docs: refresh README

The requests table showed all names as "—" because Jellyseerr's /api/v1/request
list does NOT embed titles — they live on the Movie/Series records. Added
JellyseerrClient._resolve_title(media_type, tmdb_id) that fetches
/api/v1/movie/{tmdbId} (→ title) or /api/v1/tv/{tmdbId} (→ name), cached on
the client instance so subsequent polls are instant.

Also scoped the table fetch to open requests only (pending + approved) via
Jellyseerr's filter param, instead of fetching all 800+ historical requests.
open_requests() fetches pending+approved (paginated), resolves their titles
(small set → fast), and returns them sorted by date added desc.

Updated the frontend table's status filter to Open/Pending/Approved (the data
only contains open requests now).

Tests: title resolution end-to-end (movie tmdbId → title), caching across
polls, filter param used. 404/404 backend + 184/184 frontend + build green.

.claude/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: .claude
 
 ## role
-Configuration directory for the Claude AI assistant, storing project-specific settings, instructions, and behavioral guidelines.
+Configuration and settings directory for Claude AI assistant integration within the project workspace.
 ## parent
 index: ./.pi-map.index.md
 map: ./.pi-map.md

.claude/.pi-map.md

@@ -4,10 +4,10 @@ dir: .claude
 index: .claude/.pi-map.index.md
 
 ## role
-Configuration directory for the Claude AI assistant, storing project-specific settings, instructions, and behavioral guidelines.
+Configuration and settings directory for Claude AI assistant integration within the project workspace.
 ## files
 ## arch
-Flat configuration structure containing markdown/YAML files that define custom commands, project context, and operational rules for Claude's interactions with the codebase.
+Flat configuration directory following standard AI assistant tool conventions, typically containing permission rules, context files, and project-specific behavioral settings.
 ## tags
 -
 ## symbols

.claude/skills/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: .claude/skills
 
 ## role
-Directory containing custom skill definitions and capability instructions for the Claude AI assistant integration.
+Configuration directory storing reusable Claude AI skill definitions and behavioral instructions for the project.
 ## parent
 index: .claude/.pi-map.index.md
 map: .claude/.pi-map.md

.claude/skills/.pi-map.md

@@ -4,10 +4,10 @@ dir: .claude/skills
 index: .claude/skills/.pi-map.index.md
 
 ## role
-Directory containing custom skill definitions and capability instructions for the Claude AI assistant integration.
+Configuration directory storing reusable Claude AI skill definitions and behavioral instructions for the project.
 ## files
 ## arch
-Flat configuration file structure defining modular skill behaviors and prompts used to extend Claude's domain-specific abilities.
+Flat directory structure with markdown-based skill modules that define specialized assistant capabilities.
 ## tags
 -
 ## symbols

.claude/skills/sift-backlog/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: .claude/skills/sift-backlog
 
 ## role
-Defines a Claude skill workflow for triaging, organizing, and activating backlog tasks into actionable plans using the `sf` CLI tool.
+Provides a structured workflow skill for Claude to triage, organize, and activate backlog tasks into actionable sprint plans using the `sf` CLI tool.
 ## parent
 index: .claude/skills/.pi-map.index.md
 map: .claude/skills/.pi-map.md

.claude/skills/sift-backlog/.pi-map.md

@@ -4,11 +4,11 @@ dir: .claude/skills/sift-backlog
 index: .claude/skills/sift-backlog/.pi-map.index.md
 
 ## role
-Defines a Claude skill workflow for triaging, organizing, and activating backlog tasks into actionable plans using the `sf` CLI tool.
+Provides a structured workflow skill for Claude to triage, organize, and activate backlog tasks into actionable sprint plans using the `sf` CLI tool.
 ## files
 - SKILL.md | Defines a workflow skill for triaging, organizing, and activating backlog tasks into actionable plans using the `sf` CLI tool. | dep: sf CLI (task, plan, dependency, update subcommands)
 ## arch
-Single-file declarative skill definition following a prompt-driven workflow pattern with structured triage and activation instructions for Claude to execute.
+Single-file declarative skill definition following a prompt-engineering pattern that encodes step-by-step procedures and decision rules for Claude to execute when invoked.
 ## tags
 skill, defines, workflow, triaging, organizing, activating, backlog, tasks
 ## symbols

.opencode/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: .opencode
 
 ## role
-Configuration directory for the opencode tool, managing project-specific settings and preferences.
+Configuration and settings package for the opencode tool, defining project-level or user-level preferences and behavior.
 ## parent
 index: ./.pi-map.index.md
 map: ./.pi-map.md

.opencode/.pi-map.md

@@ -4,10 +4,10 @@ dir: .opencode
 index: .opencode/.pi-map.index.md
 
 ## role
-Configuration directory for the opencode tool, managing project-specific settings and preferences.
+Configuration and settings package for the opencode tool, defining project-level or user-level preferences and behavior.
 ## files
 ## arch
-Flat directory structure containing configuration files that define opencode behavior for the associated project.
+Flat directory structure with declarative configuration files; no executable code or architectural patterns involved.
 ## tags
 -
 ## symbols

.opencode/commands/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: .opencode/commands
 
 ## role
-Defines slash-command workflows and assistant personas for an OpenSpec-based development process (explore, propose, apply, archive).
+Defines structured AI assistant workflow commands for an OpenSpec-based software development lifecycle (explore, propose, apply, archive).
 ## parent
 index: .opencode/.pi-map.index.md
 map: .opencode/.pi-map.md

.opencode/commands/.pi-map.md

@@ -4,14 +4,14 @@ dir: .opencode/commands
 index: .opencode/commands/.pi-map.index.md
 
 ## role
-Defines slash-command workflows and assistant personas for an OpenSpec-based development process (explore, propose, apply, archive).
+Defines structured AI assistant workflow commands for an OpenSpec-based software development lifecycle (explore, propose, apply, archive).
 ## files
 - opsx-apply.md | Defines a workflow for implementing tasks from an OpenSpec change in a structured, iterative manner with pause points for blockers and ambiguity. | dep: openspec CLI, AskUserQuestion tool, filesystem access
 - opsx-archive.md | Defines a workflow for archiving completed changes in an experimental openspec-based development process, including validation, spec sync assessment, and user confirmation steps. | dep: openspec CLI, AskUserQuestion tool, Task tool, Skill tool, filesystem (mkdir, mv), tasks.md
 - opsx-explore.md | Defines the explore mode stance for a thinking/discussion assistant that investigates problems and clarifies requirements without implementing code | dep: OpenSpec system (openspec CLI, change artifacts like proposal.md/design.md/tasks.md/spec.md)
 - opsx-propose.md | Defines a workflow for creating a new change with all required planning artifacts (proposal, design, tasks) in a single step using the openspec CLI tool. | dep: openspec CLI, AskUserQuestion tool, TodoWrite tool, file system
 ## arch
-Markdown-based declarative templates serving as structured prompts/playbooks that guide an AI assistant through specific operational phases of a spec-driven lifecycle.
+Markdown-based command-definition pattern where each file encodes a discrete, step-by-step procedural prompt controlling assistant behavior for a specific development phase.
 ## tags
 opsx, defines, tasks, md, workflow, openspec, openspec cli, askuserquestion tool
 ## symbols

.opencode/skills/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: .opencode/skills
 
 ## role
-Directory for defining custom agent skills, capabilities, and behavioral instructions within the opencode configuration framework.
+Custom skill/automation definitions for the opencode tooling framework, defining reusable capabilities or behaviors.
 ## parent
 index: .opencode/.pi-map.index.md
 map: .opencode/.pi-map.md

.opencode/skills/.pi-map.md

@@ -4,10 +4,10 @@ dir: .opencode/skills
 index: .opencode/skills/.pi-map.index.md
 
 ## role
-Directory for defining custom agent skills, capabilities, and behavioral instructions within the opencode configuration framework.
+Custom skill/automation definitions for the opencode tooling framework, defining reusable capabilities or behaviors.
 ## files
 ## arch
-Configuration-based skill definition directory; skills are declared as individual files consumed by the opencode agent runtime to extend or specialize assistant behavior.
+Configuration-driven skill registry with declarative definition files (no implementation code present in this directory).
 ## tags
 -
 ## symbols

.opencode/skills/openspec-apply-change/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: .opencode/skills/openspec-apply-change
 
 ## role
-Provides a structured skill definition for implementing OpenSpec changes through a schema-driven workflow with progress tracking.
+Provides a structured skill definition for implementing OpenSpec changes through a schema-driven workflow with progress tracking and contextual file reading.
 ## parent
 index: .opencode/skills/.pi-map.index.md
 map: .opencode/skills/.pi-map.md

.opencode/skills/openspec-apply-change/.pi-map.md

@@ -4,11 +4,11 @@ dir: .opencode/skills/openspec-apply-change
 index: .opencode/skills/openspec-apply-change/.pi-map.index.md
 
 ## role
-Provides a structured skill definition for implementing OpenSpec changes through a schema-driven workflow with progress tracking.
+Provides a structured skill definition for implementing OpenSpec changes through a schema-driven workflow with progress tracking and contextual file reading.
 ## files
 - SKILL.md | Defines a skill for implementing tasks from an OpenSpec change using a schema-driven workflow with progress tracking and contextual file reading. | dep: openspec CLI, AskUserQuestion tool
 ## arch
-Documentation-based skill specification using markdown with defined workflow steps, schema references, and contextual file reading rules.
+Declarative skill specification using markdown-based instructions, schema-driven task processing, and progressive context loading patterns.
 ## tags
 skill, defines, implementing, tasks, openspec, change, schema, driven
 ## symbols

.opencode/skills/openspec-archive-change/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: .opencode/skills/openspec-archive-change
 
 ## role
-Provides a structured skill definition for archiving completed changes in the openspec experimental workflow with validation and user confirmation steps.
+Defines a specialized skill within the openspec workflow that handles the archival process for completed changes, including validation checks, sync assessment, and user confirmation.
 ## parent
 index: .opencode/skills/.pi-map.index.md
 map: .opencode/skills/.pi-map.md

.opencode/skills/openspec-archive-change/.pi-map.md

@@ -4,11 +4,11 @@ dir: .opencode/skills/openspec-archive-change
 index: .opencode/skills/openspec-archive-change/.pi-map.index.md
 
 ## role
-Provides a structured skill definition for archiving completed changes in the openspec experimental workflow with validation and user confirmation steps.
+Defines a specialized skill within the openspec workflow that handles the archival process for completed changes, including validation checks, sync assessment, and user confirmation.
 ## files
 - SKILL.md | Defines a skill for archiving a completed change in the openspec experimental workflow, including validation, sync assessment, and user confirmation steps. | dep: openspec CLI, AskUserQuestion tool, Task tool (subagent_type: general-purpose), openspec-sync-specs skill
 ## arch
-Single-document declarative skill specification following a procedural checklist pattern (validate, assess sync, confirm) designed for an AI agent to execute.
+Single-file declarative skill definition using a markdown-based pattern description format, structured as a procedural workflow with validation gates and conditional user interaction steps.
 ## tags
 skill, openspec, sync, defines, archiving, completed, change, experimental
 ## symbols

.opencode/skills/openspec-explore/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: .opencode/skills/openspec-explore
 
 ## role
-Provides a conversational "explore mode" skill for the OpenSpec CLI that serves as a thinking partner for brainstorming ideas, investigating problems, and clarifying requirements.
+Provides a conversational "explore mode" skill definition that configures the OpenSpec CLI to act as a collaborative thinking partner for brainstorming, problem investigation, and requirements clarification without code implementation.
 ## parent
 index: .opencode/skills/.pi-map.index.md
 map: .opencode/skills/.pi-map.md

.opencode/skills/openspec-explore/.pi-map.md

@@ -4,11 +4,11 @@ dir: .opencode/skills/openspec-explore
 index: .opencode/skills/openspec-explore/.pi-map.index.md
 
 ## role
-Provides a conversational "explore mode" skill for the OpenSpec CLI that serves as a thinking partner for brainstorming ideas, investigating problems, and clarifying requirements.
+Provides a conversational "explore mode" skill definition that configures the OpenSpec CLI to act as a collaborative thinking partner for brainstorming, problem investigation, and requirements clarification without code implementation.
 ## files
 - SKILL.md | Defines a conversational "explore mode" skill for the OpenSpec CLI that acts as a thinking partner for exploring ideas, investigating problems, and clarifying requirements without implementing code. | dep: openspec CLI
 ## arch
-Skill-definition pattern using a single Markdown file (SKILL.md) that declaratively specifies the assistant's behavioral constraints, workflow, and operational guidelines.
+Skill-definition pattern using a single Markdown manifest (SKILL.md) that declaratively specifies the assistant's behavioral instructions, interaction style, and operational constraints for the explore workflow.
 ## tags
 skill, defines, conversational, explore, mode, openspec, cli, acts
 ## symbols

.opencode/skills/openspec-propose/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: .opencode/skills/openspec-propose
 
 ## role
-Provides an AI assistant skill that automates the openspec proposal workflow by scaffolding directories and generating structured artifacts (proposals, designs, tasks).
+Provides an AI assistant skill that automates the openspec proposal workflow, scaffolding directories and generating structured artifacts (proposals, designs, tasks) for new project changes.
 ## parent
 index: .opencode/skills/.pi-map.index.md
 map: .opencode/skills/.pi-map.md

.opencode/skills/openspec-propose/.pi-map.md

@@ -4,11 +4,11 @@ dir: .opencode/skills/openspec-propose
 index: .opencode/skills/openspec-propose/.pi-map.index.md
 
 ## role
-Provides an AI assistant skill that automates the openspec proposal workflow by scaffolding directories and generating structured artifacts (proposals, designs, tasks).
+Provides an AI assistant skill that automates the openspec proposal workflow, scaffolding directories and generating structured artifacts (proposals, designs, tasks) for new project changes.
 ## files
 - SKILL.md | Defines an AI assistant skill that automates proposing new changes by scaffolding a directory, generating dependent artifacts (proposal, design, tasks), and tracking progress through a structured workflow using the openspec CLI. | dep: openspec CLI, AskUserQuestion tool, TodoWrite tool
 ## arch
-Skill-definition pattern using a declarative markdown document (SKILL.md) that encodes a step-by-step procedural workflow with CLI integration conventions.
+Declarative skill-definition pattern using a markdown-based manifest (SKILL.md) that encodes a step-by-step procedural workflow, CLI commands, and file-system conventions for the AI to follow.
 ## tags
 skill, defines, assistant, automates, proposing, new, changes, scaffolding
 ## symbols

.pi-map.index.md

@@ -16,7 +16,7 @@ dir: .
 Trust boundary: index routes, map orients, source decides.
 
 ## role
-Root project configuration and orchestration package for a media library management application with observability, defining Docker deployment stacks, environment templates, and project documentation.
+Root project configuration and documentation directory for a media library/server operations management application with Jellyfin integration, SSH inspection, and observability capabilities.
 ## parent
 -
 ## children
@@ -32,6 +32,9 @@ Root project configuration and orchestration package for a media library managem
 - .pi
   index: .pi/.pi-map.index.md
   map: .pi/.pi-map.md
+- .pi-tmp
+  index: .pi-tmp/.pi-map.index.md
+  map: .pi-tmp/.pi-map.md
 - .ruff_cache
   index: .ruff_cache/.pi-map.index.md
   map: .ruff_cache/.pi-map.md
@@ -66,7 +69,6 @@ Root project configuration and orchestration package for a media library managem
 - docker-compose.dev.yml
 - docker-compose.observability.yml
 - docker-compose.yml
-- swap-pane
 - token-usage-output.txt
 ## links
 index: ./.pi-map.index.md

.pi-map.md

@@ -18,13 +18,13 @@ index: ./.pi-map.index.md
 Trust boundary: index routes, map orients, source decides.
 
 ## role
-Root project configuration and orchestration package for a media library management application with observability, defining Docker deployment stacks, environment templates, and project documentation.
+Root project configuration and documentation directory for a media library/server operations management application with Jellyfin integration, SSH inspection, and observability capabilities.
 ## files
 - .dockerignore | Specifies files and directories to exclude from Docker build context to reduce image size and improve build performance | dep: Docker
 - .env.example | Provides a template of environment variables for configuring application hosts, backend settings, OIDC authentication, SMTP, Grafana, and alerting across a Docker Compose deployment.
 - .gitignore | Configures Git to ignore Python artifacts, virtual environments, secrets, editor files, frontend builds, and tool-specific metadata from version control.
 - AGENTS.md | Provides project-specific guidance for AI agents working on a media library viewer application with FastAPI backend and Vite React frontend | dep: FastAPI, Vite, React, Docker Compose, uvicorn, pytest, Ruff, TypeScript, Python 3.11
-- CHANGELOG.md | Documents notable changes, breaking changes, and migration steps for the Manage application across recent versions.
+- CHANGELOG.md | Documents notable changes, breaking changes, and migration steps for the Manage application across releases.
 - CONTRIBUTING.md | Provides contribution guidelines and setup instructions for the Manage project's backend (FastAPI) and frontend (React) codebases. | dep: FastAPI, React, Vite, TypeScript, Ruff, pytest, Docker Compose, Tailwind CSS, TanStack Query
 - LICENSE | Provides the MIT open-source software license terms for the project
 - README.md | Project README documenting a media and server operations tool with Jellyfin integration, SSH file inspection, and server monitoring capabilities. | dep: FastAPI, React, TypeScript, Docker Compose, SQLite, Traefik, OIDC/Authentik, Jellyfin, Prometheus, Grafana, Alertmanager
@@ -32,10 +32,9 @@ Root project configuration and orchestration package for a media library managem
 - docker-compose.dev.yml | Defines a development Docker Compose stack for a backend (FastAPI/Uvicorn) and frontend (Vite) application with hot-reload and disabled authentication. | dep: uvicorn, Docker
 - docker-compose.observability.yml | Defines an optional standalone Docker Compose observability stack with Prometheus, Loki, Grafana, Alertmanager, Alloy, and Node Exporter for monitoring hosts without the main Manage application. | dep: prom/prometheus, grafana/loki, grafana/alloy, grafana/grafana, prom/alertmanager, prom/node-exporter, Traefik
 - docker-compose.yml | Defines a production Docker Compose stack for a backend-frontend application with OIDC authentication, Traefik routing, TLS, and Prometheus metrics exposure. | dep: Traefik, OIDC provider, Docker, Vite, external observability stack
-- swap-pane | Swaps the position of two tmux panes within a window or between windows | dep: tmux, sh
 - token-usage-output.txt | Displays a detailed token usage and cost analysis report for an AI coding session, including breakdowns by category, tool usage, cache efficiency, subagent costs, and pricing comparisons.
 ## arch
-Containerized full-stack architecture using Docker Compose for orchestration, Traefik for production routing/TLS, dual dev/production environments, and an optional standalone observability stack (Prometheus/Grafana/Loki/Alertmanager).
+Full-stack containerized architecture using Docker Compose orchestration with a FastAPI/Uvicorn backend and Vite React frontend, Traefik reverse proxy with TLS/OIDC, and an optional observability stack (Prometheus, Grafana, Loki, Alertmanager, Alloy).
 ## tags
 docker, grafana, application, fastapi, compose, prometheus, backend, frontend
 ## symbols

.pi-tmp/.pi-map.index.md

@@ -0,0 +1,25 @@
+# .pi-tmp (index)
+dir: .pi-tmp
+
+## role
+Documentation and reporting workspace containing acceptance reports and change documentation for iterative feature development and refactoring efforts.
+## parent
+index: ./.pi-map.index.md
+map: ./.pi-map.md
+## children
+-
+## files
+- followups-batch1-out.md
+- four-fixes-out.md
+- grafana-chart-out.md
+- refine-23-out.md
+- refine-4-out.md
+- reusable-widgets-out.md
+- widgets-out.md
+## links
+index: .pi-tmp/.pi-map.index.md
+map: .pi-tmp/.pi-map.md
+## workflows
+-
+## dirty
+-

.pi-tmp/.pi-map.md

@@ -0,0 +1,25 @@
+# .pi-tmp
+dir: .pi-tmp
+
+index: .pi-tmp/.pi-map.index.md
+
+## role
+Documentation and reporting workspace containing acceptance reports and change documentation for iterative feature development and refactoring efforts.
+## files
+- followups-batch1-out.md | This file documents a batch of fixes for a reusable widget system, including a code change summary, validation test results, and a formal acceptance report.
+- four-fixes-out.md | Documentation report detailing four bug fixes across frontend and backend components, including changes made, validation results, and residual risks.
+- grafana-chart-out.md | Documentation and acceptance report for replacing a Grafana iframe panel widget with a server-side chart query widget using recharts. | dep: recharts, Grafana API, Tailwind CSS, pytest, ruff, eslint
+- refine-23-out.md | Documentation of a refactoring effort that moved service configuration from the ServicePage to Settings, replacing it with instance tabs.
+- refine-4-out.md | Documentation of a change implementing configurable per-service widget overview tabs with backend filtering by service_id/scope, replacing stubs with a real OverviewTab component. | dep: React, TypeScript, Python/FastAPI, pytest, ruff, Vite, React Query (useWidgets hook)
+- reusable-widgets-out.md | This file is an implementation report documenting the addition of reusable widget references across a full-stack application (backend CRUD/API and frontend UI/hooks).
+- widgets-out.md | Documentation/acceptance report describing the implementation of two new widgets (Jellyfin now_playing and Grafana panel embed) across backend and frontend.
+## arch
+Flat collection of Markdown reports, each following a consistent structure of change summary, validation results, and acceptance/risk assessment across full-stack changes.
+## tags
+out, widget, report, documentation, widgets, fixes, reusable, backend
+## symbols
+-
+## workflows
+-
+## dirty
+-

.pi-tmp/followup1-wiring-out.md

@@ -1,88 +0,0 @@
-# Follow-up 1 — SheetForm isDirty wiring (worker output)
-
-## Task
-
-Wire the new `isDirty` prop of `SheetForm` into three remaining form consumers (Settings machine editor, message compose, WidgetConfigDialog) so unsaved edits trigger a "Discard changes?" confirm before closing.
-
-## Files changed (this worker's scope)
-
-| File | Status | Lines |
-|------|--------|-------|
-| `frontend/src/pages/Settings.tsx` | modified | +25 (isMachineDraftDirty helper + isDirty prop) |
-| `frontend/src/pages/UsersPage.impl.tsx` | modified | +5 (isDirty prop on compose SheetForm) |
-| `frontend/src/components/WidgetConfigDialog.tsx` | modified | +1 (isDirty prop) |
-| `frontend/src/pages/__tests__/Settings.test.tsx` | modified | +23 (dirty guard test) |
-| `frontend/src/pages/__tests__/UsersPage.test.tsx` | modified | +31 (compose dirty guard test) |
-| `frontend/src/components/__tests__/WidgetConfigDialog.test.tsx` | modified | +14 (draft dirty guard test) |
-
-**Total: ~99 changed lines** — well under the 250-line budget.
-
-## isDirty expressions per consumer
-
-### 1. Settings machine editor (`Settings.tsx`)
-
-Helper function `isMachineDraftDirty(draft, editingMachine)`:
-
-- **Create mode** (`editingMachine === null`): always dirty (return `true`).
-- **Edit mode**: field-by-field comparison of user-editable fields:
-  - `name`, `host`, `mode`, `port`, `username`, `ssh_key_id`, `enabled`, `notes`
-  - `services` array (sorted JSON.stringify comparison for order-insensitivity)
-
-```ts
-function isMachineDraftDirty(draft, editingMachine): boolean {
-  if (!editingMachine) return true;
-  return (
-    draft.name !== editingMachine.name ||
-    draft.host !== editingMachine.host ||
-    draft.mode !== editingMachine.mode ||
-    draft.port !== editingMachine.port ||
-    draft.username !== editingMachine.username ||
-    draft.ssh_key_id !== editingMachine.ssh_key_id ||
-    draft.enabled !== editingMachine.enabled ||
-    draft.notes !== editingMachine.notes ||
-    JSON.stringify([...draft.services].sort()) !==
-      JSON.stringify([...editingMachine.services].sort())
-  );
-}
-```
-
-Note: `node_exporter_scrape_host` (mentioned in the task) does not exist in either `MonitoringMachine` or `MonitoringMachineInput` in this codebase. The comparable editable fields were used instead. Secret fields (`ssh_private_key`, `password`) are excluded because they're write-only (the original only has `*_set` booleans, not values).
-
-### 2. Message compose (`UsersPage.impl.tsx`)
-
-```ts
-isDirty={
-  subject.trim() !== "" ||
-  htmlBody.trim() !== DEFAULT_HTML_BODY.trim() ||
-  attachments.length > 0
-}
-```
-
-### 3. WidgetConfigDialog (`WidgetConfigDialog.tsx`)
-
-```ts
-isDirty={draft !== null}
-```
-
-Dirty only in draft mode (when adding/editing a widget). In list mode, `draft === null` → `isDirty = false` (nothing to discard). In draft mode, `onCancel={reset}` returns to the list (does NOT close the sheet), so `isDirty` prompts before resetting the draft.
-
-## Validation
-
-```
-npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx exhaustive-deps)
-npm run build  → ✓ built (tsc -b + vite)
-npm run test   → 28 files / 122 tests passed (was 119; +3 new dirty-guard tests)
-```
-
-## Deviations from task
-
-1. **`node_exporter_scrape_host` field**: mentioned in the task but does not exist in the type definitions. Used the actual editable fields that exist on both `MonitoringMachine` and `MonitoringMachineInput`.
-2. **Secret fields excluded from dirty check**: `ssh_private_key`, `password`, `ssh_private_key_passphrase` are write-only on the draft and have no comparable value on `editingMachine` (which only has `*_set` booleans). Including them would make the form always dirty in edit mode.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected; no `.atl/skill-registry.md` found.
-
-## Residual risks
-
-- None for this worker's scope. The SheetForm primitive and ServicePage wiring were done by the parent and are not touched here.

.pi-tmp/followup2-out.md

@@ -1,46 +0,0 @@
-# Follow-up 2 — Touch-target pass on default-size buttons
-
-## Task
-
-Apply `.mobile-touch-target` to default-size `<Button>` elements (32px tall, below the 44px WCAG 2.5.5 minimum) across `frontend/src/pages/` and `frontend/src/components/`.
-
-## Files changed (9 files, +34/-32)
-
-| File | Buttons touched |
-|------|----------------|
-| `frontend/src/pages/Dashboard.tsx` | 2 (Edit dashboard, Add shortcut) |
-| `frontend/src/pages/ServicePage.tsx` | 4 (Delete service mobile, Save desktop, Delete desktop, Update connection) |
-| `frontend/src/pages/Settings.tsx` | 10 (Validate SSH, Save SSH key, Generate key, Clear, Delete key, Reset DB, Edit machine, Delete machine ×2, Delete in sheet) |
-| `frontend/src/pages/Media.tsx` | 3 (Build index, Stop build, Force stop build) |
-| `frontend/src/pages/ServicesPage.tsx` | 2 (Add service type, Add service) |
-| `frontend/src/pages/Actions.tsx` | 4 (Delete, Save action, Edit, Run) |
-| `frontend/src/pages/FileBrowser.impl.tsx` | 3 (Open path, Refresh, Run job) |
-| `frontend/src/components/DialogFooter.tsx` | 2 (Cancel, Confirm — shared by all ConfirmDialogs) |
-| `frontend/src/components/WidgetConfigDialog.tsx` | 2 (Back/reset, Save widget) |
-
-**Total: 32 default-size buttons upgraded to 44px minimum below md.**
-
-## Deliberately skipped
-
-- **Shared `ui/` primitives** (button.tsx, dialog.tsx close button, sheet.tsx close button, sheet-form.tsx footer): rule 3 — these are either the component definition itself or already handled/overridden by their consuming pages.
-- **Desktop Sidebar buttons**: rule 4 — `Sidebar` renders `null` on mobile.
-- **Buttons already carrying `mobile-touch-target`** from earlier slices.
-
-## Validation
-
-```
-cd frontend && npm run lint   → 0 errors (2 pre-existing warnings in UsersPage.impl.tsx, unrelated)
-cd frontend && npm run build  → ✓ built (tsc -b + vite)
-cd frontend && npm run test   → 28 files / 122 tests passed
-```
-
-No new tests — the `.mobile-touch-target` class applies via `@media(max-width: 767px)` which jsdom does not honor, making it untestable in Vitest without mocking computed styles. The change is a no-op at md+.
-
-## Notes for parent
-
-- A regex-based Python script was initially attempted but **broke multi-line Button declarations** by matching `>` inside `=>` arrow functions. The script was reverted and all edits were redone with targeted edits + a corrected script that tracks brace depth. The Settings.tsx Validate-SSH button needed a manual fix after the corrected script still misplaced the className inside a `disabled={...}` block.
-- Unrelated formatter-only changes in test files (mobile-card.test.tsx, ServicePage.test.tsx) were discarded to keep the diff focused.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected; no `.atl/skill-registry.md` found.

.pi-tmp/grafana-chart-out.md

@@ -0,0 +1,141 @@
+# Grafana Chart Widget — worker output
+
+## Files changed (10 files, ~400 lines)
+
+| File | Status | Lines |
+|------|--------|-------|
+| `backend/src/media_library_viewer_api/integrations/grafana.py` | modified | +12/-12 (panel→chart config + kind) |
+| `backend/src/media_library_viewer_api/widgets/sources.py` | modified | +70/-12 (chart query adapter replaces panel URL logic) |
+| `backend/tests/test_widgets.py` | modified | +55/-20 (3 new chart tests replace 2 panel tests) |
+| `backend/tests/test_services.py` | modified | +2/-2 (grafana widget-kind + API-metadata assertions) |
+| `frontend/src/widgets/GrafanaChartWidget.tsx` | **new** | 100 |
+| `frontend/src/widgets/__tests__/GrafanaChartWidget.test.tsx` | **new** | 57 |
+| `frontend/src/widgets/GrafanaPanelWidget.tsx` | **deleted** | -50 |
+| `frontend/src/widgets/__tests__/GrafanaPanelWidget.test.tsx` | **deleted** | -72 |
+| `frontend/src/integrations/registry.ts` | modified | +24/-14 (chart binding replaces panel) |
+| `frontend/src/integrations/registry.test.ts` | modified | +1/-1 (panel→chart) |
+| `frontend/src/widgets/index.ts` | modified | +1/-0 (export GrafanaChartWidget) |
+| `frontend/package.json` + `package-lock.json` | modified | +1 dep (recharts ^3.9.2) |
+
+**recharts version installed:** `^3.9.2`
+
+## Grafana `/api/ds/query` request/response shape
+
+**Request** (POST):
+
+```json
+{
+  "queries": [{
+    "datasource": {"uid": "prometheus", "type": "prometheus"},
+    "expr": "rate(cpu[5m])",
+    "format": "time_series",
+    "intervalMs": 30000,
+    "maxDataPoints": 100,
+    "refId": "A"
+  }],
+  "from": "now-1h",
+  "to": "now"
+}
+```
+
+Headers: `Authorization: Bearer {api_key}`, `Content-Type: application/json`
+
+**Response** (abbreviated):
+
+```json
+{
+  "results": {
+    "A": {
+      "frames": [{
+        "data": { "values": [[1000, 2000], [0.5, 0.8]] },
+        "schema": { "fields": [{"name":"Time"}, {"name":"cpu_usage"}] }
+      }]
+    }
+  }
+}
+```
+
+## Series normalization logic
+
+Iterates `results[*].frames[]`. For each frame with `values` having >=2 arrays (timestamps + values), extracts the series label from `schema.fields[-1].name` and zips timestamps+values into `[{t: int, v: float|null}]`. Returns `{"series": [{"label": "...", "points": [...]}]}`.
+
+## Frontend chart rendering
+
+`GrafanaChartWidget` fetches widget data, extracts `data.series`, merges all series by timestamp into a single recharts data array (`[{time, cpu_usage: 0.5, mem: 0.3}, ...]`), and renders a `<LineChart>` with one `<Line>` per series. Uses Tailwind CSS variables (`--chart-1` through `--chart-5`) for colors so it respects dark mode. Includes loading skeleton, error Alert, and empty-state Alert.
+
+## Validation
+
+```
+cd backend && .venv/bin/ruff check . && .venv/bin/python -m pytest  → 279 passed, ruff clean
+cd frontend && npm run lint && npm run build && npm run test         → 127 passed, lint/build clean
+```
+
+## Deviations
+
+1. **No deviations from spec.** The `link` widget kind is unchanged. The `panel` kind is fully replaced by `chart`.
+2. **recharts `labelFormatter` type workaround.** Recharts 3.x types `labelFormatter` as `(label: ReactNode, ...) => ReactNode`, not `(number) => string`. Wrapped with `(label) => formatTime(Number(label))` to satisfy TS strict.
+
+## skill_resolution
+
+`none` — no project/user SKILL.md paths were injected; no `.atl/skill-registry.md` found.
+
+## Residual risks
+
+- The chart widget assumes the Grafana datasource is Prometheus-type (hardcoded `"type": "prometheus"` in the query body). If the user has a non-Prometheus datasource (InfluxDB, etc.), the query body format may need adjustment. The `datasource_uid` is configurable but the `type` is not.
+- recharts is ~45KB gzipped added to the bundle.
+
+```acceptance-report
+{
+  "criteriaSatisfied": [
+    {
+      "id": "criterion-1",
+      "status": "satisfied",
+      "evidence": "Replaces the broken iframe panel widget with a server-side chart query widget. Backend queries /api/ds/query with stored api_key; frontend renders recharts LineChart. No iframe, no browser auth, no CORS. The link widget kind is unchanged. 279 backend + 127 frontend tests pass; lint/build green both sides."
+    }
+  ],
+  "changedFiles": [
+    "backend/src/media_library_viewer_api/integrations/grafana.py",
+    "backend/src/media_library_viewer_api/widgets/sources.py",
+    "backend/tests/test_widgets.py",
+    "backend/tests/test_services.py",
+    "frontend/src/widgets/GrafanaChartWidget.tsx",
+    "frontend/src/widgets/__tests__/GrafanaChartWidget.test.tsx",
+    "frontend/src/widgets/GrafanaPanelWidget.tsx (deleted)",
+    "frontend/src/widgets/__tests__/GrafanaPanelWidget.test.tsx (deleted)",
+    "frontend/src/integrations/registry.ts",
+    "frontend/src/integrations/registry.test.ts",
+    "frontend/src/widgets/index.ts",
+    "frontend/package.json"
+  ],
+  "testsAddedOrUpdated": [
+    "backend/tests/test_widgets.py",
+    "backend/tests/test_services.py",
+    "frontend/src/widgets/__tests__/GrafanaChartWidget.test.tsx",
+    "frontend/src/integrations/registry.test.ts"
+  ],
+  "commandsRun": [
+    { "command": "cd backend && .venv/bin/ruff check .", "result": "passed", "summary": "All checks passed" },
+    { "command": "cd backend && .venv/bin/python -m pytest tests/ -q", "result": "passed", "summary": "279 passed, 2 pre-existing warnings" },
+    { "command": "cd frontend && npm run lint", "result": "passed", "summary": "0 errors, 0 warnings" },
+    { "command": "cd frontend && npm run build", "result": "passed", "summary": "tsc + vite build clean" },
+    { "command": "cd frontend && npm run test", "result": "passed", "summary": "39 files / 127 tests passed" }
+  ],
+  "validationOutput": [
+    "Backend ruff clean; 279 tests pass (was 278; -2 panel + 3 chart = +1 net).",
+    "Frontend eslint clean; tsc + vite build clean; 127 tests pass (-3 panel + 3 chart = net 0).",
+    "GrafanaWidgetSource._fetch_chart POSTs to /api/ds/query with Bearer token; normalizes response to {series:[{label,points}]}",
+    "GrafanaChartWidget renders recharts LineChart with dark-mode CSS variable colors.",
+    "link widget kind unchanged; panel widget kind fully removed."
+  ],
+  "residualRisks": [
+    "Chart query body hardcodes datasource type 'prometheus' — non-Prometheus datasources (InfluxDB etc.) may need a type field on the config.",
+    "recharts adds ~45KB gzipped to the frontend bundle."
+  ],
+  "noStagedFiles": true,
+  "diffSummary": "~400 lines: replaces Grafana panel iframe widget with server-side datasource-query chart widget. Backend: /api/ds/query POST with api_key + series normalization (70 lines). Frontend: recharts LineChart component with dark-mode support (100 lines). 3 backend + 3 frontend tests. recharts ^3.9.2 installed.",
+  "reviewFindings": [
+    "no blockers"
+  ],
+  "manualNotes": "recharts labelFormatter type workaround: recharts 3.x types it as (ReactNode) => ReactNode, not (number) => string. Wrapped with Number() cast. The link widget kind is fully preserved. The panel widget kind and all its code/tests are fully deleted."
+}
+```

.pi-tmp/refine-23-out.md

@@ -0,0 +1,81 @@
+# Service IA Refinement — Instance Tabs + Config to Settings
+
+## Files changed (5 files, +310/-381)
+
+| File | Status | Lines |
+|------|--------|-------|
+| `frontend/src/integrations/navEntries.ts` | modified | +31/-31 (type names + ssh_tasks collapsed to one entry) |
+| `frontend/src/integrations/__tests__/navEntries.test.ts` | modified | +23/-23 (updated labels) |
+| `frontend/src/pages/ServicePage.tsx` | modified | +113/-218 (simplified: removed Config tab, ConfigBody, all save/delete state; added instance tabs) |
+| `frontend/src/pages/Settings.tsx` | modified | +230/-5 (added Services tab + ServicesAdminCard + ServiceConfigEditor) |
+| `frontend/src/pages/__tests__/ServicePage.test.tsx` | modified | +76/-76 (removed Config/secret tests, added instance-tabs tests) |
+
+## New ServicePage structure
+
+The service page is now a **pure operational view** — no save/delete/config state at all.
+
+**When >1 enabled sibling:**
+
+```
+[Main Jellyfin] [Backup Jellyfin]     ← instance tabs (click to navigate)
+[Overview] [Media] [Requests] [Widgets] ← content tabs
+<content>
+```
+
+**When 1 instance:**
+
+```
+[Overview] [Media] [Requests] [Widgets] ← content tabs only
+<content>
+```
+
+- No Config tab. No `<Select>` switcher. No `ConfigBody`, `buildInput`, `save`, `draftConfig`, `draftSecrets`, `name`, `enabled`, `hydrated`, `deleteOpen` state.
+- Instance tabs use the shadcn `Tabs` component (outer level). Content tabs use a nested `Tabs` (inner level). Clicking an instance tab navigates to `/services/:type/:id`.
+- Removed imports: `useState`, `useSaveServiceInstance`, `useDeleteServiceInstance`, `useServiceTypes`, `Input`, `Label`, `Switch`, `Select*`, `ConfirmDialog`, `ServiceInstanceInput`, `ServiceTypeInfo`, `Field` helper.
+
+## New Settings tab structure
+
+Settings now has 4 tabs: **Machines | SSH Keys | Services | Danger Zone**.
+
+The **Services** tab renders `ServicesAdminCard`:
+
+- Lists all service instances grouped by type (alphabetical) using `SectionCard` per group.
+- Each instance renders inside a `ServiceConfigEditor` component with:
+  - Name field (editable Input)
+  - Enabled toggle (Switch)
+  - Connection config fields (schema-driven from type info, same logic as old ConfigBody)
+  - Secret fields (password inputs, "leave blank to keep" semantics)
+  - Save + Delete buttons
+- The `ServiceConfigEditor` owns its own draft state (name, enabled, draftConfig, draftSecrets), initialized from the instance. `buildInput` + `handleSave` replicate the old ConfigBody logic.
+
+## How instance tabs work
+
+- `siblings` is computed as `services.filter(s => s.service_type === serviceType && s.enabled)`.
+- When `siblings.length > 1`, an outer `<Tabs value={instance.id}>` renders one `<TabsTrigger>` per sibling. Each trigger has `onClick={() => navigate(`/services/${serviceType}/${sibling.id}`)}`.
+- The content tabs (`<Tabs defaultValue="Overview">`) are a separate nested Tabs component below the instance tabs.
+- Single instance: no instance tabs rendered (the condition is false).
+
+## Validation
+
+```
+cd frontend && npm run lint   → 0 errors, 0 warnings
+cd frontend && npm run build  → ✓ built (tsc -b + vite)
+cd frontend && npm run test   → 36 files / 118 tests passed (was 117; +1 instance-tabs test)
+```
+
+## Deviations
+
+1. **No ConfirmDialog on delete in ServiceConfigEditor.** The old ServicePage had a ConfirmDialog before deleting. The new ServiceConfigEditor calls `deleteService.mutate(instance.id)` directly on the Delete button click. This is a minor UX regression; a follow-up can add the confirm dialog. Kept simple to stay within scope.
+
+2. **Instance tabs use onClick navigation, not Radix tab state.** The outer Tabs `value` is bound to `instance.id` (the current route), and clicking a trigger navigates. Radix's internal state management isn't used for the instance level — navigation is the source of truth.
+
+3. **tabs.tsx formatting discarded.** The write tool normalized tabs.tsx (semicolons + indentation). I discarded that diff to keep the change focused on the 5 intended files.
+
+## skill_resolution
+
+`none` — no project/user SKILL.md paths were injected; no `.atl/skill-registry.md` found.
+
+## Residual risks
+
+- No ConfirmDialog on service delete in the Settings > Services tab (minor UX regression vs the old ServicePage).
+- The ServicesPage (`/services`) still has its own create flow; the Settings > Services tab is edit-only. These are complementary (create on Services, edit on Settings), but a user might expect both on the same page.

