327 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
3 people	5fb28d5c5a	refactor(app): lift the shared player state onto a container (R3a) (#889) ... static/js/player-state.js — one exported object, two fields. app.js's 70 reference sites rewritten. Provably a no-op; nothing shrinks. WHY NOW. Every slice carved out of app.js so far only ever READ the state it shared (loopA/loopB, _audioSeekGen, currentFilename), so a read-only getter hook was enough and no container was needed — twice I checked and twice I got away with it. That runs out at count-in: it genuinely WRITES `isPlaying` (it starts and stops playback, 4 sites) and `lastAudioTime` (2). `import { isPlaying }` then `isPlaying = true` THROWS — an imported binding cannot be assigned to. So the state has to live on an object: `S.isPlaying = true` is a property write, and works from any module holding the same S. Same shape stems, studio, and editor all converged on. DELIBERATELY SMALL. app.js has ~104 top-level `let` scalars; lifting all of them is a ~977-site rewrite for no benefit, because most are private to one cluster and travel with it. Only what a carved module must WRITE goes here. Add on demand. THE REWRITE IS AST-DRIVEN, NOT TEXTUAL — and that is not fussiness. Of 100 textual occurrences of these two names, only 70 resolve to the module binding: * 22 are member accesses (`someObj.isPlaying`, `window.feedBack.isPlaying`) * 4 are the LOCAL PARAMETER of `function setPlayButtonState(isPlaying)` — a blind replace yields `function setPlayButtonState(S.isPlaying)` * 1 is an object key * 2 are shorthand properties `{ isPlaying }`, which must become `{ isPlaying: S.isPlaying }` — and acorn gives a shorthand's key and value the SAME range, so rewriting both produced `isPlaying: S.isPlaying: S.isPlaying` until I deduped by range A find-and-replace corrupts all 29. The rewrite walks the AST, skips shadows, member properties and keys, and replaces identifier RANGES. `window.feedBack.isPlaying` — the PUBLIC mirror — is a different thing and is untouched. Two test sandboxes stub it; those were left alone deliberately. VERIFIED WITH REAL PLAYBACK. A/B against origin/main in two browsers, real song: togglePlay -> the public mirror goes true -> false -> true across two toggles, the audio element's paused state follows, seekBy works — IDENTICAL, zero page errors. Harnesses: 8 vm-sandbox suites slice playback code out of app.js and now see S.isPlaying — juce_engine_reroute, loop_restart, play_button_reroute_guard, playback_app_adapter, song_restart, song_seek, speed_reset, and the python idempotence source-assert. Each gets the same container in its sandbox; every assertion is unchanged. pytest 2396, node 1040/1040, ESLint 0, tailwind clean, Codex 0. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 21:52:51 +02:00
3 people	cb236e6c04	refactor(app): carve the A–B loop out of app.js (R3a) (#888) ... static/js/loops.js (261) — bodies VERBATIM. app.js 8,421 → 8,224. The second slice out of the strongly-connected core. It OWNS the loop state — loopA, loopB, _loopMutationGen. Nothing outside writes them: restartCurrentSong() looked like it did, but it declares its own local `let loopA/loopB` shadows, so the module-level bindings only ever change in setLoop / setLoopStart / setLoopEnd / clearLoop. All four move here. No state container. DIRECTION IS THE WHOLE DESIGN. loops and section-practice are mutually dependent — the SCC in miniature. clearLoop() must drop section-practice's selection, and practiceSection() must call setLoop(). Both edges cannot be imports or no-cycle (rightly) rejects it. So: section-practice -> reaches loops through the HOST SEAM (host.setLoop, …) loops -> imports section-practice DIRECTLY section-practice is the higher-level feature — a consumer of loops, not the reverse — so it is the one that takes the indirection. app.js hands the loop module's exports across into the seam for it. Graph stays acyclic; no-cycle passes. THE CONTRACT TEST EARNED ITS KEEP IMMEDIATELY. It failed on the first build with "these hooks are wired by app.js but no module reads them: playSong". My dependency scan had counted a mention of playSong() inside a COMMENT in loops.js as a real call. Wired but unused is precisely the "fossil of a rename" case the test exists for — and it caught it on a path no test executes. VERIFIED BY DRIVING BOTH SIDES OF THE SEAM. A/B against origin/main in two browsers, real song loaded: * setLoop(5,12) -> true; getLoop() -> 5,12 — IDENTICAL * clearLoop() (loops -> section-practice, a direct import) -> getLoop() -> null,null — IDENTICAL * onPhraseNext() (section-practice -> loops, ACROSS THE SEAM) -> ok — IDENTICAL * loadSavedLoop / saveCurrentLoop / deleteSelectedLoop on window — IDENTICAL * zero page errors either side. An unwired hook throws, so a live app is itself proof the seam is wired. Harness: loop_api extracts the loop helpers by signature — retargeted to loops.js, `export` stripped for the vm sandbox, and the sandbox's existing _audioSeek / _audioTime / formatTime spies are now routed through a `host` object so every assertion holds unchanged, just through the indirection the real code uses. It is SPLIT: one test still reads app.js for the window.feedBack API surface, which stayed. pytest 2396, node 1040/1040, ESLint 0 (no-cycle clean), tailwind clean. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 21:32:31 +02:00
3 people	64f04565e2	refactor(app): the host seam + carve section practice out of app.js (R3a) (#887) ... static/js/host.js (99) + static/js/section-practice.js (1,214). app.js 9,461 → 8,409. THE FIRST SLICE OUT OF THE STRONGLY-CONNECTED CORE. What is left in app.js is not a tree, it is a cycle: seeding a dependency closure from section-practice, from loops, from count-in, or from the JUCE seek shim all return the SAME 178-function set, and setLoop() and practiceSection() call each other directly. No closure-based carve can cut it at any seed. So it is cut BY NAME, and the calls back into app.js go through a host seam. 61 functions + its own 24 _sectionPractice*/_sectionParents* scalars (read nowhere else) move out. 11 hooks come back in. 4 of those are read-only GETTERS — loopA/loopB/_audioSeekGen/_loopMutationGen are only ever READ here, never written, so app.js keeps owning them and NO state container is needed (a 977-site lift avoided). app.js used to reach IN and reset the module's state by hand (clearLoop() zeroed the selection; changeArrangement() invalidated the parent count). It cannot now — an imported binding is read-only — so those are exported as resetSelection() and invalidateParentCount(). Strictly better: the module owns its own invariants instead of trusting two callers on the far side of the file to zero the right three fields. ═══ THE SILENT-NO-OP PROBLEM, SOLVED ═══ The obvious host seam is an object of no-op defaults. That is a TRAP and we walked into it once: the plugin loader's seam defaulted populateVizPicker to `() => {}`, so a dropped wiring line would have left the viz picker quietly not refreshing with NO test, boot check, or bot noticing. Two layers stop it here: 1. RUNTIME — host.js is a Proxy with NO defaults and NO stubs. Reading an unwired hook THROWS. An unwired hook cannot degrade into a no-op because there is nothing to degrade INTO. configureHost() also rejects a non-function at WIRE time, and refuses to run twice. 2. STATIC — tests/js/host_contract.test.js asserts the hooks the modules USE are exactly the hooks app.js WIRES. This is the layer that matters: a runtime throw only fires if the broken path executes, and the whole danger of a seam is the paths that never run in a smoke test. VERIFIED TO BITE in all three drift directions: drop a hook from configureHost -> fails; rename host.setLoop in the module -> fails; wire a hook nobody uses -> fails. Writing that guard took three tries and each failure is instructive: (a) the configureHost regex anchored `});` at column 0, ran past the indented close, and swallowed app.js's 66-name window contract — 77 "hooks"; (b) an import-stripping regex with `[\s\S]*?` ate 14,000 characters INCLUDING the drift the bite test was meant to catch — a guard with a hole is worse than no guard, because you trust it; (c) `host.js'` in the import path backtracked from `js` to a "hook" called `j`. The bite tests are what surfaced all three. CODEX FOUND A REAL RACE [P2]. configureHost() was inside the async boot function, after several awaits — but the window handlers (onPhraseNext, …) go live during app.js's SYNCHRONOUS module evaluation. A user clicking one in that window would hit "[host] … was read before configureHost() ran". It is now a bare top-level statement sitting immediately before the window contract, so the seam is always wired before a handler can be reached. Verified live: invoking a handler 1.2s in — well before the boot awaits settle — works. VERIFIED. A/B against origin/main in two browsers with a REAL song loaded: popover toggle, practice-mode change, phrase-next, and clearLoop (all of which cross the seam — setLoop/clearLoop/_audioTime/loopA/loopB) — IDENTICAL, zero page errors. Since an unwired hook throws, a live app is itself proof the seam is wired. Harnesses: section_practice_dismiss retargeted; loop_api's clearLoop sandbox gains a resetSelection SPY (not a stub) and ASSERTS it fires — the guarantee is still tested, just through the seam. pytest 2396, node 1040/1040, ESLint 0 (no-cycle clean), tailwind clean, Codex 0. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 20:58:41 +02:00
3 people	f53d566dbc	refactor(app): give the <audio> element a module of its own (R3a) (#886) ... static/js/audio-el.js — one exported const. app.js's diff is 5 lines. This is a HINGE, not a carve: nothing shrinks, but almost everything left in app.js is blocked behind it. WHY. `audio` is `document.getElementById('audio')` with 162 references in app.js and 173 outside any one cluster. Every remaining cluster measured — settings, app-updates, count-in (208 fns), exit-confirm (212), library-render (220) — lists `audio` among its inbound symbols, because they all touch playback and playback reaches for the element directly. A module that needs it cannot import app.js to get it (that closes a cycle and fails import-x/no-cycle), so today the only way to carve any of them would be a host seam — the exact thing #878 had to build and #880 had to tear out. WHY IT'S SAFE. `audio` is a `const` and is NEVER reassigned anywhere in core, so a read-only import binding is exactly right and no state container is needed. The 162 call sites are untouched — the binding keeps its name, it is just imported instead of declared. (Contrast the reassigned scalars — isPlaying, _avOffsetMs — which CANNOT be shared this way: an imported binding cannot be written to. Those still need containers, and that is the next problem, not this one.) TIMING. app.js is <script type="module">, so it evaluates after the HTML is parsed and its imports evaluate just before its body — the same moment app.js used to run this exact lookup. If the element had not been in the document, `audio` would be null and app.js's top-level `audio.addEventListener(...)` calls would throw and kill the module. They don't. VERIFIED WITH REAL PLAYBACK, not a boot check. A/B against origin/main in two browsers: app alive with zero page errors (which is itself the proof the import resolved), #audio is an AUDIO element, togglePlay/seekBy live, and playSong() on a real library song sets audio.src and the element reports a duration — IDENTICAL on both sides. pytest 2396, node 1038/1038, ESLint 0 (no-cycle clean), tailwind clean, Codex 0. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 20:44:01 +02:00
