feat(plugins): resident network-access providers with proxy-node support - #1096
Conversation
|
Too many files changed for review (147 files, 100 file limit). Bypass the limit by tagging |
|
Important Review skippedToo many files! This PR contains 185 files, which is 85 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (185)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
ApprovabilityVerdict: Not approved Macroscope's review found this PR not approvable — This PR adds a broad network-access platform spanning resident plugin processes, proxy nodes, encrypted state, ingress authentication, new APIs, migrations, and access-path-aware playback and download routing. The unresolved High-severity nil-supervisor dereference, together with the feature's security-sensitive and cross-cutting runtime impact, requires human review. Not approved because:
Adjust the Minimum Blocking Severity for this repo — including turning it Off — in Settings. You can add or adjust custom eligibility rules. Learn more. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c847065d2d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Review findings on #1096, each with a regression test: - netaccess.Broker serializes Issue and Revoke so an old process's revoke can no longer forget the status a replacement pushed between the registry revoke and the cache forget. - A superseded successful launch is stopped when its entry is parked (stopped or failed), not only when the entry is gone or the supervisor halted; a launch a newer starting generation may adopt is still left to that generation's start-sequence check. - A failed provider RPC on a running process reports unavailable to the status sink so a dead overlay origin stops being advertised to the origin check and the node health report. - Instance-state writes take a per-scope transaction advisory lock so concurrent first writes of distinct keys cannot overshoot the 256-key budget. - Duplicate provider slugs resolve to the lowest enabled installation id everywhere (provider list, commands, node health map) with a warning, instead of the first-listed installation on one path and map order on another. - A proxy rehydrating a stored archive checks the binary's platform against its own and refuses a foreign one with a clear error; the archive was resolved for the API server's platform at install time. Documented as a same-platform requirement for this release. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f21d6dd62e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ed proxies Second round of review findings on #1096: - {"hosts": null} on connect and disconnect decoded to the same nil as omission, which means every host. The command body now records an explicit null in its decoder and the operation answers 422 for it; RawBody was not used because it would make the optional body required in the document. - A proxy's resident gate only checked that its stream_nodes row existed, so a disabled or retyped node kept serving overlay ingress while the API no longer listed it as a host that could be disconnected. The gate now requires an enabled proxy row. - Every unavailable answer from applyNetworkAccess reports to the status sink, not only the RPC-failure path, so a parked or gated instance's cached origin is dropped as well. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 26fc03da85
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aa2db25a1f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…available Review findings on #1096: - The resident set excluded nothing, so a second enabled installation declaring an already-owned provider slug kept running and serving ingress while every command and status read addressed the owner. The supervisor now derives ownership the same way the provider list does and does not start the duplicate on any host. - An unavailable answer synthesized by the host carried updated_at set to now, but the contract defines that field as when the host last heard from the provider and says it is absent while unavailable. The cache still stamps its own copy; the wire status carries none. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b15a66af40
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Quick104
left a comment
Quick104
left a comment
There was a problem hiding this comment.
Two additional P2 defects are confirmed. I am implementing both fixes and their regression tests. Review and repairs use gpt-6-astra through Codex in T3 Code.
…ode identity change Review findings on #1096: - A status push in flight while its process was being stopped, crashed, or replaced could land after the revoke and write a stale connected origin back into the cache; on a proxy the next health sweep then persisted a dead origin. The broker now accepts a push only from the process holding the installation's current ingress token, checked under the same lock Revoke takes, and the host RPC drops the rest. - A proxy whose stream_nodes row was deleted and re-registered resolved a new id, and the per-call state scope followed it while the running provider kept the old identity in memory. The supervisor now tracks the host identity each resident was started under and replaces every running resident when it changes; the proxy supplies its node scope. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Bind provider status to process generations, pin proxy state scopes, recover missed lifecycle events, and expose resident restart controls. Add provider-specific status fan-out and refresh generated contracts.\n\nReviewed PR: #1096\nValidation: focused Go tests, database-backed generation tests, web tests (579 files/4318 tests), Go build, go vet, route/OpenAPI/fixture/ledger gates.\n\nAI disclosure: OpenAI Codex CLI using gpt-6-astra through T3 Code; implementation and review fixes were AI-assisted and human verified.
