Add shared playback memory profiles, bounded disk-backed playback and storage
selection for desktop and daemon. Preserve gapless during streaming-only playback
and provide explicit cache eviction with playback confirmation.
Stop watcher read events and unchanged scans from rebuilding the local catalog.
Restore playlist/sidebar updates, folder availability feedback and player layout.
Add appearance presets and a radio-based cache settings panel with translated
trade-offs, plus consistent clipboard menus across visible Qt text editors.
Validate with Rust regressions, QML interaction tests, isolated release startup
and idle-library checks; extend the shared local and CI gates.
cx
Extract the HTTP host and catalog layer into qbz-control, preserve the
existing daemon API, and keep private session credentials out of SSE.
Scope library stores and scan workers to their host. Share bounded source
search and show Local results alongside Qobuz in the Qt search page.
Add the launch-gated Qt Orbit laboratory and persistent remote-context
banner. Let qbzd run --orbit own and administer its file library through
instance-scoped API and CLI operations. Full remote UI control remains
pending.
Validate library/control/daemon suites, Qt search and QML regressions,
two isolated daemon processes, Qt release build and final cargo check.
cx
Refresh missing artwork for unchanged SACD images when a folder cover is added after scanning. Enable image-specific metadata and cover sidecars in the Qt editor while preserving physical track numbers and never writing the ISO.
Validated with SACD regressions, the real Heathen image, 13 Qt editor tests, QML audits and the combined release build.
cx
Detect sector layout from Master TOC signatures and strip physical framing while preserving logical addressing, bounds and file mutation checks. Add reader and scanner regressions with synchronized CI presence guards.
Verified full decoding of 53 tracks across five real images, seek and previous-reader comparisons, isolated release UI opening and scanning, and disc, DSD, library and Qt tests.
cx
Restore downward stream-format downloads while keeping purchased masters on the download grant. Make Purchases playback prefer the highest complete local copy, repair duplicate copy inventory, and move copy management into a bounded modal with safe library and record actions.
cx
Parse resilient SACD images, decode DST, scan ISO releases into the local library, and keep explicit opens ephemeral.
Ship decoder notices across distribution formats and align DSD album filtering and version selection.
cx
Show SACD images in folder grouping, keep track details responsive, avoid repeated album reload work, and exclude disabled or unconfigured media servers from filters and sync.
cx
The scan never treated an .iso as audio; images only entered the library
through Open > disc image. Each root's scan now walks its .iso files,
asks qbz_disc::sacd::is_sacd_image for the SACDMTOC signature (PVD plus
Master TOC sector, four 2 KB reads at most, no directory parsing) so a DVD
or data ISO leaves silently, skips images already imported with the same
size and mtime without any I/O, and adopts the rest through the
generation-based import. The row builder moved from sacd_qt into
qbz_library::sacd_scan and the manual open is now its client, with the
translated fallback labels. Parser and import rejections are scan errors.
cc
The purchase detail badges what was bought on every row (DSD128 on a
DSD purchase, not the catalog's 24/352.8), marks the formats already on
disk with a check in the dropdown, offers a track filter, links to the
album in the Local Library once its folder is indexed, and gives the
download the accent while Play drops to a plain control of the same
size — on this screen the download is the point.
Downloads are process-wide and survive leaving the page; the nav flyout
now lists the purchases with a download in flight under "Downloads · N"
so the user can find them again, each row reopening its detail.
cc
A downloaded purchase played nothing: Play on the purchase detail (and
every other Qobuz entry) streamed the catalog, so a DSD64 album bought
and saved to disk still came out of the CD stream with a "downgrade"
badge. Resolve the download registry at the audible step instead: the
best registered copy of the track that answers the bounded reachability
probe plays under the SAME Qobuz id (`play_id` = catalog id, so
now-playing, history, scrobbling and QConnect see the track they always
did), `.dsf`/`.dff` through the player's additive DSD ticket and PCM
through the file ticket. The gapless successor takes the same route, so
an album bought as DSD stays DSD across the track edge. A play that asks
for a start offset keeps the stream for a DSD copy (DSD cannot seek), and
anything the copy cannot do falls through to the tier walk unchanged.
Contract: qt-frontend/2026-09-01-purchases-local-playback §6, first
slice (implicit preference: the copy wins; no per-album select yet).
cc
The membership hydrator looped forever on one playlist (smoke
2026-08-30): playlist/get and getUserPlaylists do not report comparable
updated_at stamps, so the revision evidence never settled, and the
driver had no forward-progress guard. replace_tracks now copies the
HEADER's revision into the membership evidence, staleness requires
comparable evidence on both sides (count is the fallback when either is
missing), and a playlist successfully written in a round is never
fetched again within it — after the initial index build, only the
playlists the authoritative list reports changed re-sync.
