test(web): harden primary-action ownership regressions

Refs #247 Co-Authored-By: OpenAI Codex <codex@openai.com>
refactor(web): replace primary-action events with context
2026-07-15 22:36:16 +02:00 · 2026-07-15 22:31:31 +02:00
554 changed files with 5768 additions and 118024 deletions
@@ -1,12 +1,54 @@
 #!/usr/bin/env bash
-# ersatztv#521 — the line-level append-only mechanic is retired. Decision integrity is now enforced by
-# the lifecycle validator. `[decisions-edit]` survives ONLY for rationale-prose edits (validator
-# body-diff, CI). This shim runs the structural validator over the working tree; the body-diff/no-
-# vanish checks run in CI where a base/head is available. Fail-open on any tooling trouble.
-set -uo pipefail
-cd "$(git rev-parse --show-toplevel)" || exit 0
-command -v python3 >/dev/null 2>&1 || exit 0            # no python -> fail-open
-PYTHONPATH=. python3 scripts/decisions_validate.py
-rc=$?
-[ "$rc" -eq 1 ] && exit 1                               # only a real validation failure blocks
-exit 0                                                  # crashes/other codes -> fail-open
+# ersatztv#303 H9 — docs/decisions.md is append-only. This blocks a commit / PR that DELETES or
+# MODIFIES an existing line of that file; pure INSERTIONS anywhere are always allowed (adding a new
+# entry inserts a TOC line near the top AND appends a block at the bottom — both are insertions, so
+# numstat reports 0 deleted lines). A genuine factual fix to a past entry is the one legitimate edit:
+# put the literal token [decisions-edit] in the commit message to override.
+#
+# Fail-open: any tooling trouble (unknown mode, non-numeric numstat, missing refs) -> allow. The point
+# is to catch the accidental rewrite-history case, never to wedge a legitimate commit.
+#
+# Assumes decisions.md ends with a trailing newline (it does; .editorconfig enforces it). If that final
+# newline were ever dropped, git would render the next append as a modify of the last line (deleted=1)
+# and this would false-block the append until the author adds [decisions-edit] — cheap and self-correcting.
+#
+# Modes:
+#   staged <msgfile>       pre-commit/commit-msg — staged diff vs HEAD; trailer read from <msgfile>
+#   range  <base> <head>   CI (PR) — merge-base diff base...head; trailer scanned across base..head msgs
+set -euo pipefail
+
+FILE="docs/decisions.md"
+mode="${1:-}"
+
+case "$mode" in
+  staged)
+    deleted=$(git diff --cached --numstat -- "$FILE" 2>/dev/null | awk '{print $2}' | head -1)
+    msg=$(cat "${2:-/dev/null}" 2>/dev/null || true)
+    ;;
+  range)
+    base="${2:-}"; head="${3:-}"
+    [ -n "$base" ] && [ -n "$head" ] || exit 0          # missing refs -> fail-open
+    deleted=$(git diff --numstat "$base...$head" -- "$FILE" 2>/dev/null | awk '{print $2}' | head -1)
+    msg=$(git log --format='%B' "$base..$head" 2>/dev/null || true)
+    ;;
+  *)
+    exit 0                                              # unknown mode -> fail-open
+    ;;
+esac
+
+# Empty (no change to the file) or '-' (binary) -> treat as 0 (fail-open / nothing to guard).
+deleted="${deleted:-0}"
+case "$deleted" in ''|*[!0-9]*) deleted=0 ;; esac
+[ "$deleted" -gt 0 ] || exit 0                          # pure insertion / no change -> allow
+
+# Explicit override for a documented factual fix.
+if printf '%s' "$msg" | grep -qiF '[decisions-edit]'; then
+  exit 0
+fi
+
+{
+  echo "decisions-guard (ersatztv#303 H9): docs/decisions.md is append-only — this change deletes/modifies ${deleted} existing line(s)."
+  echo "  Append new entries at the bottom (plus a TOC line in the Index); do not rewrite settled entries."
+  echo "  To fix a genuine factual error in a past entry, add the token [decisions-edit] to the commit message."
+} >&2
+exit 1
@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-# design-sync-reminder — single hook, both directions (#388). Keeps the Claude Design project
-# (`ChicoryTV Design System`, eb3b6122 / local mirror `design-system/`) in step with the shipped
-# SPA. Trigger is PURELY MECHANICAL: "touching the UI" == a file matching UI_RE below. No prompt
-# keyword guessing. Wired to two boundaries:
-#
-#   start   (PreToolUse / Write|Edit) — the FIRST time this session edits a UI file, remind to PULL
-#                                       the current design from Claude Design first.
-#   finish  (Stop)                    — if the working tree actually changed a UI file, remind to
-#                                       MIRROR/PUSH the change back before wrapping up.
-#
-# UI_RE is the one place the "what counts as UI" fileset is defined: SPA .tsx/.css under web/src
-# (test files excluded). Widen it here if the design surface grows.
-#
-# Fail-open: any parse trouble / non-match → emit nothing, exit 0. Throttled once per session per
-# phase so it informs without nagging. DesignSync runs only from the main session (docs/design-sync.md).
-# This is a reminder, never a hard gate — `start` only injects context; `finish` is a one-shot Stop nudge.
-set -euo pipefail
-
-UI_RE='(^|/)web/src/.*\.(tsx|css)$'
-TEST_RE='\.test\.(tsx|ts)$'
-
-phase="${1:-}"
-input=$(cat)
-me=$(printf '%s' "$input" | jq -r '.session_id // "nosess"' 2>/dev/null || true)
-cwd=$(printf '%s' "$input" | jq -r '.cwd // ""' 2>/dev/null || true)
-[ -z "$cwd" ] && cwd="$PWD"
-marker="${TMPDIR:-/tmp}/ctv-designsync-${phase}-${me}"
-
-case "$phase" in
-  start)
-    fp=$(printf '%s' "$input" | jq -r '.tool_input.file_path // ""' 2>/dev/null || true)
-    [ -z "$fp" ] && exit 0
-    printf '%s' "$fp" | grep -qE "$TEST_RE" && exit 0     # skip test files
-    printf '%s' "$fp" | grep -qE "$UI_RE" || exit 0        # not a UI file → nothing
-    [ -f "$marker" ] && exit 0
-    : > "$marker" 2>/dev/null || true
-    read -r -d '' MSG <<'EOF' || true
-[design-sync #388] About to edit a ChicoryTV SPA UI file. The `design-system/` prototypes mirror the Claude Design project (eb3b6122). If you're changing how a screen LOOKS, first PULL its current prototype from Claude Design so you start from the live design (docs/design-sync.md, pull = DesignSync list_files/get_file → design-system/, incremental). You'll be reminded to MIRROR the change back when the task finishes. DesignSync runs only from the main session.
-EOF
-    jq -n --arg m "$MSG" '{hookSpecificOutput:{hookEventName:"PreToolUse",additionalContext:$m}}'
-    exit 0
-    ;;
-  finish)
-    # Did this turn actually change a UI file? (tracked diff vs HEAD + untracked, minus tests)
-    changed=$( { git -C "$cwd" diff --name-only HEAD 2>/dev/null; git -C "$cwd" ls-files --others --exclude-standard 2>/dev/null; } | grep -vE "$TEST_RE" | grep -E "$UI_RE" || true )
-    [ -z "$changed" ] && exit 0
-    [ -f "$marker" ] && exit 0
-    : > "$marker" 2>/dev/null || true
-    n=$(printf '%s\n' "$changed" | sed '/^$/d' | wc -l | tr -d ' ')
-    reason="[design-sync #388] This task changed ${n} SPA UI file(s) under web/src. Before wrapping up, MIRROR the visual change into the matching design-system/templates/chicorytv-admin/*.jsx prototype and push it to Claude Design (eb3b6122) in this same session, per docs/design-sync.md — so the design system does not drift from prod. If you already synced, or are deliberately deferring the mirror (say why), just note it and stop. DesignSync runs only from the main session. This one-shot reminder won't fire again this session."
-    jq -n --arg r "$reason" '{decision:"block",reason:$r}'
-    exit 0
-    ;;
-  *)
-    exit 0
-    ;;
-esac
@@ -1,43 +0,0 @@
-#!/usr/bin/env bash
-# H13 (ersatztv#416 session) — refuse to push when a file in the pushed diff still has UNCOMMITTED
-# changes in the working tree or index. That is the "I left part of my intended change behind"
-# failure: a fix edited into the working file but never committed (e.g. after a `git reset --soft`
-# that re-staged a stale index) gets pushed WITHOUT the fix — while local tests and a working-tree
-# review both see the fix that never shipped. This bit the #416 session: a `--no-renames` review fix
-# lived only in the working tree, so the pushed commit, CI, and the first re-review each saw a
-# different tree, and a PR went out still carrying the bug the review had "confirmed" fixed.
-#
-# Scope is deliberately PRECISE to keep false positives near zero: it blocks only when a dirty
-# tracked file is ALSO part of this branch's diff vs origin/main. Unrelated uncommitted scratch in a
-# file the push doesn't touch is fine; untracked files are ignored.
-#
-# Fail-OPEN on anything we can't decide (a git pre-push hook has no "ask"): not a git repo, offline /
-# no origin/main, HEAD unresolved -> allow. Deliberate escape: ETV_ALLOW_DIRTY_PUSH=1.
-set -uo pipefail
-
-[ "${ETV_ALLOW_DIRTY_PUSH:-}" = "1" ] && exit 0
-git rev-parse --git-dir >/dev/null 2>&1 || exit 0
-
-# Files with uncommitted changes vs HEAD — unstaged AND staged-but-uncommitted, tracked only.
-dirty="$( { git diff --name-only; git diff --cached --name-only; } 2>/dev/null | sort -u )"
-[ -z "$dirty" ] && exit 0   # clean tree -> nothing to guard
-
-# The set of files this branch introduces vs origin/main (the "pushed diff"). Best-effort fetch;
-# if origin/main is unavailable we cannot scope precisely -> fail open rather than over-block.
-git fetch origin main --quiet 2>/dev/null || exit 0
-git rev-parse --verify --quiet origin/main >/dev/null 2>&1 || exit 0
-pushed="$( git diff --name-only "origin/main...HEAD" 2>/dev/null | sort -u )"
-[ -z "$pushed" ] && exit 0
-
-# Intersection: dirty files that are part of the pushed diff.
-both="$( comm -12 <(printf '%s\n' "$dirty") <(printf '%s\n' "$pushed") )"
-[ -z "$both" ] && exit 0
-
-branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)
-echo "husky - push blocked (H13): '$branch' has UNCOMMITTED changes to file(s) that are part of"
-echo "  what you're pushing — the pushed commit does NOT match your working tree, so a local fix"
-echo "  or review may be shipping without its change (the #416 index/worktree trap):"
-printf '%s\n' "$both" | sed 's/^/    /'
-echo "  Commit them (or 'git checkout --' to discard), then push. If the difference is intentional"
-echo "  and unrelated, bypass with: ETV_ALLOW_DIRTY_PUSH=1 git push"
-exit 1
@@ -1,99 +0,0 @@
-#!/usr/bin/env bash
-# PreToolUse / Bash — deny `git commit` / `git push` when a .cs file this branch touches carries a
-# UTF-8 BOM. `.editorconfig` sets charset=utf-8 (no BOM), and the #311 fix-as-you-touch gate
-# ("Formatting (changed .cs conform to .editorconfig)") FAILS THE PR for any touched file that has one.
-#
-# Why a hook and not a note: the ~2500 legacy .cs files carry a BOM, so it becomes *your* problem the
-# moment you touch one — and the usual ways of touching them re-add it silently. Python
-# `io.open(..., encoding='utf-8-sig')` WRITES a BOM back; perl/sed round-trips preserve it. On
-# 2026-07-17 this cost two separate sessions a red CI job on the same day (PR #405 x6 files;
-# #70/PR #402 x19), and a memory describing the trap did not prevent either — the second session
-# re-added a BOM an hour after writing that memory down. A check that runs is worth more than one you
-# have to remember.
-#
-# Generated files are excluded: dotnet format skips *.Designer.cs and TvContextModelSnapshot.cs as
-# generated code, and so does the CI verify, so `dotnet ef` may leave its BOM there.
-#
-# Fail-open by design: any parse/lookup trouble → allow (exit 0, no output). This gate must never be
-# the reason a commit can't happen; CI is still the backstop.
-set -uo pipefail
-
-input=$(cat)
-cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || true)
-[ -n "$cmd" ] || exit 0
-
-# Only gate real `git commit` / `git push` invocations (allowing global flags like `git -c x=y commit`).
-# Matched in command position so the words inside a commit message or an echo never false-trip.
-printf '%s' "$cmd" \
-  | grep -qE '(^|[;&|(]|&&|\|\|)[[:space:]]*git([[:space:]]+-[^[:space:]]+([[:space:]]+[^[:space:]]+)?)*[[:space:]]+(commit|push)([[:space:]]|$)' \
-  || exit 0
-
-# Which tree does this act on? Commits here are typically `cd <worktree>` followed by git, and the
-# harness resets the shell cwd between calls, so an in-command `cd` is the most reliable signal.
-# Fall back to the payload cwd, then the project dir.
-dir=$(printf '%s' "$cmd" \
-  | grep -oE '(^|[;&|(]|&&|\|\|)[[:space:]]*cd[[:space:]]+[^;&|)]+' \
-  | tail -1 | sed -E 's/.*cd[[:space:]]+//; s/[[:space:]]+$//' | tr -d "\"'" || true)
-if [ -z "${dir:-}" ] || [ ! -d "$dir" ]; then
-  dir=$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)
-fi
-if [ -z "${dir:-}" ] || [ ! -d "$dir" ]; then
-  dir="${CLAUDE_PROJECT_DIR:-$PWD}"
-fi
-
-root=$(git -C "$dir" rev-parse --show-toplevel 2>/dev/null) || exit 0
-
-# Scoped to this repo — the .editorconfig rule it enforces is ours.
-case "$root" in
-  *ersatztv*) ;;
-  *) exit 0 ;;
-esac
-
-# The touched set: what this branch changes vs origin/main, plus anything staged or dirty right now
-# (a commit can introduce a BOM that isn't in the pushed diff yet).
-base=$(git -C "$root" rev-parse --verify --quiet origin/main 2>/dev/null || true)
-{
-  [ -n "$base" ] && git -C "$root" diff --name-only --diff-filter=ACM "$base"...HEAD -- '*.cs' 2>/dev/null
-  git -C "$root" diff --name-only --diff-filter=ACM --cached -- '*.cs' 2>/dev/null
-  git -C "$root" diff --name-only --diff-filter=ACM -- '*.cs' 2>/dev/null
-} | sort -u > /tmp/.bom-guard-files.$$ 2>/dev/null || { rm -f /tmp/.bom-guard-files.$$; exit 0; }
-
-bad=""
-while IFS= read -r f; do
-  [ -n "$f" ] || continue
-  case "$f" in
-    *.Designer.cs|*TvContextModelSnapshot.cs) continue ;;
-  esac
-  p="$root/$f"
-  [ -f "$p" ] || continue
-  if [ "$(head -c3 "$p" 2>/dev/null | xxd -p 2>/dev/null)" = "efbbbf" ]; then
-    bad="${bad}  ${f}"$'\n'
-  fi
-done < /tmp/.bom-guard-files.$$
-rm -f /tmp/.bom-guard-files.$$
-
-[ -n "$bad" ] || exit 0
-
-reason="Blocked: these .cs files carry a UTF-8 BOM, which .editorconfig forbids (charset=utf-8). The #311 Formatting CI job fails the PR for any file this branch touches that has one:
-
-${bad}
-Strip it, then re-run this command:
-
-  python3 - <<'EOF'
-  import subprocess
-  def g(*a): return subprocess.run(['git','diff','--name-only',*a,'--','*.cs'],
-                                   capture_output=True, text=True).stdout.split()
-  # same detection set as the guard: branch diff + staged + dirty (a brand-new staged
-  # file is exactly what fires the deny and is absent from origin/main...HEAD)
-  fs = set(g('origin/main...HEAD')) | set(g('--cached')) | set(g())
-  for f in sorted(fs):
-      try: b = open(f,'rb').read()
-      except OSError: continue
-      if b[:3] == b'\xef\xbb\xbf':
-          open(f,'wb').write(b[3:]); print('stripped', f)
-  EOF
-
-Usual cause: an edit that rewrote a legacy file preserved its BOM — Python io.open(..., encoding='utf-8-sig') WRITES one back; sed/perl round-trips keep it. Touching a legacy file makes its inherited BOM yours to remove (docs/contributing.md; ersatztv#311). Generated *.Designer.cs / TvContextModelSnapshot.cs are exempt and not listed here."
-
-jq -n --arg r "$reason" '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:$r}}'
-exit 0
@@ -14,11 +14,6 @@
            "type": "command",
            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/pretooluse-worktree-guard.sh\"",
            "timeout": 10
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/pretooluse-bom-guard.sh\"",
-            "timeout": 10
          }
        ]
      },
@@ -51,16 +46,6 @@
            "timeout": 15
          }
        ]
-      },
-      {
-        "matcher": "Write|Edit|MultiEdit",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/design-sync-reminder.sh\" start",
-            "timeout": 10
-          }
-        ]
      }
    ],
    "PostToolUse": [
@@ -74,17 +59,6 @@
          }
        ]
      }
-    ],
-    "Stop": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/design-sync-reminder.sh\" finish",
-            "timeout": 10
-          }
-        ]
-      }
    ]
  }
 }
@@ -3,7 +3,7 @@
  "isRoot": true,
  "tools": {
    "jetbrains.resharper.globaltools": {
-      "version": "2025.3.4.1",
+      "version": "2025.3.0.2",
      "commands": [
        "jb"
      ],
@@ -106,17 +106,13 @@ ij_json_wrap_long_lines = false
 dotnet_diagnostic.ca1848.severity = none

 # --- Static-analysis pack adoption (ersatztv#15) ---
-# Threading analyzers and Roslynator / SonarAnalyzer / Meziantou / AsyncFixer are enabled centrally.
-# Default their diagnostics to `suggestion`; the SDK's exact per-rule suggestion baseline lives in
-# eng/analyzers/sdk-all-suggestion.globalconfig because AnalysisLevel=latest-All otherwise injects
-# exact warning severities that outrank this bulk setting. High-value rules are promoted one at a
-# time. Explicit per-rule severities (e.g. ca1848 above) take precedence over both baselines.
+# Roslynator / SonarAnalyzer / Meziantou / AsyncFixer are referenced centrally
+# (Directory.Build.targets). Default every analyzer diagnostic to `suggestion` so the new
+# packs don't fail the TreatWarningsAsErrors build; high-value rules get promoted to
+# warning/error one at a time (see ersatztv#15 / docs/contributing.md). Explicit per-rule
+# severities (e.g. ca1848 above) still take precedence over this bulk default.
 dotnet_analyzer_diagnostic.severity = suggestion

-# A collection count can never be negative. Treat comparisons that therefore collapse to a
-# constant as errors; the first promotion caught a busy/idle branch that was permanently busy.
-dotnet_diagnostic.S3981.severity = warning
-
 # Blazor components: analyzers run on .razor/.cshtml @code too, and TWAE would otherwise
 # turn their default-severity findings into build errors — keep them at suggestion as well.
 [*.razor]
@@ -1,141 +0,0 @@
-name: Build CI Toolchain Image
-
-# Builds the shared CI toolchain image (.NET 10 SDK + Node 22 + prod-identical ffmpeg) and
-# pushes it to the Gitea container registry (ersatztv#390). The toolchain jobs in
-# docker-build.yml consume it via `container:`, pinned to an immutable :<sha>.
-#
-#   push touching docker/ci/** -> :<short-sha>  (+ :latest only from main)
-#   workflow_dispatch          -> manual rebuild
-#   schedule (weekly)          -> picks up base-image security updates
-#
-# Deliberately separate from docker-build.yml: this image changes rarely (a Dockerfile edit or
-# the weekly cron), while docker-build.yml runs on every push/PR. Coupling them would rebuild a
-# ~2GB toolchain image on every commit.
-#
-# ROLLOUT NOTE: the jobs pin an immutable :<sha>, never :latest — a broken toolchain image would
-# otherwise block every converted job the moment it was pushed. Bumping the toolchain is therefore
-# a deliberate two-step: merge a docker/ci/Dockerfile change (this workflow publishes a new :<sha>),
-# then update the pin in docker-build.yml in a follow-up PR whose CI proves the new image works.
-# See docs/ci-cd.md -> "CI toolchain image".
-#
-# Like docker-build.yml: the Gitea registry is HTTP-only, so BuildKit needs the inline
-# `http = true` config (it does not inherit the host daemon's insecure-registries setting).
-
-on:
-  workflow_dispatch:
-  push:
-    paths:
-      - 'docker/ci/**'
-      - '.gitea/workflows/ci-image.yml'
-  schedule:
-    # Mondays 05:00 UTC. Gitea registers `schedule` only from the default branch (main).
-    #
-    # What this cron does and does NOT do — it does **not** update any running job. The jobs in
-    # docker-build.yml pin an immutable :<sha> (deliberately), so a rebuilt image is consumed only
-    # when a human bumps that pin. Its actual value is twofold:
-    #   1. a weekly CANARY — catches "the toolchain image no longer builds" (a NodeSource/apt/base
-    #      change) at a time of our choosing, rather than when you next need to bump the pin;
-    #   2. it leaves a freshly-patched :latest so the next pin bump starts from a current base.
-    # `no-cache` on this path is what makes both real: with the shared :buildcache, the
-    # `apt-get update && apt-get install` layer would restore from cache and re-fetch nothing.
-    - cron: '0 5 * * 1'
-
-# Serialize per ref: concurrent builds would race on the shared :buildcache tag.
-# No cancel-in-progress — a half-pushed toolchain image is worse than a redundant build.
-concurrency:
-  group: ersatztv-ci-image-${{ github.ref }}
-  cancel-in-progress: false
-
-env:
-  REGISTRY: 192.168.1.95:3000
-  CI_IMAGE: 192.168.1.95:3000/timothy/ersatztv-ci
-
-jobs:
-  build:
-    name: Build & push CI image
-    # Moved off `small` with docker-build.yml's `build` (server-management#639). Being
-    # "docker-only" made it look lightweight, but it is a full buildx of the .NET
-    # toolchain image — the heaviest thing that ran in that lane. `small` is now
-    # git-only and capped at 1g per job, which would OOM this build.
-    #
-    # Rare trigger (pushes touching docker/ci + a weekly cron), so it costs the
-    # ubuntu-latest lane almost nothing, and ci-runner (.127) runs no prod workload.
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          # only docker/ci/Dockerfile is needed; no git describe/log here
-          fetch-depth: 1
-
-      - name: Compute tags
-        id: meta
-        run: |
-          set -euo pipefail
-          SHORT=$(git rev-parse --short HEAD)
-          # Always publish the immutable :<sha> — that is what docker-build.yml pins.
-          TAGS=("${CI_IMAGE}:${SHORT}")
-          # :latest is a convenience/floating pointer for humans and the weekly rebuild; jobs must
-          # never consume it. Only main may move it.
-          if [ "${GITHUB_REF}" = "refs/heads/main" ]; then
-            TAGS+=("${CI_IMAGE}:latest")
-          fi
-          echo "short=${SHORT}" >> "$GITHUB_OUTPUT"
-          {
-            echo "tags<<__EOT__"
-            printf '%s\n' "${TAGS[@]}"
-            echo "__EOT__"
-          } >> "$GITHUB_OUTPUT"
-          printf 'tag: %s\n' "${TAGS[@]}"
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          buildkitd-config-inline: |
-            [registry."192.168.1.95:3000"]
-              http = true
-
-      - name: Login to Gitea registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./docker/ci/Dockerfile
-          platforms: linux/amd64
-          push: true
-          provenance: false
-          tags: ${{ steps.meta.outputs.tags }}
-          # The scheduled rebuild must bypass the cache or it is pointless: `mode=max` buildcache
-          # would restore the `apt-get update && apt-get install` layer verbatim and pull in none of
-          # the base updates the cron exists to collect. Push-triggered builds keep the cache.
-          no-cache: ${{ github.event_name == 'schedule' }}
-          cache-from: type=registry,ref=192.168.1.95:3000/timothy/ersatztv-ci:buildcache
-          cache-to: type=registry,ref=192.168.1.95:3000/timothy/ersatztv-ci:buildcache,mode=max,ignore-error=true
-
-      # The Dockerfile's own build-time smoke test (dotnet --info, node, ffmpeg, ...) already ran
-      # inside the build. This re-checks the *pushed* artifact end-to-end: that the registry copy
-      # pulls and its toolchain runs, which is exactly what `container:` will do on every job.
-      - name: Verify the pushed image
-        run: |
-          set -euo pipefail
-          IMG="${CI_IMAGE}:${{ steps.meta.outputs.short }}"
-          echo "Pulling ${IMG}"
-          docker pull "$IMG"
-          docker run --rm --entrypoint /bin/bash "$IMG" -euxc '
-            dotnet --version
-            dotnet ef --version
-            node --version
-            ffmpeg -version | head -1
-            git --version
-            python3 --version
-            # reportgenerator --version exits 1 ("No report files specified"); probe the shim.
-            command -v reportgenerator
-          '
-          echo "CI image OK. Pin this in .gitea/workflows/docker-build.yml -> CI_IMAGE_REF:"
-          echo "    ${IMG}"
@@ -22,17 +22,6 @@ concurrency:
  group: ersatztv-depscan
  cancel-in-progress: true

-# No persistent MSBuild/Roslyn servers (ersatztv#406). Workflow `env:` does not cross workflow
-# files, so docker-build.yml's copy of these does not apply here and this has to be repeated.
-# Smaller stakes than the build pipeline — `dotnet restore` + `dotnet list` are MSBuild-driven and
-# never invoke csc, so this is lingering worker nodes (hundreds of MiB), not a 7.8 GB VBCSCompiler.
-# Worth setting anyway: this runs unattended on a Monday 06:00 cron against the same host that runs
-# prod media, and node reuse keeps workers alive ~15 min after the job.
-env:
-  UseSharedCompilation: "false"
-  DOTNET_CLI_USE_MSBUILD_SERVER: "0"
-  MSBUILDDISABLENODEREUSE: "1"
-
 jobs:
  scan:
    name: NuGet vulnerable packages
@@ -12,38 +12,6 @@ name: Build ErsatzTV Image
 #
 # `:latest` is intentionally the test/dev channel (per ersatztv#3); prod pins
 # `:prod`, never `:latest` (enforced in the prod compose — server-management#481).
-#
-# TOOLCHAIN IMAGE (ersatztv#390): the jobs that need a toolchain (`test`, `migrations`,
-# `functional-e2e`, `api-docs`, `format`) run inside our shared CI image via `container:`
-# instead of installing .NET/Node/ffmpeg per run. It ships the .NET 10 SDK, Node 22,
-# prod-identical ffmpeg, and the dotnet-ef/reportgenerator global tools — so those jobs carry
-# no setup-dotnet, no setup-node, no apt, no `dotnet tool install`. Built by ci-image.yml from
-# docker/ci/Dockerfile. Project deps (NuGet/npm) are NOT baked in and stay on actions/cache.
-#
-# The pin below is an IMMUTABLE :<sha>, never :latest — a bad toolchain push would otherwise
-# break every converted job at once. It is repeated per job because `jobs.<id>.container.image`
-# cannot read the workflow `env` context. **Bump all five together**; see docs/ci-cd.md ->
-# "CI toolchain image" for the two-step procedure.
-#
-#   CI image pin: 192.168.1.95:3000/timothy/ersatztv-ci:4263cf7
-#
-# DOCS-ONLY SKIP (ersatztv#416): a change that touches only docs/** or *.md has nothing for the
-# heavy jobs to validate. `test`, `migrations`, `functional-e2e` and `build` each run
-# `scripts/ci-detect-docs-only.sh` as their first post-checkout step (id: detect) and gate every
-# real step on `steps.detect.outputs.docs_only != 'true'`. Crucially they STILL RUN and STILL
-# report `success` in seconds — the two REQUIRED contexts (`Build & test (.NET)`, `EF migration
-# integrity (SQLite + MySql)`) must keep reporting or a docs-only PR could never merge. We do NOT
-# `if:`-skip a required job: on Gitea 1.25.4 a skipped job reports commit-status state `skipped`
-# (verified, throwaway PR #418) and we don't rely on how branch protection treats a skipped
-# REQUIRED context. See docs/ci-cd.md -> "Docs-only skip".
-#
-# ALREADY-VALIDATED SKIP (ersatztv#420): a second, sibling gate in `test`, `migrations` and
-# `functional-e2e` only (NOT `build`). On a push-to-main merge commit, `id: revalidate` runs
-# `scripts/ci-detect-already-validated.sh`, which emits `skip=true` only when the merged tree is
-# byte-identical to a PR head that already has a green Gitea combined status — i.e. the exact
-# source was already validated in the PR run. Every heavy step in those three jobs additionally
-# gates on `steps.revalidate.outputs.skip != 'true'`. `build` is untouched and always runs on
-# main, so the image is still built (from already-validated source) even when the skip fires.

