverse samples are maintenance evidence.
getPendingConflicts is the shared settings/private-API owner for conflict summaries. Read local list name/description/count without hydrating every member for display; send dedicated localItemCount/remoteItemCount fields while leaving complete durable evidence and fresh approval reads at their authoritative owners. Preserve wording for deleted/progress/list and unknown scalar records, including items-absent inputs. Counts must never replace complete ordered state in resolution. See native admin comparison and remaining limits. Smaller DTOs do not bound total conflict cards, saved remote JSON or approval work.
A type-only correction may reuse an actual-data receipt only with preserved original sources, independently proven erased JavaScript equality and integrated type/build gates. Record the intended probe path and SHA before child launch, not just after execution. Pin connection-local TEMP state to one held/pinned session; keep native concurrent actors on explicitly separate sessions. Classify harness dispatch/import/baseline mistakes separately from method failures.
Test concurrent mutators on native independent sessions before adopting phase/cursor protocols. The proposed Jellyfin finalization phases reduce measured work but are not adopted: both baseline and candidate reproduce an existing40P01 account-row/advisory/FK cycle. Local job/version equality is not remote exactly-once delivery or live worker-lane acceptance. Preserve the measured candidate and defer the method rather than starting another lock redesign in the same execution pass.
The Collection projection preview sends only workId/title for its complete browser entry arrays. Complete delivery payloads, remote snapshots, account/version fences and approval/review execution remain in the existing durable owner. Conflict-first review derivation uses one Set of conflict IDs, preserving every review and choice. This reduces transport/derivation work; it does not bound panel cardinality or prove mounted-browser heap. Controlled persisted previews must be labelled local test states, never genuine remote replies. See independent acceptance.
Shelf uses createShelfContinuation for every horizontal row. Ordinary rows initially mount 20 cards and reveal the next 20 buffered cards near the end before requesting another native page. Paged and cursor sources retain their own query sizes, filters, eligibility, occurrence identities and Resource cancellation. Mixed Progress pages use 20-card SQL offsets/counts; ordinary catalogue pages remain 60. Reading discovery exposes its existing provider pages horizontally; finite discovery/search/local feeds end at their supplied results rather than refetching the same feed. Anchored detail rows and Library retain their existing positioning and native-window presentation instead of slicing away their focus/retained cards.
The existing rail geometry owner coalesces scroll/observer bursts. One continuation request runs per shelf; busy/error gates prevent overlapping reads and automatic error loops. Explicit Retry repeats the failed append page while retaining existing cards. Selection changes reset the reveal budget; resource ownership still cancels/fences outgoing results. Ordinary grid pagination and For You's vertical row activation stay in their existing owners. Already-browsed data/cards accumulate in ordinary append sources; the 20-card reveal budget bounds incremental mounting, not total retained DOM/heap. Library's existing three-page retention remains separate. No new timer, global queue, dependency or measured memory plateau is introduced.
The 21 October checks cover buffered reveal, page/cursor continuation, exact mixed-page coverage, duplicate suppression, failed append retry, scope replacement, disposal, finite exhaustion, cold server initialization and unchanged grid/anchored presentation. Signed-in desktop For You Activity advances 20 → 40 → 60 → 80 unique event cards, crossing its native 60-card cursor boundary without console errors; the 390px viewport advances 20 → 40. These are behavior/work-budget checks, not a production latency claim.
The 22 October browsing consistency pass checks For You, Library and Discover across all four actions. Home music uses the existing native Library pagination and retained window, rather than a fixed preview. Shared controls own availability presentation; provider explanations are not permanent row subtitles. Activity and saved/recommendation sources fence viewer and filter changes before replacement data arrives. Discovery checks cancellation before hydrating results from shared provider reads; cancelling one viewer does not cancel a provider flight needed by another viewer.
The shared Watch/Listen/Play/Read action resolves before route queries. Explicit URLs take precedence over the saved account default; withdrawn actions discard incompatible filters before fallback. Search admits only the selected provider family. Personalised definition queries restrict the action before their recent-interest limit. Main-page action/account changes retire their mounted Shelf sources; expanded destinations retain the same action/category instead of restoring mixed defaults.
Library entity tabs and their live count use the same Resource snapshot. Playlist and verified comic-series queries count container identities before paging; membership captions and cover selection run only for retained page IDs, with existing sixty-work hydration batches. They preserve the normal native-window bounds. Container cards open their own destinations without manufacturing work actions or social-enrichment reads. Recently added combines enabled subtypes inside the action, with no type segments. Shared Progress stays category-scoped on For You and uses thumbnails for Continue and posters for Next/Later/Favourites; profile history segments use posters. Music remains outside progress tracking.
The Library grid appends only through its explicit Load more button. It retains the existing three-native-page neighborhood, leased-card backpressure, earlier-page recovery and primitive URL/anchor restoration. Sort and segment predicates run before counts and native page hydration. Continue/Next reuse the established Progress ID planners; default orders remain unchanged for callers that do not select a sort.
Recently added and Requests reuse Shelf viewport admission, horizontal continuation, artwork sequencing and Resource cancellation. Row previews hydrate twenty cards; expanded pages hydrate sixty. These ordinary append feeds retain browsed data rather than adopting Library's neighborhood protocol. Requests skip social-enrichment observers/reads and project only requester username/avatar. Viewer/role/filter scope is published inside the same resource snapshot as the cards; superseded or disposed reads cannot expose an old scope. Abort checkpoints stop further bounded request queries/hydration after withdrawal. Profile Progress omits the duplicate Later/Favourites controls while its dedicated rows retain them.
Verification covers real signed-in Library sorting, genre/segment changes, manual 60→120-card append, the three-page 180-card movie neighborhood, desktop/mobile row menus and stationary menu-frame scrolling. Compiled-owner tests cover stale pages, concurrent append admission, failed refreshes, owner/role/feature withdrawal and disposal. These establish behavior and structural work bounds, not a production latency or heap-plateau claim. PostgreSQL compatibility and full disposable database suites run through PR CI before merge.
Check never-activated, visible, offscreen, document-hidden, context-replaced and disposed states separately. A memoization owner must name its primitive key, viewer/permission scope, revision sources, finite size/lifetime and explicit retry behavior. Equivalent object replacement is not a content change. Waiting work must still be needed when admitted; a previously intersecting image is not necessarily still visible.
Configuration snapshots are scoped to one HTTP request, expire when it completes and do not flow into background startup. Explicit database/transaction arguments always read through that connection. Authentication, setup, token and permission checks must not become cross-request cached decisions. A committed settings update may replace only its own request's snapshot.
Timers declare their precision, visibility policy and last-consumer cleanup. Static calendar labels must not require second-precision updates; active party heartbeats and intended audio playback have different visibility requirements. Scroll, resize and mutation paths share the same per-owner geometry frame budget, and scheduled callbacks cannot publish after disposal.
Demand-loaded modules reuse the existing Resource publication/disposal rules and successful module cache. A failed native module import can remain rejected for the current document; a mocked Promise that succeeds on its second call does not prove browser recovery. Verify a real built chunk failing and becoming available again. Use the shared reportImportFailure explicit Reload page action for module failures; both feedback hosts preserve its label. Never reload automatically, cache-bust module URLs repeatedly or reload a preview's real application. Reload can end in-memory playback or panel state and is an explicit user action. Player engine setup failures remain separate and retry within their current session after releasing partial resources.
In-place route refreshes use refreshRouteDependencies, including full-page Retry through its all option. Keep explicit navigation and action redirects in their existing owners. Direct invalidation can reset shallow panel state while the browser address retains its query. The shared helper preserves an already-open overlay through the existing broader refresh path; it does not fix opening/closing that overlay during an in-flight load, because the installed router captures the previous state before awaiting. Test actual panel visibility across the refresh window and record that remaining ownership gap separately. A broader route read is a cost of this state-preservation path, not a claimed resource saving.
Measure unchanged refreshes as well as first imports: identical final rows can hide repeated relationship rewrites, revision churn and WAL. Include permanent job-history growth, per-title child/achievement cardinality and provider mappings/metadata bytes in scale fixtures. Use database plans before selecting indexes; include old account generations and absent lookup values.
Before an expensive projection, admit only rows that a downstream consumer can use. Prove the necessary condition against every evidence source: Continue must retain inherited replay boundaries because event progress can be positive when stored position is zero. For ordered fallback lookups, skip a lateral only when an earlier source already determines the selected value; preserve null/empty distinctions and fallback tie ordering. Compare complete ordered results on actual data and keep authored edge controls separate from actual positive cohorts.
Batch bounded membership checks at their existing shared owner, retaining separate preflight and fresh transactional admission when both are required. Keep raw input limits, stored input order, first-invalid behavior and transaction ownership. Record when one statement snapshot replaces serial reads. Notification batching additionally changes partial-delivery and failure boundaries, so it needs its own behavior decision.
Reuse an inserted value through excluded when an upsert assigns that exact value again. Preserve independently sampled freshness fields and structural reconciliation. Count native JSON parameters through the project's codec; their serialized size is a parameter-size proxy, not measured wire traffic, allocation or a reduction in database writes.
Suppress an unchanged write only after preserving validation, locking, normalization and required filesystem effects. Compare the complete stored value at its existing write owner; do not turn a no-op guard into an authorization bypass. An unchanged provider observation may still intentionally advance freshness or precedence, so a profile settings guard is not permission to add the same guard to every provider table. For worker chunks, check the current lease inside the existing transaction after its established account/connection lock and before domain mutation; a later checkpoint fence alone cannot protect earlier destructive work.
Keep one in-flight control writer and coalesce redundant pending snapshots by session while preserving lifecycle event boundaries and final drain. Renderer ownership starts when a URL/worker/image is allocated, not after decode succeeds. Unchanged settled reading locations are no-ops; resize is an explicit render invalidation. Lease waits have cancellation, capped polling cost and a recoverable state after partial destructive effects.