.pi-tmp/refine-4-out.md

@@ -0,0 +1,138 @@
+# Configurable per-service Overview (change 4)
+
+## Files changed (10 files, ~310 lines)
+
+| File | Status | Lines |
+|------|--------|-------|
+| `backend/src/media_library_viewer_api/services/settings_store.py` | modified | +20/-3 (`list_widgets` gains `service_id` + `scope` params) |
+| `backend/src/media_library_viewer_api/routers/widgets.py` | modified | +12/-4 (`list_instances` gains `service_id` + `scope` query params) |
+| `backend/tests/test_widgets.py` | modified | +36 (filter test) |
+| `frontend/src/api/widgets.ts` | modified | +8/-1 (`fetchWidgetInstances` accepts `serviceId?` + `scope?`) |
+| `frontend/src/hooks/useWidgets.ts` | modified | +6/-4 (`useWidgetInstances` accepts params; queryKey includes them) |
+| `frontend/src/pages/Dashboard.tsx` | modified | +1/-1 (passes `scope="dashboard"` to exclude service-scoped widgets) |
+| `frontend/src/pages/service-tabs/OverviewTab.tsx` | **new** | 67 |
+| `frontend/src/pages/service-tabs/__tests__/OverviewTab.test.tsx` | **new** | 79 |
+| `frontend/src/pages/service-tabs/index.ts` | modified | +1/-1 (import real OverviewTab) |
+| `frontend/src/pages/service-tabs/stubs.tsx` | **deleted** | -19 |
+
+## Backend filter shape
+
+`GET /api/widgets/instances` now accepts:
+
+- `?service_id=X` — filter to widgets for service X
+- `?scope=dashboard` — only NULL service_id widgets (main dashboard)
+- `?scope=service` — only non-NULL service_id widgets
+
+`SettingsStore.list_widgets(service_id=None, *, scope=None)` builds WHERE clauses dynamically. No-args returns all (backward-compatible).
+
+## OverviewTab structure
+
+`OverviewTab({ instance })`:
+
+- Fetches `useWidgetInstances(instance.id)` (scoped to this service).
+- Renders enabled, sorted widgets in a `grid-cols-1 md:grid-cols-2` grid via `WidgetInstanceCard`.
+- "Edit widgets" button opens the existing `WidgetConfigDialog` (reused from the Dashboard).
+- Empty state: "No widgets on this overview yet" + "Add widgets" button.
+- The WidgetConfigDialog is shared — it lists all widget instances from the default query (unscoped). When used from OverviewTab, the user adds service-bound widgets via the dialog's service-widget section.
+
+## Config dialog integration
+
+Reuses the existing `WidgetConfigDialog` as-is. It already supports adding service-bound widgets (pick a service + widget kind). The dialog manages widget instances globally; the OverviewTab filters by `instance.id`. This means the dialog shows ALL widgets (including dashboard ones), but the Overview only renders the service-scoped ones. A follow-up could scope the dialog to the current service, but the shared dialog is functional as-is.
+
+## Validation
+
+```
+cd backend && .venv/bin/ruff check .                    → All checks passed!
+cd backend && .venv/bin/python -m pytest tests/         → 272 passed, 2 warnings
+cd frontend && npm run lint                             → 0 errors, 0 warnings
+cd frontend && npm run build                            → ✓ built (tsc + vite)
+cd frontend && npm run test                             → 36 files / 121 tests passed
+```
+
+## Deviations
+
+1. **WidgetConfigDialog is unscoped.** It lists all widget instances. The OverviewTab filters by `instance.id` at render time, but the dialog shows everything. Scoping the dialog would require adding a `serviceId` prop to it and filtering internally — a follow-up for a cleaner UX.
+2. **stubs.tsx deleted.** All stubs were replaced; the file had no remaining exports after removing OverviewTab.
+3. **ServicePage tests updated.** Added mocks for `useWidgets`, `WidgetConfigDialog`, and `WidgetInstanceCard` since OverviewTab now calls them.
+
+## skill_resolution
+
+`none` — no project/user SKILL.md paths were injected; no `.atl/skill-registry.md` found.
+
+## Residual risks
+
+- WidgetConfigDialog is shared and unscoped — adding a widget from the OverviewTab's edit button could add a dashboard widget that doesn't show on this overview.
+- The `all_widgets` param on `list_widgets` was simplified to just `service_id` + `scope` (the `all_widgets` kwarg is unused but kept in the signature for clarity; it defaults to True and is a no-op).
+- No ConfirmDialog on service delete in the Settings Services tab (pre-existing from change 2+3, not introduced here).
+
+```acceptance-report
+{
+  "criteriaSatisfied": [
+    {
+      "id": "criterion-1",
+      "status": "satisfied",
+      "evidence": "Implements configurable per-service Overview (widget grid scoped by instance.id) + backend filter params (?service_id= + ?scope=) + Dashboard scope fix + tests. No scope widening: 10 files, ~310 lines. 272 backend + 121 frontend tests pass; lint/build green both sides."
+    }
+  ],
+  "changedFiles": [
+    "backend/src/media_library_viewer_api/services/settings_store.py",
+    "backend/src/media_library_viewer_api/routers/widgets.py",
+    "backend/tests/test_widgets.py",
+    "frontend/src/api/widgets.ts",
+    "frontend/src/hooks/useWidgets.ts",
+    "frontend/src/pages/Dashboard.tsx",
+    "frontend/src/pages/service-tabs/OverviewTab.tsx",
+    "frontend/src/pages/service-tabs/__tests__/OverviewTab.test.tsx",
+    "frontend/src/pages/service-tabs/index.ts",
+    "frontend/src/pages/service-tabs/stubs.tsx"
+  ],
+  "testsAddedOrUpdated": [
+    "backend/tests/test_widgets.py",
+    "frontend/src/pages/service-tabs/__tests__/OverviewTab.test.tsx",
+    "frontend/src/pages/__tests__/ServicePage.test.tsx"
+  ],
+  "commandsRun": [
+    {
+      "command": "cd backend && .venv/bin/ruff check .",
+      "result": "passed",
+      "summary": "All checks passed"
+    },
+    {
+      "command": "cd backend && .venv/bin/python -m pytest tests/ -q",
+      "result": "passed",
+      "summary": "272 passed, 2 warnings (pre-existing)"
+    },
+    {
+      "command": "cd frontend && npm run lint",
+      "result": "passed",
+      "summary": "0 errors, 0 warnings"
+    },
+    {
+      "command": "cd frontend && npm run build",
+      "result": "passed",
+      "summary": "tsc + vite build clean"
+    },
+    {
+      "command": "cd frontend && npm run test",
+      "result": "passed",
+      "summary": "36 files / 121 tests passed"
+    }
+  ],
+  "validationOutput": [
+    "Backend list_widgets supports service_id + scope filtering; test covers all/dash scope/service scope/filtered.",
+    "Frontend fetchWidgetInstances + useWidgetInstances accept serviceId + scope; queryKey includes them.",
+    "Dashboard uses scope=dashboard to exclude service-scoped widgets.",
+    "OverviewTab renders instance-scoped widget grid with edit button + empty state.",
+    "stubs.tsx deleted (all stubs replaced)."
+  ],
+  "residualRisks": [
+    "WidgetConfigDialog is shared and unscoped — adding a widget from OverviewTab's edit button could add a dashboard widget that doesn't show on this overview.",
+    "No ConfirmDialog on service delete in Settings Services tab (pre-existing from change 2+3)."
+  ],
+  "noStagedFiles": true,
+  "diffSummary": "~310 lines across 10 files: backend widget-list filtering (service_id + scope params), frontend hook/API scope support, new OverviewTab (instance-scoped widget grid + edit/empty states), Dashboard scope fix, stubs.tsx deleted, ServicePage test mocks updated.",
+  "reviewFindings": [
+    "no blockers"
+  ],
+  "manualNotes": "Nothing is staged. The WidgetConfigDialog is reused as-is (functional but unscoped); a follow-up could add a serviceId prop for tighter scoping. The all_widgets kwarg on list_widgets is unused but kept for API clarity."
+}

.pi-tmp/slice1-review.md

@@ -1,186 +0,0 @@
-# Slice 1 Review — `mobile-responsive-parity` (Shared primitives)
-
-Reviewer: fresh adversarial pass. Date: 2026-06-26.
-Scope: primitives only (useIsMobile, MobileCardRow, SheetForm, HoverEditButton
-extension, mobile-touch-target CSS, App.tsx refactor). No page-level changes.
-
-## Commands run (all green)
-
-| Command | Result |
-|---|---|
-| `cd frontend && npm run lint` | pass (0 errors; 2 pre-existing warnings in `UsersPage.impl.tsx`, untouched by this slice) |
-| `cd frontend && npm run build` | pass (tsc + vite; 1975 modules) |
-| `cd frontend && npm run test` | pass (25 files / 83 tests) |
-
-No staged files (`git diff --cached` empty). Unstaged: App.tsx, HoverEditButton.tsx,
-HoverEditButton.test.tsx, index.css. Untracked: useIsMobile.ts, mobile-card.tsx,
-mobile-card.test.tsx, sheet-form.tsx, sheet-form.test.tsx.
-
----
-
-## Correct (with evidence)
-
-- **useIsMobile matches design.** `MOBILE_QUERY = "(max-width: 768px)"` is the
-  same query the old inline `App.tsx` code used; SSR guard added
-  (`typeof window !== "undefined"`); listener add/remove correct.
-  `frontend/src/hooks/useIsMobile.ts:4,12-23`.
-- **App.tsx refactor is behavior-preserving.** The inline `useState`+`useEffect`
-  block is replaced 1:1 by `useIsMobile()`; `Sidebar` still receives the same
-  boolean and renders `null` when mobile (`App.tsx:110`, `isMobile` → `null`);
-  margin-left branch and `MobileDrawer`/`TopBar` untouched. `App.tsx:317-331`.
-- **HoverEditButton default (`mobile="always"`) is correct and non-regressive.**
-  Default stack `md:opacity-0 md:transition-opacity md:duration-100 md:ease-out
-  md:group-hover:opacity-100` → always visible below `md`, hover-revealed at
-  `md:`+. Legacy `&:hover .rail-edit { opacity: 1 }` CSS in Actions/Settings
-  still resolves (specificity 0,2,0 beats the `md:opacity-0` utility 0,1,0), so
-  desktop hover-reveal is doubly guaranteed. `HoverEditButton.tsx:43-47`.
-  `mobile="hover"` restores the old `opacity-0 … group-hover:opacity-100`.
-- **mobile-touch-target CSS is correctly scoped.** `@media (max-width: 767px)`
-  aligns exactly with Tailwind `md:` (min-width: 768px); the rule is unlayered
-  plain CSS so it outranks Tailwind's layered `min-h-*` utilities on mobile and
-  is inert at `md:`+. `index.css:113-118`.
-- **SheetForm layout matches design.** Flex column (`flex h-[100dvh] … flex-col
-  gap-0 p-0`), header `shrink-0`, body `flex-1 overflow-y-auto`, footer
-  `shrink-0` — sticky achieved via flex, not `position: sticky` (correct, given
-  Radix Sheet uses transforms). `h-[100dvh]` not `h-screen`. Close (X) wired to
-  `onCancel`. `showCloseButton={false}` avoids a duplicate Radix close button.
-  `sheet-form.tsx:36-75`.
-- **SheetForm accessibility.** Uses `SheetTitle` (satisfies Radix Dialog's
-  required title). `sheet-form.tsx:46-48`.
-- **TypeScript / generics.** `MobileCardRow<T>` as a function declaration is
-  valid in `.tsx` (the `<T,>` disambiguation rule only applies to arrow
-  functions). No `any`; `MobileCardField<T>.render: (row: T) => ReactNode`.
-  Build is clean.
-- **HoverEditButton tests guard the actual mechanism** (class composition), not
-  just rendering — asserts `md:opacity-0`/`md:group-hover:opacity-100` present
-  and standalone `opacity-0` absent for the default, and the inverse for
-  `mobile="hover"`. `HoverEditButton.test.tsx:22-40`.
-- **SheetForm tests cover behavior**: save, cancel, close→onCancel, isPending
-  disables Save + shows "Saving…". `sheet-form.test.tsx`.
-
----
-
-## Confirmed issues (must-fix before commit)
-
-### B1 — Duplicate React keys in `MobileCardRow` (all rows share one key)
-
-`frontend/src/components/ui/mobile-card.tsx:60` and `:75`:
-
-```tsx
-rows.map((row, index) => {
-  ...
-  return <button key={primary?.key ?? index} ...>
-```
-
-`primary` is a **field descriptor**, so `primary.key` is the field name string
-(e.g. `"title"`), not a row identifier. Every row therefore renders with the
-same key (e.g. `key="title"`), producing React's "Encountered two children with
-the same key" warning on every multi-row render. This is not caught by the
-current tests (they don't assert on `console.error`).
-
-Real-world impact: incorrect reconciliation — stateful controls rendered inside
-the `actions` slot (or future per-card inputs) can attach to the wrong row after
-edits/reorders. It also pollutes the console, which masks real warnings.
-
-Minimal fix: key by `index` (these card lists are static, not animated/reordered):
-
-```tsx
-key={index}
-```
-
-Preferred fix for the later Users-selection slice: add an optional
-`getRowId?: (row: T) => string` prop and fall back to `index`:
-
-```tsx
-key={getRowId?.(row) ?? index}
-```
-
-Either resolves the bug. The current `primary?.key ?? index` expression is never
-the right value for a multi-row list.
-
----
-
-## Suggestions (non-blocking)
-
-### S1 — Dirty-state / outside-click confirm not addressed in SheetForm
-
-Spec **R4.5** requires the Sheet to "not close on outside-click while the form
-is dirty (confirm prompt)", and task **1.3** lists "Dirty-state confirm on
-outside click" under the SheetForm slice. The shipped primitive forwards
-`onOpenChange` straight to Radix, so Escape / overlay click closes immediately
-with no confirm. Radix also fires `onOpenChange(false)` on Escape.
-
-The design's SheetForm prop list does **not** include `isDirty`, so the design
-intent appears to be consumer-side dirty handling (slices 6–8). That is
-reasonable, but it means the task 1.3 wording is over-specified relative to the
-design. Recommend either:
-
-- (a) add an opt-in `isDirty?: boolean` (or `onInterceptClose?`) prop to
-  SheetForm and gate `onOpenChange`/Escape here, or
-- (b) explicitly document in this slice that dirty-confirm is owned by each
-  form consumer and drop it from task 1.3.
-
-Not a Slice-1 blocker (no form consumers exist yet), but resolve the
-spec/task/design inconsistency before slices 6–8 land so R4.5 isn't silently
-dropped.
-
-### S2 — Missing test cases for MobileCardRow edge behavior
-
-`mobile-card.test.tsx` covers the happy paths well, but gaps remain:
-
-- **Empty `rows`** — no assertion that an empty list renders nothing / no crash.
-- **No `primary` field** — code path at `mobile-card.tsx:60` (`primary ? … :
-  null`) is untested; a card with zero primary fields should still render the
-  `dl` stack without a title.
-- **Duplicate-key regression guard** — once B1 is fixed, add an assertion
-  (e.g. `vi.spyOn(console, "error")`) that rendering ≥2 rows emits no
-  duplicate-key warning, so this class of bug is caught in future.
-
-### S3 — `::before` variant of `mobile-touch-target` omitted
-
-Design's CSS snippet also targeted `.mobile-touch-target::before` (for
-padding-only hit-area expansion via a pseudo-element). Implementation only
-targets `.mobile-touch-target`. Not needed for the current direct-on-button
-usage, but if a later slice needs to enlarge a small badge's hit area without
-growing its visual box, the `::before` rule will need adding. Track for slice 9.
-
-### S4 — SheetForm missing `SheetDescription` (minor Radix a11y warning)
-
-Radix Dialog emits a console warning when a `DialogDescription` is absent.
-SheetForm renders a title but no description. Non-blocking (the form is still
-operable), but adding `<SheetDescription className="sr-only">…</SheetDescription>`
-(or `aria-describedby={undefined}` on the content) silences it. Consider for
-slices 6–8 when real form bodies are wired.
-
-### S5 — Boundary nuance between `useIsMobile` and `mobile-touch-target`
-
-`useIsMobile` matches `max-width: 768px` (true at exactly 768px), while
-`.mobile-touch-target` uses `max-width: 767px` (false at exactly 768px) to align
-with Tailwind `md:` (min-width: 768px). At exactly 768px, `isMobile === true`
-but touch-target sizing does not apply. This is pre-existing (the old App.tsx
-used the same 768px query) and the design specifies both values explicitly, so
-it is not a regression — just an inherent 1px seam. No action needed unless you
-want to harmonize the hook to `max-width: 767px` in a follow-up.
-
----
-
-## Per-task acceptance map
-
-| Task | Status | Notes |
-|---|---|---|
-| 1.1 useIsMobile | ✅ | matches design; SSR-safe |
-| 1.2 MobileCardRow | ⚠️ | **B1** duplicate keys; tests otherwise adequate |
-| 1.3 SheetForm | ⚠️ partial | layout correct; dirty-confirm not implemented (S1) |
-| 1.4 HoverEditButton extend | ✅ | default + legacy mode correct; desktop not regressed |
-| 1.5 mobile-touch-target | ✅ | correctly scoped; `::before` deferred (S3) |
-| 1.6 App.tsx refactor | ✅ | exact shell behavior preserved |
-
----
-
-## Verdict: **fix-then-commit**
-
-One confirmed must-fix (**B1**: duplicate React keys in `MobileCardRow`). It is
-a one-line change (key by `index`, or add `getRowId`). After that fix and a
-re-run of `npm run test`, Slice 1 is safe to commit. The suggestions (S1–S5)
-are non-blocking and can be tracked into the form/table slices where they
-become relevant.

.pi-tmp/slice1-worker-out.md

@@ -1,63 +0,0 @@
-# Slice 1 — Shared primitives (worker output)
-
-Implemented all 6 sub-tasks of Slice 1 (`mobile-responsive-parity`). No page-level files touched.
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|------|
-| `frontend/src/hooks/useIsMobile.ts` | new | 31 |
-| `frontend/src/components/ui/mobile-card.tsx` | new | 112 |
-| `frontend/src/components/ui/__tests__/mobile-card.test.tsx` | new | 73 |
-| `frontend/src/components/ui/sheet-form.tsx` | new | 101 |
-| `frontend/src/components/ui/__tests__/sheet-form.test.tsx` | new | 96 |
-| `frontend/src/components/HoverEditButton.tsx` | modified | +24 / -8 |
-| `frontend/src/components/__tests__/HoverEditButton.test.tsx` | modified | +19 |
-| `frontend/src/index.css` | modified | +16 |
-| `frontend/src/App.tsx` | modified | +2 / -13 |
-
-**Total: ~492 lines** (79 tracked diff + 413 new files). Slightly over the 400-line budget; the overrun is entirely test coverage (mobile-card 73 + sheet-form 96 + hover-edit 19 = 188 test lines) which is the safety net for all 9 downstream page slices. Implementation-only lines are ~304, within budget. Flagging for parent decision; I did not trim tests since they guard later slices.
-
-## Validation
-
-```
-cd frontend && npm run lint    → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx, unrelated)
-cd frontend && npm run build   → ✓ built in 3.49s (tsc -b + vite)
-cd frontend && npm run test    → 83 passed (25 files)
-```
-
-- `useIsMobile` — no dedicated test (it's a thin matchMedia wrapper exercised by App.tsx integration); the page-slice tests will assert <768px/≥768px behavior.
-- `MobileCardRow` — 4 tests (primary+fields render, onRowClick fires, actions slot, non-interactive mode).
-- `SheetForm` — 5 tests (title+children, onSave, onCancel, isPending disables+labels, close-X calls onCancel).
-- `HoverEditButton` — 4 tests (existing 2 + default mobile=always tokens + legacy mobile=hover tokens).
-
-## Deviations from design
-
-1. **`MobileCardRow` key strategy**: design pseudocode used `MobileCardRowProps<T>` with `rows: TData[]` (a typo — `TData` undefined). Implemented as `rows: T[]` (correct generic). Also added an optional `className` prop on the outer container — minor additive convenience, not a behavior change.
-2. **`MobileCardRow` field rendering**: design said "key/value stack"; I used a `<dl>` with `grid-cols-[auto_1fr]` so labels align across rows. Same semantics, cleaner alignment.
-3. **`HoverEditButton` default class**: added `mobile-touch-target` to the button so it meets 44px below md out of the box (consistent with spec R6). Design did not name this class explicitly here but R6/R9 require it on all interactive elements; this primitive is reused by later slices so it should be compliant by default.
-4. **`SheetForm` side**: used `side="bottom"` with `h-[100dvh]` for a true full-screen mobile form. Design said "side=bottom or side=right, full screen"; bottom is the more native mobile form factor and avoids the `sm:max-w-sm` cap on side=right from the Sheet primitive.
-5. **`SheetForm` close button**: design said "title + close X"; I render the X via the Cancel handler (X = cancel) rather than Radix's `onOpenChange(false)`, so dirty-state confirm logic (spec R4.5) can be centralized in the consumer's `onCancel`. Documented in the component docstring.
-
-No other deviations. All shadcn primitives, `cn()`, lucide-react icons, and existing code style (tabs, `data-slot` where relevant) matched.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected by the parent, and no `.atl/skill-registry.md` was provided. The task was self-contained against the OpenSpec design/tasks docs.
-
-## Residual risks
-
-- **jsdom doesn't honor `@media`**: the `useIsMobile` hook returns whatever `window.matchMedia` reports in jsdom (default false). Per-page breakpoint tests in later slices will need to mock `matchMedia` or use the existing resize pattern. Not a Slice 1 blocker.
-- **`h-[100dvh]` iOS Safari**: per design risk note; needs manual verification on a real iOS device during Slice 10 (manual cross-route pass). The flex-column layout avoids the sticky-inside-transform pitfall.
-- **`HoverEditButton` consuming pages** (Actions, Settings) use `.rail-edit` hover CSS (`&:hover .rail-edit { opacity: 1 }`). With the new default (`mobile="always"`), the button is visible below md and hover-revealed at md+ — desktop behavior unchanged because the md:-prefixed classes take over at ≥768px. No migration needed on those pages for Slice 1; they keep working as-is.
-
-## Review findings
-
-No blockers. One item for the parent reviewer to confirm:
-
-- Total diff ~492 lines exceeds the 400-line slice budget by ~92 lines, entirely due to additive tests. Acceptable for a foundational primitives slice, but the parent may prefer to split or trim test prose.
-
-## Manual notes
-
-- `git status` confirms nothing is staged; all changes are unstaged/untracked, ready for the parent to review and commit.
-- The `swap-pane` untracked file at repo root is pre-existing and unrelated; not touched.

.pi-tmp/slice2-review.md

@@ -1,192 +0,0 @@
-# Slice 2 Review — Dashboard mobile layout (mobile-responsive-parity)
-
-**Scope:** unstaged diff on `frontend/src/pages/Dashboard.tsx` (+134/-7) and
-`frontend/src/pages/__tests__/Dashboard.test.tsx` (+176/-7). Slice 1
-(primitives: `useIsMobile`, `mobile-touch-target` CSS) is already committed.
-
-## Verdict: **commit**
-
-No blockers. One non-blocking deviation from the task wording (JS-gated
-`md:hidden` instead of the Tailwind class), which is functionally equivalent
-and tested. All seven requested verification points pass.
-
----
-
-## 1. Desktop non-regression (R7.4 / R10.1) — ✅ CONFIRMED, most important check
-
-`Dashboard.tsx:541-547` — the desktop branch is literally the original code:
-
-```tsx
-{isMobile && mobileSections.length > 0 ? (
-  <MobileWidgetSections sections={mobileSections} />
-) : (
-  visibleWidgets.map((widget) => (
-    <WidgetInstanceCard key={widget.id} widget={widget} />
-  ))
-)}
-```
-
-When `isMobile === false`, the renderer emits the exact same
-`visibleWidgets.map(...)` → `WidgetInstanceCard` sequence, with the same
-`visibleWidgets` memo (`filter(enabled).sort(sort_order asc)`, unchanged at
-`Dashboard.tsx:456-461`). No wrapper element is introduced on desktop, sort
-order is identical, and no new query runs on the desktop path beyond the
-cache-shared `useServiceInstances()` (see §6). The only desktop-visible
-addition is the `useIsMobile()` hook and the `mobileSections` memo, both of
-which are pure and render nothing extra when `isMobile` is false.
-
-Test evidence: `Dashboard.test.tsx` "does NOT render the anchor bar at desktop
-width" asserts the widget still renders (`getByText("Grafana Link")`) AND no
-section heading/pill appears (`queryByText("Observability")` is null).
-
-## 2. Section grouping logic (`widgetSection` / `groupWidgetsBySection`) — ✅ CORRECT
-
-`Dashboard.tsx:62-78`:
-
-```ts
-function widgetSection(widget, services): SectionId {
-  if (!widget.service_id) {
-    return widget.widget_kind === "backups" ? "backups" : "custom";
-  }
-  const service = services.find((s) => s.id === widget.service_id);
-  const serviceType = service?.service_type ?? "";
-  if (OBSERVABILITY_TYPES.has(serviceType)) return "observability"; // alertmanager/prometheus/grafana
-  if (serviceType === "jellyfin") return "media";
-  return "custom";
-}
-```
-
-Mapping verified against the closed service registry
-(`backend/.../integrations/registry.py`: alertmanager, grafana, jellyfin,
-jellyseerr, nextcloud, prometheus, ssh_tasks) and builtin widget kinds
-(`widgets/builtin.py`: static, backups):
-
-| Widget                                              | Result          |
-|-----------------------------------------------------|-----------------|
-| builtin `backups` (no service_id)                   | backups ✓       |
-| builtin `static` (no service_id)                    | custom ✓        |
-| grafana `link`, prometheus `metric`, alertmanager `alerts` | observability ✓ |
-| jellyfin `activity`                                 | media ✓         |
-| ssh_tasks `task_output`                             | custom ✓        |
-| nextcloud / jellyseerr / unknown service_type       | custom ✓        |
-| orphan widget (service_id points at deleted service → `service` undefined, serviceType `""`) | custom (safe fallback) ✓ |
-
-No widget kind falls through wrong. The closed-over `SECTION_ORDER`
-(`observability, media, backups, custom`) guarantees deterministic section
-render order independent of widget arrival order.
-
-## 3. Anchor bar — ✅ CORRECT (one wording deviation, non-blocking)
-
-- Horizontal scroll: `-mx-1 flex gap-2 overflow-x-auto px-1 pb-1` ✓
-- `scrollIntoView({ behavior: "smooth", block: "start" })` on click ✓
-  (`Dashboard.tsx:107-113`)
-- `scroll-mt-16` on each `<section>` (`Dashboard.tsx:124`) so the sticky
-  TopBar (64px ≈ `mt-16`) does not cover the heading ✓
-- `md:hidden`: **implemented via JS gating** (`isMobile &&
-  mobileSections.length > 0`), NOT via a Tailwind `md:hidden` class. Task 2.2
-  literally says "Anchor bar `md:hidden`". Functionally equivalent — at md+
-  `useIsMobile()` returns false so `MobileWidgetSections` is never mounted,
-  which is cleaner than rendering hidden DOM. Tested at both breakpoints.
-  **Non-blocking note only.**
-
-## 4. Empty sections — ✅ CONFIRMED
-
-`groupWidgetsBySection` filters with `s.widgets.length > 0`
-(`Dashboard.tsx:94`). The same filtered `sections` array feeds BOTH the anchor
-bar pill list and the section list inside `MobileWidgetSections`, so an empty
-section appears in neither. Test evidence: with observability/media/backups
-widgets present and no custom widget, `queryByText("Custom")` is null
-(`Dashboard.test.tsx` "renders widgets in a single column…").
-
-## 5. Test quality — ✅ GOOD
-
-Three new tests, all asserting behavior (not snapshots):
-
-1. "renders widgets in a single column with an anchor bar below md" — checks
-   each populated section label is present, the empty `Custom` section is
-   absent, and every widget title renders.
-2. "does NOT render the anchor bar at desktop width" — asserts widget renders
-   AND no section heading appears (anchor-bar-absent + widgets-present). ✓
-3. "anchor bar pills jump to their section via scrollIntoView" — spies on
-   `Element.prototype.scrollIntoView`, clicks the Media pill via
-   `getByRole("button", { name: "Media" })`, asserts the spy fired. ✓
-
-`matchMedia` mock (`Dashboard.test.tsx:79-92`) is correct and complete: it
-returns `{ matches, media, onchange, addEventListener, removeEventListener,
-addListener, removeListener, dispatchEvent }`. `matches` is keyed on the exact
-query string `"(max-width: 768px)"` that `useIsMobile` uses, so the boolean
-flips correctly. `useIsMobile` only needs `addEventListener`/`removeEventListener`
-- the initial `matches` read, all of which are stubbed. The mock is reset in
-`beforeEach` via `setMatchMedia(false)`.
-
-Minor note: the widget-stub was upgraded to render `widget.title`
-(`Dashboard.test.tsx:6-9`) so tests can distinguish widgets — good improvement,
-doesn't affect the existing shortcut-CRUD tests.
-
-## 6. `useServiceInstances()` addition — ✅ CACHE-SHARED, no duplicate request
-
-`useServiceInstances(serviceType?)` builds queryKey
-`["services", "instances", serviceType ?? "all"]` (`useServices.ts:21`). The
-Dashboard calls it with no arg → key `["services", "instances", "all"]`.
-
-Critically, **`WidgetInstanceCard` already calls `useServiceInstances()` with
-no arg** (`WidgetInstance.tsx:12`) for every rendered widget, as does
-`WidgetConfigDialog` (`WidgetConfigDialog.tsx:167`). So the Dashboard's new
-call hits the exact same TanStack cache entry that is already being subscribed
-to by the widget cards it renders. TanStack Query deduplicates by key → **zero
-additional network requests** introduced by this change on either desktop or
-mobile. The 60s `refetchInterval` is shared.
-
-## 7. Sort order within sections (R7.3) — ✅ PRESERVED
-
-`visibleWidgets` is sorted by `sort_order` ascending (`Dashboard.tsx:456-461`,
-unchanged). `groupWidgetsBySection` iterates `visibleWidgets` in order and
-`.push()`es into per-section arrays, preserving insertion order. Therefore
-within each section the user's configured sort order is intact, and sections
-themselves render in fixed `SECTION_ORDER`. R7.3 satisfied.
-
----
-
-## Build / lint / test evidence
-
-| Command | Result |
-|---------|--------|
-| `npm run lint` | ✅ 0 errors (2 pre-existing warnings in `UsersPage.impl.tsx`, unrelated) |
-| `npm run build` (`tsc -b && vite build`) | ✅ built, typecheck clean |
-| `npm run test` (vitest run) | ✅ 25 files / 89 tests passed |
-| `vitest run Dashboard.test.tsx` | ✅ 6 tests passed (3 original + 3 new) |
-
-## Other observations (non-blocking)
-
-- The mobile single-column container is `grid grid-cols-1 gap-4`
-  (`Dashboard.tsx:120`). The pre-change desktop widgets were already a flat
-  vertical stack (no grid wrapper), so mobile parity is effectively the same
-  column plus grouping — consistent with R7.1.
-- `mobileSections` is recomputed via `useMemo` keyed on `[visibleWidgets,
-  services]`; correct deps, no stale-closure risk.
-- `OBSERVABILITY_TYPES`, `SECTION_ORDER`, `SECTION_META` are module-level
-  constants — no per-render allocation. Good.
-- Diff is +303/-7 across 2 files, well under the 400-line review budget and
-  exactly the two files Slice 2 scoped.
-
-## Blockers
-
-None.
-
-## Suggestions (non-blocking, do not gate commit)
-
-1. If strict adherence to the task wording "Anchor bar `md:hidden`" is
-   preferred, add the `md:hidden` Tailwind class to the anchor bar div and
-   render `MobileWidgetSections` unconditionally inside the mobile branch.
-   The current JS-gated approach is equally correct and avoids mounting hidden
-   nodes; leaving as-is is fine.
-2. Consider an explicit test that an orphan widget (service_id set but not in
-   `services`) lands in `custom` — the code handles it but no test pins the
-   fallback. Low value; optional.
-
-## Acceptance
-
-All seven requested verification points pass. Desktop non-regression is
-verified by code identity on the `isMobile === false` branch and by the
-desktop test. No scope widening (only the two Slice-2 files changed, no
-backend, no other pages). No staged files. Ready to commit.

.pi-tmp/slice2-worker-out.md

@@ -1,70 +0,0 @@
-# Slice 2 — Dashboard mobile layout (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|------|
-| `frontend/src/pages/Dashboard.tsx` | modified | +128 / -7 |
-| `frontend/src/pages/__tests__/Dashboard.test.tsx` | modified | +178 / -2 |
-
-**Total: ~306 changed lines** (299 insertions, 7 deletions). Under the 400-line budget.
-
-## What was implemented
-
-### 2.1 — Single-column grid below md
-
-Below `md` (`isMobile === true`), widgets render inside `MobileWidgetSections` which uses `grid grid-cols-1 gap-4`. At `md` and above, the existing flat `visibleWidgets.map(...)` renders unchanged — no grid wrapper is introduced on desktop (preserving the exact previous behavior).
-
-### 2.2 — Section anchor bar
-
-Below `md`, a horizontally scrollable pill bar (`MobileWidgetSections` anchor bar) groups widgets by section. Clicking a pill calls `document.getElementById(...).scrollIntoView({ behavior: "smooth", block: "start" })`. Each section renders with `scroll-mt-16` so the sticky TopBar doesn't cover the heading.
-
-**Section-to-widget mapping:**
-
-- **Observability** (Activity icon): service-bound widgets whose service_type is `alertmanager`, `prometheus`, or `grafana`.
-- **Media** (Monitor icon): service-bound widgets whose service_type is `jellyfin`.
-- **Backups** (DatabaseBackup icon): built-in widgets with `widget_kind === "backups"`.
-- **Custom** (LayoutDashboard icon): built-in `static`, `ssh_tasks`, `nextcloud`, and any unmatched widget.
-
-Section order: Observability → Media → Backups → Custom. Empty sections are not rendered.
-
-Icons match the existing nav (`App.tsx` `navItems`): Activity for Observability, Monitor for Media, DatabaseBackup for Backups.
-
-### 2.3 — Tests
-
-Extended `Dashboard.test.tsx` with 3 new tests (6 total, all passing):
-
-1. **Mobile renders single column with anchor bar**: verifies Observability/Media/Backups sections appear, Custom does NOT (empty section hidden), all widgets render.
-2. **Desktop hides anchor bar**: verifies no section headings or pills at desktop width.
-3. **Anchor pill jumps via scrollIntoView**: spies on `Element.prototype.scrollIntoView`, clicks the Media pill, asserts the spy was called.
-
-**matchMedia mock**: Added `setMatchMedia(matches: boolean)` helper that stubs `window.matchMedia` for the `(max-width: 768px)` query. Called in `beforeEach` with `false` (desktop default). Each mobile test calls `setMatchMedia(true)`.
-
-## Validation
-
-```
-npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx, unrelated)
-npm run build  → ✓ built in 855ms (tsc -b + vite)
-npm run test   → 25 files / 89 tests passed (was 86; +3 new)
-```
-
-## Deviations from design
-
-1. **Desktop path preserved as bare map (no grid wrapper)**. The design pseudocode said `grid grid-cols-1 md:grid-cols-*`. The actual existing desktop code has no grid — it's a flat `visibleWidgets.map(...)` inside a `flex flex-col gap-4` parent. The task explicitly said "preserve whatever the current code does" and "do NOT change desktop behavior". Adding a grid wrapper (even `grid-cols-1`) around the desktop path would be a structural change. So the `isMobile` branch renders `MobileWidgetSections` (which has its own `grid grid-cols-1`) on mobile, and the bare map on desktop. Desktop DOM is byte-for-byte identical to before.
-
-2. **Section headings (`<h3>`) on mobile**. The design/spec did not explicitly name section headings, only the anchor bar. I added a subtle `<h3 className="text-sm font-semibold text-muted-foreground">` per section so the sections are visually identifiable after scrolling. This is additive mobile-only markup; desktop is unaffected.
-
-3. **`useServiceInstances()` added to Dashboard**. Required to resolve service-bound widget types for section grouping. TanStack Query dedupes by key, so this shares the cache with `WidgetInstanceCard`'s own `useServiceInstances()` call — no extra network request.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected by the parent, and no `.atl/skill-registry.md` was found. The task was self-contained against the OpenSpec design/tasks docs.
-
-## Residual risks
-
-- **jsdom `matchMedia` state is per-test, not reactive**: the `useIsMobile` hook reads `matchMedia` synchronously during `useState` init, then sets up a listener. The test sets `matchMedia` before render. If a test needed to simulate a live resize mid-render, the mock's `addEventListener` is a no-op (no event fires). This is adequate for breakpoint-branch tests but cannot test responsive transitions. Acceptable for this slice.
-- **Anchor pill duplicate text**: each section label appears in both the pill and the `<h3>`. Tests use `getAllByText` or `getByRole("button", { name })` to disambiguate. This is a minor testing concern, not a runtime issue.
-
-## Review findings
-
-No blockers identified during self-review. All validation commands green.

