# Release 8 — video titles (+ follow-ups)

`main` at `bb3dbb4c`, release 7 live 2026-09-25 13:11; release 8 followed the same afternoon, starting with
the operator's video-titles ask. Rules: `plans/tools/implementer-rules.md`. Record file: this file.

## Record

### Slice V, as shipped — video titles (2026-09-25)

Branch `one-core/r8-video-titles` off `main` `bb3dbb4c`. The operator's ask (2026-09-25): "In the
editor, the individual video view should show video metadata like the title, and `/videos` should
show titles in the list when available and allow searching by them." There is no global `/videos`;
the list is the per-channel workspace `editor/app/channels/[slug]/videos/page.tsx`. Before this
slice a list row was built from `ChannelSnapshot` id lists and showed only the id, the search box
matched only the id, and the video page read `metadata.info.json` with its own parser, so a video
that was never downloaded showed a bare id even when the metadata scan knew what it was called.

Three places hold a title, and the slice reads them cheapest first. The first one found wins:
- **`index`**: the LMDB `sums` sub-DB, reached by a key-only walk of this channel's `byChannel`
  range. A summary is decoded only for an id the list asked about. It is opened `readOnly` **with
  `compression: true`**, for the reason `curatedTagsPreview.ts`'s `openIndex` gives: without it,
  any value over ~1 KB throws. A missing or unopenable index gives no titles and is not an error.
  An index title equal to the id is `summarize()`'s fallback, not a title, and is skipped.
- **`scan`**: `channels/<slug>/metadata-scan.json`, read once through `loadMetadataScan`.
- **`metadata`**: `data/<id>/metadata.info.json`, only for ids the first two did not name. It is a
  16 KB head read plus a regex (yt-dlp writes `id` then `title` first). The full parse
  (`loadRawMetadataFromDir`) runs only when the head has no title. 16 reads run concurrently.

Nothing creates `data/<id>/`, which keeps the scan store's invariant. `metadataScanStore.ts` and
`channelSnapshot.ts` are unchanged.

| sha | what |
|---|---|
| `9ed6cce8` | `common/controller/videoTitles.ts`: `readChannelVideoTitles(paths, slug, ids) → Map<id, {title, source: "index"\|"scan"\|"metadata"}>` and `readVideoMetadataForDisplay(paths, slug, id) → {title?, description?, webpageUrl?, uploader?, uploadDate?, duration?, source: "metadata"\|"scan"\|"none"}`. `.test.ts` has 6 cases on a real compressed LMDB with a 4 KB description: the three-source merge with first hit winning, bare ids absent and another channel's id not leaking; missing index and scan store; the id-as-title fallback skipped; the head read with an escaped title, a title past 16 KB and no dir created; the display reader's three outcomes; and the 5,000-id cost case |
| `cdd6c3dc` | The list. `VideoRow.title?`. `computeVideoRows` takes an optional `titles` map, which the page fills once from `readChannelVideoTitles` over data-dir ids ∪ `undownloadedIds`. `matchesVideoQuery` (id OR title, case-insensitive) is used by both the client filter and the server's `?q=` ordering for prev/next. A row shows the title with the id on a muted mono line under it, and shows the id alone when there is no title. **The row's accessible name stays `open <id>`**, and the checkbox stays `select <id>`. The placeholder is now "Search title or id…". The empty copy ("No videos match this filter.") names no ids and is unchanged. The embedded detail pane's `video title` line reads the same map, and the page's private `loadVideoTitle` parser is gone |
| `16ef0758` | The video page. `loadMeta` is now `readVideoMetadataForDisplay`, and the page's private parser is gone. When the source is `scan`, the header shows the scan's title, upload date and duration, plus an italic note "from the listing scan — not downloaded" (`aria-label="metadata source"`). A collapsed `<details>` **Description** block appears when either source has a description. `generateMetadata` behaves as before (title, else id) and now also finds scan titles. New `editor/e2e/video-titles.spec.ts` (2 tests) on `youtube-with-playlist` plus a seeded `metadata-scan.json`: `fake00000001` shows its `metadata.info.json` title, `fake00000002` its scan title, and `fake00000003` its bare id. "harbor" leaves one row, and the id still matches. The undownloaded page shows the h2, the scan note, `2024-03-15`, `12:34`, and a Description that is collapsed and opens on click. The downloaded page has no scan note |
| `ff3944cd` | this record and two `[Unreleased]` bullets in `editor/CHANGELOG.md` |
| `4e8bb285` | **Review M1.** Source 3 is memoized per channel in `videoTitles.ts` (`globalThis.__yttVideoTitleMemo__`: `Map<dataDir, {dataDirMtimeMs, titles}>`). Each render does one `stat` of `data/`. A changed mtime (a video dir added or removed) drops the channel's entry. Only ids missing from the memo are read, and misses are not memoized, so a dir still being downloaded picks up its title once the file lands. The memo holds at most 64 channels, least recently used evicted first. `resetVideoTitleMemo()` is called by `api/test/invalidate-cache` alongside the other process memos. `videoTitleMetadataReadCount()` is a test hook. New unit case: with `data/`'s mtime unchanged, the second call reads 0 files and still serves a title whose file was deleted; a new dir makes it read all 3 again; a miss is re-read later |
| `41facfe0` | **Review L1 + L2.** `matchesVideoQuery` moves above `parseFilters`' doc comment. `editor/app/channels/[slug]/lib/videoRows.test.ts` (3 cases) covers id hits, title hits (case-insensitive), a row without a title, and a blank query. This pins the server `?q=` path, which shares the predicate with the search box |
| *(this commit)* | the re-gate below and the corrected cost paragraph |

**Gates** (worktree root, on `16ef0758`). tsc (`pnpm -r --no-bail --workspace-concurrency=1 exec
tsc --noEmit`) was clean before each commit. common **1801/1801** = 1795 + 6 (`videoTitles`).
Editor unit **72/72**. test:scripts **161 pass + 1 skip**. mcp **219/219**. `pnpm --filter editor
exec next build` ok. The export build was not run, because the slice touches no file under
`export/` and no `common/` module it imports. EDITOR e2e used `$T/v-specs.txt`. `videos.spec` and
`channel-page.spec` do not exist, so the list is `video-titles`, `video-page`,
`video-filter-combine`, and the six specs that drive the list or the embedded pane
(`channel-embedded-video`, `bulk-actions`, `incomplete-transcript`, `download-format-guard`,
`channel-storage`, `whisper`). Result (`v-e2e.log`): **62 passed, 0 failed, 4.0 m**, after a
2 m 38 s queue wait behind `one-core/r8-state-share`. The run used this worktree's block
(`PORT=4011`, `EXPORT_PORT=4010`); the `PORT:3011` printed by the e2e script is a default for when
the env var is unset. Every heavy step started with ≥ 3 GB available.

**Re-gate after the review fixes** (on `41facfe0`). tsc was clean. common **1802/1802** = 1801 + 1
(memo case). Editor unit **75/75** = 72 + 3 (`videoRows.test.ts`). `pnpm --filter editor exec next
build` ok. The memo touches the e2e reset route, so the EDITOR e2e re-ran the full nine-spec list
(`v-e2e2.log`): **62 passed, 0 failed, 3.6 m**, with no queue wait. test:scripts and mcp were not
re-run, because neither imports anything that changed.