Benchmark probes reuse the production medium/gate/cohort contracts. Changing measured workload semantics requires a workload-version change; code/build changes being compared do not by themselves require a new version. Preview chart fixture bounds do not certify live datasets: a production consumer must define mark/aggregation limits and preserve truthful exact-data access.
createResource.cancel() ends the current request but leaves its owner reusable; dispose() ends the component owner permanently. Component teardown uses dispose, so a pending mutation's continuation cannot restart a GET after its panel closes. Capture the current session/renderer/revision in asynchronous playback and reader operations, and fence successes, failures and cleanup; an old failure must not overwrite its successor's error or busy state. Propagate owner AbortSignals through adapter metadata/permission requests as well as the final stream download. Do not substitute a post-await check for cancellation of a queued request.
Catalogue menus enter through WorkMenu, retain the shared Button/controller, and use createMenuResource over createResource. A snapshot belongs to one mounted owner, viewer, canonical/source identity, occurrence, selected playthrough and meaningful content/policy revision. Reopening an unchanged settled owner reuses its snapshot; closing cancels optional reads, while disposal is terminal. Session heartbeat and friend presence updates must not refetch unrelated personal action state. Fence late success and failure against the captured scope even before reactive cancellation runs. This is component-local reuse, not a permission cache.
Root action reads are local. The common Collection projection reads direct relationships, rating, queue and the selected/latest playthrough or reading state in one statement; do not invoke recursive Collection coverage to render those controls. Screen roots omit unconsumed child hydration and saved-list payloads. Lists, listening history and the party track picker use separate owner-scoped pages of sixty, with counts before pagination. Preserve exact list-entry identity and complete choice pagination; a small visible menu is not justification for silently truncating choices.
An acknowledged field patch preserves snapshot completeness: a rating update during a cold/revision-changing read must not turn empty game/reading fields into a settled snapshot. Replace the full single-flight promise when installing an authoritative replacement; stale responses still cannot publish. Private music alias search hydrates at most sixty local candidates and reuses permission-aware work assessments for availability; report the bounded-result notice when that candidate limit is reached.
Unknown provider identities resolve only through an explicit preparation/import or playback command. Play owns its required identity/next-playable read separately from optional menu reads, so dismissing a menu cannot abort playback preparation or make it wait for ratings/lists. Stable medium command owners keep dialogs outside transient menu children. Capture mutation targets before awaiting; preserve selected playthroughs, reading editions and repeated list occurrences. Treat a successful transport write as acknowledged even if route/menu refresh fails: retain success, offer refresh recovery and never invite resubmitting the write as though it failed.
Menu geometry uses synchronous placement followed by a Svelte tick for newly mounted child bounds, then coalesced ResizeObserver frames. Close/dispose releases observers, outside-event subscriptions and frames; closed menus must not schedule geometry work. Compact submenu focus returns after the parent is visible again. Verify cold/warm request counts, late delivery, exact occurrence commands, keyboard/back/focus, narrow viewports and repeated lifecycles in actual rendered controls; request counts alone do not establish retained-heap or live-provider latency improvements.
Media detail provider data follows visible/selected row demand through the existing Shelf activation observer. Share each TMDB/Trakt result among its consumers, retain TMDB crew demand for Credits, and cancel sources when no active row needs them. Do not eagerly fetch both providers for an Activity-only section. Geometry callbacks such as Dialog positioning coalesce per frame after synchronous initial placement and release the captured frame on teardown.
Detail page adapters supply the real Shelf contract to MediaDetails; MediaDetailRows owns the common Insights/Reviews/Credits rendering, without provider I/O. Full-page and overlay music/game loads share their feature services; the overlay imports only the selected medium's component after its saved data arrives. Close, viewer replacement and disabled/forbidden identities retire stale ownership immediately. An acknowledged edit keeps the open sheet and its scroll position.
DetailOverlay uses the shared Dialog's bounded 160px expansion range, one queued animation frame per scroll burst and native proximity snap areas. Read scroll position before writing the expansion CSS variable, release queued work on teardown, and do not add an idle animation loop. A fixed outer track owns expansion; after it reaches 160px, the inner scroller owns ordinary page travel. A scoped wheel handoff forwards remaining travel even when the browser keeps momentum latched to the outer track; preserve nested scroll ownership, horizontal gestures and pinch zoom, and remove the listener on teardown. Never change scroll-dependent content padding or track height: that feeds layout changes back into the scroll measurement. Artwork tint sampling is detail-only (never per shelf card), 32×32 pixels, at most six sequential candidates and a 64-entry colour cache. Replacing/closing the owner removes pending image handlers. Optional root trailers stop under the modal rather than consuming resources behind it.
Edition changes use the existing local media presentation query and shared resource cancellation, not provider requests. Load provider-item metadata only for an explicit edition read; ordinary shelves retain their existing projection. Select from permitted availability, use deterministic source ties, preserve metadata policy/override precedence, and never send raw provider snapshots to the browser. Edition changes update the shared detail model without remounting lazy rows or resetting scroll.
Reading related-title matching uses indexed author/subject overlap, SQL counts/ranking and at most one 60-card hydration page. Never hydrate a whole catalogue or make a provider call per related card. Credits reuse the bounded provider detail cache on demand; authors and provider identities remain canonical. Community aggregates apply separate visibility predicates for actual book/comic ratings and progress, plus enabled-user/feature checks. Comic-volume summaries explicitly count locally known issues, not an assumed complete provider run.
Dynamic For You takes one immutable, definition-only census per visit, with an explicit maximum of 10,000 definitions; overflow returns an error rather than silently dropping rows. The current bottom sentinel reveals one row, waits for it to settle and then observes the new bottom. Card/provider pages and artwork remain lazy. Content revisions refresh row contents independently; viewer or enabled-medium changes discard the census. This avoids rebuilding and re-ranking mutable definitions at each numeric offset, which can skip or replay rows during an ordinary tracking edit. Do not add a server snapshot cache or durable feed table for this contract.
Reader bookmark saves deduplicate only successfully acknowledged equal locations for the same session. An ambiguous failure invalidates that acknowledgement; latest pending positions, explicit retries and the final close drain remain required. Server heartbeat/session timestamps express live presence and resume ordering; identical positions are not a reason to remove the explicit 60-second visible-reader heartbeat.
Optional image persistence has its own memory admission, separate from provider rate/admission lanes and the durable disk budget. Each image cache reserves at most 64 MiB and sixteen pending writes before enqueueing a buffer; saturation declines persistence immediately while the authorized response can still deliver its image. Release reserved credit on success, error and declined disk admission. TMDB retains its four active download bound, shares exact-key work among live consumers and cancels upstream only when its last consumer leaves. A canceled download retains active credit until it actually settles; a late cleanup cannot remove a replacement's map entry.
An effect that has just computed its menu scope passes that exact value to createMenuResource.sync(scope) inside the same synchronous callback. Five existing menu families now avoid recomputing the identical serialized settings key twice. Do not hold that value across a promise, timer, event or asynchronous read. open, load admission, patches/replacements and completion fences still read the current key themselves, so permission, occurrence, viewer and revision changes remain authoritative. Keep the cold-read single flight and warm reopen behavior; tearing down every card controller would discard these snapshots and add reads.
The menu and hero report contains 52 actual-input source-callback comparisons and native signed-in menu acceptance. One fewer key evaluation is structural work reduction, not a measured CPU, heap or latency speedup. Minimal policy-key design, positive saved-list/party cohorts and wider card retention remain separate.
Keep the context that interprets a response inside the existing resource snapshot: selected period, units, filters, owner or equivalent identity belongs with its values. The pending control can show the user's new intent, while retained content, labels, captions and drill-down links use the committed snapshot context. Return that context inside the resource load result; its existing latest-request fence then publishes both together. Do not update committed context in a separate continuation after load, because a stale/failing/disposed request may finish there too.
Profile insights now publish period with totals/activity and use it for the recap, charts and links. Failure retains the previous complete snapshot; successful replacement commits its context; server replacement supplies its own context. This is a general composition rule for the shared createResource owner, with no new abstraction or production dependency. The actual visitor check covers settled output and panel behavior; authored compiled pending/failure/supersession controls cover schedules not captured naturally. Broader consumer adoption requires evidence of the same mismatch, not a blind interface rewrite.
Library and Collection use the same three-native-page buffer at page-window.ts and createLibrarySource, across Watch, Read, Play and Listen, embedded sections and ordinary routes. This bounds retained catalogue pages without silently truncating membership. Native widths remain owned by each reader: sixty for Watch/Read/Play/Collection, fifty per connected Music source. A Music page can contain more than fifty cards when several sources are admitted; three pages is not a universal 180-card or heap budget. Single-page/public-summary/preview contracts remain single-page. Cursor feeds and complete detail/sequence arrays need their own identity and recovery contracts before adopting this protocol.
The existing signed-in Library/Collection GET accepts an explicit firstPage through page, at most three ordered positive integer pages. Reuse eligibility/count/raw selection within that range, and keep each native hydration/ranking page separate. Return actual per-page hydrated counts; missing cards and multiple Music sources make flat-array slicing at sixty incorrect. Watch and Collection reuse their canonical count/selection statements. Reading progress and game ranking/presentation keep their original page boundaries. Music keeps page-major/source order, provider observation/account-generation checks and a final source census; changing totals, failed subreads or account withdrawal cannot publish a mixed retained range. Perform the fresh policy/source checks even after a provider failure so a current withdrawal returns403 and clears private content, rather than being hidden by a retryable502. Source membership/generation comparison does not require incidental database row order to remain fixed. No database transaction spans provider waits. Stable remote totals are not a guarantee that provider content is an immutable snapshot.