 on:
  workflow_dispatch:
@@ -64,71 +32,28 @@ concurrency:
  group: ersatztv-build-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

-# Inside a `container:`, act_runner does NOT default `run` steps to bash — it falls back to
-# `sh -e {0}` (dash), because it can't assume bash exists in an arbitrary image. Every multi-line
-# script here is bash (`set -o pipefail`, arrays, `shopt`, `mapfile`), so dash fails them
-# immediately: `set: Illegal option -o pipefail`. Declare the shell once for the whole workflow
-# rather than per step. Non-container jobs already defaulted to bash, so this changes nothing for
-# them. (ersatztv#390 — see docs/ci-cd.md -> "CI toolchain image".)
-defaults:
-  run:
-    shell: bash
-
 env:
  REGISTRY: 192.168.1.95:3000
  IMAGE: 192.168.1.95:3000/timothy/ersatztv

-  # --- CI build memory (ersatztv#406, server-management#604) ---
-  # Roslyn's `VBCSCompiler` is a *persistent* compiler server: it outlives the `dotnet build` that
-  # started it and keeps its managed heap warm for the next one. Locally that is a real speedup.
-  # In CI it buys nothing — each job container is torn down at the end of the run, so there is
-  # never a "next build" to warm — while costing a lot: 7.8 GB RSS was measured live on bumblebee,
-  # the single largest consumer on a 25 GiB host that also runs prod media. Several of those, one
-  # per concurrent job container, is what drove the host to load 340 with 21 GiB swapped.
-  #
-  # These are MSBuild properties/switches, set here as environment variables so they apply to every
-  # dotnet invocation in every job (restore/build/test/format/api-docs) without touching each call
-  # site. MSBuild surfaces environment variables as properties, and `UseSharedCompilation` is only
-  # defaulted to true when empty, so setting it here wins.
-  #
-  # NOTE: this reaches the *runner-side* dotnet jobs only. The `build` job compiles inside
-  # `docker build`, where these do not propagate — the same switches are set as ENV in the
-  # Dockerfile's SDK stage (docker/Dockerfile) to cover it.
-  UseSharedCompilation: "false"   # no persistent VBCSCompiler; csc runs per-project and exits
-  DOTNET_CLI_USE_MSBUILD_SERVER: "0"  # no persistent MSBuild server process
-  MSBUILDDISABLENODEREUSE: "1"    # MSBuild worker nodes exit with the build instead of lingering
-
 jobs:
  test:
    name: Build & test (.NET)
    runs-on: ubuntu-latest
-    container:
-      image: 192.168.1.95:3000/timothy/ersatztv-ci:4263cf7
-      credentials:
-        username: ${{ secrets.REGISTRY_USER }}
-        password: ${{ secrets.REGISTRY_PASSWORD }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
-          # git history/tags are needed by the `build` job's `git describe` (ersatztv#190) and,
-          # here, by the #420 revalidate step's `HEAD^2` tree comparison on a main merge commit.
-          fetch-depth: 2
+          # only the test job's steps below need the working tree; git history/tags
+          # are only needed by the `build` job's `git describe` (ersatztv#190)
+          fetch-depth: 1

-      # ersatztv#416: is this a docs-only change? If so, every heavy step below is skipped and this
-      # REQUIRED job reports success in seconds. It still RUNS (never `if:`-skipped) so the required
-      # context keeps reporting — see the workflow header and docs/ci-cd.md -> "Docs-only skip".
-      - name: Detect docs-only changes
-        id: detect
-        run: scripts/ci-detect-docs-only.sh
-      - name: Detect already-validated tree (#420)
-        id: revalidate
-        env:
-          ETV_STATUS_AUTH: ${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}
-        run: scripts/ci-detect-already-validated.sh
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'

      - name: Cache NuGet packages
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
@@ -136,132 +61,51 @@ jobs:
          restore-keys: nuget-${{ runner.os }}-

      - name: Restore
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        run: dotnet restore

-      # Replaces setup-node's built-in `cache: npm`. The toolchain image supplies node/npm, but
-      # the SPA's package downloads are project deps, so they stay cached per lockfile.
-      - name: Cache npm packages
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
-        uses: actions/cache@v4
+      - name: Setup Node
+        uses: actions/setup-node@v4
        with:
-          path: ~/.npm
-          key: npm-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}
-          restore-keys: npm-${{ runner.os }}-
+          node-version: '22.x'
+          cache: npm
+          cache-dependency-path: web/package-lock.json

      - name: Install SPA dependencies
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        working-directory: web
        run: npm ci

      - name: Check generated SPA API client
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        working-directory: web
        run: npm run check:api

      - name: Lint SPA
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        working-directory: web
        run: npm run lint

      - name: Typecheck SPA
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        working-directory: web
        run: npm run typecheck

      - name: Test SPA
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        working-directory: web
        run: npm test -- --run

      - name: Build SPA
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        working-directory: web
        run: npm run build

      - name: Strip Scanner project ref (matches Docker build)
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        run: sed -i '/Scanner/d' ErsatzTV/ErsatzTV.csproj

-      # Start the true peak-anon sampler just before the memory-heavy dotnet Build/Test/Coverage so
-      # its high-water mark spans them (SPA build/test above are comparatively light). Paired with the
-      # "Report peak container memory" step below. continue-on-error + a fail-open script => this
-      # instrumentation never reddens a build. Why anon and not memory.peak: ersatztv#412 /
-      # scripts/ci-peak-anon.sh header / docs/ci-cd.md "CI build memory".
-      - name: Start peak-anon sampler (ersatztv#412)
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
-        continue-on-error: true
-        run: scripts/ci-peak-anon.sh start
-
      - name: Build
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        run: dotnet build --configuration Release --no-restore

      - name: Test
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
-        run: >-
-          dotnet test --configuration Release --no-build --blame-hang-timeout "2m" --verbosity normal
-          --collect:"XPlat Code Coverage" --settings coverlet.runsettings --results-directory ./coverage
-
-      # Coverage reporting (ersatztv#15 scope item 4): coverlet.collector emits a Cobertura report
-      # per test project (via --collect above); ReportGenerator merges them into a human-readable
-      # summary printed to the log and the job step summary. No floor is enforced yet ("decide on a
-      # floor later"), so this step is purely informational — continue-on-error keeps a missing
-      # report or a transient tool-install failure from ever blocking a build.
-      - name: Coverage summary
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
-        continue-on-error: true
-        run: |
-          set -euo pipefail
-          shopt -s globstar nullglob
-          reports=(coverage/**/coverage.cobertura.xml)
-          if [ ${#reports[@]} -eq 0 ]; then
-            echo "No coverage reports found under ./coverage -- skipping summary."
-            exit 0
-          fi
-          echo "Found ${#reports[@]} coverage report(s)."
-          # reportgenerator is baked into the CI toolchain image (docker/ci/Dockerfile) and already
-          # on PATH — no per-run `dotnet tool` install. Bump its version there (ersatztv#390).
-          reportgenerator \
-            "-reports:coverage/**/coverage.cobertura.xml" \
-            "-targetdir:coverage/report" \
-            "-reporttypes:TextSummary;MarkdownSummaryGithub"
-          echo "::group::Coverage summary"
-          cat coverage/report/Summary.txt
-          echo "::endgroup::"
-          if [ -n "${GITHUB_STEP_SUMMARY:-}" ] && [ -f coverage/report/SummaryGithub.md ]; then
-            cat coverage/report/SummaryGithub.md >> "$GITHUB_STEP_SUMMARY"
-          fi
-
-      # Memory of THIS job container, reported every run (ersatztv#406/#412, server-management#604).
-      # #604 sizes the runners' per-job caps on these numbers. The headline is the TRUE PEAK ANON
-      # sampled by the "Start peak-anon sampler" step above — NOT `memory.peak`, which is the
-      # high-water mark of memory.current and charges reclaimable page cache to the cgroup (a build
-      # job does heavy NuGet/npm/obj/bin/coverage I/O, so cache can dominate the peak). Page cache is
-      # reclaimed under a tighter cap, not OOM-killed, so sizing a cap off `memory.peak` inverts the
-      # decision. peak anon is the OOM-forcing number. Full rationale + the bumblebee demo:
-      # scripts/ci-peak-anon.sh header and docs/ci-cd.md "CI build memory".
-      #
-      # Runs LAST on purpose (after Coverage summary / reportgenerator, the job's last real workload)
-      # and stops the sampler. `always()` so a failed Build/Test still gets a peak reading; the split
-      # is read here (end-of-job = composition then, not at the peak instant — that is exactly why the
-      # sampler exists). Skipped on docs-only/already-validated runs (nothing ran to measure).
-      - name: Report peak container memory
-        # `always()` controls whether this step RUNS, not whether its failure fails the job. With
-        # `defaults.run.shell: bash` (`-e -o pipefail`) a stray non-zero here would redden a green
-        # test job, so `continue-on-error` makes it advisory — the same guarantee Coverage summary uses.
-        if: ${{ always() && steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true' }}
-        continue-on-error: true
-        run: scripts/ci-peak-anon.sh report
+        run: dotnet test --configuration Release --no-build --blame-hang-timeout "2m" --verbosity normal

  migrations:
    name: EF migration integrity (SQLite + MySql)
    runs-on: ubuntu-latest
-    container:
-      image: 192.168.1.95:3000/timothy/ersatztv-ci:4263cf7
-      credentials:
-        username: ${{ secrets.REGISTRY_USER }}
-        password: ${{ secrets.REGISTRY_PASSWORD }}
    # Independent gate (not a 'needs' of build yet) so the new MySql-service dependency
    # can't block image builds until it's proven reliable on the runner. Promote to a
    # required check / build dependency once green. (ersatztv#13)
@@ -274,42 +118,7 @@ jobs:
        # No host-port binding: the job reaches this service as mysql:3306 on the shared
        # runner network. Publishing 3306 made concurrent runs collide ("port is already
        # allocated") whenever two migrations jobs overlapped.
-        #
-        # `--memory`/`--cpus` here because the runner's `container.options` (`--memory=10g`)
-        # applies to the JOB container ONLY, not to `services:` — verified by inspecting a live
-        # migrations job: the job container reported HostConfig.Memory=10737418240, its mysql
-        # service reported `mem=0 nanocpus=0`, i.e. unbounded. So every migrations run was adding
-        # an uncapped MySQL to an already-tight host (ersatztv#406, server-management#604).
-        #
-        # NOTE (ersatztv#416): a `services:` container starts whenever the JOB starts, regardless
-        # of step `if:`. So a docs-only migrations run still spins this mysql (capped, seconds) even
-        # though the DDL-replay steps below are skipped. Fully skipping the service would require an
-        # `if:`-skipped job, which we deliberately do NOT do for a required context — the heavy cost
-        # (the 787-migration replay) is what the step gating removes.
-        #
-        # `--memory-swap=2g` is NOT redundant with `--memory=2g` — it is the point. Docker defaults
-        # an unset `--memory-swap` to *twice* `--memory`, so `--memory=2g` alone would grant 2g RAM
-        # **plus 2g of swap** (verified on bumblebee: `--memory=2g` alone → memory.max=2147483648
-        # AND memory.swap.max=2147483648; with `--memory-swap=2g` → memory.swap.max=0). Setting it
-        # equal to --memory disables swap for this container. That matters more here than anywhere:
-        # swap thrash on this host is the whole reason this cap exists, and a swapping mysqld mid-DDL
-        # is precisely the pathology behind the known `Command Timeout expired` migrations flake. We
-        # want a loud OOM over silent swapping — an OOM is a clear signal to raise the cap.
-        #
-        # 2g is sized on measurement rather than inheritance, but honestly: a mysql:8.4 container
-        # with this exact env peaked at 543 MiB during init and settled at 481 MiB idle (probed on
-        # bumblebee 2026-07-17). That is init+idle, NOT the 787-migration replay, which grows caches
-        # idle never touches — so treat 2g as a measured floor with headroom, not a measured
-        # ceiling. The migrations job going green is what validates it. If this OOM-kills the
-        # service, raise it deliberately — do not remove the cap, and do not re-enable swap.
-        #
-        # `--cpus=2` is a ceiling, not a reservation, and is the one number here with no measurement
-        # behind it: 787 sequential DDL statements on one connection are ~1-core-bound, so 2 is
-        # judgement. Revisit if the apply step's tail latency grows.
        options: >-
-          --memory=2g
-          --memory-swap=2g
-          --cpus=2
          --health-cmd="mysqladmin ping -h 127.0.0.1 -uroot -persatztv --silent"
          --health-interval=5s
          --health-timeout=5s
@@ -317,24 +126,15 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
-        with:
-          # was the default fetch-depth: 1 (ersatztv#190); bumped to 2 so the #420 revalidate
-          # step's `HEAD^2` tree comparison can resolve on a main merge commit.
-          fetch-depth: 2
+        # default fetch-depth: 1 -- this job never runs git describe/log, only
+        # actions/checkout@v4's default (shallow) history is needed (ersatztv#190)

-      # ersatztv#416: docs-only? Skip the build + migration replay; the job still reports success in
-      # seconds. REQUIRED context, so it always RUNS (never `if:`-skipped). See the workflow header.
-      - name: Detect docs-only changes
-        id: detect
-        run: scripts/ci-detect-docs-only.sh
-      - name: Detect already-validated tree (#420)
-        id: revalidate
-        env:
-          ETV_STATUS_AUTH: ${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}
-        run: scripts/ci-detect-already-validated.sh
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'

      - name: Cache NuGet packages
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
@@ -342,21 +142,19 @@ jobs:
          restore-keys: nuget-${{ runner.os }}-

      - name: Restore
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        run: dotnet restore

      - name: Build
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        run: dotnet build --configuration Release --no-restore

-      # dotnet-ef is baked into the CI toolchain image (docker/ci/Dockerfile) and already on PATH
-      # — no per-run `dotnet tool install`. Bump its version there (ersatztv#390).
+      - name: Install dotnet-ef
+        run: dotnet tool install --global dotnet-ef --version 9.0.12

      # SQLite is the prod provider; both checks validated locally.
      - name: SQLite — model drift + apply all migrations to a fresh DB
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        run: |
          set -euo pipefail
+          export PATH="$PATH:$HOME/.dotnet/tools"
          echo "::group::SQLite model drift (has-pending-model-changes)"
          dotnet ef migrations has-pending-model-changes --no-build --configuration Release \
            --context TvContext --startup-project ErsatzTV --project ErsatzTV.Infrastructure.Sqlite -- --provider Sqlite
@@ -370,7 +168,6 @@ jobs:
      # MySql uses ServerVersion.AutoDetect (connects at config time), so it runs against the
      # service container above. MySql__ConnectionString maps to config key "MySql:ConnectionString".
      - name: MySql — model drift + apply all migrations to a fresh DB
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
        env:
          # DefaultCommandTimeout is raised from MySqlConnector's 30s default: replaying every
          # migration to a fresh DB issues DDL commands that can exceed 30s when two migration jobs
@@ -380,6 +177,7 @@ jobs:
          MySql__ConnectionString: "Server=mysql;Port=3306;Database=ersatztv_migrations;Uid=root;Pwd=ersatztv;DefaultCommandTimeout=300;"
        run: |
          set -euo pipefail
+          export PATH="$PATH:$HOME/.dotnet/tools"
          echo "::group::MySql model drift (has-pending-model-changes)"
          dotnet ef migrations has-pending-model-changes --no-build --configuration Release \
            --context TvContext --startup-project ErsatzTV --project ErsatzTV.Infrastructure.MySql -- --provider MySql
@@ -404,112 +202,14 @@ jobs:
          done
          echo "::endgroup::"

-  functional-e2e:
-    name: Functional E2E (curl contracts)
-    runs-on: ubuntu-latest
-    # Advisory gate (ersatztv#299): boots the app from source and drives the manual live-E2E
-    # flows (legacy->SPA redirects, auth/CSRF/security-stamp, library-scan status contract,
-    # If-Match/412, and since ersatztv#363 two lock-contention 409s) that sessions have been
-    # re-running by hand. Deliberately NOT a `needs:` of `build` and not (yet) a required check, so a
-    # functional-E2E flake can't block image builds or the unit-test gate — promote it to a required
-    # check / build dependency once it's proven reliable (same rollout the `migrations` job used).
-    # SQLite default provider -> no DB service. Runs on PRs and on main (regression net); skipped for
-    # v* tag builds.
-    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main'
-    container:
-      image: 192.168.1.95:3000/timothy/ersatztv-ci:4263cf7
-      credentials:
-        username: ${{ secrets.REGISTRY_USER }}
-        password: ${{ secrets.REGISTRY_PASSWORD }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          # bumped from 1 (ersatztv#190 default) so the #420 revalidate step's `HEAD^2` tree
-          # comparison can resolve on a main merge commit.
-          fetch-depth: 2
-
-      # ersatztv#416: docs-only? Skip the boot + curl harness (advisory job; safe to no-op).
-      - name: Detect docs-only changes
-        id: detect
-        run: scripts/ci-detect-docs-only.sh
-      - name: Detect already-validated tree (#420)
-        id: revalidate
-        env:
-          ETV_STATUS_AUTH: ${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}
-        run: scripts/ci-detect-already-validated.sh
-
-      - name: Cache NuGet packages
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
-        uses: actions/cache@v4
-        with:
-          path: ~/.nuget/packages
-          key: nuget-${{ runner.os }}-${{ hashFiles('Directory.Packages.props', 'global.json') }}
-          restore-keys: nuget-${{ runner.os }}-
-
-      - name: Restore
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
-        run: dotnet restore
-
-      - name: Cache npm packages
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
-        uses: actions/cache@v4
-        with:
-          path: ~/.npm
-          key: npm-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}
-          restore-keys: npm-${{ runner.os }}-
-
-      - name: Install SPA dependencies
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
-        working-directory: web
-        run: npm ci
-
-      - name: Build SPA
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
-        working-directory: web
-        run: npm run build
-
-      - name: Build (Release)
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
-        run: dotnet build ErsatzTV.sln --configuration Release --no-restore
-
-      # The old `command -v ffmpeg || sudo apt-get install ffmpeg` step is gone (ersatztv#390):
-      # the toolchain image ships the same ffmpeg build prod runs, so the binary is already here.
-      # That step also cost 110s of every run. The harness never *transcodes*, but since ersatztv#363
-      # it does use ffmpeg to synthesize ~60 tiny testsrc clips to seed the scan-lock 409 flow (and
-      # python3's stdlib sqlite3 to seed the DB rows the API can't create) — both already present in
-      # the image, so still no per-run install. The scan flow self-skips if ffmpeg is ever absent.
-
-      - name: Boot instance and run functional-E2E harness
-        if: steps.detect.outputs.docs_only != 'true' && steps.revalidate.outputs.skip != 'true'
-        run: |
-          set -euo pipefail
-          export ETV_BUILD_CONFIG=Release ETV_UI_PORT=8409
-          CFG="$(mktemp -d)"
-          # e2e-local.sh copies wwwroot, launches the DLL in the background (logging to a file, so
-          # this command substitution returns as soon as the app is ready), and prints PID/CONFIG_DIR.
-          OUT="$(scripts/e2e-local.sh "$CFG")"
-          printf '%s\n' "$OUT"
-          PID="$(printf '%s\n' "$OUT" | awk -F= '/^PID=/{print $2}')"
-          trap 'kill "$PID" 2>/dev/null || true' EXIT
-          scripts/e2e-functional.sh "http://localhost:${ETV_UI_PORT}" "$CFG"
-
  build:
    name: Build & push image (amd64)
-    # Moved back off `small` (server-management#639). This is the one HEAVY job that
-    # was still in that lane, and its 10g requirement was what pinned the lane's
-    # per-job cap at 10g — which in turn capped the lane at ONE slot on a 25 GiB
-    # host. Four jobs sharing one slot is what starved the git-only checks in act's
-    # setup phase (>10 min, no logs, then fail). With this job gone, `small` is
-    # git-only and can run wide and tiny on two hosts.
-    #
-    # The `ubuntu-latest` queueing that sent it to `small` in the first place
-    # (server-management#574: a PR-run skip stuck 31 min behind long builds) does not
-    # come back, because `needs: [test, migrations]` means this job cannot be
-    # dispatched until those two have already finished — by which point the lane it
-    # was queueing behind has drained. Real builds (main/tags) get the full
-    # ubuntu-latest allotment: 4 CPUs / 10g on ci-runner (.127).
-    runs-on: ubuntu-latest
+    # `small` = the dedicated small-jobs runner lane (server-management#574).
+    # On PR runs this job only resolves its skip, but Gitea still dispatches it
+    # as a task — on the ubuntu-latest runners that skip queued behind long
+    # builds (observed 31 min). Real builds (main/tags) run on bumblebee,
+    # capped at 4 CPUs / 10g.
+    runs-on: small
    needs: [test, migrations]
    if: github.event_name != 'pull_request'
    steps:
@@ -518,16 +218,8 @@ jobs:
        with:
          fetch-depth: 0

-      # ersatztv#416: a docs-only push to main has nothing to rebuild (docs are not in the image),
-      # so skip the build/push/smoke steps — the job still reports success. Tag builds force
-      # docs_only=false in the script, so a release is never skipped.
-      - name: Detect docs-only changes
-        id: detect
-        run: scripts/ci-detect-docs-only.sh
-
      - name: Compute version and tags
        id: meta
-        if: steps.detect.outputs.docs_only != 'true'
        run: |
          SHORT=$(git rev-parse --short HEAD)
          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
@@ -550,7 +242,6 @@ jobs:
          printf 'tag: %s\n' "${TAGS[@]}"

      - name: Set up Docker Buildx
-        if: steps.detect.outputs.docs_only != 'true'
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-config-inline: |
@@ -558,7 +249,6 @@ jobs:
              http = true

      - name: Login to Gitea registry
-        if: steps.detect.outputs.docs_only != 'true'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
@@ -566,7 +256,6 @@ jobs:
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Build and push
-        if: steps.detect.outputs.docs_only != 'true'
        uses: docker/build-push-action@v6
        with:
          context: .
@@ -582,16 +271,14 @@ jobs:
          cache-to: type=registry,ref=192.168.1.95:3000/timothy/ersatztv:buildcache,mode=max,ignore-error=true

      - name: Smoke + IPTV E2E (assert key endpoints)
-        if: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) && steps.detect.outputs.docs_only != 'true' }}
+        if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
        run: |
          IMG="${IMAGE}:${{ steps.meta.outputs.short }}"
          NAME="etv-smoke-${{ github.run_id }}"
          trap 'docker rm -f "$NAME" >/dev/null 2>&1 || true' EXIT
          echo "Pulling ${IMG}"
          docker pull "$IMG"
-          # --memory-swap equal to --memory disables swap. Without it Docker defaults --memory-swap
-          # to 2x --memory, so `--memory 2g` alone silently grants 2g RAM + 2g swap (ersatztv#406).
-          docker run -d --name "$NAME" --memory 2g --memory-swap 2g \
+          docker run -d --name "$NAME" --memory 2g \
            -e ETV_CONFIG_FOLDER=/tmp/etv/config \
            -e ETV_TRANSCODE_FOLDER=/tmp/etv/transcode \
            "$IMG"
@@ -642,57 +329,6 @@ jobs:
            exit 1
          fi

-  # BLOCKING (ersatztv#390): the CI toolchain image pin in this file must name the image that
-  # ci-image.yml actually last published — i.e. the short sha of the last commit to touch the image's
-  # sources. Without this detector, a PR that edits docker/ci/** publishes a NEW image but runs its own
-  # jobs against the OLD pin: CI green-lights a toolchain it never executed, and once merged, main's
-  # Dockerfile silently disagrees with what CI runs. **Renovate actively generates exactly that PR** —
-  # it manages docker/ci/Dockerfile's base pins (dockerfile manager) but cannot bump an opaque
-  # `:<sha>` in `container.image`, so it would leave the pin behind every time.
-  #
-  # Failing here forces the documented two-step (docs/ci-cd.md -> "CI toolchain image"): push the
-  # Dockerfile change, let ci-image.yml publish `:<sha>`, then update the pin to that sha. Seconds-long
-  # git+grep -> keep it off the build runners.
-  ci-image-pin:
-    name: CI image pin matches docker/ci
-    runs-on: small
-    if: github.event_name == 'pull_request'
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          # need real history: `git log -- <path>` on a shallow clone can't find the last
-          # commit that touched the image sources
-          fetch-depth: 0
-      - name: Verify the pin matches the last-published image
-        run: |
-          set -euo pipefail
-          # ci-image.yml tags the image `git rev-parse --short HEAD` of the push that built it, and it
-          # only builds on pushes touching these paths — so the published image is named by the last
-          # commit to touch them.
-          #
-          # Compare RESOLVED FULL shas, never the abbreviations: git auto-scales abbreviation length
-          # with the repo's object count, so the tag built in CI from a `fetch-depth: 1` shallow clone
-          # is 7 chars while `%h` here (full clone) is 8. Comparing those strings would fail always.
-          expected="$(git log -1 --format=%H -- docker/ci .gitea/workflows/ci-image.yml)"
-          mapfile -t pins < <(grep -oE 'ersatztv-ci:[0-9a-f]+' .gitea/workflows/docker-build.yml | cut -d: -f2 | sort -u)
-          echo "Image sources last changed in: ${expected}"
-          echo "Pins found in docker-build.yml: ${pins[*]} (${#pins[@]} distinct)"
-          if [ "${#pins[@]}" -ne 1 ]; then
-            echo "::error::docker-build.yml pins MORE THAN ONE ersatztv-ci tag (${pins[*]}). All jobs must pin the same image — bump them together."
-            exit 1
-          fi
-          pin_full="$(git rev-parse --verify --quiet "${pins[0]}^{commit}" || true)"
-          if [ -z "$pin_full" ]; then
-            echo "::error::The pinned CI image tag ersatztv-ci:${pins[0]} does not resolve to a commit in this repo, so it cannot correspond to an image ci-image.yml built from these sources. Rebuild the image and pin the sha it prints."
-            exit 1
-          fi
-          if [ "$pin_full" != "$expected" ]; then
-            echo "::error::CI toolchain image pin is stale: docker-build.yml pins ersatztv-ci:${pins[0]} ($pin_full), but docker/ci was last changed in $expected. Your jobs are testing an image that is NOT built from this PR's docker/ci. Let ci-image.yml publish the new :<sha>, then update the pin in ALL jobs to it (docs/ci-cd.md -> 'CI toolchain image')."
-            exit 1
-          fi
-          echo "Pin is current: ersatztv-ci:${pins[0]} resolves to $pin_full = docker/ci's last change."
-
  # Non-blocking nudge: if a PR migrates/adds a route but forgets the parity tracker, warn.
  # The rule lives in CLAUDE.md → Conventions; this only surfaces an easy-to-miss omission.
  # Deliberately no setup-dotnet/setup-node (and thus no actions/cache) so it can't hit the
@@ -726,14 +362,12 @@ jobs:
            echo "Parity-doc reminder: nothing to flag."
          fi