Library Explorer rows never opened the picker: the bulk resolver did
not know the explorer's own row caches and dropped every merged
Plex/remote row. It reads them now, and Jellyfin/Subsonic tracks are
first-class playlist citizens: source-prefixed refs (the Plex pattern),
a playlist_remote_tracks sidecar for Qobuz playlists, source-qualified
rows in local playlists, read resolution through the media cache, and
containment arms in the membership index.
cc
playlist_index_qt walks the library's hydration queue one
playlist/get?extra=track_ids fetch at a time (300ms pace, two attempts
per playlist per round, nothing written on failure), poked by every
recorded authoritative list. The sidebar and playlist-manager loads now
record ownership-aware authoritative generations (skipped while the
session user is unknown, and never from a failed fetch). The picker doc
gains lastUsed — session-local, set only by a confirmed successful add
or create, validated against the live row list — plus alreadyIn rows
with distinct-ref counts and the complete/updating/unavailable
tri-state (offline degrades updating to unavailable). Followed
playlists are no longer offered as add targets. Successful add/remove/
create/delete mutations move the snapshot synchronously; local-mode
refs resolve to typed membership refs at the index boundary.
Verified: cargo test -p qbz-library (158) and -p qbz-qt (615) green.
cc
An offline copy (qobuz_download row) attaches to Qobuz playlists as a
library-row sidecar but to local playlists as its catalog id; the
Library ref now carries the optional catalog id so containment looks
both ways. Also adds mark_inactive for the delete-playlist hook.
cc
Playlist and PlaylistWithTrackIds deserialize the API updated_at stamp
(absent on some list shapes, hence optional), and the core facade
exposes the lightweight playlist/get?extra=track_ids fetch the
membership hydrator drives.
cc
Split the snapshot's single timestamp into honest freshness columns
(header_updated_at vs membership_synced_at, plus membership_count and
remote revision evidence), add authoritative-list generations with a
two-generation retirement grace, persist ownership explicitly, and add
incremental add/remove/create producers so successful mutations move
the snapshot synchronously. New playlist_membership module answers the
inverse question — which writable playlists already hold these tracks —
over the snapshot, both sidecar tables and local playlists, through a
typed PlaylistTrackRef instead of the plex:/id string mangling. All
membership tables gain reverse-direction indexes; migrations are
probe-then-ALTER with a legacy backfill test.
cc
rusqlite 0.40 removed ToSql/FromSql for u64 (SQLite integers are i64):
every u64 column now reads/writes through an explicit i64 cast. It also
rejects a multi-statement execute() instead of silently running only the
first statement — which is what catalog.rs's editions/logical_albums
prune had been doing all along; it is an execute_batch now, so the
logical_albums prune finally runs.
cc
The scanner now keeps the identity tags Picard writes (ISRC/TSRC and the
MusicBrainz recording, track, release, release-group and artist ids —
the same lofty ItemKeys the tag writer already knows) in six additive
local_tracks columns, migrated idempotently (also after the sample_rate
table rebuild) and indexed on isrc and the recording id. Rows fill on
the next scan. The catalog projection (legacy.rs) stops hardcoding
isrc / musicbrainz_recording_id to None for local, remote and Plex rows
(the upsert already bound both), treating an empty string as no id.
qbz-source stamps both keys on local queue tracks.
cc
Add bounded native library models, complete grouping rails and scan progress. Bring source-aware metadata editing, media information and collection offline preflight to Qt, and repair inherited Plex album artwork without overriding healthy tokens.
cx
Preserve per-disc and collection artwork, multi-value genres and remote metadata across Local, Plex, Jellyfin and Subsonic.
Apply source, format and quality filters before pagination, reject invalid CUE rows, and keep Qt library surfaces aligned with the selected physical version.
cx
Promote metadata editing to a routed full-page workflow with tabular per-track fields, ordered artist credits, provider identifiers, and compilation handling.
Add bounded artwork selection and retrieval through MusicBrainz, Discogs, and Last.fm. Direct and sidecar saves preflight immutable rows, verify rich tag writes, cache covers by content, and update exact database ids transactionally.
cx
Consume preflight data when loading clears so the modal cannot spin indefinitely.
Reuse the editor for ephemeral folders and bind sidecar or direct writes to the exact active session.
cx
Inspect every tag layer before editing, target the container's canonical writable tag, and read values back before reporting progress. Preserve secondary layers by default, support explicit ID3v2.3 compatibility and synchronize compatible modern layers only when requested.\n\nMake sidecar clears persist across rescans while preserving omitted-field compatibility.\n\ncx
Associate physical copies only when normalized album identity and strong track-title/duration overlap agree. Keep every source visible on one card and resolve each authoritative album id into the existing version cache.