3 people	b5dd585d25	refactor(app): carve settings backup + plugin updates out of app.js (R3a) (#885) ... Two leaves, one PR. app.js 9,651 → 9,457. static/js/settings-io.js (155) — exportSettings + importSettings, the Settings backup bundle. Imports nothing. The two-phase rationale comment (server first and atomic; then a best-effort localStorage merge) is the contract and moved with the code. plugin-updates → INTO static/js/plugin-loader.js, not a module of its own. checkPluginUpdates + updatePlugin are plugin MANAGEMENT; they belong with the code that loads plugins. A new file for 50 lines would have been a file for its own sake. All four are inline handlers on the Settings screen and already in app.js's window contract, so app.js re-exposes the imported bindings unchanged. VERIFIED BY DRIVING BOTH FLOWS. A/B against origin/main in two browsers: * checkPluginUpdates() -> hits the API and settles the button back to "Check for Updates" — IDENTICAL * exportSettings() -> POSTs /api/settings/export and writes "Exported feedBack-settings…" to #backup-status — IDENTICAL (fetch intercepted so the assertion is on the real call, not a stub) * all four resolve on window — IDENTICAL * zero console/page errors either side Zero harnesses broke. pytest 2396, node 1038/1038, ESLint 0, tailwind clean, Codex 0. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 19:42:54 +02:00
3 people	d47883c5e5	refactor(app): carve the tuning-display helpers out of app.js (R3a) (#884) ... static/js/tuning-display.js (228 lines) — bodies VERBATIM. app.js 9,838 → 9,650. A LEAF: imports nothing. Tuning NAME resolution (Drop D / Eb Standard / raw-offset fallback), bass detection, effective string count, and the target FREQUENCIES + note names the tuner checks against. Pure functions over a small MIDI/note-name table; the 3 _TUNING_* tables are read nowhere else and move in. NOT A SLICE — a node-level extract. The span 2309-2535 INTERLEAVES the functions with the `window.*` / `window.feedBack.*` assignments that publish them, and one of those is `window.feedBack = window.feedBack || {}` — the BUS BOOTSTRAP, not tuning code at all. Every ExpressionStatement stays exactly where it was; only the 16 functions and 3 tables move. app.js re-exposes the imported bindings from the same lines, so the public surface and its ordering are untouched (constitution II names window.feedBack). app.js -> { plugin-loader, viz, diagnostics-export, dom, highway-colors, tuning-display } HARNESSES — 4 broke, and 3 of them broke in the SAME informative way: they sliced app.js from `function isBassArrangement(` UP TO the marker `window.feedBack.parseRawTuningOffsets = parseRawTuningOffsets;` — an end-marker that (correctly) stayed behind in app.js. The module is now nothing BUT the tuning helpers, so there is no block to slice: they read it whole and strip `export ` so the vm sandbox still evaluates it as a script. tuner_auto_open is SPLIT — its autoplay-gate test still reads app.js, so it keeps APP_JS and gains TUNING_JS. Retargeting its path wholesale (my first attempt) silently pointed the autoplay test at the wrong file. VERIFIED BY DRIVING THE CONTRACT. A/B against origin/main in two browsers, through the real window surface: displayTuningName -> "E Standard" / "Drop D" / "Eb Standard", parseRawTuningOffsets('-2,0,0,0,0,0') -> [-2,0,0,0,0,0], isBassArrangement, effectiveStringCount, displayTuningTargets, and window.feedBack.displayTuningName / .songTuningContext — IDENTICAL on both, zero console/page errors either side. pytest 2396, node 1038/1038, ESLint 0, tailwind-fresh clean, Codex 0. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 19:37:44 +02:00
3 people	ebbfc8da6f	refactor(app): carve the highway string-colours out of app.js (R3a) (#883) ... static/js/highway-colors.js (601 lines) — bodies VERBATIM. app.js 10,415 → 9,837. Under 10k. DECOMPOSED, not sliced. The "settings" blob measured 47 fns / 19 inbound and was not carvable as-is. Seeding the closure from a FUNCTION (initHighwayColors) found only 18 fns and left 4 HWC_* constants used outside it — i.e. the seed was wrong, not the cluster. Re-seeding from the STATE (every function touching HWC_*/`_hwc*`) found the true cluster: 45 top-level nodes, lines 2751-3331, CONTIGUOUS, with ZERO foreign nodes inside the span. INBOUND: 0. EXPORTS: 2 (initHighwayColors, hwcInitSettingsUI). The other 43 symbols — the HWC_* tables, the 12 presets, the theme store, the share codec, the picker handlers, the window.feedBack.highwayColors facade — are used nowhere else in core and stay private. No inline on*= handlers here (the Settings buttons are wired by addEventListener inside hwcInitSettingsUI), so nothing needed re-exposing on window. The three bus listeners register inside initHighwayColors, which app.js calls — not at module top level — so no ordering change. THE no-undef GATE EARNED ITS KEEP. My closure said INBOUND=0; the module actually uses `uiPrompt` (the "name this theme" prompt). It was missed because uiPrompt is no longer an app.js DECLARATION — it's an IMPORT BINDING (from #882's dom.js), and I was collecting declarations only. `no-undef` with typeof:true caught it. => Lesson for the next carve: seed `tops` from ImportDeclaration bindings too. => And it VALIDATES carving dom.js early: this module just imports uiPrompt from it. Had dom.js still been stranded in app.js, this carve would have needed a host seam. app.js -> { plugin-loader, viz, diagnostics-export, dom, highway-colors } plugin-loader -> viz highway-colors -> dom viz, diagnostics-export, dom -> (leaves) VERIFIED BY DRIVING THE FACADE. A/B against origin/main in two browsers: window.feedBack.highwayColors installed, identical method surface, 12 presets, identical default slot colours, and a share-code encode→decode round-trip returning #112233 — IDENTICAL on both, zero console/page errors either side. Harnesses: highway_colors_facade + highway_string_colors retargeted (both brace-extract blocks out of the source by signature). pytest 2396, node 1038/1038, ESLint 0, tailwind-fresh clean, Codex 0. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 19:22:14 +02:00
3 people	14b4058bc6	refactor(app): carve the DOM/modal primitives out of app.js (R3a) (#882) ... static/js/dom.js (203 lines) — esc, _escAttr, _isElementVisible, _trapFocusInModal, _confirmDialog, uiPrompt. Bodies VERBATIM. app.js 10,593 → 10,414. A GATHER, not a slice — the six lived in six different places (108, 635, 659, 2617, 2623, 8892). They belong together because they are the BOTTOM of the UI stack: `esc` alone has 25 call sites and `_escAttr` 23, and every later carve that renders HTML will need them. That is the actual point of doing this one now. Give them a home and the next carve imports them; leave them in app.js and the next carve that renders HTML has to invent a host seam to reach back into app.js — exactly the trap the plugin-loader carve had to work around until the viz layer became a module. This is the cheapest possible way to stop that recurring. app.js -> { plugin-loader, viz, diagnostics-export, dom } plugin-loader -> viz viz, diagnostics-export, dom -> (nothing) Zero imports. Six exports (every one is used outside the cluster). VERIFIED BY DRIVING THE MODALS, not just booting — they are interactive, so a green suite says little. A/B against origin/main in two browsers: * window.uiPrompt / _confirmDialog / _trapFocusInModal all resolve * uiPrompt() mounts its modal, accepts typed input, and resolves with the typed value ('typed') — IDENTICAL on both * _confirmDialog() mounts and resolves true on confirm — IDENTICAL * zero console/page errors either side pytest 2396, node 1038/1038, ESLint 0, tailwind-fresh clean, Codex 0. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 18:59:44 +02:00
3 people	bfb31a8b89	refactor(app): carve the diagnostics-bundle export out of app.js (R3a) (#881) ... static/js/diagnostics-export.js (280 lines) — bodies VERBATIM. app.js 10,858 → 10,592. Chosen BY MEASUREMENT, not by eye. Ran the transitive closure over four candidate clusters and took the one with the smallest interface: diagnostics 7 fns 235 lines span 4110-4378 imports 1 exports 2 shortcuts-modal 5 fns 235 lines span 104-9897 imports 4 exports 5 settings+updates 47 fns 1012 lines span 1409-7636 imports 19 exports 30 library-render 220 fns 4064 lines span 20-10536 imports 126 exports 117 diagnostics is contiguous and nearly closed; its one inbound symbol (_DIAG_FILE_LABELS) lives inside the region and is read only by _renderDiagPreview, so it moves in and the module ends up a LEAF — imports nothing. app.js -> { plugin-loader, viz, diagnostics-export } plugin-loader -> viz viz, diagnostics-export -> (nothing) Exports exactly 2: previewDiagnostics + exportDiagnostics, both already in app.js's window contract (they're inline handlers in the Settings screen) — so app.js keeps re-exposing them, now as imported bindings. The preview renderer, the file-label table, and the byte/HTML formatters are used NOWHERE else in core and stay private. VERIFIED BY DRIVING IT, not just booting. Zero harnesses broke — because the diagnostics export flow had NO source-level test at all, which is exactly why a green suite proves nothing here. So the flow was exercised for real: A/B against origin/main in two browsers, window.previewDiagnostics() invoked, the preview container rendered identical content on both, both entry points resolve on window, zero console/page errors either side. pytest 2396, node 1038/1038, ESLint 0, tailwind-fresh clean, Codex 0. NOTE for the next carve: library-render is NOT a cluster — 220 functions and 126 inbound symbols is most of app.js entangled together. It cannot be carved as a unit; it needs decomposing from the inside first. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 18:52:47 +02:00
3 people	a222b45c02	refactor(app): carve the viz layer out of app.js — and delete the loader seam (R3a) (#880) ... static/js/viz.js (770 lines) — the viz picker, renderer selection, Auto-match, the WebGL2 probe, the 3D-promotion nag, the notation hints. Bodies VERBATIM. app.js 11,603 → 10,857. THE SEAM IS GONE. #878's plugin-loader needed configurePluginLoader({ populateVizPicker }) purely because _populateVizPicker lived in app.js and importing app.js would have closed a cycle. viz.js is a LEAF — it imports NOTHING — so plugin-loader now imports _populateVizPicker straight from it. The _host object, the configure function, its loud-default guard, and the wiring line in app.js are all deleted. The second carve simplifies the first. app.js -> { plugin-loader, viz } plugin-loader -> viz viz -> (nothing) NOT A PURE MOVE — one listener block had to be SPLIT. app.js had a single top-level `if (window.feedBack) { … }` registering four handlers, and only two were viz. song:loaded / arrangement:changed / song:ready (the mastery slider) stay in app.js and now call the imported _autoMatchViz / _maybeShowNotationViewHint. The viz:reverted handler MOVES, because it REASSIGNS _cancelPendingAutoLabel and an imported binding is read-only — `_cancelPendingAutoLabel = null` would throw if the listener stayed behind while the state moved. ORDER CHECKED, NOT ASSUMED: viz.js's song:ready listener now registers BEFORE app.js's own (imports evaluate first). Safe — _pendingPromotionNag is only ever set inside _populateVizPicker, which runs at boot/plugin-refresh, never from inside the other song:ready handler, so the two are independent. VERIFIED — the listeners are the risk here, so they were DRIVEN, not just booted. A/B against origin/main in two browsers: * viz picker: 6 options (auto|default|venue|drum_highway_3d|keys_highway_3d| highway_3d), selected highway_3d, Auto label — IDENTICAL. This alone proves plugin-loader's direct import of viz.js works. * emit('viz:reverted') -> picker resets to default, localStorage resets to default, the warning logs — IDENTICAL. The MOVED listener fires. * emit('song:ready') -> mastery slider enables, no throw — IDENTICAL. The SPLIT listener still does both halves. * plugin screens, module injections, 37 capability participants — IDENTICAL. * zero console/page errors on both. pytest 2396, node 1038/1038, ESLint 0, tailwind-fresh clean. no-cycle re-bitten on the 3-module graph (viz -> plugin-loader fails). Codex preflight raised a [P2] claiming viz.js's top-level bus guards would be false because "app.js only creates the event bus later" — FALSE POSITIVE. app.js does not create the bus; capabilities.js does, from its own <script type="module"> at index.html:122, and module scripts execute in document order, so the bus exists long before app.js's import graph evaluates. Instrumented the setter: by viz.js's turn `window.feedBack.on` is already a function, and the viz:reverted listener is provably attached (firing it resets the picker). The ordering is also enforced by test_app_shell_loads_capability_registry_before_app_runtime. Harnesses: 5 tests retargeted to viz.js across legacy_shim_hits, venue_scene_3d, venue_viz (each SPLIT — their non-viz tests still read app.js). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 18:41:52 +02:00