-  # BLOCKING (ersatztv#521, supersedes the ersatztv#303 H9 append-only mechanic): validates decision-
-  # record lifecycle invariants (metadata schema, one active record per key, reciprocal
-  # supersedes/superseded-by links, no rationale-prose rewrite without [decisions-edit], no record
-  # vanishing from the active set without an archive copy) and that the generated active catalog
-  # (docs/decisions/README.md) is in sync. Same validator the Husky pre-commit hook shim calls, so
-  # local and CI enforcement can't drift. Seconds-long git diff + parse -> keep it off the build runners.
+  # BLOCKING (ersatztv#303 H9): docs/decisions.md is an append-only log. Fails a PR that deletes or
+  # rewrites a settled entry (numstat reports >0 deleted lines) unless a commit in the range carries
+  # the [decisions-edit] override token for a documented factual fix. Same script the Husky commit-msg
+  # hook calls, so local and CI enforcement can't drift. Seconds-long git diff -> keep it off the build runners.
  decisions-guard:
-    name: decisions lifecycle
+    name: decisions.md append-only
    runs-on: small
    if: github.event_name == 'pull_request'
    steps:
@@ -741,19 +375,22 @@ jobs:
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.x'
-      - name: Validate decision lifecycle
+      - name: Enforce append-only
        run: |
          base_ref="${{ github.base_ref }}"
          git fetch --no-tags --depth=200 origin "$base_ref" || true
-          PYTHONPATH=. python3 scripts/decisions_validate.py --base "origin/${base_ref}" --head HEAD
-      - name: Active catalog in sync
-        run: PYTHONPATH=. python3 scripts/build_decisions_catalog.py --check
-      - name: Kickoff guard
-        run: bash scripts/check-kickoff-guard.sh
+          ./.claude/hooks/decisions-guard.sh range "origin/${base_ref}" HEAD
+      - name: Consolidation-floor reminder (non-blocking)
+        run: |
+          # Consolidation is primarily a release step; this is the between-releases floor. The metric is
+          # the file's LINE COUNT — the context an agent actually burns reading the log — not entry count.
+          # Floor 1800 keeps the whole log inside one default 2000-line Read (headroom for the reader's
+          # own overhead). Nudge (never fail) past it so append-only can't grow past what agents can read.
+          n=$(wc -l < docs/decisions.md | tr -d ' ')
+          echo "docs/decisions.md is ${n} lines (consolidation floor: 1800; one Read caps at 2000)."
+          if [ "${n:-0}" -gt 1800 ]; then
+            echo "::warning::docs/decisions.md is ${n} lines (>1800) — larger than agents can comfortably read in one pass. Do a consolidation pass (prune/merge superseded entries with [decisions-edit]); don't wait for the next release. See the decisions.md header."
+          fi

  # BLOCKING (unlike docs-reminder): the mechanizable half of the "docs-update in the
  # same PR" rule for the API contract (ersatztv#303 H4/H5). If a PR touches the API
@@ -767,27 +404,7 @@ jobs:
  # API path changed, the expensive steps skip and the job passes trivially.
  api-docs:
    name: API docs in sync (OpenAPI + endpoint index)
-    # `small` lane (ersatztv#390): this job is ~5s on the ~90% of PRs that touch no API path, but
-    # it was queueing ~29 min behind the heavy jobs in the contended `ubuntu-latest` lane, which
-    # only has bumblebee-runner (capacity 2) + ci-runner. `small` has capacity 4, the same base
-    # image, and answers in ~5s. Moving it here (and `format`) also drops `ubuntu-latest` from 5
-    # jobs to 3, which shortens the queue for `test`/`migrations`/`functional-e2e` too.
-    # This is only possible because `container:` makes the job self-contained — it no longer needs
-    # the runner image to supply .NET/Node.
-    #
-    # REVERTED to `ubuntu-latest` (server-management#604 / ersatztv#406). The caveat below the
-    # original #390 rationale turned out to be the deciding factor: on an API-touching PR this
-    # job does a full `dotnet build`, so it is NOT a small job, and "capacity 4 absorbs that" was
-    # only true while nothing enforced the SUM of the lanes' memory caps. It didn't: 6 slots x 10g
-    # on a 25 GiB host drove bumblebee to load 713 with 21 GiB swapped. The `small` lane is now
-    # sized for genuinely-tiny jobs, and #604 grew the `ubuntu-latest` lane instead (ci-runner
-    # 48 GiB at capacity 4 + a bumblebee overflow slot), which fixes the queue at the source.
    runs-on: ubuntu-latest
-    container:
-      image: 192.168.1.95:3000/timothy/ersatztv-ci:4263cf7
-      credentials:
-        username: ${{ secrets.REGISTRY_USER }}
-        password: ${{ secrets.REGISTRY_PASSWORD }}
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout
@@ -810,6 +427,12 @@ jobs:
            echo "No API-surface change -> skipping regeneration (job passes)."
          fi

+      - name: Setup .NET
+        if: steps.detect.outputs.api_changed == 'true'
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
      - name: Cache NuGet packages
        if: steps.detect.outputs.api_changed == 'true'
        uses: actions/cache@v4
@@ -822,13 +445,13 @@ jobs:
        if: steps.detect.outputs.api_changed == 'true'
        run: dotnet restore

-      - name: Cache npm packages
+      - name: Setup Node
        if: steps.detect.outputs.api_changed == 'true'
-        uses: actions/cache@v4
+        uses: actions/setup-node@v4
        with:
-          path: ~/.npm
-          key: npm-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}
-          restore-keys: npm-${{ runner.os }}-
+          node-version: '22.x'
+          cache: npm
+          cache-dependency-path: web/package-lock.json

      - name: Install SPA dependencies
        if: steps.detect.outputs.api_changed == 'true'
@@ -857,32 +480,13 @@ jobs:
          echo "Generated API artifacts are in sync."

  # Formatting-as-you-touch gate (ersatztv#311): verify the .cs files THIS PR changed conform to
-  # .editorconfig whitespace + charset=utf-8 (i.e. no UTF-8 BOM). Scoped to changed files so it
-  # enforces "normalize a legacy file when you touch it" WITHOUT a big-bang reformat of the ~2500
-  # pre-existing BOM files. A PR that touches no .cs skips the check and passes trivially (always
-  # reports a status, so it is safe as a required check).
-  #
-  # ersatztv#469: uses `dotnet format whitespace . --folder`, NOT the full `dotnet format <sln>`.
-  # `--folder` treats the tree as a plain folder of files and skips the MSBuild/Roslyn workspace load
-  # + per-project compilation that dominated the old recipe (~8 min locally on a whole-solution run) —
-  # `--include` only ever narrowed *which* files were checked, never what got loaded. Folder mode
-  # reads .editorconfig and still flags WHITESPACE (indent/EOL/trailing/final-newline) and CHARSET
-  # (BOM) violations — exactly what this gate exists to catch — in ~0.5s with no `dotnet restore`.
-  # What it drops is the style/analyzer pass (naming/`var`/qualification), which this gate never
-  # meaningfully enforced: those .editorconfig rules are :suggestion/:none severity. Full rationale +
-  # non-vacuity evidence: docs/ci-cd.md → Formatting; docs/decisions.md.
+  # .editorconfig (style + charset=utf-8, i.e. no UTF-8 BOM). Scoped to changed files so it enforces
+  # "normalize a legacy file when you touch it" WITHOUT a big-bang reformat of the ~2500 pre-existing
+  # BOM files. A PR that touches no .cs skips the expensive steps and passes trivially (always reports
+  # a status, so it is safe as a required check).
  format:
    name: Formatting (changed .cs conform to .editorconfig)
-    # Folder-mode whitespace is now a seconds-long, low-memory job (no Roslyn workspace, unlike the
-    # 3.95 GiB full `dotnet format` measured in #406), so it no longer needs the memory headroom that
-    # kept it on `ubuntu-latest`. Left here to avoid re-touching the lane/memory-cap accounting; a
-    # move to a lighter lane is a server-management capacity call (#604).
    runs-on: ubuntu-latest
-    container:
-      image: 192.168.1.95:3000/timothy/ersatztv-ci:4263cf7
-      credentials:
-        username: ${{ secrets.REGISTRY_USER }}
-        password: ${{ secrets.REGISTRY_PASSWORD }}
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout
@@ -906,14 +510,32 @@ jobs:
            echo "No .cs change -> skipping format verify (job passes)."
          fi

+      - name: Setup .NET
+        if: steps.detect.outputs.cs_changed == 'true'
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Cache NuGet packages
+        if: steps.detect.outputs.cs_changed == 'true'
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('Directory.Packages.props', 'global.json') }}
+          restore-keys: nuget-${{ runner.os }}-
+
+      - name: Restore
+        if: steps.detect.outputs.cs_changed == 'true'
+        run: dotnet restore
+
      - name: Verify formatting of changed .cs files
        if: steps.detect.outputs.cs_changed == 'true'
        shell: bash
        run: |
          mapfile -t files < /tmp/changed-cs.txt
-          echo "Verifying ${#files[@]} changed .cs file(s) against .editorconfig (whitespace + charset)..."
-          if ! dotnet format whitespace . --folder --verify-no-changes --include "${files[@]}"; then
-            echo "::error::One or more .cs files this PR touches don't conform to .editorconfig (whitespace or a UTF-8 BOM). Run 'dotnet format whitespace . --folder --include <files>' (or the full 'dotnet format ErsatzTV.sln --include <files>') and commit the result in THIS PR — the fix-as-you-touch convention (docs/contributing.md §7; ersatztv#311). Legacy files you did NOT touch are unaffected."
+          echo "Verifying ${#files[@]} changed .cs file(s) against .editorconfig..."
+          if ! dotnet format ErsatzTV.sln --no-restore --verify-no-changes --include "${files[@]}"; then
+            echo "::error::One or more .cs files this PR touches don't conform to .editorconfig (formatting or a UTF-8 BOM). Run 'dotnet format ErsatzTV.sln --include <files>' and commit the result in THIS PR — the fix-as-you-touch convention (docs/contributing.md §7; ersatztv#311). Legacy files you did NOT touch are unaffected."
            exit 1
          fi
          echo "All changed .cs files conform to .editorconfig."
@@ -2,8 +2,6 @@
 *.*~
 project.lock.json
 .DS_Store
-# Code-coverage output (dotnet test --results-directory ./coverage, ersatztv#15)
-/coverage/
 *.pyc
 .worktrees/

@@ -8,3 +8,8 @@ grep -q '^Co-Authored-By:' "$1" || {
  echo 'husky - commit message missing Co-Authored-By trailer'
  exit 1
 }
+
+# H9 (ersatztv#303) — docs/decisions.md is append-only. Block a commit that rewrites a settled
+# entry unless the message carries [decisions-edit]. commit-msg runs after the index is final, so
+# the staged diff is what's being committed; the message file ($1) supplies the override token.
+./.claude/hooks/decisions-guard.sh staged "$1" || exit 1
@@ -1,12 +1,6 @@
 cd web && npx lint-staged || exit 1
 cd ..

-# ersatztv#521 — decision-record lifecycle structural validator (replaces the old H9 append-only
-# line guard). Runs the same validator the CI `decisions lifecycle` job uses, over the working
-# tree (no base/head here, so only structural checks run; the body-diff/no-vanish checks run in
-# CI where a base ref exists). Fail-open shim — see .claude/hooks/decisions-guard.sh.
-./.claude/hooks/decisions-guard.sh || exit 1
-
 # H3 (ersatztv#303) — never commit a screenshot dropped at the repo root. Belt-and-suspenders with
 # .gitignore (catches a forced `git add -f`). Root-level *.png only; nested paths are legit assets.
 root_png=$(git diff --cached --name-only --diff-filter=ACM | grep -iE '^[^/]+\.png$' || true)
@@ -17,17 +11,15 @@ if [ -n "$root_png" ]; then
  exit 1
 fi

-# dotnet format on staged .cs files (repo root). Uses `whitespace . --folder` — same recipe as
-# the CI `format` job (ersatztv#469): folder mode checks .editorconfig whitespace + charset (BOM)
-# without the MSBuild/Roslyn workspace load, so it runs in ~0.5s instead of the old ~20-40s sln
-# load. Keeping this identical to CI avoids a local hook that blocks on rules CI no longer enforces.
-# Skip entirely when no .cs is staged (avoids any cost for web-only commits).
+# dotnet format on staged .cs files (repo root). Scoped to the staged files so we
+# don't pay the full-tree cost; skip entirely when no .cs is staged (avoids the
+# ~20-40s sln load for web-only commits).
 cs_files=$(git diff --cached --name-only --diff-filter=ACM -- '*.cs')
 if [ -n "$cs_files" ]; then
-  echo "husky - dotnet format (whitespace verify) on staged .cs files"
+  echo "husky - dotnet format (verify) on staged .cs files"
  # shellcheck disable=SC2086
-  dotnet format whitespace . --folder --verify-no-changes --include $cs_files || {
-    echo "husky - dotnet format found whitespace/BOM issues in staged .cs files; run 'dotnet format whitespace . --folder --include <files>' to fix"
+  dotnet format ErsatzTV.sln --verify-no-changes --include $cs_files || {
+    echo "husky - dotnet format found issues in staged .cs files; run 'dotnet format ErsatzTV.sln --include <files>' to fix"
    exit 1
  }
 fi
@@ -15,12 +15,6 @@ unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE
 # hook on code that isn't yours). Fail-open; escape with ETV_SKIP_REBASE_CHECK=1.
 ./.claude/hooks/prepush-rebase-check.sh || exit 1

-# H13 (ersatztv#416 session): refuse to push when a file in the pushed diff still has uncommitted
-# working-tree/index changes — the pushed commit wouldn't match what you built/reviewed (the #416
-# index/worktree trap: a review fix left in the working tree shipped without being committed).
-# Runs before the slow CI-parity checks so it fails fast. Fail-open; escape ETV_ALLOW_DIRTY_PUSH=1.
-./.claude/hooks/prepush-clean-worktree-check.sh || exit 1
-
 # CI-parity checks: catch "green locally, red in CI" before the push leaves the machine.
 # check:api guards the generated OpenAPI types (v1.json / v1.d.ts drift); the full
 # lint/typecheck/build catch a staged change that breaks an UNstaged file (lint-staged
@@ -35,10 +35,10 @@ Custom IPTV channel server for Jellyfin. Forked from [ErsatzTV/ErsatzTV](https:/

 ## Deployment

- **Docker host**: **jazz (192.168.1.29)**, container `ersatztv`, port 8409. Media transcoders (Jellyfin, `ersatztv`, `ersatztv-test`) moved here from bumblebee on 2026-07-20 (server-management#633); bumblebee (192.168.1.99) still hosts the **CI runners** and the rest of the stacks. **Name-reuse trap**: `jazz` was an *earlier* name for the .99 host, so pre-2026-07-20 docs/commits saying "jazz" mean today's **bumblebee** — go by the IP, not the name.
- **Config volume**: `~/downloadswarm/ersatztv/` on jazz → `/config` in container
+- **Docker host**: bumblebee (192.168.1.99), container `ersatztv`, port 8409
+- **Config volume**: `~/downloadswarm/ersatztv/` on bumblebee → `/config` in container
 - **SQLite DB**: `/config/ersatztv.sqlite3` (WAL mode, root-owned)
- **Images** (our fork, built by `.gitea/workflows/docker-build.yml` → `192.168.1.95:3000/timothy/ersatztv`): push to `main` → `:latest` + `:<sha>` (test image); push `v*` tag → `:prod` + `:<version>` + `:<sha>`. Prod's **Komodo GitOps** stack — named **`jazz-media`** (the compose *project* is still `media-servers`; a dead `media-servers` stack lingers on bumblebee) — follows floating `:prod`; after the immutable `:<version>` candidate passes the release scans, manually `DeployStack jazz-media`. There is **no** auto-update fallback (`auto_update: false`) — promotion is manual. Both paths run the fail-closed pre-deploy backup and prod-copy migration smoke before recreation. Test tracks `:latest`. Pipeline details: `docs/ci-cd.md`.
+- **Images** (our fork, built by `.gitea/workflows/docker-build.yml` → `192.168.1.95:3000/timothy/ersatztv`): push to `main` → `:latest` + `:<sha>` (test image); push `v*` tag → `:prod` + `:<version>` + `:<sha>`. Prod's **Komodo GitOps** `media-servers` stack follows floating `:prod`; after the immutable `:<version>` candidate passes the release scans, manually deploy the stack (Global Auto Update is the daily fallback). Both paths run the fail-closed pre-deploy backup and prod-copy migration smoke before recreation. Test tracks `:latest`. Pipeline details: `docs/ci-cd.md`.

 ## Development

@@ -56,7 +56,7 @@ docker build -f docker/Dockerfile -t ersatztv:dev .
 ## Conventions

 - **Read [`docs/contributing.md`](docs/contributing.md)** before non-trivial changes — it documents the established patterns (layering, CQRS handlers, LanguageExt, the ChicoryTV SPA, EF Core + dual-provider migrations, the FFmpeg pipeline, analyzers, testing) and the **deviation policy**: match the established style; diverge only with a concrete, stated reason.
- **Docs-first is a HARD RULE — read before you explore**: before ANY API / SPA / E2E / parity / scheduling work, read the `docs/README.md` **task-signal map** and only the sections it points to for your task — not the whole corpus. **Do NOT reverse-engineer conventions from source (Grep/Read) before reading these** — they exist precisely so you don't. Only recon the task-specific delta the docs deliberately don't freeze (a merged endpoint's exact DTO, a Blazor page's field list). **This applies to delegated subagents too**: tell each agent which doc section to read; never let one re-derive conventions from code. **Decision/convention lookups start at the active catalog**, `docs/decisions/README.md` — resolve by topic/key, never by chasing a file path named in a historical comment (the breadcrumb rule; see `docs/README.md` → "Knowledge retrieval").
+- **Docs-first is a HARD RULE — read before you explore**: before ANY API / SPA / E2E / parity / scheduling work, read `docs/README.md` (index) → the convention docs (`api-conventions`, `spa-conventions`, `e2e-local`, `domain-model`, `blazor-route-parity`, `decisions`). **Do NOT reverse-engineer conventions from source (Grep/Read) before reading these** — they exist precisely so you don't. Only recon the task-specific delta the docs deliberately don't freeze (a merged endpoint's exact DTO, a Blazor page's field list). **This applies to delegated subagents too**: tell each agent which doc section to read; never let one re-derive conventions from code.
 - **Docs-update is part of "done" — same PR, never a follow-up**: any PR that changes a convention, adds/migrates/redirects a route, adds/changes a `/api/*` endpoint, or reverses a decision MUST update the relevant doc in that same PR:

  | Change | Update in the same PR |
@@ -64,7 +64,7 @@ docker build -f docker/Dockerfile -t ersatztv:dev .
  | Migrate / add / redirect a route (new `web/src/screens/*.tsx`, `LegacyUiRedirects.cs`) | `docs/blazor-route-parity.md` + `docs/domain-model.md` |
  | Add / change a `/api/*` endpoint | `docs/api-conventions.md` checklist, then regenerate `v1.json` + `endpoint-index.md` via `./scripts/update-openapi.sh` |
  | Change a SPA screen convention | `docs/spa-conventions.md` |
-  | Establish / reverse a convention or decision | `docs/decisions.md` (lifecycle: add record, relocate predecessor to archive/) + the affected doc |
+  | Establish / reverse a convention or decision | `docs/decisions.md` (append-only) + the affected doc |
  | Add / remove / retitle a doc | `docs/README.md` index |

  The `docs-reminder` CI job flags a screen/route change that skips `blazor-route-parity.md`, but it's a **non-blocking** nudge — the rule is on you, not the check.
@@ -91,24 +91,11 @@ Both need Gitea read creds in the env to enforce (**`ETV_GITEA_BASICAUTH=user:pa
 1. **Root cause** (bug fixes / incidents only): Document WHY the problem existed, not just what was changed. If root cause is unknown, say so explicitly and open a follow-up investigation issue. Fixing symptoms without understanding causes creates recurring problems.
 2. **Comment on issues** as you work — what you found, what approach you're taking, any deviations from the suggested fix.
 3. **Push changes**: `git push` all commits before closing. Use `fixes #N` in commit messages to auto-close where appropriate.
-4. **Close comment**: Add a structured `## Closing record` comment on the issue (template below).
+4. **Close comment**: Add a structured closing comment on the issue covering: what was done, root cause (if applicable), files changed, anything deferred, follow-up issues created, and which docs were updated.
 5. **Close the issue** via API or `fixes #N` commit. Leave open with a comment only if partially addressed.
 6. **Update docs**: If the change affects operational behavior, update the relevant Obsidian docs (`~/homelab-docs/`), MEMORY.md, or CLAUDE.md inline — not as a follow-up.
 7. **Reply to reviewer** (if from adversarial review): Summary of done/deferred/questions. This triggers the next review cycle.

-**`## Closing record` template** (step 4 — this is both the human-readable summary and the per-issue unit MemPalace mines for retrieval; see `docs/handoffs/chicorytv-issue-queue.md` → "Knowledge retrieval" for the retrieval contract this feeds):
-
-```markdown
-## Closing record
-**Outcome:** <what shipped / what didn't; PR link>
-**Root cause:** <for bug fixes/incidents — why the problem existed, or "unknown, see follow-up #N">
-**Decisions/conventions changed:** <keys added/superseded in docs/decisions.md, or "none">
-**Reusable knowledge:** <a fact/gotcha worth surfacing to a future session or MemPalace search>
-**Verification:** <tests run, live-E2E, CI status>
-**Deferred:** <anything explicitly punted, with a follow-up issue link, or "none">
-**Docs updated:** <which docs/*.md files changed in this PR, or "none required and why">
-```
-
 ## Project Boundaries

 **ersatztv OWNS**: ErsatzTV fork code (C#/.NET), channel/collection/schedule management, M3U/XMLTV generation, the ErsatzTV skill in server-management.
@@ -3,12 +3,6 @@
        <InformationalVersion>develop</InformationalVersion>
        <IncludeSourceRevisionInInformationalVersion>false</IncludeSourceRevisionInInformationalVersion>
        <AllowMissingPrunePackageData>true</AllowMissingPrunePackageData>
-        <!-- Analyzer posture (ersatztv#15): enable the complete SDK rule set and the
-             threading analyzer in every centrally managed project. The checked-in globalconfig
-             keeps the SDK baseline at suggestion; individually promoted rules become CI-blocking. -->
-        <EnableNETAnalyzers>true</EnableNETAnalyzers>
-        <AnalysisLevel>latest-All</AnalysisLevel>
-        <EnableThreadingAnalyzers>true</EnableThreadingAnalyzers>
        <!-- NuGet audit (on by default in .NET 10) reports vulnerable transitive
             packages as NU1901-1904 warnings. Several projects set
             TreatWarningsAsErrors=true, which would otherwise fail `dotnet restore`
@@ -16,13 +10,8 @@
             advisories to warnings (still printed in build logs); NU1904 (critical)
             stays an error so criticals still block. Track fixes separately.
             WarningsAsErrors promotes NU1904 in EVERY project (even those without
-             TreatWarningsAsErrors), so "criticals block" actually holds repo-wide.
-             S3981 is the first explicitly promoted analyzer rule (ersatztv#15). -->
+             TreatWarningsAsErrors), so "criticals block" actually holds repo-wide. -->
        <WarningsNotAsErrors>$(WarningsNotAsErrors);NU1901;NU1902;NU1903</WarningsNotAsErrors>
-        <WarningsAsErrors>$(WarningsAsErrors);NU1904;S3981</WarningsAsErrors>
+        <WarningsAsErrors>$(WarningsAsErrors);NU1904</WarningsAsErrors>
    </PropertyGroup>
-
-    <ItemGroup>
-        <EditorConfigFiles Include="$(MSBuildThisFileDirectory)eng/analyzers/sdk-all-suggestion.globalconfig" />
-    </ItemGroup>
 </Project>
@@ -1,7 +1,9 @@
 <Project>
-    <!-- Guard on CPM so the gitignored .mcp tool, which deliberately uses inline package
-         versions, does not inherit a versionless analyzer PackageReference. -->
-    <ItemGroup Condition="'$(ManagePackageVersionsCentrally)' == 'true'">
+    <PropertyGroup>
+        <EnableThreadingAnalyzers Condition="'$(EnableThreadingAnalyzers)' == ''">false</EnableThreadingAnalyzers>
+    </PropertyGroup>
+
+    <ItemGroup>
        <PackageReference
            Include="Microsoft.VisualStudio.Threading.Analyzers"
            Condition="'$(EnableThreadingAnalyzers)' == 'true'">
@@ -10,11 +12,11 @@
        </PackageReference>
    </ItemGroup>

-    <!-- Curated static-analysis packs (ersatztv#15), applied to every centrally managed project.
-         Versions are central (Directory.Packages.props / CPM). Guarded on CPM so the gitignored
-         .mcp tool (which opts out of CPM) doesn't pull versionless references. They start at
-         `suggestion` severity in .editorconfig so they don't fail the TreatWarningsAsErrors build;
-         high-value rules are promoted to warning/error incrementally. -->
+    <!-- Curated static-analysis packs (ersatztv#15), applied to every project. Versions are
+         central (Directory.Packages.props / CPM). Guarded on CPM so the gitignored .mcp tool
+         (which opts out of CPM) doesn't pull versionless references. They start at `suggestion`
+         severity in .editorconfig so they don't fail the TreatWarningsAsErrors build; high-value
+         rules are promoted to warning/error incrementally. -->
    <ItemGroup Condition="'$(ManagePackageVersionsCentrally)' == 'true'">
        <PackageReference Include="Roslynator.Analyzers">
            <PrivateAssets>all</PrivateAssets>
@@ -19,7 +19,7 @@
    <PackageVersion Include="FluentValidation.AspNetCore" Version="11.3.1" />
    <PackageVersion Include="Flurl" Version="4.0.0" />
    <PackageVersion Include="Hardware.Info" Version="101.1.1.1" />
-    <PackageVersion Include="Humanizer.Core" Version="3.0.10" />
+    <PackageVersion Include="Humanizer.Core" Version="3.0.1" />
    <PackageVersion Include="Jint" Version="4.5.0" />
    <PackageVersion Include="JsonSchema.Net" Version="9.0.0" />
    <PackageVersion Include="LanguageExt.Core" Version="4.4.9" />
@@ -9,13 +9,8 @@ namespace ErsatzTV.Application.Artworks;
 public class UploadArtworkHandler : IRequestHandler<UploadArtwork, Either<BaseError, ArtworkUploadResponseModel>>
 {
    private readonly IImageCache _imageCache;
-    private readonly IRemoteImageValidator _validator;