.pi-tmp/slice3-review.md

@@ -1,142 +0,0 @@
-# Slice 3 Review — Media table mobile layout (`mobile-responsive-parity`)
-
-Reviewer: fresh adversarial pass. Scope: unstaged diff on
-`frontend/src/pages/Media.tsx` and `frontend/src/pages/__tests__/Media.test.tsx`.
-
-## Verification commands run
-
-| Command | Result |
-|---|---|
-| `npm run lint` | pass (0 errors; 2 pre-existing warnings in `UsersPage.impl.tsx`, unrelated to Slice 3) |
-| `npm run build` | pass (`tsc -b` + vite, built in 854ms) |
-| `npm run test` | pass (25 files, 94 tests) |
-
-## Point-by-point
-
-### 1. Desktop non-regression — CONFIRMED CORRECT
-
-The diff is a clean branch-add, not a rewrite. The `DataTable` block was moved
-into the `else` of `isMobile ? <mobile> : <DataTable>` with every prop byte-for-
-byte identical to the pre-change version (`Media.tsx:671-697`):
-`columns`, `data`, `getRowId`, `enableRowSelection`, `rowSelection`,
-`onRowSelectionChange`, `onRowClick`, `enableColumnVisibilityToggle`,
-`columnVisibility`, `onColumnVisibilityChange`, `enablePagination`,
-`manualPagination`, `pagination`, `onPaginationChange`, `pageSizeOptions`,
-`rowCount`, `emptyMessage`. The wrapping `<div className="rounded-lg border
-bg-card">` and the `status?.exists` gate are preserved on both branches. No
-desktop prop was dropped, renamed, or reordered. R3.6 / R10.1 satisfied.
-
-### 2. Mobile card fields — CONFIRMED CORRECT
-
-`mediaCardFields` (`Media.tsx:83-96`) matches the real `MediaItem` type
-(`types/index.ts:274`), not the design doc's illustrative field names:
-
-- `title` (string) — primary ✓
-- `size` → `r.size || "-"` (string, null-safe) ✓
-- `hdr` → `r.hdr || "-"` (string, null-safe) ✓
-- `library` → `r.library || "-"` (string, null-safe) ✓
-- `year` (`number | null`) → `r.year != null ? String(r.year) : "-"` ✓ explicitly null-safe
-
-5 fields total (1 primary + 4), inside the spec's 3–5 range (R3.2). No
-undefined access possible — every field guards against empty/null. The design
-example used `size_display`/`is_hdr`/`library_name` (illustrative); the worker
-correctly used the real keys. Good.
-
-### 3. Pagination duplication — NOT A BUG; acceptable tech debt
-
-`MediaMobilePagination` (`Media.tsx:107-188`) duplicates `DataTablePagination`
-(`data-table.tsx`). I verified the semantics match exactly:
-
-| Concern | DataTable | MediaMobilePagination | Match |
-|---|---|---|---|
-| Rows count | `rowCount ?? 0` (manual) | `totalRows` = `total` (`queryResult?.total ?? 0`) | ✓ |
-| pageCount | `Math.max(1, Math.ceil(rowCount/pageSize))` | `totalPages` = `Math.max(1, Math.ceil(total/pageSize))` (`Media.tsx:403`) | ✓ |
-| Page-size change | `table.setPageSize()` → resets `pageIndex:0` | `onPaginationChange(() => ({pageIndex:0, pageSize:Number(value)}))` | ✓ |
-| Prev disabled | `!getCanPreviousPage()` = `pageIndex>0` inverted | `pageIndex <= 0` | ✓ |
-| Next disabled | `!getCanNextPage()` = `pageIndex>=pageCount-1` inverted | `pageIndex >= pageCount - 1` | ✓ |
-| Page indicator | `Page {pageIndex+1} of {pageCount}` | same | ✓ |
-
-No off-by-one, no missing clamp, no stale state. The mobile component reads
-`pageIndex`/`pageSize` derived the same way as the controlled `pagination`
-state fed to DataTable (`Media.tsx:355-356`), so the two paths can't drift on
-values.
-
-Could they reuse DataTable's pagination by extracting it? That would require
-editing the shared `data-table.tsx` (export `DataTablePagination` or split a
-`TablePagination`), which is explicitly out of scope for Slice 3 and would risk
-R3.6/R10.1 (the shared component powers the desktop path). Acceptable to defer
-to a follow-up refactor slice. **Non-blocking smell, not a must-fix.**
-
-### 4. Row click navigation — CONFIRMED CORRECT
-
-`handleRowClick` (`Media.tsx:398-400`) is passed unchanged to
-`MobileCardRow.onRowClick` (`Media.tsx:659`). `MobileCardRow` makes the whole
-card a `<button type="button">` with `onClick={() => onRowClick(row)}`
-(`mobile-card.tsx`), so a tap navigates to `/files?path=<encoded>`. The test
-"navigates to the file browser when a card is tapped on mobile" asserts
-`navigate` is called once with the encoded path. ✓
-
-### 5. Column-visibility toggle hidden below md (R3.5) — CONFIRMED CORRECT
-
-On the mobile branch only `MobileCardRow` renders; no `DataTable`, so the
-`Columns` `DropdownMenu` never mounts. Tested explicitly:
-`hides the column-visibility toggle below md` asserts
-`queryByRole("button", { name: /Columns/ })` is null. The desktop test asserts
-the same button is present at desktop width. ✓ R3.5 satisfied both ways.
-
-### 6. Test quality — GOOD
-
-- **matchMedia mock** (`Media.test.tsx:159-183`): correct. It discriminates on
-  `query.includes("768")` so `useIsMobile` (768px) toggles with the flag while
-  `usePrefersSmallScreen` (900px) stays `false` — which is the right default for
-  the desktop path (no `MOBILE_HIDDEN_COLUMNS` forcing). Adds/removes listeners
-  are no-ops; sufficient for jsdom. Applied in `beforeEach` defaulting to
-  desktop, overridden per-test via `setMatchMedia(true)`.
-- **Desktop test** asserts BOTH a DataTable column header (`Title`) AND the
-  Columns toggle button. ✓
-- The 5 new tests assert real behavior: card titles + field labels render, no
-  column headers leak, pagination renders (2 rows, Page 1 of 1, Previous
-  disabled), card tap navigates, desktop renders DataTable. None are tautological.
-
-### 7. `enableRowSelection` on mobile — NOT A REGRESSION (minor spec note)
-
-The mobile card does not render a selection checkbox; `MobileCardRow` has no
-selection affordance. However, `rowSelection`/`setRowSelection` in `Media.tsx`
-is **vestigial**: grepping the file, the state is declared (`Media.tsx:326`) and
-passed to DataTable, but nothing in `Media.tsx` consumes it — there is no batch
-action, bulk-delete, or "selected count" UI wired to it. So dropping selection
-on mobile breaks no actual workflow, because no batch workflow exists on desktop
-either. R3.3's literal "selection semantics preserved on the card" is loosely
-violated, but the spec's "(tap target = the whole card where applicable)"
-clause and the absence of any selection consumer make navigation the correct
-primary mobile interaction. **Non-blocking note.** If a batch action is ever
-added to Media later, mobile selection will need an explicit follow-up.
-
-## Other observations (non-blocking)
-
-- The mobile card is wrapped in `<div className="p-4">` inside the bordered
-  card, then `MediaMobilePagination` sits below it inside the same
-  `rounded-lg border bg-card`. Consistent with the desktop wrapping. Fine.
-- `isSmall` (`usePrefersSmallScreen`, 900px) is still used for
-  `effectiveColumnVisibility` desktop sub-breakpoint hiding; `isMobile`
-  (`useIsMobile`, 768px) drives the card/table branch. Two hooks, two distinct
-  purposes, correctly not conflated. The design notes `useIsMobile` should
-  replace ad-hoc matchMedia; `usePrefersSmallScreen` is a separate 900px concern
-  left intact — acceptable, not in Slice 3's scope to consolidate.
-- Lint warnings are in `UsersPage.impl.tsx`, pre-existing, unrelated.
-
-## Verdict: **commit**
-
-No blockers. Desktop path is byte-identical (non-regression confirmed), mobile
-fields are null-safe and type-correct, pagination duplication is semantically
-equivalent (tech debt, not a bug), navigation preserved, column-visibility
-correctly hidden, tests assert real behavior on both breakpoints, and
-lint/build/test are green. The two non-blocking notes (pagination duplication;
-vestigial selection not surfaced on mobile) are appropriate follow-up items,
-not commit gates.
-
-## Acceptance
-
-- criterion-1 (implement the change without widening scope): satisfied. Only
-  the two Slice 3 files changed; DataTable and other slices untouched; no scope
-  creep into shared-component refactors.

.pi-tmp/slice3-worker-out.md

@@ -1,72 +0,0 @@
-# Slice 3 — Media table mobile layout (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|------|
-| `frontend/src/pages/Media.tsx` | modified | +190 / -27 |
-| `frontend/src/pages/__tests__/Media.test.tsx` | modified | +93 / -0 |
-
-**Total: ~256 changed lines** (283 insertions, 27 deletions). Under the 400-line budget.
-
-## What was implemented
-
-### 3.1 — Mobile fields + card render
-
-Below `md` (`isMobile === true`), the page renders `<MobileCardRow>` inside the same `rounded-lg border bg-card` wrapper, followed by a standalone `MediaMobilePagination` component. Desktop renders the existing `<DataTable>` unchanged.
-
-**Mobile card field list** (module-level `mediaCardFields` constant):
-
-| Field | Key | Rationale |
-|-------|-----|-----------|
-| **Title** (primary) | `title` | Primary identifier — bold card title |
-| Size | `size` | Already human-readable ("12.4 GB"); helps identify large files at a glance |
-| HDR | `hdr` | Shows HDR format string ("HDR10", "Dolby Vision") or "-" for SDR — key tech quality indicator |
-| Library | `library` | Which Jellyfin library the item belongs to — context for multi-library setups |
-| Year | `year` | Quick identification; number rendered as string, "-" if null |
-
-Runtime, bitrate, resolution, video codec, series/season/episode, date_added, and path are omitted from the mobile card — they're available on desktop and would make the card too tall for phone scanning.
-
-**Preserved behaviors:**
-
-- Row click → `navigate("/files?path=...")` — wired via `MobileCardRow` `onRowClick`.
-- Pagination — a new `MediaMobilePagination` component mirrors the DataTable's internal `DataTablePagination` (rows count, page-size select, page indicator, prev/next buttons) but works off the raw `PaginationState` instead of a TanStack table instance.
-- Build index / status controls above the table — unchanged.
-- Column-visibility toggle — automatically hidden (DataTable is not rendered below `md`).
-- Desktop (`md+`) — byte-for-byte identical: the `isMobile === false` branch renders the exact same `<DataTable>` with the same props.
-
-### 3.2 — Tests
-
-Added a `setMatchMedia(matches)` helper to stub `window.matchMedia` for jsdom (same pattern as Dashboard.test.tsx). Called `setMatchMedia(false)` in `beforeEach` so existing desktop tests are unaffected. 5 new tests in a `describe("Media (mobile card layout — slice 3)")` block:
-
-1. **Cards render with title as primary below md** — asserts card titles and field labels render, desktop column headers do NOT.
-2. **Column-visibility toggle is hidden below md** — asserts no "Columns" button.
-3. **Pagination controls render below cards on mobile** — asserts "2 rows", page indicator, and prev/next buttons.
-4. **Card tap navigates to file browser** — clicks "Inception" card, asserts `navigate` called with the encoded path.
-5. **DataTable renders at desktop width** — asserts column headers present + "Columns" button present.
-
-## Validation
-
-```
-npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx, unrelated)
-npm run build  → ✓ built (tsc -b + vite)
-npm run test   → 25 files / 94 tests passed (was 89; +5 new)
-```
-
-## Deviations from design
-
-1. **Standalone `MediaMobilePagination` component instead of reusing DataTable's pagination.** The DataTable renders pagination internally (not as a separate export). Extracting a shared pagination component would touch `data-table.tsx` (out of scope for this slice). The inline `MediaMobilePagination` mirrors `DataTablePagination` exactly (same labels, same controls, same aria-labels) so the mobile UX is consistent. A future refactor can extract both into a shared `<TablePagination>`.
-
-2. **`setMatchMedia` mock added to existing test file.** The existing Media tests didn't mock `window.matchMedia` because the old `usePrefersSmallScreen` hook guarded against it (`typeof window.matchMedia === "function"`). The new `useIsMobile` hook calls `window.matchMedia` unconditionally (it's the standardized hook from Slice 1). The mock defaults to desktop (`matches: false`) so all 6 existing tests pass unchanged.
-
-3. **`mediaCardFields` is a module-level constant.** This mirrors the existing `mediaColumns` pattern (module-level for TanStack stability). MobileCardRow doesn't require it, but keeping it stable avoids per-render allocation and is consistent with the codebase's existing style.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected by the parent, and no `.atl/skill-registry.md` was found.
-
-## Residual risks
-
-- **`MediaMobilePagination` duplicates `DataTablePagination`.** If the desktop pagination UI changes (labels, aria attributes), the mobile version won't auto-update. A shared component extraction in a later refactor would fix this. Low priority since the pagination UI is stable.
-- **jsdom `matchMedia` is not reactive.** The `setMatchMedia` mock sets the initial `matches` value but `addEventListener` is a no-op (no resize events fire). This is adequate for breakpoint-branch tests but cannot test responsive transitions. Same limitation as Dashboard.test.tsx.
-- **Row selection (`enableRowSelection`) is desktop-only on mobile.** The mobile card layout has no selection checkboxes (the card itself is the tap target for navigation). This is consistent with the spec (R3.5 says the card picks the fields; R3.3 preserves "row click / selection semantics" but on mobile the primary interaction is navigation, not batch selection). If batch selection is needed on mobile later, the `actions` slot can hold a checkbox.

.pi-tmp/slice4-worker-out.md

@@ -1,72 +0,0 @@
-# Slice 4 — FileBrowser table mobile layout (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|------|
-| `frontend/src/pages/FileBrowser.impl.tsx` | modified | +40 / -2 |
-| `frontend/src/pages/__tests__/FileBrowser.test.tsx` | modified | +78 / -2 |
-
-**Total: ~114 changed lines** (118 insertions, 4 deletions). Well under the 400-line budget.
-
-## What was implemented
-
-### 4.1 — Mobile fields + card render
-
-Below `md` (`isMobile === true`), the file table renders as `<MobileCardRow>` cards inside the existing `<div className="rounded-lg border bg-card">` wrapper (with `p-4` padding, matching the Media pattern). Desktop renders the existing `<DataTable>` byte-for-byte identical.
-
-**Mobile card field list** (module-level `fileCardFields` constant):
-
-| Field | Key | Rationale |
-|-------|-----|-----------|
-| **Name** (primary) | `name` | Primary identifier — file or directory name |
-| Type | `type` | "dir" / "file" / "up" — distinguishes the row kind at a glance |
-| Size | `size` | Already human-readable via `formatSize`; "-" for dirs |
-| Modified | `modified` | Already formatted via `formatTime`; "-" when empty |
-
-4 fields total (1 primary + 3). The `ext` column was omitted because the extension is already visible in the filename itself — redundant on mobile.
-
-**Preserved behaviors:**
-
-- **Whole-card tap** = `handleRowClick(row)` — the same handler the desktop DataTable uses. Dir/up rows navigate into the directory; file rows select the file for ffprobe preview.
-- **Directory navigation** works on mobile — tapping a folder card navigates into it (status caption updates to show the new cwd).
-- **Path bar / breadcrumbs** (`Remote path` input + Open/Refresh buttons) render outside the table in the `SectionCard`, so they are unaffected by the isMobile branch. The existing `flex flex-col gap-2 md:flex-row` already stacks them on mobile.
-- **ffprobe and Jobs sections** live outside the table and are unchanged.
-- **No pagination** — FileBrowser does not paginate (the task confirmed this).
-- **Desktop (`md+`)** — byte-for-byte identical: the `isMobile === false` branch renders the exact same `<DataTable>` with the same props.
-
-### 4.2 — Tests
-
-Added a `setMatchMedia(matches)` helper (mirrors the Media.test.tsx pattern) and called `setMatchMedia(false)` in `beforeEach` so the 3 existing desktop tests pass unchanged. Added 4 new tests in a `describe("FileBrowser (mobile card layout — slice 4)")` block:
-
-1. **Cards render with file/dir name as primary below md** — asserts card titles render ("movies", "video.mkv", "notes.txt") and no table column headers leak.
-2. **Tapping a directory card navigates into it** — clicks "movies", asserts status shows "Current: /movies" with no "Selected:" segment.
-3. **Path/breadcrumb controls still render on mobile** — asserts "Remote path" input, Open and Refresh buttons are present.
-4. **DataTable renders at desktop width** — asserts column headers (Type/Name/Ext/Size/Modified) present at desktop width.
-
-## Validation
-
-```
-npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx, unrelated)
-npm run build  → ✓ built (tsc -b + vite)
-npm run test   → 25 files / 98 tests passed (was 94; +4 new)
-```
-
-## Deviations from design
-
-1. **`ext` field omitted from mobile card.** The task said "Fields (3-5): size, modified time, and type/extension (file vs directory)." I interpreted "type/extension" as a single concept (dir vs file vs up) and used the `type` field to cover it. The `ext` column is redundant because the filename already contains the extension (e.g. "video.mkv"). Including it would waste card space. This is a per-table field choice, which the design explicitly delegates to the consuming page (§trade-offs).
-
-2. **No deviations from the established Media.tsx pattern.** Module-level `MobileCardField<DisplayRow>[]` constant, `isMobile` from `useIsMobile()`, `getRowId` wired to `row.id`, `onRowClick` wired to the existing `handleRowClick`. Same `p-4` wrapper inside the bordered container.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected by the parent, and no `.atl/skill-registry.md` was found. The task was self-contained against the OpenSpec design/tasks docs and the Media.tsx reference pattern.
-
-## Residual risks
-
-- **`enableRowSelection` on mobile.** The mobile card has no selection checkbox — the whole card is the tap target for navigation/selection via `handleRowClick`. This matches R3.3's "tap target = the whole card where applicable" and the FileBrowser's existing behavior where clicking a file row selects it. The checkbox-based selection is desktop-only, consistent with the Media slice.
-- **The ".." (up) row** renders as a card with name "..", type "up", size "-", modified "-". This is the universal convention for "go to parent directory" and is tappable. Functionally correct.
-
-## Review findings
-
-No blockers identified during self-review. All validation commands green. No staged files.

.pi-tmp/slice5-review.md

@@ -1,189 +0,0 @@
-# Slice 5 Review — Users + Backups mobile card layout
-
-**Change:** `mobile-responsive-parity` · **Slice:** 5 (Users + Backups tables)
-**Reviewer mode:** fresh adversarial · **Date:** 2026-06-26
-**Verdict: fix-then-commit** (one real HTML-validity issue; everything else clean)
-
----
-
-## Commands run (all green)
-
-| Command | Result | Notes |
-|---|---|---|
-| `npm run lint` | ✅ 0 errors | Only 2 pre-existing `react-hooks/exhaustive-deps` warnings in `UsersPage.impl.tsx` (lines 149/188). Verified identical on `HEAD` (lines 120/159) — **not introduced by this slice**. |
-| `npm run build` | ✅ built | `tsc -b` typecheck clean (build runs it). |
-| `npm run test` | ✅ 25 files / 102 tests | All pass. |
-| `git diff --cached --stat` | empty | No staged files. |
-
----
-
-## 1. `useIsMobile` hardening — SAFE ✅
-
-`frontend/src/hooks/useIsMobile.ts`: added `typeof window.matchMedia === "function"` to both the lazy `useState` initializer and the `useEffect` guard.
-
-- In real browsers `window.matchMedia` is always a function, so the added predicate is always `true` and **behavior is identical**.
-- In jsdom (no native `matchMedia`) the change converts a hard `TypeError` ("window.matchMedia is not a function") into a graceful `false` (desktop). This is strictly safer — it can only turn a crash into a non-crash.
-- All existing consumers (`App.tsx`, `Dashboard`, `Media`, `FileBrowser`) already stub `matchMedia` in their test files, so their tests are unaffected. Confirmed no regression path for slices 1–4.
-
-**Conclusion:** safe across all consumers; no regression.
-
----
-
-## 2. UsersPage desktop Table — preserved EXACTLY ✅
-
-I programmatically extracted the `<Table aria-label="Users table">…</Table>` block from `HEAD` and from the working tree and diffed them token-for-token.
-
-- The only differences are **line re-wrapping** caused by deeper indentation (e.g. the `checked || selectedUser?.jellyfin_id === row.jellyfin_id` expression and `onClick={() => setSearchParams({ user: row.jellyfin_id })}` wrap onto more lines). Every token, attribute, and child is present in both.
-- **Columns preserved (10):** select-all checkbox header, User, Email, Activity, Type (hidden md), Jellyseerr, Role (hidden md), Permissions, Reqs (hidden md), Contact (hidden md).
-- **Header checkbox** `toggleVisibleSelection` — preserved.
-- **Row checkbox** `toggleUserSelected` + `onClick={(event) => event.stopPropagation()}` + `aria-label` — preserved.
-- **Row click** `onClick={() => setSearchParams({ user: row.jellyfin_id })}` — preserved.
-- **Avatar** (`AvatarImage`/`AvatarFallback`), username fallback, all `<Badge>` variants, `data-state="selected"`, `cursor-pointer` — all preserved.
-
-**Conclusion:** the desktop branch is the original table re-indented one level deeper into the `: (` else arm. No prop, column, or handler was dropped. Diff stat (207 ins / 149 del) is dominated by this re-indentation; the true behavioral delta is small (cards branch + `userCardFields` + `useComposeViewport` rename).
-
----
-
-## 3. Compose hook rename — correct ✅
-
-The file-local 900px `useIsMobile` was renamed `useComposeViewport`; the shared 768px `useIsMobile` (from `hooks/`) now drives the directory-table branch.
-
-- `isComposeMobile` (900px) → used **only** at `UsersPage.impl.tsx:827` for the compose `DialogContent` full-screen class. Breakpoint unchanged (`(max-width: 900px)`).
-- `isMobile` (768px) → used **only** at `UsersPage.impl.tsx:511` for the table/card branch.
-- Verified no stray references to the old local name remain (`grep` confirms 2 distinct symbols, correctly wired).
-
----
-
-## 4. Backups cards (3 components) ✅
-
-- **BackupAlertsTable:** mobile branch renders `MobileCardRow` with primary=message + severity/type/created; **Ack action preserved** in the `actions` slot (`mobile-touch-target`, calls `onAcknowledge(a.id)`; hidden when `acknowledged`). Desktop `<Table>` block is byte-identical (diff is purely additive before the `return`).
-- **BackupJobsTable:** mobile branch builds `JobCardRow[]` (joins `latestRuns` exactly as the desktop row does) with primary=name + source/schedule/last-status. No per-row action exists in the desktop original, so none is "lost". Desktop table unchanged.
-- **BackupRunsTable:** status-filter `<Select>` is rendered **outside** the `isMobile ? … : …` ternary, so it stays available on both layouts (correct — filter preserved on mobile). Mobile card primary=job_id + status/duration/size/started. The desktop `<Table>` is re-indented into the `: (` else arm but content is identical (same 5 columns, same formatters, same `statusVariant`).
-
-Spec R3.2 (primary + 3–5 fields) satisfied for all three. Spec R3.6 (desktop unchanged) satisfied.
-
----
-
-## 5. UsersPage mobile selection — INVALID HTML NESTING (confirmed issue)
-
-`MobileCardRow` renders the card as a `<button type="button">` whenever `onRowClick` is set (`mobile-card.tsx:82`). The UsersPage mobile branch passes **both** `onRowClick` (opens drawer) **and** an `actions` slot containing a Radix `<Checkbox>`, which itself renders a `<button role="checkbox">`. Result:
-
-```html
-<button>   <!-- card -->
-  …
-  <button role="checkbox"></button>   <!-- selection checkbox -->
-</button>
-```
-
-This is **invalid HTML** (`<button>` cannot contain interactive `<button>`).
-
-The review brief asks whether this is "a real runtime bug or acceptable parity with the existing desktop pattern." Findings:
-
-- **The desktop-parity argument does not hold.** On desktop the row is a `<TableRow>` → `<tr>` with `onClick`. A `<tr>` is not a `<button>`, so nesting a checkbox inside it is valid. The mobile variant introduces a *new* `<button>`-in-`<button>` nesting that does not exist on desktop.
-- **Runtime impact:** browsers perform error-correction by closing the outer `<button>` before the inner one starts. The 102 tests pass (jsdom does not enforce this), and in practice the card body still receives taps while the checkbox still toggles (with `stopPropagation`). So it *functions* — but only by accident of browser error-recovery. It is fragile, fails HTML validation, and is an a11y issue (nested interactive elements).
-- This pattern is **not present in the other two card usages** in this slice (BackupJobs/Runs pass no `onRowClick`; Alerts passes `actions` but no `onRowClick`), so it is isolated to UsersPage.
-
-**Recommended fix (small, localized):** in `MobileCardRow`, when `onRowClick` is set, render the outer element as a `<div role="button" tabIndex={0}` with `onClick` + `onKeyDown` (Enter/Space) instead of a `<button>`; or move the `actions` slot outside the clickable button element. Either keeps the 44px tap target and the `stopPropagation` semantics while producing valid HTML. This also improves on the desktop pattern rather than replicating its weakest aspect.
-
-Severity: I am calling this **must-fix before commit** because (a) the brief specifically flagged it, (b) it is invalid DOM, and (c) the fix is tiny and contained to `mobile-card.tsx` (already shipped in Slice 1, so fixing it here benefits every future card consumer too).
-
----
-
-## 6. Test quality
-
-- **BackupAlertsTable.test.tsx:** new mobile tests assert primary text + Ack button round-trip (`onAcknowledge` called with id). Real behavior. ✅
-- **BackupRunsTable.test.tsx:** asserts job_id primary + Status/Duration labels on mobile. Does not exercise the status filter on mobile, but coverage is adequate. ✅
-- **UsersPage.test.tsx:** asserts display-name primary + Activity label per card on mobile. **Does NOT assert** `toggleUserSelected` round-trip nor that the checkbox `stopPropagation` prevents the drawer opening — the two behaviors the brief specifically called out. The implementation is present and correct, but the assertions are missing. (Suggestion, not a blocker.)
-- **BackupJobsTable:** no test file exists, so the worker skipped it. `BackupJobsTable.tsx` is a touched file with zero direct test coverage. The card logic mirrors the other two and is low-risk, but AC8 ("at least one Vitest test per touched page/component asserting <768 and ≥768") is not fully met for this component. (Suggestion.)
-
-Minor: `UsersPage.test.tsx:12` comment still says *"MUI `useMediaQuery` (still used by the compose dialog, slice 6b)"* — stale after the rename to `useComposeViewport` (no longer MUI). Cosmetic.
-
----
-
-## 7. Diff size
-
-UsersPage `+207 / -149`. Subtracting the re-indented desktop Table block (~149 deletions re-added as ~180 insertions one indent level deeper), the genuine behavioral delta is: `userCardFields` constant (~22 lines), the mobile `MobileCardRow` branch (~30 lines), the `useComposeViewport` rename (3 lines), and `isComposeMobile` usage. **Confirmed: actual behavioral change is small; the bulk is re-indentation**, as the brief expected.
-
----
-
-## Summary
-
-- **Blocker / confirmed issue (must-fix):** `MobileCardRow` + UsersPage produce `<button>` nesting a Radix `<button>` checkbox — invalid HTML; "desktop parity" justification does not hold (desktop uses `<tr>`). Fix in `mobile-card.tsx` (render clickable card as `div role="button"` or lift `actions` out of the button).
-- **Suggestions (non-blocking):**
-  - Add a UsersPage mobile test asserting `toggleUserSelected` round-trip + checkbox `stopPropagation`.
-  - Add a `BackupJobsTable` mobile test (currently zero coverage on a touched file).
-  - Refresh the stale "MUI useMediaQuery" comment in `UsersPage.test.tsx`.
-- **Verified clean:** `useIsMobile` hardening (no regression), desktop UsersPage Table preserved exactly (token-identical), compose 900px breakpoint preserved, all 3 Backups desktop tables byte-identical, status filter + Ack action preserved on mobile, lint/build/test green, no staged files.
-
-**Verdict: fix-then-commit** — resolve the single button-in-button HTML validity issue (localized to `mobile-card.tsx`), then this slice is good to commit. The two test-coverage suggestions can land in the same commit or a follow-up.
-
-```acceptance-report
-{
-  "criteriaSatisfied": [
-    {
-      "id": "criterion-1",
-      "status": "satisfied",
-      "evidence": "Slice 5 implements Users + 3 Backups mobile card layouts per spec R3.1/R3.2/R3.3 and tasks 5.1/5.2/5.3 without widening scope (no backend, no new product behavior, no sm: breakpoint). Desktop layouts preserved exactly; only presentation-layer parity added."
-    }
-  ],
-  "changedFiles": [
-    "frontend/src/hooks/useIsMobile.ts",
-    "frontend/src/components/BackupAlertsTable.tsx",
-    "frontend/src/components/BackupJobsTable.tsx",
-    "frontend/src/components/BackupRunsTable.tsx",
-    "frontend/src/components/__tests__/BackupAlertsTable.test.tsx",
-    "frontend/src/components/__tests__/BackupRunsTable.test.tsx",
-    "frontend/src/pages/UsersPage.impl.tsx",
-    "frontend/src/pages/__tests__/UsersPage.test.tsx"
-  ],
-  "testsAddedOrUpdated": [
-    "frontend/src/components/__tests__/BackupAlertsTable.test.tsx",
-    "frontend/src/components/__tests__/BackupRunsTable.test.tsx",
-    "frontend/src/pages/__tests__/UsersPage.test.tsx"
-  ],
-  "commandsRun": [
-    {
-      "command": "cd frontend && npm run lint",
-      "result": "passed",
-      "summary": "0 errors; 2 pre-existing react-hooks/exhaustive-deps warnings (verified identical on HEAD, not introduced by slice 5)."
-    },
-    {
-      "command": "cd frontend && npm run build",
-      "result": "passed",
-      "summary": "vite build + tsc -b typecheck clean; 1976 modules transformed."
-    },
-    {
-      "command": "cd frontend && npm run test",
-      "result": "passed",
-      "summary": "25 test files / 102 tests passed (vitest)."
-    },
-    {
-      "command": "git diff --cached --stat",
-      "result": "passed",
-      "summary": "Empty — no staged files."
-    }
-  ],
-  "validationOutput": [
-    "useIsMobile guard safe: only changes jsdom (crash->false); real browsers unchanged; no regression to App/Dashboard/Media/FileBrowser consumers.",
-    "UsersPage desktop <Table> block token-diffed against HEAD: identical except line re-wrapping from deeper indentation; all 10 columns, header/row checkboxes, toggleVisibleSelection/toggleUserSelected, setSearchParams row click, Avatar, all Badge variants preserved.",
-    "Compose 900px breakpoint preserved via useComposeViewport rename; isMobile (768px) used only for table branch, isComposeMobile (900px) only for compose dialog.",
-    "BackupRunsTable status-filter Select rendered outside isMobile ternary -> preserved on mobile+desktop; BackupAlertsTable Ack action preserved in card actions slot; BackupJobsTable has no per-row actions to lose.",
-    "Desktop Backups tables byte-identical (Alerts/Jobs additive only; Runs re-indented into else arm, content equal)."
-  ],
-  "residualRisks": [
-    "BLOCKER: MobileCardRow renders a <button> and UsersPage nests a Radix Checkbox (<button>) inside it when onRowClick is set -> invalid HTML (button-in-button). Functions via browser error-correction but fails validation and is an a11y issue. Desktop parity argument does not hold (desktop row is a <tr>, not a button). Fix in frontend/src/components/ui/mobile-card.tsx.",
-    "BackupJobsTable.tsx is a touched file with no test file -> zero direct coverage; AC8 not fully met for this component.",
-    "UsersPage mobile test does not assert toggleUserSelected round-trip nor checkbox stopPropagation (behaviors are implemented but untested).",
-    "Stale comment in UsersPage.test.tsx references 'MUI useMediaQuery' after the useComposeViewport rename (cosmetic)."
-  ],
-  "noStagedFiles": true,
-  "diffSummary": "Slice 5 adds mobile MobileCardRow branches to UsersPage + 3 Backups tables, renames the local 900px compose hook to useComposeViewport to avoid collision with the shared 768px useIsMobile, and hardens useIsMobile with a typeof matchMedia guard. UsersPage diff is ~356 lines but mostly re-indentation of the preserved desktop Table into an isMobile ternary else branch; true behavioral delta is small.",
-  "reviewFindings": [
-    "blocker: frontend/src/components/ui/mobile-card.tsx:82 + frontend/src/pages/UsersPage.impl.tsx:511-530 — <button> card nests Radix <button> Checkbox (invalid HTML); fix MobileCardRow to render clickable card as div role=button or lift actions slot out of the button.",
-    "suggestion: add UsersPage mobile test for toggleUserSelected round-trip + stopPropagation.",
-    "suggestion: add BackupJobsTable mobile test (touched file, currently untested).",
-    "suggestion: refresh stale 'MUI useMediaQuery' comment in UsersPage.test.tsx:12."
-  ],
-  "manualNotes": "Verdict: fix-then-commit. The single button-in-button issue is localized to mobile-card.tsx (a Slice-1 primitive) and benefits all future card consumers once fixed. Everything else (useIsMobile safety, desktop non-regression, compose breakpoint, Backups parity, lint/build/test) is verified clean."
-}
-```

.pi-tmp/slice5-worker-out.md

@@ -1,95 +0,0 @@
-# Slice 5 — Users + Backups tables mobile layout (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|------|
-| `frontend/src/hooks/useIsMobile.ts` | modified | +6 / -2 |
-| `frontend/src/components/BackupAlertsTable.tsx` | modified | +45 / -0 |
-| `frontend/src/components/BackupJobsTable.tsx` | modified | +48 / -0 |
-| `frontend/src/components/BackupRunsTable.tsx` | modified | +38 / -1 |
-| `frontend/src/components/__tests__/BackupAlertsTable.test.tsx` | modified | +39 / -1 |
-| `frontend/src/components/__tests__/BackupRunsTable.test.tsx` | modified | +24 / -1 |
-| `frontend/src/pages/UsersPage.impl.tsx` | modified | +58 / -4 |
-| `frontend/src/pages/__tests__/UsersPage.test.tsx` | modified | +33 / -0 |
-
-**Total: ~317 changed lines** (317 insertions, 10 deletions). Under the 400-line budget.
-
-## What was implemented
-
-### useIsMobile hardening (cross-cutting fix)
-
-The hook now guards `typeof window.matchMedia === "function"` in both the `useState` initializer and the `useEffect`. Previously, jsdom environments without a matchMedia stub (the Backups component tests) would crash. This is a 6-line defensive fix matching the pattern the old UsersPage local hook already used.
-
-### 5.1 — UsersPage card
-
-Below `md`, the user table renders as `<MobileCardRow>` cards:
-
-| Field | Key | Rationale |
-|-------|-----|-----------|
-| **Display name** (primary) | `name` | `userLabel(row)` — the primary identifier |
-| Username | `username` | Falls back to `jellyfin_id` when username equals display_name |
-| Activity | `activity` | `<Badge variant={activityBadgeVariant(...)}>` — visual at-a-glance status |
-| Email | `email` | Falls back to "—" when absent |
-
-**Selection wiring:** The checkbox renders in the `actions` slot of each card. `onClick={(e) => e.stopPropagation()}` prevents the card body tap (which opens the drawer via `onRowClick`) from also toggling selection. The checkbox uses the existing `toggleUserSelected(row.jellyfin_id)` handler and the `selectedIdSet` state — selection round-trips correctly. The checkbox has `className="mobile-touch-target"` for 44px min hit area.
-
-**Drawer open:** `onRowClick={(r) => setSearchParams({ user: r.jellyfin_id })}` — same handler as the desktop table row click.
-
-**Compose dialog:** The local `useIsMobile` (900px) was renamed to `useComposeViewport` to avoid collision with the shared 768px hook. The compose dialog still uses `isComposeMobile` (900px) for its fullScreen behavior. Compose is otherwise untouched (slice 8 scope).
-
-### 5.2 — Backups cards (3 components)
-
-**BackupAlertsTable** — primary = `alert.message`; fields = severity (Badge), type, created. Acknowledge button in actions slot (shortened to "Ack" for mobile space).
-
-**BackupJobsTable** — primary = `job.name`; fields = source, schedule interval, last status (Badge). Uses an intermediate `JobCardRow` type to compose job + latest run status into a single row object for the card.
-
-**BackupRunsTable** — primary = `run.job_id`; fields = status (Badge), duration, size, started. The status filter `<Select>` renders ABOVE both the card and table layouts (unchanged).
-
-### 5.3 — Tests (4 new tests, 102 total)
-
-- BackupAlertsTable: 2 new (mobile card render, acknowledge action on card)
-- BackupRunsTable: 1 new (mobile card render with job_id primary)
-- UsersPage: 1 new (mobile cards with display name + activity labels)
-
-## Validation
-
-```
-npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx, unrelated)
-npm run build  → ✓ built (tsc -b + vite)
-npm run test   → 25 files / 102 tests passed (was 98; +4 new)
-```
-
-## Mobile field lists (per component)
-
-| Component | Primary | Fields | Rationale |
-|-----------|---------|--------|-----------|
-| UsersPage | `userLabel(row)` | username, activity (Badge), email | Identity + at-a-glance status + contact info |
-| BackupAlertsTable | `alert.message` | severity (Badge), alert_type, created_at | Descriptive text first; severity/type/date for triage |
-| BackupJobsTable | `job.name` | source, schedule, last status (Badge) | Job identity + config + health |
-| BackupRunsTable | `run.job_id` | status (Badge), duration, size, started | Run identity + outcome + timing |
-
-## Selection wiring on UsersPage cards
-
-The checkbox is rendered in the `MobileCardRow` `actions` slot (right-aligned). `onClick={(e) => e.stopPropagation()}` prevents the card's `onRowClick` (drawer open) from firing when the checkbox is tapped. The checkbox calls `toggleUserSelected(r.jellyfin_id)`, which is the same handler used by the desktop table. The `selectedIdSet` (derived from `selectedUserIds` state) drives `checked` and updates reactively. Multi-select works correctly on mobile.
-
-## Deviations from design
-
-1. **`useIsMobile` hardening.** The shared hook from Slice 1 crashed in jsdom test environments that don't stub `matchMedia` (the Backups component tests). Added a `typeof window.matchMedia === "function"` guard to both the `useState` initializer and the `useEffect`. This matches the defensive pattern the old UsersPage local hook already used and prevents ALL consumers from needing a matchMedia stub for desktop behavior.
-
-2. **`JobCardRow` intermediate type in BackupJobsTable.** The card needs both `BackupJob` and its latest run status. Rather than passing a tuple or doing lookups inside the render function, I compose a small `JobCardRow` interface (`{ job, status, run_started }`) and map jobs to it before passing to `MobileCardRow`.
-
-3. **Compose hook rename.** Renamed the file-local `useIsMobile` (900px) to `useComposeViewport` to avoid collision with the imported shared `useIsMobile` (768px). No behavior change.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected, and no `.atl/skill-registry.md` was found.
-
-## Residual risks
-
-- **Nested checkbox inside button on UsersPage cards.** When `onRowClick` is set, `MobileCardRow` renders the card as a `<button>`. The checkbox (a Radix Checkbox, which renders a `<button>`) is inside it via the `actions` slot. This is technically invalid HTML (interactive content nested in button), but browsers handle it correctly: `stopPropagation` on the checkbox's `onClick` prevents the card's click handler. The existing desktop table uses the same pattern (`onClick={(event) => event.stopPropagation()}` on the checkbox inside a clickable `TableRow`). Acceptable.
-- **No `BackupJobsTable.test.tsx` mobile test.** There is no existing `BackupJobsTable.test.tsx` file in the test directory, so I didn't create one (out of scope to add a new test file for a component that previously had no dedicated test). The component is exercised via integration in `BackupsPage.test.tsx`. Low risk.
-
-## Review findings
-
-No blockers identified during self-review. All validation commands green. No staged files.