4 people	5b904706d0	feat(audio): loopback feeder mode + static no-cache — all app audio under exclusive/ASIO (#877) ... * feat(audio): route feedpak full-mix natively under exclusive output Song playback runs through the renderer, which WASAPI-exclusive (and ASIO) output silences. Route single-mix feedpaks (stem-less original_audio packs AND single-stem packs) onto the engine's backing transport when the output device type is exclusive-style, and migrate back to HTML5 when it isn't. Extends /api/audio-local-path to resolve /api/sloppak/.../file/... URLs via the same containment guards as serve_sloppak_file. Multi-stem packs stay on the WebAudio path (Phase 2). Includes [feedpak-route] transition-gated diagnostics logging. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(audio): renderer-bus feeder — mix renderer song audio into engine output (Phase 2) Under exclusive-style output the native backing transport (Phase 1, #824) carries loose /audio/ songs and feedpak full-mixes, but not the stems plugin's multi-stem WebAudio graph or tracks JUCE rejected. The feeder taps the renderer-side master with an AudioWorklet, re-points the owning AudioContext at a null sink so it keeps rendering without a device, and pushes ~10 ms chunks over IPC into the desktop engine's renderer bus (feedBack-desktop#90 follow-up). Inert in the Docker sphere and in shared mode. Validated by the fix12 tester spike: null-sink rendering works, clocks hold, no overflow. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(diag): --debug ASIO routing diagnostics in static bundle Gated on window.feedBackDesktop.audio.debugEnabled() (desktop --debug); inert in the Docker sphere and normal desktop runs. - [asio-diag] getCurrentDevice= full device object on outputType change (catches ASIO drivers reporting a non-'ASIO' type name) - [asio-diag] renderer-bus: full feeder decision vector, change-gated (running/exclusive/stems/juceMode/elementSong/want/mode) - [asio-diag] setSink: every sink flip with ctx state + rate Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(audio): loopback feeder mode — all app audio under exclusive/ASIO Tester-confirmed (2026-07-11 log): song previews and other plugin-private audio bypass the per-surface feeder taps and leak to the default WASAPI device under ASIO output. Also confirmed: the element capture path poisons itself when highway_3d already owns #audio's one-shot MediaElementSource (InvalidStateError with _elCtx assigned pre-throw → TypeError every later tick). - New preferred mode 'loopback': one getDisplayMedia frame-audio capture (desktop main answers with the app's own frame) covers song, previews, and UI sounds for the whole exclusive session — engages even with no song loaded. Local playback silenced via suppressLocalAudioPlayback, page-mute IPC fallback otherwise. - Sticky fallback to the existing stems/element surface modes when capture is unavailable (old desktop main, denied, Docker sphere). - Element capture: assign module state only after the whole chain succeeds; close the context on failure — collision now retries clean. - Failed engage now disables the bus and tears down loopback (no more bus-enabled-with-no-producer stranding). - Tests: 12 (5 new — loopback engage/preference/mute-fallback/sticky fallback, collision retry). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(audio): loopback feeder mode — all app audio under exclusive/ASIO Tester-confirmed (2026-07-11 log): song previews and other plugin-private audio bypass the per-surface feeder taps and leak to the default WASAPI device under ASIO output. Also confirmed: the element capture path poisons itself when highway_3d already owns #audio's one-shot MediaElementSource (InvalidStateError with _elCtx assigned pre-throw → TypeError every later tick). - New preferred mode 'loopback': one getDisplayMedia frame-audio capture (desktop main answers with the app's own frame) covers song, previews, and UI sounds for the whole exclusive session — engages even with no song loaded. Local playback silenced via suppressLocalAudioPlayback, page-mute IPC fallback otherwise. - Sticky fallback to the existing stems/element surface modes when capture is unavailable (old desktop main, denied, Docker sphere). - Element capture: assign module state only after the whole chain succeeds; close the context on failure — collision now retries clean. - Failed engage now disables the bus and tears down loopback (no more bus-enabled-with-no-producer stranding). - Tests: 12 (5 new — loopback engage/preference/mute-fallback/sticky fallback, collision retry). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(audio): close loopback capture context on teardown (release tap worklet) The loopback context was reused across engages (_lbCtx || new), but teardown only stopped the stream + deactivated the tap — never closing the context or detaching the worklet node. Each exclusive<->shared switch orphaned a live tap worklet on the long-lived context. Use a fresh context per session and close it on disengage. Adds a test asserting the context is closed on teardown. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(diag): install-time + uncaught-error diagnostics for the reroute chain 2026-07-11 tester log showed the routing watcher and renderer-bus feeder never installed (zero [feedpak-route]/[renderer-bus] lines) plus an uncaught SyntaxError with no source location — nothing in the log said why. New: - global error/unhandledrejection tap logging message + filename:line:col (error events carry the location even for parse errors in other scripts) - explicit install / NOT-installed lines for watcher and feeder (incl. loopback capability probe) - DOMException detail (name/message/stack head) in the feeder retry warn — the console-message forward stringified it to [object DOMException] Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(static): force conditional revalidation on /static (Cache-Control: no-cache) Without Cache-Control Chromium's heuristic freshness (10% of file age) serves /static/app.js from disk cache for hours-to-days without revalidating. Desktop consequence: a new build's window ran the previous build's app.js — the 2026-07-11 ASIO investigation traced 'routing watcher never installed' + a stems module-plugin SyntaxError to exactly this (stale loader predating scriptType support). no-cache keeps caching but revalidates via ETag — unchanged files still cost only a 304. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(diag): gate install-time + uncaught-error [asio-diag] lines on --debug The error tap and install lines from the previous diag commit were unconditional. Now: error/rejection taps check _asioDiagEnabled() at event time; install lines log deferred once the async debugEnabled() resolves true. The NOT-installed anomaly lines stay bridge-gated (window.feedBackDesktop present) instead — a broken bridge can't deliver the debug flag, they fire at most once, and only in the broken state they exist to witness. Docker sphere: fully silent. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Byron Gamatos <xasiklas@gmail.com>	2026-07-11 18:22:25 +02:00
3 people	38772f604a	refactor(app): carve the plugin loader out of app.js into static/js/ (R3a) (#878) ... The first carve, and deliberately the riskiest: app.js IS the plugin loader (the R0 host rails), so it goes first while the module graph is still one edge deep. static/js/plugin-loader.js (829 lines) — bodies VERBATIM. app.js 12,217 → 11,439. Core's first `static/js/` module, exactly as constitution II anticipates. CLOSURE (measured with acorn, not regex — brace-matching stripped source drifted): the block at app.js:11246-12031 is contiguous and self-contained. It needs only TWO things from the rest of app.js, and exports only TWO: exports: loadPlugins (the window contract), bootstrapPluginsAndUi (boot) inbound: window.showScreen — already the public host contract (constitution II), so it is called through `window`, not re-coupled as an import _populateVizPicker — injected via configurePluginLoader() WHY A SEAM, NOT AN IMPORT. plugin-loader must not import app.js: app.js imports it, so that would close a cycle. I checked whether _populateVizPicker could just move into the module instead (which would delete the seam entirely) — it drags 9 further symbols (_canRun3D, _autoMatchViz, _showPromotionNag, …), i.e. a whole viz cluster. That is its own carve, so the seam stays. THE SEAM'S DEFAULT IS LOUD, ON PURPOSE. A no-op stub is the classic silent failure for this pattern (see the editor's setHostHooks trap, hit twice): drop the wiring call and the loader keeps working while the viz picker quietly stops refreshing — no test, no boot check says a word. The default now console.errors, so the smoke harness catches it. VERIFIED BY BITE TEST: removing configurePluginLoader() from app.js surfaces "[plugin-loader] host seam not configured" at boot. The seam IS exercised on the plugin-startup path, so an unwired hook cannot pass silently. no-cycle is now LIVE on core's own graph for the first time. eslint.config.js gains `static/app.js` + `static/js/**` to the module block — app.js now `import`s, so parsing it as a script would be a syntax error. VERIFIED BY BITE TEST: making plugin-loader import app.js back fails with "Dependency cycle detected". HARNESSES (the R3a note said budget one conversion per carve — it was five): retargeted capability_inspector_nav, plugin_hydration_wipe, plugin_loader_script_type, plugin_style_injection, legacy_shim_hits (SPLIT — one test needs the loader, one still needs app.js) + test_plugin_runtime_idempotence. legacy_shim_hits was missed by a symbol-name grep because it greps for a code STRING; only the failing run found it. test_capability_events' NEGATIVE asserts now span app.js + the loader — carving code out of app.js would otherwise make them vacuous instead of failing. VERIFIED: A/B against origin/main in two browsers — mounted plugin screens, 14 loaded plugin scripts, the 3 module plugins injected as <script type="module">, 37 capability participants, 14 shims, window.loadPlugins: IDENTICAL, zero console/page errors on both. /static/js/plugin-loader.js serves 200; R0 rails intact (src/main.js 200, conditional GET 304, script_type passthrough). pytest 2396, node 1032/1032, ESLint 0, Codex 0. Codex preflight caught a REAL [P1] first pass: static/js/plugin-loader.js was untracked, so a checkout would have served an app.js importing a nonexistent module — a failed static import kills the whole module and every window handler with it. Now tracked. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 18:18:00 +02:00