-    public UploadArtworkHandler(IImageCache imageCache, IRemoteImageValidator validator)
-    {
-        _imageCache = imageCache;
-        _validator = validator;
-    }
+    public UploadArtworkHandler(IImageCache imageCache) => _imageCache = imageCache;

    public async Task<Either<BaseError, ArtworkUploadResponseModel>> Handle(
        UploadArtwork request,
@@ -43,22 +38,6 @@ public class UploadArtworkHandler : IRequestHandler<UploadArtwork, Either<BaseEr

        string contentType = maybeContentType.IfNone(string.Empty);

-        // One rule: anything entering the logo cache is decode-budget-checked. A supported format is
-        // not enough — a small header can declare a multi-gigabyte canvas (a decompression bomb), so
-        // reject it here before it lands in the cache. The synthetic upload:// Uri is only for the
-        // exception message text. (ersatztv#525)
-        using (var probe = new MemoryStream(bytes, writable: false))
-        {
-            try
-            {
-                await _validator.Validate(probe, new Uri("upload://artwork"), cancellationToken);
-            }
-            catch (Exception ex)
-            {
-                return BaseError.New($"Image cannot be used: {ex.Message}");
-            }
-        }
-
        using var toCache = new MemoryStream(bytes, writable: false);
        Either<BaseError, string> maybeFileName = await _imageCache.SaveArtworkToCache(
            toCache,
@@ -1,96 +0,0 @@
-using ErsatzTV.Core.Domain;
-
-namespace ErsatzTV.Application.Channels;
-
-public static class AutoTuneAxisMap
-{
-    // Server-owned Lucene smart-collection query for an axis value.
-    public static string GenerateQuery(AutoTuneAxis axis, string value)
-    {
-        string escaped = EscapeLuceneValue(value);
-        return axis switch
-        {
-            AutoTuneAxis.TvShow => $"type:episode AND show_title:\"{escaped}\"",
-            AutoTuneAxis.TvGenre => $"type:episode AND genre:\"{escaped}\"",
-            AutoTuneAxis.MovieGenre => $"type:movie AND genre:\"{escaped}\"",
-            _ => throw new ArgumentOutOfRangeException(nameof(axis), axis, null)
-        };
-    }
-
-    // Human-facing channel name. Movie-genre channels are suffixed so a genre that exists for
-    // both TV and movies ("Comedy" vs "Comedy Movies") does not produce two identically-named channels.
-    public static string GenerateName(AutoTuneAxis axis, string value) =>
-        axis switch
-        {
-            AutoTuneAxis.TvShow => value,
-            AutoTuneAxis.TvGenre => value,
-            AutoTuneAxis.MovieGenre => $"{value} Movies",
-            _ => throw new ArgumentOutOfRangeException(nameof(axis), axis, null)
-        };
-
-    // PseudoTV per-type defaults: single-show channels play in episode order; genre channels shuffle.
-    public static PlaybackOrder PlaybackOrderFor(AutoTuneAxis axis) =>
-        axis switch
-        {
-            AutoTuneAxis.TvShow => PlaybackOrder.SeasonEpisode,
-            AutoTuneAxis.TvGenre => PlaybackOrder.Shuffle,
-            AutoTuneAxis.MovieGenre => PlaybackOrder.Shuffle,
-            _ => throw new ArgumentOutOfRangeException(nameof(axis), axis, null)
-        };
-
-    // Per-source member query for a weighted auto-tune channel (#425). The discriminator identifies ONE
-    // content source within the channel's axis:
-    //   * TV axes  -> the show title. Episodes carry no parent-show id in the search index (only show_title
-    //     is denormalized onto them), so show_title is the only field that selects a show's episodes. It is
-    //     the same discriminator the TvShow axis already uses, so this introduces no new fragility class;
-    //     a post-create show rename empties the member (items fall through to the remainder) until re-tuned.
-    //   * MovieGenre -> the movie's media-item id (the stable, rename-proof `id` field; a movie IS the
-    //     played item, so its own id selects it exactly).
-    // Deliberately discriminator-ONLY (no genre clause): membership is decided when the channel is tuned,
-    // so a materialized show airs all its episodes and the remainder subtracts the whole source (below).
-    public static string GenerateSourceQuery(AutoTuneAxis axis, string discriminator) =>
-        axis switch
-        {
-            AutoTuneAxis.TvShow or AutoTuneAxis.TvGenre =>
-                $"type:episode AND show_title:\"{EscapeLuceneValue(discriminator)}\"",
-            AutoTuneAxis.MovieGenre => $"type:movie AND id:{discriminator}",
-            _ => throw new ArgumentOutOfRangeException(nameof(axis), axis, null)
-        };
-
-    // The bare clause used to subtract a materialized/excluded source from the remainder query (below).
-    // Mirrors GenerateSourceQuery's discriminator field, minus the type prefix.
-    public static string SourceDiscriminatorClause(AutoTuneAxis axis, string discriminator) =>
-        axis switch
-        {
-            AutoTuneAxis.TvShow or AutoTuneAxis.TvGenre =>
-                $"show_title:\"{EscapeLuceneValue(discriminator)}\"",
-            AutoTuneAxis.MovieGenre => $"id:{discriminator}",
-            _ => throw new ArgumentOutOfRangeException(nameof(axis), axis, null)
-        };
-
-    // The catch-all remainder query: the base axis query minus every materialized/excluded source, so the
-    // base set is partitioned across (member sources + remainder) with no item counted twice and none
-    // dropped. Returns the plain base query when there is nothing to subtract. Emitted as valid classic
-    // Lucene — `(base) AND NOT (d1 OR d2 ...)` — because a ParseException silently escapes the whole query
-    // into a literal (SearchQueryParser.ParseQuery fallback).
-    public static string GenerateRemainderQuery(
-        AutoTuneAxis axis,
-        string value,
-        IReadOnlyCollection<string> subtractedDiscriminators)
-    {
-        string baseQuery = GenerateQuery(axis, value);
-        if (subtractedDiscriminators is null || subtractedDiscriminators.Count == 0)
-        {
-            return baseQuery;
-        }
-
-        string negated = string.Join(
-            " OR ",
-            subtractedDiscriminators.Select(d => SourceDiscriminatorClause(axis, d)));
-        return $"({baseQuery}) AND NOT ({negated})";
-    }
-
-    // Escape a value for a Lucene double-quoted phrase: backslash first, then double-quote.
-    public static string EscapeLuceneValue(string value) =>
-        (value ?? string.Empty).Replace("\\", "\\\\").Replace("\"", "\\\"");
-}
@@ -1,27 +0,0 @@
-using System.Globalization;
-
-namespace ErsatzTV.Application.Channels;
-
-public static class AutoTuneNumberAllocator
-{
-    // Allocate `count` sequential integer channel numbers starting at `startingNumber`,
-    // skipping any number already present in `existingNumbers`. Channel.Number is a string,
-    // so numbers are returned as invariant-culture strings.
-    public static List<string> Allocate(int startingNumber, int count, ISet<string> existingNumbers)
-    {
-        var result = new List<string>(count);
-        int next = startingNumber;
-        while (result.Count < count)
-        {
-            string candidate = next.ToString(CultureInfo.InvariantCulture);
-            if (!existingNumbers.Contains(candidate))
-            {
-                result.Add(candidate);
-            }
-
-            next++;
-        }
-
-        return result;
-    }
-}
@@ -42,16 +42,6 @@ public class BulkDeleteChannelsHandler(

        dbContext.Channels.RemoveRange(channels);
        await dbContext.SaveChangesAsync(cancellationToken);
-
-        // Clean up the system-owned weighted-auto-tune artifacts these channels created (#425), inside the
-        // same transaction — see DeleteChannelHandler for the cascade rationale.
-        await dbContext.MultiCollections
-            .Where(mc => mc.OwnedByChannelId != null && channelIds.Contains(mc.OwnedByChannelId.Value))
-            .ExecuteDeleteAsync(cancellationToken);
-        await dbContext.SmartCollections
-            .Where(sc => sc.OwnedByChannelId != null && channelIds.Contains(sc.OwnedByChannelId.Value))
-            .ExecuteDeleteAsync(cancellationToken);
-
        await transaction.CommitAsync(cancellationToken);

        searchTargets.SearchTargetsChanged();
@@ -8,7 +8,6 @@ using ErsatzTV.Core.Api.LibraryBrowse;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.Domain.Filler;
 using ErsatzTV.Core.Errors;
-using ErsatzTV.Core.Interfaces.Images;
 using ErsatzTV.Core.Interfaces.Search;
 using ErsatzTV.Core.Scheduling;
 using ErsatzTV.Infrastructure.Data;
@@ -22,7 +21,6 @@ public class CreateChannelFromLineupHandler(
    ChannelWriter<IBackgroundServiceRequest> workerChannel,
    IDbContextFactory<TvContext> dbContextFactory,
    ISearchTargets searchTargets,
-    IRemoteLogoCacher remoteLogoCacher,
    ILogger<CreateChannelFromLineupHandler> logger)
    : IRequestHandler<CreateChannelFromLineup, Either<BaseError, CreateChannelFromLineupResponseModel>>
 {
@@ -39,42 +37,7 @@ public class CreateChannelFromLineupHandler(
        Either<BaseError, PreparedCreate> validation = await Validate(dbContext, request, cancellationToken);
        return await validation.Match(
            Left: error => Task.FromResult<Either<BaseError, CreateChannelFromLineupResponseModel>>(error),
-            Right: async prepared =>
-            {
-                Either<BaseError, PreparedCreate> resolved =
-                    await ResolveExternalLogo(request, prepared, cancellationToken);
-                return await resolved.Match(
-                    Left: error => Task.FromResult<Either<BaseError, CreateChannelFromLineupResponseModel>>(error),
-                    Right: p => PersistAndDispatch(dbContext, p, cancellationToken));
-            });
-    }
-
-    // The lineup logo artwork is built (in BuildChannel) with the raw request path. When that path is
-    // an external http(s) URL, download + cache it and swap the cache name onto the logo artwork before
-    // persisting (a cacher Left fails the whole create); a blank or already-local/cached path is left
-    // unchanged. (ersatztv#525)
-    private async Task<Either<BaseError, PreparedCreate>> ResolveExternalLogo(
-        CreateChannelFromLineup request,
-        PreparedCreate prepared,
-        CancellationToken cancellationToken)
-    {
-        string path = request.Logo?.Path ?? string.Empty;
-
-        if (!Artwork.IsExternalUrl(path))
-        {
-            return prepared;
-        }
-
-        Either<BaseError, string> cached = await remoteLogoCacher.CacheFromUrl(new Uri(path), cancellationToken);
-        return cached.Map(name =>
-        {
-            foreach (Artwork logo in prepared.Channel.Artwork.Where(a => a.ArtworkKind == ArtworkKind.Logo))
-            {
-                logo.Path = name;
-            }
-
-            return prepared;
-        });
+            Right: prepared => PersistAndDispatch(dbContext, prepared, cancellationToken));
    }

    private async Task<Either<BaseError, CreateChannelFromLineupResponseModel>> PersistAndDispatch(
@@ -234,25 +197,13 @@ public class CreateChannelFromLineupHandler(

        bool multiItem = normalized.Count >= 2;

-        // MultiCollection entries only support Shuffle / ShuffleInOrder / WeightedShuffle
-        // (mirrors PlayoutModeMustBeValid -- keep the two lists in step).
+        // MultiCollection entries only support Shuffle / ShuffleInOrder (mirrors PlayoutModeMustBeValid).
        if (normalized.Any(i => i.CollectionType is CollectionType.MultiCollection) &&
-            playbackOrder is not (PlaybackOrder.Shuffle or PlaybackOrder.ShuffleInOrder
-                or PlaybackOrder.WeightedShuffle))
+            playbackOrder is not (PlaybackOrder.Shuffle or PlaybackOrder.ShuffleInOrder))
        {
            return BaseError.New($"Invalid playback order for multi collection: '{playbackOrder}'");
        }

-        // A lineup of 2+ entries is persisted as a Playlist, and PlaylistEnumerator has no default arm: an
-        // order it doesn't know leaves the enumerator null and the items are dropped from the playlist with
-        // nothing reported. This is the second (and less obvious) persisting writer of
-        // PlaylistItem.PlaybackOrder, alongside ReplacePlaylistItems (#70; the silent fallbacks are #403).
-        if (multiItem && playbackOrder is PlaybackOrder.WeightedShuffle)
-        {
-            return BaseError.New(
-                $"Playback order '{playbackOrder}' is not supported for a multi-item lineup; it is available on classic schedule items");
-        }
-
        if (multiItem)
        {
            // The generated playlist cannot express rerun collections or nested playlists
@@ -1,10 +1,9 @@
-using System.Globalization;
+using System.Globalization;
 using System.Text.RegularExpressions;
 using System.Threading.Channels;
 using ErsatzTV.Core;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.Domain.Filler;
-using ErsatzTV.Core.Interfaces.Images;
 using ErsatzTV.Core.Interfaces.Search;
 using ErsatzTV.Infrastructure.Data;
 using ErsatzTV.Infrastructure.Extensions;
@@ -17,8 +16,7 @@ namespace ErsatzTV.Application.Channels;
 public class CreateChannelHandler(
    ChannelWriter<IBackgroundServiceRequest> workerChannel,
    IDbContextFactory<TvContext> dbContextFactory,
-    ISearchTargets searchTargets,
-    IRemoteLogoCacher remoteLogoCacher)
+    ISearchTargets searchTargets)
    : IRequestHandler<CreateChannel, Either<BaseError, CreateChannelResult>>
 {
    public async Task<Either<BaseError, CreateChannelResult>> Handle(
@@ -27,52 +25,7 @@ public class CreateChannelHandler(
    {
        await using TvContext dbContext = await dbContextFactory.CreateDbContextAsync(cancellationToken);
        Validation<BaseError, Channel> validation = await Validate(dbContext, request, cancellationToken);
-        return await validation.Match(
-            Succ: async channel =>
-            {
-                Either<BaseError, string> resolvedLogo = await ResolveLogoPath(request, cancellationToken);
-                return await resolvedLogo.Match(
-                    Right: async logoPath =>
-                    {
-                        ApplyResolvedLogo(request, channel, logoPath);
-                        return Right<BaseError, CreateChannelResult>(await PersistChannel(dbContext, channel));
-                    },
-                    Left: e => Task.FromResult(Left<BaseError, CreateChannelResult>(e)));
-            },
-            Fail: errors => Task.FromResult(Left<BaseError, CreateChannelResult>(errors.Join())));
-    }
-
-    // Resolve the incoming logo path into a value safe to persist. An external http(s) URL is
-    // downloaded and cached (a cacher Left fails the whole save); an empty path or an
-    // already-local/cached path passes through unchanged. (ersatztv#525)
-    private async Task<Either<BaseError, string>> ResolveLogoPath(
-        CreateChannel request,
-        CancellationToken cancellationToken)
-    {
-        string path = request.Logo?.Path ?? string.Empty;
-
-        if (!Artwork.IsExternalUrl(path))
-        {
-            return path;
-        }
-
-        Either<BaseError, string> cached = await remoteLogoCacher.CacheFromUrl(new Uri(path), cancellationToken);
-        return cached;
-    }
-
-    // When the incoming logo was an external URL, swap the downloaded cache name onto the logo
-    // artwork built during validation so no URL is ever persisted in Artwork.Path. (ersatztv#525)
-    private static void ApplyResolvedLogo(CreateChannel request, Channel channel, string resolvedLogoPath)
-    {
-        if (!Artwork.IsExternalUrl(request.Logo?.Path ?? string.Empty))
-        {
-            return;
-        }
-
-        foreach (Artwork logo in channel.Artwork.Where(a => a.ArtworkKind == ArtworkKind.Logo))
-        {
-            logo.Path = resolvedLogoPath;
-        }
+        return await validation.Apply(c => PersistChannel(dbContext, c));
    }

    private async Task<CreateChannelResult> PersistChannel(TvContext dbContext, Channel channel)
@@ -57,22 +57,9 @@ public class DeleteChannelHandler : IRequestHandler<DeleteChannel, Either<BaseEr
            _fileSystem.File.Delete(cacheFile);
        }

-        int channelId = channel.Id;
        dbContext.Channels.Remove(channel);
        await dbContext.SaveChangesAsync(cancellationToken);

-        // Clean up the system-owned weighted-auto-tune artifacts this channel created (#425): the
-        // MultiCollection (its cascade removes the now-dangling flood schedule item) and its per-source
-        // SmartCollections (cascade removes their join rows). Null OwnedByChannelId = a user collection, left
-        // untouched. Non-weighted (#69 single-SmartCollection) auto-tune channels set no ownership, so their
-        // pre-existing orphan-on-delete behavior is unchanged.
-        await dbContext.MultiCollections
-            .Where(mc => mc.OwnedByChannelId == channelId)
-            .ExecuteDeleteAsync(cancellationToken);
-        await dbContext.SmartCollections
-            .Where(sc => sc.OwnedByChannelId == channelId)
-            .ExecuteDeleteAsync(cancellationToken);
-
        _searchTargets.SearchTargetsChanged();

        // refresh channel list to remove channel that has no playout — post-commit side effect runs on
@@ -1,4 +1,4 @@
-using System.Globalization;
+using System.Globalization;
 using System.Text.RegularExpressions;
 using System.Threading.Channels;
 using ErsatzTV.Application.Subtitles;
@@ -6,7 +6,6 @@ using ErsatzTV.Core;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.Domain.Filler;
 using ErsatzTV.Core.Errors;
-using ErsatzTV.Core.Interfaces.Images;
 using ErsatzTV.Core.Interfaces.Search;
 using ErsatzTV.Infrastructure.Data;
 using ErsatzTV.Infrastructure.Extensions;
@@ -20,8 +19,7 @@ namespace ErsatzTV.Application.Channels;
 public class UpdateChannelHandler(
    ChannelWriter<IBackgroundServiceRequest> workerChannel,
    IDbContextFactory<TvContext> dbContextFactory,
-    ISearchTargets searchTargets,
-    IRemoteLogoCacher remoteLogoCacher)
+    ISearchTargets searchTargets)
    : IRequestHandler<UpdateChannel, Either<BaseError, ChannelViewModel>>
 {
    public async Task<Either<BaseError, ChannelViewModel>> Handle(
@@ -41,47 +39,29 @@ public class UpdateChannelHandler(
            {
                Validation<BaseError, Channel> validation =
                    await Validate(dbContext, request, channel, cancellationToken);
-                return await validation.Match(
-                    Succ: async c =>
-                    {
-                        Either<BaseError, string> resolvedLogo = await ResolveLogoPath(request, cancellationToken);
-                        return await resolvedLogo.Match(
-                            Right: async logoPath => Right<BaseError, ChannelViewModel>(
-                                await ApplyUpdateRequest(dbContext, c, request, logoPath, cancellationToken)),
-                            Left: e => Task.FromResult(Left<BaseError, ChannelViewModel>(e)));
-                    },
-                    Fail: errors => Task.FromResult(Left<BaseError, ChannelViewModel>(errors.Join())));
+                return await validation.Apply(c => ApplyUpdateRequest(dbContext, c, request, cancellationToken));
            },
            None: () => Task.FromResult(
                Left<BaseError, ChannelViewModel>(
                    new NotFoundError($"Channel {request.ChannelId} does not exist."))));
    }

-    // Resolve the incoming logo path into a value safe to persist. An external http(s) URL is
-    // downloaded and cached (a cacher Left fails the whole save); an empty path (logo removal) or an
-    // already-local/cached path passes through unchanged. (ersatztv#525)
-    private async Task<Either<BaseError, string>> ResolveLogoPath(
-        UpdateChannel request,
-        CancellationToken cancellationToken)
-    {
-        string path = request.Logo?.Path ?? string.Empty;
-
-        if (!Artwork.IsExternalUrl(path))
-        {
-            return path;
-        }
-
-        Either<BaseError, string> cached = await remoteLogoCacher.CacheFromUrl(new Uri(path), cancellationToken);
-        return cached;
-    }
-
    private async Task<ChannelViewModel> ApplyUpdateRequest(
        TvContext dbContext,
        Channel c,
        UpdateChannel update,
-        string resolvedLogoPath,
        CancellationToken cancellationToken)
    {
+        // don't save mirror when playout exists
+        if (c.Playouts.Count > 0)
+        {
+            update = update with
+            {
+                PlayoutSource = ChannelPlayoutSource.Generated,
+                MirrorSourceChannelId = null
+            };
+        }
+
        bool hasEpgChange = c.PlayoutSource != update.PlayoutSource || c.ShowInEpg != update.ShowInEpg;

        c.Name = update.Name;
@@ -106,9 +86,9 @@ public class UpdateChannelHandler(
        c.ShowInEpg = update.IsEnabled && update.ShowInEpg;
        c.Artwork ??= [];

-        if (!string.IsNullOrWhiteSpace(resolvedLogoPath))
+        if (!string.IsNullOrWhiteSpace(update.Logo?.Path))
        {
-            string logo = resolvedLogoPath;
+            string logo = update.Logo.Path;
            if (logo.StartsWith("iptv/logos/", StringComparison.Ordinal))
            {
                logo = logo.Replace("iptv/logos/", string.Empty);
@@ -160,8 +140,6 @@ public class UpdateChannelHandler(
            c.PlayoutMode = ChannelPlayoutMode.Continuous;
            hasEpgChange |= c.MirrorSourceChannelId != update.MirrorSourceChannelId;
            hasEpgChange |= c.PlayoutOffset != update.PlayoutOffset;
-            c.MirrorSourceChannelId = update.MirrorSourceChannelId;
-            c.PlayoutOffset = update.PlayoutOffset;
        }
        else
        {
@@ -169,6 +147,8 @@ public class UpdateChannelHandler(
            c.PlayoutOffset = null;
        }

+        c.MirrorSourceChannelId = update.MirrorSourceChannelId;
+        c.PlayoutOffset = update.PlayoutOffset;
        c.StreamingMode = update.StreamingMode;
        c.WatermarkId = update.WatermarkId;
        c.FallbackFillerId = update.FallbackFillerId;
@@ -196,13 +176,6 @@ public class UpdateChannelHandler(
            await workerChannel.WriteAsync(new RefreshChannelData(c.Number), CancellationToken.None);
        }

-        // Deliberately NOT Mapper.GetPlayoutsCount: this handler's query (see Handle) doesn't include
-        // MirrorSourceChannel, so the shared helper would read that navigation as null and return the
-        // same own-playouts-only count anyway — with a false air of Mirror-awareness. Harmless today
-        // because ChannelController discards this view model and re-projects through
-        // GetChannelByIdForApi, so this count never reaches the wire. If you ever return it directly,
-        // fix the QUERY first (add the MirrorSourceChannel ThenInclude) — swapping in the helper alone
-        // would report 0 playouts for a working mirror channel.
        return ProjectToViewModel(c, c.Playouts?.Count ?? 0);
    }

@@ -214,7 +187,7 @@ public class UpdateChannelHandler(
    {
        Validation<BaseError, Channel> channelValidation = (ValidateName(request),
            await ValidateNumber(dbContext, request, cancellationToken),
-            await MirrorSourceMustBeValid(dbContext, request, channel, cancellationToken),
+            await MirrorSourceMustBeValid(dbContext, request, cancellationToken),
            ValidateShowInEpg(request.IsEnabled, request.ShowInEpg),
            ValidateLogo(request.Logo?.Path))
        .Apply((_, _, _, _, _) => channel);
@@ -289,7 +262,6 @@ public class UpdateChannelHandler(
    private static async Task<Validation<BaseError, Unit>> MirrorSourceMustBeValid(
        TvContext dbContext,
        UpdateChannel request,
-        Channel channel,
        CancellationToken cancellationToken)
    {
        if (request.PlayoutSource is not ChannelPlayoutSource.Mirror)
@@ -297,18 +269,6 @@ public class UpdateChannelHandler(
            return Unit.Default;
        }

