Add random access for DSF, DFF, and SACD demuxers, replace live DoP/native sources without releasing ALSA, and expose seek through Qt, MPRIS, and the daemon API.
cx
Show SACD images in folder grouping, keep track details responsive, avoid repeated album reload work, and exclude disabled or unconfigured media servers from filters and sync.
cx
Measured on a 24-core box: 52 threads held 82 glibc malloc arenas, 257 MB
of fragmented anonymous mappings at idle, and the 400 MB in-memory audio
cache kept every played track until another evicted it. main now calls
mallopt(M_ARENA_MAX, 2) before the first thread (an explicit
MALLOC_ARENA_MAX wins), the tokio runtime runs eight workers instead of
one per core, and the playback poll moves the L1 audio cache to the L2
disk cache after 300 s with nothing audible locally, remotely or on a
cast. Idle RSS went from 728 MB to 537 MB; the trim verified at exactly
300 s after a pause.
cc
The scan never treated an .iso as audio; images only entered the library
through Open > disc image. Each root's scan now walks its .iso files,
asks qbz_disc::sacd::is_sacd_image for the SACDMTOC signature (PVD plus
Master TOC sector, four 2 KB reads at most, no directory parsing) so a DVD
or data ISO leaves silently, skips images already imported with the same
size and mtime without any I/O, and adopts the rest through the
generation-based import. The row builder moved from sacd_qt into
qbz_library::sacd_scan and the manual open is now its client, with the
translated fallback labels. Parser and import rejections are scan errors.
cc
DSD gets its own Quality chip and Hi-Res goes back to 24-bit PCM only, in
the MediaFilter, the native catalog SQL (tracks CASE and the materialized
album quality_tier) and the legacy QML filters. A Format chip would be the
same predicate, so there is none. Schema version 6 re-derives the album
tiers that were materialized as hires.
cc
/album/get sends streamable_at and release_date_stream per track: a future
value marks a pre-release, null a pulled track. Track carries both fields
and Track::is_upcoming applies the one rule (future streamable_at wins,
then a future release date); the album, playlist, search and label rows
publish qobuzUpcoming and the unavailable glyph reads "This track is not
yet available" instead of "no longer". Artist page rows carry no dates and
keep the generic copy. New msgid in the seven translated catalogs.
cc
The now-playing stamp bubble came out wider than its lines with the text
offset, and never reproduced in isolation. The three stamp ToolTips now
bind width/height straight to the content's implicit size with zero
paddings, insets and margins, leaving nothing for the style to add.
cc
A KEF LSX reached the end of every track and never advanced (#733); its
poll answers were swallowed, so an INFO log could not tell a mute renderer
from one that never reports STOPPED. The DLNA poll now logs a failed
position read, GetTransportInfo faults degrade to the last transport
command instead of failing the whole read, and a RelTime frozen inside the
end guard for five polls without STOPPED counts as end-of-track. A user
pause never counts. Pure helper with unit tests.
cc
rodio's Decoder::new leaves byte_len unset and the source non-seekable, so
symphonia's MP3 demuxer never estimates the duration of a file without a
Xing/Info/VBRI frame. The local play path then fell back to duration 0 and
the playback clock stayed clamped at 0 for the whole track, which the Slint
2.0.2 frontend read as a stuck load and restarted every 45 s (#734).
The decoder is now built with the buffer length, and an unknown (0)
duration no longer clamps the position. Regression fixture: a 2 s CBR MP3
written without an Info tag.
cc
Apply interface scaling through Qt at startup, complete keyboard navigation, move account migration into setup and progress modals, and defer Subsonic sync while the server scans.
cx
After a recovery advance (`recovery: engine empty … poll: advancing to X`)
the poll loop reset `last_track_id` and started the next track, but for
1-2 s (CMAF session + init segment, or a DSD→PCM conversion) the player
kept reporting the id of the track that had just ENDED. The 1 Hz tick took
that as a track change: `sync_current_to_id` rewound the queue cursor one
row and `refresh_now_playing` republished the previous track (now-playing,
MPRIS, notification), then the next tick flipped back — three
notifications per change, the middle one a ghost, intermittent because it
depends on the tick landing in that window. With the cursor rewound, the
gapless stage asked `peek_upcoming(1)` and was handed the track already
playing, so it played twice (smoke 2026-09-02, local DSD row; the queue had
no duplicate).
