chore: stop tracking .AGENTTRASH — the purger deletes tracked files, dirtying every host

The deletion policy moves in-repo deletions into .AGENTTRASH/ beside the item,
and .gitignore line 25 already declares it ignored. But 37 retired payloads were
committed before that rule existed, and gitignore never applies to tracked paths.
Consequence measured 2026-10-31: Dankserver's deploy checkout reported 37 tracked
deletions — exactly every tracked trash file — because the approved purger had
done its job. Any host that purges is permanently dirty, and a future pull that
touches one of those paths aborts mid-deploy with 'local changes would be
overwritten' while the tree is in fact clean of real edits.

Untrack the four dirs; the bytes stay on disk and in history (they always were
recoverable from git, which is what the trash policy's 'temporary hold, not an
archive' means). tests/deployment_scoping.bats asserts the staged chat template
exists on disk — it still does, so the seam is untouched.

.AGENTTRASH/frank-default-small.env.llama.cpp

@@ -1,71 +0,0 @@
-# Tunables for frank-default-small (Tiel-Coder-35B-A3B UD-Q6_K_XL,
-# qwen35moe hybrid MoE, Dankserver, RTX 3090).
-#
-# Runtime: upstream llama.cpp (latest master, CUDA build with
-# -DGGML_CUDA_FA_ALL_QUANTS=ON -DCMAKE_CUDA_ARCHITECTURES=86) on RTX 3090
-# 24 GB; Ryzen 7 7700X; 62 GB RAM.  Replaced the ik_llama.cpp Ornith
-# CRACK Q8_0 deployment on 2026-09-01.
-#
-# Model: peculiar-ragdoll/Tiel-Coder-35B-A3B-GGUF, UD-Q6_K_XL quant
-# (30 GB).  Architecture: qwen35moe — 40 layers, full_attention_interval=4
-# (10 attention + 30 SSM/Mamba), 256 experts / 8 used, 2 KV heads × 256
-# dim, embedding 2048, rope dimension_count 64, rope freq_base 10 000 000.
-# Text-only (no mmproj).  Built-in chat template in the GGUF.
-#
-# Expert offload: --cpu-moe keeps all 256 expert weights in CPU RAM.
-# Non-expert weights (~1.6 GB) fit entirely on the 24 GB card.
-#
-# KV cache: Q8_0 for both K and V.  With CTX_SIZE=200700 (66 900 per slot
-# × 3 parallel) and 10 attention layers, the KV cache is ~2 GB — the
-# requested 2 GB VRAM buffer.
-#
-# WARNING: do not name any variable TEMP, HOST, or GPU_MAX_HEAP_SIZE. The
-# ROCm HIP runtime reads those bare env vars (see the 2026-08-13 TEMP
-# incident). This box is NVIDIA/CUDA, but the rule keeps the env portable.
-
-# Model file (UD-Q6_K_XL, 30 GB, text-only MoE hybrid).
-MODEL_DIR=/home/dank/models/tiel-coder-35b
-MODEL_FILE=Tiel-Coder-35B-A3B-UD-Q6_K_XL.gguf
-
-# Upstream llama.cpp llama-server (CUDA build, latest master).
-# Built with -DGGML_CUDA_FA_ALL_QUANTS=ON -DCMAKE_CUDA_ARCHITECTURES=86
-# using the staged CUDA 13.2 toolkit at /home/dank/cuda13-stage.
-LLAMA_SERVER=/home/dank/llama.cpp/build/bin/llama-server
-
-ALIAS=frank-default-small
-BIND_ADDR=0.0.0.0
-LISTEN_PORT=7770
-
-# Total context budget across all parallel slots.  200700 / 3 = 66 900
-# per slot.  The model's context_length is 262 144, so 66 900 is well
-# within range.
-CTX_SIZE=200700
-PARALLEL=3
-
-# Expert offload: all MoE expert weights pinned to CPU RAM.
-CPU_MOE=1
-
-# All non-expert layers on GPU (auto-fit will determine the exact count;
-# with --cpu-moe the non-expert footprint is ~1.6 GB, leaving ample room).
-N_GPU_LAYERS=999
-
-# KV cache: Q8_0 for both K and V.  ~2 GB total for 200700 ctx × 3 slots
-# × 10 attention layers × (2 KV heads × 256 dim × 1 byte) × 2 (K+V).
-CACHE_TYPE_K=q8_0
-CACHE_TYPE_V=q8_0
-
-VERBOSITY=2
-
-# Prefill batch sizing.
-BATCH_SIZE=4096
-UBATCH_SIZE=1024
-
-# Sampling.
-TEMPERATURE=1.0
-TOP_K=20
-TOP_P=0.95
-MIN_P=0.0
-
-# Compute threads lowered so other processes keep a core.
-THREADS=7
-THREADS_HTTP=8

.AGENTTRASH/frank-default-small.service.llama.cpp

@@ -1,16 +0,0 @@
-[Unit]
-Description=llama.cpp Tiel-Coder-35B-A3B Q6_K_XL qwen35moe hybrid MoE (dankserver, frank-default-small)
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=dank
-Group=dank
-Environment="FRANK_SMALL_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-default-small.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-small.sh
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target

.AGENTTRASH/frank-dragoon.env.llama.cpp

@@ -1,126 +0,0 @@
-# Tunables for frank-dragoon (kingjones777/Qwen3.8-Flash-Next-ROCmFP4-
-# STRIX-GGUF on the kingjones30/ROCmFPX llama.cpp runtime, Dankclaw,
-# Strix Halo gfx1151, unified memory).
-#
-# Runtime: kingjones30/ROCmFPX (fork of charlie12345/ROCmFPX with the
-# qwen4exp-on-rocmfpx-d3ca537 patch applied — the model card's pinned
-# runtime: ROCmFP4 tensor types AND the qwen4exp architecture in one
-# tree; stock llama.cpp and charlie's fork alone cannot load this GGUF).
-# Built per the card recipe:
-#   cmake -B build -DGGML_HIP=ON -DGPU_TARGETS=gfx1151 -DGGML_NATIVE=ON -DCMAKE_BUILD_TYPE=Release
-# at /home/dank/GitPackages/kingjones-ROCmFPX/build.
-# Replaced the agentionai ROCmFP4-FAST imatrix deployment (charlie's
-# build-qwen38 runtime) on 2026-08-30.
-#
-# Model: Qwen3.8-Flash-Next base (qwen4exp MoE: 512 experts / 10 used,
-# 48 layers = 12 attention + 36 SSM, QSA indexer, hyper-connections, PLE
-# at layer 1), Q4_0_ROCMFP4_STRIX (file_type 105), 113.47 GiB single
-# file. STRIX is the top quality tier: PLE table at Q8_0 (50.66 GiB),
-# token embeddings + lm head at Q6_K. The PLE table NEVER enters GPU
-# memory — it streams from the file through the OS page cache. Two hard
-# card constraints:
-#  1. mmap MUST stay enabled (default) — --no-mmap forces the 50.66 GiB
-#     table into anonymous memory and the cgroup killer takes the
-#     process with nothing in the server log (only dmesg).
-#  2. Do NOT pin the PLE tensor to CPU with -ot — measured gen fell
-#     ~23 -> 13.4 tok/s; the kernel streams it better.
-# NOTE: the card's own build_attn_qsa still calls ggml_fill on the
-# F16-cast kq mask (the path that aborted our charlie build with
-# --flash-attn on before scripts/patches/qwen4exp-qsa-f32-mask.patch).
-# If a clean kingjones-tree build aborts graph build with
-# GGML_ASSERT(a-type == GGML_TYPE_F32), port that fix (F32 base mask +
-# cast at the attention call) into this tree and rebuild.
-#
-# WARNING: do not name any variable TEMP, HOST, or GPU_MAX_HEAP_SIZE. The ROCm HIP runtime reads those bare env vars (see the 2026-08-13 TEMP
-# incident). llama.cpp reads --host/--port/--temp as CLI flags, never as
-# env vars.
-
-# kingjones30/ROCmFPX runtime binary (card recipe build).
-LLAMA_BIN=/home/dank/GitPackages/kingjones-ROCmFPX/build/bin/llama-server
-
-# Model package from
-# https://huggingface.co/kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF
-# Layout: single unsharded GGUF, text-only (the repo ships no mmproj;
-# the vision tower below is borrowed from the agentionai FAST package —
-# same base model, f16 — kept only if it loads clean, drop
-# MMPROJ_PATH if it does not).
-MODEL_DIR=/home/dank/models/kingjones-Qwen3.8-Flash-Next-ROCmFP4-STRIX
-MODEL_FILE=Qwen3.8-Flash-Next-Q4_0-ROCmFP4-STRIX.gguf
-MMPROJ_PATH=/home/dank/models/agentionai-Qwen3.8-Flash-Next-ROCmFP4-FAST/mmproj/mmproj-Qwen3.8-Flash-Next-f16.gguf
-
-# Qwen-Sharp chat template (tracked in the repo, staged on the host). The
-# Sharp template drives thinking on by default (medium effort); the server
-# emits reasoning in DeepSeek format so clients receive reasoning_content
-# separately instead of literal thinking tags in content.
-CHAT_TEMPLATE_FILE=/home/dank/serverAppConfigs/scripts/chat-template.jinja
-CHAT_TEMPLATE_KWARGS='{"enable_thinking":true,"preserve_thinking":true,"preserve_reasoning":true}'
-
-# Alias + network.
-ALIAS=frank-dragoon
-BIND_ADDR=0.0.0.0
-LISTEN_PORT=7770
-
-# Serving: 401408-token context, TWO slots (parallel 2), batch 4096 /
-# ubatch 512, 16+16 threads, f16 KV, 16 context checkpoints, 8 GiB
-# prompt cache. --fit off: auto-fit segfaults on this model's
-# hyper-connection/indexer config; -ngl 999 puts every layer on the
-# SVM-backed GPU pool. ubatch 512 matches the card's re-measurement
-# (-ub 1024/2048/4096 showed no effect; -t 32 vs 16 is noise).
-#
-# CTX_SIZE=401408 / PARALLEL=2: carried over from the FAST deployment
-# where it loaded clean (~74 s, health 200). The card measures the full
-# 262144 window at ~71.7 GiB GTT at load on the same 128 GB board; QSA
-# caps KV growth so the extra window is cheap. KV footprint scales
-# with the 12 attention layers only. Verify load on first STRIX boot.
-CTX_SIZE=401408
-PARALLEL=2
-
-BATCH_SIZE=4096
-UBATCH_SIZE=512
-NUM_THREADS=16
-THREAD_BATCH=16
-CACHE_TYPE_K=f16
-CACHE_TYPE_V=f16
-CTX_CHECKPOINTS=16
-CACHE_RAM=8192
-SLOT_SAVE_PATH=/home/dank/serverAppConfigs/scripts/slot-state
-SPLIT_MODE=none
-FIT=off
-NGL=999
-FLASH_ATTN=on
-
-# Sampling (card instruct table, non-thinking).
-TEMPERATURE=0.7
-TOP_K=20
-TOP_P=0.8
-MIN_P=0.0
-PRESENCE_PENALTY=1.5
-
-# Reasoning on (Sharp template drives it; preserve_thinking + preserve_reasoning
-# keep the reasoning trail in the conversation). DeepSeek format projects the
-# reasoning into the API's reasoning_content field instead of literal thinking
-# tags.
-REASONING=on
-REASONING_FORMAT=deepseek
-
-# Strix Halo unified memory + native gfx1151.
-HSA_OVERRIDE_GFX_VERSION=11.5.1
-
-VERBOSITY=4
-
-
-# Speculative decoding: disabled. The card's Usage block ships no spec
-# flags. The Flash-Next MTP heads do not load on this loader (requires
-# per-layer blk.N.hc_attn_norm; every head carries only blk.48 —
-# verified 3x on build-qwen38). DRAFT_MODEL_* point at the retired
-# agentionai FAST head and are unused while SPEC_TYPE=none.
-DRAFT_MODEL_DIR=/home/dank/models/mtp-Qwen3.8-Flash-Next-FAST
-DRAFT_MODEL_FILE=Qwen3.8-Flash-Next-MTP-ROCmFP4-FAST.gguf
-SPEC_TYPE=none
-SPEC_DRAFT_N_MAX=3
-SPEC_DRAFT_N_MIN=0
-SPEC_DRAFT_P_MIN=0.75
-SPEC_DRAFT_NGL=999
-SPEC_DRAFT_DEVICE=ROCm0
-SPEC_DRAFT_TYPE_K=f16
-SPEC_DRAFT_TYPE_V=f16

.AGENTTRASH/frank-dragoon.service.llama.cpp

@@ -1,16 +0,0 @@
-[Unit]
-Description=ROCmFPX (kingjones30 fork) llama.cpp Qwen3.8-Flash-Next ROCmFP4 STRIX 177B MoE (dankclaw, frank-dragoon)
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=dank
-Group=dank
-Environment="FRANK_DRAGOON_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-dragoon.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-dragoon.sh
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target

.AGENTTRASH/frank-npu.env.flm-npu

@@ -1,23 +0,0 @@
-# Tunables for frank-npu (FastFlowLM NPU endpoint, Dankclaw)
-# Runtime: FLM 1.0.1 (/usr/bin/flm) on the XDNA2 NPU (50 TOPS). Boot tag is
-# nuextract3:4b (NuExtract3-4B-NPU2, Qwen3.5-4B skeleton, structured-extraction
-# model); serve routes every request by the exact FLM registry tag in the
-# request's model field, so any registered tag (gemma4-it:e4b, qwythos:9b, ...)
-# is reachable on this port regardless of the boot tag. The NPU is a
-# single-lane device: generations serialize FIFO, and the first request after a
-# model swap pays the ~6-11 s load cost. The NPU draws from the unified RAM
-# pool shared with frank-dragoon (iGPU).
-FLM_MODEL=nuextract3:4b
-FLM_HOST=0.0.0.0
-FLM_PORT=7771
-# turbo = max NPU power mode (xrt-smi configure --pmode turbo at serve start).
-# No other tenant uses the NPU on this host, so the top mode costs nothing to
-# neighbours; drop to `performance` if iGPU power-budget contention ever shows.
-FLM_PMODE=turbo
-# FLM_ASR=1 additionally loads Whisper-V3-Turbo-NPU2 (+0.62 GB) and exposes
-# /v1/audio/transcriptions. NuExtract3 answers text-only; audio stays off.
-FLM_ASR=0
-# -1 = no --ctx-len flag: every pack loads with its own trained context
-# (nuextract3:4b -> 32768, gemma4-it:e4b -> 131072). A global override would
-# over-allocate KV for the small packs.
-FLM_CTX_LEN=-1

.AGENTTRASH/frank-npu.service.flm-npu

@@ -1,17 +0,0 @@
-[Unit]
-Description=FastFlowLM NPU sight+sound inference (frank-npu) on Dankclaw
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=dank
-Group=dank
-Environment="FRANK_NPU_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-npu.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-npu.sh
-LimitMEMLOCK=infinity
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target

.AGENTTRASH/serve-frank-dragoon.sh.llama.cpp

@@ -1,180 +0,0 @@
-#!/usr/bin/env bash
-# Serve kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF as
-# frank-dragoon via the kingjones30/ROCmFPX llama.cpp runtime on
-# Dankclaw (Strix Halo gfx1151, unified memory).
-#
-# Runtime: kingjones30/ROCmFPX (fork of charlie12345/ROCmFPX with the
-# model card's qwen4exp-on-rocmfpx patch) built at
-# /home/dank/GitPackages/kingjones-ROCmFPX/build (HIP, gfx1151,
-# ROCm 7.2.4, card recipe). The ROCmFP4 quant types plus the qwen4exp
-# architecture must be in one tree; stock llama.cpp cannot load this
-# GGUF.
-#
-# Model: Qwen3.8-Flash-Next base (qwen4exp MoE: 512 experts / 10 used,
-# 48 layers = 12 attention + 36 SSM, QSA indexer, hyper-connections, PLE
-# at layer 1) quantized Q4_0_ROCMFP4_STRIX, 113.47 GiB single file. The
-# 50.66 GiB PLE n-gram table stays OUT of GPU memory and streams via
-# mmap from the OS page cache — never add --no-mmap or -ot for it.
-#
-# Profile: card sampling table (temp 0.7, top_p 0.80, top_k 20, min_p 0.0,
-# presence 1.5 — non-thinking instruct) mixed with the validated serving
-# profile: ctx 401408 x 2 slots, b 4096 / ub 512, t 16 / tb 16, f16 KV,
-# fa on (if the graph build aborts on the QSA F16 mask, see the note in
-# the env file: port scripts/patches/qwen4exp-qsa-f32-mask.patch into
-# this tree and rebuild), cont-batching, prompt cache + 8 GiB cache-ram
-# + idle-slot cache, 16 ctx checkpoints, --fit off (auto-fit segfaults
-# on qwen4exp hyper-connection config). Speculative decoding off: the
-# Flash-Next MTP heads do not load on this loader; the card ships no
-# spec flags.
-set -euo pipefail
-
-SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_DRAGOON_ENV_FILE:-$SCRIPT_DIR/frank-dragoon.env}"
-if [[ -f "$ENV_FILE" ]]; then
-    set -a
-    # shellcheck disable=SC1090
-    source "$ENV_FILE"
-    set +a
-fi
-
-# --- defaults (used when the env file does not set them) -------------------
-: "${LLAMA_BIN:=/home/dank/GitPackages/kingjones-ROCmFPX/build/bin/llama-server}"
-: "${MODEL_DIR:=/home/dank/models/kingjones-Qwen3.8-Flash-Next-ROCmFP4-STRIX}"
-: "${MODEL_FILE:=Qwen3.8-Flash-Next-Q4_0-ROCmFP4-STRIX.gguf}"
-: "${MMPROJ_PATH:=/home/dank/models/agentionai-Qwen3.8-Flash-Next-ROCmFP4-FAST/mmproj/mmproj-Qwen3.8-Flash-Next-f16.gguf}"
-: "${CHAT_TEMPLATE_FILE:=$SCRIPT_DIR/chat-template.jinja}"
-: "${CHAT_TEMPLATE_KWARGS:={}}"
-: "${ALIAS:=frank-dragoon}"
-: "${BIND_ADDR:=0.0.0.0}"
-: "${LISTEN_PORT:=7770}"
-: "${CTX_SIZE:=401408}"
-: "${PARALLEL:=2}"
-: "${BATCH_SIZE:=4096}"
-: "${UBATCH_SIZE:=512}"
-: "${NUM_THREADS:=16}"
-: "${THREAD_BATCH:=16}"
-: "${CACHE_TYPE_K:=f16}"
-: "${CACHE_TYPE_V:=f16}"
-: "${CTX_CHECKPOINTS:=16}"
-: "${CACHE_RAM:=8192}"
-: "${SLOT_SAVE_PATH:=$SCRIPT_DIR/slot-state}"
-: "${SPLIT_MODE:=none}"
-: "${FIT:=off}"
-: "${NGL:=999}"
-: "${FLASH_ATTN:=on}"
-: "${TEMPERATURE:=0.7}"
-: "${TOP_K:=20}"
-: "${TOP_P:=0.8}"
-: "${MIN_P:=0.0}"
-: "${PRESENCE_PENALTY:=1.5}"
-: "${REASONING:=on}"
-: "${REASONING_FORMAT:=deepseek}"
-: "${HSA_OVERRIDE_GFX_VERSION:=11.5.1}"
-: "${SPEC_TYPE:=none}"
-: "${DRAFT_MODEL_DIR:=/home/dank/models/mtp-Qwen3.8-Flash-Next-FAST}"
-: "${DRAFT_MODEL_FILE:=Qwen3.8-Flash-Next-MTP-ROCmFP4-FAST.gguf}"
-: "${SPEC_DRAFT_N_MAX:=3}"
-: "${SPEC_DRAFT_N_MIN:=0}"
-: "${SPEC_DRAFT_P_MIN:=0.75}"
-: "${SPEC_DRAFT_NGL:=999}"
-: "${SPEC_DRAFT_DEVICE:=ROCm0}"
-: "${SPEC_DRAFT_TYPE_K:=f16}"
-: "${SPEC_DRAFT_TYPE_V:=f16}"
-
-MODEL="$MODEL_DIR/$MODEL_FILE"
-for f in "$LLAMA_BIN" "$MODEL" "$CHAT_TEMPLATE_FILE"; do
-    if [[ ! -r "$f" ]]; then
-        echo "missing or unreadable required artifact: $f" >&2
-        exit 1
-    fi
-done
-if [[ ! -x "$LLAMA_BIN" ]]; then
-    echo "missing executable runtime: $LLAMA_BIN" >&2
-    exit 1
-fi
-
-# --- speculative decoding (MTP draft head) ---------------------------------
-# The MTP draft head is a separate GGUF sidecar loaded via --spec-draft-model
-# (alias --model-draft).  ngram-only specs do not need a draft file.
-# Set SPEC_TYPE=none in the env to disable speculative decoding entirely.
-SPEC_ARGS=()
-if [[ -n "$SPEC_TYPE" && "$SPEC_TYPE" != "none" ]]; then
-    SPEC_ARGS=(
-        --spec-type "$SPEC_TYPE"
-        --spec-draft-n-max "$SPEC_DRAFT_N_MAX"
-        --spec-draft-n-min "$SPEC_DRAFT_N_MIN"
-        --spec-draft-p-min "$SPEC_DRAFT_P_MIN"
-    )
-    if [[ "$SPEC_TYPE" == *draft-mtp* ]]; then
-        DRAFT_MODEL="$DRAFT_MODEL_DIR/$DRAFT_MODEL_FILE"
-        if [[ ! -r "$DRAFT_MODEL" ]]; then
-            echo "missing or unreadable draft model: $DRAFT_MODEL" >&2
-            exit 1
-        fi
-        SPEC_ARGS+=(
-            --spec-draft-model "$DRAFT_MODEL"
-            --spec-draft-ngl "$SPEC_DRAFT_NGL"
-            --spec-draft-device "$SPEC_DRAFT_DEVICE"
-            --spec-draft-type-k "$SPEC_DRAFT_TYPE_K"
-            --spec-draft-type-v "$SPEC_DRAFT_TYPE_V"
-        )
-    fi
-    if [[ -n "${SPEC_DRAFT_P_SPLIT:-}" ]]; then
-        SPEC_ARGS+=(--spec-draft-p-split "$SPEC_DRAFT_P_SPLIT")
-    fi
-fi
-
-# The STRIX repo ships no mmproj; this is the agentionai FAST package's
-# f16 vision tower for the same base model. Passed only when readable.
-MMPROJ_ARGS=()
-if [[ -n "${MMPROJ_PATH:-}" && -r "${MMPROJ_PATH:-}" ]]; then
-    MMPROJ_ARGS=(--mmproj "$MMPROJ_PATH")
-fi
-
-SERVER_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-mkdir -p "$SLOT_SAVE_PATH"
-ROCM_PATH="${ROCM_PATH:-/opt/rocm}"
-LIBRARY_PATH="$SERVER_DIR:$ROCM_PATH/lib:$ROCM_PATH/lib/rocm_sysdeps/lib:$ROCM_PATH/lib/llvm/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
-
-exec /usr/bin/env \
-    ROCM_PATH="$ROCM_PATH" \
-    HIP_VISIBLE_DEVICES=0 \
-    LD_LIBRARY_PATH="$LIBRARY_PATH" \
-    HSA_OVERRIDE_GFX_VERSION="$HSA_OVERRIDE_GFX_VERSION" \
-    "$LLAMA_BIN" \
-    --model "$MODEL" \
-    --alias "$ALIAS" \
-    --chat-template-file "$CHAT_TEMPLATE_FILE" \
-    --chat-template-kwargs "$CHAT_TEMPLATE_KWARGS" \
-    --host "$BIND_ADDR" \
-    --port "$LISTEN_PORT" \
-    --jinja \
-    --device ROCm0 \
-    --gpu-layers "$NGL" \
-    --split-mode "$SPLIT_MODE" \
-    --parallel "$PARALLEL" \
-    --ctx-size "$CTX_SIZE" \
-    --batch-size "$BATCH_SIZE" \
-    --ubatch-size "$UBATCH_SIZE" \
-    --fit "$FIT" \
-    --flash-attn "$FLASH_ATTN" \
-    --cache-type-k "$CACHE_TYPE_K" \
-    --cache-type-v "$CACHE_TYPE_V" \
-    --threads "$NUM_THREADS" \
-    --threads-batch "$THREAD_BATCH" \
-    --ctx-checkpoints "$CTX_CHECKPOINTS" \
-    --cache-ram "$CACHE_RAM" \
-    --slot-save-path "$SLOT_SAVE_PATH" \
-    --cache-prompt \
-    --cache-idle-slots \
-    --metrics \
-    --temp "$TEMPERATURE" \
-    --top-p "$TOP_P" \
-    --top-k "$TOP_K" \
-    --min-p "$MIN_P" \
-    --presence-penalty "$PRESENCE_PENALTY" \
-    --reasoning "$REASONING" \
-    --reasoning-format "$REASONING_FORMAT" \
-    --reasoning-budget -1 \
-    "${MMPROJ_ARGS[@]}" \
-    "${SPEC_ARGS[@]}"

.AGENTTRASH/serve-frank-npu.sh.flm-npu

@@ -1,62 +0,0 @@
-#!/usr/bin/env bash
-# Serve the FastFlowLM (FLM) sight+sound endpoint — frank-npu.
-#
-# Runs `flm serve <tag>` on the XDNA2 NPU (50 TOPS, Dankclaw). The NPU is a
-# single-lane device: generations serialize in FIFO order, so this is a
-# background/triage endpoint, not an interactive multi-user chat. The NPU
-# draws from the unified RAM pool shared with frank-dragoon (the iGPU
-# llama.cpp service); see serverAppConfigs-docs/LLM/frank-npu.md
-# for the memory budget and the model-selection tradeoff.
-#
-# NOTE: FLM requires unlimited memlock. The unit sets LimitMEMLOCK=infinity.
-# NOTE: an unknown model tag does NOT 404 — /v1/chat/completions answers HTTP 200 with a
-# flat {"error":"Failed to load <tag> model!"} body and no choices; /v1/completions returns a
-# nested OpenAI-shaped server_error (code 500) also under HTTP 200. Client model IDs must be the exact FLM registry
-# tag (e.g. gemma4-it:e4b), never a service alias. Custom tags only resolve
-# when FLM_CONFIG_PATH points at the user registry that carries them and their
-# kernels are symlinked into /home/dank/.config/flm/xclbins/<PackName>.
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_NPU_ENV_FILE:-$SCRIPT_DIR/frank-npu.env}"
-if [[ -f "$ENV_FILE" ]]; then
-    set -a
-    # shellcheck disable=SC1090
-    source "$ENV_FILE"
-    set +a
-fi
-
-# --- defaults (used when the env file does not set them) -------------------
-: "${FLM_BIN:=/usr/bin/flm}"
-: "${FLM_MODEL:=gemma4-it:e4b}"
-: "${FLM_HOST:=0.0.0.0}"
-: "${FLM_PORT:=7771}"
-: "${FLM_PMODE:=turbo}"
-: "${FLM_ASR:=0}"
-: "${FLM_CTX_LEN:=131072}"
-
-# The user registry is a superset of the system registry (it carries the
-# custom tags too), and its model_path resolves relative to the registry file,
-# so exports keep a tag swap in the env file from needing script edits.
-export FLM_CONFIG_PATH="${FLM_CONFIG_PATH:-/home/dank/.config/flm/model_list.json}"
-export FLM_XCLBIN_PATH="${FLM_XCLBIN_PATH:-/home/dank/.config/flm/xclbins}"
-
-if [[ ! -x "$FLM_BIN" ]]; then
-    echo "missing flm binary: $FLM_BIN" >&2
-    exit 1
-fi
-
-# --- optional flags ----------------------------------------------------------
-OPT_ARGS=()
-if [[ "${FLM_ASR}" != "0" ]]; then
-    OPT_ARGS+=(--asr "${FLM_ASR}")
-fi
-if [[ "${FLM_CTX_LEN}" != "-1" ]]; then
-    OPT_ARGS+=(--ctx-len "${FLM_CTX_LEN}")
-fi
-
-exec "$FLM_BIN" serve "$FLM_MODEL" \
-    --host "$FLM_HOST" \
-    -p "$FLM_PORT" \
-    --pmode "$FLM_PMODE" \
-    "${OPT_ARGS[@]}"

.AGENTTRASH/serve-frank-small.sh.llama.cpp

@@ -1,87 +0,0 @@
-#!/usr/bin/env bash
-# Serve peculiar-ragdoll/Tiel-Coder-35B-A3B (UD-Q6_K_XL) as
-# frank-default-small via stock llama.cpp on Dankserver (RTX 3090).
-#
-# Runtime: upstream llama.cpp (latest master, CUDA build with
-# -DGGML_CUDA_FA_ALL_QUANTS=ON -DCMAKE_CUDA_ARCHITECTURES=86).
-# The model is a 35B-total / 8-active MoE hybrid (qwen35moe arch) with
-# SSM/Mamba layers (full_attention_interval=4: 10 attention + 30 SSM
-# layers out of 40).  256 experts, 8 used per token.
-#
-# Expert offload: --cpu-moe keeps all 256 expert weights in CPU RAM.
-# Non-expert weights (attention, SSM, shared expert, embeddings, output)
-# are ~1.6 GB and fit entirely on the 24 GB RTX 3090.
-#
-# KV cache: Q8_0 for both K and V.  With CTX_SIZE=200700 (66 900 per
-# slot × 3 parallel) and 10 attention layers (2 KV heads × 256 dim),
-# the KV cache is ~2 GB — the requested 2 GB VRAM buffer.
-#
-# Model is loaded with mmap (default).  The 30 GB Q6_K_XL file is
-# memory-mapped; only accessed pages enter RAM.
-#
-# Tunables come from frank-default-small.env unless FRANK_SMALL_ENV_FILE
-# overrides that path.
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_SMALL_ENV_FILE:-$SCRIPT_DIR/frank-default-small.env}"
-if [[ -f "$ENV_FILE" ]]; then
-    set -a
-    # shellcheck disable=SC1090
-    source "$ENV_FILE"
-    set +a
-fi
-
-# --- defaults (used when the env file does not set them) -----------------
-: "${MODEL_DIR:=/home/dank/models/tiel-coder-35b}"
-: "${MODEL_FILE:=Tiel-Coder-35B-A3B-UD-Q6_K_XL.gguf}"
-: "${LLAMA_SERVER:=/home/dank/llama.cpp/build/bin/llama-server}"
-: "${ALIAS:=frank-default-small}"
-: "${BIND_ADDR:=0.0.0.0}"
-: "${LISTEN_PORT:=7770}"
-: "${CTX_SIZE:=200700}"
-: "${PARALLEL:=3}"
-: "${CACHE_TYPE_K:=q8_0}"
-: "${CACHE_TYPE_V:=q8_0}"
-: "${N_GPU_LAYERS:=999}"
-: "${BATCH_SIZE:=4096}"
-: "${UBATCH_SIZE:=1024}"
-: "${VERBOSITY:=2}"
-: "${CPU_MOE:=1}"
-: "${TEMPERATURE:=1.0}"
-: "${TOP_K:=20}"
-: "${TOP_P:=0.95}"
-: "${MIN_P:=0.0}"
-: "${THREADS:=7}"
-: "${THREADS_HTTP:=8}"
-
-MODEL="$MODEL_DIR/$MODEL_FILE"
-
-if [[ ! -f "$MODEL" ]]; then
-    echo "missing required file: $MODEL" >&2
-    exit 1
-fi
-if [[ ! -x "$LLAMA_SERVER" ]]; then
-    echo "missing llama-server binary: $LLAMA_SERVER" >&2
-    exit 1
-fi
-
-exec "$LLAMA_SERVER" \
-    --model "$MODEL" \
-    $([ "$CPU_MOE" = "1" ] && printf -- "--cpu-moe") \
-    --cache-type-k "$CACHE_TYPE_K" \
-    --cache-type-v "$CACHE_TYPE_V" \
-    --ctx-size "$CTX_SIZE" \
-    --parallel "$PARALLEL" \
-    --gpu-layers "$N_GPU_LAYERS" \
-    --batch-size "$BATCH_SIZE" \
-    --ubatch-size "$UBATCH_SIZE" \
-    --temp "$TEMPERATURE" \
-    --top-k "$TOP_K" \
-    --top-p "$TOP_P" \
-    --min-p "$MIN_P" \
-    --threads "$THREADS" \
-    --threads-http "$THREADS_HTTP" \
-    --alias "$ALIAS" \
-    --host "$BIND_ADDR" \
-    --port "$LISTEN_PORT"

AGENTS.md

@@ -156,6 +156,15 @@ Unit requirements:
   (`<host>/<svc>/quadlet/`), is installed by the deployer, and is covered by
   the quadlet test seam. The host-side unit is generated state; the repo file
   is the source of truth.
+- **Bind-source gate** — a unit whose `Volume=` source is a mount this host owns
+  (the entropy array, the metadata view) carries
+  `ExecStartPre=/home/dank/serverAppConfigs/scripts/wait-for-mount.sh <source>`.
+  Measured 2026-10-31: in a **rootless** unit `RequiresMountsFor=` is inert (the
+  user manager cannot order against the system's mount unit), and
+  `ConditionPathIsMountPoint=` is fail-*dead* — an unmet condition logs `skipped,
+  unmet condition check` with `NRestarts=0` and no start attempt ever follows.
+  Bind the array before it is mounted and the container sees the empty pre-mount
+  directory as truth; a media scan then deletes the library it cannot see.
 
 Before declaring a service deployed: `systemctl --user is-enabled <name>` →
 `enabled`, `is-active` → `active`, and the container answers its health check.
@@ -851,6 +860,6 @@ history.
 | Benchmarking (only when ordered) | **Stop and mask the service first**, bench, unmask, restart, verify health. |
 | Deleting a file | **Move it to trash** — `.AGENTTRASH/` (in-repo) or `~/.AGENTTRASH/YYYYMMDD-topic`. Never `rm`. |
 | Relayout the movie library | **Census → plan → read the exceptions → `scripts/media-apply.py`** — renames only, journal before every move; never hand-rename, never copy. |
-| Making media metadata visible to both media servers | **Bind `/var/lib/media-meta/view`** — the overlay `scripts/media-view.sh` installs (array below, NVMe above). Never write the array; never delete through the view. |
+| Making media metadata visible to both media servers | **Bind `/var/lib/media-meta/view`** — the overlay `scripts/media-view.sh` installs (array below, NVMe above). Never write the array; never delete through the view. **Not yet deployed on Dankserver: the live quadlets still bind the array read-only — see [[Media Metadata View]].** |
 | Tests exist | **Run them** — verify tests pass after every change. Do not commit failing tests. |
 | Real secrets | **Never commit** — host `.env` files; `.env.example` holds placeholders only. |

dankserver/.AGENTTRASH/20260916-vllm-radiance/affinity-proxy.py

@@ -1,156 +0,0 @@
-#!/usr/bin/env python3
-"""HTTP front door for the frank-medium single-GPU replicas.
-
-Why two replicas instead of TP=2: one vLLM process spanning both R9700s needs
-RCCL collectives, and RCCL's kernels require PCIe atomics on every
-participating GPU. The second card sits behind chipset bridges advertising
-`AtomicOpsCap: Routing-`, which no software can enable (see the runbook), so
-no collective can launch on it. Two single-GPU replicas use both cards; this
-service keeps the fleet contract of one endpoint on :7770, streaming included.
-
-Routing decisions live in routing.py — spread single-turn requests, pin
-continuations to the replica whose prefix cache holds their context. This file
-only moves bytes: parse enough of the request to route it, forward it verbatim,
-stream the answer back, and report replica health on /health.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import os
-from contextlib import suppress
-from aiohttp import ClientSession, ClientTimeout, web
-
-import routing
-
-PORT = int(os.environ.get("PORT", "7770"))
-HEALTH_TTL = float(os.environ.get("HEALTH_TTL", "10"))
-# Hop-by-hop headers must not be forwarded (RFC 9110 §7.6.1) — forwarding
-# transfer-encoding or content-length of a rewritten body breaks clients.
-HOP_BY_HOP = {
-    "host", "content-length", "transfer-encoding", "connection",
-    "keep-alive", "proxy-authenticate", "proxy-authorization", "te",
-    "trailers", "upgrade",
-}
-
-UPSTREAMS = routing.UPSTREAMS
-# Replica health, refreshed by the watcher. Module state rather than aiohttp app
-# state: the application is frozen once the site is up.
-_UP: list[bool] = [True] * len(UPSTREAMS)
-
-
-async def health(session: ClientSession) -> web.Response:
-    results = await asyncio.gather(
-        *(session.get(u + "/health", timeout=ClientTimeout(total=5)) for u in UPSTREAMS),
-        return_exceptions=True,
-    )
-    lines, up = [], 0
-    for url, res in zip(UPSTREAMS, results):
-        if isinstance(res, Exception) or res.status != 200:
-            lines.append(f"{url} DOWN")
-        else:
-            up += 1
-            lines.append(f"{url} UP")
-    return web.Response(status=200 if up else 503, text="\n".join(lines) + "\n")
-
-
-async def watch_health() -> None:
-    """Refresh the replica up/down table so routing never targets a dead one.
-
-    One HTTP request per replica per interval, in exchange for never handing a
-    client a 502 after a restart.
-    """
-    global _UP
-    session = ClientSession()
-    try:
-        while True:
-            res = await asyncio.gather(
-                *(session.get(u + "/health", timeout=ClientTimeout(total=5)) for u in UPSTREAMS),
-                return_exceptions=True,
-            )
-            _UP = [not isinstance(r, Exception) and r.status == 200 for r in res]
-            await asyncio.sleep(HEALTH_TTL)
-    finally:
-        await session.close()
-
-
-async def proxy(request: web.Request) -> web.StreamResponse:
-    session: ClientSession = request.app["session"]
-    if request.path == "/health":
-        return await health(session)
-
-    body = await request.read()
-    headers = {k: v for k, v in request.headers.items() if k.lower() not in HOP_BY_HOP}
-
-    # Fail over before anything is written to the client. A replica that
-    # restarts is invisible to the health watcher for up to HEALTH_TTL, and a
-    # deploy restarts both replicas — without this retry a 10 s window of
-    # requests would 502 on a service that has a live card the whole time.
-    # vLLM's OpenAI endpoints are stateless per request, so re-sending a
-    # request that never reached an engine is safe; a request that failed
-    # mid-stream is not retried (that path is below).
-    tried: set[int] = set()
-    upstream = None
-    last_error = "no healthy frank-medium replica"
-    while len(tried) < len(UPSTREAMS):
-        idx = routing.route(body, request.remote, _UP)
-        if idx < 0 or idx in tried:
-            break
-        tried.add(idx)
-        target = UPSTREAMS[idx] + request.path_qs
-        try:
-            upstream = await session.request(
-                request.method, target, headers=headers, data=body or None,
-                timeout=ClientTimeout(total=None, sock_connect=10, sock_read=3600),
-            )
-            break
-        except Exception as exc:
-            # Demote at once: the watcher will confirm, but every request until
-            # then should skip this replica rather than pay the same timeout.
-            # Logged because a silent failover hides a card that is down.
-            _UP[idx] = False
-            last_error = f"{target} unreachable: {exc}"
-            print(f"proxy: failover — {target} unreachable ({exc}); retrying "
-                  f"another replica", flush=True)
-    if upstream is None:
-        # 503 when no replica was even reachable through the routing table,
-        # 502 when replicas were tried and all of them failed.
-        status = 502 if tried else 503
-        return web.Response(status=status, text=f"proxy: {last_error}\n")
-
-    out = web.StreamResponse(status=upstream.status, reason=upstream.reason)
-    for k, v in upstream.headers.items():
-        if k.lower() not in HOP_BY_HOP:
-            out.headers[k] = v
-    await out.prepare(request)
-    try:
-        async for chunk in upstream.content.iter_any():
-            await out.write(chunk)
-    except Exception:
-        # The client went away mid-stream (an aborted generation). Nothing to
-        # report: the engine sees its own cancellation.
-        pass
-    finally:
-        upstream.release()
-    with suppress(Exception):
-        await out.write_eof()
-    return out
-
-
-async def main() -> None:
-    app = web.Application(client_max_size=1024 ** 3)
-    app["session"] = ClientSession()
-    app.router.add_route("*", "/{tail:.*}", proxy)
-    runner = web.AppRunner(app)
-    await runner.setup()
-    await web.TCPSite(runner, "0.0.0.0", PORT).start()
-    print(f"proxy: :{PORT} -> {', '.join(UPSTREAMS)} routing={routing.ROUTING} "
-          f"key={routing.AFFINITY_BYTES}B known_max={routing.KNOWN_MAX}", flush=True)
-    watcher = asyncio.create_task(watch_health())
-    with suppress(asyncio.CancelledError):
-        await asyncio.gather(watcher)
-
-
-if __name__ == "__main__":
-    with suppress(KeyboardInterrupt):
-        asyncio.run(main())

dankserver/.AGENTTRASH/20260916-vllm-radiance/frank-medium-a.container

@@ -1,98 +0,0 @@
-# Quadlet unit: frank-medium replica A (rootless, boot-persistent).
-#
-# Install path on dankserver: ~/.config/containers/systemd/frank-medium-a.container
-# Unit name: frank-medium-a.service (container name: frank-medium-a)
-#
-# WHY TWO REPLICAS INSTEAD OF TP=2. The intended shape for frank-medium is one
-# tensor-parallel process across both R9700s (see frank-medium.container, kept
-# as the target). That shape cannot run on this host: RCCL's collective kernels
-# carry a hidden hostcall-buffer parameter, and the ROCr runtime refuses to
-# dispatch them on a device without PCIe atomics ("Pcie atomics not enabled,
-# hostcall not supported" -> AQL dispatch failed -> hipErrorIllegalState). The
-# second R9700 sits behind the chipset bridges 05:00.0/06:09.0, which advertise
-# `AtomicOpsCap: Routing-` — a read-only capability, so no software can enable
-# atomics on that path; the amdgpu driver's pci_enable_atomic_ops_to_root()
-# therefore fails for that GPU and KFD marks the CPU<->GPU2 link NO_ATOMICS.
-# The first R9700 sits on CPU root port 00:01.1 (Routing+) and does have
-# atomics. Result: every collective that touches GPU 2 dies at launch.
-# Two independent single-GPU replicas use both cards instead; the proxy unit
-# keeps the single :7770 endpoint. Full evidence: the frank-medium runbook.
-#
-# SHAPE. vLLM binds 0.0.0.0:7771 on the host network directly; no PublishPort.
-# MAXLEN is 114688, not the TP=2 deployment's 262144: one card carries the
-# whole model (~20 GiB of weights + drafter), leaving ~5.2 GiB of KV, and
-# 131072 does not fit (measured: needs 5.58 GiB). KV_MEM=0 lets vLLM profile
-# this shape instead of using the 2x7551-32624 pin, which is only valid at
-# TP=2/262144.
-#
-# DEVICES. /dev/kfd + /dev/dri; HIP_VISIBLE_DEVICES=0 (the first R9700). The
-# 2 GiB Raphael iGPU enumerates as index 2 and is excluded by the pin.
-# Only HIP_VISIBLE_DEVICES is set, never ROCR_VISIBLE_DEVICES: ROCR filters
-# first and HIP indexes into the filtered list, so a single-valued pair
-# (ROCR=1,HIP=1) leaves an empty device set.
-#
-# DO NOT name an environment variable TEMP, HOST or GPU_MAX_HEAP_SIZE: the
-# HIP runtime reads bare TEMP for its JIT cache path (2026-08-13 incident).
-[Unit]
-Description=frank-medium replica A — vllm-radiance MXFP4 Qwen3.8-27B on R9700 #1
-After=network-online.target
-
-[Container]
-ContainerName=frank-medium-a
-Image=localhost/radiance-vllm:0.9.3
-AddDevice=/dev/kfd
-AddDevice=/dev/dri
-GroupAdd=keep-groups
-# The upstream launcher's exact podman posture (rootless).
-PodmanArgs=--privileged --ipc=host --security-opt seccomp=unconfined --cap-add SYS_PTRACE --network=host
-Environment=HIP_VISIBLE_DEVICES=0
-Environment=SNAP=/models/Qwen3.8-27B-Uncensored-MXFP4-awq
-Environment=DRAFTER=/models/Qwen3.8-27B-DFlash2-FP8
-Environment=CHAT_TEMPLATE=/patches/qwen-fixed-v22.3.jinja
-Environment=SERVED_NAMES=frank-medium
-Environment=PORT=7771
-Environment=TP=1
-Environment=MAXSEQS=4
-Environment=CHUNK=8192
-Environment=MAXLEN=114688
-Environment=GPU_UTIL=0.98
-Environment=KV_MEM=0
-Environment=SPEC_METHOD=dflash
-Environment=SPEC=7
-# Checkpoints (rw: nothing downloads at runtime, but vLLM mmaps the shards).
-Volume=/home/dank/models:/models
-# Tokenizer files ride the HF cache; HF_HUB_OFFLINE=1 is set in the entrypoint.
-Volume=/home/dank/.cache/huggingface:/root/.cache/huggingface
-# Compile cache. Shared with the other replica and with the TP=2 target: the
-# entries are content-addressed, so shapes simply add subdirectories.
-Volume=/home/dank/.radiance-cache-w4a8-093-gdnm-nqft-fp8s-gnq:/cache
-# The pinned radiance clone: patches applied at every container start.
-Volume=/home/dank/GitPackages/radiance-vllm-mxfp4:/patches:z
-# The patched libr4d (pin b9e42ab + repo extras, key b9e42ab-rx6). The image's
-# shipped r4d.so predates the GDN overflow fix and NaNs this model.
-Volume=/home/dank/.cache/radiance-libr4d/b9e42ab-rx6:/r4d:z
-# Entrypoint + healthcheck from this checkout, mounted read-only.
-Volume=/home/dank/serverAppConfigs/dankserver/frank-medium/radiance-entrypoint.sh:/usr/local/bin/frank-medium-entrypoint.sh:ro
-Volume=/home/dank/serverAppConfigs/dankserver/frank-medium/frank-medium-healthcheck.py:/usr/local/bin/frank-medium-healthcheck.py:ro
-# The entrypoint must be the container command; the image's own entrypoint
-# (which the patched script execs at the end) must not run unpatched.
-PodmanArgs=--entrypoint /usr/local/bin/frank-medium-entrypoint.sh
-# 200 only once the engine serves; during first-start compilation the
-# container is legitimately unhealthy. HealthCmd is split on spaces into an
-# argv array by the podman 5.x v1 generator, hence the file-based probe.
-HealthCmd=python3 /usr/local/bin/frank-medium-healthcheck.py
-HealthInterval=60s
-HealthTimeout=30s
-HealthRetries=3
-HealthStartPeriod=1800s
-Pull=never
-
-[Service]
-# First start compiles Triton/inductor kernels (several minutes) before the
-# engine loads ~20 GiB of weights.
-TimeoutStartSec=1800
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=default.target

dankserver/.AGENTTRASH/20260916-vllm-radiance/frank-medium-b.container

@@ -1,98 +0,0 @@
-# Quadlet unit: frank-medium replica B (rootless, boot-persistent).
-#
-# Install path on dankserver: ~/.config/containers/systemd/frank-medium-b.container
-# Unit name: frank-medium-b.service (container name: frank-medium-a)
-#
-# WHY TWO REPLICAS INSTEAD OF TP=2. The intended shape for frank-medium is one
-# tensor-parallel process across both R9700s (see frank-medium.container, kept
-# as the target). That shape cannot run on this host: RCCL's collective kernels
-# carry a hidden hostcall-buffer parameter, and the ROCr runtime refuses to
-# dispatch them on a device without PCIe atomics ("Pcie atomics not enabled,
-# hostcall not supported" -> AQL dispatch failed -> hipErrorIllegalState). The
-# second R9700 sits behind the chipset bridges 05:00.0/06:09.0, which advertise
-# `AtomicOpsCap: Routing-` — a read-only capability, so no software can enable
-# atomics on that path; the amdgpu driver's pci_enable_atomic_ops_to_root()
-# therefore fails for that GPU and KFD marks the CPU<->GPU2 link NO_ATOMICS.
-# The first R9700 sits on CPU root port 00:01.1 (Routing+) and does have
-# atomics. Result: every collective that touches GPU 2 dies at launch.
-# Two independent single-GPU replicas use both cards instead; the proxy unit
-# keeps the single :7770 endpoint. Full evidence: the frank-medium runbook.
-#
-# SHAPE. vLLM binds 0.0.0.0:7772 on the host network directly; no PublishPort.
-# MAXLEN is 114688, not the TP=2 deployment's 262144: one card carries the
-# whole model (~20 GiB of weights + drafter), leaving ~5.2 GiB of KV, and
-# 131072 does not fit (measured: needs 5.58 GiB). KV_MEM=0 lets vLLM profile
-# this shape instead of using the 2x7551-32624 pin, which is only valid at
-# TP=2/262144.
-#
-# DEVICES. /dev/kfd + /dev/dri; HIP_VISIBLE_DEVICES=1 (the second R9700). The
-# 2 GiB Raphael iGPU enumerates as index 2 and is excluded by the pin.
-# Only HIP_VISIBLE_DEVICES is set, never ROCR_VISIBLE_DEVICES: ROCR filters
-# first and HIP indexes into the filtered list, so a single-valued pair
-# (ROCR=1,HIP=1) leaves an empty device set.
-#
-# DO NOT name an environment variable TEMP, HOST or GPU_MAX_HEAP_SIZE: the
-# HIP runtime reads bare TEMP for its JIT cache path (2026-08-13 incident).
-[Unit]
-Description=frank-medium replica B — vllm-radiance MXFP4 Qwen3.8-27B on R9700 #2
-After=network-online.target
-
-[Container]
-ContainerName=frank-medium-b
-Image=localhost/radiance-vllm:0.9.3
-AddDevice=/dev/kfd
-AddDevice=/dev/dri
-GroupAdd=keep-groups
-# The upstream launcher's exact podman posture (rootless).
-PodmanArgs=--privileged --ipc=host --security-opt seccomp=unconfined --cap-add SYS_PTRACE --network=host
-Environment=HIP_VISIBLE_DEVICES=1
-Environment=SNAP=/models/Qwen3.8-27B-Uncensored-MXFP4-awq
-Environment=DRAFTER=/models/Qwen3.8-27B-DFlash2-FP8
-Environment=CHAT_TEMPLATE=/patches/qwen-fixed-v22.3.jinja
-Environment=SERVED_NAMES=frank-medium
-Environment=PORT=7772
-Environment=TP=1
-Environment=MAXSEQS=4
-Environment=CHUNK=8192
-Environment=MAXLEN=114688
-Environment=GPU_UTIL=0.98
-Environment=KV_MEM=0
-Environment=SPEC_METHOD=dflash
-Environment=SPEC=7
-# Checkpoints (rw: nothing downloads at runtime, but vLLM mmaps the shards).
-Volume=/home/dank/models:/models
-# Tokenizer files ride the HF cache; HF_HUB_OFFLINE=1 is set in the entrypoint.
-Volume=/home/dank/.cache/huggingface:/root/.cache/huggingface
-# Compile cache. Shared with the other replica and with the TP=2 target: the
-# entries are content-addressed, so shapes simply add subdirectories.
-Volume=/home/dank/.radiance-cache-w4a8-093-gdnm-nqft-fp8s-gnq:/cache
-# The pinned radiance clone: patches applied at every container start.
-Volume=/home/dank/GitPackages/radiance-vllm-mxfp4:/patches:z
-# The patched libr4d (pin b9e42ab + repo extras, key b9e42ab-rx6). The image's
-# shipped r4d.so predates the GDN overflow fix and NaNs this model.
-Volume=/home/dank/.cache/radiance-libr4d/b9e42ab-rx6:/r4d:z
-# Entrypoint + healthcheck from this checkout, mounted read-only.
-Volume=/home/dank/serverAppConfigs/dankserver/frank-medium/radiance-entrypoint.sh:/usr/local/bin/frank-medium-entrypoint.sh:ro
-Volume=/home/dank/serverAppConfigs/dankserver/frank-medium/frank-medium-healthcheck.py:/usr/local/bin/frank-medium-healthcheck.py:ro
-# The entrypoint must be the container command; the image's own entrypoint
-# (which the patched script execs at the end) must not run unpatched.
-PodmanArgs=--entrypoint /usr/local/bin/frank-medium-entrypoint.sh
-# 200 only once the engine serves; during first-start compilation the
-# container is legitimately unhealthy. HealthCmd is split on spaces into an
-# argv array by the podman 5.x v1 generator, hence the file-based probe.
-HealthCmd=python3 /usr/local/bin/frank-medium-healthcheck.py
-HealthInterval=60s
-HealthTimeout=30s
-HealthRetries=3
-HealthStartPeriod=1800s
-Pull=never
-
-[Service]
-# First start compiles Triton/inductor kernels (several minutes) before the
-# engine loads ~20 GiB of weights.
-TimeoutStartSec=1800
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=default.target

dankserver/.AGENTTRASH/20260916-vllm-radiance/frank-medium-proxy.container

@@ -1,61 +0,0 @@
-# Quadlet unit: frank-medium proxy (rootless, boot-persistent).
-#
-# Install path on dankserver: ~/.config/containers/systemd/frank-medium-proxy.container
-# Unit name: frank-medium-proxy.service (container name: frank-medium-proxy)
-#
-# WHAT IT IS. A prefix-affinity reverse proxy in front of the two single-GPU
-# frank-medium replicas (:7771 on R9700 #1, :7772 on R9700 #2). It preserves
-# the fleet contract: one endpoint on host port 7770 answering as the served
-# model name frank-medium, OpenAI /v1, streaming included.
-#
-# WHY IT EXISTS. TP=2 — one vLLM process spanning both cards — is impossible
-# on this host (see frank-medium-a.container and the runbook: RCCL's kernels
-# need PCIe atomics, and the second card's chipset path advertises
-# AtomicOpsCap: Routing-). Two replicas are how both cards get used.
-#
-# ROUTING. Requests are keyed on a hash of their leading 4 KiB of prompt text,
-# so a conversation family — an agent loop re-sending the same system prompt,
-# tool list and file context every turn — keeps landing on the same replica,
-# where --enable-prefix-caching has that prefix warm. Plain round-robin threw
-# half of those cache hits away. A replica that is down is skipped, and
-# ROUTING=roundrobin restores the old behaviour for A/B measurement. /health
-# answers 200 while at least one replica is up and names the ones that are
-# down. The proxy runs on host networking so it can bind 7770 and reach the
-# replicas on loopback.
-#
-# The script is a few dozen lines of aiohttp, mounted read-only out of
-# /home/dank/serverAppConfigs (deploy.sh pulls that checkout before dispatch).
-# It reuses the same image as the replicas: aiohttp is already there and no
-# extra image has to be pulled on this host.
-[Unit]
-Description=frank-medium proxy — prefix-affinity in front of the two single-GPU replicas
-After=network-online.target
-Wants=frank-medium-a.service frank-medium-b.service
-After=frank-medium-a.service frank-medium-b.service
-
-[Container]
-ContainerName=frank-medium-proxy
-Image=localhost/radiance-vllm:0.9.3
-PodmanArgs=--network=host
-Environment=PORT=7770
-Environment=UPSTREAMS=http://127.0.0.1:7771,http://127.0.0.1:7772
-# The proxy is two files: routing.py holds the replica-selection policy, the
-# server holds the HTTP plumbing. Both are mounted because the server imports
-# the policy by name from its own directory (/usr/local/bin is sys.path[0]).
-Volume=/home/dank/serverAppConfigs/dankserver/frank-medium/proxy/routing.py:/usr/local/bin/routing.py:ro
-Volume=/home/dank/serverAppConfigs/dankserver/frank-medium/proxy/affinity-proxy.py:/usr/local/bin/affinity-proxy.py:ro
-Volume=/home/dank/serverAppConfigs/dankserver/frank-medium/frank-medium-healthcheck.py:/usr/local/bin/frank-medium-healthcheck.py:ro
-PodmanArgs=--entrypoint /usr/local/bin/affinity-proxy.py
-HealthCmd=python3 /usr/local/bin/frank-medium-healthcheck.py
-HealthInterval=60s
-HealthTimeout=30s
-HealthRetries=3
-HealthStartPeriod=60s
-Pull=never
-
-[Service]
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=default.target

dankserver/.AGENTTRASH/20260916-vllm-radiance/routing.py

@@ -1,129 +0,0 @@
-#!/usr/bin/env python3
-"""Routing policy for the frank-medium proxy: which replica serves a request.
-
-Kept apart from the HTTP plumbing in affinity-proxy.py so the decisions can be
-tested without aiohttp, a network or a GPU — the first version of these rules
-shipped with a bug that only appeared on a continuation request, and a test
-that loads this module catches that class of mistake directly.
-
-Two cards, two behaviours, and the workload decides which is right:
-
-* A **single-turn** request is one member of a batch (a benchmark run, a burst
-  of parallel subagents). Spreading those over both replicas lets both cards
-  prefill at once; measured on this host, a 16-request burst of 15k-token
-  prompts finishes in 18.6 s spread versus 30.1 s pinned.
-* A **continuation** re-sends a prefix the replica has already prefilled. Pinned
-  to that replica the turn costs a cache lookup; spread, half the turns pay a
-  cold prefill again (measured: 1096 ms versus 2676 ms mean warm-turn TTFT on
-  90k-token contexts).
-
-ROUTING picks the strategy; the default `adaptive` applies both rules above.
-`affinity` and `roundrobin` exist so the choice can be re-measured, and are not
-production settings.
-"""
-
-from __future__ import annotations
-
-import collections
-import hashlib
-import itertools
-import json
-import os
-
-UPSTREAMS = [u.strip() for u in os.environ.get(
-    "UPSTREAMS", "http://127.0.0.1:7771,http://127.0.0.1:7772").split(",") if u.strip()]
-ROUTING = os.environ.get("ROUTING", "adaptive").strip().lower()
-# Leading bytes of prompt text that identify a conversation's shared prefix.
-# 4 KiB covers a system prompt plus the start of the first user turn, which is
-# where agent loops keep the text they resend every turn.
-AFFINITY_BYTES = int(os.environ.get("AFFINITY_BYTES", "4096"))
-# Prefixes remembered for pinning. Bounded so a long-lived proxy cannot grow
-# without limit; 4096 conversations is far beyond what this fleet runs at once.
-KNOWN_MAX = int(os.environ.get("KNOWN_MAX", "4096"))
-
-_counter = itertools.count()
-# digest -> replica index, insertion-ordered for O(1) LRU eviction. A prefix is
-# remembered as soon as any request carries it; only a continuation is pinned
-# there, because only a continuation can profit from the cache entry.
-_known: "collections.OrderedDict[bytes, int]" = collections.OrderedDict()
-
-
-def affinity_key(body: bytes, remote: str | None) -> tuple[bytes, bool]:
-    """Key a request by its shared prefix, and report whether it continues one.
-
-    Chat and completions bodies both carry their prompt text in JSON, so the
-    leading bytes of that text are the prefix; a body we cannot parse (or an
-    endpoint with no prompt, e.g. /v1/models) falls back to the client address,
-    which still beats nothing for a single-client loop.
-    """
-    fallback = (remote or "anonymous").encode()
-    try:
-        payload = json.loads(body)
-    except Exception:
-        return fallback, False
-
-    text = ""
-    continuation = False
-    if isinstance(payload, dict):
-        if isinstance(payload.get("prompt"), str):
-            text = payload["prompt"]
-        elif isinstance(payload.get("messages"), list):
-            continuation = len(payload["messages"]) > 1
-            parts = []
-            for msg in payload["messages"]:
-                if isinstance(msg, dict):
-                    content = msg.get("content")
-                    if isinstance(content, str):
-                        parts.append(content)
-                    elif isinstance(content, list):  # multimodal content blocks
-                        parts.extend(
-                            blk.get("text", "") for blk in content
-                            if isinstance(blk, dict) and isinstance(blk.get("text"), str)
-                        )
-            text = "\n".join(parts)
-    if not text:
-        return fallback, continuation
-    return text[:AFFINITY_BYTES].encode("utf-8", "replace"), continuation
-
-
-def pick(key: bytes, continuation: bool, up: list[bool]) -> int:
-    """Replica for a request, or -1 when none is available.
-
-    Down replicas are never selected — a rollout must not send traffic to an
-    engine that is still compiling its graphs — and a pin whose replica is down
-    is re-established on a live one rather than kept pointing at a corpse.
-    """
-    digest = hashlib.sha1(key).digest()
-
-    if ROUTING == "roundrobin":
-        start = next(_counter) % len(UPSTREAMS)
-    elif ROUTING == "adaptive":
-        entry = _known.get(digest)
-        if continuation and entry is not None and up[entry]:
-            _known.move_to_end(digest)
-            return entry
-        # Anything that is not a continuation spreads by counter — including a
-        # batch of requests that happen to share one prefix. Hashing the prefix
-        # would send every member of such a batch to whichever card the hash
-        # names (measured: 29.8 s for a 16-request burst, against 18.6 s when
-        # spread). The counter is only advanced by these requests, so batch
-        # members alternate across the cards.
-        start = next(_counter) % len(UPSTREAMS)
-    else:  # affinity
-        start = int.from_bytes(digest[:8], "big") % len(UPSTREAMS)
-
-    for offset in range(len(UPSTREAMS)):
-        idx = (start + offset) % len(UPSTREAMS)
-        if up[idx]:
-            if ROUTING == "adaptive":
-                _known[digest] = idx
-                _known.move_to_end(digest)
-                if len(_known) > KNOWN_MAX:
-                    _known.popitem(last=False)
-            return idx
-    return -1
-
-
-def route(body: bytes, remote: str | None, up: list[bool]) -> int:
-    """Convenience wrapper: decode the request body and choose a replica."""
-    return pick(*affinity_key(body, remote), up)

dankserver/copyparty/quadlet/copyparty.container

@@ -36,6 +36,9 @@ Volume=/home/dank/Containers/copyparty/cfg:/cfg
 PublishPort=3923:3923
 
 [Service]
+# /w is the array: serving the pre-mount directory instead of the volume shows an
+# empty share and nothing complains, so the mount has to answer first.
+ExecStartPre=/home/dank/serverAppConfigs/scripts/wait-for-mount.sh /mnt/entropy
 EnvironmentFile=/home/dank/Containers/copyparty/env
 Restart=always
 RestartSec=5

dankserver/host/crypttab

@@ -0,0 +1 @@
+entropy	UUID=cd86c728-459e-4f3a-bcc2-41ecf84685ec	/etc/entropy	nofail,luks

dankserver/host/fstab

@@ -0,0 +1,18 @@
+# /etc/fstab: static file system information.
+#
+# Use 'blkid' to print the universally unique identifier for a
+# device; this may be used with UUID= as a more robust way to name devices
+# that works even if disks are added and removed. See fstab(5).
+#
+# <file system> <mount point>   <type>  <options>       <dump>  <pass>
+# / was on /dev/nvme0n1p2 during curtin installation
+/dev/disk/by-uuid/4f3731d2-fb7b-48e7-a79f-0e33cb8a4162 / ext4 defaults 0 1
+# /boot/efi was on /dev/nvme0n1p1 during curtin installation
+/dev/disk/by-uuid/183C-442D /boot/efi vfat defaults 0 1
+#/dev/disk/by-label/archive-one /mnt/archive-one auto nosuid,nodev,nofail,x-gvfs-show 0 0
+#/dev/disk/by-label/archive-two /mnt/archive-two auto nosuid,nodev,nofail,x-gvfs-show 0 0
+# /dev/md0 is a LUKS container, not a filesystem; its ext4 is mounted via
+# /dev/mapper/entropy on the next line. Mounting /dev/md0 directly fails.
+#/dev/md0 /mnt/md0 ext4 auto,nofail,nosuid,nodev 0 0 
+/dev/mapper/entropy /mnt/entropy ext4 auto,nosuid,nofail,nodev,x-gvfs-show 0 0
+/swapfile none swap sw 0 0

dankserver/host/systemd/user.slice.d/io-accounting.conf

@@ -0,0 +1,14 @@
+# The io controller is what makes IOWeight= mean anything, and systemd does not
+# enable it below `user.slice` by default: with io accounting off, `io` never
+# appears in `user.slice/cgroup.subtree_control`, so no rootless container can
+# have an `io.weight` file and `IOWeight=` in a quadlet is silently inert.
+# Measured on Dankserver 2026-10-31: setting this property flipped
+# `user.slice/cgroup.subtree_control` from `cpu memory pids` to `cpu io memory
+# pids` immediately, with nothing restarted.
+#
+# This is half the fix; the other half is delegating io to user@1000.service
+# (user@1000.service.d/io-delegate.conf). Both must be in place before a reboot,
+# because the delegation is read when the user manager starts. Law and the
+# verification command: [[Quadlet Lifecycle]].
+[Slice]
+IOAccounting=yes

dankserver/host/systemd/user@1000.service.d/io-delegate.conf

@@ -0,0 +1,12 @@
+# The system manager gives the user manager cpu/memory/pids by default (systemd
+# 259: `systemctl show user@1000.service -p DelegateControllers` → `cpu memory
+# pids`). Without `io` in that set no `io.weight` file can exist anywhere below
+# `user.slice`, so `IOWeight=` in a rootless quadlet is silently inert — the same
+# class of trap as `RequiresMountsFor=`. Granting the controller here is what
+# makes the media servers' I/O share real.
+#
+# Inert until `user@1000.service` starts again, i.e. the next reboot (restarting
+# it would kill every rootless container on the host). Verify after the reboot
+# with the check in [[Quadlet Lifecycle]].
+[Service]
+DelegateControllers=cpu memory pids io

dankserver/jellyfin/quadlet/jellyfin.container

@@ -43,11 +43,10 @@ PublishPort=1900:1900/udp
 Volume=/home/dank/Containers/jellyfin/config:/config
 Volume=/home/dank/Containers/jellyfin/cache:/cache
 # The view, writable: Jellyfin is the metadata writer (movie.nfo / tvshow.nfo /
-# episode.nfo + artwork) and those bytes belong on the SSD. The condition is the
-# fail-closed guard — starting against a plain, unmounted view directory would let
-# a scan conclude the library is empty.
+# episode.nfo + artwork) and those bytes belong on the SSD. The gate in [Service]
+# is the guard: started against a plain, unmounted view directory a scan decides
+# the library is empty and deletes what it cannot see.
 Volume=/var/lib/media-meta/view:/data
-UnitConfigItem=ConditionPathIsMountPoint=/var/lib/media-meta/view
 AddDevice=/dev/dri
 GroupAdd=keep-groups
 HealthCmd=curl -f http://localhost:8096/health
@@ -56,8 +55,19 @@ HealthTimeout=10s
 HealthRetries=3
 
 [Service]
+# Refuse to start until the bind source is a real mount — see the header of
+# scripts/wait-for-mount.sh for the blind-boot incident this prevents.
+ExecStartPre=/home/dank/serverAppConfigs/scripts/wait-for-mount.sh /var/lib/media-meta/view /mnt/entropy
 Restart=always
 RestartSec=5
 
+# A library scan reads the array for minutes on end. Weighted LOW (default is
+# 100) so that when the array is contended a scan loses to playback and to every
+# other container this user runs. Proportional share, not a cap: it changes
+# nothing while the disk is idle. 10 is a convention — the requirement is only
+# that it sit far below 100 — and it is inert until user@1000.service is
+# delegated the io controller ([[Quadlet Lifecycle]]).
+IOWeight=10
+
 [Install]
 WantedBy=default.target

dankserver/plex/quadlet/plex.container

@@ -16,12 +16,21 @@ Volume=/var/lib/plexmediaserver:/config
 # to the overlay view re-points Plex at the sidecars without touching its DB.
 # Read-only: Plex consumes the NFO files Jellyfin writes and writes no metadata.
 Volume=/var/lib/media-meta/view:/mnt/entropy:ro
-UnitConfigItem=ConditionPathIsMountPoint=/var/lib/media-meta/view
 PublishPort=32400:32400
 
 [Service]
+# Refuse to start until the bind source is a real mount: Plex blind is how paths
+# get marked missing in its own database. Both the view and the array under it
+# must answer — scripts/wait-for-mount.sh names the 2026-10-31 incident.
+ExecStartPre=/home/dank/serverAppConfigs/scripts/wait-for-mount.sh /var/lib/media-meta/view /mnt/entropy
 Restart=always
 RestartSec=5
 
+# See the jellyfin unit for the reasoning: a section scan gets a LOW weight
+# (default 100) so a walk of 50k files loses the array to playback and to every
+# other container under this user. Inert until user@1000.service holds the io
+# controller ([[Quadlet Lifecycle]]).
+IOWeight=10
+
 [Install]
 WantedBy=default.target

scripts/.AGENTTRASH/20260920-llama-layersplit/bench-spec-ab.py.llamacpp-layersplit