ShelfSource.retry lets an owner retry its exact retained/blocked operation; generic error delivery must not substitute a single numbered page or cancel an already owned retry. Only the existing Resource publishes or cancels requests. Same-scope refresh replaces the retained neighborhood atomically through one bounded range request; a failed or incomplete refresh retains the previous complete window. Forbidden/not-found responses, viewer withdrawal and effective feature withdrawal clear private content. Capture primitive owner/filter/revision/request identities and reject stale results before publication, including the interval before the reactive cleanup effect runs. Clamp recovery rebuilds the current bounded neighborhood instead of relabelling a stale tail. Ordinary source filters reset the range. Keep preview requests on their isolated injected transport.
A page must not evict a focused card, open menu/dialog draft or in-flight action owner. MediaCard supplies the shared retention context; generic menus, Dialog and operation/mutation helpers acquire it for their actual lifetimes, including acknowledgement/refresh and failed completion. Nested owners also retain their parent card. All component operation callers capture this port during initialization. The buffer declines publication when it would evict a leased card, reports a reachable retry, and retries only after an owner releases; it never grows an unbounded collection of pinned pages. Release must be idempotent, and a stale release must not remove a replacement owner. Retire the old ledger on viewer/policy/filter withdrawal, while same-scope server-rendered reuse preserves the existing leases; reuse a fresh admissible server result without another read. Explicit navigation and authorization withdrawal remain separate from automatic same-scope eviction.
Shelf's existing geometry owner preserves a surviving visible card before DOM changes and restores it after rendering, through one animation-frame budget. It also rechecks eligible grid end geometry after pending reads/scroll bursts, so a missed intersection edge cannot strand an automatic section. Stop on errors and remove the captured scroll listener/observers on disposal. Reverse travel can fetch the preceding native page; an explicit previous control stays reachable. Dialog marks its content scroll owner with data-shelf-scroll: temporary hidden overflow during expansion does not transfer restoration to the 160-pixel expansion track. Back history stores only the committed bounded URL and primitive anchor/focus data. Restore after data admission and compensate the sheet's final width through the existing ResizeObserver; intervening user input cancels that restoration ownership. Never store card payloads, detached DOM nodes or an unbounded height cache in browser history.
Drift checks must cover complete actual-data ordered page/range DTOs, sparse/empty/clamped pages, source/feature withdrawal, stale publication, engaged-owner backpressure, reverse loading, refresh and child/Back/focus. Native DOM plateaus and heap/CPU/GPU/decoded-image budgets are separate evidence. Preserve the stopped/adverse trials and report absent cohorts. The bounded-window implementation and receipts describe the measured corpus and remaining limits; they do not certify every other Shelf source or complete the wider audit.
All Shelf sources share the same header-control partition and rail renderer. Availability uses the existing compact toggle beside ordinary row segments; focused panels place standalone buttons/toggles alongside top-right filters so the sticky footer contains only segments. Changing a header or opening its filter menu must not activate another data source or add a second loader: menu content mounts only on open through the existing Button/menu controller, and selection dispatches to the owning source. Local finite-array selection remains local; paged sources keep server filtering/counts before pagination. Real destination links retain the active selection and use native anchors.
Preserve the existing one-shot Shelf activation, component-local Resource cancellation/latest-response rules, revision scope, bounded hydration/social enrichment, per-rail left-to-right lazy artwork and coalesced geometry teardown. Dynamic rows remain append-only at the actual bottom, one settled row at a time. Verify header order and keyboard/submenu/back/focus on desktop and narrow viewports alongside request counts; do not introduce a separate row scheduler, global artwork queue or eager provider fetch for layout consistency.
Music detail routes return only root metadata and a bounded parent lookup. Albums/tracks load through the existing Shelf source/resource lifecycle when their row or selected section is visible. Hydrate one bounded page together with viewer-scoped availability, authorized artwork, credits and private progress; preserve release-entry IDs for repeated tracks. Do not replace missing access with a canonical work UUID. Source-backed music requests and manual reader source searches pass request cancellation to Jellyfin, and cancelled observations cannot grant account access. Music child pages use the shared sixty-item bound and recheck stale page numbers against each source response. Allow at most three page reads; if the source keeps shrinking, return an explicit retryable conflict rather than relabelling items from the wrong offset or scanning the library. An unchanged verified reading-file fingerprint reuses its durable identity without an Open Library edition lookup; Jellyfin access, direct identity conflicts and transaction/account fences still apply, and changed files still require metadata validation.
Game detail routes fetch a playthrough summary/count, not its session history. Music and game history use the same lazy resource and bounded paging methods as Reading. A resource owns its request through context changes, close and destruction; an externally cancelled reader preparation must also clear its loading owner and retire a late prepared session. Reference specimens mount feature-owned production detail compositions with finite fake transports, rather than copying simplified route markup or invoking live commands.
Eligible detail anchors share one delegated root listener and an explicit route parser. Suppress duplicate full-route tap preload only for the handled event; do not add per-link observers, retain DOM nodes, preload detail modules globally, or intercept core application/action routes. Reuse feature-owned loaders in an internal dispatcher. Opening and replacing content owns one abortable request and lazy component import; keep the current panel until the next destination is ready. Local section/filter/page state must use that destination's URL, rather than the page underneath it.
The native modal owns click/focus isolation and a CSS document scroll lock. Expansion and the retained adaptive hero capability use the existing coalesced scroll frame, not another scroll observer or animation loop. Detail heroes currently remain left-aligned; adaptive alignment is parked. Keep a fixed 160px outer expansion track separate from the inner content scroller. Reverse momentum cannot contract the sheet while inner content remains above its top: pin the outer offset to its expanded limit in that same coalesced frame. Hand upward wheel travel back to the expansion track only after content reaches zero, preserving nested scroll ownership and non-cancelable gesture handling. Section navigation resets only the content scroller; it retains the outer offset and presentation, even for short/empty sections. Focused media sections suppress their detail hero and repeated metadata links in the shared composition. Review sources use the same segment picker as Activity; additional review pages use the existing Shelf end-of-list activation. Keep canonical or provider-scoped identity in section destinations. Linked row views reuse source cancellation, filters and bounded-page append; they must not rewrite the underlying page URL or introduce a second loading scheduler. Plain segmented controls must not mount disabled glass renderers: a disabled renderer can still supply a fallback backdrop. Material variants have exactly one material owner.
The detail friends rail uses the existing lazy detail Shelf with bounded sixty-person pages. Filter visibility and relationships before counts/ranking; omit presence and reaction hydration when only people cards are rendered. Ordinary card heads retain the bounded top-three social projection.
The shared media detail Activity row reuses the For You social source and card presentation. Resolve durable work/artist/reading-group identity in the composition; do not add medium-specific history fetchers. Apply the requested work or verified container membership in visible_raw, before grouping and the 61-row cursor lookahead. Keep privacy/category gates and reaction targets unchanged, append on demand, and cancel superseded item requests. Remote previews without a persisted identity do not start an Activity request.
Item Activity relationship segments share relationshipEdges/relationshipReasons with card-head projections. Restrict reasons to the requested work/container closure before privacy checks and grouping. Represent no-history relationships as undated state cards, not synthetic history records; retain a stable event/state cursor with the existing 61-row lookahead and hydrate only the returned page. Filter changes cancel old reads and make one replacement request; ordinary unscoped For You requests do not activate relationship traversal.
A controller composing successive filter URLs must retire its pending composition when native Back/Forward changes history. In the installed router, beforeNavigate can be skipped while another navigation is active; route data can still describe the cancelled filter after the browser address has changed. Observe popstate in that shared route controller's client mount lifecycle, use the same-origin/same-path native target as the next URL base, and remove the listener on disposal. Do not add one listener or intent cache per row, card or medium.
The Search controller owns both rows and every enabled medium. Native history clears pending intent revisions and the typing timer before adopting its target. Restore an unchanged submitted query from that target; preserve an unsent draft. The framework popstate hook leaves this boundary to the native listener. Successful or failed goto completion may settle only its own current revision; after a latest failure, use the current same-route address rather than stale route data as the next base. A late superseded promise must not clear a newer intent. Other navigation/redirect/disposal behavior retains its existing owner.
Verify the actual rapid sequence, not only settled filters: submit/filter → native Back → another row filter while prior data is still present. Compare the restored query/independent selections and complete ordered card identity/title projection with a canonical direct load. Supplement with held/late/failed goto, absent framework-hook, dirty-draft and listener-disposal controls. Keep the native UI trial separate from full server DTO, provider-call, SQL, heap or latency claims. The actual before/after reproduction records the cancelled Albums intent that previously resurfaced after Back restored Movies. That historical acceptance used the Kit 2 patch and 21 schedules. The Kit 3 migration ports the repair and maintains 18 schedules for the changed owners and native refresh semantics.
Each inline hero video owner must enforce current page.data.capabilities.screen and .playback independently of a retained hero claim. Explicit false makes the surface invisible and ends source ownership; existing cleanup pauses, removes src and calls load(). Crop preparation also ends. Preserve the lightweight hero identity/URL so an allowed claim can attach again. This follows the existing feature-Off contract and avoids keeping a decoder attached solely because a stale hero claim survives.
Ordinary offscreen/hidden/paused warm source retention is a different policy and remains unchanged. Normal signed-in actual trailer loading, scroll-away pause, return resume and no-consumer pause are verified separately from the two authored capability-withdrawal controls. Those controls prove ownership cleanup, not codec memory reclamation or natural feature-Off acceptance. Intentional foreground audio/video remains independent.
