严格检查全部宿主源码，清零类型错误预算并移除按模块类型豁免。
按原因、所属方法、错误码及语法指纹锁定必要兼容例外和站点类型桩，
CI 阻断新增忽略、检查范围退化、本地桩替代真实接口及新的类型错误。
修复空值、异步和供应方类型边界，保持插件与 API 兼容合同，
并补充存储、订阅、通知、Agent 和工作流边界的回归覆盖。
Keep only install, usage, development-workflow and architecture-boundary
documents; remove the one-off refactor plans, audits and ledgers that had
already served their purpose.
- delete docs/refactor plus the agent API surface audit generator and its
drift-only tests; the fixed route registry remains the source of truth
- delete internal implementation notes (agent, music, notification, transfer,
subscription activity, docker startup, V3t runtime governance)
- delete site adapter capture/release shims and the ADR records; external
links point at MoviePilot-Site-Collector instead
- keep docs/architecture-overview.md and gate its dependency and event
figures against the generated fixtures
- drop doc-only assertions from the architecture baseline test and retarget
remaining references at code and rule documents
Define multiline reStructuredText docstrings and item-level documentation for dataclasses, Pydantic models, and Protocols. Align agent instructions, review guidance, and development documentation.
Validation: document links, Python example syntax, docstring format, and diff checks passed. The unchanged text-only architecture documentation test passed under isolated pytest with temporary CONFIG_DIR and no application bootstrap. Normal bootstrap remains unverified because the local environment lacks moviepilot_rust; installed uv also predates the project configuration format. No product code changed.
Recover Jellyfin deletion paths from webhook payloads or bounded server-scoped caches. Avoid querying deleted items and preserve TV season/series lookup behavior.
BREAKING CHANGE: Movie and unspecified-type history queries without a destination now return no records unless match_all_versions=True is explicitly requested.
Refs #6988
Recover complete release coverage from successful local transfers and audio tags/CUE before subscription searches. Keep release-group and album boundaries, and reject completed torrent hashes before downloader submission.
Keep enabled host and clone sources in dependency recovery. Fall back to per-plugin requests while retaining ready and recovered manifest constraints, preserving original sources and cancellation ownership.
Refs #6943
The access-token endpoint accepted unlimited password attempts; the
only existing rate limiters are single-instance helpers for outbound
site requests. Add app/application/security/throttle.py, an in-memory
LoginThrottle keyed by (client address, normalized username) that locks
for 30s after five consecutive failures and doubles the lockout up to
15 minutes. The endpoint answers 429 with Retry-After while locked,
counts only real credential failures (an MFA challenge after a correct
password does not count), and clears the record on success.
X-Forwarded-For is deliberately not trusted because there is no
trusted-proxy setting; behind the bundled nginx all requests share one
address, so the key degrades to per-username throttling, which is the
dimension brute-force protection needs. Sync the dependency snapshot
and architecture metrics for the new module.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