@@ -1,309 +0,0 @@
-#!/usr/bin/env python3
-"""bench-spec-ab.py — settle "which proposer should this endpoint use?" with data.
-
-Runs one payload through several speculative-decoding configurations of the same
-binary, one at a time, with the unit stopped between runs: on a single-GPU host
-there is no room for two copies of a 29 GiB model, and the benchmarking policy
-applies. Every configuration gets identical prompts at temperature 0, and the
-greedy text is compared across them — speculation may buy speed, never change
-the answer.
-
-    bench-spec-ab.py <env-file> <serve-script> [options]
-    bench-spec-ab.py /home/dank/serverAppConfigs/scripts/frank-medium.env \
-                     /home/dank/serverAppConfigs/scripts/serve-frank-medium.sh \
-                     --configs "dflash=draft-dflash@7;ngram=ngram-mod@64;chain=draft-dflash,ngram-mod@7"
-
-Config syntax: `name=SPEC_TYPE[@n_max][|ENV=VAL|ENV=VAL]`, entries joined by `;`.
-The systemd unit is restored in a finally block, so it comes back on whatever the
-env file says even if a configuration crashes the harness.
-
-THREE SHAPES, because a single one answers the wrong question. A proposer can
-only draft text it has seen, so the shape decides the verdict:
-
-  prose       a 1k prompt asking for one sentence. Nothing to copy and nothing
-              repetitive, so only a model-backed proposer can help: this is the
-              shape that compares drafters.
-  echo        a ~1.5k passage of unique lines, "repeat it back verbatim". The
-              output IS the prompt, which is ngram-mod's home turf.
-  structured  "25 JSON records, one per line" — repetitive OUTPUT with no prompt
-              overlap, which is what an ngram matcher is really for in an
-              agentic fleet (config edits, tables, record lists).
-
-echo and structured disable thinking (`chat_template_kwargs`), otherwise the
-model thinks the answer into `reasoning_content`, `content` comes back empty and
-the cross-configuration identity check passes vacuously — which is exactly how
-this harness first "verified" an echo it never looked at.
-
-Results on Dankserver (frank-medium payload, 2026-09-16, temperature 0). Decode:
-
-  shape            dflash=7   ngram-mod(48/64)   chain        (tok/s)
-  prose 1k/512        43.8        17.7 (0 drafts)   43.7
-  echo 1.5k/400       76.8       102.5             200.6
-  structured/400      91.1        17.8 (0 drafts)   91.2
-  identity            70.4        17.8 (0 drafts)   70.4
-
-`draft-mtp,draft-dflash` fails at load (a chain has ONE draft context and MTP
-builds against whatever model that context holds); ngram-mod has no such
-constraint — it is draftless and joins the chain unconditionally.
-"""
-import argparse
-import json
-import os
-import re
-import subprocess
-import sys
-import time
-import urllib.request
-
-FILLER = ("The quick brown fox jumps over the lazy dog near the river bank. "
-          "A cache is a component that stores data so future requests are faster. ")
-TOKENS_PER_REP = 28
-UNIT = "frank-medium.service"
-MODEL = "frank-medium"
-SPEC_GREP = ("adding speculative implementation|- n_max=|- block_size=|creating MTP|"
-             "draft acceptance")
-
-DEFAULT_CONFIGS = [
-    ("none", {"SPEC_TYPE": "none"}),
-    ("mtp-n3", {"SPEC_TYPE": "draft-mtp", "SPEC_DRAFT_N_MAX": "3"}),
-    ("mtp-n7", {"SPEC_TYPE": "draft-mtp", "SPEC_DRAFT_N_MAX": "7"}),
-    ("dflash-n7", {"SPEC_TYPE": "draft-dflash", "SPEC_DRAFT_N_MAX": "7"}),
-]
-
-WORDS = ["latency", "throughput", "cache", "adapter", "scheduler", "allocator",
-         "queue", "kernel", "buffer", "shard", "replica", "window"]
-
-
-def echo_passage(lines=90):
-    """Unique lines: no long span repeats inside the prompt, so an n-gram can
-    only fire when the OUTPUT copies the INPUT."""
-    return "\n".join(
-        "Record %03d: the %s of subsystem %d reports state %d with checksum %05d."
-        % (i, WORDS[i % len(WORDS)], i % 7, i % 3, (i * 7919) % 100000)
-        for i in range(lines))
-
-
-ECHO = (echo_passage() + "\n\nRepeat the passage above verbatim, every line, exactly as "
-        "written, with no commentary before or after it.")
-STRUCTURED = ("Output exactly 25 JSON records, one per line, no prose and no code fence. "
-              'Each line must look like {"id": N, "state": "active", "region": "us-west-2"} '
-              "with N running from 1 to 25.")
-PROSE = FILLER * (1000 // TOKENS_PER_REP) + "\n\nReply with a single short sentence."
-IDENTITY = "List the first five prime numbers, comma separated, then stop."
-NO_THINK = {"chat_template_kwargs": {"enable_thinking": False}}
-
-
-def log(msg, logfile):
-    line = "[" + time.strftime("%H:%M:%S") + "] " + str(msg)
-    print(line, flush=True)
-    with open(logfile, "a") as fh:
-        fh.write(line + "\n")
-
-
-def sh(cmd):
-    return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout.strip()
-
-
-def parse_configs(spec):
-    """`name=SPEC_TYPE[@n_max][|KEY=VALUE]...`, entries joined by ';'.
-
-    KEY=VALUE parts override any env file key, which is how an impl's own window
-    (SPEC_NGRAM_N_MIN/MAX, for instance) gets swept without hand-editing env
-    files."""
-    out = []
-    for chunk in spec.split(";"):
-        chunk = chunk.strip()
-        if not chunk:
-            continue
-        name, _, rest = chunk.partition("=")
-        over = {}
-        if "|" in rest:
-            rest, _, extras = rest.partition("|")
-            for item in extras.split("|"):
-                if "=" in item:
-                    k, _, v = item.partition("=")
-                    over[k.strip()] = v.strip()
-        n_max = None
-        if "@" in rest:
-            rest, _, n_max = rest.partition("@")
-        over["SPEC_TYPE"] = rest.strip()
-        if n_max:
-            over["SPEC_DRAFT_N_MAX"] = n_max.strip()
-        out.append((name.strip(), over))
-    return out
-
-
-def write_env(src, name, overrides):
-    """The env file with this configuration's overrides applied."""
-    path = "/tmp/spec-ab-" + name.replace("/", "_") + ".env"
-    with open(src) as fh:
-        lines = fh.read().splitlines()
-    out = []
-    for line in lines:
-        for k, v in overrides.items():
-            if line.startswith(k + "="):
-                line = k + "=" + v
-                break
-        out.append(line)
-    with open(path, "w") as fh:
-        fh.write("\n".join(out) + "\n")
-    return path
-
-
-def post(base, body, timeout=1800):
-    req = urllib.request.Request(
-        base + "/v1/chat/completions", data=json.dumps(body).encode(),
-        headers={"Content-Type": "application/json"})
-    with urllib.request.urlopen(req, timeout=timeout) as r:
-        return json.load(r)
-
-
-def vram():
-    out = sh("rocm-smi --showmeminfo vram 2>/dev/null | grep 'Used Memory'")
-    return [round(int(x) / 1e9, 2) for x in re.findall(r":\s+(\d+)\s*$", out, re.M)][:2]
-
-
-def wait_health(base, timeout=420):
-    t0 = time.time()
-    while time.time() - t0 < timeout:
-        if not sh("pgrep -x llama-server >/dev/null && echo up"):
-            return False
-        try:
-            with urllib.request.urlopen(base + "/health", timeout=5) as r:
-                if r.status == 200 and json.load(r).get("status") == "ok":
-                    return True
-        except Exception:
-            time.sleep(3)
-    return False
-
-
-def stop_unit():
-    sh("sudo systemctl stop " + UNIT)
-    sh("pkill -x llama-server")
-    for _ in range(40):
-        if not sh("pgrep -x llama-server || true"):
-            return
-        time.sleep(1)
-
-
-def restore_unit(base, logfile):
-    """Bring the endpoint back on the deployed configuration. Runs in a
-    finally, because a harness that can leave production down is a hazard."""
-    log("restoring " + UNIT, logfile)
-    sh("sudo systemctl start " + UNIT)
-    for _ in range(120):
-        try:
-            with urllib.request.urlopen(base + "/health", timeout=5) as r:
-                if json.load(r).get("status") == "ok":
-                    log(UNIT + " healthy again", logfile)
-                    return True
-        except Exception:
-            time.sleep(5)
-    log("WARNING: " + UNIT + " did not come back healthy -- check it by hand", logfile)
-    return False
-
-
-def run_shape(base, prompt, max_tokens, label, extra=None):
-    body = {"model": MODEL, "messages": [{"role": "user", "content": prompt}],
-            "max_tokens": max_tokens, "temperature": 0.0}
-    if extra:
-        body.update(extra)
-    d = post(base, body)
-    tm = d["timings"]
-    msg = d["choices"][0]["message"]
-    content = (msg.get("content") or "").strip()
-    row = {"shape": label,
-           "prompt_n": tm["prompt_n"],
-           "prefill_tps": round(1000 * tm["prompt_n"] / tm["prompt_ms"], 1),
-           "predicted_n": tm["predicted_n"],
-           "decode_tps": round(tm["predicted_per_second"], 2),
-           "draft_n": tm.get("draft_n", 0),
-           "accepted": tm.get("draft_n_accepted", 0),
-           "answer": content,
-           "reasoning_len": len(msg.get("reasoning_content") or "")}
-    if label.startswith("echo"):
-        # How much of the answer really is the passage: a configuration that
-        # "wins" by answering something else is not a win.
-        want = {l.strip() for l in echo_passage().splitlines()}
-        got = [l.strip() for l in content.splitlines() if l.strip()]
-        row["copy_ratio"] = round(sum(1 for l in got if l in want) / len(got), 3) if got else 0.0
-    return row
-
-
-def measure(base):
-    run_shape(base, FILLER * (4000 // TOKENS_PER_REP) +
-              "\n\nReply with a single short sentence.", 32, "warmup")
-    return [
-        run_shape(base, PROSE, 512, "prose 1k/512"),
-        run_shape(base, ECHO, 400, "echo 1.5k/400", NO_THINK),
-        run_shape(base, STRUCTURED, 400, "structured/400", NO_THINK),
-        run_shape(base, IDENTITY, 192, "identity"),
-    ]
-
-
-def main():
-    ap = argparse.ArgumentParser()
-    ap.add_argument("env_file")
-    ap.add_argument("serve_script")
-    ap.add_argument("--base-url", default="http://127.0.0.1:7770")
-    ap.add_argument("--log", default="/tmp/bench-spec-ab.log")
-    ap.add_argument("--configs", default=None,
-                    help="name=SPEC_TYPE[@n_max][|ENV=VAL] joined by ';' "
-                         "(default: the four configs measured on 2026-09-16)")
-    ap.add_argument("--json", default="/tmp/bench-spec-ab.json")
-    args = ap.parse_args()
-
-    configs = parse_configs(args.configs) if args.configs else DEFAULT_CONFIGS
-    # Absolute paths: the launcher must not depend on the caller's cwd, and a
-    # relative path plus a `cd` to its own directory double-counts the prefix.
-    env_file = os.path.abspath(args.env_file)
-    serve_script = os.path.abspath(args.serve_script)
-    base, logfile = args.base_url, args.log
-    results = {}
-    log("spec A/B start: " + ", ".join(n for n, _ in configs) +
-        " (unit " + UNIT + " stopped for the duration)", logfile)
-    try:
-        stop_unit()
-        for name, over in configs:
-            env_path = write_env(env_file, name, over)
-            logf = "/tmp/spec-ab-" + name.replace("/", "_") + ".log"
-            sh("FRANK_MEDIUM_ENV_FILE=" + env_path + " setsid bash " + serve_script +
-               " > " + logf + " 2>&1 < /dev/null &")
-            if not wait_health(base):
-                log(name + ": FAILED to become healthy -- " + sh("tail -3 " + logf), logfile)
-                results[name] = {"error": "not healthy", "tail": sh("tail -6 " + logf)}
-                stop_unit()
-                continue
-            rows = measure(base)
-            results[name] = {"vram_gb": vram(), "rows": rows,
-                             "spec_log": sh("grep -E '" + SPEC_GREP + "' " + logf + " | tail -4")}
-            for r in rows:
-                log(name + " | " + r["shape"] + " prefill " + str(r["prefill_tps"]) +
-                    " tok/s | decode " + str(r["decode_tps"]) + " tok/s | draft " +
-                    str(r["draft_n"]) + "/" + str(r["accepted"]) +
-                    (" (" + str(round(100.0 * r["accepted"] / r["draft_n"])) + " %)"
-                     if r["draft_n"] else "") +
-                    (" | copy " + str(r["copy_ratio"]) if "copy_ratio" in r else "") +
-                    (" | EMPTY ANSWER" if not r["answer"] else ""), logfile)
-            log(name + " | vram " + str(results[name]["vram_gb"]), logfile)
-            stop_unit()
-    finally:
-        restore_unit(base, logfile)
-
-    with open(args.json, "w") as fh:
-        json.dump(results, fh, indent=2)
-    for shape in ("prose 1k/512", "echo 1.5k/400", "structured/400", "identity"):
-        texts = [r["answer"] for v in results.values() if "rows" in v
-                 for r in v["rows"] if r["shape"] == shape]
-        if any(not t for t in texts):
-            log("WARNING: '" + shape + "' produced an empty answer in some configuration -- "
-                "its identity check proves nothing", logfile)
-        elif len(set(texts)) > 1:
-            log("WARNING: configurations disagree on greedy text for '" + shape +
-                "' -- speculation is changing answers", logfile)
-    log("done; results in " + args.json, logfile)
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

scripts/.AGENTTRASH/20260920-llama-layersplit/frank-medium.env.llamacpp-layersplit

@@ -1,318 +0,0 @@
-# Tunables for frank-medium (orcarouter/Qwen3.8-27B-Uncensored-GGUF Q8_0 +
-# z-lab/Qwen3.8-27B-DFlash2-GGUF Q4_K_M drafter), mainline llama.cpp on
-# Dankserver, 2x AMD Radeon AI PRO R9700 (gfx1201).  Since 2026-09-16 this is
-# the SOLE LLM runtime on the box: the vllm-radiance replica pair and its
-# routing proxy are retired.
-#
-# Hardware: two R9700 (Navi 48, RDNA4, 32,624 MiB each), no XGMI, different
-# IOMMU groups -- every cross-card byte goes over PCIe.  The Raphael iGPU
-# (gfx1036/Radeon 610M) enumerates as HIP device 2 and is hidden below so
-# nothing can drift onto shared system RAM.
-#
-# WHY LAYER SPLIT AND NOT TENSOR (operator call, 2026-09-16): tensor parallel
-# needs a cross-card allreduce per layer, and this host cannot dispatch one.
-# RCCL's kernels carry a hidden hostcall-buffer parameter, and ROCr refuses it
-# on a device without PCIe atomics -- the second card sits behind the B650
-# chipset bridges (AtomicOpsCap: Routing-, read-only), so every collective that
-# touches it dies with hipErrorIllegalState.  Measured on this box 2026-09-15
-# (llama-bench, pp4096 / tg128, f16 KV, fa on):
-#
-#   single R9700    1160.9 / 19.42
-#   layer  2x       1991.2 / 18.76      (859.1 / 17.64 at depth 32768)
-#   tensor 2x        271.8 / 26.26      (no RCCL: butterfly fallback, -7x prefill)
-#
-# Layer split distributes layers in order; only the activation at the boundary
-# crosses the wire, once per forward pass.  That is the "pipeline parallelism"
-# this service wanted, and it needs no collective at all.
-#
-# Runtime: mainline llama.cpp master fb27a525 (2026-09-16), gfx1201, built by
-# scripts/build-llama-rdna4.sh against a private ROCm 7.14.0a20260624 toolchain
-# that is bundled next to the binary (RPATH $ORIGIN/../lib, no LD_LIBRARY_PATH).
-# The ref is pinned by TWO features: DFlash2 (ggml-org/llama.cpp#27342 -- the
-# drafter is detected from its GGUF) and qwen35 MTP.  Do not float it.
-#
-# Model: orcarouter/Qwen3.8-27B-Uncensored-GGUF @ Q8_0, 27.0 GiB, arch qwen35
-# (verified from the GGUF header 2026-09-19: 262144 trained window, 24 heads /
-# 4 KV heads, nextn_predict_layers=1).  The file ALSO carries the model's MTP
-# head (blk.64.nextn.*), so --spec-type draft-mtp is available without a second
-# copy in VRAM -- one SPEC_TYPE change, the drafter below stays on disk.
-#
-# Drafter: z-lab/Qwen3.8-27B-DFlash2-GGUF @ Q4_K_M, 1.06 GiB (operator call
-# 2026-09-19: the Q4 rung -- the drafter's job is throughput, not output
-# quality, and the target verifies every drafted token).  5 layers, hidden
-# 5120, a block-diffusion proposal (block_size 8) under a 2048-token sliding
-# window (dflash.attention.sliding_window=2048, verified from the header).
-# The window is what makes it cheap HERE: its KV is bounded at 2048 positions
-# (~40 MiB) instead of spanning the context (see SIZING).
-#
-# Architecture (GGUF arch qwen35): 64 layers as 16 x (3 x (Gated DeltaNet ->
-# FFN) + 1 x (Gated Attention -> FFN)) -- 48 linear-attention layers whose
-# per-sequence state is CONSTANT-SIZE, 16 full-attention layers at 4 KV heads x
-# 256 head_dim.  A token therefore costs 2 x 4 x 256 x 2 B = 64 KiB of KV at f16
-# in the attention layers only, plus ~0.16 GiB per sequence of f32 DeltaNet
-# state at any depth.
-#
-# SIZING, the deployed shape (32:33 / ctx 327680 / 6144x512 / two slots /
-# DFlash2 Q4_K_M), measured 2026-09-19 after the model swap (rocm-smi):
-#
-#   card 0 (x16)  26.9 GiB used, 5.7 GiB free
-#   card 1 (x1)   27.8 GiB used, 4.8 GiB free
-#
-# The predecessor's measured table (rocm-smi, 2026-09-16, UD-Q8_K_XL target)
-# stays as the calibration history:
-#
-#   CTX     split  batch  slots  drafter  GPU 0 free  GPU 1 free   note (ubatch 1536)
-#   262144   1,1   2048   1      DFlash2   8.64 GiB    4.43 GiB   day's start
-#   262144  39,26  6144   2      DFlash2   2.42 GiB    7.20 GiB
-#   262144  38,27  6144   2      DFlash2   3.85 GiB    5.77 GiB
-#   262144  37,28  6144   2      DFlash2   4.28 GiB    5.34 GiB
-#   262144  36,29  6144   2      DFlash2   4.71 GiB    4.91 GiB
-#   262144  35,30  6144   2      DFlash2   5.14 GiB    4.48 GiB
-#   262144  40,25  6144   2      DSpark    1.87 GiB    1.86 GiB   (retired)
-#
-# ...and the same deployed shape re-measured at ubatch 512, after llama-bench
-# showed 512 is the throughput optimum and costs 3.71 GiB less in total (see the
-# batch block below):
-#
-#   262144  36,29  6144   512    2      DFlash2   6.01 GiB    7.32 GiB   ubatch only
-#   262144  35,30  6144   512    2      DFlash2   6.44 GiB    6.90 GiB
-#
-# ONE -ts STEP IS ONE LAYER, AND LAYERS ARE NOT THE SAME SIZE.  This is a hybrid
-# stack -- 16 x (3 Gated DeltaNet + 1 Gated Attention) blocks -- so moving a
-# DeltaNet layer shifts ~0.43 GiB while an attention layer shifts ~1.43 GiB
-# (0.45 of weights plus ~1.0 GiB of its own f16 KV at 262144).  Both step sizes
-# were measured, which is why the balance is found by measurement rather than by
-# interpolating between splits.
-#
-# WHY THE SPLIT IS 32:33 (operator call, 2026-09-19).  The operator asked for
-# the tensors BALANCED across the two cards, which for 65 layers is 32:33 --
-# the most even split that exists.  The predecessor's 35:30 skew existed to lean
-# work onto the x16 card (ROCm0), because ROCm1's Gen4 x1 chipset path made it
-# the 98 % utilization bottleneck; the measured trade of the balanced point is
-# that the x1 card runs hotter while the x16 card idles a little more, and the
-# operator accepted that for symmetry.  Do not re-skew without asking.
-#
-# THE TWO CARDS' PATHS ARE NOT SYMMETRIC (measured, 2026-09-17): ROCm0
-# (03:00.0) hangs off CPU root port 00:01.1 at Gen4 x16 end to end (~31.5 GB/s);
-# ROCm1 (0b:00.0) rides the B650 chipset through bridges that each negotiate
-# Gen4 x1 (~1.97 GB/s).  The layer-split boundary itself is not the cost
-# (~5.2 MB of activation per 512-token ubatch rides the wire); the x1 card is
-# COMPUTE-bound, not PCIe-bound.
-#
-# A FAULT TO WATCH.  A 39:26 split, at 1x batch / 1 slot, died on its eighth
-# request: the amdgpu driver logged SDMA0 UTCL2 page faults and the engine
-# surfaced `ROCm error: an illegal memory access was encountered` -> ggml_abort,
-# i.e. a fault in the cross-card boundary copy, this layer split's hot path.  It
-# has not reproduced since, but the signature is worth recognising -- it is NOT
-# an OOM, and no amount of headroom prevents it.
-#
-# WARNING: do not name any variable TEMP, HOST, or GPU_MAX_HEAP_SIZE (HIP reads
-# those bare vars; 2026-08-13 incident).  llama.cpp takes --host/--port/--temp
-# as flags only.
-
-# llama-server: mainline fb27a525 built for gfx1201 by scripts/build-llama-rdna4.sh.
-LLAMA_BIN=/home/dank/GitPackages/llama.cpp-dflash2/build-rdna4-rocm714/bin/llama-server
-
-# Payload, fetched with scripts/download-frank-medium-gguf.sh.
-MODEL_DIR=/home/dank/models/Qwen3.8-27B-Uncensored-GGUF
-MODEL_FILE=Qwen3.8-27B-Uncensored-Q8_0.gguf
-# The f16 vision projector, same repo as the target.  llama-server loads it via
-# the explicit --mmproj flag (no autoload in this build); the serve script
-# refuses to start without it when vision is enabled, so a missing file is a
-# deploy error, not a text-only server that pretends to be multimodal.
-MM_PROJ_FILE=mmproj-Qwen3.8-27B-Uncensored-f16.gguf
-DRAFT_MODEL_DIR=/home/dank/models/Qwen3.8-27B-DFlash2-GGUF
-DRAFT_MODEL_FILE=Qwen3.8-27B-DFlash2-Q4_K_M.gguf
-
-# Fleet identity.  7770 is the fleet's dankserver endpoint; the alias is the id
-# at /v1/models and what every client asks for.
-ALIAS=frank-medium
-BIND_ADDR=0.0.0.0
-LISTEN_PORT=7770
-# Device placement.  HIP_VISIBLE_DEVICES hides the Raphael iGPU (HIP device 2)
-# so nothing can drift onto shared system RAM; DEVICES is what llama.cpp splits
-# across, and neither of the two cards has an XGMI link to the other.
-HIP_VISIBLE_DEVICES=0,1
-DEVICES=ROCm0,ROCm1
-SPLIT_MODE=layer
-
-# 32:33 -- balanced (operator call 2026-09-19): 65 layers split as evenly as
-# they can be, ROCm1 (the last-layers card, which also carries the drafter and
-# the output layers) holding the extra one.  See the WHY THE SPLIT IS 32:33
-# block above for the trade against the predecessor's 35:30 x16-lean.
-TENSOR_SPLIT=32,33
-
-NGL=999
-# Auto-fit has no business resizing a context we set explicitly.
-FIT=off
-FLASH_ATTN=on
-
-# 327680 positions over TWO slots, so each conversation gets 163840 --
-# --parallel DIVIDES --ctx-size, so more slots would shrink every
-# conversation rather than grow the cache.  163840 is inside the checkpoint's
-# trained 262144 window, so the whole pool is trained territory (no rope
-# extrapolation, unlike the predecessor's 393216).
-CTX_SIZE=327680
-PARALLEL=2
-
-# MEASURED 2026-09-16 with scripts/bench-batch-ubatch.sh on this box: llama-bench,
-# a 64k prefill plus a 128-token decode with 64k of KV already resident, 3 reps,
-# one invocation per cell, the deployed split and f16 KV.  --ubatch-size is the
-# physical batch the graph is built at -- and the only one of the two knobs that
-# costs VRAM:
-#
-#   batch  ubatch   prefill tok/s        GPU 0 / GPU 1 free
-#   6144   1536    1164.96 +- 2.30      10.28 / 11.71 GiB
-#   6144    768    1135.03 +- 1.09      11.29 / 13.28 GiB
-#   6144    512    1192.93 +- 0.91      11.63 / 13.81 GiB   <- deployed
-#   6144    384    1068.04 +- 0.79      11.80 / 14.07 GiB
-#   6144    256    1045.98 +- 1.69      11.97 / 14.33 GiB
-#   4096   1536    1161.90 +- 0.96      10.28 / 11.71 GiB
-#   2048   1536    1170.23 +- 0.86      10.28 / 11.71 GiB
-#   2048    512    1193.88 +- 1.01      11.63 / 13.81 GiB
-#
-# THE PLATEAU STARTS AT 512.  512 -> 1536 buys ~2 % of prefill -- inside the
-# run-to-run spread, and the 512 cells were the faster pair in BOTH batch
-# columns -- while costing 1.35 GiB on ROCm0 and 2.10 GiB on ROCm1, so the
-# deployment takes the cheap end.  BELOW 512 the SMs are no longer saturated:
-# 384 and 256 fall ~11 % and ~12 %.  The logical batch is free either way --
-# 2048, 4096 and 6144 land within 2 % of each other at a fixed ubatch and use
-# the SAME VRAM, because the compute buffers are sized by ubatch alone.
-#
-# The prefill figure is a property of the SHAPE, not of this knob: the same
-# sweep with no depth in front of it (depth 0) runs 1543 tok/s at ubatch 256 and
-# 1723 at 1536 -- the plateau is in the same place, and the ~32 % between the two
-# tables is what attending over 64k of resident KV costs.  Decode is 15.88 tok/s
-# at depth 65536 on EVERY ubatch (17.80 at depth 0), so this knob cannot touch
-# generation at all.
-#
-# 8192/2048 stays untested under this drafter (the "2020 MiB pp buffer fails on
-# ROCm1" note was measured under DSpark, when it had 0.08 GiB free), and there is
-# no longer a reason to want it: batch buys nothing measurable here.
-BATCH_SIZE=6144
-UBATCH_SIZE=512
-
-# Threads cover tokenization, sampling and HTTP only: every layer is on a GPU.
-NUM_THREADS=8
-THREAD_BATCH=8
-
-# f16 K/V: an agentic checkpoint is the wrong place to spend KV precision.
-CACHE_TYPE_K=f16
-CACHE_TYPE_V=f16
-# Context checkpoints: 0 -- no per-slot KV snapshots at all.  The build's
-# default is 32 (this binary's --help), so the 0 below is a deliberate
-# deviation, not an inherited default: a checkpoint is a VRAM->host-RAM copy
-# of part of a slot's KV, taken so a partially-matching prompt can be restored
-# instead of re-prefilled.  This endpoint trades that away -- its reuse comes
-# from the slot prompt and from the RAM-side prompt cache below.  Stated
-# explicitly so the tunable stays visible rather than merely absent.
-CTX_CHECKPOINTS=0
-# PROMPT CACHE, HOST RAM -- this is the one cache tunable that is NOT VRAM.
-# --cache-ram caps the total bytes of saved prompt states
-# (server_prompt_cache, tools/server/server-task.cpp): update() evicts
-# oldest-first past the cap, and alloc() REFUSES outright any single state
-# bigger than the whole cap.  A state is the serialized KV of a whole sequence
-# plus its DeltaNet state plus the draft context's own KV, so at this shape it
-# costs ~68 KiB per token --
-#   16 full-attention layers x 4 kv heads x 256 dim x 2 B x 2 (K,V) = 64 KiB
-#   plus the draft context's window-bounded KV (a ~40 MiB constant for DFlash2)
-# -- which makes the cap a TOKEN budget in disguise: 16384 MiB holds ~240k
-# tokens, i.e. a FULL 163840-token slot (~10.6 GiB) with ~5 GiB of the budget
-# spare for a second entry.
-#
-# The cost is host RAM, allocated on demand and never pinned (plain heap
-# vectors), so no VRAM number above moves.  dankserver has 62 GiB beside the
-# media-stack co-tenants, so the cache is bounded rather than unlimited (-1):
-# the seam test refuses a budget over half the host's RAM.
-CACHE_RAM=16384
-
-# Sampling defaults for requests that send none -- the values the vLLM
-# predecessor served on this endpoint (`--override-generation-config`), so a
-# client sees no change across the runtime swap.  The model card's own
-# recommendation is temp 1.0 / top_p 0.95; the harness sets its own per model in
-# models.yml, so this is the floor, not the contract.
-TEMPERATURE=0.7
-TOP_P=0.95
-TOP_K=20
-MIN_P=0.0
-PRESENCE_PENALTY=0.0
-
-# Reasoning on, projected into reasoning_content (deepseek format) with no
-# budget: the model decides how long to think.
-REASONING=on
-REASONING_FORMAT=deepseek
-REASONING_BUDGET=-1
-
-# Chat template: empty = the one embedded in the GGUF (Qwen3.8's own).
-CHAT_TEMPLATE_FILE=
-CHAT_TEMPLATE_KWARGS='{"enable_thinking":true,"preserve_thinking":true}'
-
-# Speculative decoding: the DFlash2 sidecar (operator call 2026-09-19).  The
-# target file also carries its own MTP head (nextn_predict_layers=1), so
-# draft-mtp is one SPEC_TYPE change away -- the drafter file stays on disk.
-# n_max 7 is the measured DFlash2 winner (see the table below); the drafter
-# rides ROCm1, the card that holds the last layers.
-SPEC_TYPE=draft-dflash
-SPEC_DRAFT_N_MAX=7
-SPEC_DRAFT_NGL=999
-SPEC_DRAFT_DEVICE=ROCm1
-SPEC_DRAFT_TYPE_K=f16
-SPEC_DRAFT_TYPE_V=f16
-
-# DFlash2 vs the model's own MTP head -- MEASURED 2026-09-16 on the predecessor
-# payload (temperature 0, 1k prompt / 512 out; the autoregressive baseline and
-# both MTP depths were run in one session, same binary, same prompts):
-#
-#   none            17.7 tok/s                     card1 26.07 GB
-#   draft-mtp  n=3  32.4 tok/s  58 % accepted       card1 29.35 GB
-#   draft-mtp  n=7  26.7 tok/s  33 % accepted       card1 29.65 GB
-#   draft-dflash 7  43.5 tok/s  41 % accepted       card1 29.42 GB
-#
-# All four produced IDENTICAL greedy text, so verification is lossless
-# whichever proposer runs.  DFlash2 is the faster proposer (2.46x over
-# autoregressive, 34 % over the best MTP).  The MTP head adds ~3.3 GB to the
-# card that holds it, against 1.06 GB for the Q4_K_M drafter's file -- at the
-# 327680 pool the drafter's window-bounded KV (~40 MiB) leaves headroom on
-# both cards, so the speed wins.
-#
-# THE TWO CANNOT BE CHAINED. `--spec-type draft-mtp,draft-dflash` dies at load:
-#   context type MTP requested but model doesn't contain MTP layers
-#   failed to create MTP context
-# A chain has ONE draft context, and MTP builds against whatever model that
-# context holds -- here the DFlash2 file, which has no MTP layers. MTP's head is
-# only loaded when MTP IS the draft model ("creating MTP draft context against
-# the target model ..."), so a chain of the two is a structural dead end, not a
-# tuning question. See serverAppConfigs-docs/LLM/frank-medium-llamacpp-dflash2.md.
-
-# ngram-mod: the draftless n-gram matcher (CPU hash table in host RAM, no VRAM,
-# no model file, no draft context).  It joins the chain unconditionally --
-# unlike MTP, which needs a draft context and therefore cannot share one with
-# DFlash2.  NOT CURRENTLY ACTIVE: SPEC_TYPE is draft-dflash alone, and the serve
-# script only passes --spec-ngram-mod-* when the type contains "ngram".  The
-# window below is retained because the DFlash2 + ngram chain was measured free
-# on prose and 2.6x on prompt-echo -- one SPEC_TYPE change brings it back.
-#
-# WINDOW MEASURED 2026-09-16 (chain at each window, decode tok/s):
-#
-#   n_min/n_max    prose 1k/512   prompt-echo 1.5k/400
-#   48/64          43.9           200.6
-#   16/32          36.0           161.0
-#    8/16          36.2           113.8
-#
-# The long window is the right one, and not only because it wins on echo: a
-# SHORT window makes the matcher propose on short fragments of ordinary prose,
-# where the proposals are rejected and the verification still costs -- which is
-# the "ngram hurts" result the fleet measured on other payloads twice before.
-# With 48/64 the chain is byte-identical to DFlash2 alone on prose (same 119
-# drafts / 49 accepted) and on the identity prompt (70/53).
-#
-# Do not shorten these without re-running scripts/bench-spec-ab.py: the
-# no-penalty property is what makes the chain safe as a default.
-SPEC_NGRAM_N_MATCH=24
-SPEC_NGRAM_N_MIN=48
-SPEC_NGRAM_N_MAX=64
-
-# Vision enabled: llama-server loads mmproj-Qwen3.8-27B-Uncensored-f16.gguf
-# (931 MiB, lands on ROCm0 -- the fit charges it there) via the explicit
-# --mmproj flag.  This keeps frank-medium multimodal across the model swap.
-NO_MMPROJ=0

scripts/.AGENTTRASH/20260920-llama-layersplit/frank-medium.service.llamacpp-layersplit

@@ -1,20 +0,0 @@
-[Unit]
-Description=llama.cpp Qwen3.8-27B Uncensored UD-Q8_K_XL + DFlash2 drafter (dankserver, frank-medium, 2x Radeon AI PRO R9700)
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=dank
-Group=dank
-# The engine pins staging buffers on the first card; keep the memlock budget
-# unbounded so an RLIMIT that is smaller than the split buffers cannot fail the
-# load.  Parity with the other LLM units on this fleet.
-LimitMEMLOCK=infinity
-Environment="FRANK_MEDIUM_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-medium.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-medium.sh
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target

scripts/.AGENTTRASH/20260920-llama-layersplit/serve-frank-medium.sh.llamacpp-layersplit

@@ -1,203 +0,0 @@
-#!/usr/bin/env bash
-# Serve ajgazin/Swift-Qwen3.8-27B-Uncensored-Dynamic-MTP-GGUF @ UD-Q8_K_XL as
-# frank-medium on Dankserver's two Radeon AI PRO R9700 (gfx1201), with the
-# z-lab DFlash2 block-diffusion drafter, using mainline llama.cpp.
-#
-# Runtime: llama.cpp master fb27a525 (2026-09-16), a gfx1201 HIP build that
-# bundles its own ROCm 7.14 runtime (RPATH $ORIGIN/../lib), produced by
-# scripts/build-llama-rdna4.sh.  Two features pin that ref: DFlash2
-# (ggml-org/llama.cpp#27342) and qwen35 MTP.  The charlie12345/ROCmFPX fork
-# this deployment replaced has neither (its tip is c49ebdb, 2026-08-22).
-#
-# Parallelism: --split-mode layer across both cards.  Tensor split would need a
-# cross-card allreduce and this host cannot dispatch one -- RCCL's kernels
-# require a hostcall buffer that ROCr refuses on a card without PCIe atomics,
-# and the second R9700 sits behind the chipset (AtomicOpsCap: Routing-).  Layer
-# split crosses the wire once per forward pass instead of once per layer.
-#
-# The vLLM replica pair and its routing proxy were retired with this cutover:
-# one process, one model, both cards.
-#
-# Tunables come from frank-medium.env unless FRANK_MEDIUM_ENV_FILE overrides it.
-set -euo pipefail
-
-SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_MEDIUM_ENV_FILE:-$SCRIPT_DIR/frank-medium.env}"
-if [[ -f "$ENV_FILE" ]]; then
-    set -a
-    # shellcheck disable=SC1090
-    source "$ENV_FILE"
-    set +a
-fi
-
-# --- defaults (used when the env file does not set them) ------------------
-: "${LLAMA_BIN:=/home/dank/GitPackages/llama.cpp-dflash2/build-rdna4-rocm714/bin/llama-server}"
-: "${MODEL_DIR:=/home/dank/models/Swift-Qwen3.8-27B-Uncensored-Dynamic-MTP-GGUF}"
-: "${MODEL_FILE:=Swift-Qwen3.8-27B-Uncensored-Dynamic-MTP-UD-Q8_K_XL.gguf}"
-: "${DRAFT_MODEL_DIR:=/home/dank/models/Qwen3.8-27B-DFlash2-GGUF}"
-: "${DRAFT_MODEL_FILE:=Qwen3.8-27B-DFlash2-Q8_0.gguf}"
-: "${ALIAS:=frank-medium}"
-: "${BIND_ADDR:=0.0.0.0}"
-: "${LISTEN_PORT:=7770}"
-
-# Devices.  HIP_VISIBLE_DEVICES hides the Raphael iGPU (HIP device 2) so nothing
-# can drift onto shared system RAM; DEVICES is what llama.cpp splits across.
-: "${HIP_VISIBLE_DEVICES:=0,1}"
-: "${DEVICES:=ROCm0,ROCm1}"
-: "${SPLIT_MODE:=layer}"
-: "${TENSOR_SPLIT:=1,1}"
-: "${NGL:=999}"
-: "${FIT:=off}"
-: "${FLASH_ATTN:=on}"
-
-: "${CTX_SIZE:=131072}"
-: "${PARALLEL:=1}"
-: "${BATCH_SIZE:=2048}"
-: "${UBATCH_SIZE:=512}"
-: "${NUM_THREADS:=8}"
-: "${THREAD_BATCH:=8}"
-: "${CACHE_TYPE_K:=f16}"
-: "${CACHE_TYPE_V:=f16}"
-: "${CTX_CHECKPOINTS:=8}"
-: "${CACHE_RAM:=8192}"
-
-# Sampling defaults for silent clients: the values the vLLM predecessor served.
-: "${TEMPERATURE:=0.7}"
-: "${TOP_P:=0.95}"
-: "${TOP_K:=20}"
-: "${MIN_P:=0.0}"
-: "${PRESENCE_PENALTY:=0.0}"
-
-: "${REASONING:=on}"
-: "${REASONING_FORMAT:=deepseek}"
-: "${REASONING_BUDGET:=-1}"
-: "${CHAT_TEMPLATE_FILE:=}"
-: "${CHAT_TEMPLATE_KWARGS:={\"enable_thinking\":true,\"preserve_thinking\":true}}"
-
-# Speculative decoding: draft-dflash or draft-dspark (both are MODEL drafters --
-# a file, not a flag), or draft-mtp (the target GGUF's own MTP head, no draft
-# file).  The drafter's own tuning knobs (n-min, p-min, p-split, poll) are left
-# at the build's defaults: they were only ever passed for dspark, and dspark is
-# not the deployed drafter.
-: "${SPEC_TYPE:=draft-dflash}"
-: "${SPEC_DRAFT_N_MAX:=7}"
-: "${SPEC_DRAFT_NGL:=999}"
-: "${SPEC_DRAFT_DEVICE:=}"
-: "${SPEC_DRAFT_TYPE_K:=f16}"
-: "${SPEC_DRAFT_TYPE_V:=f16}"
-: "${SPEC_NGRAM_N_MATCH:=24}"
-: "${SPEC_NGRAM_N_MIN:=48}"
-: "${SPEC_NGRAM_N_MAX:=64}"
-
-NO_MMPROJ="${NO_MMPROJ:-0}"
-: "${MM_PROJ_FILE:=mmproj-BF16.gguf}"
-
-export HIP_VISIBLE_DEVICES
-
-MODEL="$MODEL_DIR/$MODEL_FILE"
-DRAFT_MODEL="$DRAFT_MODEL_DIR/$DRAFT_MODEL_FILE"
-
-if [[ ! -x "$LLAMA_BIN" ]]; then
-    echo "missing executable runtime: $LLAMA_BIN" >&2
-    echo "build it with: bash $SCRIPT_DIR/build-llama-rdna4.sh" >&2
-    exit 1
-fi
-if [[ ! -r "$MODEL" ]]; then
-    echo "missing or unreadable target model: $MODEL" >&2
-    echo "fetch it with: bash $SCRIPT_DIR/download-frank-medium-gguf.sh" >&2
-    exit 1
-fi
-if [[ "$NO_MMPROJ" != "1" ]]; then
-    MM_PROJ="$MODEL_DIR/$MM_PROJ_FILE"
-    if [[ ! -r "$MM_PROJ" ]]; then
-        echo "vision is enabled but the projector is missing: $MM_PROJ" >&2
-        echo "fetch it with: bash $SCRIPT_DIR/download-frank-medium-gguf.sh" >&2
-        exit 1
-    fi
-fi
-if [[ -n "$CHAT_TEMPLATE_FILE" && ! -r "$CHAT_TEMPLATE_FILE" ]]; then
-    echo "missing or unreadable chat template: $CHAT_TEMPLATE_FILE" >&2
-    exit 1
-fi
-
-# --- speculative decoding -------------------------------------------------
-SPEC_ARGS=()
-if [[ -n "$SPEC_TYPE" && "$SPEC_TYPE" != "none" ]]; then
-    SPEC_ARGS=(--spec-type "$SPEC_TYPE" --spec-draft-n-max "$SPEC_DRAFT_N_MAX")
-    if [[ "$SPEC_TYPE" == *dflash* || "$SPEC_TYPE" == *dspark* ]]; then
-        if [[ ! -r "$DRAFT_MODEL" ]]; then
-            echo "missing or unreadable draft model: $DRAFT_MODEL" >&2
-            exit 1
-        fi
-        SPEC_ARGS+=(
-            --spec-draft-model "$DRAFT_MODEL"
-            --spec-draft-ngl "$SPEC_DRAFT_NGL"
-            --spec-draft-type-k "$SPEC_DRAFT_TYPE_K"
-            --spec-draft-type-v "$SPEC_DRAFT_TYPE_V"
-        )
-    fi
-    # ngram-mod is draftless: it needs no draft context and its window is its
-    # own (--spec-ngram-mod-*), so it can ride in the chain beside a model
-    # drafter. It also costs no VRAM -- a CPU hash table.
-    if [[ "$SPEC_TYPE" == *ngram* ]]; then
-        SPEC_ARGS+=(
-            --spec-ngram-mod-n-match "$SPEC_NGRAM_N_MATCH"
-            --spec-ngram-mod-n-min "$SPEC_NGRAM_N_MIN"
-            --spec-ngram-mod-n-max "$SPEC_NGRAM_N_MAX"
-        )
-    fi
-    if [[ -n "$SPEC_DRAFT_DEVICE" ]]; then
-        SPEC_ARGS+=(--spec-draft-device "$SPEC_DRAFT_DEVICE")
-    fi
-fi
-
-# --- template + placement -------------------------------------------------
-TEMPLATE_ARGS=()
-if [[ -n "$CHAT_TEMPLATE_FILE" ]]; then
-    TEMPLATE_ARGS+=(--chat-template-file "$CHAT_TEMPLATE_FILE")
-fi
-TEMPLATE_ARGS+=(--chat-template-kwargs "$CHAT_TEMPLATE_KWARGS")
-
-PLACEMENT_ARGS=(--device "$DEVICES" --split-mode "$SPLIT_MODE" --tensor-split "$TENSOR_SPLIT")
-
-MMPROJ_ARGS=()
-if [[ "$NO_MMPROJ" == "1" ]]; then
-    MMPROJ_ARGS=(--no-mmproj)
-else
-    # No autoload in this build: a server without the flag starts text-only
-    # and answers image requests with a 500, so name the projector.
-    MMPROJ_ARGS=(--mmproj "$MM_PROJ")
-fi
-exec "$LLAMA_BIN" \
-    --model "$MODEL" \
-    --alias "$ALIAS" \
-    --host "$BIND_ADDR" \
-    --port "$LISTEN_PORT" \
-    --jinja \
-    --gpu-layers "$NGL" \
-    --fit "$FIT" \
-    --parallel "$PARALLEL" \
-    --ctx-size "$CTX_SIZE" \
-    --batch-size "$BATCH_SIZE" \
-    --ubatch-size "$UBATCH_SIZE" \
-    --flash-attn "$FLASH_ATTN" \
-    --cache-type-k "$CACHE_TYPE_K" \
-    --cache-type-v "$CACHE_TYPE_V" \
-    --threads "$NUM_THREADS" \
-    --threads-batch "$THREAD_BATCH" \
-    --ctx-checkpoints "$CTX_CHECKPOINTS" \
-    --cache-ram "$CACHE_RAM" \
-    --cache-prompt \
-    --metrics \
-    --temp "$TEMPERATURE" \
-    --top-p "$TOP_P" \
-    --top-k "$TOP_K" \
-    --min-p "$MIN_P" \
-    --presence-penalty "$PRESENCE_PENALTY" \
-    --reasoning "$REASONING" \
-    --reasoning-format "$REASONING_FORMAT" \
-    --reasoning-budget "$REASONING_BUDGET" \
-    "${TEMPLATE_ARGS[@]}" \
-    "${PLACEMENT_ARGS[@]}" \
-    "${MMPROJ_ARGS[@]}" \
-    "${SPEC_ARGS[@]}"

scripts/.AGENTTRASH/bench-decode-threads-batch.py.strix-rocmfp4

@@ -1,192 +0,0 @@
-#!/usr/bin/env python3
-"""
-Decode throughput benchmark for frank-dragoon.
-Starts the server with a given --threads-batch value, sends an 8K+ token prompt,
-generates 256 tokens, measures generation tok/s.
-
-Each --threads-batch value requires a cold server load (~3 min).
-"""
-import json, time, urllib.request, urllib.error, subprocess, os, sys
-
-MODEL = "/home/dank/models/kingjones-Qwen3.8-Flash-Next-ROCmFP4-STRIX/Qwen3.8-Flash-Next-Q4_0-ROCmFP4-STRIX.gguf"
-SERVE = "/home/dank/GitPackages/ROCmFPX/build-qwen38/bin/llama-server"
-PORT = 7770
-N_GEN = 256
-PROMPT_FILE = "/tmp/bench-prompts/prompt_code.txt"
-ENV_FILE = os.path.join(os.path.dirname(__file__), "frank-dragoon.env")
-SERVER_DIR = os.path.dirname(SERVE)
-ROCM_PATH = "/opt/rocm"
-
-def make_env():
-    """Build the same env as serve-frank-dragoon.sh."""
-    env = {**os.environ, "HSA_OVERRIDE_GFX_VERSION": "11.5.1", "HIP_VISIBLE_DEVICES": "0"}
-    
-    # Source env file for tunables
-    if os.path.exists(ENV_FILE):
-        with open(ENV_FILE) as f:
-            for line in f:
-                line = line.strip()
-                if line and not line.startswith("#") and "=" in line:
-                    k, v = line.split("=", 1)
-                    env[k] = v
-    
-    # Build LD_LIBRARY_PATH
-    lib_path = f"{SERVER_DIR}:{ROCM_PATH}/lib:{ROCM_PATH}/lib/rocm_sysdeps/lib:{ROCM_PATH}/lib/llvm/lib"
-    if os.environ.get("LD_LIBRARY_PATH"):
-        lib_path += f":{os.environ['LD_LIBRARY_PATH']}"
-    env["LD_LIBRARY_PATH"] = lib_path
-    env["ROCM_PATH"] = ROCM_PATH
-    
-    return env
-
-ENV = make_env()
-
-def kill_all():
-    subprocess.run(["pkill", "-9", "llama-server"], capture_output=True)
-    time.sleep(3)
-
-def wait_ready():
-    for i in range(600):
-        try:
-            r = urllib.request.urlopen(f"http://127.0.0.1:{PORT}/health", timeout=2)
-            if json.loads(r.read()).get("status") == "ok":
-                return True
-        except:
-            pass
-        time.sleep(1)
-    return False
-
-def send_request(prompt, max_tokens=N_GEN):
-    """Send chat completion, measure generation throughput."""
-    body = json.dumps({
-        "model": "frank-dragoon",
-        "messages": [{"role": "user", "content": prompt}],
-        "max_tokens": max_tokens,
-        "stream": False,
-        "temperature": 0.7,
-        "top_p": 0.8
-    }).encode()
-    
-    t0 = time.time()
-    req = urllib.request.Request(
-        f"http://127.0.0.1:{PORT}/v1/chat/completions",
-        data=body,
-        headers={"Content-Type": "application/json"},
-        method="POST"
-    )
-    r = urllib.request.urlopen(req, timeout=1200)
-    resp = json.loads(r.read())
-    wall = time.time() - t0
-    
-    usage = resp.get("usage", {})
-    pt = usage.get("prompt_tokens", 0)
-    gt = usage.get("completion_tokens", 0)
-    gtps = gt / wall if wall > 0 else 0
-    return pt, gt, wall, gtps
-
-def load_and_extend_prompt():
-    """Load prompt and extend to ~8K tokens if needed."""
-    with open(PROMPT_FILE) as f:
-        text = f.read()
-    
-    # Count approximate tokens (rough: ~4 chars per token for code)
-    approx_tokens = len(text) / 4.0
-    needed = 8200
-    
-    if approx_tokens < needed:
-        repeats = needed // max(int(approx_tokens), 1) + 1
-        text = (text + "\n") * repeats
-        words = text.split()[:needed]
-        text = " ".join(words)
-    
-    return text
-
-def main():
-    tb_values = [int(x) for x in sys.argv[1:]] if len(sys.argv) > 1 else [16, 32, 64, 128]
-    results = []
-    
-    prompt = load_and_extend_prompt()
-    n_words = len(prompt.split())
-    print(f"Prompt: {n_words} words (~{n_words} tokens), {len(prompt)} chars\n", flush=True)
-    
-    for tb in tb_values:
-        print(f"\n{'='*60}")
-        print(f"threads-batch = {tb}")
-        print(f"{'='*60}", flush=True)
-        
-        kill_all()
-        print("  Starting server...", flush=True)
-        
-        lib_path = ENV.get("LD_LIBRARY_PATH", "")
-        cmd = [
-            "/usr/bin/env",
-            "HSA_OVERRIDE_GFX_VERSION=11.5.1",
-            "HIP_VISIBLE_DEVICES=0",
-            f"LD_LIBRARY_PATH={lib_path}",
-            f"ROCM_PATH={ROCM_PATH}",
-            SERVE, "--model", MODEL, "--port", str(PORT), "--jinja",
-            "--device", "ROCm0", "--gpu-layers", "999", "--fit", "off",
-            "--threads", "16", "--threads-batch", str(tb),
-            "--parallel", "2", "--ctx-size", "131072",
-            "--batch-size", "4096", "--ubatch-size", "4096",
-            "--flash-attn", "on",
-            "--cache-type-k", "f16", "--cache-type-v", "f16",
-            "--cache-prompt", "--cache-idle-slots", "--metrics"
-        ]
-        
-        srv = subprocess.Popen(cmd, env=ENV, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-        
-        ready = wait_ready()
-        if not ready:
-            print("  FAILED: server did not become ready", flush=True)
-            srv.terminate()
-            srv.wait()
-            for line in (srv.stdout.readlines() or [])[-20:]:
-                print(f"  LOG: {line.rstrip()}", flush=True)
-            continue
-        
-        print("  Server ready.", flush=True)
-        
-        # Warmup (small request)
-        try:
-            send_request("Hi", 16)
-        except Exception as e:
-            print(f"  Warmup failed: {e}", flush=True)
-            srv.terminate()
-            srv.wait()
-            continue
-        
-        # Benchmark
-        print(f"  Generating {N_GEN} tokens...", flush=True)
-        try:
-            pt, gt, wall, gtps = send_request(prompt, N_GEN)
-            print(f"  {gt}/{N_GEN} gen tokens in {wall:.1f}s = {gtps:.1f} tok/s")
-            print(f"  Prompt tokens: {pt}")
-            results.append({"tb": tb, "wall": wall, "gtps": gtps, "gt": gt, "pt": pt})
-        except Exception as e:
-            print(f"  FAILED: {e}", flush=True)
-        
-        srv.terminate()
-        srv.wait()
-        time.sleep(2)
-    
-    # Summary
-    print(f"\n{'='*60}")
-    print("SUMMARY")
-    print(f"{'='*60}")
-    for r in results:
-        print(f"  tb={r['tb']:>3}: {r['gt']} gen tokens, {r['wall']:.1f}s, {r['gtps']:.1f} tok/s")
-    
-    if results:
-        best = max(results, key=lambda r: r['gtps'])
-        print(f"\nBest: tb={best['tb']} at {best['gtps']:.1f} tok/s")
-    
-    with open("/tmp/bench_decode_results.txt", "w") as f:
-        f.write("tb,gen_tokens,wall_s,gen_tps,prompt_tokens\n")
-        for r in results:
-            f.write(f"{r['tb']},{r['gt']},{r['wall']:.1f},{r['gtps']:.1f},{r['pt']}\n")
-    
-    print(f"\nResults: /tmp/bench_decode_results.txt")
-
-if __name__ == "__main__":
-    main()

scripts/.AGENTTRASH/bench-ngram-mod.py.ik-llama.cpp

@@ -1,268 +0,0 @@
-#!/usr/bin/env python3
-"""
-Benchmark n-gram speculative decoding vs no-spec for frank-dragoon.
-
-Tests prompt-processing throughput with 16K token prompts (manageable request size).
-Code-heavy prompt (high n-gram redundancy) vs prose prompt (low redundancy).
-
-Usage:
-    # Generate prompts: python3 scripts/bench-ngram-mod.py generate /tmp/prompts/
-    # Run: python3 scripts/bench-ngram-mod.py /tmp/prompts/
-"""
-
-import json
-import os
-import sys
-import time
-import subprocess
-import urllib.request
-import urllib.error
-from pathlib import Path
-
-MODEL = "/home/dank/models/kingjones-Qwen3.8-Flash-Next-ROCmFP4-STRIX/Qwen3.8-Flash-Next-Q4_0-ROCmFP4-STRIX.gguf"
-CHAT_TEMPLATE = "/home/dank/serverAppConfigs/scripts/chat-template.jinja"
-BUILD_DIR = "/home/dank/GitPackages/ROCmFPX/build-qwen38/bin"
-LLAMA_BIN = os.path.join(BUILD_DIR, "llama-server")
-
-# 16K tokens ~= 64KB text
-TARGET_PROMPT_TOKENS = 16000
-TOKEN_CHAR_RATIO = 4
-TARGET_PROMPT_BYTES = TARGET_PROMPT_TOKENS * TOKEN_CHAR_RATIO
-
-CONTEXT = 65536
-BATCH = 4096
-UBATCH = 4096
-THREADS = 16
-THREAD_BATCH = 32
-NGRAM_N_MAX = 24
-NGRAM_N_MIN = 4
-TEST_TOKENS = 128
-SERVER_WAIT = 300
-
-
-def start_server(port, spec_type):
-    cmd = [
-        LLAMA_BIN,
-        "--model", MODEL,
-        "--chat-template-file", CHAT_TEMPLATE,
-        "--jinja",
-        "--device", "ROCm0",
-        "--gpu-layers", "999",
-        "--parallel", "1",
-        "--ctx-size", str(CONTEXT),
-        "--batch-size", str(BATCH),
-        "--ubatch-size", str(UBATCH),
-        "--fit", "off",
-        "--flash-attn", "on",
-        "--cache-type-k", "f16",
-        "--cache-type-v", "f16",
-        "--threads", str(THREADS),
-        "--threads-batch", str(THREAD_BATCH),
-        "--cache-prompt",
-        "--cache-idle-slots",
-        "--metrics",
-        "--host", "127.0.0.1",
-        "--port", str(port),
-        "--temp", "0",
-    ]
-    if spec_type == "ngram-mod":
-        cmd.extend([
-            "--spec-type", "ngram-mod",
-            "--spec-ngram-mod-n-max", str(NGRAM_N_MAX),
-            "--spec-ngram-mod-n-min", str(NGRAM_N_MIN),
-        ])
-    else:
-        cmd.extend(["--spec-type", "none"])
-
-    env = os.environ.copy()
-    env["ROCM_PATH"] = "/opt/rocm"
-    env["LD_LIBRARY_PATH"] = f"{BUILD_DIR}:/opt/rocm/lib:/opt/rocm/lib/rocm_sysdeps/lib:/opt/rocm/lib/llvm/lib"
-    env["HSA_OVERRIDE_GFX_VERSION"] = "11.5.1"
-    env["HIP_VISIBLE_DEVICES"] = "0"
-
-    proc = subprocess.Popen(cmd, env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-
-    print(f"  Waiting for server on port {port} (spec={spec_type})...")
-    for i in range(SERVER_WAIT):
-        try:
-            req = urllib.request.urlopen(f"http://127.0.0.1:{port}/health", timeout=2)
-            resp = json.loads(req.read().decode())
-            if resp.get("status") == "ok":
-                print(f"  Server ready after {i+1}s")
-                return proc
-        except:
-            time.sleep(1)
-
-    proc.terminate()
-    out, err = proc.communicate()
-    print(f"ERROR: Server failed to start in {SERVER_WAIT}s")
-    print(err.decode()[-2000:])
-    sys.exit(1)
-
-
-def run_test(prompt_text, spec_type, port):
-    """Send a request and extract prompt processing metrics."""
-    data = json.dumps({
-        "model": "frank-dragoon",
-        "messages": [{"role": "user", "content": prompt_text}],
-        "max_tokens": TEST_TOKENS,
-        "stream": False,
-        "temperature": 0,
-    }).encode()
-
-    req = urllib.request.Request(
-        f"http://127.0.0.1:{port}/v1/chat/completions",
-        data=data,
-        headers={"Content-Type": "application/json"},
-    )
-
-    start = time.monotonic()
-    resp = urllib.request.urlopen(req, timeout=600)
-    elapsed = time.monotonic() - start
-
-    result = json.loads(resp.read().decode())
-    timings = result.get("timings", {})
-    usage = result.get("usage", {})
-
-    return {
-        "prompt_tokens": usage.get("prompt_tokens", 0),
-        "prompt_ms": timings.get("prompt_ms", 0),
-        "prompt_per_second": timings.get("prompt_per_second", 0),
-        "prompt_per_token_ms": timings.get("prompt_per_token_ms", 0),
-        "predicted_per_second": timings.get("predicted_per_second", 0),
-        "total_time_s": elapsed,
-        "cache_n": timings.get("cache_n", 0),
-    }
-
-
-def main():
-    if len(sys.argv) < 2:
-        print(f"Usage: {sys.argv[0]} <prompt_dir>")
-        sys.exit(1)
-
-    prompt_dir = Path(sys.argv[1])
-    prompt_dir.mkdir(parents=True, exist_ok=True)
-
-    code_prompt_file = prompt_dir / "prompt_code.txt"
-    prose_prompt_file = prompt_dir / "prompt_prose.txt"
-
-    # Generate prompts if they don't exist
-    if not code_prompt_file.exists() or not prose_prompt_file.exists():
-        print("Generating prompts...")
-        # Generate deterministic prompts
-        # Code prompt: structured algorithms + data generation + config schemas
-        code_lines = []
-        for i in range(50):
-            code_lines.append(f"# Algorithm {i}\n")
-            code_lines.append(f"def algo_{i}(x, y):\n")
-            code_lines.append(f"    \"\"\"Algorithm {i} processing.\"\"\"\n")
-            code_lines.append(f"    result = 0\n")
-            code_lines.append(f"    for j in range({i * 10}):\n")
-            code_lines.append(f"        result += x * y + j\n")
-            code_lines.append(f"    return result\n\n")
-        code_text = "".join(code_lines)
-        # Pad/truncate to target
-        while len(code_text) < TARGET_PROMPT_BYTES:
-            code_text += "# Additional algorithm block\n"
-            code_text += f"def extra_{len(code_text)//100}():\n"
-            code_text += "    x = 1\n"
-            code_text += "    y = 2\n"
-            code_text += "    return x + y\n\n"
-        code_text = code_text[:TARGET_PROMPT_BYTES]
-
-        # Prose prompt: historical/scientific/philosophical text
-        prose_text = ""
-        topics = [
-            "The Renaissance brought profound transformation to European civilization. Artists and scholars pushed the boundaries of human expression.",
-            "Quantum mechanics describes the behavior of matter and energy at atomic scales. The uncertainty principle limits measurement precision.",
-            "Ethical philosophy grapples with questions of right and wrong. Utilitarianism judges actions by their consequences and the happiness they produce.",
-            "Mountains rise like ancient sentinels, their peaks lost in clouds that swirl and dance across the sky above the valleys below.",
-            "The ocean whispers secrets to the shore, each wave carrying fragments of distant lands across the water before retreating back to sea.",
-        ]
-        for _ in range(500):
-            prose_text += f"{topics[len(prose_text) % len(topics)]} "
-        prose_text = prose_text[:TARGET_PROMPT_BYTES]
-
-        code_prompt_file.write_text(code_text)
-        prose_prompt_file.write_text(prose_text)
-        print(f"  Code: {code_prompt_file.stat().st_size:,} bytes")
-        print(f"  Prose: {prose_prompt_file.stat().st_size:,} bytes")
-
-    print("=" * 60)
-    print("  N-gram Mod Benchmark — frank-dragoon")
-    print(f"  STRIX ROCmFP4 · 64K context · 16K prompts")
-    print("=" * 60)
-
-    results = []
-    port_base = 7772
-    port_ngram = 7773
-
-    tests = [
-        ("code", "none", port_base, code_prompt_file),
-        ("prose", "none", port_ngram, prose_prompt_file),
-        ("code", "ngram-mod", port_base, code_prompt_file),
-        ("prose", "ngram-mod", port_ngram, prose_prompt_file),
-    ]
-
-    for prompt_type, spec_type, port, pfile in tests:
-        print(f"\n=== {spec_type} ({prompt_type}) ===")
-        print(f"  File: {pfile} ({pfile.stat().st_size:,} bytes)")
-        print(f"  Spec: {spec_type}")
-        if spec_type == "ngram-mod":
-            print(f"  n_max={NGRAM_N_MAX}, n_min={NGRAM_N_MIN}")
-
-        proc = start_server(port, spec_type)
-
-        try:
-            # Warm-up
-            print("  Warm-up...")
-            run_test("Hello test", spec_type, port)
-
-            # Full prompt
-            print(f"  Sending {TARGET_PROMPT_TOKENS} token prompt...")
-            with open(pfile) as f:
-                prompt_text = f.read()
-            result = run_test(prompt_text, spec_type, port)
-
-            tps = result["prompt_per_second"]
-            print(f"  Tokens:  {result['prompt_tokens']}")
-            print(f"  Prompt:  {result['prompt_ms']:.0f}ms")
-            print(f"  TPS:     {tps:.1f} tok/s")
-            print(f"  Total:   {result['total_time_s']:.1f}s")
-
-            results.append({
-                "prompt_type": prompt_type,
-                "spec_type": spec_type,
-                "prompt_tokens": result["prompt_tokens"],
-                "prompt_ms": result["prompt_ms"],
-                "tps": tps,
-                "total_time_s": result["total_time_s"],
-            })
-
-        finally:
-            proc.terminate()
-            try:
-                proc.wait(timeout=5)
-            except:
-                proc.kill()
-
-    # Summary
-    print("\n" + "=" * 60)
-    print("  RESULTS SUMMARY")
-    print("=" * 60)
-
-    for ptype in ["code", "prose"]:
-        baseline = next((r for r in results if r["prompt_type"] == ptype and r["spec_type"] == "none"), None)
-        ngram = next((r for r in results if r["prompt_type"] == ptype and r["spec_type"] == "ngram-mod"), None)
-        if baseline and ngram:
-            gain = ((ngram["tps"] - baseline["tps"]) / baseline["tps"]) * 100 if baseline["tps"] > 0 else 0
-            print(f"\n{ptype.upper()} PROMPT:")
-            print(f"  Baseline TPS: {baseline['tps']:.1f} tok/s ({baseline['prompt_ms']:.0f}ms)")
-            print(f"  N-gram TPS:   {ngram['tps']:.1f} tok/s ({ngram['prompt_ms']:.0f}ms)")
-            print(f"  Speedup:      {gain:+.1f}%")
-
-    print("\n" + "=" * 60)
-
-
-if __name__ == "__main__":
-    main()

scripts/.AGENTTRASH/bench-ngram-mod.sh.ik-llama.cpp

@@ -1,304 +0,0 @@
-#!/usr/bin/env bash
-# Benchmark n-gram speculative decoding vs no-spec for frank-dragoon.
-#
-# This tests prompt-processing throughput at 64k context with two distinct
-# prompts: one code-heavy and one prose-heavy. Uses llama-server on scratch
-# ports with the OpenAI-compatible API to measure prompt_eval_duration_ms.
-#
-# Run on Dankclaw after stopping the production service:
-#   sudo systemctl stop frank-dragoon
-#   ./scripts/bench-ngram-mod.sh
-#   sudo systemctl start frank-dragoon
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_DRAGOON_ENV_FILE:-$SCRIPT_DIR/frank-dragoon.env}"
-if [[ -f "$ENV_FILE" ]]; then
-    set -a; source "$ENV_FILE"; set +a
-fi
-
-: "${LLAMA_BIN:=/home/dank/GitPackages/ROCmFPX/build-qwen38/bin/llama-server}"
-: "${MODEL_DIR:=/home/dank/models/kingjones-Qwen3.8-Flash-Next-ROCmFP4-STRIX}"
-: "${MODEL_FILE:=Qwen3.8-Flash-Next-Q4_0-ROCmFP4-STRIX.gguf}"
-: "${CHAT_TEMPLATE_FILE:=$SCRIPT_DIR/chat-template.jinja}"
-: "${CHAT_TEMPLATE_KWARGS:={}}"
-: "${BATCH_SIZE:=4096}"
-: "${UBATCH_SIZE:=4096}"
-: "${CTX_SIZE:=65536}"
-: "${NUM_THREADS:=16}"
-: "${THREAD_BATCH:=32}"
-: "${CACHE_TYPE_K:=f16}"
-: "${CACHE_TYPE_V:=f16}"
-: "${FIT:=off}"
-: "${TEMPERATURE:=0.7}"
-: "${TOP_P:=0.8}"
-: "${TOP_K:=20}"
-: "${MIN_P:=0.0}"
-: "${REASONING:=on}"
-: "${REASONING_FORMAT:=deepseek}"
-
-MODEL="$MODEL_DIR/$MODEL_FILE"
-HOSTNAME=$(hostname 2>/dev/null || echo "dankclaw")
-
-# Prompt files (generated by generate-prompts.py or passed via args)
-PROMPT_CODE="${1:-}"
-PROMPT_PROSE="${2:-}"
-
-if [[ -z "$PROMPT_CODE" || -z "$PROMPT_PROSE" ]]; then
-    echo "ERROR: Need two prompt file paths."
-    echo "Usage: $0 <prompt_code.txt> <prompt_prose.txt>"
-    echo "Generate with: python3 scripts/generate-prompts.py"
-    exit 1
-fi
-
-if [[ ! -r "$MODEL" ]]; then
-    echo "missing or unreadable model: $MODEL" >&2
-    exit 1
-fi
-
-SERVER_DIR="$(cd -- "$(dirname -- "$LLAMA_BIN")" && pwd)"
-ROCM_PATH="${ROCM_PATH:-/opt/rocm}"
-LIBRARY_PATH="$SERVER_DIR:$ROCM_PATH/lib:$ROCM_PATH/lib/rocm_sysdeps/lib:$ROCM_PATH/lib/llvm/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
-
-# Scratch ports
-PORT_NGRAM=7771
-PORT_BASELINE=7772
-
-cleanup() {
-    echo "Cleaning up servers..."
-    # Kill any leftover llama-server on our ports
-    for port in $PORT_NGRAM $PORT_BASELINE; do
-        fuser -k "$port"/tcp 2>/dev/null || true
-    done
-}
-trap cleanup EXIT
-
-wait_for_server() {
-    local port=$1
-    local max_wait=120
-    local elapsed=0
-    while (( elapsed < max_wait )); do
-        if curl -s "http://127.0.0.1:$port/health" | grep -q '"running"'; then
-            return 0
-        fi
-        sleep 1
-        (( elapsed++ ))
-    done
-    echo "ERROR: Server on port $port did not start within ${max_wait}s" >&2
-    return 1
-}
-
-get_prompt_tokens() {
-    local file=$1
-    # Count tokens approximately (1 token ~ 4 chars for English/code)
-    wc -c < "$file" | awk '{printf "%d", $1/4}'
-}
-
-run_single_test() {
-    local port=$1
-    local spec_type="$2"
-    local prompt_file=$3
-    local label=$4
-    local ngram_n_max="${5:-24}"
-    local ngram_n_min="${6:-4}"
-    
-    echo "=== $label ==="
-    echo "  spec-type: $spec_type"
-    echo "  ngram-mod n-max: $ngram_n_max (if enabled)"
-    echo "  ngram-mod n-min: $ngram_n_min (if enabled)"
-    echo "  prompt: $prompt_file ($(wc -c < "$prompt_file") bytes)"
-    
-    # Build command
-    local cmd=(
-        /usr/bin/env
-        ROCM_PATH="$ROCM_PATH"
-        HIP_VISIBLE_DEVICES=0
-        LD_LIBRARY_PATH="$LIBRARY_PATH"
-        HSA_OVERRIDE_GFX_VERSION="${HSA_OVERRIDE_GFX_VERSION:-11.5.1}"
-        "$LLAMA_BIN"
-        --model "$MODEL"
-        --chat-template-file "$CHAT_TEMPLATE_FILE"
-        --chat-template-kwargs "$CHAT_TEMPLATE_KWARGS"
-        --host 127.0.0.1
-        --port "$port"
-        --jinja
-        --device ROCm0
-        --gpu-layers 999
-        --parallel 1
-        --ctx-size "$CTX_SIZE"
-        --batch-size "$BATCH_SIZE"
-        --ubatch-size "$UBATCH_SIZE"
-        --fit "$FIT"
-        --flash-attn on
-        --cache-type-k "$CACHE_TYPE_K"
-        --cache-type-v "$CACHE_TYPE_V"
-        --threads "$NUM_THREADS"
-        --threads-batch "$THREAD_BATCH"
-        --cache-prompt
-        --cache-idle-slots
-        --metrics
-        --temp "$TEMPERATURE"
-        --top-p "$TOP_P"
-        --top-k "$TOP_K"
-        --min-p "$MIN_P"
-        --reasoning "$REASONING"
-        --reasoning-format "$REASONING_FORMAT"
-        --reasoning-budget -1
-    )
-    
-    # Add spec flags
-    if [[ "$spec_type" == "ngram-mod" ]]; then
-        cmd+=(
-            --spec-type "ngram-mod"
-            --spec-ngram-mod-n-max "$ngram_n_max"
-            --spec-ngram-mod-n-min "$ngram_n_min"
-        )
-    else
-        cmd+=(
-            --spec-type "none"
-        )
-    fi
-    
-    # Start server with stderr to log
-    local log_file="/tmp/ngram-bench-${label//[^a-zA-Z0-9]/-}.log"
-    echo "  Starting server (log: $log_file)..."
-    
-    "${cmd[@]}" 2> "$log_file" &
-    local server_pid=$!
-    
-    if ! wait_for_server "$port"; then
-        echo "ERROR: Server failed to start" >&2
-        kill "$server_pid" 2>/dev/null || true
-        return 1
-    fi
-    
-    echo "  Server ready."
-    
-    # Send prompt via API
-    echo "  Sending prompt..."
-    local prompt_text
-    prompt_text=$(cat "$prompt_file")
-    
-    local response
-    response=$(curl -s -X POST "http://127.0.0.1:$port/v1/completions" \
-        -H "Content-Type: application/json" \
-        -d "{
-            \"model\": \"frank-dragoon\",
-            \"prompt\": \"$prompt_text\",
-            \"max_tokens\": 128,
-            \"temperature\": 0,
-            \"stream\": false
-        }")
-    
-    # Extract metrics
-    local prompt_tokens prompt_eval_duration_ms total_duration_ms
-    prompt_tokens=$(echo "$response" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['prompt_eval_count'])" 2>/dev/null || echo "0")
-    prompt_eval_duration_ms=$(echo "$response" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['prompt_eval_duration_ms'])" 2>/dev/null || echo "0")
-    total_duration_ms=$(echo "$response" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['total_duration_ms'])" 2>/dev/null || echo "0")
-    
-    # Calculate throughput
-    local prompt_tps=0
-    if [[ "$prompt_eval_duration_ms" -gt 0 ]]; then
-        prompt_tps=$(python3 -c "print(f'{($prompt_tokens / $prompt_eval_duration_ms) * 1000:.1f}')")
-    fi
-    
-    echo "  Prompt tokens:  $prompt_tokens"
-    echo "  Prompt eval:    ${prompt_eval_duration_ms}ms"
-    echo "  Prompt TPS:     $prompt_tps tok/s"
-    echo "  Total duration: ${total_duration_ms}ms"
-    
-    # Kill server
-    kill "$server_pid" 2>/dev/null || true
-    sleep 2
-    
-    echo "  Done."
-    echo "---"
-    
-    # Output structured results for parsing
-    echo "RESULT|$label|$prompt_file|$prompt_tokens|$prompt_eval_duration_ms|$total_duration_ms|$prompt_tps"
-}
-
-echo "╔══════════════════════════════════════════════════════════╗"
-echo "║  N-gram Mod Benchmark — frank-dragoon             ║"
-echo "║  STRIX ROCmFP4 · 64k context · two prompts             ║"
-echo "╚══════════════════════════════════════════════════════════╝"
-echo ""
-echo "Host: $HOSTNAME"
-echo "Model: $MODEL"
-echo "Build: $(basename "$LLAMA_BIN")"
-echo "Context: $CTX_SIZE"
-echo ""
-
-# Run baseline (no spec)
-echo "=== BASELINE (no speculative decoding) ==="
-echo ""
-
-BASELINE_CODE_RESULT=$(run_single_test $PORT_BASELINE "none" "$PROMPT_CODE" "Baseline-Code" 24 4)
-BASELINE_PROSE_RESULT=$(run_single_test $PORT_NGRAM "none" "$PROMPT_PROSE" "Baseline-Prose" 24 4)
-
-echo ""
-echo "=== NGRAM-MOD (speculative decoding enabled) ==="
-echo ""
-
-# Run n-gram mod
-NGRAM_CODE_RESULT=$(run_single_test $PORT_NGRAM "ngram-mod" "$PROMPT_CODE" "Ngram-Code" 24 4)
-NGRAM_PROSE_RESULT=$(run_single_test $PORT_BASELINE "ngram-mod" "$PROMPT_PROSE" "Ngram-Prose" 24 4)
-
-echo ""
-echo "╔══════════════════════════════════════════════════════════╗"
-echo "║  RESULTS SUMMARY                                       ║"
-echo "╚══════════════════════════════════════════════════════════╝"
-echo ""
-
-# Parse and display results
-python3 << 'PYEOF'
-import sys
-
-results = []
-for line in sys.stdin:
-    line = line.strip()
-    if not line.startswith("RESULT|"):
-        continue
-    parts = line.split("|")
-    if len(parts) != 8:
-        continue
-    label, prompt_file, prompt_tokens, prompt_eval_ms, total_ms, tps = parts[1], parts[2], int(parts[3]), int(parts[4]), int(parts[5]), float(parts[6])
-    results.append({
-        'label': label,
-        'prompt_file': prompt_file,
-        'prompt_tokens': prompt_tokens,
-        'prompt_eval_ms': prompt_eval_ms,
-        'total_ms': total_ms,
-        'tps': tps
-    })
-
-# Compare baseline vs ngram for each prompt type
-for code_result in results:
-    if not code_result['label'].startswith('Ngram-'):
-        continue
-    prompt_type = code_result['label'].replace('Ngram-', '').replace('Ngram', 'Baseline').replace('-', '-')
-    baseline = next((r for r in results if r['label'] == 'Baseline-' + prompt_type), None)
-    if not baseline:
-        continue
-    
-    spec = code_result['label'] == 'Ngram-' + prompt_type
-    
-    print(f"Prompt: {prompt_type}")
-    print(f"  Tokens:   {code_result['prompt_tokens']}")
-    if spec:
-        print(f"  Spec:     ngram-mod (n_max=24, n_min=4)")
-        print(f"  Prompt:   {code_result['prompt_eval_ms']}ms  |  {code_result['tps']:>10.1f} tok/s")
-        baseline_tps = baseline['tps']
-        if baseline_tps > 0:
-            improvement = ((code_result['tps'] - baseline_tps) / baseline_tps) * 100
-            print(f"  Speedup:  {improvement:+.1f}% vs baseline ({baseline_tps:.1f} tok/s)")
-    else:
-        print(f"  Spec:     none (baseline)")
-        print(f"  Prompt:   {baseline['prompt_eval_ms']}ms  |  {baseline['tps']:>10.1f} tok/s")
-    print()
-PYEOF
-
-echo ""
-echo "Raw data lines above (RESULT|... format) can be parsed for automation."
-echo ""