Diagnostic output admission and hidden material resources
Keep diagnostic retention, complete export and limited viewer output separate. DiagnosticStore.recent(limit) preserves full segment validation, seven-day retention, normalized timestamp order and reverse occurrence order for equal timestamps. The optional output limit admits only the detail sanitization work needed by the caller. Skip malformed detail and continue to the next eligible record; never let a rejected row consume an output slot. listDiagnostics keeps administrator admission and its existing 1–500 limit; Activity/Admin currently request 30. Unbounded recent() remains the complete download/runtime-read contract. Never return raw detail, persist a tail cache or replace current permission checks with this admission bound.
Pruning inspects the first newline with indexOf/slice; it need not split every retained line merely to inspect the oldest event. Whole segment reads, current-file accounting, full parse/filter/sort and external-change observation remain. The output bound is not a storage/parse/heap budget. Compare complete actual ordered DTOs, file retention and failure/drop metrics for full and limited reads, retention boundaries and malformed/no-newline copies. Keep authored fault controls distinct from actual production failures.
When the enabled native glass path observes zero width or height, it releases its SVG definition and encoded displacement map. Clear those resources through liquidGlass at the shared renderer, retain the existing resize observer/frame owner, and rebuild when dimensions become positive. Visible same-key definitions still reuse their map; unsupported/disabled/CSS policy and deferred destroy remain separate. Clearing a hidden map trades warm reopening work for lower retained resources. Disabled/CSS fallback warm-map lifetime remains separate; do not describe this zero-size rule as universal inactive-cache reclamation. Verify actual hide/reopen/menu rendering plus controlled width/height transitions and teardown; DOM definition removal is not proof of reclaimed browser heap, GPU bytes or pixel equivalence.
Run maintained tests with bun run test (bun test ./tests). A bare tests argument is a substring filter in this installed Bun and can discover evidence snapshots elsewhere in the repository. Historical test sources remain immutable evidence, not independently runnable fixture trees. Do not add snapshot-discovery errors to application failure counts or silently discard the failed run. The actual-data and native-browser receipt retains this repair and its boundaries.
Use native actual-data models to select an algorithm, preserving exact values, ordering, labels and selection identities. SSR markup can contain multiple responsive copies of each mark: count the actual renderer’s loops and report visible-browser work separately. The batch26 chart measurement retains actual workloads and corrected instrumentation; these linear bar/distribution/target models do not justify the conditional spatial-index/worker proposal. Fictional chart catalogue examples do not establish actual demand.
For image admission, capture the original encoded bytes through the existing authorized reader, record their hash and native decoded dimensions, and keep content bytes outside the repository. A screenshot is not an encoded input. Header parsing adds its own copies/latency; ordinary below-limit pages do not demonstrate a peak-decode saving. The private header candidate remains unapplied after actual JPEG/ordinary PNG checks. Unknown/incomplete header fallback and postdecode protection remain distinct from full format/animation/orientation/oversize acceptance.
Use an owned header projection when a command consumes only identity/type/permission fields. Keep full detail hydration in its existing reader, sharing the same UUID and ownership gate; a cheap header must not become an authorization shortcut. Playlist start and complete list detail now share getListHeader in src/lib/core/lists/service.server.ts.
For ordered list mutations, preserve the established user/list locks and exact entry-ID permutation validation. Use one set-based update with ordinality or row numbers, scoped to the owned list and limited to changed positions. Keep the existing raw10000-ID bound and parameter binding; never interpolate UUID text. An absent delete, identical order or identical normalized header is a no-op only after existing admission/type checks. Skip timestamps/export/projection effects together when no domain change occurred. This reduces round trips; it does not prove fewer tuple writes, WAL, lock time or faster latency. Include positive native nonempty order/export/concurrency checks; controlled temporary states over actual records are permitted when natural saved states are absent.
After a provider-driven page clamp, compute public pagination metadata from the final observations used for the returned cards. Preserve per-source page width and source ordering; do not divide an aggregated multi-source total by one source's page width. Deriving metadata from a reread adds no extra provider work. It does not solve another concurrent shrink or short nonfinal page; those need their own contract/evidence.
For drift, retain before/after source identities, complete actual DTO comparisons, native SQL/binding checks and all affected callers. Keep absent-cohort checks separate from positive mutation proof and symbolic unit controls. Update the active known-findings queue and batch receipts when these owners change. Historical actual receipts remain immutable; advancing a current hash must say whether that particular proof was rerun.
At existing command owners, validate and acquire the established policy/ownership locks before deciding that normalized domain values are unchanged. Compare derived lifecycle dates too: an unchanged status can still require a missing-start-date repair. Return the current stored result on a true no-op and skip timestamps, derived projection preparation and event/webhook publication together. For conflict-safe membership inserts/deletes, use affected identities from the existing write rather than an unlocked preflight read. The planned game and Up Next repairs verify these rules with native before/after rollback commands on actual retained records.
A performance opportunity does not require a patch. Run its planned comparison, retain adverse results and keep the current owner when the candidate is not a worthwhile improvement. The PJ-09 value guard changes the real diagnostic access path and increases work, so it is rejected; no open-ended search or normal maintenance follows. Separate that decision from missing positive cohorts and actual defects. Agents must execute their own default/candidate acceptance before handing back a verified fix; the coordinator integrates source and common gates. Share CPU/database measurement slots to avoid interference. Complete a finding only when its full required scope is proven; a narrower owner repair remains partial.
Respect the agreed investigation scope. Retain a failed method on the investigation backlog, keep the proven default and stop that method; alternatives require a separately authorized investigation. Prioritize uninvestigated areas before retrying failed methods. Record genuine missing prerequisites separately from measured failures and completed repairs.
A game variant updates only when its parent/provider tuple changes. Keep canonical game and work-feature refresh clocks: feature resolution uses the newest provider observation, so suppressing an equal feature write can change precedence. Verify complete native outputs, keyed feature associations, real structural changes and revision effects; fewer tuple writes do not imply fewer SQL statements or universal latency gains. The game importer’s actual-data matrix is linked in batch25.
Imported Jellyfin listens use the shared music persistence owner to insert at most 100 deterministic occurrence identities per statement, increment progress only for newly inserted rows, and prepare the native webhook event for every returned occurrence in submitted order. Idempotent overlaps must be tested across the 100-row boundary, including webhook association and rollback. The importer still publishes final progress and remote/agreed evidence in its existing transaction. A smaller INSERT does not create a committed checkpoint or bound total transaction work. See the actual-admin execution and deferred methods. Source drift requires rerunning the archived final-source comparison and effect acceptance before renewed adoption; never rewrite frozen receipt manifests to make changed code look tested.
A batching method must preserve the owner's failure and observation boundaries. Source-notification batching is not adopted: fewer statements changed preference timing and which earlier notices survive a later write failure. Do not replace a per-recipient loop with notifyMany solely on statement counts. Bulk task controls similarly require a defined continuation/receipt and frozen-target contract before returning partial work as complete. Keep rejected methods and unavailable provider/media acceptance separate from adopted repairs.
Full music playback queues use one 10,000-track boundary in music/queue.server.ts. Album and saved/Up Next expansion request 10,001 entries; overflow raises explicit 409/queue_too_large before assessment/progress hydration. Never publish a silently truncated queue or change repeat/occurrence ordering. The separately paged unique party picker retains its own contract. Actual boundary/API/resource checks and their limits are in batch25.
An optional administrator-only Jellyfin LAN URL changes the common instanceFetchConfig / instanceTransport upstream for every server-owned API, sync, artwork, reading, playback and party operation. Preserve the public baseUrl, provider identity and account connections. Verify the public server identity on creation, then verify every configured LAN alias against that pin (new instances verify both endpoints); apply the existing administrator allowlist, private-network approval, port, DNS/address and redirect checks. Missing LAN configuration uses the public URL. A configured LAN failure is explicit: do not probe routes per request or silently fall back with credentials. Public/LAN prefixes in playback resources are normalized only for these two verified addresses and the same item. Browser streams and HLS children remain authenticated Coast URLs; never publish the LAN endpoint to ordinary users.
A local Coast→Jellyfin hop is not evidence that the viewer is local. It never selects a local quality preset, trusts forwarded IP headers or raises playback limits. Existing server, personal-account, browser and shared-viewer ceilings apply independently of transport; parties retain each participant’s policy. The actual-data LAN verification checks a high-bitrate video at 1 Mbps, account/server reductions with a 50 Mbps-capable viewer, and Coast-only HLS rewriting. These are policy/route checks, not measured WAN throughput or a hard egress-rate shaper. See the focused delivery report.
The common transport admits at most 128 waiting requests per origin and 512 active plus waiting requests overall. Eight per-origin waiting slots and 32 global slots are reserved for bootstrap/interactive work. A local ProviderQueueBusyError is retryable capacity pressure, never provider unavailability or a reason to clear live observations. It must not consume a webhook's HTTP delivery budget; cumulative claim attempts remain monotonic for fencing. Idle pacing metadata shares one expiry timer. Do not bypass provider spacing or add another queue when admission is full.
Use task-timing.ts for eligibility and due decisions, job-policy.ts for work identity and purpose, and the existing durable outbox for claims and recovery. Never add an adapter-private FIFO that hides requests from the common priority transport. An explicit foreground operation can promote an exact shared resource through providerSingleFlight; this must not promote unrelated work or duplicate the fetch. Current HTTP arbitration is process-local and retains one request per origin, provider spacing, cooldowns and aging.
Queued traversals use jobCheckpoint() only after committing their cursor and effects together, or after an idempotent persisted stage. Workers yield after five committed boundaries or ten seconds at a safe boundary. This is cooperative scheduling, not interruption of an in-flight request or transaction. JobYield is control flow: do not catch it as a provider failure or consume retry attempts. Persist large stable responses outside the bounded action payload; Steam uses job-scoped snapshots and Trakt uses staged records. Recommendation jobs retain only their bounded seed selection and completed-set cursor; do not reselect seeds on resume as saving a set changes freshness. Personal publication must check the active job lease inside its guarded transaction, after account locks.