Order versions by delivered quality and then track count, expose inferred edition labels and full format metadata, and keep source filters aware of every represented copy.
cx
Order every source by the active grouping key before the bounded merge so later pages preserve the visible prefix. Remove the accumulated QML reorder that moved the viewport when new rows sorted ahead.
cx
Adopt fully parsed SACD generations atomically into library.db and preserve local row IDs across image moves. Keep failed reads non-destructive, reject stale metadata writes, and project the virtual tracks through the existing local catalogue.
cx
Stream each registered root into bounded extraction batches, persist fingerprint and checkpoint generations, and prune only after a complete reachable pass. Add local watcher hints plus separate periodic local and network reconciliation.
Preserve CUE identities, retry unreadable files, and keep cancellation, traversal errors, offline roots, and overlapping roots from authorizing destructive cleanup.
cx
Bound each enabled source to an independent candidate page and merge one stable global Tracks page while advancing only consumed offsets. Include remote counts and artists, preserve Plex rows past 5,000, and reject stale search or sort generations before state and UI publication.
cx
Opening a 247-file box set from a NAS took ~9.3 s. The instrumentation
added in the previous commit put the whole cost in one place:
[ephemeral][perf] parallel tag reads: 9.268s for 247 files
[ephemeral][perf] serial bookkeeping (artwork + ids): 29.4ms
Everything that is not a file read — artwork caching, id assignment,
grouping, sorting, serialising — is 29 ms. And parallelising the reads
across 8 threads had bought only 1.6x over the serial 14.7 s, which is
the signature of a BANDWIDTH wall, not a latency one: threads cannot help
when the bytes are the problem.
A FLAC keeps its cover art INSIDE the tag, so `Probe::read()` was pulling
multiple megabytes of picture data per file across the network in order
to recover a title, an artist and a track number. Those pictures were
then dropped on the floor: the cover shown for a block is resolved
separately, once per ALBUM, by `extract_artwork` / `find_folder_artwork`
— 13 reads out of 247 in this box.
`ParseOptions::read_cover_art(false)` on the two paths that only ever
wanted metadata (`extract_with_roots`, `extract_properties`).
`read_properties` stays ON: duration, bit depth and sample rate come from
the header and cost nothing. `extract_artwork` and `extract_artwork_bytes`
— the two functions that genuinely want the picture — are untouched.
MEASURED ON THE SAME FOLDER, SAME NAS, AFTER THE CHANGE:
[ephemeral][perf] parallel tag reads: 922.9ms for 247 files
[ephemeral][perf] serial bookkeeping (artwork + ids): 66.5ms
9.268 s -> 0.923 s on the reads, and ~14.8 s -> 990 ms for the whole
open. The prediction written before the run was "under 2 s", so the
mechanism is confirmed rather than merely consistent.
Worth recording plainly: the parallel-reads commit before this one was
NOT the fix. It masked a bandwidth problem with threads and made the
number look better while the app still moved the same bytes — and it left
me believing the remainder was the NAS's ceiling. What refuted that was
the owner pointing out that fooyin opens the SAME folder from the SAME
NAS almost instantly. The fix is not reading what nobody asked for.
Shared crate, so this also reaches the library scanner — which wants the
same thing for the same reason. qbz-library: 103 tests green.
cc
BINDING LOOP. The Binding's `when` read `viewLoader.item.activeTab` —
through `typeof`, which still registers a dependency — while the Binding
WRITES that same property. Every flyout navigation logged
QML Binding: Binding loop detected for property "when"
Pre-existing, not from the two-phase commit: reproduced on the
pre-2026-08-21 binary by navigating the same way, where it logs from the
same Binding at its own line number. The guard now lives in a handler on
the Loader's `item`, which runs once per mount and registers no
dependency. Verified by log: 0 "Binding loop", and 0 QML complaints of
any kind on a full navigation pass.
EPHEMERAL OPEN — INSTRUMENTED, NOT SOLVED. Two timers split the work
either side of the parallel read phase, because the remaining ~9 s has no
confirmed owner. The owner reports fooyin opening the SAME NAS folder
near-instantly, which rules out the network as the ceiling and makes this
our code — the obvious suspect is that we read each file's tags in
`extract` and then open and read it AGAIN in `extract_artwork`, plus
decode and re-encode a thumbnail, where a grid-only player needs none of
that up front. That is a design change, not a tweak, so it is measured
rather than guessed at.
The numbers arrive on the next real open ("[ephemeral][perf] parallel tag
reads" / "serial bookkeeping"). I could not trigger one from the test
harness: the entry point is a native folder picker, and the rehydrate
path did not fire from the surface the harness can reach.
cc
Opening a box set through "Open ▾" — the quick path for something outside
the library — listed its 13 discs as Disc 1, 10, 11, 12, 13, 2, 3 …, each
with the same heading and the same cover. The Folders grid gets all three
right from the same files, which is what proved it was fixable.