scripts/.AGENTTRASH/bench-spec-decode.py.ik-llama.cpp

@@ -1,229 +0,0 @@
-#!/usr/bin/env python3
-"""Benchmark decode throughput across speculative decoding configs.
-
-Sweeps 4 configs: none, ngram-mod, draft-mtp, draft-mtp+ngram-mod.
-Each config generates 16k tokens from a minimal prompt at temp 0.
-
-Runs ON the target host (Dankclaw). Service management uses local sudo.
-Usage:
-    python3 bench-spec-decode.py [--max-tokens N] [--host H] [--port P]
-"""
-import json
-import subprocess
-import sys
-import time
-import urllib.request
-import urllib.error
-
-SERVICE = "frank-dragoon"
-ENV_FILE = "/home/dank/serverAppConfigs/scripts/frank-dragoon.env"
-ALIAS = "frank-dragoon"
-DEFAULT_HOST = "localhost"
-DEFAULT_PORT = 7770
-DEFAULT_MAX_TOKENS = 16384
-HEALTH_TIMEOUT = 1200  # 20 min for cold load
-HEALTH_INTERVAL = 5
-
-PROMPT = (
-    "Write a comprehensive, detailed essay about the complete history of "
-    "computing, from the earliest mechanical calculators through modern AI. "
-    "Cover every major era in detail, including key figures, machines, and "
-    "breakthroughs. Be as thorough as possible."
-)
-
-CONFIGS = [
-    ("none", "none"),
-    ("ngram-mod", "ngram-mod"),
-    ("draft-mtp", "draft-mtp"),
-    ("draft-mtp+ngram-mod", "draft-mtp,ngram-mod"),
-]
-
-
-def local(cmd):
-    """Run a command locally (the script runs on the target host)."""
-    r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=120)
-    if r.returncode != 0:
-        print(f"  WARNING: {cmd} -> exit {r.returncode}: {r.stderr.strip()}",
-              file=sys.stderr)
-    return r
-
-
-def sed_spec_type(value):
-    local(f"sudo sed -i 's/^SPEC_TYPE=.*/SPEC_TYPE={value}/' {ENV_FILE}")
-
-
-def wait_health(host, port, timeout=HEALTH_TIMEOUT):
-    start = time.time()
-    while time.time() - start < timeout:
-        try:
-            resp = urllib.request.urlopen(
-                f"http://{host}:{port}/health", timeout=10
-            )
-            if resp.status == 200:
-                return True
-        except (urllib.error.URLError, urllib.error.HTTPError, ConnectionError,
-                OSError):
-            pass
-        time.sleep(HEALTH_INTERVAL)
-    return False
-
-
-def benchmark(host, port, alias, max_tokens):
-    body = json.dumps({
-        "model": alias,
-        "messages": [{"role": "user", "content": PROMPT}],
-        "max_tokens": max_tokens,
-        "temperature": 0,
-        "stream": False,
-    }).encode()
-    req = urllib.request.Request(
-        f"http://{host}:{port}/v1/chat/completions",
-        data=body,
-        headers={"Content-Type": "application/json"},
-    )
-    t0 = time.time()
-    resp = urllib.request.urlopen(req, timeout=1200)
-    wall = time.time() - t0
-    data = json.loads(resp.read())
-    return data, wall
-
-
-def main():
-    import argparse
-    ap = argparse.ArgumentParser(description=__doc__)
-    ap.add_argument("--host", default=DEFAULT_HOST)
-    ap.add_argument("--port", type=int, default=DEFAULT_PORT)
-    ap.add_argument("--max-tokens", type=int, default=DEFAULT_MAX_TOKENS)
-    args = ap.parse_args()
-
-    # Read original SPEC_TYPE from the env file
-    r = local(f"grep '^SPEC_TYPE=' {ENV_FILE}")
-    original_spec = r.stdout.strip()
-    orig_val = (original_spec.split("=", 1)[1]
-                if "=" in original_spec else "draft-mtp,ngram-mod")
-    print(f"Original: {original_spec}")
-    print(f"Max tokens: {args.max_tokens}")
-    print(f"Configs: {[c[0] for c in CONFIGS]}")
-    print()
-
-    # Stop + mask the production service
-    print("Stopping + masking production service...")
-    local(f"sudo systemctl stop {SERVICE}")
-    local(f"sudo systemctl mask {SERVICE}")
-    time.sleep(2)
-
-    results = []
-    for name, spec_type in CONFIGS:
-        print(f"\n{'='*60}")
-        print(f"Config: {name} (SPEC_TYPE={spec_type})")
-        print(f"{'='*60}")
-
-        # Set SPEC_TYPE
-        sed_spec_type(spec_type)
-        print(f"Set SPEC_TYPE={spec_type}")
-
-        # Start the service
-        local(f"sudo systemctl unmask {SERVICE}")
-        local(f"sudo systemctl start {SERVICE}")
-        print("Starting service...")
-
-        # Wait for health
-        print(f"Waiting for health (up to {HEALTH_TIMEOUT}s)...")
-        if not wait_health(args.host, args.port):
-            print(f"FAILED: service did not become healthy for {name}")
-            results.append({
-                "config": name, "spec_type": spec_type,
-                "error": "health timeout",
-            })
-            local(f"sudo systemctl stop {SERVICE}")
-            local(f"sudo systemctl mask {SERVICE}")
-            continue
-
-        print("Healthy. Running benchmark...")
-
-        # Run benchmark
-        try:
-            data, wall = benchmark(
-                args.host, args.port, ALIAS, args.max_tokens
-            )
-        except Exception as e:
-            print(f"FAILED: {e}")
-            results.append({
-                "config": name, "spec_type": spec_type,
-                "error": str(e),
-            })
-            local(f"sudo systemctl stop {SERVICE}")
-            local(f"sudo systemctl mask {SERVICE}")
-            continue
-
-        timings = data.get("timings", {})
-        usage = data.get("usage", {})
-        pred_n = timings.get("predicted_n", usage.get("completion_tokens", 0))
-        pred_ms = timings.get("predicted_ms", 0)
-        pred_ps = timings.get("predicted_per_second", 0)
-        prompt_n = timings.get("prompt_n", usage.get("prompt_tokens", 0))
-        prompt_ms = timings.get("prompt_ms", 0)
-
-        print(f"  Generated:   {pred_n} tokens")
-        print(f"  Wall time:   {wall:.1f}s")
-        print(f"  Decode:      {pred_ps:.2f} tok/s")
-        print(f"  Prefill:     {prompt_n} tokens in {prompt_ms:.0f}ms"
-              f" ({prompt_n / max(prompt_ms, 1) * 1000:.1f} tok/s)")
-
-        results.append({
-            "config": name,
-            "spec_type": spec_type,
-            "predicted_tokens": pred_n,
-            "predicted_ms": pred_ms,
-            "predicted_per_second": pred_ps,
-            "prompt_tokens": prompt_n,
-            "prompt_ms": prompt_ms,
-            "wall_time": wall,
-        })
-
-        # Stop + mask between configs
-        local(f"sudo systemctl stop {SERVICE}")
-        local(f"sudo systemctl mask {SERVICE}")
-        time.sleep(2)
-
-    # Restore original SPEC_TYPE
-    sed_spec_type(orig_val)
-    print(f"\nRestoring SPEC_TYPE={orig_val}")
-    print("Unmasking + starting production service...")
-    local(f"sudo systemctl unmask {SERVICE}")
-    local(f"sudo systemctl start {SERVICE}")
-
-    # Health check
-    if wait_health(args.host, args.port):
-        print("Production service healthy.")
-    else:
-        print("WARNING: production service not healthy after restore!")
-
-    # Print results table
-    print(f"\n{'='*70}")
-    print("RESULTS")
-    print(f"{'='*70}")
-    print(f"{'Config':<30} {'Tokens':>8} {'Wall(s)':>10} {'Decode tok/s':>14} "
-          f"{'Error':>20}")
-    print(f"{'-'*30} {'-'*8} {'-'*10} {'-'*14} {'-'*20}")
-    for r in results:
-        if "error" in r:
-            print(f"{r['config']:<30} {'':>8} {'':>10} {'':>14} "
-                  f"{r['error']:>20}")
-        else:
-            print(f"{r['config']:<30} {r['predicted_tokens']:>8} "
-                  f"{r['wall_time']:>10.1f} {r['predicted_per_second']:>14.2f} "
-                  f"{'':>20}")
-    print(f"{'='*70}")
-
-    # Save JSON results
-    ts = time.strftime("%Y%m%d-%H%M%S")
-    out = f"/tmp/bench-spec-decode-{ts}.json"
-    with open(out, "w") as f:
-        json.dump({"results": results, "max_tokens": args.max_tokens,
-                   "timestamp": ts}, f, indent=2)
-    print(f"Results saved: {out}")
-
-
-if __name__ == "__main__":
-    main()

scripts/.AGENTTRASH/bench-vllm-corpus.py

@@ -1,85 +0,0 @@
-#!/usr/bin/env python3
-"""bench-vllm-corpus.py — build a code-shaped benchmark corpus from the repo.
-
-Why this exists: `vllm bench serve --dataset-name random` produces synthetic
-token soup, and speculative decoding accepts it nothing like real code — measured
-on frank-medium, random prompts accepted 2.9-3.6 tokens/update against the ~5.8
-the upstream reference reports on a code mix, which makes the random corpus
-under-report throughput by a wide margin and would pick the wrong SPEC depth.
-
-The prompts are the shape agents actually send: a repository artifact plus an
-instruction that requires reading it. Output length is fixed at bench time
-(`--custom-output-len`), so the corpus carries prompts only.
-
-Usage:
-    bench-vllm-corpus.py [repo-root] [out.jsonl]
-
-Then feed it to the endpoint (see scripts/bench-vllm-serve.sh, which passes the
-tokenizer the client needs and salts prompts so no run inherits a warm prefix
-cache). Methodology and the numbers these corpora produced are in
-serverAppConfigs-docs/LLM/frank-medium-radiance-mxfp4.md.
-"""
-
-from __future__ import annotations
-
-import json
-import pathlib
-import sys
-
-REPO = pathlib.Path(sys.argv[1] if len(sys.argv) > 1 else "/home/dank/serverAppConfigs")
-OUT = pathlib.Path(sys.argv[2] if len(sys.argv) > 2 else "/home/dank/bench/corpus-code.jsonl")
-
-TARGETS = [
-    "scripts/deploy-remote.sh",
-    "scripts/deploy-plan.py",
-    "scripts/deploy.sh",
-    "dankserver/frank-medium/radiance-entrypoint.sh",
-    "dankserver/frank-medium/quadlet/frank-medium-a.container",
-    "dankserver/frank-medium/proxy/affinity-proxy.py",
-    "dankserver/frank-medium/proxy/routing.py",
-    "tests/frank_medium_quadlet.bats",
-    "tests/deployment_scoping.bats",
-    "dankclaw/hermes/quadlet/hermes.container",
-    "dankclaw/anubis/quadlet/anubis.container",
-    "shared/prometheus/prometheus.yml",
-    "shared/prometheus/rules/llm-fleet.yml",
-    "shared/loki/loki-config.yaml",
-    "dankclaw/compose.yaml",
-    "dankserver/copyparty/quadlet/copyparty.container",
-]
-
-PROMPTS = [
-    "Read this repository artifact and summarise what it does, then list every "
-    "assumption it makes about the host it runs on.\n\n```\n{body}\n```",
-    "Here is a file from our homelab repository. Identify any bug, race or "
-    "missing error path, and show the minimal patch that fixes it.\n\n```\n{body}\n```",
-    "Explain this configuration to a new operator, then rewrite it with "
-    "comments that state the constraint each line protects.\n\n```\n{body}\n```",
-    "This file changed in a recent deploy. Write the changelog entry and a test "
-    "that would fail if the change regressed.\n\n```\n{body}\n```",
-]
-
-MAX_LINES = 220
-
-
-def main() -> int:
-    samples = []
-    for i, rel in enumerate(TARGETS):
-        path = REPO / rel
-        if not path.is_file():
-            continue
-        body = "\n".join(path.read_text(errors="replace").splitlines()[:MAX_LINES])
-        samples.append({"prompt": PROMPTS[i % len(PROMPTS)].format(body=body)})
-    if not samples:
-        print(f"no corpus sources found under {REPO}", file=sys.stderr)
-        return 1
-    OUT.parent.mkdir(parents=True, exist_ok=True)
-    with OUT.open("w") as fh:
-        for sample in samples:
-            fh.write(json.dumps(sample) + "\n")
-    print(f"wrote {len(samples)} prompts to {OUT}")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

scripts/.AGENTTRASH/bench-vllm-serve.sh

@@ -1,63 +0,0 @@
-#!/bin/bash
-# bench-vllm-serve.sh — concurrency sweep against a vLLM endpoint.
-#
-# Usage: bench-vllm-serve.sh <tag> <port> [concurrency ...]
-#   e.g. bench-vllm-serve.sh baseline 7770 1 4 8
-#
-# Runs `vllm bench serve` from inside the serving image (so the client matches
-# the server build) through an OpenAI-compatible endpoint, on the code corpus
-# scripts/bench-vllm-corpus.py writes.
-#
-# Two traps this script exists to encode, both of which produced silent garbage
-# during the 2026-09-16 frank-medium work:
-#
-#   1. The tokenizer must be passed explicitly and /models mounted. With only
-#      `--model frank-medium` the client tries to resolve that alias on
-#      HuggingFace and dies before sending a request — a run that looks like a
-#      benchmark and reports nothing.
-#   2. `--ignore-eos` is deliberate: it measures decode throughput at a fixed
-#      output length. Drop it when you care about real stop behaviour, but then
-#      do not compare the numbers with anything measured under it.
-#
-# Also note the corpora are code-shaped on purpose (see the generator's header):
-# synthetic random prompts misreport speculative acceptance badly.
-#
-# Methodology, and the numbers these runs produced on 2x R9700, are in
-# serverAppConfigs-docs/LLM/frank-medium-radiance-mxfp4.md.
-set -u
-
-TAG=${1:?usage: bench-vllm-serve.sh <tag> <port> [concurrency ...]}
-PORT=${2:?usage: bench-vllm-serve.sh <tag> <port> [concurrency ...]}
-shift 2
-CONCS=("$@")
-[ "${#CONCS[@]}" -eq 0 ] && CONCS=(1 4 8)
-
-IMG=${IMG:-localhost/radiance-vllm:0.9.3}
-MODELS_DIR=${MODELS_DIR:-/home/dank/models}
-TOK=${TOK:-/models/Qwen3.8-27B-Uncensored-MXFP4-awq}
-BENCH_DIR=${BENCH_DIR:-/home/dank/bench}
-CORPUS=${CORPUS:-$BENCH_DIR/corpus-code.jsonl}
-OUT=${OUT:-$BENCH_DIR/$TAG}
-mkdir -p "$OUT"
-
-if [ ! -f "$CORPUS" ]; then
-    echo "corpus $CORPUS is missing; run scripts/bench-vllm-corpus.py first" >&2
-    exit 1
-fi
-
-for c in "${CONCS[@]}"; do
-    echo "== $TAG conc=$c (port $PORT)"
-    podman run --rm --network=host -v "$MODELS_DIR":/models:ro -v "$BENCH_DIR":/bench:ro \
-        -e HF_HUB_OFFLINE=1 --entrypoint bash "$IMG" -lc "
-        vllm bench serve --backend openai-chat \
-          --base-url http://127.0.0.1:$PORT --endpoint /v1/chat/completions \
-          --model frank-medium --tokenizer $TOK \
-          --dataset-name custom --dataset-path /bench/$(basename "$CORPUS") \
-          --custom-output-len 512 --num-prompts 16 --max-concurrency $c \
-          --disable-shuffle --seed 0 --ignore-eos \
-          --percentile-metrics ttft,tpot --metric-percentiles 50,99 \
-          --disable-tqdm 2>&1 | grep -E 'Successful requests|Benchmark duration|Output token throughput|Total Token throughput|Mean TTFT|P50 TTFT|P50 TPOT|Acceptance rate|Acceptance length'
-    " 2>&1 | sed 's/^/  /'
-    echo
-done
-echo "results for $TAG written under $OUT"

scripts/.AGENTTRASH/chat-template.jinja.ik-llama-qwen-sharp

@@ -1,453 +0,0 @@
-{%- set template_version = "qwen3.8-froggeric-v22.4.0" %}
-{%- set _tool_format = tool_call_format if tool_call_format is defined else 'xml' %}
-{%- set image_count = namespace(value=0) %}
-{%- set video_count = namespace(value=0) %}
-{%- set add_vision_id = add_vision_id if add_vision_id is defined else false %}
-{%- set enable_thinking = enable_thinking if enable_thinking is defined else true %}
-{%- set auto_disable_thinking_with_tools = auto_disable_thinking_with_tools if auto_disable_thinking_with_tools is defined else false %}
-{%- if preserve_reasoning is defined and preserve_reasoning is not none %}
-    {%- set _preserve_thinking = preserve_reasoning %}
-{%- elif preserve_thinking is defined and preserve_thinking is not none %}
-    {%- set _preserve_thinking = preserve_thinking %}
-{%- else %}
-    {%- set _preserve_thinking = true %}
-{%- endif %}
-{%- set max_tool_arg_chars = max_tool_arg_chars if max_tool_arg_chars is defined else 0 %}
-{%- set max_tool_response_chars = max_tool_response_chars if max_tool_response_chars is defined else 0 %}
-{%- set _default_reasoning_effort = 'medium' %}
-{%- set _has_tools = (tools is defined and tools and tools is iterable and tools is not mapping) %}
-{%- set _effort_raw = (reasoning_effort | string | lower) if reasoning_effort is defined and reasoning_effort is not none else _default_reasoning_effort %}
-{%- set _initial_thinking = enable_thinking %}
-{%- if _effort_raw in ('none', 'off') %}
-    {%- set _initial_thinking = false %}
-    {%- set _initial_effort = 'medium' %}
-{%- elif _effort_raw in ('minimal', 'low') %}
-    {%- set _initial_effort = 'low' %}
-{%- elif _effort_raw in ('high', 'xhigh', 'max', 'ultracode', 'extreme') %}
-    {%- set _initial_effort = 'xhigh' %}
-{%- else %}
-    {%- set _initial_effort = 'medium' %}
-{%- endif %}
-{%- set ns_state = namespace(thinking=_initial_thinking, effort=_initial_effort) %}
-{%- if auto_disable_thinking_with_tools and _has_tools %}
-    {%- set ns_state.thinking = false %}
-{%- endif %}
-{%- for msg in messages %}
-    {%- if msg.role == 'system' or msg.role == 'developer' or msg.role == 'user' %}
-        {%- if msg.content is string %}
-            {%- if '<|think_off|>' in msg.content %}
-                {%- set ns_state.thinking = false %}
-            {%- elif '<|think_on|>' in msg.content %}
-                {%- set ns_state.thinking = true %}
-            {%- elif '<|think_xhigh|>' in msg.content or '<|think_high|>' in msg.content or '<|think_ultracode|>' in msg.content or '<|think_extreme|>' in msg.content or '<|think_max|>' in msg.content %}
-                {%- set ns_state.thinking = true %}
-                {%- set ns_state.effort = 'xhigh' %}
-            {%- elif '<|think_low|>' in msg.content or '<|think_minimal|>' in msg.content %}
-                {%- set ns_state.thinking = true %}
-                {%- set ns_state.effort = 'low' %}
-            {%- elif '<|think_medium|>' in msg.content %}
-                {%- set ns_state.thinking = true %}
-                {%- set ns_state.effort = 'medium' %}
-            {%- endif %}
-        {%- elif msg.content is iterable and msg.content is not mapping %}
-            {%- for item in msg.content %}
-                {%- if item is string %}
-                    {%- set _item_text = item %}
-                {%- elif item is mapping and 'text' in item and item.text is string %}
-                    {%- set _item_text = item.text %}
-                {%- else %}
-                    {%- set _item_text = '' %}
-                {%- endif %}
-                {%- if _item_text %}
-                    {%- if '<|think_off|>' in _item_text %}
-                        {%- set ns_state.thinking = false %}
-                    {%- elif '<|think_on|>' in _item_text %}
-                        {%- set ns_state.thinking = true %}
-                    {%- elif '<|think_xhigh|>' in _item_text or '<|think_high|>' in _item_text or '<|think_ultracode|>' in _item_text or '<|think_extreme|>' in _item_text or '<|think_max|>' in _item_text %}
-                        {%- set ns_state.thinking = true %}
-                        {%- set ns_state.effort = 'xhigh' %}
-                    {%- elif '<|think_low|>' in _item_text or '<|think_minimal|>' in _item_text %}
-                        {%- set ns_state.thinking = true %}
-                        {%- set ns_state.effort = 'low' %}
-                    {%- elif '<|think_medium|>' in _item_text %}
-                        {%- set ns_state.thinking = true %}
-                        {%- set ns_state.effort = 'medium' %}
-                    {%- endif %}
-                {%- endif %}
-            {%- endfor %}
-        {%- endif %}
-    {%- endif %}
-{%- endfor %}
-{%- set reasoning_instructions = '' %}
-{%- if ns_state.thinking %}
-    {%- if ns_state.effort == 'xhigh' %}
-        {%- set reasoning_instructions = 'Reasoning effort is set to xhigh. Please think carefully through the task, validate key assumptions, consider plausible alternatives, and prioritize correctness, consistency, and clarity in the final answer.' %}
-    {%- elif ns_state.effort == 'low' %}
-        {%- set reasoning_instructions = 'Reasoning effort is set to low. Keep your thinking brief and focused, moving directly to the conclusion without unnecessary elaboration.' %}
-    {%- endif %}
-{%- endif %}
-{%- macro render_content(content, do_vision_count, is_system_content=false) %}
-    {%- if content is string %}
-        {{- content }}
-    {%- elif content is iterable and content is not mapping %}
-        {%- for item in content %}
-            {%- if item is mapping %}
-                {%- if item.type == 'image' or 'image' in item or 'image_url' in item %}
-                    {%- if is_system_content %}
-                        {{- raise_exception('System message cannot contain images.') }}
-                    {%- endif %}
-                    {%- if do_vision_count %}
-                        {%- set image_count.value = image_count.value + 1 %}
-                    {%- endif %}
-                    {%- if add_vision_id %}
-                        {{- 'Picture ' ~ image_count.value ~ ': ' }}
-                    {%- endif %}
-                    {{- '<|vision_start|><|image_pad|><|vision_end|>' }}
-                {%- elif item.type == 'video' or 'video' in item %}
-                    {%- if is_system_content %}
-                        {{- raise_exception('System message cannot contain videos.') }}
-                    {%- endif %}
-                    {%- if do_vision_count %}
-                        {%- set video_count.value = video_count.value + 1 %}
-                    {%- endif %}
-                    {%- if add_vision_id %}
-                        {{- 'Video ' ~ video_count.value ~ ': ' }}
-                    {%- endif %}
-                    {{- '<|vision_start|><|video_pad|><|vision_end|>' }}
-                {%- elif 'text' in item %}
-                    {{- item.text }}
-                {%- else %}
-                    {{- raise_exception('Unexpected item type in content.') }}
-                {%- endif %}
-            {%- else %}
-                {{- item | string }}
-            {%- endif %}
-        {%- endfor %}
-    {%- elif content is none or content is undefined %}
-        {{- '' }}
-    {%- else %}
-        {{- raise_exception('Unexpected content type.') }}
-    {%- endif %}
-{%- endmacro %}
-{%- if not messages %}
-    {{- raise_exception('No messages provided.') }}
-{%- endif %}
-{%- set head = namespace(count=0, seen_non_system=false) %}
-{%- for message in messages %}
-    {%- set _is_sys = (message.role == 'system' or message.role == 'developer') %}
-    {%- if _is_sys and not head.seen_non_system %}
-        {%- set head.count = head.count + 1 %}
-    {%- else %}
-        {%- set head.seen_non_system = true %}
-    {%- endif %}
-{%- endfor %}
-{%- set sys_state = namespace(content='') %}
-{%- for message in messages[:head.count] %}
-    {%- set _part = render_content(message.content, false, true) | trim %}
-    {%- if '<|think_off|>' in _part %}{%- set _part = _part.split('<|think_off|>') | join('') | trim %}{%- endif %}
-    {%- if '<|think_on|>' in _part %}{%- set _part = _part.split('<|think_on|>') | join('') | trim %}{%- endif %}
-    {%- if '<|think_xhigh|>' in _part %}{%- set _part = _part.split('<|think_xhigh|>') | join('') | trim %}{%- endif %}
-    {%- if '<|think_high|>' in _part %}{%- set _part = _part.split('<|think_high|>') | join('') | trim %}{%- endif %}
-    {%- if '<|think_ultracode|>' in _part %}{%- set _part = _part.split('<|think_ultracode|>') | join('') | trim %}{%- endif %}
-    {%- if '<|think_extreme|>' in _part %}{%- set _part = _part.split('<|think_extreme|>') | join('') | trim %}{%- endif %}
-    {%- if '<|think_max|>' in _part %}{%- set _part = _part.split('<|think_max|>') | join('') | trim %}{%- endif %}
-    {%- if '<|think_medium|>' in _part %}{%- set _part = _part.split('<|think_medium|>') | join('') | trim %}{%- endif %}
-    {%- if '<|think_low|>' in _part %}{%- set _part = _part.split('<|think_low|>') | join('') | trim %}{%- endif %}
-    {%- if '<|think_minimal|>' in _part %}{%- set _part = _part.split('<|think_minimal|>') | join('') | trim %}{%- endif %}
-    {%- if _part %}
-        {%- if sys_state.content %}
-            {%- set sys_state.content = sys_state.content ~ '\n\n' ~ _part %}
-        {%- else %}
-            {%- set sys_state.content = _part %}
-        {%- endif %}
-    {%- endif %}
-{%- endfor %}
-{%- set _sc = sys_state.content %}
-{%- set _msgs = messages[head.count:] %}
-{%- if ns_state.thinking %}
-    {%- set _terse_lead = 'Answer directly, after thinking. Lead with the answer, then only what it needs to be correct and usable.' %}
-{%- else %}
-    {%- set _terse_lead = 'Answer directly and concisely. Give the answer with only what it needs to be correct and usable.' %}
-{%- endif %}
-{%- set _terse_core %}
-Never: open with preamble or pleasantries; restate the question; add filler transitions; hedge with niceties; or repeat a point you've already made.
-Always: keep essential steps, caveats, uncertainties, and specifics — never drop correctness or a needed warning for brevity. Keep the final answer lean. Use the least structure that conveys it (plain prose when short; lists or code only when they earn their place). If genuinely uncertain, say so and explain why — never omit uncertainty for the sake of brevity.
-If a user request is genuinely ambiguous, ask a sharp question, don't guess.
-{%- endset %}
-{%- set _terse = _terse_lead ~ '\n' ~ (_terse_core | trim) %}
-{#- `terse` chat-template kwarg: default true, so behaviour is unchanged unless a caller opts out.
-    Pass {"terse": false} via chat_template_kwargs to serve the model with only its own system
-    prompt -- useful for A/B-ing the terseness effect, or when a downstream prompt conflicts. #}
-{%- set _terse_on = terse if terse is defined else true %}
-{%- if _terse_on %}
-    {%- if not _sc %}
-        {%- set _sc = _terse | trim %}
-    {%- else %}
-        {%- set _sc = (_sc | trim) ~ '\n\n' ~ (_terse | trim) %}
-    {%- endif %}
-{%- endif %}
-{%- if _has_tools %}
-    {{- '<|im_start|>system\n' }}
-    {%- if reasoning_instructions %}
-        {{- reasoning_instructions + '\n\n' }}
-    {%- endif %}
-    {{- '# Tools\n\nYou have access to the following functions:\n\n<tools>' }}
-    {%- for tool in tools %}
-        {{- '\n' }}
-        {{- tool | tojson }}
-    {%- endfor %}
-    {{- '\n</tools>' }}
-    {%- if _tool_format == 'json' %}
-        {{- '\n\nIf you choose to call a function ONLY reply in the following format with NO suffix:\n\n' }}{%- if ns_state.thinking %}{{- '<think>\nBrief explanation of tool call\n</think>\n' }}{%- endif %}{{- '<tool_call>\n{"name": "example_function_name", "arguments": {"example_parameter_1": "value_1", "example_parameter_2": "This is the value for the second parameter"}}\n</tool_call>\n\n<IMPORTANT>\nReminder:\n' }}{%- if ns_state.thinking %}{{- '- You can use the <think></think> block to plan your next tool call OR to synthesize data and formulate your final response to the user.\n- ALL explanation and reasoning MUST be placed strictly inside the <think></think> block.\n' }}{%- endif %}{{- '- Function calls MUST follow the specified format: a single JSON object with "name" and "arguments" keys inside <tool_call></tool_call> XML tags.\n- If you choose to call a tool, you MUST output the <tool_call> block IMMEDIATELY' }}{%- if ns_state.thinking %}{{- ' after thinking' }}{%- endif %}{{- ', with NO conversational text before it.\n- The <tool_call> tag MUST be at the very beginning of a new line, with NO spaces or indentation before it.\n- To call multiple functions, output a separate, completely closed <tool_call></tool_call> block for EACH function. Do NOT nest <tool_call> blocks.\n- If you have all necessary data, provide your final answer directly to the user without any tool call.\n</IMPORTANT>' }}
-    {%- else %}
-        {{- '\n\nIf you choose to call a function ONLY reply in the following format with NO suffix:\n\n' }}{%- if ns_state.thinking %}{{- '<think>\nBrief explanation of tool call\n</think>\n' }}{%- endif %}{{- '<tool_call>\n<function=example_function_name>\n<parameter=example_parameter_1>\nvalue_1\n</parameter>\n<parameter=example_parameter_2>\nThis is the value for the second parameter\nthat can span\nmultiple lines\n</parameter>\n</function>\n</tool_call>\n\n<IMPORTANT>\nReminder:\n' }}{%- if ns_state.thinking %}{{- '- You can use the <think></think> block to plan your next tool call OR to synthesize data and formulate your final response to the user.\n- ALL explanation and reasoning MUST be placed strictly inside the <think></think> block.\n' }}{%- endif %}{{- '- Function calls MUST follow the specified format: an inner <function=...></function> block must be nested within <tool_call></tool_call> XML tags.\n- If you choose to call a tool, you MUST output the <tool_call> block IMMEDIATELY' }}{%- if ns_state.thinking %}{{- ' after thinking' }}{%- endif %}{{- ', with NO conversational text before it.\n- The <tool_call> and <function> tags MUST be at the very beginning of a new line, with NO spaces or indentation before them.\n- To call multiple functions, output a separate, completely closed <tool_call></tool_call> block for EACH function. Do NOT nest <tool_call> blocks.\n- If you have all necessary data, provide your final answer directly to the user without any tool call.\n</IMPORTANT>' }}
-    {%- endif %}
-    {%- if _sc %}
-        {{- '\n\n' + _sc }}
-    {%- endif %}
-    {{- '<|im_end|>\n' }}
-{%- else %}
-    {%- if _sc %}
-        {{- '<|im_start|>system\n' + (reasoning_instructions + '\n\n' if reasoning_instructions else '') + _sc + '<|im_end|>\n' }}
-    {%- elif reasoning_instructions %}
-        {{- '<|im_start|>system\n' + reasoning_instructions + '<|im_end|>\n' }}
-    {%- endif %}
-{%- endif %}
-{%- set _last_idx = _msgs | length - 1 %}
-{%- set ns = namespace(multi_step_tool=true, last_query_index=_last_idx) %}
-{%- for message in _msgs[::-1] %}
-    {%- set index = (_msgs | length - 1) - loop.index0 %}
-    {%- if ns.multi_step_tool and message.role == 'user' %}
-        {%- set _rc = render_content(message.content, false) | trim %}
-        {%- if not (_rc.startswith('<tool_response>') and _rc.endswith('</tool_response>')) %}
-            {%- set ns.multi_step_tool = false %}
-            {%- set ns.last_query_index = index %}
-        {%- endif %}
-    {%- endif %}
-{%- endfor %}
-{%- if ns.multi_step_tool %}
-    {%- if _last_idx > 50 %}
-        {%- set ns.last_query_index = _last_idx %}
-    {%- else %}
-        {%- set ns.last_query_index = 0 %}
-    {%- endif %}
-{%- endif %}
-{%- set ns2 = namespace(prev_role='', consecutive_failures=0) %}
-{%- for message in _msgs %}
-    {%- set is_system = (message.role == "system" or message.role == "developer") %}
-    {%- set content = render_content(message.content, true, is_system) | trim %}
-    {%- if is_system or message.role == 'user' %}
-        {%- if '<|think_off|>' in content %}{%- set content = content.split('<|think_off|>') | join('') | trim %}{%- endif %}
-        {%- if '<|think_on|>' in content %}{%- set content = content.split('<|think_on|>') | join('') | trim %}{%- endif %}
-        {%- if '<|think_xhigh|>' in content %}{%- set content = content.split('<|think_xhigh|>') | join('') | trim %}{%- endif %}
-        {%- if '<|think_high|>' in content %}{%- set content = content.split('<|think_high|>') | join('') | trim %}{%- endif %}
-        {%- if '<|think_ultracode|>' in content %}{%- set content = content.split('<|think_ultracode|>') | join('') | trim %}{%- endif %}
-        {%- if '<|think_extreme|>' in content %}{%- set content = content.split('<|think_extreme|>') | join('') | trim %}{%- endif %}
-        {%- if '<|think_max|>' in content %}{%- set content = content.split('<|think_max|>') | join('') | trim %}{%- endif %}
-        {%- if '<|think_medium|>' in content %}{%- set content = content.split('<|think_medium|>') | join('') | trim %}{%- endif %}
-        {%- if '<|think_low|>' in content %}{%- set content = content.split('<|think_low|>') | join('') | trim %}{%- endif %}
-        {%- if '<|think_minimal|>' in content %}{%- set content = content.split('<|think_minimal|>') | join('') | trim %}{%- endif %}
-    {%- endif %}
-    {%- if is_system %}
-        {{- '<|im_start|>system\n' + content + '<|im_end|>\n' }}
-    {%- elif message.role == 'user' %}
-        {%- set ns2.consecutive_failures = 0 %}
-        {{- '<|im_start|>user\n' + content + '<|im_end|>\n' }}
-    {%- elif message.role == 'assistant' %}
-        {%- set reasoning_content = '' %}
-        {%- set _explicit_reasoning = '' %}
-        {%- if message.reasoning_content is defined and message.reasoning_content is not none %}
-            {%- if message.reasoning_content is string %}
-                {%- set _explicit_reasoning = message.reasoning_content %}
-            {%- else %}
-                {%- set _explicit_reasoning = message.reasoning_content | string %}
-            {%- endif %}
-        {%- elif message.thinking is defined and message.thinking is not none %}
-            {%- if message.thinking is string %}
-                {%- set _explicit_reasoning = message.thinking %}
-            {%- else %}
-                {%- set _explicit_reasoning = message.thinking | string %}
-            {%- endif %}
-        {%- elif message.reasoning is defined and message.reasoning is not none %}
-            {%- if message.reasoning is string %}
-                {%- set _explicit_reasoning = message.reasoning %}
-            {%- else %}
-                {%- set _explicit_reasoning = message.reasoning | string %}
-            {%- endif %}
-        {%- endif %}
-        {%- if _explicit_reasoning %}
-            {%- set _lead_end = '' %}
-            {%- if content.startswith('<think>') and '</think>' in content %}
-                {%- set _lead_end = '</think>' %}
-            {%- elif content.startswith('<thinking>') and '</thinking>' in content %}
-                {%- set _lead_end = '</thinking>' %}
-            {%- elif content.startswith('</think>') %}
-                {%- set _lead_end = '</think>' %}
-            {%- elif content.startswith('</thinking>') %}
-                {%- set _lead_end = '</thinking>' %}
-            {%- endif %}
-            {%- if _lead_end %}
-                {%- set content = content.split(_lead_end)[-1].lstrip('\n') %}
-            {%- endif %}
-            {%- set reasoning_content = _explicit_reasoning %}
-        {%- else %}
-            {%- set _think_end = '' %}
-            {%- if content.startswith('</think>') %}
-                {%- set _think_end = '</think>' %}
-            {%- elif content.startswith('</thinking>') %}
-                {%- set _think_end = '</thinking>' %}
-            {%- elif '\n</think>' in content %}
-                {%- set _think_end = '\n</think>' %}
-            {%- elif '\n</thinking>' in content %}
-                {%- set _think_end = '\n</thinking>' %}
-            {%- elif '\n</ think>' in content %}
-                {%- set _think_end = '\n</ think>' %}
-            {%- elif '\n</think >' in content %}
-                {%- set _think_end = '\n</think >' %}
-            {%- elif content.startswith('<think>') and '</think>' in content %}
-                {%- set _think_end = '</think>' %}
-            {%- elif content.startswith('<thinking>') and '</thinking>' in content %}
-                {%- set _think_end = '</thinking>' %}
-            {%- endif %}
-            {%- if _think_end %}
-                {%- if 'thinking' in _think_end %}
-                    {%- set _think_start = '<thinking>' %}
-                {%- else %}
-                    {%- set _think_start = '<think>' %}
-                {%- endif %}
-                {%- set reasoning_content = content.split(_think_end)[0].rstrip('\n') %}
-                {%- if _think_start in reasoning_content %}
-                    {%- set reasoning_content = reasoning_content.split(_think_start)[-1].lstrip('\n') %}
-                {%- endif %}
-                {%- set content = content.split(_think_end)[-1].lstrip('\n') %}
-            {%- endif %}
-        {%- endif %}
-        {%- set reasoning_content = reasoning_content | trim %}
-        {%- if (_preserve_thinking or loop.index0 > ns.last_query_index) %}
-            {{- '<|im_start|>assistant\n<think>\n' + reasoning_content + '\n</think>\n\n' + content }}
-        {%- else %}
-            {{- '<|im_start|>assistant\n' + content }}
-        {%- endif %}
-        {%- if message.tool_calls is defined and message.tool_calls and message.tool_calls is iterable and message.tool_calls is not mapping %}
-            {%- for tool_call in message.tool_calls %}
-                {%- if tool_call.function is defined and tool_call.function is not none %}
-                    {%- set tc = tool_call.function %}
-                {%- else %}
-                    {%- set tc = tool_call %}
-                {%- endif %}
-                {%- set tc_name = tc.name if (tc.name is defined and tc.name is not none) else '' %}
-                {%- if _tool_format == 'json' %}
-                    {%- if loop.first %}
-                        {%- if content | trim %}
-                            {{- '\n\n' }}
-                        {%- endif %}
-                    {%- else %}
-                        {{- '\n' }}
-                    {%- endif %}
-                    {%- set _args = '{}' %}
-                    {%- if tc.arguments is defined and tc.arguments is not none %}
-                        {%- if tc.arguments is mapping %}
-                            {%- set _args = tc.arguments | tojson %}
-                        {%- elif tc.arguments is string %}
-                            {%- if tc.arguments %}
-                                {%- set _args = tc.arguments %}
-                            {%- endif %}
-                        {%- else %}
-                            {%- set _args = tc.arguments | tojson %}
-                        {%- endif %}
-                    {%- endif %}
-                    {{- '<tool_call>\n{"name": ' }}{{- tc_name | tojson }}{{- ', "arguments": ' }}{{- _args }}{{- '}\n</tool_call>' }}
-                {%- else %}
-                    {%- if loop.first %}
-                        {%- if content | trim %}
-                            {{- '\n\n<tool_call>\n<function=' + tc_name + '>\n' }}
-                        {%- else %}
-                            {{- '<tool_call>\n<function=' + tc_name + '>\n' }}
-                        {%- endif %}
-                    {%- else %}
-                        {{- '\n<tool_call>\n<function=' + tc_name + '>\n' }}
-                    {%- endif %}
-                    {%- if tc.arguments is defined and tc.arguments is not none %}
-                        {%- if tc.arguments is mapping %}
-                            {%- for args_name, args_value in tc.arguments.items() %}
-                                {{- '<parameter=' + args_name + '>\n' }}
-                                {%- if args_value is string %}
-                                    {%- set _av = args_value %}
-                                {%- else %}
-                                    {%- set _av = args_value | tojson %}
-                                {%- endif %}
-                                {%- if max_tool_arg_chars > 0 and _av | length > max_tool_arg_chars %}
-                                    {{- _av[:max_tool_arg_chars] + '\n[TRUNCATED - original length ' ~ (_av | length | string) ~ ' chars]' }}
-                                {%- else %}
-                                    {{- _av }}
-                                {%- endif %}
-                                {{- '\n</parameter>\n' }}
-                            {%- endfor %}
-                        {%- else %}
-                            {%- if tc.arguments is string %}
-                                {%- set _raw_args = tc.arguments %}
-                            {%- else %}
-                                {%- set _raw_args = tc.arguments | tojson %}
-                            {%- endif %}
-                            {%- if _raw_args %}
-                                {%- if max_tool_arg_chars > 0 and _raw_args | length > max_tool_arg_chars %}
-                                    {{- _raw_args[:max_tool_arg_chars] + '\n[TRUNCATED - original length ' ~ (_raw_args | length | string) ~ ' chars]' }}
-                                {%- else %}
-                                    {{- _raw_args }}
-                                {%- endif %}
-                            {%- endif %}
-                        {%- endif %}
-                    {%- endif %}
-                    {{- '</function>\n</tool_call>' }}
-                {%- endif %}
-            {%- endfor %}
-        {%- endif %}
-        {{- '<|im_end|>\n' }}
-    {%- elif message.role == 'tool' %}
-        {%- set _content_lower = content | lower %}
-        {%- set _content_head = _content_lower[:120] %}
-        {%- set _is_code_or_grep = ('throw new ' in _content_lower or 'throw error' in _content_lower or 'console.error' in _content_lower or 'logger.error' in _content_lower or 'logging.error' in _content_lower or 'import ' in _content_head or 'def ' in _content_head or 'function ' in _content_head) %}
-        {%- set _exit_code_zero = ('exit code: 0' in _content_head or 'process exited with code 0' in _content_head) %}
-        {%- set _error_field_ok = ('"error": null' in _content_head or '"error":null' in _content_head or '"error": false' in _content_head or '"error":false' in _content_head or '"error": ""' in _content_head or '"error":""' in _content_head) %}
-        {%- set _strong_error = (('"error":' in _content_head and not _error_field_ok) or '"status": "error"' in _content_head or '"status":"error"' in _content_head or 'traceback (most recent call last):' in _content_head or 'command not found' in _content_head or 'invalid syntax' in _content_head or 'fatal:' in _content_head or (('exit code: ' in _content_head or 'process exited with code' in _content_head) and not _exit_code_zero) or _content_head.startswith('exception:') or _content_head.startswith('failed to ')) %}
-        {%- set _weak_error = ('error:' in _content_head or 'err!' in _content_head) %}
-        {%- set _weak_suppressed = ('$ ' in _content_head or 'took ' in _content_head or content | length >= 600) %}
-        {%- if not _is_code_or_grep and (_strong_error or (_weak_error and not _weak_suppressed)) %}
-            {%- set ns2.consecutive_failures = ns2.consecutive_failures + 1 %}
-        {%- else %}
-            {%- set ns2.consecutive_failures = 0 %}
-        {%- endif %}
-        {%- if ns2.prev_role != 'tool' %}
-            {{- '<|im_start|>user' }}
-        {%- endif %}
-        {%- if _tool_format != 'json' and max_tool_response_chars > 0 and content | length > max_tool_response_chars %}
-            {%- set content = content[:max_tool_response_chars] + '\n[TRUNCATED - original length ' ~ (content | length | string) ~ ' chars]' %}
-        {%- endif %}
-        {{- '\n<tool_response>\n' + content }}
-        {%- if ns2.consecutive_failures >= 2 %}
-            {{- '\n\n⚠️ SYSTEM WARNING: ' ~ ns2.consecutive_failures ~ ' consecutive tool errors detected. Your previous approach is incorrect. You MUST use a fundamentally different approach or corrected arguments.' }}
-        {%- elif ns2.consecutive_failures == 1 %}
-            {{- '\n\n⚠️ SYSTEM WARNING: The previous tool call returned an error. Diagnose the failure and retry with completely corrected arguments.' }}
-        {%- endif %}
-        {{- '\n</tool_response>' }}
-        {%- if loop.last %}
-            {{- '<|im_end|>\n' }}
-        {%- else %}
-            {%- set _next_role = _msgs[loop.index0 + 1].role %}
-            {%- if _next_role != 'tool' %}
-                {{- '<|im_end|>\n' }}
-            {%- endif %}
-        {%- endif %}
-    {%- else %}
-        {{- '<|im_start|>user\n[' + message.role + ']: ' + content + '<|im_end|>\n' }}
-    {%- endif %}
-    {%- set ns2.prev_role = message.role %}
-{%- endfor %}
-{%- if add_generation_prompt %}
-    {{- '<|im_start|>assistant\n' }}
-    {%- if not ns_state.thinking %}
-        {{- '<think>\n\n</think>\n\n' }}
-    {%- else %}
-        {{- '<think>\n' }}
-    {%- endif %}
-{%- endif %}

scripts/.AGENTTRASH/download-q8agent.sh.rocmfpx

@@ -1,86 +0,0 @@
-#!/usr/bin/env bash
-# Download the kingjones Qwen3.8-27B-ROCmFPX-Q8_0-AGENT payload for
-# frank-medium from HuggingFace into
-# /home/dank/models/kingjones-Qwen3.8-27B-ROCMFPX-Q8_0-AGENT.
-#
-# Run on Dankserver (the box that serves it).  The repo is public, so the
-# download works anonymously; a token in ~/.cache/huggingface/token is used
-# when present, which keeps the ~28 GB main file clear of the anonymous
-# rate limit at full speed.
-#
-#   bash scripts/download-q8agent.sh
-#   bash scripts/download-q8agent.sh --verify-only
-#
-# The script is resumable (curl -C -) and verifies every artifact's size
-# afterwards, so a truncated file fails loudly instead of load-crashing.
-set -euo pipefail
-
-REPO="kingjones777/Qwen3.8-27B-ROCmFPX-Q8_0-AGENT-GGUF"
-DIR="/home/dank/models/kingjones-Qwen3.8-27B-ROCMFPX-Q8_0-AGENT"
-EXPECTED=(
-  "Qwen3.8-27B-Q8_0_ROCMFPX_AGENT.gguf:28214425952"
-  "mmproj-Qwen3.8-27B-BF16.gguf:931145888"
-  "mtp-Qwen3.8-27B-Q4_0.gguf:1680271648"
-)
-# The model card's MTP prompt-cache fix ships in the same repo as a patch;
-# fetched for reference only.  This fork's main already carries the
-# speculative boundary in the context checkpoint, so nothing applies it.
-EXTRA=(
-  "patches/mtp-prompt-cache-fix.patch"
-)
-
-cd -- "$(dirname -- "$0")/.."
-
-main() {
-  local mode="download"
-  [[ "${1:-}" == "--verify-only" ]] && mode="verify"
-  mkdir -p "$DIR"
-  cd "$DIR"
-
-  local token="" auth=()
-  if [[ -r "$HOME/.cache/huggingface/token" ]]; then
-    token="$(cat "$HOME/.cache/huggingface/token")"
-    auth=(-H "Authorization: Bearer $token")
-  else
-    echo "no HF token at $HOME/.cache/huggingface/token; downloading anonymously"
-  fi
-
-  dl() {
-    local f="$1"
-    mkdir -p "$(dirname "$f")"
-    curl -fsSL -C - -o "$f" --retry 10 --retry-delay 5 --retry-max-time 10800 \
-      "${auth[@]}" \
-      "https://huggingface.co/$REPO/resolve/main/$f"
-    echo "  done: $f ($(du -h "$f" | cut -f1))"
-  }
-
-  if [[ "$mode" == "download" ]]; then
-    echo "downloading $REPO into $DIR"
-    for entry in "${EXPECTED[@]}"; do
-      dl "${entry%%:*}"
-    done
-    for f in "${EXTRA[@]}"; do
-      dl "$f"
-    done
-  fi
-
-  echo "verifying sizes"
-  local ok=1 f want act
-  for entry in "${EXPECTED[@]}"; do
-    f="${entry%%:*}"; want="${entry##*:}"
-    act="$(stat -c%s "$f" 2>/dev/null || echo 0)"
-    if [[ "$act" -eq "$want" ]]; then
-      echo "  OK   $f ($act bytes)"
-    else
-      echo "  BAD  $f ($act bytes, want $want)" >&2
-      ok=0
-    fi
-  done
-  if [[ -z "$token" ]]; then
-    echo "note: no token was used; sizes above are the integrity check"
-  fi
-  [[ "$ok" -eq 1 ]] || exit 1
-  echo "all files present and sized correctly"
-}
-
-main "$@"

scripts/.AGENTTRASH/frank-default-npu.env

@@ -1,17 +0,0 @@
-# Tunables for frank-default-npu (FastFlowLM NPU endpoint, Dankclaw)
-# Runtime: FLM 1.0.1 on the XDNA2 NPU (50 TOPS). Model: Gemma4-E4B-IT
-# (8B, Q4_1, vision + audio + reasoning). The NPU allocates from the
-# unified pool shared with frank-default-large (the CIRU llama.cpp
-# service on the iGPU). See serverAppConfigs-docs/FastFlowLM NPU Inference.md.
-#
-# 2026-08-20: gemma4-it:e4b deployed. Footprint ~9.1 GB. 64k context.
-
-FLM_MODEL=gemma4-it:e4b
-FLM_HOST=0.0.0.0
-FLM_PORT=52626
-FLM_PMODE=performance
-FLM_ASR=0
-# 64K context (native max for gemma4-it is 32768, but NPU supports up to 256k).
-# The model's max_prefill_len is 4096, so prompts longer than that get
-# truncated at prefill time.
-FLM_CTX_LEN=65536

scripts/.AGENTTRASH/frank-default-npu.service

@@ -1,17 +0,0 @@
-[Unit]
-Description=FastFlowLM NPU inference (frank-default-npu) on Dankclaw
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=dank
-Group=dank
-Environment="FLM_NPU_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-default-npu.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-default-npu.sh
-LimitMEMLOCK=infinity
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target

scripts/.AGENTTRASH/frank-dragoon.env.ik-llama.cpp

@@ -1,105 +0,0 @@
-# Tunables for frank-dragoon (mradermacher i1-Q4_K_M of
-# orcarouter/Qwen3.8-Flash-Next-Uncensored on ik_llama.cpp, Dankclaw,
-# RTX 3090 CUDA + Strix Halo CPU path, since 2026-09-15).
-#
-# Runtime: ik_llama.cpp master d85a1d7 (2026-09-15) with full qwen4exp
-# support (upstream PRs #2365/#2369/#2373 merged). Build recipe (CUDA for
-# the 3090 at sm_86, Zen5 AVX-512 IQK kernels for the CPU expert path):
-#   cmake -B build -DCMAKE_BUILD_TYPE=Release -DGGML_NATIVE=ON \
-#     -DGGML_CUDA=ON -DCMAKE_CUDA_ARCHITECTURES=86 \
-#     -DGGML_AVX512=ON -DGGML_AVX512_VBMI=ON -DGGML_AVX512_VNNI=ON \
-#     -DGGML_AVX512_BF16=ON -DLLAMA_CURL=OFF
-# The startup banner must print HAVE_FANCY_SIMD is defined — without those
-# macros the quantized GEMM silently falls back to AVX2 (no warning).
-#
-# Model: mradermacher imatrix quant of the uncensored Flash-Next (qwen4exp
-# MoE: 512 experts / 10 used, 48 layers = 12 attention + 36 GDN/ssm, QSA
-# indexer, hyper-connections, PLE n-gram table ~320M rows). 111 GiB shipped
-# as 3 parts, concatenated on disk; each part's sha256 was verified against
-# its HF LFS oid at download time.
-#
-# Placement (ikawrakow's hybrid recipe; upstream issue #2402 for the PLE):
-#   - -ot "exps=CPU": ALL 512-expert tensors (121B elems, ~84 GB) live in
-#     the Strix Halo's LPDDR5X via the plain CPU backend buffer — mmap-backed
-#     page cache, ik's fastest known configuration for this shape (the
-#     author's 2x3090 + Threadripper reference box measures ~50 t/s on the
-#     same model family). The shared experts (shexp) keep their GPU-side
-#     default: they run on every token.
-#   - -ot "per_layer_token_embd=CPU": the ~32 GB PLE n-gram table follows —
-#     only a tiny slice is touched per token, so it streams from page cache.
-#   - NEVER use --cpu-moe on this host: it routes the CPU-overridden
-#     weights through the CUDA_Host PINNED buffer (measured 2026-09-15:
-#     108.12 GiB page-locked, evicted every co-tenant into swap and starved
-#     sshd into unreachability until a power cycle). -ot ...=CPU is the
-#     mmap-backed path with identical DDR5 bandwidth for resident pages,
-#     and the kernel degrades gracefully under pressure (page cache evict
-#     + re-read) instead of stranding anyone.
-#   - GGML_CUDA_NO_PINNED_WEIGHTS=1 (src/llama-load-tensors.cpp) keeps the
-#     CPU-overridden weights mmapped and leaves only the small staging
-#     buffers pinned. (GGML_CUDA_NO_PINNED would also unpin staging —
-#     unnecessary here and slower for prefill transfers.)
-#
-# Sampling: greedy-by-default to preserve the halogen-era client contract
-# (a request without temperature decodes greedy; temp 0.0 = argmax).
-# Clients that send their own temperature get their own values.
-#
-# WARNING: do not name any variable TEMP, HOST, or GPU_MAX_HEAP_SIZE (see
-# the 2026-08-13 HIP incident in AGENTS.md). llama.cpp reads --host and
-# --temp as CLI flags, never as environment variables.
-
-# ik_llama.cpp runtime binary (master d85a1d7 build).
-LLAMA_BIN=/home/dank/GitPackages/ik_llama.cpp/build/bin/llama-server
-
-# Model package from
-# https://huggingface.co/mradermacher/Qwen3.8-Flash-Next-Uncensored-i1-GGUF
-# (parts concatenated). The mmproj is the matching vision tower from the
-# static repo mradermacher/Qwen3.8-Flash-Next-Uncensored-GGUF — ik_llama.cpp
-# links examples/mtmd, so image input survives the runtime swap.
-MODEL_DIR=/home/dank/models/mradermacher-Qwen3.8-Flash-Next-Uncensored-i1-Q4_K_M
-MODEL_FILE=Qwen3.8-Flash-Next-Uncensored.i1-Q4_K_M.gguf
-MMPROJ_PATH=/home/dank/models/mradermacher-Qwen3.8-Flash-Next-Uncensored-i1-Q4_K_M/Qwen3.8-Flash-Next-Uncensored.mmproj-f16.gguf
-
-# Qwen-Sharp chat template (tracked in the repo, staged on the host). The
-# server emits reasoning in DeepSeek format so clients receive
-# reasoning_content separately instead of literal think tags in content.
-CHAT_TEMPLATE_FILE=/home/dank/serverAppConfigs/scripts/chat-template.jinja
-
-# Alias + network.
-ALIAS=frank-dragoon
-BIND_ADDR=0.0.0.0
-LISTEN_PORT=7770
-
-# Serving: single 262144-token slot (the model's full context window),
-# batch 4096 / ubatch 512, 16+16 threads (the Halo CPU has 16 cores, no
-# SMT), f16 KV. The KV cache scales with the 12 full-attention layers only
-# (~6 GB f16 at 262k); the GDN/ssm layers keep constant-size state. If
-# VRAM headroom is needed, --cache-type-k/v q8_0 halves the KV footprint.
-CTX_SIZE=262144
-PARALLEL=1
-BATCH_SIZE=4096
-UBATCH_SIZE=512
-NUM_THREADS=16
-THREAD_BATCH=16
-CACHE_TYPE_K=f16
-CACHE_TYPE_V=f16
-
-# GPU/MoE placement: everything on the 3090 except the experts and the PLE
-# table, which both live in host RAM via the CPU backend buffer (see the
-# placement notes above).
-NGL=999
-# ik_llama.cpp CUDA host-memory policy: CPU-overridden weights stay mmapped;
-# only the small staging buffers are pinned (see the placement notes above).
-GGML_CUDA_NO_PINNED_WEIGHTS=1
-
-# Prompt cache (RAM budget in MiB) and slot state dir.
-CACHE_RAM=8192
-SLOT_SAVE_PATH=/home/dank/serverAppConfigs/scripts/slot-state
-
-# Greedy-by-default (halogen contract). See sampling note above.
-TEMPERATURE=0.0
-
-# Reasoning on: DeepSeek format projects thinking into the API's
-# reasoning_content field instead of literal think tags in content;
-# unlimited reasoning budget (the model decides).
-REASONING_FORMAT=deepseek
-REASONING_BUDGET=-1

scripts/.AGENTTRASH/frank-dragoon.service.ik-llama.cpp

@@ -1,21 +0,0 @@
-[Unit]
-Description=ik_llama.cpp Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M 177B MoE (dankclaw, frank-dragoon)
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=dank
-Group=dank
-# Staging buffers for the CUDA transfers are page-locked; the weights
-# themselves stay mmapped (GGML_CUDA_NO_PINNED_WEIGHTS=1), but the staging
-# budget still needs room. Parity with the halogen quadlet's
-# Ulimit=memlock=-1:-1.
-LimitMEMLOCK=infinity
-Environment="FRANK_DRAGOON_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-dragoon.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-dragoon.sh
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target

scripts/.AGENTTRASH/frank-medium.env.rocmfpx

@@ -1,138 +0,0 @@
-# Tunables for frank-medium (kingjones777/Qwen3.8-27B-ROCmFPX-Q8_0-AGENT-GGUF,
-# charlie12345/ROCmFPX llama.cpp, Dankserver, 2x AMD Radeon AI PRO R9700).
-#
-# Hardware (2026-09-15): the RTX 3090 left Dankserver and two Radeon AI PRO
-# R9700 cards (Navi 48, gfx1201, RDNA4, 32,624 MiB each, PCIe 5.0 x16) took
-# its place.  The Raphael iGPU (gfx1036) is still enumerated by HIP as the
-# third device.  There is no XGMI link between the two cards and they sit in
-# different IOMMU groups, so any cross-GPU traffic goes over PCIe.
-#
-# Runtime: charlie12345/ROCmFPX (llama.cpp fork, ROCmFPX quant family; the
-# Q8_0_ROCMFPX_AGENT tensor type exists nowhere else - stock llama.cpp cannot
-# load this GGUF).  Built for gfx1201 with the fork's self-contained ROCm
-# 7.14 toolchain so the host's stale /opt/rocm-6.3.3 install is never used:
-#
-#   cd /home/dank/GitPackages/charlie-ROCmFPX
-#   env JOBS=8 ./scripts/build-rocmfp4-rocm714-local.sh
-#
-# gfx1201 must be the build target: a gfx1200 binary links, loads the model
-# and then segfaults on this card (fork's docs/BUILD-AMD-ARCHITECTURES.md).
-#
-# Model: kingjones Qwen3.8-27B-ROCmFPX-Q8_0-AGENT - Q8_0_ROCMFPX_AGENT
-# (ftype 115), 26.28 GiB, 8.39 bpw, arch qwen35 (MoE), quantized from a
-# 51.3 GiB BF16 source.  The AGENT routing keeps 12 more attention-output
-# projections at full Q8_0 than the plain 8-bit build, which buys a higher
-# MTP draft acceptance (0.953 vs 0.911) and that is the whole point of this
-# checkpoint.  Model card documents 131,072 context.
-#
-# Parallelism (--split-mode layer, operator call 2026-09-15 "pipeline
-# parallelism"): layers are distributed across the two cards in order and
-# activations hop PCIe at the boundary.  Measured with llama-bench
-# (pp4096 / tg128 / same at depth 32768, f16 KV, fa on, 3 reps):
-#
-#   single R9700   1160.9 / 19.42   (fits: 26.27 GiB weights, ~5 GiB left)
-#   layer  2x      1991.2 / 18.76   859.1 / 17.64
-#   tensor 2x       271.8 / 26.26   228.6 / 25.09
-#
-# Tensor parallel wins decode (+40 %) but collapses prefill 7x: this build
-# has no RCCL (llama.cpp logs "AllReduce init failed; falling back to
-# meta-backend butterfly"), so every layer pays a slow cross-card reduction.
-# Agentic traffic is prefill-heavy, so layer split wins the workload.  Revisit
-# if the fork ships a working RCCL tensor path.
-#
-# WARNING: do not name any variable TEMP, HOST, or GPU_MAX_HEAP_SIZE. The
-# ROCm HIP runtime reads those bare env vars (see the 2026-08-13 TEMP
-# incident).  llama.cpp reads --host/--port/--temp as CLI flags, never as
-# env vars.
-
-# charlie12345/ROCmFPX llama-server (self-contained ROCm 7.14 build, RPATH
-# points at the bundled runtime libs; no LD_LIBRARY_PATH needed).
-LLAMA_BIN=/home/dank/GitPackages/charlie-ROCmFPX/build-rdna4-rocm714/bin/llama-server
-
-# Model package, fetched with scripts/download-q8agent.sh:
-#   Qwen3.8-27B-Q8_0_ROCMFPX_AGENT.gguf   26.28 GiB  main weights
-#   mtp-Qwen3.8-27B-Q4_0.gguf              1.68 GiB  MTP draft head
-#   mmproj-Qwen3.8-27B-BF16.gguf           0.93 GiB  vision tower (unused)
-MODEL_DIR=/home/dank/models/kingjones-Qwen3.8-27B-ROCMFPX-Q8_0-AGENT
-MODEL_FILE=Qwen3.8-27B-Q8_0_ROCMFPX_AGENT.gguf
-DRAFT_MODEL_FILE=mtp-Qwen3.8-27B-Q4_0.gguf
-
-# Alias + network.  The port is the fleet's dankserver endpoint; the alias is
-# what clients ask for, and it replaces the retired `frank-small`.
-ALIAS=frank-medium
-BIND_ADDR=0.0.0.0
-LISTEN_PORT=7770
-
-# Device placement.  HIP_VISIBLE_DEVICES hides the iGPU (device 2) so nothing
-# can drift onto shared system RAM; DEVICES is what llama.cpp splits across.
-HIP_VISIBLE_DEVICES=0,1
-DEVICES=ROCm0,ROCm1
-SPLIT_MODE=layer
-
-# TENSOR_SPLIT empty = layers distributed by free VRAM (equal here).
-TENSOR_SPLIT=
-
-NGL=999
-# Auto-fit has no business resizing a context we set explicitly.
-FIT=off
-FLASH_ATTN=on
-
-# 131,072 tokens, one slot (the model card's documented window; the GGUF
-# reports n_ctx_train 262144, untested by the model author).  Layer split
-# keeps each layer's KV on the card that owns the layer, so the window is
-# bounded by per-card free memory: ~5.6 GiB of KV per card at 131072 f16.
-CTX_SIZE=131072
-PARALLEL=1
-
-# 26.28 GiB of weights + MTP draft + KV cache leaves ~15 GiB per card at this
-# context, so the batch shape is chosen for prefill throughput, not memory.
-BATCH_SIZE=2048
-UBATCH_SIZE=512
-NUM_THREADS=8
-THREAD_BATCH=8
-
-# f16 K/V: an agent checkpoint is the wrong place to spend KV precision.
-CACHE_TYPE_K=f16
-CACHE_TYPE_V=f16
-CTX_CHECKPOINTS=8
-CACHE_RAM=8192
-
-# Sampling: the checkpoint's instruct table.
-TEMPERATURE=0.7
-TOP_P=0.8
-TOP_K=20
-MIN_P=0.0
-PRESENCE_PENALTY=1.5
-
-# Reasoning on; DeepSeek format projects the trace into reasoning_content
-# instead of literal thinking tags in content.
-REASONING=on
-REASONING_FORMAT=deepseek
-REASONING_BUDGET=-1
-
-# Chat template: empty = the template embedded in the GGUF.  Point this at
-# /home/dank/serverAppConfigs/scripts/chat-template.jinja to force the repo's
-# Sharp agent template instead.
-CHAT_TEMPLATE_FILE=
-CHAT_TEMPLATE_KWARGS='{"enable_thinking":true,"preserve_thinking":true}'
-
-# MTP speculative decoding.  n_max 6 / p_min 0.6 is the fork's measured
-# sweet spot for a MTP head with high acceptance; p_min 0.0 drafts
-# low-probability tokens that get rejected and makes MTP a net loss.
-SPEC_TYPE=draft-mtp
-SPEC_DRAFT_N_MAX=6
-SPEC_DRAFT_N_MIN=0
-SPEC_DRAFT_P_MIN=0.6
-SPEC_DRAFT_P_SPLIT=0.10
-SPEC_DRAFT_NGL=999
-SPEC_DRAFT_TYPE_K=f16
-SPEC_DRAFT_TYPE_V=f16
-SPEC_DRAFT_POLL=1
-SPEC_DRAFT_POLL_BATCH=1
-# The draft head rides the card that holds the target model's LAST layers:
-# the MTP head consumes the final hidden state, so pinning it to ROCm1 keeps
-# the per-token hop off the wire.  (Under the abandoned tensor split the
-# draft must also be pinned to exactly one device or the meta-device KV
-# allocation aborts: GGML_ASSERT(buffer) in ggml-backend.cpp, measured
-# 2026-09-15.)
-SPEC_DRAFT_DEVICE=ROCm1

scripts/.AGENTTRASH/frank-medium.service.rocmfpx

@@ -1,16 +0,0 @@
-[Unit]
-Description=charlie12345/ROCmFPX llama.cpp serving kingjones777/Qwen3.8-27B-ROCmFPX-Q8_0-AGENT qwen35 MoE (dankserver, frank-medium, 2x Radeon AI PRO R9700)
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=dank
-Group=dank
-Environment="FRANK_MEDIUM_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-medium.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-medium.sh
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target

scripts/.AGENTTRASH/serve-frank-default-npu.sh

@@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-# Serve the FastFlowLM (FLM) NPU endpoint — frank-default-npu.
-#
-# Runs flm serve with the model tag in frank-default-npu.env. The NPU
-# (XDNA2, 50 TOPS) is a single-lane device: generations serialize in FIFO
-# order, so this is a background/triage endpoint. The NPU shares the ~30 GiB
-# unified pool with frank-default-large (the CIRU llama.cpp service on the
-# iGPU); see serverAppConfigs-docs/FastFlowLM NPU Inference.md for the memory budget.
-#
-# NOTE: FLM requires unlimited memlock. The unit sets LimitMEMLOCK=infinity.
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FLM_NPU_ENV_FILE:-$SCRIPT_DIR/frank-default-npu.env}"
-if [[ -f "$ENV_FILE" ]]; then
-    set -a
-    # shellcheck disable=SC1090
-    source "$ENV_FILE"
-    set +a
-fi
-
-# --- defaults (used when the env file does not set them) -------------------
-: "${FLM_BIN:=/usr/bin/flm}"
-: "${FLM_MODEL:=gemma4-it:e4b}"
-: "${FLM_HOST:=0.0.0.0}"
-: "${FLM_PORT:=52626}"
-: "${FLM_PMODE:=performance}"
-: "${FLM_ASR:=0}"
-: "${FLM_CTX_LEN:=-1}"
-
-if [[ ! -x "$FLM_BIN" ]]; then
-    echo "missing flm binary: $FLM_BIN" >&2
-    exit 1
-fi
-
-# --- optional flags ----------------------------------------------------------
-OPT_ARGS=()
-if [[ "${FLM_ASR}" != "0" ]]; then
-    OPT_ARGS+=(-a "${FLM_ASR}")
-fi
-if [[ "${FLM_CTX_LEN}" != "-1" ]]; then
-    OPT_ARGS+=(-c "${FLM_CTX_LEN}")
-fi
-
-exec "$FLM_BIN" serve "$FLM_MODEL" \
-    --host "$FLM_HOST" \
-    -p "$FLM_PORT" \
-    --pmode "$FLM_PMODE" \
-    "${OPT_ARGS[@]}"

scripts/.AGENTTRASH/serve-frank-dragoon.sh.ik-llama.cpp

@@ -1,123 +0,0 @@
-#!/usr/bin/env bash
-# Serve mradermacher/Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M as frank-dragoon
-# via ik_llama.cpp on Dankclaw.
-#
-# Topology (ikawrakow's hybrid recipe; upstream issue #2402 for the PLE):
-# the RTX 3090 (CUDA, sm_86) takes the dense/attention/output weights and
-# the KV cache (-ngl 999); ALL MoE expert tensors and the ~32 GB PLE
-# n-gram table stay in the Strix Halo's LPDDR5X via the plain CPU backend
-# buffer (-ot ...=CPU — mmap-backed page cache; only a tiny slice of PLE is
-# touched per token). NEVER use --cpu-moe on this host: it routes the
-# CPU-overridden weights through the CUDA_Host PINNED buffer (measured
-# 108.12 GiB page-locked on 2026-09-15, which evicted every co-tenant into
-# swap and starved sshd into unreachability until a power cycle). NEVER add
-# --no-mmap — the STRIX-era lesson transfers directly (the cgroup killer
-# takes the process with nothing in the server log).
-#
-# Runtime: ik_llama.cpp master d85a1d7 built with CUDA (sm_86) + Zen5
-# AVX-512 IQK kernels; the startup banner must show HAVE_FANCY_SIMD
-# is defined. Flag set verified against this binary's --help before this
-# script was written. ik has no --cache-prompt/--cache-idle-slots (prompt
-# caching is its default behavior) and no --alias: it is a single-model
-# server and reports the GGUF's general.name at /v1/models.
-#
-# Sampling: greedy-by-default (halogen client contract) — clients that
-# send their own temperature get their own values.
-set -euo pipefail
-
-SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_DRAGOON_ENV_FILE:-$SCRIPT_DIR/frank-dragoon.env}"
-if [[ -f "$ENV_FILE" ]]; then
-    set -a
-    # shellcheck disable=SC1090
-    source "$ENV_FILE"
-    set +a
-fi
-
-# --- defaults (used when the env file does not set them) -------------------
-: "${LLAMA_BIN:=/home/dank/GitPackages/ik_llama.cpp/build/bin/llama-server}"
-: "${MODEL_DIR:=/home/dank/models/mradermacher-Qwen3.8-Flash-Next-Uncensored-i1-Q4_K_M}"
-: "${MODEL_FILE:=Qwen3.8-Flash-Next-Uncensored.i1-Q4_K_M.gguf}"
-: "${MMPROJ_PATH:=$MODEL_DIR/Qwen3.8-Flash-Next-Uncensored.mmproj-f16.gguf}"
-: "${CHAT_TEMPLATE_FILE:=$SCRIPT_DIR/chat-template.jinja}"
-: "${BIND_ADDR:=0.0.0.0}"
-: "${LISTEN_PORT:=7770}"
-: "${CTX_SIZE:=262144}"
-: "${PARALLEL:=1}"
-: "${BATCH_SIZE:=4096}"
-: "${UBATCH_SIZE:=512}"
-: "${NUM_THREADS:=16}"
-: "${THREAD_BATCH:=16}"
-: "${CACHE_TYPE_K:=f16}"
-: "${CACHE_TYPE_V:=f16}"
-: "${NGL:=999}"
-: "${CPU_MOE:=on}"
-: "${FLASH_ATTN:=on}"
-: "${TEMPERATURE:=0.0}"
-: "${REASONING:=on}"
-: "${REASONING_FORMAT:=deepseek}"
-: "${REASONING_BUDGET:=-1}"
-: "${CACHE_RAM:=8192}"
-: "${SLOT_SAVE_PATH:=$SCRIPT_DIR/slot-state}"
-# Hard guard: on this host CUDA pinned host memory strands the co-tenants
-# (measured 2026-09-15: a default-policy start tried to page-lock 108.12 GiB,
-# evicted every co-tenant into swap and starved sshd into unreachability
-# until a power cycle). GGML_CUDA_NO_PINNED_WEIGHTS=1 keeps the
-# CPU-overridden weights mmapped (src/llama-load-tensors.cpp); the env file
-# sets it. Refuse to run without it.
-if [[ "${GGML_CUDA_NO_PINNED_WEIGHTS:-}" != "1" ]]; then
-    echo "frank-dragoon: refusing to start — GGML_CUDA_NO_PINNED_WEIGHTS=1 is mandatory on this host" >&2
-    exit 1
-fi
-
-mkdir -p "$SLOT_SAVE_PATH"
-
-# The UVM device node is created lazily by nvidia-modprobe on the first
-# CUDA open after boot; make sure it exists before the server needs it.
-nvidia-modprobe -u -c=0 2>/dev/null || true
-
-CPU_MOE_ARGS=()
-if [[ "$CPU_MOE" == "on" ]]; then
-    # -ot ...=CPU (plain CPU backend buffer) is the mmap-backed path. NEVER
-    # swap this for --cpu-moe: that routes the weights through the CUDA_Host
-    # PINNED buffer (108.12 GiB measured) and strands the co-tenants.
-    CPU_MOE_ARGS=(-ot "exps=CPU" -ot "per_layer_token_embd=CPU")
-fi
-
-MMPROJ_ARGS=()
-if [[ -n "${MMPROJ_PATH:-}" && -f "$MMPROJ_PATH" ]]; then
-    MMPROJ_ARGS=(--mmproj "$MMPROJ_PATH")
-fi
-
-TEMPLATE_ARGS=()
-if [[ -n "${CHAT_TEMPLATE_FILE:-}" && -f "$CHAT_TEMPLATE_FILE" ]]; then
-    TEMPLATE_ARGS=(--chat-template-file "$CHAT_TEMPLATE_FILE")
-else
-    TEMPLATE_ARGS=(--jinja)
-fi
-
-exec "$LLAMA_BIN" \
-    --model "$MODEL_DIR/$MODEL_FILE" \
-    "${TEMPLATE_ARGS[@]}" \
-    --host "$BIND_ADDR" \
-    --port "$LISTEN_PORT" \
-    --gpu-layers "$NGL" \
-    "${CPU_MOE_ARGS[@]}" \
-    --flash-attn "$FLASH_ATTN" \
-    --parallel "$PARALLEL" \
-    --ctx-size "$CTX_SIZE" \
-    --batch-size "$BATCH_SIZE" \
-    --ubatch-size "$UBATCH_SIZE" \
-    --threads "$NUM_THREADS" \
-    --threads-batch "$THREAD_BATCH" \
-    --cache-type-k "$CACHE_TYPE_K" \
-    --cache-type-v "$CACHE_TYPE_V" \
-    --cache-ram "$CACHE_RAM" \
-    --slot-save-path "$SLOT_SAVE_PATH" \
-    --ctx-checkpoints 16 \
-    --metrics \
-    --temp "$TEMPERATURE" \
-    --reasoning "$REASONING" \
-    --reasoning-format "$REASONING_FORMAT" \
-    --reasoning-budget "$REASONING_BUDGET" \
-    "${MMPROJ_ARGS[@]}"