-        // a channel with its own playout already built (Generated mode) cannot become a Mirror —
-        // Mirror channels relay another channel's playout and never build one of their own, so
-        // switching this transition on would strand the existing playout. This used to be
-        // silently coerced back to Generated (issue #401); reject the transition instead so the
-        // caller sees why the requested Mirror source was not applied. A round-trip that keeps
-        // PlayoutSource as Generated never reaches this check.
-        if (channel.Playouts.Count > 0)
-        {
-            return BaseError.New(
-                "Channel cannot switch to Mirror playout source while it has a playout; reset or delete the existing playout first.");
-        }
-
        Option<Channel> maybeMirrorSource = await dbContext.Channels
            .AsNoTracking()
            .SelectOneAsync(
@@ -1,52 +0,0 @@
-using ErsatzTV.Application.Artworks;
-using ErsatzTV.Core.Domain;
-using MediatR;
-
-namespace ErsatzTV.Application.Channels;
-
-public record CreateAutoTunedChannels(
-    int TemplateId,
-    string Group,
-    List<AutoTuneChannelSelection> Channels) : IRequest<AutoTuneResult>;
-
-// The batch-level TemplateId is the default; any per-channel field set here overrides it for that one
-// channel. Advanced/Logo/TemplateId are all optional so the older positional {axis, value, name, number}
-// form (and every existing caller/test) keeps compiling and behaving identically.
-public record AutoTuneChannelSelection(
-    AutoTuneAxis Axis,
-    string Value,
-    string Name,
-    string Number,
-    int? TemplateId = null,
-    ArtworkContentTypeModel Logo = null,
-    CreateChannelFromLineupAdvancedOptions Advanced = null,
-    List<AutoTuneSourceWeight> Sources = null);
-
-// Per-content-source rotation weight + query correction for a weighted auto-tune channel (#425).
-// SourceId is the show id (TV axes) or movie media-item id (movie axis) from the members list (#384).
-// Weight is the relative share of airtime (weighted round-robin; 1 = fair-share). Excluded drops the
-// source entirely. A SourceId that is not in the axis's base set is an "add-untagged" source — materialized
-// like any other. When every entry is Weight 1 and not excluded (and adds nothing), the channel keeps the
-// single-SmartCollection fair-share shape; otherwise it is built as a MultiCollection of per-source
-// SmartCollections carrying the weights.
-public record AutoTuneSourceWeight(int SourceId, int Weight = 1, bool Excluded = false);
-
-public record AutoTuneResult(List<AutoTuneChannelOutcome> Results)
-{
-    public int CreatedCount => Results.Count(r => r.Status == AutoTuneOutcomeStatus.Created);
-    public int SkippedCount => Results.Count(r => r.Status == AutoTuneOutcomeStatus.Skipped);
-    public int FailedCount => Results.Count(r => r.Status == AutoTuneOutcomeStatus.Failed);
-}
-
-public record AutoTuneChannelOutcome(
-    string Name,
-    AutoTuneOutcomeStatus Status,
-    int? ChannelId,
-    string Reason);
-
-public enum AutoTuneOutcomeStatus
-{
-    Created,
-    Skipped,
-    Failed
-}
@@ -1,519 +0,0 @@
-using ErsatzTV.Application.Artworks;
-using ErsatzTV.Application.MediaCollections;
-using ErsatzTV.Core;
-using ErsatzTV.Core.Api.Channels;
-using ErsatzTV.Core.Api.LibraryBrowse;
-using ErsatzTV.Core.Domain;
-using ErsatzTV.Core.Interfaces.Search;
-using ErsatzTV.Core.Search;
-using ErsatzTV.Infrastructure.Data;
-using LanguageExt;
-using MediatR;
-using Microsoft.EntityFrameworkCore;
-
-namespace ErsatzTV.Application.Channels;
-
-public class CreateAutoTunedChannelsHandler(
-    ISender mediator,
-    IDbContextFactory<TvContext> dbContextFactory,
-    ISearchTargets searchTargets,
-    ISmartCollectionCache smartCollectionCache)
-    : IRequestHandler<CreateAutoTunedChannels, AutoTuneResult>
-{
-    private const string NumberTakenError = "Channel number must be unique";
-    private const string DefaultGroup = "Auto-Tuned";
-
-    // The members enumeration caps its own search at 10k leaf items, so a channel's distinct source count is
-    // already bounded (dozens/hundreds). One large page pulls them all.
-    private const int MaxSources = 10_000;
-
-    public async Task<AutoTuneResult> Handle(
-        CreateAutoTunedChannels request,
-        CancellationToken cancellationToken)
-    {
-        string group = string.IsNullOrWhiteSpace(request.Group) ? DefaultGroup : request.Group.Trim();
-        var outcomes = new List<AutoTuneChannelOutcome>();
-
-        foreach (AutoTuneChannelSelection selection in request.Channels ?? [])
-        {
-            outcomes.Add(await CreateOne(request.TemplateId, group, selection, cancellationToken));
-        }
-
-        return new AutoTuneResult(outcomes);
-    }
-
-    private async Task<AutoTuneChannelOutcome> CreateOne(
-        int templateId,
-        string group,
-        AutoTuneChannelSelection selection,
-        CancellationToken cancellationToken)
-    {
-        string name = (selection.Name ?? string.Empty).Trim();
-        if (name.Length is 0 or > 50)
-        {
-            return new AutoTuneChannelOutcome(name, AutoTuneOutcomeStatus.Failed, null, "Invalid channel name");
-        }
-
-        // Per-channel template override falls back to the batch template.
-        int effectiveTemplateId = selection.TemplateId ?? templateId;
-
-        // Per-channel uploaded channel image; None = generate the on-the-fly fallback logo at serve time.
-        ArtworkContentTypeModel logo = selection.Logo ?? ArtworkContentTypeModel.None;
-
-        // Per-source rotation weights / query corrections (#425) turn the channel from one fair-share
-        // SmartCollection into a MultiCollection of per-source SmartCollections carrying the weights. Only
-        // when the caller actually customized a source (a non-default weight, an exclusion, or an added
-        // out-of-axis source) — otherwise the single-SmartCollection fair-share shape is kept (cheaper, and
-        // identical output for TV since the fake-collection path already groups per show).
-        WeightedPlan plan = await BuildWeightedPlan(selection, cancellationToken);
-        if (plan is not null)
-        {
-            return await CreateWeightedChannel(
-                effectiveTemplateId, group, name, logo, selection, plan, cancellationToken);
-        }
-
-        return await CreateSingleSmartCollectionChannel(
-            effectiveTemplateId,
-            group,
-            name,
-            logo,
-            selection,
-            cancellationToken);
-    }
-
-    private async Task<AutoTuneChannelOutcome> CreateSingleSmartCollectionChannel(
-        int effectiveTemplateId,
-        string group,
-        string name,
-        ArtworkContentTypeModel logo,
-        AutoTuneChannelSelection selection,
-        CancellationToken cancellationToken)
-    {
-        string query = AutoTuneAxisMap.GenerateQuery(selection.Axis, selection.Value);
-
-        // The axis default (SeasonEpisode for a single show, Shuffle for a genre) is the playback order
-        // unless the DetailPanel set an explicit per-channel override. Any other Advanced field the caller
-        // set is layered on top of the template by CreateChannelFromLineup's `advanced.X ?? template.X`
-        // stamp-at-create contract, so we only have to fill in the axis-derived PlaybackOrder default here.
-        PlaybackOrder axisOrder = AutoTuneAxisMap.PlaybackOrderFor(selection.Axis);
-        CreateChannelFromLineupAdvancedOptions advanced =
-            (selection.Advanced ?? new CreateChannelFromLineupAdvancedOptions()) with
-            {
-                PlaybackOrder = selection.Advanced?.PlaybackOrder ?? axisOrder
-            };
-
-        // 1. Create the smart collection that drives this channel.
-        Either<BaseError, SmartCollectionViewModel> scResult =
-            await mediator.Send(new CreateSmartCollection(query, name), cancellationToken);
-
-        SmartCollectionViewModel smartCollection = null;
-        foreach (BaseError error in scResult.LeftToSeq())
-        {
-            return new AutoTuneChannelOutcome(
-                name, AutoTuneOutcomeStatus.Failed, null, $"Smart collection: {error.Value}");
-        }
-
-        foreach (SmartCollectionViewModel vm in scResult.RightToSeq())
-        {
-            smartCollection = vm;
-        }
-
-        // 2. Create the channel from a single-item lineup referencing the smart collection.
-        var command = new CreateChannelFromLineup(
-            name,
-            selection.Number,
-            group,
-            string.Empty,
-            logo,
-            IsEnabled: true,
-            ShowInEpg: true,
-            effectiveTemplateId,
-            advanced,
-            [
-                new CreateChannelFromLineupItem(
-                    LibraryBrowseMediaType.SmartCollection,
-                    CollectionType.SmartCollection,
-                    CollectionId: null,
-                    MultiCollectionId: null,
-                    SmartCollectionId: smartCollection.Id,
-                    RerunCollectionId: null,
-                    MediaItemId: null,
-                    PlaylistId: null)
-            ]);
-
-        Either<BaseError, CreateChannelFromLineupResponseModel> channelResult =
-            await mediator.Send(command, cancellationToken);
-
-        foreach (BaseError error in channelResult.LeftToSeq())
-        {
-            // Roll back the smart collection we just created so a retry of this
-            // axis/value doesn't fail on SmartCollection-name uniqueness. Best-effort;
-            // the primary outcome below is still Skipped/Failed regardless of the delete result.
-            // Swallow any exception (not just an Either.Left) so a transient infra failure
-            // during rollback never aborts this channel's outcome or the batch; the
-            // orphaned SmartCollection is an acceptable degraded outcome.
-            try
-            {
-                await mediator.Send(new DeleteSmartCollection(smartCollection.Id), cancellationToken);
-            }
-            catch (Exception)
-            {
-                // intentionally ignored; see comment above
-            }
-
-            AutoTuneOutcomeStatus status = error.Value.Contains(NumberTakenError, StringComparison.Ordinal)
-                ? AutoTuneOutcomeStatus.Skipped
-                : AutoTuneOutcomeStatus.Failed;
-            return new AutoTuneChannelOutcome(name, status, null, error.Value);
-        }
-
-        int channelId = channelResult.Match(Left: _ => 0, Right: r => r.ChannelId);
-        return new AutoTuneChannelOutcome(name, AutoTuneOutcomeStatus.Created, channelId, null);
-    }
-
-    // A resolved weighting plan: the per-source member queries + their weights, and the catch-all remainder.
-    // Null when the caller did not actually customize anything (fall back to the single-SmartCollection path).
-    private sealed record WeightedPlan(List<WeightedMember> Members, WeightedMember Remainder);
-
-    private sealed record WeightedMember(string Query, int Weight);
-
-    // Resolve the caller's per-source overrides against the channel's live base source set. Returns null when
-    // no source was customized (all weights 1, nothing excluded, nothing added) so the caller keeps the
-    // single-SmartCollection fair-share shape.
-    private async Task<WeightedPlan> BuildWeightedPlan(
-        AutoTuneChannelSelection selection,
-        CancellationToken cancellationToken)
-    {
-        List<AutoTuneSourceWeight> sources = selection.Sources ?? [];
-        if (sources.Count == 0)
-        {
-            return null;
-        }
-
-        // Enumerate the axis's distinct base sources (parent shows for TV, movies for the movie axis) exactly
-        // as the DetailPanel members list does, so weight resolution matches what the user saw.
-        PagedLibraryBrowseItemsResponseModel members = await mediator.Send(
-            new GetAutoTuneChannelMembers(selection.Axis, selection.Value, 0, MaxSources),
-            cancellationToken);
-
-        var baseIds = members.Page.Select(i => i.Id).ToHashSet();
-
-        // Any override touching a non-default weight, an exclusion, or an id outside the base set means the
-        // channel really is customized; otherwise the plan would be identical to fair-share.
-        bool customized = sources.Any(s => s.Weight != 1 || s.Excluded || !baseIds.Contains(s.SourceId));
-        if (!customized)
-        {
-            return null;
-        }
-
-        Dictionary<int, AutoTuneSourceWeight> overridesById = sources
-            .GroupBy(s => s.SourceId)
-            .ToDictionary(g => g.Key, g => g.Last());
-
-        return selection.Axis switch
-        {
-            AutoTuneAxis.MovieGenre => BuildMoviePlan(selection, members, overridesById),
-            _ => await BuildTvPlan(selection, members, overridesById, cancellationToken)
-        };
-    }
-
-    // TV: every base show becomes its own weighted SmartCollection (discriminator-only `show_title`) so
-    // un-weighted shows keep per-show fair-share — a single merged remainder would regress them to
-    // item-proportional (a 200-episode show would swamp a 20-episode one). The remainder is the live
-    // catch-all for shows/episodes added after tune-in, at weight 1.
-    private async Task<WeightedPlan> BuildTvPlan(
-        AutoTuneChannelSelection selection,
-        PagedLibraryBrowseItemsResponseModel members,
-        Dictionary<int, AutoTuneSourceWeight> overridesById,
-        CancellationToken cancellationToken)
-    {
-        var weightedMembers = new List<WeightedMember>();
-        var subtracted = new List<string>();
-
-        // Base shows (title is the discriminator; the members list already carries it).
-        var baseIds = members.Page.Select(i => i.Id).ToHashSet();
-        foreach (LibraryBrowseItemResponseModel item in members.Page)
-        {
-            AutoTuneSourceWeight ov = overridesById.GetValueOrDefault(item.Id);
-            if (ov is { Excluded: true })
-            {
-                subtracted.Add(item.Title);
-                continue;
-            }
-
-            weightedMembers.Add(new WeightedMember(
-                AutoTuneAxisMap.GenerateSourceQuery(selection.Axis, item.Title),
-                NormalizeWeight(ov?.Weight ?? 1)));
-            subtracted.Add(item.Title);
-        }
-
-        // Added (out-of-axis) shows: resolve the title from metadata since the members list won't include them.
-        List<int> addedIds = overridesById.Keys.Where(id => !baseIds.Contains(id)).ToList();
-        if (addedIds.Count > 0)
-        {
-            await using TvContext dbContext = await dbContextFactory.CreateDbContextAsync(cancellationToken);
-            Dictionary<int, string> titles = (await dbContext.ShowMetadata
-                    .AsNoTracking()
-                    .Where(sm => addedIds.Contains(sm.ShowId))
-                    .Select(sm => new { sm.ShowId, sm.Title })
-                    .ToListAsync(cancellationToken))
-                .GroupBy(x => x.ShowId)
-                .ToDictionary(g => g.Key, g => g.First().Title);
-
-            foreach (int id in addedIds)
-            {
-                AutoTuneSourceWeight ov = overridesById[id];
-                if (ov.Excluded || !titles.TryGetValue(id, out string title) || string.IsNullOrWhiteSpace(title))
-                {
-                    continue;
-                }
-
-                weightedMembers.Add(new WeightedMember(
-                    AutoTuneAxisMap.GenerateSourceQuery(selection.Axis, title),
-                    NormalizeWeight(ov.Weight)));
-                subtracted.Add(title);
-            }
-        }
-
-        var remainder = new WeightedMember(
-            AutoTuneAxisMap.GenerateRemainderQuery(selection.Axis, selection.Value, subtracted),
-            1);
-
-        return new WeightedPlan(weightedMembers, remainder);
-    }
-
-    // Movies: materialize only the touched movies (a non-default weight, or an added out-of-axis movie) as
-    // individual `id:{n}` SmartCollections; every un-touched base movie stays in ONE remainder whose weight is
-    // its member count. Because the fake-collection path already pools all movies uniformly, a count-weighted
-    // remainder is exactly equivalent to materializing each movie individually — without hundreds of rows.
-    private static WeightedPlan BuildMoviePlan(
-        AutoTuneChannelSelection selection,
-        PagedLibraryBrowseItemsResponseModel members,
-        Dictionary<int, AutoTuneSourceWeight> overridesById)
-    {
-        var weightedMembers = new List<WeightedMember>();
-        var subtracted = new List<string>();
-
-        var baseIds = members.Page.Select(i => i.Id).ToHashSet();
-        var subtractedBase = 0;
-
-        foreach ((int id, AutoTuneSourceWeight ov) in overridesById)
-        {
-            bool inBase = baseIds.Contains(id);
-            string idClause = id.ToString(System.Globalization.CultureInfo.InvariantCulture);
-
-            if (ov.Excluded)
-            {
-                subtracted.Add(idClause);
-                if (inBase)
-                {
-                    subtractedBase++;
-                }
-
-                continue;
-            }
-
-            // Materialize weighted base movies and every added (out-of-axis) movie; a base movie left at
-            // weight 1 is cheaper to leave in the remainder (same airtime either way).
-            if (ov.Weight != 1 || !inBase)
-            {
-                weightedMembers.Add(new WeightedMember(
-                    AutoTuneAxisMap.GenerateSourceQuery(selection.Axis, idClause),
-                    NormalizeWeight(ov.Weight)));
-                subtracted.Add(idClause);
-                if (inBase)
-                {
-                    subtractedBase++;
-                }
-            }
-        }
-
-        // Remainder weight = the un-touched base movie count, so a weighted movie airs N× *each* remainder
-        // movie (the fake path already pools movies uniformly, so this is equivalent to materializing each).
-        // Clamped to MultiCollectionItemWeight.Maximum (1000): a genre with >1000 un-touched movies can't
-        // express the exact ratio (the weighted movie then airs slightly more than intended) — the same
-        // 1..1000 bound #70's weight column imposes everywhere. Realistic only at very large scale.
-        int remainderCount = baseIds.Count - subtractedBase;
-        var remainder = new WeightedMember(
-            AutoTuneAxisMap.GenerateRemainderQuery(selection.Axis, selection.Value, subtracted),
-            NormalizeWeight(remainderCount));
-
-        return new WeightedPlan(weightedMembers, remainder);
-    }
-
-    private static int NormalizeWeight(int weight) =>
-        Math.Clamp(weight, MultiCollectionItemWeight.Minimum, MultiCollectionItemWeight.Maximum);
-
-    private async Task<AutoTuneChannelOutcome> CreateWeightedChannel(
-        int effectiveTemplateId,
-        string group,
-        string name,
-        ArtworkContentTypeModel logo,
-        AutoTuneChannelSelection selection,
-        WeightedPlan plan,
-        CancellationToken cancellationToken)
-    {
-        // WeightedShuffle is the whole point; it overrides any axis default / caller Advanced.PlaybackOrder.
-        CreateChannelFromLineupAdvancedOptions advanced =
-            (selection.Advanced ?? new CreateChannelFromLineupAdvancedOptions()) with
-            {
-                PlaybackOrder = PlaybackOrder.WeightedShuffle
-            };
-
-        // Short unique token: the channel id isn't known until CreateChannelFromLineup runs, and both
-        // SmartCollection.Name and MultiCollection.Name are unique varchar(50).
-        string token = Guid.NewGuid().ToString("N")[..8];
-
-        int multiCollectionId;
-        List<int> smartCollectionIds;
-        await using (TvContext dbContext = await dbContextFactory.CreateDbContextAsync(cancellationToken))
-        {
-            var multiCollection = new MultiCollection
-            {
-                Name = $"at-mc:{token}",
-                MultiCollectionItems = [],
-                MultiCollectionSmartItems = []
-            };
-
-            var index = 0;
-            foreach (WeightedMember member in plan.Members.Append(plan.Remainder))
-            {
-                var smartCollection = new SmartCollection
-                {
-                    Name = index == plan.Members.Count ? $"at:{token}:rem" : $"at:{token}:{index}",
-                    Query = member.Query
-                };
-
-                dbContext.SmartCollections.Add(smartCollection);
-                multiCollection.MultiCollectionSmartItems.Add(new MultiCollectionSmartItem
-                {
-                    MultiCollection = multiCollection,
-                    SmartCollection = smartCollection,
-                    ScheduleAsGroup = false,
-                    PlaybackOrder = PlaybackOrder.Shuffle,
-                    Weight = member.Weight
-                });
-
-                index++;
-            }
-
-            dbContext.MultiCollections.Add(multiCollection);
-
-            try
-            {
-                await dbContext.SaveChangesAsync(cancellationToken);
-            }
-            catch (Exception ex)
-            {
-                return new AutoTuneChannelOutcome(
-                    name, AutoTuneOutcomeStatus.Failed, null, $"Weighted collections: {ex.Message}");
-            }
-
-            multiCollectionId = multiCollection.Id;
-            smartCollectionIds = multiCollection.MultiCollectionSmartItems
-                .Select(i => i.SmartCollectionId)
-                .ToList();
-
-            // New smart collections became visible; refresh targets + cache like CreateSmartCollectionHandler
-            // (post-commit, CancellationToken.None so a late cancel can't abort it after the commit landed).
-            searchTargets.SearchTargetsChanged();
-            await smartCollectionCache.Refresh(CancellationToken.None);
-        }
-
-        var command = new CreateChannelFromLineup(
-            name,
-            selection.Number,
-            group,
-            string.Empty,
-            logo,
-            IsEnabled: true,
-            ShowInEpg: true,
-            effectiveTemplateId,
-            advanced,
-            [
-                new CreateChannelFromLineupItem(
-                    LibraryBrowseMediaType.MultiCollection,
-                    CollectionType.MultiCollection,
-                    CollectionId: null,
-                    MultiCollectionId: multiCollectionId,
-                    SmartCollectionId: null,
-                    RerunCollectionId: null,
-                    MediaItemId: null,
-                    PlaylistId: null)
-            ]);
-
-        Either<BaseError, CreateChannelFromLineupResponseModel> channelResult =
-            await mediator.Send(command, cancellationToken);
-
-        foreach (BaseError error in channelResult.LeftToSeq())
-        {
-            // Roll back the multi collection + its member smart collections so a retry doesn't collide on
-            // name uniqueness. Best-effort; the outcome below stands regardless of the cleanup result.
-            await TryDeleteOwnedArtifacts(multiCollectionId, smartCollectionIds, cancellationToken);
-
-            AutoTuneOutcomeStatus status = error.Value.Contains(NumberTakenError, StringComparison.Ordinal)
-                ? AutoTuneOutcomeStatus.Skipped
-                : AutoTuneOutcomeStatus.Failed;
-            return new AutoTuneChannelOutcome(name, status, null, error.Value);
-        }
-
-        int channelId = channelResult.Match(Left: _ => 0, Right: r => r.ChannelId);
-
-        // Stamp ownership so the artifacts are hidden from user collection lists and cleaned up on channel
-        // delete. Best-effort: an unstamped artifact is a cosmetic/cleanup issue, never a failed channel.
-        await TryStampOwnership(multiCollectionId, smartCollectionIds, channelId);
-
-        return new AutoTuneChannelOutcome(name, AutoTuneOutcomeStatus.Created, channelId, null);
-    }
-
-    private async Task TryStampOwnership(
-        int multiCollectionId,
-        List<int> smartCollectionIds,
-        int channelId)
-    {
-        try
-        {
-            // Post-commit side effect: runs on CancellationToken.None so a late request cancellation can't
-            // abort it after the channel-create commit landed (#254) — an un-stamped artifact would be a
-            // permanent orphan (never cleaned on delete, and visible in the user collection lists). The MC +
-            // its member smart collections are stamped in one transaction so a mid-way failure can't leave the
-            // MC owned while the smart collections stay orphaned.
-            await using TvContext dbContext = await dbContextFactory.CreateDbContextAsync(CancellationToken.None);
-            await using var transaction = await dbContext.Database.BeginTransactionAsync(CancellationToken.None);
-            await dbContext.MultiCollections
-                .Where(mc => mc.Id == multiCollectionId)
-                .ExecuteUpdateAsync(s => s.SetProperty(mc => mc.OwnedByChannelId, channelId), CancellationToken.None);
-            await dbContext.SmartCollections
-                .Where(sc => smartCollectionIds.Contains(sc.Id))
-                .ExecuteUpdateAsync(s => s.SetProperty(sc => sc.OwnedByChannelId, channelId), CancellationToken.None);
-            await transaction.CommitAsync(CancellationToken.None);
-        }
-        catch (Exception)
-        {
-            // intentionally ignored; see call site
-        }
-    }
-
-    private async Task TryDeleteOwnedArtifacts(
-        int multiCollectionId,
-        List<int> smartCollectionIds,
-        CancellationToken cancellationToken)
-    {
-        try
-        {
-            await using TvContext dbContext = await dbContextFactory.CreateDbContextAsync(cancellationToken);
-            await dbContext.MultiCollections
-                .Where(mc => mc.Id == multiCollectionId)
-                .ExecuteDeleteAsync(cancellationToken);
-            await dbContext.SmartCollections
-                .Where(sc => smartCollectionIds.Contains(sc.Id))
-                .ExecuteDeleteAsync(cancellationToken);
-            searchTargets.SearchTargetsChanged();
-            await smartCollectionCache.Refresh(CancellationToken.None);
-        }
-        catch (Exception)
-        {
-            // intentionally ignored; see call site
-        }
-    }
-}
@@ -1,13 +0,0 @@
-using ErsatzTV.Core.Api.LibraryBrowse;
-using ErsatzTV.Core.Domain;
-
-namespace ErsatzTV.Application.Channels;
-
-// Read-only enumeration of the distinct content-source members a proposed auto-tune channel's
-// server-generated SmartCollection query resolves to (issue #384). The client passes axis+value; the
-// server owns query generation (AutoTuneAxisMap.GenerateQuery) — the client never sends Lucene.
-public record GetAutoTuneChannelMembers(
-    AutoTuneAxis Axis,
-    string Value,
-    int PageNum,
-    int PageSize) : IRequest<PagedLibraryBrowseItemsResponseModel>;
@@ -1,168 +0,0 @@
-using ErsatzTV.Application.LibraryBrowse;
-using ErsatzTV.Core.Api.LibraryBrowse;
-using ErsatzTV.Core.Domain;
-using ErsatzTV.Core.Interfaces.Search;
-using ErsatzTV.Core.Search;
-using ErsatzTV.Infrastructure.Data;
-using ErsatzTV.Infrastructure.Search;
-using Microsoft.EntityFrameworkCore;
-
-namespace ErsatzTV.Application.Channels;
-
-// Runs the server-owned SmartCollection query for an axis value through the same search index the
-// built channel's playout uses, then rolls the matching leaf items up to their distinct content
-// sources: parent shows for the episode axes, movies for the movie-genre axis. Feeds the Auto-Tune
-// DetailPanel's read-only-by-default source list (#383/#384).
-public class GetAutoTuneChannelMembersHandler(
-    ISearchIndex searchIndex,
-    IDbContextFactory<TvContext> dbContextFactory)
-    : IRequestHandler<GetAutoTuneChannelMembers, PagedLibraryBrowseItemsResponseModel>
-{
-    // Mirrors MediaCollectionRepository.GetSmartCollectionItems: the index dislikes a zero limit, so
-    // pull up to 10k matching leaf items and group in memory. A source whose matches fall entirely
-    // beyond this cap would be under-counted (the same staleness bound the smart-collection path
-    // already accepts) — realistic axis values resolve to far fewer than 10k items.
-    private const int SearchLimit = 10_000;
-
-    public async Task<PagedLibraryBrowseItemsResponseModel> Handle(
-        GetAutoTuneChannelMembers request,
-        CancellationToken cancellationToken)
-    {
-        // An out-of-range numeric axis binds successfully (ModelState stays valid, so [ApiController]'s
-        // auto-400 does not fire); treat it as no results rather than letting GenerateQuery's
-        // ArgumentOutOfRangeException surface as a 500 — matching #69's EnumerateAxis `_ => []`.
-        if (string.IsNullOrWhiteSpace(request.Value) || !Enum.IsDefined(request.Axis))
-        {
-            return new PagedLibraryBrowseItemsResponseModel(0, []);
-        }
-
-        string query = AutoTuneAxisMap.GenerateQuery(request.Axis, request.Value);
-        SearchResult searchResults = await searchIndex.Search(
-            query,
-            string.Empty,
-            0,
-            SearchLimit,
-            cancellationToken);
-
-        await using TvContext dbContext = await dbContextFactory.CreateDbContextAsync(cancellationToken);
-
-        return request.Axis switch
-        {
-            AutoTuneAxis.MovieGenre => await MovieMembers(dbContext, searchResults, request, cancellationToken),
-            _ => await ShowMembers(dbContext, searchResults, request, cancellationToken)
-        };
-    }
-
-    // Episode axes (TvShow / TvGenre): roll matching episodes up to their distinct parent shows.
-    private static async Task<PagedLibraryBrowseItemsResponseModel> ShowMembers(
-        TvContext dbContext,
-        SearchResult searchResults,
-        GetAutoTuneChannelMembers request,
-        CancellationToken cancellationToken)
-    {
-        List<int> episodeIds = searchResults.Items
-            .Where(i => i.Type == LuceneSearchIndex.EpisodeType)
-            .Select(i => i.Id)
-            .ToList();
-
-        if (episodeIds.Count == 0)
-        {
-            return new PagedLibraryBrowseItemsResponseModel(0, []);
-        }
-
-        // Per-show count is the number of episodes THIS channel's query contributes, not the show's
-        // total episode count (Episode -> Season -> ShowId; proven query style from LibraryBrowseItemMapper).
-        Dictionary<int, int> matchCountByShow = (await dbContext.Episodes
-                .AsNoTracking()
-                .Where(e => episodeIds.Contains(e.Id))
-                .Select(e => new { e.Id, e.Season.ShowId })
-                .ToListAsync(cancellationToken))
-            .GroupBy(x => x.ShowId)
-            .ToDictionary(g => g.Key, g => g.Count());
-
-        List<int> showIds = matchCountByShow.Keys.ToList();
-
-        // Order the distinct shows by title, then page (the show set is bounded — dozens, not thousands).
-        List<int> orderedShowIds = (await dbContext.ShowMetadata
-                .AsNoTracking()
-                .Where(sm => showIds.Contains(sm.ShowId))
-                .Select(sm => new { sm.ShowId, sm.Title })
-                .ToListAsync(cancellationToken))
-            .GroupBy(x => x.ShowId)
-            .Select(g => new { ShowId = g.Key, Title = g.OrderBy(x => x.Title).Select(x => x.Title).FirstOrDefault() })
-            .OrderBy(x => x.Title, StringComparer.OrdinalIgnoreCase)
-            .ThenBy(x => x.ShowId)
-            .Select(x => x.ShowId)
-            .ToList();
-
-        int total = orderedShowIds.Count;
-        List<int> pageIds = orderedShowIds
-            .Skip(request.PageNum * request.PageSize)
-            .Take(request.PageSize)
-            .ToList();
-
-        List<LibraryBrowseItemResponseModel> hydrated =
-            await LibraryBrowseItemMapper.GetShows(dbContext, pageIds, cancellationToken);
-        Dictionary<int, LibraryBrowseItemResponseModel> byId = hydrated.ToDictionary(s => s.Id);
-
-        // GetShows groups by show id, so restore the requested title order and override its total-episode
-        // ItemCount with the query-matching count.
-        List<LibraryBrowseItemResponseModel> ordered = pageIds
-            .Where(byId.ContainsKey)
-            .Select(id => byId[id] with
-            {
-                ItemCount = matchCountByShow.TryGetValue(id, out int count) ? count : byId[id].ItemCount
-            })
-            .ToList();
-
-        return new PagedLibraryBrowseItemsResponseModel(total, ordered);
-    }
-
-    // Movie-genre axis: the matching movies are themselves the distinct content sources.
-    private static async Task<PagedLibraryBrowseItemsResponseModel> MovieMembers(
-        TvContext dbContext,
-        SearchResult searchResults,
-        GetAutoTuneChannelMembers request,
-        CancellationToken cancellationToken)
-    {
-        List<int> movieIds = searchResults.Items
-            .Where(i => i.Type == LuceneSearchIndex.MovieType)
-            .Select(i => i.Id)
-            .Distinct()
-            .ToList();
-
-        if (movieIds.Count == 0)
-        {
-            return new PagedLibraryBrowseItemsResponseModel(0, []);
-        }
-
-        List<int> orderedMovieIds = (await dbContext.MovieMetadata
-                .AsNoTracking()
-                .Where(mm => movieIds.Contains(mm.MovieId))
-                .Select(mm => new { mm.MovieId, mm.Title })
-                .ToListAsync(cancellationToken))
-            .GroupBy(x => x.MovieId)
-            .Select(g => new { MovieId = g.Key, Title = g.OrderBy(x => x.Title).Select(x => x.Title).FirstOrDefault() })
-            .OrderBy(x => x.Title, StringComparer.OrdinalIgnoreCase)
-            .ThenBy(x => x.MovieId)
-            .Select(x => x.MovieId)
-            .ToList();
-
-        int total = orderedMovieIds.Count;
-        List<int> pageIds = orderedMovieIds
-            .Skip(request.PageNum * request.PageSize)
-            .Take(request.PageSize)
-            .ToList();
-
-        List<LibraryBrowseItemResponseModel> hydrated =
-            await LibraryBrowseItemMapper.GetMovies(dbContext, pageIds, cancellationToken);
-        Dictionary<int, LibraryBrowseItemResponseModel> byId = hydrated.ToDictionary(m => m.Id);
-
-        List<LibraryBrowseItemResponseModel> ordered = pageIds
-            .Where(byId.ContainsKey)
-            .Select(id => byId[id])
-            .ToList();
-
-        return new PagedLibraryBrowseItemsResponseModel(total, ordered);
-    }
-}
@@ -1,4 +1,4 @@
-using ErsatzTV.Application.Artworks;
+using ErsatzTV.Application.Artworks;
 using ErsatzTV.Core.Api.Channels;
 using ErsatzTV.Core.Domain;