Codex review follow-up — 36ef0b5Reviewed the updated PR head and addressed five confirmed issues:
Validation passed: focused Go tests across netaccess, pluginhost, plugins, proxy, nodepool, Jellyfin, handlers, and apiv2; database-backed instance-state and lifecycle-generation tests; The full Go suite still reports the repository's documented merge-base failures in unrelated adminjob/catalog/metadata/handler/database packages; it also encountered resource-sensitive timeouts in unrelated tests during the broad run. Those results are recorded in the PR validation notes and are not called green. Mergeability: 8/10 — conditional. The reviewed head has no remaining actionable findings from this pass; merge requires the hosted Go check to complete successfully or for maintainers to classify any baseline failure. Real-provider overlay QA remains the planned follow-up because the provider plugin does not exist yet. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 36ef0b5b77
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ir the merged tree - Reconcile is serialized end to end (Macroscope finding on #1096): the desired set and gate result are computed outside the state lock, so two overlapping reconciles could apply results in the wrong order and an older one could resurrect a resident a newer one had removed. Test races eight reconciles against a disable under the race detector. - RestartInstallation now advances runtime_generation before restarting locally, so a proxy whose lifecycle subscription missed the event replaces its process on the next poll and a failed entry's budget is cleared there too. This makes TestResidentPollRecoversMissedRestartOfFailedProvider from the previous commit pass; it had no writer for the generation it waited on. - The worker route inventory count includes the per-provider proxy status route the previous commit added. - gofmt under the toolchain CI pins (go.mod says 1.26.4) reflows one struct the previous commit left misaligned; the local 1.26.5 accepted it, which is why it slipped through. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a242cb4439
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Review findings on #1096: - With the restart recorded as a runtime_generation bump, publishing a restart event as well made a following proxy restart on the event and then replace the fresh process again on the reconcile that saw the new generation: two overlay outages and two token rotations per admin restart. The event is now a plain reconcile when the generation was persisted, and it is published whether or not this host runs the resident itself. Test: TestAdminRestartReplacesFollowerProcessOnce. - The broker idle test documents why it sleeps (go-plugin's five-second pending-stream window is a constant with no seam or signal) and that a late cleanup can only make it pass vacuously, never fail; it is skipped under -short. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b11d176599
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…adapter Review finding on #1096: the supervisor's superseded-launch check read NextStartSeq through a type assertion the production hostAdapter did not satisfy, so outside the test fake the floor was always zero and a newer generation could adopt a launch an older one had started. NextStartSeq is now part of the plugins.Host interface and the adapter forwards it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: da7193faf7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…he restart receipt Review findings on #1096: - A literal null request body on connect and disconnect decoded to a nil body, which means every host. The input now records whether a body was sent at all and answers 422 for null; omission still means every host. - The admin installation view flagged every enabled installation with a resident capability as resident, including a duplicate provider slug the supervisor deliberately does not own, so the web page offered a restart that could not start anything. Once the supervisor is armed its entries decide; the capability is used only before boot finishes. - The restart receipt was built from the pre-restart row and carried a stale updated_at after the generation bump; it now reloads the row. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 50ed025fc5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ed proxies Second round of review findings on #1096: - {"hosts": null} on connect and disconnect decoded to the same nil as omission, which means every host. The command body now records an explicit null in its decoder and the operation answers 422 for it; RawBody was not used because it would make the optional body required in the document. - A proxy's resident gate only checked that its stream_nodes row existed, so a disabled or retyped node kept serving overlay ingress while the API no longer listed it as a host that could be disconnected. The gate now requires an enabled proxy row. - Every unavailable answer from applyNetworkAccess reports to the status sink, not only the RPC-failure path, so a parked or gated instance's cached origin is dropped as well. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ter idle Live testing with the stub provider on a sandbox (API server plus one proxy and one transcode node) found that a provider connected more than five seconds after its process started could never reach the host: go-plugin drops the pending broker stream after five seconds and the SDK dialed it lazily on the first Host() call. Connect then timed out on every host. Silo-Server/silo-plugin-sdk#22 (v0.16.1) dials at bind time. The resident fixture's GetStatus now makes a host call and reports whether it worked, and a new test idles six seconds after start before the first callback. It fails against v0.16.0 and passes against v0.16.1. The resident test host binds the RuntimeHost broker so fixtures can call back at all. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…available Review findings on #1096: - The resident set excluded nothing, so a second enabled installation declaring an already-owned provider slug kept running and serving ingress while every command and status read addressed the owner. The supervisor now derives ownership the same way the provider list does and does not start the duplicate on any host. - An unavailable answer synthesized by the host carried updated_at set to now, but the contract defines that field as when the host last heard from the provider and says it is absent while unavailable. The cache still stamps its own copy; the wire status carries none. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ode identity change Review findings on #1096: - A status push in flight while its process was being stopped, crashed, or replaced could land after the revoke and write a stale connected origin back into the cache; on a proxy the next health sweep then persisted a dead origin. The broker now accepts a push only from the process holding the installation's current ingress token, checked under the same lock Revoke takes, and the host RPC drops the rest. - A proxy whose stream_nodes row was deleted and re-registered resolved a new id, and the per-call state scope followed it while the running provider kept the old identity in memory. The supervisor now tracks the host identity each resident was started under and replaces every running resident when it changes; the proxy supplies its node scope. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Bind provider status to process generations, pin proxy state scopes, recover missed lifecycle events, and expose resident restart controls. Add provider-specific status fan-out and refresh generated contracts.\n\nReviewed PR: #1096\nValidation: focused Go tests, database-backed generation tests, web tests (579 files/4318 tests), Go build, go vet, route/OpenAPI/fixture/ledger gates.\n\nAI disclosure: OpenAI Codex CLI using gpt-6-astra through T3 Code; implementation and review fixes were AI-assisted and human verified.