Measure synthetic fixtures separately from live-provider latency. Test resumption without repeated committed effects, changed account generations, local edits, incomplete pages, cooldown preservation and final-negative publication. Raising priority must not bypass authentication, permissions, rate limits or retry backoff. The Queue waiting reason and order should reflect these same execution rules.
The 20 October shared task implementation follows the 41-handler audit. Dependency scope belongs in server/queue/dependencies.ts: observations may pass unsent mutations, overlapping work/list effects stay ordered, unknown/bulk effects remain conservative, and running work excludes other scoped account workers. Compute heads once with ordered windows; do not rebuild a correlated account bitmap per candidate or join every same-account pair before checking effect scope. Keep worker/task representative eligibility and bounded detail explanations consistent; test their blocked booleans against an independent ordered actual-row reference. Preserve generation, feature-transition, developer pause, cooldown, urgency and lease gates. Before adding a kind, document whether it observes current state, mutates one effect or needs the whole account.
On an approved exact 118,586-row task export, three alternating warm selection pairs give median 10,004.389→170.749 ms. These are temporary-table/JIT-off selection analogues with incomplete live parent context, not complete claims, production shared-buffer timings or provider delivery benchmarks. Retain the adverse join and NULL-head trials. New indexes and worker counts were unnecessary for this result; full concurrency/WAL/worker acceptance remains open.
Bulk task controls select at most 101 IDs and mutate at most 100 through canonical owners; show the cap and more-remain result. Use the shared taskControlLimit in policy, server and UI. Repeated promotion must advance beyond previously promoted jobs; filter known canonical retry conflicts before the bound so a blocked prefix cannot hide other eligible accounts, and report blocked failures separately. Separate bounded selection from a durable all-target command: unexpected failures may retain a committed prefix. Run now reports failed jobs as needing Retry/review rather than healthy active work. Attention takes precedence over running/waiting for terminal failures and sustained classified retries, without stopping automatic recovery or treating local capacity as a provider outage. Aggregate attention across every pending row, count only the affected jobs, and select failing context for display; an eligible representative must not hide another job in backoff. Normalize UUID conflict keys before comparing work/list identities. Preserve Run-now’s distinct newly queued and already-active healthy counts.
Keep recoverable pending/failed snapshots with their cursors; expire only succeeded/cancelled staging under the existing retention budget. A missing partial Seerr page restarts a fresh census, never a slice into an unrelated response. Positive reading observations may precede screen/history reconciliation, but only the complete fenced census proves absence. A single reading 404/410 affects that authenticated account/file; schema/authentication failures remain failures. Persist aggregate counters in the acknowledgement transaction, and publish only truthful outcome scopes. Durable diagnostics admit at most 12 issues × 12 segments, a bounded stage, closed types and public field names; dynamic record keys must be redacted even when they look like identifiers. Raw values and exception bodies never belong there.
The implementation ledger separates real-provider checks, controlled actual-admin states, supplemental guards and absent cohorts. Trakt continuation/receipts, complete claim/provider delivery and several failure schedules remain explicit follow-up work. The original audit's 20 observed and 21 source-only handler distinction remains; neither code coverage nor passing guards closes absent real-data cases.
Local screen, game and reading searches retrieve bounded candidates through native PostgreSQL GIN full-text indexes before hydration. Normalize punctuation consistently in query and indexed documents; do not score the entire catalogue in application code. Only an empty direct result permits a second bounded prefix candidate query. Screen metadata aliases stay indexed and user-specific aliases stay owner-scoped; public search does not read them. SQL relevance and document-length normalization apply before the result limit, while the shared pure search.ts helper ranks hydrated/streamed results with stable ties.
Keep Search's existing local-first streaming and shared Shelf loading. Provider fallbacks run at most once after a successful empty response, retain only relevant broader matches and never retry a failure or bypass cooldowns. Comic series enrichment is bounded and batched, not a request per issue. Resolve registered reading identities together, without fetching details for every search card. Database tests verify the candidate index plan, ranking before limits and private alias isolation.
Normal Read uses the shared launcher and one {source:'linked'} preparation, gated by viewer availability/reader capability in details, menus and planning. Candidate selection is one query capped at twenty, prefers the latest prepared edition then freshest observation, and grants no access: live exact source/version/permission and transactional feature/account checks remain authoritative. Only a true provider 404 permits a freshness/generation-fenced Unknown observation and next-link fallback. Never skip authentication/transient/identity errors or copy progress across editions to make Read succeed. Do not restore per-card discovery calls or a normal file/version chooser. The existing source/local contracts remain separate internal callers.
Books/comics use the same streamed Search, lazy Shelf artwork, bounded hydration, content revisions and provider request lanes. Metadata results do not fan out into per-card detail imports. File readers import only the selected format on open: PDF has its own worker, CBZ/ZIP uses the ZIP decoder, CBR/CB7/CBT loads its self-hosted decoder in one disposable worker only on demand, and EPUB retains one paginated view. Remote comic archives use the shared server manifest/page delivery below, with no configured compressed-input file-size cap. Local comic files keep the cancellable browser source loader: ZIP reads its local blob; native formats extract one bounded page at a time with no extracted-page cache. Terminate local-file workers on close or supersession to cancel synchronous native work; retry through a new owner. Their decoder operation budget is 30 seconds. Physical presentation's separate raster/texture bounds are documented below. Local file identity hashes in a lazy worker. Archive/file/pixel limits are documented in Reading; cancellation and destruction release renderer resources on close/minimize.
Authenticated file HEAD retains fresh item/version checks. Only upstream 405/501 enables a one-byte GET probe, with immediate body cancellation and validated full-length translation; explicit ranges keep their response semantics. Do not let a metadata probe retain the whole file or cache authorization. Actual provider acceptance and authored protocol failures are separate evidence.
Bookmarks coalesce behind one request at a time and close drains the latest position. State transitions journal once; page turns do not add Activity rows. Reading imports commit per-item durable cursors before cooperative queue yields, including skipped files. Source permission and generation checks remain authoritative even with cached shared mappings. Public progress writes reuse scoped, idempotent transactions and durable webhooks. Validate reader lifecycle and party behavior in disposable browser/database fixtures; distinguish these from live file/provider certification.
Reuse the existing authenticated playback relay and pinned provider transport. Shared viewers use durable, owner-scoped bandwidth reservations across all links. Reservation transactions perform database work only; Jellyfin preparations/stops run after releasing transaction locks. Preparation ownership uses UUID tokens rather than round-tripped timestamps, since PostgreSQL timestamps retain finer precision than JavaScript Dates. Fence publication and finally cleanup by that token so an expired worker cannot overwrite its replacement.
Signed HLS resource paths remain stable across bitrate-only provider generations. Validate the viewer and share on each resource, then replace only the upstream session/device/bitrate parameters. Keep codecs, dimensions and segment timing fixed, preserve abort signals and never expose provider tokens. Admission/renewal and delivered-position observations coalesce their writes; do not create an outbox job per segment or fetch upstream data per stream card. Active-stream hydration batches by server, uses keyset pagination and excludes duplicated provider device observations. Failed encoder cleanup remains a durable playback-session flag and retries in bounded lifecycle passes.
Use disposable sharing fixtures for concurrent admissions, revoked/expired grants, cross-viewer resource isolation, replaced source accounts, preparation ownership, retryable cleanup and unchanged personal histories. Separately test actual decoding and bitrate transitions with real players; successful segment HTTP responses alone do not prove uninterrupted playback or strict network bandwidth enforcement.
DATA-09's shared avatar candidate is adopted on normal dev after explicit approval and a private checkpoint; normal rollout and limits record actual conversion, byte/settings/idempotence and signed-in/repeated consumer checks. Smaller serialized settings/social/session DTOs do not establish a faster complete page: account for private image requests, permission reads, filesystem probes, cold/repeated loads, cache policy, cleanup, migration and rollback. Preserve original image bytes and fresh visibility/current-identity checks. Avoid whole-directory foreground cleanup under an account row lock; use known previous asset identities for direct cleanup and separately bound orphan discovery. The reviewed candidate now makes at most four direct format-path attempts and preserves the current identity; its actual proof covers both guards.
A cleanup operation added to an existing timer still needs its own bounded single-flight lifetime and disposal; it must not hold unrelated maintenance scheduling open while file I/O stalls. Preserve failed lifecycle checks and test the stalled external boundary. The candidate's real-data and controlled proofs are separate. Its coupled real-account deletion checks now pass with the separately verified 0064 repair; that migration and the avatar runtime/representation rollout now pass normal source/database/consumer acceptance; whole-page network/resource and absent-format checks remain. No measured whole-page gain is claimed.
Migration0064 is applied on normal dev after the approved checkpoint, standard migration and exact ledger/function/trigger verification. When a deleted user's FK cascade is removing their connections, sync accounts and activity, shared triggers should not build reconnect archives for that disappearing owner or issue one projection deletion per already-owned event. Check the owning row's absence inside the same transaction, preserve normal disconnect/event behavior, and retain FK-driven final cleanup. This repair adds no account-specific or per-medium deletion walker.
Use statement transition tables for cleanup of a deleted set when the final result is the union of per-row removals and no row-order behavior is required. 0064 removes activity reactions once per deleted activity statement. Preserve complete stored values, permission behavior and content revisions. Verify the live trigger/function identities, ordinary paths and DDL rollback, not just the triggering large cascade.