@@ -6,29 +6,6 @@ namespace ErsatzTV.Application.Channels;

 internal static class Mapper
 {
-    /// <summary>
-    ///     A mirror channel has no playouts of its own; it relays the playouts of its mirror source, so both must be
-    ///     counted for the total to answer "can this channel play anything?". Requires <see cref="Channel.Playouts" />
-    ///     and, for mirrors, <see cref="Channel.MirrorSourceChannel" />.<see cref="Channel.Playouts" /> to be included
-    ///     by the query — the repository reads are AsNoTracking, so an un-included navigation silently counts zero.
-    /// </summary>
-    internal static int GetPlayoutsCount(Channel channel)
-    {
-        var result = 0;
-
-        if (channel.Playouts != null)
-        {
-            result += channel.Playouts.Count;
-        }
-
-        if (channel.PlayoutSource is ChannelPlayoutSource.Mirror && channel.MirrorSourceChannel?.Playouts != null)
-        {
-            result += channel.MirrorSourceChannel.Playouts.Count;
-        }
-
-        return result;
-    }
-
    internal static ChannelViewModel ProjectToViewModel(Channel channel, int playoutCount) =>
        new(
            channel.Id,
@@ -96,7 +73,7 @@ internal static class Mapper
            channel.ShowInEpg);
    }

-    internal static ChannelResponseModel ProjectToResponseModel(Channel channel, int playoutCount) =>
+    internal static ChannelResponseModel ProjectToResponseModel(Channel channel) =>
        new(
            channel.Id,
            channel.Number,
@@ -108,9 +85,7 @@ internal static class Mapper
            channel.PreferredAudioLanguageCode,
            GetStreamingMode(channel),
            channel.IsEnabled,
-            channel.ShowInEpg,
-            playoutCount,
-            GetLogoUrl(channel));
+            channel.ShowInEpg);

    internal static ResolutionViewModel ProjectToViewModel(Resolution resolution) =>
        new(resolution.Height, resolution.Width);
@@ -124,31 +99,6 @@ internal static class Mapper
            channel.FFmpegProfile.VideoProfile,
            channel.FFmpegProfile.AudioFormat);

-    // Rooted, directly-usable channel-logo URL for the SPA's <img src> on browse surfaces (guide grid +
-    // channels list), following the #181 artwork convention (docs/api-conventions.md §4): the SPA does no
-    // client-side path building. External logo URLs pass through as-is; an uploaded logo ("iptv/logos/{file}")
-    // is rooted with a leading slash so it resolves against the site root regardless of the current SPA route.
-    // Returns null when the channel has no logo, so the SPA falls back to the generated initials "bug".
-#nullable enable
-    internal static string? GetLogoUrl(Channel channel)
-    {
-        // Browse surfaces must not crash the whole list over a missing Artwork include; GetLogo assumes
-        // the caller included Channel.Artwork (GetAll + the guide query do), but stay defensive here.
-        if (channel.Artwork is null)
-        {
-            return null;
-        }
-
-        ArtworkContentTypeModel logo = GetLogo(channel);
-        if (string.IsNullOrWhiteSpace(logo.Path))
-        {
-            return null;
-        }
-
-        return logo.IsExternalUrl || logo.Path.StartsWith('/') ? logo.Path : $"/{logo.Path}";
-    }
-#nullable restore
-
    private static ArtworkContentTypeModel GetLogo(Channel channel)
    {
        Option<Artwork> maybeArtwork = channel.Artwork
@@ -1,19 +0,0 @@
-using ErsatzTV.Core;
-using ErsatzTV.Core.Domain;
-using LanguageExt;
-using MediatR;
-
-namespace ErsatzTV.Application.Channels;
-
-public record PreviewAutoTuneChannels(
-    List<AutoTuneAxis> Axes,
-    int MinItems,
-    int StartingNumber) : IRequest<Either<BaseError, List<AutoTuneProposal>>>;
-
-public record AutoTuneProposal(
-    AutoTuneAxis Axis,
-    string Value,
-    string Name,
-    string Number,
-    int ItemCount,
-    bool AlreadyExists);
@@ -1,144 +0,0 @@
-using ErsatzTV.Core;
-using ErsatzTV.Core.Domain;
-using ErsatzTV.Infrastructure.Data;
-using LanguageExt;
-using MediatR;
-using Microsoft.EntityFrameworkCore;
-
-namespace ErsatzTV.Application.Channels;
-
-public class PreviewAutoTuneChannelsHandler(IDbContextFactory<TvContext> dbContextFactory)
-    : IRequestHandler<PreviewAutoTuneChannels, Either<BaseError, List<AutoTuneProposal>>>
-{
-    public async Task<Either<BaseError, List<AutoTuneProposal>>> Handle(
-        PreviewAutoTuneChannels request,
-        CancellationToken cancellationToken)
-    {
-        if (request.Axes is null || request.Axes.Count == 0)
-        {
-            return BaseError.New("At least one axis is required");
-        }
-
-        if (request.MinItems < 1)
-        {
-            return BaseError.New("Minimum items must be at least 1");
-        }
-
-        if (request.StartingNumber < 1)
-        {
-            return BaseError.New("Starting channel number must be at least 1");
-        }
-
-        await using TvContext dbContext = await dbContextFactory.CreateDbContextAsync(cancellationToken);
-
-        // Enumerate (axis, value, count) triples per requested axis, preserving axis order.
-        var raw = new List<(AutoTuneAxis Axis, string Value, int Count)>();
-        foreach (AutoTuneAxis axis in request.Axes.Distinct())
-        {
-            raw.AddRange(await EnumerateAxis(dbContext, axis, request.MinItems, cancellationToken));
-        }
-
-        System.Collections.Generic.HashSet<string> existingNumbers = (await dbContext.Channels.AsNoTracking()
-                .Select(c => c.Number).ToListAsync(cancellationToken))
-            .ToHashSet();
-        System.Collections.Generic.HashSet<string> existingNames = (await dbContext.Channels.AsNoTracking()
-                .Select(c => c.Name).ToListAsync(cancellationToken))
-            .ToHashSet(StringComparer.OrdinalIgnoreCase);
-
-        // Drop entries whose generated name would be rejected at create time (Channel name <= 50
-        // chars) before number allocation, so numbers aren't wasted on proposals that can never
-        // be created.
-        List<(AutoTuneAxis Axis, string Value, int Count, string Name)> survivors = raw
-            .Select(r => (r.Axis, r.Value, r.Count, Name: AutoTuneAxisMap.GenerateName(r.Axis, r.Value)))
-            .Where(r => r.Name.Length <= 50)
-            .ToList();
-
-        List<string> numbers = AutoTuneNumberAllocator.Allocate(
-            request.StartingNumber, survivors.Count, existingNumbers);
-
-        var proposals = new List<AutoTuneProposal>(survivors.Count);
-        for (int i = 0; i < survivors.Count; i++)
-        {
-            (AutoTuneAxis axis, string value, int count, string name) = survivors[i];
-            proposals.Add(new AutoTuneProposal(
-                axis, value, name, numbers[i], count, existingNames.Contains(name)));
-        }
-
-        return proposals;
-    }
-
-    private static async Task<List<(AutoTuneAxis, string, int)>> EnumerateAxis(
-        TvContext dbContext, AutoTuneAxis axis, int minItems, CancellationToken cancellationToken) =>
-        axis switch
-        {
-            AutoTuneAxis.TvShow => await EnumerateTvShows(dbContext, minItems, cancellationToken),
-            AutoTuneAxis.TvGenre => await EnumerateEpisodeGenres(dbContext, minItems, cancellationToken),
-            AutoTuneAxis.MovieGenre => await EnumerateMovieGenres(dbContext, minItems, cancellationToken),
-            _ => []
-        };
-
-    private static async Task<List<(AutoTuneAxis, string, int)>> EnumerateTvShows(
-        TvContext dbContext, int minItems, CancellationToken cancellationToken)
-    {
-        // Episode count per show id (Episode -> Season -> ShowId). Proven query style from LibraryBrowseItemMapper.
-        Dictionary<int, int> episodeCounts = await dbContext.Episodes.AsNoTracking()
-            .GroupBy(e => e.Season.ShowId)
-            .Select(g => new { ShowId = g.Key, Count = g.Count() })
-            .ToDictionaryAsync(g => g.ShowId, g => g.Count, cancellationToken);
-
-        var showTitles = await dbContext.ShowMetadata.AsNoTracking()
-            .Select(sm => new { sm.ShowId, sm.Title })
-            .ToListAsync(cancellationToken);
-
-        // Collapse shows that share a title (the generated show_title query matches them together).
-        var byTitle = new Dictionary<string, int>();
-        foreach (var row in showTitles)
-        {
-            if (string.IsNullOrWhiteSpace(row.Title))
-            {
-                continue;
-            }
-
-            episodeCounts.TryGetValue(row.ShowId, out int count);
-            byTitle[row.Title] = byTitle.GetValueOrDefault(row.Title) + count;
-        }
-
-        return byTitle
-            .Where(kv => kv.Value >= minItems)
-            .OrderBy(kv => kv.Key, StringComparer.OrdinalIgnoreCase)
-            .Select(kv => (AutoTuneAxis.TvShow, kv.Key, kv.Value))
-            .ToList();
-    }
-
-    private static async Task<List<(AutoTuneAxis, string, int)>> EnumerateEpisodeGenres(
-        TvContext dbContext, int minItems, CancellationToken cancellationToken)
-    {
-        var counts = await dbContext.EpisodeMetadata.AsNoTracking()
-            .SelectMany(m => m.Genres)
-            .GroupBy(g => g.Name)
-            .Select(grp => new { Name = grp.Key, Count = grp.Count() })
-            .ToListAsync(cancellationToken);
-
-        return counts
-            .Where(c => !string.IsNullOrWhiteSpace(c.Name) && c.Count >= minItems)
-            .OrderBy(c => c.Name, StringComparer.OrdinalIgnoreCase)
-            .Select(c => (AutoTuneAxis.TvGenre, c.Name, c.Count))
-            .ToList();
-    }
-
-    private static async Task<List<(AutoTuneAxis, string, int)>> EnumerateMovieGenres(
-        TvContext dbContext, int minItems, CancellationToken cancellationToken)
-    {
-        var counts = await dbContext.MovieMetadata.AsNoTracking()
-            .SelectMany(m => m.Genres)
-            .GroupBy(g => g.Name)
-            .Select(grp => new { Name = grp.Key, Count = grp.Count() })
-            .ToListAsync(cancellationToken);
-
-        return counts
-            .Where(c => !string.IsNullOrWhiteSpace(c.Name) && c.Count >= minItems)
-            .OrderBy(c => c.Name, StringComparer.OrdinalIgnoreCase)
-            .Select(c => (AutoTuneAxis.MovieGenre, c.Name, c.Count))
-            .ToList();
-    }
-}
@@ -1,4 +1,4 @@
-using ErsatzTV.Core.Api.Channels;
+using ErsatzTV.Core.Api.Channels;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.Interfaces.Repositories;
 using static ErsatzTV.Application.Channels.Mapper;
@@ -13,6 +13,6 @@ public class GetAllChannelsForApiHandler(IChannelRepository channelRepository)
        CancellationToken cancellationToken)
    {
        IEnumerable<Channel> channels = Optional(await channelRepository.GetAll(cancellationToken)).Flatten();
-        return channels.Map(c => ProjectToResponseModel(c, GetPlayoutsCount(c))).ToList();
+        return channels.Map(ProjectToResponseModel).ToList();
    }
 }
@@ -1,4 +1,4 @@
-using ErsatzTV.Core.Domain;
+using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.Interfaces.Repositories;
 using static ErsatzTV.Application.Channels.Mapper;

@@ -11,4 +11,21 @@ public class GetAllChannelsHandler(IChannelRepository channelRepository)
        await channelRepository.GetAll(cancellationToken)
            .Map(list => list.Where(c => c.IsEnabled || request.ShowDisabled)
                .Map(c => ProjectToViewModel(c, GetPlayoutsCount(c))).ToList());
+
+    private static int GetPlayoutsCount(Channel channel)
+    {
+        var result = 0;
+
+        if (channel.Playouts != null)
+        {
+            result += channel.Playouts.Count;
+        }
+
+        if (channel.PlayoutSource is ChannelPlayoutSource.Mirror && channel.MirrorSourceChannel?.Playouts != null)
+        {
+            result += channel.MirrorSourceChannel.Playouts.Count;
+        }
+
+        return result;
+    }
 }
@@ -11,5 +11,5 @@ public class GetChannelByIdForApiHandler(IChannelRepository channelRepository)
        GetChannelByIdForApi request,
        CancellationToken cancellationToken) =>
        channelRepository.GetChannel(request.Id)
-            .MapT(channel => ProjectToDetailResponseModel(channel, GetPlayoutsCount(channel)));
+            .MapT(channel => ProjectToDetailResponseModel(channel, channel.Playouts?.Count ?? 0));
 }
@@ -47,7 +47,6 @@ public class GetChannelGuideDataHandler(
        List<Channel> channels = await dbContext.Channels
            .AsNoTracking()
            .Where(c => c.ShowInEpg)
-            .Include(c => c.Artwork)
            .Include(c => c.MirrorSourceChannel)
            .ToListAsync(cancellationToken);

@@ -122,7 +121,6 @@ public class GetChannelGuideDataHandler(
                new ChannelGuideChannelResponseModel(
                    channel.Number,
                    channel.Name,
-                    Mapper.GetLogoUrl(channel),
                    programmes.OrderBy(p => p.Start).ToList()));
        }

@@ -1,12 +1,9 @@
 using System.Collections.Immutable;
 using System.IO.Abstractions;
-using System.Security;
 using System.Text;
 using System.Text.RegularExpressions;
 using ErsatzTV.Core;
-using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.Interfaces.Metadata;
-using ErsatzTV.Core.Interfaces.Repositories;
 using ErsatzTV.Core.Iptv;
 using ErsatzTV.Infrastructure.Data;
 using Microsoft.EntityFrameworkCore;
@@ -18,8 +15,7 @@ public partial class GetChannelGuideHandler(
    IDbContextFactory<TvContext> dbContextFactory,
    RecyclableMemoryStreamManager recyclableMemoryStreamManager,
    IFileSystem fileSystem,
-    ILocalFileSystem localFileSystem,
-    IConfigElementRepository configElementRepository)
+    ILocalFileSystem localFileSystem)
    : IRequestHandler<GetChannelGuide, Either<BaseError, ChannelGuide>>
 {
    public async Task<Either<BaseError, ChannelGuide>> Handle(
@@ -27,21 +23,6 @@ public partial class GetChannelGuideHandler(
        CancellationToken cancellationToken)
    {
        await using TvContext dbContext = await dbContextFactory.CreateDbContextAsync(cancellationToken);
-
-        Option<string> maybeBaseUrl =
-            await configElementRepository.GetValue<string>(ConfigElementKey.IptvBaseUrl, cancellationToken);
-
-        (string scheme, string host, string baseUrl) = AdvertisedBaseUrl.Resolve(
-            maybeBaseUrl.IfNone(string.Empty),
-            request.Scheme,
-            request.Host,
-            request.BaseUrl);
-
-        // The cache fragments are pre-built XML written raw (like {AccessTokenUri}, which is already
-        // emitted as &amp;), so the substituted base must be XML-escaped. A path prefix can legally
-        // contain '&' (Uri keeps it out of the query), which would otherwise emit a bare '&' and
-        // malform the whole guide. Normal URLs have no special chars, so this is a no-op for them.
-        string requestBase = SecurityElement.Escape($"{scheme}://{host}{baseUrl}");
        var hiddenChannelNumbers = dbContext.Channels
            .Where(c => c.ShowInEpg == false)
            .Select(c => c.Number)
@@ -60,17 +41,14 @@ public partial class GetChannelGuideHandler(
        var accessTokenUri = $"?v={mtime}";
        if (!string.IsNullOrWhiteSpace(request.AccessToken))
        {
-            // The token value is HTTP-request-derived and interpolated raw into the pre-built XMLTV
-            // cache fragments, so it must be XML-escaped like {RequestBase} above — a token containing
-            // '&', '<', '>', or '"' would otherwise malform the whole guide. Opaque tokens are a no-op.
-            accessTokenUri += $"&amp;access_token={SecurityElement.Escape(request.AccessToken)}";
+            accessTokenUri += $"&amp;access_token={request.AccessToken}";
        }

        string channelsFragment = await ReadAllTextShared(channelsFile, cancellationToken);

        // TODO: is regex faster?
        channelsFragment = channelsFragment
-            .Replace("{RequestBase}", requestBase)
+            .Replace("{RequestBase}", $"{request.Scheme}://{request.Host}{request.BaseUrl}")
            .Replace("{AccessTokenUri}", accessTokenUri);

        var channelDataFragments = new Dictionary<string, string>();
@@ -92,7 +70,7 @@ public partial class GetChannelGuideHandler(
                string channelDataFragment = await ReadAllTextShared(fileName, cancellationToken);

                channelDataFragment = channelDataFragment
-                    .Replace("{RequestBase}", requestBase)
+                    .Replace("{RequestBase}", $"{request.Scheme}://{request.Host}{request.BaseUrl}")
                    .Replace("{AccessTokenUri}", accessTokenUri);

                channelDataFragment = EtvTagRegex().Replace(channelDataFragment, string.Empty);
@@ -4,31 +4,19 @@ using ErsatzTV.Core.Iptv;

 namespace ErsatzTV.Application.Channels;

-public class GetChannelPlaylistHandler(
-    IChannelRepository channelRepository,
-    IConfigElementRepository configElementRepository)
+public class GetChannelPlaylistHandler(IChannelRepository channelRepository)
    : IRequestHandler<GetChannelPlaylist, ChannelPlaylist>
 {
-    public async Task<ChannelPlaylist> Handle(GetChannelPlaylist request, CancellationToken cancellationToken)
-    {
-        Option<string> maybeBaseUrl =
-            await configElementRepository.GetValue<string>(ConfigElementKey.IptvBaseUrl, cancellationToken);
-
-        (string scheme, string host, string baseUrl) = AdvertisedBaseUrl.Resolve(
-            maybeBaseUrl.IfNone(string.Empty),
-            request.Scheme,
-            request.Host,
-            request.BaseUrl);
-
-        List<Channel> channels = EnsureMode(await channelRepository.GetAll(cancellationToken), request.Mode);
-        return new ChannelPlaylist(
-            scheme,
-            host,
-            baseUrl,
-            channels,
-            request.UserAgent,
-            request.AccessToken);
-    }
+    public Task<ChannelPlaylist> Handle(GetChannelPlaylist request, CancellationToken cancellationToken) =>
+        channelRepository.GetAll(cancellationToken)
+            .Map(channels => EnsureMode(channels, request.Mode))
+            .Map(channels => new ChannelPlaylist(
+                request.Scheme,
+                request.Host,
+                request.BaseUrl,
+                channels,
+                request.UserAgent,
+                request.AccessToken));

    private static List<Channel> EnsureMode(IEnumerable<Channel> channels, string mode)
    {
@@ -2,7 +2,6 @@ using ErsatzTV.Core.Api.Channels;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.Domain.Filler;
 using ErsatzTV.Core.Interfaces.FFmpeg;
-using ErsatzTV.Core.Interfaces.Streaming;
 using ErsatzTV.Infrastructure.Data;
 using Microsoft.EntityFrameworkCore;
 using PlayoutMapper = ErsatzTV.Application.Playouts.Mapper;
@@ -11,8 +10,7 @@ namespace ErsatzTV.Application.Channels;

 public class GetChannelStatesForApiHandler(
    IDbContextFactory<TvContext> dbContextFactory,
-    IFFmpegSegmenterService ffmpegSegmenterService,
-    IDirectStreamSessionTracker directStreamSessionTracker)
+    IFFmpegSegmenterService ffmpegSegmenterService)
    : IRequestHandler<GetChannelStatesForApi, List<ChannelStateResponseModel>>
 {
    // a guide entry (program + surrounding filler) never spans anywhere near a day; the time
@@ -143,8 +141,7 @@ public class GetChannelStatesForApiHandler(
                return new ChannelStateResponseModel(
                    channel.Id,
                    channel.Number,
-                    ffmpegSegmenterService.IsActive(channel.Number) ||
-                    directStreamSessionTracker.IsActive(channel.Number),
+                    ffmpegSegmenterService.IsActive(channel.Number),
                    nowPlaying);
            })
            .ToList();
@@ -1,7 +1,6 @@
 using ErsatzTV.Core;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.Errors;
-using ErsatzTV.Infrastructure.Data;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.ChangeTracking;

@@ -71,32 +70,6 @@ public static class ConcurrencyExtensions
        }
    }

-    /// <summary>
-    ///     Like <see cref="SaveChangesForcingVersion" />, but additionally treats a unique / primary-key
-    ///     constraint violation as an idempotent no-op: returns <c>false</c> instead of throwing when the
-    ///     save fails because a concurrent request inserted a row we had membership-checked absent (the
-    ///     composite-PK race on <c>CollectionItem</c> — issue #308). A <c>false</c> means "the desired row
-    ///     already exists because a racing writer won; the winner ran the ETag rotation + fan-out, so skip
-    ///     ours." <c>true</c> means our own change committed. Every other <see cref="DbUpdateException" />
-    ///     (and the genuine deleted-row concurrency conflict rethrown by <see cref="SaveChangesForcingVersion" />)
-    ///     still propagates. The only insert these callers stage is the <c>CollectionItem</c> join row, so the
-    ///     sole unique/PK constraint that can fire here is that composite key.
-    /// </summary>
-    public static async Task<bool> TrySaveChangesForcingVersion(
-        this DbContext dbContext,
-        CancellationToken cancellationToken)
-    {
-        try
-        {
-            await dbContext.SaveChangesForcingVersion(cancellationToken);
-            return true;
-        }
-        catch (DbUpdateException ex) when (TvContext.IsUniqueConstraintViolation(ex))
-        {
-            return false;
-        }
-    }
-
    /// <summary>
    ///     Persist pending changes, mapping the EF optimistic-concurrency failure to
    ///     <see cref="PreconditionFailedError" /> (→ 412). When a versioned root carries an
@@ -1,5 +0,0 @@
-using ErsatzTV.Core;
-
-namespace ErsatzTV.Application.Configuration;
-
-public record UpdateIptvSettings(IptvSettingsViewModel IptvSettings) : IRequest<Either<BaseError, Unit>>;
@@ -1,51 +0,0 @@
-using ErsatzTV.Core;
-using ErsatzTV.Core.Domain;
-using ErsatzTV.Core.Interfaces.Repositories;
-using ErsatzTV.Core.Iptv;
-
-namespace ErsatzTV.Application.Configuration;
-
-public class UpdateIptvSettingsHandler(IConfigElementRepository configElementRepository)
-    : IRequestHandler<UpdateIptvSettings, Either<BaseError, Unit>>
-{
-    public async Task<Either<BaseError, Unit>> Handle(
-        UpdateIptvSettings request,
-        CancellationToken cancellationToken)
-    {
-        Validation<BaseError, Unit> validation = Validate(request);
-        return await validation.Apply<Unit, Unit>(_ => ApplyUpdate(request.IptvSettings, cancellationToken));
-    }
-
-    private async Task<Unit> ApplyUpdate(IptvSettingsViewModel iptvSettings, CancellationToken cancellationToken)
-    {
-        string baseUrl = (iptvSettings.BaseUrl ?? string.Empty).Trim();
-
-        // A blank value clears the setting so the request-derived behavior is restored.
-        if (string.IsNullOrWhiteSpace(baseUrl))
-        {
-            await configElementRepository.Delete(ConfigElementKey.IptvBaseUrl, cancellationToken);
-        }
-        else
-        {
-            await configElementRepository.Upsert(ConfigElementKey.IptvBaseUrl, baseUrl, cancellationToken);
-        }
-
-        return Unit.Default;
-    }
-
-    private static Validation<BaseError, Unit> Validate(UpdateIptvSettings request)
-    {
-        string baseUrl = request.IptvSettings.BaseUrl;
-
-        // Blank is valid (clears the override); a non-blank value must be a well-formed advertised base URL.
-        if (string.IsNullOrWhiteSpace(baseUrl))
-        {
-            return Unit.Default;
-        }
-
-        return AdvertisedBaseUrl.TryParse(baseUrl)
-            .Map(_ => Unit.Default)
-            .ToValidation<BaseError>(
-                "Advertised base URL must be an absolute http(s) URL with no credentials, query, or fragment");
-    }
-}
@@ -1,6 +0,0 @@
-namespace ErsatzTV.Application.Configuration;
-
-public class IptvSettingsViewModel
-{
-    public string BaseUrl { get; set; }
-}
@@ -1,3 +0,0 @@
-namespace ErsatzTV.Application.Configuration;
-
-public record GetIptvSettings : IRequest<IptvSettingsViewModel>;
@@ -1,19 +0,0 @@
-using ErsatzTV.Core.Domain;
-using ErsatzTV.Core.Interfaces.Repositories;
-
-namespace ErsatzTV.Application.Configuration;
-
-public class GetIptvSettingsHandler(IConfigElementRepository configElementRepository)
-    : IRequestHandler<GetIptvSettings, IptvSettingsViewModel>
-{
-    public async Task<IptvSettingsViewModel> Handle(GetIptvSettings request, CancellationToken cancellationToken)
-    {
-        Option<string> maybeBaseUrl =
-            await configElementRepository.GetValue<string>(ConfigElementKey.IptvBaseUrl, cancellationToken);
-
-        return new IptvSettingsViewModel
-        {
-            BaseUrl = await maybeBaseUrl.IfNoneAsync(string.Empty)
-        };
-    }
-}
@@ -4,6 +4,7 @@
        <TargetFramework>net10.0</TargetFramework>
        <NoWarn>VSTHRD200,CA1873</NoWarn>
        <ImplicitUsings>enable</ImplicitUsings>
+        <AnalysisLevel>latest-Recommended</AnalysisLevel>
        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
        <Configurations>Debug;Release;Debug No Sync</Configurations>
    </PropertyGroup>
@@ -26,10 +27,4 @@
        <ProjectReference Include="..\ErsatzTV.Infrastructure\ErsatzTV.Infrastructure.csproj" />
    </ItemGroup>