THREE DEFECTS, one per symptom:
ORDER. Blocks are grouped in a BTreeMap keyed on the STRING
"{album}#disc{n}", which sorts lexicographically. The final
`sort_by(title)` was meant to impose real order, but every block of a
box carries the same title, so it tied on every pair and the string key
showed through.
TITLE. `album_group_title` is the group name with the disc suffix
STRIPPED — identical for all 13 blocks. That stripping is what makes a
box ONE album and must stay.
COVER. `artwork_path` is biased to the album ROOT by the scanner
(+5 bonus, strict >), so every block resolved to the same file.
The name and cover helpers now live in `local_rows` and are shared with
the album page's divider, which had grown its own copies yesterday.
AND THE ORDERING FIX HAD A SECOND ACT WORTH RECORDING: giving each block
its own title made `sort_by(title)` start to bite, and it sorted by the
DISC NAME — putting "Complete Song Collection 1" (disc 11) first.
Measured, not predicted. So the sort key is the BOX's title with the disc
NUMBER as the tiebreak: ordering discs by anything except their number is
the same mistake twice.
Verified against the owner's own box: blocks now run TV Series
Soundtrack #01, #02, Movie Saint Seiya OST, #03, Movie Kamigami…, #04 —
i.e. discs 1,2,3,4,5,6 in order, matching the Folders grid, each with its
own cover.
ALSO, the 15 s open: it is not painting, it is 247 sequential
`canonicalize` + tag reads over NFS. Only the READS are now parallel
(`std::thread::scope`, no new dependency, ≤8 workers); the CUE dedup, the
APE skip, id assignment, the artwork caches and the push order all stay
serial and in scan order, because ids are observable. Measured 14.8 s →
8.9 s on the owner's NAS. Better, NOT solved — something else holds the
remaining half and I have not identified it.
cc
Opening a box set FOLDER whose discs each have their own name and cover,
the divider said "Disc 2" and nothing else. Switching the header to
METADATA grouping showed them correctly, which is what made it look like
data the app already had.
IT WAS NOT. In folder grouping a box is deliberately ONE album, so
`TrackRow.album` is `album_group_title` — the name with the disc suffix
STRIPPED, which is exactly what makes the box hold together. "Box (Disc
1)" and "Box (Disc 2)" collapse to "Box", and the only thing separating
disc 1 from disc 2 in the published document was an integer. (Metadata
grouping works for an unrelated reason: there each disc is its own album
row, keyed album||artist, so it keeps its raw tag and its own artwork.)
So the document now carries a small `discs` array — one entry per disc,
not per row: the divider is 2-4 items where the track list can run to
hundreds, and widening TrackRow to label three of them would have been
the wrong trade on the surface this view is most careful about.
The title is resolved most-trustworthy-first: the disc FOLDER's own
titled tail ("Disc 1 - Rheingold"), else the raw album tag when it names
something the group title does not already say — compared AFTER stripping
the disc suffix, so a tag of "Box (Disc 2)" is rejected instead of being
echoed next to the "Disc 2" label — else nothing, and the divider stays
the bare "Disc N" it has always been.
THE ART NEEDED A SECOND FIX, and an adversarial pass is what caught it.
The plan was to read each disc's cover off its first track, on the
assumption that scanned artwork is per-folder. It is not:
`find_folder_artwork` gives the album ROOT a +5 bonus against a strict
`>`, so `Box/cover.jpg` beats `Box/Disc 01 - X/cover.jpg` on every track
of every disc, and the thumbnails would have been N copies of one image —
which the "only draw them when they differ" guard would then have
suppressed, leaving the feature silently inert. `folder_artwork_in_dir`
is the unbiased sibling, used only where the caller already knows it is
asking about one disc. Nothing on the scan path changes and no re-scan is
needed.
Additive only in the shared crate: `strip_disc_suffix` and
`album_root_dir` are untouched — they are what keep a box set one album,
there is a regression test pinning that, and a per-disc label must not be
bought by breaking it. qbz-library: 103 tests green.
cc
Reported: the CD opened with its names but no artwork. The log said why,
because the previous commit taught it to — "no cover art (500 Internal Server
Error)" — which is a better failure than the silent one it replaced, and it
pointed straight at two separate bugs.
WRONG KEY. Cover art was asked for by RELEASE, and a release is one pressing.
The owner's Fear Inoculum answers 500 for its release and 200 for its RELEASE
GROUP, which is the album as a work and where the canonical art lives. The
lookup now asks for `release-groups` too and tries the release first, the
group second.
WRONG PLACE. The fetch was awaited BEFORE the session was published, so a
click produced ten seconds of nothing — measured: the Cover Art Archive took
9.4 s to answer, because it redirects to archive.org. The tracks now land
immediately and the art is patched in when it arrives.