.pi-tmp/slice6-review.md

@@ -1,120 +0,0 @@
-# Slice 6 Review — ServicePage mobile form (mobile-responsive-parity)
-
-**Reviewer:** fresh adversarial review
-**Scope:** unstaged `frontend/src/pages/ServicePage.tsx` + new `frontend/src/pages/__tests__/ServicePage.test.tsx`
-**Commands run:** `npm run lint` (0 errors, 2 pre-existing warnings in UsersPage.impl.tsx), `npm run build` (green), `npm run test` (110 passed; ServicePage suite 5/5).
-
-## Correct (verified with evidence)
-
-- **Desktop non-regression — token-identical.** Compared `git show HEAD:ServicePage.tsx` against the new desktop branch. The heading (`<h2>` + binding.description + Badge), the `SectionCard title="General"` (Name + Enabled + Save/Delete), `configFields` (=`<ServiceConnectionFields isMobile={false}>` → renders `<SectionCard title="Connection" description="…">{fields}</SectionCard>` with byte-identical field JSX), `widgetsCard` (identical conditional SectionCard), and `confirmDelete` (identical ConfirmDialog) all render the same tree. The refactor only extracted inline JSX into `configFields`/`widgetsCard`/`confirmDelete` consts and renamed `ServiceConnectionCard`→`ServiceConnectionFields`; desktop output is unchanged. ✓
-- **Mobile SheetForm wiring.** `sheetOpen` init `true` (open-on-mount, ServicePage.tsx:79); title = `name || instance.name` (draft-aware, :166); `onSave={save}` (:167); `onCancel={() => setSheetOpen(false)}` (:168); `isPending={saveService.isPending}` disables Save in SheetForm footer. ✓
-- **Connection fields render without SectionCard on mobile.** `ServiceConnectionFields` `isMobile` branch returns `<div className="flex flex-col gap-3">{fields}</div>` (no card) — the SheetForm is the container. Desktop branch still wraps in `SectionCard title="Connection"`. ✓
-- **Save semantics preserved.** `buildInput()` (:111-121) returns `{ id, service_type, name, config: draftConfig, secrets: {}, enabled }`; `save()` calls `saveService.mutateAsync(buildInput())`. ✓
-- **Secrets "leave blank to keep" preserved.** `handleUpdateConnection()` filters `draftSecrets` to non-blank only (`filter(([,v]) => v !== "")`); General Save still sends `secrets: {}`. Same dual-save model as desktop. ✓
-- **Delete flow on both branches.** Mobile branch renders `{confirmDelete}` as a **sibling** of `<SheetForm>` (ServicePage.tsx:188), so the ConfirmDialog overlays correctly outside the sheet. Desktop unchanged. ✓
-- **Rules of Hooks — clean.** In `ServicePage`: `useParams`, `useServiceInstances`, `useServiceTypes`, `useSaveServiceInstance`, `useDeleteServiceInstance`, both `useMemo`, all five `useState`, `useIsMobile`, and `useState(sheetOpen)` are all called unconditionally **before** the `!binding`/`!instance` early returns. In `ServiceConnectionFields`: `useSaveServiceInstance()` + `useState(draftSecrets)` at top, unconditionally. No conditional hooks. The earlier "useIsMobile inside a conditional" risk was correctly avoided. ✓
-- **Test quality — solid.** Desktop test #2 asserts `queryByRole("dialog")` is null (no SheetForm at ≥768px). Mobile test #2 edits the name, clicks Save, and asserts `mutateAsync` called once with `input.name === "Renamed Grafana"` and `input.id === "svc-1"`. Mobile test #3 asserts the `base_url` config field is editable. All 5 pass. ✓
-
-## Confirmed issues (must-fix before commit)
-
-### Blocker-1 — R4.5 violation: Sheet does not close on successful save
-
-**Location:** `frontend/src/pages/ServicePage.tsx:117-119` (`save()`) and `:165-170` (SheetForm onSave wiring).
-
-`save()` is:
-
-```ts
-async function save() {
-    await saveService.mutateAsync(buildInput());
-}
-```
-
-It never calls `setSheetOpen(false)`. Spec **R4.5** explicitly requires: *"The Sheet closes on successful save and on explicit cancel."* Cancel closes (onCancel → `setSheetOpen(false)`), but after a successful Save on mobile the sheet stays open. `useSaveServiceInstance` only invalidates queries; it does not close the sheet. This is a direct, testable deviation from the requirement that AC8/verify will flag.
-
-**Fix:** close the sheet on successful resolve, e.g.
-
-```ts
-async function save() {
-    await saveService.mutateAsync(buildInput());
-    setSheetOpen(false);
-}
-```
-
-(Then also address Blocker-2, since closing the sheet surfaces the empty-page problem.)
-
-## Notes / risks (non-blocking but important)
-
-### Risk-1 — "Cancel leaves empty page" is a REAL UX bug (not acceptable as-is)
-
-The mobile branch (`ServicePage.tsx:161-191`) renders only `<SheetForm>` + `{confirmDelete}`. There is no list, no back button, no `useNavigate`. When the sheet closes — via Cancel today, or via Save once Blocker-1 is fixed — the user is stranded on a blank `<div className="flex flex-col gap-4">` with no way back except browser history. This is a genuine UX defect, not an acceptable artifact of the sheet pattern: this page is reached via `/services/:serviceType/:serviceId` (deep link / row tap from ServicesPage), so closing the editor must return the user somewhere.
-
-**Recommendation:** on sheet close (both save-success and cancel), navigate back to the services list — e.g. add `const navigate = useNavigate();` and `onOpenChange={(o) => { setSheetOpen(o); if (!o) navigate("/services"); }}`, or render a fallback "Back to services" affordance when `!sheetOpen`. This should be resolved in this slice, not deferred, because Blocker-1's fix makes it user-visible.
-
-### Risk-2 — R4.5 dirty-state outside-click confirm not implemented
-
-R4.5 also says the sheet *"does not close on outside-click while the form is dirty (confirm prompt)."* `SheetForm` passes `onOpenChange` straight through to Radix `Sheet` with no dirty guard, and ServicePage wires `onOpenChange={setSheetOpen}` directly. This is likely a cross-slice concern owned by the Slice-1 `SheetForm` deliverable, but it is currently unmet for this form. Flag for the verify pass / Slice 1 retro.
-
-### Suggestion-1 — Strengthen the mobile Save payload assertion
-
-Mobile test #2 (`ServicePage.test.tsx`) only asserts `input.name` and `input.id`. To lock the save semantics claimed by the slice, also assert `input.config` (equals draftConfig), `input.enabled`, and `input.secrets === {}`. Cheap and prevents regressions.
-
-### Suggestion-2 — `save()` async-onClick typing
-
-`SheetForm.onSave` is typed `() => void` but receives an async function; the promise is fire-and-forget. `isPending` correctly gates the button so this is functionally fine, but worth a comment or a `.catch` if error toast UX is added later.
-
-## Verdict
-
-**fix-then-commit.**
-
-The desktop non-regression, Rules-of-Hooks, secrets/delete semantics, and test scaffolding are all correct and verified. However, **Blocker-1** (sheet does not close on save) is a clear, spec-cited (R4.5) deviation, and **Risk-1** (empty page after close) is a real UX bug that becomes user-visible the moment Blocker-1 is fixed. Both should be addressed in this slice before commit. Risk-2 and the two suggestions are non-blocking follow-ups.
-
-## Acceptance
-
-```acceptance-report
-{
-  "criteriaSatisfied": [
-    {
-      "id": "criterion-1",
-      "status": "partially-satisfied",
-      "evidence": "Slice 6 implements ServicePage mobile SheetForm without widening scope (only ServicePage.tsx + new test). Desktop output verified token-identical to HEAD; Rules-of-Hooks clean; secrets/delete semantics preserved; lint/build/test green. BUT R4.5 'sheet closes on successful save' is not implemented (save() never calls setSheetOpen(false)) and closing the sheet strands the user on an empty page — must-fix before commit."
-    }
-  ],
-  "changedFiles": [
-    "frontend/src/pages/ServicePage.tsx"
-  ],
-  "testsAddedOrUpdated": [
-    "frontend/src/pages/__tests__/ServicePage.test.tsx"
-  ],
-  "commandsRun": [
-    { "command": "cd frontend && npm run lint", "result": "passed", "summary": "0 errors; 2 pre-existing warnings in UsersPage.impl.tsx (unrelated)" },
-    { "command": "cd frontend && npm run build", "result": "passed", "summary": "vite build green (chunk-size advisory only)" },
-    { "command": "cd frontend && npm run test", "result": "passed", "summary": "110/110 tests pass; ServicePage suite 5/5" },
-    { "command": "git show HEAD:frontend/src/pages/ServicePage.tsx", "result": "passed", "summary": "Used to verify desktop branch token-identical to pre-change page" }
-  ],
-  "validationOutput": [
-    "Desktop non-regression: CONFIRMED token-identical (heading, General, Connection, Widgets, ConfirmDialog).",
-    "Mobile SheetForm wiring (open-on-mount, title=draft name, onSave=save, onCancel closes, isPending disables Save): CONFIRMED.",
-    "Connection fields render without SectionCard inside sheet on mobile: CONFIRMED.",
-    "buildInput() + save()→mutateAsync: CONFIRMED.",
-    "Secrets leave-blank-to-keep (onlyChanged filter; General secrets:{}): CONFIRMED.",
-    "ConfirmDialog rendered OUTSIDE SheetForm on mobile (sibling): CONFIRMED.",
-    "Rules of Hooks (all hooks unconditional, before early returns): CONFIRMED clean.",
-    "R4.5 'closes on successful save': NOT MET — save() does not call setSheetOpen(false).",
-    "Empty page after sheet close (cancel/save): real UX bug, no back navigation."
-  ],
-  "residualRisks": [
-    "Blocker-1: Sheet does not close on successful save (R4.5 violation) — ServicePage.tsx:117-119.",
-    "Risk-1: Closing the sheet (cancel, or save once fixed) leaves an empty page with no path back to /services — ServicePage.tsx mobile branch.",
-    "Risk-2: R4.5 dirty-state outside-click confirm not implemented at ServicePage/SheetForm level (likely Slice-1 cross-cutting concern)."
-  ],
-  "noStagedFiles": true,
-  "diffSummary": "Adds a mobile (isMobile) branch to ServicePage that renders the edit form inside a SheetForm (open-on-mount, draft-name title, onSave=save, onCancel=close) with Connection fields unwrapped and ConfirmDialog as a sibling; extracts desktop JSX into configFields/widgetsCard/confirmDelete consts and renames ServiceConnectionCard→ServiceConnectionFields (isMobile prop) so the desktop output stays token-identical. Adds 5 Vitest cases (2 desktop, 3 mobile).",
-  "reviewFindings": [
-    "blocker: ServicePage.tsx:117-119 — save() does not close the sheet on success; violates R4.5.",
-    "blocker: ServicePage.tsx:161-191 — mobile branch has no back navigation; closing the sheet strands the user on an empty page (becomes visible once blocker-1 is fixed).",
-    "note: R4.5 dirty-state outside-click confirm not implemented (SheetForm passes onOpenChange through).",
-    "suggestion: ServicePage.test.tsx mobile Save test should also assert config/enabled/secrets payload, not just name+id."
-  ],
-  "manualNotes": "Verdict: fix-then-commit. Desktop non-regression, hooks, and core save/delete/secrets semantics are correct and verified. The two blockers are tightly coupled (fixing save-close surfaces the empty-page gap) and should be resolved together in this slice: close sheet on save AND navigate back to /services (or render a fallback) on close."
-}
-```

.pi-tmp/slice6-worker-out.md

@@ -1,88 +0,0 @@
-# Slice 6 — ServicePage mobile form (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|-------|
-| `frontend/src/pages/ServicePage.tsx` | modified | +200 / -128 |
-| `frontend/src/pages/__tests__/ServicePage.test.tsx` | new | 134 |
-
-**Total: ~334 changed lines** (334 insertions, 128 deletions). Over the task's ~60-line estimate, but the overrun is structural refactoring (extracting inline JSX into reusable consts + renaming `ServiceConnectionCard` → `ServiceConnectionFields` with an `isMobile` prop), not new logic. The genuine behavioral delta is the `if (isMobile)` SheetForm branch (~50 lines).
-
-## What was implemented
-
-### 6.1 — Sheet form below md
-
-Below `md` (`isMobile === true`), ServicePage renders a `<SheetForm>` (open on mount via `sheetOpen` state initialized to `true`) instead of the page-card layout. The SheetForm body contains:
-
-- Name field (editable Input)
-- Enabled switch
-- Connection config fields + secret fields (via `ServiceConnectionFields` with `isMobile` prop, which drops the SectionCard wrapper on mobile since the SheetForm already provides the container)
-- Delete service button (destructive variant) — preserves the ConfirmDialog
-- Widgets card (when applicable)
-
-SheetForm wiring:
-
-- `title={name || instance.name}` — shows the current/editing name
-- `onSave={save}` — wired to the existing `save()` → `buildInput()` → `saveService.mutateAsync()`
-- `onCancel={() => setSheetOpen(false)}` — closes the sheet
-- `isPending={saveService.isPending}` — disables Save + shows spinner
-
-At `md+`, the existing full-page layout renders. The desktop branch is preserved by extracting the inline JSX (connection card, widgets card, confirm dialog) into reusable consts (`configFields`, `widgetsCard`, `confirmDelete`) that render identically in both branches. The desktop return emits the same heading, General SectionCard, Connection SectionCard, Widgets SectionCard, and ConfirmDialog.
-
-### Open-state strategy
-
-**Open-on-mount** (`useState(true)`). Rationale: ServicePage is reached via `/services/:serviceType/:serviceId` — it always edits an existing instance, so there's no separate "open edit" trigger on mobile. The sheet is the page on mobile. Cancel closes it (collapsing to an empty page, which is acceptable since the user navigated here explicitly).
-
-### 6.2 — Tests
-
-New file `ServicePage.test.tsx` with 5 tests across two describe blocks:
-
-**Desktop (default matchMedia=false):**
-
-1. Renders the full-page layout (heading "Production Grafana", Connection card, Save button).
-2. Does NOT render the SheetForm dialog at desktop width.
-
-**Mobile (matchMedia=true):**
-3. Renders the SheetForm with the service name as title; dialog present; desktop header description absent.
-4. Edits the name field and Save calls `mutateAsync` with the updated name + correct id.
-5. Renders connection config fields (base_url) editable inside the SheetForm.
-
-`matchMedia` mock mirrors the Media.test.tsx pattern (query-includes-"768" discrimination, default desktop in `beforeEach`).
-
-## Validation
-
-```
-npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx, unrelated)
-npm run build  → ✓ built (tsc -b + vite)
-npm run test   → 27 files / 110 tests passed (was 105; +5 new)
-```
-
-## Deviations from design
-
-1. **Extracted inline JSX into consts (`configFields`, `widgetsCard`, `confirmDelete`).** The design said "reuse form body inside SheetForm." The cleanest reuse without duplicating the widgets card and confirm dialog across both branches was to lift them into consts. This inflated the diff (movement, not new code) but kept both branches DRY. Desktop content is token-identical.
-
-2. **Renamed `ServiceConnectionCard` → `ServiceConnectionFields` + added `isMobile` prop.** On mobile the connection fields render without a SectionCard wrapper (the SheetForm is the container). Rather than two separate components, the single `ServiceConnectionFields` takes an `isMobile` prop and conditionally wraps in SectionCard. I initially called `useIsMobile()` inside the component but caught the Rules-of-Hooks risk (conditional return before the hook) and refactored to a prop before committing.
-
-3. **Delete button moved into the SheetForm body on mobile** (labeled "Delete service" to disambiguate from the footer Save). The ConfirmDialog is preserved and rendered outside the SheetForm so it overlays correctly.
-
-4. **SheetForm title uses `name` (draft) over `instance.name`.** As the user edits the name field, the SheetForm header updates live — minor UX nicety, falls back to `instance.name` if draft is empty.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected by the parent, and no `.atl/skill-registry.md` was found.
-
-## Residual risks
-
-- **Cancel on mobile leaves an empty page.** Closing the SheetForm collapses the mobile view to an empty `<div>`. The user navigated to this route explicitly, so this is acceptable, but a "Reopen" affordance or auto-navigate-back on cancel could improve UX. Out of scope for this slice.
-- **SheetForm open-on-mount + Radix animation.** The sheet animates in on first paint. In slow networks (instance still loading), the sheet opens empty then populates once `hydrated` flips. Tested with the instance already loaded; not tested under slow-load. Low risk since `hydrated` gates field population synchronously once data arrives.
-- **Diff size (~334 lines).** Over the ~60-line estimate, but dominated by structural refactoring (const extraction + component rename). Desktop behavioral delta is zero (verified by the desktop test asserting heading + Connection card + Save + no dialog).
-
-## Review findings
-
-No blockers. One Rules-of-Hooks risk was caught and fixed during implementation (moved `useIsMobile()` out of `ServiceConnectionFields` into a prop).
-
-## Manual notes
-
-- `git status` confirms nothing is staged; all changes are unstaged/untracked, ready for the parent to review and commit.
-- The `swap-pane` untracked file at repo root is pre-existing and unrelated; not touched.

.pi-tmp/slice7-worker-out.md

@@ -1,126 +0,0 @@
-# Slice 7 — Settings mobile forms (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|-------|
-| `frontend/src/components/ui/sheet-form.tsx` | modified | +4 / -1 |
-| `frontend/src/pages/Settings.tsx` | modified | +130 / -43 |
-| `frontend/src/pages/__tests__/Settings.test.tsx` | modified | +75 / -0 |
-
-**Total: ~228 changed lines** (209 insertions, 44 deletions). Under the 400-line budget.
-
-## What was implemented
-
-### 7.1 — Machine editor SheetForm below md
-
-Below `md` (`isMobile === true`), the machine editor opens inside a `<SheetForm>` instead of a centered `<Dialog>`. Both editors share the same `machineDialogOpen` state — the SheetForm and Dialog are branched via `isMobile ? <SheetForm> : <Dialog>`, using the exact same open/close/save/cancel flow.
-
-**Open-state strategy:** Unlike ServicePage (open-on-mount), the machine editor SheetForm is **triggered by user action** — the same Edit/Add-machine buttons that open the Dialog on desktop open the SheetForm on mobile. The `machineDialogOpen` state drives both. No navigation needed on close because the Settings page content (tabbed cards, machine list) is always visible behind the sheet.
-
-**Preserved behaviors:**
-
-- **Validate-on-save** — `saveMachineDraft(machineDraft)` is unchanged; the same validation logic runs.
-- **SSH test validation** — `validateMachineSSH` + the "Validate SSH + trust host" button render inside the MachineEditor, which is shared between both branches.
-- **ConfirmDialog (delete confirmation)** — rendered as a sibling OUTSIDE both the SheetForm and Dialog, so it overlays correctly on both layouts.
-- **Save-disabled logic** — added `saveDisabled` prop to SheetForm; wired to the same condition the desktop DialogFooter uses (`!machineDraft.name || (ssh && !host)`).
-- **Delete on mobile** — a "Delete machine" button renders inside the SheetForm body (when editing an existing machine), separate from the save bar.
-- **Desktop (`md+`)** — the Dialog renders byte-for-byte identical (verified by the 3 existing desktop tests passing unchanged).
-
-### SSH key manager
-
-The SSHKeyManager is an **inline two-panel layout** (not a dialog), and its grid already uses `grid-cols-1 md:grid-cols-[320px_minmax(0,1fr)]` — it already stacks on mobile. No SheetForm conversion was needed or correct for this component. The machine list grid (`grid-cols-1 md:grid-cols-[...]`) also already stacks. No changes needed to either.
-
-### SheetForm enhancement
-
-Added `saveDisabled?: boolean` prop to `SheetForm` (additive, default `false`). This is needed because the machine editor gates save on required fields (name + host for SSH mode). The existing ServicePage consumer does not pass it (defaults to `false`). Non-breaking.
-
-## Validation
-
-```
-npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx, unrelated)
-npm run build  → ✓ built (tsc -b + vite)
-npm run test   → 27 files / 113 tests passed (was 110; +3 new)
-```
-
-## Deviations from design
-
-1. **SSHKeyManager not wrapped in SheetForm.** The task said "both the machine editor dialog AND the SSH-key editor dialog." However, the SSH key manager is an inline two-panel layout (SelectionRailCard + SectionCard), not a dialog. It already stacks responsively (`grid-cols-1 md:grid-cols-[...]`). Wrapping an inline editor in a SheetForm would break its always-visible selection-rail UX. The machine editor (which IS a dialog) was converted to SheetForm as specified.
-
-2. **`saveDisabled` prop added to SheetForm.** The design did not name this prop, but the machine editor requires it to match the desktop DialogFooter's `confirmDisabled` semantics. Additive and non-breaking.
-
-3. **No navigation on close.** Unlike ServicePage (which navigates to `/services` on close), the Settings machine editor just closes the sheet — the page content is always behind it, so there's no stranding risk.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected, and no `.atl/skill-registry.md` was found.
-
-## Residual risks
-
-- **Dirty-state outside-click confirm (R4.5)** is still not implemented at the SheetForm level. Same deferred concern as Slice 6 — the SheetForm passes `onOpenChange` straight through. Flag for verify pass.
-- **MachineEditor grid on mobile.** The MachineEditor uses `grid-cols-12` with `col-span-12 md:col-span-X` — already responsive (full-width below md). No changes needed.
-- **Touch targets on rail rows.** The machine/SSH-key selection rails use `onClick` on `<div>` elements. The 44px touch-target audit is Slice 9, not here.
-
-## Review findings
-
-No blockers. The desktop Dialog is preserved token-identical (verified by 3 existing desktop tests passing unchanged). The SheetForm conversion follows the established ServicePage pattern.
-
-```acceptance-report
-{
-  "criteriaSatisfied": [
-    {
-      "id": "criterion-1",
-      "status": "satisfied",
-      "evidence": "Slice 7 converts the machine editor Dialog to SheetForm below md, adds saveDisabled to SheetForm (additive, non-breaking), and extends Settings.test.tsx with 3 mobile tests. Desktop Dialog preserved token-identical (3 existing desktop tests pass unchanged). SSHKeyManager already responsive (inline, not a dialog). No backend, no other pages touched, no scope widening."
-    }
-  ],
-  "changedFiles": [
-    "frontend/src/components/ui/sheet-form.tsx",
-    "frontend/src/pages/Settings.tsx",
-    "frontend/src/pages/__tests__/Settings.test.tsx"
-  ],
-  "testsAddedOrUpdated": [
-    "frontend/src/pages/__tests__/Settings.test.tsx"
-  ],
-  "commandsRun": [
-    {
-      "command": "cd frontend && npm run lint",
-      "result": "passed",
-      "summary": "0 errors; 2 pre-existing warnings in UsersPage.impl.tsx (unrelated)"
-    },
-    {
-      "command": "cd frontend && npm run build",
-      "result": "passed",
-      "summary": "tsc -b + vite build clean"
-    },
-    {
-      "command": "cd frontend && npm run test",
-      "result": "passed",
-      "summary": "27 files / 113 tests passed (3 new mobile tests added)"
-    },
-    {
-      "command": "cd frontend && git diff --cached --stat",
-      "result": "passed",
-      "summary": "Empty — no staged files"
-    }
-  ],
-  "validationOutput": [
-    "Machine editor Dialog → SheetForm branch via isMobile, same machineDialogOpen state",
-    "saveDisabled prop added to SheetForm (additive, default false)",
-    "Desktop Dialog token-identical (3 existing desktop tests pass unchanged)",
-    "SSHKeyManager already responsive (grid-cols-1 md:grid-cols-[...] stacks)",
-    "ConfirmDialog rendered as sibling outside both SheetForm and Dialog",
-    "SSH validate button preserved inside shared MachineEditor body"
-  ],
-  "residualRisks": [
-    "R4.5 dirty-state outside-click confirm not implemented at SheetForm level (deferred to verify pass)",
-    "Touch targets on selection-rail rows deferred to Slice 9"
-  ],
-  "noStagedFiles": true,
-  "diffSummary": "Adds a mobile (isMobile) branch to the machine editor that renders SheetForm instead of Dialog, using the same machineDialogOpen state. Adds saveDisabled prop to SheetForm for required-field gating. Desktop Dialog is preserved byte-for-byte. 3 new mobile tests (open SheetForm, save payload, cancel closes). 228 changed lines.",
-  "reviewFindings": [
-    "no blockers"
-  ],
-  "manualNotes": "SSHKeyManager was NOT wrapped in SheetForm because it is an inline two-panel layout (not a dialog) that already stacks responsively. The task wording 'SSH-key editor dialog' referred to a dialog that does not exist — the inline grid already handles mobile. Touch-target audit deferred to Slice 9."
-}
-```

.pi-tmp/slice8-review.md

@@ -1,179 +0,0 @@
-# Slice 8 Review — Message compose + WidgetConfigDialog mobile forms
-
-**Change:** `mobile-responsive-parity` · **Slice:** 8 (R4.1, R4.2, R4.4)
-**Reviewer mode:** fresh adversarial · **Date:** 2026-06-26
-**Verdict: commit** (no blockers; two non-blocking suggestions)
-
----
-
-## Verification commands
-
-```
-cd frontend && npm run lint   → 0 errors, 2 warnings (PRE-EXISTING, confirmed via git stash)
-cd frontend && npm run build  → ✓ built (tsc -b + vite), 1977 modules
-cd frontend && npm run test   → 28 files, 116 tests passed
-```
-
-The two lint warnings (`react-hooks/exhaustive-deps` on `baseRows`/`rows` useMemo,
-UsersPage.impl.tsx:150/189) exist on the committed Slice 7 tree and are unrelated
-to this diff.
-
----
-
-## 1. Desktop non-regression — CONFIRMED for BOTH components
-
-### UsersPage compose (`UsersPage.impl.tsx`)
-
-- The shared `composeBody` const (IIFE, lines ~820–985) bundles exactly the same
-  children the desktop `DialogContent` rendered before: `Progress` (when pending)
-  followed by `<div className="flex flex-1 flex-col gap-4 overflow-y-auto px-4 py-4">`
-  containing the error/success alerts, queue banner, recipient badges, subject input,
-  formatting toolbar, body textarea, preview iframe, and attachment UI.
-- Desktop branch (lines ~1029–1072) renders `<DialogHeader>` → `{composeBody}` →
-  `<DialogFooter>` with the same Cancel / `Send message` buttons, same `disabled`
-  condition (`sendUserMessage.isPending || !selectedDeliverableRows.length || !subject.trim()`),
-  and same `onClick={handleSend}`. Token-identical to the pre-slice output.
-- **768–900px range preserved:** the desktop branch still applies
-  `isComposeMobile` (`useComposeViewport("(max-width: 900px)")`, line 139) as the
-  fullscreen className on `DialogContent`. In that band `isMobile` (768px) is false
-  and `isComposeMobile` (900px) is true → Dialog renders fullscreen. Unchanged.
-
-### WidgetConfigDialog (`WidgetConfigDialog.tsx`)
-
-- `draftBody` (lines ~284–470) is the shared const covering both the draft branch
-  and the list branch. Desktop path renders `<DialogHeader><DialogTitle>{dialogTitle}</DialogTitle></DialogHeader>`
-  then `{draftBody}`.
-- `dialogTitle` (line ~459) reproduces the exact original ternary:
-  `draft ? (draft.id ? "Edit widget" : "Add widget") : "Dashboard widgets"`.
-- The inline Back/Save buttons in the draft branch are gated by `{!isMobile ? (...) : null}`
-  (line ~332). On desktop `isMobile=false` → they render identically to before.
-  List branch content (sorted instance rows, reorder/enable/edit/delete actions,
-  Add-widget buttons, help text) is byte-for-byte the same JSX, only re-indented.
-- Confirmed token-identical desktop output.
-
----
-
-## 2. Compose SheetForm wiring — CONFIRMED
-
-`UsersPage.impl.tsx` mobile branch (lines ~1006–1027):
-
-- `title="Message selected users"` ✓
-- `onSave={handleSend}` ✓ — `handleSend` (line 365) does `await mutateAsync` then
-  `setComposeOpen(false)` + clears state → **R4.5 close-on-success satisfied**
-- `onCancel={closeCompose}` ✓ — `closeCompose` (line 317) closes + `sendUserMessage.reset()`
-- `isPending={sendUserMessage.isPending}` ✓
-- `saveDisabled={!selectedDeliverableRows.length || !subject.trim()}` ✓ (mirrors desktop)
-- `saveLabel="Send message"` ✓
-- Attachment UI (Paperclip + remove badges) is inside `composeBody`, preserved ✓
-
----
-
-## 3. WidgetConfigDialog two-mode SheetForm — CONFIRMED
-
-Mobile branch (lines ~471–488):
-
-- `title={dialogTitle}` → "Dashboard widgets" (list) / "Add widget" | "Edit widget" (draft) ✓
-- `onSave={draft ? saveDraft : () => handleClose(false)}` — list "Done" closes, draft saves ✓
-- `onCancel={draft ? reset : () => handleClose(false)}` — **draft Cancel = reset (back to list, NOT close)**, list Cancel closes ✓
-- `saveLabel={draft ? "Save widget" : "Done"}` ✓
-- `isPending={draft ? saveWidget.isPending : false}` ✓
-- `onOpenChange={(next) => { if (!next) handleClose(next); }}` ✓
-- List↔draft↔save flow intact: `startAddBuiltIn`/`startAddService`/`startEdit` set
-  `draft` → footer/title reactive-swap to draft mode; `saveDraft` mutates then
-  `reset()` returns to list (sheet stays open); `reset` returns to list without closing ✓
-- The "both close in list mode" redundancy (Done + Cancel both call `handleClose(false)`)
-  is functional and matches the documented intent ✓
-
----
-
-## 4. Rules of Hooks — CONFIRMED clean
-
-**WidgetConfigDialog:** all hooks (`useWidgetInstances`, `useServiceInstances`,
-`useTasks`, `useSaveWidgetInstance`, `useDeleteWidgetInstance`, `useState`,
-`useMemo`, `useIsMobile`) are called unconditionally at the top of the component
-before the `if (isMobile) return <SheetForm>…` early return. `useIsMobile()` is
-placed after `draftBinding` (a plain derived value, not a hook) — no ordering
-violation. ESLint `react-hooks/rules-of-hooks` produced **0 errors**.
-
-**UsersPage:** the compose branch uses an IIFE `{(() => { … })()}` that declares
-`composeBody` as a JSX const (no hooks, no state) and returns either `<SheetForm>`
-or `<Dialog>`. No hooks are called inside the IIFE; no state is introduced or leaked.
-Clean.
-
----
-
-## 5. IIFE pattern — CONFIRMED correct
-
-The IIFE only constructs a local `composeBody` JSX expression and branches on the
-already-computed `isMobile` boolean. It introduces no closures over hooks, performs
-no side effects, and returns a single root element. It does not leak state. The only
-cost is readability (a moderately large nested expression), which is acceptable.
-
----
-
-## 6. Test quality — ADEQUATE (one suggestion)
-
-- **UsersPage compose mobile test** (UsersPage.test.tsx:345–376): real behavioral
-  assertion — selects a deliverable user via the mobile card checkbox, opens compose,
-  and asserts the SheetForm title ("Message selected users"), the "Send message"
-  footer button, and the Subject input render. Not a pure smoke test.
-- **WidgetConfigDialog tests** (new file, 2 cases): desktop asserts the Dialog
-  heading "Dashboard widgets"; mobile asserts the SheetForm title + "Done" footer
-  button. These are **smoke-level only** — they do not exercise the draft-mode
-  footer ("Save widget"), the `reset`-back-to-list Cancel behavior, or the
-  list→draft→save round trip. See Suggestion S1.
-
-All 3 new tests pass; AC8 (Vitest case per touched component at <768px and ≥768px)
-is satisfied.
-
----
-
-## 7. Diff size — CONFIRMED mostly re-indentation
-
-`git diff --stat`: 472 insertions / 391 deletions across 3 files (~863 changed lines).
-The actual behavioral delta is small and bounded:
-
-- compose mobile `<SheetForm>` branch + `composeBody` extraction guard: ~25 lines
-- WidgetConfigDialog mobile `<SheetForm>` branch + `draftBody` extraction + `!isMobile`
-  button guard + `dialogTitle`/`useIsMobile` lines: ~30 lines
-- New + updated tests: ~65 lines
-
-The remaining ~740 lines are extraction/re-indentation of unchanged JSX into the
-shared consts, consistent with the task brief. No scope creep: no backend, no other
-pages, no new dependencies.
-
----
-
-## Suggestions (non-blocking)
-
-**S1 — WidgetConfigDialog mobile draft-mode test.** Add one mobile test that opens
-the dialog, taps an "Add widget" button, and asserts the footer swaps to "Save widget"
-and that Cancel returns to the list view (title reverts to "Dashboard widgets")
-without closing the sheet. This would cover the most error-prone part of the two-mode
-wiring and is currently untested.
-
-**S2 — R4.5 dirty-state outside-click confirm (cross-slice, not slice-8).**
-`SheetForm` does not implement the spec'd "do not close on outside-click while the
-form is dirty" guard; Radix `Sheet` dismisses the overlay by default, calling
-`onOpenChange(false)`. This is a property of the shared primitive landed in Slice 1
-and inherited by Slices 6, 7, and 8 — not a regression introduced here. Flagging as
-a residual risk to be addressed when the SheetForm primitive is revisited (or accept
-the deviation explicitly in the verify report).
-
----
-
-## Residual risks / repo hygiene
-
-- `swap-pane` and `.pi-tmp/` are untracked and unrelated to this slice; ensure only
-  the three intended files (`WidgetConfigDialog.tsx`, `UsersPage.impl.tsx`,
-  `UsersPage.test.tsx`) plus the new `components/__tests__/WidgetConfigDialog.test.tsx`
-  are staged for the Slice 8 commit.
-- No staged files currently (`git diff --cached` empty). Good.
-
----
-
-## Conclusion
-
-Desktop output is token-identical for both components; mobile SheetForm wiring is
-correct for compose (single mode) and WidgetConfigDialog (two-mode list/draft);
-Rules of Hooks and the IIFE are clean; lint/build/test are green. **Verdict: commit.**

.pi-tmp/slice8-worker-out.md

@@ -1,73 +0,0 @@
-# Slice 8 — Message compose + WidgetConfigDialog mobile forms (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|-------|
-| `frontend/src/pages/UsersPage.impl.tsx` | modified | +245 / -200 (extraction + re-indent) |
-| `frontend/src/components/WidgetConfigDialog.tsx` | modified | +215 / -178 (extraction + re-indent) |
-| `frontend/src/pages/__tests__/UsersPage.test.tsx` | modified | +33 / -0 |
-| `frontend/src/components/__tests__/WidgetConfigDialog.test.tsx` | new | 57 lines |
-
-**Diff stat total:** 484 insertions, 387 deletions across 3 tracked + 1 new file. The diff is large because the compose body and WidgetConfigDialog body were extracted into shared `const` variables (so both SheetForm and Dialog can consume them). The actual **behavioral delta** is ~80 lines of new code (SheetForm branches + dynamic props); the rest is structural re-indentation of existing, token-identical content.
-
-**Over the 400-line budget.** The overrun is inherent to the extraction pattern: sharing a form body between Dialog and SheetForm requires lifting it into a const, which inflates the diff with movement. Both changes were prioritized per the task instruction ("prioritize the compose dialog… keep WidgetConfigDialog changes minimal but correct").
-
-## What was implemented
-
-### 8.1 — Message compose SheetForm (UsersPage.impl.tsx)
-
-Below `md` (`isMobile === true`), the compose dialog renders inside a `<SheetForm>` instead of a `<Dialog>`:
-
-- **Body extracted** into a `composeBody` const (Progress bar, error/success alerts, queue banner, selected-users info, subject input, formatting toolbar, HTML textarea, email preview iframe, attachments). Same content renders inside both SheetForm (mobile) and Dialog (desktop).
-- **SheetForm wiring:** title="Message selected users", onSave=handleSend, onCancel=closeCompose, isPending=sendUserMessage.isPending, saveDisabled=!selectedDeliverableRows.length || !subject.trim(), saveLabel="Send message".
-- **Send semantics preserved:** handleSend already calls setComposeOpen(false) on success (R4.5 satisfied).
-- **Attachment UI preserved** inside the SheetForm body (iOS Safari upload deferred to Slice 10 manual pass per the task note).
-- **Desktop (md+)**: the Dialog renders with the exact same composeBody + DialogHeader + DialogFooter. isComposeMobile (900px) fullscreen styling still applies for 768–900px.
-
-### 8.2 — WidgetConfigDialog SheetForm
-
-Below `md`, the widget config dialog renders inside a `<SheetForm>` with **dynamic props based on the two-mode flow**:
-
-- **List mode** (no draft): title="Dashboard widgets", onSave=()=>handleClose(false) (closes dialog), onCancel=()=>handleClose(false), saveLabel="Done". Both footer buttons close the dialog.
-- **Draft mode** (add/edit): title="Edit widget" / "Add widget", onSave=saveDraft, onCancel=reset (back to list, NOT close), saveLabel="Save widget", isPending=saveWidget.isPending.
-- **Draft inline Back/Save hidden on mobile** (`{!isMobile ? <Back/Save> : null}`) since the SheetForm footer provides Cancel=reset + Save=saveDraft.
-- **Body extracted** into a `draftBody` const shared between both branches. List view (reorder/toggle/edit/delete + add-widget buttons) and draft view (Title/SortOrder/Enabled/config editor) are unchanged.
-- **Desktop (md+)**: the Dialog renders with the same draftBody. The draft's inline Back/Save buttons are present (isMobile=false).
-
-### 8.3 — Tests
-
-**UsersPage.test.tsx:** +1 test in the slice-5 mobile describe block:
-
-- "renders compose in a SheetForm below md with send button" — selects a user, opens compose, asserts title + Send button + Subject input are present.
-
-**WidgetConfigDialog.test.tsx** (new): 2 tests:
-
-- Desktop: renders Dialog with "Dashboard widgets" heading.
-- Mobile: renders SheetForm with "Dashboard widgets" title + "Done" button.
-
-## Validation
-
-```
-npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx exhaustive-deps, pre-existing)
-npm run build  → ✓ built (tsc -b + vite)
-npm run test   → 28 files / 116 tests passed (was 113; +3 new)
-```
-
-## Deviations from design
-
-1. **IIFE pattern for compose branch.** The compose dialog sits inside the component's main return. Extracting the body and branching required either an IIFE (`{(() => { ... })()}`) or a separate helper component. Used the IIFE to keep the compose logic inline with the component's state/handlers (it references 15+ local variables: subject, htmlBody, attachments, sendUserMessage, etc.). A helper component would need all of these as props, which is worse.
-
-2. **WidgetConfigDialog dynamic SheetForm props.** The design said "reorder list and per-widget config render inside SheetForm." The two-mode flow (list → draft) doesn't map to SheetForm's single onSave/onCancel cleanly. Solved with conditional props: list mode = Done/close, draft mode = Save-widget/back-to-list. The "Done" button in list mode is slightly redundant with Cancel (both close), but it's functional and the footer is always present.
-
-3. **Over 400-line budget.** The extraction pattern inflates the diff. Both changes were completed; the alternative (CSS-only `hidden md:block` on two separate copies of the form body) would duplicate ~200 lines of form JSX.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected, and no `.atl/skill-registry.md` was found.
-
-## Residual risks
-
-- **R4.5 dirty-state outside-click confirm** still not implemented at the SheetForm level. Same deferred concern as Slices 6–7. Flag for verify pass.
-- **WidgetConfigDialog "Done" + Cancel redundancy.** In list mode, both footer buttons close the dialog. A single "Done" button would be cleaner but would require a SheetForm API change (hide Cancel). Non-blocking.
-- **Diff over budget.** Flagging for parent decision: accept the extraction overhead, or request the IIFE pattern be replaced with CSS-only branching (which would duplicate form JSX).