`stale_after_advance` remembers the ended id at the advance (0 under
repeat-one, where old == new); while the player still reports it and
nothing plays, the tick does its bookkeeping and skips the edge; any other
id or running audio clears it. The gapless stage also refuses a successor
equal to the player's own current track id. No change to the audio
backend.
cc
Same shape as the listen-log presence check: the workspace run already
executes them; the counts keep a renamed module or a dropped cfg from
shrinking coverage without a trace. The workflow calls the script, so the
mirror stays exact; its header names the new check.
cc
A new top-level Settings section, Import / Export, gathers everything that
moves data in or out of this install:
- SETTINGS PORTABILITY: the settings bundle export moves here from
Developer, with a note on what the bundle does not hold (favorites,
playlists, blacklist, purchases).
- BLACKLIST: export the blocked artists and albums as a JSON one user can
hand to another; import merges additively and never touches the enabled
flag (qbz_app::settings::blacklist_portable, frontend-agnostic).
- ACCOUNT MIGRATION: create a snapshot while signed in with the old
account, then migrate it into the account signed in now, with the local
profile copy and its three opt-in toggles (media servers, scrobblers,
listening history, all on). The disclaimer states that subscriptions and
purchases do not move. Progress and results are status lines in the
settings document; the favorites cache re-warms and the sidebar reloads
after a run, the local half asks for a restart.
Also: the header shows a translated "Member" for accounts without a
subscription, and the login screen says what a member can and cannot do.
50 new strings in all eight catalogs.
cc
A frontend-agnostic crate for moving a Qobuz account's favorites and
playlists into another account, additively (contract
qbz-nix-docs/specs/2026-09-02-account-migration-contract.md §9):
- snapshot: capture the signed-in account (five favorite kinds with
favorited_at, owned playlists with track ids in order, followed
playlists) into users/<uid>/account_migration/snapshot-*.json; the same
capture is the target's live state at migration time.
- plan: the pure delta against the target and the ledger. Same-name
playlists holding nothing foreign are the same playlist and get the
missing tracks appended; anything foreign means a different playlist and
a " (migrated)" copy. Favorites are written oldest first so the target's
own stamps keep the chronology.
- apply: one favorite per call with pacing and bounded retries, 50-track
chunks, subscriptions re-followed; every success lands in the ledger
before the next write, so a run resumes and a second run adds nothing.
- local: copy the old profile directory row by row (library folders and
scanned tracks on the fast path, playlist folders, settings keyed by
qobuz_playlist_id remapped through the ledger, pinned items, orders,
preferences, blacklist; media servers, scrobblers and listening history
behind options). Never the favorites cache, the subscription clock, the
session or the purchases.
The writes are the ones the app already issues when a user hearts or
creates a playlist; nothing touches subscriptions, purchases or account
data.
cc
The 30-day offline grace (D4) was produced by the Qt shell alone, and only
when a login was REJECTED; its purge predicate had no caller in the live
tree, so past the window the CMAF cache was blocked from playing but never
removed (Tauri purged it; Slint recorded the gap). With member accounts now
signing in, the clock has to key on the entitlement, not on a rejection,
and it has to run wherever a session activates.
`qbz_app::subscription_lifecycle` records the verdict from the core's
session (`offline_streaming` clears the clock; a member keeps it running
from its first observation) and purges the offline cache once the window
has passed, through the cache a host registers with
`AppRuntime::set_offline_cache`. `activate_at` runs it for every host (Qt
via `activate`, qbzd directly), a daily ticker per session re-checks it,
and a cache registered after activation is enforced against on
registration. qbzd registers no cache and keeps the verdict. The Qt
producers are gone; `offline_playback_allowed` stays the read gate.
cc
Qobuz answers `/user/login` with 200 for an account without an active
subscription and the web player signs it in as a "Qobuz member" with its
favorites, playlists, purchases and 30-second previews. QBZ threw that
session away: `parse_login_response` returned `IneligibleUser` whenever
`credential.parameters` was empty (verified 2026-09-02 with a lapsed
account). The gate was ours, not Qobuz's.
The parser now reads the entitlement flags (`lossy/lossless/hires/
hires_purchases/offline/mobile_streaming`) into a typed `Entitlements`
on `UserSession`, labels a member "Member", and keeps `subscription.
end_date`/`offer` as information (the embedded Qobuz fixture has a past
end_date with every flag true: the flags are the verdict, the date is
not). `StreamUrl` gains `sample`, the flag Qobuz sets when it serves a
preview instead of the track. `IneligibleUser` stays in the enum for its
existing matchers; nothing emits it from this path any more. Persisted
pre-member sessions still load (`serde(default)`).
cc
Qobuz answers 200 for an account without an active subscription, but the
login parser rejects it (IneligibleUser) before anything can be captured.