Patching it in needs `replace_tracks_preserving_ids`: re-running `open_tracks`
would renumber every row from the synthetic floor, and the queue may already
hold the old ids — a playing track would lose its source mid-song. A late
cover for a session that has since been closed or replaced is dropped rather
than painted onto whatever is open now.
cc
`PlaybackTicket::CdTrack { device, start_lsn, sectors }`. No path-shaped
variant fits: a track on a disc is a device plus a sector RANGE, and the bytes
only exist while that medium is in that drive. `File` and `DsdFile` would both
hand it to something that opens it.
`LocalSource::playback` answers it FIRST, before the extension tests, through
`CdRef::is_cd_path` — the encoder's own predicate rather than a second
`starts_with` written out at the call site. That is deliberate: a hand-copied
prefix list is exactly how six bugs of the same shape shipped on 2026-08-20,
and a fold to a valid-looking answer is invisible to every test.
The match in `audible_qt::play_ticket` is exhaustive on purpose, so the new
variant broke the build until somebody decided what a CD means. It now means:
read the sectors and feed them as 44.1 kHz / 16-bit / stereo PCM.
`EphemeralLibraryState::open_tracks` installs a track list that did not come
from scanning a directory. `open_folder` cannot serve a disc — it takes a
`&Path`, rejects anything that is not a real directory, and derives every
field by reading files off a filesystem. A disc has no filesystem to read.
Ids come from the same synthetic range, so every playback caller keeps routing
them without knowing a disc exists.
cc
`LibraryDatabase::parse_format` is the inverse of `AudioFormat`'s Display,
which is what the scanner stores. It had no arm for "DSD", so every DSD row
came back out of the DB as `Unknown`: the album header printed "UNKNOWN" as
its format, the quality badge said CD (depth 1 IS a known depth below 24) and
the detail line read "1-bit / 2822.4 kHz". The now-playing bar was right all
along because it reads the decoder, not the row — which is exactly the clue
that separated the two data sources.
A fold to `Unknown` is a VALID answer, so nothing failed: not the build, not
`cargo check` (it cannot see the match at all), not a single test.
Three sites had the same hole and all three are fixed:
- `database.rs`, the one that bit;
- `local_plex.rs`, same fold for a Plex server serving DSD;
- `media_servers_qt.rs`, worse than the others — its fallback is `Flac`, so
a .dsf from Jellyfin or Navidrome was not losing its format, it was being
mislabelled as lossless PCM.
The guard is a round-trip over EVERY variant rather than a "DSD parses" test:
adding a variant without an arm now fails here instead of shipping the same
silent loss again. Verified against the real rows: format is stored as "DSD",
so this is a READ-side fix and no rescan is needed.
cc
Three pieces that only mean anything together: rows in the shared cache,
a union that shows them, and settings that decide whether either
happens.
THE UNION. `get_albums_metadata_page` grows a second, INDEPENDENT
attachment. `plex_cache` stays; `remote_cache` is the shared mirror, and
they attach separately on purpose — a missing Plex cache must not cost
the user their Jellyfin rows. `attach_best_effort` is extracted because
the failure mode of a botched ATTACH is a silently local-only library,
and a failure stays non-fatal: refusing to list any albums because one
server is off turns "Jellyfin is unplugged" into "your library is
empty".
The union takes an ENABLED-SOURCES list, not just a path. The mirror
holds every remote source, so the master toggle has to be a filter
rather than a detach: turning Jellyfin off must hide Jellyfin's rows and
leave Subsonic's alone. That predicate is interpolated into SQL, so it
is VALIDATED rather than escaped — only [a-z] survives, an all-invalid
list yields `0` (show nothing, the safe direction), and a test feeds it
`x'; DROP TABLE local_tracks; --`.
The remote group key is `<source>:<album id>`, matching Plex's
`plex:<hash>`. That namespaces two servers using the same album id AND
lets a source claim an album card that arrives with no source word,
which is every card that round-trips through a QML string property —
`recognises` grew that arm and `claim` strips the prefix, because
carrying it inward is how Plex ended up with two album keys only one of
its queries understood (IC-2).
THE SETTINGS. One store for both servers, keyed by a `server` column,
mirroring the shared-cache decision. What each protocol needs differs
and `is_configured` is the one place that knows: Jellyfin needs its
issued token, Subsonic needs a password because it has no session and
re-derives `md5(password + salt)` per request.
Two identifiers are minted once and persisted, and both are
load-bearing. Jellyfin's DeviceId, because re-authenticating under the
same one revokes the previous token — a constant would make two installs
log each other out, a fresh one per launch drops the last run's token.
Subsonic's salt, because rolling it per request makes every cover URL
unique and the artwork cache keys on the URL.
THE SWEEP. In the frontend, where the runtime and the progress UI are,
writing through the cache handle the SOURCE owns so sweep and reads can
never point at different users. Jellyfin gets progress and a delta path
(45.8 s for 4924 rows); Subsonic needs neither (0.81 s for 6678).