-    <ItemGroup>
-        <AssemblyAttribute Include="System.Runtime.CompilerServices.InternalsVisibleToAttribute">
-            <_Parameter1>ErsatzTV.Tests</_Parameter1>
-        </AssemblyAttribute>
-    </ItemGroup>
-
 </Project>
@@ -1,4 +1,4 @@
-using ErsatzTV.Core;
+using ErsatzTV.Core;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.FFmpeg;

@@ -34,5 +34,4 @@ public record CreateFFmpegProfile(
    int AudioSampleRate,
    bool NormalizeFramerate,
    bool NormalizeColors,
-    bool DeinterlaceVideo,
-    bool QsvPreferNativeDecoder) : IRequest<Either<BaseError, CreateFFmpegProfileResult>>;
+    bool DeinterlaceVideo) : IRequest<Either<BaseError, CreateFFmpegProfileResult>>;
@@ -1,8 +1,7 @@
-using ErsatzTV.Core;
+using ErsatzTV.Core;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.Errors;
 using ErsatzTV.Core.Interfaces.Search;
-using ErsatzTV.FFmpeg;
 using ErsatzTV.Infrastructure.Data;
 using ErsatzTV.Infrastructure.Extensions;
 using Microsoft.EntityFrameworkCore;
@@ -68,11 +67,7 @@ public class CreateFFmpegProfileHandler :
                HardwareAcceleration = hwAccel,
                VaapiDriver = request.VaapiDriver,
                VaapiDevice = request.VaapiDevice,
-                // store what the pipeline will actually use, never a pool size FFmpegState would
-                // floor away at render time (ersatztv#529)
-                QsvExtraHardwareFrames = request.QsvExtraHardwareFrames is { } frames
-                    ? Math.Max(frames, FFmpegState.MinimumQsvExtraHardwareFrames)
-                    : null,
+                QsvExtraHardwareFrames = request.QsvExtraHardwareFrames,
                ResolutionId = resolutionId,
                ScalingBehavior = request.ScalingBehavior,

@@ -110,8 +105,7 @@ public class CreateFFmpegProfileHandler :
                AudioSampleRate = request.AudioSampleRate,
                NormalizeFramerate = request.NormalizeFramerate,
                NormalizeColors = request.NormalizeColors,
-                DeinterlaceVideo = request.DeinterlaceVideo,
-                QsvPreferNativeDecoder = request.QsvPreferNativeDecoder
+                DeinterlaceVideo = request.DeinterlaceVideo
            };
        });

@@ -1,4 +1,4 @@
-using ErsatzTV.Core;
+using ErsatzTV.Core;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.FFmpeg;

@@ -35,5 +35,4 @@ public record UpdateFFmpegProfile(
    int AudioSampleRate,
    bool NormalizeFramerate,
    bool NormalizeColors,
-    bool DeinterlaceVideo,
-    bool QsvPreferNativeDecoder) : IRequest<Either<BaseError, UpdateFFmpegProfileResult>>;
+    bool DeinterlaceVideo) : IRequest<Either<BaseError, UpdateFFmpegProfileResult>>;
@@ -3,7 +3,6 @@ using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.Errors;
 using ErsatzTV.Core.FFmpeg;
 using ErsatzTV.Core.Interfaces.Search;
-using ErsatzTV.FFmpeg;
 using ErsatzTV.FFmpeg.Preset;
 using ErsatzTV.Infrastructure.Data;
 using ErsatzTV.Infrastructure.Extensions;
@@ -55,11 +54,7 @@ public class UpdateFFmpegProfileHandler(IDbContextFactory<TvContext> dbContextFa
        p.VaapiDisplay = update.VaapiDisplay;
        p.VaapiDriver = update.VaapiDriver;
        p.VaapiDevice = update.VaapiDevice;
-        // store what the pipeline will actually use, so a profile doesn't keep displaying a pool
-        // size that FFmpegState floors away at render time (ersatztv#529)
-        p.QsvExtraHardwareFrames = update.QsvExtraHardwareFrames is { } frames
-            ? Math.Max(frames, FFmpegState.MinimumQsvExtraHardwareFrames)
-            : null;
+        p.QsvExtraHardwareFrames = update.QsvExtraHardwareFrames;
        p.ResolutionId = update.ResolutionId;
        p.ScalingBehavior = update.ScalingBehavior;
        p.PadMode = update.PadMode;
@@ -107,7 +102,6 @@ public class UpdateFFmpegProfileHandler(IDbContextFactory<TvContext> dbContextFa
        p.NormalizeFramerate = update.NormalizeFramerate;
        p.NormalizeColors = update.NormalizeColors;
        p.DeinterlaceVideo = update.DeinterlaceVideo;
-        p.QsvPreferNativeDecoder = update.QsvPreferNativeDecoder;

        // don't save invalid preset
        ICollection<string> presets = FFmpegLibraryHelper.PresetsForFFmpegProfile(
@@ -1,4 +1,4 @@
-using ErsatzTV.Application.Resolutions;
+using ErsatzTV.Application.Resolutions;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.FFmpeg;

@@ -35,5 +35,4 @@ public record FFmpegProfileViewModel(
    int AudioSampleRate,
    bool NormalizeFramerate,
    bool NormalizeColors,
-    bool DeinterlaceVideo,
-    bool QsvPreferNativeDecoder);
+    bool DeinterlaceVideo);
@@ -1,4 +1,4 @@
-using ErsatzTV.Core.Api.FFmpegProfiles;
+using ErsatzTV.Core.Api.FFmpegProfiles;
 using ErsatzTV.Core.Domain;

 namespace ErsatzTV.Application.FFmpegProfiles;
@@ -37,8 +37,7 @@ internal static class Mapper
            profile.AudioSampleRate,
            profile.NormalizeFramerate,
            profile.NormalizeColors,
-            profile.DeinterlaceVideo == true,
-            profile.QsvPreferNativeDecoder != false);
+            profile.DeinterlaceVideo == true);

    internal static FFmpegProfileResponseModel ProjectToResponseModel(FFmpegProfile ffmpegProfile) =>
        new(
@@ -81,6 +80,5 @@ internal static class Mapper
            ffmpegProfile.AudioSampleRate,
            ffmpegProfile.NormalizeFramerate,
            ffmpegProfile.NormalizeColors,
-            ffmpegProfile.DeinterlaceVideo == true,
-            ffmpegProfile.QsvPreferNativeDecoder != false);
+            ffmpegProfile.DeinterlaceVideo == true);
 }
@@ -10,11 +10,7 @@ internal static class Mapper
            result.Title,
            GetStatus(result.Status),
            result.Message,
-            string.IsNullOrWhiteSpace(result.BriefMessage) ? null : result.BriefMessage,
-            result.Link.MatchUnsafe(l => l.Target, () => (string)null),
-            result.Link.MatchUnsafe(
-                l => new HealthCheckRemediationResponseModel(GetLinkKind(l.Kind), l.Target),
-                () => (HealthCheckRemediationResponseModel)null));
+            result.Link.MatchUnsafe(l => l.Link, () => null));

    private static string GetStatus(HealthCheckStatus status) =>
        status switch
@@ -23,17 +19,6 @@ internal static class Mapper
            HealthCheckStatus.Fail => "fail",
            HealthCheckStatus.Warning => "warn",
            HealthCheckStatus.Info => "info",
-            // NotApplicable is filtered out before mapping today; map it defensively rather
-            // than throwing, so a future caller that skips the filter can't 500 the endpoint.
-            HealthCheckStatus.NotApplicable => "notApplicable",
            _ => throw new ArgumentOutOfRangeException(nameof(status), status, null)
        };
-
-    private static string GetLinkKind(HealthCheckLinkKind kind) =>
-        kind switch
-        {
-            HealthCheckLinkKind.ExternalDoc => "ExternalDoc",
-            HealthCheckLinkKind.AppRoute => "AppRoute",
-            _ => throw new ArgumentOutOfRangeException(nameof(kind), kind, null)
-        };
 }
@@ -2,4 +2,4 @@ using ErsatzTV.Core.Api.Health;

 namespace ErsatzTV.Application.Health;

-public record GetAllHealthCheckResultsForApi(bool Refresh = false) : IRequest<List<HealthCheckResponseModel>>;
+public record GetAllHealthCheckResultsForApi : IRequest<List<HealthCheckResponseModel>>;
@@ -18,8 +18,7 @@ public class GetAllHealthCheckResultsForApiHandler
    {
        try
        {
-            List<HealthCheckResult> results =
-                await _healthCheckService.PerformHealthChecks(request.Refresh, cancellationToken);
+            List<HealthCheckResult> results = await _healthCheckService.PerformHealthChecks(cancellationToken);
            return results
                .Filter(r => r.Status != HealthCheckStatus.NotApplicable)
                .Map(ProjectToResponseModel)
@@ -1,4 +1,4 @@
-using ErsatzTV.Core.Health;
+using ErsatzTV.Core.Health;

 namespace ErsatzTV.Application.Health;

@@ -15,7 +15,7 @@ public class GetAllHealthCheckResultsHandler : IRequestHandler<GetAllHealthCheck
    {
        try
        {
-            List<HealthCheckResult> results = await _healthCheckService.PerformHealthChecks(false, cancellationToken);
+            List<HealthCheckResult> results = await _healthCheckService.PerformHealthChecks(cancellationToken);
            return results.Filter(r => r.Status != HealthCheckStatus.NotApplicable).ToList();
        }
        catch (Exception ex) when (ex is TaskCanceledException or OperationCanceledException)
@@ -1,4 +1,4 @@
-using System.IO.Abstractions;
+using System.IO.Abstractions;
 using System.Threading.Channels;
 using ErsatzTV.Application.MediaSources;
 using ErsatzTV.Core;
@@ -70,23 +70,9 @@ public class CreateLocalLibraryHandler : LocalLibraryHandlerBase,
        CreateLocalLibrary request) =>
        MediaSourceMustExist(dbContext, request)
            .BindT(localLibrary => NameMustBeValid(request, localLibrary))
-            .BindT(MediaKindMustBeSupportedLocally)
            .BindT(localLibrary => PathsMustBeValid(dbContext, localLibrary))
            .BindT(localLibrary => NewPathsMustExist(fileSystem, localLibrary));

-    /// <summary>
-    /// Mixed is only ever produced for remote (Jellyfin) libraries, where the media server classifies
-    /// each item for us. No local folder scanner handles it, so a local Mixed library would fail every
-    /// scan forever. The API takes a raw LibraryMediaKind, so this must be enforced here rather than
-    /// left to the SPA's media-kind options.
-    /// </summary>
-    private static Validation<BaseError, LocalLibrary> MediaKindMustBeSupportedLocally(
-        LocalLibrary localLibrary) =>
-        localLibrary.MediaKind is LibraryMediaKind.Mixed
-            ? BaseError.New(
-                "Local libraries cannot use the Mixed media kind; it is only valid for Jellyfin libraries.")
-            : localLibrary;
-
    private static Task<Validation<BaseError, LocalLibrary>> MediaSourceMustExist(
        TvContext dbContext,
        CreateLocalLibrary request) =>
@@ -27,7 +27,7 @@ public class ReleaseMemoryHandler : IRequestHandler<ReleaseMemory>
            return Task.CompletedTask;
        }

-        bool hasActiveWorkers = _ffmpegSegmenterService.Workers.Count > 0 || FFmpegProcess.ProcessCount > 0;
+        bool hasActiveWorkers = _ffmpegSegmenterService.Workers.Count >= 0 || FFmpegProcess.ProcessCount > 0;
        if (request.ForceAggressive || !hasActiveWorkers)
        {
            _logger.LogDebug("Starting aggressive garbage collection");
@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Playouts;
 using ErsatzTV.Application.Search;
 using ErsatzTV.Core;
@@ -55,13 +55,7 @@ public class AddArtistToCollectionHandler :
        // force-write past a concurrent replace-all Version bump — this add takes no If-Match, so a
        // benign race must not 500 (#253/#269 §7a). Post-commit enqueues run on CancellationToken.None.
        parameters.Collection.Version++;
-        if (!await dbContext.TrySaveChangesForcingVersion(CancellationToken.None))
-        {
-            // A concurrent add of this same item won the composite-PK race and already inserted the row,
-            // rotated the collection ETag, and fanned out the rebuild — so this is now an idempotent
-            // no-op. Skip our reindex/rebuild fan-out (the winner already did it). #308
-            return Unit.Default;
-        }
+        await dbContext.SaveChangesForcingVersion(CancellationToken.None);

        await _searchChannel.WriteAsync(new ReindexMediaItems([parameters.Artist.Id]), CancellationToken.None);

@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Playouts;
 using ErsatzTV.Application.Search;
 using ErsatzTV.Core;
@@ -57,13 +57,7 @@ public class AddEpisodeToCollectionHandler :
        // force-write past a concurrent replace-all Version bump — this add takes no If-Match, so a
        // benign race must not 500 (#253/#269 §7a). Post-commit enqueues run on CancellationToken.None.
        parameters.Collection.Version++;
-        if (!await dbContext.TrySaveChangesForcingVersion(CancellationToken.None))
-        {
-            // A concurrent add of this same item won the composite-PK race and already inserted the row,
-            // rotated the collection ETag, and fanned out the rebuild — so this is now an idempotent
-            // no-op. Skip our reindex/rebuild fan-out (the winner already did it). #308
-            return Unit.Default;
-        }
+        await dbContext.SaveChangesForcingVersion(CancellationToken.None);

        await _searchChannel.WriteAsync(new ReindexMediaItems([parameters.Episode.Id]), CancellationToken.None);

@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Playouts;
 using ErsatzTV.Application.Search;
 using ErsatzTV.Core;
@@ -54,13 +54,7 @@ public class AddImageToCollectionHandler : IRequestHandler<AddImageToCollection,
        // force-write past a concurrent replace-all Version bump — this add takes no If-Match, so a
        // benign race must not 500 (#253/#269 §7a). Post-commit enqueues run on CancellationToken.None.
        parameters.Collection.Version++;
-        if (!await dbContext.TrySaveChangesForcingVersion(CancellationToken.None))
-        {
-            // A concurrent add of this same item won the composite-PK race and already inserted the row,
-            // rotated the collection ETag, and fanned out the rebuild — so this is now an idempotent
-            // no-op. Skip our reindex/rebuild fan-out (the winner already did it). #308
-            return Unit.Default;
-        }
+        await dbContext.SaveChangesForcingVersion(CancellationToken.None);

        await _searchChannel.WriteAsync(new ReindexMediaItems([parameters.Image.Id]), CancellationToken.None);

@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Playouts;
 using ErsatzTV.Application.Search;
 using ErsatzTV.Core;
@@ -38,52 +38,23 @@ public class AddItemsToCollectionHandler :
        _searchChannel = searchChannel;
    }

-    // A duplicate-key race can roll back the whole batch (#308); recompute membership from a fresh
-    // context and retry with only the still-missing items. Bounded to avoid a livelock — the common
-    // no-collision path runs the loop body exactly once.
-    private const int MaxDuplicateRetries = 5;
-
    public async Task<Either<BaseError, Unit>> Handle(
        AddItemsToCollection request,
        CancellationToken cancellationToken)
    {
-        for (var attempt = 0; ; attempt++)
-        {
-            await using TvContext dbContext = await _dbContextFactory.CreateDbContextAsync(cancellationToken);
-            Option<Collection> maybeCollection = await CollectionMustExist(dbContext, request, cancellationToken);
-
-            // true = terminal (nothing to add, or our batch committed); false = a duplicate-key race
-            // rolled the batch back, recompute membership and retry.
-            Either<BaseError, bool> attemptResult = await maybeCollection.Match(
-                Some: async collection =>
-                {
-                    Validation<BaseError, Collection> validation = await Validate(dbContext, request, collection, cancellationToken);
-                    return await validation.Apply(c => ApplyAddItemsRequest(dbContext, c, request, cancellationToken));
-                },
-                None: () => Task.FromResult<Either<BaseError, bool>>(
-                    new NotFoundError($"Collection {request.CollectionId} does not exist.")));
-
-            if (attemptResult.IsLeft)
+        await using TvContext dbContext = await _dbContextFactory.CreateDbContextAsync(cancellationToken);
+        Option<Collection> maybeCollection = await CollectionMustExist(dbContext, request, cancellationToken);
+        return await maybeCollection.Match(
+            Some: async collection =>
            {
-                return attemptResult.Map(_ => Unit.Default);
-            }
-
-            bool committed = attemptResult.Match(Left: _ => false, Right: done => done);
-            if (committed)
-            {
-                return Unit.Default;
-            }
-
-            // A concurrent add inserted one+ of our items first; recompute against fresh membership.
-            if (attempt >= MaxDuplicateRetries)
-            {
-                return BaseError.New(
-                    "Concurrent modification while adding items to the collection; please retry.");
-            }
-        }
+                Validation<BaseError, Collection> validation = await Validate(dbContext, request, collection, cancellationToken);
+                return await validation.Apply(c => ApplyAddItemsRequest(dbContext, c, request, cancellationToken));
+            },
+            None: () => Task.FromResult<Either<BaseError, Unit>>(
+                new NotFoundError($"Collection {request.CollectionId} does not exist.")));
    }

-    private async Task<bool> ApplyAddItemsRequest(
+    private async Task<Unit> ApplyAddItemsRequest(
        TvContext dbContext,
        Collection collection,
        AddItemsToCollection request,
@@ -104,10 +75,10 @@ public class AddItemsToCollectionHandler :
        var toAddIds = allItems.Where(item => collection.MediaItems.All(mi => mi.Id != item)).ToList();

        // No-op when every requested item is already a member: don't rotate the ETag or fan out
-        // rebuilds for an idempotent re-add — #269. Terminal success (no retry).
+        // rebuilds for an idempotent re-add — #269.
        if (toAddIds.Count == 0)
        {
-            return true;
+            return Unit.Default;
        }

        List<MediaItem> toAdd = await dbContext.MediaItems
@@ -120,15 +91,7 @@ public class AddItemsToCollectionHandler :
        // force-write past a concurrent replace-all Version bump — this add takes no If-Match, so a
        // benign race must not 500 (#253/#269 §7a).
        collection.Version++;
-
-        // A concurrent add of an overlapping item won the composite-PK race and rolled back this whole
-        // batch. Unlike the single-item handlers (idempotent no-op), a bulk add must NOT drop the items
-        // that did NOT collide — signal the caller to recompute membership and retry the still-missing
-        // ones. #308
-        if (!await dbContext.TrySaveChangesForcingVersion(cancellationToken))
-        {
-            return false;
-        }
+        await dbContext.SaveChangesForcingVersion(cancellationToken);

        // post-commit side effect runs on CancellationToken.None so a late request cancellation
        // can't abort it after the commit landed (#254)
@@ -141,7 +104,7 @@ public class AddItemsToCollectionHandler :
            await _channel.WriteAsync(new BuildPlayout(playoutId, PlayoutBuildMode.Refresh), CancellationToken.None);
        }

-        return true;
+        return Unit.Default;
    }

    private async Task<Validation<BaseError, Collection>> Validate(
@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Playouts;
 using ErsatzTV.Application.Search;
 using ErsatzTV.Core;
@@ -55,13 +55,7 @@ public class AddMediaItemToCollectionHandler :
        // force-write past a concurrent replace-all Version bump — this add takes no If-Match, so a
        // benign race must not 500 (#253/#269 §7a). Post-commit enqueues run on CancellationToken.None.
        parameters.Collection.Version++;
-        if (!await dbContext.TrySaveChangesForcingVersion(CancellationToken.None))
-        {
-            // A concurrent add of this same item won the composite-PK race and already inserted the row,
-            // rotated the collection ETag, and fanned out the rebuild — so this is now an idempotent
-            // no-op. Skip our reindex/rebuild fan-out (the winner already did it). #308
-            return Unit.Default;
-        }
+        await dbContext.SaveChangesForcingVersion(CancellationToken.None);

        await _searchChannel.WriteAsync(new ReindexMediaItems([parameters.MediaItem.Id]), CancellationToken.None);

@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Playouts;
 using ErsatzTV.Application.Search;
 using ErsatzTV.Core;
@@ -55,13 +55,7 @@ public class AddMovieToCollectionHandler :
        // force-write past a concurrent replace-all Version bump — this add takes no If-Match, so a
        // benign race must not 500 (#253/#269 §7a). Post-commit enqueues run on CancellationToken.None.
        parameters.Collection.Version++;
-        if (!await dbContext.TrySaveChangesForcingVersion(CancellationToken.None))
-        {
-            // A concurrent add of this same item won the composite-PK race and already inserted the row,
-            // rotated the collection ETag, and fanned out the rebuild — so this is now an idempotent
-            // no-op. Skip our reindex/rebuild fan-out (the winner already did it). #308
-            return Unit.Default;
-        }
+        await dbContext.SaveChangesForcingVersion(CancellationToken.None);

        await _searchChannel.WriteAsync(new ReindexMediaItems([parameters.Movie.Id]), CancellationToken.None);

@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Playouts;
 using ErsatzTV.Application.Search;
 using ErsatzTV.Core;
@@ -57,13 +57,7 @@ public class AddMusicVideoToCollectionHandler :
        // force-write past a concurrent replace-all Version bump — this add takes no If-Match, so a
        // benign race must not 500 (#253/#269 §7a). Post-commit enqueues run on CancellationToken.None.
        parameters.Collection.Version++;
-        if (!await dbContext.TrySaveChangesForcingVersion(CancellationToken.None))
-        {
-            // A concurrent add of this same item won the composite-PK race and already inserted the row,
-            // rotated the collection ETag, and fanned out the rebuild — so this is now an idempotent
-            // no-op. Skip our reindex/rebuild fan-out (the winner already did it). #308
-            return Unit.Default;
-        }
+        await dbContext.SaveChangesForcingVersion(CancellationToken.None);

        await _searchChannel.WriteAsync(new ReindexMediaItems([parameters.MusicVideo.Id]), CancellationToken.None);

@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Playouts;
 using ErsatzTV.Application.Search;
 using ErsatzTV.Core;
@@ -57,13 +57,7 @@ public class AddOtherVideoToCollectionHandler :
        // force-write past a concurrent replace-all Version bump — this add takes no If-Match, so a
        // benign race must not 500 (#253/#269 §7a). Post-commit enqueues run on CancellationToken.None.
        parameters.Collection.Version++;
-        if (!await dbContext.TrySaveChangesForcingVersion(CancellationToken.None))
-        {
-            // A concurrent add of this same item won the composite-PK race and already inserted the row,
-            // rotated the collection ETag, and fanned out the rebuild — so this is now an idempotent
-            // no-op. Skip our reindex/rebuild fan-out (the winner already did it). #308
-            return Unit.Default;
-        }
+        await dbContext.SaveChangesForcingVersion(CancellationToken.None);

        await _searchChannel.WriteAsync(new ReindexMediaItems([parameters.OtherVideo.Id]), CancellationToken.None);

@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Playouts;
 using ErsatzTV.Application.Search;
 using ErsatzTV.Core;
@@ -55,13 +55,7 @@ public class AddSeasonToCollectionHandler :
        // force-write past a concurrent replace-all Version bump — this add takes no If-Match, so a
        // benign race must not 500 (#253/#269 §7a). Post-commit enqueues run on CancellationToken.None.
        parameters.Collection.Version++;
-        if (!await dbContext.TrySaveChangesForcingVersion(CancellationToken.None))
-        {
-            // A concurrent add of this same item won the composite-PK race and already inserted the row,
-            // rotated the collection ETag, and fanned out the rebuild — so this is now an idempotent
-            // no-op. Skip our reindex/rebuild fan-out (the winner already did it). #308
-            return Unit.Default;
-        }
+        await dbContext.SaveChangesForcingVersion(CancellationToken.None);

        await _searchChannel.WriteAsync(new ReindexMediaItems([parameters.Season.Id]), CancellationToken.None);

@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Playouts;
 using ErsatzTV.Application.Search;
 using ErsatzTV.Core;
@@ -55,13 +55,7 @@ public class AddShowToCollectionHandler :
        // force-write past a concurrent replace-all Version bump — this add takes no If-Match, so a
        // benign race must not 500 (#253/#269 §7a). Post-commit enqueues run on CancellationToken.None.
        parameters.Collection.Version++;
-        if (!await dbContext.TrySaveChangesForcingVersion(CancellationToken.None))
-        {
-            // A concurrent add of this same item won the composite-PK race and already inserted the row,
-            // rotated the collection ETag, and fanned out the rebuild — so this is now an idempotent
-            // no-op. Skip our reindex/rebuild fan-out (the winner already did it). #308
-            return Unit.Default;
-        }
+        await dbContext.SaveChangesForcingVersion(CancellationToken.None);

        await _searchChannel.WriteAsync(new ReindexMediaItems([parameters.Show.Id]), CancellationToken.None);

@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Playouts;
 using ErsatzTV.Application.Search;
 using ErsatzTV.Core;
@@ -55,13 +55,7 @@ public class AddSongToCollectionHandler :
        // force-write past a concurrent replace-all Version bump — this add takes no If-Match, so a
        // benign race must not 500 (#253/#269 §7a). Post-commit enqueues run on CancellationToken.None.
        parameters.Collection.Version++;
-        if (!await dbContext.TrySaveChangesForcingVersion(CancellationToken.None))
-        {
-            // A concurrent add of this same item won the composite-PK race and already inserted the row,
-            // rotated the collection ETag, and fanned out the rebuild — so this is now an idempotent
-            // no-op. Skip our reindex/rebuild fan-out (the winner already did it). #308
-            return Unit.Default;
-        }
+        await dbContext.SaveChangesForcingVersion(CancellationToken.None);

        await _searchChannel.WriteAsync(new ReindexMediaItems([parameters.Song.Id]), CancellationToken.None);