**Numbers: none.** No `settings.json`, `site.json` or `config.json` key changed, and nothing is
written: the slice only reads.

**Cost of the title map** (the brief's bar: "does not change the page's order of magnitude").
The first version held that bar only for a YouTube-shaped channel, where most titles come from the
index. The review found the Rumble case. On Rumble every directory name misses the index, so every
row fell through to a `metadata.info.json` head read, on **every** render. Each row click
re-renders, because rows are `?video=` links on a force-dynamic page. `the-quartering-rumble` has
**8,049** dirs. The reviewer replayed the read pattern read-only and measured **5,024 ms cold /
224 ms warm per render** before the memo. After the memo (`4e8bb285`), measured read-only with
`readChannelVideoTitles` itself over the live `data/` (no index opened, `$T/v-memo-measure.mts`):
the **first render took 5,331 ms** (cold page cache, all 8,049 titled) and **memoized renders took
5.5 ms and 6.5 ms**. The cold first render is still paid once per editor process, and again after a
video dir is added or removed on that channel. In the unit test's synthetic 5,000-id mix (3,000
index, 1,500 scan, 400 `metadata.info.json`, 100 bare) it is 82–148 ms first and ~75 ms memoized.
That run is dominated by the index walk and the scan store, which are not memoized: one LMDB range
and one JSON read, not N file reads.

**The memo's one blind spot, accepted.** A `metadata.info.json` rewritten inside an *existing* video
dir does not change `data/`'s mtime, so the list keeps the old title until the editor restarts or a
video dir is added or removed. A video's title does not change after download, so this was
accepted.

**Found and left.**
- **Coverage is partial on `paramount-tactical`.** A read-only `jq` over live `snapshot.json` /
  `metadata-scan.json` found one channel with undownloaded ids: `paramount-tactical`, with **1,439**
  and no `metadata-scan.json`. Those rows show ids until a metadata scan runs, which is the same
  step slice K's `keep-videos` needs. Every other channel's list is fully downloaded, so it is
  titled from the index and `metadata.info.json`.
- **The index is keyed by metadata id and the list by directory name.** On Rumble (URL-slug dirs,
  embed-id metadata) and on legacy `YYYYMMDD_<id>` dirs, the index lookup misses. Those rows are
  titled from `metadata.info.json`, and the memo above now carries that cost. Matching dir names to
  index ids (for example through the `mtimes` sub-DB's `[slug, videoDir]` keys) would make the cold
  first render cheap too, but is left for later.
- **L3 (review, left).** When a previously scanned video has a `data/<id>/` dir but no readable
  `metadata.info.json` (a failed or partial download), the page falls back to the scan entry and says
  "not downloaded" beside a files panel. This is rare, and the wording was left as it is.
- **Rows stay sorted by id**, as before. Sorting by title or date is a separate ask.
- `VideoListPane.tsx` lives at `editor/app/channels/[slug]/components/`, not under `videos/**`. The
  brief names "the list pane" in ownership, so it was edited as in scope. `ROW_ESTIMATE_PX` (30) was
  left alone. Titled rows are about 40 px, and the virtualizer measures each row, so only the first
  scrollbar estimate is off.
- The stage lists (`VideoIdList.tsx`, on the download/transcribe stage panels) still show bare ids.
  They are not the `/videos` list, and titling them is outside this slice.
- **Commit trailers** name `Claude Opus 5.5 (1M context)`, as the release-6 and release-7
  implementers did.

### Slice S, as shipped — one shared auto-queue state per process (2026-09-25)

Branch `one-core/r8-state-share` off `main` `eff6a3a7`. **The bug, live on 2026-09-25.**
`sharedAutoQueueState` (`common/controller/autoRunner.ts`) is meant to give ONE `AutoQueueState`
object to all four lane runners, because `writeAutoQueueState` serializes the WHOLE
`.auto-queue/state.json` (all four lanes). It cached only the RESOLVED value. At boot,
`startAutoRunnersIfEnabled` awaits only each lane's *registration*: `runManagedFunction` fires
`runLoop` without awaiting it. So all four runLoops reached `await readAutoQueueState` before any of
them set `singleton.state`. Each got its own copy and kept it for its lifetime, since `state` is
captured once per runLoop and every `persist()` reuses it.

The live sequence ran as follows:
- **13:10–13:11** boot. Four private copies were made, all reading `download.platformBackoff.youtube = {fails: 12, until: 13:20}` and `videoDeferrals: {}`.
- **13:20** the download lane persisted `fails: 13`, `until: 13:52` and a 6 h deferral for `_60iFE_FBPQ`.
- **13:29** the operator renamed `paramount-tactical-videos` to `paramount-tactical`. The priority recompile re-shaped the other lanes' trees. The rename does not touch this file.
- **13:33:37** another lane picked work and persisted its boot-time copy, which set the file back to `fails: 12` and deferrals `{}`. The pacing was silently undone on disk.

The rename is only what made another lane persist at that moment. The race is what made the write wrong.

**The fix** caches the in-flight read, keyed by the state file. Every caller in the same window
awaits one `readAutoQueueState` and gets the same object. A failed read is never cached, so the next
caller retries. A read that a call for a different file supersedes resolves only to its own awaiters.
The e2e harness reset (`api/test/invalidate-cache` sets `__yttAutoRunner__ = undefined`) replaces the
singleton wholesale, so a read still in flight lands in the old singleton and cannot leak into the
next spec. The big comment above the function is kept, and a paragraph with this incident is added.
`sharedAutoQueueState` is now exported for the tests. There is no restructuring, no file-format
change and no change to `writeAutoQueueState`.

**The same bug in the other direction, fixed in review.** `recordDownloadBackoff`
(`common/jobs/downloadBackoff.ts:31-43`) records a 429 hit by a manual Sync, a metadata scan or the
video page. It was a disk-only read-modify-write while every runner held the shared object in
memory, so the next save by any lane erased it. The download lane's merge-from-disk at the top of
each iteration did not help while that lane was paused, stopped or at capacity, which is when an
operator is riding out a rate limit. The holder and `sharedAutoQueueState` moved to
`jobs/autoQueueState.ts` on their own global, `__yttAutoQueueState__`. `jobs/` may not import
`controller/`, and `controller/` importing `jobs/` is allowed, so `architecture.test.ts` is unchanged.
`autoRunner.ts` re-exports `sharedAutoQueueState`. A new `liveAutoQueueState(paths)` returns the live
object, or the in-flight one, without starting a read. `recordDownloadBackoff` uses it: when a runner
is live, it merges the disk backoff in (the later `until` wins, as the runner's merge does), escalates
on the live object and writes through it. With no runner live it keeps the disk round trip.
`platformCooldownRemainingMs` and the status builder's `computeLeafPending`, which only clones, prefer
the live object. The e2e reset (`api/test/invalidate-cache`) clears the new global beside
`__yttAutoRunner__`.