`prune_stale` runs only after a COMPLETED full sweep — a delta never
prunes, because it deliberately does not see unchanged rows and would
read every one of them as deleted. `last_sync_at` is stamped only on
success for the same reason.
Verified against the running binary, twice:
source registry bound: local_tracks=617 plex=connected
ephemeral_store=yes remote=none configured
jellyfin: minted a device id for this install
subsonic: minted a salt for this install
...and on the second launch, zero re-mints and the same values on disk —
which is the property that keeps a Jellyfin session alive.
qbz-qt 428/428, qbz-app 224/224, qbz-library 100/100, qbz-source 88/88.
Release build clean, zero warnings.
cc
Two owner requirements, one shape: something that cannot play must be
skipped, and cleaned when there is nowhere left to skip to. The causes
are outside our control — Qobuz withdraws a track overnight, or a
local/Plex file sits on a share this network cannot see today.
THE FUNNEL, which is where the real gap was. `play_current_if_local`
returned a bool whose two `false`s meant opposite things: "not my row,
run the Qobuz path" and "my row, and it cannot play". The caller could
only act on the first, so an unreachable local file fell through to the
Qobuz tier-walk, failed there with an unrelated error, and
`auto_skip_unavailable` then declined it as non-terminal. One dead file
stopped playback silently. It is now a three-state `LocalPlay`, and a
local failure takes the SAME bounded walk a pulled Qobuz track takes —
to the user they are the same event.
CLEANING. Both dead ends of that walk (budget spent, queue edge) now
call `purge_unavailable_upcoming`, which drops only rows
`queue_track_unavailable` already refuses to play, walking backwards so
a removal cannot shift an index still to be visited. A track on an
unreachable share can never land there: it is Unreachable, not dead.
PROBES THAT CANNOT HANG (`qbz-library/src/reachability.rs`, 4 tests).
The machinery for network shares already existed — mount_info,
`library_folders.is_network`, a populated `local_tracks.is_network_mount`,
even an unreachable-folder guard in scan.rs. Every one of them probed
with a bare blocking syscall, and a mounted-but-unreachable share does
not make `exists()`/`read_dir()` fail, it makes them BLOCK for the
mount's timeout. The guards could not fire; scan.rs hung on the very
condition it existed to detect.
Three states, not two, and that distinction is the whole safety
property: `Missing` is the filesystem saying the file is gone and may
be cleaned; `Unreachable` is it saying nothing, and may only ever be
skipped. Collapsing them — which a bare `exists()` does — would delete
a user's NAS library because they changed networks.
The deadline goes on the PROBE only, never the transfer: a hi-res FLAC
over a working-but-slow share legitimately takes longer than any probe
budget, and timing the read out would turn "your network is slow" into
"this track is gone". A blocked syscall cannot be cancelled, so a
timed-out probe leaks its thread; the mount is therefore remembered
with a cool-down, one probe per dead mount rather than one per track,
which on a 2000-row queue is the difference between a defence and a
thread bomb.
PERSISTENCE. `busy_timeout=1000` on all 18 store pragmas. Deliberately
NOT the 2-3s discussed: these writes run on the Qt thread, so a 3s wait
would install exactly the stall this whole sweep has been removing,
while today's 0 means contention loses a setting silently and instantly.
One second resolves transient contention without a visible stall.
`home_bridge::ui` announces both of its silent failure modes. Three
builds went into proving it was NOT dropping the Home document during
the launch freeze; one warn line would have answered it in one.
Verified against the owner's real session state (1935-row queue): the
app launches to a painted Discover with no QML errors and no dropped
publishes.
cc
The frontend-agnostic half of Purchases. Ported against the Tauri reference,
which is the only implementation ever validated by a real user; the Slint
controller was read for divergences only and never as a source of truth.
Context that sets the bar for all of it: Qobuz does not sell Purchases in this
account's region, so no populated screen and no download can be exercised here.
Anything merely plausible ships unseen. Hence the tests below are the deliverable
as much as the code.
Behaviour ported or corrected:
- Album "downloaded" now comes from the LOCAL REGISTRY. The reference derives it
from `album.tracks.items`, but `getUserPurchases?type=albums` carries no nested
tracks page (measured against a live account), so that predicate is
unsatisfiable: no album card can ever mark as downloaded and "Hide downloaded"
can never hide anything. `get_downloaded_purchase_album_counts` answers it
instead, giving a reader at last to the `album_id` column and to the index that
has always sat on it.
- `album_id` is written by every download path. It used to be set only by the
album loop, so a release downloaded track by track produced rows the rule could
never attribute. The `/track/get` payload each download already fetches carries
the id.