3 people	92c86f5393	refactor(ui): load app.js as an ES module (R3a) (#876) ... One attribute. #871/#872/#874/#875 exist to make this line safe. app.js's 385 top-level `function` declarations stop being implicit `window` properties: 87 stay reachable via the explicit contract (#874's Object.assign block + the 47 pre-existing `window.X = X` assignments), and 298 become module-private. Verified NO unexposed name is read from outside app.js. Strict mode (modules are always strict) checked ahead of the flip: app.js parses clean as `sourceType: module` (no octal, dup params, `with`), and has no implicit globals, no `eval`/`new Function`, no top-level `this`. `registerShortcut` is called bare at 15 top-level sites but is assigned at `window.registerShortcut` (app.js:10387) before its first call (10648), and a bare identifier in a module still resolves through the global object — verified `typeof window.registerShortcut === 'function'` in the browser. HARD GATE — app.js IS the plugin loader: - /api/plugins script_type passthrough: editor/stems/studio = "module" - /api/plugins/stems/src/main.js -> 200; conditional GET -> 304 (live-edit ETag) - deep graph: stems/src/transport.js, editor/src/state.js -> 200 - window.loadPlugins present; 5 plugin screens mount; the 3 migrated plugins injected as <script type="module"> - 37 capability participants, 14 compatibility shims, bus + capabilities v1 Every one of the shell's 336 inline handlers resolves on window under module scope, and the A-Z rail / pagination execute 6/6 with no ReferenceError. A/B against origin/main: the ONLY unresolvable handler is `editorToggleStemMixer`, which is equally broken on main (a dead handler in the editor plugin — not defined anywhere in its source; pre-existing, flagged separately). Codex preflight raised a [P1] claiming restartCurrentSong / requestExitSong / editRegionInEditor / returnToEditorFromHighway would ReferenceError — FALSE POSITIVE. It scanned only #874's new Object.assign block and missed app.js's 47 scattered `window.X = X` assignments; all four are at app.js:7086/7204/8492/8511 and all four resolve as `function` in the browser with app.js loaded as a module. pytest 2396, node 1032/1032, ESLint 0 errors, tailwind-fresh clean. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 17:38:33 +02:00
3 people	c223ace419	refactor(ui): load the capabilities as ES modules (R3a) (#875) ... The 12 capability <script> tags become type="module". No JS changes — the capability scripts already self-register on the window.feedBack bus, version-negotiate (`capabilities.version !== 1` → bail), and self-guard for idempotency. They never import or call app.js; it is pure pub/sub. Verified they export nothing by name: no top-level declaration in capabilities.js or capabilities/*.js is read by any other script, so losing global scope costs nothing. This is the first REAL exercise of the ordering fix from #872. A module defers to after HTML parse, so the capabilities now execute AFTER the document is parsed — while app.js still calls `window.feedBack.on(...)` at its top level. That only works because #872 put every classic script into the same deferred queue, where document order IS execution order: capabilities.js (line 122) still runs before app.js (line 1237). Had app.js stayed a plain classic script it would have run during parse, hit a bare `{}`, and died on `.on is not a function`. A/B against origin/main, 11 probes — capabilities.version, registered participants (37), compatibility shims (14), the bus, workingTuning, theme, setViz/showScreen/playSong, mounted plugin screens: IDENTICAL, zero console/page errors on both. 12 module tags served and executed; pytest 2396, node 1032/1032, ESLint 0, Codex 0. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 17:15:38 +02:00
3 people	ff7e855e35	refactor(app): make app.js's window contract explicit — 66 names (R3a) (#874) ... app.js is a classic script, so each of its 385 top-level `function foo()` decls is implicitly a property of `window`. As an ES module it will not be — module scope is not global scope — and every name reached from outside this file would silently vanish. This adds the explicit `window.*` assignments BEFORE the flip. Provably a NO-OP: all 66 are top-level function declarations, so while app.js is still a classic script `Object.assign(window, {...})` only re-assigns what `window` already has. That is what makes it safe to land on its own, ahead of the flip that needs it. The consumers are wider than the inline handlers in index.html: - inline on*= handlers in static/v3/index.html - on*= handlers app.js BUILDS inside template literals (goFavPage, updatePlugin, hideScanBanner, ...) — they resolve against window at CLICK time, but live in a JS string, so scanning the HTML alone never finds them - static/v3/*.js (showScreen alone has 17 consumers), capabilities - feedback-desktop and the external plugin repos — easy to miss, they live in other repos and no core test covers them - capabilities/visualization.js reads window.setViz behind a `typeof` guard, so losing it DEGRADES IN SILENCE rather than throwing Constitution II names window.playSong / window.showScreen / window.feedBack as the public extension contract, so this is an obligation, not a convenience. FOUR names are invisible to every static tool. app.js:2156-2157 picks the handler NAME at runtime — const letterFn = favoritesOnly ? 'filterFavTreeLetter' : 'filterTreeLetter'; — and interpolates it into `onclick="${letterFn}('A')"`. The names exist only inside string literals, so ESLint, no-undef, and any grep for `onclick="fn` all miss them. They are the library A-Z rail and its pagination: drop one and those buttons throw at click time and nowhere else. New tests/js/window_contract.test.js scrapes the HTML's handlers AND app.js's template-literal handlers, and pins the 4 runtime-composed names by hand. Verified to BITE: dropping showScreen, goTreePage, or setViz each fails it with the right message. On-device: 28 A-Z rail buttons render with their real onclick sources (filterTreeLetter('A'), ...) and 8/8 execute with no ReferenceError; all 66 names resolve on window in the browser. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 17:09:18 +02:00
3 people	4b4c156fce	refactor(ui): defer every classic script, keep boot() on DOMContentLoaded (R3a) (#872) ... Puts every external `<script>` in the v3 shell into the deferred queue, and keeps each script's boot() firing at DOMContentLoaded exactly as it does today. Behaviourally a no-op; it is what makes the ES-module flips safe. WHY. `type="module"` defers execution to after HTML parse. Classic-`defer` and module scripts share ONE "execute after parsing" list and run in DOCUMENT ORDER, but a plain classic script runs DURING parse — ahead of all of them. So the moment capabilities.js becomes a module while app.js is still plain, app.js runs FIRST, and its 11 top-level `window.feedBack.on(...)` calls (app.js:6245-6722) hit a bare `{}` — `_ensureFeedBackEventBus()` (capabilities.js:33), which attaches .on/.emit/.off, would not have run yet. TypeError, app.js dies mid-parse. Deferring everything now keeps document order == execution order through the rest of the migration. THE CATCH (Codex preflight caught this — a real ordering change). 22 scripts guard their boot with `if (document.readyState === 'loading')`. A deferred script runs at readyState 'interactive', so that test is FALSE and the else-branch fires boot() immediately, at the script's position in document order — instead of at DOMContentLoaded, after every script has evaluated. That matters far more than one call site: a scan of the shell's scripts found **43 forward references** where a script's boot() reads a global that a LATER script defines (shell.js -> profile.js's window.v3Onboarding, songs.js -> settings.js's window._confirmDialog, badges.js -> songs.js's window.displayTuningName, ...). Every one of them resolves today only because all boots happen at DOMContentLoaded. So the guards now treat 'interactive' as not-ready (`!== 'complete'`), restoring that exactly. Codex's specific finding (first-run onboarding silently skipped) did NOT reproduce — shell.js's boot() awaits /api/profile, and that yield lets the remaining deferred scripts run first. But the race it described is real, the guard is silent when it fails (`&& window.v3Onboarding`), and the other 42 forward refs have no such await protecting them. Fixed at the root rather than at the one site. VERIFIED. A/B against origin/main on a fresh profile, 13 probes (onboarding overlay, v3Onboarding/v3Songs/v3Profile/fbNotify/v3Badges/uiPrompt/showScreen, bus, capabilities.version, createHighway, plugin scripts, mounted screens): IDENTICAL, zero console/page errors on both. pytest 2396, node 1028/1028, ESLint 0 errors, Codex 0. New guard: test_every_external_script_defers_so_document_order_is_execution_order fails if any external tag is plain classic — verified to fail on a single reverted tag, so it actually bites. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 16:57:04 +02:00
3 people	9d0bf95716	refactor(ui)!: remove the classic v2 shell — v3 is the only UI (R3a) (#871) ... * refactor(ui)!: remove the classic v2 shell — v3 is the only UI (R3a) Deletes `static/index.html`, the `/v2` route, and the `FEEDBACK_UI` v2/legacy opt-out. `/` and `/v3` both serve `static/v3/index.html`, which has been the default since 0.3.0. This is step 0 of the core-frontend ES-module migration (R3a). Both shells load the same `static/app.js`, so every later step of that migration — exposing the window contract, the `defer` ordering fix, the `type="module"` flips — would otherwise have to be made and verified twice. Removing the fallback now halves that surface before any of it is touched. Incidentally fixes a latent bug in `index()`: its guard read `if getenv_compat("FEEDBACK_UI") or getenv_compat("FEEDBACK_UI") in ("v2", "legacy")`, whose left operand is truthy for *any* non-empty value — so `FEEDBACK_UI=v3` actually served the **v2** shell. - `static/tailwind.min.css` regenerated: the content globs scanned the deleted file, so v2-only utility classes are now purged (CI's tailwind-fresh job rebuilds and diffs it). - Constitution amended to 1.3.0 — Principle II's frontend file list now names `static/v3/index.html`. - Tests: 4 suites read the v2 shell (3 via a constructed `path.join` that a literal grep misses). Their v2 halves are paired duplicates of v3 tests that stay, so they are dropped; `alpha_warning_banner` and the capability-registry script-order test retarget to `static/v3/index.html`. BREAKING CHANGE: `FEEDBACK_UI=v2` / `=legacy` and the `/v2` route are gone. Unset the variable and use `/`. No chart, settings, or plugin data changes, and no plugin API changes — v3 reuses the same engine. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: drop the stale '/ is v2' plugin-verification guidance (CodeRabbit) The v3-only rewrite updated the intro paragraphs but left three lines that still instructed plugin authors to verify in 'both / (v2) and /v3' — now the same shell. Historical 'in v2 it was X' contrasts are kept: they still orient authors whose plugins also ship to users on older cores. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 16:33:03 +02:00
3 people	5e30138c87	refactor(server): extract the artist routes into routers/artist.py (R3) (#870) ... The artist page + external-links payload (/api/artist/{name}/page, /links, /links/refresh) plus their exclusive helpers (_artist_links_payload, _artist_links_from_mb, the URL-slot table) move to lib/routers/artist.py. Bodies verbatim except @app->@router and the seam reads (meta_db->appstate.meta_db, CONFIG_DIR->appstate.config_dir, _default_settings->appstate.default_settings). MB link enrichment is reached as enrichment.X; the URL-safety validator is imported from lib/library_registry.py. No new seams. server.py: 2,507 -> 2,413 (-94). Verified: pyflakes clean; route set unchanged (143); full pytest 2395 passed. eslint 0. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 15:49:37 +02:00