scripts/.AGENTTRASH/serve-frank-medium.sh.rocmfpx

@@ -1,215 +0,0 @@
-#!/usr/bin/env bash
-# Serve kingjones777/Qwen3.8-27B-ROCmFPX-Q8_0-AGENT-GGUF as frank-medium via
-# the charlie12345/ROCmFPX llama.cpp runtime on Dankserver
-# (2x AMD Radeon AI PRO R9700, Navi 48, gfx1201, 32 GB each).
-#
-# Runtime: charlie12345/ROCmFPX main (c49ebdb, 2026-08-22), built for
-# gfx1201 with the fork's self-contained ROCm toolchain:
-#
-#   cd /home/dank/GitPackages/charlie-ROCmFPX
-#   env JOBS=8 ./scripts/build-rocmfp4-rocm714-local.sh
-#   -> build-rdna4-rocm714/bin/llama-server
-#
-# That script downloads the gfx120X-all TheRock ROCm 7.14 toolchain into
-# ~/.local/share/rocm-7.14.0a20260624, builds with
-# -DCMAKE_HIP_ARCHITECTURES="gfx1200;gfx1201", copies the ROCm runtime
-# (hip/hsa/rocblas/hipblaslt + their kernel libraries) next to the binary and
-# sets RPATH=$ORIGIN/../lib on it.  The resulting service is self-contained:
-# no LD_LIBRARY_PATH, and the host's stale /opt/rocm-6.3.3 cannot leak in.
-# gfx1201 is NOT interchangeable with gfx1200 on this card (the fork's
-# docs/BUILD-AMD-ARCHITECTURES.md: a gfx1200 build links, loads and then
-# segfaults), and the build verifies the emitted code objects afterwards.
-#
-# Model: kingjones Qwen3.8-27B-ROCmFPX-Q8_0-AGENT (Q8_0_ROCMFPX_AGENT,
-# ftype 115, arch qwen35 MoE), 26.28 GiB main file, plus a separate
-# MTP draft head and an mmproj vision tower.  8.39 bpw; the AGENT routing
-# keeps 13 of the 17 attention-output projections at full Q8_0, which is
-# what makes the MTP draft land ~0.95 of its guesses.  A stock llama.cpp
-# cannot load this GGUF at all - Q8_0_ROCMFPX exists only in this fork.
-#
-# Parallelism: --split-mode layer across both cards (operator call
-# 2026-09-15).  Layers are distributed in order and activations hop PCIe at
-# the boundary; measured llama-bench: layer 1991/18.8 tok/s (pp4096/tg128)
-# vs tensor 272/26.3 and single-card 1161/19.4.  Tensor wins decode +40 %
-# but its prefill collapses 7x on this build (no RCCL: "AllReduce init
-# failed; falling back to meta-backend butterfly"), so layer split wins the
-# prefill-heavy agentic workload.
-#
-# Tunables come from frank-medium.env unless FRANK_MEDIUM_ENV_FILE
-# overrides that path.
-set -euo pipefail
-
-SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_MEDIUM_ENV_FILE:-$SCRIPT_DIR/frank-medium.env}"
-if [[ -f "$ENV_FILE" ]]; then
-    set -a
-    # shellcheck disable=SC1090
-    source "$ENV_FILE"
-    set +a
-fi
-
-# --- defaults (used when the env file does not set them) -----------------
-: "${LLAMA_BIN:=/home/dank/GitPackages/charlie-ROCmFPX/build-rdna4-rocm714/bin/llama-server}"
-: "${MODEL_DIR:=/home/dank/models/kingjones-Qwen3.8-27B-ROCMFPX-Q8_0-AGENT}"
-: "${MODEL_FILE:=Qwen3.8-27B-Q8_0_ROCMFPX_AGENT.gguf}"
-: "${DRAFT_MODEL_FILE:=mtp-Qwen3.8-27B-Q4_0.gguf}"
-: "${ALIAS:=frank-medium}"
-: "${BIND_ADDR:=0.0.0.0}"
-: "${LISTEN_PORT:=7770}"
-
-# Devices: ROCm0/ROCm1 are the two R9700s; the Raphael iGPU enumerates as
-# ROCm2 (gfx1036) and is hidden from HIP so nothing can drift onto it.
-: "${HIP_VISIBLE_DEVICES:=0,1}"
-: "${DEVICES:=ROCm0,ROCm1}"
-: "${SPLIT_MODE:=tensor}"
-: "${TENSOR_SPLIT:=}"
-: "${NGL:=999}"
-: "${FIT:=off}"
-: "${FLASH_ATTN:=on}"
-
-: "${CTX_SIZE:=131072}"
-: "${PARALLEL:=1}"
-: "${BATCH_SIZE:=2048}"
-: "${UBATCH_SIZE:=512}"
-: "${NUM_THREADS:=8}"
-: "${THREAD_BATCH:=8}"
-: "${CACHE_TYPE_K:=f16}"
-: "${CACHE_TYPE_V:=f16}"
-: "${CTX_CHECKPOINTS:=8}"
-: "${CACHE_RAM:=8192}"
-
-# Sampling: the checkpoint's instruct table.
-: "${TEMPERATURE:=0.7}"
-: "${TOP_P:=0.8}"
-: "${TOP_K:=20}"
-: "${MIN_P:=0.0}"
-: "${PRESENCE_PENALTY:=1.5}"
-
-# Reasoning: the model is an agent checkpoint; keep the trace and project it
-# into the API's reasoning_content field rather than literal thinking tags.
-: "${REASONING:=on}"
-: "${REASONING_FORMAT:=deepseek}"
-: "${REASONING_BUDGET:=-1}"
-
-# Chat template: empty means "use the template embedded in the GGUF".
-: "${CHAT_TEMPLATE_FILE:=}"
-: "${CHAT_TEMPLATE_KWARGS:={\"enable_thinking\":true,\"preserve_thinking\":true}}"
-
-# MTP draft head (separate GGUF, --spec-type draft-mtp).  SPEC_DRAFT_DEVICE
-# must name exactly one device: under tensor mode an unsplit draft joins the
-# meta-device KV allocation and aborts while building the KV cache
-# (GGML_ASSERT(buffer) in ggml-backend.cpp, 2026-09-15).
-: "${SPEC_TYPE:=draft-mtp}"
-: "${SPEC_DRAFT_N_MAX:=6}"
-: "${SPEC_DRAFT_N_MIN:=0}"
-: "${SPEC_DRAFT_P_MIN:=0.6}"
-: "${SPEC_DRAFT_P_SPLIT:=0.10}"
-: "${SPEC_DRAFT_NGL:=999}"
-: "${SPEC_DRAFT_DEVICE:=}"
-: "${SPEC_DRAFT_TYPE_K:=f16}"
-: "${SPEC_DRAFT_TYPE_V:=f16}"
-: "${SPEC_DRAFT_POLL:=1}"
-: "${SPEC_DRAFT_POLL_BATCH:=1}"
-
-# Text only: the server must not try to autoload the vision tower.  Vision
-# stays on frank-dragoon (Dankclaw), which is where the fleet routes images.
-NO_MMPROJ="${NO_MMPROJ:-1}"
-
-export HIP_VISIBLE_DEVICES
-
-MODEL="$MODEL_DIR/$MODEL_FILE"
-if [[ ! -x "$LLAMA_BIN" ]]; then
-    echo "missing executable runtime: $LLAMA_BIN" >&2
-    echo "build it with: cd $(dirname "$(dirname "$LLAMA_BIN")")/.. && env JOBS=8 ./scripts/build-rocmfp4-rocm714-local.sh" >&2
-    exit 1
-fi
-if [[ ! -r "$MODEL" ]]; then
-    echo "missing or unreadable required artifact: $MODEL" >&2
-    echo "fetch it with: bash $SCRIPT_DIR/download-q8agent.sh" >&2
-    exit 1
-fi
-if [[ -n "$CHAT_TEMPLATE_FILE" && ! -r "$CHAT_TEMPLATE_FILE" ]]; then
-    echo "missing or unreadable chat template: $CHAT_TEMPLATE_FILE" >&2
-    exit 1
-fi
-
-# --- speculative decoding (MTP draft head) --------------------------------
-SPEC_ARGS=()
-if [[ -n "$SPEC_TYPE" && "$SPEC_TYPE" != "none" ]]; then
-    SPEC_ARGS=(
-        --spec-type "$SPEC_TYPE"
-        --spec-draft-n-max "$SPEC_DRAFT_N_MAX"
-        --spec-draft-n-min "$SPEC_DRAFT_N_MIN"
-        --spec-draft-p-min "$SPEC_DRAFT_P_MIN"
-        --spec-draft-p-split "$SPEC_DRAFT_P_SPLIT"
-    )
-    if [[ "$SPEC_TYPE" == *draft-mtp* ]]; then
-        DRAFT_MODEL="$MODEL_DIR/$DRAFT_MODEL_FILE"
-        if [[ ! -r "$DRAFT_MODEL" ]]; then
-            echo "missing or unreadable draft model: $DRAFT_MODEL" >&2
-            exit 1
-        fi
-        SPEC_ARGS+=(
-            --spec-draft-model "$DRAFT_MODEL"
-            --spec-draft-ngl "$SPEC_DRAFT_NGL"
-            --spec-draft-type-k "$SPEC_DRAFT_TYPE_K"
-            --spec-draft-type-v "$SPEC_DRAFT_TYPE_V"
-            --spec-draft-poll "$SPEC_DRAFT_POLL"
-            --spec-draft-poll-batch "$SPEC_DRAFT_POLL_BATCH"
-        )
-        if [[ -n "$SPEC_DRAFT_DEVICE" ]]; then
-            SPEC_ARGS+=(--spec-draft-device "$SPEC_DRAFT_DEVICE")
-        fi
-    fi
-fi
-
-# --- template + placement -------------------------------------------------
-TEMPLATE_ARGS=()
-if [[ -n "$CHAT_TEMPLATE_FILE" ]]; then
-    TEMPLATE_ARGS+=(--chat-template-file "$CHAT_TEMPLATE_FILE")
-    TEMPLATE_ARGS+=(--chat-template-kwargs "$CHAT_TEMPLATE_KWARGS")
-fi
-
-PLACEMENT_ARGS=(--device "$DEVICES" --split-mode "$SPLIT_MODE")
-if [[ -n "$TENSOR_SPLIT" ]]; then
-    PLACEMENT_ARGS+=(--tensor-split "$TENSOR_SPLIT")
-fi
-
-MMPROJ_ARGS=()
-if [[ "$NO_MMPROJ" == "1" ]]; then
-    MMPROJ_ARGS=(--no-mmproj)
-fi
-
-exec "$LLAMA_BIN" \
-    --model "$MODEL" \
-    --alias "$ALIAS" \
-    --host "$BIND_ADDR" \
-    --port "$LISTEN_PORT" \
-    --jinja \
-    --gpu-layers "$NGL" \
-    --fit "$FIT" \
-    --parallel "$PARALLEL" \
-    --ctx-size "$CTX_SIZE" \
-    --batch-size "$BATCH_SIZE" \
-    --ubatch-size "$UBATCH_SIZE" \
-    --flash-attn "$FLASH_ATTN" \
-    --cache-type-k "$CACHE_TYPE_K" \
-    --cache-type-v "$CACHE_TYPE_V" \
-    --threads "$NUM_THREADS" \
-    --threads-batch "$THREAD_BATCH" \
-    --ctx-checkpoints "$CTX_CHECKPOINTS" \
-    --cache-ram "$CACHE_RAM" \
-    --cache-prompt \
-    --metrics \
-    --temp "$TEMPERATURE" \
-    --top-p "$TOP_P" \
-    --top-k "$TOP_K" \
-    --min-p "$MIN_P" \
-    --presence-penalty "$PRESENCE_PENALTY" \
-    --reasoning "$REASONING" \
-    --reasoning-format "$REASONING_FORMAT" \
-    --reasoning-budget "$REASONING_BUDGET" \
-    "${TEMPLATE_ARGS[@]}" \
-    "${PLACEMENT_ARGS[@]}" \
-    "${MMPROJ_ARGS[@]}" \
-    "${SPEC_ARGS[@]}"

scripts/deploy-plan.py

@@ -476,6 +476,11 @@ def services_for_path(path: str, target: str) -> set[str]:
             # The installer is what creates, mounts and reaps the view both media
             # servers read, so a change to it is a restart of that pair.
             _add(services, "jellyfin", "plex")
+        if name == "jellyfin-providers.sh":
+            # The deployer runs this before jellyfin restarts, so a change to
+            # the installer is a change to the provider state Jellyfin loads at
+            # start-up: it selects jellyfin and nothing else.
+            _add(services, "jellyfin")
         if name in {"frank-zealot.env", "frank-zealot.service", "serve-frank-zealot.sh"}:
             # llama.cpp frank-zealot (2026-09-16) keeps its unit, env and serve
             # files here; each one selects frank-zealot only. The ik_llama.cpp

scripts/deploy-remote.sh

@@ -1208,16 +1208,70 @@ ensure_media_view() {
     # array below stays read-only and every sidecar Jellyfin writes lands on the
     # NVMe.
     # Raise it BEFORE either container starts — a start against a bare view
-    # directory would let a scan clear the library database. The units also carry
-    # ConditionPathIsMountPoint, so a missing view skips the start rather than
-    # damaging anything. A relayout must be followed by `media-view.sh reap`
+    # directory would let a scan clear the library database. Each unit gates on
+    # scripts/wait-for-mount.sh, which waits and then refuses the start. A
+    # relayout must be followed by `media-view.sh reap`
     # (see the Media Relayout page), which this is not.
     run_privileged bash scripts/media-view.sh install
     bash scripts/media-view.sh verify
 }
 
+ensure_user_io_delegate() {
+    # The media servers ask for an I/O share (IOWeight= in their quadlets) so a
+    # library scan cannot starve playback or the array's other reader. Two system
+    # drop-ins are what make that request real, and both are host state, so the
+    # deployer places them:
+    #   user.slice.d/io-accounting.conf        io enters user.slice's subtree
+    #   user@1000.service.d/io-delegate.conf   the user manager gets the controller
+    # Without the first, `io` never appears in user.slice/cgroup.subtree_control,
+    # so no container under it can have an io.weight file at all; without the
+    # second the user manager never asks for the controller. systemd hands
+    # user@.service cpu/memory/pids by default and drops a line it cannot honour
+    # without a word — IOWeight= on its own is inert config.
+    local src dst
+    for src in \
+        dankserver/host/systemd/user.slice.d/io-accounting.conf \
+        dankserver/host/systemd/user@1000.service.d/io-delegate.conf; do
+        dst=/etc/systemd/system/${src#dankserver/host/systemd/}
+        run_privileged mkdir -p "$(dirname "$dst")"
+        if ! run_privileged cmp -s "$src" "$dst"; then
+            run_privileged install -m 644 "$src" "$dst"
+            run_privileged systemctl daemon-reload
+        fi
+    done
+    # Accounting lands immediately; the delegation is read when user@1000.service
+    # starts, and restarting that unit would kill every rootless container on this
+    # host. So the share becomes real at the next reboot — say so out loud rather
+    # than let a quadlet line read as live config.
+    if ! systemctl show user@1000.service -p DelegateControllers | grep -qw io; then
+        echo "NOTE: io is not delegated to user@1000.service yet - IOWeight= is"
+        echo "NOTE: inert until the next reboot (see [[Quadlet Lifecycle]])"
+    fi
+}
+
+ensure_provider_keys() {
+    # Jellyfin's metadata-provider keys live in the container-owned plugin
+    # configuration under the data root, never in git; scripts/jellyfin-providers.sh
+    # is what places them, reading the per-service host env file (the fleet
+    # convention: grafana, caddy, pihole, copyparty, romm, seerr) that holds
+    # TMDB_API_KEY= and TVDB_API_KEY=, mode 600.
+    # Missing keys mean a keyless provider — a degraded library, not a broken
+    # deploy — so this warns rather than failing the restart. But when the keys
+    # ARE placed it must happen before the restart: the plugin and its keys are
+    # read at start-up, so a restart first would boot the old state.
+    local keys=/home/dank/Containers/jellyfin/provider-keys
+    if [ -f "$keys" ]; then
+        bash scripts/jellyfin-providers.sh install
+    else
+        echo "WARN: $keys is absent - provider keys NOT placed"
+        echo "WARN: create it (TMDB_API_KEY=, TVDB_API_KEY=, chmod 600) and re-deploy jellyfin"
+    fi
+}
+
 deploy_jellyfin() {
     ensure_media_view
+    ensure_user_io_delegate
+    ensure_provider_keys
     cp "dankserver/jellyfin/quadlet/jellyfin.container" "$quadlet_unit_dir/"
     systemctl --user daemon-reload
     if ! systemctl --user is-active -q jellyfin.service; then
@@ -1306,6 +1360,7 @@ deploy_copyparty() {
 
 deploy_plex() {
     ensure_media_view
+    ensure_user_io_delegate
     cp "dankserver/plex/quadlet/plex.container" "$quadlet_unit_dir/"
     systemctl --user daemon-reload
     if ! systemctl --user is-active -q plex.service; then

scripts/jellyfin-providers.sh

@@ -0,0 +1,391 @@
+#!/usr/bin/env bash
+# Metadata-provider keys for Jellyfin on Dankserver, placed from the service's
+# host env file with the plugin artifact pinned by content hash.
+#
+# Jellyfin 12 ships TMDb, OMDb, StudioImages and MusicBrainz as CORE plugins:
+# they have no DLL, only a configuration file under the data root, and that
+# file is created by the running container. So the fleet's provider state lives
+# in two places the repo does not track —
+#
+#   plugins/configurations/Jellyfin.Plugin.Tmdb.xml   <TmdbApiKey /> (empty = keyless)
+#   plugins/configurations/Jellyfin.Plugin.Tvdb.xml   <ApiKey />     (needs the plugin)
+#
+# and both are owned by the container user. This tool is the only thing that
+# writes them: it is declarative, idempotent, and it never prints a key, so it
+# is safe to run while someone watches.
+#
+# Keys never enter git and never enter argv (a value in argv is world-readable
+# through /proc/<pid>/cmdline). They live in the per-service host env file that
+# is the fleet's convention for container credentials (grafana, caddy, pihole,
+# copyparty, romm, seerr), mode 600:
+#
+#   /home/dank/Containers/jellyfin/provider-keys
+#       TMDB_API_KEY=<key>
+#       TVDB_API_KEY=<key>
+#       TVDB_PIN=<pin>        # optional: only a subscriber-shaped TVDB key
+#                             # needs one; a licensed key does not
+#
+# TVDB itself is not core in 12 (the metadata provider was cut in 10.9), so it
+# is installed from the official catalog, pinned three ways: sha256 of the
+# artifact, the plugin's own guid, and its version. A matching sha proves only
+# that the bytes are the bytes fetched — the guid check is what says it is the
+# official plugin, the version check is what says it is the one this file was
+# reviewed against.
+#
+# Subcommands
+#   plan      print the resolved shape and every pending change, touch nothing
+#   install   fetch+verify the plugin, then write the keys (backing up first)
+#   verify    prove the plugin and both keys are actually in place
+#
+# Nothing here restarts Jellyfin: the deployer owns that
+# (`scripts/deploy.sh dankserver --service jellyfin`), and the plugin is read at
+# start-up, so a key written while the server runs is not live until then.
+set -euo pipefail
+
+# Jellyfin's data root on Dankserver (the rootless quadlet's config volume).
+JF_ROOT="${JF_ROOT:-/home/dank/Containers/jellyfin/config}"
+PROV_KEYS="${PROV_KEYS:-/home/dank/Containers/jellyfin/provider-keys}"
+TRASH_DIR="${TRASH_DIR:-$HOME/.AGENTTRASH/$(date +%Y%m%d)-jellyfin-providers}"
+
+PLUGINS="$JF_ROOT/plugins"
+CONF="$PLUGINS/configurations"
+TMDB_XML="$CONF/Jellyfin.Plugin.Tmdb.xml"
+TVDB_XML="$CONF/Jellyfin.Plugin.Tvdb.xml"
+
+# repo.jellyfin.org catalog entry for TheTVDB (owner: jellyfin), version 24.0.0.0,
+# targetAbi 12.0.0.0 — published 2026-09-09, verified against Jellyfin 12.4.0.
+TVDB_PLUGIN_URL="${TVDB_PLUGIN_URL:-https://repo.jellyfin.org/files/plugin/thetvdb/thetvdb_24.0.0.0.zip}"
+TVDB_PLUGIN_SHA256="${TVDB_PLUGIN_SHA256:-6302fba3857bdde8d186dd099fac09ca43247041f531a528a2c788add70a5319}"
+TVDB_PLUGIN_GUID="${TVDB_PLUGIN_GUID:-a677c0da-fac5-4cde-941a-7134223f14c8}"
+TVDB_PLUGIN_VERSION="${TVDB_PLUGIN_VERSION:-24.0.0.0}"
+PLUGIN_DIR="thetvdb_${TVDB_PLUGIN_VERSION}"
+TVDB_DLL="Jellyfin.Plugin.Tvdb.dll"
+
+die() {
+    printf 'jellyfin-providers: %s\n' "$*" >&2
+    exit 1
+}
+
+usage() {
+    printf 'usage: %s plan|install|verify\n' "$0" >&2
+    exit 2
+}
+
+# check_keys — refuse anything that is not a readable private file. An open
+# mode is an error, not a warning: a provider key readable by every user on the
+# box is the failure this check exists to catch.
+check_keys() {
+    [ -f "$PROV_KEYS" ] ||
+        die "$PROV_KEYS not found (create it with TMDB_API_KEY= and TVDB_API_KEY=, then chmod 600)"
+    local mode
+    mode="$(stat -c '%a' "$PROV_KEYS")"
+    case "$mode" in
+    600 | 400) ;;
+    *) die "$PROV_KEYS is mode $mode; provider keys must be 600" ;;
+    esac
+}
+
+# keys_value <VAR> — the value of one variable in the env file, or nothing.
+keys_value() {
+    awk -v k="$1" -F= '$1 == k { sub(/^[^=]*=/, ""); print; exit }' "$PROV_KEYS"
+}
+
+# keys_len <VAR> — the length, and a refusal naming the variable when absent.
+# The value itself is never printed.
+keys_len() {
+    local v
+    v="$(keys_value "$1")"
+    [ -n "$v" ] || die "$PROV_KEYS has no $1= line"
+    printf '%s' "${#v}"
+}
+
+# xml_value <file> <element> — the element's text, empty when it is absent or
+# self-closing.
+xml_value() {
+    python3 - "$1" "$2" <<'PYEOF'
+import re, sys
+src = open(sys.argv[1], encoding="utf-8").read()
+m = re.search(r"<%s(?:\s*/>|>(.*?)</%s>)" % (sys.argv[2], sys.argv[2]), src, re.S)
+print(m.group(1).strip() if (m and m.group(1)) else "")
+PYEOF
+}
+
+# xml_secret <file> <element> <var> — set <element> to that variable from the
+# env file. The python process reads the env file itself, so the value never
+# appears in argv.
+xml_secret() {
+    python3 - "$1" "$2" "$3" "$PROV_KEYS" <<'PYEOF'
+import os, re, sys, tempfile
+from xml.sax.saxutils import escape
+
+xml_path, elem, var, keys_path = sys.argv[1:5]
+val = ""
+for line in open(keys_path, encoding="utf-8"):
+    key, sep, rest = line.partition("=")
+    if sep and key.strip() == var:
+        val = rest.strip()
+        break
+if not val:
+    raise SystemExit(f"{keys_path} has no {var}= line")
+
+src = open(xml_path, encoding="utf-8").read()
+pat = re.compile(r"([ \t]*)<%s(?:\s*/>|>.*?</%s>)" % (elem, elem), re.S)
+text = escape(val)
+if pat.search(src):
+    out = pat.sub(lambda m: f"{m.group(1)}<{elem}>{text}</{elem}>", src, count=1)
+else:
+    out = src.replace("</Configuration>", f"  <{elem}>{text}</{elem}>\n</Configuration>", 1)
+if out == src:
+    raise SystemExit(f"{xml_path}: no place to write <{elem}>")
+
+d, base = os.path.split(xml_path)
+fd, tmp = tempfile.mkstemp(prefix=base + ".", dir=d)
+with os.fdopen(fd, "w", encoding="utf-8") as fh:
+    fh.write(out)
+os.chmod(tmp, os.stat(xml_path).st_mode & 0o777)
+os.replace(tmp, xml_path)
+PYEOF
+}
+
+# plugin_meta <zip> — "guid version" out of the artifact's own meta.json.
+plugin_meta() {
+    python3 - "$1" <<'PYEOF'
+import json, sys, zipfile
+meta = json.loads(zipfile.ZipFile(sys.argv[1]).read("meta.json").decode("utf-8"))
+print(meta.get("guid", ""), meta.get("version", ""))
+PYEOF
+}
+
+check_root() {
+    # Never fabricate a data root: creating plugins/ beside a typo'd path would
+    # install a plugin Jellyfin never loads and hide the operator's mistake.
+    [ -d "$CONF" ] || die "no Jellyfin configuration directory at $CONF (is JF_ROOT right?)"
+}
+
+check_keys_report() {
+    check_keys
+    # A refusal inside a command substitution used as a printf argument would
+    # be swallowed, so the guard runs as its own statement.
+    keys_len TMDB_API_KEY >/dev/null
+    keys_len TVDB_API_KEY >/dev/null
+    printf '= keys read from %s (mode %s)\n' "$PROV_KEYS" "$(stat -c '%a' "$PROV_KEYS")"
+}
+
+# The plugin's state, as one line in the shared vocabulary.
+plugin_state() {
+    if [ -d "$PLUGINS/$PLUGIN_DIR" ]; then
+        printf '= %s already installed\n' "$PLUGIN_DIR"
+        return 0
+    fi
+    local other
+    other="$(find "$PLUGINS" -maxdepth 1 -type d -name 'thetvdb_*' ! -name "$PLUGIN_DIR" -printf '%f\n' 2>/dev/null | sort | tr '\n' ' ')"
+    if [ -n "$other" ]; then
+        printf '+ install %s (a different version is present: %s)\n' "$PLUGIN_DIR" "$other"
+        return 0
+    fi
+    printf '+ install %s from %s\n' "$PLUGIN_DIR" "${TVDB_PLUGIN_URL#*://}"
+}
+
+tmdb_state() {
+    if [ ! -f "$TMDB_XML" ]; then
+        printf '! %s is missing — save the TMDb plugin settings once in the UI, then re-run\n' "$TMDB_XML" >&2
+        return 1
+    fi
+    local now want
+    now="$(xml_value "$TMDB_XML" TmdbApiKey)"
+    want="$(keys_value TMDB_API_KEY)"
+    if [ -n "$now" ] && [ "$now" = "$want" ]; then
+        printf '= TmdbApiKey already set (%s chars)\n' "${#now}"
+    elif [ -n "$now" ]; then
+        printf '+ replace the TmdbApiKey in Jellyfin.Plugin.Tmdb.xml\n'
+    else
+        printf '+ set TmdbApiKey in Jellyfin.Plugin.Tmdb.xml\n'
+    fi
+}
+
+tvdb_state() {
+    local now
+    if [ -f "$TVDB_XML" ]; then
+        now="$(xml_value "$TVDB_XML" ApiKey)"
+        if [ -n "$now" ]; then
+            printf '= Jellyfin.Plugin.Tvdb.xml already has an ApiKey (kept)\n'
+        else
+            printf '+ fill the empty ApiKey in Jellyfin.Plugin.Tvdb.xml\n'
+        fi
+    else
+        printf '+ create Jellyfin.Plugin.Tvdb.xml with ApiKey\n'
+    fi
+}
+
+write_plugin() {
+    local tmp guid version other
+    other="$(find "$PLUGINS" -maxdepth 1 -type d -name 'thetvdb_*' ! -name "$PLUGIN_DIR" -printf '%f\n' 2>/dev/null | sort | tr '\n' ' ')"
+    [ -z "$other" ] ||
+        die "another TheTVDB version is already installed ($other); move it to the trash first — two copies of one plugin means two loads"
+
+    tmp="$(mktemp "${TMPDIR:-/tmp}/thetvdb.XXXXXX.zip")"
+    # The pins are checked before anything is unpacked, so a bad artifact never
+    # reaches the plugins directory.
+    curl -fsSL --max-time 300 -o "$tmp" "$TVDB_PLUGIN_URL" ||
+        { rm -f "$tmp"; die "could not fetch $TVDB_PLUGIN_URL"; }
+    local got
+    got="$(sha256sum "$tmp" | cut -d' ' -f1)"
+    if [ "$got" != "$TVDB_PLUGIN_SHA256" ]; then
+        rm -f "$tmp"
+        die "artifact sha256 is $got, pinned $TVDB_PLUGIN_SHA256 — refusing to install"
+    fi
+    read -r guid version <<<"$(plugin_meta "$tmp")"
+    if [ "$guid" != "$TVDB_PLUGIN_GUID" ]; then
+        rm -f "$tmp"
+        die "artifact guid is $guid, expected the official $TVDB_PLUGIN_GUID — refusing to install"
+    fi
+    if [ "$version" != "$TVDB_PLUGIN_VERSION" ]; then
+        rm -f "$tmp"
+        die "artifact version is $version, pinned $TVDB_PLUGIN_VERSION — refusing to install"
+    fi
+    mkdir -p "$PLUGINS/$PLUGIN_DIR"
+    python3 -m zipfile -e "$tmp" "$PLUGINS/$PLUGIN_DIR/"
+    rm -f "$tmp"
+    [ -f "$PLUGINS/$PLUGIN_DIR/$TVDB_DLL" ] ||
+        die "$PLUGIN_DIR has no $TVDB_DLL — the artifact does not match this plugin"
+    printf '+ installed %s\n' "$PLUGIN_DIR"
+}
+
+backup_to_trash() {
+    local f="$1"
+    mkdir -p "$TRASH_DIR"
+    local dest="$TRASH_DIR/$(basename "$f").$(date +%H%M%S)"
+    cp -p "$f" "$dest"
+    printf '+ previous copy kept at %s\n' "$dest"
+}
+
+cmd_write_keys() {
+    local now want
+    KEYS_CHANGED=0
+    # TMDb: the running container owns this file and every setting in it. Only
+    # the key element is touched, so country, language and adult settings
+    # survive the edit.
+    [ -f "$TMDB_XML" ] ||
+        die "$TMDB_XML is missing — save the TMDb plugin settings once in the UI, then re-run"
+    now="$(xml_value "$TMDB_XML" TmdbApiKey)"
+    keys_len TMDB_API_KEY >/dev/null
+    want="$(keys_value TMDB_API_KEY)"
+    if [ "$now" = "$want" ]; then
+        printf '= TmdbApiKey already set (%s chars)\n' "${#now}"
+    else
+        backup_to_trash "$TMDB_XML"
+        xml_secret "$TMDB_XML" TmdbApiKey TMDB_API_KEY
+        printf '+ set TmdbApiKey (%s chars)\n' "${#want}"
+        KEYS_CHANGED=1
+    fi
+
+    # TVDB: never overwrite a config the operator saved through the UI.
+    if [ -f "$TVDB_XML" ]; then
+        now="$(xml_value "$TVDB_XML" ApiKey)"
+        if [ -n "$now" ]; then
+            printf '= Jellyfin.Plugin.Tvdb.xml already has an ApiKey (kept)\n'
+        else
+            keys_len TVDB_API_KEY >/dev/null
+            backup_to_trash "$TVDB_XML"
+            xml_secret "$TVDB_XML" ApiKey TVDB_API_KEY
+            if [ -n "$(keys_value TVDB_PIN)" ] && [ -z "$(xml_value "$TVDB_XML" Pin)" ]; then
+                xml_secret "$TVDB_XML" Pin TVDB_PIN
+            fi
+            printf '+ filled the ApiKey in Jellyfin.Plugin.Tvdb.xml\n'
+            KEYS_CHANGED=1
+        fi
+    else
+        keys_len TVDB_API_KEY >/dev/null
+        cat >"$TVDB_XML" <<XML
+<?xml version="1.0" encoding="utf-8"?>
+<Configuration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+  <ApiKey />
+</Configuration>
+XML
+        xml_secret "$TVDB_XML" ApiKey TVDB_API_KEY
+        if [ -n "$(keys_value TVDB_PIN)" ]; then
+            xml_secret "$TVDB_XML" Pin TVDB_PIN
+        fi
+        printf '+ created Jellyfin.Plugin.Tvdb.xml with ApiKey\n'
+        KEYS_CHANGED=1
+    fi
+}
+
+cmd_plan() {
+    check_root
+    check_keys_report
+    printf 'root  %s\n' "$JF_ROOT"
+    plugin_state
+    tmdb_state
+    tvdb_state
+}
+
+cmd_install() {
+    check_root
+    check_keys_report
+    KEYS_CHANGED=0
+    if [ ! -d "$PLUGINS/$PLUGIN_DIR" ]; then
+        write_plugin
+        KEYS_CHANGED=1
+    else
+        printf '= %s already installed\n' "$PLUGIN_DIR"
+    fi
+    cmd_write_keys
+    if [ "$KEYS_CHANGED" -eq 1 ]; then
+        # Nothing is restarted here on purpose: this host may be playing media
+        # right now, and both the plugin and its keys are read at start-up.
+        printf 'next: scripts/deploy.sh dankserver --service jellyfin (the plugin and keys load at start-up)\n'
+    else
+        printf '= no change\n'
+    fi
+}
+
+cmd_verify() {
+    check_root
+    local bad=0
+    if [ ! -d "$PLUGINS/$PLUGIN_DIR" ]; then
+        printf 'MISSING plugin directory %s (thetvdb not installed)\n' "$PLUGIN_DIR" >&2
+        bad=1
+    else
+        local dlls abi
+        dlls="$(find "$PLUGINS/$PLUGIN_DIR" -maxdepth 1 -name '*.dll' | wc -l)"
+        [ "$dlls" -ge 1 ] || {
+            printf 'MISSING %s inside %s\n' "$TVDB_DLL" "$PLUGIN_DIR" >&2
+            bad=1
+        }
+        abi="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("targetAbi","?"))' \
+            "$PLUGINS/$PLUGIN_DIR/meta.json" 2>/dev/null || echo '?')"
+        printf 'plugin %s: %s dll(s), targetAbi %s\n' "$PLUGIN_DIR" "$dlls" "$abi"
+    fi
+    local pair elem n
+    for pair in "$TMDB_XML|TmdbApiKey" "$TVDB_XML|ApiKey"; do
+        elem="${pair##*|}"
+        if [ ! -f "${pair%%|*}" ]; then
+            printf 'MISSING %s\n' "${pair%%|*}" >&2
+            bad=1
+            continue
+        fi
+        if ! python3 -c 'import sys, xml.dom.minidom; xml.dom.minidom.parse(sys.argv[1])' "${pair%%|*}"; then
+            printf 'UNPARSEABLE %s\n' "${pair%%|*}" >&2
+            bad=1
+            continue
+        fi
+        n="$(xml_value "${pair%%|*}" "$elem")"
+        if [ -z "$n" ]; then
+            printf 'MISSING key: %s has no %s value\n' "$(basename "${pair%%|*}")" "$elem" >&2
+            bad=1
+        else
+            printf '%s %s chars\n' "$elem" "${#n}"
+        fi
+    done
+    [ "$bad" -eq 0 ] || return 1
+    printf 'providers configured\n'
+}
+
+cmd="${1:-}"
+case "$cmd" in
+plan) cmd_plan ;;
+install) cmd_install ;;
+verify) cmd_verify ;;
+*) usage ;;
+esac

scripts/media-apply.py

@@ -32,6 +32,12 @@ cross a filesystem (rename cannot do it and a silent copy at 24 TB would not).
 --force relaxes only the guards that are opinion (journal already rolled back,
 paths outside --root); it never allows overwriting a file.
 
+--metadata-view names the overlay the media servers read their library through
+(default /var/lib/media-meta/view). The sidecar follow-up printed after an apply
+or rollback is conditioned on that path being a mountpoint: where no view is
+mounted the servers bind the array itself, the sidecars moved with the media,
+and a reap order would point at a directory that is not there.
+
 The journal defaults to `media-relayout.jsonl` BESIDE the library root, never
 inside it: a log inside the library is a file Jellyfin will index.
 """
@@ -53,10 +59,18 @@ def journal_default(root):
 
 
 class Journal:
-    """Append-only JSONL of intents. Writes are fsynced before the tool acts."""
+    """Append-only JSONL of intents. Writes are fsynced before the tool acts.
 
-    def __init__(self, path, writing):
+    ``batch`` is how many intents may be written before one fsync covers them.
+    The rule the file exists for is unchanged — an intent is on disk before the
+    move it authorises runs — so the caller must call ``sync()`` before it
+    performs a batch's renames; only the number of flushes falls. 1 = a flush
+    per intent (the original behaviour).
+    """
+
+    def __init__(self, path, writing, batch=1):
         self.path, self.writing = path, writing
+        self.batch = max(1, int(batch))
         self.records = []
         if os.path.exists(path):
             for line in open(path):
@@ -64,11 +78,15 @@ class Journal:
                 if line:
                     self.records.append(json.loads(line))
         self._fh = None
+        self._unsynced = 0
+        # (src, dst) index: already() is called three times per move, so an
+        # any() over every record written so far made a 58k-move pass quadratic.
+        self._intents = {(r.get("src"), r.get("dst"))
+                         for r in self.records if r.get("op") == "move"}
 
     def already(self, dst, src):
         """An intent for this exact (src, dst) was written by an earlier run."""
-        return any(r.get("op") == "move" and r.get("dst") == dst
-                   and r.get("src") == src for r in self.records)
+        return (src, dst) in self._intents
 
     @property
     def rolled_back(self):
@@ -76,16 +94,28 @@ class Journal:
 
     def record(self, **fields):
         self.records.append(fields)
+        if fields.get("op") == "move":
+            self._intents.add((fields.get("src"), fields.get("dst")))
         if not self.writing:
             return
         if self._fh is None:
             self._fh = open(self.path, "a")
         self._fh.write(json.dumps(fields) + "\n")
         self._fh.flush()
+        self._unsynced += 1
+        if self._unsynced >= self.batch:
+            self.sync()
+
+    def sync(self):
+        """Make every intent written so far durable. No-op when nothing pending."""
+        if not self.writing or self._fh is None or not self._unsynced:
+            return
         os.fsync(self._fh.fileno())
+        self._unsynced = 0
 
     def close(self):
         if self._fh:
+            self.sync()
             self._fh.close()
 
 
@@ -114,13 +144,24 @@ def read_plan(path, root, force):
     return mkdirs, keeps, moves
 
 
-# A relayout moves bytes on the raw array; the sidecars the media servers wrote
-# live in the SSD overlay and stay at the old coordinates. Naming the follow-up
-# here is the point of use for that fact — see the Media Metadata View page.
+# The media servers may read the library through the SSD overlay view
+# (scripts/media-view.sh). A relayout moves bytes on the raw array, so sidecars
+# the servers wrote through that view stay at the old coordinates — naming the
+# follow-up here is the point of use for that fact, but only where the view
+# exists: where it is not mounted the servers bind the array itself, the
+# sidecars moved with the media, and a reap order points at a directory that
+# is not there. See the Media Metadata View page for the host's state.
+METADATA_VIEW = "/var/lib/media-meta/view"
 METADATA_HINT = ("note: sidecars written through the metadata view did not follow"
                  " these moves — next: scripts/media-view.sh reap")
 
 
+def metadata_note(args):
+    """Print the sidecar follow-up only when the overlay is really mounted."""
+    if os.path.ismount(args.metadata_view):
+        print(METADATA_HINT)
+
+
 def do_apply(args, root, journal, mkdirs, keeps, moves):
     """Preflight everything, then folders, then renames. Never a partial start."""
     problems = []
@@ -160,14 +201,30 @@ def do_apply(args, root, journal, mkdirs, keeps, moves):
             print(f"  would move {src} -> {dst}")
         return 0
 
+    batch = max(1, args.batch)
     made = {r.get("dst") for r in journal.records if r.get("op") == "mkdir"}
     dirs_new = 0
+    queued = []
+
+    def drain_dirs():
+        """Create the queued folders only after their intents are durable."""
+        nonlocal dirs_new
+        if not queued:
+            return
+        journal.sync()
+        for d in queued:
+            os.makedirs(d, exist_ok=True)
+            dirs_new += 1
+        queued.clear()
+
     for d in sorted(mkdirs, key=lambda q: q.count(os.sep)):
         if d in made or os.path.isdir(d):
             continue
         journal.record(op="mkdir", dst=d)
-        os.makedirs(d, exist_ok=True)
-        dirs_new += 1
+        queued.append(d)
+        if len(queued) >= batch:
+            drain_dirs()
+    drain_dirs()
 
     # same-filesystem gate: rename cannot cross a device, and a silent copy of a
     # library this size is not an option anyone would choose.
@@ -184,6 +241,19 @@ def do_apply(args, root, journal, mkdirs, keeps, moves):
         return 2
 
     moved = done = 0
+    pending = []
+
+    def drain_moves():
+        """Perform the queued renames only after their intents are on disk."""
+        nonlocal moved
+        if not pending:
+            return
+        journal.sync()
+        for s, d in pending:
+            os.rename(s, d)
+            moved += 1
+        pending.clear()
+
     for src, dst, _kind in moves:
         if journal.already(dst, src):
             if os.path.exists(dst) and not os.path.exists(src):
@@ -196,13 +266,15 @@ def do_apply(args, root, journal, mkdirs, keeps, moves):
         st = os.stat(src)
         journal.record(op="move", src=src, dst=dst, bytes=st.st_size, mode=st.st_mode,
                        mtime=st.st_mtime, ino=st.st_ino, dev=st.st_dev)
-        os.rename(src, dst)
-        moved += 1
+        pending.append((src, dst))
+        if len(pending) >= batch:
+            drain_moves()
+    drain_moves()
     print(f"applied: {moved} moved, {done} already done in an earlier run,"
           f" {dirs_new} folders created, {len(keeps)} files stayed put")
     print(f"journal: {journal.path} — undo with: media-apply.py rollback"
           f" --journal {journal.path} --root {root} --apply")
-    print(METADATA_HINT)
+    metadata_note(args)
     return 0
 
 
@@ -386,7 +458,7 @@ def do_rollback(args, root, journal):
                    t=datetime.datetime.now(datetime.timezone.utc).isoformat())
     print(f"rolled back: {undone} files back where the census found them,"
           f" {dirs_gone} empty folders removed, {recreated} swept folders recreated")
-    print(METADATA_HINT)
+    metadata_note(args)
     return 0
 
 
@@ -398,13 +470,20 @@ def main():
     ap.add_argument("--journal")
     ap.add_argument("--apply", action="store_true", help="actually change the library")
     ap.add_argument("--force", action="store_true", help="relax the opinion guards")
+    ap.add_argument("--metadata-view", default=METADATA_VIEW,
+                    help="overlay the media servers read through; the sidecar"
+                         " note prints only when this path is a mountpoint")
+    ap.add_argument("--batch", type=int, default=64,
+                    help="journal intents per fsync (1 = flush before every move)."
+                         " An intent is still durable before the move it authorises;"
+                         " only the number of flushes falls")
     args = ap.parse_args()
 
     root = os.path.abspath(args.root)
     if not os.path.isdir(root):
         raise Refuse(f"no library at {root}")
     journal_path = args.journal or journal_default(root)
-    journal = Journal(journal_path, args.apply)
+    journal = Journal(journal_path, args.apply, batch=args.batch)
     try:
         if args.cmd in ("rollback", "verify", "sweep") and not os.path.exists(journal_path):
             raise Refuse(f"no journal at {journal_path} — nothing to {args.cmd}")

scripts/media-audiobooks.py

@@ -0,0 +1,425 @@
+#!/usr/bin/env python3
+r"""media-audiobooks.py — a plan that re-files the audiobook library into one folder per book.
+
+    media-audiobooks.py --root DIR --enum TSV --rows TSV [--out TSV] [--exceptions FILE]
+
+Plex reads this library and Jellyfin does not: its music scanner has no audiobook
+concept, and the tree is indexed entirely by Plex, which matched 58,975 of the
+62,879 files here into its Artist/Album/Track shape. So the authority is
+`scripts/media-census.py audiobooks` — the BOOK (album row), its NARRATOR (that
+book's single artist row) and its CHAPTERS (track rows) — and never the folder a
+release pack made. The plan is:
+
+    Audiobooks/<Narrator>/<Book> (<year>)/<the file's own name>.<ext>
+                     ... the same folder, " (2)" on the name, when two chapters
+                         of one book carry the same name
+
+What that buys is the one property both media servers' book scanners assume: a
+folder holds exactly one book. Today 212 top-level folders are a mix of
+author-named shelves and collection packs, and the books inside the packs are
+split across `… [Part 1]`, `… [Part 2]` folders three or four deep.
+
+Three laws here are the opposite of what a music shelf does, and each is forced
+by what the rows actually hold:
+
+ * A chapter is NEVER renumbered. 7,556 of the 10,485 books contain at least one
+   chapter whose index Plex does not know, so a number written into a name would
+   be invented — and it would buy nothing, because both servers order playback by
+   the embedded track tag, not by the file name. A wrong number in a name is worse
+   than none: it is the number a human later trusts. A file already carrying its
+   own number keeps it, untouched.
+ * The shelf is the NARRATOR, not the author. Every book has exactly one artist row
+   and it is the narrator; the author survives only inside 10% of the album titles
+   (`Kryptos by Graham McNeill`) and in no column Plex stores, so deriving the
+   author would mean parsing titles for one book in ten and inventing it for the
+   rest. One rule that always resolves beats a shelf that is half author and half
+   narrator; the author stays visible in the book folder's own name, which is the
+   title Plex shows.
+ * Nothing is guessed at. A chapter row with no book or no narrator parks — a
+   tag-scan placeholder (`[Unknown Album]`) names neither, since unrelated books
+   share it and filing on one merges them, and so does a chapter number the ripper
+   mistagged as the artist (`0.4`). An audio file Plex never matched parks, a
+   video container parks, and a loose file in a folder holding two books parks.
+
+Nothing is deleted and nothing is overwritten. The output is a list of rename(2)
+intents for `scripts/media-apply.py`, whose preflight refuses any target that is
+already claimed and whose journal is the rollback.
+"""
+import argparse
+import csv
+import os
+import re
+import sys
+from collections import Counter, defaultdict
+
+# What a chapter file can be. .m4b is the audiobook container; the rest are the
+# audio a pack ships when it was ripped as music.
+AUDIO_EXT = {".mp3", ".m4a", ".m4b", ".ogg", ".oga", ".opus", ".wav", ".flac",
+             ".wma", ".aiff", ".aif", ".m4v", ".aac", ".mka"}
+# Never an audiobook, whatever the library it sits in says: Plex reads these as
+# video, and renaming one into an audio extension would claim it is a chapter.
+VIDEO_EXT = {".mkv", ".mp4", ".webm", ".avi", ".mov", ".mpg", ".mpeg", ".ts",
+             ".m2ts", ".vob", ".ifo", ".wmv", ".iso", ".img", ".bdmv", ".ogm",
+             ".divx"}
+
+# Tag-scan placeholders. These strings are not identities: 1,106 chapters from
+# 14 unrelated top-level folders carry the album `[Unknown Album]`, so filing on
+# them would merge books that have nothing to do with each other — the exact
+# shape this relayout exists to make impossible. Such a chapter parks with the
+# path it has today and the fix belongs in its tags. `Various Artists` is NOT a
+# placeholder: that is what a multi-cast read carries, and the one book here
+# with 1,189 chapters under it is genuinely one book.
+PLACEHOLDER_BOOK = {"[unknown album]", "unknown album", "no title", "untitled",
+                    "[untitled]", "unknown title", "n/a", "-"}
+PLACEHOLDER_NARRATOR = {"[unknown artist]", "unknown artist", "unknown author",
+                        "<unknown>", "[unknown]", "unknown"}
+
+
+def identity(value, placeholders, needs_letter=False):
+    """The tag value Plex matched, when it names something; '' when it does not.
+
+    A trailing parenthesized group is stripped for the test only, because rippers
+    glue timestamps to the placeholder (`Unknown album (03/03/2015 21:39:55)`).
+
+    `needs_letter` is for a NARRATOR alone: a shelf is a person's name, and 272
+    chapters here carry a chapter number in the artist tag (`0.4`, `31`). The same
+    test must never judge a BOOK title, which may honestly be `1984`.
+    """
+    v = (value or "").strip()
+    bare = re.sub(r"\s*\([^()]*\)\s*$", "", v).strip().casefold()
+    if bare in placeholders or (needs_letter and not any(c.isalpha() for c in v)):
+        return ""
+    return v
+
+
+# The characters Plex documents as breaking playback. They are dropped, not
+# substituted: a replacement character is a guess at what the title meant.
+BAD_CHARS = set('<>:"/\\|?*')
+TRASH_DIR = re.compile(r"(^|/)(\.AGENTTRASH|\.thumbnails|\.Trash-\d+|@eaDir"
+                       r"|lost\+found)(/|$)")
+
+ARGS = None
+HELD = {}                            # path -> (bytes, ext)
+ROWS = {}                            # path -> the chapter row Plex matched
+PLACED = {}                          # chapter path -> the destination the plan gave it
+CLAIMED = set()                      # every destination path the plan has handed out
+MOVES, KEEPS = [], []
+PARKED = defaultdict(list)           # reason -> [path]
+NOTES = defaultdict(list)            # section -> [line]
+AUDIO_BY_DIR = defaultdict(set)      # source dir -> chapter files a row names
+CHILD_OF = defaultdict(set)          # dir -> the dirs directly below it holding chapters
+FOLDERS_SEEN = {}                    # (dir, depth) -> book folders placed below it
+SUBTREE_DEPTH = 2                    # how far below a folder its chapters may sit
+BOOKS = {}                           # (narrator, book, year) -> the book group
+
+AMBIGUOUS = object()
+
+
+def dominant(values):
+    """The spelling the rows mostly agree on: the most frequent value, ties broken
+    by sort so the answer never depends on the order rows arrived in."""
+    counts = Counter(values)
+    return min(counts.items(), key=lambda kv: (-kv[1], kv[0]))[0]
+
+
+def rel(path):
+    """The path as seen from the library root."""
+    return os.path.relpath(path, ARGS.root)
+
+
+def safe(name):
+    """A name every client can carry: no reserved character, nothing unprintable,
+    no trailing dot or space, and short enough to rename."""
+    out = "".join(c for c in (name or "")
+                  if c not in BAD_CHARS and (c.isprintable() or c == " "))
+    out = re.sub(r"\s+", " ", out).strip().rstrip(". ")
+    while out and len(out.encode("utf-8", "ignore")) > 200:
+        out = out[:-4].rstrip()
+    return out
+
+
+def assign(src, folder, name, ext, kind, note):
+    """Book one file into `folder` under `name`, renamed if that exact destination
+    is already taken — by another file in the plan, or by a file standing there
+    today. Two files claiming one path is the fault that costs a re-run of a 60k
+    plan, and so is a plan that only works if the renames happen in the right
+    order: the executor refuses any target that is occupied, so an occupied path
+    is never a destination, even when its occupant is scheduled to leave.
+    A file already standing where the contract puts it is a keep, not a move."""
+    stem = safe(name) or "file"
+    dst = os.path.join(folder, stem + ext)
+    if dst == src:
+        CLAIMED.add(dst.lower())          # it is standing on its own target
+        KEEPS.append((src, dst, kind))
+        return dst
+    # A file already in this folder under this name — or under the numbered
+    # variant the collision rule gives it — keeps the name it has. Renumbering it
+    # every run would turn the plan into a shuffle instead of a fixed point.
+    base = os.path.splitext(os.path.basename(src))[0]
+    if os.path.dirname(src) == folder and (base == stem
+                                           or base.startswith(stem + " (")):
+        CLAIMED.add(src.lower())
+        KEEPS.append((src, src, kind))
+        return src
+    n = 1
+    while dst.lower() in CLAIMED:
+        n += 1
+        dst = os.path.join(folder, f"{stem} ({n}){ext}")
+    if n > 1:
+        NOTES[note].append(rel(dst))
+    CLAIMED.add(dst.lower())
+    MOVES.append((src, dst, kind))
+    return dst
+
+
+def park(path, reason):
+    """Hold a file where it is, under the park folder, keeping its relative path."""
+    PARKED[reason].append(path)
+    dst = os.path.join(ARGS.park_dir, rel(path))
+    if dst != path:
+        CLAIMED.add(dst.lower())
+        MOVES.append((path, dst, "park"))
+
+
+def under_park(path):
+    """True for a file already parked: that pile is for a human to review, and
+    re-parking it every run would only push it deeper."""
+    return path.startswith(ARGS.park_dir + os.sep)
+
+
+# ------------------------------------------------------------------------ books
+def group_books():
+    """Every matched chapter into one group per (narrator, book, year).
+
+    The key is the identity Plex asserts in its own database, not the folder the
+    file sits in: one book arrives as four part folders inside a collection pack,
+    and two copies of one book in one pack are one book to Plex, whose album item
+    IS that narrator, title and year. The year is part of the key so a 1965
+    recording and a 2020 recording that share a title stay two books.
+    """
+    for path, r in sorted(ROWS.items()):
+        if path not in HELD or under_park(path) or TRASH_DIR.search(path):
+            continue
+        d = os.path.dirname(path)
+        AUDIO_BY_DIR[d].add(path)
+        CHILD_OF[os.path.dirname(d)].add(d)   # so a cover above Part 1/Part 2 sees both
+        narrator = identity(r["narrator"], PLACEHOLDER_NARRATOR, needs_letter=True)
+        book = identity(r["book"], PLACEHOLDER_BOOK)
+        if not book:
+            park(path, "a chapter row that names no book — Plex's album title is a "
+                       "placeholder like [Unknown Album], so filing on it would "
+                       "merge unrelated books onto one shelf")
+            continue
+        if not narrator:
+            park(path, "a chapter row that names no narrator — the artist row is a "
+                       "placeholder like [Unknown Artist] or a chapter number a "
+                       "ripper mistagged as the artist, so no shelf owns it")
+            continue
+        key = (narrator.casefold(), book.casefold(), (r["year"] or "").strip())
+        g = BOOKS.setdefault(key, {"narrators": [], "books": [], "year": key[2],
+                                   "members": [], "indexed": 0})
+        g["members"].append(path)
+        g["narrators"].append(narrator)
+        g["books"].append(book)
+        if str(r["track"] or "").isdigit():
+            g["indexed"] += 1
+
+
+def book_folder(g):
+    """The shelf Plex's own rows name: <narrator>/<book> (<year>). None when a
+    name is made of characters no path can hold — inventing a shelf is filing it
+    wrong, so those chapters park instead."""
+    narrator = safe(dominant(g["narrators"]))
+    book = safe(dominant(g["books"]))
+    if not narrator or not book:
+        return None
+    return os.path.join(ARGS.root, narrator,
+                        f"{book} ({g['year']})" if g["year"] else book)
+
+
+def place_books():
+    """One folder per book; every chapter keeps the name it has today."""
+    for key in sorted(BOOKS):
+        g = BOOKS[key]
+        folder = book_folder(g)
+        if folder is None:
+            for path in sorted(g["members"]):
+                park(path, "a book or narrator Plex spells with characters no "
+                           "folder name can hold")
+            continue
+        for path in sorted(g["members"]):
+            ext = HELD[path][1]
+            base = os.path.splitext(os.path.basename(path))[0]
+            # The name the ripper wrote, unchanged: the track tag inside the file
+            # is what orders playback, and 72% of the books here have chapters no
+            # row numbers, so any number added here would be invented.
+            PLACED[path] = assign(path, folder, base, ext, "chapter",
+                                  "two chapters of one book carried the same name")
+
+
+# --------------------------------------------------------------------- sidecars
+def folders_below(d, depth):
+    """The book folders the chapters in `d`, or within `depth` directories below
+    it, were placed in. Memoised, because every loose file in a big collection
+    folder asks the same question about it."""
+    if (d, depth) not in FOLDERS_SEEN:
+        seen = {os.path.dirname(PLACED[a]) for a in AUDIO_BY_DIR.get(d, ())
+                if a in PLACED}
+        if depth:
+            for child in CHILD_OF.get(d, ()):
+                seen |= folders_below(child, depth - 1)
+        FOLDERS_SEEN[(d, depth)] = seen
+    return FOLDERS_SEEN[(d, depth)]
+
+
+def owner_folder(d):
+    """The book folder that owns this directory — the first place up the tree
+    where chapters sit, in the directory itself or within SUBTREE_DEPTH levels
+    below it, which is how a pack whose parts are `… [Part 1]`/`… [Part 2]` owns
+    the cover art lying above them. None when no chapter is near enough to say,
+    AMBIGUOUS when the chapters there belong to more than one book."""
+    while d.startswith(ARGS.root + os.sep) and d != ARGS.root:
+        folders = folders_below(d, SUBTREE_DEPTH)
+        if folders:
+            return next(iter(folders)) if len(folders) == 1 else AMBIGUOUS
+        d = os.path.dirname(d)
+    return None
+
+
+def place_other():
+    """Everything that is not a chapter Plex matched: covers, booklets, EPUBs,
+    logs, checksums, playlists — and the clutter that is none of those."""
+    for path, (_size, ext) in sorted(HELD.items()):
+        if path in ROWS or under_park(path) or TRASH_DIR.search(path):
+            continue
+        d = os.path.dirname(path)
+        base = os.path.splitext(os.path.basename(path))[0]
+        if ext in VIDEO_EXT:
+            park(path, "a video container inside the audiobook library: Plex reads "
+                       "it as video, and renaming it would claim it is a chapter")
+        elif ext in AUDIO_EXT:
+            park(path, "an audio file no chapter row names — it is not in the "
+                       "library Plex matched, so nothing says which book it is")
+        else:
+            owner = owner_folder(d)
+            if owner is AMBIGUOUS:
+                park(path, "a file whose folder holds more than one book, so "
+                           "nothing says which one it belongs to")
+            elif owner:
+                assign(path, owner, base, ext,
+                       "playlist" if ext in (".m3u", ".m3u8") else "sidecar",
+                       "one book folder would have carried two files of the same"
+                       " sidecar name")
+            else:
+                park(path, "not an audiobook file, and no book's folder lies with"
+                           " it to carry it")
+
+
+# ---------------------------------------------------------------------- outputs
+def write_plan():
+    """mkdir rows for every destination folder and its whole chain, then the moves.
+    Parents first: the executor creates directories in the order they are listed."""
+    chain = set()
+    for _s, dst, _k in MOVES:
+        d = os.path.dirname(dst)
+        while d and d != ARGS.root and d != os.path.dirname(d):
+            chain.add(d)
+            d = os.path.dirname(d)
+    dirs = sorted(chain, key=lambda p: (p.count("/"), p))
+    with open(ARGS.out, "w") as fh:
+        fh.write("action\tsrc\tdst\tkind\n")
+        for d in dirs:
+            fh.write(f"mkdir\t\t{d}\tdir\n")
+        for src, dst, kind in sorted(MOVES, key=lambda m: (m[1], m[0])):
+            fh.write(f"move\t{src}\t{dst}\t{kind}\n")
+        for src, dst, kind in sorted(KEEPS, key=lambda m: (m[1], m[0])):
+            fh.write(f"keep\t{src}\t{dst}\t{kind}\n")
+    parked = [m for m in MOVES if m[2] == "park"]
+    sized = sum(HELD[s][0] for s, _d, _k in MOVES if s in HELD)
+    print(f"plan: {len(MOVES) - len(parked)} moves, {len(parked)} parked"
+          f" ({sized / 2**40:.2f} TiB touched), {len(KEEPS)} already placed,"
+          f" {len(dirs)} folders -> {ARGS.out}")
+
+
+def write_exceptions():
+    with open(ARGS.exceptions, "w") as fh:
+        fh.write(f"Audiobook relayout exceptions for {ARGS.root}\n\n")
+        fh.write(f"Everything below is parked under {ARGS.park_dir}, keeping the\n"
+                 "relative path it has today. Nothing is deleted and nothing is\n"
+                 "overwritten: a parked file is one rename from wherever the plan is\n"
+                 "pointed next.\n\n")
+        for reason in sorted(PARKED, key=lambda r: -len(PARKED[r])):
+            rs = PARKED[reason]
+            fh.write(f"{len(rs):>6} files  {reason}\n")
+            for p in sorted(rs, key=rel)[:400]:
+                fh.write(f"          {rel(p)}\n")
+            if len(rs) > 400:
+                fh.write(f"          … and {len(rs) - 400} more\n")
+            fh.write("\n")
+        for section in sorted(NOTES, key=lambda s: -len(NOTES[s])):
+            lines = sorted(set(NOTES[section]))
+            fh.write(f"{len(lines):>6}  {section}\n")
+            for line in lines[:200]:
+                fh.write(f"          {line}\n")
+            if len(lines) > 200:
+                fh.write(f"          … and {len(lines) - 200} more\n")
+            fh.write("\n")
+        unindexed = sorted(f"{safe(dominant(g['narrators']))}/{safe(dominant(g['books']))}"
+                           for g in BOOKS.values()
+                           if 0 < g["indexed"] < len(g["members"]))
+        if unindexed:
+            fh.write(f"{len(unindexed):>6} books have chapters Plex does not number. Their\n")
+            fh.write("       files keep the names they carry: playback order comes from the\n"
+                     "       track tag inside each file, and a number written here would be\n"
+                     "       invented for the chapters with no index. Fix it in the tags, not\n"
+                     "       in the names — Plex re-reads tags on a scan and never names files.\n\n")
+        fh.write("       Playlists move with their book and their contents are never\n"
+                 "       rewritten: the paths inside an .m3u go stale.\n")
+    print(f"exceptions -> {ARGS.exceptions}")
+
+
+def main():
+    global ARGS
+    ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    ap.add_argument("--root", default=os.environ.get("MEDIA_AUDIOBOOKS_ROOT",
+                                                     "/mnt/entropy/Audiobooks"))
+    ap.add_argument("--enum", default="/tmp/audiobooks-enum.tsv",
+                    help="the enumerate TSV (bytes, ext, path)")
+    ap.add_argument("--rows", default="/tmp/plex-audiobooks.tsv",
+                    help="the chapter rows scripts/media-census.py audiobooks wrote")
+    ap.add_argument("--out", default="/tmp/audiobooks-plan.tsv")
+    ap.add_argument("--exceptions", default="/tmp/audiobooks-exceptions.txt")
+    ap.add_argument("--park", default="_unsorted",
+                    help="the folder inside the root that holds what cannot be filed")
+    ARGS = ap.parse_args()
+    ARGS.root = os.path.normpath(ARGS.root)
+    ARGS.park_dir = os.path.join(ARGS.root, ARGS.park)
+    read_inputs()
+    # Every path a file occupies today is claimed before a single destination is
+    # handed out: the executor refuses an occupied target, so a plan that aimed at
+    # one would only fail after the renames that were supposed to clear it.
+    CLAIMED.update(p.lower() for p in HELD)
+    group_books()
+    place_books()
+    place_other()
+    write_plan()
+    write_exceptions()
+
+
+def read_inputs():
+    with open(ARGS.enum) as fh:
+        for line in fh:
+            parts = line.rstrip("\n").split("\t")
+            if len(parts) >= 3:
+                HELD[parts[2]] = (int(parts[0]), parts[1].lower())
+    with open(ARGS.rows, newline="") as fh:
+        for row in csv.DictReader(fh, delimiter="\t"):
+            if row.get("file"):
+                ROWS[row["file"]] = row
+    gone = [p for p in ROWS if p not in HELD]
+    if gone:
+        NOTES["a chapter row whose file the census no longer sees"].extend(gone)
+
+
+if __name__ == "__main__":
+    main()

scripts/media-census.py

@@ -1,13 +1,15 @@
 #!/usr/bin/env python3
-r"""Read-only census of a movie library — the inputs a relayout plan is built from.
+r"""Read-only census of a media library — the inputs a relayout plan is built from.
 
   media-census.py enumerate [--root DIR] [--out TSV]
   media-census.py probe     [--enum TSV] [--out TSV] [--jobs N]
   media-census.py plex      [--root DIR] [--db PATH] [--out TSV]
+  media-census.py jellyfin  [--root DIR] [--db PATH] [--container PREFIX] [--out TSV]
+  media-census.py audiobooks [--root DIR] [--db PATH] [--out TSV]
 
 Run it on the machine that mounts the library. Nothing here writes inside the
-library and nothing is deleted; the only outputs are the three TSVs below, and
-scripts/media-plan.py reads them instead of touching media.
+library and nothing is deleted; the only outputs are the TSVs below, and the
+scripts/media-plan.py and scripts/media-shows.py read them instead of touching media.
 
   enum    bytes <TAB> ext <TAB> path                  every file under the root
   probed  bytes <TAB> path <TAB> dur <TAB> vcodec <TAB> WxH <TAB> fps <TAB> vbit
@@ -18,10 +20,34 @@ scripts/media-plan.py reads them instead of touching media.
   plex    file <TAB> leaf_title <TAB> … (see PLEX_COLS)
           the titles Plex already matched — the authority over any filename guess
 
+  jellyfin file <TAB> series <TAB> year <TAB> season <TAB> episode <TAB> extra
+          <TAB> tmdb <TAB> title <TAB> tvdb      (see JF_COLS)
+          one row per episode Jellyfin has matched and numbered, its path mapped
+          from the container's view back to the host; `year`, `tmdb` and `tvdb`
+          are the SERIES' values, `title` is the episode title the row carries,
+          `extra` is Jellyfin's own extra type when the row is bonus material
+          rather than an episode
+
+  music file <TAB> artist <TAB> album <TAB> year <TAB> disc <TAB> track <TAB> title
+         <TAB> mb <TAB> performer   (see MUSIC_COLS)
+         one row per track Jellyfin has tagged: the tag read is what the row IS,
+         so `artist` is the album artist (the track artist when that is empty) and
+         `album`/`year` are the album item's provider values when the folder is an
+         album item and the tags' otherwise; `mb` is the album's MusicBrainz
+         release group, `performer` the track artist the tags carry
+
+  audiobooks file <TAB> narrator <TAB> book <TAB> year <TAB> track <TAB> chapter
+         (see AB_COLS)
+         one row per chapter Plex matched under the audiobook root: `book` is the
+         album row Plex built from the files' own tags, `narrator` that book's
+         artist row — Plex keeps exactly one artist per book, which is why it, and
+         not an author parsed out of a title, names the shelf. `track` is empty
+         wherever Plex has no chapter number, which is most of this library.
+
 `probe` is the slow step (every container is opened for its header, ~10 min for
 4,800 files on a spindle array at 6 workers) so it is `nice`d: a census beside a
 live service must not starve it. `enumerate` is a stat pass, so re-censusing
-before a plan is cheap — and a plan is only ever as good as these three files.
+before a plan is cheap — and a plan is only ever as good as these files.
 """
 import argparse
 import csv
@@ -57,6 +83,72 @@ join metadata_items mi on mi.id = m.metadata_item_id
 left join metadata_items par on par.id = mi.parent_id
 where p.file like ? and p.deleted_at is null and mi.deleted_at is null
 """
+JF_DB = "/home/dank/Containers/jellyfin/config/data/jellyfin.db"
+JF_COLS = ["file", "series", "year", "season", "episode", "extra",
+           "tmdb", "title", "tvdb"]
+# Jellyfin stores the entity's .NET class as its type; the TV tree is these three.
+JF_TV = ("MediaBrowser.Controller.Entities.TV.Episode",
+         "MediaBrowser.Controller.Entities.TV.Season",
+         "MediaBrowser.Controller.Entities.TV.Series")
+JF_SQL = ("""select Id, Path, IndexNumber, ParentIndexNumber, ExtraType,
+                   IsVirtualItem, Name from BaseItems where Type = ? and Path like ?""")
+
+# The music tree is these two entity classes. The track row carries the tags
+# Jellyfin read out of the file; the album row carries what the provider matched,
+# which is the better folder name of the two.
+JF_AUDIO = "MediaBrowser.Controller.Entities.Audio.Audio"
+JF_ALBUM = "MediaBrowser.Controller.Entities.Audio.MusicAlbum"
+MUSIC_COLS = ["file", "artist", "album", "year", "disc", "track", "title", "mb",
+              "performer"]
+MUSIC_SQL = ("""select b.Path, b.AlbumArtists, b.Artists, b.Album, b.ProductionYear,
+                       b.ParentIndexNumber, b.IndexNumber, b.Name, b.Id,
+                       a.Name, a.ProductionYear, a.Id
+                  from BaseItems b
+                  left join BaseItems a on a.Id = b.ParentId and a.Type = ?
+                 where b.Type = ? and b.Path like ?""")
+# The album's identity, in preference order. A release group is the album; a bare
+# release id is one reissue of it.
+MUSIC_PROVIDERS = ("MusicBrainzReleaseGroup", "MusicBrainzAlbum")
+
+# Plex's audiobook tree is the same Artist/Album/Track shape as its music tree:
+# the leaf (10) is a CHAPTER, its parent (9) is the BOOK, and that book's artist
+# (8) is the NARRATOR. The track's own `index` is exported because the exceptions
+# report counts how many books have chapters Plex does not number — the reason the
+# relayout refuses to invent numbers into file names.
+PLEX_ARTIST, PLEX_ALBUM, PLEX_TRACK = 8, 9, 10
+AB_COLS = ["file", "narrator", "book", "year", "track", "chapter"]
+AB_SQL = f"""
+select p.file, coalesce(ar.title,''), coalesce(al.title,''), coalesce(al.year,0),
+       coalesce(mi."index",-1), coalesce(mi.title,'')
+from media_parts p
+join media_items m on m.id = p.media_item_id
+join metadata_items mi on mi.id = m.metadata_item_id
+join metadata_items al on al.id = mi.parent_id and al.metadata_type = {PLEX_ALBUM}
+left join metadata_items ar on ar.id = al.parent_id
+                          and ar.metadata_type = {PLEX_ARTIST}
+where p.file like ? and p.deleted_at is null and mi.deleted_at is null
+  and al.deleted_at is null
+"""
+
+def open_plex_ro(db):
+    """Plex's library, read the way Plex writes it.
+
+    `immutable=1` tells sqlite the file never changes, so it skips the
+    write-ahead log: every row a scan has committed but not yet checkpointed
+    is invisible, and reading a live database that way can fail outright as
+    "database disk image is malformed". Plain ro reads the WAL through its
+    -shm; immutable is only the fallback for a database whose -shm cannot be
+    read. The same law scripts/media-verify.py states.
+    """
+    last = None
+    for opt in ("mode=ro", "mode=ro&immutable=1"):
+        try:
+            return sqlite3.connect(f"file:{db}?{opt}", uri=True)
+        except sqlite3.Error as e:
+            last = e
+    sys.exit(f"cannot open the Plex database read-only ({db}): {last}\n"
+             "Plex runs rootless here: run this as the container's owner, never "
+             "with sudo — rootless storage is per-user, so root sees nothing.")
 