- `remove_downloaded_purchase` keys on `(track_id, format_id)`, the table's actual
primary key; erasing every format is now a separate, named call.
- `sanitize_filename` no longer panics. The 200 cap is in BYTES and `truncate`
panics off a char boundary — reachable because the mapping keeps Unicode
alphanumerics. Measured: the crash belongs to the THREE-byte class (CJK), where
200 % 3 lands mid-character; two-byte scripts happen to land on a boundary. The
cap stays in bytes so no already-downloaded path moves.
- The purchase path sends `/album/get` and `/track/get` UNSIGNED, matching both
the reference and Qobuz's own desktop client, whose request helper takes a sign
flag and passes it false for these and true only for `getFileUrl`. That
signature is the entitlement proof and is untouched.
- The purchase-type guard runs before any I/O; a bogus type no longer issues a
live authenticated GET before failing.
- Track subtitles survive. `PurchaseTrack` gained `version` and
`build_purchase_album` maps it from the catalog track, closing a latent
regression where every purchased track lost its edition.
- Downloads write tags, `cover.jpg`/`back.jpg` and goodies. All three are
best-effort: the audio file is the deliverable and is already on disk and
registered before any of it runs.
- `goodies` is deserialized leniently. Its populated shape has never been
observed — it comes back empty on every album nobody owns — and `/album/get`
is parsed with the strict structs, so an unexpected shape would take the whole
album down rather than merely hide a booklet.
Riding along, both found while building the above and both unrelated to
Purchases:
- The metadata EDITOR silently discarded saves. `write_album_tags_to_files`
picked its write target as "the primary tag, or else the first one I can find",
and lofty refuses to WRITE a tag type a container only supports READING —
silently, skipping it rather than erroring. A FLAC carrying an ID3v2 tag has no
Vorbis comments, so every edited field went into that ID3v2 tag, the save
dropped the lot, and the call returned Ok. The user pressed Save, saw a success
toast, and the file never changed. Same defect, same fix, in the new purchase
tagger.
- `fetch_asset_bytes` does not reuse the audio downloader. That one sizes its
buffer from the response's own Content-Length and sets no total timeout, which
is fine for a track from a trusted CDN and wrong for an arbitrary goodie URL on
a machine that hard-freezes under memory pressure.
Tests: 277 across the four crates, covering every acceptance item the contract
set. The signature preimage character for character, the pagination loop
including the zero-total case, the sanitizer against the inputs that used to
panic, every deserializer default, and the wire envelopes against real bytes
captured from a live account. A download harness stands up a local HTTP server
and drives the pipeline end to end — real bytes over a real socket, a real FLAC
tagged and read back, a real database — and the two tag regressions were both
verified to FAIL against the old code before being accepted.
cc
Restored queues and recently_played carried whatever variant the building
surface picked — 50px JPEGs measured in the wild — into the now-playing
bar, MPRIS, Discord and the immersive big slots. The np feed rewrites
sized Qobuz covers up to 600px; big slots (immersive panels, split,
preview overlay) resolve per size bucket through npArtworkPathLarge with
one re-resolve per tier crossed and never on shrink.
Registry-miss arm (restored sessions carry no ImageSet): rewrite to the
FULL requested bucket with a session negative cache, so a pre-mega album
pays one 404 per session instead of one per track change. And the mega
tier's wire suffix is the literal _max.jpg, not _3000 (404 measured
against the live CDN) — qobuz_cover_at_px now accepts and emits _max.
Local covers gain an on-demand 1600px tier (never upscaled); Plex big
slots tokenize at 1024.
km
insert_track used INSERT OR REPLACE. SQLite resolves that conflict by DELETING
the old row and inserting a new one, which hands out a fresh rowid.
playlist_local_tracks.local_track_id is a foreign key onto local_tracks(id), and
foreign keys are OFF in this database (the only pragmas set are journal_mode and
synchronous), so the cascade never fires: the playlist row survives pointing at
an id that no longer exists and the INNER JOIN that reads it returns nothing.
The scan re-inserts every file — there is no mtime skip — so every library
rescan silently emptied Qobuz playlists of their local tracks.
The conflict that fires is not the obvious one, which is worth recording: the
table's UNIQUE(file_path, cue_start_secs) does NOT catch an ordinary track,
because cue_start_secs is NULL and SQLite treats NULLs as distinct. What catches
it is the partial index idx_tracks_file_nocue. Both identities are handled.
The row is now looked up and UPDATEd in place. Reproduced on a scratch database
before the fix was written, and the regression test was confirmed to fail
against the old code path.
First-class LOCAL playlists were never affected: local_playlist_tracks stores
local_path, not an id.
cc
write_album_tags_to_files called set_artist(album_artist) unconditionally on
every file. Two irreversible outcomes, and a direct write has no undo:
- On a various-artists release the editor pre-fills the artist field from
compute_track_artist_match, which returns None the moment two track artists
disagree — so the field renders EMPTY and that empty string was written over
the ARTIST of every file in the release.