| sha | what |
|---|---|
| `135dbebd` | `autoRunner.ts`: `AutoRunnerSingleton` gains `loading` / `loadingFile`, and `sharedAutoQueueState` caches the promise (exported, with the incident paragraph). `autoRunner.test.ts` has 4 cases: (a) four concurrent calls (the boot fan-out) resolve to the same object, and a later call gets it too; (b) a mutation through one caller (backoff `fails: 13` plus a video deferral) is visible to the other before any write; (c) the write seam: the download lane escalates the backoff and writes, then another lane mutates the digest runtime and writes *its* reference, and the file on disk carries both; (d) a reset singleton reads afresh, and two files in flight at once stay two objects. Temp dirs, no module mocks. **Cases (a)–(c) FAIL against the pre-fix behaviour** (checked by disabling the in-flight branch: 3 failed) and pass with it |
| `755e137b` | the `[Unreleased]` bullet in `editor/CHANGELOG.md` (this record is pasted into `plans/release-8.md` by the parent at merge) |
| `4cfc7491` | (review fix) The holder and `sharedAutoQueueState` move to `jobs/autoQueueState.ts` (`__yttAutoQueueState__`, plus `liveAutoQueueState`), and `autoRunner.ts` re-exports them. `recordDownloadBackoff` merges and writes through the live object, and `platformCooldownRemainingMs` and `computeLeafPending` prefer it. `invalidate-cache` clears the new global. `downloadBackoff.test.ts` gains 4 cases: with a runner live, another lane's persist keeps a manual cooldown on disk; a cooldown already on disk is merged in, not dropped; the remaining time prefers the live object; with no runner live, the call stays a disk round trip and starts no read. **The first three FAIL on the pre-fix `downloadBackoff.ts`** (checked: 3 failed) |
| `89a7d6ab` | the CHANGELOG clause for the cooldown fix |

**Gates.** First run, on `135dbebd`: tsc clean; common **1799/1799** = 1795 + 4; editor unit
**72/72**; `pnpm --filter editor exec next build` ok. EDITOR e2e, `auto-queue.spec.ts
lane-runner.spec.ts pacing.spec.ts queues.spec.ts` (`s-e2e1.log`): **38 passed, 0 failed, 4.0 min**,
no queue wait.

Re-gate after the review fix, on `4cfc7491`: tsc clean; common **1803/1803** = 1799 + 4; editor unit
**72/72**. The first `next build` attempt failed on a Google Fonts fetch (`next/font/google` module
not found). The retry was ok, with no code change. EDITOR e2e, the same four specs plus
`rumble-sweep.spec.ts`, which seeds `platformBackoff` (`s-e2e2.log`): **39 passed, 0 failed, 4.0 min**, no queue wait.

The export build, test:scripts and mcp were not run, because the slice touches no file under
`export/`, `scripts/` or `mcp/`. Heavy steps started only at ≥ 3 GB available memory.

**Numbers: none.** No `settings.json`, `site.json` or `config.json` key changed, and the state file's
format is unchanged.

**Found and left.**
- **The status builder's disk read is kept as a fallback.** `computeLeafPending` reads
  `shared?.state`, then the live object, then the file. It only clones from it, so it is not a writer.
- **An orphaned runLoop after an e2e reset (pre-existing, e2e only).** A spec-1 runLoop can still
  persist its old object to the same fixture file until it notices its job is gone. That is a
  cross-spec clobber, not a two-lanes-in-one-process problem, and this slice did not introduce it.

### Slice H, as shipped — the homepage, rethought (2026-09-25)

Branch `one-core/r8-homepage` off `main` `07a56106`. **The operator's direction (2026-09-25):** "take a
look at the homepage and try out a complete refresh, rethink it from the ground up. Primarily describe
the project, and any of our existing sites should be regarded as the instances that belong to me, maybe
called something like 'Official instances'." The page had "a bit of 'clunky AI' writing where it could
be more straight to the point and have less subtitles"; "The whole 'What this isn't' section seems kind
of bad"; "narrow it down to minimal most impactful copy and show some cool stats about the official
instances"; and "The 'recent acquisitions' list doesn't feel like it should be the above-the-fold
showpiece, I think a chart there would be a cooler visual." The hub link stays withheld
(`HUB_LINK_ENABLED = false`).

**The data.** `buildHomepageSummary` is v5, all additive and optional on the type so a v4 summary on
disk still renders (its numbers hide):
- `monthly: {month, bySite}[]` counts transcribed public-universe recordings by **upload month**
  (`VideoStat.uploadDate`), attributed to the primary public site. It is full history, from the
  earliest upload month to the last complete month (the build month is never emitted), zero-filled, and every site is keyed in every month.
  Upload month rather than `transcribedDate` because the transcription history is six months old
  (2026-04 to 2026-09, 25,288 of it in May) and would chart the tool's own backlog. Upload month
  shows how far back each archive reaches: 204 months, 2009-09 to 2026-08.
- `monthlyUnplaced` counts the transcripts with a missing, malformed, build-month or future upload date, so
  nothing is dropped silently (106 on the current corpus, all from the build month).
- Each site gains `channels` (with a transcript), `recordings` (with a download date), `hoursArchived`
  and `gone` (status `deleted`).
- `official` sums them over the public sites. It is not `totals`, which also counts pool-only
  channels and the URL-less Jasolyzer: 49,767 official transcripts against 49,769 in total.

**The page, top to bottom, with its final copy:**
1. **H1** `{official.hoursArchived} hours of speech, searchable to the second.` (no data:
   `Every word a channel said, searchable to the second.`). It is one line from `lg` up.
   **Subhead:** "Download a channel's back catalogue, transcribe it on your own hardware, publish a
   static site you host yourself." The CTAs are unchanged: `Download the source` → `/downloads/`,
   `Read the setup guide →` → `/docs/install/`, and the hub button behind the switch.
2. **The chart** (`ArchiveGrowthChart.tsx`), in the hero above the fold at 1280×900. It has a
   legend row, then stacked strata, then the caption "Transcripts by the month each video was
   published, all official instances." and a `Numbers by year` details table.
3. **The stats strip** (`FamilyStats.tsx`): Hours of speech · Transcripts · Recordings · Channels ·
   Official instances · **Recordings gone at the source, still here**. The last cell is double
   width, in `--state-gone`. The caption is `Across the official instances · index built <time>`.
4. **Official instances**, with the standfirst "The archives I run. Anyone can run their own." It
   has five cards: title linking out (↗), description, and channels · recordings · transcripts ·
   hours. The stripe is `seriesColor(i)`, the chart's colour for that instance.
5. **What it does**, as three short paragraphs. Without subtitles, three one-sentence items are a
   paragraph with bullets in front:
   "Archilyzer downloads a channel's videos and keeps up with new uploads. It uses the platform's
   captions where they exist and transcribes the audio on your machine where they don't." / "The
   result is a static site of plain HTML and JSON that any file host can serve. Search covers every
   transcript and opens the video at the second the words were said." / "It is a program you run,
   not a service. There is no account and nothing phones home. The docs cover setup and deployment."
   (links `/docs/`).

**Dropped from `/`:** the recent-acquisitions rail (`RecentAdditions.tsx` is kept and `recent` stays
in the summary), "How it works", "What this isn't", the proof-point band (its number is now the strip's
gone cell), the "This deployment, at last build" eyebrow and every other eyebrow.