3 people	0547f55844	refactor(server): extract the media/file-serving routes into routers/media.py (R3) (#869) ... Song audio (/audio/{f}), the local-audio-path resolver (/api/audio-local-path), and raw sloppak-member serving (/api/sloppak/{f}/file/{rel}) — plus the shared _resolve_sloppak_local_file helper — move to lib/routers/media.py. Bodies verbatim except @app->@router and the cache/static path seams (AUDIO_CACHE_DIR-> appstate.audio_cache_dir, STATIC_DIR->appstate.static_dir, SLOPPAK_CACHE_DIR-> appstate.sloppak_cache_dir — all already in the seam). No new slots. The two test fixtures that redirect STATIC_DIR to a temp dir now also patch appstate.static_dir (the moved routes read the seam, not server's global). server.py: 2,638 -> 2,507 (-131). Verified: pyflakes clean; route set identical (143), all unique-path (no catch-all, no shadowing); full pytest 2395 passed (the audio-local-path + sloppak-file-traversal cases). eslint 0. Boot smoke: /audio, /api/sloppak/{}/file serve 404 for unknown, 0 tracebacks. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 15:36:22 +02:00
3 people	b7624b7e65	refactor(server): extract the enrichment route handlers into routers/enrichment.py (R3) (#868) ... The 14 /api/enrichment/* routes — status, kick/cancel, per-song state, the Match-Review queue (accept/reject/pick/search/rematch/refresh/states), and the AcoustID fingerprint identify endpoints — plus the route-exclusive candidate sanitizer move to lib/routers/enrichment.py. Bodies verbatim except @app->@router and the seam reads (meta_db->appstate.meta_db, CONFIG_DIR->appstate.config_dir). The enrichment engine (transport, matcher, worker, upload caps) already lives in lib/enrichment.py from the earlier subsystem move and is reached as enrichment.X. No new seams. server.py: 2,925 -> 2,638 (-287). Verified: pyflakes clean; route set identical (143); full pytest 2396 passed (the enrichment route + Match-Review + identify cases, which fake the network on the enrichment module). eslint 0. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 15:19:34 +02:00
Byron GamatosandGitHub	f00ba2217d	Revert "feat(audio): loopback feeder mode — all app audio under exclusive/ASIO (#865)" (#867) ... This reverts commit 9a58a55fe8.	2026-07-11 14:56:35 +02:00
3 people	f09c4a217f	refactor(server): extract library + collections routes + the provider registry (R3) (#866) ... The library query surface (songs/albums/artists/stats/genres/tuning-names/ practice-suggestions), the provider list/art/sync endpoints, and collection CRUD move to lib/routers/library.py. The registry itself — LibraryProviderRegistry, LocalLibraryProvider, SmartCollectionProvider, the collection-provider lifecycle (_sync/_unregister_collection_provider), and the shared query/collection helpers (_library_filter_args, _split_csv, _sanitize_collection_rules, _safe_art_redirect_url, the filter-key sets) — moves to lib/library_registry.py. The PLUGIN CONTRACT is untouched: server.py still constructs the singleton (LocalLibraryProvider needs meta_db), still exposes register_library_provider / unregister_library_provider to plugins via plugin_context (with the per-plugin ownership scoping in plugins/__init__.py), and injects the registry + local provider into appstate. The router reads appstate.library_providers / appstate.local_library_provider at call time; the provider classes are duck-typed so no plugin imports a base class. Acyclic: library_registry imports routers.art (for LocalLibraryProvider.get_art) + appstate, never server. server.py: 3,692 -> 2,925 (-767). Verified: pyflakes clean; ORDERED route table identical set (library block mounts at one site — all exact/specific-path, no catch-all, no shadowing); full pytest 2397 passed (incl the plugin register/unregister + collection-as-provider tests). eslint 0. Boot smoke: /api/library + providers list "local"; a created collection surfaces as a `collection:N` provider through the seam; collection CRUD clean. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 14:56:12 +02:00
4 people	9a58a55fe8	feat(audio): loopback feeder mode — all app audio under exclusive/ASIO (#865) ... * feat(audio): loopback feeder mode — all app audio under exclusive/ASIO Tester-confirmed (2026-07-11 log): song previews and other plugin-private audio bypass the per-surface feeder taps and leak to the default WASAPI device under ASIO output. Also confirmed: the element capture path poisons itself when highway_3d already owns #audio's one-shot MediaElementSource (InvalidStateError with _elCtx assigned pre-throw → TypeError every later tick). - New preferred mode 'loopback': one getDisplayMedia frame-audio capture (desktop main answers with the app's own frame) covers song, previews, and UI sounds for the whole exclusive session — engages even with no song loaded. Local playback silenced via suppressLocalAudioPlayback, page-mute IPC fallback otherwise. - Sticky fallback to the existing stems/element surface modes when capture is unavailable (old desktop main, denied, Docker sphere). - Element capture: assign module state only after the whole chain succeeds; close the context on failure — collision now retries clean. - Failed engage now disables the bus and tears down loopback (no more bus-enabled-with-no-producer stranding). - Tests: 12 (5 new — loopback engage/preference/mute-fallback/sticky fallback, collision retry). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(audio): close loopback capture context on teardown (release tap worklet) The loopback context was reused across engages (_lbCtx || new), but teardown only stopped the stream + deactivated the tap — never closing the context or detaching the worklet node. Each exclusive<->shared switch orphaned a live tap worklet on the long-lived context. Use a fresh context per session and close it on disengage. Adds a test asserting the context is closed on teardown. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Byron Gamatos <xasiklas@gmail.com>	2026-07-11 14:54:40 +02:00
3 people	bbdff4e10f	refactor(server): extract the song routes into routers/song.py (R3) (#864) ... Upload/delete, the catalog-metadata write-back, user-meta, overrides, gap-fill, and the per-song info payload (11 routes) move to lib/routers/song.py with their exclusive helpers (the atomic upload commit + the song-IO lock, the upload caps, the gap-fill proposal builders). Bodies verbatim except @app->@router and the seam reads: meta_db->appstate.meta_db, art_override_paths->appstate.art_override_paths, and the scan/ingest helpers that stay in server.py (the scan lifecycle owns them) -> new appstate seam callables: kick_scan, invalidate_song_caches, stat_for_cache, and scan_status() (a getter — the underlying dict is reassigned). The gap-fill MBID/ISRC regexes are reached as enrichment.X; _MULTIPART_OVERHEAD_SLACK (shared with the staying AcoustID-identify route) moves to lib/enrichment.py beside _ACOUSTID_MAX_UPLOAD_BYTES. ROUTE ORDER: song_router mounts AFTER art_router — get_song_info's catch-all `/api/song/{filename:path}` would otherwise shadow `/api/song/{path}/art*` (Starlette matches first-registered; the :path converter is greedy). server.py: 4,478 -> 3,692 (-786). Verified: pyflakes clean; ORDERED route table preserves the specific-before-catch-all invariant; full pytest 2397 passed (incl the art/cover 304 + CAA-fetch tests that caught the shadowing before it was fixed). eslint 0. BEHAVIORAL — needs an on-device pass (upload a sloppak, edit metadata write-back, delete a song) before merge. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 13:14:52 +02:00
3 people	7258e1066a	refactor(server): extract the settings routes into routers/settings.py (R3) (#863) ... GET/POST /api/settings, /api/settings/reset, and the two-phase atomic export/import bundle (/api/settings/export|import) move to lib/routers/settings.py with their exclusive helpers (the relpath allowlist validator, the atomic writer, the library-DB snapshot + sqlite integrity gate, the config-type validator, the bundle schema). Bodies verbatim except @app->@router and the seam reads: meta_db->appstate.meta_db, CONFIG_DIR->appstate.config_dir, _running_version->appstate.running_version(), and _default_settings-> appstate.default_settings (the canonical defaults builder stays in server.py — the scan + artist-links code share it — and is injected as a new seam callable). server.py: 5,539 -> 4,478 (-1,061). Verified: pyflakes clean (bar the pre-existing File/safe_join/tuning_name/ET); route table IDENTICAL (143); full pytest 2397 passed (154 settings cases incl the export→import round-trip + library-DB snapshot/restore + relpath-allowlist SSRF/ traversal guards, retargeted onto the settings module). eslint 0. BEHAVIORAL — needs an on-device settings export→import round-trip sign-off before merge (do not merge on green CI alone). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 12:35:05 +02:00
3 people	73127d5416	refactor(server): extract the album-art routes into routers/art.py (R3) (#862) ... The six song-art routes — GET /api/song/{f}/art, .../art/cover-search, .../art/candidates, POST .../art/upload, .../art/url, DELETE /api/art/{f}/override — plus their exclusive helpers (the ETag/304 response machinery, _save_art_override, _url_host_is_internal, _fetch_art_url + the art size/redirect caps) move to lib/routers/art.py. Bodies verbatim except @app->@router and the seam reads: meta_db->appstate.meta_db, ART_CACHE_DIR->appstate.art_cache_dir, and the three shared art helpers that stay in server.py (used by the song/delete routes too) -> appstate.<callable> (_song_pack_art_exists, _art_override_paths — already seam-injected for the enrichment worker — plus a new art_safe_name slot). The CAA / release-search transport lives in lib/enrichment.py and is reached as enrichment.X. LocalLibraryProvider.get_art now calls art_router.get_song_art. server.py: 5,988 -> 5,540 (-448). Verified: pyflakes clean (bar the pre-existing File/safe_join/tuning_name/ET); route table IDENTICAL (143); full pytest 2399 passed (33 art serve/candidates/ override/url cases incl the SSRF-guard _url_host_is_internal + _fetch_art_url size-cap tests, retargeted onto the art module); test_packaging 43; eslint 0. Boot smoke: /art 404, /art/candidates 404, DELETE /override 200 from the router. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 11:56:53 +02:00
3 people	165475d115	refactor(server): move the metadata-enrichment subsystem into lib/enrichment.py (R3) (#861) ... * refactor(server): move the metadata-enrichment subsystem into lib/enrichment.py (R3) MusicBrainz / Cover-Art-Archive / AcoustID transport, the match-scorer glue, and the background enrichment worker (~930 lines, 61 defs) leave server.py as one cohesive unit. Bodies are verbatim; the only changes are seam reads: meta_db / config_dir / sloppak_cache_dir / art_cache_dir -> appstate.<slot> _song_pack_art_exists / _art_override_paths (stay in server.py for the art + delete routes) -> appstate.<callable> (new seam slots, injected by reference) _env_flag -> env_compat.env_flag_compat (the existing identical helper) _artist_title_from_filename -> imported from metadata_db (its home) the User-Agent VERSION lookup: Path(__file__).parent -> Path(__file__).resolve().parents[1] (lib/enrichment.py -> app root) server.py drives the worker through the module (import enrichment; the routes + scan lifecycle call enrichment.X). Tests that faked the network on `server` (_mb_http_get, _enrich_network_enabled, _caa_http_get, ...) now patch the same names on `enrichment` — the module attribute is resolved at call time, so one setattr reaches both the routes and the worker's internal callers. Acyclic: enrichment imports appstate/appconfig/dlc_paths/metadata_db/mb_match/ acoustid_match/sloppak/loosefolder, never server. server.py: 6,917 -> 5,988 (-929). Verified: pyflakes clean (bar the pre-existing File/safe_join/tuning_name/ET); route table IDENTICAL (143); full pytest 2400 passed (140 enrichment/art cases incl the offline-safety + transport-error-pauses-pass contracts that fake the network); test_packaging 44 passed (enrichment.py resolves under lib/); eslint 0. Boot smoke: /api/enrichment/status + POST /kick serve from the new module. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: reset enrichment worker state between tests (CodeRabbit) lib/enrichment.py now owns the worker, and it stays imported for the whole session while the `server` fixtures pop-and-reimport `server` — so the cancel Event / status dict / caches would leak across tests, and a stale `_enrich_cancel` could short-circuit a later direct `_background_enrich()`. An autouse conftest fixture clears that process-global state before each test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: tighten the enrichment-reset fixture (CodeRabbit) Narrow the import guard to ImportError (not blind Exception, BLE001), and stop clearing _caa_index_locks — it's guarded by _caa_index_locks_guard, so an unlocked clear() would race a still-alive worker, and its per-release mutexes carry no test state. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 11:32:21 +02:00