- With a non-empty album artist, every guest credit was replaced by it.
The DB half of the same save was already careful: update_album_group_metadata
renames the track artist only where it still equals the value that was uniform
across the album. The file writer now agrees with it. A pre-pass reads the prior
artist from the files themselves — they are the ground truth about what is being
overwritten — and should_rename_artist renames only on an exact match with a
non-empty new value. ARTIST is track scope and the editor has no field for it.
The pre-pass is skipped when the album artist is blank, so the common path costs
nothing.
cc
In the DEFAULT (folder) grouping mode, a box set laid out the way our own
multi-disc guidance recommends — Disc NN - {subtitle}/ — showed up as one album
per disc.
album_root_dir climbs past a directory only when is_disc_folder accepts it, and
that predicate required the name to consist ONLY of disc tokens, digits and a
short modifier list. "Disc 01 - TV Series Soundtrack #01" tokenises to
["disc","01","tv","series","soundtrack","01"], has_extra_words hits "tv", and
the climb stops — so the group key becomes the disc directory and a 13-disc set
becomes 13 albums.
is_disc_folder now also accepts a name whose LEADING token is a disc designator
followed by a separator with whitespace on at least one side. That is disjoint
from the issue #147 false positives, which are album titles that END with a disc
token ("Now 75 - CD1", "100 Popular Classics, Disc 1", "Relaxation Disc1") —
their regression tests pass unchanged. The rule stays narrow deliberately:
"CD-Rom Favourites" and "Disc Jockey Anthems" are still album titles, because an
accidental merge of two releases is worse than the split being fixed.
The disc NUMBER is gated on the same predicate, so a box set with no DISCNUMBER
tag now recovers it from the folder name too.
Sidecar lookup follows the key, so moving the key would have orphaned every
.qbz.json saved while a disc was still its own album — album title, artist, year,
genre, catalog and all per-track overrides, silently. apply_sidecar_override now
tries the album root and then the file's own directory, and the CUE path goes
through the same function instead of its own single-directory copy.
Existing installs see the merge after a rescan; album_group_key is stored at
index time.
cc
Every 0.23.x release of lofty is yanked on crates.io, so the version
requirement only resolves from the committed Cargo.lock. A fresh resolve
of qbz-library or qbz-offline-cache as a dependency fails outright.
0.24.0 needs no code changes across the 19 call sites.
Port of 0c3b38f8 (bugfix/internal/local-library-tag-fallback) onto current
pre-release. The scanner read metadata from a SINGLE lofty tag
(primary_tag().or(first_tag())) with no per-key fallback to the file's other
tags. Old, repeatedly-retagged collections routinely carry the album /
Album Artist / date only in a secondary tag (ID3v1/APE/Vorbis) while the
primary tag lacks them:
- #447: the missed album tag let the folder-derived backfill land in the
album column and masquerade as metadata (folder-name albums, folder-level
grouping, MIN(year) across mixed folders).
- #507: the missed Album Artist left album_artist NULL, degenerating every
COALESCE(album_artist, artist) to the per-track artist (Various Artists).
extract() now falls back per key across tagged_file.tags() (primary first,
deterministic conflict policy) for title/artist/album/album_artist/genre/
catalog/track/disc/date. Folder backfills stay as-is for genuinely untagged
files. Tests adapted to the AlbumGroupMode signature; 75/75 pass. A full
library rescan picks the fix up (no migration).
km
Spec 2026-07-19-local-album-grouping-mode (A1 + C + D).
AlbumGroupMode { Metadata, Folder }: the Albums view can now group by the
album|artist metadata pair (today's #411 behavior) OR by the album-root
folder — a compilation with 10 track artists renders as ONE card, and
multi-disc boxes merge even when discs are tagged separately. Read-time
switch: no schema change, no rescan. Threaded through
get_albums_metadata_page / count / get_albums_metadata_grouped; the
cover-art lookup matches both key shapes. Title/artist derivation is
mode-agnostic (album tag preferred, album_group_title fallback, per-row
COALESCE(album_artist, artist) + COUNT(DISTINCT track_artist) > 1 ->
'Various Artists').
Untagged-root clamp (C): infer_artist_album no longer returns the library
ROOT's name as the artist when the album dir hangs directly off a root
(a tagless DSD set surfaced with artist 'Music'). extract_with_roots
threads the scan targets; plain extract keeps the legacy inference for
ephemeral/single-file paths.
Tests (66/66): folder mode compilation = 1 album + VA + all_artists,
album_artist respected, orphan bucket preserved, metadata split unchanged;
root-clamp cases incl. disc subfolders, 'Artist - Album' split, real
artist folder named like the root, and the no-roots legacy path.
km
vicrodh