**The chart.** It is a server component and renders inline SVG at build time. It ships no client JS
and no chart library. The plot is an SVG with `preserveAspectRatio="none"` in a fixed-height box
(200/260/300 px), which avoids layout shift at any width. The hairlines are `non-scaling-stroke`, and
the axis labels are HTML positioned in percent, so no text stretches. Year ticks run every 4 years on
a phone and every 2 from `sm`. The value scale sits on its gridlines. Hover is native: one transparent
column per month with a `<title>` (month, total and per instance) and a CSS tint. The chart has
`role="img"` with a sentence label (total, span, instance count and busiest month). **Area, not bars:**
204 months over ~1,100 px is ~5 px a month, and the dataviz spec's 2 px gap would be half of each bar.
The palette check (`validate_palette.js`) on the family's `--chart-1..5` FAILS normal-vision separation
for the adjacent teal/blue pair (ΔE 12.4 light, 9.0 dark). The **stack order is therefore interleaved
(0, 2, 1, 4, 3)**, and every touching pair then passes (worst 21.5 light / 22.5 dark, CVD ≥ 10.2). The
colours still follow the instance. Cards no longer use a site's `accent`, so a stripe cannot disagree
with its layer (no site sets one today).

**`deploy homepage [--preview <branch>]`.** `deployHomepage` takes `previewBranch` the way `deployHub`
does. `previewBranchProblem` refuses `main`/`production` and bad names before the build check. A preview
deploys with `--branch <name>` and no `--branch main`, and prints the `previewAliasUrl` line.
`homepageDeployArgs(outDir, previewBranch?)` is the pure argv. **No deploy was run.**

| sha | what |
|---|---|
| `6fd98789` | `homepageSummary.ts` v5: `monthly`, `monthlyUnplaced`, per-site `channels`/`recordings`/`hoursArchived`/`gone`, `official`. New `homepageSummary.test.ts` (+3): upload-month placement, zero fill and every site keyed; unplaceable dates counted; per-site and official sums exclude a URL-less site that `totals` still counts; hours rounded once over summed seconds; empty `monthly` when there is nothing to place |
| `1f93fd10` | `ArchiveGrowthChart.tsx` and the `.growth-hit` hover rule in `globals.css` |
| `921f534b` | `page.tsx` rewritten. `FamilyStats.tsx` is new. `ArchiveCards.tsx` gets per-site numbers and a `seriesColor(i)` stripe, and the title becomes the link |
| `8aa17ccb` | `marketing.spec.ts`: "What this isn't" and the rail are replaced by the chart (`role=img`, present iff the summary on disk has `monthly`) and `Official instances` (≥ 1 absolute link iff sites) with the strip's `time[datetime]`. H1 regex, CTA names, the conditional hub link, nav and 404 are kept |
| `cde68392` | (review fix) `monthly` ends at the last COMPLETE month: the month holding `generatedAt` is never emitted, because charted it read as a collapse (106 so far in 2026-09). Its transcripts join `monthlyUnplaced` (106 on the live data), so placed + unplaced still equals `official.transcripts`. `homepageSummary.test.ts` +1 (a build month in January rolls back to December) and the fixture gains a build-month upload that is not emitted. The chart and the `Numbers by year` table read the same series, so the 2026 row now stops at August. The caption is unchanged. It says "by the month each video was published", which is still true |
| `7c01ea86` | `deployHomepage({previewBranch})`, `homepageDeployArgs` and the CLI row. `build.test.ts` +2 (argv for production, blank and preview; refusal order) |

**Re-gate after the review fix**, on `cde68392` (`h-regate.log`): tsc clean. Common tests **1816/1816**
(1815 + 1). `next build` ok. Homepage e2e **22 passed, 0 failed, 36 s** (`h-e2e2.log`), with no queue
wait. `h-home-desktop-dark.png` was re-shot: the strata end at 2026-08 with no drop to zero, and there
is no overflow at 1280 or 390.

**Gates**, on `7c01ea86`: tsc clean. Common tests **1815/1815** = 1810 + 5. `pnpm --filter homepage
exec next build` ok, 15 static pages (`out/index.html` is 271 KB, 38 KB gzipped, against 94 KB before;
most of the growth is the chart's paths and 205 hover columns, repeated in the RSC payload). The
homepage e2e (`node scripts/worktree.mjs run -- pnpm --filter homepage run e2e`, `h-e2e.log`) passed
**22, failed 0, in 35 s**, with no queue wait; its 5 specs were run against the copied v5 summary. The
marketing spec also passed with the summary moved away (no-data path: no chart, no heading, the
fallback H1). Screenshots at 1280 and 390 wide in light and dark were checked by eye: no horizontal
overflow (scrollWidth equals the viewport in all four), the chart legible, nothing clipped. The
editor/export builds, editor unit, test:scripts and mcp were not run, because the slice touches no file
they build or test (`common/publish/build.ts` is covered by the common suite and tsc).

For a realistic render, the worktree's `homepage/public/{channel-sites.json,stats/}` were copied from
the primary. `homepage-summary.json` was rebuilt offline by `buildHomepageSummary` over the primary's
stats pages (`$T/h-mksummary.ts`) and read no corpus. On the current data, official is 5 instances,
63 channels, 75,785 recordings, 49,767 transcripts, 60,840 h and 480 gone.

**Numbers: none.** No settings, site or channel key changed. The summary's format is additive.

**Pending, the parent's:** `archilyzer build homepage`, then the preview (`deploy homepage --preview
<branch>`) and production deploys, from the primary. The live summary becomes v5 only when compose
runs there.

**Done by the parent (16:32).** Review `$T/r8-review-h.md` SHIP (LOW/NIT only: count `official.transcripts` in the placing loop and guard a site outside `keptIds`; count `gone` only with a `downloadedDate`; stale comments; `lg:grid-cols-7` with no gone cell; a docstring; "205" → 204; the CHANGELOG's "to now"; and, for tokens.css, `--chart-3` = `--state-gone`). Merged as `1d54b7af`. `archilyzer build homepage` on the primary: 41 s, `homepage-summary.json` version 5, 204 months. `deploy homepage --preview refresh`: 12 s → https://refresh.archilyzer.pages.dev (alias of https://6a1724fe.archilyzer.pages.dev), 200, 2 × "Official instances", one `role="img"`, no hub link, no "What this isn't". Production waits for the operator's review.

**Production (18:30, next session).** The operator approved the refresh as is. `archilyzer build
homepage` on the primary: 57 s, `homepage-summary.json` version 5; `deploy homepage`: 13 s →
https://archilyzer.pages.dev (deploy `a684a0ce`), 200 at 270,581 B with the H1 ("hours of speech,
searchable to the second"), one `role="img"`, no "Search all archives" (the hub link stays off until
the hub is polished), `/docs/install/` 200 and `/downloads/archilyzer-source.tar.gz` 200 (2.5 MB).
The scripts that did it now live in `plans/tools/rollout/` (`4bdb1f5e`).

**Found and left.**
- **The partial build month is trimmed (review fix above). August still lags.** The last complete month,
  2026-08, has 419 against ~600 a month through 2025 and 778 in July, because archiving trails recent
  uploads. It stays in the series: the rule is to trim one month, and August is complete as a calendar
  month.
- **The chart cannot show when things were archived.** `transcribedDate` has six months of history
  and a 25k May spike. The summary's `series.transcribed.month` still carries it for `/stats`.
- **`--chart-3` is `--state-gone` in the archilyzer family** (Bonnellyzer's layer is the same rust as
  the gone figure). The family chroma floor also fails the validator (teal and ochre read greyish).
  Both are in `common/styles/tokens.css`, outside this slice.
- **`/stats` logs `Received NaN for the width attribute`** once during `stats.spec.ts` (the spec
  passes). It comes from the `/stats` client charts, not this page, and was not investigated.
- `KpiHeader.tsx` and `RecentAdditions.tsx` are unchanged. `/stats` still uses `KpiHeader`. The rail is
  unused on `/` but kept, per the brief.