The actual proof independently predicts all remaining values across 99 public tables and every revision row, compares three surviving-owner operations against original functions across 102 tables, executes the exact SQL through the standard Bun Drizzle migrator, and retains the failed/cancelled trials. Two real copied-account avatar deletions also pass. Missing positive reaction/archive/reconnect and wider concurrency/provider cohorts stay explicit. Sampled RSS, controlled deadlines and observation-inclusive copy timings do not establish production tails or the killed backend's peak. Keep the actual-copy destructive proof distinct from the normal checkpointed rollout; never delete a normal account merely to recheck the migration.
Feature choices are explicit subjects, not a process-wide actor cache. Request read models may share one config/subject snapshot only for that request; transaction/publication checks and queued provider admission use current policy. Filter admitted categories/cohorts before counts, ranking, pagination and taste construction. A scheduling actor's personal opt-out cannot disable shared work serving other users. Administrator stream inspection remains independent of optional personal presence.
Off must remove optional resource owners, module consumers, timers and observers, rather than fetching empty results behind hidden UI. Use primitive effective-policy keys with existing cancellation/disposal. Withdrawal uses bounded, resumable outbox cleanup (forty users, one hundred resources/jobs per batch); it must not hold a settings transaction over provider I/O, create another scheduler, or flush disabled-period webhook/reminder backlog on reenabling. Operational stop/revocation remains admitted. Preserve imported positive availability when a medium is skipped, and invalidate scan checkpoints when their medium-policy signature changes.
Feature-gated command transactions acquire coast_lock_feature_policy before their fresh policy decision: shared configuration advisory lock, then shared subject-row lock. Settings writes use the corresponding exclusive lock in global-first order. Keep the lock and decision in separate statements so a waiter receives a fresh READ COMMITTED snapshot. These are local command transactions only; read projections use non-locking predicates, and provider I/O must not be moved into the locked transaction.
When a large event stream repeats the same permission inputs, materialize distinct exact (user_id, section, category) keys from that stream and evaluate the existing authoritative predicates on those keys. Join the permitted unique keys back to the complete stream, preserving null semantics and event multiplicity. Activity uses its existing scoped admitted events where supplied; global Activity derives keys from the complete activity stream. Do not add an early limit, replace privacy predicates with an approximation, or store permission results across requests. The same native statement snapshot and verified STABLE policy functions are the equivalence boundary.
Key completeness and uniqueness are correctness requirements: omitting a policy input can leak visibility, while duplicate permitted keys can multiply events and change grouping/cursors. Keep an independent original per-event permission oracle and actual-data admission checks; verify policy-function stability/definition drift, positive and denied peer/self cases, feature/category/section/friendship changes, explicit IDs and scoped intersections. The maintained Activity guard compares full admitted identities, not merely a shortened first page. Full DTO/browser checks remain separate from that admission oracle.
This technique trades an extra scan/hash for fewer repeated policy evaluations. On the retained actual Activity corpus, 12 keys replace repeated checks across 13,902 events; full all-media/screen owner medians before this Activity repair fall from 9.20/9.40s to 0.93/0.65s with identical complete output and unchanged statement counts. The key aggregate uses 24kB, the works hash peaks at 4,997kB in two batches, and the plan writes/reads 422 temporary blocks each direction. Disclose those costs and small-feed results: the empty relationship scope moves 208→225ms, while actual populated item/artist/explicit-ID/show scopes retain exact outputs. Do not extrapolate a global-feed gain to every item or process memory.
Use root inclusive buffer totals, never add ancestor and child counters. Separate timed native trials from EXPLAIN, retain all adverse samples, and distinguish query execution from full rendered navigation. The parent guard retains its demonstrated fallback-scan reduction. The dated evidence overview records the separate unchanged-source Tasks attribution; no Tasks adoption follows from the Activity repair. Batch27 evidence and acceptance limits.
The friendship acceptance owner now locks both participant policy/user rows in sorted identity order before its friendship row, then revalidates identities and preserves the existing feature checks and error/no-op/cleanup behavior. Steam ownership chunks acquire the existing policy fence before the connection/running-attempt locks. Actual two-session native commands on disposable real-data copies prove the demonstrated user/friendship and user/outbox deletion cycles are removed. The Steam proof covers the extracted native chunk, not full provider bootstrap or the hypothesized account-advisory/connection cycle.
An earlier policy fence can add work: friendship acceptance adds an identity read and two lock-helper calls; every Steam ownership chunk adds one policy query and a user SHARE fence, including warm chunks. Adopt for verified stability, without claiming universal latency improvement. Name the observed cascade blocker from native receipts, preserve ordinary effects, and verify the exact database-object epoch as well as restored table rows. Batch26 evidence.
Run the ordinary verification gates after code changes:
bun run code:inventory
bun run ui:inventory:check
bun run check
bun run test
bun run test:db
bun run buildRun SvelteKit generation/check and production build sequentially in one checkout. They share generated files; concurrent runs can produce different server/client bootstrap identities. Start browser acceptance only after the final build finishes, and restart any fixture server that loaded an earlier build.
test:db requires the create-database-capable TEST_DATABASE_URL described above and isolates each suite. Database tests and lifecycle hooks have a bounded 30-second default so bulk import fixtures and FK cleanup can complete on slower CI runners; this is a correctness-test allowance, not a production latency target. Unit tests and benchmark deadlines retain their own limits. Choose focused tests while iterating, including resource cancellation, content revisions, request priority, journals and benchmark fixtures. Add tests for meaningful regression behavior, not timing thresholds that vary with the host. See verification platform.
For rendering changes, exercise a production build as well as development mode. Record desktop/mobile viewport, browser and device; developer tooling and hot reload affect measurements. Check:
- Initial routes fetch only needed rows; scrolling loads bounded pages on demand.
- Unchanged session polls do not refetch content, empty results are remembered and stale requests cannot repopulate a changed context.
- Navigation/filter changes release resources; repeated open/close and scroll cycles do not accumulate listeners, timers or requests.
- Skeletons match the loaded structure, empty rows disappear after settling and partial provider results stay usable.
- Charts load their renderer on demand, retain one specimen, paginate exact data and leave no renderer mounted after changing sections.
- Playback keeps buffered media usable through transient network failures; seeking, subtitles, crop, audio navigation and party synchronization retain their behavior.
Use network request counts, browser performance traces and repeated lifecycle observations to support findings. Fixture playback tests cannot establish live codec, autoplay, mobile or multi-account party acceptance. Report that evidence separately; see readiness.
Inspect application timings, provider/job activity, browser work and container resources together. RSS includes more than JavaScript heap; cgroup memory can include filesystem cache and PostgreSQL. Compare idle and active workloads over time before attributing growth to a leak. Increasing concurrency, pool size or memory limits without a measured bottleneck can worsen the problem.
The shared Bun SQL pool stays bounded at ten connections, with a ten-second connection timeout and idle retirement disabled. Workers hold session advisory locks while waiting on providers; Bun's idle timer also closes reserved sessions, releasing those locks and producing ERR_POSTGRES_IDLE_TIMEOUT. Do not reinstate idle retirement without verifying reserved-session behavior. database-pool-db.test.ts checks lock ownership across a wait longer than the former thirty-second timeout and release afterward. Explicit pool cleanup uses closeDb; this setting does not suppress query failures or replace durable job retries.
The production image sets IDLE_TIMEOUT=60. A timed-out request is distinct from a stopped process, and a handler log with status 200 does not prove successful delivery to the browser. Capture proxy/client failures and timings before assigning cause.
Unexpected exits retain /data/runtime/child-exits.jsonl and rotated evidence. Application stderr survives restart in /data/runtime/application-stderr.log and .1, bounded to 256 KiB each. These raw operator logs can contain sensitive details; do not include them unredacted in reports or public fixtures. Safe structured exports follow diagnostic logging.
Inspect exit status, signals, build identity, logs around the event and host/container memory evidence from that same period. Counters observed only after recreation cannot establish what happened to an earlier container. A larger timeout or persistent logging improves diagnosis; it does not prove an unexplained process-exit cause has been fixed.
Horizontal Shelf artwork uses the shared lazyImage observer and a separate left-to-right request queue per rail. Only intersecting artwork is queued; horizontal off-screen cards remain deferred. One request runs per rail, while different rails remain independent. Load, error and component teardown release the slot. Grid artwork keeps its existing independent loading. Do not add a page-wide image queue or eager artwork preloads.
Anchored detail rows resolve the next item and its air-date position using lightweight IDs, then hydrate only its sixty-item page. Earlier/later pages use the shared detail source and rail; never fetch all preceding seasons to reach a late episode. Prepending retains the visible card position, and append/loading changes do not reset the rail. The shared source retains its remote page while a segment displays an already loaded finite selection, cancels hidden pending reads and refreshes invalidated data only when needed. Available filters before server pagination; finite selections filter locally. Initial positioning runs once per selected owner/revision, rather than on every scroll or page append.
Fallbacks and artwork source changes reacquire that same rail slot; assigning an unchanged URL is a no-op. Shared progress sources refresh activated shelves only when the content revision or supplied initial payload changes. Metadata readiness and artwork readiness remain independent, and card avatars wait for their artwork to settle.
For You's initial route returns only its hero and next action. Continue uses the shared lazy progress source; section grids skip the home hero query. Hero selection reuses Continue's lightweight page plan and retains saved-history and permitted-Library bounds, then hydrates only the chosen hero. On a disposable PostgreSQL 17.11/Bun 1.4.2 fixture with 1,000 tracked screen works and 100 Library works, one warm-up and five alternating samples measured a homeData median of 50.05 ms before and 16.79 ms after. Hero/next-action payloads matched across six priority, permission and history-bound scenarios. These samples exclude HTTP, parent route loads, browser rendering and provider calls, and are not production latency guarantees. Durable cases live in tests/home-data-db.test.ts.