 
 def enumerate_lib(root, out):
@@ -157,15 +249,9 @@ def probe(enum, out, jobs):
 
 def plex(root, db, out):
     """Plex's matched titles for files under root, from its DB, read-only."""
-    uri = f"file:{db}?mode=ro&immutable=1"
-    try:
-        con = sqlite3.connect(uri, uri=True)
-    except sqlite3.Error as e:
-        sys.exit(f"cannot open the Plex database read-only ({db}): {e}\n"
-                 "Plex runs rootless here: run this as the container's owner, never "
-                 "with sudo — rootless storage is per-user, so root sees nothing.")
+    con = open_plex_ro(db)
     with open(out, "w", newline="") as fh:
-        w = csv.writer(fh, delimiter="\t")
+        w = csv.writer(fh, delimiter="\t", lineterminator="\n")
         w.writerow(PLEX_COLS)
         n = 0
         for r in con.execute(PLEX_SQL, (root + "/%",)):
@@ -174,6 +260,210 @@ def plex(root, db, out):
     print(f"plex-matched={n} -> {out}")
 
 
+def jellyfin(root, db, container, out):
+    """The episodes Jellyfin has already numbered, for the library at root.
+
+    Jellyfin stores each path as the CONTAINER sees it (its quadlet binds the
+    share at /data), so `container` is the in-container prefix that stands for
+    root and every exported path is mapped back to the host before it is written
+    — the planner reads host paths, because it plans moves on the array.
+
+    The numbering is what matters, not the name: a release group's file name says
+    nothing about which episode a file is, and Jellyfin has already answered that
+    question against a provider. Season/episode and the episode's own title come
+    from the episode row; the series name, its year and its TMDb and Tvdb ids come
+    from the Series row the episode climbs to, because those are the only place
+    Jellyfin keeps them.
+    """
+    try:
+        con = sqlite3.connect(f"file:{db}?mode=ro", uri=True)
+    except sqlite3.Error as e:
+        sys.exit(f"cannot open the Jellyfin database read-only ({db}): {e}\n"
+                 "It is a WAL database: copy it with its -wal and -shm beside it and"
+                 " point --db at the copy. Never sudo it — the data dir belongs to"
+                 " the container's owner, and rootless storage is per-user.")
+    have = {r[1] for r in con.execute("pragma table_info(BaseItems)")}
+    need = {"Id", "ParentId", "Type", "Path", "IndexNumber", "ParentIndexNumber",
+            "ExtraType", "IsVirtualItem", "ProductionYear", "Data"}
+    if not need <= have:
+        sys.exit(f"{db} is not a Jellyfin library database (BaseItems has no"
+                 f" {','.join(sorted(need - have))})")
+    node = {}
+    for i, pid, typ, name, year, data in con.execute(
+            "select Id, ParentId, Type, Name, ProductionYear, Data from BaseItems"
+            " where Type in (?,?,?)", JF_TV):
+        node[i] = (pid, typ, name, year, data)
+
+    # Jellyfin 12 keeps provider ids in their own table; older builds kept them in
+    # the row's Data blob. Both shapes are read, because the tvdb id the series
+    # naming depends on is wherever this build happened to write it.
+    prov = {}
+    if "BaseItemProviders" in {r[0] for r in con.execute(
+            "select name from sqlite_master where type='table'")}:
+        for iid, pid, val in con.execute(
+                "select ItemId, ProviderId, ProviderValue from BaseItemProviders"
+                " where ProviderId in ('Tmdb', 'Tvdb')"):
+            prov[(iid, pid)] = val
+
+    def provider_of(item_id, want):
+        got = prov.get((item_id, want))
+        if got:
+            return str(got)
+        try:
+            blob = json.loads(node[item_id][4] or "{}").get("ProviderIds") or {}
+        except (KeyError, ValueError, TypeError):
+            return ""
+        return str(blob.get(want, "") or "")
+
+    def series_of(item_id):
+        """Climb episode -> season -> series; empty when the chain is broken."""
+        for _ in range(4):
+            if item_id not in node:
+                return "", "", "", ""
+            pid, typ = node[item_id][0], node[item_id][1]
+            if typ.endswith(".Series"):
+                return (node[item_id][2] or "", node[item_id][3] or "",
+                        provider_of(item_id, "Tmdb"), provider_of(item_id, "Tvdb"))
+            item_id = pid
+        return "", "", "", ""
+
+    # The fleet's quadlets bind the share at /data, so the container's view of
+    # this library is /data/<the library's own folder name> unless told otherwise.
+    if not container:
+        container = "/data/" + os.path.basename(os.path.normpath(root))
+    prefix = container.rstrip("/") + "/"
+    written = skipped = 0
+    with open(out, "w", newline="") as fh:
+        w = csv.writer(fh, delimiter="\t", lineterminator="\n")
+        w.writerow(JF_COLS)
+        for iid, path, idx, pidx, extra, virt, epname in con.execute(
+                JF_SQL, (JF_TV[0], prefix + "%")):
+            if virt or not path or not path.startswith(prefix):
+                skipped += 1          # a virtual item is a variant, not a file
+                continue
+            sname, syear, tmdb, tvdb = series_of(iid)
+            w.writerow([root + "/" + path[len(prefix):],
+                        sname.replace("\t", " "), syear,
+                        "" if pidx is None else pidx,
+                        "" if idx is None else idx,
+                        (extra or "").replace("\t", " "), tmdb,
+                        (epname or "").replace("\t", " "), tvdb])
+            written += 1
+    print(f"episodes={written} virtual-or-blank={skipped} -> {out}")
+
+
+def music(root, db, container, out):
+    """The tracks Jellyfin has already tagged, for the library at root.
+
+    Jellyfin reads music metadata out of the file itself, so an Audio row IS the
+    tag read, done once, by the vendor's own parser: its album-artist, album,
+    year, disc and track columns are what the embedded tags say and its Name is
+    the track title. That makes this export the whole authority for a music
+    relayout — the path a ripper chose is not evidence of anything, and the
+    folder Jellyfin put a track under is often a release pack, not an album.
+
+    Two gaps this export answers from the row rather than the tree. Many tracks
+    sit under a folder that is not an album item at all (a disc folder, or a
+    mixed one), so the album name and year fall back to the tags when the album
+    row is absent. And an album's MusicBrainz ids are not in the row's own Data
+    — the current schema leaves that empty for music — they are rows of
+    BaseItemProviders keyed by the item's Id.
+    """
+    try:
+        con = sqlite3.connect(f"file:{db}?mode=ro", uri=True)
+    except sqlite3.Error as e:
+        sys.exit(f"cannot open the Jellyfin database read-only ({db}): {e}\n"
+                 "It is a WAL database: copy it with its -wal and -shm beside it and"
+                 " point --db at the copy. Never sudo it — the data dir belongs to"
+                 " the container's owner, and rootless storage is per-user.")
+    have = {r[1] for r in con.execute("pragma table_info(BaseItems)")}
+    need = {"Id", "ParentId", "Type", "Path", "Name", "IndexNumber",
+            "ParentIndexNumber", "ProductionYear", "Album", "AlbumArtists",
+            "Artists"}
+    if not need <= have:
+        sys.exit(f"{db} is not a Jellyfin library database with music columns"
+                 f" (BaseItems has no {','.join(sorted(need - have))})")
+    # Provider ids, best identity first: the release group is the album, a bare
+    # release id is one reissue of it and never overrides a group.
+    mb = {}
+    if "BaseItemProviders" in {r[0] for r in con.execute(
+            "select name from sqlite_master where type='table'")}:
+        rank = {p: i for i, p in enumerate(MUSIC_PROVIDERS)}
+        best = {}
+        for iid, pid, val in con.execute(
+                "select ItemId, ProviderId, ProviderValue from BaseItemProviders"
+                " where ProviderId in (?, ?)", MUSIC_PROVIDERS):
+            if iid not in best or rank[pid] < best[iid][0]:
+                best[iid] = (rank[pid], val)
+        mb = {k: v[1] for k, v in best.items()}
+
+    # The fleet's quadlets bind the share at /data, so the container's view of
+    # this library is /data/<the library's own folder name> unless told otherwise.
+    if not container:
+        container = "/data/" + os.path.basename(os.path.normpath(root))
+    prefix = container.rstrip("/") + "/"
+    written = skipped = 0
+    with open(out, "w", newline="") as fh:
+        w = csv.writer(fh, delimiter="\t", lineterminator="\n")
+        w.writerow(MUSIC_COLS)
+        for (path, aal, arts, tag_album, tag_year, disc, track, name, iid,
+             alb_name, alb_year, alb_id) in con.execute(
+                MUSIC_SQL, (JF_ALBUM, JF_AUDIO, prefix + "%")):
+            if not path or not path.startswith(prefix):
+                skipped += 1          # a row for a file outside this library
+                continue
+            # The album artist owns the folder; the track artist is the fallback
+            # for the compilations whose album-artist tag was left empty.
+            w.writerow([root + "/" + path[len(prefix):],
+                        ((aal or "").strip() or (arts or "").strip()),
+                        (alb_name or tag_album or "").replace("\t", " "),
+                        alb_year or tag_year or "",
+                        "" if disc is None else disc,
+                        "" if track is None else track,
+                        (name or "").replace("\t", " "),
+                        mb.get(alb_id or "") or mb.get(iid or "") or "",
+                        (arts or "").replace("\t", " ")])
+            written += 1
+    print(f"tracks={written} outside-root-or-blank={skipped} -> {out}")
+
+
+def audiobooks(root, db, out):
+    """The chapters Plex matched inside the audiobook library, read-only.
+
+    Plex stores HOST paths here (unlike Jellyfin, which stores the container's
+    view), so no prefix mapping is needed: the part's `file` is the path the
+    operator has today. Rows for files outside `root` are skipped, because one
+    Plex library DB carries every library on the box.
+
+    The chapter's `index` is exported as an empty field when Plex has none. That
+    is not a gap to fill in here: three quarters of the books on this box contain
+    at least one un-indexed chapter, so the relayout that reads this file must
+    not renumber anything from it.
+    """
+    con = open_plex_ro(db)
+    tables = {r[0] for r in con.execute(
+        "select name from sqlite_master where type='table'")}
+    missing = {"media_parts", "media_items", "metadata_items"} - tables
+    if missing:
+        sys.exit(f"{db} is not a Plex library database (no "
+                 f"{', '.join(sorted(missing))})")
+    written = skipped = 0
+    with open(out, "w", newline="") as fh:
+        w = csv.writer(fh, delimiter="\t", lineterminator="\n")
+        w.writerow(AB_COLS)
+        for file, narrator, book, year, track, chapter in con.execute(
+                AB_SQL, (root.rstrip("/") + "/%",)):
+            if not file or not file.startswith(root.rstrip("/") + "/"):
+                skipped += 1              # a row for a file outside this library
+                continue
+            w.writerow([file.replace("\t", " "), narrator.replace("\t", " "),
+                        book.replace("\t", " "), "" if not year else year,
+                        "" if track is None or int(track) < 0 else track,
+                        chapter.replace("\t", " ")])
+            written += 1
+    print(f"chapters={written} outside-root={skipped} -> {out}")
+
+
 def main():
     ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
     sub = ap.add_subparsers(dest="cmd", required=True)
@@ -190,13 +480,46 @@ def main():
     x.add_argument("--root", **root)
     x.add_argument("--db", default=PLEX_DB)
     x.add_argument("--out", default="/tmp/plex-movies.tsv")
+    j = sub.add_parser("jellyfin",
+                       help="export the episodes Jellyfin has numbered for the root")
+    j.add_argument("--root", default=os.environ.get("MEDIA_ROOT",
+                                                    "/mnt/entropy/TVShows"),
+                   help="TV library root on the host")
+    j.add_argument("--db", default=JF_DB)
+    j.add_argument("--container", default=None,
+                   help="the in-container prefix that stands for --root"
+                        " (default /data/<root's folder name>)")
+    j.add_argument("--out", default="/tmp/jellyfin-tv.tsv")
+    m = sub.add_parser("music",
+                       help="export the tracks Jellyfin has tagged for the root")
+    m.add_argument("--root", default=os.environ.get("MEDIA_MUSIC_ROOT",
+                                                    "/mnt/entropy/Music"),
+                   help="music library root on the host")
+    m.add_argument("--db", default=JF_DB)
+    m.add_argument("--container", default=None,
+                   help="the in-container prefix that stands for --root"
+                        " (default /data/<root's folder name>)")
+    m.add_argument("--out", default="/tmp/jellyfin-music.tsv")
+    b = sub.add_parser("audiobooks",
+                       help="export the chapters Plex matched for the audiobook root")
+    b.add_argument("--root", default=os.environ.get("MEDIA_AUDIOBOOKS_ROOT",
+                                                    "/mnt/entropy/Audiobooks"),
+                   help="audiobook library root on the host")
+    b.add_argument("--db", default=PLEX_DB)
+    b.add_argument("--out", default="/tmp/plex-audiobooks.tsv")
     a = ap.parse_args()
     if a.cmd == "enumerate":
         enumerate_lib(a.root, a.out)
     elif a.cmd == "probe":
         probe(a.enum, a.out, a.jobs)
-    else:
+    elif a.cmd == "plex":
         plex(a.root, a.db, a.out)
+    elif a.cmd == "music":
+        music(a.root, a.db, a.container, a.out)
+    elif a.cmd == "audiobooks":
+        audiobooks(a.root, a.db, a.out)
+    else:
+        jellyfin(a.root, a.db, a.container, a.out)
 
 
 if __name__ == "__main__":

scripts/media-music.py

@@ -0,0 +1,445 @@
+#!/usr/bin/env python3
+r"""media-music.py — a plan that re-files the music library into Jellyfin's own shape.
+
+    media-music.py --root DIR --enum TSV --rows TSV [--out TSV] [--exceptions FILE]
+
+Jellyfin's music contract (https://jellyfin.org/docs/general/server/media/music/)
+is not the movie one. Jellyfin reads the metadata out of the file, so a folder is
+an ALBUM and nothing else, every disc of an album belongs in that one folder, the
+tags decide the track order, and a file name only matters when it carries a
+character known to break playback (`< > : " / \ | ? *`) or when a lyric file has
+to match the basename of the track it belongs to. The plan is therefore:
+
+    Music/<album artist>/<Album> (<year>)/NN - <Title>.<ext>
+                       ... the same folder, D.NN - <Title>  when the album has discs
+                       Music/Various Artists/...            when its tracks name
+                                                            more than one artist
+
+The authority is the tag row Jellyfin already read — `scripts/media-census.py
+music` — never the release-pack folder a ripper made. A file with no row is not
+guessed at: it parks under `<root>/_unsorted` with the relative path it has today.
+
+The rules below exist because of what a downloaded discography pack actually
+contains:
+
+ * A cuesheet beside exactly one audio file means the album is one image with a
+   track list inside it. That file keeps its own name: numbering it `01` would
+   claim it is one track, and Jellyfin shows one track either way.
+ * Sidecars — images, cuesheets, EAC logs, checksums, booklets, playlists —
+   follow the album the audio in their own folder belongs to. A folder holding
+   two albums gives a sidecar no single owner, so it parks instead of being
+   guessed into one.
+ * A video container (.mkv, .vob, .ifo, …) inside a music library is not music.
+   Renaming it to .mka/.m4a would tell Jellyfin to index video as audio, so it
+   parks for a human decision.
+ * Playlists move with their album and their CONTENTS are never rewritten: the
+   paths inside an .m3u go stale. Editing a file the operator owns to keep a
+   convenience file tidy is not this tool's job.
+
+Nothing is deleted and nothing is overwritten. The output is a list of rename(2)
+intents for `scripts/media-apply.py`, whose preflight refuses any target that is
+already claimed and whose journal is the rollback.
+"""
+import argparse
+import csv
+import os
+import re
+import sys
+from collections import Counter, defaultdict
+
+# What Jellyfin will index as music. .mp4/.mkv/.webm are deliberately NOT here:
+# the vendor doc says an audio-only stream in those containers is never read as
+# music, and this tool renames for a reason it can prove, not to guess at one.
+AUDIO_EXT = {".flac", ".mp3", ".m4a", ".m4b", ".ogg", ".oga", ".opus", ".wav",
+             ".wma", ".aiff", ".aif", ".ape", ".dsf", ".dff", ".wv", ".mka",
+             ".mpc", ".aac"}
+VIDEO_EXT = {".mkv", ".vob", ".ifo", ".bup", ".mpg", ".mpeg", ".avi", ".mov",
+             ".ts", ".m2ts", ".wmv", ".webm", ".mp4", ".m4v", ".iso", ".img",
+             ".bdmv", ".divx", ".ogm"}
+# A lyric has to carry the basename of its track, so it is named after the audio
+# file and not after itself. .txt counts only when its stem matches an audio stem:
+# a loose .txt in an album folder is a note.
+LYRIC_EXT = {".lrc", ".elrc", ".txt"}
+IMAGE_EXT = {".jpg", ".jpeg", ".png", ".webp", ".gif", ".bmp", ".tiff"}
+# The album-artist strings that mean "compilation", so such an album is not filed
+# under one artist who does not own it.
+VARIOUS = {"various", "various artists", "unknown", "unknown artist", "unknow"}
+# The characters Jellyfin documents as breaking playback. They are dropped, not
+# substituted: a replacement character is a guess at what the title meant.
+BAD_CHARS = set('<>:"/\\|?*')
+TRASH_DIR = re.compile(r"(^|/)(\.AGENTTRASH|\.thumbnails|\.Trash-\d+|@eaDir"
+                       r"|lost\+found)(/|$)")
+
+ARGS = None
+HELD = {}                            # path -> (bytes, ext)
+ROWS = {}                            # path -> the tag row
+PLACED = {}                          # audio path -> the destination the plan gave it
+CLAIMED = set()                      # every destination path the plan has handed out
+MOVES, KEEPS = [], []
+PARKED = defaultdict(list)           # reason -> [path]
+NOTES = defaultdict(list)            # section -> [line]
+CUE_DIRS = set()                     # source dirs holding a .cue
+AUDIO_BY_DIR = defaultdict(set)      # source dir -> audio files a row names
+CHILD_OF = defaultdict(set)          # dir -> the dirs directly below it holding audio
+FOLDERS_SEEN = {}                    # (dir, depth) -> album folders placed below it
+SUBTREE_DEPTH = 2                    # how far below a folder its audio may sit
+ALBUMS = {}                          # (artist, album, year) -> the album group
+
+AMBIGUOUS = object()
+
+
+def dominant(values):
+    """The spelling the tags mostly agree on: the most frequent value, ties broken
+    by sort so the answer never depends on the order rows arrived in."""
+    counts = Counter(values)
+    return min(counts.items(), key=lambda kv: (-kv[1], kv[0]))[0]
+
+
+def rel(path):
+    """The path as seen from the library root."""
+    return os.path.relpath(path, ARGS.root)
+
+
+def safe(name):
+    """A name every client can carry: no reserved character, nothing
+    unprintable, no trailing dot or space, and short enough to rename."""
+    out = "".join(c for c in (name or "")
+                  if c not in BAD_CHARS and (c.isprintable() or c == " "))
+    out = re.sub(r"\s+", " ", out).strip().rstrip(". ")
+    while out and len(out.encode("utf-8", "ignore")) > 200:
+        out = out[:-4].rstrip()
+    return out
+
+
+def assign(src, folder, name, ext, kind, note):
+    """Book one file into `folder` under `name`, renamed if that exact destination
+    is already taken — by another file in the plan, or by a file standing there
+    today. Two files claiming one path is the fault that costs a re-run of a 90k
+    plan, and so is a plan that only works if the renames happen in the right
+    order: the executor refuses any target that is occupied, so an occupied path
+    is never a destination, even when its occupant is scheduled to leave.
+    A file already standing where the contract puts it is a keep, not a move."""
+    stem = safe(name) or "file"
+    dst = os.path.join(folder, stem + ext)
+    if dst == src:
+        CLAIMED.add(dst.lower())          # it is standing on its own target
+        KEEPS.append((src, dst, kind))
+        return dst
+    # A file already in this folder under this name — or under the numbered
+    # variant the collision rule gives it — keeps the name it has. Renumbering it
+    # every run would turn the plan into a shuffle instead of a fixed point.
+    base = os.path.splitext(os.path.basename(src))[0]
+    if os.path.dirname(src) == folder and (base == stem
+                                           or base.startswith(stem + " (")):
+        CLAIMED.add(src.lower())
+        KEEPS.append((src, src, kind))
+        return src
+    n = 1
+    while dst.lower() in CLAIMED:
+        n += 1
+        dst = os.path.join(folder, f"{stem} ({n}){ext}")
+    if n > 1:
+        NOTES[note].append(rel(dst))
+    CLAIMED.add(dst.lower())
+    MOVES.append((src, dst, kind))
+    return dst
+
+
+def park(path, reason):
+    """Hold a file where it is, under the park folder, keeping its relative path."""
+    PARKED[reason].append(path)
+    dst = os.path.join(ARGS.park_dir, rel(path))
+    if dst != path:
+        CLAIMED.add(dst.lower())
+        MOVES.append((path, dst, "park"))
+
+
+def under_park(path):
+    """True for a file already parked: that pile is for a human to review, and
+    re-parking it every run would only push it deeper."""
+    return path.startswith(ARGS.park_dir + os.sep)
+
+
+# ---------------------------------------------------------------------- albums
+def group_albums():
+    """Every tagged track into one group per (album-artist tag, album, year).
+
+    The key is the identity the tags assert, not the folder the file sits in: one
+    album arrives as three discs in three folders, and two copies of an album in
+    one pack are one album to Jellyfin, whose album item is that name, artist and
+    year. The artist in the key is the ALBUM-artist tag and never the performer,
+    because a compilation is one album whose tracks name many performers — keying
+    on the performer would file one album once per artist.
+    """
+    for path, r in sorted(ROWS.items()):
+        if path not in HELD or under_park(path):
+            continue
+        d = os.path.dirname(path)
+        AUDIO_BY_DIR[d].add(path)
+        CHILD_OF[os.path.dirname(d)].add(d)   # so a cover above CD1/CD2 sees both
+        tag = (r["artist"] or "").strip()
+        album = (r["album"] or "").strip()
+        performer = (r["performer"] or "").strip()
+        if not album:
+            park(path, "a track no album names")
+            continue
+        if not tag and not performer:
+            park(path, "a track no artist names")
+            continue
+        key = (tag.casefold(), album.casefold(), (r["year"] or "").strip())
+        g = ALBUMS.setdefault(key, {"tags": [], "albums": [], "year": key[2],
+                                    "members": [], "performers": set(),
+                                    "mb": set()})
+        g["members"].append(path)
+        g["tags"].append(tag)
+        g["albums"].append(album)
+        g["performers"].add(performer or tag)
+        if r.get("mb"):
+            g["mb"].add(r["mb"])
+
+
+def folder_artist(g):
+    """Whose shelf the album sits on. The album-artist tag owns it when it names
+    one; when the tags name only performers, a single performer names the album
+    and several make it a compilation, which belongs to no one of them. The key is
+    case-folded, so the spelling that reaches the folder is the one the tracks
+    mostly carry — see dominant()."""
+    tags = [t for t in g["tags"] if t]
+    if tags:
+        name = dominant(tags)
+        return "Various Artists" if name.casefold() in VARIOUS else name
+    if len({p.casefold() for p in g["performers"]}) == 1:
+        return dominant(g["performers"])
+    return "Various Artists"
+
+
+def album_folder(g):
+    name = safe(dominant(g["albums"])) or "Untitled"
+    return os.path.join(ARGS.root, safe(folder_artist(g)) or "Unknown Artist",
+                        f"{name} ({g['year']})" if g["year"] else name)
+
+
+def is_cue_image(path):
+    """A folder holding this one audio file and a cuesheet is an album image."""
+    d = os.path.dirname(path)
+    return len(AUDIO_BY_DIR.get(d, ())) == 1 and d in CUE_DIRS
+
+
+def number_of(value, width):
+    return f"{int(value):0{width}d}" if str(value or "").isdigit() else ""
+
+
+def place_albums():
+    for key in sorted(ALBUMS):
+        g = ALBUMS[key]
+        folder = album_folder(g)
+        discs = {g0["disc"] for g0 in (ROWS[p] for p in g["members"]) if g0["disc"]}
+        tracks = [int(ROWS[p]["track"]) for p in g["members"]
+                  if str(ROWS[p]["track"] or "").isdigit()]
+        # More than one disc, or a disc numbered past the first: the track number
+        # alone cannot name a file uniquely, so the disc goes in front of it.
+        multi = len(discs) > 1 or any(str(d).isdigit() and int(d) > 1 for d in discs)
+        width = 3 if multi or (max(tracks, default=0) > 99) else 2
+        for path in sorted(g["members"]):
+            r = ROWS[path]
+            ext = HELD[path][1]
+            base = os.path.splitext(os.path.basename(path))[0]
+            if is_cue_image(path):
+                name = safe(base) or "image"
+            else:
+                title = safe(r["title"] or base) or "untitled"
+                num = number_of(r["track"], 2 if multi else width)
+                if multi and num:
+                    num = f"{r['disc'] or '1'}.{num}"
+                name = f"{num} - {title}" if num else title
+            PLACED[path] = assign(path, folder, name, ext, "track",
+                                  "two tracks claimed one name inside one album")
+
+
+# --------------------------------------------------------------------- sidecars
+def folders_below(d, depth):
+    """The album folders the audio in `d`, or within `depth` directories below it,
+    was placed in. Memoised, because every loose file in a big discography folder
+    asks the same question about it."""
+    if (d, depth) not in FOLDERS_SEEN:
+        seen = {os.path.dirname(PLACED[a]) for a in AUDIO_BY_DIR.get(d, ())
+                if a in PLACED}
+        if depth:
+            for child in CHILD_OF.get(d, ()):
+                seen |= folders_below(child, depth - 1)
+        FOLDERS_SEEN[(d, depth)] = seen
+    return FOLDERS_SEEN[(d, depth)]
+
+
+def owner_folder(d):
+    """The album folder that owns this directory — the first place up the tree
+    where audio sits, in the directory itself or within SUBTREE_DEPTH levels below
+    it, which is how a box with its discs in CD1/CD2 owns the cover lying above
+    them. None when no audio is near enough to say, AMBIGUOUS when the audio there
+    belongs to more than one album."""
+    while d.startswith(ARGS.root + os.sep) and d != ARGS.root:
+        folders = folders_below(d, SUBTREE_DEPTH)
+        if folders:
+            return next(iter(folders)) if len(folders) == 1 else AMBIGUOUS
+        d = os.path.dirname(d)
+    return None
+
+
+def place_sidecars():
+    """Everything that is not a tagged track: lyrics, images, cuesheets, logs,
+    booklets, playlists — and the clutter that is none of those."""
+    # The lyric rule needs the audio's stem as it is named TODAY, before the plan
+    # renames it, because that is what the sidecar's own name was copied from.
+    stem = {(d, os.path.splitext(os.path.basename(a))[0]): a
+            for d, audios in AUDIO_BY_DIR.items() for a in audios}
+    for path, (_size, ext) in sorted(HELD.items()):
+        if path in ROWS or under_park(path) or TRASH_DIR.search(path):
+            continue
+        d, base = os.path.dirname(path), os.path.splitext(os.path.basename(path))[0]
+        if ext in VIDEO_EXT:
+            park(path, "a video container inside the music library: Jellyfin will "
+                       "not read it as music, and renaming it would claim it is")
+        elif ext in AUDIO_EXT:
+            park(path, "an audio file no provider row names — its tags are not in "
+                       "the library Jellyfin has matched")
+        elif ext in (LYRIC_EXT | IMAGE_EXT) and (d, base) in stem:
+            # A lyric, or a picture named after its track: it follows that track
+            # and takes the name the track now has, or Jellyfin cannot find it.
+            audio = stem[(d, base)]
+            dst = PLACED.get(audio)
+            if dst:
+                folder, name = os.path.dirname(dst), os.path.splitext(
+                    os.path.basename(dst))[0]
+                assign(path, folder, name, ext, "lyric",
+                       "a sidecar whose name collided with another in its album")
+            else:
+                park(path, "a sidecar of a track the plan could not place")
+        else:
+            owner = owner_folder(d)
+            if owner is AMBIGUOUS:
+                park(path, "a sidecar whose folder holds more than one album, so "
+                           "nothing says which one it belongs to")
+            elif owner:
+                assign(path, owner, base, ext,
+                       "playlist" if ext in (".m3u", ".m3u8") else "sidecar",
+                       "one album folder would have carried two files of the same "
+                       "sidecar name")
+            else:
+                park(path, "not music, or music with nothing beside it to belong to")
+
+
+# ---------------------------------------------------------------------- outputs
+def write_plan():
+    """mkdir rows for every destination folder and its whole chain, then the moves.
+    Parents first: the executor creates directories in the order they are listed."""
+    chain = set()
+    for _s, dst, _k in MOVES:
+        d = os.path.dirname(dst)
+        while d and d != ARGS.root and d != os.path.dirname(d):
+            chain.add(d)
+            d = os.path.dirname(d)
+    dirs = sorted(chain, key=lambda p: (p.count("/"), p))
+    with open(ARGS.out, "w") as fh:
+        fh.write("action\tsrc\tdst\tkind\n")
+        for d in dirs:
+            fh.write(f"mkdir\t\t{d}\tdir\n")
+        for src, dst, kind in sorted(MOVES, key=lambda m: (m[1], m[0])):
+            fh.write(f"move\t{src}\t{dst}\t{kind}\n")
+        for src, dst, kind in sorted(KEEPS, key=lambda m: (m[1], m[0])):
+            fh.write(f"keep\t{src}\t{dst}\t{kind}\n")
+    parked = [m for m in MOVES if m[2] == "park"]
+    sized = sum(HELD[s][0] for s, _d, _k in MOVES if s in HELD)
+    print(f"plan: {len(MOVES) - len(parked)} moves, {len(parked)} parked"
+          f" ({sized / 2**40:.2f} TiB touched), {len(KEEPS)} already placed,"
+          f" {len(dirs)} folders -> {ARGS.out}")
+
+
+def write_exceptions():
+    with open(ARGS.exceptions, "w") as fh:
+        fh.write(f"Music relayout exceptions for {ARGS.root}\n\n")
+        fh.write(f"Everything below is parked under {ARGS.park_dir}, keeping the\n"
+                 "relative path it has today. Nothing is deleted and nothing is\n"
+                 "overwritten: a parked file is one rename from wherever the plan is\n"
+                 "pointed next.\n\n")
+        for reason in sorted(PARKED, key=lambda r: -len(PARKED[r])):
+            rs = PARKED[reason]
+            fh.write(f"{len(rs):>6} files  {reason}\n")
+            for p in sorted(rs, key=rel)[:400]:
+                fh.write(f"          {rel(p)}\n")
+            if len(rs) > 400:
+                fh.write(f"          … and {len(rs) - 400} more\n")
+            fh.write("\n")
+        for section in sorted(NOTES, key=lambda s: -len(NOTES[s])):
+            lines = sorted(set(NOTES[section]))
+            fh.write(f"{len(lines):>6}  {section}\n")
+            for line in lines[:200]:
+                fh.write(f"          {line}\n")
+            if len(lines) > 200:
+                fh.write(f"          … and {len(lines) - 200} more\n")
+            fh.write("\n")
+        no_year = sorted(f"{folder_artist(g)}/{dominant(g['albums'])}"
+                         for g in ALBUMS.values() if not g["year"])
+        if no_year:
+            fh.write(f"{len(no_year):>6} albums carry no year in any tag, so their folders\n"
+                     "       are named without one; Jellyfin still matches them.\n")
+            fh.write("       " + ", ".join(no_year[:300]) + "\n\n")
+        clash = sorted(f"{folder_artist(g)}/{dominant(g['albums'])}"
+                       for g in ALBUMS.values() if len(g["mb"]) > 1)
+        if clash:
+            fh.write(f"{len(clash):>6} albums put one folder name on more than one\n"
+                     "       MusicBrainz release group — different releases, one name.\n"
+                     "       They share the folder Jellyfin's own album item names.\n")
+            fh.write("       " + ", ".join(clash[:200]) + "\n\n")
+        fh.write("       Playlists move with their album and their contents are never\n"
+                 "       rewritten: the paths inside an .m3u go stale.\n")
+    print(f"exceptions -> {ARGS.exceptions}")
+
+
+def main():
+    global ARGS
+    ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    ap.add_argument("--root", default=os.environ.get("MEDIA_MUSIC_ROOT",
+                                                     "/mnt/entropy/Music"))
+    ap.add_argument("--enum", default="/tmp/music-enum.tsv",
+                    help="the enumerate TSV (bytes, ext, path)")
+    ap.add_argument("--rows", default="/tmp/jellyfin-music.tsv",
+                    help="the tag rows scripts/media-census.py music wrote")
+    ap.add_argument("--out", default="/tmp/music-plan.tsv")
+    ap.add_argument("--exceptions", default="/tmp/music-exceptions.txt")
+    ap.add_argument("--park", default="_unsorted",
+                    help="the folder inside the root that holds what cannot be filed")
+    ARGS = ap.parse_args()
+    ARGS.root = os.path.normpath(ARGS.root)
+    ARGS.park_dir = os.path.join(ARGS.root, ARGS.park)
+    read_inputs()
+    # Every path a file occupies today is claimed before a single destination is
+    # handed out: the executor refuses an occupied target, so a plan that aimed at
+    # one would only fail after the renames that were supposed to clear it.
+    CLAIMED.update(p.lower() for p in HELD)
+    for path, (_size, ext) in HELD.items():
+        if ext == ".cue":
+            CUE_DIRS.add(os.path.dirname(path))
+    group_albums()
+    place_albums()
+    place_sidecars()
+    write_plan()
+    write_exceptions()
+
+
+def read_inputs():
+    with open(ARGS.enum) as fh:
+        for line in fh:
+            parts = line.rstrip("\n").split("\t")
+            if len(parts) >= 3:
+                HELD[parts[2]] = (int(parts[0]), parts[1].lower())
+    with open(ARGS.rows, newline="") as fh:
+        for row in csv.DictReader(fh, delimiter="\t"):
+            if row.get("file"):
+                ROWS[row["file"]] = row
+    gone = [p for p in ROWS if p not in HELD]
+    if gone:
+        NOTES["a tag row whose file the census no longer sees"].extend(gone)
+
+
+if __name__ == "__main__":
+    main()

scripts/media-shows-tvdb-ids.tsv

@@ -0,0 +1,35 @@
+# The operator's tvdb id map: `folder <TAB> tvdb id <TAB> note`.
+#
+# These are the pack folders whose show tvdb's NAME SEARCH cannot reach: the
+# record exists, but tvdb titles it in the show's own language and the English
+# name rides in aliases the search never reads. Without a row here the folder
+# keeps the release folder's words and no episode title; with one, both matchers
+# read `[tvdbid-NNNN]` and the files rename to tvdb's own name and titles.
+#
+# Every id was read from tvdb's own record (`/series/<id>/extended`) on
+# 2026-10-31, and the note states what that record says plus the neighbouring
+# record a name search would have picked instead — the row is checkable without
+# re-searching, because one wrong id renames a whole pack to the wrong show. The
+# plan refuses a line whose id is not a number and lists every folder the map
+# touched in the exceptions file.
+#
+# Folders the name search DOES reach (the EXACT and PUNCT classes of the proposal
+# table) stay off this file on purpose: a map row would hide a live lookup behind
+# a number nobody re-checks.
+[Anime Time] Pokemon Complete Series (Season 01-25+Movies+Specials+Shorts+OST) [DVD+BD][1080p][HEVC 10bit x265][AAC]	76703	tvdb: ポケットモンスター (1997), the umbrella record for every era this pack spans; 1268 files
+[Anime Time] One Piece (0001-1071+Movies+Specials) [BD+CR] [Dual Audio] [1080p][HEVC 10bit x265][AAC][Multi Sub]	81797	tvdb: ワンピース (1999), alias ONE PIECE; the bare alias "One Piece" belongs to 392276, the 2023 live action; 1072 files
+[Judas] Naruto (Complete Series) [BD 1080p][HEVC x265 10bit][Multi-Audio][Multi-Subs]	78857	tvdb: NARUTO－ナルト－ (2002), alias "Naruto" carries the full-width dashes; 220 files
+Star Trek Deep Space 9 Deluxe DVD Boxset + Extras DVDRip TSV	72073	tvdb: Star Trek: Deep Space Nine (1993), alias "Star Trek Deep Space 9"; the box set's own words match nothing; 279 files
+Top Gear UK 1-17	74608	tvdb: Top Gear (2002), no "UK" alias — the US version is 199051; 131 files
+Black Clover 001	331753	tvdb: ブラッククローバー (2017), which holds NO alias at all; 378762 is Mugyutto! Black Clover (2019), a different show; 108 files
+Shin Chan - Complete Eng Dub Series 2160p Ai Upscaled -Mesc	437356	tvdb: Shin Chan (2006) — the English dub record this pack is; 79654 is the 1992 Japanese original; 78 files
+Fairy Tail (2009-2014) (Seasons 1-8 + OVAs) (BD 1080p)(HEVC x265 10bit)(Dual-Audio)(Eng-Subs)-Judas[TGx]	114801	tvdb: フェアリーテイル (2009), alias FAIRY TAIL; 410031 is FAIRY TAIL 100 NEN QUEST (2024), the sequel; 59 files
+(CBB) Tokyo Ghoul - The Complete Series (BD 1080p)(Dual-Audio)(HEVC-10bit-x265)	281249	tvdb: 東京喰種トーキョーグール (2014) — :re and √A are seasons of THIS record, confirmed by search; 58 files
+[Anime Time] Demon Slayer - Kimetsu no Yaiba (S01+S02+S03+S04+Mugen Train Arc+Movie) [BD] [Dual Audio][1080p][HEVC 10bit x265][AAC][Eng Sub]	348545	tvdb: 鬼滅の刃 (2019), alias "Demon Slayer: Kimetsu no Yaiba" — the folder's hyphen splits it differently; 56 files
+(CBB) Tengen Toppa Gurren Lagann - The Complete Series (BD 1080p)(Dual-Audio)(HEVC-x265-10bit)	80096	tvdb: 天元突破グレンラガン (2007), alias Tengen Toppa Gurren Lagann; 51 files
+Fullmetal Alchemist - Brotherhood	85249	tvdb: 鋼の錬金術師 FULLMETAL ALCHEMIST (2009), alias "Full Metal Alchemist Brotherhood" — spaced, unlike this folder; 64 files
+[NewbSubs] Attack on Titan~Shingeki no Kyojin Series (1080p Blu-ray x265 Dual Audio)	267440	tvdb: 進撃の巨人 (2013), aliases carry "Attack on Titan" and "Shingeki no Kyojin", joined here by a tilde; 27 files
+Kimetsu no Yaiba	348545	the same record as the Anime Time pack above: two release folders, ONE show; 12 files
+Rick and Morty The Anime	420279	tvdb: リック・アンド・モーティ：ジ・アニメ (2024), no English alias on the record; 10 files
+[Anime Time] Dorohedoro (Season 1+OVA+Extra) [Dual Audio][BD][1080p][HEVC 10bit x265][AAC][Eng Sub]	370761	tvdb: ドロヘドロ (2020), alias Dorohedoro; 9 files
+Ken Il Guerriero HOKUTO NO KEN	79156	tvdb: 北斗の拳 (1984), alias "Hokuto no Ken"; the Italian title matches nothing and 465216 is the 2026 remake; 5 files

scripts/media-shows-tvdb.py

@@ -0,0 +1,306 @@
+#!/usr/bin/env python3
+r"""Ask tvdb what it calls the shows a plan renamed WITHOUT a tvdb id.
+
+ media-shows-tvdb.py [--plan TSV] [--root DIR] [--park DIR] [--map TSV]
+                     [--out TSV] [--credentials FILE]
+
+`media-shows.py` renames a series to tvdb's own words only when an id backs the
+name; everything else keeps the metadata provider's words and no episode title,
+and the plan's mkdir rows are where those folders show up. This script turns that
+list into a decision sheet: one row per destination series folder that carries no
+`[tvdbid-NNNN]`, with what tvdb's search answers for it and a verdict that says
+HOW MUCH was guessed to get there.
+
+It changes nothing. The sheet is for the operator; the file that changes
+behaviour is `scripts/media-shows-tvdb-ids.tsv`, whose rows he approves. That is
+the loop: plan -> this sheet -> approved map rows -> re-plan.
+
+Verdicts, weakest last:
+
+  EXACT   tvdb's own name equals the folder's words as they stand.
+  PUNCT   it equals them only after release junk is stripped (pack numbers,
+          codecs, group names, `Complete Series`); the difference is spelling,
+          not identity.
+  NEAR    tvdb answered something whose name is NOT the query. The best hit is
+          printed so a human can judge it, and it is never applied by anything.
+  NONE    nothing left to ask with, or no answer at all.
+
+Acceptance is deliberately unforgiving — a hit counts only when tvdb's name
+equals the query with every non-alphanumeric dropped from both sides, and the
+series' year still has to fall inside any year span the folder names. The
+cleaner is the only thing that got smarter over the passes this tool replaces;
+the acceptance test never moved, because a wrong id renames a whole pack to the
+wrong show. A query that needs the cleaner is reported as PUNCT for exactly that
+reason: the machine stripped words, so a human reads the row.
+
+Read-only against tvdb. The credential file is the planner's own
+(`api_key=`, optional `pin=`), read here and never printed.
+"""
+import argparse
+import collections
+import importlib.util
+import json
+import os
+import re
+import sys
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+
+ARGS = argparse.ArgumentParser(description=__doc__.splitlines()[0],
+                               formatter_class=argparse.RawDescriptionHelpFormatter)
+ARGS.add_argument("--plan", default="/tmp/tv-plan.tsv",
+                  help="the plan media-shows.py just wrote (its mkdir rows are "
+                       "the folders this sheet asks about)")
+ARGS.add_argument("--root", default=os.environ.get("TV_ROOT", "/mnt/entropy/TVShows"),
+                  help="the TV library the plan renames")
+ARGS.add_argument("--park", default="",
+                  help="the review pile inside it (its folders are not shows)")
+ARGS.add_argument("--map",
+                  default=os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                                       "media-shows-tvdb-ids.tsv"),
+                  help="the operator's approved map; its folders are reported as "
+                       "MAPPED and never asked again")
+ARGS.add_argument("--credentials",
+                  default=os.path.expanduser("~/.config/secrets/tvdb"),
+                  help="file with an api_key= line (and a pin= for a user-issued "
+                       "key); mode 600, and never printed")
+ARGS.add_argument("--out", default="/tmp/tvdb-proposal.tsv",
+                  help="the decision sheet")
+ARGS = ARGS.parse_args()
+
+ROOT = os.path.abspath(ARGS.root)
+PARK = os.path.abspath(ARGS.park or os.path.join(ROOT, "_unsorted"))
+
+_spec = importlib.util.spec_from_file_location(
+    "eng", os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                        "media-titles.py"))
+eng = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(eng)
+
+# Release metadata, not the show: everything a scene folder name says about the
+# ENCODING, the packaging or the languages, which tvdb has never heard of.
+JUNK = re.compile(
+    r"complete|series|dual|multi|audio|sub|subs|multisub|dualaudio|"
+    r"\d{3,4}p|1080p|720p|2160p|480p|4k|hd|hdtv|cam|hdcam|telesync|x264|x265|hevc|avc|"
+    r"\d+bit|bit|bluray|blu-?ray|bdrip|web-?rip|web-?dl|webrip|hdtvrip|"
+    r"dvdrip|dvdr|dvdscr|tsr|tsv|mkv|avi|mp4|aac|ac3|dts|eac3|flac|ddp?5[.1]1|"
+    r"bd|dvd|rip|boxset|box|season|seasons|episodes?|specials?|shorts|ost|"
+    r"ova|ovas|oad|repack|proper|internal|mi?xed|budgetbits|deluxe|remux|"
+    r"remastered|uncut|collector|edition|extras?|volume|volumes|part|"
+    r"disc|disk|cd|ntsc|pal|region|fixed|patched|proof|english|esp|"
+    r"espagnol|french|vostfr|subtitul\w*|spanish|german|italian|ita|eng|fre|spa|lat|"
+    r"upscaled?|ai|dd|movie|movies",
+    re.I)
+GROUP = re.compile(r"KONTRAST|TGx|Judas|Silence|FreetheFilms|NTb|DEADPOOL|Xploit|"
+                   r"SM737|TSA|3OISL3R|PLAYWEB|EPiC|FLUX|HONEY|Zaxton|Cca3rW|"
+                   r"monikeres|frank|hdh|psi|rtfpemaker|cbm|web|asser|astro|"
+                   r"yfn|uindex|www|org|com|net|mesc|ataraxiaprime|seph\d*|"
+                   r"[a-z]+subs?|edge", re.I)
+BRACKET = re.compile(r"[\[({]([^\])}]*)[\])}]")
+NUM_RANGE = re.compile(r"(?<!\w)\d{1,4}\s*(?:-|–|to|through)\s*\d{1,4}(?!\w)", re.I)
+INSIDE = re.compile(r"all|complete|full|dual|multi|audio|sub|subs|ova|ovas|"
+                    r"movies?|episodes?|extras?|bonus|pack|remux|region\s*\d*|"
+                    r"bd|dvd|cd|ntsc|pal|hr-?dvd", re.I)
+
+
+def drop_bracket(m):
+    """A bracket says nothing when its words are junk; keep it when they aren't."""
+    toks = [t for t in re.split(r"[\s_.,+~&]+", m.group(1)) if t]
+    if not toks or all(INSIDE.fullmatch(t) or JUNK.fullmatch(t)
+                       or GROUP.fullmatch(t)
+                       or re.fullmatch(r"\d+[a-z]?", t, re.I)
+                       or re.fullmatch(r"(19|20)\d\d", t) for t in toks):
+        return " "
+    return " " + m.group(1) + " "
+
+
+def clean(name):
+    """The folder's words with everything about the RELEASE taken out, so what is
+    left is what a person would type into tvdb. `Star Trek Deep Space 9 Deluxe
+    DVD Boxset + Extras DVDRip TSV` becomes `Star Trek Deep Space 9`; `SNL 16-20`
+    becomes `SNL`."""
+    name = re.sub(r"^\s*www\b.*?\b(org|com|net)\b\s*[-–]\s*", " ", name, flags=re.I)
+    name = re.sub(r"\bS\d{1,2}([ .Ee]\d+)?[-–Ee\d.]*", " ", name)
+    name = re.sub(r"\b\d{1,2}[xX]\d{1,3}\b", " ", name)
+    name = NUM_RANGE.sub(" ", name)
+    name = re.sub(r"(19|20)\d\d(?:\s*[-/–]\s*(?:19|20)\d\d)?", " ", name)
+    name = re.sub(r"\bby\s+[A-Za-z0-9_.-]+$", " ", name)
+    name = BRACKET.sub(drop_bracket, name)
+    name = re.sub(r"[\[()\]:,;!?*]", " ", name)
+    toks = re.split(r"[\s_.\-+~&]+", name)
+    out = []
+    for i, t in enumerate(toks):
+        if not t or JUNK.fullmatch(t) or GROUP.fullmatch(t):
+            continue
+        if re.fullmatch(r"\d+", t):
+            after = sum(1 for x in toks[i + 1:] if x
+                        and not JUNK.fullmatch(x) and not GROUP.fullmatch(x)
+                        and not re.fullmatch(r"\d+", x))
+            # A pack index (`001`) and a lead-in number over a real title
+            # (`01 Charles Barkley`) are noise; `30 Rock`, `24`, `Deep Space 9`
+            # are the title itself.
+            if len(t) >= 3 or (not out and after >= 2):
+                continue
+        out.append(t)
+    while out and out[-1].lower() in ("and", "with", "the", "a", "an", "to", "of"):
+        out.pop()
+    return " ".join(out).strip()
+
+
+def years(name):
+    return [int(y) for y in re.findall(r"\b(19\d\d|20\d\d)\b", name)]
+
+
+def bare(s):
+    return re.sub(r"[^a-z0-9]", "", s.lower())
+
+
+CRED = {}
+try:
+    for _line in open(ARGS.credentials):
+        if "=" in _line:
+            k, v = _line.strip().split("=", 1)
+            CRED[k.strip()] = v.strip()
+except OSError:
+    print(f"tvdb: no credentials at {ARGS.credentials} — the sheet would be all "
+          "NEAR and NONE, which is not a decision sheet", file=sys.stderr)
+    sys.exit(2)
+if not CRED.get("api_key"):
+    print(f"tvdb: no api_key in {ARGS.credentials}", file=sys.stderr)
+    sys.exit(2)
+
+TOKEN = {"jwt": ""}
+
+
+def call(path):
+    """One tvdb v4 GET, logging in again once when the JWT expires mid-run."""
+    for attempt in (1, 2):
+        if not TOKEN["jwt"]:
+            body = {"apiKey": CRED["api_key"]}
+            if CRED.get("pin"):
+                body["token"] = CRED["pin"]
+            req = urllib.request.Request("https://api4.thetvdb.com/v4/login",
+                                         data=json.dumps(body).encode(),
+                                         headers={"Content-Type":
+                                                  "application/json"})
+            TOKEN["jwt"] = json.load(
+                urllib.request.urlopen(req, timeout=30))["data"]["token"]
+        try:
+            req = urllib.request.Request("https://api4.thetvdb.com/v4" + path,
+                                         headers={"Authorization":
+                                                  "Bearer " + TOKEN["jwt"]})
+            return json.load(urllib.request.urlopen(req, timeout=30))["data"]
+        except urllib.error.HTTPError as e:
+            if e.code == 401 and attempt == 1:
+                TOKEN["jwt"] = ""
+                continue
+            raise
+
+
+MAPPED = {}
+if ARGS.map and os.path.exists(ARGS.map):
+    for _line in open(ARGS.map):
+        _line = _line.rstrip("\n")
+        if not _line.strip() or _line.startswith("#"):
+            continue
+        cols = _line.split("\t")
+        if len(cols) > 1 and cols[1].strip().isdigit():
+            MAPPED[cols[0].strip()] = cols[1].strip()
+
+# The folders the plan created inside the library, with the file count each one
+# will hold. The review pile is not a show: its files belong to no identity, and
+# naming the pile would put one junk series on the sheet for all of them.
+shows = collections.Counter()
+for line in open(ARGS.plan).read().splitlines()[1:]:
+    parts = line.split("\t")
+    if len(parts) < 4 or parts[0] != "mkdir":
+        continue
+    dst = os.path.abspath(parts[2])
+    if not dst.startswith(ROOT + os.sep) or dst.startswith(PARK + os.sep):
+        continue
+    top = os.path.relpath(dst, ROOT).split(os.sep)[0]
+    if top.startswith((".", "_")):
+        continue
+    if "[tvdbid-" in top:
+        continue                                # an id already backs it
+    shows.setdefault(top, 0)
+for line in open(ARGS.plan).read().splitlines()[1:]:
+    parts = line.split("\t")
+    if len(parts) < 4 or parts[0] != "move":
+        continue
+    dst = os.path.abspath(parts[2])
+    if not dst.startswith(ROOT + os.sep) or dst.startswith(PARK + os.sep):
+        continue
+    top = os.path.relpath(dst, ROOT).split(os.sep)[0]
+    if "[tvdbid-" in top:
+        continue
+    shows[top] += 1
+
+tally = collections.Counter()
+rows = []
+for folder in sorted(shows, key=lambda f: (-shows[f], f)):
+    files, tag, note = shows[folder], "NONE", ""
+    if folder in MAPPED:
+        rows.append([files, "MAPPED", folder, "", "", "", MAPPED[folder],
+                     "the operator's map already states this id"])
+        tally["MAPPED"] += 1
+        continue
+    query, untouched = clean(folder), clean(folder) == folder
+    ys = years(folder)
+    if not query:
+        rows.append([files, "NONE", folder, "", "", "", "",
+                     "nothing is left of the folder's name once release junk"
+                     " is gone"])
+    else:
+        try:
+            hits = call("/search?query=" + urllib.parse.quote(query)
+                        + "&type=series") or []
+        except Exception as e:                                  # noqa: BLE001
+            hits = []
+            note = f"tvdb did not answer: {e}"
+        want = bare(query)
+        pick = None
+        for h in hits:
+            if bare(h.get("name") or "") != want:
+                continue
+            hy = str(h.get("year") or "")
+            if ys and hy.isdigit() and not (min(ys) <= int(hy) <= max(ys)):
+                continue
+            pick = h
+            break
+        if pick:
+            tag = "EXACT" if untouched else "PUNCT"
+            rows.append([files, tag, folder, query, pick.get("name", ""),
+                         str(pick.get("year", "") or ""),
+                         str(pick.get("tvdb_id", "") or ""), ""])
+        elif hits:
+            best = hits[0]
+            rows.append([files, "NEAR", folder, query, best.get("name", ""),
+                         str(best.get("year", "") or ""),
+                         str(best.get("tvdb_id", "") or ""),
+                         f"{len(hits)} answer(s); tvdb's own name is not the "
+                         "query, so nothing would take it"])
+        else:
+            rows.append([files, "NONE", folder, query, "", "", "",
+                         note or "tvdb has no series by that name"])
+    tally[rows[-1][1]] += 1
+    time.sleep(0.12)
+
+# Two folders mapping to one record is not two shows; it is one show the release
+# folders split. Say it on every row involved, or the operator approves the same
+# id twice and reads the second as a mistake.
+by_id = collections.Counter(r[6] for r in rows if r[6] and r[1] != "MAPPED")
+for r in rows:
+    if r[6] and r[1] != "MAPPED" and by_id[r[6]] > 1:
+        r[7] = (f"MERGE: {by_id[r[6]]} folders map to tvdb {r[6]} — one show, "
+                "the releases split it; " + r[7]).strip("; ")
+
+with open(ARGS.out, "w") as fh:
+    fh.write("files\tverdict\tfolder\tquery\ttvdb_name\ttvdb_year\ttvdb_id\tnote\n")
+    for r in rows:
+        fh.write("\t".join(str(c) for c in r) + "\n")
+print(f"sheet: {len(rows)} folders"
+      + "".join(f" {t}={n}" for t, n in sorted(tally.items()))
+      + f" -> {ARGS.out}")

scripts/media-titles.py

@@ -275,7 +275,14 @@ def is_extra(path, title="", dur=0.0, root=ROOT, matched=False):
     bonus_folder = False
     for folder in parts[head:-1]:
         if folder_is_bonus(folder):
-            bonus_folder = not mentions(name_words(name), name_words(folder))
+            # The folder's words are often the film's own name ("Angel's Egg
+            # Extras/"), and then they are not bonus evidence. Only WORDS can name
+            # a film: "extras" is release junk that name_words drops, so a folder
+            # like "01. Extras" reduces to its index — and an index matching an
+            # index ("NCOP 01") is a coincidence, not a title.
+            nw = [w for w in name_words(name) if not w.isdigit()]
+            fw = [w for w in name_words(folder) if not w.isdigit()]
+            bonus_folder = not fw or not mentions(nw, fw)
             break
     if dur and dur > SHORT_MAX:
         # Runtime vetoes vocabulary, with ONE exception: an explicit bonus folder

scripts/media-verify.py

@@ -0,0 +1,221 @@
+#!/usr/bin/env python3
+"""Prove a relayout landed, using the media server's own tables.
+
+A scan answers `204` whether or not it found anything, and a rename that the
+scanner has not followed looks exactly like a rename that never happened from
+the outside. The only honest proof is the run's journal replayed against the
+database the server actually serves from: every `move` row must have a row at
+its destination, and NO row may still name its source — a source row is a scan
+that has not caught up, and it is the one signature of a library pointing at
+files that no longer exist.
+
+Two doors, both read-only, both without a lock while the server runs (there is
+no `sqlite3` binary on these hosts). Open `mode=ro` PLAIN: both servers keep
+their libraries in WAL mode, and `immutable=1` — which claims the file never
+changes — makes sqlite skip the write-ahead log entirely, so every row the
+server has committed but not yet checkpointed reads as MISSING, and a read
+beside a running scanner can even fail as "database disk image is malformed".
+`immutable=1` is only the fallback, for a database whose `-shm` cannot be read.
+
+  jellyfin  `BaseItems.Path`. The container binds the share at `/data`, so the
+            database holds `/data/<library>/…` where the journal holds
+            `/mnt/entropy/<library>/…`. Translate, or every row reads as missing.
+  plex      `media_parts.file`, joined up to `metadata_items`. Plex is bound at
+            the host path, so its rows match the journal verbatim. Filter
+            `deleted_at is null` on BOTH tables — a deleted scan leaves its parts
+            behind, and one of those rows is not proof anything landed.
+
+Neither server holds a row for everything the journal renames: a `.log`, `.cue`
+or cover image has no row to land in, so its absence is not a fault. The report
+therefore breaks the missing rows down by extension, and `--ignore-ext` names the
+extensions this server does not index, which are then counted separately and kept
+out of the verdict. What is left is split by what the filesystem says, because
+the database alone cannot: a file still at its `src` is `REAL` (this pass's own
+damage), a file at neither path is `gone` (a later pass or the server renamed it),
+and a file sitting at its `dst` with no row naming it is simply something the
+server does not index. A row that still names `src` is none of these: it is the
+server's own stale pointer — a phantom — and it costs a re-scan, never a restore.
+
+Exit codes: 0 every move landed; 1 something is stale or missing (the details are
+printed); 2 the journal or the database is not usable at all.
+"""
+
+import argparse
+import json
+import os
+import sqlite3
+import sys
+from collections import Counter
+
+JF_DB = "/home/dank/Containers/jellyfin/config/data/jellyfin.db"
+PLEX_DB = ("/var/lib/plexmediaserver/Library/Application Support/Plex Media Server"
+           "/Plug-in Support/Databases/com.plexapp.plugins.library.db")
+
+# Per kind: the table whose columns are required, those columns, and the query
+# that returns every path the server believes it has.
+KINDS = {
+    "jellyfin": {
+        "table": "BaseItems",
+        "columns": {"Path"},
+        "sql": "select Path from BaseItems",
+        "default_db": JF_DB,
+    },
+    "plex": {
+        "table": "media_parts",
+        "columns": {"file", "media_item_id", "deleted_at"},
+        "sql": ("select p.file from media_parts p"
+                " join media_items m on m.id = p.media_item_id"
+                " join metadata_items mi on mi.id = m.metadata_item_id"
+                " where p.deleted_at is null and mi.deleted_at is null"),
+        "default_db": PLEX_DB,
+    },
+}
+
+def die(msg):
+    print(f"media-verify: {msg}", file=sys.stderr)
+    sys.exit(2)
+
+
+def read_moves(path):
+    """The (src, dst) pairs of a journal, in the order the run performed them."""
+    moves = []
+    try:
+        fh = open(path, encoding="utf-8")
+    except OSError as e:
+        die(f"cannot read the journal {path}: {e.strerror}")
+    with fh:
+        for n, line in enumerate(fh, 1):
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                rec = json.loads(line)
+            except json.JSONDecodeError:
+                die(f"{path} line {n} is not a journal record")
+            if rec.get("op") == "move":
+                if not rec.get("src") or not rec.get("dst"):
+                    die(f"{path} line {n} is a move without both src and dst")
+                moves.append((rec["src"], rec["dst"]))
+    return moves
+
+
+def server_paths(db, kind):
+    """Every path the server holds, or a refusal that names what is missing."""
+    spec = KINDS[kind]
+    con = None
+    err = None
+    # Plain ro reads the WAL the server commits through; immutable is the last
+    # resort, because it cannot see a row the server has not checkpointed.
+    for opt in ("mode=ro", "mode=ro&immutable=1"):
+        try:
+            con = sqlite3.connect(f"file:{db}?{opt}", uri=True)
+            break
+        except sqlite3.Error as e:
+            err = e
+    if con is None:
+        die(f"cannot open {db}: {err}")
+    with con:
+        have = {r[1] for r in con.execute(f"pragma table_info({spec['table']})")}
+        if not spec["columns"] <= have:
+            die(f"{db} is not a {kind} library database ({spec['table']} has no "
+                f"{','.join(sorted(spec['columns'] - have))})")
+        try:
+            return {r[0] for r in con.execute(spec["sql"]) if r[0]}
+        except sqlite3.Error as e:
+            die(f"{db} refused the {kind} query: {e}")
+
+
+def to_host(path, container, share):
+    """The database's path in the journal's terms; identity when it is not a
+    container-side path."""
+    if not container:
+        return path
+    prefix = container.rstrip("/") + "/"
+    if path.startswith(prefix):
+        return share.rstrip("/") + "/" + path[len(prefix):]
+    return path
+
+
+def main():
+    ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    ap.add_argument("--journal", required=True,
+                    help="the run's journal (scripts/media-apply.py writes it)")
+    ap.add_argument("--db-kind", choices=sorted(KINDS), required=True)
+    ap.add_argument("--db", default=None, help="the server's database on this host")
+    ap.add_argument("--share", default="/mnt/entropy",
+                    help="the share every journal path lives under")
+    ap.add_argument("--container", default=None,
+                    help="what the share is called inside the container; empty"
+                         " compares verbatim (default /data for jellyfin, nothing"
+                         " for plex)")
+    ap.add_argument("--show", type=int, default=20,
+                    help="how many offenders to name before saying 'and N more'")
+    ap.add_argument("--ignore-ext", default="",
+                    help="comma-separated extensions this server does not index,"
+                         " kept out of the verdict (e.g. log,cue,nfo,srt)")
+    args = ap.parse_args()
+
+    db = args.db or KINDS[args.db_kind]["default_db"]
+    container = ("/data" if args.db_kind == "jellyfin" else "") \
+        if args.container is None else args.container
+    ignore = set()
+    for ext in args.ignore_ext.split(","):
+        ext = ext.strip().lower()
+        if ext:
+            ignore.add(ext if ext.startswith(".") else "." + ext)
+
+    moves = read_moves(args.journal)
+    stored = {to_host(p, container, args.share) for p in server_paths(db, args.db_kind)}
+
+    landed, stale, missing, ignored = 0, [], [], 0
+    for src, dst in moves:
+        if os.path.splitext(dst)[1].lower() in ignore:
+            ignored += 1
+            continue
+        at_dst, at_src = dst in stored, src in stored
+        if at_dst and not at_src:
+            landed += 1
+            continue
+        if at_src:
+            stale.append(src)
+        if not at_dst:
+            missing.append((src, dst))
+
+    # The database cannot tell a lost file from one it never indexes: both read
+    # as "no row at the destination". Stat both paths, so the report separates
+    # the classes the runbook names — `REAL` is the only one that is this pass's
+    # own damage, and `gone` is a later pass or the server's own rename.
+    on_disk, real, gone = [], [], []
+    for src, dst in missing:
+        if os.path.exists(dst):
+            on_disk.append(dst)
+        elif os.path.exists(src):
+            real.append(src)
+        else:
+            gone.append(dst)
+
+    print(f"{args.db_kind}: {len(moves)} moves checked")
+    print(f"landed: {landed}")
+    print(f"still at src: {len(stale)}")
+    print(f"missing from the DB: {len(missing)}")
+    print(f"  on disk at dst, no row names it: {len(on_disk)}")
+    print(f"  REAL — file still at src: {len(real)}")
+    print(f"  gone — at neither path: {len(gone)}")
+    if ignored:
+        print(f"not indexed (extension ignored): {ignored}")
+    if missing:
+        exts = Counter(os.path.splitext(d)[1].lower() or "(no extension)"
+                       for _, d in missing)
+        print("missing by extension: "
+              + ", ".join(f"{e} {n}" for e, n in sorted(exts.items())))
+    for label, items in (("real", real), ("gone", gone), ("missing", on_disk),
+                         ("stale", stale)):
+        for path in items[:args.show]:
+            print(f"  {label}: {path}")
+        if len(items) > args.show:
+            print(f"  {label}: … and {len(items) - args.show} more")
+    return 1 if (stale or missing) else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/wait-for-mount.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# wait-for-mount.sh — refuse a container start until what it binds is mounted.
+#
+# Why this exists (live 2026-10-31, Dankserver): a rootless quadlet cannot order
+# itself against a SYSTEM mount unit. `RequiresMountsFor=/mnt/entropy` in a user
+# unit resolves to nothing and is inert, so when the array's mount finished a
+# second after podman resolved the bind, Jellyfin and Plex started against the
+# pre-mount directory. Their library root looked EMPTY and Jellyfin began
+# deleting metadata by the thousand (`Removing item, Type: "Season"`). A blind
+# bind is not a cosmetic fault; it is a metadata-deleting machine.
+#
+# A `ConditionPathIsMountPoint=` is NOT the fix, measured on the same host: an
+# unmet condition logs "skipped, unmet condition check", NRestarts=0, and no
+# start attempt ever follows — the unit stays dead until a human starts it.
+# That is fail-dead. This script WAITS (the mount usually lands within seconds)
+# and only then refuses, so `Restart=always` carries the unit across the race.
+#
+# usage: wait-for-mount.sh [-t SECONDS] MOUNTPOINT [MOUNTPOINT...]
+#   exit 0  every path is a mountpoint
+#   exit 1  a path is still not a mountpoint after the window (named on stderr)
+#   exit 2  usage error
+set -euo pipefail
+
+usage() { printf 'usage: %s [-t SECONDS] MOUNTPOINT [MOUNTPOINT...]\n' "$0"; }
+
+window=90
+while getopts ":t:h" opt; do
+    case "$opt" in
+        t) window=$OPTARG ;;
+        h) usage; exit 0 ;;
+        *) usage >&2; exit 2 ;;
+    esac
+done
+shift $((OPTIND - 1))
+
+[ "$#" -ge 1 ] || { usage >&2; exit 2; }
+case "$window" in
+    '' | *[!0-9]*) printf 'refused: -t wants whole seconds, got %s\n' "$window" >&2; exit 2 ;;
+esac
+
+is_mount() { findmnt -M "$1" -rno TARGET >/dev/null 2>&1; }
+
+report() {
+    local why=$1; shift
+    printf '%s:' "$why"
+    for p in "$@"; do printf ' %s' "$p"; done
+    printf '\n'
+}
+
+deadline=$(( $(date +%s) + window ))
+warned=0
+while :; do
+    missing=()
+    for path in "$@"; do
+        is_mount "$path" || missing+=("$path")
+    done
+    [ "${#missing[@]}" -eq 0 ] && break
+
+    if [ "$(date +%s)" -ge "$deadline" ]; then
+        report "refused: still not mounted after ${window}s" "${missing[@]}" >&2
+        printf 'refusing to start: a container bind-mounted here would see the empty\n' >&2
+        printf 'directory underneath and conclude the library is empty — which is how a\n' >&2
+        printf 'scan begins deleting metadata it cannot find.\n' >&2
+        exit 1
+    fi
+    if [ "$warned" -eq 0 ]; then
+        report "waiting for mount(s) this unit depends on" "${missing[@]}"
+        warned=1
+    fi
+    sleep 1
+done
+
+[ "$warned" -eq 0 ] || printf 'mounted; proceeding.\n'
+exit 0

serverAppConfigs-docs/Agent/Issue Tracker.md

@@ -48,6 +48,14 @@ Use the `Authorization: token` header for everything.
 - **Read an issue**: `curl -s -K "$cfg" $API/issues/<number>` (fields: `number`, `title`, `body`, `labels[].name`, `state`)
 - **List issues**: `curl -s -K "$cfg" "$API/issues?state=open&limit=50"` — add `&labels=<id>` to filter
 - **Comment**: `curl -s -K "$cfg" -X POST -d "$(jq -n --rawfile b "$BODY" '{body:$b}')" $API/issues/<number>/comments`
+- **Comment on a PR**: the conversation thread is `POST $API/issues/<PR-number>/comments`
+  (201, and the answer's `html_url` points at `pulls/<n>`; Gitea's issue index is
+  unified, so the PR's number is the same number). `$API/pulls/<n>/comments` is the
+  **review**-comment store and answers `405` to a plain body.
+- **A body built by `jq --rawfile b /dev/stdin` inside `$(…)` is empty**: the command
+  substitution does not inherit the heredoc, so Gitea receives `{}` and answers 422 —
+  and `jq -r '.id'` on the error prints nothing, which reads as success. Write the
+  body to a file and pass `--rawfile` that file.
 - **Apply labels**: `POST $API/issues/<number>/labels` with `{"labels":[<label-ID numbers>]}` — Gitea wants numeric label **IDs**, not names; resolve them from `GET $API/labels` (see [[Triage Labels]] for which labels exist)
 - **Remove a label**: `DELETE $API/issues/<number>/labels/<label-id>`
 - **Close**: `PATCH $API/issues/<number>` with `{"state":"closed"}`

serverAppConfigs-docs/Architecture/E2E Suite.md

@@ -100,3 +100,12 @@ aborts with `DEPLOY INCOMPLETE: e2e gate FAILED` when it does not pass
    hand-off list (`HANDOFFS`) instead of a single host. The guard contract is
    untouched: challenge cleared, no authentik `uidField`, status < 500, and every
    host NOT in the list still has to land on its own vhost.
+7. **The runner's resolver is part of the suite.** A 2026-10-31 deploy of one
+   Dankserver quadlet failed the gate with 21 reds spread over SSO, homepage RBAC
+   and every vhost crawl — precisely the specs that navigate to an absolute
+   `*.franksdank.cloud` name, while every spec on the relative `baseURL` stayed
+   green. The error was `net::ERR_NAME_NOT_RESOLVED`: the workstation had lost its
+   wired link, and on the fallback its resolver was no longer pinned to Pi-hole.
+   Nothing on the fleet was wrong — the same suite re-run minutes later passed
+   37/37. Before a mass red gets blamed on the guard chain, run
+   `resolvectl query grafana.franksdank.cloud` on the box that runs the gate.

serverAppConfigs-docs/Architecture/Quadlet Lifecycle.md

@@ -167,6 +167,43 @@ Gate: `tests/quadlet_image_pins.bats`. Where upstream publishes no version
 tags (copyparty-ac stops at 1.19.15), pin `:latest@sha256:` and name the
 version the config label carries in the comment beside it.
 