### Slice E, as shipped — export: the restored search waits for the visitor (2026-09-25)

Branch `one-core/r8-export-norefire` off `main` `1d54b7af`. **The operator's instruction (2026-09-25):** "The
export homepage pre-loads the last query from localStorage, including firing that search to immediately
see results. Just load the settings but don't re-fire the search on first load." A restored query re-ran
the leaf pipeline on every visit. On a cold device that refetched transcript shards (up to 8 MB each); even
from the service-worker cache it was CPU and memory the visitor had not asked for. Nothing else heavy loads
on a plain visit (~1.24 MB of summaries).

**The restore-vs-run split** (all in `common/components/SearchSessionContext.tsx`, so `/`, `/ask` and the
hub get it together). Hydration still COMMITS everything it restores: the query tree (draft and committed),
the filters, the channel selection, the tag chips, the profile pointer and the grounding selection. The
profile divergence check, the share link and the persisted `working` snapshot therefore see the session
exactly as it was left; nothing about what is stored changed. What is new is one boolean, `runHeld`:
- It is set only when the query came from the stored snapshot (`working` or the active profile), is
  non-empty, and no search has run yet in this page life (`ranThisPageLife`, module state set by
  `commitSearch`, `applySnapshot` and a URL query that runs; it survives client-side navigation and resets
  on a reload or a new visit). That last condition is the review fix: the HUB mounts a separate provider
  per route, so `/` → `/ask` re-hydrates, and without it the hub chat lost the search just run. A query on the URL (`qt=`, or the legacy `q=`/`m=`/`re=`) is never held: a shared link is the
  visitor asking, and it runs as before.
- While held, `hasActiveQuery` is false. The pipeline effect returns early (no leaf pipeline, no shard
  fetch), the results area is the ordinary browse listing under the restored filters (summaries only, the
  same `All videos (N)` + `browse-hint` as a visit with no query), chart defaults and `/ask`'s live
  grounding see "no active query", and the selection self-clean prunes against the browse set, a
  superset of the search's, so a restored selection survives.
- `queryDirty` is true while held, so the bar shows what it already shows for any unapplied edit: the
  filled `Search` button (`data-dirty="true"`) and "Press Enter or click Search to apply". That is the
  "neutral line": existing UI and copy, nothing new. The browse listing was chosen over an empty results
  area because it is what the page shows with no query, costs nothing extra, and keeps `browse-all.spec.ts`'s
  contract.
- It is cleared by whatever already commits a search: `commitSearch` (Search, Enter, the filters panel's
  Apply) and `applySnapshot` (loading or reverting a profile). The pipeline effect now also depends on
  `hasActiveQuery`, so committing the same query that was held (same hash) still starts it.

| sha | what |
|---|---|
| `00fb567b` | `SearchSessionContext.tsx`: `runHeld` (set by hydration only for a stored query, cleared by `commitSearch`/`applySnapshot`), gating `hasActiveQuery` and `queryDirty`; the pipeline effect keys on `hasActiveQuery`; a held query does not default a restored chart to "search". New `export/e2e/restore-no-refire.spec.ts` (+2): a pre-seeded query + filter loads into the form with no transcript shard requested in 1.5 s after the browse listing is up, and Enter fetches one and shows `Matching videos`; a `?qt=` link with a stored session present still fetches on load |
| `501ee3e2` | (review fix R1) `ranThisPageLife` gates the hold, so hub `/` → `/ask` (per-card Ask / "Ask AI", `router.push`, a NEW `SearchSessionProvider` in `AskHub`) keeps grounding in the search just run. New `export/e2e-hub/ask-grounding.spec.ts` (+1): metadata search on hub `/`, per-card Ask, "Whole search" → `Grounded in 1 result from your current search`; with the gate disabled it fails (not even the selection grounding appears). `ask-chat.spec.ts` now asserts the hold on `/ask` (Search `data-dirty="true"`, no `Grounded in 1 result`) before clicking Search |
| `545c7405` | `ask-chat.spec.ts` "Load context enriches the pin and persists": after the reload on `/ask` it clicks Search before asserting `Grounded in 1 result` (the test encoded the old re-run-on-load). Outside the slice's listed ownership; no other release-8 slice touches `export/e2e/` |

`filter-profile-persistence.spec.ts` is **unchanged**: it seeds no query and asserts only the profile
pointer and checkbox state across reloads, all of which this slice preserves.

**Gates**, on `545c7405`: tsc clean. Common tests **1816/1816** (unchanged; no common unit test covers the
hook). `pnpm --filter export exec next build` ok. Export e2e **194 passed, 0 failed, 6.7 min** (192 + 2;
`e-final-export.log`). `e2e:hub` **8 passed, 18 s**. `e2e:2origin` with `TWO_ORIGIN_REBUILD=1` **3 passed,
38 s**, with the hub-written `export/public` entries swapped for copies and relinked after, as in
`final-e2e-r7.sh`. An earlier targeted run on `00fb567b` (six specs, `e-e2e-targeted.log`) was 41 passed,
1 failed: the ask-chat test fixed in `545c7405`. The editor build, editor unit, test:scripts and mcp were
not run: the slice touches no file they build or test beyond `common/components/`, which tsc covers
and the editor does not render (`SearchSessionContext` is export-only). **Numbers: none.**

**Re-gate after the review fix**, on `501ee3e2` (`e-regate.log`): tsc clean. `pnpm --filter export exec next build` ok. Export e2e `restore-no-refire` + `ask-chat` **25 passed, 0 failed, 1.2 min**. `e2e:hub` in full **9 passed** (8 + 1), 22 s. `e2e:2origin` (`TWO_ORIGIN_REBUILD=1`, swap and relink as before) **3 passed**, 43 s. Common tests not re-run: no common unit covers the hook, and the fix is 16 lines inside it.

**Pending, the parent's:** a rebuild and deploy of every export site (and the hub) for the change to reach
visitors.

**Found and left.**
- **A cold, direct visit to hub `/ask` still holds the restored query, and nothing there can run it:**
  `AskHub` has no search bar. The chat answers ungrounded until the visitor searches on `/` and comes
  back. That is the operator's rule ("don't re-fire the search on first load") applied literally; a
  single site's `/ask` has the bar and is unaffected.
- **Saving a profile while a query is held keeps it held.** `handleSaveProfile` / `Save as…` promote the
  draft FILTERS to committed but have never committed the query tree, so they do not clear the hold; the
  saved profile still carries the query. The visitor runs it with Search. Left as is: saving is not searching.
- **A held chat or posts query still loads the subs/posts manifests on first load**, because the DRAFT
  tree names that scope (`draftHasChatLeaf`), exactly as it does while someone types one. Manifests are
  small; no shard is fetched.
- The e2e measures shard requests from the page (`page.on("request")`). A search served wholly from the
  IndexedDB layer cache would fetch nothing either way, which is why the spec seeds storage in a fresh
  context that has never searched.

