Register a lifecycle-owned periodic reaper and close expired sessions on their original workers. Guard pending operations and retain closing resources until actual completion, including owner shutdown races. Add isolated concurrency and lifecycle regressions and synchronize browser documentation.
Co-Authored-By: Claude Code <noreply@anthropic.com>
严格检查全部宿主源码，清零类型错误预算并移除按模块类型豁免。
按原因、所属方法、错误码及语法指纹锁定必要兼容例外和站点类型桩，
CI 阻断新增忽略、检查范围退化、本地桩替代真实接口及新的类型错误。
修复空值、异步和供应方类型边界，保持插件与 API 兼容合同，
并补充存储、订阅、通知、Agent 和工作流边界的回归覆盖。
Keep only install, usage, development-workflow and architecture-boundary
documents; remove the one-off refactor plans, audits and ledgers that had
already served their purpose.
- delete docs/refactor plus the agent API surface audit generator and its
drift-only tests; the fixed route registry remains the source of truth
- delete internal implementation notes (agent, music, notification, transfer,
subscription activity, docker startup, V3t runtime governance)
- delete site adapter capture/release shims and the ADR records; external
links point at MoviePilot-Site-Collector instead
- keep docs/architecture-overview.md and gate its dependency and event
figures against the generated fixtures
- drop doc-only assertions from the architecture baseline test and retarget
remaining references at code and rule documents
Define multiline reStructuredText docstrings and item-level documentation for dataclasses, Pydantic models, and Protocols. Align agent instructions, review guidance, and development documentation.
Validation: document links, Python example syntax, docstring format, and diff checks passed. The unchanged text-only architecture documentation test passed under isolated pytest with temporary CONFIG_DIR and no application bootstrap. Normal bootstrap remains unverified because the local environment lacks moviepilot_rust; installed uv also predates the project configuration format. No product code changed.
Recover Jellyfin deletion paths from webhook payloads or bounded server-scoped caches. Avoid querying deleted items and preserve TV season/series lookup behavior.
BREAKING CHANGE: Movie and unspecified-type history queries without a destination now return no records unless match_all_versions=True is explicitly requested.
Refs #6988
Recover complete release coverage from successful local transfers and audio tags/CUE before subscription searches. Keep release-group and album boundaries, and reject completed torrent hashes before downloader submission.
Keep enabled host and clone sources in dependency recovery. Fall back to per-plugin requests while retaining ready and recovered manifest constraints, preserving original sources and cancellation ownership.
Refs #6943
The access-token endpoint accepted unlimited password attempts; the
only existing rate limiters are single-instance helpers for outbound
site requests. Add app/application/security/throttle.py, an in-memory
LoginThrottle keyed by (client address, normalized username) that locks
for 30s after five consecutive failures and doubles the lockout up to
15 minutes. The endpoint answers 429 with Retry-After while locked,
counts only real credential failures (an MFA challenge after a correct
password does not count), and clears the record on success.
X-Forwarded-For is deliberately not trusted because there is no
trusted-proxy setting; behind the bundled nginx all requests share one
address, so the key degrades to per-username throttling, which is the
dimension brute-force protection needs. Sync the dependency snapshot
and architecture metrics for the new module.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