+## 4b. Resource control needs host permission (measured 2026-10-31, Dankserver)
+
+`IOWeight=` in a rootless quadlet does nothing on its own, and nothing says so.
+The system manager delegates `cpu memory pids` to `user@.service` and **not** `io`;
+systemd drops a resource line it cannot honour **without a word** — the generator
+still emits `IOWeight=10`, the container still starts and answers its health check,
+and the cgroup simply has no `io.weight` file. Same family as
+`RequiresMountsFor=` (inert in the user manager) and `ConditionPathIsMountPoint=`
+(fail-dead): the line is accepted, the unit is happy, the setting is dead.
+
+Two system drop-ins make it real, both placed by `ensure_user_io_delegate` in
+`scripts/deploy-remote.sh` (repo copies under `dankserver/host/systemd/`):
+
+| File | Effect |
+|---|---|
+| `user.slice.d/io-accounting.conf` → `[Slice] IOAccounting=yes` | puts `io` into `user.slice/cgroup.subtree_control`; lands immediately, no restart |
+| `user@1000.service.d/io-delegate.conf` → `[Service] DelegateControllers=cpu memory pids io` | the user manager can only request controllers it was delegated; read when it starts, so it lands on **the next reboot** (restarting it kills every rootless container on the host) |
+
+Read the chain in this order — each line is the failure mode of the one after it:
+
+```bash
+cat /sys/fs/cgroup/user.slice/cgroup.subtree_control                    # wants: io
+systemctl show user@1000.service -p DelegateControllers                 # wants: io
+cat /sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service/app.slice/\<unit\>.service/libpod-payload-*/io.weight
+```
+
+`io` missing from the first → the accounting drop-in is absent. Missing from the
+second → the host has not rebooted since the delegation landed (the deployer prints
+`NOTE: io is not delegated …` for exactly this). No file at the third → that unit
+carries no weight.
+
+Two limits that survive the fix: a container's weight covers **everything** in its
+cgroup, so a library scan and a playback stream share one weight; and the comparison
+is made *inside* `user.slice`, so a rootless unit's weight cannot push it below a
+root unit (`frank-archon`). Shaping that pairing is the weight of `user.slice`
+itself — a fleet decision, not a unit line.
+
 ## 5. Rootless Quadlet log retrieval
 
 Step 0 — establish ownership: `systemctl --user status <name>.service`

serverAppConfigs-docs/Dankserver/Entropy Volume.md

@@ -1,51 +1,68 @@
 ---
 type: reference
-description: "The Dankserver entropy volume is a RAID-backed LUKS filesystem mounted at"
+description: "Dankserver's /mnt/entropy volume: the LUKS/array chain, the crypttab + fstab boot path, and the containers bound to it"
 tags:
   - dankserver
-timestamp: 2026-08-28
+timestamp: 2026-10-31
 ---
 
 # Entropy Volume
 
-The Dankserver entropy volume is a RAID-backed LUKS filesystem mounted at
-`/mnt/entropy`. The command-line helper reuses the host's desktop-integrated
-`udisks2`, `crypttab`, and `fstab` configuration; it does not store or handle
-the passphrase itself.
+`/mnt/entropy` is the ext4 filesystem on the LUKS container holding `/dev/md0`
+(RAID6, seven disks). The media stack's data lives there, so the mount is a boot
+dependency for those containers rather than a convenience.
 
-## Command-line mount
-
-```bash
-/home/dank/serverAppConfigs/scripts/mount-entropy.sh
-```
-
-Run it as the normal desktop user (`dank`), not from a root shell. `udisksctl`
-will securely prompt for the LUKS passphrase. `sudo mount /mnt/entropy` then
-uses the existing `/etc/fstab` entry, preserving its options:
+## Chain
 
 ```text
-nosuid,nodev
+/dev/md0                     <- mdadm (its mdadm.conf ARRAY is what makes md0 exist at boot)
+  -> LUKS UUID=cd86c728-459e-4f3a-bcc2-41ecf84685ec   keyfile: /etc/entropy
+     -> /dev/mapper/entropy  <- systemd-cryptsetup@entropy.service
+        -> ext4 at /mnt/entropy  <- mnt-entropy.mount, from /etc/fstab
 ```
 
-The existing mountpoint is owned by `dank:dankserver` with mode `0755`; the
-helper deliberately does not run `chmod` or `chown`, so it cannot silently
-change those permissions.
+## Files that own it
 
-## Device path
+| Repo file | Installs to | Produces at boot |
+|---|---|---|
+| `dankserver/host/crypttab` | `/etc/crypttab` | `systemd-cryptsetup@entropy.service` → `/dev/mapper/entropy` |
+| `dankserver/host/fstab` | `/etc/fstab` | `mnt-entropy.mount` (mountpoint `dank:dankserver`, `0755`) |
 
-The current storage chain is:
+Deploy a change by copying the file onto the host, then
+`systemctl daemon-reload && update-initramfs -u`. The initramfs step is not
+optional: the cryptsetup hook bakes `/etc/crypttab` into the initrd, and the
+array is unlocked there, before the real root mounts. `scripts/mount-entropy.sh`
+(`udisksctl unlock` + `mount`) stays as the manual path for a volume that was
+never unlocked; on a correct boot it is redundant.
 
-```text
-/dev/md0 -> LUKS UUID cd86c728-459e-4f3a-bcc2-41ecf84685ec
-         -> ext4 label entropy
-         -> /mnt/entropy
-```
+## Law
 
-The helper checks that `/dev/md0` exists and exits successfully if the volume
-is already mounted. It is intentionally specific to this host and volume:
-that avoids accidentally unlocking or mounting a different disk.
+**`crypttab`'s device field takes the LUKS UUID, never the md array UUID.**
+`blkid` prints both on adjacent lines for a RAID-backed container, and the file
+shipped since 2025 carried the array UUID (`61bd6eaf-…`) where the LUKS container
+is `cd86c728-…`. The generator produced a perfectly valid unit pointing at a
+device that never appears, so the mapper came into existence only through a
+desktop `udisks2` session — the volume looked mounted on every login while every
+boot failed to mount it. The matching `fstab` line named the same wrong UUID
+directly instead of the mapper.
 
-## Related
+**A LUKS keyfile is hashed whole, so a trailing newline is a different
+passphrase.** The shipped `/etc/entropy` was 27 bytes — 26 characters plus `\n` —
+and `cryptsetup` rejected it even after the UUID was corrected. Keyfiles stay
+`0600` with no trailing newline; prove it with
+`cryptsetup open --test-passphrase --key-file /etc/entropy UUID=…` *before*
+relying on it for a boot.
 
-- [[Storage Policy]]
-- [[Dankserver Stack]]
+**Prove a mount fix with the artifacts systemd generates, not with a live
+mount.** The regenerated `systemd-cryptsetup@entropy.service` naming the right
+device, `findmnt /mnt/entropy` sourcing `/dev/mapper/entropy`, and a matching
+checksum between the repo copy and the host copy are the evidence. A mount that
+exists because someone logged in proves nothing about the boot path — that
+exactly describes the year this bug survived.
+
+## Consumers
+
+`jellyfin`, `copyparty`, and `plex` bind paths under `/mnt/entropy`; with the
+volume absent they start `active (healthy)` against empty directories, which is
+how a missing 91 TiB volume hides. See [[Dankserver Stack]] for the stack and
+[[Storage Policy]] for what may be written here.

serverAppConfigs-docs/Dankserver/Jellyfin.md

@@ -1,7 +1,7 @@
 ---
 type: reference
 title: Jellyfin
-description: "Jellyfin on Dankserver: quadlet unit, overlay metadata view layout, ports, access, hardware-transcode status."
+description: "Jellyfin on Dankserver: quadlet unit, overlay metadata view, provider keys, ports, access, transcode status."
 tags: [jellyfin, dankserver, media-server]
 timestamp: 2026-10-30T00:00:00Z
 ---
@@ -18,7 +18,7 @@ clients.
 public vhost `jelly.franksdank.cloud` behind the [[Anubis]] guard chain →
 [[Authentik]] outpost (post-auth route proxies `localhost:8096`).
 
-## Facts (verified from the live unit, 2026-09-03)
+## Facts (the repo quadlet; the live unit is still the pre-view generation — see Data layout)
 
 | Item | Value |
 |------|-------|
@@ -26,7 +26,7 @@ public vhost `jelly.franksdank.cloud` behind the [[Anubis]] guard chain →
 | Image | `ghcr.io/jellyfin/jellyfin:latest` |
 | Network | `dankserver_appnet`; publishes 8096/tcp, 8920/tcp, 7359/udp, 1900/udp |
 | Data roots | `/home/dank/Containers/jellyfin/config:/config`, `/home/dank/Containers/jellyfin/cache:/cache` |
-| Media | `Volume=/var/lib/media-meta/view:/data` — the [[Media Metadata View]] overlay, **writable**; sidecars land on the NVMe, the [[Entropy Volume]] array underneath stays read-only and untouched |
+| Media | `Volume=/var/lib/media-meta/view:/data` in git — the [[Media Metadata View]] overlay, **writable**, sidecars land on the NVMe and the [[Entropy Volume]] array underneath stays untouched. **The live unit is still pre-view: `/mnt/entropy:/data:ro`** — nothing is written into the library until the view is deployed |
 | GPU | none — no `AddDevice`; CPU decode only (jellyfin-ffmpeg path) |
 | Env quirks | `DOTNET_SYSTEM_IO_DISABLEFILELOCKING=true`, `LD_PRELOAD=libjemalloc.so.2`, `MALLOC_TRIM_THRESHOLD_=131072` kept verbatim from the compose-era container (zero-drift cutover) |
 | Health | `curl -f http://localhost:8096/health` every 30 s |
@@ -36,23 +36,27 @@ public vhost `jelly.franksdank.cloud` behind the [[Anubis]] guard chain →
 ```
 /home/dank/Containers/jellyfin/config   -> /config   (JELLYFIN_DATA_DIR)
 /home/dank/Containers/jellyfin/cache    -> /cache    (JELLYFIN_CACHE_DIR, XDG_CACHE_HOME)
-/var/lib/media-meta/view                -> /data     (the SSD-backed overlay view)
+/var/lib/media-meta/view                -> /data     (git: the overlay view)
+/mnt/entropy                             -> /data     (live today: the array, read-only)
 ```
 
-Library folders point at `/data` paths, which are the view's paths: stable
-across container recreation, and identical to the raw array layout below it.
+Library folders point at `/data` paths: stable across container recreation and
+identical to the raw array layout below. Which side of that path the container
+is on is the open question on this host — the installed unit binds the read-only
+array, and `scripts/media-view.sh status` reports `NOT MOUNTED` (2026-10-31).
 
-`Local metadata` — save metadata to media folders — is enabled, and it works
-because `/data` is the [[Media Metadata View]] rather than the read-only array:
-`movie.nfo`, `tvshow.nfo`, `episode.nfo` and artwork are written once, on the
-NVMe upper layer, and [[Plex]] reads the same files. Jellyfin is the fleet's
-only metadata writer.
+`Local metadata` — save metadata to media folders — is enabled, and it is the
+reason the view exists: `movie.nfo`, `tvshow.nfo`, `episode.nfo` and artwork
+written once on the NVMe upper layer are files [[Plex]] can read too. While
+`/data` is bound read-only every item update logs the error below and no sidecar
+is written; Jellyfin becomes the fleet's only metadata writer with the deploy
+that raises the view.
 
 **Failure signature:** `System.IO.IOException: Read-only file system :
 '/data/Movies/<film>/movie.nfo'` means the container is binding the raw array
-instead of the view — the view is unmounted or the quadlet drifted. That used to
-be the expected state (pre-view, every item update logged it); today it is a
-fault. Run `scripts/media-view.sh status`.
+instead of the view. On Dankserver that is today's expected state — the view has
+never been installed (`scripts/media-view.sh status`). Once it is deployed, the
+same line is a fault: the quadlet drifted or the mount died.
 
 ## Ports & access
 
@@ -117,12 +121,109 @@ where the LDAP plugin runs. Verified 2026-09-25: `alex` authenticates over
 `AuthenticateByName` (HTTP 200; full plugin flow logged — service bind,
 search, `ldapUid`, user bind, token).
 
+## Metadata providers and their keys (2026-10-30)
+
+TMDb, OMDb, StudioImages and MusicBrainz are **core plugins** in Jellyfin 12 —
+no DLL, just a configuration file the running container owns under the data
+root. TVDB is not core (its metadata provider was removed in 10.9), so it is an
+official-catalog plugin.
+
+| Provider | Shape on disk | Key lives in |
+|---|---|---|
+| TMDb | `config/plugins/configurations/Jellyfin.Plugin.Tmdb.xml` → `<TmdbApiKey>` | `/home/dank/Containers/jellyfin/provider-keys` → `TMDB_API_KEY=` (mode 600) |
+| TVDB | `config/plugins/thetvdb_24.0.0.0/` + `…Jellyfin.Plugin.Tvdb.xml` → `<ApiKey>` | the same file → `TVDB_API_KEY=` |
+| OMDb | `…Jellyfin.Plugin.Omdb.xml` | **not configured** — its key is issued by email, 1 000 req/day, and its ToS forbids storing the returned data; ratings stay Jellyfin's own lookup |
+
+**None of it is tracked in git.** Those XML files belong to the container and
+hold credentials, and `tests/jellyfin_providers.bats` fails the suite if one is
+ever committed. The keys themselves sit in the per-service host env file that is
+the fleet's convention for container credentials (grafana, caddy, pihole,
+copyparty, romm, seerr): `provider-keys`, mode 600, beside the data root.
+`scripts/jellyfin-providers.sh` is the only thing that writes the XML:
+
+```
+scripts/jellyfin-providers.sh plan      # what would change; prints no key
+scripts/jellyfin-providers.sh install   # plugin + keys, previous copy to trash
+scripts/jellyfin-providers.sh verify    # plugin + key LENGTHS, never key bytes
+```
+
+- **A key never enters git, argv, or the tool's output.** The installer reads
+  that 600-perm file itself (a value in argv is world-readable through
+  `/proc/<pid>/cmdline`) and refuses it when it is group- or world-readable —
+  an exposed key is an error, not a warning. A key that shows up in a transcript
+  or `ps` output has leaked: rotate it with the provider, rewrite
+  `provider-keys`, re-run `install`.
+- **The TVDB artifact is pinned three ways**: sha256
+  `6302fba3857bdde8d186dd099fac09ca43247041f531a528a2c788add70a5319`, the
+  official plugin guid `a677c0da-fac5-4cde-941a-7134223f14c8`, and version
+  `24.0.0.0` (`targetAbi 12.0.0.0`, which fits the deployed 12.4.0). A sha
+  match alone only proves the bytes are the bytes fetched — the guid check is
+  what says it is the official plugin. Rollback: move `thetvdb_24.0.0.0/` into
+  the trash and revert the pin; a second `thetvdb_*` directory is a refusal,
+  never a quiet second copy.
+- **The homelab TVDB key is a licensed key** (its JWT claims say
+  `community_supported: false`), so it needs **no PIN** — the optional
+  `TVDB_PIN=` line exists only for a subscriber-shaped key.
+- **TVDB is installed and keyed but is not a metadata agent**: TMDb still
+  identifies everything. Enabling TVDB as a provider would re-fetch show
+  metadata across the library, so it is a deliberate, separate change.
+- **The deployer places the keys before it restarts jellyfin**
+  (`ensure_provider_keys` in `scripts/deploy-remote.sh`) and warns instead of
+  failing when `provider-keys` is absent, so a host without it still deploys.
+- **Keys and plugins are read at start-up**: after a manual `install` the
+  change is inert until `./scripts/deploy.sh dankserver --service jellyfin`.
+- TMDb's terms are the reason this stays narrow: attribution required, no
+  caching beyond 6 months, no derivative works. Fine for a personal homelab,
+  and the reason no bulk enrichment pass runs against it.
+
 ## Configuration workflow
 
 1. Create libraries pointing at `/data` folders (movies, shows, audio).
 2. Set metadata/language preferences (`LANG=en_US.UTF-8` pinned in the unit).
 3. Configure clients to use `http://192.168.0.235:8096` or the guarded vhost.
 
+## Triggering a scan
+
+The scan key lives in `~/.config/secrets/jellyfin` (mode 600; the same value is
+`JELLYFIN_API_KEY` in the ignored `dankserver/.env`). It rides a mode-600 curl
+config, never a header argument, in the `MediaBrowser` form: 12.4 authenticates
+only `Authorization: MediaBrowser Token="…"` and refuses a bare `X-Emby-Token`
+for every key, valid or not. Before believing a 401, prove the key against the
+server's own table — `select count(*) from ApiKeys where AccessToken = ?` on
+`jellyfin.db` opened `mode=ro&immutable=1`. The backslashes below matter:
+
+```bash
+umask 077
+{ printf 'header = "Authorization: MediaBrowser Token=\\"%s\\""\n' \
+    "$(cat ~/.config/secrets/jellyfin)"
+  echo 'url = "http://127.0.0.1:8096/Library/Refresh"'
+  echo 'request = "POST"'; } >/tmp/jf.hdr
+curl -s -K /tmp/jf.hdr -o /dev/null -w "jellyfin scan: %{http_code}\n"
+shred -u /tmp/jf.hdr
+```
+
+`204` is acceptance; anything else queued no scan, so re-issue the identical
+request instead of diagnosing. A `401` from a key that answers `200` on a
+hand-typed request is this block's quoting, not the server: bash `printf`
+collapses `\"` to `"`, curl ends the quoted value at that quote, and Jellyfin
+receives `Authorization: MediaBrowser Token=` with nothing after it (`\\"` answers
+204, `\"` answers 401 — both run on this host).
+
+One accepted refresh is the whole procedure. A second one while a scan runs moves
+`Scan Media Library` to `Cancelling`, and once the runner holds `Cancelling` every
+later `204` is accepted and then discarded — the status code stops meaning
+anything. The fix is `systemctl --user restart jellyfin.service` (never
+`deploy.sh`: that runs the never-tested metadata-view cutover), one POST after
+health answers, and then believe `ScheduledTasks` State at 130 % CPU, not the
+response code.
+
+**A scan that must see a new folder has to be recursive.** `POST /Library/Refresh`
+is the incremental pass, and inotify does not cross a rootless podman bind, so
+folders created on the host stay invisible to it. The move is
+`POST /Items/{id}/Refresh?Recursive=true` (204) per library, the id from
+`GET /Library/VirtualFolders` — its field is `ItemId`, not `Id` — and that same
+record's `RefreshStatus` is the progress read.
+
 ## See Also
 
 - [[Plex]] — co-resident media server on the same volume

serverAppConfigs-docs/Dankserver/Media Audiobook Relayout.md

@@ -0,0 +1,74 @@
+---
+type: reference
+title: Media Audiobook Relayout
+description: "Re-filing /mnt/entropy/Audiobooks by Plex's chapter rows: narrator shelves, no renumbering, the refusals."
+tags: [dankserver, media-server, plex, media-relayout]
+timestamp: 2026-10-31T00:00:00Z
+---
+
+# Media Audiobook Relayout
+
+`/mnt/entropy/Audiobooks` is the one library here that [[Jellyfin]] does not read
+at all — its music scanner has no audiobook concept — while [[Plex]] indexes all
+of it as Artist → Album → Track: the album is the BOOK, that book's single artist
+is the NARRATOR, both matched out of the files' own tags. Today one book is split
+across `… [Part 1]`, `… [Part 2]` folders three or four deep inside a collection
+pack, so a scan serves three quarters of a novel; `scripts/media-audiobooks.py`
+re-files the tree so the property both servers' book scanners assume is true —
+
+    Audiobooks/<Narrator>/<Book> (<year>)/<the file keeps its own name>
+
+The shared gates, the executor, the journal law and the rollback live in
+[[Media Relayout]]; this page is the audiobook arm only.
+
+```bash
+# 1. The authority: Plex's chapter rows for this root (the DB opens read-only).
+python3 scripts/media-census.py audiobooks --root /mnt/entropy/Audiobooks \
+    --out /tmp/ab_rows.tsv
+# 2. What is on disk (stat only).
+python3 scripts/media-census.py enumerate --root /mnt/entropy/Audiobooks \
+    --out /tmp/ab_enum.tsv
+# 3. The plan.
+python3 scripts/media-audiobooks.py --root /mnt/entropy/Audiobooks \
+    --enum /tmp/ab_enum.tsv --rows /tmp/ab_rows.tsv --out /tmp/ab_plan.tsv \
+    --exceptions /tmp/ab_exceptions.txt
+# 4. Read the exceptions file FIRST. Then the same executor, journal and rollback
+#    as [[Media Relayout]] shows, on its own journal, and refresh the Plex section
+#    as in step 5 of the movie Procedure — from inside the container, never over
+#    the host port.
+scripts/media-apply.py apply --plan /tmp/ab_plan.tsv --root /mnt/entropy \
+    --journal /mnt/entropy/media-relayout-audiobooks.jsonl --apply
+```
+
+The group is the identity Plex asserts in its own database — **(narrator, book,
+year)** — so one book arriving in four part folders becomes one folder, and a
+1965 and a 2020 recording that share a title stay two books.
+
+Two laws are forced by what the rows actually hold:
+
++- **A chapter is never renumbered.** Most books contain chapters whose index Plex
+  does not know, so a number written into a name would be invented — and it would
+  buy nothing, because both servers order playback by the embedded track tag, not
+  by the file name. A wrong number in a name is the number a human later trusts.
+  Fix order in the tags: a Plex scan re-reads tags and never renames a file.
++- **The shelf is the narrator, not the author.** Every book has exactly one artist
+  row and it is the narrator; the author survives only inside some album titles
+  (`Kryptos by Graham McNeill`) and in no column Plex stores, so deriving it would
+  mean parsing titles where a ripper wrote one and inventing it everywhere else.
+  The author stays visible in the folder name Plex itself shows.
+
+What it refuses, the music arm's list with one addition: a video container, audio
+no chapter row names, and a loose file in a folder holding two books all park under
+`_unsorted` with the path they have today — and so does a chapter whose row names
+**no book or no narrator**: a placeholder (`[Unknown Album]`, `[Unknown Artist]`)
+that unrelated books share, or a chapter number mistagged as the artist (`0.4`).
+`Various Artists` is not a placeholder — that is a multi-cast read.
+
+The reviewed plan lives at `/mnt/entropy/media-relayout-audiobooks-plan.tsv`; it
+applies on its own journal, behind the music writer, and then refreshes the Plex
+section. Verify it with `--db-kind plex` — Jellyfin holds no rows here, so a
+Jellyfin pass proves nothing either way.
+
+## See Also
+
+[[Media Relayout]], [[Media Music Relayout]], [[Plex]]

serverAppConfigs-docs/Dankserver/Media Metadata View.md

@@ -20,6 +20,19 @@ The mount point is not a volume and holds nothing while unmounted. It sits insid
 merged door are one directory — and so the mount table grows no new `/mnt` entry
 next to the array.
 
+**Not deployed on Dankserver — verified 2026-10-31.** `scripts/media-view.sh
+status` answers `view: /var/lib/media-meta/view NOT MOUNTED`,
+`/var/lib/media-meta` does not exist, and the installed quadlets under
+`~/.config/containers/systemd/` still carry the pre-view binds — `/mnt/entropy:/data:ro`
+for [[Jellyfin]], `/mnt/entropy:/mnt/entropy:ro` for [[Plex]]. Everything below
+is the shape git describes, not the shape the servers run. The cutover is an
+ordinary deploy: `deploy.sh dankserver --service jellyfin|plex` runs
+`ensure_media_view` (`install` then `verify`) before it restarts the container,
+so it must not be fired through the middle of a library scan. Until that deploy
+lands there is no upper layer, so no relayout can leave ghost metadata and
+`reap` has nothing to do — `media-apply.py` prints that follow-up only when the
+view really is a mountpoint.
+
 ## Shape
 
 | Item | Value |
@@ -33,10 +46,11 @@ next to the array.
 | Installer | `scripts/media-view.sh` — `plan` / `install` / `verify` / `status` / `reap` |
 | Written by | Jellyfin only (Plex binds read-only); nothing else in the fleet touches it |
 
-Both consumers guard the view with
-`UnitConfigItem=ConditionPathIsMountPoint=/var/lib/media-meta/view`, and
-`scripts/deploy.sh dankserver --service jellyfin|plex` calls `media-view.sh
-install` + `verify` before it restarts either container.
+Both consumers gate their start on the view with
+`ExecStartPre=/home/dank/serverAppConfigs/scripts/wait-for-mount.sh` (it waits
+for the mount, then refuses), and `scripts/deploy.sh dankserver --service
+jellyfin|plex` calls `media-view.sh install` + `verify` before it restarts
+either container.
 
 | Consumer | Bind | Mode | Why that path |
 |---|---|---|---|
@@ -67,11 +81,20 @@ the defaults are the host values above.
   refuse via `lsblk -dno ROTA` if the upper base lives on the array: an overlay
   whose upper is the spinners is the original problem with extra steps, and it
   silently turns every metadata write back into a seek.
-- **Never mount the view over an unmounted lower.** `RequiresMountsFor=/mnt/entropy`
-  plus the container `ConditionPathIsMountPoint` guards: an empty `lowerdir`
-  presents an *empty library* as truth, and a media scan would then clear the
-  database of everything. systemd does not create a mount point, so `install`
-  creates `view` itself; without it the mount simply fails.
+- **A container that binds the array must refuse to start until the mount
+  answers.** Live 2026-10-31: the array's mount and the media containers raced at
+  boot, podman resolved the bind against the pre-mount directory, and both
+  servers came up blind — Jellyfin read an empty library and began
+  `Removing item, Type: "Season"` by the thousand. Two dependencies people reach
+  for do not work here, both measured on that host: `RequiresMountsFor=` in a
+  **rootless** unit is inert (the user manager cannot order against the system's
+  `mnt-entropy.mount`), and `ConditionPathIsMountPoint=` is fail-*dead* — an
+  unmet condition logs `skipped, unmet condition check` with `NRestarts=0` and no
+  start attempt ever follows, so the unit waits for a human. The working guard is
+  `scripts/wait-for-mount.sh` as `ExecStartPre`: it waits out the race, refuses by
+  name after its window, and `Restart=always` carries the unit from there.
+  systemd does not create a mount point, so `install` creates `view` itself;
+  without it the mount simply fails.
 - **Never delete through the view.** A delete writes an overlayfs whiteout
   (`.wh.<name>`) in the upper layer, which hides the array's copy without
   removing it — the file reappears the moment the view is unmounted, and the
@@ -94,7 +117,8 @@ the defaults are the host values above.
 
 | Symptom | Meaning |
 |---|---|
-| `jellyfin.service` / `plex.service` show `ConditionPathIsMountPoint=... was not met` and stay inactive | The view is not mounted. Do not start them anyway: `scripts/media-view.sh install`, then `verify`. |
+| `jellyfin.service` / `plex.service` fail with `refused: still not mounted after 90s: …` | The view or the array is not mounted. Do not start them anyway: `scripts/media-view.sh install`, then `verify`. |
+| Servers answer, library looks empty, Jellyfin logs `Removing item, Type: "Season"` by the thousand | Blind bind — the container started before the mount and bound the pre-mount directory. `podman exec jellyfin ls /data` against `ls /mnt/entropy` is the whole diagnosis; restarting the container re-resolves the bind. |
 | Jellyfin log: `Read-only file system : '/data/Movies/…/movie.nfo'` | The container is binding the raw array, not the view — the quadlet drifted back or the view is gone. `media-view.sh status`. |
 | A folder appears in a media server with artwork/`.nfo` but no video | Ghost metadata from a relayout. `media-view.sh reap`. |
 | `verify` prints `refused: …/view is not a mountpoint` | A plain directory is sitting where the overlay belongs. That is the fail-closed guard working; `install` on the box. |

serverAppConfigs-docs/Dankserver/Media Music Relayout.md

@@ -0,0 +1,68 @@
+---
+type: reference
+title: Media Music Relayout
+description: "Re-filing /mnt/entropy/Music by Jellyfin's tag rows: the census, the album key, the refusals."
+tags: [dankserver, media-server, jellyfin, media-relayout]
+timestamp: 2026-10-31T00:00:00Z
+---
+
+# Media Music Relayout
+
+`/mnt/entropy/Music` is rips and discography packs, and Jellyfin has matched and
+tagged almost all of it. `scripts/media-music.py` re-files it into the shape
+Jellyfin's music scanner reads —
+
+    Music/<album artist>/<Album> (<year>)/NN - <Title>.ext
+
+— and the authority is the tag row of the track, never the name the ripper gave
+the file. The shared gates, the executor, the journal law and the rollback live in
+[[Media Relayout]]; this page is the music arm only.
+
+```bash
+# 1. The authority: Jellyfin's audio rows, one per track, with the album and
+#    artist ids its own database carries (the DB opens read-only).
+python3 scripts/media-census.py music --root /mnt/entropy/Music \
+    --out /tmp/music_rows.tsv
+# 2. What is on disk (stat only).
+python3 scripts/media-census.py enumerate --root /mnt/entropy/Music \
+    --out /tmp/music_enum.tsv
+# 3. The plan.
+python3 scripts/media-music.py --root /mnt/entropy/Music --enum /tmp/music_enum.tsv \
+    --rows /tmp/music_rows.tsv --out /tmp/music_plan.tsv \
+    --exceptions /tmp/music_exceptions.txt
+# 4. Read the exceptions file FIRST — it is the review, not a log. Then the same
+#    executor, journal and rollback as [[Media Relayout]] shows, on its own journal.
+scripts/media-apply.py apply --plan /tmp/music_plan.tsv --root /mnt/entropy \
+    --journal /mnt/entropy/media-relayout-music.jsonl --apply
+```
+
+The group is what the tags assert, not where the files sit: **(album-artist tag,
+album, year)**. One album arrives as three disc folders and as two copies of one
+rip, and one MusicBrainz release group is one album. A compilation is one album
+whose tracks name many performers, so it files once under `Various Artists`:
+keying on the performer would file one album once per artist. Two different
+album-artist tags on one album name are two albums, which is what Jellyfin's two
+album items say.
+
+What it refuses:
+
++- **A sidecar is placed by the audio around it, never by its own name.** A
+  `.lrc`, `.txt` or picture that shares a track's stem follows that track and
+  takes the name the track now has, or Jellyfin cannot find it; anything else
+  goes to the album its own folder was placed in, or to the folder whose discs
+  sit one level below it. A folder whose audio belongs to two albums parks its
+  sidecar rather than guessing.
++- **An image album keeps its name.** A folder holding one audio file and a
+  `.cue` is a whole album in one file; numbering it `01 - …` tells Jellyfin to
+  index it as one track.
++- **A video container parks**, because Jellyfin will not index it as music and a
+  rename to `.m4a` would claim it is; **audio no provider row names parks** too,
+  because unmatched audio is a tagging job, not a renaming job.
+
+ONE writer at a time on this array: two rename passes race, and neither journal
+tells. Verify the run against Jellyfin's own tables — see *Proving the move
+landed* in [[Media Relayout]].
+
+## See Also
+
+[[Media Relayout]], [[Jellyfin]], [[Media Audiobook Relayout]]

serverAppConfigs-docs/Dankserver/Media Relayout.md

@@ -1,7 +1,7 @@
 ---
 type: reference
 title: Media Relayout
-description: "Census, plan and apply the movie library into Jellyfin format, and move TV out of it: the gates, refusals, rollback."
+description: "Census, plan and apply the movie, TV, music and audiobook libraries: the gates, the refusals, the rollback."
 tags: [dankserver, media-server, jellyfin, plex, procedure]
 timestamp: 2026-10-30T00:00:00Z
 ---
@@ -12,17 +12,24 @@ The movie library on [[Entropy Volume]] arrived as release folders —
 `Some.Movie.2019.1080p.WiKiTaLx.x265-FOO/` with the video inside named after
 the release. [[Jellyfin]] matches a movie by folder and file name, so the
 release noise cost posters, extras and versions. These scripts turn that
-library into Jellyfin's own shape — and move TV back out of it — and nothing
-else in the repo touches a media file.
+library into the shape its media server reads — the movies, the TV packs, the TV
+that turns up in the movie share, the music library, and the audiobooks, whose
+only reader is Plex — and nothing else in the repo touches a media file.
 
 | Script | Touches media? | Output |
 |---|---|---|
-| `scripts/media-census.py` | reads headers only | `enum`, `probed`, `plex` TSVs |
+| `scripts/media-census.py` | reads headers and the servers' own DBs, never writes | `enum`, `probed`, and one authority TSV per library |
 | `scripts/media-plan.py` | no — TSVs in, TSVs out | the plan + the exception report |
 | `scripts/media-apply.py` | **renames, never copies**; sweeps only what a run emptied | the moves, plus a journal |
 | `scripts/media-tv.py` | no — TSV out | a plan that moves TV into the TV library |
+| `scripts/media-shows.py` | no — TSV out | a plan that re-files the TV library itself |
+| `scripts/media-music.py` | no — TSV out | a plan that re-files the music library by its tags |
+| `scripts/media-audiobooks.py` | no — TSV out | a plan that re-files the audiobooks by the book Plex matched |
+| `scripts/media-verify.py` | no — reads the servers' DBs read-only | the verdict that every journaled move landed |
 
-The seam is `tests/media_relayout.bats`; the target contract is quoted from
+The seams are `tests/media_relayout.bats`, `tests/media_shows.bats`,
+`tests/media_music.bats`, `tests/media_audiobooks.bats` and `tests/media_verify.bats`;
+the movie and TV target contracts are quoted from
 [jellyfin.org/docs/general/server/media/movies](https://jellyfin.org/docs/general/server/media/movies)
 in `media-plan.py`'s docstring.
 
@@ -40,8 +47,10 @@ $C plex      --root /mnt/entropy/Movies --out /tmp/plex-movies.tsv
 ```
 
 `plex` reads the Plex metadata cache (`--db` defaults to the path the
-[[Plex]] container bind-mounts at `/var/lib/plexmediaserver`) with
-`mode=ro&immutable=1`: a live server is never locked or written.
+[[Plex]] container bind-mounts at `/var/lib/plexmediaserver`) with plain
+`mode=ro`: a live server is never locked or written, and plain ro is also what
+makes a scan's uncheckpointed rows visible. The same rule as
+`scripts/media-verify.py` — see *Proving the move landed*.
 
 Then plan — this reads only the three TSVs, so it costs seconds and can run
 anywhere, including a laptop:
@@ -72,41 +81,62 @@ An apply also leaves the release folders it emptied standing where they were —
 hundreds of them at the library root — which is what `sweep` removes, dry-run
 first, from the same journal.
 
-After it lands, both servers need a scan or the change is invisible.
+`--batch N` (default 64) makes the journal durable per batch instead of per
+move: N intents are written and fsynced, then those N rename. The rule a crash
+relies on — no rename runs before its intent is on disk — is unchanged, so an
+interrupted apply still replays the batch and resumes with nothing lost. Batch 1
+is the old behaviour; the only reason to name it is debugging, because on the
+spinning array it spends most of a large apply's wall time in fsyncs.
+
+After it lands, both servers need a scan or the change is invisible. [[Plex]] and
+[[Jellyfin]] own the exact requests; two laws hold at this step: `204` is
+acceptance and anything else queued nothing — re-issue the identical request
+rather than diagnosing — and ONE accepted refresh is the whole procedure, because
+a second while a scan runs moves `Scan Media Library` to `Cancelling` and every
+later `204` is accepted and then discarded.
+
+### Proving the move landed
+
+A scan answers `204` whether or not it finds anything, so proof is the journal
+replayed against both servers' own tables: every `move` row has a row at its
+`dst`, and **zero** rows still name its `src`. `scripts/media-verify.py` is that
+replay: it opens each database read-only (there is no `sqlite3` binary on these
+hosts or inside either container) and exits non-zero while a row is stale.
+
+Both libraries live in WAL mode, so the tool opens them plain `mode=ro`:
+`immutable=1` promises sqlite the file never changes, which skips the
+write-ahead log — a scanner's own uncheckpointed rows then read as missing, and
+a read beside a running scan can fail as "database disk image is malformed".
+`immutable` stays only the fallback for a database whose `-shm` cannot be read.
 