Add `exchange_oauth_code` (OAuth step 1, extracted from
`login_with_oauth_code` unchanged), `login_with_token_raw` and
`get_stream_url_raw`, which return status and body verbatim without
parsing or storing a session, and a probe example that signs in through
the same system-browser OAuth flow as the app (or a pasted token), then
prints the redacted login payload, favorites totals, playlists and the
getFileUrl responses at CD and Hi-Res quality. Nothing is written to
Qobuz or to disk.
cc
Merges bugfix/internal/purchases-albums-tab (17 commits): the blank
Albums tab root cause (on-prefixed QML property, now gated by an audit),
entitlement-driven formats with the streaming ladder below the purchase,
intent=download grants and a DSD-safe streaming writer, album-artist
folders with master cover and goodies, the purchased copy playing under
its Qobuz id, the DSD tier and mark across purchases and the Local
Library, purchases list/detail polish with a genre filter, and active
downloads in the sidebar. Gates: source 95, offline-cache 75+9,
qbz-qt 663, six QML audits; owner smokes on the live purchases account.
cc
The Downloads section leaves the nav flyout. With the sidebar open, the
purchases downloading now sit under the Purchases entry, one row per
album with a thin progress bar, each reopening its detail. With the
sidebar collapsed, and in the compact header nav when it is closed, they
fold into one progress ring whose hover bubble lists every album with
its count and percentage. The ring is a Canvas that repaints only when a
publish moves the value — no timer, per the repaint-pulse rule. The
active set now carries done/total/percent per album.
cc
The list view's quality column was 110 px for a badge that is 136 px
wide, so the badge ran into the release-date column; it is 150 now, the
album list's width. Both list rows and track rows draw the odd-row
zebra every other list in the app draws. The filter panel gains a Genre
section built from the catalog genre on each purchased album (albums
tab only, transient like group and sort), counted and summarised with
the other filters.
cc
The local rows, the source-side quality hint and the MyQBZ badge still
tiered a 1-bit file as "hires"; they now say `dsd`, so the same DSD mark
the purchases show reaches every local surface, and the Local Library's
hi-res filter keeps counting DSD as hi-res.
cc
The downward streaming ladder read `album.hires` to add 27/7, but the
live DSD album is hires:true with a 16/44.1 stream, so "[FLAC][24-bit,
192kHz]" was offered and the CDN filled a folder by that name with CD
files. Gate the two hi-res rungs on the catalog's `hires_streamable`.
cc
The purchase detail badges what was bought on every row (DSD128 on a
DSD purchase, not the catalog's 24/352.8), marks the formats already on
disk with a check in the dropdown, offers a track filter, links to the
album in the Local Library once its folder is indexed, and gives the
download the accent while Play drops to a plain control of the same
size — on this screen the download is the point.
Downloads are process-wide and survive leaving the page; the nav flyout
now lists the purchases with a download in flight under "Downloads · N"
so the user can find them again, each row reopening its detail.
cc
A 1-bit master wore the Hi-Res logo and "24-bit / 352.8 kHz" — a stream
Qobuz never serves (nothing above 24/192 streams). Give DSD its own
tier: the official DSD mark, baked light and dark so the monochrome logo
follows the theme, on the mini badge, the full badge and the now-playing
stamp, with the multiple (DSD64 / DSD128) as the detail line. The
now-playing derivation and the delivered-tier evaluation report `dsd`
for a 1-bit stream instead of folding it into hires.
cc
`qobuz_purchase` rows badged `Offline`, the mark reserved for the
encrypted CMAF downloads only qbz-core's offline tier can open, so the
local source refused a purchased DSF on disk as "a CMAF bundle" and the
album the user had just downloaded and added answered "File not
available — is the drive mounted?". A purchase is a plain DRM-free file:
badge it Local and let the file path play it.
cc
The Qobuz desktop client leaves `folder.jpg` and `large_cover.jpg` beside
a purchase and fetches its booklet with it; QBZ wrote a 600 px `cover.jpg`
and kept the goodies behind a separate control. Write `large_cover.jpg`
from the `_max` variant next to `cover.jpg`/`back.jpg`, and fetch every
goodie the catalog lists into the album folder as part of "Download all",
counted separately from the tracks as before. The "Download goodies"
control stays as the re-download for a folder that lost them.
cc
A downloaded purchase played nothing: Play on the purchase detail (and
every other Qobuz entry) streamed the catalog, so a DSD64 album bought
and saved to disk still came out of the CD stream with a "downgrade"
badge. Resolve the download registry at the audible step instead: the
best registered copy of the track that answers the bounded reachability
probe plays under the SAME Qobuz id (`play_id` = catalog id, so
now-playing, history, scrobbling and QConnect see the track they always
did), `.dsf`/`.dff` through the player's additive DSD ticket and PCM
through the file ticket. The gapless successor takes the same route, so
an album bought as DSD stays DSD across the track edge. A play that asks
for a start offset keeps the stream for a DSD copy (DSD cannot seek), and
anything the copy cannot do falls through to the tier walk unchanged.