…ir the merged tree - Reconcile is serialized end to end (Macroscope finding on #1096): the desired set and gate result are computed outside the state lock, so two overlapping reconciles could apply results in the wrong order and an older one could resurrect a resident a newer one had removed. Test races eight reconciles against a disable under the race detector. - RestartInstallation now advances runtime_generation before restarting locally, so a proxy whose lifecycle subscription missed the event replaces its process on the next poll and a failed entry's budget is cleared there too. This makes TestResidentPollRecoversMissedRestartOfFailedProvider from the previous commit pass; it had no writer for the generation it waited on. - The worker route inventory count includes the per-provider proxy status route the previous commit added. - gofmt under the toolchain CI pins (go.mod says 1.26.4) reflows one struct the previous commit left misaligned; the local 1.26.5 accepted it, which is why it slipped through. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Review findings on #1096: - With the restart recorded as a runtime_generation bump, publishing a restart event as well made a following proxy restart on the event and then replace the fresh process again on the reconcile that saw the new generation: two overlay outages and two token rotations per admin restart. The event is now a plain reconcile when the generation was persisted, and it is published whether or not this host runs the resident itself. Test: TestAdminRestartReplacesFollowerProcessOnce. - The broker idle test documents why it sleeps (go-plugin's five-second pending-stream window is a constant with no seam or signal) and that a late cleanup can only make it pass vacuously, never fail; it is skipped under -short. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…adapter Review finding on #1096: the supervisor's superseded-launch check read NextStartSeq through a type assertion the production hostAdapter did not satisfy, so outside the test fake the floor was always zero and a newer generation could adopt a launch an older one had started. NextStartSeq is now part of the plugins.Host interface and the adapter forwards it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…he restart receipt Review findings on #1096: - A literal null request body on connect and disconnect decoded to a nil body, which means every host. The input now records whether a body was sent at all and answers 422 for null; omission still means every host. - The admin installation view flagged every enabled installation with a resident capability as resident, including a duplicate provider slug the supervisor deliberately does not own, so the web page offered a restart that could not start anything. Once the supervisor is armed its entries decide; the capability is used only before boot finishes. - The restart receipt was built from the pre-restart row and carried a stale updated_at after the generation bump; it now reloads the row. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
Latest head: Babysit update: fixed and resolved the two new findings about colliding API replica presence keys and the fixed restart quiet-period wait. The cache/plugin race suites with Redis/PostgreSQL, build, vet, scoped lint and path checks passed. Duplicate names failed the Redis census before the fix; restoring a duplicate restart made the revised completion-based test fail. Macroscope resolved the older nil-supervisor allegation after the updated evidence reply. All 40 current review threads are resolved. Go and Web CI passed on this head. Codex re-reviewed this commit and reported no major issues. No reviewer has an outstanding changes-requested review. No merge was performed. The earlier route/UI review and its evidence apply to The rebase and route/UI fixes are pushed, and GitHub reports no merge conflicts. The change fits the network-plugin scope: resident lifecycle, provider-aware routing, and visible playback network/node information. Client address identity and TV pairing recovery are separate follow-ups. Resolved P2: initial Jellyfin local HLS startup persisted its recipe before its route assignment. Child-segment recovery now overlays the durable assignment before reconstructing the session. The endpoint regression reproduced missing provider/route facts before the fix and passes afterward for default and Tailscale routes. The full Jellyfin package passes. Independent review covered route persistence/recovery, native/Jellyfin callers, v1/v2 boundaries, frontend command state, resident lifecycle, archive rehydration, and proxy propagation. It found no further verified blocker. The existing nil-supervisor allegation remains a false positive: Validation:
Follow-ups addressing the mixed-address and TV onboarding discussion: server #1268, Silo-Server/silo-apple#341, Silo-Server/silo-android#352. They link to #1169 and #1192. The current activity changes expose provider and named execution/egress nodes for the concern raised against #1205. Physical cross-platform TV acceptance remains unperformed. Mergeability: 9/10, at AI assistance: gpt-6 in Codex through T3 Code, GitHub CLI, and an independent Codex review agent. Applied the code-review and repository unslop skills. Review and fixes were source- and test-based; no physical TV validation is claimed. Babysit repairs: gpt-6 in Codex through T3 Code, using the babysit, Modern Go Guidelines and repository unslop skills. |
2ab3e0d to
c415b1a
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c415b1a453
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@zZebrahz The activity views now show the selected network provider alongside named execution and egress nodes, including an explicit API-server label, in c415b1a. Default and unknown routes are distinguished; this reports the prepared playback route rather than inferring network access from a client IP. That covers the route-visibility concern raised for #1205. The #1169/#1192 check found a separate client issue: URL-derived server matching treats public and plugin addresses as different servers, and companion pairing supplies the phone's address even when the TV cannot reach it. Coordinated follow-ups are open: server #1268, Silo-Server/silo-apple#341, and Silo-Server/silo-android#352. They cover verified server identity across addresses, TV-side reachability, provider setup guidance, and an explicit configured-public-address fallback. SiloRemote remains same-LAN; physical cross-platform acceptance is still outstanding. AI-assisted source review and reply: gpt-6 in Codex through T3 Code, using the babysit and repository unslop skills. |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Problem
Related issue: #1001
Network access plugins need to stay running, retain their network identity across restarts, and route playback through proxy addresses reachable on the client's network. Administrators also need to see which network and nodes a playback session selected.
Changes
Validation
Route and UI validation at
c415b1a45:make test-web: 583 files and 4,379 tests passed.make test-gofailed in two packages on macOS.TestAdminResourceCapabilitiesAndScopereproduces unchanged onmain(d2596927e): it expects resource support on a platform reportingunsupported.TestResolveViewerScopeParityhit its 25 ms policy timeout; the full policy package passed on rerun. Other packages in that run passed. This is not a claim that the full local Go gate is green.Route coverage includes default/overlay/unknown persistence, native and Jellyfin preparation, recipe/token recovery, rollback, admin v2 serialization, and independent host controls.
Shared development testing with a real Tailscale plugin observed playback using a transcode worker and proxy over the overlay. Browser checks covered the activity presentation and network settings. This is not full Apple/Android TV handoff or onboarding acceptance.
Review summary: #1096 (comment)
Review fixes at
ffdd3e2a7Replica presence now uses a unique process marker even when replicas share a logical node name. The Redis regression reproduced the undercount before the fix and verifies independent cleanup afterward. The admin restart regression now waits for reconciliation and its launches to finish instead of sleeping for two seconds; temporarily restoring the duplicate restart made the revised test fail.
The cache and plugin packages passed under the race detector with Redis and PostgreSQL enabled. The restart test passed five race runs. Build, vet, scoped lint, and the local-path check passed. Go and Web CI passed on this latest head. Codex re-reviewed the same commit and reported no major issues. Both corresponding review threads are resolved. Macroscope also resolved its nil-supervisor finding after the updated source and race-test evidence. All 40 review threads are resolved, with no outstanding changes-requested review. The PR remains open and has not been merged.
Limits and follow-up
v0.16.1.AI disclosure
Original implementation and earlier repairs used Claude Code (Claude Agent SDK) in T3 Code, Workflow subagents, OpenAI Codex CLI and Codex desktop. Previously disclosed models:
claude-fable-5-1, Claude Opus 5 workflow subagents, andgpt-6-astra.The rebase, route visibility, UI repairs, current validation and follow-up issue drafting were AI-assisted using
gpt-6in Codex through T3 Code, GitHub CLI, and the code-review and repository unslop skills. A separate Codex agent reviewed route persistence/recovery, API boundaries, frontend state, and resident lifecycle/propagation. It found a Jellyfin child-segment recovery gap; a regression failed before the fix and passed afterward. The nil-supervisor review allegation was checked against the explicit nil-receiver guard. No physical cross-platform TV acceptance is claimed.Current review repairs and replies: gpt-6 in Codex through T3 Code, using the babysit, Modern Go Guidelines and repository unslop skills.