 ```bash
-# Run this from the host shell through `podman exec`, never from a neighbour
-# container: Plex's HTTPD closes without a single byte on any request that
-# arrives from another container's netns (10.89.x.x reads as "empty reply", not
-# as a 401). The token rides stdin, never argv, where any process on the host
-# could read it out of /proc/<pid>/cmdline.
-umask 077
-podman exec plex sh -c "sed -n 's/.*PlexOnlineToken=\"\\([^\"]*\\)\".*/\\1/p' \
-  '/config/Library/Application Support/Plex Media Server/Preferences.xml'" >/tmp/px.tok
-podman exec -i plex sh -c 'read -r T
-  for k in $(curl -s -H "X-Plex-Token: $T" -H "Accept: application/json" \
-      http://127.0.0.1:32400/library/sections | grep -o "\"key\":\"[0-9]*\"" | cut -d\" -f4); do
-    curl -s -o /dev/null -w "plex section $k: %{http_code}\n" -X POST \
-      -H "X-Plex-Token: $T" "http://127.0.0.1:32400/library/sections/$k/refresh"
-  done' </tmp/px.tok
+scripts/media-verify.py --journal /mnt/entropy/media-relayout-music.jsonl \
+    --db-kind jellyfin --ignore-ext jpg,jpeg,png,log,cue,toc,nfo,txt,m3u,accurip
 ```
 
-[[Jellyfin]]'s scan key lives in `~/.config/secrets/jellyfin` (mode 600; the
-same value is `JELLYFIN_API_KEY` in the ignored `dankserver/.env`). It rides a
-mode-600 curl config, never a header argument, and it must use the
-`MediaBrowser` form — Jellyfin 12.4 refuses a bare `X-Emby-Token` for any key:
+"No row at the destination" is not one verdict but four. **never indexed**: the
+server indexes no file of that extension (its own extension census says so) — a
+sidecar, not a lost film. **gone**: the file sits at neither src nor dst, because
+a later pass or the server's own extension sweep renamed it. **phantom**: a row
+still naming src while the file has left src. **REAL**: no row at dst *and* the
+file still at src — the only class that is this relayout's own damage. Phantoms
+are normal for both servers (Plex carries thousands that predate any relayout);
+re-scan to clear them and never read them as loss.
 
-```bash
-umask 077
-{ printf 'header = "Authorization: MediaBrowser Token=\\"%s\\""\n' \
-    "$(cat ~/.config/secrets/jellyfin)"
-  echo 'url = "http://127.0.0.1:8096/Library/Refresh"'
-  echo 'request = "POST"'; } >/tmp/jf.hdr
-curl -s -K /tmp/jf.hdr -o /dev/null -w "jellyfin scan: %{http_code}\n"
-shred -u /tmp/jf.hdr
-```
+`media-verify.py` prints this split itself — `on disk at dst, no row names it`,
+`REAL — file still at src`, `gone — at neither path` — so nobody hand-stats a
+thousand paths to find out whether a film is lost or merely unindexed.
 
-`204` is acceptance; the scan then runs on the server's own schedule.
+The owning server decides whether a pass can convict anything: Plex's roots are
+its `sections` rows joined to their location rows (`Movies`, `TVShows`, `Music`,
+`Audiobooks`, `LiveRecording`) and Jellyfin holds no audiobook library at all, so
+the audiobook journal verifies with `--db-kind plex` or it proves nothing.
+
+Three doors that look right and are not: `GET /search?query=` matches metadata
+titles, never file paths; `?path=` on `/library/sections/N/all` makes Plex's
+HTTPD close without a single byte; and the same HTTPD drops requests that carry
+no `Accept` and client-identifier header (see the scan block above for the form
+that works).
 
 ## TV in the movie library
 
@@ -137,22 +167,187 @@ from the box-set folder. What it refuses it prints and leaves alone:
 - a destination two files both claim: the executor refuses the whole plan
   before its first rename, and only Frank decides which copy is the keeper.
 - an episode the destination library already holds at the same byte count. The
-  movie share carried a second copy of the whole Monk box set — 124 episodes
-  both sides, the same episode list, every byte count identical, 31.5 GiB each
-  way, and head+tail blake2b identical on a 6-episode sample. The mover leaves
-  such a series in place and says so; a duplicate is deleted or kept by Frank,
-  never copied into one library by a tool.
+  movie share once carried a second copy of a whole box set — same episode list,
+  every byte count identical. The mover leaves such a series in place and says
+  so; a duplicate is deleted or kept by Frank, never copied into one library by
+  a tool.
 
 A sidecar that shares an episode's own name (`.srt`, `.nfo`) moves with it.
 
 Below the threshold the mover prints and leaves, so a lone downloaded episode of
-a real show stays in the movie library on purpose — six did on 2026-10-30.
+a real show stays in the movie library on purpose.
 Filing one by hand is the same executor on a hand-written plan and the same
 journal; the trap is the series year. Read it from the file's own name or the
 folder it owns, never from the title whose bonus folder it happens to be parked
 in — `The Cleveland Show S03E07` inside `Die Hard (1988)/extras/` is not a 1988
 show. A name whose marker is `Part 2` is a film and stays put.
 
+## The TV library's own relayout
+
+`/mnt/entropy/TVShows` is scene packs rather than a library, and Jellyfin has
+already matched and numbered most of it. `scripts/media-shows.py` re-files that
+library into the shape Jellyfin reads, with **tvdb as the name authority**:
+
+    <Series> (<year>) [tvdbid-NNNN]/Season NN/
+        <Series> (<year>) - SxxEyy - <Episode Title>.ext
+
+It never guesses: every series name, episode number and title it writes traces to
+an authority, and what has none is parked for a human to read.
+
+```bash
+# 1. The authority: Jellyfin's own matched rows — each carries the series' TMDb
+#    and Tvdb ids and the title the row holds (the DB opens read-only).
+python3 scripts/media-census.py jellyfin --root /mnt/entropy/TVShows \
+    --out /tmp/tv_titles.tsv
+# 2. What is on disk (stat only), and the runtimes the film arm needs.
+python3 scripts/media-census.py enumerate --root /mnt/entropy/TVShows \
+    --out /tmp/tv_enum.tsv
+python3 scripts/media-census.py probe --root /mnt/entropy/TVShows \
+    --enum /tmp/tv_enum.tsv --jobs 6 --out /tmp/tv_probed.tsv
+#    The probe is the slow step: ffprobe reads both ends of every file. So re-use
+#    the last one — a duration belongs to the file, not to its name: re-key the
+#    previous census through that pass's own journal (`src` -> `dst`) instead of
+#    seeking the array again. It is also the only column the film arm reads, and
+#    only for a file with no marker and no provider row (4,794 of 58,551 today,
+#    all of them covered by a re-key that costs seconds, not an hour).
+# 3. The plan. --tmdb needs TMDB_API_KEY — the v3 key in ~/.config/secrets/tmdb,
+#    which travels as the `api_key` query parameter. Only a v4 request token is
+#    accepted as a Bearer header, and the wrong shape answers 401 on EVERY call,
+#    which the summary line flags as NOT provider-complete. --tvdb reads its
+#    `api_key=` line from ~/.config/secrets/tvdb, never argv. Both write the SAME
+#    cache file, so the plan is reproducible offline afterwards: run it once to
+#    fill the cache, and quote the second run.
+#    Paths are only strings to a dry run, so this step can run on the workstation
+#    against scp'd TSVs — which is where the two provider secrets live.
+python3 scripts/media-shows.py --root /mnt/entropy/TVShows --enum /tmp/tv_enum.tsv \
+    --titles /tmp/tv_titles.tsv --probed /tmp/tv_probed.tsv \
+    --tmdb-cache /mnt/entropy/media-tv-names.json --tmdb --tvdb \
+    --park /mnt/entropy/media-park/TVShows \
+    --out /mnt/entropy/media-relayout-shows2-plan.tsv \
+    --exceptions /mnt/entropy/media-relayout-shows2-exceptions.txt
+# 4. Read the exceptions file FIRST — it is the review, not a log. Same executor
+#    as above, but on this arm's OWN journal, NAMED PER PASS: the journal of an
+#    applied pass is its unwind record, so a second pass that reuses the name
+#    destroys the only map back.
+scripts/media-apply.py apply --plan /mnt/entropy/media-relayout-shows2-plan.tsv \
+    --root /mnt/entropy --journal /mnt/entropy/media-relayout-shows2.jsonl --apply
+```
+
+Evidence, strongest first — the order the planner believes things:
+
+- the **episode marker the file's own name states** (`S01E02-E03`, `1x04`); a digit
+  run longer than three at that position is NOT a number — `S03E2019` and
+  `S04E47370355` are one box set's airdate fragment and pack index — so such a file
+  is renumbered by tvdb's title or parks, and is never truncated down to fit;
+- the **`Season NN` folder it sits in and the number its name leads with inside
+  it**: `Season 19/01 Charles Barkley, Nirvana.avi` is S19E01;
+- the **provider row**: which episode the file IS, and the numbering of a file
+  whose own name says nothing;
+- the **row's tvdb id, else its TMDb id carried through TMDb's external ids, else
+  an exact tvdb name search**: that id names the SERIES FOLDER and supplies the
+  episode title, because a name the server read off a folder is not a show name.
+  The folder CARRIES the id: `[tvdbid-NNNN]` is what Jellyfin's Tvdb agent and
+  Plex's scanner both read, so a show whose title is ambiguous resolves by number
+  instead of by a human guessing which folder is which. The id rides the folder
+  only — a file name gets 180 characters and the episode title needs the room.
+- a **bonus folder** anywhere above the file, or Jellyfin's `ExtraType` → the
+  series' canonical extra folder;
+- a runtime over `SHORT_MAX` makes it film-shaped, and it leaves for `--movies` only
+  when the movie provider's title is a run of words the FILE itself states and its
+  year agrees with the file's: the query is only what `title_of` salvaged from a
+  release name, and the first hit for a short one is a near miss — a 1963 Bond film
+  for the word "russia", *Special Edition I* for a file saying *Edition III*. Else it
+  parks.
+
+Four refusals carry the design: what the planner will NOT do is the point of it.
+
+- **Folders resolve a series; they never invent one.** A folder's words may
+  resolve a file to a series a provider has already named — `(CBB) Tengen Toppa
+  Gurren Lagann - The Complete Series (BD 1080p)` names the registered *Tengen
+  Toppa Gurren Lagann* — but a bonus subfolder is not a show. An early run made
+  `…/03. Extra/01. NCOP/NCOP 01.mkv` into a root series called `01 NCOP`.
+- **A scraped row does not outrank the filesystem.** Jellyfin numbers
+  multi-season packs badly: every file under `SNL 16-20/Season 16..19` carries
+  season 16 episode 20, and one Gundam row says season 2004. The folder, then
+  the file's own leading number, win.
+- **A season that is a YEAR is the date matcher, not a season.** Jellyfin files
+  specials by airdate, so a row can arrive saying `season 2002`; that is not a
+  season and it never becomes a folder. The one authority on such a row is tvdb's
+  episode list read backwards: the title the row carries names the (season,
+  episode) tvdb gives it. A title tvdb gives to two episodes names nothing, and
+  the file parks with the reason it always carried. `Season 00` IS a legal
+  season — specials live there — so a row that really says 0 files there instead
+  of parking.
+- **A season tvdb's own list contradicts gets no tvdb title.** An anime pack
+  numbered by its release group books `S05E01` in a season tvdb does not hold, or
+  books more episodes there than tvdb lists: the slot its number points at is a
+  different episode, and dressing it in that episode's title is a confident lie.
+  The file still renames to the standard shape; the title does not ride, and the
+  series is listed under *seasons whose numbering tvdb contradicts* in the
+  exceptions. A season holding FEWER files than tvdb lists stays plausible — a
+  partial pack is the normal shape. Neither reading holds for a list tvdb
+  cut off at its own page limit: the default episode query answers at most
+  500 rows and states no total, and One Piece, Crayon Shin-chan and
+  Detective Conan each answer exactly 500 while holding over a thousand —
+  a page bounds nothing above itself, so it contradicts nothing.
+
+**A provider name is evidence only when an id backs it.** Jellyfin names a Series
+after the folder it scanned, so a library filed by release folders ends up with
+one Series item per box set — `24 (2001) Season 1`, `Modern Family S05` — and
+copying those names verbatim launders folder junk into the contract. The planner
+resolves each series to its tvdb id and writes tvdb's name and year; the merged
+identity is also what turns a box set split across five release folders into ONE
+folder, and what makes two files claiming one episode MEET in the duplicate rule.
+A series no id resolves keeps the provider's words and is listed under *no tvdb
+identity* in the exceptions — that list, not a rename, is the review.
+
+**The review pile lives outside the library.** Files parked inside
+`/mnt/entropy/TVShows` were indexed as one show named `_unsorted`, and that
+show's rows then looked like evidence. So a row whose series is the hidden
+top-level folder the file itself sits in is dropped — and the folder is matched
+with its leading underscore stripped, because the server *displays* `_unsorted` as
+`unsorted`: compare the spelled names and the pile survives the relayout as a
+visible series folder that real files get renamed into. `--park` outside the root
+makes the next plan re-file the pile instead of skipping it. Inside a hidden
+top-level folder a file's own words may MATCH a registered show, never invent one.
+
+**The operator's id map is the door for a name tvdb cannot be searched by.**
+`scripts/media-shows.py` reads `scripts/media-shows-tvdb-ids.tsv` by default: one
+line per pack folder, `folder <TAB> tvdb id <TAB> note`. The file exists because
+tvdb titles a record in the show's own language and the English name rides in
+*aliases* the name search never reads: `ブラッククローバー` (331753) answers to no
+spelling of "Black Clover", and the bare alias `One Piece` belongs to 392276, the
+2023 live action, not to the 1999 record (81797) the pack here is. The map
+outranks a provider id — a box set's provider id is the server's own guess at a
+folder name — and it merges the release folders that are one show. Everything it
+touched is written to the exceptions: every folder it named, every row that
+matched no folder, every disagreement with a provider id, every id tvdb never
+answered. A line whose id is not a number stops the plan, because a typo renames
+a whole pack to the wrong show. Only folders the search CANNOT reach belong in
+it; a row for a folder the search would resolve hides a live lookup behind a
+number nobody re-checks.
+
+`scripts/media-shows-tvdb.py` makes the sheet the map is built from. It reads a
+plan's `mkdir` rows, asks tvdb about every destination folder carrying no
+`[tvdbid-`, and writes one row per folder with the verdict that says how much was
+guessed to get there: `EXACT` (tvdb's own spelling), `PUNCT` (equal only after
+release junk is stripped from the folder's words), `NEAR` (tvdb answered
+something else — the best hit is printed for a human and nothing applies it),
+`NONE`. Acceptance never moved across the passes that built this: a hit counts
+only when tvdb's name equals the query with every non-alphanumeric dropped from
+both sides, and the record's year still has to fall inside any year span the
+folder names. That gate is what caught three confident picks — Fairy Tail's 2024
+sequel (410031), the 2026 Hokuto no Ken remake (465216) and `Mugyutto! Black
+Clover` (378762) offered for Black Clover. It is why the map is approved by hand
+and the sheet is never fed to the planner.
+
+## The music and audiobook arms
+
+Each is a page of its own, because each reads a different authority and refuses
+for a different reason: [[Media Music Relayout]] files by Jellyfin's track tags,
+[[Media Audiobook Relayout]] by Plex's chapter rows. Both share this page's
+executor, the one-journal-per-arm law, the sweep and the rollback.
+
 ## Laws
 
 - **A moved file is a 404 in [[Plex]] until its section is rescanned.** The
@@ -192,19 +387,6 @@ show. A name whose marker is `Part 2` is a film and stays put.
   free space, and `rename(2)` refuses it anyway. Trash goes beside the item —
   `/mnt/entropy/.AGENTTRASH/<date>-<topic>/` — so it costs one inode change and
   rolls back exactly like the move that made it.
-- **A Jellyfin 401 is the header, not the key.** 12.4 authenticates only
-  `Authorization: MediaBrowser Token="…"` and refuses a bare `X-Emby-Token` for
-  every key, valid or not. This page carried "no credential on this box can
-  trigger a scan, the two Seerr keys answer 401" for weeks because of that
-  header — the keys were innocent. Before believing a 401, prove the key against
-  the server's own table: `select count(*) from ApiKeys where AccessToken = ?`
-  on `jellyfin.db` opened `mode=ro&immutable=1`.
-- **A scan that must see a new folder has to be recursive.** `POST
-  /Library/Refresh` is the incremental pass, and inotify does not cross a
-  rootless podman bind, so folders created on the host stay invisible to it. The
-  move is `POST /Items/{id}/Refresh?Recursive=true` (204) per library, the id
-  from `GET /Library/VirtualFolders` — its field is `ItemId`, not `Id` — and
-  that same record's `RefreshStatus` is the progress read.
 - **A file whose name carries no words is bonus material, not a folder.**
   `.Extra 1 ( 1H 27min multisub ).mkv` parses to `1`; a movie folder named `1`
   is not a movie. It becomes a review line telling a human to name the file.
@@ -233,16 +415,15 @@ show. A name whose marker is `Part 2` is a film and stays put.
   recreates the folder, so the sweep is undone by the same command as the moves.
   Proof carries downward: inside a folder the journal proves emptied, every
   empty directory goes with it. A release's `Screens/` or `Sample/` is never a
-  move source itself, so 146 of them held their emptied parents on disk after
-  the first sweep.
+  move source itself, so it can hold an emptied parent until the next sweep.
   A failed `rmdir` is not a removal: only a folder that is really gone leaves
   scope, so the next sweep finishes what a permission problem stopped.
 - **An episode-shaped name marks a SERIES, not a film — and the series is the
   name BEFORE the marker.** `Monk - S05E03 - Mr. Monk and the Big Game` is series
-  `Monk`. Keyed on the whole title instead, every episode became a group of one
-  and never reached the five-episode size that calls something a series, so a
-  box set was filed as 124 movies in 124 folders. The threshold still earns its
-  keep: a lone film named `Part 2` stays a film. Episodes of a series are parked
+  `Monk`. Keyed on the whole title instead, every episode became a group of one,
+  never reaching the five-episode size that calls something a series — a whole
+  box set filed as one folder per episode. The threshold still earns its keep:
+  a lone film named `Part 2` stays a film. Episodes of a series are parked
   in `_TV needs a TV library - <series>` for a human to move to a TV source —
   the movie tool never files TV.
 - **One journal is one undo.** The TV move runs on its own journal, and with
@@ -253,14 +434,29 @@ show. A name whose marker is `Part 2` is a film and stays put.
 - **Sidecar metadata does not follow a rename, because it lives on another
   filesystem.** The media servers write `.nfo` and artwork through the
   [[Media Metadata View]] (NVMe upper layer); this tool moves bytes on the raw
-  array path. After any sweep or TV move, run `scripts/media-view.sh reap`, then
-  the same command with `--apply`: the sidecars left at the old coordinates become
-  ghost folders — artwork and an `.nfo` with no video — that both servers browse
-  and report as content.
+  array path, so where that view is mounted a sweep or a move must be followed by
+  `scripts/media-view.sh reap --apply` — stranded sidecars become ghost folders
+  that both servers browse and report as content. Whether this host mounts the
+  view at all is stated on that page; `media-apply.py` stays silent when it does not.
 - **Nothing deletes through the metadata view.** A delete there writes an overlayfs
   whiteout in the upper layer, which hides the array's copy without removing it;
   the file returns when the view is unmounted. Deletions in this pipeline happen
   on the raw path only, which is what the journal can undo.
+- **The music album key is case-folded; the folder name is not.** `Master Of
+  Puppets` and `Master of Puppets` are one album to the matcher, so the spelling
+  that reaches the folder is the one most tracks carry. Taking it from whichever
+  row sorted first made the folder name depend on row order, and re-planning an
+  already-filed library renamed albums that were already in place.
+- **An occupied path is never a destination**, not even when its occupant is
+  scheduled to leave: the executor refuses an occupied target, so a plan that
+  aims at one fails after the renames that were supposed to clear it. A file
+  standing where the contract puts it is a keep, and a file already carrying a
+  collision suffix keeps that suffix — otherwise the plan is a shuffle, not a
+  fixed point, and a re-run moves albums that are already right.
+- **`media-census.py music` reads the `BaseItemProviders` table, not the item's
+  JSON.** This Jellyfin build carries an empty `ProviderIds` inside
+  `BaseItems.Data` for albums, so a census that parses the JSON finds no
+  MusicBrainz or Spotify id on any album and reads as "the library is untagged".
 
 ## Rollback
 
@@ -270,6 +466,14 @@ any folder a sweep removed, restores every source path, removes only the folders
 that run created *and that are now empty*, and refuses everything if any moved
 file cannot be accounted for. A rolled-back journal refuses to roll back twice.
 
+**Roll a chain back newest journal first, or the tool refuses.** Each pass
+re-files what an earlier one moved, so a journal is a clean inverse only until
+something downstream touches its files; `ls -l /mnt/entropy/media-relayout*.jsonl`
+is the order. Refusing is the tool working: on 2026-10-31 the movie journal could
+not restore files the later TV passes had re-filed, and the stray journal could
+not restore files Jellyfin's extension sweep had renamed. Roll back what still
+inverts and leave the rest as the current state — never force it.
+
 ## See Also
 
 [[Jellyfin]], [[Plex]], [[Media Metadata View]], [[Entropy Volume]], [[Testing Policy]], [[Storage Policy]]

serverAppConfigs-docs/Dankserver/Plex.md

@@ -27,7 +27,7 @@ public traffic can be fronted by Caddy like every other vhost.
 | Runtime | podman quadlet, `plex.service` (user manager) — migrated from the native `plexmediaserver.service` OS-package unit (2026-09) |
 | Image | `lscr.io/linuxserver/plex:1.43.5.11029-6bf8af3f0-ls329` (pinned; verified == the registry's `latest` manifest digest at pin time: `sha256:8f655bad…e9e2334`) |
 | Data root | `/var/lib/plexmediaserver` bind-mounted **in place** as `/config` (RW) — the migration moved zero bytes |
-| Media | `/var/lib/media-meta/view` (the [[Media Metadata View]] overlay) bound at the same absolute path `/mnt/entropy` **read-only** — every library path in the PMS database stayed valid, zero re-scan |
+| Media | git: `/var/lib/media-meta/view` (the [[Media Metadata View]] overlay) bound at the same absolute path `/mnt/entropy` **read-only**; live today: `/mnt/entropy` itself, read-only — the view has never been installed. Either way every library path in the PMS database stays valid, zero re-scan |
 | Identity | fleet rootless model — container root maps to the `dank` user (1000:1000); the deployer chowns the data root on first cutover |
 | Port | `32400/tcp` published on `0.0.0.0` — zero client reconfiguration |
 | Network | `dankserver_appnet`, alias `plex`; Tautulli reaches it at `http://plex:32400` |
@@ -40,7 +40,8 @@ public traffic can be fronted by Caddy like every other vhost.
 The migration moved zero bytes: the container bind-mounts the native data
 root where it already lived, and the media archive re-mounts at
 `/mnt/entropy` inside the container — only the HOST side of that bind has moved
-(array, then the overlay view), so every absolute library path in the
+(the array today; the overlay view in git has never been deployed), so every
+absolute library path in the
 PMS database keeps resolving. The one metadata change: rootless podman
 cannot map the real host uid 997, so the fleet model applies — container
 root runs as the `dank` user, and the deployer adopts the data root with
@@ -86,3 +87,45 @@ root runs as the `dank` user, and the deployer adopts the data root with
    while the HTTP layer finishes loading; the first boot of a years-old
    library took ~10 minutes (2026-09 cutover). The deployer gate now allows
    600 s before failing; later boots are much faster (warm page cache).
+
+## Triggering a scan
+
+A rename on disk is invisible until the section is rescanned, and a moved file is
+a `Couldn't find the file to stream` 404 until that scan passes it. Run this from
+the host shell through `podman exec`, never from a neighbour container: PMS's
+HTTPD closes without a single byte on any request that arrives from another
+container's netns (10.89.x.x reads as "empty reply", not as a 401). The token
+rides stdin, never argv, where any process on the host could read it out of
+`/proc/<pid>/cmdline`; it lives in `Preferences.xml` inside the RW data bind.
+
+```bash
+umask 077
+podman exec plex sh -c "sed -n 's/.*PlexOnlineToken=\"\\([^\"]*\\)\".*/\\1/p' \
+  '/config/Library/Application Support/Plex Media Server/Preferences.xml'" >/tmp/px.tok
+cat >/tmp/pxscan.sh <<'EOS'
+read -r T
+cfg=$(mktemp)
+mk() { { printf 'header = "X-Plex-Token: %s"\nheader = "Accept: application/json"\n' "$T"
+        printf 'url = "%s"\n' "$1"; } > "$cfg"; }
+mk "http://127.0.0.1:32400/library/sections"
+for k in $(curl -s -K "$cfg" | grep -o '"key":"[0-9]*"' | cut -d\" -f4); do
+  mk "http://127.0.0.1:32400/library/sections/$k/refresh"
+  printf 'request = "POST"\n' >> "$cfg"
+  echo "plex section $k: $(curl -s -o /dev/null -w '%{http_code}' -K "$cfg")"
+done
+shred -u "$cfg"
+EOS
+podman cp /tmp/pxscan.sh plex:/tmp/pxscan.sh
+podman exec -i plex sh /tmp/pxscan.sh </tmp/px.tok
+shred -u /tmp/px.tok
+```
+
+Every section answers `204` — or `200` with a Directory body when
+`Accept: application/json` is sent. Inside the quoted `printf` format a
+backslash-newline is LITERAL, not a continuation, so `mk` writes two `printf`s:
+one glued line and one stray backslash is a config file curl rejects, and the
+failure prints as `option -K: is unknown`, never as a bad config line.
+
+Proof that a rename landed is not a scan response: `scripts/media-verify.py`
+replays the run's journal against the database — the only read that
+distinguishes "not scanned yet" from "gone"; see [[Media Relayout]].

serverAppConfigs-docs/Infrastructure/Pi-hole.md

@@ -77,7 +77,7 @@ Both prerequisites survive the dnsmasq → Pi-hole swap. Do not remove them.
 | Port 53 `bind: permission denied` crash loop after a reboot | sysctl conflict: the value must be 53 at boot, and remember `/etc/sysctl.conf` is applied **after** all of `sysctl.d/`. Redeploy pihole — `deploy_pihole` reinstalls the drop-in, neutralizes conflicting drop-ins, and comments out a stale `/etc/sysctl.conf` line |
 | Single-label name (for example `dankclaw`) answers `127.0.1.1` | The rootless container `/etc/hosts` carries the host entry (`127.0.1.1 <host>`), and FTL serves it. Use the FQDN, or add an `/etc/hosts` entry on the client |
 | Every `franksdank.cloud` name is NXDOMAIN for LAN clients while external names still answer | FTL holds no local records: `getent hosts <name>` on Dankclaw comes back empty → `podman exec pihole pihole restartdns reload` (the 2026-10-19 pitfall under **Records**) |
-| One client gets nothing while every other client is fine | FTL rate-limiting that client: `podman exec pihole grep Rate-limiting /var/log/pihole/FTL.log`. A `10.0.2.x` client address is a pasta container's DNS forwarder, not a machine |
+| One client gets nothing while every other client is fine | FTL rate-limiting that client: `podman exec pihole grep Rate-limiting /var/log/pihole/FTL.log`. A `10.0.2.x` client address is a pasta container's DNS forwarder, not a machine — and **every** rootless container on that host shares the one address, so a single chatty container throttles DNS for all of them (measured 2026-10-31: 8 throttle events in a day, all `10.0.2.100`) |
 
 ## See Also
 

serverAppConfigs-docs/index.md

@@ -48,11 +48,13 @@ is a locator: one row, one clause, no numbers.
 | [[Calibre-Web]] | Calibre-Web is a web application that browses, reads, and downloads eBooks from an existing Calibre library database. |
 | [[Copyparty]] | Copyparty is a lightweight file server and media streamer that runs as a single Python binary. |
 | [[Dankserver Stack]] | Service inventory and routing overview for the media and library host. |
-| [[Entropy Volume]] | The Dankserver entropy volume is a RAID-backed LUKS filesystem mounted at |
-| [[Jellyfin]] | Jellyfin on Dankserver: quadlet unit, overlay metadata view layout, ports, access, hardware-transcode status. |
+| [[Entropy Volume]] | Dankserver's /mnt/entropy volume: the LUKS/array chain, the crypttab + fstab boot path, and the containers bound to it |
+| [[Jellyfin]] | Jellyfin on Dankserver: quadlet unit, overlay metadata view, provider keys, ports, access, transcode status. |
 | [[mariadb]] | The MariaDB backend for RomM: quadlet unit, network alias, env-file secret handling, and the backup path. |
+| [[Media Audiobook Relayout]] | Re-filing /mnt/entropy/Audiobooks by Plex's chapter rows: narrator shelves, no renumbering, the refusals. |
 | [[Media Metadata View]] | The SSD-backed overlay the two media servers read and write: shape, guards, commands, laws, rollback. |
-| [[Media Relayout]] | Census, plan and apply the movie library into Jellyfin format, and move TV out of it: the gates, refusals, rollback. |
+| [[Media Music Relayout]] | Re-filing /mnt/entropy/Music by Jellyfin's tag rows: the census, the album key, the refusals. |
+| [[Media Relayout]] | Census, plan and apply the movie, TV, music and audiobook libraries: the gates, the refusals, the rollback. |
 | [[Plex]] | Plex Media Server is a **containerized media server on Dankserver**: a podman |
 | [[redis]] | The Redis cache and task queue for RomM: quadlet unit, network alias topology, and the backup path. |
 | [[RomM]] | RomM (ROM Manager) is a self-hosted ROM library manager and player. |

tests/.AGENTTRASH/frank_medium_proxy.bats

@@ -1,145 +0,0 @@
-#!/usr/bin/env bats
-# Seam: the frank-medium proxy's routing decisions.
-# The proxy is the only thing between the fleet's clients and the two
-# single-GPU replicas, and its routing rules carry the performance work: spread
-# single-turn requests (batch members, one-shot questions) so both cards prefill
-# in parallel, and pin continuations so an agent loop keeps hitting the replica
-# whose prefix cache holds its context. This seam drives the routing policy
-# directly; the first version of these rules shipped a bug that only appeared on
-# a continuation request, which is exactly the class of mistake a test this
-# cheap should catch.
-
-load helpers
-
-ROUTING="$REPO_ROOT/dankserver/frank-medium/proxy/routing.py"
-PROXY="$REPO_ROOT/dankserver/frank-medium/proxy/affinity-proxy.py"
-
-setup() {
-    DRIVER="$BATS_TEST_TMPDIR/route.py"
-    touch "$DRIVER"
-}
-
-@test "the proxy and its routing policy exist and compile" {
-    [ -f "$ROUTING" ]
-    [ -f "$PROXY" ]
-    python3 -m py_compile "$ROUTING"
-    python3 -m py_compile "$PROXY"
-    # The policy must not drag the HTTP stack in: it is imported by tests and
-    # reasoned about without aiohttp, a network or a GPU.
-    ! grep -q 'import aiohttp' "$ROUTING"
-}
-
-@test "a batch of single-turn requests spreads across both cards" {
-    cat > "$DRIVER" <<PY
-import importlib.util, json, os, sys
-os.environ["ROUTING"] = "adaptive"
-spec = importlib.util.spec_from_file_location("routing", "$ROUTING")
-mod = importlib.util.module_from_spec(spec)
-sys.modules["routing"] = mod
-spec.loader.exec_module(mod)
-class R:
-    remote = "127.0.0.1"
-shared = "shared document " + "y" * 8000
-picks = []
-for i in range(6):
-    text = shared if i % 2 else f"distinct prompt {i} " + "x" * 8000
-    body = json.dumps({"messages": [{"role": "user", "content": text}]}).encode()
-    picks.append(mod.pick(*mod.affinity_key(body, R.remote), [True, True]))
-print(" ".join(str(p) for p in picks))
-PY
-    run python3 "$DRIVER"
-    [ "$status" -eq 0 ]
-    read -r -a picks <<< "$output"
-    used=$(printf '%s\n' "${picks[@]}" | sort -u | wc -l)
-    # Both cards must work on a batch, or one card prefills an entire benchmark
-    # while the other idles.
-    [ "$used" -eq 2 ]
-    # Consecutive members alternate (the counter is advanced only by requests
-    # that are not continuations), including the two that share a document.
-    for ((i = 0; i < 5; i++)); do
-        [ "${picks[i]}" != "${picks[i + 1]}" ]
-    done
-}
-
-@test "a continuation is pinned to the replica that served its prefix" {
-    cat > "$DRIVER" <<PY
-import importlib.util, json, os, sys
-os.environ["ROUTING"] = "adaptive"
-spec = importlib.util.spec_from_file_location("routing", "$ROUTING")
-mod = importlib.util.module_from_spec(spec)
-sys.modules["routing"] = mod
-spec.loader.exec_module(mod)
-class R:
-    remote = "127.0.0.1"
-prefix = "system prompt " + "z" * 8000
-first = json.dumps({"messages": [{"role": "user", "content": prefix + " turn one"}]}).encode()
-start = mod.pick(*mod.affinity_key(first, R.remote), [True, True])
-# Same leading bytes, longer history and a different tail each turn: an agent
-# loop resending its context.
-turns = []
-history = [{"role": "assistant", "content": "ack"}]
-for tail in ("turn two", "turn three", "turn four"):
-    history.append({"role": "user", "content": "question " + tail})
-    body = json.dumps({"messages": [{"role": "user", "content": prefix + " turn one"}] + history}).encode()
-    turns.append(mod.pick(*mod.affinity_key(body, R.remote), [True, True]))
-    history.append({"role": "assistant", "content": "ack again"})
-print(start, " ".join(str(t) for t in turns))
-PY
-    run python3 "$DRIVER"
-    [ "$status" -eq 0 ]
-    read -r -a out <<< "$output"
-    # Every continuation agrees with the first turn's replica: that is where
-    # the prefix cache entry lives.
-    [ "${out[1]}" = "${out[0]}" ]
-    [ "${out[2]}" = "${out[0]}" ]
-    [ "${out[3]}" = "${out[0]}" ]
-}
-
-@test "no routing mode ever picks a replica that is down" {
-    for mode in adaptive affinity roundrobin; do
-        cat > "$DRIVER" <<PY
-import importlib.util, json, os, sys
-os.environ["ROUTING"] = "$mode"
-spec = importlib.util.spec_from_file_location("routing", "$ROUTING")
-mod = importlib.util.module_from_spec(spec)
-sys.modules["routing"] = mod
-spec.loader.exec_module(mod)
-class R:
-    remote = "127.0.0.1"
-body = json.dumps({"messages": [{"role": "user", "content": "x" * 400}]}).encode()
-one_down = mod.pick(*mod.affinity_key(body, R.remote), [False, True])
-both_down = mod.pick(*mod.affinity_key(body, R.remote), [False, False])
-print(one_down, both_down)
-PY
-        run python3 "$DRIVER"
-        [ "$status" -eq 0 ]
-        # Replica 0 down -> replica 1; both down -> -1, and the proxy answers
-        # 503 rather than forwarding into the void.
-        [ "$output" = "1 -1" ]
-    done
-}
-
-@test "affinity is deterministic per prefix, roundrobin is not" {
-    cat > "$DRIVER" <<PY
-import importlib.util, json, os, sys
-os.environ["ROUTING"] = "affinity"
-spec = importlib.util.spec_from_file_location("routing", "$ROUTING")
-mod = importlib.util.module_from_spec(spec)
-sys.modules["routing"] = mod
-spec.loader.exec_module(mod)
-class R:
-    remote = "127.0.0.1"
-def pick(text):
-    body = json.dumps({"messages": [{"role": "user", "content": text}]}).encode()
-    return mod.pick(*mod.affinity_key(body, R.remote), [True, True])
-doc = "d" * 8000
-# Same leading 4 KiB, different tails: affinity keys on the prefix, so both go
-# to one replica. Different documents may hash anywhere — that is the point of
-# hashing — so only the prefix property is asserted.
-print(pick(doc + " a"), pick(doc + " b"))
-PY
-    run python3 "$DRIVER"
-    [ "$status" -eq 0 ]
-    read -r -a aff <<< "$output"
-    [ "${aff[0]}" = "${aff[1]}" ]
-}

tests/.AGENTTRASH/frank_medium_quadlet.bats

@@ -1,164 +0,0 @@
-#!/usr/bin/env bats
-# Seam: the frank-medium service on dankserver.
-# frank-medium became a rootless Quadlet deployment on 2026-09-15 when the
-# vllm-radiance MXFP4 stack replaced the charlie12345/ROCmFPX llama.cpp
-# runtime on the 2x Radeon AI PRO R9700. The intended shape is one
-# tensor-parallel process across both cards (frank-medium.container, kept as
-# the target); it cannot run on this host because RCCL's kernels require PCIe
-# atomics and the second card's chipset path advertises AtomicOpsCap: Routing-.
-# The deployed shape is therefore two single-GPU replicas behind a round-robin
-# proxy, which keeps the fleet contract of one :7770 endpoint. This seam pins
-# the properties that make that work: GPU access on the fixed device indices,
-# the upstream launcher's podman posture, host networking with the fleet's
-# client port and alias, per-replica resource shape, boot persistence, and a
-# deploy handler that moves the unusable TP=2 unit into the trash.
-
-load helpers
-
-UNIT_A="$REPO_ROOT/dankserver/frank-medium/quadlet/frank-medium-a.container"
-UNIT_B="$REPO_ROOT/dankserver/frank-medium/quadlet/frank-medium-b.container"
-UNIT_PROXY="$REPO_ROOT/dankserver/frank-medium/quadlet/frank-medium-proxy.container"
-UNIT_TP2="$REPO_ROOT/dankserver/frank-medium/quadlet/frank-medium.container"
-ENTRYPOINT="$REPO_ROOT/dankserver/frank-medium/radiance-entrypoint.sh"
-HEALTHCHECK="$REPO_ROOT/dankserver/frank-medium/frank-medium-healthcheck.py"
-PROXY="$REPO_ROOT/dankserver/frank-medium/proxy/affinity-proxy.py"
-REMOTE_DEPLOY="$REPO_ROOT/scripts/deploy-remote.sh"
-
-@test "the frank-medium units live under dankserver/frank-medium/quadlet/" {
-    [ -f "$UNIT_A" ]
-    [ -f "$UNIT_B" ]
-    [ -f "$UNIT_PROXY" ]
-}
-
-@test "the TP=2 unit is kept as the documented target, not deleted" {
-    # It becomes runnable again only on a host whose second card sits on an
-    # atomic-capable root port, so the artifact stays in the repo.
-    [ -f "$UNIT_TP2" ]
-    grep -q '^Environment=TP=2$' "$UNIT_TP2"
-}
-
-@test "every frank-medium unit is boot-persistent (WantedBy=default.target)" {
-    # Generated units cannot be enabled on the podman 5.x v1 quadlet
-    # generator; [Install] plus linger is the entire boot-persistence story.
-    for unit in "$UNIT_A" "$UNIT_B" "$UNIT_PROXY"; do
-        grep -q '^WantedBy=default.target$' "$unit"
-    done
-}
-
-@test "every frank-medium unit is self-healing" {
-    for unit in "$UNIT_A" "$UNIT_B" "$UNIT_PROXY"; do
-        grep -q '^Restart=on-failure$' "$unit"
-        grep -q '^RestartSec=' "$unit"
-    done
-}
-
-@test "frank-medium units pin the image tag and never pull at boot" {
-    for unit in "$UNIT_A" "$UNIT_B" "$UNIT_PROXY"; do
-        grep -Eq '^Image=localhost/radiance-vllm:[0-9]+\.[0-9]+\.[0-9]+$' "$unit"
-        grep -q '^Pull=never$' "$unit"
-    done
-}
-
-@test "the replicas each get exactly one GPU on the fixed device index" {
-    grep -q '^AddDevice=/dev/kfd$' "$UNIT_A"
-    grep -q '^AddDevice=/dev/dri$' "$UNIT_A"
-    # One index per replica: ROCR filters first and HIP indexes into the
-    # filtered list, so setting both to the same non-zero value leaves an
-    # empty device set.
-    grep -q '^Environment=HIP_VISIBLE_DEVICES=0$' "$UNIT_A"
-    grep -q '^Environment=HIP_VISIBLE_DEVICES=1$' "$UNIT_B"
-    ! grep -q '^Environment=ROCR_VISIBLE_DEVICES=' "$UNIT_A"
-    ! grep -q '^Environment=ROCR_VISIBLE_DEVICES=' "$UNIT_B"
-}
-
-@test "the replicas run with the upstream launcher's podman posture" {
-    for unit in "$UNIT_A" "$UNIT_B"; do
-        grep -q -- '--privileged' "$unit"
-        grep -q -- '--ipc=host' "$unit"
-        grep -q -- '--security-opt seccomp=unconfined' "$unit"
-        grep -q -- '--network=host' "$unit"
-    done
-}
-
-@test "the replicas serve single-GPU shapes that fit one card" {
-    for unit in "$UNIT_A" "$UNIT_B"; do
-        grep -q '^Environment=TP=1$' "$unit"
-        # 262144 does not fit one card (needs 9.61 GiB of KV, 5.14 available)
-        # and 131072 does not either (5.58 needed vs 5.22 available); 114688
-        # is the largest measured shape that boots.
-        grep -q '^Environment=MAXLEN=114688$' "$unit"
-        # KV_MEM=0 makes vLLM profile this shape: the 2x7551-32624 pin is a
-        # TP=2/262144 measurement and invalid here.
-        grep -q '^Environment=KV_MEM=0$' "$unit"
-        grep -q '^Environment=SNAP=/models/Qwen3.8-27B-Uncensored-MXFP4-awq$' "$unit"
-        grep -q '^Environment=SPEC_METHOD=dflash$' "$unit"
-        grep -q '^Environment=SPEC=7$' "$unit"
-    done
-}
-
-@test "the proxy keeps the fleet endpoint: host-network port 7770, alias frank-medium" {
-    grep -q '^Environment=PORT=7770$' "$UNIT_PROXY"
-    grep -q '^Environment=UPSTREAMS=http://127.0.0.1:7771,http://127.0.0.1:7772$' "$UNIT_PROXY"
-    grep -q -- '--network=host' "$UNIT_PROXY"
-    [ "$(grep -c '^PublishPort=' "$UNIT_PROXY")" -eq 0 ]
-    # The replicas answer as the same served model name, so a client cannot
-    # tell which one served a request.
-    grep -q '^Environment=SERVED_NAMES=frank-medium$' "$UNIT_A"
-    grep -q '^Environment=SERVED_NAMES=frank-medium$' "$UNIT_B"
-    grep -q '^Environment=PORT=7771$' "$UNIT_A"
-    grep -q '^Environment=PORT=7772$' "$UNIT_B"
-}
-
-@test "frank-medium entrypoint is a syntax-clean fork of the upstream launcher" {
-    [ -f "$ENTRYPOINT" ]
-    bash -n "$ENTRYPOINT"
-    grep -q '9735329348ae1c9319f01cbe5f7004ec5f4dba63' "$ENTRYPOINT"
-}
-
-@test "frank-medium healthcheck probes the serving endpoint on its own port" {
-    [ -f "$HEALTHCHECK" ]
-    python3 -m py_compile "$HEALTHCHECK"
-    # One probe serves the replicas, the proxy and the TP=2 target because it
-    # reads PORT instead of hardcoding 7770.
-    grep -q 'os.environ.get("PORT"' "$HEALTHCHECK"
-    for unit in "$UNIT_A" "$UNIT_B" "$UNIT_PROXY"; do
-        grep -q 'frank-medium-healthcheck.py' "$unit"
-        grep -q '^HealthStartPeriod=' "$unit"
-    done
-}
-
-@test "the proxy unit mounts the routing policy and the server" {
-    # The policy lives in its own file so it can be tested without aiohttp;
-    # the server imports it by name from its own directory, so both must be
-    # mounted or the container dies on ModuleNotFoundError at start.
-    grep -q 'proxy/routing.py:/usr/local/bin/routing.py:ro' "$UNIT_PROXY"
-    grep -q 'proxy/affinity-proxy.py:/usr/local/bin/affinity-proxy.py:ro' "$UNIT_PROXY"
-    # Routing behaviour itself is covered by tests/frank_medium_proxy.bats,
-    # which drives the policy directly.
-    [ -f "$REPO_ROOT/tests/frank_medium_proxy.bats" ]
-}
-@test "the deploy handler installs the trio and retires the TP=2 unit" {
-    grep -q 'install_quadlet frank-medium-a dankserver/frank-medium/quadlet frank-medium-a' "$REMOTE_DEPLOY"
-    grep -q 'install_quadlet frank-medium-b dankserver/frank-medium/quadlet frank-medium-b' "$REMOTE_DEPLOY"
-    grep -q 'install_quadlet frank-medium-proxy dankserver/frank-medium/quadlet frank-medium-proxy' "$REMOTE_DEPLOY"
-    grep -q 'systemctl --user restart frank-medium-a.service frank-medium-b.service frank-medium-proxy.service' "$REMOTE_DEPLOY"
-    # The TP=2 unit cannot become healthy on this host; a leftover copy would
-    # leave the generator restarting it forever. It moves to the trash.
-    grep -q 'mv -- "$quadlet_unit_dir/frank-medium.container"' "$REMOTE_DEPLOY"
-    ! grep -qE '(^|[^[:alnum:]_])rm (-[a-zA-Z]+ )?"?\$quadlet_unit_dir/frank-medium' "$REMOTE_DEPLOY"
-}
-
-@test "the deploy handler never tries to enable a generated unit" {
-    ! grep -q 'systemctl --user enable frank-medium' "$REMOTE_DEPLOY"
-}
-
-@test "the deploy handler retires the old root unit without deleting it" {
-    grep -q 'retire_root_llm_medium' "$REMOTE_DEPLOY"
-    grep -q 'systemctl stop frank-medium.service' "$REMOTE_DEPLOY"
-    grep -q 'mv -- /etc/systemd/system/frank-medium.service' "$REMOTE_DEPLOY"
-    ! grep -qE '(^|[^[:alnum:]_])rm (-[a-zA-Z]+ )?/etc/systemd/system/frank-medium' "$REMOTE_DEPLOY"
-}
-
-@test "the deploy handler re-tags the registry image to the localhost alias" {
-    grep -q 'podman tag docker.io/stilldeadcode/vllm-radiance:0.9.3 localhost/radiance-vllm:0.9.3' "$REMOTE_DEPLOY"
-}

tests/array_mount_gate.bats

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# Seam: a container that binds the entropy array must refuse to start until the
+# thing it binds is actually mounted.
+#
+# Live 2026-10-31, Dankserver: the array's systemd mount STARTED eight seconds
+# before the media containers were created, but a rootless quadlet cannot order
+# itself against a SYSTEM mount unit — `RequiresMountsFor=/mnt/entropy` resolves
+# to nothing in the user manager and is simply inert. So podman resolved the bind
+# against the pre-mount directory (which held one stale subdirectory) and both
+# Jellyfin and Plex came up blind: their library root looked empty, Jellyfin
+# logged thousands of `Removing item, Type: "Season"`, and the array sat at 80 %
+# util doing nothing useful until the host went down. A blind bind is not a
+# cosmetic fault — it is a metadata-deleting machine.
+#
+# The measured fix is `ExecStartPre=<repo>/scripts/wait-for-mount.sh <source>`:
+# it WAITS for the mount and then refuses, so `Restart=always` carries the unit
+# across a slow mount. A `ConditionPathIsMountPoint=` was measured on the same
+# host and is the wrong tool: an unmet condition logs `skipped, unmet condition
+# check` with NRestarts=0 and never a start attempt — the unit stays dead until
+# a human starts it. That is fail-dead, not fail-closed.
+#
+# Tests assert only observable behavior of the gate (exit status and the name it
+# refuses by) and the structural law over the quadlets; never the internals.
+
+load helpers
+
+GATE="$REPO_ROOT/scripts/wait-for-mount.sh"
+
+@test "the gate accepts a path that really is a mountpoint" {
+    run "$GATE" -t 2 /proc
+    [ "$status" -eq 0 ] || { printf '%s\n' "$output" >&2; return 1; }
+}
+
+@test "a plain directory is refused, and refused BY NAME" {
+    dir="$BATS_TEST_TMPDIR/not-a-mount"
+    mkdir "$dir"
+    run "$GATE" -t 1 "$dir"
+    [ "$status" -ne 0 ] || { printf 'accepted a plain directory\n' >&2; return 1; }
+    [[ "$output" == *"$dir"* ]] || { printf 'refusal did not name the path: %s\n' "$output" >&2; return 1; }
+}
+
+@test "a path that does not exist is refused by name" {
+    run "$GATE" -t 1 "$BATS_TEST_TMPDIR/does/not/exist"
+    [ "$status" -ne 0 ]
+    [[ "$output" == *"$BATS_TEST_TMPDIR/does/not/exist"* ]]
+}
+
+@test "the gate holds the deadline instead of deciding on one look" {
+    # A single check that failed at the wrong instant is the boot race itself:
+    # the mount lands a second later and the unit is dead anyway. So the window
+    # must be spent waiting, and that is observable from outside as elapsed time.
+    dir="$BATS_TEST_TMPDIR/never"
+    mkdir "$dir"
+    start=$SECONDS
+    run "$GATE" -t 4 "$dir"
+    elapsed=$((SECONDS - start))
+    [ "$status" -ne 0 ]
+    [ "$elapsed" -ge 4 ] || { printf 'gave up after %ss, window was 4s\n' "$elapsed" >&2; return 1; }
+}
+
+@test "the gate accepts a mount that arrives during its window" {
+    dir="$BATS_TEST_TMPDIR/later"
+    mkdir "$dir"
+    if ! mount --bind /proc "$dir" 2>/dev/null; then
+        skip "creating a mount needs privileges this box does not grant"
+    fi
+    run "$GATE" -t 4 "$dir"
+    umount "$dir" 2>/dev/null || sudo -n umount "$dir" 2>/dev/null || true
+    [ "$status" -eq 0 ] || { printf 'gate did not wait for a mount that arrived: %s\n' "$output" >&2; return 1; }
+}
+
+@test "no unit without the gate binds the array or the metadata view" {
+    bad=""
+    while IFS= read -r unit; do
+        sources=$(sed -n 's/^Volume=\([^:]*\):.*/\1/p' "$unit" \
+            | grep -E '^(/mnt/entropy|/var/lib/media-meta/view)$' | sort -u)
+        [ -n "$sources" ] || continue
+        for src in $sources; do
+            grep -q "ExecStartPre=.*wait-for-mount.sh.* $src\b" "$unit" \
+                || bad="$bad$unit binds $src with no start gate"$'\n'
+        done
+    done < <(find "$REPO_ROOT"/dankserver "$REPO_ROOT"/dankclaw "$REPO_ROOT"/frankbook-pro \
+                 -path '*/quadlet/*.container' -not -path '*.AGENTTRASH*')
+    [ -z "$bad" ] || { printf 'blind binds:\n%s' "$bad" >&2; return 1; }
+}
+
+@test "no gated unit keeps the fail-dead ConditionPathIsMountPoint" {
+    bad=""
+    while IFS= read -r unit; do
+        grep -q "wait-for-mount.sh" "$unit" || continue
+        grep -q "ConditionPathIsMountPoint" "$unit" \
+            && bad="$bad$unit: a gate and an unmet-condition skip cannot coexist"$'\n'
+    done < <(find "$REPO_ROOT"/dankserver "$REPO_ROOT"/dankclaw "$REPO_ROOT"/frankbook-pro \
+                 -path '*/quadlet/*.container' -not -path '*.AGENTTRASH*')
+    [ -z "$bad" ] || { printf 'fail-dead conditions:\n%s' "$bad" >&2; return 1; }
+}

tests/dankserver_quadlet.bats

@@ -106,3 +106,24 @@ load helpers
     # env file, not an Environment= line.
     ! grep -qE '^Environment=CUSTOM_(USER|PASSWORD)=' "$unit" || return 1
 }
+
+@test "a quadlet that asks for an I/O share ships the host permission that makes it real" {
+    # IOWeight= is silently inert unless the system manager both enables io for
+    # user.slice and delegates it to the user manager: systemd drops a resource
+    # line it cannot honour without a word and the container still starts healthy.
+    # So an in-repo weight is only honest together with both drop-ins AND with a
+    # deployer that places them. Measured 2026-10-31; verification chain in
+    # Architecture/Quadlet Lifecycle 4b.
+    if grep -lq '^IOWeight=' "$REPO_ROOT"/dankserver/*/quadlet/*.container; then
+        asked=1
+    else
+        skip "no dankserver quadlet asks for an I/O share"
+    fi
+    grep -q '^IOAccounting=yes$' \
+        "$REPO_ROOT/dankserver/host/systemd/user.slice.d/io-accounting.conf" || return 1
+    grep -q '^DelegateControllers=.* io' \
+        "$REPO_ROOT/dankserver/host/systemd/user@1000.service.d/io-delegate.conf" || return 1
+    for f in user.slice.d/io-accounting.conf 'user@1000.service.d/io-delegate.conf'; do
+        grep -q "dankserver/host/systemd/$f" "$REPO_ROOT/scripts/deploy-remote.sh" || return 1
+    done
+}

tests/jellyfin_providers.bats

@@ -0,0 +1,297 @@
+#!/usr/bin/env bats
+# Seam: scripts/jellyfin-providers.sh — the only mechanism that puts a
+# metadata-provider key into Jellyfin's plugin configuration on Dankserver.
+#
+# Output vocabulary the tests depend on:
+#   "+ <action>"    something this run will change
+#   "= <fact>"      something already true, so nothing changes
+#
+# The contracts, in the order the seam tests them:
+#   1. plan reports every action and never prints a key;
+#   2. a secret file that is not mode 600 is refused by name and nothing is
+#      written — a key readable by other users is an error, not a warning;
+#   3. a downloaded plugin artifact is accepted only on its pinned sha256, its
+#      official guid and its pinned version (a swapped or downgraded artifact
+#      is refused before anything lands in plugins/);
+#   4. the TMDb key is written into the EXISTING config with every other
+#      setting preserved — Jellyfin owns that file, and clobbering it would
+#      silently reset country, language and adult settings;
+#   5. a TVDB config the operator already saved through the UI is kept;
+#   6. install is idempotent: a second run changes no byte;
+#   7. whatever is replaced is copied to the trash first (fleet law: never
+#      overwrite without a recoverable copy);
+#   8. verify answers whether the endpoint is configured, key LENGTH only;
+#   9. no plugin configuration XML is tracked in git, the deployer places the
+#      keys BEFORE it restarts Jellyfin, and the planner routes a change to this
+#      installer to jellyfin.
+
+load helpers
+
+PROV="$REPO_ROOT/scripts/jellyfin-providers.sh"
+TMDB_KEY="tmdbk3a9Zq7Rtestkey"
+TVDB_KEY="tvdbk8b2Wt4Ptestkey"
+GUID_OFFICIAL="a677c0da-fac5-4cde-941a-7134223f14c8"
+
+# make_plugin <file> <guid> <version> — a zip shaped like the official TheTVDB
+# artifact (meta.json + its two DLLs), so extraction is exercised for real.
+make_plugin() {
+    python3 - "$1" "$2" "$3" <<'PYEOF'
+import json, sys, zipfile
+path, guid, version = sys.argv[1], sys.argv[2], sys.argv[3]
+meta = {
+    "category": "MoviesAndShows",
+    "guid": guid,
+    "name": "TheTVDB",
+    "owner": "jellyfin",
+    "targetAbi": "12.0.0.0",
+    "version": version,
+}
+with zipfile.ZipFile(path, "w") as z:
+    z.writestr("meta.json", json.dumps(meta))
+    z.writestr("Jellyfin.Plugin.Tvdb.dll", "dll-bytes")
+    z.writestr("Tvdb.Sdk.dll", "dll-bytes")
+PYEOF
+    sha256sum "$1" | cut -d' ' -f1
+}
+
+setup() {
+    JF="$BATS_TEST_TMPDIR/jf"
+    TRASH="$BATS_TEST_TMPDIR/trash"
+    SEC="$BATS_TEST_TMPDIR/secrets"
+    mkdir -p "$JF/plugins/configurations" "$TRASH" "$SEC"
+    cat >"$JF/plugins/configurations/Jellyfin.Plugin.Tmdb.xml" <<XML
+<?xml version="1.0" encoding="utf-8"?>
+<Configuration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+  <MetadataCountryCode>US</MetadataCountryCode>
+  <PreferOriginalLanguage />
+  <Language>en</Language>
+  <EnableCinematicForTrailers>false</EnableCinematicForTrailers>
+  <IncludeAdult>false</IncludeAdult>
+  <MaxCastMembers>25</MaxCastMembers>
+  <AddGenresFromKeywords>true</AddGenresFromKeywords>
+  <TmdbApiKey />
+</Configuration>
+XML
+    KEYS="$SEC/provider-keys"
+    printf 'TMDB_API_KEY=%s\nTVDB_API_KEY=%s\n' "$TMDB_KEY" "$TVDB_KEY" >"$KEYS"
+    chmod 600 "$KEYS"
+    ZIP="$BATS_TEST_TMPDIR/thetvdb.zip"
+    PIN_SHA="$(make_plugin "$ZIP" "$GUID_OFFICIAL" 24.0.0.0)"
+    PROV_ENV=(
+        JF_ROOT="$JF"
+        PROV_KEYS="$KEYS"
+        TRASH_DIR="$TRASH"
+        TVDB_PLUGIN_URL="file://$ZIP"
+        TVDB_PLUGIN_SHA256="$PIN_SHA"
+        TVDB_PLUGIN_GUID="$GUID_OFFICIAL"
+        TVDB_PLUGIN_VERSION=24.0.0.0
+    )
+}
+
+prov() { env "${PROV_ENV[@]}" bash "$PROV" "$@"; }
+
+tree_fingerprint() { find "$JF" -type f | sort | xargs -r sha256sum | sha256sum; }
+
+@test "plan names the plugin and both config files, and prints no key" {
+    run prov plan
+    [ "$status" -eq 0 ]
+    printf '%s\n' "${lines[@]}" | grep -q '^+ install thetvdb_24\.0\.0\.0'
+    printf '%s\n' "${lines[@]}" | grep -q '^+ set TmdbApiKey'
+    printf '%s\n' "${lines[@]}" | grep -q '^+ create Jellyfin\.Plugin\.Tvdb\.xml'
+    # The whole point of running this over a shoulder: a key never appears.
+    ! printf '%s\n' "${lines[@]}" | grep -qF "$TMDB_KEY"
+    ! printf '%s\n' "${lines[@]}" | grep -qF "$TVDB_KEY"
+}
+
+@test "plan writes nothing" {
+    before="$(tree_fingerprint)"
+    run prov plan
+    [ "$status" -eq 0 ]
+    [ "$(tree_fingerprint)" = "$before" ]
+}
+
+@test "an already-configured endpoint reports no pending action" {
+    prov install >/dev/null
+    run prov plan
+    [ "$status" -eq 0 ]
+    ! printf '%s\n' "${lines[@]}" | grep -q '^+ '
+    printf '%s\n' "${lines[@]}" | grep -q '= thetvdb_24\.0\.0\.0 already installed'
+    printf '%s\n' "${lines[@]}" | grep -q '= TmdbApiKey already set'
+    printf '%s\n' "${lines[@]}" | grep -q '= Jellyfin\.Plugin\.Tvdb\.xml already has an ApiKey'
+}
+
+@test "a keys file that is not mode 600 is refused and nothing is written" {
+    chmod 644 "$KEYS"
+    before="$(tree_fingerprint)"
+    run prov install
+    [ "$status" -ne 0 ]
+    printf '%s\n' "${lines[@]}" | grep -qF '600'
+    [ "$(tree_fingerprint)" = "$before" ]
+}
+
+@test "a missing TVDB key is refused by name before anything is fetched" {
+    printf 'TMDB_API_KEY=%s\n' "$TMDB_KEY" >"$KEYS"
+    chmod 600 "$KEYS"
+    run prov install
+    [ "$status" -ne 0 ]
+    printf '%s\n' "${lines[@]}" | grep -qF 'TVDB_API_KEY'
+    [ ! -d "$JF/plugins/thetvdb_24.0.0.0" ]
+}
+
+@test "a root with no plugin directory is refused instead of fabricated" {
+    # Creating plugins/ inside a wrong path would install a plugin Jellyfin
+    # never loads, and would hide the operator's typo.
+    run env "${PROV_ENV[@]}" JF_ROOT="$BATS_TEST_TMPDIR/nope" bash "$PROV" install
+    [ "$status" -ne 0 ]
+    [ ! -d "$BATS_TEST_TMPDIR/nope/plugins" ]
+}
+
+@test "an artifact whose sha256 is not the pinned one is refused" {
+    run env "${PROV_ENV[@]}" TVDB_PLUGIN_SHA256="$(printf 'f%.0s' {1..64})" \
+        bash "$PROV" install
+    [ "$status" -ne 0 ]
+    printf '%s\n' "${lines[@]}" | grep -qiF 'sha256'
+    [ ! -d "$JF/plugins/thetvdb_24.0.0.0" ]
+}
+
+@test "an artifact that is not the official TVDB plugin is refused" {
+    # A matching sha proves only that the bytes are the bytes we fetched.
+    EVIL="$BATS_TEST_TMPDIR/evil.zip"
+    EVIL_SHA="$(make_plugin "$EVIL" "deadbeef-0000-0000-0000-000000000000" 24.0.0.0)"
+    run env "${PROV_ENV[@]}" TVDB_PLUGIN_URL="file://$EVIL" TVDB_PLUGIN_SHA256="$EVIL_SHA" \
+        bash "$PROV" install
+    [ "$status" -ne 0 ]
+    printf '%s\n' "${lines[@]}" | grep -qiF 'guid'
+    [ ! -d "$JF/plugins/thetvdb_24.0.0.0" ]
+}
+
+@test "an artifact that is not the pinned version is refused" {
+    OLD="$BATS_TEST_TMPDIR/old.zip"
+    OLD_SHA="$(make_plugin "$OLD" "$GUID_OFFICIAL" 22.0.0.0)"
+    run env "${PROV_ENV[@]}" TVDB_PLUGIN_URL="file://$OLD" TVDB_PLUGIN_SHA256="$OLD_SHA" \
+        bash "$PROV" install
+    [ "$status" -ne 0 ]
+    printf '%s\n' "${lines[@]}" | grep -qiF 'version'
+    [ ! -d "$JF/plugins/thetvdb_24.0.0.0" ]
+}
+
+@test "a different plugin version already in plugins/ is refused, not doubled" {
+    # Two thetvdb_* directories means Jellyfin loads one plugin twice; the
+    # operator removes the old one (into the trash) deliberately, not by an
+    # installer quietly adding a second.
+    prov install >/dev/null
+    OLD="$BATS_TEST_TMPDIR/old.zip"
+    OLD_SHA="$(make_plugin "$OLD" "$GUID_OFFICIAL" 22.0.0.0)"
+    run env "${PROV_ENV[@]}" TVDB_PLUGIN_URL="file://$OLD" TVDB_PLUGIN_SHA256="$OLD_SHA" \
+        TVDB_PLUGIN_VERSION=22.0.0.0 bash "$PROV" install
+    [ "$status" -ne 0 ]
+    printf '%s\n' "${lines[@]}" | grep -qF 'thetvdb_24.0.0.0'
+    [ ! -d "$JF/plugins/thetvdb_22.0.0.0" ]
+}
+
+@test "install places the plugin, keys TMDb, and preserves every other setting" {
+    run prov install
+    [ "$status" -eq 0 ]
+    ! printf '%s\n' "${lines[@]}" | grep -qF "$TMDB_KEY"
+    ! printf '%s\n' "${lines[@]}" | grep -qF "$TVDB_KEY"
+    [ -f "$JF/plugins/thetvdb_24.0.0.0/meta.json" ]
+    [ -f "$JF/plugins/thetvdb_24.0.0.0/Jellyfin.Plugin.Tvdb.dll" ]
+    local cfg="$JF/plugins/configurations/Jellyfin.Plugin.Tmdb.xml"
+    # Jellyfin owns this file: the settings it wrote must survive the edit.
+    for setting in MetadataCountryCode Language IncludeAdult MaxCastMembers AddGenresFromKeywords; do
+        grep -qF "<$setting>" "$cfg" || {
+            echo "lost $setting"
+            return 1
+        }
+    done
+    grep -qF '<IncludeAdult>false</IncludeAdult>' "$cfg"
+    grep -qF "<TmdbApiKey>$TMDB_KEY</TmdbApiKey>" "$cfg"
+    grep -qF "<ApiKey>$TVDB_KEY</ApiKey>" "$JF/plugins/configurations/Jellyfin.Plugin.Tvdb.xml"
+}
+
+@test "a TVDB config the operator saved through the UI is kept" {
+    cat >"$JF/plugins/configurations/Jellyfin.Plugin.Tvdb.xml" <<XML
+<?xml version="1.0" encoding="utf-8"?>
+<Configuration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+  <ApiKey>ui-saved-key</ApiKey>
+  <EnableSeasonPathMatching>true</EnableSeasonPathMatching>
+</Configuration>
+XML
+    run prov install
+    [ "$status" -eq 0 ]
+    printf '%s\n' "${lines[@]}" | grep -qiF 'kept'
+    local cfg="$JF/plugins/configurations/Jellyfin.Plugin.Tvdb.xml"
+    grep -qF '<ApiKey>ui-saved-key</ApiKey>' "$cfg"
+    grep -qF '<EnableSeasonPathMatching>true</EnableSeasonPathMatching>' "$cfg"
+}
+
+@test "a pin in the TVDB secret lands in the plugin config" {
+    # A subscriber-shaped key needs the account's PIN beside it; a licensed key
+    # does not, so the element appears only when the secret carries one.
+    printf 'TMDB_API_KEY=%s\nTVDB_API_KEY=%s\nTVDB_PIN=123456\n' "$TMDB_KEY" "$TVDB_KEY" >"$KEYS"
+    chmod 600 "$KEYS"
+    prov install >/dev/null
+    grep -qF '<Pin>123456</Pin>' "$JF/plugins/configurations/Jellyfin.Plugin.Tvdb.xml"
+}
+
+@test "install is idempotent: a second run changes no byte" {
+    prov install >/dev/null
+    before="$(tree_fingerprint)"
+    run prov install
+    [ "$status" -eq 0 ]
+    [ "$(tree_fingerprint)" = "$before" ]
+    printf '%s\n' "${lines[@]}" | grep -qiF 'no change'
+    # One plugin directory only: two versions in plugins/ means two loads.
+    [ "$(find "$JF/plugins" -maxdepth 1 -type d -name 'thetvdb_*' | wc -l)" -eq 1 ]
+}
+
+@test "what install replaces is copied to the trash first" {
+    prov install >/dev/null
+    # The TMDb config existed before this tool touched it, so the pre-edit copy
+    # must stay recoverable.
+    [ -n "$(find "$TRASH" -name 'Jellyfin.Plugin.Tmdb.xml*' -print -quit)" ]
+    grep -qF '<TmdbApiKey />' "$(find "$TRASH" -name 'Jellyfin.Plugin.Tmdb.xml*' | head -1)"
+}
+
+@test "verify refuses an unconfigured endpoint and names what is missing" {
+    run prov verify
+    [ "$status" -ne 0 ]
+    printf '%s\n' "${lines[@]}" | grep -qiF 'thetvdb'
+    printf '%s\n' "${lines[@]}" | grep -qiF 'TmdbApiKey'
+}
+
+@test "verify passes once the plugin and both keys are in place" {
+    prov install >/dev/null
+    run prov verify
+    [ "$status" -eq 0 ]
+    ! printf '%s\n' "${lines[@]}" | grep -qF "$TMDB_KEY"
+    ! printf '%s\n' "${lines[@]}" | grep -qF "$TVDB_KEY"
+    # Length, not bytes: the operator sees the key loaded without reading it.
+    printf '%s\n' "${lines[@]}" | grep -qE 'TmdbApiKey .*[0-9]+ chars'
+}
+
+@test "no plugin configuration XML is tracked in this repo" {
+    # These files hold provider keys and are owned by the running container;
+    # tracking them would put credentials in git and guarantee drift.
+    run git -C "$REPO_ROOT" ls-files
+    [ "$status" -eq 0 ]
+    ! printf '%s\n' "${lines[@]}" | grep -qF 'plugins/configurations'
+    ! printf '%s\n' "${lines[@]}" | grep -qiF 'Plugin.Tvdb.xml'
+}
+
+@test "the planner routes this installer to jellyfin" {
+    run python3 "$REPO_ROOT/scripts/deploy-plan.py" --target dankserver \
+        --paths scripts/jellyfin-providers.sh
+    [ "$status" -eq 0 ]
+    [ "$output" = "jellyfin" ]
+}
+
+@test "the deployer places the keys before it restarts jellyfin" {
+    # The plugin and both keys are read at start-up, so a restart that runs
+    # ahead of the placement boots the old, keyless state.
+    body="$(sed -n '/^deploy_jellyfin()/,/^\}/p' "$REPO_ROOT/scripts/deploy-remote.sh")"
+    [ -n "$body" ]
+    up="$(printf '%s\n' "$body" | grep -n 'ensure_provider_keys' | head -1 | cut -d: -f1)"
+    restart="$(printf '%s\n' "$body" | grep -n 'systemctl --user restart jellyfin.service' | head -1 | cut -d: -f1)"
+    [ "${up:-999}" -lt "${restart:-0}" ]
+}

tests/media_audiobooks.bats

@@ -0,0 +1,483 @@
+#!/usr/bin/env bats
+# Seam: the audiobook-library relayout — scripts/media-census.py audiobooks (the
+# export of the rows Plex matched) and scripts/media-audiobooks.py (the plan).
+#
+# The audiobook tree is the one library on this box that Jellyfin does not read
+# at all and Plex reads completely: every chapter here is a Plex Track row under
+# an Album row (the BOOK) under one Artist row (the NARRATOR). That is the
+# authority this seam files by — never the collection folder a release pack made.
+#
+# Two laws here are the opposite of the music tool's, and both come from what the
+# rows actually contain. Files are NEVER renumbered: 7,556 of 10,485 books carry
+# at least one chapter whose index Plex does not know, so a `00 -` invented from
+# a missing index would order a book wrong, and playback order comes from the
+# embedded track tag either way — the name buys nothing and can only lie. And the
+# folder artist is the NARRATOR even though a reader thinks in authors: every
+# book has exactly one artist row, while the author survives only in 10% of the
+# album titles (`Kryptos by Graham McNeill`) and in no column Plex stores, so one
+# rule beats a shelf that is half authors and half narrators.
+#
+# Every test states which authority a file has and asserts where the PLAN files
+# it, never how the planner decided.
+
+load helpers
+
+PLAN="$REPO_ROOT/scripts/media-audiobooks.py"
+CENSUS="$REPO_ROOT/scripts/media-census.py"
+APPLY="$REPO_ROOT/scripts/media-apply.py"
+
+# at PATH SIZE — a file with deterministic content.
+at() { mkdir -p "$(dirname "$1")"; head -c "$2" /dev/zero > "$1"; }
+
+# row FILE NARRATOR BOOK YEAR TRACK CHAPTER
+# One row of the authority export scripts/media-census.py audiobooks writes.
+row() {
+    printf '%s\t%s\t%s\t%s\t%s\t%s\n' \
+        "$1" "$2" "$3" "${4:-}" "${5:-}" "$6" >> "$ROWS"
+}
+
+# dst SRC — the destination the plan gives SRC, or nothing when it does not move.
+dst() {
+    awk -F '\t' -v s="$1" '$1 == "move" && $2 == s {print $3}' "$OUT"
+}
+
+# kind SRC — the kind the plan gave SRC's move row.
+kind() {
+    awk -F '\t' -v s="$1" '$1 == "move" && $2 == s {print $4}' "$OUT"
+}
+
+setup() {
+    AB="$BATS_TEST_TMPDIR/Audiobooks"
+    PARK="$AB/_unsorted"
+    ENUM="$BATS_TEST_TMPDIR/enum.tsv"
+    ROWS="$BATS_TEST_TMPDIR/rows.tsv"
+    OUT="$BATS_TEST_TMPDIR/plan.tsv"
+    EXC="$BATS_TEST_TMPDIR/exceptions.txt"
+    # The header is part of the authority export, so the fixture carries it.
+    printf 'file\tnarrator\tbook\tyear\ttrack\tchapter\n' > "$ROWS"
+
+    # One book of one author, split across the two part folders a pack shipped it
+    # in, with a cover above part 1 and a playlist beside the chapters.
+    A="$AB/Stephen King/It (1986)"
+    at "$A [Part 1]/01 - Chapter 1.mp3" 9000
+    at "$A [Part 1]/02 - Chapter 2.mp3" 9000
+    at "$A [Part 1]/cover.jpg" 20
+    at "$A [Part 1]/It.m3u" 30
+    at "$A [Part 2]/03 - Chapter 3.mp3" 9000
+    row "$A [Part 1]/01 - Chapter 1.mp3" "George Guidall" "It" 1986 1 "Chapter 1"
+    row "$A [Part 1]/02 - Chapter 2.mp3" "George Guidall" "It" 1986 2 "Chapter 2"
+    row "$A [Part 2]/03 - Chapter 3.mp3" "George Guidall" "It" 1986 3 "Chapter 3"
+
+    # A book whose album row carries no year at all.
+    B="$AB/Collected/Project Gold"
+    at "$B/01.ogg" 9000
+    row "$B/01.ogg" "Operator X" "Project Gold" "" 1 "Opening"
+
+    # One book title, two narrators: two different books.
+    C="$AB/Shared"
+    at "$C/Dune side a.m4b" 9000
+    at "$C/Dune side b.m4b" 9000
+    at "$C/Dune 2020.m4b" 9000
+    row "$C/Dune side a.m4b" "Scott Brick" "Dune" 1965 1 "Prologue"
+    row "$C/Dune side b.m4b" "Scott Brick" "Dune" 1965 2 "Dune"
+    row "$C/Dune 2020.m4b" "Malcolm Hillgartner" "Dune" 2020 1 "Book One"
+
+    # Two part folders of one book whose chapters share a file name.
+    D="$AB/Pulp"
+    at "$D/Book A/vol1.mp3" 9000
+    at "$D/Book A vol2/vol1.mp3" 9000
+    row "$D/Book A/vol1.mp3" "Nora Pace" "Hard Food" 2001 1 "Vol 1"
+    row "$D/Book A vol2/vol1.mp3" "Nora Pace" "Hard Food" 2001 2 "Vol 1"
+
+    # The same narrator spelled two ways across one book's chapters.
+    E="$AB/Spell"
+    at "$E/kharn 1.mp3" 9000
+    at "$E/kharn 2.mp3" 9000
+    at "$E/kharn 3.mp3" 9000
+    row "$E/kharn 1.mp3" "David Timson" "Kharn" 2013 1 "One"
+    row "$E/kharn 2.mp3" "David timson" "Kharn" 2013 2 "Two"
+    row "$E/kharn 3.mp3" "David Timson" "Kharn" 2013 3 "Three"
+
+    # A folder holding two different books: its loose note has no owner.
+    F="$AB/Mixed"
+    at "$F/book one chapter.mp3" 9000
+    at "$F/book two chapter.mp3" 9000
+    at "$F/notes.txt" 10
+    row "$F/book one chapter.mp3" "Ann Reader" "Book One" 2001 1 "One"
+    row "$F/book two chapter.mp3" "Bob Reader" "Book Two" 2002 1 "Two"
+
+    # A file already parked: the pile is for a human, so a row that would file it
+    # must not pull it back into the tree.
+    at "$PARK/Old/nobody.mp3" 9000
+    row "$PARK/Old/nobody.mp3" "Ann Reader" "Book One" 2001 1 "One"
+
+    # The odd cases: no row, a video container, a name carrying a character Plex
+    # says breaks playback, rows with a blank book and a blank narrator, and a
+    # matched chapter whose file has no extension.
+    G="$AB/Odd"
+    at "$G/loose.mp3" 9000
+    at "$G/concert.mp4" 9000
+    at "$G/Bad: Name/01 chapter.mp3" 9000
+    row "$G/Bad: Name/01 chapter.mp3" "Some Reader" "Trail: Marked" 1999 1 "Marked"
+    at "$G/blank book.mp3" 9000
+    row "$G/blank book.mp3" "Some Reader" "" 2000 1 "No Book"
+    at "$G/blank narrator.mp3" 9000
+    row "$G/blank narrator.mp3" "" "No Artist" 2000 1 "No Artist"
+    at "$G/NoExt/part01" 9000
+    row "$G/NoExt/part01" "Archivist" "Tapes" 1971 1 "Tape One"
+
+    # Tag-scan placeholders. Two unrelated books whose album rows both read
+    # `[Unknown Album]`: the name is shared, so filing on it would merge books
+    # that have nothing to do with each other. A rip timestamp can be glued to
+    # the placeholder, and a multi-cast read says `Various Artists` — which IS a
+    # narrator.
+    H="$AB/Packs"
+    at "$H/Stross/Ship/c1.mp3" 9000
+    at "$H/Leckie/State/c1.mp3" 9000
+    at "$H/Rip/tape.mp3" 9000
+    at "$H/NoWho/Real Book.mp3" 9000
+    at "$H/Multicast/Genesis.mp3" 9000
+    row "$H/Stross/Ship/c1.mp3" "Various Artists" "[Unknown Album]" "" 1 "Part 1"
+    row "$H/Leckie/State/c1.mp3" "Various Artists" "[Unknown Album]" "" 1 "Part 1"
+    row "$H/Rip/tape.mp3" "Ann Reader" "Unknown album (03/03/2015 21:39:55)" "" 1 "One"
+    row "$H/NoWho/Real Book.mp3" "[Unknown Artist]" "A Named Book" 2001 1 "One"
+    row "$H/Multicast/Genesis.mp3" "Various Artists" "The Bible" "" 1 "Genesis"
+    at "$H/Numbered/01 - Grimoire.mp3" 9000
+    at "$H/Digits/1984.mp3" 9000
+    row "$H/Numbered/01 - Grimoire.mp3" "0.4" "Grimoire of the Lamb" "" 1 "One"
+    row "$H/Digits/1984.mp3" "Ann Reader" "1984" 1949 1 "One"
+
+    # The enum TSV is what scripts/media-census.py enumerate writes: bytes, ext,
+    # path, no header.
+    python3 - "$AB" "$ENUM" <<'PY'
+import os, sys
+root, out = sys.argv[1], sys.argv[2]
+with open(out, "w") as fh:
+    for dirpath, _dirs, files in os.walk(root):
+        for fn in files:
+            p = os.path.join(dirpath, fn)
+            fh.write(f"{os.path.getsize(p)}\t{os.path.splitext(fn)[1].lower()}\t{p}\n")
+PY
+}
+
+plan() {
+    run python3 "$PLAN" --root "$AB" --enum "$ENUM" --rows "$ROWS" \
+        --out "$OUT" --exceptions "$EXC"
+    if [ "$status" -ne 0 ]; then
+        echo "planner said: $output"
+        return 1
+    fi
+}
+
+# db_with_part DB FILE NARRATOR BOOK YEAR TRACK CHAPTER — one Plex Track row
+# under an Album under an Artist, in the three tables the export joins.
+db_with_part() {
+    local db="$1" file="$2" narrator="$3" book="$4" year="$5" track="$6" chapter="$7"
+    local del="${8:-0}"
+    python3 - "$db" "$file" "$narrator" "$book" "$year" "$track" "$chapter" "$del" <<'PY'
+import sqlite3, sys
+db, file, narrator, book, year, track, chapter, deleted = sys.argv[1:9]
+c = sqlite3.connect(db)
+c.execute("create table if not exists media_parts (id integer primary key,"
+          " media_item_id, file, deleted_at)")
+c.execute("create table if not exists media_items (id integer primary key,"
+          " metadata_item_id, deleted_at)")
+c.execute("""create table if not exists metadata_items (id integer primary key,
+           parent_id, metadata_type, title, year, "index", deleted_at)""")
+now = None if deleted == "0" else "2026-01-01"
+ar = c.execute("insert into metadata_items (parent_id, metadata_type, title, year,"
+               " \"index\", deleted_at) VALUES (NULL, 8, ?, NULL, NULL, NULL)",
+               (narrator,)).lastrowid
+al = c.execute("insert into metadata_items (parent_id, metadata_type, title, year,"
+               " \"index\", deleted_at) VALUES (?, 9, ?, ?, NULL, NULL)",
+               (ar, book, int(year) if year else None)).lastrowid
+mi = c.execute("insert into metadata_items (parent_id, metadata_type, title, year,"
+               " \"index\", deleted_at) VALUES (?, 10, ?, NULL, ?, NULL)",
+               (al, chapter, int(track) if track else -1)).lastrowid
+it = c.execute("insert into media_items (metadata_item_id, deleted_at) VALUES (?, NULL)",
+               (mi,)).lastrowid
+c.execute("insert into media_parts (media_item_id, file, deleted_at) VALUES (?,?,?)",
+          (it, file, now))
+c.commit()
+PY
+}
+
+# ------------------------------------------------------------------ the export
+
+@test "the census exports the narrator, book and chapter Plex matched for a part" {
+    DB="$BATS_TEST_TMPDIR/plex.db"
+    db_with_part "$DB" "$BATS_TEST_TMPDIR/Audiobooks/Pack/It part 1/01.mp3" \
+        "George Guidall" "It" 1986 1 "Chapter 1"
+    run python3 "$CENSUS" audiobooks --root "$BATS_TEST_TMPDIR/Audiobooks" --db "$DB" \
+        --out "$BATS_TEST_TMPDIR/exp.tsv"
+    [ "$status" -eq 0 ]
+    run head -1 "$BATS_TEST_TMPDIR/exp.tsv"
+    [ "${lines[0]}" = "file	narrator	book	year	track	chapter" ]
+    tail -1 "$BATS_TEST_TMPDIR/exp.tsv" \
+        | grep -q "^$BATS_TEST_TMPDIR/Audiobooks/Pack/It part 1/01\.mp3	George Guidall	It	1986	1	Chapter 1$"
+}
+
+@test "the census exports nothing outside the root, and nothing Plex deleted" {
+    DB="$BATS_TEST_TMPDIR/plex.db"
+    db_with_part "$DB" "/mnt/other/Library/01.mp3" "Someone" "Elsewhere" 1990 1 "One"
+    db_with_part "$DB" "$BATS_TEST_TMPDIR/Audiobooks/Gone/01.mp3" "Someone" \
+        "Deleted" 1990 1 "One" 1
+    run python3 "$CENSUS" audiobooks --root "$BATS_TEST_TMPDIR/Audiobooks" --db "$DB" \
+        --out "$BATS_TEST_TMPDIR/exp.tsv"
+    [ "$status" -eq 0 ]
+    [ "$(wc -l < "$BATS_TEST_TMPDIR/exp.tsv")" -eq 1 ]   # header only
+}
+
+# wal_fresh DB ROOT OUT — a row Plex matched during a scan and committed, but
+# has not checkpointed: the normal state of a library being walked. The holder
+# connection stops the WAL folding into the main file when the writer closes,
+# and the census runs as a real subprocess against those same files.
+wal_fresh() {
+    local db="$1" root="$2" out="$3"
+    python3 - "$db" "$root" "$out" "$CENSUS" <<'PY'
+import sqlite3, subprocess, sys
+db, root, out, census = sys.argv[1:5]
+w = sqlite3.connect(db)
+w.execute("pragma journal_mode=wal")
+w.execute("pragma wal_autocheckpoint=0")
+w.commit()
+w.execute("pragma wal_checkpoint(truncate)")     # the rows so far are on disk
+holder = sqlite3.connect(db)                     # last close would checkpoint
+ar = w.execute('insert into metadata_items (parent_id, metadata_type, title,'
+               ' year, "index", deleted_at) VALUES (NULL, 8, ?, NULL, NULL, NULL)',
+               ("Fresh Narrator",)).lastrowid
+al = w.execute('insert into metadata_items (parent_id, metadata_type, title,'
+               ' year, "index", deleted_at) VALUES (?, 9, ?, ?, NULL, NULL)',
+               (ar, "Fresh Book", 2026)).lastrowid
+mi = w.execute('insert into metadata_items (parent_id, metadata_type, title,'
+               ' year, "index", deleted_at) VALUES (?, 10, ?, NULL, ?, NULL)',
+               (al, "Fresh Chapter", 1)).lastrowid
+it = w.execute("insert into media_items (metadata_item_id, deleted_at)"
+               " VALUES (?, NULL)", (mi,)).lastrowid
+w.execute("insert into media_parts (media_item_id, file, deleted_at)"
+          " VALUES (?, ?, NULL)", (it, root + "/Fresh/01.mp3"))
+w.commit()
+sys.exit(subprocess.run([sys.executable, census, "audiobooks", "--root", root,
+                         "--db", db, "--out", out]).returncode)
+PY
+}
+
+@test "the census exports a row the scanner committed but has not checkpointed" {
+    DB="$BATS_TEST_TMPDIR/plex.db"
+    db_with_part "$DB" "$BATS_TEST_TMPDIR/Audiobooks/Old/01.mp3" \
+        "Old Narrator" "Old Book" 1990 1 "Old Chapter"
+    run wal_fresh "$DB" "$BATS_TEST_TMPDIR/Audiobooks" "$BATS_TEST_TMPDIR/exp.tsv"
+    [ "$status" -eq 0 ]
+    [ "$(wc -l < "$BATS_TEST_TMPDIR/exp.tsv")" -eq 3 ]   # header + both rows
+    tail -1 "$BATS_TEST_TMPDIR/exp.tsv" \
+        | grep -q "^$BATS_TEST_TMPDIR/Audiobooks/Fresh/01\.mp3	Fresh Narrator	Fresh Book	2026	1	Fresh Chapter$"
+}
+
+# -------------------------------------------------------------------- the plan
+
+@test "a matched chapter files under its narrator and its book, name untouched" {
+    plan
+    [ "$(dst "$A [Part 1]/01 - Chapter 1.mp3")" = \
+        "$AB/George Guidall/It (1986)/01 - Chapter 1.mp3" ]
+}
+
+@test "one book arrives in one folder however many part folders it shipped in" {
+    plan
+    [ "$(dst "$A [Part 2]/03 - Chapter 3.mp3")" = \
+        "$AB/George Guidall/It (1986)/03 - Chapter 3.mp3" ]
+    [ "$(dst "$A [Part 1]/02 - Chapter 2.mp3")" = \
+        "$AB/George Guidall/It (1986)/02 - Chapter 2.mp3" ]
+}
+
+@test "a chapter is never renumbered, whether or not Plex knows its index" {
+    # The law this guards: playback order comes from the embedded track tag, and
+    # three quarters of the books have chapters with no index at all, so a