### Slice Z, as shipped — the yt-dlp command button is not a download (2026-09-25)

Branch `one-core/r8-ytdlp-button` off `main` `90a6aae6`. **The operator (2026-09-25):** "Oh no yt-dlp
stays, I was only talking about the zip downloads. Re-add ytdlp button asap and redeploy to all sites
that removed it." Release 5 slice X put three controls behind `transcriptDownloads: false`; the yt-dlp
button was one of them, though it only copies a `yt-dlp --download-sections … "<url>"` line to the
clipboard (`PlayerProvider.copyDownloadCommand`) and serves no file. All five live sites carry the flag,
so every public modal lost it.

**What changed.** `TranscriptModal.tsx` renders the yt-dlp button, in both its states ("Mark both clip
start and end first" / "Copy yt-dlp download command for this clip"), whatever the switch says; the
Download menu and Copy MD stay behind it. Accessible names unchanged. The `siteSchema` doc for
`transcriptDownloads` (SITE.md regenerated through `bin/file-schemas-docs.ts`, `--check` clean), the
`PlayerFeatures` and `homepage.ts` comments, and the editor's site and hub form labels
(`SiteForm.tsx`, `HomepageConfigForm.tsx` — "Per-video transcript downloads (Download menu, Copy
Markdown)", hint says the yt-dlp command stays) stop claiming the switch hides it. The last four files
were outside the brief's ownership list; they are comment/label text only and no sibling r8 branch
touches them. No key, default or data format changed. The editor never mounts these controls, so no
editor spec changed; no editor spec reads the form label.

| Commit | What |
|---|---|
| `4ca398a9` | common: the yt-dlp clip command shows with transcriptDownloads off (modal, schema doc + SITE.md, comments, form labels, both transcript-downloads specs) |
| this commit | plans: the record; `[Unreleased]` bullet |

**Specs.** `export/e2e/transcript-downloads.spec.ts` and `export/e2e-hub/transcript-downloads.spec.ts`
now name two export controls and assert the yt-dlp button ("Mark both clip start and end first")
visible in both the default and the off case. `player-control-bar.spec.ts` copies the command on the
default (on) site and needed no change; `archives-off` and `modal-*` never name these controls.

**Gates.** tsc (`pnpm -r … tsc --noEmit`) clean. `pnpm --filter export exec next build` OK. Export e2e
(`archives-off modal-open modal-share modal-close modal-digest transcript-downloads
player-control-bar`): 22 passed, 0 failed, 1.2 min. `e2e:hub`: 8 passed, 0 failed, 23.8 s (count
unchanged). Common/editor unit, test:scripts, mcp and the editor build were not run: the code change is
one JSX condition plus text (the brief's gate list). **Numbers: none.**

**Pending, the parent's:** merge, then rebuild and redeploy every site that has `transcriptDownloads:
false` (all five) and the hub, from the primary.

### Slices Z + E, deployed (2026-09-25, 17:04 → 17:45 and after)

Z merged as `a52b4c11` after the parent read the component diff (exactly the un-gating; both transcript-downloads specs updated, export specs 22/22, hub 8/8). `pnpm ops build-deploy --json '{"siteIds":[jeralyzer, anilyzer, bonnellyzer, hasanalyzer, rekietalyzer],"skipArchives":true}' --wait` (the per-site HOST path — the all-sites path would have fanned out into the two-month-old docker build image that predates the CLI): one job per site on the deploy queue, **2,429 s** for all five (`r8-sites-redeploy.log`): https://9e7dd38c.jeralyzer.pages.dev, https://86cf0309.anilyzer.pages.dev, https://3cbf1302.bonnellyzer.pages.dev, https://1ee44be1.hasanalyzer.pages.dev, https://8d1e36a3.rekietalyzer.pages.dev; then `build-hub` 36 s + `deploy-hub` 32 s → https://657ad917.archilyzer-hub.pages.dev. Live proof (`r8-ytdlp-live-check.mjs`, Playwright on https://jeralyzer.pages.dev, first result's modal): `yt-dlp=1 download-file=0 copy-md=0`. E reviewed SHIP after the hub-grounding fix (`r8-review-e.md`), merged as `d4326e3c` (conflicts only in the changelog and this record; sections kept in order H, E, Z); its own five-site run started 17:48:10 (`r8-sites-redeploy2.log`, jobs `01M3D8MJ…`): **1,296 s** for all five — https://89e79885.jeralyzer.pages.dev, https://85ede90c.anilyzer.pages.dev, https://127c0831.bonnellyzer.pages.dev, https://fd40555c.hasanalyzer.pages.dev, https://a1018cc4.rekietalyzer.pages.dev; `build-hub` 39 s + `deploy-hub` 31 s → https://fe41d223.archilyzer-hub.pages.dev (18:10). Live proof (`r8-e-live-check.mjs` on https://jeralyzer.pages.dev): a stored transcripts query "lawsuit" restored into the form, **0 shard requests on load** over 3 s, one shard fetched after Enter. E and Z are live on every official site and the hub.

## Rollout 2026-09-25 (late afternoon) — `0e72ef73` live on :3001 (second restart of the day)

The second editor restart of the day. Release 7 (`bb3dbb4c`) had gone live at 13:11. Two things
made a release 8 that same afternoon:
- **The operator's ask**, at 13:40: "the individual video view should show video metadata like
  the title, and `/videos` should show titles in the list when available and allow searching by
  them." A read-only Explore pass scoped it. The video page already showed the title from
  `metadata.info.json`, but showed a bare id for an undownloaded video. There is no global
  `/videos`, and the per-channel list `channels/<slug>/videos` showed ids and searched ids only.
  That became slice V.
- **The 13:33:37 state revert.** The live `state.json` lost the 13:20 deferral and `fails: 13`
  (release 7's rollout, "And then the disk lost it"). The trace (`$T/q-state-revert.md`) found
  that `sharedAutoQueueState` cached the resolved value, not the in-flight read. The four lanes
  booted concurrently, each held a private copy, and any persist overwrote the whole file. That
  became slice S. **It happened again at ~14:18:** the state read `fails: 12` again, with no
  deferral, before S was live.

**Merge.** `main` moved `b558a7b8` (plans: release 7, the 13:33 revert traced) → `faa92c51` (merge
V, tip `4122471e`, off `bb3dbb4c`) → **`0e72ef73`** (merge S, tip `89a7d6ab`, off `eff6a3a7`).
`0e72ef73` is the sha that went live. S's merge conflicted only in `editor/CHANGELOG.md`, and both
sides were kept. S's record section was pasted in above this heading in the merge commit.
`git diff --stat b558a7b8 0e72ef73` shows **17 files, +1,439 / −104**. umtool and the lockfile
are unchanged.