A complete logical row hash proves restored data values; it does not prove that stored functions, application triggers, indexes or foreign-key/check definitions match the runtime being tested. Before comparing native owners, record these definition hashes through the shared database-object epoch reader, then verify the particular migration semantics the workload depends on. Hash definitions rather than publishing bodies or stored credentials. The helper covers public/drizzle functions, noninternal application triggers, indexes and constraint definitions; it does not certify every PostgreSQL setting, internal-trigger enable state or server binary.
A retained actual-data clone can predate an approved normal rollout. If necessary, apply only the already reviewed migration to a marker-owned disposable copy before both variants, record exact SQL and before/after object epochs, and keep the original clone/normal installation unchanged. Keep old attempts under their actual database epoch; a timeout on obsolete trigger behavior is not an optimization failure or current-runtime performance result. This protocol does not retroactively certify older receipts.
The 17 October app-wide actual-data audit retains pinned baseline coverage, actual installation/query plans, rollback-only real-data probes and signed-in normal-dev journeys. Its implementation ledger separately records current shared fixes, actual-data results, regression evidence and remaining acceptance for every recorded finding/opportunity. Preserve the baseline manifest; use the inventory tool's explicit output/reference options for reviewed implementation snapshots.
After changing an audited owner, run the report integrity check and retain a new source snapshot and acceptance receipt. It checks source/artifact hashes, finding IDs, links, rendered statuses and staged patch applicability; it cannot establish runtime correctness. Preserve failed runs and historical measurements. Updating a current source hash must explicitly say whether the affected actual-data proof was rerun. Keep controlled regression objects separate from actual catalogue/provider evidence, and record absent cohorts without manufacturing them. Freeze source during browser acceptance and verify the snapshot again afterward.
The 15 October cross-feature audit retains seven independent reports, a deduplicated implementation ledger and controlled evidence. Confirmed issues, measurement-gated candidates, policy decisions, acceptance gaps and checked nonissues are separate. An audit entry alone does not authorize deferred restructuring, long-play/native codec acceptance or material redesign; later explicit user decisions and their recorded acceptance define the active scope.
Reference methods: PostgreSQL EXPLAIN and buffer evidence, combining indexed OR conditions, and Page Visibility lifecycle. Browser throttling is not a substitute for explicit ownership and cleanup.
A partial finding can contain an applied fix with wider acceptance still open. Record each prescribed method as adopted, acceptance-only, rejected/default retained, measured keep-current, or awaiting a concrete contract/input. Do not treat all partial records as untouched fixes, or natural absence as a reason to avoid controlled tests over actual admin/catalogue data. The 25th-batch execution reconciliation separates these outcomes. Preference coalescing failed native independent-retry behavior; retain its default and investigate alternatives only after unchecked areas. Guarded unit skips, source pins and compiled derivations never substitute for native real-data or mounted-browser acceptance.
The user deferred PR-02 durable playback recovery and PJ-15 bulk-task command receipts to the design backlog for this run. Their concrete contracts and native test matrix remain unimplemented and untested. No implicit timeout, silent lifecycle loss, new durable storage or changed completion toast is selected by a performance pass. Resume these only through a new explicit decision; the existing task query/index pair remains unchanged.
Earlier cross-feature audit, implementation evidence and raw measurements retain their own controlled-fixture boundaries. Keep historical receipts immutable; update current source pins and handoff status through the linked maintenance protocol.
The public audit evidence protocol separates committed source/numerical proof from private actual-user state and content. Unpack the checked portable archive before inspecting historical artifact links; verify projection hashes and report omissions explicitly. Repackaging is not native performance revalidation.
The physical presentation is demand-loaded only when a PDF or comic is opened. Three.js is outside the normal route entry. EPUB keeps its native reflow renderer. Coast keeps authorization, decoding limits, sessions, bookmarks and party revisions; the model receives canvases and presentation callbacks only.
The adapter retains an LRU of at most eight canvas promises (each raster's longest dimension is at most 2048). The model retains its four cover faces, a 12-face neighborhood around current/required spreads, and faces used by at most four cascading turns. Old textures are disposed when these requirements move. Two nested visible sheets per side and a fixed pool of four turning meshes reuse their geometry. Speculative decoding is serial, stops admitting work while document-hidden and resumes on visibility; it never queues the entire archive's pixels. Local-file comic inspection remains a sequential extraction/decode pass; its shared physicalImage owner returns dimensions without allocating/drawing a canvas. Remote comics receive the full version-bound dimensions from the server and perform zero inspection image decodes in the browser. It closes successful and late-aborted bitmaps. Coast keeps its existing pixel/2048 scale bounds; the local lab passes its separate existing pixel policy explicitly. Do not duplicate this lifetime or silently change a consumer's admission policy.
The user preference Sanitize odd page counts defaults on, preserving intentional final-face trimming and original last-face location semantics. Capture it once per reader open through the shared ReaderOptions/layout owner. Off retains every scan/half and inserts unprinted faces for an even, minimum-four-face binding before the actual back cover/final wraparound pair. This is a presentation choice, not a performance claim. Blanks have no source location; page totals stay original. Real-content comparisons must verify every old printed pixel in order, any restored actual tail, truthful locations and independently decoded outside back cover. Blind whole-output equality across different approved policies is not the correct oracle; silently dropping changed pixels is not acceptable either.
Remote comics use reading/cache.server.ts, delivery.server.ts and reader/remote-comic.ts. One authorized source acquisition streams to private temporary disk and the isolated libarchive helper; CB7 downloads first because its native decoder requires seekable input. Sharp reads supported image metadata, including orientation. Original encoded pages remain unchanged. Publish a cold manifest only after complete order/dimension, expansion, extraction and ZIP-index checks. Update inspection counts on every verified page, including metadata that trails acquisition; notification alone must not repeat the initial count. The browser maps the original scans through the existing shared layout/odd-page policy, then requests its normal raster neighborhood. Simultaneous halves coalesce at most eight in-flight page operations; the last cancelled subscriber aborts that request. Encoded pages are not retained in a second browser cache, and streamed bytes cannot exceed the verified page size.
The cache key includes provider instance, exact external file, edition and format. A key is never permission: each manifest/page operation checks the owning session, current user/category/feature/account generation and live provider item/version. Long acquisition rechecks before publishing the manifest. Party participants keep independent source grants while sharing acquisition/encoded bytes. Page requests do not write progress, history or room state. No whole-file browser fallback hides server failures.
One process owns a dedicated local cache root. Do not share COAST_READING_CACHE_DIRECTORY between simultaneously running Coast processes: startup removes that owner's abandoned run-UUID directories. This is not a distributed cache. Reserve at most 8 GiB total temporary space, including source bytes plus the existing 512 MiB expansion allowance per preparing archive; leave a 512 MiB filesystem floor. Check all concurrent reservations, conservatively including materialized bytes already counted by the filesystem; checking only each caller's added bytes permits overcommit. Admit at most two preparations and 64 session leases globally, with at most eight active delivery leases per account. Cold preparation uses the global pool without an additional one-per-account gate, so normal reopen/switch is not rejected by an unrelated preparation for that account. Renewal and coalescing an already-preparing source remain allowed; closing/expiry returns admission. The bounded account lease check reuses the existing map, with no new query, queue or poller. Recheck admission after asynchronous idle eviction before starting a job; concurrent requests must not consume a stale remaining slot. Idle leases expire after three minutes, swept every 30 seconds; foreground heartbeats renew them. Closing the last lease cancels unfinished preparation and drains its writers. Successfully completed encoded pages remain shared for 30 minutes after the last lease closes, including their disk/metadata charges. Reopening or another authorized reader reuses those pages without downloading the archive again. Bound active plus idle entries at 64; evict the oldest idle entries under disk/free-space/metadata/count pressure, never an active reader. Expiry marks entries unavailable immediately and schedules cleanup without blocking unrelated page reads; eviction under pressure and shutdown await cleanup. Files are removed before returning reservations. Minimize disposes the renderer while its lease expires naturally if not resumed. Restart/server-module replacement clears this temporary cache.
Exact-version manifest records retain only page metadata/hashes for 30 minutes, bounded by 64 records, 100,000 pages and 16 MiB estimated metadata. Active metadata has a separate 32 MiB estimated accounting limit. These are accounting estimates, not hard process-heap limits. Retained metadata verifies reacquired page hashes, dimensions and byte sizes; the browser manifest stream publishes only when preparation is complete. A metadata-only hit must keep streaming real preparation progress rather than hiding an ongoing archive transfer behind render readiness. Failed preparation evicts its record and releases leases. Completed page-cache hits avoid archive transfer; after byte expiry/eviction a new transfer is required. Per-entry/page/pixel policies remain 10,000 entries, 512 MiB expanded, 32 MiB encoded page and 32 Mi pixels; total disk admission is not an arbitrary restored per-file transfer cap.
The native helper has a 30-second CPU budget and Linux 512 MiB address-space limit; macOS lacks that address-space enforcement. Provider streaming keeps the existing 30-second idle bound and cancellation. Sharp metadata runs in the coordinator, so neither metadata estimates nor the extractor's limit prove a hard process-tree memory bound. Image signatures are admitted before invoking sharp; unsupported/encrypted/damaged containers fail explicitly. Increased disk writes, cold full-manifest latency, additional per-page authorization/provider calls and the two-preparation admission limit are explicit costs. A comic source verification must also fetch the token-owned Jellyfin /Users/Me policy, match the pinned server identity, reject disabled users and require EnableContentDownloading:true. Visible item metadata alone never grants download access to bytes acquired under another token. This adds one fresh provider policy request per source verification; do not hide this authorization cost behind a cross-request cache. Treat adapter identity/permission errors as withdrawal too: release the reader’s existing lease so heartbeats cannot pin a denied source indefinitely. Raw document relay requests still exercise the current token’s real Download endpoint. Every page rechecks its live reader/session/source generation and download policy after admission and page lookup, immediately before response construction, including completed cache hits. A previously finished entry cannot skip this check: admission itself yields and may recreate a lease after close. This deliberately costs two source verifications per page (two item metadata and two token-owned policy reads), rather than weakening revocation for warm-cache speed. PDF keeps its selected-page range renderer; EPUB and browser-local files retain their existing owners. See Reading for packaging, operation and verification commands.