+    # number written into a name would be invented and would lie.
+    plan
+    [ "$(dst "$B/01.ogg")" = "$AB/Operator X/Project Gold/01.ogg" ]
+    [ "$(dst "$A [Part 1]/01 - Chapter 1.mp3")" = \
+        "$AB/George Guidall/It (1986)/01 - Chapter 1.mp3" ]
+}
+
+@test "a book whose album row has no year gets no parentheses" {
+    plan
+    [ "$(dst "$B/01.ogg")" = "$AB/Operator X/Project Gold/01.ogg" ]
+}
+
+@test "two chapters claiming one name inside one book are named apart" {
+    plan
+    first="$(dst "$D/Book A/vol1.mp3")"
+    second="$(dst "$D/Book A vol2/vol1.mp3")"
+    [ "$first" != "$second" ]
+    [ -n "$first" ] && [ -n "$second" ]
+    # and the plan still passes the executor's preflight, which refuses a target
+    # two sources claim.
+    run python3 "$APPLY" apply --plan "$OUT" --root "$AB"
+    [ "$status" -eq 0 ]
+    [[ "$output" != *"double-claim"* ]]
+}
+
+@test "a cover follows the book whose folder it lies in" {
+    plan
+    [ "$(dst "$A [Part 1]/cover.jpg")" = "$AB/George Guidall/It (1986)/cover.jpg" ]
+}
+
+@test "a playlist moves with its book and its bytes are never rewritten" {
+    plan
+    [ "$(dst "$A [Part 1]/It.m3u")" = "$AB/George Guidall/It (1986)/It.m3u" ]
+    before=$(md5sum "$A [Part 1]/It.m3u" | cut -d" " -f1)
+    run python3 "$APPLY" apply --plan "$OUT" --root "$AB" --journal "$BATS_TEST_TMPDIR/j.jsonl" --apply
+    [ "$status" -eq 0 ]
+    [ "$(md5sum "$AB/George Guidall/It (1986)/It.m3u" | cut -d" " -f1)" = "$before" ]
+    # the stored paths inside it still name the old file names, which the tool
+    # leaves alone rather than editing a file the operator owns.
+    [ "$(kind "$A [Part 1]/It.m3u")" != "chapter" ]
+}
+
+@test "a note in a folder holding two books has no owner and parks" {
+    plan
+    [ "$(kind "$F/notes.txt")" = "park" ]
+    [ "$(dst "$F/notes.txt")" = "$PARK/Mixed/notes.txt" ]
+}
+
+@test "an audio file no row names parks with the path it has today" {
+    plan
+    [ "$(kind "$G/loose.mp3")" = "park" ]
+    [ "$(dst "$G/loose.mp3")" = "$PARK/Odd/loose.mp3" ]
+}
+
+@test "a video container parks instead of being renamed into audio" {
+    plan
+    [ "$(kind "$G/concert.mp4")" = "park" ]
+    run grep -c "concert\.mp4" "$EXC"
+    [ "$output" != "0" ]
+}
+
+@test "a character Plex says breaks playback never reaches a destination" {
+    plan
+    [ "$(dst "$G/Bad: Name/01 chapter.mp3")" = \
+        "$AB/Some Reader/Trail Marked (1999)/01 chapter.mp3" ]
+    run cut -f3 "$OUT"
+    [[ "$output" != *":"* ]]
+}
+
+@test "one book title with two narrators stays two books" {
+    plan
+    [ "$(dst "$C/Dune side a.m4b")" = "$AB/Scott Brick/Dune (1965)/Dune side a.m4b" ]
+    [ "$(dst "$C/Dune 2020.m4b")" = \
+        "$AB/Malcolm Hillgartner/Dune (2020)/Dune 2020.m4b" ]
+}
+
+@test "the spelling most chapters carry names the folder, and they share one folder" {
+    plan
+    [ "$(dst "$E/kharn 1.mp3")" = "$AB/David Timson/Kharn (2013)/kharn 1.mp3" ]
+    [ "$(dst "$E/kharn 2.mp3")" = "$AB/David Timson/Kharn (2013)/kharn 2.mp3" ]
+    [ "$(dst "$E/kharn 3.mp3")" = "$AB/David Timson/Kharn (2013)/kharn 3.mp3" ]
+}
+
+@test "a row with no book title parks rather than inventing a folder" {
+    plan
+    [ "$(kind "$G/blank book.mp3")" = "park" ]
+}
+
+@test "a row with no narrator parks rather than inventing a shelf" {
+    plan
+    [ "$(kind "$G/blank narrator.mp3")" = "park" ]
+}
+
+@test "books that share a placeholder album name never share a shelf" {
+    plan
+    [ "$(dst "$H/Stross/Ship/c1.mp3")" = "$PARK/Packs/Stross/Ship/c1.mp3" ]
+    [ "$(dst "$H/Leckie/State/c1.mp3")" = "$PARK/Packs/Leckie/State/c1.mp3" ]
+}
+
+@test "a placeholder with a rip timestamp glued to it is still a placeholder" {
+    plan
+    [ "$(kind "$H/Rip/tape.mp3")" = "park" ]
+}
+
+@test "a narrator placeholder parks even when the book is named" {
+    plan
+    [ "$(kind "$H/NoWho/Real Book.mp3")" = "park" ]
+}
+
+@test "Various Artists is a multi-cast narrator and files its book" {
+    plan
+    [ "$(dst "$H/Multicast/Genesis.mp3")" = \
+        "$AB/Various Artists/The Bible/Genesis.mp3" ]
+}
+
+@test "a chapter number mistagged as the narrator parks" {
+    plan
+    [ "$(kind "$H/Numbered/01 - Grimoire.mp3")" = "park" ]
+}
+
+@test "a book whose title is digits still files, because only a name must have a letter" {
+    plan
+    [ "$(dst "$H/Digits/1984.mp3")" = "$AB/Ann Reader/1984 (1949)/1984.mp3" ]
+}
+
+@test "the row, not the extension, decides what a chapter is" {
+    plan
+    [ "$(kind "$G/NoExt/part01")" = "chapter" ]
+    [ "$(dst "$G/NoExt/part01")" = "$AB/Archivist/Tapes (1971)/part01" ]
+}
+
+@test "the plan replays through the executor with nothing refused" {
+    plan
+    run python3 "$APPLY" apply --plan "$OUT" --root "$AB" \
+        --journal "$BATS_TEST_TMPDIR/journal.jsonl"
+    [ "$status" -eq 0 ]
+    [[ "$output" != *"refusing"* ]]
+    # The refusal this guards is two sources claiming one target: the executor
+    # stops the whole run on it, so the plan must never hand a path out twice.
+    [ -z "$(awk -F '\t' '$1 == "move" {print $3}' "$OUT" | sort | uniq -d)" ]
+}
+
+@test "an occupied destination is refused rather than overwritten" {
+    plan
+    mkdir -p "$AB/George Guidall/It (1986)"
+    at "$AB/George Guidall/It (1986)/01 - Chapter 1.mp3" 1
+    run python3 "$APPLY" apply --plan "$OUT" --root "$AB"
+    [ "$status" -ne 0 ]
+    [[ "$output" == *"occupied"* ]]
+    [ -e "$A [Part 1]/01 - Chapter 1.mp3" ]
+}
+
+@test "applying the plan and re-planning moves nothing" {
+    plan
+    run python3 "$APPLY" apply --plan "$OUT" --root "$AB" \
+        --journal "$BATS_TEST_TMPDIR/j.jsonl" --apply
+    [ "$status" -eq 0 ]
+    python3 - "$AB" "$ENUM" <<'PY'
+import os, sys
+root, out = sys.argv[1], sys.argv[2]
+with open(out, "w") as fh:
+    for dirpath, _dirs, files in os.walk(root):
+        for fn in files:
+            p = os.path.join(dirpath, fn)
+            fh.write(f"{os.path.getsize(p)}\t{os.path.splitext(fn)[1].lower()}\t{p}\n")
+PY
+    # The rows still name the paths the chapters were placed at: that is what a
+    # server re-scan of the moved tree reports.
+    python3 - "$OUT" "$ROWS" <<'PY'
+import csv, sys
+out, rows = sys.argv[1], sys.argv[2]
+moved = {r[1]: r[2] for r in csv.reader(open(out), delimiter="\t") if r[0] == "move"}
+with open(rows) as fh, open(rows + ".2", "w") as fh2:
+    fh2.write(fh.readline().rstrip("\n") + "\n")
+    for line in fh:
+        f = line.split("\t")[0]
+        fh2.write("\t".join([moved.get(f, f)] + line.rstrip("\n").split("\t")[1:]) + "\n")
+PY
+    run python3 "$PLAN" --root "$AB" --enum "$ENUM" --rows "$ROWS.2" \
+        --out "$OUT.2" --exceptions "$EXC.2"
+    [ "$status" -eq 0 ]
+    [ "$(awk -F '\t' '$1 == "move"' "$OUT.2" | wc -l)" -eq 0 ]
+}
+
+@test "nothing under the park root is planned again" {
+    plan
+    run awk -F '\t' '$1 == "move" && $2 ~ /_unsorted/' "$OUT"
+    [ -z "$output" ]
+}

tests/media_music.bats

@@ -0,0 +1,373 @@
+#!/usr/bin/env bats
+# Seam: the music-library relayout — scripts/media-census.py music (the tag and
+# provider authority export) and scripts/media-music.py (the plan).
+#
+# Jellyfin's music rule is the opposite of the movie and TV ones: the embedded
+# tags are the metadata and the file name is only a fallback title, so the
+# authority here is the Audio row Jellyfin already matched (its album-artist,
+# album, year, disc and track columns) and NOT the path a ripper chose. Every
+# test states which authority a file has — row only, row with no album item,
+# sidecar of a file that has a row, nothing at all — and asserts where the PLAN
+# files it, never how the planner decided.
+#
+# The three outcomes that cost a re-run of a 90k-file plan: a track filed under
+# the wrong artist (it splits one album across two artists), a destination that
+# two tracks claim (the executor refuses, and the operator loses the run), and a
+# lyric file that stops matching the basename of the track it belongs to, which
+# silently loses the lyrics. Everything below is written to catch those, plus the
+# gate that matters most: the plan must replay through scripts/media-apply.py,
+# whose preflight is the fleet's only overwrite guard.
+
+load helpers
+
+PLAN="$REPO_ROOT/scripts/media-music.py"
+CENSUS="$REPO_ROOT/scripts/media-census.py"
+APPLY="$REPO_ROOT/scripts/media-apply.py"
+
+# at PATH SIZE — a file with deterministic content.
+at() { mkdir -p "$(dirname "$1")"; head -c "$2" /dev/zero > "$1"; }
+
+# row FILE ARTIST ALBUM YEAR DISC TRACK TITLE [MB] [PERFORMER]
+# One row of the authority export scripts/media-census.py music writes.
+row() {
+    printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
+        "$1" "$2" "$3" "${4:-}" "${5:-}" "${6:-}" "$7" "${8:-}" "${9:-}" >> "$ROWS"
+}
+
+# dst SRC — the destination the plan gives SRC, or nothing when it does not move.
+dst() {
+    awk -F '\t' -v s="$1" '$1 == "move" && $2 == s {print $3}' "$OUT"
+}
+
+setup() {
+    MUSIC="$BATS_TEST_TMPDIR/Music"
+    PARK="$MUSIC/_unsorted"
+    ENUM="$BATS_TEST_TMPDIR/enum.tsv"
+    ROWS="$BATS_TEST_TMPDIR/rows.tsv"
+    OUT="$BATS_TEST_TMPDIR/plan.tsv"
+    EXC="$BATS_TEST_TMPDIR/exceptions.txt"
+
+    # A discography pack: the artist's own albums buried under "01. Albums",
+    # with a lyric, a cover, an EAC log and a playlist beside the tracks.
+    A="$MUSIC/Artist One - Discography [FLAC]/01. Albums/Album X"
+    at "$A/01. First.flac" 9000
+    at "$A/02. Second.flac" 9000
+    at "$A/01. First.lrc" 10
+    at "$A/cover.jpg" 20
+    at "$A/rip.log" 10
+    at "$A/Album X.m3u" 10
+
+    # A multi-disc compilation: one album (the album artist is the compilation
+    # tag), two discs, and a different performer on each track.
+    B="$MUSIC/Box (2019)"
+    at "$B/Disc 1/01 Track A.flac" 9000
+    at "$B/Disc 2/01 Track B.flac" 9000
+
+# The box cover lies above the two disc folders: the discs below it own it.
+at "$B/box.jpg" 10
+
+    # One image plus its cuesheet: a whole album in one file.
+    C="$MUSIC/Image Cue"
+    at "$C/Image.flac" 9000
+    at "$C/Image.cue" 10
+
+    # The hard cases: no row at all, a video container, two tracks claiming one
+    # number and one title, a track with no number, and a track whose album
+    # artist tag is empty so only the performer names it.
+    D="$MUSIC/Odd"
+    at "$D/loose.flac" 9000
+    at "$D/concert.mkv" 9000
+    at "$D/dup1.flac" 9000
+    at "$D/dup2.flac" 9000
+    at "$D/unnumbered.flac" 9000
+    at "$D/lone.flac" 9000
+
+    # A sidecar in a folder that holds two different albums.
+    E="$MUSIC/Mixed"
+    at "$E/one.flac" 9000
+    at "$E/two.flac" 9000
+    at "$E/notes.pdf" 10
+
+    # An album title carrying a character Jellyfin says breaks playback.
+    F="$MUSIC/Question Mark"
+    at "$F/01. Bang.flac" 9000
+
+    # An album whose tags name no album artist at all, and two different
+    # performers; and one album title carried by two different album artists.
+    G="$MUSIC/Tagless"
+    at "$G/one.flac" 9000
+    at "$G/two.flac" 9000
+    H="$MUSIC/Same Title"
+    at "$H/a.flac" 9000
+    at "$H/b.flac" 9000
+
+    # One album whose tracks disagree on the spelling of its name; the minority
+    # spelling sorts first, so it must not win the folder.
+    I="$MUSIC/Puppets"
+    at "$I/one.flac" 9000
+    at "$I/two.flac" 9000
+    at "$I/three.flac" 9000
+
+    # The authority export carries a header; the planner reads it by column name.
+    printf 'file\tartist\talbum\tyear\tdisc\ttrack\ttitle\tmb\tperformer\n' > "$ROWS"
+    row "$A/01. First.flac" "Artist One" "Album X" 2015 1 1 "First Song"
+    row "$A/02. Second.flac" "Artist One" "Album X" 2015 1 2 "Second Song: Reprise"
+    row "$B/Disc 1/01 Track A.flac" "Various Artists" "Best Of" 2019 1 1 "Track A" \
+        "" "Aaa Singer"
+    row "$B/Disc 2/01 Track B.flac" "Various Artists" "Best Of" 2019 2 1 "Track B" \
+        "" "Bbb Singer"
+    row "$C/Image.flac" "Solo" "Single Album" 2001 1 1 "Single Album"
+    row "$D/dup1.flac" "Dup Artist" "Dupes" "" "" 1 "Same"
+    row "$D/dup2.flac" "Dup Artist" "Dupes" "" "" 1 "Same"
+    row "$D/unnumbered.flac" "No Number" "No Number Album" "" "" "" "Untitled"
+    row "$D/lone.flac" "" "Session Works" "" "" 1 "Lone" "" "Session Singer"
+    row "$E/one.flac" "Mix Artist" "First Set" 2000 "" 1 "One"
+    row "$E/two.flac" "Mix Artist" "Second Set" 2001 "" 1 "Two"
+    row "$F/01. Bang.flac" "Billie" "WHEN WE ALL FALL ASLEEP, WHERE DO WE GO?" \
+        2019 "" 1 "!!!!!!"
+    row "$G/one.flac" "" "Two Seasons" 2005 "" 1 "One" "" "Alpha Band"
+    row "$G/two.flac" "" "Two Seasons" 2005 "" 2 "Two" "" "Beta Band"
+    row "$H/a.flac" "Aaa Singer" "Same Title" 2011 "" 1 "A Song"
+    row "$H/b.flac" "Bbb Singer" "Same Title" 2011 "" 1 "B Song"
+    row "$I/one.flac" "Metallica" "Master Of Puppets" 2015 "" 1 "One"
+    row "$I/two.flac" "Metallica" "Master of Puppets" 2015 "" 2 "Two"
+    row "$I/three.flac" "Metallica" "Master of Puppets" 2015 "" 3 "Three"
+
+    # The enum TSV is what scripts/media-census.py enumerate writes: bytes, ext,
+    # path, no header.
+    python3 - "$MUSIC" "$ENUM" <<'PY'
+import os, sys
+root, out = sys.argv[1], sys.argv[2]
+with open(out, "w") as fh:
+    for dirpath, _dirs, files in os.walk(root):
+        for fn in files:
+            p = os.path.join(dirpath, fn)
+            fh.write(f"{os.path.getsize(p)}\t{os.path.splitext(fn)[1].lower()}\t{p}\n")
+PY
+}
+
+plan() {
+    run python3 "$PLAN" --root "$MUSIC" --enum "$ENUM" --rows "$ROWS" \
+        --out "$OUT" --exceptions "$EXC"
+    [ "$status" -eq 0 ] || echo "planner said: $output"
+}
+
+@test "the census exports the tag and provider row Jellyfin matched for a track" {
+    DB="$BATS_TEST_TMPDIR/jellyfin.db"
+    python3 - "$DB" <<'PY'
+import sqlite3, sys, uuid
+c = sqlite3.connect(sys.argv[1])
+c.execute("""create table BaseItems (Id, ParentId, Type, Name, Path, IndexNumber,
+                                      ParentIndexNumber, ProductionYear, Album,
+                                      AlbumArtists, Artists, Data)""")
+c.execute("""create table BaseItemProviders (ItemId, ProviderId, ProviderValue)""")
+AU = "MediaBrowser.Controller.Entities.Audio.Audio"
+AL = "MediaBrowser.Controller.Entities.Audio.MusicAlbum"
+aid, trk = str(uuid.uuid4()), "/data/Music/Pack/Album X/01. First.flac"
+c.execute("insert into BaseItems values (?,?,?,?,?,?,?,?,?,?,?,?)",
+          (aid, None, AL, "Album X", "/data/Music/Pack/Album X", None, None, 2015,
+           None, "Artist One", None, '{}'))
+c.execute("insert into BaseItemProviders values (?,?,?)",
+          (aid, "MusicBrainzReleaseGroup", "rg-1234"))
+c.execute("insert into BaseItems values (?,?,?,?,?,?,?,?,?,?,?,?)",
+          (str(uuid.uuid4()), aid, AU, "First Song", trk, 1, 1, 2015,
+           "album x (the tag)", "Artist One", "Artist One", '{}'))
+c.commit()
+PY
+    run python3 "$CENSUS" music --root "$BATS_TEST_TMPDIR/Music" --db "$DB" \
+        --out "$BATS_TEST_TMPDIR/exp.tsv"
+    [ "$status" -eq 0 ]
+    run head -1 "$BATS_TEST_TMPDIR/exp.tsv"
+    [ "${lines[0]}" = "file	artist	album	year	disc	track	title	mb	performer" ]
+    tail -1 "$BATS_TEST_TMPDIR/exp.tsv" \
+        | grep -q "^$BATS_TEST_TMPDIR/Music/Pack/Album X/01\. First\.flac	Artist One	Album X	2015	1	1	First Song	rg-1234	Artist One$"
+}
+
+@test "a track whose folder is no album item still exports from its own tags" {
+    DB="$BATS_TEST_TMPDIR/jellyfin.db"
+    python3 - "$DB" <<'PY'
+import sqlite3, sys, uuid
+c = sqlite3.connect(sys.argv[1])
+c.execute("""create table BaseItems (Id, ParentId, Type, Name, Path, IndexNumber,
+                                      ParentIndexNumber, ProductionYear, Album,
+                                      AlbumArtists, Artists, Data)""")
+c.execute("""create table BaseItemProviders (ItemId, ProviderId, ProviderValue)""")
+c.execute("insert into BaseItems values (?,?,?,?,?,?,?,?,?,?,?,?)",
+          (str(uuid.uuid4()), None, "MediaBrowser.Controller.Entities.Audio.Audio",
+           "Lone", "/data/Music/Pack/lone.flac", 1, None, None,
+           "Session Works", None, "Session Singer", '{}'))
+c.commit()
+PY
+    run python3 "$CENSUS" music --root "$BATS_TEST_TMPDIR/Music" --db "$DB" \
+        --out "$BATS_TEST_TMPDIR/exp.tsv"
+    [ "$status" -eq 0 ]
+    tail -1 "$BATS_TEST_TMPDIR/exp.tsv" \
+        | grep -q "^$BATS_TEST_TMPDIR/Music/Pack/lone\.flac	Session Singer	Session Works			1	Lone		Session Singer$"
+}
+
+@test "a tagged track files under artist, album and year with a numbered title" {
+    plan
+    [ "$status" -eq 0 ]
+    [ "$(dst "$A/01. First.flac")" = "$MUSIC/Artist One/Album X (2015)/01 - First Song.flac" ]
+}
+
+@test "the tag title wins over the name the ripper gave the file" {
+    plan
+    [ "$(dst "$A/02. Second.flac")" = "$MUSIC/Artist One/Album X (2015)/02 - Second Song Reprise.flac" ]
+}
+
+@test "a character Jellyfin says breaks playback never reaches a destination" {
+    plan
+    [ "$(dst "$F/01. Bang.flac")" = "$MUSIC/Billie/WHEN WE ALL FALL ASLEEP, WHERE DO WE GO (2019)/01 - !!!!!!.flac" ]
+    run awk -F '\t' '$1 == "move" && $3 ~ /[<>:"|?*]/ {print $3}' "$OUT"
+    [ -z "$output" ]
+}
+
+@test "every disc of a multi-disc album lands in one folder, numbered apart" {
+    plan
+    [ "$(dst "$B/Disc 1/01 Track A.flac")" = "$MUSIC/Various Artists/Best Of (2019)/1.01 - Track A.flac" ]
+    [ "$(dst "$B/Disc 2/01 Track B.flac")" = "$MUSIC/Various Artists/Best Of (2019)/2.01 - Track B.flac" ]
+}
+
+@test "an album whose tracks name several artists files under Various Artists" {
+    plan
+    run awk -F '\t' '$1 == "move" && $3 ~ /\/Best Of \(2019\)\/.*\.flac$/ {print $3}' "$OUT"
+    [ "${#lines[@]}" -eq 2 ]
+    [[ "${lines[0]}" == "$MUSIC/Various Artists/"* ]]
+}
+
+@test "an album with no album artist and two performers is a compilation" {
+    plan
+    [ "$(dst "$G/one.flac")" = "$MUSIC/Various Artists/Two Seasons (2005)/01 - One.flac" ]
+    [ "$(dst "$G/two.flac")" = "$MUSIC/Various Artists/Two Seasons (2005)/02 - Two.flac" ]
+}
+
+@test "the same album title under two album artists is two albums" {
+    plan
+    [ "$(dst "$H/a.flac")" = "$MUSIC/Aaa Singer/Same Title (2011)/01 - A Song.flac" ]
+    [ "$(dst "$H/b.flac")" = "$MUSIC/Bbb Singer/Same Title (2011)/01 - B Song.flac" ]
+}
+
+@test "the folder carries the album spelling most tracks carry" {
+    plan
+    [ "$(dst "$I/one.flac")" = "$MUSIC/Metallica/Master of Puppets (2015)/01 - One.flac" ]
+    [ "$(dst "$I/two.flac")" = "$MUSIC/Metallica/Master of Puppets (2015)/02 - Two.flac" ]
+    [ "$(dst "$I/three.flac")" = "$MUSIC/Metallica/Master of Puppets (2015)/03 - Three.flac" ]
+}
+
+@test "a lyric file is renamed to match the track it belongs to" {
+    plan
+    [ "$(dst "$A/01. First.lrc")" = "$MUSIC/Artist One/Album X (2015)/01 - First Song.lrc" ]
+}
+
+@test "the album image, the rip log and the playlist follow the album folder" {
+    plan
+    [ "$(dst "$A/cover.jpg")" = "$MUSIC/Artist One/Album X (2015)/cover.jpg" ]
+    [ "$(dst "$A/rip.log")" = "$MUSIC/Artist One/Album X (2015)/rip.log" ]
+    [ "$(dst "$A/Album X.m3u")" = "$MUSIC/Artist One/Album X (2015)/Album X.m3u" ]
+}
+
+@test "a cover above the disc folders of one album follows that album" {
+    plan
+    [ "$(dst "$B/box.jpg")" = "$MUSIC/Various Artists/Best Of (2019)/box.jpg" ]
+}
+
+@test "an image carrying a whole album keeps its own name beside its cuesheet" {
+    plan
+    [ "$(dst "$C/Image.flac")" = "$MUSIC/Solo/Single Album (2001)/Image.flac" ]
+    [ "$(dst "$C/Image.cue")" = "$MUSIC/Solo/Single Album (2001)/Image.cue" ]
+}
+
+@test "an audio file no provider row names is parked, not filed under an artist" {
+    plan
+    [[ "$(dst "$D/loose.flac")" == "$PARK/Odd/loose.flac" ]]
+}
+
+@test "a video container in the music library is parked, never renamed to an audio one" {
+    plan
+    [[ "$(dst "$D/concert.mkv")" == "$PARK/Odd/concert.mkv" ]]
+    run awk -F '\t' '$1 == "move" && $3 ~ /\.mka$|\.m4a$/ {print $3}' "$OUT"
+    [ -z "$output" ]
+}
+
+@test "two tracks claiming one number and one title get two destinations" {
+    plan
+    [ "$(dst "$D/dup1.flac")" = "$MUSIC/Dup Artist/Dupes/01 - Same.flac" ]
+    [ "$(dst "$D/dup2.flac")" = "$MUSIC/Dup Artist/Dupes/01 - Same (2).flac" ]
+}
+
+@test "an album with no year is named without one, a track with no number likewise" {
+    plan
+    [ "$(dst "$D/unnumbered.flac")" = "$MUSIC/No Number/No Number Album/Untitled.flac" ]
+}
+
+@test "a track naming only a performer files under that performer" {
+    plan
+    [ "$(dst "$D/lone.flac")" = "$MUSIC/Session Singer/Session Works/01 - Lone.flac" ]
+}
+
+@test "a sidecar in a folder holding two albums parks instead of guessing" {
+    plan
+    [[ "$(dst "$E/notes.pdf")" == "$PARK/Mixed/notes.pdf" ]]
+}
+
+@test "the plan creates every folder before the move that needs it" {
+    plan
+    python3 - "$OUT" "$MUSIC" <<'PY'
+import os, sys
+made = set()
+for line in open(sys.argv[1]).read().splitlines()[1:]:
+    action, _src, dest, _kind = line.split("\t")
+    if action == "mkdir":
+        made.add(dest)
+    elif action == "move":
+        parent = os.path.dirname(dest)
+        while parent and parent != sys.argv[2]:
+            assert parent in made, f"{dest} needs {parent}, which is never made"
+            parent = os.path.dirname(parent)
+PY
+}
+
+@test "no move lands outside the music library" {
+    plan
+    run awk -F '\t' -v l="$MUSIC" \
+        '$1 == "move" && $3 !~ "^" l "/" {print $3}' "$OUT"
+    [ -z "$output" ]
+}
+
+@test "the executor preflights the plan and no target is claimed twice" {
+    plan
+    run python3 "$APPLY" apply --plan "$OUT" --root "$BATS_TEST_TMPDIR" \
+        --journal "$BATS_TEST_TMPDIR/journal.jsonl"
+    [ "$status" -eq 0 ]
+    dup=$(awk -F '\t' '$1 == "move" {print $3}' "$OUT" | sort | uniq -d)
+    [ -z "$dup" ]
+}
+
+@test "re-planning a library the plan already satisfies moves nothing" {
+    plan
+    # Applying the plan and re-censusing is what the operator does next: both
+    # authority files are keyed by path, so both are replayed through the plan
+    # the way a fresh census of the moved tree would see them. (The enum has no
+    # header; the rows export does, and its header row is not a path.)
+    python3 - "$OUT" "$ENUM" "$ROWS" <<'PY'
+import os, sys
+plan = sys.argv[1]
+moves = {}
+for line in open(plan).read().splitlines()[1:]:
+    action, src, dest, _kind = line.split("\t")
+    if action == "move":
+        moves[src] = dest
+        os.makedirs(os.path.dirname(dest), exist_ok=True)
+        os.rename(src, dest)
+for path, col in ((sys.argv[2], 2), (sys.argv[3], 0)):
+    rows = [line.rstrip("\n").split("\t") for line in open(path)]
+    with open(path, "w") as fh:
+        for f in rows:
+            f[col] = moves.get(f[col], f[col])
+            fh.write("\t".join(f) + "\n")
+PY
+    plan
+    run awk -F '\t' '$1 == "move" {print $2 " -> " $3}' "$OUT"
+    [ -z "$output" ] || { echo "moved again: $output"; false; }
+}

tests/media_overlay.bats

@@ -61,7 +61,10 @@ UNIT="$REPO_ROOT/dankserver/host/systemd/media-meta-view.mount"
 @test "both media servers bind the view and refuse to start without it" {
     for unit in "$JELLY" "$PLEX"; do
         grep -q "^Volume=$MOUNT:" "$unit" || return 1
-        grep -q "^UnitConfigItem=ConditionPathIsMountPoint=$MOUNT$" "$unit" || return 1
+        # The refusal is a start GATE, not a Condition: measured on the host, a
+        # unit whose Condition goes unmet is skipped forever (NRestarts=0, no
+        # start attempt) — fail-dead. The gate waits, then refuses.
+        grep -q "^ExecStartPre=.*wait-for-mount.sh .*$MOUNT" "$unit" || return 1
         # The raw array must no longer be a container source: that bind is what
         # made sidecar sharing impossible (read-only) and metadata slow (seeks).
         ! grep -q '^Volume=/mnt/entropy' "$unit"

tests/media_relayout.bats

@@ -374,7 +374,10 @@ PY
 # apply_plan — plan, then apply for real; the journal goes in the tmpdir.
 apply_plan() {
     JOURNAL="$BATS_TEST_TMPDIR/journal.jsonl"
-    run python3 "$APPLY" apply --plan "$OUT" --root "$LIB" --journal "$JOURNAL" --apply
+    # `/` is always a mountpoint, so the overlay note behaves as it does on a
+    # host that runs the metadata view.
+    run python3 "$APPLY" apply --plan "$OUT" --root "$LIB" \
+        --journal "$JOURNAL" --metadata-view / --apply
 }
 
 @test "a run without --apply says what it would do and touches nothing" {
@@ -409,6 +412,32 @@ print(sum(1 for l in open(sys.argv[1]) if json.loads(l).get("op") == "move"))' "
     [ "$status" -eq 0 ]
 }
 
+# The overlay note is only true where the metadata view is really mounted. On a
+# host whose media servers bind the array directly (dankserver today: both
+# quadlets mount /mnt/entropy, /var/lib/media-meta does not exist) the sidecars
+# moved with the media, and "next: run reap" is an order that cannot be carried
+# out. --metadata-view is how the caller names that path; the default is the
+# host's view path, and the note rides only when it is a mountpoint.
+@test "an apply with no mounted metadata view does not order a reap" {
+    plan
+    JOURNAL="$BATS_TEST_TMPDIR/journal.jsonl"
+    run python3 "$APPLY" apply --plan "$OUT" --root "$LIB" --journal "$JOURNAL" --apply
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"moved"* ]]
+    [[ "$output" != *"media-view.sh reap"* ]]
+}
+
+@test "a rollback with no mounted metadata view does not order a reap" {
+    plan
+    JOURNAL="$BATS_TEST_TMPDIR/journal.jsonl"
+    run python3 "$APPLY" apply --plan "$OUT" --root "$LIB" --journal "$JOURNAL" --apply
+    [ "$status" -eq 0 ]
+    run python3 "$APPLY" rollback --journal "$JOURNAL" --root "$LIB" --apply
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"rolled back"* ]]
+    [[ "$output" != *"media-view.sh reap"* ]]
+}
+
 @test "a target already holding a different file stops the whole run" {
     plan
     JOURNAL="$BATS_TEST_TMPDIR/journal.jsonl"
@@ -465,6 +494,65 @@ for r in moves:
 PY
 }
 
+# The live pass paid an fsync per move on a spinning array (63 074 of them) and
+# the run took 11 minutes for 58 278 renames. --batch N writes N intents, syncs
+# once, then performs those N moves — the durability rule is unchanged (no move
+# runs before its intent is on disk), only the number of flushes falls.
+@test "a batched apply journals every move and lands the same tree" {
+    plan
+    JOURNAL="$BATS_TEST_TMPDIR/batched.jsonl"
+    run python3 "$APPLY" apply --plan "$OUT" --root "$LIB" --journal "$JOURNAL" \
+        --batch 4 --apply
+    [ "$status" -eq 0 ]
+    local planned journalled
+    planned=$(awk -F'\t' '$1=="move"' "$OUT" | wc -l)
+    journalled=$(grep -c '"op": "move"' "$JOURNAL")
+    [ "$journalled" -eq "$planned" ]
+    run python3 "$APPLY" verify --plan "$OUT" --root "$LIB" --journal "$JOURNAL"
+    [ "$status" -eq 0 ]
+    python3 - "$OUT" <<'PY'
+import os, sys
+moves = [r for r in (l.rstrip("\n").split("\t") for l in open(sys.argv[1]))
+         if r[0] == "move"]
+assert moves, "fixture planned no moves"
+for r in moves:
+    assert os.path.exists(r[2]), f"target missing: {r[2]}"
+    assert not os.path.exists(r[1]), f"source left behind: {r[1]}"
+PY
+}
+
+@test "an apply stopped mid-batch resumes without losing or double-journalling a move" {
+    plan
+    JOURNAL="$BATS_TEST_TMPDIR/interrupted-batch.jsonl"
+    python3 "$APPLY" apply --plan "$OUT" --root "$LIB" --journal "$JOURNAL" \
+        --batch 2 --apply > "$BATS_TEST_TMPDIR/first.log" 2>&1 &
+    local pid=$! i
+    # stop the run the moment a batch of intents is on disk (it may also have
+    # finished already — both outcomes must resume cleanly)
+    for i in $(seq 1 200); do
+        [ -f "$JOURNAL" ] && [ "$(grep -c '"op": "move"' "$JOURNAL" 2>/dev/null || true)" -ge 2 ] && break
+        sleep 0.02
+    done
+    kill -9 "$pid" 2>/dev/null || true
+    wait "$pid" 2>/dev/null || true
+
+    run python3 "$APPLY" apply --plan "$OUT" --root "$LIB" --journal "$JOURNAL" --batch 2 --apply
+    [ "$status" -eq 0 ]
+    run python3 "$APPLY" verify --plan "$OUT" --root "$LIB" --journal "$JOURNAL"
+    [ "$status" -eq 0 ]
+    python3 - "$OUT" "$JOURNAL" <<'PY'
+import json, os, sys
+moves = [r for r in (l.rstrip("\n").split("\t") for l in open(sys.argv[1]))
+         if r[0] == "move"]
+journal = [json.loads(l) for l in open(sys.argv[2])]
+dsts = [j["dst"] for j in journal if j.get("op") == "move"]
+assert len(dsts) == len(set(dsts)), "a destination was journalled twice"
+assert len(dsts) == len(moves), f"journalled {len(dsts)} of {len(moves)} moves"
+for r in moves:
+    assert os.path.exists(r[2]) and not os.path.exists(r[1]), r[2]
+PY
+}
+
 @test "rollback puts every file back where the census found it" {
     plan
     apply_plan

tests/media_shows.bats

@@ -0,0 +1,751 @@
+#!/usr/bin/env bats
+# Seam: the TV-library relayout — scripts/media-census.py jellyfin (the metadata
+# authority export) and scripts/media-shows.py (the plan).
+#
+# The TV library is 52k files written in five different release layouts, and the
+# one thing that makes a rename of that size survivable is that the plan is
+# derived from what a metadata provider already matched, not from a guess at the
+# file name. So every test here states which authority a file had — name only,
+# provider only, both, neither — and asserts where the PLAN files it, never how
+# the planner decided. A fixture Jellyfin database stands in for the live one and
+# the name caches are input files, so no test touches the network.
+#
+# The target contract is tvdb-grade naming:
+#   <Series> (<year>) [tvdbid-NNNN]/Season NN/<Series> (<year>) - SxxEyy - <Title>.<ext>
+# The id rides the FOLDER only: it is what both matchers read the series by, and a
+# 180-character ceiling on a file name is not the place to spend it. Season 00
+# holds specials; a provider row whose "season" is a YEAR is renumbered by the
+# episode title tvdb states for the series' id, never by a guess.
+# tvdb is the IDENTITY authority: a provider name a server derived from a folder
+# is not a series name, so a polluted name is undone through the series' tvdb id.
+# The review pile parks OUTSIDE the library — a parked folder inside it indexes
+# as one junk show, and that show's rows are then mistaken for evidence.
+#
+# The two outcomes that cost a re-run of a 50k-file plan are a file filed as an
+# episode that is not one (it steals an episode number from its real owner) and a
+# move that lands on an existing file. Everything below is written to catch
+# exactly those, plus the gate that matters most: the plan must be replayable by
+# scripts/media-apply.py, whose preflight is the fleet's only overwrite guard.
+
+load helpers
+
+PLAN="$REPO_ROOT/scripts/media-shows.py"
+CENSUS="$REPO_ROOT/scripts/media-census.py"
+APPLY="$REPO_ROOT/scripts/media-apply.py"
+
+# at PATH SIZE — a file with deterministic content.
+at() { mkdir -p "$(dirname "$1")"; head -c "$2" /dev/zero > "$1"; }
+
+# title_row FILE SERIES YEAR SEASON EPISODE [EXTRA] [TMDB] [TITLE] [TVDB]
+# — one row of the authority export scripts/media-census.py jellyfin writes.
+title_row() {
+    printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' "$1" "$2" "$3" "${4:-}" \
+        "${5:-}" "${6:-}" "${7:-}" "${8:-}" "${9:-}" >> "$TITLES"
+}
+
+# file PATH SIZE — `at` plus the row the enum census would have carried had the
+# file existed when setup walked the tree. A test that needs a shape the fixture
+# does not ship adds it here, or the planner never sees it.
+file() {
+    at "$1" "$2"
+    local b="${1##*/}"
+    printf '%s\t.%s\t%s\n' "$2" "${b##*.}" "$1" >> "$ENUM"
+}
+
+# dst SRC — the destination the plan gives SRC, or nothing when it does not move.
+dst() {
+    awk -F '\t' -v s="$1" '$1 == "move" && $2 == s {print $3}' "$OUT"
+}
+
+setup() {
+    LIB="$BATS_TEST_TMPDIR/TVShows"
+    PARK="$LIB/_unsorted"
+    OUTSIDE="$BATS_TEST_TMPDIR/park"
+    MOVIES="$BATS_TEST_TMPDIR/Movies"
+    ENUM="$BATS_TEST_TMPDIR/enum.tsv"
+    PROBED="$BATS_TEST_TMPDIR/probed.tsv"
+    TITLES="$BATS_TEST_TMPDIR/titles.tsv"
+    CACHE="$BATS_TEST_TMPDIR/tmdb.json"
+    OUT="$BATS_TEST_TMPDIR/plan.tsv"
+    EXC="$BATS_TEST_TMPDIR/exceptions.txt"
+    : > "$PROBED"
+
+    SEASON="$LIB/The Examples (2010) Season 1 S01 (1080p BluRay x265 Silence)"
+    # An episode its own name states, with a subtitle, a season image and a
+    # trailer: four things that have to end up in four different places.
+    at "$SEASON/The.Examples.S01E01.Pilot.1080p.x265.mkv" 9000
+    at "$SEASON/The.Examples.S01E01.Pilot.1080p.x265.en.srt" 200
+    at "$SEASON/The.Examples.S01E01.Pilot.1080p.x265.mkv.forced.srt" 250
+    # A scene pack buries its subtitles two levels down, in Subs/<release-name>/.
+    at "$SEASON/Subs/The.Examples.S01E01.Pilot.1080p.x265/The.Examples.S01E01.Pilot.1080p.x265.jpn.srt" 220
+    at "$SEASON/folder.jpg" 300
+    at "$SEASON/Trailers/teaser.mkv" 1000
+    at "$SEASON/tvshow.nfo" 400
+    # An anime pack: no episode marker anywhere in its name, numbered by the
+    # provider only. Its year is the one thing no authority states.
+    ANIME="$LIB/Anime Pack [grp] (1080p HEVC)"
+    at "$ANIME/[grp] Anime Pack - 05.mkv" 5000
+    # Two releases claiming one episode, and a file holding two episodes.
+    at "$LIB/Dupes/Show Two S01E01.mkv" 4000
+    at "$LIB/Dupes/Show.Two.S01E01.720p.other.mkv" 7000
+    at "$LIB/Dupes/Show.Two.S01E02-E03.720p.mkv" 7000
+    # A file no authority numbers, and a long file the movie provider knows.
+    at "$LIB/Orphan Tapes/clip001.mp4" 3000
+    at "$LIB/Longform/Some Documentary Special (2015).mkv" 8000
+    # A bonus folder inside a release pack whose own name is not the show's. The
+    # pack's rows name the show; the bonus folder may never invent a series.
+    at "$ANIME/01. Extras/NCOP 01.mkv" 1200
+    # A season folder whose rows are stale: the database numbers every file of this
+    # pack season 16 episode 20, four seasons' worth of them.
+    at "$LIB/SNL Pack/Season 19/01 Charles Barkley, Nirvana.avi" 6000
+    at "$LIB/Loose.Show.S02E03.720p.WEB-DL.mkv" 4000
+    # A box-set folder whose Series item the server named AFTER THE FOLDER: the
+    # row's own name is junk, and only a provider id can undo it.
+    BOX="$LIB/Show Box (2016) Season 1 S01 (1080p WEB-DL)"
+    at "$BOX/Show.Box.S01E01.1080p.WEB-DL.mkv" 6000
+    # The park inside the library: the server indexed the whole pile as ONE show
+    # named after the folder, so its rows state a series that is not a show.
+    at "$PARK/Park Show S01E01.mkv" 5000
+    at "$PARK/Twisted.Metal.S01E01.1080p.WEB-DL.mkv" 5200
+
+    # The enum census lists every file; the planner reads that instead of walking
+    # the tree, so the fixture writes the same three columns.
+    python3 - "$LIB" "$ENUM" <<'PY'
+import os, sys
+root, out = sys.argv[1], sys.argv[2]
+with open(out, "w") as fh:
+    for d, _, fs in os.walk(root):
+        for f in fs:
+            p = os.path.join(d, f)
+            fh.write(f"{os.stat(p).st_size}\t{os.path.splitext(f)[1]}\t{p}\n")
+PY
+
+    printf 'file\tseries\tyear\tseason\tepisode\textra\ttmdb\ttitle\ttvdb\n' > "$TITLES"
+    printf '{}\n' > "$CACHE"
+    title_row "$SEASON/The.Examples.S01E01.Pilot.1080p.x265.mkv" \
+        "The Examples" 2010 1 1 "" "" "Pilot"
+    title_row "$ANIME/[grp] Anime Pack - 05.mkv" "Anime Pack" "" 1 5
+    title_row "$LIB/Dupes/Show Two S01E01.mkv" "Show Two" 2016 1 1 "" "" "Two Pilots"
+    title_row "$LIB/Dupes/Show.Two.S01E01.720p.other.mkv" "Show Two" 2016 1 1 "" "" "Two Pilots"
+    title_row "$LIB/Dupes/Show.Two.S01E02-E03.720p.mkv" "Show Two" 2016 1 2 "" "" "Double Trouble"
+    title_row "$LIB/Loose.Show.S02E03.720p.WEB-DL.mkv" "Loose Show" 2019 2 3 "" "" "Loose Ends"
+    title_row "$LIB/SNL Pack/Season 19/01 Charles Barkley, Nirvana.avi" \
+        "SNL Pack" "" 16 20
+    title_row "$BOX/Show.Box.S01E01.1080p.WEB-DL.mkv" \
+        "Show Box (2016) Season 1" 2016 1 1 "" "2334" "Pilot" "78850"
+    # The row the server wrote for a parked file: the series is the PARK FOLDER.
+    title_row "$PARK/Park Show S01E01.mkv" "_unsorted" "" 1 1
+}
+
+plan() {
+    run python3 "$PLAN" --root "$LIB" --enum "$ENUM" --titles "$TITLES" \
+        --probed "$PROBED" --tmdb-cache "$CACHE" --movies "$MOVIES" \
+        --out "$OUT" --exceptions "$EXC"
+}
+
+plan_park() {                                  # the review pile outside the library
+    run python3 "$PLAN" --root "$LIB" --enum "$ENUM" --titles "$TITLES" \
+        --probed "$PROBED" --tmdb-cache "$CACHE" --movies "$MOVIES" \
+        --park "$OUTSIDE" --out "$OUT" --exceptions "$EXC"
+}
+
+@test "--tmdb with no key is reported as an unfinished plan, not a finished one" {
+    # A dead provider is invisible where it happens: every 401 is one line on
+    # stderr, and a terminal that scrolled past them shows a plan that reads as
+    # complete while every folder still carries the metadata provider's junk. The
+    # plan is still written — the answers that DID arrive are worth their rename —
+    # so the state has to ride in the summary line and in the review file.
+    # env -u keeps this offline no matter what the developer's shell exports.
+    run env -u TMDB_API_KEY python3 "$PLAN" --root "$LIB" --enum "$ENUM" \
+        --titles "$TITLES" --probed "$PROBED" --tmdb-cache "$CACHE" \
+        --movies "$MOVIES" --tmdb --out "$OUT" --exceptions "$EXC"
+    [ "$status" -eq 0 ]
+    grep -q 'tmdb NOT ASKED (TMDB_API_KEY unset): NOT provider-complete' <<<"$output"
+    grep -q 'WARNING: tmdb NOT ASKED (TMDB_API_KEY unset) — NOT provider-complete' "$EXC"
+    grep -qE '^plan: [1-9][0-9]* moves' <<<"$output"
+}
+
+@test "the census exports the provider's episode numbering as a TSV" {
+    DB="$BATS_TEST_TMPDIR/jellyfin.db"
+    python3 - "$DB" "$SEASON" <<'PY'
+import os, sqlite3, sys, uuid
+db, season = sys.argv[1], sys.argv[2]
+c = sqlite3.connect(db)
+pre = "/data/TVShows/" + os.path.basename(season)
+c.execute("""create table BaseItems (Id, ParentId, Type, Name, Path, IndexNumber,
+                                      ParentIndexNumber, ProductionYear, ExtraType,
+                                      IsVirtualItem, Data)""")
+sid = str(uuid.uuid4())
+c.execute("insert into BaseItems values (?,?,?,?,?,?,?,?,?,?,?)",
+          (sid, None, "MediaBrowser.Controller.Entities.TV.Series", "The Examples",
+           pre, None, None, 2010, None, 0,
+           '{"ProviderIds":{"Tmdb":"1234","Tvdb":"78850"}}'))
+c.execute("insert into BaseItems values (?,?,?,?,?,?,?,?,?,?,?)",
+          (str(uuid.uuid4()), sid, "MediaBrowser.Controller.Entities.TV.Episode",
+           "Pilot", pre + "/The.Examples.S01E01.Pilot.1080p.x265.mkv", 1, 1,
+           None, None, 0, '{}'))
+c.commit()
+PY
+    run python3 "$CENSUS" jellyfin --root "$LIB" --db "$DB" \
+        --out "$BATS_TEST_TMPDIR/exp.tsv"
+    [ "$status" -eq 0 ]
+    run head -1 "$BATS_TEST_TMPDIR/exp.tsv"
+    [ "${lines[0]}" = "file	series	year	season	episode	extra	tmdb	title	tvdb" ]
+    tail -1 "$BATS_TEST_TMPDIR/exp.tsv" \
+        | grep -q "^$SEASON/The\.Examples\.S01E01\.Pilot\.1080p\.x265\.mkv	The Examples	2010	1	1		1234	Pilot	78850$"
+}
+
+@test "the census reads provider ids from the table newer Jellyfin keeps" {
+    DB="$BATS_TEST_TMPDIR/jellyfin12.db"
+    python3 - "$DB" "$SEASON" <<'PY'
+import os, sqlite3, sys, uuid
+db, season = sys.argv[1], sys.argv[2]
+c = sqlite3.connect(db)
+pre = "/data/TVShows/" + os.path.basename(season)
+c.execute("""create table BaseItems (Id, ParentId, Type, Name, Path, IndexNumber,
+                                      ParentIndexNumber, ProductionYear, ExtraType,
+                                      IsVirtualItem, Data)""")
+# Jellyfin 12 moved the ids out of the Data blob and into their own table.
+c.execute("create table BaseItemProviders (ItemId, ProviderId, ProviderValue)")
+sid = str(uuid.uuid4())
+eid = str(uuid.uuid4())
+c.execute("insert into BaseItems values (?,?,?,?,?,?,?,?,?,?,?)",
+          (sid, None, "MediaBrowser.Controller.Entities.TV.Series", "The Examples",
+           pre, None, None, 2010, None, 0, '{}'))
+c.execute("insert into BaseItems values (?,?,?,?,?,?,?,?,?,?,?)",
+          (eid, sid, "MediaBrowser.Controller.Entities.TV.Episode",
+           "Pilot", pre + "/The.Examples.S01E01.Pilot.1080p.x265.mkv", 1, 1,
+           None, None, 0, '{}'))
+c.execute("insert into BaseItemProviders values (?,?,?)", (sid, "Tvdb", "9999"))
+c.commit()
+PY
+    run python3 "$CENSUS" jellyfin --root "$LIB" --db "$DB" \
+        --out "$BATS_TEST_TMPDIR/exp12.tsv"
+    [ "$status" -eq 0 ]
+    tail -1 "$BATS_TEST_TMPDIR/exp12.tsv" \
+        | grep -q "	Pilot	9999$"
+}
+
+@test "an episode its own name states files as the titled standard name" {
+    plan
+    [ "$status" -eq 0 ]
+    [ "$(dst "$SEASON/The.Examples.S01E01.Pilot.1080p.x265.mkv")" \
+        = "$LIB/The Examples (2010)/Season 01/The Examples (2010) - S01E01 - Pilot.mkv" ]
+}
+
+@test "the tvdb identity names the series folder, id and all, not the folder's echo" {
+    printf '{"tvdb:series:78850": {"name": "Show Box", "year": "2016"}}\n' > "$CACHE"
+    plan
+    want="$LIB/Show Box (2016) [tvdbid-78850]/Season 01"
+    want+="/Show Box (2016) - S01E01 - Pilot.mkv"
+    [ "$(dst "$BOX/Show.Box.S01E01.1080p.WEB-DL.mkv")" = "$want" ]
+}
+
+@test "a provider name that already carries the year is not given it twice" {
+    # TVDb answers the reboot as `Acapulco (2021)`. The folder contract is ONE year,
+    # and `Acapulco (2021) (2021)` is a folder neither matcher nor human reuses.
+    printf '{"tvdb:series:78850": {"name": "Show Box (2016)", "year": "2016"}}\n' > "$CACHE"
+    plan
+    want="$LIB/Show Box (2016) [tvdbid-78850]/Season 01"
+    want+="/Show Box (2016) - S01E01 - Pilot.mkv"
+    [ "$(dst "$BOX/Show.Box.S01E01.1080p.WEB-DL.mkv")" = "$want" ]
+    run grep -F '(2016) (2016)' "$OUT"
+    [ -z "$output" ]
+}
+
+@test "a series no authority resolves keeps the provider's name and is reported" {
+    plan
+    [ "$(dst "$LIB/SNL Pack/Season 19/01 Charles Barkley, Nirvana.avi")" \
+        = "$LIB/SNL Pack/Season 19/SNL Pack - S19E01.avi" ]
+    grep -A9 -i "no tvdb" "$EXC" | grep -q "SNL Pack"
+}
+
+@test "a row whose series is the park folder is not evidence of a show" {
+    plan_park
+    run awk -F '\t' -v p="$PARK/" '$1 == "move" && index($3, p) == 1 {print $3}' "$OUT"
+    [ -z "$output" ]
+    run awk -F '\t' '$1 == "move" && $2 ~ /Park Show S01E01/ {print $3}' "$OUT"
+    [[ "$output" == "$OUTSIDE/"* ]]
+}
+
+@test "the pile's sanitized display name is still the pile, not a series" {
+    # Jellyfin drops the leading underscore when it shows the hidden folder, so the
+    # row says the series is "unsorted" while the file sits in `_unsorted`. Match
+    # only the underscored spelling and the plan renames real files into a visible
+    # folder named after the review pile — which is how 617 of them got there.
+    title_row "$PARK/Twisted.Metal.S01E01.1080p.WEB-DL.mkv" "unsorted" "" 1 1 \
+        "" "" "Twisted Metal"
+    plan_park
+    run awk -F '\t' -v l="$LIB" \
+        '$1 == "move" && index($3, l "/unsorted/") == 1 {print $3}' "$OUT"
+    [ -z "$output" ]
+    run awk -F '\t' '$1 == "move" && $2 ~ /Twisted\.Metal\.S01E01/ {print $3}' "$OUT"
+    [[ "$output" == "$OUTSIDE/"* ]]
+}
+
+@test "a subtitle follows its episode and keeps its language flag" {
+    plan
+    [ "$(dst "$SEASON/The.Examples.S01E01.Pilot.1080p.x265.en.srt")" \
+        = "$LIB/The Examples (2010)/Season 01/The Examples (2010) - S01E01 - Pilot.en.srt" ]
+}
+
+@test "a subtitle two folders down inside Subs/<release-name>/ still follows its episode" {
+    plan
+    [ "$(dst "$SEASON/Subs/The.Examples.S01E01.Pilot.1080p.x265/The.Examples.S01E01.Pilot.1080p.x265.jpn.srt")" \
+        = "$LIB/The Examples (2010)/Season 01/The Examples (2010) - S01E01 - Pilot.jpn.srt" ]
+}
+
+@test "a subtitle that carries the container's word in its own name still follows the episode" {
+    plan
+    [ "$(dst "$SEASON/The.Examples.S01E01.Pilot.1080p.x265.mkv.forced.srt")" \
+        = "$LIB/The Examples (2010)/Season 01/The Examples (2010) - S01E01 - Pilot.forced.srt" ]
+}
+
+@test "a season image keeps its own name; a series nfo keeps the series folder" {
+    plan
+    [ "$(dst "$SEASON/folder.jpg")" = "$LIB/The Examples (2010)/Season 01/folder.jpg" ]
+    [ "$(dst "$SEASON/tvshow.nfo")" = "$LIB/The Examples (2010)/tvshow.nfo" ]
+}
+
+@test "bonus material files as an extra, never as an episode" {
+    plan
+    [ "$(dst "$SEASON/Trailers/teaser.mkv")" = "$LIB/The Examples (2010)/trailers/teaser.mkv" ]
+    [ -z "$(awk -F '\t' '$3 ~ /Season .*teaser/ {print $3}' "$OUT")" ]
+}
+
+@test "a file only the provider numbers files at the episode it is matched to, title or no title" {
+    plan
+    [ "$(dst "$ANIME/[grp] Anime Pack - 05.mkv")" \
+        = "$LIB/Anime Pack/Season 01/Anime Pack - S01E05.mkv" ]
+}
+
+@test "a bonus folder inside a release pack belongs to the pack's show, not to its own name" {
+    plan
+    [ "$(dst "$ANIME/01. Extras/NCOP 01.mkv")" = "$LIB/Anime Pack/extras/NCOP 01.mkv" ]
+    [ -z "$(awk -F '\t' '$3 ~ /\/01\. Extras\// {print $3}' "$OUT")" ]
+}
+
+@test "a Season folder outvotes the stale row its files carry" {
+    plan
+    [ "$(dst "$LIB/SNL Pack/Season 19/01 Charles Barkley, Nirvana.avi")" \
+        = "$LIB/SNL Pack/Season 19/SNL Pack - S19E01.avi" ]
+}
+
+
+@test "one file holding two episodes keeps both numbers in its name" {
+    plan
+    [ "$(dst "$LIB/Dupes/Show.Two.S01E02-E03.720p.mkv")" \
+        = "$LIB/Show Two (2016)/Season 01/Show Two (2016) - S01E02-E03 - Double Trouble.mkv" ]
+}
+
+@test "two files claiming one episode: one keeps the name, the other parks" {
+    plan
+    n=$(grep -c "	$LIB/Show Two (2016)/Season 01/Show Two (2016) - S01E01 - Two Pilots.mkv	" "$OUT")
+    [ "$n" -eq 1 ]
+    run dst "$LIB/Dupes/Show Two S01E01.mkv"
+    [[ "$output" == "$PARK/"* ]]
+    run dst "$LIB/Dupes/Show.Two.S01E01.720p.other.mkv"
+    [[ "$output" == "$LIB/Show Two (2016)/Season 01/"* ]]
+}
+
+@test "a file no authority numbers is parked, never renamed into the library" {
+    plan
+    run dst "$LIB/Orphan Tapes/clip001.mp4"
+    [[ "$output" == "$PARK/Orphan Tapes/clip001.mp4" ]]
+    grep -q "clip001.mp4" "$EXC"
+}
+
+@test "a long file the movie provider knows leaves the TV library for the movie one" {
+    printf '8000\t%s\t7200\thevc\t1920x1080\t23.976\t4000000\tyuv420p10le\taac:eng\t0\t0\tmatroska,webm\n' \
+        "$LIB/Longform/Some Documentary Special (2015).mkv" > "$PROBED"
+    python3 -c 'import json, sys
+json.dump({"movie:some documentary":
+           {"name": "Some Documentary Special", "year": 2015, "id": 55}},
+          open(sys.argv[1], "w"))' "$CACHE"
+    plan
+    [ "$(dst "$LIB/Longform/Some Documentary Special (2015).mkv")" \
+        = "$MOVIES/Some Documentary Special (2015)/Some Documentary Special (2015).mkv" ]
+}
+
+@test "a long file no movie provider knows is parked, not moved into Movies" {
+    printf '8000\t%s\t7200\thevc\t1920x1080\t23.976\t4000000\tyuv420p10le\taac:eng\t0\t0\tmatroska,webm\n' \
+        "$LIB/Longform/Some Documentary Special (2015).mkv" > "$PROBED"
+    plan
+    run dst "$LIB/Longform/Some Documentary Special (2015).mkv"
+    [[ "$output" == "$PARK/"* ]]
+}
+
+@test "a movie answer the file does not itself name stays in the review pile" {
+    # TMDb's top hit for a truncated query is a NEAR miss, not an answer: "mobile
+    # suit gundam 00" comes back as Special Edition I while the file is Special
+    # Edition III, and a one-word query "russia" comes back as a 1963 Bond film. A
+    # file leaves the TV library only when it states the title the provider names.
+    printf '8000\t%s\t7200\thevc\t1920x1080\t23.976\t4000000\tyuv420p10le\taac:eng\t0\t0\tmatroska,webm\n' \
+        "$LIB/Longform/Some Documentary Special (2015).mkv" > "$PROBED"
+    python3 -c 'import json, sys
+json.dump({"movie:some documentary":
+           {"name": "Some Documentary Special Part Two", "year": "2015", "id": 55}},
+          open(sys.argv[1], "w"))' "$CACHE"
+    plan
+    run dst "$LIB/Longform/Some Documentary Special (2015).mkv"
+    [[ "$output" == "$PARK/"* ]]
+    run awk -F '\t' -v m="$MOVIES/" '$1 == "move" && index($3, m) == 1 {print $3}' "$OUT"
+    [ -z "$output" ]
+}
+
+@test "a movie answer from another year is not that film" {
+    # The year the file states outranks a provider's eagerness: the 2015 special is
+    # not the 1999 one, however alike their names are.
+    printf '8000\t%s\t7200\thevc\t1920x1080\t23.976\t4000000\tyuv420p10le\taac:eng\t0\t0\tmatroska,webm\n' \
+        "$LIB/Longform/Some Documentary Special (2015).mkv" > "$PROBED"
+    python3 -c 'import json, sys
+json.dump({"movie:some documentary":
+           {"name": "Some Documentary Special", "year": "1999", "id": 55}},
+          open(sys.argv[1], "w"))' "$CACHE"
+    plan
+    run dst "$LIB/Longform/Some Documentary Special (2015).mkv"
+    [[ "$output" == "$PARK/"* ]]
+}
+
+@test "the plan creates every folder before the move that needs it" {
+    plan
+    python3 - "$OUT" "$LIB" "$MOVIES" "$PARK" <<'PY'
+import os, sys
+plan, known = sys.argv[1], set(sys.argv[2:])
+made, bad = set(), []
+for line in open(plan).read().splitlines()[1:]:
+    action, _src, dest, _kind = line.split("\t")
+    if action == "mkdir":
+        made.add(dest)
+    elif action == "move":
+        d = os.path.dirname(dest)
+        while d not in known and d != os.path.dirname(d):
+            if d not in made:
+                bad.append(f"{dest}: {d} was never made")
+            d = os.path.dirname(d)
+print("\n".join(bad[:5]))
+sys.exit(1 if bad else 0)
+PY
+}
+
+@test "no move lands outside the library or the movie library" {
+    plan
+    run awk -F '\t' -v l="$LIB" -v m="$MOVIES" \
+        '$1 == "move" && $3 !~ "^" l "/" && $3 !~ "^" m "/" {print $3}' "$OUT"
+    [ -z "$output" ]
+}
+
+@test "the executor preflights the plan and no target is claimed twice" {
+    plan
+    run python3 "$APPLY" apply --plan "$OUT" --root "$BATS_TEST_TMPDIR" \
+        --journal "$BATS_TEST_TMPDIR/journal.jsonl"
+    [ "$status" -eq 0 ]
+    dup=$(awk -F '\t' '$1 == "move" {print $3}' "$OUT" | sort | uniq -d)
+    [ -z "$dup" ]
+}
+
+@test "re-planning a library the plan already satisfies moves nothing" {
+    plan
+    # Applying the plan and re-censusing is exactly what the operator does next:
+    # every authority file is keyed by path, so all three are replayed through the
+    # plan the way a fresh census would see them. (The enum has no header; the
+    # titles export does, and its header row is not a path so it survives.)
+    python3 - "$OUT" "$ENUM" "$TITLES" "$PROBED" <<'PY'
+import os, sys
+plan = sys.argv[1]
+moves = {}
+for line in open(plan).read().splitlines()[1:]:
+    action, src, dest, _kind = line.split("\t")
+    if action == "move":
+        moves[src] = dest
+        os.makedirs(os.path.dirname(dest), exist_ok=True)
+        os.rename(src, dest)
+for path, col in ((sys.argv[2], 2), (sys.argv[3], 0), (sys.argv[4], 1)):
+    if not os.path.getsize(path):
+        continue
+    rows = [line.rstrip("\n").split("\t") for line in open(path)]
+    with open(path, "w") as fh:
+        for f in rows:
+            f[col] = moves.get(f[col], f[col])
+            fh.write("\t".join(f) + "\n")
+PY
+    plan
+    [ -z "$(awk -F '\t' '$1 == "move" {print $2}' "$OUT")" ]
+}
+
+# Specials and the year-shaped season. Jellyfin's contract puts specials in
+# Season 00, and its date matcher hands back rows whose "season" is the AIRDATE
+# YEAR. Both used to park — 1,412 and 1,033 files of one 52k plan — although one
+# is a legal season and the other is renumberable from the title tvdb states.
+@test "a provider's season 0 is a special, so it files under Season 00" {
+    file "$LIB/Show Bumps/Best Of The Examples.mkv" 5000
+    title_row "$LIB/Show Bumps/Best Of The Examples.mkv" "The Examples" 2010 0 2
+    plan
+    [ "$(dst "$LIB/Show Bumps/Best Of The Examples.mkv")" \
+        = "$LIB/The Examples (2010)/Season 00/The Examples (2010) - S00E02.mkv" ]
+}
+
+# These three tests carry a tvdb id of their own. The fixture's box set is 78850 and
+# ONE id means ONE show: reusing it here would merge these files into that series and
+# the duplicate rule would park them before any numbering question is asked.
+@test "a row whose season is a year is renumbered by the title tvdb states" {
+    printf '{"tvdb:series:4242": %s, "tvdb:episodes:4242": %s}\n' \
+        '{"name": "The Examples", "year": "2010"}' \
+        '{"1/7": "Best Of"}' > "$CACHE"
+    file "$LIB/Show Bumps/Best Of The Examples.mkv" 5000
+    title_row "$LIB/Show Bumps/Best Of The Examples.mkv" \
+        "The Examples" 2010 2010 11 "" "" "Best Of" "4242"
+    plan
+    want="$LIB/The Examples (2010) [tvdbid-4242]/Season 01"
+    want+="/The Examples (2010) - S01E07 - Best Of.mkv"
+    [ "$(dst "$LIB/Show Bumps/Best Of The Examples.mkv")" = "$want" ]
+}
+
+@test "a title tvdb gives twice never renumbers an episode" {
+    printf '{"tvdb:series:4242": %s, "tvdb:episodes:4242": %s}\n' \
+        '{"name": "The Examples", "year": "2010"}' \
+        '{"1/7": "Best Of", "2/3": "Best Of"}' > "$CACHE"
+    file "$LIB/Show Bumps/Best Of The Examples.mkv" 5000
+    title_row "$LIB/Show Bumps/Best Of The Examples.mkv" \
+        "The Examples" 2010 2010 11 "" "" "Best Of" "4242"
+    plan_park
+    run awk -F '\t' -v p="$OUTSIDE/" '$1 == "move" && index($3, p) == 1 {print $3}' "$OUT"
+    [[ "$output" == *"Best Of The Examples.mkv"* ]]
+}
+
+
+# A release pack can carry a number that is not an episode at all: two files of
+# the Attack on Titan box set on the array are named S03E2019 and S04E47370355,
+# and the provider rows the server recorded for them say the same junk. Reading
+# either as "the first three digits" files the box set under E201 and E473 and
+# steals those episode slots from their real owners, so a run too long to be an
+# episode is no marker and no number: the file is renumbered from tvdb's title
+# when the series' id answers it, and parks when nothing answers.
+@test "an episode number longer than three digits never files as an episode" {
+    file "$LIB/Junk Numbers/Attack Pack S03E2019.mkv" 5000
+    title_row "$LIB/Junk Numbers/Attack Pack S03E2019.mkv" "Attack Pack" 2013 3 2019
+    plan_park
+    run grep -c -- "- S03E201 -" "$OUT"
+    [ "$output" = "0" ]
+    [[ "$(dst "$LIB/Junk Numbers/Attack Pack S03E2019.mkv")" == "$OUTSIDE/"* ]]
+    grep -q "a provider row of season 3 episode 2019" "$EXC"
+}
+
+@test "a provider episode too long to be one is renumbered by the title tvdb states" {
+    printf '{"tvdb:series:4242": %s, "tvdb:episodes:4242": %s}\n' \
+        '{"name": "Attack Pack", "year": "2013"}' \
+        '{"3/7": "A Title tvdb Holds"}' > "$CACHE"
+    file "$LIB/Junk Numbers/Attack Pack S03E2019.mkv" 5000
+    title_row "$LIB/Junk Numbers/Attack Pack S03E2019.mkv" \
+        "Attack Pack" 2013 3 2019 "" "" "A Title tvdb Holds" "4242"
+    plan
+    want="$LIB/Attack Pack (2013) [tvdbid-4242]/Season 03"
+    want+="/Attack Pack (2013) - S03E07 - A Title tvdb Holds.mkv"
+    [ "$(dst "$LIB/Junk Numbers/Attack Pack S03E2019.mkv")" = "$want" ]
+}
+
+@test "a resolution glued to the marker still reads as one episode" {
+    file "$LIB/Junk Numbers/Glued Mark S01E02-1080p.mkv" 5000
+    title_row "$LIB/Junk Numbers/Glued Mark S01E02-1080p.mkv" \
+        "The Examples" 2010 1 2 "" "" "Second Look"
+    plan
+    [ "$(dst "$LIB/Junk Numbers/Glued Mark S01E02-1080p.mkv")" \
+        = "$LIB/The Examples (2010)/Season 01/The Examples (2010) - S01E02 - Second Look.mkv" ]
+}
+
+# Anime numbering is the one place a tvdb title can be confidently wrong: a pack
+# numbered by its release group still names S05E01, and tvdb answers that slot with
+# a different episode. A season the authority does not hold, or holds fewer of than
+# the pack books, is CONTRADICTED: the rename still happens, the title does not.
+@test "a season tvdb contradicts keeps the rename but never its titles" {
+    printf '{"tvdb:series:4242": %s, "tvdb:episodes:4242": %s}\n' \
+        '{"name": "Anime Gate", "year": "2010"}' \
+        '{"1/1": "Pilot"}' > "$CACHE"
+    file "$LIB/Gate Pack/Season 01/one S01E01.mkv" 5000
+    file "$LIB/Gate Pack/Season 05/two S05E01.mkv" 5000
+    file "$LIB/Gate Pack/Season 05/three S05E02.mkv" 5000
+    title_row "$LIB/Gate Pack/Season 01/one S01E01.mkv" \
+        "Anime Gate" 2010 1 1 "" "" "" "4242"
+    title_row "$LIB/Gate Pack/Season 05/two S05E01.mkv" \
+        "Anime Gate" 2010 5 1 "" "" "" "4242"
+    title_row "$LIB/Gate Pack/Season 05/three S05E02.mkv" \
+        "Anime Gate" 2010 5 2 "" "" "" "4242"
+    plan
+    want="$LIB/Anime Gate (2010) [tvdbid-4242]/Season 01"
+    want+="/Anime Gate (2010) - S01E01 - Pilot.mkv"
+    [ "$(dst "$LIB/Gate Pack/Season 01/one S01E01.mkv")" = "$want" ]
+    want="$LIB/Anime Gate (2010) [tvdbid-4242]/Season 05"
+    want+="/Anime Gate (2010) - S05E01.mkv"
+    [ "$(dst "$LIB/Gate Pack/Season 05/two S05E01.mkv")" = "$want" ]
+    grep -A6 -i "numbering tvdb contradicts" "$EXC" | grep -q "Anime Gate"
+}
+
+# Tvdb's default episode query answers at most 500 rows and states no total, so a
+# list that long is a PAGE, not a list: One Piece (1999), Crayon Shin-chan (1992)
+# and Detective Conan (1996) each answer exactly 500 while holding over a thousand.
+# Read as the whole truth, that page contradicts every long-running show's pack
+# and strips the tvdb title from all of it.
+@test "an episode list the authority paginates never contradicts the pack" {
+    python3 - "$CACHE" <<'PY'
+import json, sys
+json.dump({"tvdb:series:4242": {"name": "Long Run", "year": "1999"},
+           "tvdb:episodes:4242": {f"1/{n}": f"Episode {n}"
+                                  for n in range(1, 501)}},
+          open(sys.argv[1], "w"))
+PY
+    for n in $(seq 1 501); do
+        ep=$(printf '%02d' "$n")
+        file "$LIB/Long Pack/Season 01/long $ep.mkv" 1000
+        title_row "$LIB/Long Pack/Season 01/long $ep.mkv" \
+            "Long Run" 1999 1 "$n" "" "" "" "4242"
+    done
+    plan
+    want="$LIB/Long Run (1999) [tvdbid-4242]/Season 01"
+    want+="/Long Run (1999) - S01E01 - Episode 1.mkv"
+    [ "$(dst "$LIB/Long Pack/Season 01/long 01.mkv")" = "$want" ]
+    run grep -i "numbering tvdb contradicts" "$EXC"
+    [ "$status" -ne 0 ]
+}
+
+# ------------------------------------------------------------- the operator map
+# Most of this library carries no tvdb id anywhere: the authority titles anime by
+# its own record — in the show's language — and the English name rides in aliases
+# the planner's name search never reads, so a search that demands tvdb's own
+# spelling cannot reach it. The operator's map is the other door: one line per
+# folder, `folder <TAB> tvdb id <TAB> note`, each id checked by hand against the
+# record it names. It outranks a provider id, it merges the release folders that
+# are one show, and every folder it touched is named in the exceptions: one wrong
+# row there is 1,268 renames to the wrong show, so nothing about it is silent.
+
+plan_map() {                          # the plan, with the operator's map in hand
+    run python3 "$PLAN" --root "$LIB" --enum "$ENUM" --titles "$TITLES" \
+        --probed "$PROBED" --tmdb-cache "$CACHE" --movies "$MOVIES" \
+        --tvdb-ids "$1" --out "$OUT" --exceptions "$EXC"
+}
+
+@test "a folder the operator mapped to a tvdb id renames to that record" {
+    printf '{"tvdb:series:331753": %s}\n' \
+        '{"name": "Black Clover", "year": "2017"}' > "$CACHE"
+    {
+        printf '# the note column carries why the name search cannot reach it\n'
+        printf 'Black Clover 001\t331753\tthe record holds no alias\n'
+    } > "$BATS_TEST_TMPDIR/ids.tsv"
+    file "$LIB/Black Clover 001/Season 01/Black.Clover.001.mkv" 5000
+    title_row "$LIB/Black Clover 001/Season 01/Black.Clover.001.mkv" \
+        "Black Clover 001" "" 1 1
+    plan_map "$BATS_TEST_TMPDIR/ids.tsv"
+    want="$LIB/Black Clover (2017) [tvdbid-331753]/Season 01"
+    want+="/Black Clover (2017) - S01E01.mkv"
+    [ "$(dst "$LIB/Black Clover 001/Season 01/Black.Clover.001.mkv")" = "$want" ]
+}
+
+@test "release folders one id maps are ONE series folder" {
+    printf '{"tvdb:series:81797": %s}\n' \
+        '{"name": "One Piece", "year": "1999"}' > "$CACHE"
+    {
+        printf '[Anime Time] One Piece (0001-1071)\t81797\tbare "One Piece" is the 2023 live action\n'
+        printf 'One Piece Ship Collection\t81797\tthe same record, split by release\n'
+    } > "$BATS_TEST_TMPDIR/ids.tsv"
+    file "$LIB/[Anime Time] One Piece (0001-1071)/One.Piece.0001.mkv" 5000
+    file "$LIB/One Piece Ship Collection/One.Piece.0002.mkv" 6000
+    title_row "$LIB/[Anime Time] One Piece (0001-1071)/One.Piece.0001.mkv" \
+        "One Piece" 1999 1 1
+    title_row "$LIB/One Piece Ship Collection/One.Piece.0002.mkv" \
+        "One Piece Ship Collection" "" 1 2
+    plan_map "$BATS_TEST_TMPDIR/ids.tsv"
+    want="$LIB/One Piece (1999) [tvdbid-81797]/Season 01"
+    want+="/One Piece (1999) - S01E01.mkv"
+    [ "$(dst "$LIB/[Anime Time] One Piece (0001-1071)/One.Piece.0001.mkv")" \
+        = "$want" ]
+    want="$LIB/One Piece (1999) [tvdbid-81797]/Season 01"
+    want+="/One Piece (1999) - S01E02.mkv"
+    [ "$(dst "$LIB/One Piece Ship Collection/One.Piece.0002.mkv")" = "$want" ]
+}
+
+@test "the map outranks a provider id and says which two disagreed" {
+    printf '{"tvdb:series:4242": %s, "tvdb:series:78850": %s}\n' \
+        '{"name": "Real Ship", "year": "1999"}' \
+        '{"name": "Box Junk", "year": "2016"}' > "$CACHE"
+    printf '%s\t4242\thand-verified against the record\n' \
+        "Show Box (2016) Season 1 S01 (1080p WEB-DL)" > "$BATS_TEST_TMPDIR/ids.tsv"
+    plan_map "$BATS_TEST_TMPDIR/ids.tsv"
+    dst "$BOX/Show.Box.S01E01.1080p.WEB-DL.mkv" \
+        | grep -q "^$LIB/Real Ship (1999) \[tvdbid-4242\]/Season 01/"
+    run grep -E '78850.*4242|4242.*78850' "$EXC"
+    [ "$status" -eq 0 ]
+}
+
+@test "a map id the authority never answered keeps the provider's name and is named" {
+    printf 'Black Clover 001\t331753\ttvdb never answered\n' \
+        > "$BATS_TEST_TMPDIR/ids.tsv"
+    file "$LIB/Black Clover 001/Season 01/Black.Clover.001.mkv" 5000
+    title_row "$LIB/Black Clover 001/Season 01/Black.Clover.001.mkv" \
+        "Black Clover 001" "" 1 1
+    plan_map "$BATS_TEST_TMPDIR/ids.tsv"
+    dst "$LIB/Black Clover 001/Season 01/Black.Clover.001.mkv" \
+        | grep -q "^$LIB/Black Clover 001 \[tvdbid-331753\]/Season 01/"
+    run grep -q "331753" "$EXC"
+    [ "$status" -eq 0 ]
+}
+
+@test "a map row for a folder the array no longer holds is reported" {
+    printf 'Gone Pack\t4242\tmoved away\n' > "$BATS_TEST_TMPDIR/ids.tsv"
+    plan_map "$BATS_TEST_TMPDIR/ids.tsv"
+    run grep "Gone Pack" "$EXC"
+    [ "$status" -eq 0 ]
+}
+
+@test "a map row whose folder is on the array but never became a series says so" {
+    # The array holds three folders exactly like this one: a credits/extras pack
+    # the operator mapped to a record, whose every file is bonus material with no
+    # series to own it. The folder IS on the array, and telling the operator the
+    # pack moved sends them hunting for a folder that never left.
+    printf 'Credit Pack\t114801\tthe record tvdb names\n' > "$BATS_TEST_TMPDIR/ids.tsv"
+    file "$LIB/Credit Pack/01. Extras/NCOP 01.mkv" 1200
+    plan_map "$BATS_TEST_TMPDIR/ids.tsv"
+    grep -q "bonus material with no series to own it" "$EXC"
+    grep -q "never became a series" "$EXC"
+    run grep "no folder on the array" "$EXC"
+    [ "$status" -ne 0 ]
+}
+
+@test "a map line whose id is not a number stops the plan" {
+    printf 'Black Clover 001\tnotanid\ttypo\n' > "$BATS_TEST_TMPDIR/ids.tsv"
+    file "$LIB/Black Clover 001/Season 01/Black.Clover.001.mkv" 5000
+    title_row "$LIB/Black Clover 001/Season 01/Black.Clover.001.mkv" \
+        "Black Clover 001" "" 1 1
+    plan_map "$BATS_TEST_TMPDIR/ids.tsv"
+    [ "$status" -ne 0 ]
+    [[ "$output" == *"notanid"* ]]
+}
+
+# The map the fleet ships is scripts/media-shows-tvdb-ids.tsv, and the planner
+# reads it by default: an unusable line there stops every plan the operator runs
+# from the checkout, so the seam validates the real file, not a fixture copy.
+@test "the shipped operator map parses and never stops a plan" {
+    MAPS="$REPO_ROOT/scripts/media-shows-tvdb-ids.tsv"
+    run awk -F '\t' '!/^#/ && NF {
+        if (NF < 2 || $2 !~ /^[0-9]+$/) { print "unusable row: " $0; bad = 1 }
+    } END { exit bad }' "$MAPS"
+    [ "$status" -eq 0 ]
+    dup=$(awk -F '\t' '!/^#/ && NF {print $1}' "$MAPS" | sort | uniq -d)
+    [ -z "$dup" ]
+    plan_map "$MAPS"
+    [ "$status" -eq 0 ]
+    grep -qi "operator's map" "$EXC"
+}
+
+@test "a map that names one folder twice stops the plan" {
+    printf '{"tvdb:series:78850": %s}\n' \
+        '{"name": "Naruto", "year": "2002"}' > "$CACHE"
+    {
+        printf 'Naruto Complete Series\t78850\tthe dub pack\n'
+        printf 'Naruto Complete Series\t331753\ta paste of another row\n'
+    } > "$BATS_TEST_TMPDIR/ids.tsv"
+    file "$LIB/Naruto Complete Series/Season 01/naruto 01.mkv" 5000
+    title_row "$LIB/Naruto Complete Series/Season 01/naruto 01.mkv" \
+        "Naruto Complete Series" "" 1 1
+    plan_map "$BATS_TEST_TMPDIR/ids.tsv"
+    [ "$status" -eq 2 ]
+    [[ "$output" == *"named twice"* ]]
+}

tests/media_verify.bats

@@ -0,0 +1,282 @@
+#!/usr/bin/env bats
+# Seam: scripts/media-verify.py — the replay of a relayout journal against a
+# media server's OWN database, which is the documented proof that a rename
+# landed (a scan answers 204 whether or not it finds anything).
+#
+# Every test states what the database holds and asserts what the command prints
+# and returns; nothing here reaches into the script's internals. The fixtures are
+# minimal sqlite files with the columns the two servers really use, so the seam
+# fails if the tool ever reads the wrong table, forgets Plex's `deleted_at`
+# filter, or forgets that Jellyfin stores the container-side path (/data/…) while
+# Plex stores the host path verbatim.
+
+load helpers
+
+VERIFY="$REPO_ROOT/scripts/media-verify.py"
+
+# jf_mk <db> — the Jellyfin shape: one BaseItems table, Path is the column.
+jf_mk() {
+    python3 - "$1" <<'PY'
+import sqlite3, sys
+con = sqlite3.connect(sys.argv[1])
+con.execute("create table BaseItems (Id INTEGER PRIMARY KEY, Path TEXT, Type TEXT,"
+            " ParentId INTEGER, Name TEXT)")
+con.commit()
+PY
+}
+
+# jf_row <db> <path> — one item the server believes it has.
+jf_row() {
+    python3 - "$1" "$2" <<'PY'
+import sqlite3, sys
+con = sqlite3.connect(sys.argv[1])
+con.execute("insert into BaseItems (Path, Type) values (?, 'x')", (sys.argv[2],))
+con.commit()
+PY
+}
+
+# px_mk <db> — the Plex shape: media_parts joined up to metadata_items.
+px_mk() {
+    python3 - "$1" <<'PY'
+import sqlite3, sys
+con = sqlite3.connect(sys.argv[1])
+con.execute("create table metadata_items (id INTEGER PRIMARY KEY, title TEXT,"
+            " deleted_at TEXT)")
+con.execute("create table media_items (id INTEGER PRIMARY KEY, metadata_item_id"
+            " INTEGER, container TEXT)")
+con.execute("create table media_parts (id INTEGER PRIMARY KEY, media_item_id"
+            " INTEGER, file TEXT, deleted_at TEXT)")
+con.commit()
+PY
+}
+
+# px_row <db> <path> [DELETED_AT] — one part; a non-empty DELETED_AT is a row a
+# deleted scan left behind, which must never count as proof.
+px_row() {
+    python3 - "$1" "$2" "${3:-}" <<'PY'
+import sqlite3, sys
+db, path, gone = sys.argv[1], sys.argv[2], sys.argv[3] or None
+con = sqlite3.connect(db)
+cur = con.execute("insert into metadata_items (title, deleted_at) values ('t', ?)",
+                  (gone,))
+mi = cur.lastrowid
+cur = con.execute("insert into media_items (metadata_item_id, container)"
+                  " values (?, 'mkv')", (mi,))
+con.execute("insert into media_parts (media_item_id, file, deleted_at)"
+            " values (?, ?, NULL)", (cur.lastrowid, path))
+con.commit()
+PY
+}
+
+# move_row <src> <dst> — one move in the journal.
+move_row() {
+    printf '{"op": "move", "src": "%s", "dst": "%s"}\n' "$1" "$2" >> "$JOURNAL"
+}
+
+setup() {
+    SHARE="$BATS_TEST_TMPDIR/mnt/entropy"
+    JFDB="$BATS_TEST_TMPDIR/jellyfin.db"
+    PXDB="$BATS_TEST_TMPDIR/plex.db"
+    JOURNAL="$BATS_TEST_TMPDIR/journal.jsonl"
+    : > "$JOURNAL"
+    jf_mk "$JFDB"
+    px_mk "$PXDB"
+}
+
+@test "every move that the database holds at its destination is reported landed" {
+    move_row "$SHARE/Movies/Old Name (1999).mkv" "$SHARE/Movies/Old Name (1999)/Old Name (1999).mkv"
+    move_row "$SHARE/Movies/Two.mkv" "$SHARE/Movies/Two/Two.mkv"
+    # Jellyfin stores the container-side path: /data stands for the share.
+    jf_row "$JFDB" "/data/Movies/Old Name (1999)/Old Name (1999).mkv"
+    jf_row "$JFDB" "/data/Movies/Two/Two.mkv"
+
+    run python3 "$VERIFY" --journal "$JOURNAL" --db-kind jellyfin --db "$JFDB" \
+        --share "$SHARE" --container /data
+    [ "$status" -eq 0 ]
+    [ "${lines[0]}" = "jellyfin: 2 moves checked" ]
+    [ "${lines[1]}" = "landed: 2" ]
+    [ "${lines[2]}" = "still at src: 0" ]
+    [ "${lines[3]}" = "missing from the DB: 0" ]
+}
+
+@test "a database that has not rescanned yet is refused, naming the stale rows" {
+    move_row "$SHARE/Movies/Old.mkv" "$SHARE/Movies/Old/Old.mkv"
+    jf_row "$JFDB" "/data/Movies/Old.mkv"
+
+    run python3 "$VERIFY" --journal "$JOURNAL" --db-kind jellyfin --db "$JFDB" \
+        --share "$SHARE" --container /data
+    [ "$status" -eq 1 ]
+    [ "${lines[1]}" = "landed: 0" ]
+    [ "${lines[2]}" = "still at src: 1" ]
+    [[ "$output" == *"$SHARE/Movies/Old.mkv"* ]]
+}
+
+@test "a moved file no row of the database names is reported missing" {
+    move_row "$SHARE/Movies/Old.mkv" "$SHARE/Movies/Old/Old.mkv"
+
+    run python3 "$VERIFY" --journal "$JOURNAL" --db-kind jellyfin --db "$JFDB" \
+        --share "$SHARE" --container /data
+    [ "$status" -eq 1 ]
+    [ "${lines[3]}" = "missing from the DB: 1" ]
+    [[ "$output" == *"$SHARE/Movies/Old/Old.mkv"* ]]
+}
+
+@test "Plex stores the host path verbatim, so a row at the destination lands" {
+    move_row "$SHARE/TVShows/Show/Season 01/Show S01E01.mkv" \
+             "$SHARE/TVShows/Show (2002)/Season 01/Show (2002) S01E01.mkv"
+    px_row "$PXDB" "$SHARE/TVShows/Show (2002)/Season 01/Show (2002) S01E01.mkv"
+
+    run python3 "$VERIFY" --journal "$JOURNAL" --db-kind plex --db "$PXDB" \
+        --share "$SHARE"
+    [ "$status" -eq 0 ]
+    [ "${lines[0]}" = "plex: 1 moves checked" ]
+    [ "${lines[1]}" = "landed: 1" ]
+}
+
+@test "a Plex row a deleted scan left behind is not proof a move landed" {
+    move_row "$SHARE/TVShows/Old S01E01.mkv" "$SHARE/TVShows/Show/Old S01E01.mkv"
+    px_row "$PXDB" "$SHARE/TVShows/Show/Old S01E01.mkv" "2026-10-30 00:00:00"
+
+    run python3 "$VERIFY" --journal "$JOURNAL" --db-kind plex --db "$PXDB" \
+        --share "$SHARE"
+    [ "$status" -eq 1 ]
+    [ "${lines[1]}" = "landed: 0" ]
+    [ "${lines[3]}" = "missing from the DB: 1" ]
+}
+
+@test "a database without the columns that kind needs is an error, not a zero" {
+    move_row "$SHARE/Movies/Old.mkv" "$SHARE/Movies/Old/Old.mkv"
+
+    run python3 "$VERIFY" --journal "$JOURNAL" --db-kind jellyfin --db "$PXDB" \
+        --share "$SHARE" --container /data
+    [ "$status" -eq 2 ]
+    [[ "$output" == *"$PXDB"* ]]
+    [[ "$output" == *"BaseItems"* ]]
+}
+
+@test "only move rows are counted, so folder operations cannot inflate the tally" {
+    move_row "$SHARE/Movies/Old.mkv" "$SHARE/Movies/Old/Old.mkv"
+    jf_row "$JFDB" "/data/Movies/Old/Old.mkv"
+    printf '{"op": "mkdir", "dst": "%s/Movies/Old"}\n' "$SHARE" >> "$JOURNAL"
+    printf '{"op": "rmdir", "path": "%s/Movies/Empty"}\n' "$SHARE" >> "$JOURNAL"
+
+    run python3 "$VERIFY" --journal "$JOURNAL" --db-kind jellyfin --db "$JFDB" \
+        --share "$SHARE" --container /data
+    [ "$status" -eq 0 ]
+    [ "${lines[0]}" = "jellyfin: 1 moves checked" ]
+}
+
+@test "a journal with no moves is clean, not a failure" {
+    printf '{"op": "mkdir", "dst": "%s/Movies/Old"}\n' "$SHARE" >> "$JOURNAL"
+
+    run python3 "$VERIFY" --journal "$JOURNAL" --db-kind jellyfin --db "$JFDB" \
+        --share "$SHARE" --container /data
+    [ "$status" -eq 0 ]
+    [ "${lines[1]}" = "landed: 0" ]
+}
+
+@test "the offender list stops at --show so a stale library stays readable" {
+    for n in 1 2 3 4; do
+        move_row "$SHARE/Movies/F$n.mkv" "$SHARE/Movies/F$n/F$n.mkv"
+    done
+    run python3 "$VERIFY" --journal "$JOURNAL" --db-kind jellyfin --db "$JFDB" \
+        --share "$SHARE" --container /data --show 2
+    [ "$status" -eq 1 ]
+    [ "${lines[3]}" = "missing from the DB: 4" ]
+    [[ "$output" == *"$SHARE/Movies/F1/F1.mkv"* ]]
+    [[ "$output" != *"$SHARE/Movies/F4/F4.mkv"* ]]
+}
+
+@test "the missing rows are counted by extension, so a sidecar is not mistaken for a lost film" {
+    move_row "$SHARE/Music/Album/Mandatory Fun.log" "$SHARE/Music/Weird Al/Mandatory Fun (2014)/Mandatory Fun.log"
+    move_row "$SHARE/Music/Album/Film.mkv" "$SHARE/Music/Weird Al/Mandatory Fun (2014)/Film.mkv"
+
+    run python3 "$VERIFY" --journal "$JOURNAL" --db-kind jellyfin --db "$JFDB" \
+        --share "$SHARE" --container /data
+    [ "$status" -eq 1 ]
+    [ "${lines[3]}" = "missing from the DB: 2" ]
+    [[ "$output" == *"missing by extension: .log 1, .mkv 1"* ]]
+}
+
+@test "--ignore-ext keeps a file the server never indexes out of the verdict" {
+    move_row "$SHARE/Music/Album/Song.flac" "$SHARE/Music/Weird Al/Mandatory Fun (2014)/Song.flac"
+    jf_row "$JFDB" "/data/Music/Weird Al/Mandatory Fun (2014)/Song.flac"
+    move_row "$SHARE/Music/Album/Mandatory Fun.cue" "$SHARE/Music/Weird Al/Mandatory Fun (2014)/Mandatory Fun.cue"
+
+    run python3 "$VERIFY" --journal "$JOURNAL" --db-kind jellyfin --db "$JFDB" \
+        --share "$SHARE" --container /data --ignore-ext log,cue
+    [ "$status" -eq 0 ]
+    [ "${lines[1]}" = "landed: 1" ]
+    [ "${lines[3]}" = "missing from the DB: 0" ]
+    [[ "$output" == *"not indexed (extension ignored): 1"* ]]
+}
+
+# wal_case <db> — a Jellyfin database whose NEW row lives only in the
+# write-ahead log: the server has committed the rename but not checkpointed it,
+# which is the normal state of a library a scan is writing. The holder
+# connection keeps the WAL from folding into the main file, and the verifier
+# runs as a real subprocess so it faces the same files Plex and Jellyfin leave.
+wal_case() {
+    python3 - "$JFDB" "$JOURNAL" "$SHARE" "$VERIFY" <<'PY'
+import sqlite3, subprocess, sys
+db, journal, share, verify = sys.argv[1:5]
+w = sqlite3.connect(db)
+w.execute("pragma journal_mode=wal")
+w.execute("pragma wal_autocheckpoint=0")
+w.execute("insert into BaseItems (Path, Type) values ('/data/Movies/Old.mkv', 'x')")
+w.commit()
+w.execute("pragma wal_checkpoint(truncate)")
+holder = sqlite3.connect(db)  # last-connection close would checkpoint
+w.execute("update BaseItems set Path='/data/Movies/Old/Old.mkv'")
+w.commit()
+r = subprocess.run([sys.executable, verify, "--journal", journal,
+                    "--db-kind", "jellyfin", "--db", db,
+                    "--share", share, "--container", "/data"],
+                   capture_output=True, text=True)
+print(r.stdout, end="")
+sys.exit(r.returncode)
+PY
+}
+
+@test "a row the server committed but has not checkpointed is proof, not a miss" {
+    move_row "$SHARE/Movies/Old.mkv" "$SHARE/Movies/Old/Old.mkv"
+    run wal_case
+    [ "$status" -eq 0 ]
+    [ "${lines[1]}" = "landed: 1" ]
+    [ "${lines[3]}" = "missing from the DB: 0" ]
+}
+
+# The DB alone cannot tell a lost file from a sidecar: both are "no row at the
+# destination". The tool therefore stats the two paths and separates the classes
+# the runbook names, so an operator never reads a `.pdf` as a lost film or,
+# worse, reads a real loss as a sidecar.
+@test "a file the database does not name that still sits at src is the pass's own damage" {
+    mkdir -p "$SHARE/Movies"
+    echo film > "$SHARE/Movies/Old.mkv"
+    move_row "$SHARE/Movies/Old.mkv" "$SHARE/Movies/Old/Old.mkv"
+
+    run python3 "$VERIFY" --journal "$JOURNAL" --db-kind jellyfin --db "$JFDB" \
+        --share "$SHARE" --container /data
+    [ "$status" -eq 1 ]
+    [ "${lines[3]}" = "missing from the DB: 1" ]
+    [ "${lines[4]}" = "  on disk at dst, no row names it: 0" ]
+    [ "${lines[5]}" = "  REAL — file still at src: 1" ]
+    [ "${lines[6]}" = "  gone — at neither path: 0" ]
+    [[ "$output" == *"real: $SHARE/Movies/Old.mkv"* ]]
+}
+
+@test "a file at neither path is gone, and a file at dst the server ignores is not a loss" {
+    move_row "$SHARE/Movies/Gone.mkv" "$SHARE/Movies/Gone/Gone.mkv"
+    mkdir -p "$SHARE/Movies/Sidecar"
+    echo cover > "$SHARE/Movies/Sidecar/cover.jpg"
+    move_row "$SHARE/Movies/Album/cover.jpg" "$SHARE/Movies/Sidecar/cover.jpg"
+
+    run python3 "$VERIFY" --journal "$JOURNAL" --db-kind jellyfin --db "$JFDB" \
+        --share "$SHARE" --container /data
+    [ "$status" -eq 1 ]
+    [ "${lines[3]}" = "missing from the DB: 2" ]
+    [ "${lines[4]}" = "  on disk at dst, no row names it: 1" ]
+    [ "${lines[5]}" = "  REAL — file still at src: 0" ]
+    [ "${lines[6]}" = "  gone — at neither path: 1" ]
+    [[ "$output" == *"gone: $SHARE/Movies/Gone/Gone.mkv"* ]]
+}