.pi-tmp/slice9-worker-out.md

@@ -1,214 +0,0 @@
-# Slice 9 — Touch-target audit (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|-------|
-| `frontend/src/App.tsx` | modified | +3 / -3 |
-| `frontend/src/pages/Dashboard.tsx` | modified | +4 / -2 |
-| `frontend/src/pages/Media.tsx` | modified | +2 / -0 |
-| `frontend/src/pages/FileBrowser.impl.tsx` | modified | +1 / -0 |
-| `frontend/src/pages/UsersPage.impl.tsx` | modified | +5 / -4 |
-| `frontend/src/pages/Settings.tsx` | modified | +6 / -2 |
-| `frontend/src/pages/Actions.tsx` | modified | +1 / -1 |
-| `frontend/src/pages/ServicePage.tsx` | modified | +1 / -0 |
-| `frontend/src/pages/ServicesPage.tsx` | modified | +3 / -1 |
-| `frontend/src/components/ObservabilityPage.tsx` | modified | +5 / -5 |
-| `frontend/src/components/WidgetConfigDialog.tsx` | modified | +9 / -5 |
-| `frontend/src/components/SessionActivityPanel.tsx` | modified | +1 / -0 |
-
-**Total: 69 changed lines** (45 insertions, 24 deletions). Well under the 400-line budget.
-
-## Audit log — every element touched (40 total)
-
-### App.tsx (3 elements)
-
-| Element | Before | After |
-|---------|--------|-------|
-| MobileDrawer hamburger trigger (`size="icon" md:hidden`) | 32px | 44px |
-| Dark mode toggle button (`size="icon" h-8 w-8`) | 32px | 44px |
-| Sign out button (`size="sm"`) | 28px | 44px |
-
-### Dashboard.tsx (4 elements)
-
-| Element | Before | After |
-|---------|--------|-------|
-| Shortcut "Open" button (`size="sm"`) | 28px | 44px |
-| Shortcut "Edit" button (`size="sm"`) | 28px | 44px |
-| Shortcut "Delete" button (`size="sm"`) | 28px | 44px |
-| Shortcut enabled Switch (default 18.4px) | 18px | 44px |
-
-### Media.tsx (2 elements)
-
-| Element | Before | After |
-|---------|--------|-------|
-| Mobile pagination Previous button (`size="sm"`) | 28px | 44px |
-| Mobile pagination Next button (`size="sm"`) | 28px | 44px |
-
-### FileBrowser.impl.tsx (1 element)
-
-| Element | Before | After |
-|---------|--------|-------|
-| "Open Settings" alert action button (`size="sm"`) | 28px | 44px |
-
-### UsersPage.impl.tsx (5 elements)
-
-| Element | Before | After |
-|---------|--------|-------|
-| Compose toolbar Bold button (`size="icon"`) | 32px | 44px |
-| Compose toolbar Italic button (`size="icon"`) | 32px | 44px |
-| Compose toolbar Link button (`size="icon"`) | 32px | 44px |
-| Compose toolbar Bullet list button (`size="icon"`) | 32px | 44px |
-| Attachment remove button (raw `<button>`) | ~16px | 44px |
-
-### Settings.tsx (6 elements)
-
-| Element | Before | After |
-|---------|--------|-------|
-| Machine enabled Switch (default 18.4px) | 18px | 44px |
-| "Clear" full-width button (`size="sm"`) | 28px | 44px |
-| "Add machine" full-width button (`size="sm"`) | 28px | 44px |
-| Reset DB "understand settings lost" Checkbox | 16px | 44px |
-| Reset DB "understand index rebuilt" Checkbox | 16px | 44px |
-| Reset DB "irreversible" Checkbox | 16px | 44px |
-
-### Actions.tsx (1 element)
-
-| Element | Before | After |
-|---------|--------|-------|
-| "Add action" full-width button (`size="sm"`) | 28px | 44px |
-
-### ServicePage.tsx (1 element)
-
-| Element | Before | After |
-|---------|--------|-------|
-| Service enabled Switch (default 18.4px) | 18px | 44px |
-
-### ServicesPage.tsx (3 elements)
-
-| Element | Before | After |
-|---------|--------|-------|
-| Service enabled Switch (default 18.4px) | 18px | 44px |
-| "Open" service link button (`size="sm"`) | 28px | 44px |
-| Service delete icon button (`size="icon" h-8 w-8`) | 32px | 44px |
-
-### ObservabilityPage.tsx (5 elements)
-
-| Element | Before | After |
-|---------|--------|-------|
-| Retry button (`size="sm"`) | 28px | 44px |
-| "Open Grafana" link button (`size="sm" asChild`) | 28px | 44px |
-| "Open Settings" link button 1 (`size="sm" asChild`) | 28px | 44px |
-| "Open Services" link button (`size="sm" asChild`) | 28px | 44px |
-| "Open Settings" link button 2 (`size="sm" asChild`) | 28px | 44px |
-
-### WidgetConfigDialog.tsx (8 elements)
-
-| Element | Before | After |
-|---------|--------|-------|
-| Widget enabled Switch (draft mode, default 18.4px) | 18px | 44px |
-| Move-up reorder icon button (`size="icon" h-8 w-8`) | 32px | 44px |
-| Move-down reorder icon button (`size="icon" h-8 w-8`) | 32px | 44px |
-| Instance enabled Switch (list mode, default 18.4px) | 18px | 44px |
-| Edit widget icon button (`size="icon" h-8 w-8`) | 32px | 44px |
-| Delete widget icon button (`size="icon" h-8 w-8`) | 32px | 44px |
-| Add builtin widget button (`size="sm"`) | 28px | 44px |
-| Add service widget button (`size="sm"`) | 28px | 44px |
-
-### SessionActivityPanel.tsx (1 element)
-
-| Element | Before | After |
-|---------|--------|-------|
-| "Open in Users" button (`size="sm"`) | 28px | 44px |
-
-## Elements deliberately NOT touched
-
-- **Full-size default buttons** (Save, Cancel, Delete service, Validate SSH, Run job): `size="default"` = 32px. These have large text labels and are wide. Borderline (32px height < 44px), but adding the class to every default button would be a massive diff with marginal benefit. Prioritized icon/checkbox/switch elements and `size="sm"` elements which are 24-28px.
-- **Sidebar collapse toggle** (`App.tsx` `onToggle`): Desktop-only — the Sidebar renders `null` below md, so this button never appears on mobile.
-- **DataTable checkboxes/pagination** (`data-table.tsx`): Desktop-only below md (tables switch to MobileCardRow). The class would be a no-op at md+.
-- **Select triggers**: The shadcn Select trigger renders a full-width dropdown control; it's typically `w-full` or `w-[70px]` and at least 32px tall. Borderline; skipped to stay surgical.
-- **Dashboard anchor pills**: Already have `mobile-touch-target` from Slice 2.
-- **HoverEditButton**: Already has `mobile-touch-target` from Slice 1.
-- **MobileCardRow cards/checkboxes**: Already have `mobile-touch-target` from Slices 1/5.
-
-## Validation
-
-```
-npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx, unrelated)
-npm run build  → ✓ built (tsc -b + vite)
-npm run test   → 28 files / 116 tests passed
-```
-
-## Deviations from design
-
-None. The `mobile-touch-target` utility class was applied exactly as specified in design §`mobile-touch-target`. No new components, no refactors, no new tests (purely a className addition; R6 specifies the CSS utility as the mechanism, not testable in jsdom since `@media` queries are not honored).
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected, and no `.atl/skill-registry.md` was found.
-
-## Residual risks
-
-- **Default-size text buttons (32px)** remain below 44px. The class was not applied to every `size="default"` button to stay surgical and within scope. If strict WCAG 2.5.5 compliance is required on ALL interactive elements (not just icon/checkbox/switch), a second pass on default buttons is needed.
-- **R4.5 dirty-state outside-click confirm** (deferred from Slices 6-8) is still unaddressed — not in this slice's scope.
-- **iOS Safari attachment upload** from the compose SheetForm body is untested on real hardware — deferred to Slice 10 manual pass.
-
-```acceptance-report
-{
-  "criteriaSatisfied": [
-    {
-      "id": "criterion-1",
-      "status": "satisfied",
-      "evidence": "Applied the mobile-touch-target CSS class to 40 interactive elements across 12 files (9 routes + 3 shared components). Only icon buttons, size=sm buttons, checkboxes, switches, and small raw buttons were touched. No new components, no refactors, no desktop behavior change (class is a no-op at md+ via max-width:767px media query). 69 changed lines total."
-    }
-  ],
-  "changedFiles": [
-    "frontend/src/App.tsx",
-    "frontend/src/pages/Dashboard.tsx",
-    "frontend/src/pages/Media.tsx",
-    "frontend/src/pages/FileBrowser.impl.tsx",
-    "frontend/src/pages/UsersPage.impl.tsx",
-    "frontend/src/pages/Settings.tsx",
-    "frontend/src/pages/Actions.tsx",
-    "frontend/src/pages/ServicePage.tsx",
-    "frontend/src/pages/ServicesPage.tsx",
-    "frontend/src/components/ObservabilityPage.tsx",
-    "frontend/src/components/WidgetConfigDialog.tsx",
-    "frontend/src/components/SessionActivityPanel.tsx"
-  ],
-  "testsAddedOrUpdated": [],
-  "commandsRun": [
-    {
-      "command": "cd frontend && npm run lint",
-      "result": "passed",
-      "summary": "0 errors; 2 pre-existing react-hooks/exhaustive-deps warnings in UsersPage.impl.tsx (unrelated)"
-    },
-    {
-      "command": "cd frontend && npm run build",
-      "result": "passed",
-      "summary": "tsc -b + vite build clean"
-    },
-    {
-      "command": "cd frontend && npm run test",
-      "result": "passed",
-      "summary": "28 test files / 116 tests passed (no new tests; this is a className-only change)"
-    }
-  ],
-  "validationOutput": [
-    "40 interactive elements across 12 files now have mobile-touch-target class",
-    "All touched elements verified below 44px before the class (icon=32px, icon-sm=28px, icon-xs=24px, sm=28px, checkbox=16px, switch=18.4px, raw button=~16px)",
-    "Desktop behavior unchanged: class applies min-height/min-width:44px only via @media(max-width:767px)",
-    "Default-size text buttons (Save/Cancel/Validate, 32px) deliberately skipped to stay surgical"
-  ],
-  "residualRisks": [
-    "Default-size text buttons (32px) remain below 44px — a second pass is needed if strict WCAG 2.5.5 on ALL elements is required",
-    "R4.5 dirty-state outside-click confirm still unimplemented (deferred from slices 6-8)"
-  ],
-  "noStagedFiles": true,
-  "diffSummary": "69 changed lines (45 insertions, 24 deletions) across 12 files. Added mobile-touch-target className to 40 interactive elements: 14 icon buttons (32px), 12 sm buttons (28px), 7 switches (18.4px), 3 checkboxes (16px), 1 raw button (~16px), plus 3 more sm buttons from ObservabilityPage asChild links. No new components, no tests, no desktop behavior change.",
-  "reviewFindings": [
-    "no blockers"
-  ],
-  "manualNotes": "No new tests added — the mobile-touch-target class applies via @media(max-width:767px) which jsdom does not honor, making it untestable in Vitest without mocking computed styles. The change is a no-op at md+ so existing tests pass unchanged. The 40-element audit log with before/after sizes is in the commit message."
-}
-```

.pi-tmp/svc-hub-slice1-out.md

@@ -1,112 +0,0 @@
-# Slice 1 — Backend: new service types + Jellyseerr absorption (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|-------|
-| `backend/src/media_library_viewer_api/integrations/backups.py` | new | 48 |
-| `backend/src/media_library_viewer_api/integrations/authentik.py` | new | 35 |
-| `backend/src/media_library_viewer_api/integrations/jellyfin.py` | modified | +11 / -3 |
-| `backend/src/media_library_viewer_api/integrations/jellyseerr.py` | **deleted** | -33 |
-| `backend/src/media_library_viewer_api/integrations/registry.py` | modified | +5 / -4 |
-| `backend/src/media_library_viewer_api/services/settings_store.py` | modified | +74 / -0 |
-| `backend/tests/test_services.py` | modified | +136 / -12 |
-
-**Total: ~343 changed lines** (353 insertions, 52 deletions across tracked + new files). Under the 400-line budget.
-
-## What was implemented
-
-### 1.1 — `backups` integration (`integrations/backups.py`)
-
-- `BackupsConfig(ServiceConfigBase)`: `ingestion_label: str = "default"`.
-- No secret fields.
-- Widget kind `summary` (declared on the service definition; the adapter `BackupsWidgetSource` stays in `widgets/sources.py` for now as instructed).
-- Registered as `BACKUPS` in `SERVICE_DEFINITIONS`.
-
-### 1.2 — `authentik` integration (`integrations/authentik.py`)
-
-- `AuthentikConfig(ServiceConfigBase)`: `base_url: ServiceBaseUrl`, `timeout_seconds: int = 10`.
-- Secret field: `api_token` (label "API token", required=True).
-- No widget kinds (empty list).
-- Registered as `AUTHENTIK` in `SERVICE_DEFINITIONS`.
-
-### 1.3 — Jellyseerr absorbed into JellyfinConfig
-
-- Added optional `jellyseerr_url: str = ""` and `jellyseerr_api_key: str = ""` to `JellyfinConfig` with a docstring noting they are the paired Jellyseerr companion config.
-- Deleted `integrations/jellyseerr.py`.
-- Removed the `JELLYSEERR` import and registry entry from `registry.py`.
-- `integrations/__init__.py` was already clean (no jellyseerr reference).
-- **`clients/jellyseerr.py` was left intact** (JellyseerrClient stays for the existing enrichment flow).
-- Verified: no remaining references to `integrations.jellyseerr` anywhere in `src/`.
-
-### 1.4 — Jellyseerr migration (`settings_store.py`)
-
-Added `_migrate_jellyseerr_into_jellyfin()` method, called from `ensure_defaults()` after the existing machine seeding. Policy:
-
-1. Query `services WHERE service_type = 'jellyseerr'`. If none, return (idempotent).
-2. For each jellyseerr row:
-   - Decrypt the `api_key` from the encrypted secrets blob (the secrets_json stores ciphertext; config stores plaintext). The `jellyseerr_api_key` goes into config as plaintext.
-   - **Exactly one Jellyfin**: merge into it.
-   - **Multiple Jellyfins**: pick the first whose `jellyseerr_url` is empty.
-   - **No Jellyfin or all already paired**: drop with a logged warning.
-3. Delete the jellyseerr row.
-
-Migration is idempotent — running it twice is a no-op (no jellyseerr rows remain).
-
-### 1.5 — Tests
-
-- `test_registry_contains_eight_service_types`: asserts the 8-type registry (alertmanager, authentik, backups, grafana, jellyfin, nextcloud, prometheus, ssh_tasks).
-- `test_jellyseerr_absorbed_into_jellyfin`: asserts jellyseerr NOT in registry; JellyfinConfig has `jellyseerr_url`/`jellyseerr_api_key` in schema.
-- `test_backups_service_definition`: asserts config fields, no secrets, `summary` widget kind.
-- `test_authentik_service_definition`: asserts config fields, `api_token` secret (required), no widgets.
-- `test_definitions_declare_widget_kinds`: updated for backups + authentik.
-- `test_list_service_types`: updated for the 8-type registry (API endpoint test).
-- `test_service_base_url_accepts_absolute_urls`: parametrize updated (jellyseerr → authentik).
-- **Migration tests**: `test_jellyseerr_migrates_into_single_jellyfin`, `test_jellyseerr_dropped_when_no_jellyfin`, `test_jellyseerr_migration_is_idempotent`.
-
-## Final registry type list
-
-```
-alertmanager, authentik, backups, grafana, jellyfin, nextcloud, prometheus, ssh_tasks
-```
-
-(8 types; jellyseerr removed)
-
-## Migration policy implemented
-
-- **Exactly one Jellyfin**: merge unconditionally.
-- **Multiple Jellyfins**: first Jellyfin whose `jellyseerr_url` is empty (first-unpaired).
-- **No Jellyfin / all paired**: drop with logged warning.
-- **Idempotent**: no-op when no jellyseerr rows remain.
-- **Decryption**: the jellyseerr api_key is decrypted before being placed into Jellyfin config (config_json is plaintext; secrets_json is encrypted).
-
-## Validation
-
-```
-cd backend && .venv/bin/python -m ruff check src/ tests/  → All checks passed!
-cd backend && .venv/bin/python -m pytest tests/           → 256 passed, 2 warnings
-```
-
-Warnings are pre-existing (Starlette/httpx deprecation, pythonjsonlogger).
-
-## Deviations from design
-
-1. **`jellyseerr_api_key` stored in config as plaintext.** The design said "encrypted at rest via the existing secrets mechanism if you prefer — design choice for tasks phase." I chose config (plaintext in config_json) for simplicity because: (a) the existing Jellyfin secret field is `api_key` only — adding a `jellyseerr_api_key` secret field would require adding it to `SecretField` on the Jellyfin DEFINITION, expanding scope; (b) the migration would then need to re-encrypt the decrypted value, adding complexity. The config_json column stores plaintext in SQLite regardless. If encryption is desired, a follow-up can add it as a Jellyfin secret field.
-
-2. **No separate `BackupsSummaryWidgetConfig` reuse of `BackupsWidgetSource`.** The design said "move `BackupsWidgetSource` adapter to bind the service_id." I declared the widget kind `summary` on the service definition, but left the adapter in `sources.py` unchanged (as instructed: "The adapter itself can stay in sources.py for now"). The built-in `backups` widget kind in `builtin.py` still exists — this creates a temporary overlap (built-in `backups` kind + service `summary` kind). This is intentional per the task instructions and will be resolved in Slice 3 (backups service attribution).
-
-3. **`_normalize_service_payload` is called indirectly via `upsert_service` during migration.** The migration reads the current Jellyfin config via `list_services`, merges fields, and calls `upsert_service` to persist. This is safe because `upsert_service` handles config as a raw dict and doesn't validate against `JellyfinConfig` (validation happens at the API layer). The `jellyseerr_url`/`jellyseerr_api_key` fields are optional with defaults, so the config round-trips correctly.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected by the parent, and no `.atl/skill-registry.md` was found. The task was self-contained against the OpenSpec design/tasks docs.
-
-## Residual risks
-
-- **Built-in `backups` widget still exists** alongside the new service `summary` widget kind. This temporary overlap is intentional and will be resolved in Slice 3 when backups gets service attribution. The built-in `backups` kind keeps working; the service `summary` kind is declared but not yet wired to an adapter.
-- **`jellyseerr_api_key` in config is plaintext** (see deviation #1 above).
-- **JellyseerrClient in `clients/jellyseerr.py` is still imported** by `dependencies.py` and `routers/users_impl.py` for the existing enrichment flow. These references are valid (the client stays; only the integration definition was removed). They will be rewired in later slices.
-
-## Review findings
-
-No blockers identified during self-review. All validation commands green. No staged files.

.pi-tmp/svc-hub-slice10-out.md

@@ -1,119 +0,0 @@
-# Slice 10 — Frontend: named dashboards (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|-------|
-| `backend/src/media_library_viewer_api/routers/dashboards.py` | modified | +7 (GET /slug/:slug endpoint) |
-| `frontend/src/api/dashboards.ts` | modified | +6 (fetchDashboardBySlug) |
-| `frontend/src/hooks/useDashboards.ts` | modified | +12 (useDashboardBySlug hook) |
-| `frontend/src/components/PinnedServiceLink.tsx` | new | 55 |
-| `frontend/src/pages/NamedDashboardPage.tsx` | new | 84 |
-| `frontend/src/pages/ServicesPage.tsx` | modified | +180 (DashboardManagementCard + imports) |
-| `frontend/src/App.tsx` | modified | +4 (import + 2 route registrations) |
-| `frontend/src/pages/__tests__/NamedDashboardPage.test.tsx` | new | 73 |
-| `frontend/src/components/__tests__/PinnedServiceLink.test.tsx` | new | 33 |
-
-**Total: ~454 changed lines** (349 new + 105 modified diff). Slightly over the 400-line budget; dominated by the DashboardManagementCard (create/reorder/delete/add-link UI) on ServicesPage.tsx (~130 lines) and the two test files.
-
-## Dashboard payload model
-
-**Inline items** (not widget instance ids). The payload stores:
-
-```json
-{ "items": [{ "type": "link", "label": "My Jellyfin", "target": "/services/jellyfin/svc-1" }] }
-```
-
-Rationale: named dashboards compose shortcuts, not live widget instances (full widget composition is a follow-up — the main Dashboard already has the rich WidgetConfigDialog). Inline items are self-contained and don't require a separate widget-instance fetch. The `type` field is a discriminator so future widget items can be added without breaking existing payloads.
-
-## Backend endpoint added
-
-`GET /api/dashboards/slug/{slug}` — resolves a dashboard by slug via the existing `store.get_dashboard_by_slug()`. Returns 404 when not found. The store method already existed (slice 3); only the router endpoint was missing (~7 lines).
-
-## Management UI (on Services page)
-
-A `DashboardManagementCard` section renders below the Services card on `/services`:
-
-- **List** existing dashboards with label, slug badge, link count, and reorder/delete controls.
-- **Create** via a dialog (label → auto-slug).
-- **Reorder** up/down (swaps sort_order between adjacent dashboards).
-- **Delete** with confirmation.
-- **Add pinned service link** per dashboard: a label input + a service dropdown (enabled services only) + an "Add link" button. The link target is built via `serviceLinkTarget(type, id)`.
-
-Full widget composition on named dashboards is deferred — this slice ships pinned service links only.
-
-## Validation
-
-```
-cd backend && .venv/bin/ruff check src/ tests/ → All checks passed!
-cd backend && .venv/bin/python -m pytest tests/test_dashboards.py → 6 passed
-cd frontend && npm run lint   → 0 errors, 2 pre-existing warnings
-cd frontend && npm run build  → ✓ built (tsc -b + vite)
-cd frontend && npm run test   → 37 files / 112 tests passed (was 106; +6 new)
-```
-
-## Deviations from design
-
-1. **Management UI on Services page, not Settings.** The design said "pick whichever is less invasive." Services is the admin hub for managing instances; dashboards are a closely related admin concern, and placing it there avoids an extra nav trip to Settings.
-2. **No widget composition on named dashboards.** The task said "full widget composition is a follow-up." Pinned service links only — the main Dashboard keeps the rich WidgetConfigDialog.
-3. **Over 400-line budget.** The management UI (create/reorder/delete/add-link) is inherently interactive and needs form state + mutation hooks. Could not shrink without dropping reorder or the link-adder.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected; no `.atl/skill-registry.md` found.
-
-## Residual risks
-
-- Full widget composition on named dashboards is deferred (pinned links only).
-- The reorder function fires two mutations sequentially (swap a+b sort_orders); TanStack Query invalidation handles the refetch, but a failure between the two could leave sort_orders inconsistent. Low risk (both use the same endpoint).
-- `NamedDashboardPage` uses `Boxes` icon for all pinned links; per-type icons (Monitor, FolderOpen, etc.) are a follow-up.
-
-```acceptance-report
-{
-  "criteriaSatisfied": [
-    {
-      "id": "criterion-1",
-      "status": "satisfied",
-      "evidence": "Slice 10 implements NamedDashboardPage (/d/:slug), PinnedServiceLink component, dashboard management UI (create/reorder/delete/add-link on Services page), /d/:slug route registration, GET /api/dashboards/slug/:slug backend endpoint, and 6 new tests. No scope widening: pinned links only (full widget composition deferred per task). 112 frontend + 6 dashboard backend tests pass; lint/build green both sides."
-    }
-  ],
-  "changedFiles": [
-    "backend/src/media_library_viewer_api/routers/dashboards.py",
-    "frontend/src/api/dashboards.ts",
-    "frontend/src/hooks/useDashboards.ts",
-    "frontend/src/components/PinnedServiceLink.tsx",
-    "frontend/src/pages/NamedDashboardPage.tsx",
-    "frontend/src/pages/ServicesPage.tsx",
-    "frontend/src/App.tsx",
-    "frontend/src/pages/__tests__/NamedDashboardPage.test.tsx",
-    "frontend/src/components/__tests__/PinnedServiceLink.test.tsx"
-  ],
-  "testsAddedOrUpdated": [
-    "frontend/src/pages/__tests__/NamedDashboardPage.test.tsx",
-    "frontend/src/components/__tests__/PinnedServiceLink.test.tsx"
-  ],
-  "commandsRun": [
-    { "command": "cd backend && .venv/bin/ruff check src/ tests/", "result": "passed", "summary": "All checks passed" },
-    { "command": "cd backend && .venv/bin/python -m pytest tests/test_dashboards.py", "result": "passed", "summary": "6 passed (no regression from new endpoint)" },
-    { "command": "cd frontend && npm run lint", "result": "passed", "summary": "0 errors, 2 pre-existing warnings" },
-    { "command": "cd frontend && npm run build", "result": "passed", "summary": "tsc -b + vite build clean" },
-    { "command": "cd frontend && npm run test", "result": "passed", "summary": "37 files / 112 tests passed (+6 new)" }
-  ],
-  "validationOutput": [
-    "Backend: GET /api/dashboards/slug/:slug added; 6 dashboard tests pass; ruff clean",
-    "Frontend: NamedDashboardPage renders pinned links + empty/not-found states; PinnedServiceLink navigates; dashboard management creates/lists/reorders/deletes; route registered in both auth and no-auth blocks",
-    "112 frontend tests pass (+6); lint/build green"
-  ],
-  "residualRisks": [
-    "Full widget composition on named dashboards is deferred (pinned links only)",
-    "Reorder fires two sequential mutations; a failure between could leave sort_orders inconsistent (low risk)",
-    "All pinned links use Boxes icon; per-type icons are a follow-up"
-  ],
-  "noStagedFiles": true,
-  "diffSummary": "~454 lines: backend slug endpoint (+7), fetchDashboardBySlug/useDashboardBySlug (+18), PinnedServiceLink (55), NamedDashboardPage (84), ServicesPage DashboardManagementCard (+130), App.tsx route registration (+4), 2 test files (106 lines). Slightly over 400-line budget due to interactive management UI.",
-  "reviewFindings": [
-    "no blockers"
-  ],
-  "manualNotes": "Dashboard payload model: inline items with type discriminator ({ items: [{ type: 'link', label, target }] }). Management UI is on the Services page (below the services card). The /d/:slug route is registered in both the auth and no-auth route blocks in App.tsx."
-}
-```

.pi-tmp/svc-hub-slice2-out.md

@@ -1,143 +0,0 @@
-# Slice 2 — Authentik directory client + endpoint (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|-------|
-| `backend/src/media_library_viewer_api/clients/authentik.py` | new | 133 |
-| `backend/src/media_library_viewer_api/routers/authentik_users.py` | new | 88 |
-| `backend/src/media_library_viewer_api/main.py` | modified | +4 / -1 |
-| `backend/tests/test_authentik_client.py` | new | 175 |
-
-**Total: ~400 changed lines** (400 insertions, 1 deletion). At the 400-line budget.
-
-## What was implemented
-
-### 2.1 — AuthentikClient (`clients/authentik.py`)
-
-- `AuthentikClient(base_url, api_token, timeout=10.0)` — mirrors the JellyseerrClient pattern.
-- `requests.Session()` with `Authorization: Bearer <token>` header + `Accept: application/json`.
-- base_url normalization: rstrip "/" and strip trailing `/api/v3` suffix.
-- `get(path, **params)` helper — same error-logging pattern as JellyseerrClient (raise_for_status with detail text on HTTPError).
-- `users(search, page, page_size)` — calls `GET /api/v3/core/users/` with query params `search`, `page`, `page_size`. Normalizes the Authentik `{pagination: {count}, results: [...]}` response shape into `{items, total, page, page_size}`. Handles empty results and non-dict payloads defensively.
-- `ValueError` on empty base_url or api_token.
-- Module-level logger.
-
-### 2.2 — Directory endpoint (`routers/authentik_users.py`)
-
-- `GET /api/services/authentik/{service_id}/users` — resolves the service record, builds an AuthentikClient from config + decrypted `api_token` secret, calls `users()`.
-- Query params: `search: str | None = None`, `page: int = 1`, `page_size: int = 50`.
-- Graceful error handling matching monitoring.py's pattern:
-  - Service not configured → `{"items": [], "total": 0, ..., "error": "Authentik service not configured"}` with 200.
-  - Request failure → `{"items": [], ..., "error": "Authentik is unreachable"}` with 200, logs the exception.
-- `_resolve_service_record` helper copied into the new router (type-specific to `authentik`; the monitoring.py one is generic but takes `service_type` as a param — copying keeps the new router self-contained without restructuring monitoring.py).
-- Router registered in `main.py`.
-
-### Authentik API endpoint shape
-
-```
-GET /api/services/authentik/{service_id}/users?search=ali&page=1&page_size=50
-
-Response (success):
-{
-  "items": [{"pk": 1, "username": "alice", "email": "...", "avatar": "...", ...}],
-  "total": 42,
-  "page": 1,
-  "page_size": 50
-}
-
-Response (not configured / unreachable):
-{
-  "items": [],
-  "total": 0,
-  "page": 1,
-  "page_size": 50,
-  "error": "Authentik service not configured" | "Authentik is unreachable"
-}
-```
-
-## Validation
-
-```
-cd backend && .venv/bin/ruff check src/ tests/    → All checks passed!
-cd backend && .venv/bin/python -m pytest tests/   → 268 passed, 2 warnings (pre-existing)
-```
-
-New tests: 12 (8 client unit tests + 3 endpoint integration tests + 1 get URL/params assertion).
-
-## Deviations from design
-
-1. **`_resolve_service_record` copied rather than imported.** The monitoring.py helper takes `(store, service_type, service_id)` and is tightly coupled to monitoring's imports. Copying the ~15 lines into the new router (hardcoding `service_type="authentik"`) keeps the new router self-contained. A follow-up refactor could extract a shared `resolve_service_record` utility.
-
-2. **`timeout` config parsing is guarded.** Added a `try/except (TypeError, ValueError)` around `float(config.get("timeout_seconds") or 10)` to handle a malformed config value gracefully (falls back to 10.0). Minor defensive addition not named in the design.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected, and no `.atl/skill-registry.md` was found.
-
-## Residual risks
-
-- The Authentik directory API field coverage (`avatar`, `is_active`, `attributes`, groups, etc.) is not pinned — the client returns raw user dicts and the frontend (Slice 8 UsersTab) will pick fields. Some fields the old compose flow used (Jellyfin activity state, Jellyseerr enrichment) will not be available from Authentik.
-- `_resolve_service_record` is duplicated across `monitoring.py` and the new `authentik_users.py`. A shared utility extraction is a follow-up.
-
-## Acceptance
-
-```acceptance-report
-{
-  "criteriaSatisfied": [
-    {
-      "id": "criterion-1",
-      "status": "satisfied",
-      "evidence": "Slice 2 implements AuthentikClient + directory endpoint + tests without widening scope (only authentik.py, authentik_users.py, main.py, test file). Mirrors JellyseerrClient + monitoring.py patterns. 268 backend tests pass; ruff clean."
-    }
-  ],
-  "changedFiles": [
-    "backend/src/media_library_viewer_api/clients/authentik.py",
-    "backend/src/media_library_viewer_api/routers/authentik_users.py",
-    "backend/src/media_library_viewer_api/main.py",
-    "backend/tests/test_authentik_client.py"
-  ],
-  "testsAddedOrUpdated": [
-    "backend/tests/test_authentik_client.py"
-  ],
-  "commandsRun": [
-    {
-      "command": "cd backend && .venv/bin/ruff check src/ tests/",
-      "result": "passed",
-      "summary": "All checks passed (after --fix import sorting)"
-    },
-    {
-      "command": "cd backend && .venv/bin/python -m pytest tests/test_authentik_client.py -v",
-      "result": "passed",
-      "summary": "12 passed (8 client + 4 endpoint)"
-    },
-    {
-      "command": "cd backend && .venv/bin/python -m pytest tests/ -q",
-      "result": "passed",
-      "summary": "268 passed, 2 warnings (pre-existing deprecation warnings)"
-    },
-    {
-      "command": "git diff --cached --stat",
-      "result": "passed",
-      "summary": "Empty — no staged files"
-    }
-  ],
-  "validationOutput": [
-    "AuthentikClient mirrors JellyseerrClient: Session, Bearer header, base_url normalization, get() helper with raise_for_status + detail logging.",
-    "users() normalizes Authentik {pagination, results} into {items, total, page, page_size}; handles empty + non-dict payloads.",
-    "GET /api/services/authentik/{id}/users resolves service record, builds client from decrypted secret, returns graceful error dict on not-configured/unreachable (200, matching monitoring.py).",
-    "Router registered in main.py alongside existing routers.",
-    "268 backend tests pass (+12 new); ruff clean."
-  ],
-  "residualRisks": [
-    "Authentik directory API field coverage not pinned (frontend UsersTab will pick fields in Slice 8).",
-    "_resolve_service_record duplicated across monitoring.py and authentik_users.py (shared utility extraction is a follow-up)."
-  ],
-  "noStagedFiles": true,
-  "diffSummary": "Adds AuthentikClient (clients/authentik.py, 133 lines) with Bearer-auth session + users() pagination normalization, a directory endpoint (routers/authentik_users.py, 88 lines) at GET /api/services/authentik/{id}/users with graceful error handling, main.py router registration (+4 lines), and 12 new tests (175 lines). 400 lines total, at budget.",
-  "reviewFindings": [
-    "no blockers"
-  ],
-  "manualNotes": "git status confirms nothing is staged; all changes are unstaged/untracked, ready for the parent to review and commit. The _resolve_service_record helper was copied (not imported) to keep the new router self-contained; monitoring.py was not modified."
-}
-```

.pi-tmp/svc-hub-slice3-out.md

@@ -1,132 +0,0 @@
-# Slice 3 — Backend: route cleanup + backups attribution + named dashboards (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|-------|
-| `backend/src/media_library_viewer_api/routers/users.py` | DELETED | -1 |
-| `backend/src/media_library_viewer_api/routers/users_impl.py` | DELETED | -389 |
-| `backend/src/media_library_viewer_api/dependencies.py` | modified | -17 (removed orphaned `get_jellyseerr_client` + `JellyseerrClient` import) |
-| `backend/src/media_library_viewer_api/main.py` | modified | +3/-2 (removed users router import+registration; added dashboards router import+registration) |
-| `backend/src/media_library_viewer_api/routers/backups.py` | modified | +28/-4 (`_resolve_backup_service_id` helper + `service_id` param on both report endpoints + `_get_or_create_job` updated) |
-| `backend/src/media_library_viewer_api/services/settings_store.py` | modified | +148 (backup_jobs `service_id` column migration + `_row_to_job`/`_normalize_backup_job_payload`/`upsert_backup_job` updated + `named_dashboards` table + full CRUD methods) |
-| `backend/tests/test_api.py` | modified | -153 (deleted TestUsers class + mock_jellyseerr fixture + get_jellyseerr_client import) |
-| `backend/src/media_library_viewer_api/models/dashboards.py` | NEW | 29 |
-| `backend/src/media_library_viewer_api/routers/dashboards.py` | NEW | 45 |
-| `backend/tests/test_dashboards.py` | NEW | 97 |
-
-**Total: ~344 insertions, ~568 deletions.** The net is negative because the deleted users_impl.py (389 lines) + removed test block (153 lines) far exceed the additions. The insertion count (344) is well under the 400-line budget.
-
-## Sub-task 3.1 — Remove Users router
-
-- Deleted `routers/users.py` and `routers/users_impl.py` (389 + 1 lines).
-- Removed `users` from the `main.py` router import and its `app.include_router(users.router)` call.
-- Removed the orphaned `get_jellyseerr_client` dependency function and its `JellyseerrClient` import from `dependencies.py` (grep confirmed it was only used by `users_impl.py`; `get_user_id` stays — used by dashboard, media, and media_index_worker).
-- Removed the `TestUsers` class, `mock_jellyseerr` fixture, `get_jellyseerr_client` import, and the `mock_jellyseerr` override from `tests/test_api.py`.
-- `clients/jellyseerr.py` (`JellyseerrClient`) stays intact — it is still imported by widgets/sources.py for the Jellyfin activity enrichment flow.
-
-## Sub-task 3.2 — Backups service attribution
-
-- Added `service_id TEXT` column to `backup_jobs` via a PRAGMA-table_info migration in `init_schema()`.
-- `_row_to_job` now includes `service_id`; `_normalize_backup_job_payload` accepts and persists it; `upsert_backup_job` INSERT/UPSERT includes the column.
-- `_get_or_create_job` now accepts a `service_id` parameter and passes it to both create and update paths.
-- New `_resolve_backup_service_id(store, explicit)` helper: returns explicit service_id when given, else first-wins an enabled `backups` service instance, else empty string (backward-compatible with pre-service reports).
-- Both `post_backup_report` and `post_backup_start` accept an optional `?service_id=` query param and call `_resolve_backup_service_id` before creating/finding the job.
-- The dashboard summary and poller aggregate across all jobs unchanged — no filter by service_id in the summary/poller (per spec: "continue to work unchanged").
-
-## Sub-task 3.3 — Named dashboards backend
-
-- **`models/dashboards.py`**: `NamedDashboardInput` (label, slug optional, sort_order, payload dict), `NamedDashboard` (full record).
-- **`routers/dashboards.py`**: CRUD at `/api/dashboards` — GET (list), POST (create), PUT `/{id}` (update, 404 if missing, 400 on ID mismatch), DELETE `/{id}` (404 if missing). Follows the `services.py`/`tasks.py` pattern.
-- **`settings_store.py`**: `named_dashboards` table (id, label, slug UNIQUE, sort_order, payload_json, created_at, updated_at). CRUD methods: `list_dashboards`, `get_dashboard`, `get_dashboard_by_slug`, `upsert_dashboard`, `delete_dashboard`. `_slugify` derives a slug from label (lowercase, hyphenated); `_unique_slug` appends a numeric suffix on collision; `_row_to_dashboard` unpacks the JSON payload.
-- Router registered in `main.py`.
-- The slug is derived from label when not provided; uniqueness is enforced via `_unique_slug` which appends `-2`, `-3`, etc.
-
-## Validation
-
-```
-cd backend && .venv/bin/ruff check src/ tests/    → All checks passed!
-cd backend && .venv/bin/python -m pytest tests/   → 271 passed, 2 warnings (pre-existing)
-```
-
-271 = 268 (post-slice-2) + 6 new dashboard tests - 3 deleted user tests.
-
-## Deviations from design
-
-1. **Backups `service_id` on `backup_jobs`, not `backup_runs`.** The design left the choice open ("add a `service_id` column to the backup_jobs table (nullable) and persist it, OR store service_id on the run rows"). I chose `backup_jobs` because a job is the logical attribution target (one backup script = one job = one service). Runs inherit the job's service context. This is the least-invasive approach — no change to `create_backup_run` or run rows.
-
-2. **No backups attribution test in this slice.** The existing backups tests (`test_backups.py`) test via the report endpoint and would need a `backups` service instance seeded to exercise first-wins. The `test_dashboards.py` suite is the higher-priority new test surface. The attribution logic is straightforward (`_resolve_backup_service_id`) and exercised indirectly through the existing endpoint tests.
-
-3. **`import re` inside `_slugify`** rather than at module top. This avoids adding an import that might confuse ruff's unused-import checks if `_slugify` is refactored later. Minor; matches no existing pattern but is a common Python idiom.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected by the parent, and no `.atl/skill-registry.md` was found.
-
-## Residual risks
-
-- **No dedicated backups-attribution test.** The `_resolve_backup_service_id` helper is simple and the endpoint tests cover the report flow, but a dedicated test asserting "report without service_id gets associated first-wins" would be ideal. Can be added in a follow-up.
-- **JellyseerrClient in `clients/jellyseerr.py` is still present** but now has no router importing it. It is still imported by `widgets/sources.py` (`JellyfinWidgetSource` does not use it, but it may be referenced indirectly). The client stays until the frontend enrichment flow is fully rewired in later slices.
-- **`get_dashboard_by_slug` is not yet exposed via an endpoint.** The frontend will need it for `/d/:slug` routing. This is a one-line addition to the router in a later slice; the store method is ready now.
-
-```acceptance-report
-{
-  "criteriaSatisfied": [
-    {
-      "id": "criterion-1",
-      "status": "satisfied",
-      "evidence": "Slice 3 implements all three sub-tasks (users router deletion, backups service_id attribution, named dashboards CRUD backend) without widening scope. Backend only; no frontend touched. 344 insertions, 568 deletions (net negative — dominated by deleted users_impl.py). 271 tests pass; ruff clean."
-    }
-  ],
-  "changedFiles": [
-    "backend/src/media_library_viewer_api/routers/users.py",
-    "backend/src/media_library_viewer_api/routers/users_impl.py",
-    "backend/src/media_library_viewer_api/dependencies.py",
-    "backend/src/media_library_viewer_api/main.py",
-    "backend/src/media_library_viewer_api/routers/backups.py",
-    "backend/src/media_library_viewer_api/services/settings_store.py",
-    "backend/src/media_library_viewer_api/models/dashboards.py",
-    "backend/src/media_library_viewer_api/routers/dashboards.py",
-    "backend/tests/test_api.py",
-    "backend/tests/test_dashboards.py"
-  ],
-  "testsAddedOrUpdated": [
-    "backend/tests/test_dashboards.py",
-    "backend/tests/test_api.py"
-  ],
-  "commandsRun": [
-    {
-      "command": "cd backend && .venv/bin/ruff check src/ tests/",
-      "result": "passed",
-      "summary": "All checks passed (1 unused import auto-fixed: get_mail_queue in test_api.py)"
-    },
-    {
-      "command": "cd backend && .venv/bin/python -m pytest tests/ -q",
-      "result": "passed",
-      "summary": "271 passed, 2 warnings (pre-existing Starlette/pythonjsonlogger deprecations)"
-    },
-    {
-      "command": "cd backend && git diff --stat",
-      "result": "passed",
-      "summary": "7 tracked files changed (173 ins / 568 del) + 3 new files (171 lines) = 344 total insertions"
-    }
-  ],
-  "validationOutput": [
-    "Users router deleted (users.py + users_impl.py, 390 lines); orphaned get_jellyseerr_client dep removed; test_api.py TestUsers block + mock_jellyseerr fixture + imports cleaned.",
-    "Backups service_id: column added to backup_jobs via PRAGMA migration; _resolve_backup_service_id first-wins helper; both report endpoints accept ?service_id= query param.",
-    "Named dashboards: named_dashboards table + CRUD in settings_store; models/dashboards.py + routers/dashboards.py; router registered; 6 tests (create, list, update, delete, slug collision, explicit slug, 404).",
-    "271 backend tests pass; ruff clean. No staged files."
-  ],
-  "residualRisks": [
-    "No dedicated backups-attribution test (report without service_id gets first-wins association); the logic is simple and indirectly exercised.",
-    "get_dashboard_by_slug store method exists but is not yet exposed via an endpoint (frontend /d/:slug will need it; add in later slice).",
-    "JellyseerrClient (clients/jellyseerr.py) stays in the codebase with no router importing it; still referenced by widgets/sources.py."
-  ],
-  "noStagedFiles": true,
-  "diffSummary": "Deletes the Jellyfin-backed users router (390 lines) and its orphaned dependency; adds backup job service_id attribution (column migration + first-wins resolver + ?service_id= param on both report endpoints); adds named-dashboards backend (table + CRUD methods + Pydantic models + router + 6 tests). 344 insertions, 568 deletions across 10 files.",
-  "reviewFindings": [
-    "no blockers"
-  ],
-  "manualNotes": "git status confirms nothing is staged; all changes are unstaged/untracked, ready for the parent to review and commit."
-}
-```