**Reviews** (Opus, read-only). Both slices came back SHIP AFTER FIXES and were SHIP on re-review.
- **V** (`$T/r8-review-v.md`). **M1** was the Rumble list. Every Rumble dir misses the index, so
  every row fell through to a `metadata.info.json` read on **every** render. Every row is a
  `<Link ?video=>` on a force-dynamic page, so every click re-rendered. On
  `the-quartering-rumble`, with **8,049** dirs, that measured **5,024 ms cold / 224 ms warm per
  render**. The fix, `4e8bb285`, memoizes titles per channel, keyed by the `data/` dir mtime: LRU
  64, untitled ids not memoized, cleared by invalidate-cache. Measured live read-only: **5,331 ms
  for the first render, then 5.5 ms and 6.5 ms**. L1 (comment placement) and L2 (a test) were fixed in
  `41facfe0`, and `4122471e` records the re-gate.
- **S** (`$T/r8-review-s.md`). **Item 3 was required in the slice.** `recordDownloadBackoff`
  (`common/jobs/downloadBackoff.ts:31-43`) wrote straight to disk, so any other lane's persist
  erased a 429 cooldown recorded by a manual Sync, a metadata scan or the video page. The fix,
  `4cfc7491`, moves the holder and `sharedAutoQueueState` to `common/jobs/autoQueueState.ts` on
  `__yttAutoQueueState__` and re-exports them, and adds `liveAutoQueueState(paths)`.
  `recordDownloadBackoff` now merges disk into the live object (the later `until` wins) and
  writes through it. `platformCooldownRemainingMs` and the status builder prefer the live object,
  and invalidate-cache clears the global. It adds 4 tests, 3 of which fail on the old code.
  `89a7d6ab` is the CHANGELOG clause. One optional low item remains: merge `until` and `fails`
  separately.

**Gate on `0e72ef73`** (worktree `one-core-r8-state-share` detached at the merge,
`$T/r8-gate.log`, 14:1x–14:25):
- tsc **0 errors**.
- common **1,810/1,810** = 1,795 + V's 7 + S's 8.
- Editor unit **75/75** = 72 + 3 (`videoRows.test.ts`).
- test:scripts **161 + 1 skip**.
- `next build` ok.
- EDITOR e2e over the union of both slices' specs (`$T/r8-gate-specs.txt`: `video-titles
  video-page video-filter-combine channel-embedded-video auto-queue lane-runner pacing queues
  rumble-sweep ops-api`): **86 passed, 0 failed, 4.9 min**.
- **Numbers: none.** No schema key changed. Both slices only read or reshape.

**Baseline and builds.**
- md5 `before` (14:25) and `pre-restart` (14:43): **80 files** each (`r8-md5.sh`, the same set
  as release 7). `state.json`'s download keys were already `picks, platformBackoff, runtime,
  videoDeferrals`.
- Builds (`r8-builds.log`, 14:25:49). Editor: exit 0, **37 s**, `BUILD_ID`
  `6kMVr9Gn2093S9tp_pgqT` → **`9pC6zELQSzjdkIPDNsVox`**, and client-s3 still resolves into
  `node_modules/.pnpm`.
- **umtool was rebuilt too, although its code did not change.** The cloned build script builds
  both: exit 0, 16 s, `5gN2_DKycn5pOV7fNMVos` → **`a9YAe_dwhuM6DiCPzIwMD`**. So umtool was
  **restarted as well**, because a rebuilt `.next` under a running server serves a stale chunk
  set.

**The operator's call.** The operator's download-missing on `paramount-tactical` was running
(61 → 91 of 1,473 dirs). They were asked, and chose **"Restart now"**, with a re-queue after
boot. Jobs at the restart (`r8-jobs-before-restart.json`):
- the auto-transcribe and auto-download runners;
- download-missing `01M3CSDWSS148ZW7PWG7EBRNGC`, running;
- metadata scans `01M3CT2H88CP3EPBXR4MS2N8GY` + `01M3CV5W6WG8QJW09G2F0N1V8A` and sync
  `01M3CXGDYWWHPA4F7GDYZJPG8S`, queued.

**Restart** (`r8-restart.log`, 14:43). Editor: 1232277 / 1232307 killed, `/` 200 after **3 s**.
umtool: 1232396 / 1232411 killed, `/` 200 after **3 s**. `/tags` 200. ZodError 0, one
"Ready in", umtool errors 0.

**After boot.**
- **md5 `after-boot`: 80 files, one differs**, `channels/paramount-tactical/config.json`. During
  the afternoon the operator had set `downloadFilter.include: "Quartering"` through the form, and
  the cancelled download-missing stamped `lastFullDownloadAt`. A diff against the 13:30 copy shows
  exactly those two keys. Boot wrote nothing.
- **The state survived.** `state.json` after boot held `platformBackoff.youtube {fails: 13, until
  13:52:55}` and `videoDeferrals {_60iFE_FBPQ}`. The download lane's last persist lived through
  the restart, and with S live it cannot be clobbered again.
- **Stale metas.** The cancelled download-missing reads `cancelled`. The three queued jobs still
  read `queued` in their meta files: a restart neither re-queues nor marks them. This is cosmetic.
- **New jobs.** A NEW metadata scan for `paramount-tactical`, `01M3CY1ZXR9EMTA42DR1FN9BKP`,
  started at boot by itself (the scan auto-dispatch). The parent then queued the owed sync
  `teamrcn`, `01M3CY7BN3DNN12T93X9GZM48X` (release 7 step 10), and then re-queued download-missing,
  `01M3CY7FHQNMTA376HA724BKK7`. The order was deliberate, so the 7-video sync would not wait behind
  hours of downloads.

**The second-restart proof** (release 7 step 12, the scan-error refresh). The old build's
auto-download runner log (`01M3BAAN4K…`) has **1** `legal-mindset` line. The 13:11 boot's
(`01M3CRRX37…`) and the 14:43 boot's (`01M3CY1YFH…`) have **0**.
`channels/legal-mindset/metadata-scan.json`'s mtime is still 2026-09-24 23:52, so the
members-only ids were not re-scanned today. **Proved.**

**Smoke** (`r8-smoke.out`, 14:44:22–14:48:09). `SMOKE_FAIL=1`, with **both flags explained**:
- **Seven of the eight pairs were identical.** `/api/jobs/active` and `/api/view/activeJobs`
  differed by 500 B, then by 1 B on a recheck, while refresh-reports were finishing. That is a
  moving list, not a view difference; release 7's smoke ran idle.
- **`autoQueueStatus.download.deferred`** = `[{videoId: _60iFE_FBPQ, channelSlug:
  paramount-tactical-videos, untilMs: …}]`. The check, carried over from release 7, expected
  `[]`, and that expectation is what is stale. A deferral exists, and it is correct.
- **Everything else passed.** 404s, presets, and an unchanged pulse rev. Pages 200 (`/` 4 s).
  `/operations/download` 200 with one `Rate-limit cooldown` region (youtube cooling, one deferred
  video). `/sites` has Build hub + Deploy hub. umtool `/` 200 on `a9YAe_dwhuM6DiCPzIwMD`.

**Live title proof.**
- `/channels/paramount-tactical/videos` 200: 630,962 B, 42 `open <id>` rows. The RSC payload
  carries real titles for the downloaded rows, for example `"title":"What is Really Going on With
  The Strait of Hormuz ft. Colonel Rob Ma…"` and `"Complete Guide To Precision Scope Mounting -
  Part 1 of 2"`.
- `/channels/paramount-tactical/videos/1p-YxSNbmsc` renders `<h2>FIRST SU*C*DE Bomber TIED to
  IRAN</h2>`.
- The scan-only rows showed bare ids until the running scan reached them.