3 people	508829c012	refactor(server): extract /api/tunings into routers/tunings.py + lib/appconfig.py (R3) (#858) ... The merged-tuning-catalog route moves to lib/routers/tunings.py, verbatim except @app->@router, CONFIG_DIR->appstate.config_dir, and the two seam substrates it needed: - lib/appconfig.py — the pure config.json reader `_load_config` (used by ~11 server sites + future config-reading routers). server.py re-imports it, so those call sites and any `server._load_config` test reference are unchanged. - appstate.tuning_providers — the TuningProviderRegistry instance injected by reference (a stable object mutated in place via register()/unregister()), so the router reads the same registry plugins populate through plugin_context. The instance stays defined in server.py, so `server.tuning_providers` still resolves — zero test retargets. The tuning constants (DEFAULT_REFERENCE_PITCH, TUNING_PRESET_MIDIS, freqs_to_midis) already live in lib/tunings.py and are imported directly. server.py: 6,960 -> 6,917. Verified: pyflakes clean (bar the pre-existing unused `tuning_name` import); route table IDENTICAL (143); full pytest 2400 passed (110 tuning/config cases); eslint 0. Boot smoke: /api/tunings serves referencePitch + tunings + tuningMidis. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 01:43:19 +02:00
3 people	cce95cbd1e	refactor(server): extract the diagnostics routes into routers/diagnostics.py (R3) (#857) ... The three /api/diagnostics/* routes (export, preview, hardware) plus their exclusive payload-cap helpers and the `_diag_*` normalisers. Bodies verbatim except @app->@router, CONFIG_DIR->appstate.config_dir, _running_version()-> appstate.running_version() (a new seam slot; the impl stays in server.py where the settings region also calls it), and the builtin-plugins lookup in _diag_plugins_roots: Path(__file__).parent -> Path(__file__).resolve().parents[2] (routers -> lib -> app root; plugins/ ships at the app root in every packaging path). The pure caps/normalisers (_diag_cap_console/_dict/_contributions, _diag_coerce_bool, _diag_normalize_include, _DIAG_MAX_*) are re-exported from server.py so the existing `server._diag_*` / `server._DIAG_*` tests keep resolving — none of them monkeypatch these, so no test retargets. server.py: 7,216 -> 6,960. Verified: pyflakes clean (bar the intentional re-export lines); route table IDENTICAL (143); full pytest 2399 passed (77 diag/packaging + 122 diagnostic- matched cases incl the cap/coerce/normalize suites); eslint 0; Codex pending. Boot smoke: /hardware, /preview, and POST /export (200 application/zip) all serve from the new router location. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 01:27:52 +02:00
3 people	32ebc7671e	refactor(server): extract the version route into routers/version.py (R3) (#856) ... GET /api/version + its exclusive _safe_http_url URL validator. Bodies verbatim except @app -> @router and the VERSION-file lookup: Path(__file__).parent (the app root when this lived at the top level) -> Path(__file__).resolve().parents[2] (routers -> lib -> app root). VERSION ships at the app root in every packaging path (Dockerfile COPY VERSION /app/, desktop bundle). server.py: 7,275 -> 7,214. Verified: pyflakes clean; route table IDENTICAL (143); pytest 2401 passed (33 in test_version_endpoint, incl the URL-validation + env-override cases); eslint 0. Boot smoke: /api/version returns the real version + validated source/license URLs. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 00:56:36 +02:00
3 people	46f3be7fd7	refactor(server): extract XP + per-song stats into routers/stats.py (R3) (#855) ... The last of the progression cluster. XP award (1 route) + per-song practice stats (record/recent/best/top/per-song, 5 routes) — meta_db-only apart from the two seam accessors record_stats uses (get_progression_content, builtin_diagnostic_ filename, both landed by shop/progression). Bodies verbatim; @app -> @router, meta_db -> appstate.meta_db, _as_int from metadata_db, _clean_str from reqfields. Three scattered source blocks (xp, the stats block, and the separated /api/stats/{filename:path} which the /api/library/practice-suggestions route splits off) are assembled into one module and mounted once. Registration order is preserved WHERE IT MATTERS: the /api/stats/{filename:path} catch-all is assembled LAST inside the router, so it still can't shadow the fixed /recent /best /top paths — verified against the live route table (recent/best/top all precede the catch-all) and the route SET is identical to origin/main (143). server.py: 7,478 -> 7,275. Verified: pyflakes clean; route set identical + catch-all-last; pytest 2401 passed (113 across song_stats/profile/progression); eslint 0. Boot smoke: /stats/recent /best /top all 200 (not shadowed), xp/award 200. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 00:45:35 +02:00
3 people	76159c16cd	feat(diag): --debug ASIO routing diagnostics in static bundle (#852) ... * feat(audio): route feedpak full-mix natively under exclusive output Song playback runs through the renderer, which WASAPI-exclusive (and ASIO) output silences. Route single-mix feedpaks (stem-less original_audio packs AND single-stem packs) onto the engine's backing transport when the output device type is exclusive-style, and migrate back to HTML5 when it isn't. Extends /api/audio-local-path to resolve /api/sloppak/.../file/... URLs via the same containment guards as serve_sloppak_file. Multi-stem packs stay on the WebAudio path (Phase 2). Includes [feedpak-route] transition-gated diagnostics logging. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(audio): renderer-bus feeder — mix renderer song audio into engine output (Phase 2) Under exclusive-style output the native backing transport (Phase 1, #824) carries loose /audio/ songs and feedpak full-mixes, but not the stems plugin's multi-stem WebAudio graph or tracks JUCE rejected. The feeder taps the renderer-side master with an AudioWorklet, re-points the owning AudioContext at a null sink so it keeps rendering without a device, and pushes ~10 ms chunks over IPC into the desktop engine's renderer bus (feedBack-desktop#90 follow-up). Inert in the Docker sphere and in shared mode. Validated by the fix12 tester spike: null-sink rendering works, clocks hold, no overflow. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(diag): --debug ASIO routing diagnostics in static bundle Gated on window.feedBackDesktop.audio.debugEnabled() (desktop --debug); inert in the Docker sphere and normal desktop runs. - [asio-diag] getCurrentDevice= full device object on outputType change (catches ASIO drivers reporting a non-'ASIO' type name) - [asio-diag] renderer-bus: full feeder decision vector, change-gated (running/exclusive/stems/juceMode/elementSong/want/mode) - [asio-diag] setSink: every sink flip with ctx state + rate Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-11 00:42:41 +02:00
3 people	4cc8fa3b4d	refactor(server): extract the profile routes into routers/profile.py (R3) (#854) ... 6 routes (get/set profile, bundled+custom avatars, avatar upload/serve, progress) + the exclusive _list_bundled_avatars helper. Bodies verbatim; @app -> @router, meta_db -> appstate.meta_db, CONFIG_DIR/STATIC_DIR -> appstate.config_dir/ static_dir (seam), _clean_str from reqfields, _get_progression_content() -> appstate.get_progression_content(). No STATIC_DIR test retarget: _list_bundled_avatars reads appstate.static_dir but test_profile_api doesn't patch STATIC (only the sloppak/audio/traversal suites do, for handlers that stay in server.py). server.py: 7,594 -> 7,478. Verified: pyflakes clean; route table IDENTICAL (143); pytest 2401 passed (61 in test_profile_api); eslint 0. Boot smoke: GET /api/profile 200 (drives get_progression_content), /avatars lists via appstate.static_dir, /progress 200. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 00:38:03 +02:00
3 people	f9f33320ac	refactor(server): extract the progression routes into routers/progression.py (R3) (#853) ... 4 routes (overview/add-paths/onboarding/events, spec 010) + their EXCLUSIVE helpers (_goal_ui_progress, _progression_overview 112L) + the _PROGRESSION_EVENT_TYPES whitelist. Bodies verbatim; @app -> @router, meta_db -> appstate.meta_db, _clean_str from reqfields. The two SHARED server accessors read through the seam: get_progression_content (added for shop #851) and builtin_diagnostic_filename (new slot — a trivial const-returning fn shared with the stats router's api_record_stats). Both are injected via the second appstate.configure() after their defs (the import-top configure runs before them). The cache + fns stay in server.py, so test_progression_api's server._progression_content patch is untouched — 0 retarget. server.py: 7,798 -> 7,594. Verified: pyflakes clean; route table IDENTICAL (143); both seam accessors wired; pytest 2401 passed (63 in test_progression_api); eslint 0. Boot smoke: GET /api/progression 200 (drives _progression_overview + both accessors), events 400 on bad body. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 00:25:53 +02:00
3 people	5f58af4faa	refactor(server): extract the shop routes + inject get_progression_content into the seam (R3) (#851) ... The progression-content substrate: `_get_progression_content` (a lazy, double-checked-locking content cache) is now published into the appstate seam as a CALLABLE. The cache global + lock + the function stay in server.py (startup uses it, and test_progression_api patches `server._progression_content` directly), so ZERO test retargeting — routers just call `appstate.get_progression_content()`. Because the accessor is defined at server.py:1152 but the import-top configure() runs at :346, a second `appstate.configure(get_progression_content=...)` publishes it right after the def (configure is idempotent/additive). First consumer: routers/shop.py (3 routes: buy/equip/list). Bodies verbatim; @app -> @router, meta_db -> appstate.meta_db, _clean_str from reqfields, _get_progression_content() -> appstate.get_progression_content(). This unblocks stats/progression/profile next (all share the accessor). server.py: 7,880 -> 7,845. Verified: pyflakes clean; route table IDENTICAL (143); pytest 2401 passed (test_progression_api's server._progression_content patch still works via the kept cache); packaging guard; eslint 0. Boot smoke: GET /api/shop 200 (drives appstate.get_progression_content), buy 400 on bad body. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 23:42:02 +02:00