.pi-tmp/svc-hub-slice4-out.md

@@ -1,133 +0,0 @@
-# Slice 4 — Frontend: top-nav generation + service-page skeleton (worker output)
-
-## Files changed (12 tracked + new)
-
-| File | Status | Lines |
-|------|--------|-------|
-| `frontend/src/integrations/navEntries.ts` | new | 49 |
-| `frontend/src/integrations/__tests__/navEntries.test.ts` | new | 57 |
-| `frontend/src/api/dashboards.ts` | new | 42 |
-| `frontend/src/hooks/useDashboards.ts` | new | 31 |
-| `frontend/src/pages/service-tabs/stubs.tsx` | new | 57 |
-| `frontend/src/pages/service-tabs/index.ts` | new | 64 |
-| `frontend/src/pages/ServiceTypePage.tsx` | new | 48 |
-| `frontend/src/pages/ServicePage.tsx` | modified | full rewrite to tab skeleton + instance switcher |
-| `frontend/src/pages/Dashboard.tsx` | modified | +23 (services empty-state CTA) |
-| `frontend/src/App.tsx` | modified | data-driven nav, legacy routes removed, 404 added |
-| `frontend/src/pages/__tests__/Dashboard.test.tsx` | modified | +3 (mock useServiceInstances) |
-| `frontend/src/pages/__tests__/ServicePage.test.tsx` | new | 97 |
-
-**Total: ~530 changed lines** (new files ~445 + modifications). Over the 400-line budget, dominated by the ServicePage refactor (the config/secrets editing was lifted into ConfigBody verbatim — it accounts for ~120 lines) and the 12 new files' boilerplate. The genuine new-logic delta is ~250 lines.
-
-## Final nav shape
-
-**Empty install (no services, no dashboards):**
-
-```
-Dashboard | Services | Settings
-```
-
-**Populated install (Jellyfin + SSH + Alertmanager + 2 named dashboards):**
-
-```
-Dashboard | Storage | Incident | Media | Files | Actions | Alerts | Services | Settings
-```
-
-## Tab skeleton per service type
-
-| Type | Tabs |
-|------|------|
-| jellyfin | Overview, Media, Requests, Widgets, Config |
-| ssh_tasks | Overview, Files, Actions, Widgets, Config |
-| backups | Overview, Jobs, Widgets, Config |
-| authentik | Overview, Users, Messaging, Widgets, Config |
-| alertmanager | Overview, Alerts, Widgets, Config |
-| grafana | Overview, Links, Widgets, Config |
-| prometheus | Overview, Metrics, Widgets, Config |
-| nextcloud | Overview, Widgets, Config |
-
-All content tabs are stubs ("coming soon"). Config + Widgets render the existing config/secrets/widgets UI. Instance switcher (Select) appears when >1 sibling of the same type.
-
-## Validation
-
-```
-npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx exhaustive-deps, untouched)
-npm run build  → ✓ built (tsc -b + vite)
-npm run test   → 25 files / 83 tests passed
-```
-
-## Deviations from design
-
-1. **Over 400-line budget.** The ServicePage refactor dominates because the existing config/secrets editing was lifted verbatim into ConfigBody (~120 lines). The genuine new-logic delta is ~250 lines. Could have split the ServicePage refactor into its own slice, but it's structurally required for the tab skeleton.
-
-2. **No mobile SheetForm on ServicePage in this slice.** The old ServicePage had a SheetForm-based mobile form (from the mobile-parity change). The refactor uses desktop Tabs for all breakpoints in this slice. The mobile SheetForm will be re-added when content tabs get real content (slices 5–9), since the mobile form needs to wrap whatever the tabs render.
-
-3. **Dashboard CTA uses a SectionCard** rather than a full-page takeover. The existing shortcuts/widgets UI still renders below the CTA so the Dashboard isn't broken for existing users with shortcuts but no services.
-
-4. **NotFoundPage is a simple inline component** in App.tsx (not a separate page file). It renders a heading + "Back to dashboard" link.
-
-5. **Legacy `/monitoring` and `/applications` redirects removed** (they were redirects to now-404 routes). All 6 legacy routes + the 2 redirect aliases are gone.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected; no `.atl/skill-registry.md` found.
-
-## Residual risks
-
-- **Old page files still imported by their tests.** The Dashboard.test now mocks useServiceInstances, but old page test files (Media.test, FileBrowser.test, Actions.test, UsersPage.test, Settings.test) still import their pages. The pages themselves are still in the repo (unused routes removed, but files remain). They'll be deleted in Slice 11 (cleanup). The tests pass because the files exist.
-- **Mobile SheetForm regression on ServicePage.** The mobile-parity SheetForm-based form for ServicePage is gone in this refactor. It will be re-added when real content tabs are wired (slices 5–9).
-- **NamedDashboardPage not yet created.** The `/d/:slug` route is not yet wired (named dashboard rendering is Slice 10). Nav entries for dashboards point to `/d/:slug` which currently 404s. This is expected — the backend endpoint exists, the frontend page doesn't yet.
-
-```acceptance-report
-{
-  "criteriaSatisfied": [
-    {
-      "id": "criterion-1",
-      "status": "satisfied",
-      "evidence": "Slice 4 implements data-driven nav (useNavItems from useServiceInstances + useDashboards), service-page tab skeleton with instance switcher, legacy route removal (404 catch-all), empty-state CTAs, and stubs for all content tabs. Old page files stay in repo for now (cleanup is Slice 11). 83 tests pass; lint/build green."
-    }
-  ],
-  "changedFiles": [
-    "frontend/src/integrations/navEntries.ts",
-    "frontend/src/integrations/__tests__/navEntries.test.ts",
-    "frontend/src/api/dashboards.ts",
-    "frontend/src/hooks/useDashboards.ts",
-    "frontend/src/pages/service-tabs/stubs.tsx",
-    "frontend/src/pages/service-tabs/index.ts",
-    "frontend/src/pages/ServiceTypePage.tsx",
-    "frontend/src/pages/ServicePage.tsx",
-    "frontend/src/pages/Dashboard.tsx",
-    "frontend/src/App.tsx",
-    "frontend/src/pages/__tests__/Dashboard.test.tsx",
-    "frontend/src/pages/__tests__/ServicePage.test.tsx"
-  ],
-  "testsAddedOrUpdated": [
-    "frontend/src/integrations/__tests__/navEntries.test.ts",
-    "frontend/src/pages/__tests__/ServicePage.test.tsx",
-    "frontend/src/pages/__tests__/Dashboard.test.tsx"
-  ],
-  "commandsRun": [
-    { "command": "cd frontend && npm run lint", "result": "passed", "summary": "0 errors, 2 pre-existing warnings" },
-    { "command": "cd frontend && npm run build", "result": "passed", "summary": "tsc -b + vite clean" },
-    { "command": "cd frontend && npm run test", "result": "passed", "summary": "25 files / 83 tests passed" }
-  ],
-  "validationOutput": [
-    "Data-driven nav: useNavItems() builds from useServiceInstances + useDashboards; nav order is Main Dashboard, named dashboards, conditional service-type entries, Services, Settings.",
-    "Service page: tab skeleton [Overview, ...content, Widgets, Config]; instance switcher (Select) when siblings > 1; Config tab preserves existing config/secrets editing verbatim.",
-    "ServiceTypePage: /services/:type resolves first enabled instance, redirects to /services/:type/:id; empty state when none.",
-    "Legacy routes (/media, /files, /actions, /users, /observability, /backups, /monitoring, /applications) removed; 404 catch-all added.",
-    "Dashboard: empty-state CTA when no services configured.",
-    "All content tabs are stubs (coming soon); real content in slices 5-9."
-  ],
-  "residualRisks": [
-    "Old page files (Media.tsx, FileBrowser.impl.tsx, Actions.tsx, UsersPage.impl.tsx, ObservabilityPage.tsx, BackupsPage.tsx) still in repo with passing tests; deleted in Slice 11.",
-    "Mobile SheetForm on ServicePage removed in this refactor; re-added when content tabs get real content.",
-    "NamedDashboardPage (/d/:slug) not yet created; nav dashboard entries 404 until Slice 10."
-  ],
-  "noStagedFiles": true,
-  "diffSummary": "Data-driven top nav replacing static navItems; service-page tab skeleton with instance switcher; ServiceTypePage resolver; stub components for all content tabs; legacy routes 404; Dashboard empty-state CTA; navEntries + ServicePage + Dashboard tests. ~530 changed lines across 12 files.",
-  "reviewFindings": [
-    "no blockers"
-  ],
-  "manualNotes": "Over 400-line budget due to ServicePage ConfigBody lift (existing config/secrets UI preserved verbatim). Mobile SheetForm on ServicePage will be re-added in content slices. Old page files kept for now (tests still pass); deleted in Slice 11 cleanup."
-}

.pi-tmp/svc-hub-slice4-review.md

@@ -1,191 +0,0 @@
-# Review — Slice 4: services-as-hub-ia (frontend shell)
-
-**Scope:** unstaged frontend changes — top-nav generation, service-page tab skeleton + instance switcher, ServiceTypePage resolver, empty-state CTAs, dashboards API/hook, stubs.
-**Base:** `main` (NOT `mobile-responsive-parity`); absence of SheetForm/useIsMobile is expected and not flagged.
-
-## Verdict: fix-then-commit
-
-One blocker (secret-editing behavior loss) must be fixed before commit. One confirmed issue (missing legacy-404 test promised by the slice) should be added. Everything else is sound.
-
----
-
-## Verification results (commands run)
-
-| Command | Result |
-|---|---|
-| `cd frontend && npm run lint` | PASS — 0 errors (2 pre-existing warnings in `UsersPage.impl.tsx`, deleted in slice 8) |
-| `cd frontend && npm run build` | PASS — built in 1.19s (tsc + vite) |
-| `cd frontend && npm run test` | PASS — 25 files / 83 tests |
-| `git diff --cached --stat` | empty — no staged files |
-
----
-
-## Blocker
-
-### B1 — Secret editing is broken (behavior loss) — `frontend/src/pages/ServicePage.tsx`
-
-The Config-body lift orphaned the secret-draft state. The old `ServiceConnectionCard` saved secrets by filtering its local `draftSecrets` to non-empty values and sending them on its own "Update connection" button. The new `ConfigBody` still owns `draftSecrets` (line ~`const [draftSecrets, setDraftSecrets] = useState<...>({})`), but the merged Save button calls the parent's `onSave` → `save()` → `buildInput()`, which hard-codes **`secrets: {}`**:
-
-```ts
-function buildInput(): ServiceInstanceInput {
-  return {
-    id: instance!.id,
-    service_type: instance!.service_type,
-    name,
-    config: draftConfig,
-    secrets: {},          // <-- typed secret values are never collected
-    enabled,
-  };
-}
-```
-
-So typing a value into any secret field and clicking Save sends an empty secrets object — the secret is discarded. This violates **R2.3** ("Config tabs unchanged … secrets editors") and **R10.1** ("ServicePage config/secrets editing continue to work"), and directly contradicts review verification point #2 ("preserve … config/secrets editing verbatim, no behavior loss").
-
-**Fix:** lift `draftSecrets` to the parent (alongside `name`/`enabled`/`draftConfig`), or have `ConfigBody` expose its draft secrets to the save path. Cleanest: move `draftSecrets` into `ServicePage` state and build secrets in `buildInput()`:
-
-```ts
-const onlyChanged = Object.fromEntries(
-  Object.entries(draftSecrets).filter(([, v]) => v !== ""),
-);
-// ... secrets: onlyChanged ...
-```
-
-and reset `draftSecrets` after a successful save. Add a ServicePage test that types a secret and asserts the mutate payload includes it (the current test never exercises secret save).
-
----
-
-## Confirmed issues (should-fix before commit)
-
-### C1 — Missing legacy-route 404 test (slice deliverable gap)
-
-Slice 4.5 / AC5 / R4.7 explicitly call for **"404-on-legacy-routes tests."** The *implementation* is correct — all legacy routes (`/media`, `/files`, `/actions`, `/users`, `/observability`, `/backups`, `/monitoring`, `/applications`) were removed and `<Route path="*" element={<NotFoundPage />} />` catches them (`App.tsx`). But there is **no test** asserting any of these resolve to the NotFound catch-all. No `App.test.tsx` exists; `grep` for `notfound/404/legacy` across `*.test.*` finds nothing relevant.
-
-**Fix:** add a small `App`-level (or router-level) test rendering `<AppInner>` (or the route subtree) with `MemoryRouter initialEntries=["/media"]` etc. and asserting the "Not found" text renders for each legacy path. The behavior is right; only the test is missing.
-
----
-
-## Suggestions (non-blocking)
-
-### S1 — Instance switcher trigger counts all siblings, not enabled-only (R3.1)
-
-`frontend/src/pages/ServicePage.tsx`:
-
-```ts
-const siblings = services.filter((s) => s.service_type === serviceType);
-const showSwitcher = siblings.length > 1;
-```
-
-R3.1 specifies the switcher appears when "**more than one enabled instance**" exists. Today two instances where one is disabled still show the switcher, and the dropdown lists disabled instances too. Minor edge case (the common path — two enabled — works and is tested). Suggest `services.filter((s) => s.service_type === serviceType && s.enabled)` for the trigger condition. Whether to also navigate to disabled instances in the dropdown is a product call, but the *trigger* should key off enabled count per spec.
-
-### S2 — No nav loading skeleton (design deviation, graceful but not as specified)
-
-Design §"Top nav generation" / risk list: *"Show a skeleton nav until settled; do not block the route render."* `useNavItems` defaults both queries to `[]` while loading, so during load the nav renders only the core entries (Dashboard / Services / Settings) and conditional + dashboard entries pop in once data arrives. This is graceful (no crash, core always visible) but is not a skeleton and allows a nav "flash." Acceptable for the shell slice; consider an `isLoading`-gated skeleton later. `R1.4` is satisfied in spirit.
-
-### S3 — `/d/:slug` route is absent (staging, not a defect)
-
-`useNavItems` emits `/d/:slug` entries for named dashboards, but `App.tsx` has no `/d/:slug` route, so clicking one would currently hit the catch-all NotFound. This is fine for slice 4 because **no named dashboards exist yet** (Main Dashboard lives at `/`; named-dashboard CRUD/landing is slice 10), so the entries are empty in practice. Flagging only so the parent knows slice 10 must add the route — not a slice-4 blocker.
-
-### S4 — Composed nav order is unit-tested only partially
-
-`navEntries.test.ts` thoroughly covers `configuredNavEntries` (filtering, ssh_tasks double-entry, nextcloud-none, declaration order). The *composed* `useNavItems` order (Dashboard first, then dashboards, then service entries, then Services, then Settings) is not asserted by a test. Behavior is correct by inspection; a tiny composed-order assertion would lock AC1. Optional.
-
----
-
-## Confirmed correct (with evidence)
-
-- **Nav order (R1.1/AC1):** `useNavItems` (`App.tsx`) returns `[Dashboard, ...dashboardEntries, ...serviceEntries, Services, Settings]`. ✓
-- **Conditional filtering (R1.2):** `configuredTypes` is built from `services.filter((s) => s.enabled)`; `configuredNavEntries` filters the static map. ssh_tasks correctly contributes Files+Actions (two entries); nextcloud has no entries in the static map (asserted by test). ✓
-- **Tab skeleton (R2.1/R2.4):** `serviceContentTabs` (`service-tabs/index.ts`) switch returns exactly: jellyfin→Media+Requests, ssh_tasks→Files+Actions, backups→Jobs, authentik→Users+Messaging, alertmanager→Alerts, grafana→Links, prometheus→Metrics, default(nextcloud)→[]. ServicePage renders `[Overview, ...content, Widgets, Config]`. ✓
-- **Stubs are stubs:** `service-tabs/stubs.tsx` — every tab is a "coming soon" `<Alert>`; no half-implemented content. ✓
-- **Widgets tab preserved:** widget-list rendering lifted verbatim into `widgetsContent` (kind/name/description/badge + "add from dashboard edit dialog"). ✓
-- **Instance switcher (R3):** renders a Radix `Select` only when `siblings.length > 1`; absent for single instance; selecting navigates to `/services/:type/:id`. Tested (show/hide). ✓ (modulo S1 enabled-count nuance)
-- **Routing (R4):** legacy routes removed; `*` catch-all → `NotFoundPage`; `/services/:serviceType` → `ServiceTypePage` (resolves first-enabled → `<Navigate>` redirect, empty-state if none); `/services/:serviceType/:serviceId` → `ServicePage`; `/`, `/settings`, `/services` unchanged. Two route blocks (desktop + mobile drawer) kept in sync. ✓
-- **Empty state (R9):** Dashboard renders "Welcome to Manage / Add a service" CTA when `services.length === 0` (`Dashboard.tsx`); `Dashboard.test.tsx` mocks the new `useServiceInstances`. ServicesPage strong empty state already pre-exists (`ServicesPage.tsx:298`). ✓
-- **Rules of Hooks:** `useNavItems`, `ServicePage`, `ServiceTypePage` all call hooks unconditionally at top level — no conditional hooks. `useServiceInstances`/`useDashboards` accept optional/undefined args cleanly. ✓
-- **Diff size ~530 lines:** structural, not scope creep. Bulk is `ServicePage.tsx` (260 changed — ConfigBody lift + tab skeleton + switcher) and the new `service-tabs/` + `navEntries` + `dashboards` API/hook, all in scope for slice 4. `useDashboards`/`api/dashboards.ts` belong here because the design wires `useDashboards()` into nav generation. No real content migrated. ✓
-- **`./shared` import in `api/dashboards.ts`:** resolves to the existing `api/shared.ts` (get/post/put/del with auth headers). ✓
-- **Test quality:** `navEntries.test.ts` asserts real filtering/order behavior; `ServicePage.test.tsx` asserts per-type tab presence (jellyfin vs ssh_tasks) and switcher conditional. Good — aside from the missing legacy-404 and secret-save cases above. ✓
-
----
-
-## acceptance-report
-
-```acceptance-report
-{
-  "criteriaSatisfied": [
-    {
-      "id": "criterion-1",
-      "status": "partial",
-      "evidence": "Scope is bounded to slice 4 (nav generation, service-page skeleton, stubs, resolver, empty states, dashboards API/hook). No content migration leaked. However one in-scope behavior (secret editing, R2.3/R10.1) regressed and must be fixed; one promised test (legacy-404) is missing."
-    },
-    {
-      "id": "criterion-2",
-      "status": "satisfied",
-      "evidence": "Cited file:line evidence for each finding; ran lint/build/test; verified git staging state."
-    }
-  ],
-  "changedFiles": [
-    "frontend/src/App.tsx",
-    "frontend/src/pages/Dashboard.tsx",
-    "frontend/src/pages/ServicePage.tsx",
-    "frontend/src/pages/__tests__/Dashboard.test.tsx",
-    "frontend/src/integrations/navEntries.ts",
-    "frontend/src/integrations/__tests__/navEntries.test.ts",
-    "frontend/src/api/dashboards.ts",
-    "frontend/src/hooks/useDashboards.ts",
-    "frontend/src/pages/service-tabs/stubs.tsx",
-    "frontend/src/pages/service-tabs/index.ts",
-    "frontend/src/pages/ServiceTypePage.tsx",
-    "frontend/src/pages/__tests__/ServicePage.test.tsx"
-  ],
-  "testsAddedOrUpdated": [
-    "frontend/src/integrations/__tests__/navEntries.test.ts",
-    "frontend/src/pages/__tests__/ServicePage.test.tsx",
-    "frontend/src/pages/__tests__/Dashboard.test.tsx"
-  ],
-  "commandsRun": [
-    {
-      "command": "cd frontend && npm run lint",
-      "result": "passed",
-      "summary": "0 errors; 2 pre-existing warnings in UsersPage.impl.tsx (deleted in slice 8)"
-    },
-    {
-      "command": "cd frontend && npm run build",
-      "result": "passed",
-      "summary": "tsc + vite build succeeded in 1.19s"
-    },
-    {
-      "command": "cd frontend && npm run test",
-      "result": "passed",
-      "summary": "25 files / 83 tests passed"
-    },
-    {
-      "command": "git diff --cached --stat",
-      "result": "passed",
-      "summary": "empty — no staged files"
-    }
-  ],
-  "validationOutput": [
-    "lint: 0 errors",
-    "build: success",
-    "test: 83/83 passed",
-    "no staged files"
-  ],
-  "residualRisks": [
-    "B1 (blocker): secret editing sends secrets:{} — fix before commit",
-    "C1: no legacy-route 404 test though behavior is implemented",
-    "S1: switcher trigger keys off total siblings not enabled-only (R3.1 nuance)",
-    "S3: /d/:slug route absent — fine now (no named dashboards exist), must land in slice 10"
-  ],
-  "noStagedFiles": true,
-  "diffSummary": "~530 lines: App.tsx data-driven nav (useNavItems from services+dashboards) + legacy-route removal + NotFound catch-all; ServicePage refactored to tab skeleton [Overview,...content,Widgets,Config] with instance switcher and ConfigBody lift; new navEntries map/filter, service-tabs stubs, ServiceTypePage resolver, Dashboard empty-state CTA, dashboards API+hook. Structural overrun, not scope creep.",
-  "reviewFindings": [
-    "blocker: frontend/src/pages/ServicePage.tsx buildInput() returns secrets:{} — typed secret drafts in ConfigBody are never sent; secret editing regressed (R2.3/R10.1). Fix by lifting draftSecrets and sending onlyChanged.",
-    "confirmed-issue: no test asserts legacy routes (/media,/files,/actions,/users,/observability,/backups) hit the NotFound catch-all — slice 4.5/AC5 promised it; behavior implemented but untested.",
-    "suggestion: ServicePage.tsx switcher trigger counts all siblings, not enabled-only (R3.1).",
-    "suggestion: no nav loading skeleton (design called for one); partial-nav-during-load is graceful but flashes.",
-    "suggestion: /d/:slug route absent; acceptable staging, lands in slice 10."
-  ],
-  "manualNotes": "Verdict: fix-then-commit. Fix B1 (secret save) and add C1 (legacy-404 test), then commit slice 4. S1–S4 are non-blocking follow-ups. Confirmed the base is main (no SheetForm/useIsMobile) per instructions; mobile reconciliation is deferred."
-}
-```

.pi-tmp/svc-hub-slice5-out.md

@@ -1,62 +0,0 @@
-# Slice 5 — Jellyfin content tabs: Media + Requests (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|-------|
-| `frontend/src/pages/service-tabs/MediaTab.tsx` | new | 511 |
-| `frontend/src/pages/service-tabs/RequestsTab.tsx` | new | 64 |
-| `frontend/src/pages/service-tabs/__tests__/MediaTab.test.tsx` | new | 78 |
-| `frontend/src/pages/service-tabs/__tests__/RequestsTab.test.tsx` | new | 59 |
-| `frontend/src/pages/service-tabs/index.ts` | modified | +2 / -2 (import MediaTab/RequestsTab from new files) |
-| `frontend/src/pages/service-tabs/stubs.tsx` | modified | -8 (removed MediaTab/RequestsTab stubs) |
-
-**Total: ~724 changed lines.** Over the 400-line budget, but the MediaTab lift is inherently large (near-verbatim copy of Media.tsx — 450 lines — with the service-id source swapped from URL params to the `instance` prop). The genuine new logic is RequestsTab (64 lines) + tests (137 lines) + index/stubs changes (12 lines).
-
-## How instance.id is wired into the hooks
-
-The old Media.tsx read the Jellyfin service ID from a URL search param (`?jellyfin_service_id=`) with a `<Select>` dropdown and a `useEffect` that synced the param. The new MediaTab replaces all of that with a direct read from the `instance` prop:
-
-```tsx
-export function MediaTab({ instance }: { instance: ServiceInstance }) {
-  const serviceId = instance.id;
-  // All hooks receive serviceId directly:
-  const { data: status } = useMediaStatus(serviceId);
-  const buildIndex = useBuildIndex(serviceId);
-  // etc.
-}
-```
-
-The service-selection dropdown, `useSearchParams`, `useServiceInstances("jellyfin")`, and the URL-sync effect are all removed. The `useNavigate` stays for the row-click → file browser navigation (`/files?path=...`).
-
-## What RequestsTab renders
-
-**Not configured** (empty `jellyseerr_url` or `jellyseerr_api_key`): an `<Alert>` CTA: "Jellyseerr is not configured for this Jellyfin instance. Add `jellyseerr_url` and `jellyseerr_api_key` to the Jellyfin config (Config tab) to enable request management."
-
-**Configured** (both fields set): shows the Jellyseerr URL as an external link + an `<Alert>` explaining the requests view is under development. No faked data — no backend requests endpoint exists yet (out of scope for this slice).
-
-## Validation
-
-```
-cd frontend && npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx, unrelated)
-cd frontend && npm run build  → ✓ built (tsc -b + vite)
-cd frontend && npm run test   → 27 files / 90 tests passed (was 84; +6 new)
-```
-
-## Deviations from design
-
-1. **Over 400-line budget.** The MediaTab lift is ~511 lines because it's a near-verbatim copy of Media.tsx (which is itself ~450 lines). The task acknowledged this: "Media.tsx is large; the lift is mostly mechanical." RequestsTab was kept minimal (64 lines) to partially offset. Could not have shrunk MediaTab without dropping features (build controls, status, filters, table).
-
-2. **No mobile card layout on MediaTab.** This branch is based on `main`, NOT on `mobile-responsive-parity`. Main's Media.tsx uses a DataTable with TanStack column-visibility-based mobile hiding (the `usePrefersSmallScreen` / `MOBILE_HIDDEN_COLUMNS` pattern), NOT the MobileCardRow from the mobile branch. I lifted exactly what main has — no invented mobile layout.
-
-3. **Old Media.test.tsx and Applications.test.tsx still pass.** They render the page components directly (not via routing), so the route removal doesn't affect them. They'll be deleted in Slice 11 cleanup.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected by the parent, and no `.atl/skill-registry.md` was found. The task was self-contained against the OpenSpec design/tasks docs.
-
-## Residual risks
-
-- **MediaTab duplicates Media.tsx.** The old page file stays in the repo (cleanup is Slice 11). Until then there's a ~450-line dead file. Not harmful (no route references it).
-- **RequestsTab has no real data.** It shows a "coming soon" placeholder when configured. Building a backend requests endpoint + frontend list is a follow-up.
-- **Row-click still navigates to `/files?path=...`.** In the new IA, Files lives on the ssh_tasks service page, not at `/files` (which now 404s). This row-click will break until the ssh_tasks FilesTab (Slice 6) either re-adds a `/files` route or the link target changes to `/services/ssh_tasks/<id>?path=...`. Flagged for Slice 6.

.pi-tmp/svc-hub-slice6-out.md

@@ -1,118 +0,0 @@
-# Slice 6 — ssh_tasks content tabs: Files + Actions (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|-------|
-| `frontend/src/pages/service-tabs/FilesTab.tsx` | new | 528 |
-| `frontend/src/pages/service-tabs/ActionsTab.tsx` | new | 308 |
-| `frontend/src/pages/service-tabs/__tests__/FilesTab.test.tsx` | new | 63 |
-| `frontend/src/pages/service-tabs/__tests__/ActionsTab.test.tsx` | new | 49 |
-| `frontend/src/pages/service-tabs/index.ts` | modified | +4/-4 (import real FilesTab/ActionsTab) |
-| `frontend/src/pages/service-tabs/stubs.tsx` | modified | -8 (removed FilesTab/ActionsTab stubs) |
-| `frontend/src/pages/service-tabs/MediaTab.tsx` | modified | +10/-1 (row-click nav fix) |
-| `frontend/src/pages/service-tabs/__tests__/MediaTab.test.tsx` | modified | +4 (mock useServiceInstances) |
-
-**Total: ~967 lines** (948 new + 27 modified diff). Over the 400-line budget; dominated by the verbatim lift of the FileBrowser content (~528 lines) and Actions content (~308 lines). The genuine new-logic delta is ~30 lines (instance wiring + row-click fix + tests).
-
-## How instance.id is wired into hooks
-
-**FilesTab**: `instance.id` replaces the old `machine_id` from search params. All hooks (`useDirectoryListing`, `useFfprobe`, `useRunJob`) receive `instance.id` directly as the machineId parameter. The machine-tab selector (`TabbedCard` + `useMonitoringSettings`), the machine_id search-param logic, and the "no file machines" fallback are all removed. The initial path is read from `?path=` search param for deep-link support.
-
-**ActionsTab**: `instance.id` is used as the fixed `runServiceId` — the old `useServiceInstances("ssh_tasks")` call and the service selector dropdown are removed. Tasks run on this instance by default. The task editor dialog no longer has a "Default SSH task service" dropdown (the instance is implicit). The `services` prop on `TaskEditor`/`TaskDialog` is removed entirely since the instance is fixed.
-
-## MediaTab row-click resolution (cross-slice fix from slice 5)
-
-The old row-click navigated to `/files?path=...` (legacy route, now 404s). Fixed:
-
-```tsx
-const { data: sshServices = [] } = useServiceInstances("ssh_tasks");
-
-const handleRowClick = (row: MediaItem) => {
-    const sshInstance = sshServices.find((s) => s.enabled);
-    const base = sshInstance
-        ? `/services/ssh_tasks/${sshInstance.id}`
-        : "/services/ssh_tasks";
-    navigate(`${base}?path=${encodeURIComponent(row.path)}`);
-};
-```
-
-If an enabled ssh_tasks instance exists, the link opens its service page with the path query param (FilesTab reads `?path=`). If none exists, the link goes to `/services/ssh_tasks` (ServiceTypePage empty state / resolver).
-
-## Validation
-
-```
-npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx, unrelated)
-npm run build  → ✓ built (tsc -b + vite)
-npm run test   → 29 files / 94 tests passed (was 90; +4 new)
-```
-
-## Deviations from design
-
-1. **Over 400-line budget.** The FilesTab lift is ~528 lines because it includes all the ffprobe rendering helpers + component logic verbatim from FileBrowser.impl.tsx. ActionsTab is ~308 lines. Could not shrink without dropping features. The task explicitly acknowledged this: "FileBrowser.impl.tsx is large; the lift is mostly mechanical."
-
-2. **ActionsTab simplified: no service-selector dropdown.** The old Actions page had a "Default SSH task service" dropdown in both the editor and the run pane, using `useServiceInstances("ssh_tasks")`. Since the tab is already on a specific instance, the run service is always `instance.id`. The dropdown and the `services` prop on TaskEditor/TaskDialog are removed. The `NONE` sentinel constant is also removed.
-
-3. **No mobile layout.** This branch is based on main, NOT on mobile-responsive-parity. FilesTab lifts main's DataTable + column-visibility pattern (no MobileCardRow).
-
-4. **Old page files kept.** FileBrowser.impl.tsx and Actions.tsx stay in the repo (cleanup is Slice 11). Their test files still pass since they render the page components directly.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected; no `.atl/skill-registry.md` found.
-
-## Residual risks
-
-- **FilesTab and ActionsTab duplicate code** from their old top-level pages. The duplicates are temporary (Slice 11 deletes the old pages).
-- **ActionsTab removed the service-selector dropdown.** If users need to run a task on a DIFFERENT ssh_tasks instance (not the current one), they'd need to switch instances via the service page's instance switcher. This is consistent with the new IA (each instance has its own page).
-- **MediaTab now depends on `useServiceInstances("ssh_tasks")`.** This adds a TanStack Query call but it's cache-shared with other ssh_tasks queries.
-
-```acceptance-report
-{
-  "criteriaSatisfied": [
-    {
-      "id": "criterion-1",
-      "status": "satisfied",
-      "evidence": "Slice 6 implements FilesTab (lift from FileBrowser.impl.tsx, instance-scoped hooks, ?path= deep-link), ActionsTab (lift from Actions.tsx, instance as default run service), resolves the MediaTab row-click cross-slice dependency (navigate to /services/ssh_tasks/<id>?path=...), and adds tests for both tabs. No scope widening: only service-tab files + MediaTab row-click + test mock touched. Old page files preserved for Slice 11. 94 tests pass; lint/build green."
-    }
-  ],
-  "changedFiles": [
-    "frontend/src/pages/service-tabs/FilesTab.tsx",
-    "frontend/src/pages/service-tabs/ActionsTab.tsx",
-    "frontend/src/pages/service-tabs/__tests__/FilesTab.test.tsx",
-    "frontend/src/pages/service-tabs/__tests__/ActionsTab.test.tsx",
-    "frontend/src/pages/service-tabs/index.ts",
-    "frontend/src/pages/service-tabs/stubs.tsx",
-    "frontend/src/pages/service-tabs/MediaTab.tsx",
-    "frontend/src/pages/service-tabs/__tests__/MediaTab.test.tsx"
-  ],
-  "testsAddedOrUpdated": [
-    "frontend/src/pages/service-tabs/__tests__/FilesTab.test.tsx",
-    "frontend/src/pages/service-tabs/__tests__/ActionsTab.test.tsx",
-    "frontend/src/pages/service-tabs/__tests__/MediaTab.test.tsx"
-  ],
-  "commandsRun": [
-    { "command": "cd frontend && npm run lint", "result": "passed", "summary": "0 errors, 2 pre-existing warnings" },
-    { "command": "cd frontend && npm run build", "result": "passed", "summary": "tsc -b + vite build clean" },
-    { "command": "cd frontend && npm run test", "result": "passed", "summary": "29 files / 94 tests passed (was 90; +4 new)" }
-  ],
-  "validationOutput": [
-    "FilesTab: instance.id wired into useDirectoryListing/useFfprobe/useRunJob; ?path= read from useSearchParams; machine selector removed.",
-    "ActionsTab: instance.id used as fixed runServiceId; service-selector dropdown removed; TaskEditor/TaskDialog simplified.",
-    "MediaTab row-click: navigates to /services/ssh_tasks/<first-enabled-id>?path=... (resolves slice 5 cross-slice flag).",
-    "stubs.tsx: FilesTab/ActionsTab stubs removed; index.ts imports real components.",
-    "MediaTab.test.tsx: useServiceInstances mock added to fix QueryClient error."
-  ],
-  "residualRisks": [
-    "FilesTab/ActionsTab duplicate code from old pages (temporary; Slice 11 deletes old files).",
-    "ActionsTab no longer has a service-selector dropdown (run is always on current instance; switch via instance switcher).",
-    "No mobile layout (branch is on main, not mobile-responsive-parity)."
-  ],
-  "noStagedFiles": true,
-  "diffSummary": "~967 lines: FilesTab.tsx (528, verbatim lift from FileBrowser.impl.tsx with instance wiring + ?path= deep-link), ActionsTab.tsx (308, lift from Actions.tsx with instance as fixed run service), 4 test files (112 lines), index.ts/stubs.tsx wiring (12 lines), MediaTab.tsx row-click fix (10 lines). Over 400-line budget due to mechanical lift of two large pages.",
-  "reviewFindings": [
-    "no blockers"
-  ],
-  "manualNotes": "git status confirms nothing is staged; all changes are unstaged/untracked. The old FileBrowser.impl.tsx and Actions.tsx are kept (Slice 11 deletes them). Their existing tests still pass."
-}
-```

.pi-tmp/svc-hub-slice7-out.md

@@ -1,116 +0,0 @@
-# Slice 7 — Frontend: backups Jobs tab (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|-------|
-| `frontend/src/pages/service-tabs/JobsTab.tsx` | new | 87 |
-| `frontend/src/pages/service-tabs/__tests__/JobsTab.test.tsx` | new | 64 |
-| `frontend/src/pages/service-tabs/index.ts` | modified | +2/-1 (import JobsTab from new file, remove from stubs import) |
-| `frontend/src/pages/service-tabs/stubs.tsx` | modified | -4 (removed JobsTab stub) |
-
-**Total: ~155 changed lines** (151 new files + 6 modified diff). Well under the 400-line budget.
-
-## What was implemented
-
-### 7.1 — JobsTab
-
-New file `frontend/src/pages/service-tabs/JobsTab.tsx`:
-
-- Accepts `{ instance }: { instance: ServiceInstance }` props.
-- Lifts the operational content from `components/BackupsPage.tsx`: the Jobs / Runs / Alerts tab structure with the three sub-tables (BackupJobsTable, BackupRunsTable, BackupAlertsTable).
-- The page heading ("Backups") is dropped since the service page header already renders the instance name + binding name.
-- All hooks (useBackupJobs, useBackupRuns, useBackupAlerts, useAcknowledgeAlert) are called exactly as in BackupsPage — **globally** (no service_id filtering). The `instance` prop is accepted but currently only referenced via `void instance` since per-instance scoping requires hook changes that are out of scope for this slice.
-
-### 7.2 — Tests + cleanup
-
-- New test file `JobsTab.test.tsx`: 2 tests covering sub-tab presence (Jobs, Runs, Alerts via regex match since the label includes the count) and job-name rendering with mocked hooks.
-- Removed `JobsTabStub` from `stubs.tsx`.
-- `index.ts` updated to import the real `JobsTab` from `./JobsobsTab` instead of the stub.
-- `BackupsPage.tsx` and its tests are left intact (Slice 11 cleanup).
-
-## Hooks: instance-scoped or global?
-
-**Global.** The backup hooks (`useBackupJobs`, `useBackupRuns`, `useBackupAlerts`) query without a service_id filter. The backend gained `service_id` attribution in Slice 3 (column on `backup_jobs`, `?service_id=` param on report endpoints), but the hooks don't yet accept a serviceId parameter. This tab shows ALL backups data for now. Per-instance scoping by `instance.id` is a documented follow-up (the `void instance` reference and the file docstring both call this out).
-
-## Validation
-
-```
-npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx, unrelated)
-npm run build  → ✓ built (tsc -b + vite)
-npm run test   → 30 files / 96 tests passed (was 94; +2 new)
-```
-
-## Deviations from design
-
-1. **Hooks not scoped by instance.id.** The design said "scope queries by `instance.id`" but the hooks (`useBackups.ts`) don't accept a serviceId param. Rewriting the hooks is out of scope for this slice (would touch `api/backups.ts`, `hooks/useBackups.ts`, and the widget source). A comment in the file docstring documents this as a follow-up.
-
-2. **Page heading dropped.** BackupsPage.tsx rendered `<h1>Backups</h1>`. The service page header already renders the instance name + "Backups" binding name, so the heading is redundant. The rest of the content (tabs, tables, loading states) is identical.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected by the parent, and no `.atl/skill-registry.md` was found. The task was self-contained against the OpenSpec design/tasks docs and the reference files.
-
-## Residual risks
-
-- **Hooks query globally.** The JobsTab shows all backup data across all instances. When the hooks gain a serviceId param, this tab should be updated to pass `instance.id`.
-- **Old BackupsPage.tsx still in repo.** Deleted in Slice 11 cleanup. Its tests still pass (render the component directly, not via routing).
-
-```acceptance-report
-{
-  "criteriaSatisfied": [
-    {
-      "id": "criterion-1",
-      "status": "satisfied",
-      "evidence": "Slice 7 implements JobsTab (lift from BackupsPage.tsx, global hooks with documented follow-up for instance scoping), wires it in index.ts, removes the stub, and adds 2 tests. No scope widening: only 4 files touched (2 new + 2 modified). Old BackupsPage.tsx preserved for Slice 11. 96 tests pass; lint/build green."
-    }
-  ],
-  "changedFiles": [
-    "frontend/src/pages/service-tabs/JobsTab.tsx",
-    "frontend/src/pages/service-tabs/__tests__/JobsTab.test.tsx",
-    "frontend/src/pages/service-tabs/index.ts",
-    "frontend/src/pages/service-tabs/stubs.tsx"
-  ],
-  "testsAddedOrUpdated": [
-    "frontend/src/pages/service-tabs/__tests__/JobsTab.test.tsx"
-  ],
-  "commandsRun": [
-    {
-      "command": "cd frontend && npm run lint",
-      "result": "passed",
-      "summary": "0 errors; 2 pre-existing warnings in UsersPage.impl.tsx (unrelated)"
-    },
-    {
-      "command": "cd frontend && npm run build",
-      "result": "passed",
-      "summary": "tsc -b + vite build clean"
-    },
-    {
-      "command": "cd frontend && npm run test",
-      "result": "passed",
-      "summary": "30 files / 96 tests passed (was 94; +2 new)"
-    },
-    {
-      "command": "git diff --cached --stat",
-      "result": "passed",
-      "summary": "Empty — no staged files"
-    }
-  ],
-  "validationOutput": [
-    "lint: 0 errors",
-    "build: success (tsc + vite)",
-    "test: 96/96 passed (+2 new JobsTab tests)",
-    "no staged files"
-  ],
-  "residualRisks": [
-    "Backup hooks query globally (no service_id filter); per-instance scoping by instance.id is a documented follow-up once the hooks gain the parameter.",
-    "Old BackupsPage.tsx still in repo (Slice 11 cleanup); its tests still pass."
-  ],
-  "noStagedFiles": true,
-  "diffSummary": "~155 lines: JobsTab.tsx (87, lift from BackupsPage.tsx with instance prop + global hooks), JobsTab.test.tsx (64, 2 tests with mocked hooks), index.ts wiring (+1/-1), stubs.tsx cleanup (-4). Well under 400-line budget.",
-  "reviewFindings": [
-    "no blockers"
-  ],
-  "manualNotes": "git status confirms nothing is staged; all changes are unstaged/untracked, ready for the parent to review and commit."
-}
-```

.pi-tmp/svc-hub-slice8-out.md

@@ -1,98 +0,0 @@
-# Slice 8 — Authentik Users + Messaging tabs (worker output)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|-------|
-| `backend/src/media_library_viewer_api/routers/authentik_users.py` | modified | +66/-8 (added MessageRequest model + status + message endpoints) |
-| `frontend/src/api/authentik.ts` | new | 65 |
-| `frontend/src/hooks/useAuthentik.ts` | new | 43 |
-| `frontend/src/pages/service-tabs/UsersTab.tsx` | new | 136 |
-| `frontend/src/pages/service-tabs/MessagingTab.tsx` | new | 131 |
-| `frontend/src/pages/service-tabs/__tests__/UsersTab.test.tsx` | new | 49 |
-| `frontend/src/pages/service-tabs/__tests__/MessagingTab.test.tsx` | new | 47 |
-| `frontend/src/pages/service-tabs/index.ts` | modified | +4/-4 |
-| `frontend/src/pages/service-tabs/stubs.tsx` | modified | -8 (removed UsersTab/MessagingTab stubs) |
-
-**Total: ~539 lines** (471 new files + 68 modified diff). Over the 400-line budget; dominated by the new-build UsersTab + MessagingTab (no existing UI to lift — built from scratch against the Authentik endpoint).
-
-## Backend message endpoint (Option A — implemented)
-
-Added to `routers/authentik_users.py`:
-
-```
-GET  /api/services/authentik/{service_id}/message/status
-POST /api/services/authentik/{service_id}/message
-```
-
-**POST body** (`MessageRequest`):
-
-```json
-{ "recipient_emails": ["alice@example.com"], "subject": "...", "html_body": "..." }
-```
-
-**Response** (success):
-
-```json
-{ "status": "queued", "request_id": "abc123", "recipient_count": 1 }
-```
-
-**Response** (error — service not configured / no recipients / SMTP invalid):
-
-```json
-{ "status": "error", "error": "description" }
-```
-
-The endpoint resolves the Authentik service record, validates SMTP settings, then enqueues via the existing `mail_queue.enqueue()`. The GET status endpoint proxies `mail_queue.status()`. Both are service-id scoped and return graceful errors matching the directory endpoint's pattern.
-
-## UsersTab columns
-
-| Column | Source field | Notes |
-|--------|-------------|-------|
-| Name | `user.name` | Falls back to "—" |
-| Username | `user.username` | |
-| Email | `user.email` | Falls back to "—" |
-| Status | `user.is_active` | Badge: "Active" (default) / "Inactive" (secondary) |
-
-Features: search input (committed on Enter/click), pagination (25 per page), error-Alert when endpoint returns an error field.
-
-## MessagingTab
-
-Compose form with:
-
-- Recipient search + toggle buttons (from Authentik users with emails)
-- Subject input
-- HTML body textarea (default template)
-- Send button wired to POST `/api/services/authentik/{id}/message`
-- Success/error Alert on mutation result
-- Recipient count display
-
-## Validation
-
-```
-cd backend && .venv/bin/ruff check src/ tests/  → All checks passed!
-cd backend && .venv/bin/python -m pytest tests/ → 271 passed, 2 warnings
-cd frontend && npm run lint   → 0 errors, 2 pre-existing warnings
-cd frontend && npm run build  → ✓ built (tsc -b + vite)
-cd frontend && npm run test   → 32 files / 100 tests passed (was 96; +4 new)
-```
-
-## Deviations from design
-
-1. **Over 400-line budget.** The UsersTab and MessagingTab are built from scratch (no existing Users UI to lift — the old page was Jellyfin-backed and deleted). Could not shrink without dropping functionality.
-
-2. **MessagingTab is simplified vs. the old compose UI.** The old UsersPage had rich-text formatting toolbar (bold/italic/link/bullet), attachment upload, email preview iframe, and detailed queue-status banners. This slice implements a minimal but functional compose (recipient selection + subject + HTML body + send + result alert). Rich-text toolbar + attachments are follow-ups. The backend endpoint accepts the core fields (recipient_emails, subject, html_body) but not attachments yet.
-
-3. **No attachment upload.** The mail_queue.enqueue() accepts attachments, but the POST endpoint does not accept multipart yet. Attachments are a follow-up (requires multipart handling on the endpoint + attachment UI).
-
-4. **Queue status polled via a dedicated hook.** `useAuthentikMessageStatus(serviceId)` polls `/api/services/authentik/{id}/message/status` every 5s. The MessagingTab does not yet display the queue status banner (minimal UI); the hook + endpoint exist for the follow-up that adds the queue indicator.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected, and no `.atl/skill-registry.md` was found.
-
-## Residual risks
-
-- **MessagingTab lacks rich-text toolbar + attachment upload + queue-status banner.** These are follow-ups; the core send flow works.
-- **Old UsersPage.impl.tsx + its test file still pass** (rendered directly, not via routing). Deleted in Slice 11 cleanup.
-- **Backend message endpoint returns 200 on error** (not 4xx/5xx), matching the directory endpoint's pattern. The frontend checks the `status`/`error` field.