Contract: qt-frontend/2026-09-01-purchases-local-playback §6, first
slice (implicit preference: the copy wins; no per-album select yet).
cc
The store grants `intent=download` for exactly the entitlement ids
(measured live: a DSD64 purchase gets 55 and nothing else), so a DSD
album could no longer be saved as a CD FLAC the way the Slint and Tauri
builds allowed. Those builds fetched every download through the
STREAMING grant, which serves any streamable album, bought or not.
Keep that route, but only downward: the menu lists the entitlement
first, then the catalog-synthesized 27/7/6/5 options ranked below the
purchase and not already owned, each marked `streaming` and fetched
through `intent=stream`. Nothing above the purchase is offered, and a
purchased id always goes through the purchase grant.
cc
The list printed the purchase date as "9/1/26" and nothing else, so a
row said neither when the record came out nor, at a glance, what the
number meant. Rows now carry the catalog's original release date next to
the purchase date, both as "Sep 1, 2026", under a column-label strip
like the album list's, and the toolbar sorts by release date (`released`)
beside the four existing keys.
cc
The purchase card and list row printed `qualityTier` as text ("hires")
under the artist, the one surface in the app that did. Use the same
icon-only QualityMini on the card and QualityBadgeFull on the row that
every other album card and list row draws, with the exact quality
(DSD64/DSD128, 24-bit / 96 kHz) in the badge's tooltip and detail line.
cc
The download path used the track performer as the artist folder — the
reference did the same — so a Various-Artists compilation landed as one
folder per performer with one track each (fourteen for "Audiophile
Analog Collection Vol.3", smoke 2026-09-01) and the cover only beside
the first track. Use the album artist from the download context for the
folder; the ARTIST tag keeps the performer.
cc
The purchases listing carries `downloadable_format_ids` per album, and
it is the only honest source for the download menu: a DSD64 purchase
streams as 16/44.1 (`hires:false`), so the catalog-derived ladder
(27/7/6/5) offered a CD FLAC the account never bought and could not
reach the DSD it did. Model the field (plus `hires_purchased`), build
the menu from it highest quality first, and keep the synthesis only as
the fallback for a listing without the field. Fixture from the first
populated capture, redacted.
The download grant is a distinct signed operation: `intent` is part of
the `getFileUrl` preimage, and a DSD entitlement answers 400 to
`intentstream` and 200 to `intentdownload` (measured live). Sign the
purchase grant with `download`, stream the body straight into the
`.part` instead of holding a 650 MB master in memory, take the file
extension from the served container (`audio/x-dsf` -> `.dsf`), verify
its magic before the rename, and leave neither `.part` nor registry row
behind on a truncated or foreign body. Tags stay FLAC/MP3-only.
The tab counters now come from `getUserPurchases?type=...&limit=1`;
`getUserPurchasesIds` counts album tracks as tracks (34 against 0 on
the smoke account). The list card and detail header badge what was
bought: 55/56 ride the hires tier with a DSD64/DSD128 detail.
cc
Purchases is now exercised against an account with real purchases, so
the one-time "built in blind mode" notice no longer describes the
feature. Remove the modal, its controller state, the bridge invokable,
the persisted pref and the three strings from the seven catalogs that
carried them.
cc
A property named `on<Upper>` is filed as a signal handler as soon as a
sibling member `<upper>` exists: its initializer never binds, it sits at
the type default, and nothing warns. `PurchasesView.qml` declared
`onAlbums` next to `albums`, so the Albums tab bound `[]` once and never
re-evaluated, which blanked Purchases for every account with real
purchases. Reproduced standalone with the `qml` runtime: the identical
expression under another name reads `true`.
Rename it to `albumsTab` and the four other `on<Upper>` properties
(`collectionsTab`, `surfaceTint`, `accentFloor`, `litColor`) so the rule
can be exact, and add `qml_on_prefixed_property_audit.py` to the four
QML audit sites (qt-run, cargo-test, test-crates, qt-gate-windows).
cc
vicrodh