3 people	ea8834862d	refactor(server): batch the small meta_db user-state endpoints into routers/library_extras.py (R3) (#850) ... work keeper-chart prefs (3) + favorites toggle + tags list + saved toggle + session/continue — 7 routes across 5 domains, all meta_db-only (0 setattr, 0 helpers). Bodies verbatim; @app -> @router, meta_db -> appstate.meta_db, _clean_str from reqfields. These were scattered singletons with no natural neighbor, so they're grouped as "small library/user-state endpoints" and mounted once. All paths are distinct and non-overlapping, so registering them together doesn't change routing: verified the route SET is identical to origin/main (143) AND that no moved path shadows or is shadowed by another (order-independence check). server.py: 7,880 -> 7,833. Verified: pyflakes clean; route set identical + order-independent; pytest 2401 passed; packaging guard 45; eslint 0. Boot smoke: tags/session GET 200, favorites/saved toggle (400 on missing filename), work/charts 200. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 23:37:24 +02:00
3 people	2281cac438	refactor(highway): lift 79 per-instance closure vars into hwState (R3c H lift) (#849) ... * refactor(highway): lift 79 per-instance closure vars into `hwState` (R3c H lift) Collapses createHighway()'s 79 mutable closure `let`s into one per-instance `hwState` object. Scope-resolved rewrite via acorn + eslint-scope: 1059 edits (1057 references + 79 defs - the deleted `let canvas, ctx, ws`), with the four names shadowed in inner scopes (chartTime/ctx/notes/chordTemplates) resolved correctly so only closure-bound refs move. Enables the later module split: extracted renderer/ws modules close over `hwState` as a factory arg, so multi-panel plugins (highway_3d, note_detect, splitscreen) don't share one highway's state. Container is `hwState`, NOT `H` — `H` is already canvas height (70 uses). The frame-time gate caught that collision instantly (0 draws, `H._drawHooks is not iterable` in the shared draw-hook path). PERF (the whole risk): identical to the pre-lift baseline. Draw p50 2.1-2.2 ms, p95 2.7-3.0 ms (pre-lift 2.7-3.2), measured on the Arcturus feedpak, headless. Each closure-slot read became a `hwState.<slot>` monomorphic property load; the hot loop pays nothing. On-device: Byron confirmed the 2D highway plays smoothly. Tests: the ~30 highway JS suites brace-extract functions/patterns from the source; their state references + the monotonic-clock vm sandbox now use `hwState.<slot>` (the const _CHART_MAX_INTERP_MS etc. stay top-level, not lifted). node --test: 1030/1030 green. Two self-inflicted over-replacements caught and reverted (`_lefty` is a prefix of the 3D-local `_leftyCached`; `STRING_COLORS` a suffix of `DEFAULT_STRING_COLORS`) — substring replaces on the brace-extract regexes need word care. Transformer saved at ~/.local/share/feedback-editor/highway-h-lift.mjs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(highway): pin the setNoteStateProvider assertion to hwState._noteStateProvider (CodeRabbit) The [^}]* form matched an unqualified _noteStateProvider =, so a regression to closure-level state could still pass. Require the hwState-qualified assignment. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 23:19:20 +02:00
3 people	b6098e3695	perf(harness): add 2D-highway frame-time measurement + capture the R3c gate (H0) (#848) ... * perf(harness): add 2D-highway frame-time measurement + capture the R3c gate (H0) scripts/perf-baseline.mjs gains a `--song` mode: it wraps requestAnimationFrame before any page script, TAGS the frames the highway actually painted (via highway.addDrawHook), starts playback, and reports draw-frame p50/p95/p99 over `--frames` seconds across `--runs` runs. Tagging is the point — ~half the rAF callbacks are other cheap loops (~0.1 ms); averaging them in would hide a renderer regression, so only draw frames are counted. This is the metric the plan says gates the highway.js split (R3c) but the harness never measured (it did server latency + boot + heap only, and the R0 numbers were against an empty library). docs/perf-baseline.md now records the pre-lift baseline on the Arcturus feedpak: p50 ~2.2 ms, p95 spread 2.7-3.2 ms across 3 runs. The H-container lift (next) re-runs this on the same box and must stay within noise. Maintainer/CI-only tooling; the existing no-`--song` run is unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(harness): close page on error + MD040 fence + CHANGELOG (CodeRabbit) - frameTimeOnce now closes its page in a finally, so a failing run doesn't leak the page until the final browser.close() (CodeRabbit). - fenced code block gets a bash language hint (MD040). - CHANGELOG mentions the new --song frame-time mode. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 23:15:07 +02:00
3 people	cbc65458e3	refactor(server): extract the wishlist routes into routers/wanted.py (R3) (#847) ... Free after _clean_str moved to lib (#841): wanted's deps are JSONResponse, _clean_str (reqfields), app + meta_db (seam). 3 routes (list/add/remove), 0 setattr targets, 0 helpers to relocate. Bodies verbatim; @app -> @router, meta_db -> appstate.meta_db. include_router at the original site; 143-route table identical. No test retargeting. server.py: 8,003 -> 7,974 (this branch is independent of the chart PR). Verified: pyflakes clean; route table identical; pytest 2401 passed (52 in test_wanted_api); eslint 0. Boot smoke: add wishlist entry -> list -> delete, 400 on missing artist+title (_clean_str path). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 22:20:10 +02:00
3 people	7c87538d6b	refactor(server): extract the chart routes into routers/chart.py (R3) (#846) ... Unblocked by the DLC-path substrate (#843): chart's only server-module deps are now app + meta_db (both seam); _get_dlc_dir/_resolve_dlc_path come from dlc_paths, sloppak/loose detection from the shared lib modules. 4 routes (split/unsplit/ work/fileinfo), meta_db-only otherwise. 0 setattr targets, 0 helpers to relocate. Bodies verbatim; @app -> @router, meta_db -> appstate.meta_db. include_router at the original site; 143-route table identical to origin/main. No test retargeting. server.py: 8,003 -> 7,909. Verified: pyflakes clean on the router; no new undefined/dead in server.py; route table identical; pytest 2401 passed (74 across work_charts/context_menu/ group_filter/packaging); eslint 0. Boot smoke: chart/work 200, chart/fileinfo resolves the real pack path through _resolve_dlc_path. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 22:15:25 +02:00
3 people	c8701991cb	fix(ws_highway): swallow a mid-stream WebSocketDisconnect quietly (#845) ... * fix(ws_highway): swallow a mid-stream WebSocketDisconnect quietly Pre-existing (byte-identical to origin/main), flagged by CodeRabbit on #844: the outer try's only guard was `except Exception as e: log.exception("highway_ws unhandled error")`. The inner `except WebSocketDisconnect` covers ONLY the post-`ready` keep-alive loop, and the drum_tab/notation sends have their own localized guards — but the ~13 other streamed sends (beats, sections, notes, chords, anchors, …) fall through to the blanket handler. Since WebSocketDisconnect is an Exception subclass, a routine tab-close mid-load was logged as an error at whichever send was in flight. Fix: a dedicated `except WebSocketDisconnect: return` before the blanket handler, matching the two localized guards and the lib/ coding guideline. tests/test_ws_highway_disconnect.py drives highway_ws with a fake websocket that raises WebSocketDisconnect on the first streamed send (`loading`), over a real minimal sloppak. Negative-checked: removing the guard makes it fail (the disconnect is logged as `highway_ws unhandled error`); the fix passes. Uses a raw handler on `feedBack.server` rather than caplog, since configure_logging() reroutes that logger through structlog where caplog doesn't observe it. Full suite green. Closes the review thread on #844. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(ws_highway): assert streaming stops after disconnect (exactly one send) — CodeRabbit The stub now raises only on the first send and the test asserts ws.sends == 1, so a handler that caught the disconnect and kept streaming would fail. Still negative-checked: removing the guard fails the test. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 21:30:53 +02:00
3 people	514461167e	refactor(server): extract the highway WebSocket into routers/ws_highway.py (R3) (#844) ... The single largest handler in server.py — the 902-line /ws/highway/{filename} chart streamer — plus its 3 exclusive helpers (_pick_smart_arrangement, _sanitize_authors, _sanitized_song_offset). server.py: 9,008 -> 8,003 (-1,005, the biggest single R3 cut). Clean move despite the size: the handler's only server-module deps are the 4 path constants + 3 exclusive helpers + app + log. Everything else it uses is either NESTED inside the handler (_evict_audio_cache, _fill_scale_degree, _manifest_entries, _tone_names, _xml_rank, _send_keepalives) or imported from the shared lib modules (song/audio/sloppak/drums/notation/dlc_paths/metadata_db). - Path constants read through the appstate seam: added static_dir / sloppak_cache_dir / audio_cache_dir slots (config_dir already there); server.py configures them. Bodies otherwise verbatim (@app.websocket -> @router.websocket, PATHS -> appstate.*, log -> module logger). - sloppak_cache_dir IS setattr-patched, so the 3 test_highway_ws_* suites now also `setattr(appstate, "sloppak_cache_dir", ...)` next to their existing server patch. _sanitize_authors unit tests import it from routers.ws_highway (it moved). No other test churn. - Removed 23 now-dead imports from server.py (song/audio/drums/notation/ bisect/contextvars/structlog/WebSocket*/_arr_smart_sort_key) — diffed against the origin/main unused-import baseline so only NEWLY-dead ones went. owns_tmp (assigned, never read) moved verbatim — it's pre-existing dead on origin/main too; left as-is to keep the move faithful. Verified: route table identical to origin/main (143, paths/methods/order); handler body verbatim spot-checked; pyflakes clean (server has no new undefined/dead); pytest 2400 passed; packaging guard 53; eslint 0. Boot smoke: the highway WS streams the full chart (song_info/beats/sections/notes/chords/ notation/anchors/drum_tab -> ready) BYTE-for-byte the same message sequence as origin/main across arrangements 0/1/2, zero tracebacks. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 21:12:54 +02:00
3 people	0dcc9136b6	refactor(server): move DLC path resolution to lib/dlc_paths.py (R3 substrate) (#843) ... The keystone for the path-dependent routers (ws_highway, song, audio-local-path, sloppak): the "where do the song files live + safe containment" layer leaves server.py so a router can reach it. - `_resolve_dlc_path` (pure — args only) moves verbatim. - `_get_dlc_dir` reads the env-derived paths through the appstate seam (appstate.dlc_dir/dlc_dir_env/config_dir) instead of module globals, so lib/dlc_paths.py does no import-time IO. - appstate gains `dlc_dir`/`dlc_dir_env` slots (config_dir already there); server.py configures them. All three are env-derived, so a setenv+reimport fixture reconfigures them for free — ZERO setattr retargeting. - server.py RE-EXPORTS both (`from dlc_paths import _get_dlc_dir, _resolve_dlc_path`), so its 24+16 call sites AND the tests that reach `server._get_dlc_dir()` / `server._resolve_dlc_path()` directly (test_dlc_junction, test_highway_ws_*) resolve unchanged — no test edits. server.py: 9,085 -> 9,008. Verified: _resolve_dlc_path byte-identical to origin/main; _get_dlc_dir's only change is the three path identifiers -> appstate.*; pyflakes clean; route table identical (143); pytest 2407 passed (test_dlc_junction + both highway_ws suites green via re-export); packaging guard 52; eslint 0. Boot smoke: library scans (8 songs, _get_dlc_dir), a real song resolves + serves art (_resolve_dlc_path), and the highway WS reaches `ready` with notes. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 20:41:42 +02:00