Physical-reader entry constructs the closed binding from its two outside covers first. Start the entrance before waiting for inside-cover/opening-spread rasters; load only those required faces alongside the motion. Keep speculative neighbors behind this entry barrier, then use the existing one-at-a-time preloader and bounded retention. Opening either cover must explicitly await its own inside face; never expose blank placeholders or warm every page in the document. Complete cold manifest/indexing remains a separate prerequisite. Verify a real-file interior stall still permits a visible cover, plus both-cover opening, saved/followed locations, cancellation and reduced motion.
Dim and blur use separate pointer-transparent backdrop layers with 250 ms opacity transitions, leaving the physical book unchanged. Blur joins only at render preparation; both layers leave after the engine exit. Respect reduced motion with zero-duration fades. Animate layer opacity rather than the full-screen blur radius, and let the component transition own retention/cleanup without another timer or animation loop.
Normal physical-reader close/minimize uses the same registered engine exit before disposal, reusing the entrance pose in reverse. Suppress presentation-only close callbacks from bookmarks/party commands. Failed bookmark saves retain the visible reader; account/feature withdrawal skips optional animation. Pending load/turn cancellation stays immediate. Track animation frames/promises under renderer disposal and settle them when hidden; reduced motion schedules no optional frames. Test ordinary close, backdrop/Escape, minimize, replacement, duplicate exit, interrupted teardown and no saved-location drift.
Resting views render on demand. Animation frames exist only during gestures/transitions; hidden documents skip drawing. Minimize, replace and close abort the owner and release decoders, workers, observers, pointer/wheel/visibility subscriptions, pending turn waiters, geometry, materials, textures and the WebGL renderer. External party locations wait for a safe settled view, serialize and discard superseded queued work without echoing saves. These are structural bounds, not a measured device memory plateau or frame-rate claim. The integration tests cover cancellation, late setup, cascade admission, canonical locations and read-only followers; actual-content browser observations and remaining acceptance are recorded separately.
Register each allocation's cleanup during construction, before a later callback/append/initial render can reject. One idempotent reverse-order registry handles rejected factories and successful disposal; remove event subscriptions before explicitly losing the WebGL context. Actual-raster injected failures must leave zero tracked contexts/canvases/observers/listeners. Prompt context release can cost more synchronous teardown time; record that tradeoff rather than claiming a universal speed win. Count limits and post-decode pixel admission do not prove peak decoded-byte/GPU memory bounds.
The focused receipts separate four-pair pre-padding inspection timings from final policy acceptance, normal live delivery and software-GPU lifecycle tests. Inspection removes 24–33 canvas/draw operations/file; final single-pair timings include an adverse input. Native micro-batching was reverted despite fewer packets because full entry was adverse. In that historical browser-only implementation, minimize released the compressed blob, so resume downloaded again; all five sampled natural CBZs exceeded the former 128 MiB cap, removed in the later loading follow-up. Whole-file retention still grows with archive size. Follow the focused checklist before adding session caches, changing extraction budgets or a server page service.
Loading feedback shares one optional progress callback from the existing transfer/inspection/renderer owners. Report real bytes/pages, keep unknown totals indeterminate, fence late callbacks by the current reader signal/session, and remove the visible indicator only once the outside cover rasters and renderer are ready for the entrance, before blurring only the app backdrop. Keep an indeterminate opening indicator during cover delivery/decode after manifest acquisition. A fast completed-cache hit may make feedback brief; never add an artificial minimum delay. Never use guessed timing percentages or add another download to measure progress. The later reading acceptance verifies settings persistence, Activity/presence and native party/sharing boundaries on actual data. Admin operational reading rows reuse existing reader sessions with feature/category/account freshness, bounded lookahead and the existing stream cursor; page counts are not playback seconds. History complements the live heartbeat/source predicate, including null source states, with last-observed display ends for stale/withdrawn sessions; fresh observations return to Now. No additional poller or history writes are introduced.
The earlier automatic full-archive party-download decision is superseded for remote comics by the shared server delivery above. Local-file/EPUB/PDF ownership remains format-specific. The delivery roadmap distinguishes this implementation from selective upstream range loading, missing natural formats and device/resource investigations still deferred.
Use native framework APIs at the shared owner: asynchronous shallow navigation must preserve parent/child history ordering, viewer/address ownership and scroll/focus. Refresh must preserve an open overlay and may not steal a pending navigation's ownership. Skip full-route animation/dirty-form side effects for shallow Back/Forward as well as goto. Readonly page URLs must be copied before mutation. Keep framework/application/validation errors distinct from unexpected failures.
Runtime ORIGIN remains the exact configured browser origin for a reusable Coast image; do not infer LAN/WAN from a hostname or automatically trust forwarding headers. The official Bun adapter and Kit client each have a pinned maintained patch plus an installed-source build guard. Run bun run adapter:check, bun run navigation:check, the installed-source contracts/schedules, normal project checks and actual-data/browser acceptance before changing these owners. Review upstream behavior first; updating version/hash constants alone is not verification. See the Kit 3 record for stock-versus-patched evidence and limits.
For You hydrates its administrator-selected hero IDs in one batch of at most 20, preserving exact identities and selection order. Only the first item's next-playable action is eager; subsequent active group actions use the existing on-demand playable read. A keyed action menu prevents one hero's snapshot or pending action from leaking into another. Feature-list edits run under the existing configuration advisory lock, including their read/modify/write operation. There is no hero refresh poller or per-card feature lookup.
The shared presentation owns one pausable phase deadline and one active-title trailer lookup, admitted only while visible and permitted. The cycle is 5 seconds of artwork → full trailer → 5 seconds of artwork; without a trailer, artwork lasts 10 seconds total. A pending trailer/plugin analysis keeps artwork visible beyond the initial five seconds. Trailer startup has a 30-second failure bound, released by the playing event; successful trailers have no duration cap. End/error returns to artwork. Visibility, foreground playback/reader/detail coverage, focused controls and reduced motion gate the deadline. Identity change/disposal aborts discovery and cancels the phase and transition work. Each hero renders and clips its own video in normal page flow; scrolling requires no video-position listener or animation frame. Its existing ResizeObserver supplies dimensions for crop fitting. Discovery requests the URL and companion crop during the initial artwork window. As soon as that descriptor arrives, the active inline video attaches with automatic preload and fits the crop after metadata, while playback stays gated until the five-second artwork deadline. Only the current visible, permitted hero admits this preparation; later carousel items are not prefetched. The source releases on post-trailer artwork, identity change and disposal, while ordinary offscreen trailer pauses retain its position. Controlled clock tests cover deadlines and failures; compiled mounted-owner tests cover media completion, visibility pause/resume, exact active identities and cleanup. These are behavior/resource checks, not a measured runtime speedup.
The authenticated companion endpoint supplies crop rectangles for trailers, movies and episodes; its existing TrailerCrop route accepts any video item ID. Coast normalizes the rectangle against the selected source dimensions and includes it in trailer/startup data before playback. Inline heroes wait for both video metadata and valid hero dimensions, then flush the fitted crop styles before play, without browser frame sampling. A failed source cannot mark itself ready again. Integrated controller tests cover descriptor arrival during artwork, delayed crop data under an overlay, buffering without early playback, crop fitting, pause/resume without reload, item transition preparation, and decoder/observer/timer cleanup. Full playback uses the plugin crop when supplied and retains its existing browser detector only as an optional-plugin fallback. Manual hero pause pauses the video in place and fades artwork over it; resume fades that overlay away without hiding or reloading the video. Playback position and crop remain intact. Item navigation decodes only the requested artwork and logo before fading the copy/actions and crossfading the old and new artwork over 450 ms. Navigation controls remain steady, superseded preparation is cancelled, and reduced motion removes the fades. Missing/disabled/failed plugin analysis never grants media access or prevents ordinary playback; existing transport/account/source checks still apply. No extra application crop cache or poller is added.
The expanded 22 October actual-data audit records executed coverage across all nine follow-up streams, the Library navigation/preview regressions, safe receipts and the precise input/device/contract gaps. Use its case matrix and reproduction protocol when refreshing acceptance; the original HTML report is historical.
The independent continuation adds two-stage reading Search and source-scoped TMDB invariant metadata caching. Keep primary and complete Search ownership separate: partial matches remain visible under existing loading state; complete results retain exact ranking, deduplication and paging. A valid complete cache snapshot must be reused before starting an earlier primary stage. Every cache read checks current source/credential identity; expiration, rotation and disable are regression cases. A route abort stops obsolete caller hydration/publication; shared bounded public-metadata work may finish for cache consumers. Do not couple a viewer abort to another viewer's shared metadata request.
Recheck current feature choices when producing remote reading cards and after merging streamed local/provider results. A withdrawn saved identity must not fall through to an unrestricted remote preview. Source-change errors remain distinct from outages: unavailable connections are 404, and a rejected stale music observation is 409. Repeat the genuine held-response, restore/retry and reading downgrade regressions for these owners. The continuation records real published EPUB/PDF engine checks, additional desktop engines, current SQL rejection, finite concurrent browsing, safe receipts and explicit remaining inputs; none substitutes for physical-device or production-capacity acceptance.