@@ -1,4 +1,4 @@
-using ErsatzTV.Core;
+using ErsatzTV.Core;
 using ErsatzTV.Core.Domain;

 namespace ErsatzTV.Application.MediaCollections;
@@ -7,8 +7,7 @@ public record CreateMultiCollectionItem(
    int? CollectionId,
    int? SmartCollectionId,
    bool ScheduleAsGroup,
-    PlaybackOrder PlaybackOrder,
-    int Weight = 1);
+    PlaybackOrder PlaybackOrder);

 public record CreateMultiCollection(string Name, List<CreateMultiCollectionItem> Items)
    : IRequest<Either<BaseError, MultiCollectionViewModel>>;
@@ -1,4 +1,4 @@
-using ErsatzTV.Core;
+using ErsatzTV.Core;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.Interfaces.Search;
 using ErsatzTV.Infrastructure.Data;
@@ -51,56 +51,42 @@ public class CreateMultiCollectionHandler :
    private static Task<Validation<BaseError, MultiCollection>> Validate(
        TvContext dbContext,
        CreateMultiCollection request) =>
-        ValidateName(dbContext, request)
-            .BindT(name => ValidateWeights(request).Map(_ => name))
-            .MapT(name => new MultiCollection
-            {
-                Name = name,
-                MultiCollectionItems = request.Items.Bind(i =>
+        ValidateName(dbContext, request).MapT(name => new MultiCollection
+        {
+            Name = name,
+            MultiCollectionItems = request.Items.Bind(i =>
+                {
+                    if (i.CollectionId.HasValue)
                    {
-                        if (i.CollectionId.HasValue)
-                        {
-                            return Some(
-                                new MultiCollectionItem
-                                {
-                                    CollectionId = i.CollectionId.Value,
-                                    ScheduleAsGroup = i.ScheduleAsGroup,
-                                    PlaybackOrder = i.PlaybackOrder,
-                                    Weight = i.Weight
-                                });
-                        }
+                        return Some(
+                            new MultiCollectionItem
+                            {
+                                CollectionId = i.CollectionId.Value,
+                                ScheduleAsGroup = i.ScheduleAsGroup,
+                                PlaybackOrder = i.PlaybackOrder
+                            });
+                    }

-                        return Option<MultiCollectionItem>.None;
-                    })
+                    return Option<MultiCollectionItem>.None;
+                })
                .ToList(),
-                MultiCollectionSmartItems = request.Items.Bind(i =>
+            MultiCollectionSmartItems = request.Items.Bind(i =>
+                {
+                    if (i.SmartCollectionId.HasValue)
                    {
-                        if (i.SmartCollectionId.HasValue)
-                        {
-                            return Some(
-                                new MultiCollectionSmartItem
-                                {
-                                    SmartCollectionId = i.SmartCollectionId.Value,
-                                    ScheduleAsGroup = i.ScheduleAsGroup,
-                                    PlaybackOrder = i.PlaybackOrder,
-                                    Weight = i.Weight
-                                });
-                        }
+                        return Some(
+                            new MultiCollectionSmartItem
+                            {
+                                SmartCollectionId = i.SmartCollectionId.Value,
+                                ScheduleAsGroup = i.ScheduleAsGroup,
+                                PlaybackOrder = i.PlaybackOrder
+                            });
+                    }

-                        return Option<MultiCollectionSmartItem>.None;
-                    })
+                    return Option<MultiCollectionSmartItem>.None;
+                })
                .ToList()
-            });
-
-    // Bounds are shared with the update path so the two cannot drift -- they silently disagreed before #402:
-    // EF's HasDefaultValue substitutes 1 for a 0 on INSERT (0 reads as "not set") while an UPDATE writes the 0
-    // through, so the same input landed differently depending on the verb. The enumerator clamps out-of-range
-    // weights, so neither a 0 nor a huge value can reach the rotation; this gate refuses input that has no
-    // meaning on a share-of-airtime scale, and keeps create and update honest with each other. See #70.
-    private static Validation<BaseError, Unit> ValidateWeights(CreateMultiCollection request) =>
-        request.Items.All(i => MultiCollectionItemWeight.IsValid(i.Weight))
-            ? Unit.Default
-            : BaseError.New(MultiCollectionItemWeight.ValidationMessage);
+        });

    private static async Task<Validation<BaseError, string>> ValidateName(
        TvContext dbContext,
@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Playouts;
 using ErsatzTV.Application.Search;
 using ErsatzTV.Core;
@@ -73,35 +73,7 @@ public class ReplacePlaylistItemsHandler(IDbContextFactory<TvContext> dbContextF
        ReplacePlaylistItems request,
        CancellationToken cancellationToken) =>
        PlaylistMustExist(dbContext, request.PlaylistId, cancellationToken)
-            .BindT(playlist => CollectionTypesMustBeValid(request, playlist))
-            .BindT(playlist => PlaybackOrdersMustBeSupported(request, playlist))
-            .BindT(playlist => ValidateName(request).Map(_ => playlist));
-
-    private static Validation<BaseError, string> ValidateName(ReplacePlaylistItems request) =>
-        request.NotEmpty(x => x.Name)
-            .Bind(_ => request.NotLongerThan(50)(x => x.Name));
-
-    private static Validation<BaseError, Playlist> PlaybackOrdersMustBeSupported(
-        ReplacePlaylistItems request,
-        Playlist playlist) =>
-        request.Items
-            .Map(item => PlaybackOrderMustBeSupported(item.PlaybackOrder))
-            .Sequence()
-            .Map(_ => playlist);
-
-    private static Validation<BaseError, Unit> PlaybackOrderMustBeSupported(PlaybackOrder playbackOrder)
-    {
-        // WeightedShuffle (#70) is implemented for classic schedule items only. PlaylistEnumerator has no
-        // default arm, so an order it doesn't know leaves the enumerator null and the item is dropped from the
-        // playlist silently -- refuse it at the write path instead of scheduling nothing at build time.
-        if (playbackOrder is PlaybackOrder.WeightedShuffle)
-        {
-            return BaseError.New(
-                $"Playback order '{playbackOrder}' is not supported for playlist items; it is available on classic schedule items");
-        }
-
-        return Unit.Default;
-    }
+            .BindT(playlist => CollectionTypesMustBeValid(request, playlist));

    private static Task<Validation<BaseError, Playlist>> PlaylistMustExist(
        TvContext dbContext,
@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Playouts;
 using ErsatzTV.Core;
 using ErsatzTV.Core.Domain;
@@ -7,8 +7,7 @@ public record UpdateMultiCollectionItem(
    int? CollectionId,
    int? SmartCollectionId,
    bool ScheduleAsGroup,
-    PlaybackOrder PlaybackOrder,
-    int Weight = 1);
+    PlaybackOrder PlaybackOrder);

 public record UpdateMultiCollection(
    int MultiCollectionId,
@@ -76,8 +76,7 @@ public class UpdateMultiCollectionHandler : IRequestHandler<UpdateMultiCollectio
                CollectionId = i.CollectionId.Value,
                MultiCollectionId = c.Id,
                ScheduleAsGroup = i.ScheduleAsGroup,
-                PlaybackOrder = i.PlaybackOrder,
-                Weight = i.Weight
+                PlaybackOrder = i.PlaybackOrder
            })
            .ToList();
        var toRemove = c.MultiCollectionItems
@@ -95,7 +94,6 @@ public class UpdateMultiCollectionHandler : IRequestHandler<UpdateMultiCollectio
            {
                item.ScheduleAsGroup = incoming.ScheduleAsGroup;
                item.PlaybackOrder = incoming.PlaybackOrder;
-                item.Weight = incoming.Weight;
            }
        }

@@ -112,8 +110,7 @@ public class UpdateMultiCollectionHandler : IRequestHandler<UpdateMultiCollectio
                SmartCollectionId = i.SmartCollectionId.Value,
                MultiCollectionId = c.Id,
                ScheduleAsGroup = i.ScheduleAsGroup,
-                PlaybackOrder = i.PlaybackOrder,
-                Weight = i.Weight
+                PlaybackOrder = i.PlaybackOrder
            })
            .ToList();
        var toRemoveSmart = c.MultiCollectionSmartItems
@@ -131,7 +128,6 @@ public class UpdateMultiCollectionHandler : IRequestHandler<UpdateMultiCollectio
            {
                item.ScheduleAsGroup = incoming.ScheduleAsGroup;
                item.PlaybackOrder = incoming.PlaybackOrder;
-                item.Weight = incoming.Weight;
            }
        }

@@ -160,20 +156,8 @@ public class UpdateMultiCollectionHandler : IRequestHandler<UpdateMultiCollectio
        TvContext dbContext,
        UpdateMultiCollection request,
        CancellationToken cancellationToken) =>
-        (await MultiCollectionMustExist(dbContext, request, cancellationToken),
-            await ValidateName(dbContext, request),
-            ValidateWeights(request))
-        .Apply((collectionToUpdate, _, _) => collectionToUpdate);
-
-    // Bounds are shared with the create path so the two cannot drift -- they silently disagreed before #402:
-    // EF's HasDefaultValue substitutes 1 for a 0 on INSERT (0 reads as "not set"), but an UPDATE writes the 0
-    // through, so the same input landed differently depending on the verb. The enumerator clamps out-of-range
-    // weights, so a 0 no longer removes the source; this gate is about refusing input that has no meaning on a
-    // share-of-airtime scale, and about keeping create and update honest with each other. See #70.
-    private static Validation<BaseError, Unit> ValidateWeights(UpdateMultiCollection request) =>
-        request.Items.All(i => MultiCollectionItemWeight.IsValid(i.Weight))
-            ? Unit.Default
-            : BaseError.New(MultiCollectionItemWeight.ValidationMessage);
+        (await MultiCollectionMustExist(dbContext, request, cancellationToken), await ValidateName(dbContext, request))
+        .Apply((collectionToUpdate, _) => collectionToUpdate);

    private static Task<Validation<BaseError, MultiCollection>> MultiCollectionMustExist(
        TvContext dbContext,
@@ -1,4 +1,4 @@
-using ErsatzTV.Application.Tree;
+using ErsatzTV.Application.Tree;
 using ErsatzTV.Core.Api.SmartCollections;
 using ErsatzTV.Core.Domain;

@@ -70,8 +70,7 @@ internal static class Mapper
            multiCollectionItem.MultiCollectionId,
            ProjectToViewModel(multiCollectionItem.Collection),
            multiCollectionItem.ScheduleAsGroup,
-            multiCollectionItem.PlaybackOrder,
-            multiCollectionItem.Weight);
+            multiCollectionItem.PlaybackOrder);

    private static MultiCollectionSmartItemViewModel ProjectToViewModel(
        MultiCollectionSmartItem multiCollectionSmartItem) =>
@@ -79,8 +78,7 @@ internal static class Mapper
            multiCollectionSmartItem.MultiCollectionId,
            ProjectToViewModel(multiCollectionSmartItem.SmartCollection),
            multiCollectionSmartItem.ScheduleAsGroup,
-            multiCollectionSmartItem.PlaybackOrder,
-            multiCollectionSmartItem.Weight);
+            multiCollectionSmartItem.PlaybackOrder);

    internal static TreeViewModel ProjectToViewModel(List<PlaylistGroup> playlistGroups) =>
        new(
@@ -1,4 +1,4 @@
-using ErsatzTV.Core.Domain;
+using ErsatzTV.Core.Domain;

 namespace ErsatzTV.Application.MediaCollections;

@@ -6,5 +6,4 @@ public record MultiCollectionItemViewModel(
    int MultiCollectionId,
    MediaCollectionViewModel Collection,
    bool ScheduleAsGroup,
-    PlaybackOrder PlaybackOrder,
-    int Weight = 1);
+    PlaybackOrder PlaybackOrder);
@@ -1,4 +1,4 @@
-using ErsatzTV.Core.Domain;
+using ErsatzTV.Core.Domain;

 namespace ErsatzTV.Application.MediaCollections;

@@ -6,5 +6,4 @@ public record MultiCollectionSmartItemViewModel(
    int MultiCollectionId,
    SmartCollectionViewModel SmartCollection,
    bool ScheduleAsGroup,
-    PlaybackOrder PlaybackOrder,
-    int Weight = 1);
+    PlaybackOrder PlaybackOrder);
@@ -1,4 +1,4 @@
-using ErsatzTV.Infrastructure.Data;
+using ErsatzTV.Infrastructure.Data;
 using Microsoft.EntityFrameworkCore;
 using static ErsatzTV.Application.MediaCollections.Mapper;

@@ -17,7 +17,6 @@ public class GetAllMultiCollectionsHandler : IRequestHandler<GetAllMultiCollecti
    {
        await using TvContext dbContext = await _dbContextFactory.CreateDbContextAsync(cancellationToken);
        return await dbContext.MultiCollections
-            .Where(mc => mc.OwnedByChannelId == null)
            .ToListAsync(cancellationToken)
            .Map(list => list.Map(ProjectToViewModel).ToList());
    }
@@ -1,4 +1,4 @@
-using ErsatzTV.Core.Api.SmartCollections;
+using ErsatzTV.Core.Api.SmartCollections;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Infrastructure.Data;
 using Microsoft.EntityFrameworkCore;
@@ -16,7 +16,6 @@ public class GetAllSmartCollectionsForApiHandler(IDbContextFactory<TvContext> db
        await using TvContext dbContext = await dbContextFactory.CreateDbContextAsync(cancellationToken);
        List<SmartCollection> ffmpegProfiles = await dbContext.SmartCollections
            .AsNoTracking()
-            .Where(sc => sc.OwnedByChannelId == null)
            .ToListAsync(cancellationToken);
        return ffmpegProfiles.Map(ProjectToResponseModel).ToList();
    }
@@ -1,4 +1,4 @@
-using ErsatzTV.Infrastructure.Data;
+using ErsatzTV.Infrastructure.Data;
 using Microsoft.EntityFrameworkCore;
 using static ErsatzTV.Application.MediaCollections.Mapper;

@@ -17,7 +17,6 @@ public class GetAllSmartCollectionsHandler : IRequestHandler<GetAllSmartCollecti
    {
        await using TvContext dbContext = await _dbContextFactory.CreateDbContextAsync(cancellationToken);
        return await dbContext.SmartCollections
-            .Where(sc => sc.OwnedByChannelId == null)
            .ToListAsync(cancellationToken)
            .Map(list => list.Map(ProjectToViewModel).ToList());
    }
@@ -1,4 +1,4 @@
-using ErsatzTV.Core.Domain;
+using ErsatzTV.Core.Domain;
 using ErsatzTV.Infrastructure.Data;
 using Microsoft.EntityFrameworkCore;
 using static ErsatzTV.Application.MediaCollections.Mapper;
@@ -13,12 +13,9 @@ public class GetPagedMultiCollectionsHandler(IDbContextFactory<TvContext> dbCont
        CancellationToken cancellationToken)
    {
        await using TvContext dbContext = await dbContextFactory.CreateDbContextAsync(cancellationToken);
-        int count = await dbContext.MultiCollections
-            .CountAsync(mc => mc.OwnedByChannelId == null, cancellationToken);
+        int count = await dbContext.MultiCollections.CountAsync(cancellationToken);

-        IQueryable<MultiCollection> query = dbContext.MultiCollections
-            .AsNoTracking()
-            .Where(mc => mc.OwnedByChannelId == null);
+        IQueryable<MultiCollection> query = dbContext.MultiCollections.AsNoTracking();

        if (!string.IsNullOrWhiteSpace(request.Query))
        {
@@ -1,4 +1,4 @@
-using ErsatzTV.Core.Domain;
+using ErsatzTV.Core.Domain;
 using ErsatzTV.Infrastructure.Data;
 using Microsoft.EntityFrameworkCore;
 using static ErsatzTV.Application.MediaCollections.Mapper;
@@ -13,12 +13,9 @@ public class GetPagedSmartCollectionsHandler(IDbContextFactory<TvContext> dbCont
        CancellationToken cancellationToken)
    {
        await using TvContext dbContext = await dbContextFactory.CreateDbContextAsync(cancellationToken);
-        int count = await dbContext.SmartCollections
-            .CountAsync(sc => sc.OwnedByChannelId == null, cancellationToken);
+        int count = await dbContext.SmartCollections.CountAsync(cancellationToken);

-        IQueryable<SmartCollection> query = dbContext.SmartCollections
-            .AsNoTracking()
-            .Where(sc => sc.OwnedByChannelId == null);
+        IQueryable<SmartCollection> query = dbContext.SmartCollections.AsNoTracking();

        if (!string.IsNullOrWhiteSpace(request.Query))
        {
@@ -10,16 +10,6 @@ public class GetAllMediaSourcesForApiHandler(
    IDbContextFactory<TvContext> dbContextFactory)
    : IRequestHandler<GetAllMediaSourcesForApi, List<MediaSourceResponseModel>>
 {
-    // A never-scanned library has a null LastScan at runtime, but historical DB rows still carry the
-    // 0001-01-01 MinValue sentinel written by the old Reset_* migrations. Coerce any such residual
-    // sentinel to null so the API/MCP surface reports "never scanned" as null (parity with the UI),
-    // regardless of DB history or provider. Belt-and-suspenders alongside the NullOutNeverScannedLastScan
-    // data migration.
-    private static readonly DateTime NeverScannedThreshold = new(2000, 1, 1);
-
-    private static DateTime? NormalizeLastScan(DateTime? lastScan) =>
-        lastScan is { } value && value < NeverScannedThreshold ? null : lastScan;
-
    public async Task<List<MediaSourceResponseModel>> Handle(
        GetAllMediaSourcesForApi request,
        CancellationToken cancellationToken)
@@ -46,7 +36,7 @@ public class GetAllMediaSourcesForApiHandler(
                    l.Id,
                    l.Name,
                    l.MediaKind,
-                    NormalizeLastScan(l.LastScan),
+                    l.LastScan,
                    itemCountsByLibrary.TryGetValue(l.Id, out int count) ? count : 0))
                .ToList();

@@ -1,3 +0,0 @@
-namespace ErsatzTV.Application.Playouts;
-
-public record ReshufflePlayout(int PlayoutId) : IRequest;
@@ -1,40 +0,0 @@
-using System.Threading.Channels;
-using ErsatzTV.Application.Scheduling;
-using ErsatzTV.Core.Domain;
-using ErsatzTV.Core.Scheduling;
-using ErsatzTV.Infrastructure.Data;
-using Microsoft.EntityFrameworkCore;
-
-namespace ErsatzTV.Application.Playouts;
-
-public class ReshufflePlayoutHandler(
-    IMediator mediator,
-    ChannelWriter<IBackgroundServiceRequest> channel,
-    IDbContextFactory<TvContext> dbContextFactory)
-    : IRequestHandler<ReshufflePlayout>
-{
-    public async Task Handle(ReshufflePlayout request, CancellationToken cancellationToken)
-    {
-        await using TvContext dbContext = await dbContextFactory.CreateDbContextAsync(cancellationToken);
-
-        Option<Playout> maybePlayout = await dbContext.Playouts
-            .AsNoTracking()
-            .Where(p => p.ScheduleKind == PlayoutScheduleKind.Classic ||
-                        p.ScheduleKind == PlayoutScheduleKind.Block ||
-                        p.ScheduleKind == PlayoutScheduleKind.Sequential ||
-                        p.ScheduleKind == PlayoutScheduleKind.Scripted)
-            .SingleOrDefaultAsync(p => p.Id == request.PlayoutId, cancellationToken);
-
-        foreach (Playout playout in maybePlayout)
-        {
-            // Roll a new play order. BuildPlayout(Reset) only reseeds Playout.Seed for CLASSIC playouts
-            // (PlayoutBuilder); Block/Sequential/Scripted rebuild deterministically from the existing seed.
-            // ErasePlayoutHistory is the one primitive that reseeds + clears the derived per-collection
-            // enumerator anchors for ALL four kinds — run it first, then rebuild from scratch.
-            await mediator.Send(new ErasePlayoutHistory(playout.Id), cancellationToken);
-            await channel.WriteAsync(
-                new BuildPlayout(playout.Id, PlayoutBuildMode.Reset),
-                cancellationToken);
-        }
-    }
-}
@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Channels;
 using ErsatzTV.Core;
 using ErsatzTV.Core.Domain;
@@ -65,8 +65,7 @@ public class
            playout.BuildStatus,
            playout.DecoId,
            playout.Deco?.Name,
-            playout.Version,
-            playout.Seed);
+            playout.Version);
    }

    private static Task<Validation<BaseError, Playout>> Validate(
@@ -1,4 +1,4 @@
-using ErsatzTV.Core;
+using ErsatzTV.Core;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Infrastructure.Data;
 using ErsatzTV.Infrastructure.Extensions;
@@ -57,8 +57,7 @@ public class UpdatePlayoutHandler : IRequestHandler<UpdatePlayout, Either<BaseEr
            playout.BuildStatus,
            playout.DecoId,
            playout.Deco?.Name,
-            playout.Version,
-            playout.Seed);
+            playout.Version);
    }

    private static Task<Validation<BaseError, Playout>> Validate(
@@ -1,4 +1,4 @@
-using System.CommandLine.Parsing;
+using System.CommandLine.Parsing;
 using System.IO.Abstractions;
 using System.Threading.Channels;
 using ErsatzTV.Application.Channels;
@@ -60,8 +60,7 @@ public class
            playout.BuildStatus,
            playout.DecoId,
            playout.Deco?.Name,
-            playout.Version,
-            playout.Seed);
+            playout.Version);
    }

    private async Task<Validation<BaseError, Playout>> Validate(
@@ -1,4 +1,4 @@
-using System.Threading.Channels;
+using System.Threading.Channels;
 using ErsatzTV.Application.Channels;
 using ErsatzTV.Core;
 using ErsatzTV.Core.Domain;
@@ -65,8 +65,7 @@ public class
            playout.BuildStatus,
            playout.DecoId,
            playout.Deco?.Name,
-            playout.Version,
-            playout.Seed);
+            playout.Version);
    }

    private static Task<Validation<BaseError, Playout>> Validate(
@@ -1,4 +1,4 @@
-using ErsatzTV.Core.Domain;
+using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.Domain.Scheduling;

 namespace ErsatzTV.Application.Playouts;
@@ -20,8 +20,7 @@ internal static class Mapper
            // the paged-playouts query does not eager-load Deco (the list response does not surface
            // the default deco); GetPlayoutById includes it for the detail response
            playout.Deco?.Name,
-            playout.Version,
-            playout.Seed);
+            playout.Version);

    internal static PlayoutItemViewModel ProjectToViewModel(PlayoutItem playoutItem) =>
        new(
@@ -1,4 +1,4 @@
-using ErsatzTV.Core.Domain;
+using ErsatzTV.Core.Domain;

 namespace ErsatzTV.Application.Playouts;

@@ -14,8 +14,7 @@ public record PlayoutNameViewModel(
    PlayoutBuildStatus BuildStatus,
    int? DecoId,
    string DecoName,
-    int Version,
-    int Seed)
+    int Version)
 {
    public Option<TimeSpan> DailyRebuildTime => Optional(DbDailyRebuildTime);

@@ -1,4 +1,4 @@
-using ErsatzTV.Infrastructure.Data;
+using ErsatzTV.Infrastructure.Data;
 using ErsatzTV.Infrastructure.Extensions;
 using Microsoft.EntityFrameworkCore;

@@ -31,7 +31,6 @@ public class GetPlayoutByIdHandler(IDbContextFactory<TvContext> dbContextFactory
                p.BuildStatus,
                p.DecoId,
                p.DecoId == null ? null : p.Deco.Name,
-                p.Version,
-                p.Seed));
+                p.Version));
    }
 }
@@ -1,4 +1,4 @@
-using ErsatzTV.Core;
+using ErsatzTV.Core;
 using ErsatzTV.Core.Domain;
 using ErsatzTV.Core.Domain.Filler;
 using ErsatzTV.Core.Errors;
@@ -63,9 +63,6 @@ public abstract class ProgramScheduleItemCommandBase
                    return BaseError.New($"Invalid playback order for multi collection: '{item.PlaybackOrder}'");
                case PlaybackOrder.Shuffle:
                case PlaybackOrder.ShuffleInOrder:
-                // WeightedShuffle (#70) distributes across a multi collection's sources, so this is its
-                // intended home. Listed explicitly rather than falling through the switch by omission.
-                case PlaybackOrder.WeightedShuffle:
                    break;
            }
        }
@@ -112,30 +112,7 @@ public class ReplaceBlockItemsHandler(IDbContextFactory<TvContext> dbContextFact
        BlockMustExist(dbContext, request.BlockId, cancellationToken)
            .BindT(block => MinutesMustBeValid(request, block))
            .BindT(block => BlockNameMustBeValid(dbContext, block, request))
-            .BindT(block => CollectionTypesMustBeValid(request, block))
-            .BindT(block => PlaybackOrdersMustBeSupported(request, block));
-
-    private static Validation<BaseError, Block> PlaybackOrdersMustBeSupported(
-        ReplaceBlockItems request,
-        Block block) =>
-        request.Items
-            .Map(item => PlaybackOrderMustBeSupported(item.PlaybackOrder))
-            .Sequence()
-            .Map(_ => block);
-
-    private static Validation<BaseError, Unit> PlaybackOrderMustBeSupported(PlaybackOrder playbackOrder)
-    {
-        // WeightedShuffle (#70) is implemented for classic schedule items only. BlockPlayoutBuilder filters
-        // block items against an allow-list of orders and silently `continue`s past anything else, so an
-        // unsupported order here means the block item never airs and nothing reports why.
-        if (playbackOrder is PlaybackOrder.WeightedShuffle)
-        {
-            return BaseError.New(
-                $"Playback order '{playbackOrder}' is not supported for block items; it is available on classic schedule items");
-        }
-
-        return Unit.Default;
-    }
+            .BindT(block => CollectionTypesMustBeValid(request, block));

    private static Task<Validation<BaseError, Block>> BlockMustExist(
        TvContext dbContext,
@@ -1,5 +0,0 @@
-using ErsatzTV.Core.Api.Search;
-
-namespace ErsatzTV.Application.Search.Queries;
-
-public record GetSearchFieldCatalog : IRequest<List<SearchFieldResponseModel>>;
@@ -1,11 +0,0 @@
-using ErsatzTV.Core.Api.Search;
-
-namespace ErsatzTV.Application.Search.Queries;
-
-public class GetSearchFieldCatalogHandler : IRequestHandler<GetSearchFieldCatalog, List<SearchFieldResponseModel>>
-{
-    public Task<List<SearchFieldResponseModel>> Handle(
-        GetSearchFieldCatalog request,
-        CancellationToken cancellationToken) =>
-        Task.FromResult(SearchFieldCatalog.Fields);
-}
@@ -1,4 +1,3 @@
-namespace ErsatzTV.Application.Search;
+namespace ErsatzTV.Application.Search;

-public record QuerySearchIndexAllItems(string Query, int PageNum, int PageSize)
-    : IRequest<SearchResultAllItemsViewModel>;
+public record QuerySearchIndexAllItems(string Query) : IRequest<SearchResultAllItemsViewModel>;
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
timothyandOpenAI Codex	1e786c1f22	test(web): harden primary-action ownership regressions Refs #247 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-15 22:36:16 +02:00
timothyandOpenAI Codex	4efb1a1b03	refactor(web): replace primary-action events with context Refs #247 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-15 22:31:31 +02:00