3 people	6da01c55a4	fix(playlists): split cover decode (400) from persist (500), unique temp, existence re-check (#842) ... Two pre-existing cover-upload issues CodeRabbit flagged on #841 (verbatim move, so correctly not fixed there): 1. One `except Exception as e` wrapped BOTH the PIL decode and the img.save/ tmp.replace, returned 400 for both, and echoed `e` — so a disk/permission failure was mislabeled a client error and could leak a filesystem path. Now: decode/validation -> 400 "Invalid image" (generic); save/replace failure -> logged 500 "could not save cover" (no detail). 2. A shared `{pid}.png.tmp` let two concurrent uploads clobber each other's temp file. Now a unique `tempfile.mkstemp` in the cover dir, atomic replace to publish. Plus an existence re-check just before publishing so an upload that raced a playlist delete can't leave an orphan cover. mkstemp itself is INSIDE the try (Codex catch): an unwritable dir / full disk raises there and is the same persistence failure as save/replace, so it hits the logged generic-500 path instead of escaping as an unhandled 500. Cleanup guards `tmp is not None` for the mkstemp-failed case. Did NOT add a full per-playlist critical section (CodeRabbit's "heavy lift"): FeedBack is single-user (Principle I), so a cover upload racing a delete on the same id can't happen — documented in the code rather than building a lock framework for a precluded race. tests/test_playlist_cover_errors.py pins all of it; negative-checked three ways: the old single-except-400 shape fails the 500 + no-leak-400 tests, and moving mkstemp back outside the try fails the temp-creation-500 test. Fix passes 5/5. Full suite 2405 passed; boot smoke: valid cover 200, bad image -> generic "Invalid image" 400, no .tmp litter. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 20:16:22 +02:00
3 people	a883f9213f	refactor(server): extract the playlists routes into routers/playlists.py (R3) (#841) ... The biggest router yet — 12 playlist routes + custom covers — and the first that needs the config-path seam. server.py: 9,302 -> 9,085 (-217). Three causally-linked pieces, all required for playlists: - `config_dir` joins the appstate seam (the plan always put the path constants there; deferred in S3, needed now). It's env-derived, so the ~49 pop-and-reimport fixtures reconfigure it for free — ZERO setattr retargeting. STATIC_DIR/SLOPPAK_CACHE_DIR (patched via setattr) stay in server.py until a router that reads them is extracted, and get retargeted then. - `_clean_str` (pure request-field sanitizer, 14 callers) -> lib/reqfields.py; server.py imports it back. Unblocks wanted/saved/collections/profile/... later. - routers/playlists.py: bodies verbatim, `@app`->`@router`, `meta_db`-> `appstate.meta_db`, `CONFIG_DIR`->`appstate.config_dir`, `_clean_str` from reqfields, `_ART_CACHE_HEADERS` as a local const (art keeps server.py's). The two exclusive cover helpers (_playlist_cover_path/_url) move with it. include_router at the original site; full 143-route table identical to origin/main. One test retarget: test_playlists_api called `server._playlist_cover_path` directly -> now imports it from routers.playlists (reads appstate.config_dir, which the `server` fixture configures). Verified: pyflakes clean; route table identical; pytest 2401 passed (28 in playlists+collections+appstate); packaging guard 51 (auto-picked up reqfields); eslint 0; boot smoke drives create/rename/add-song/cover-upload/serve/delete — the cover writes 1.png under CONFIG_DIR THROUGH appstate.config_dir and serves 200 with an mtime cache-bust token; a wrong-typed name field still 400s via _clean_str; demo untouched. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 19:58:09 +02:00
3 people	4fd0cd49e7	fix(loops): take the DB lock for the count+insert and the list read (#840) ... Two pre-existing races in the loops routes, flagged by CodeRabbit on #839 (the verbatim extraction moved them unchanged from server.py, so they correctly weren't fixed there): 1. save_loop computed `COUNT(*)` OUTSIDE meta_db._lock, then inserted inside it. Two simultaneous unnamed POSTs read the same count and both mint "Loop N". Fix: one lock scope around COUNT + INSERT. 2. list_loops read the shared single connection (check_same_thread=False) with no lock, so it could overlap a POST/DELETE commit. Fix: read under the lock, like every writer. Low severity in context — FeedBack is single-user (Principle I), so concurrent unnamed-loop POSTs essentially can't happen — but each fix is one lock scope. tests/test_loops_concurrency.py pins both with a threading.Barrier that releases 16 workers into save_loop at once. Negative-checked: reverting the COUNT back outside the lock fails the uniqueness assertion 5/5 runs; the fix passes 3/3. pytest 2400 passed; on-device two unnamed POSTs -> ['Loop 1','Loop 2']. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 19:16:01 +02:00
3 people	b41361eb1b	refactor(server): extract the loops routes into routers/loops.py (R3) (#839) ... Third router. Practice loops (saved A/B regions per song): GET/POST/DELETE /api/loops, meta_db-only (0 setattr targets, 0 helpers to relocate per router_scan.py). Bodies verbatim; @app -> @router, meta_db -> appstate.meta_db. include_router at the original site; 143-route table identical to origin/main. server.py: 9,337 -> 9,301. No test retargeting (test_demo_mode only names the paths in middleware regexes). Verified: pyflakes clean; route table identical; pytest 2398 passed; packaging guard green; eslint 0; boot smoke drives POST (auto-names "Loop N") / GET / DELETE / missing-fields error, and demo mode 403s both writes while allowing the read. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 19:05:01 +02:00
3 people	6c98aba433	refactor(server): extract the artist-alias routes into routers/artist_aliases.py (R3) (#838) ... * refactor(server): extract the artist-alias routes into routers/artist_aliases.py (R3) Second router, picked by router_scan.py: the artist-aliases / Tidy-up (P4) group ranks at 0 monkeypatch.setattr targets and 0 helpers to relocate. 5 routes (list/set/merge/delete aliases + raw-artist picker), all meta_db-only. Bodies verbatim; only @app.<m> -> @router.<m> and meta_db -> appstate.meta_db. include_router mounts at the original site; full 143-route table identical to origin/main (paths, methods, order). No test retargets: test_artist_alias drives via TestClient(server.app) + server.meta_db, neither of which moved. Verified: pyflakes clean on the router; no new undefined in server.py; JSONResponse still used in server.py (not dead); pytest 2398 passed (18 in test_artist_alias); packaging guard green; eslint 0; boot smoke drives all 5 routes end-to-end (set ACDC->AC/DC, read back, 400 on missing fields, delete). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: credit both router extractions in the size-exemptions rationale (CodeRabbit) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 18:55:03 +02:00
3 people	b3215694e7	fix(build): move appstate.py + routers/ under lib/ so the desktop app ships them (#836) ... The packaged desktop app died at startup: File ".../Resources/slopsmith/server.py", line 71, in <module> import appstate ModuleNotFoundError: No module named 'appstate' feedback-desktop's scripts/bundle-slopsmith.sh copies a HARDCODED list of core files into the bundle -- server.py, VERSION, lib/, data/, static/, plugins/__init__.py. The root-level appstate.py (#833) and routers/ (#834) shipped fine in Docker, passed every test, and were silently dropped from the packaged app. Both now live under lib/, the one core directory every packaging path already copies wholesale -- Dockerfile `COPY lib/`, docker-compose.yml, and the desktop bundler's `cp -r lib` -- and that all three put on sys.path (on Windows via the embeddable-Python ._pth, where PYTHONPATH is ignored: build-windows.sh writes `../slopsmith` and `../slopsmith/lib`). No feedback-desktop change and no new release are needed for this to take effect. lib/ is also the CORRECT home under Principle V, and always was once the design settled: with the injection seam, appstate.py constructs nothing and does no import-time IO, and a route module only builds an APIRouter. The premise that forced root placement -- "appstate opens sqlite at import" -- stopped being true when configure() replaced ownership. The Dockerfile / .dockerignore / docker-compose.yml entries added for the root layout are reverted; nothing else in core changes (git mv, so --follow survives). tests/test_packaging.py is the guard: it walks server.py's module-level imports, keeps the ones resolving inside this repo, and fails if any lives outside a directory the packagers copy -- with the ModuleNotFoundError spelled out. So the next root-level core module can't ship broken. Negative-checked: restoring appstate.py to the root fails it; the message names the file and the four packaging files a root module would have to teach. (It also has to skip `origin in {"built-in","frozen"}` -- on 3.14 the frozen stdlib reports origin="frozen", and Path("frozen").resolve() lands inside the repo, which flagged `os` and `stat` as first-party.) Verified: the bundler's copy replicated exactly into a temp dir and booted with PYTHONPATH=<bundle>:<bundle>/lib -- `import server`, `import appstate`, `import routers.audio_effects` all resolve, appstate.meta_db is server.meta_db, 143 routes. The same simulation against origin/main reproduces the production ModuleNotFoundError. pytest 2398 passed (2348 + 50 new); route table still identical to origin/main (paths, methods, order); docker build context reaches lib/appstate.py and lib/routers/ with no __pycache__; native uvicorn boot smoke serves /api/version, /api/library, the moved audio-effects router, and all three migrated plugins' src/ graphs; eslint 0 errors. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 17:16:34 +02:00
3 people	ebe59d3f97	refactor(server): extract the audio-effects routes into routers/audio_effects.py (R3) (#834) ... The first route module through the appstate seam (#833). Picked BY MEASUREMENT, not by the plan's guess: a transitive dep-closure scan over every route group ranked audio-effects at 0 monkeypatch.setattr targets and exactly one exclusive helper. (The same scan disproved the plan's assumption that artists/aliases was free -- api_artist_links reaches _mb_http_get and _enrich_network_enabled, both setattr targets.) Bodies are verbatim. The only edits are mechanical: @app.get(...) -> @router.get(...) audio_effect_mappings.x -> appstate.audio_effect_mappings.x The singleton read must stay a module attribute resolved at call time, so a re-imported server re-publishes a fresh DB into the seam and monkeypatch reaches this module. `routers/` never imports `server`: server -> routers -> appstate. `app.include_router(...)` sits exactly where the routes used to be defined -- FastAPI matches in registration order, so the mount site preserves it. Verified by diffing the FULL route table against origin/main: 143 routes, identical paths, methods AND order. server.py: 9,445 -> 9,386 lines. `fastapi.Query` went dead with the move and was removed (the other four unused imports are pre-existing on main). Packaging: COPY routers/ /app/routers/ plus `!routers/` + `!routers/**` in .dockerignore (that file opens with a blanket `*`). Verified against the real docker daemon: routers/ reaches the build context, __pycache__ does not. Verified: pyflakes clean on routers/; no new undefined name in server.py; pytest 2348 passed (75 in the audio-effects + demo-mode suites); eslint 0 errors; boot smoke drives all five routes end-to-end (create -> read back -> activate -> clear -> delete -> 404 on missing -> 400 on bad body), Query(...) still 422s on a missing required param, and demo mode still 403s all four moved write routes while allowing the read. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 15:24:31 +02:00