**Paramount Tactical: scan → cancel → download-missing.**
- **The scan** (`01M3CY1ZXR9EMTA42DR1FN9BKP`). 1,382 listed videos, `--sleep-requests 1`, about
  **10 videos/min**, **0 429s**. 11 members-only errors ("Join this channel") were recorded and
  passed over.
- **Cancelled at 377.** At 15:20 the operator asked to stop it so downloads could start, since
  the Quartering collaborations are recent. It was cancelled through the `/jobs` row's Cancel
  button (`r8-cancel-scan.mjs`) at **377 / 1,382**. The scan store
  `channels/paramount-tactical/metadata-scan.json` is written incrementally, so it keeps its **377
  entries**, and a later scan resumes the remainder.
- **The stall label.** While the scan progressed at 10/min, its `/jobs` row read `STUCK ·
  POSSIBLY-STALLED`. The stall heuristic misjudges a slow but alive scan (below).
- **download-missing** (`01M3CY7FHQNMTA376HA724BKK7`) started as soon as the scan was cancelled:
  `Prefilter: 1382 missing … 91 already complete (of 1473)`. Then **`Settled by this channel's
  download filter: 376 skipped (already decided)`**. The 377 scanned entries let the operator's
  `downloadFilter.include: "Quartering"` settle 376 non-matching videos with **no extra
  request**. Then `running the full set (1006 item(s))`: per-video prefetch, matches downloaded
  (the first was `DLOM_ARCHIVE youtube NV1QqS9NOiU`), and `Sleeping 30s before next download`.
  Its meta still read `queued` while its log was 49 lines long. The status flips late, which is
  cosmetic.

**The owed sync (release 7 step 10)**, `teamrcn`, job `01M3CY7BN3DNN12T93X9GZM48X`, ran at 15:21
after 35 min in the queue.
- **The work was done.** Full sweep, availability check (1 dir, 0 attempted), backfill wrote 0.
  `teamrcn/config.json` moved on exactly `lastSyncedAt` (2026-05-18 → 2026-09-25T19:21:15.754Z)
  and a new `lastFullSweepAt`. No other file changed (md5).
- **The status reads `failed`.** Its last line is `[error] Invariant: static generation store
  missing in revalidatePath /channels/teamrcn`. The work stands, but the status is wrong, the ops
  exit code (1) is wrong, and the pages are not revalidated.
- **Where it throws.** A sync submitted through the action runs `runPipelineAction`'s job body,
  and that body calls `revalidatePath` itself once `runYtdlp` returns
  (`editor/app/channels/[slug]/pipelineActions.ts:220-224`). Release 7's
  step 10 calls this the `onDone` hook. For a sync it is the job body's own revalidation. The
  same idea is also written as an explicit hook: the metadata scan's `afterRun`
  (`pipelineActions.ts:364-367`) and the `onDone` of `runOperationChannelJob`
  (`common/controller/operationJobs.ts:23` explains that it exists because common cannot import
  `next/cache`).
- **Why it throws.** When the job was QUEUED, the body runs from the platform queue's drain loop,
  where Next has no request store. A job that starts inside the ops request (an empty queue) never
  hits it, which covers every earlier ops sync, including release 5's. Only one live job log in
  the last 200 carries the invariant.
- **Expected next.** The re-queued download-missing `01M3CY7FHQNMTA376HA724BKK7` runs the same
  body and also started from the drain loop. Expect it to end `failed` on the same line once its
  1,006 items are through, with its downloads intact.
- **Fix owed** (small): make the job-completion revalidations tolerate a missing store (below).

**keep-videos, live** (slice K's first real run, 15:23, `r8-keep-videos-run2.json`):

    pnpm ops keep-videos --json '{"slug":"paramount-tactical","match":"TheQuartering|Quartering","note":"keep-videos: TheQuartering collaboration (operator ask 2026-09-25)"}'

- **Result.** `considered 468` (91 downloaded + 377 scanned), **`matched 1`**: `NV1QqS9NOiU`,
  "Charlie Kirk Conspiracies, Internet Sleuths & The Outrage Machine | Th…". That is the first
  video download-missing archived under the filter. It was `marked 1` on the first run and
  `alreadyKept 1` on the idempotent second.
- **The marker.** `data/NV1QqS9NOiU/do-not-clean.json` =
  `{"setAt":"2026-09-25T19:23:55.075Z","note":"keep-videos: TheQuartering collaboration (operator
  ask 2026-09-25)"}`.
- **What was not matched.** `notDownloaded []`: no scanned but undownloaded match, which is
  consistent with the filter settling 376 as non-matching. `unscanned 1002`, `noMetadata 3`.
- **Before the scan.** An earlier dry run at 14:0x read `considered 24, matched 0, unscanned
  1449`.
- **Owed:** re-run keep-videos after download-missing finishes, because each match it downloads
  gets its marker only then. This is the morning step.

**Found and left.**
- **The `/jobs` stall label misreads a slow scan.** A metadata scan advancing at 10 videos/min
  read `STUCK · POSSIBLY-STALLED` (`possibly-stalled`, `common/views/jobRowView.ts`,
  `common/views/jobRows.ts`). The heuristic needs a notion of "progress moved recently".
- **Stale `queued` metas after a restart.** Jobs queued when the server went down keep `queued`
  in their meta. A freshly drained job also reads `queued` for a while (`startedAt: null`). Both
  are cosmetic. The release-7 waiter's sync attempt died with the restart
  (`r7-scan-sync2.log`: "sync exit=1 attempt=1 575s").
- **The smoke's `DEFERRED_OK` check** must become "the list is well-formed", not "empty".
- **V's memo notes.**
  - A `metadata.info.json` rewritten inside an existing dir does not refresh the memo. Titles do
    not change, so this is accepted.
  - A new dir drops the whole channel's memo. The reviewer's optional follow-up is to keep the
    entry and read only the new ids.
  - **L3:** the scan note can say "not downloaded" beside a dir whose metadata file is missing or
    corrupt. This is rare.
- **S's merge rule.** It copies the whole disk entry when its `until` is later. A brief race can
  therefore lower `fails` or revive a just-cleared entry. Optional fix: merge `until` and `fails`
  separately (max of each).
- **The queued-job `revalidatePath` fix, owed.** Proposed shape: one editor-side `safeRevalidate`
  that calls `revalidatePath` and treats the missing-store invariant as a no-op, used by every job
  body, `afterRun` and `onDone` that revalidates. The alternative is to drop those revalidations in
  favour of the file-based `requestChannelSnapshot`, since the pages are force-dynamic and the
  snapshot scheduler already refreshes on completion. Until then, an ops-submitted job that
  queues reports `failed` (and `pnpm ops … --wait` exits 1) after doing its work.
- **YouTube `--sleep-requests`** (release 7's finding) is still not applied in
  `common/ytdlp/platformArgs.mjs`. Phase 4 slice 3 is still next.
- **Worktrees to remove:** `one-core-r7-pacing`, `one-core-r7-cli`, `one-core-r7-keep`,
  `one-core-r8-video-titles`, `one-core-r8-state-share`, plus the older `one-core-r5-exports`,
  `one-core-r5-rumble`, `one-core-r6-followups` and `one-core-phase-4-s1`. Removing shifts port
  blocks.
- **keep-videos re-run owed** after download-missing finishes. Optionally, a
  `pnpm ops metadata-scan` on `paramount-tactical` finishes the remaining ~1,000 for list titles.