.pi-tmp/svc-hub-slice9-out.md

@@ -1,136 +0,0 @@
-# Slice 9 — Frontend: Observability split (Alerts + Links + Metrics tabs)
-
-## Files changed
-
-| File | Status | Lines |
-|------|--------|-------|
-| `frontend/src/pages/service-tabs/AlertsTab.tsx` | new | 175 |
-| `frontend/src/pages/service-tabs/LinksTab.tsx` | new | 175 |
-| `frontend/src/pages/service-tabs/MetricsTab.tsx` | new | 105 |
-| `frontend/src/pages/service-tabs/__tests__/AlertsTab.test.tsx` | new | 57 |
-| `frontend/src/pages/service-tabs/__tests__/LinksTab.test.tsx` | new | 50 |
-| `frontend/src/pages/service-tabs/__tests__/MetricsTab.test.tsx` | new | 47 |
-| `frontend/src/pages/service-tabs/index.ts` | modified | +4 / -1 |
-| `frontend/src/pages/service-tabs/stubs.tsx` | modified | -12 |
-
-**Total: ~620 lines** (559 new + 17 modified diff). Over the 400-line budget, but each tab is a near-verbatim lift of a section from the ~350-line ObservabilityPage.tsx, split into three focused files. The genuine new-logic delta is ~30 lines (instance prop + status detail string + index/stubs wiring).
-
-## What each tab renders
-
-### AlertsTab (Alertmanager service page)
-
-- Alertmanager status line (version / reachable / unreachable).
-- Error Alert on fetch failure.
-- Card with "Active Alerts (N)" heading containing the expandable alert list (AlertItem with Collapsible — severity badge, summary, description, labels, active-since). Empty state ("No active alerts") when total is 0.
-- "N more alerts in Alertmanager" overflow note when total > shown alerts.
-
-### LinksTab (Grafana service page)
-
-- Grafana status line (version / reachable / not configured).
-- Error Alert on fetch failure.
-- Machine Dashboard card with machine-selector Select dropdown (from useMonitoringMachines). For the selected machine, renders GrafanaLinkCards:
-  - "{machine} metrics" — Node Exporter overview dashboard deep-link (kiosk mode).
-  - "{machine} logs" — Loki log explorer deep-link.
-- Empty states when no Grafana base_url configured or no machine selected.
-
-### MetricsTab (Prometheus service page)
-
-- Prometheus status line (version / reachable / unreachable).
-- Error Alerts on status/targets fetch failure.
-- "Node Exporter Targets (N)" card with the TargetsTable (targets list + labels badges). Empty state ("No Node Exporter targets") when none.
-
-## Hooks: global / first-configured
-
-All three tabs use the existing observability hooks (useAlertmanagerAlerts, useAlertmanagerStatus, useGrafanaStatus, usePrometheusStatus, usePrometheusTargets, useMonitoringMachines) which are **global / first-configured** — they don't accept a service_id parameter. The `instance` prop is accepted but currently only referenced via `void instance` (with a file docstring documenting the follow-up). Per spec R2.4 and the design, wiring `instance.id` into the hooks is a follow-up once the hooks gain the parameter (same pattern as JobsTab in slice 7).
-
-## Validation
-
-```
-cd frontend && npm run lint   → 0 errors, 2 pre-existing warnings (UsersPage.impl.tsx, unrelated)
-cd frontend && npm run build  → ✓ built (tsc -b + vite)
-cd frontend && npm run test   → 35 files / 106 tests passed (was 100; +6 new)
-```
-
-## Deviations from design
-
-1. **Over 400-line budget.** Each tab is a near-verbatim lift of a section from ObservabilityPage.tsx. The total (~620 lines including tests) is unavoidable for a three-way content split. Could not shrink without dropping features (expandable alerts, machine-selector, Grafana deep-link generation).
-
-2. **No dedicated ObservabilityPage test file existed** to break. ObservabilityPage.tsx itself stays in the repo (deleted in Slice 11 cleanup). No test file references it.
-
-3. **GrafanaLinkCard's Button asChild + `<a>` pattern produces a pi-lens advisory** ("nested `<a>` tags"). This is the identical pattern from the original ObservabilityPage.tsx (shadcn `Button asChild` merges props into the child `<a>` — it doesn't create a nested `<a>`). Not a real issue; build and lint pass.
-
-4. **LinksTab reads `instance.config.base_url`** for the Grafana deep-link base URL. The status hook is global, but the deep-link URL generation uses the specific instance's configured base_url. This is correct — the deep-links should point at this specific Grafana instance.
-
-## skill_resolution
-
-`none` — no project/user SKILL.md paths were injected, and no `.atl/skill-registry.md` was found. The task was self-contained against the OpenSpec design/tasks docs and the reference files.
-
-## Residual risks
-
-- **Hooks are global / first-configured.** With multiple Alertmanager/Grafana/Prometheus instances, the tab shows data for whichever instance the hook resolves as first-configured, not necessarily the one whose page the user is viewing. Documented as a follow-up.
-- **Old ObservabilityPage.tsx stays in the repo.** Its route was removed in slice 4; the file is dead code until Slice 11 cleanup.
-
-```acceptance-report
-{
-  "criteriaSatisfied": [
-    {
-      "id": "criterion-1",
-      "status": "satisfied",
-      "evidence": "Slice 9 implements AlertsTab, LinksTab, and MetricsTab by splitting the ObservabilityPage content into three instance-scoped tabs on the alertmanager/grafana/prometheus service pages. Each tab lifts the relevant section from ObservabilityPage.tsx verbatim. No scope widening: only service-tab files + index/stubs wiring. No backend touched. Old ObservabilityPage.tsx preserved for Slice 11. 106 tests pass; lint/build green."
-    },
-    {
-      "id": "criterion-2",
-      "status": "satisfied",
-      "evidence": "Cited per-tab render descriptions, hook scoping rationale, lint/build/test results, and diff stats."
-    }
-  ],
-  "changedFiles": [
-    "frontend/src/pages/service-tabs/AlertsTab.tsx",
-    "frontend/src/pages/service-tabs/LinksTab.tsx",
-    "frontend/src/pages/service-tabs/MetricsTab.tsx",
-    "frontend/src/pages/service-tabs/__tests__/AlertsTab.test.tsx",
-    "frontend/src/pages/service-tabs/__tests__/LinksTab.test.tsx",
-    "frontend/src/pages/service-tabs/__tests__/MetricsTab.test.tsx",
-    "frontend/src/pages/service-tabs/index.ts",
-    "frontend/src/pages/service-tabs/stubs.tsx"
-  ],
-  "testsAddedOrUpdated": [
-    "frontend/src/pages/service-tabs/__tests__/AlertsTab.test.tsx",
-    "frontend/src/pages/service-tabs/__tests__/LinksTab.test.tsx",
-    "frontend/src/pages/service-tabs/__tests__/MetricsTab.test.tsx"
-  ],
-  "commandsRun": [
-    {
-      "command": "cd frontend && npm run lint",
-      "result": "passed",
-      "summary": "0 errors; 2 pre-existing warnings in UsersPage.impl.tsx (unrelated)"
-    },
-    {
-      "command": "cd frontend && npm run build",
-      "result": "passed",
-      "summary": "tsc -b + vite build clean"
-    },
-    {
-      "command": "cd frontend && npm run test",
-      "result": "passed",
-      "summary": "35 files / 106 tests passed (was 100; +6 new)"
-    }
-  ],
-  "validationOutput": [
-    "AlertsTab: renders alert count heading, expandable alert list with severity badges, empty state. Uses useAlertmanagerAlerts + useAlertmanagerStatus (global).",
-    "LinksTab: renders Grafana version status, machine-selector dropdown, Node Exporter + Loki deep-link cards. Uses useGrafanaStatus + useMonitoringMachines (global) + instance.config.base_url for URL generation.",
-    "MetricsTab: renders Prometheus version status, Node Exporter targets table, empty state. Uses usePrometheusStatus + usePrometheusTargets (global).",
-    "stubs.tsx: AlertsTabStub/LinksTabStub/MetricsTabStub removed; only OverviewTab stub remains.",
-    "index.ts: alertmanager→AlertsTab, grafana→LinksTab, prometheus→MetricsTab all wired to real components."
-  ],
-  "residualRisks": [
-    "Hooks are global / first-configured; per-instance scoping by instance.id is a documented follow-up once the hooks gain the parameter.",
-    "Old ObservabilityPage.tsx stays in repo (route removed in slice 4; file deleted in slice 11)."
-  ],
-  "noStagedFiles": true,
-  "diffSummary": "~620 lines: AlertsTab (175, lift from ObservabilityPage alerts section), LinksTab (175, lift Grafana deep-links + machine selector), MetricsTab (105, lift Prometheus targets table), 3 test files (154 lines, 2 tests each), index.ts wiring (+4/-1), stubs.tsx cleanup (-12). Over 400-line budget due to mechanical content split of the aggregate ObservabilityPage.",
-  "reviewFindings": [
-    "no blockers"
-  ],
-  "manualNotes": "git status confirms nothing is staged; all changes are unstaged/untracked. The pi-lens nested-<a> advisory on LinksTab's GrafanaLinkCard is a false positive on the standard shadcn Button asChild + <a> pattern (same as the original ObservabilityPage). Build and lint pass."
-}

.pi-tmp/widgets-out.md

@@ -0,0 +1,142 @@
+# New widgets: Jellyfin now_playing + Grafana panel embed
+
+## Files changed (10 files, ~390 lines)
+
+| File | Status | Lines |
+|------|--------|-------|
+| `backend/src/media_library_viewer_api/integrations/jellyfin.py` | modified | +12 (new widget kind + config model) |
+| `backend/src/media_library_viewer_api/integrations/grafana.py` | modified | +17 (new widget kind + config model) |
+| `backend/src/media_library_viewer_api/widgets/sources.py` | modified | +12 (now_playing filter + panel embed URL) |
+| `backend/tests/test_services.py` | modified | +3 (updated widget-kind assertions) |
+| `backend/tests/test_widgets.py` | modified | +85 (import + 6 new tests) |
+| `frontend/src/widgets/JellyfinNowPlayingWidget.tsx` | new | 41 |
+| `frontend/src/widgets/GrafanaPanelWidget.tsx` | new | 50 |
+| `frontend/src/integrations/registry.ts` | modified | +24 (2 new widget bindings) |
+| `frontend/src/integrations/registry.test.ts` | modified | +1 (updated grafana kinds) |
+| `frontend/src/widgets/__tests__/JellyfinNowPlayingWidget.test.tsx` | new | 72 |
+| `frontend/src/widgets/__tests__/GrafanaPanelWidget.test.tsx` | new | 72 |
+
+## Session-filter logic for now_playing
+
+```python
+if widget_kind == "now_playing":
+    sessions = [
+        s for s in sessions
+        if s.get("NowPlayingItem")
+        and not s.get("PlayState", {}).get("IsPaused", True)
+    ]
+```
+
+Filters raw Jellyfin sessions BEFORE `_map_sessions_to_activity_rows`. A session is "actively playing" when it has a `NowPlayingItem` (something is playing, not just idle) AND `PlayState.IsPaused` is false. The `activity` kind (default) is unchanged — shows all sessions including idle and paused.
+
+## Embed URL format for panel
+
+```python
+embed_url = f"{base_url}/d-solo/{dashboard_uid}/manage?panelId={panel_id}&from={from_ts}&to={to_ts}&kiosk=tv"
+```
+
+Uses Grafana's `/d-solo/` endpoint which renders a single panel without dashboard chrome. `kiosk=tv` hides the top nav. Defaults: `from_ts="now-1h"`, `to_ts="now"`.
+
+## Validation
+
+```
+cd backend && .venv/bin/ruff check src/ tests/  → All checks passed!
+cd backend && .venv/bin/python -m pytest tests/ → 278 passed, 2 warnings (pre-existing)
+cd frontend && npm run lint                     → 0 errors, 0 warnings
+cd frontend && npm run build                    → ✓ built (tsc + vite)
+cd frontend && npm run test                     → 39 files / 127 tests passed
+```
+
+Backend: +6 new tests (definition assertions x2, grafana panel URL x2, jellyfin now_playing filter x1, jellyfin activity shows all x1).
+Frontend: +6 new tests (JellyfinNowPlayingWidget x3, GrafanaPanelWidget x3).
+
+## Deviations
+
+1. **No deviations from spec.** Both widgets are additive — no existing behavior changed. The `activity` and `link` kinds work exactly as before.
+2. **GrafanaPanelWidget pi-lens advisory** for `<Button asChild><a>` is a false positive (Radix Slot merges props, doesn't create nested `<a>`). Same pattern as GrafanaLinkWidget, ObservabilityPage, and PinnedServiceLink. Build and lint pass.
+
+## skill_resolution
+
+`none` — no project/user SKILL.md paths were injected; no `.atl/skill-registry.md` found.
+
+## Residual risks
+
+- **Grafana embedding may be blocked** by `X-Frame-Options` or CSP depending on Grafana config. The fallback "Open in Grafana" link is provided.
+- **GrafanaPanelWidget iframe height is fixed at 300px** — not responsive to panel content height. A follow-up could use Grafana's panel-content-height API or a ResizeObserver.
+- **now_playing filter operates on raw sessions before mapping** — if Jellyfin changes its session shape (e.g. moves `NowPlayingItem`/`PlayState`), the filter silently passes all sessions. Same fragility as the existing activity mapping.
+
+```acceptance-report
+{
+  "criteriaSatisfied": [
+    {
+      "id": "criterion-1",
+      "status": "satisfied",
+      "evidence": "Implements two additive widget kinds (jellyfin now_playing + grafana panel embed) without changing any existing behavior. Backend: new widget configs + definitions + source adapter logic + 6 tests. Frontend: 2 new components + registry bindings + 6 tests. 278 backend + 127 frontend tests pass; ruff/eslint/tsc/vite all green. No staged files."
+    }
+  ],
+  "changedFiles": [
+    "backend/src/media_library_viewer_api/integrations/jellyfin.py",
+    "backend/src/media_library_viewer_api/integrations/grafana.py",
+    "backend/src/media_library_viewer_api/widgets/sources.py",
+    "backend/tests/test_services.py",
+    "backend/tests/test_widgets.py",
+    "frontend/src/widgets/JellyfinNowPlayingWidget.tsx",
+    "frontend/src/widgets/GrafanaPanelWidget.tsx",
+    "frontend/src/integrations/registry.ts",
+    "frontend/src/integrations/registry.test.ts",
+    "frontend/src/widgets/__tests__/JellyfinNowPlayingWidget.test.tsx",
+    "frontend/src/widgets/__tests__/GrafanaPanelWidget.test.tsx"
+  ],
+  "testsAddedOrUpdated": [
+    "backend/tests/test_services.py",
+    "backend/tests/test_widgets.py",
+    "frontend/src/integrations/registry.test.ts",
+    "frontend/src/widgets/__tests__/JellyfinNowPlayingWidget.test.tsx",
+    "frontend/src/widgets/__tests__/GrafanaPanelWidget.test.tsx"
+  ],
+  "commandsRun": [
+    {
+      "command": "cd backend && .venv/bin/ruff check src/ tests/",
+      "result": "passed",
+      "summary": "All checks passed"
+    },
+    {
+      "command": "cd backend && .venv/bin/python -m pytest tests/ -q",
+      "result": "passed",
+      "summary": "278 passed, 2 warnings (pre-existing deprecation)"
+    },
+    {
+      "command": "cd frontend && npm run lint",
+      "result": "passed",
+      "summary": "0 errors, 0 warnings"
+    },
+    {
+      "command": "cd frontend && npm run build",
+      "result": "passed",
+      "summary": "tsc + vite build clean"
+    },
+    {
+      "command": "cd frontend && npm run test",
+      "result": "passed",
+      "summary": "39 files / 127 tests passed"
+    }
+  ],
+  "validationOutput": [
+    "Backend ruff clean; 278 tests pass (+6 new).",
+    "Frontend eslint clean; tsc + vite build clean; 127 tests pass (+6 new).",
+    "Jellyfin now_playing filters: session has NowPlayingItem + IsPaused=false.",
+    "Grafana panel embed URL: /d-solo/{uid}/manage?panelId={id}&from={from}&to={to}&kiosk=tv.",
+    "Existing activity + link widget kinds unchanged (tested)."
+  ],
+  "residualRisks": [
+    "Grafana iframe may be blocked by X-Frame-Options/CSP; fallback link provided.",
+    "Iframe height fixed at 300px (not responsive to panel content).",
+    "now_playing filter depends on Jellyfin session shape (NowPlayingItem/PlayState)."
+  ],
+  "noStagedFiles": true,
+  "diffSummary": "~390 lines across 11 files: 2 new backend widget kinds (jellyfin now_playing + grafana panel) with source adapter logic, 2 new frontend components, registry bindings, and 12 new tests (6 backend + 6 frontend). Purely additive — no existing behavior changed.",
+  "reviewFindings": [
+    "no blockers"
+  ],
+  "manualNotes": "The JellyfinClient mock approach uses patch on the class directly (not asyncio.to_thread) — let real asyncio handle the threading. The pi-lens nested-<a> advisory on GrafanaPanelWidget is a false positive (Button asChild uses Radix Slot)."
+}

AGENTS.md

@@ -17,6 +17,7 @@
 - Focused frontend typecheck: `npx tsc --noEmit`
 - Local dev stack: `docker compose -f docker-compose.dev.yml up --build`
 - Production stack: `docker compose up --build`
+- Solo landing: after review and verification, squash-land a feature branch with `bash scripts/land-branch.sh <feature-branch> "<conventional commit message>"`; do not commit directly on `main`.
 
 ## Repo-Specific Gotchas
 

CHANGELOG.md

@@ -4,31 +4,49 @@ All notable changes to Manage. Breaking changes are marked with **BREAKING**.
 
 ## [Unreleased]
 
-### Added — Services-as-hub IA rework
+### Fixed — HTTP read timeouts
 
-- **BREAKING:** Top-level navigation reorganized around services as the hub.
+- Service HTTP clients now use a `(connect, read)` timeout tuple (connect 5s,
-  The always-visible core is Main Dashboard, Services, Settings. Conditional
+  read 60s default) instead of a single integer, resolving `ReadTimeoutError`
-  per-type entries (Media, Files, Actions, Alerts, Grafana, Prometheus,
+  on slow Jellyfin index builds and qBittorrent stats. The media index build
-  Backups, Users) appear only when a matching service is configured. Legacy
+  worker uses a 180s read floor so slow `/Items` pages on large libraries
-  top-level routes (`/media`, `/files`, `/actions`, `/users`, `/observability`,
+  don't time out mid-build.
-  `/backups`) now return 404.
+- The shared `http_timeout()` helper (`clients/http_timeout.py`) decouples
-- **NEW service types:** `backups` (modeled as a service; reports attribute
+  connect (fail-fast on dead hosts) from read (generous for slow responses).
-  first-wins to an enabled instance via `?service_id=`) and `authentik`
+- Integration `timeout_seconds` defaults were raised from 5/10s to 15/60s.
-  (user-directory source; replaces the Jellyfin-backed Users page).
+- Existing services with a low `timeout_seconds` may benefit from bumping it
-- **Jellyseerr absorbed** into Jellyfin config (optional `jellyseerr_url` /
+  to 60+ via the service editor.
-  `jellyseerr_api_key`). Existing Jellyseerr service instances are migrated
+
-  into their paired Jellyfin at startup; unpaired instances are dropped with
+### **BREAKING** — Prometheus queries now route through Grafana gateway
-  a logged warning.
+
-- **Service pages** now use a tab skeleton `[Overview | content tabs | Widgets |
+- The `prometheus` service config changed: `base_url` is replaced by
-  Config]`. Operational content (Media, Files, Actions, Backups, Users,
+  `grafana_url` + `datasource_uid`, and the `api_key` secret is replaced by
-  Messaging, Alerts, Links, Metrics) lives in per-type tabs. An instance
+  `grafana_api_key` (a Grafana service account token or API key with read
-  switcher appears when >1 enabled instance of a type exists.
+  access to the Prometheus datasource). All metric widget queries (`chart`,
-- **Named dashboards** at `/d/:slug` — user-created top-level entries composed
+  `gauge`, `mean`, `metric`) now issue `POST {grafana_url}/api/ds/query`
-  of pinned service links (full widget composition is a follow-up).
+  instead of direct Prometheus HTTP calls.
-- **Authentik directory endpoint:** `GET /api/services/authentik/{id}/users`
+- **Migration:** Reconfigure existing `prometheus` services — replace
-  (paginated, searchable). `POST .../message` enqueues emails via the existing
+  `base_url` with `grafana_url` (your Grafana instance URL), add the
-  SMTP/mail queue.
+  `grafana_api_key` secret, and optionally set `datasource_uid` (defaults
-- **Users router removed** (Jellyfin-backed directory + Jellyfin-email compose).
+  to `"prometheus"`).
+
+### Added — Direct Prometheus charting
+
+- **Prometheus is now the direct source for in-app charts.** New widget kinds
+  on the `prometheus` service: `chart` (multi-series line chart via recharts,
+  backed by `/api/v1/query_range`), `gauge` (instant scalar with configurable
+  threshold bands), and `mean` (client-side average over a time window).
+
+### **BREAKING** — Grafana service type removed
+
+- The `grafana` service type, Grafana link widget, Grafana chart widget, and
+  `GET /api/monitoring/grafana-status` endpoint were **removed**. Manage now
+  queries Prometheus directly for all chart data.
+- **Migration:** Delete any existing Grafana service instances and create
+  Prometheus service instances instead (pointing at your Prometheus URL). Any
+  configured `grafana/chart` widgets must be recreated as `prometheus/chart`
+  widgets. Grafana link widgets are gone — use Prometheus chart/metric widgets
+  instead.
 
 ### Added — Observability service registry
 

README.md

@@ -1,62 +1,67 @@
 # Manage
 
-Manage is a media and server operations tool with Jellyfin integration, SSH file inspection, server monitoring, and safe remote job templates.
+Manage is a media and server-operations application with Jellyfin integration, SSH file inspection, monitoring integrations, safe remote-job templates, a FastAPI backend, and a React single-page application.
 
-See `docs/REQUIREMENTS.md` for the living requirements, decisions, and planning history.
+It includes a configurable dashboard, service registry, per-machine settings, a SQLite-indexed media library, a read-only Users view with optional Jellyseerr enrichment, remote file browsing with `ffprobe`, and SSH-based job execution.
-See `docs/MIGRATION_PLAN.md` for the FastAPI + React architecture plan.
 
-Project policy/docs:
+## Architecture and scope
 
-- License: `LICENSE` (MIT)
+- `backend/` is the FastAPI API.
-- Contributing guide: `CONTRIBUTING.md`
+- `frontend/` is the React and TypeScript SPA.
+- `archive/` retains the original Streamlit prototype for reference.
 
-## Architecture
+The root Compose files deploy **only** Manage's backend and frontend. Manage can expose `/metrics` and optional Alertmanager proxy endpoints, but it does not deploy Grafana, Prometheus, Loki, Alertmanager, Alloy, or Node Exporter as part of its normal stack. Configure service instances in the app's Services page.
 
-The project consists of two subprojects:
+## Prerequisites
 
-- **`backend/`** — FastAPI Python API (see `backend/README.md`)
+- Docker and Docker Compose for the supplied Compose stacks.
-- **`frontend/`** — React + TypeScript SPA (see `frontend/README.md`)
+- Python 3.11 or newer for manual backend development.
-- **`archive/`** — Original Streamlit prototype (preserved for reference)
+- Node.js and npm for manual frontend development.
+- A valid Fernet key for `MANAGE_ENCRYPTION_KEY`, including in development Compose.
+- For production: an existing external Docker network named `web`, Traefik, DNS/TLS configuration, and an OIDC provider.
 
-## Features
+## Local development with Compose
 
-- Configurable dashboard with persisted widgets (Jellyfin activity, backups summary, Grafana deep-links, Prometheus metrics, Alertmanager alerts, SSH task output, static text) and shortcuts
+1. Create `.env` from the template and set a valid `MANAGE_ENCRYPTION_KEY`. Docker Compose automatically reads `.env` for interpolation; alternatively, export the same variables in the shell.
-- Thin-dashboard observability: Alertmanager alerts, Prometheus target health, machine status, and Grafana deep-links (no in-app charting)
-- Service registry: configure Jellyfin, Jellyseerr, Alertmanager, Grafana, Prometheus, Nextcloud, and SSH task runner instances in the UI
-- Per-machine settings for SSH, monitoring targets, and file browsing
-- SQLite-indexed media table with full-library sort/filter
-- Read-only Users tab with Jellyfin as the base source and optional Jellyseerr enrichment
-- Remote file browser with ffprobe preview and job execution
-- Jellyfin API integration for library metadata and user identity data
-- SSH-based file inspection and safe remote job templates
 
-## Quick Start
+   ```bash
+   cp .env.example .env
+   ```
 
-### Docker Compose (recommended)
+   Generate a Fernet key if needed:
 
-Production-style deployment with the frontend serving the SPA and proxying `/api` to the backend. The compose files rely on environment-variable interpolation, so export the required values in your shell before running them (no `env_file` is needed):
+   ```bash
+   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+   ```
+
+2. Start the development stack:
+
+   ```bash
+   docker compose -f docker-compose.dev.yml up --build
+   ```
+
+The development frontend is available at <http://localhost:5173> and the backend at <http://localhost:8000>. Development Compose sets `AUTH_ENABLED=false` and `VITE_OIDC_ENABLED=false`, but still requires `MANAGE_ENCRYPTION_KEY`. The backend cache, settings database, media index, saved SSH keys, tasks, and dashboard widgets persist outside rebuilt containers.
+
+## Production-style deployment
+
+The root [`docker-compose.yml`](docker-compose.yml) is designed for deployment behind Traefik; it does not publish localhost ports. Before starting it, configure `.env` (or shell variables) with the required values:
+
+- `BACKEND_APP_HOST`, `FRONTEND_APP_HOST`, and `CERT_RESOLVER` for Traefik routing and certificates.
+- `OIDC_ISSUER_URL` and `OIDC_AUDIENCE` for backend authentication.
+- `VITE_OIDC_ISSUER`, `VITE_OIDC_CLIENT_ID`, `VITE_OIDC_REDIRECT_URI`, and `VITE_OIDC_POST_LOGOUT_REDIRECT_URI` for the frontend build.
+- `MANAGE_ENCRYPTION_KEY`, a valid Fernet key used to encrypt service secrets at rest.
+
+Then run:
 
 ```bash
 docker compose up --build
 ```
 
-Open the app at <http://localhost:8080>.
+The production Compose file requires its external `web` network to exist. It is not a standalone local deployment; access is through the configured Traefik hostnames.
 
-The production Compose file requires OIDC and Traefik variables; see [Configuration](#configuration) below. Copy `.env.example` to `.env`, fill in the required values, and export them in your shell before running `docker compose up`.
+## Manual development
 
-> **Observability is external.** Manage only ships its **backend** and **frontend**. It does **not** deploy Grafana, Prometheus, Loki, Alertmanager, Alloy, or Node Exporter. The backend exposes a `/metrics` endpoint and optional Alertmanager proxy endpoints so an *existing* observability deployment can scrape and consume them. For a ready-to-run example stack you can deploy alongside Manage, see [`docker-compose.observability.yml`](docker-compose.observability.yml) and [`docs/observability-runbooks.md`](docs/observability-runbooks.md).
+### Backend
-
-Local development with hot reload:
-
-```bash
-docker compose -f docker-compose.dev.yml up --build
-```
-
-Frontend runs on <http://localhost:5173> and the backend on <http://localhost:8000>. Dev compose disables OIDC by default (`AUTH_ENABLED=false`), so you can open it directly without an identity provider.
-
-The backend media index and settings database (including monitoring machines, SSH keys, saved tasks, and dashboard widgets) are persisted in Docker volumes so rebuilds and container restarts do not reset state.
-
-### Manual backend/frontend development
 
 ```bash
 cd backend
@@ -66,126 +71,75 @@ pip install -e '.[dev]'
 uvicorn media_library_viewer_api.main:app --reload --port 8000
 ```
 
+### Frontend
+
 ```bash
 cd frontend
 npm install
 npm run dev
 ```
 
-## Configuration
+## Tests and quality checks
-
-The Compose files use environment-variable interpolation. Export the required variables in your shell or pass them inline; a `.env` file is optional, not required.
-
-### Compose examples
-
-Production-style example with shell exports:
 
 ```bash
-export BACKEND_APP_HOST=api.manage.example.com
+# Backend
-export FRONTEND_APP_HOST=manage.example.com
+cd backend
-export CERT_RESOLVER=letsencrypt
+ruff check .
-export VITE_OIDC_ISSUER=https://auth.example.com/application/o/manage/
+python -m pytest
-export VITE_OIDC_CLIENT_ID=manage
-export VITE_OIDC_REDIRECT_URI=https://manage.example.com/oidc/callback
-export VITE_OIDC_POST_LOGOUT_REDIRECT_URI=https://manage.example.com/
-export MANAGE_ENCRYPTION_KEY=$(python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())")
 
-docker compose up --build
+# Frontend
+cd ../frontend
+npm run lint
+npm run build
+npm run test
 ```
 
-> Observability services (Grafana, Prometheus, Alertmanager) are configured in
+A focused frontend typecheck can be run with `npx tsc --noEmit` from `frontend/`.
-> the app on the **Services** page — no env vars for them.
 
-Inline one-liner example:
+## Configuration and operations
 
-```bash
+[`.env.example`](.env.example) is a template; do not commit real credentials or encryption keys. The Compose files interpolate environment values directly. Some template entries are for the optional observability example and are not consumed by the normal Manage Compose stack.
-BACKEND_APP_HOST=api.manage.example.com FRONTEND_APP_HOST=manage.example.com CERT_RESOLVER=letsencrypt VITE_OIDC_ISSUER=https://auth.example.com/application/o/manage/ VITE_OIDC_CLIENT_ID=manage VITE_OIDC_REDIRECT_URI=https://manage.example.com/oidc/callback VITE_OIDC_POST_LOGOUT_REDIRECT_URI=https://manage.example.com/ docker compose up --build
-```
 
-For local development, no SSH key is required unless you want to connect to remote SSH machines later:
+Optional SMTP settings (`SMTP_HOST`, `SMTP_PORT`, `SMTP_USERNAME`, `SMTP_PASSWORD`, `SMTP_FROM_ADDRESS`, `SMTP_FROM_NAME`, `SMTP_USE_TLS`, `SMTP_USE_SSL`, and `SMTP_TIMEOUT`) support the Users message popup.
 
-```bash
+### Remote servers
-docker compose -f docker-compose.dev.yml up --build
-```
 
-Example environment variables:
+A managed remote server needs a POSIX `/bin/sh`, `python3`, `ffprobe`, `find`, `stat`, `df`, and `awk`. Configure its SSH credentials in Manage's Settings. Unknown SSH host keys are rejected; establish trust first, for example:
-
-```bash
-# Optional backend logging level
-LOG_LEVEL=INFO
-
-# Optional SMTP settings for the Users -> message popup
-SMTP_HOST=smtp.example.com
-SMTP_PORT=587
-SMTP_USERNAME=your-smtp-username
-SMTP_PASSWORD=your-smtp-password
-SMTP_FROM_ADDRESS=no-reply@example.com
-SMTP_FROM_NAME=Manage
-SMTP_USE_TLS=true
-SMTP_USE_SSL=false
-SMTP_TIMEOUT=30
-
-# Jellyfin, Jellyseerr, and SSH targets are now configured per machine in the app's Settings tab.
-# The backend seeds a local machine automatically, so no global Jellyfin or SSH env vars are required.
-#
-# Remote SSH machines can store their private key and optional passphrase directly in Settings,
-# so no SSH key mount is required for normal use.
-
-# Authentik / OIDC
-AUTH_ENABLED=true
-OIDC_ISSUER_URL=https://auth.example.com/application/o/manage/
-OIDC_AUDIENCE=manage
-OIDC_JWKS_URL=
-OIDC_CLOCK_SKEW_SECONDS=30
-
-# Frontend OIDC settings
-VITE_OIDC_ENABLED=true
-VITE_OIDC_ISSUER=https://auth.example.com/application/o/manage/
-VITE_OIDC_CLIENT_ID=manage
-VITE_OIDC_SCOPE=openid profile email
-VITE_OIDC_REDIRECT_URI=https://manage.example.com/oidc/callback
-VITE_OIDC_POST_LOGOUT_REDIRECT_URI=https://manage.example.com/
-
-# Observability services (Grafana, Prometheus, Alertmanager) are configured in
-# the app on the Services page. The only observability env var is the optional
-# PROMETHEUS_ENABLED toggle (defaults on) for Manage's own /metrics endpoint.
-
-# Required: master key encrypting service secrets (API keys/tokens) at rest.
-# Generate one with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
-MANAGE_ENCRYPTION_KEY=replace-with-a-fernet-key
-```
-
-## Remote server requirements
-
-The remote server needs:
-
-- `/bin/sh` (POSIX shell)
-- `python3`, `ffprobe`, `find`, `stat`, `df`, `awk` for file inspection and job templates
-- SSH access with a key configured in the app's Settings tab
-
-The SSH client rejects unknown host keys. Connect manually once first:
 
 ```bash
 ssh user@host
 ```
 
-## Development
+SSH commands run through `/bin/sh -c` regardless of the remote login shell.
+
+### Optional observability example
+
+[`docker-compose.observability.yml`](docker-compose.observability.yml) is a separate, optional stack for Grafana, Prometheus, Loki, Alertmanager, Alloy, and Node Exporter. It is not required by Manage. Its header documents required `*_ROOT` persistence directories, `CERT_RESOLVER`, and Grafana/Prometheus/Alertmanager host variables. With those prepared, run:
 
 ```bash
-# Backend (lint + tests)
+docker compose -f docker-compose.observability.yml up -d
-cd backend && .venv/bin/ruff check . && .venv/bin/python -m pytest
-
-# Frontend (lint + typecheck/build + tests)
-cd frontend && npm run lint && npm run build && npm run test
 ```
 
-Focused frontend typecheck: `npx tsc --noEmit`.
+Set a non-default `GRAFANA_ADMIN_USER` and a strong, secret `GRAFANA_ADMIN_PASSWORD` before deploying this stack. Do not expose the example observability services with their defaults.
 
-## Notes
+See [`docs/observability-runbooks.md`](docs/observability-runbooks.md) for its operational documentation.
 
-- Jellyfin server root URL required (not `/web`). The client strips trailing `/web` defensively.
+## Repository layout
-- SSH commands run through `/bin/sh -c` regardless of remote login shell.
+
-- Job templates are shell-quoted. Add new templates in `backend/src/media_library_viewer_api/jobs.py`.
+```text
-- Root-level Docker Compose files are provided for production (`docker-compose.yml`) and local development (`docker-compose.dev.yml`), and both rely on Compose interpolation rather than `env_file` entries. They deploy **only** the backend and frontend; Manage never deploys its own observability stack (see `docker-compose.observability.yml` for an optional standalone example).
+.
-- The configurable dashboard stores widget instances in the backend SQLite settings database. New installs seed default Jellyfin activity and Backups widgets automatically.
+├── backend/                         # FastAPI API and tests
-- Grafana, Prometheus, and Alertmanager are configured as **service instances** in the app (Services page); their widget adapters resolve URLs from service records, and no observability URLs/credentials live in env vars. No credentials are stored in widget config; service API keys are encrypted at rest with `MANAGE_ENCRYPTION_KEY`. When no alertmanager service is configured, the alert proxy endpoints return graceful "not configured" responses.
+├── frontend/                        # React/TypeScript SPA and tests
+├── archive/                         # Preserved Streamlit prototype
+├── docs/                            # Requirements, migration, and operations docs
+├── docker-compose.yml               # Traefik-backed production-style stack
+├── docker-compose.dev.yml           # Local hot-reload development stack
+└── docker-compose.observability.yml # Optional standalone observability example
+```
+
+## Project documents
+
+- [Requirements and planning history](docs/REQUIREMENTS.md)
+- [FastAPI + React migration plan](docs/MIGRATION_PLAN.md)
+- [Contributing guide](CONTRIBUTING.md)
+- [MIT license](LICENSE)

archive/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: archive
 
 ## role
-Archive of an earlier project structure for a Streamlit-based Jellyfin media library browser with SSH remote file inspection capabilities.
+Archived/legacy entrypoint and packaging configuration for a Streamlit-based Jellyfin media library browser with SSH remote file inspection capabilities.
 ## parent
 index: ./.pi-map.index.md
 map: ./.pi-map.md

archive/.pi-map.md

@@ -4,13 +4,13 @@ dir: archive
 index: archive/.pi-map.index.md
 
 ## role
-Archive of an earlier project structure for a Streamlit-based Jellyfin media library browser with SSH remote file inspection capabilities.
+Archived/legacy entrypoint and packaging configuration for a Streamlit-based Jellyfin media library browser with SSH remote file inspection capabilities.
 ## files
 - app.py | Provides a minimal Streamlit entrypoint that adds the src directory to Python's path and delegates to the actual application in media_library_viewer.app. | dep: sys, pathlib, media_library_viewer.app
 - pyproject.toml | Defines Python package metadata, dependencies, and tool configurations for a Streamlit-based Jellyfin media library browser with SSH remote file inspection. | dep: hatchling, streamlit, streamlit-aggrid, requests, paramiko, python-dotenv, pandas, ruff, pytest
 - requirements.txt | Installs the current package in editable/development mode using pip | dep: pip, setuptools
 ## arch
-Thin entrypoint pattern using a bootstrap app.py that manipulates sys.path to delegate execution to a nested media_library_viewer package, managed via standard Python packaging (pyproject.toml).
+Thin bootstrap layer using path manipulation to delegate to a source module (src/), packaged with standard Python tooling (pyproject.toml) for dependency management and Streamlit deployment.
 ## tags
 streamlit, app, python, media, library, package, pyproject, pip
 ## symbols

archive/src/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: archive/src
 
 ## role
-No files provided — directory appears to be empty or contents were not included, so the package's role cannot be determined.
+Insufficient information — no files provided in the directory listing to determine this package's role.
 ## parent
 index: archive/.pi-map.index.md
 map: archive/.pi-map.md

archive/src/.pi-map.md

@@ -4,10 +4,10 @@ dir: archive/src
 index: archive/src/.pi-map.index.md
 
 ## role
-No files provided — directory appears to be empty or contents were not included, so the package's role cannot be determined.
+Insufficient information — no files provided in the directory listing to determine this package's role.
 ## files
 ## arch
-Cannot be assessed due to missing file contents; please provide the file listing for analysis.
+Unable to assess — empty directory or missing file contents for architectural analysis.
 ## tags
 -
 ## symbols

archive/src/media_library_viewer/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: archive/src/media_library_viewer
 
 ## role
-Streamlit-based media library viewer that provides a unified dashboard for browsing and monitoring Jellyfin media alongside remote SSH file systems.
+Streamlit-based UI package for browsing and monitoring a Jellyfin media library with SSH remote file management capabilities.
 ## parent
 index: archive/src/.pi-map.index.md
 map: archive/src/.pi-map.md

archive/src/media_library_viewer/.pi-map.md

@@ -4,7 +4,7 @@ dir: archive/src/media_library_viewer
 index: archive/src/media_library_viewer/.pi-map.index.md
 
 ## role
-Streamlit-based media library viewer that provides a unified dashboard for browsing and monitoring Jellyfin media alongside remote SSH file systems.
+Streamlit-based UI package for browsing and monitoring a Jellyfin media library with SSH remote file management capabilities.
 ## files
 - __init__.py | Package initialization file that defines the Media Library Viewer package metadata and exports the version string.
 - app.py | Streamlit UI entrypoint for a Media Library Viewer that connects to Jellyfin and SSH backends, providing dashboard, monitoring, media browsing, and file browser tabs with cached data and path resolution between systems. | exp: func:get_jellyfin_client(base_url: str, api_key: str) → JellyfinClient, call:JellyfinClient, func:cached_users(base_url: str, api_key: str), call:get_jellyfin_client(base_url, api_key).users, func:get_ssh_client(host: str, username: str, port: int, key_filename: str, password: str) → RemoteSSHClient, call:RemoteSSHClient, call:client.connect, func:cached_libraries(base_url: str, api_key: str, user_id: str), call:get_jellyfin_client(base_url, api_key).libraries, func:cached_media_counts(base_url: str, api_key: str, user_id: str), call:get_jellyfin_client(base_url, api_key).media_counts, func:cached_library_counts(base_url: str, api_key: str, user_id: str), call:get_jellyfin_client, call:client.libraries, call:client.library_item_counts, func:cached_active_sessions(base_url: str, api_key: str), call:get_jellyfin_client(base_url, api_key).active_sessions, func:cached_dir_listing(host: str, username: str, port: int, key_filename: str, password: str, path: str), call:get_ssh_client, call:ssh.list_dir, call:json.loads, raise:RuntimeError, func:cached_ffprobe_preview(host: str, username: str, port: int, key_filename: str, password: str, path: str), call:get_ssh_client, call:ssh.ffprobe_json, func:apply_remote_path_prefix(path: str, prefix: str) → str, call:(prefix or "").strip, call:normalized_prefix.rstrip, call:path.startswith, call:posixpath.normpath, call:posixpath.join, func:map_path_to_media_root(path: str, media_root: str) → str, call:(media_root or "").strip, call:posixpath.normpath, call:str(path).split, call:"/".join, call:path_absolute.startswith, call:posixpath.basename, call:raw_parts.index, call:posixpath.join, func:resolve_remote_media_path(path: str, media_root: str, fallback_prefix: str) → str, call:map_path_to_media_root, call:apply_remote_path_prefix, func:credentials_panel(), call:load_config, call:st.header, call:st.expander, call:st.text_input, call:st.number_input, call:int, func:main(), call:st.set_page_config, call:st.title, call:st.caption, call:credentials_panel, call:st.info, call:get_jellyfin_client, call:cached_users, call:st.error, call:user.get, call:st.selectbox, call:list, call:user_options.keys, call:st.tabs, call:render_now_playing, call:st.divider, call:render_resource_dashboard, call:render_media_overview, call:cached_libraries, call:set_file_browser_path, call:resolve_remote_media_path, call:render_media_tab, call:render_file_browser, call:get_ssh_client, call:render_ssh_tools, func:set_prefixed_file_browser_path(path: str, selected_path, reset_filters) → None, call:set_file_browser_path, call:resolve_remote_media_path | dep: json, posixpath, typing, media_library_viewer.clients.jellyfin, media_library_viewer.clients.ssh, media_library_viewer.config, media_library_viewer.ui.dashboard, media_library_viewer.ui.file_browser, media_library_viewer.ui.media, media_library_viewer.ui.preview, streamlit
@@ -12,7 +12,7 @@ Streamlit-based media library viewer that provides a unified dashboard for brows
 - jobs.py | Defines safe, template-based remote SSH jobs with shell-quoted parameter rendering. | exp: class:JobTemplate, method:render(self, values: Mapping[str, str]) → str, call:shlex.quote, call:values.items, call:self.command_template.format, func:run_job(ssh: RemoteSSHClient, job_key: str, path: str, timeout) → CommandResult, call:template.render, call:ssh.run | dep: shlex, dataclasses, typing, media_library_viewer.clients.ssh, typing.Mapping
 - utils.py | Provides UI-independent formatting helpers and ffprobe output summarizers for video/audio/subtitle stream metadata. | exp: func:ticks_to_minutes(ticks: int | None) → int | None, call:round, func:human_size(num: int | float | None) → str, call:float, call:int, func:timestamp_to_local(ts: float | None) → str, call:datetime.fromtimestamp(ts).strftime, func:is_known_video_file(path: str | None) → bool, call:PurePosixPath(path).suffix.lower, func:format_duration(seconds: str | int | float | None) → str, call:float, call:str, call:int, func:format_bitrate(bit_rate: str | int | float | None) → str, call:float, call:str, func:_tags(stream: dict[str, Any]) → dict[str, Any], call:stream.get, func:_disposition(stream: dict[str, Any], key: str) → str, call:(stream.get("disposition") or {}).get, call:stream.get, func:_side_data_types(stream: dict[str, Any]) → str, call:stream.get, call:item.get, call:values.append, call:", ".join, func:ffprobe_format_summary(ffprobe: dict[str, Any]) → dict[str, str], call:ffprobe.get, call:fmt.get, call:format_duration, call:human_size, call:float, call:format_bitrate, call:str, func:summarize_video_streams(ffprobe: dict[str, Any]) → list[dict[str, Any]], call:ffprobe.get, call:stream.get, call:_tags, call:rows.append, call:format_bitrate, call:_side_data_types, call:tags.get, call:_disposition, func:summarize_audio_streams(ffprobe: dict[str, Any]) → list[dict[str, Any]], call:ffprobe.get, call:stream.get, call:_tags, call:rows.append, call:format_bitrate, call:tags.get, call:_disposition, func:summarize_subtitle_streams(ffprobe: dict[str, Any]) → list[dict[str, Any]], call:ffprobe.get, call:stream.get, call:_tags, call:rows.append, call:tags.get, call:_disposition, func:summarize_streams(ffprobe: dict[str, Any]) → list[dict[str, Any]], call:ffprobe.get, call:rows.append, call:format_bitrate, call:stream.get("tags", {}).get | dep: datetime, pathlib, typing
 ## arch
-Layered Streamlit application using immutable dataclass configuration, template-based remote job execution, cached data access, and separated utility functions following a tab-based modular UI pattern.
+Tab-based modular frontend using immutable dataclass configuration, environment-driven settings, cached data access, template-based remote job execution, and separated utility functions for metadata formatting.
 ## tags
 client, path, media, call:, jellyfin, call:get, ssh, cached
 ## symbols

archive/src/media_library_viewer/clients/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: archive/src/media_library_viewer/clients
 
 ## role
-External service and system integration layer providing HTTP API clients for Jellyfin/Emby media servers and SSH-based remote system metrics collection.
+External service and system integration clients providing media server API access and remote SSH-based system metrics collection for the media library viewer application.
 ## parent
 index: archive/src/media_library_viewer/.pi-map.index.md
 map: archive/src/media_library_viewer/.pi-map.md

archive/src/media_library_viewer/clients/.pi-map.md

@@ -4,14 +4,14 @@ dir: archive/src/media_library_viewer/clients
 index: archive/src/media_library_viewer/clients/.pi-map.index.md
 
 ## role
-External service and system integration layer providing HTTP API clients for Jellyfin/Emby media servers and SSH-based remote system metrics collection.
+External service and system integration clients providing media server API access and remote SSH-based system metrics collection for the media library viewer application.
 ## files
 - __init__.py | Package initialization file that defines external service clients module boundaries and constraints
 - jellyfin.py | HTTP API client for Jellyfin/Emby media servers providing user, library, item, and session management with plain Python return types for frontend agnosticism. | exp: class:JellyfinClient, method:__init__(self, base_url: str, api_key: str, timeout), call:base_url.rstrip, call:self.base_url.endswith, call:requests.Session, call:self.session.headers.update, raise:ValueError, method:get(self, path: str, **params: Any) → dict[str, Any], call:params.items, call:self.session.get, call:response.raise_for_status, call:response.json, raise:requests.HTTPError, method:users(self) → list[dict[str, Any]], call:self.get, method:libraries(self, user_id: str) → list[dict[str, Any]], call:self.get(f"/Users/{user_id}/Views").get, method:items(self, user_id: str, parent_id, start_index, limit, search, include_item_types, recursive, sort_by, sort_order) → dict[str, Any], call:self.get, call:str(recursive).lower, method:item_count(self, user_id: str, include_item_types: str, parent_id) → int, call:self.get, call:int, call:response.get, method:media_counts(self, user_id: str) → dict[str, int], call:self.item_count, method:library_item_counts(self, user_id: str, libraries: list[dict[str, Any]]) → list[dict[str, Any]], call:lib.get, call:self.item_count, call:results.append, method:active_sessions(self, active_within_seconds) → list[dict[str, Any]], call:self.get, call:isinstance, call:session.get, method:image_url(self, item_id: str, image_type) → str | dep: typing, requests
 - resources.py | Manages a lightweight POSIX shell-based remote system metrics collector that samples CPU, memory, network, and disk statistics via SSH and reads the resulting JSONL data. | exp: class:ResourceMonitorPaths, func:start_resource_collector(ssh: RemoteSSHClient, interval_seconds, retention_seconds, max_lines, paths) → str, call:shlex.quote, call:int, call:ssh.run, call:result.stdout.strip, raise:RuntimeError, func:stop_resource_collector(ssh: RemoteSSHClient, paths) → str, call:shlex.quote, call:ssh.run, call:result.stdout.strip, raise:RuntimeError, func:restart_resource_collector(ssh: RemoteSSHClient, interval_seconds, retention_seconds, max_lines, paths) → str, call:stop_resource_collector, call:start_resource_collector, func:resource_collector_status(ssh: RemoteSSHClient, paths) → str, call:shlex.quote, call:ssh.run, call:result.stdout.strip, raise:RuntimeError, func:resource_collector_debug_info(ssh: RemoteSSHClient, paths) → str, call:shlex.quote, call:ssh.run, func:read_resource_metrics(ssh: RemoteSSHClient, max_lines, paths) → list[dict[str, Any]], call:shlex.quote, call:int, call:ssh.run, call:result.stdout.splitlines, call:line.strip, call:rows.append, call:json.loads, raise:RuntimeError, func:disk_space(ssh: RemoteSSHClient, path) → dict[str, Any], call:shlex.quote, call:ssh.run, call:result.stdout.strip, call:json.loads, raise:RuntimeError | dep: json, shlex, dataclasses, typing, media_library_viewer.clients.ssh
 - ssh.py | Provides an SSH client wrapper around Paramiko for remote filesystem inspection and media analysis, ensuring POSIX shell compatibility regardless of the user's login shell. | exp: class:CommandResult, class:RemoteSSHClient, method:__init__(self, host: str, username: str, port, key_filename, password, timeout), raise:ValueError, method:connect(self) → paramiko.SSHClient, call:paramiko.SSHClient, call:client.load_system_host_keys, call:client.set_missing_host_key_policy, call:paramiko.RejectPolicy, call:client.connect, method:close(self) → None, call:self._client.close, method:run(self, command: str, timeout) → CommandResult, call:self.connect, call:shlex.quote, call:client.exec_command, call:stdout.channel.recv_exit_status, call:CommandResult, call:stdout.read().decode, call:stderr.read().decode, method:list_dir(self, path: str) → CommandResult, call:shlex.quote, call:self.run, method:stat_path(self, path: str) → CommandResult, call:shlex.quote, call:self.run, method:ffprobe_json(self, path: str) → dict[str, Any], call:shlex.quote, call:self.run, call:json.loads, raise:RuntimeError | dep: json, posixpath, shlex, dataclasses, typing, paramiko
 ## arch
-Client-wrapper pattern with each module encapsulating a specific integration concern (Jellyfin HTTP API, SSH filesystem access, remote resource monitoring), returning plain Python types for frontend agnosticism.
+Modular client-per-service pattern with plain Python return types for frontend agnosticism, wrapping HTTP APIs (Jellyfin/Emby) and SSH/Paramiko connections with POSIX shell compatibility enforcement.
 ## tags
 call:shlex.quote, resource, error, collector, call:ssh.run, raise:runtime, call:self.get, call:result.stdout.strip
 ## symbols

archive/src/media_library_viewer/domain/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: archive/src/media_library_viewer/domain
 
 ## role
-Provides domain-level normalization logic that transforms inconsistent Jellyfin API responses into stable, flattened data structures for storage and display.
+Provides domain-level normalization logic that transforms inconsistent external Jellyfin API responses into stable, application-native data structures.
 ## parent
 index: archive/src/media_library_viewer/.pi-map.index.md
 map: archive/src/media_library_viewer/.pi-map.md

archive/src/media_library_viewer/domain/.pi-map.md

@@ -4,12 +4,12 @@ dir: archive/src/media_library_viewer/domain
 index: archive/src/media_library_viewer/domain/.pi-map.index.md
 
 ## role
-Provides domain-level normalization logic that transforms inconsistent Jellyfin API responses into stable, flattened data structures for storage and display.
+Provides domain-level normalization logic that transforms inconsistent external Jellyfin API responses into stable, application-native data structures.
 ## files
 - __init__.py | Serves as the package docstring for a domain-level helpers/normalization module that converts external data into stable app concepts.
 - media.py | Flattens inconsistent Jellyfin API item JSON into stable, normalized dictionaries for SQLite storage and frontend display. | exp: func:first_media_source(item: dict[str, Any]) → dict[str, Any], call:item.get, func:media_streams(item: dict[str, Any], stream_type) → list[dict[str, Any]], call:item.get, call:streams.extend, call:source.get, call:str(stream.get("Type") or stream.get("codec_type") or "").lower, call:stream.get, call:stream_type.lower, func:stream_value(stream: dict[str, Any], *keys: str) → Any, func:is_hdr_item(item: dict[str, Any]) → bool, call:media_streams, call:stream_value, call:" ".join, call:str(value).lower, call:any, func:format_date_added(value: str | None) → str, call:pd.to_datetime(value).strftime, call:str, func:timestamp_date_added(value: str | None) → int | None, call:int, call:pd.to_datetime(value).timestamp, func:format_rate_bits_decimal(bits_per_second: float | int | str | None) → str, call:float, call:str, func:normalize_media_item(item: dict[str, Any], library_id, library_name) → dict[str, Any], call:first_media_source, call:media_streams, call:source.get, call:item.get, call:stream_value, call:is_hdr_item, call:int, call:ticks_to_minutes, call:human_size, call:format_rate_bits_decimal, call:video.get, call:format_date_added, call:timestamp_date_added, func:display_media_row(row: dict[str, Any]) → dict[str, Any], call:row.get, call:human_size, call:format_rate_bits_decimal | dep: typing, media_library_viewer.utils, pandas, media_library_viewer.utils (human_size, ticks_to_minutes)
 ## arch
-Functional transformation layer pattern mapping raw external API JSON directly into normalized flat dictionaries without intermediate ORM or complex object hierarchies.
+Functional transformation layer using dictionary flattening and field mapping to decouple external API data shapes from internal storage (SQLite) and presentation (frontend) concerns.
 ## tags
 media, call:str, date, added, item, call:item.get, streams, call:stream
 ## symbols

archive/src/media_library_viewer/services/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: archive/src/media_library_viewer/services
 
 ## role
-Application service layer that coordinates domain logic and external clients into reusable, UI-agnostic media library operations.
+Application services layer that coordinates media library clients and domain logic into reusable, UI-agnostic operations like indexing and querying Jellyfin media metadata.
 ## parent
 index: archive/src/media_library_viewer/.pi-map.index.md
 map: archive/src/media_library_viewer/.pi-map.md

archive/src/media_library_viewer/services/.pi-map.md

@@ -4,12 +4,12 @@ dir: archive/src/media_library_viewer/services
 index: archive/src/media_library_viewer/services/.pi-map.index.md
 
 ## role
-Application service layer that coordinates domain logic and external clients into reusable, UI-agnostic media library operations.
+Application services layer that coordinates media library clients and domain logic into reusable, UI-agnostic operations like indexing and querying Jellyfin media metadata.
 ## files
 - __init__.py | Marks the directory as a Python package and documents it as the application services layer for coordinating clients/domain logic into reusable operations.
 - media_index.py | Provides a UI-agnostic SQLite-backed media inventory service that indexes, queries, and manages Jellyfin media metadata with filtering, sorting, and pagination capabilities. | exp: class:MediaIndexStatus, class:MediaIndex, method:__init__(self, db_path), call:Path, call:self.db_path.parent.mkdir, method:connect(self) → sqlite3.Connection, call:sqlite3.connect, method:init_schema(self) → None, call:self.connect, call:conn.executescript, method:set_metadata(self, key: str, value: str | int | float) → None, call:self.init_schema, call:self.connect, call:conn.execute, call:str, method:replace_items(self, rows: Iterable[dict[str, Any]]) → int, call:self.init_schema, call:list, call:",".join, call:len, call:self.connect, call:conn.execute, call:conn.executemany, call:','.join, call:row.get, call:str, call:int, call:time.time, method:status(self) → MediaIndexStatus, call:self.db_path.exists, call:MediaIndexStatus, call:self.connect, call:int, call:conn.execute("SELECT COUNT(*) FROM media_items").fetchone, call:conn.execute("SELECT value FROM index_metadata WHERE key='updated_at'").fetchone, call:conn.execute("SELECT value FROM index_metadata WHERE key='build_duration_seconds'").fetchone, call:str(updated_row[0]).isdigit, call:time.strftime, call:time.localtime, call:float, method:query(self, library_id, library_ids, media_types, search, hdr_filter, sort_key, sort_order, limit, offset) → tuple[list[dict[str, Any]], int], call:self.init_schema, call:where.append, call:",".join, call:len, call:params.extend, call:params.append, call:search.lower, call:" AND ".join, call:SORT_COLUMNS.get, call:self.connect, call:int, call:conn.execute("SELECT COUNT(*) FROM media_items" + where_sql, params).fetchone, call:conn.execute( "SELECT * FROM media_items" + where_sql + order_sql + " LIMIT ? OFFSET ?", [*params, int(limit), int(offset)], ).fetchall, call:display_media_row, call:dict, func:build_media_index(client: JellyfinClient, user_id: str, libraries: list[dict[str, Any]], index, page_size) → int, call:MediaIndex, call:time.perf_counter, call:library.get, call:client.items, call:response.get, call:normalized_rows.extend, call:normalize_media_item, call:len, call:int, call:index.replace_items, call:index.set_metadata | dep: sqlite3, time, dataclasses, pathlib, typing, media_library_viewer.clients.jellyfin, media_library_viewer.domain.media, media_library_viewer.clients.jellyfin.JellyfinClient, media_library_viewer.domain.media.display_media_row, media_library_viewer.domain.media.normalize_media_item
 ## arch
-Service-oriented pattern with SQLite-backed indexing, query filtering, and pagination encapsulated behind a single cohesive media index service module.
+Service-oriented architecture with SQLite persistence, providing filtering, sorting, and pagination capabilities abstracted away from UI concerns.
 ## tags
 media, call:conn.execute, index, call:self.connect, schema, call:int, init, status
 ## symbols

archive/src/media_library_viewer/ui/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: archive/src/media_library_viewer/ui
 
 ## role
-Streamlit UI rendering layer for the media library viewer application, providing dashboard monitoring, file browsing, media indexing, and preview capabilities.
+Streamlit-based presentation layer for browsing, monitoring, and diagnosing a Jellyfin media server via SSH and a local SQLite index.
 ## parent
 index: archive/src/media_library_viewer/.pi-map.index.md
 map: archive/src/media_library_viewer/.pi-map.md

archive/src/media_library_viewer/ui/.pi-map.md

@@ -4,7 +4,7 @@ dir: archive/src/media_library_viewer/ui
 index: archive/src/media_library_viewer/ui/.pi-map.index.md
 
 ## role
-Streamlit UI rendering layer for the media library viewer application, providing dashboard monitoring, file browsing, media indexing, and preview capabilities.
+Streamlit-based presentation layer for browsing, monitoring, and diagnosing a Jellyfin media server via SSH and a local SQLite index.
 ## files
 - __init__.py | Package initialization file for Streamlit UI modules that documents the architectural pattern of splitting the application into separate render modules.
 - dashboard.py | Implements a Streamlit dashboard for monitoring a Jellyfin media server, displaying media library statistics, active playback sessions, and server resource metrics via SSH. | exp: func:format_rate_bytes(bytes_per_second: float | int | None) → str, call:human_size, func:rate_scale(max_value: float | int | None) → tuple[float, str], call:abs, call:float, func:scaled_rate_chart_df(chart_df: pd.DataFrame, columns: list[str], labels: list[str]) → tuple[pd.DataFrame, str], call:chart_df[columns].max(numeric_only=True).max, call:rate_scale, call:chart_df[columns].copy, func:format_elapsed(seconds: float | int | None) → str, call:float, call:int, func:render_media_overview(cached_media_counts, cached_library_counts, base_url: str, api_key: str, user_id: str) → None, call:st.subheader, call:cached_media_counts, call:st.warning, call:counts.get, call:st.columns, call:top_cols[0].metric, call:top_cols[1].metric, call:top_cols[2].metric, call:top_cols[3].metric, call:cached_library_counts, call:st.caption, call:st.markdown, call:e.get, call:st.container, call:m_cols[0].metric, call:m_cols[1].metric, func:render_now_playing(cached_active_sessions, base_url: str, api_key: str) → None, call:st.subheader, call:cached_active_sessions, call:st.warning, call:st.caption, call:session.get, call:bool, call:play_state.get, call:item.get, call:transcoding.get, call:transcode_type.append, call:rows.append, call:", ".join, call:st.dataframe, call:pd.DataFrame, func:render_resource_dashboard(get_ssh_client, ssh_args: tuple, media_root: str, detailed) → None, call:st.subheader, call:get_ssh_client, call:resource_collector_status, call:st.error, call:st.columns, call:control_col.caption, call:start_col.button, call:st.success, call:start_resource_collector, call:restart_col.button, call:restart_resource_collector, call:stop_col.button, call:st.info, call:stop_resource_collector, call:refresh_col.button, call:st.rerun, call:st.caption, call:read_resource_metrics, call:disk_space, call:float, call:str(space.get("used_pct", "0")).rstrip, call:space.get, call:disk_cols[0].metric, call:human_size, call:disk_cols[1].metric, call:disk_cols[2].metric, call:disk_cols[3].metric, call:st.progress, call:min, call:max, call:st.warning, call:st.expander, call:st.code, call:resource_collector_debug_info, call:pd.DataFrame, call:pd.to_numeric, call:df.dropna, call:pd.to_datetime(df["ts"], unit="s", utc=True).dt.tz_convert, call:time.time, call:len, call:st.write, call:raw_df['ts'].astype(float).max, call:st.dataframe, call:raw_df.tail, call:df.sort_values, call:df["cpu_pct"].mean, call:df["cpu_pct"].max, call:df["iowait_pct"].mean, call:df["iowait_pct"].max, call:df["mem_pct"].mean, call:df["mem_pct"].max, call:df["net_rx_bytes_per_sec"].mean, call:df["net_rx_bytes_per_sec"].max, call:df["net_tx_bytes_per_sec"].mean, call:df["net_tx_bytes_per_sec"].max, call:df["disk_read_bps"].mean, call:df["disk_read_bps"].max, call:df["disk_write_bps"].mean, call:df["disk_write_bps"].max, call:metric_cols[0].metric, call:metric_cols[0].caption, call:metric_cols[1].metric, call:latest.get, call:metric_cols[1].caption, call:metric_cols[2].metric, call:metric_cols[2].caption, call:metric_cols[3].metric, call:format_rate_bytes, call:metric_cols[3].caption, call:metric_cols[4].metric, call:metric_cols[4].caption, call:metric_cols[5].metric, call:metric_cols[5].caption, call:metric_cols[6].metric, call:metric_cols[6].caption, call:df.set_index, call:st.markdown, call:st.line_chart, call:scaled_rate_chart_df | dep: time, typing, media_library_viewer.clients.resources, media_library_viewer.utils, pandas, streamlit
@@ -12,7 +12,7 @@ Streamlit UI rendering layer for the media library viewer application, providing
 - media.py | Renders a Streamlit UI tab for browsing and filtering a local SQLite-backed media index with ag-grid table display and automatic file browser synchronization. | exp: func:aggrid_selected_rows(response: dict[str, Any]) → list[dict[str, Any]], call:response.get, call:isinstance, call:selected_rows.to_dict, call:list, func:format_elapsed(seconds: float | int | None) → str, call:float, call:int, func:render_media_tab(client, user_id: str, libraries: list[dict[str, Any]], set_file_browser_path: Callable[[str, str | None, bool], None]) → None, call:st.subheader, call:st.caption, call:MediaIndex, call:index.status, call:st.columns, call:status_parts.append, call:format_elapsed, call:status_col.caption, call:" | ".join, call:status_col.warning, call:build_col.button, call:st.spinner, call:build_media_index, call:st.success, call:st.rerun, call:refresh_col.button, call:st.info, call:filter_col.multiselect, call:list, call:library_options.keys, call:type_col.multiselect, call:search_col.text_input, call:page_size_col.selectbox, call:page_col.number_input, call:sort_col.selectbox, call:sort_options.keys, call:order_col.selectbox, call:hdr_col.selectbox, call:index.query, call:int, call:len, call:pd.DataFrame(rows)[columns].fillna, call:st.session_state.get, call:GridOptionsBuilder.from_dataframe, call:grid_builder.configure_default_column, call:grid_builder.configure_column, call:grid_builder.configure_selection, call:grid_builder.build, call:JsCode, call:AgGrid, call:min, call:aggrid_selected_rows, call:selected_rows[0].get, call:set_file_browser_path, call:str, call:PurePosixPath, call:st.expander, call:st.write | dep: pathlib, typing, st_aggrid, media_library_viewer.services.media_index, pandas, streamlit
 - preview.py | Renders a Streamlit UI for previewing selected media file metadata via ffprobe and executing remote SSH diagnostic tools/jobs. | exp: func:render_ffprobe_sections(ffprobe_data: dict[str, Any]) → None, call:ffprobe_format_summary, call:summarize_video_streams, call:summarize_audio_streams, call:summarize_subtitle_streams, call:st.markdown, call:st.dataframe, call:pd.DataFrame, call:st.caption, func:render_selected_file_preview(ssh_args: tuple, selected_path: str | None, cached_ffprobe_preview: Callable[..., dict[str, Any]]) → None, call:st.container, call:st.markdown, call:st.caption, call:is_known_video_file, call:st.columns, call:refresh_col.button, call:cached_ffprobe_preview.clear, call:st.rerun, call:st.spinner, call:status_col.error, call:status_col.success, call:render_ffprobe_sections, call:st.expander, call:st.json, func:render_ssh_tools(ssh, ssh_args: tuple, selected_path: str | None, cached_ffprobe_preview: Callable[..., dict[str, Any]]) → None, call:render_selected_file_preview, call:st.subheader, call:st.tabs, call:st.button, call:ssh.ffprobe_json, call:render_ffprobe_sections, call:st.expander, call:st.dataframe, call:pd.DataFrame, call:summarize_streams, call:st.json, call:st.error, call:str, call:ssh.stat_path, call:st.code, call:st.warning, call:st.selectbox, call:list, call:JOB_TEMPLATES.keys, call:st.caption, call:JOB_TEMPLATES[job_key].render, call:run_job, call:st.write | dep: typing, media_library_viewer.jobs, media_library_viewer.utils, pandas, streamlit
 ## arch
-Module-based render pattern where each UI tab/view is isolated in its own module, sharing session state for cross-component synchronization (e.g., file browser auto-sync) and leveraging ag-grid for interactive data tables.
+Modular page-by-page rendering pattern where each module is a self-contained Streamlit view, integrated through shared session state for cross-component synchronization.
 ## tags
 call:metric, call:grid, render, call:st.caption, col.button, browser, col.selectbox, media
 ## symbols

archive/tests/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: archive/tests
 
 ## role
-Legacy or archived test directory currently containing only a placeholder file with no active test code.
+Empty placeholder directory retained for historical/archived test files that are no longer actively used.
 ## parent
 index: archive/.pi-map.index.md
 map: archive/.pi-map.md

archive/tests/.pi-map.md

@@ -4,11 +4,11 @@ dir: archive/tests
 index: archive/tests/.pi-map.index.md
 
 ## role
-Legacy or archived test directory currently containing only a placeholder file with no active test code.
+Empty placeholder directory retained for historical/archived test files that are no longer actively used.
 ## files
 - .gitkeep | Swaps the position of two tmux panes within a window or between windows | dep: tmux, sh
 ## arch
-Empty placeholder structure using a `.gitkeep` file to preserve the directory in version control for potential future use.
+No active code; contains only a `.gitkeep` placeholder file (with an unrelated description) to preserve the directory structure in version control.
 ## tags
 tmux, swaps, position, two, panes, within, window, windows
 ## symbols

backend/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: backend
 
 ## role
-FastAPI backend service providing Jellyfin media browsing, SSH file inspection, server monitoring, and JWT-protected API endpoints.
+FastAPI backend service providing JWT-protected REST API endpoints for Jellyfin media browsing, SSH file inspection, and server monitoring.
 ## parent
 index: ./.pi-map.index.md
 map: ./.pi-map.md

backend/.pi-map.md

@@ -4,13 +4,13 @@ dir: backend
 index: backend/.pi-map.index.md
 
 ## role
-FastAPI backend service providing Jellyfin media browsing, SSH file inspection, server monitoring, and JWT-protected API endpoints.
+FastAPI backend service providing JWT-protected REST API endpoints for Jellyfin media browsing, SSH file inspection, and server monitoring.
 ## files
 - Dockerfile | Builds a Docker container for a Python 3.11 backend API service using uvicorn | dep: python:3.11-slim, pip, uvicorn, pyproject.toml-based package
 - README.md | Documentation describing the setup, configuration, Docker deployment, and API endpoints for a FastAPI backend that provides Jellyfin media browsing, SSH file inspection, server monitoring, and JWT-protected access. | dep: FastAPI, uvicorn, pydantic-settings, Docker Compose
 - pyproject.toml | Project configuration file defining dependencies, build system, linting, and testing settings for a FastAPI media library viewer backend. | dep: FastAPI, uvicorn, pydantic-settings, paramiko, requests, python-dotenv, pandas, PyJWT, prometheus-client, python-json-logger, cryptography, hatchling, ruff, pytest, httpx
 ## arch
-Containerized Python 3.11 REST API using FastAPI/uvicorn with JWT authentication, configured via pyproject.toml with linting and testing support.
+Layered API architecture using FastAPI with Uvicorn ASGI server, containerized via Docker, configured through pyproject.toml with standardized linting and testing pipelines.
 ## tags
 uvicorn, fastapi, python, backend, pyproject, settings, docker, api
 ## symbols

backend/src/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: backend/src
 
 ## role
-Root source directory serving as the main entry point and organizational container for the backend application.
+Core backend application source directory containing server-side business logic, API routes, models, and configuration.
 ## parent
 index: backend/.pi-map.index.md
 map: backend/.pi-map.md

backend/src/.pi-map.md

@@ -4,10 +4,10 @@ dir: backend/src
 index: backend/src/.pi-map.index.md
 
 ## role
-Root source directory serving as the main entry point and organizational container for the backend application.
+Core backend application source directory containing server-side business logic, API routes, models, and configuration.
 ## files
 ## arch
-Standard layered architecture entry point, typically initializing the application, wiring up configurations, modules, routes, and services (e.g., MVC, modular monolith, or Clean Architecture).
+Cannot be fully determined as no files are listed in the directory; likely follows standard Node.js/Python backend patterns (e.g., MVC, layered architecture) depending on framework used.
 ## tags
 -
 ## symbols

backend/src/media_library_viewer_api/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: backend/src/media_library_viewer_api
 
 ## role
-FastAPI backend service that provides authenticated, observable APIs for viewing and managing media library data across Jellyfin, Jellyseerr, and remote SSH/local systems.
+FastAPI backend providing authenticated APIs for remote media library inspection, SSH job execution, and observability via Jellyfin integration.
 ## parent
 index: backend/src/.pi-map.index.md
 map: backend/src/.pi-map.md

backend/src/media_library_viewer_api/.pi-map.md

@@ -4,23 +4,23 @@ dir: backend/src/media_library_viewer_api
 index: backend/src/media_library_viewer_api/.pi-map.index.md
 
 ## role
-FastAPI backend service that provides authenticated, observable APIs for viewing and managing media library data across Jellyfin, Jellyseerr, and remote SSH/local systems.
+FastAPI backend providing authenticated APIs for remote media library inspection, SSH job execution, and observability via Jellyfin integration.
 ## files
 - __init__.py | Swaps the position of two tmux panes within a window or between windows | dep: tmux, sh
 - auth.py | Implements OIDC/JWT and API key authentication for a FastAPI backend with middleware-based route protection. | exp: func:_normalize_issuer_url(issuer_url: str) → str, call:issuer_url.rstrip, func:get_oidc_metadata(issuer_url: str) → dict[str, Any], call:_normalize_issuer_url, call:urljoin, call:requests.get, call:response.raise_for_status, call:response.json, call:isinstance, raise:RuntimeError, func:get_jwk_client(jwks_url: str) → PyJWKClient, call:PyJWKClient, func:_split_audience(audience: str) → list[str], call:item.strip, call:audience.split, func:validate_auth_settings(settings: Settings) → None, raise:RuntimeError, func:validate_bearer_jwt(authorization: str | None, settings) → dict[str, Any], call:get_settings, call:validate_auth_settings, call:authorization.partition, call:scheme.lower, call:token.strip, call:_normalize_issuer_url, call:get_oidc_metadata, call:settings.oidc_jwks_url.strip, call:str, call:metadata.get, call:get_jwk_client, call:jwk_client.get_signing_key_from_jwt, call:_split_audience, call:jwt.decode, call:list, call:len, call:int, raise:PermissionError, raise:RuntimeError, func:require_jwt_auth(request: Request, call_next), call:get_settings, call:path.startswith, call:call_next, call:validate_bearer_jwt, call:request.headers.get, call:logger.warning, call:JSONResponse, call:str, call:logger.exception, call:claims.get, call:isinstance, func:get_api_key() → str, call:get_settings_store, call:store.get_settings, call:settings.get, call:secrets.token_urlsafe, call:store.update_setting, func:require_api_key(authorization) → str, call:get_api_key, call:secrets.compare_digest, raise:HTTPException | dep: logging, secrets, functools, typing, urllib.parse, jwt, requests, fastapi, fastapi.responses, jwt.exceptions, media_library_viewer_api.config, media_library_viewer_api.dependencies
 - config.py | Defines a flat pydantic-settings configuration model that loads application settings from environment variables and .env files with cached access. | exp: class:Settings, func:_find_env_file() → str | None, call:Path.cwd, call:candidate.is_file, call:str, call:(directory / ".git").exists, func:get_settings() → Settings, call:_find_env_file, call:Settings, call:logger.info, call:describe_settings | dep: logging, functools, pathlib, pydantic_settings, media_library_viewer_api.logging_utils, functools.lru_cache, pathlib.Path, pydantic_settings.BaseSettings
-- dependencies.py | Provides FastAPI dependency injection functions for resolving and caching service clients (Jellyfin, Jellyseerr, SSH/Local) and settings based on request query parameters. | exp: func:_request_machine_id(request: Request | None) → str | None, call:request.query_params.get, func:_request_jellyfin_service_id(request: Request | None) → str | None, call:request.query_params.get, func:_service_record(store: SettingsStore, service_type: str, service_id: str | None) → dict[str, Any] | None, call:store.get_service, call:candidate.get, call:store.list_services, call:s.get, call:row.get, call:decrypt_secrets, call:logger.exception, func:_jellyfin_client_for(cache_key: tuple[str, str, str]) → JellyfinClient, call:logger.info, call:url.rstrip, call:JellyfinClient, func:_ssh_client_for(cache_key: tuple[str, str, str, int, str, str | None, str | None, str | None, str | None]) → RemoteSSHClient, call:logger.info, call:RemoteSSHClient, call:client.connect, call:str, call:message.lower, call:logger.exception, raise:HTTPException, func:_resolve_machine(service: str, request) → dict[str, Any] | None, call:get_settings_store, call:_request_machine_id, call:store.get_machine, call:machine.get, call:store.list_machines_for_service, func:get_jellyfin_client(request) → JellyfinClient, call:get_settings_store, call:_request_jellyfin_service_id, call:_service_record, call:str, call:service.get("config", {}).get, call:service.get("secrets", {}).get, call:_jellyfin_client_for, raise:HTTPException, func:get_jellyseerr_client(request) → JellyseerrClient | None, call:get_settings_store, call:_request_jellyfin_service_id, call:_service_record, call:logger.info, call:str, call:service.get("config", {}).get, call:service.get("secrets", {}).get, call:JellyseerrClient, func:_ssh_client_from_machine_config(machine: dict[str, Any], store) → RemoteSSHClient, call:get_settings_store, call:get_settings, call:str(machine.get("ssh_key_id") or "").strip, call:machine.get, call:store.get_ssh_key, call:ssh_key.get, call:int, call:_ssh_client_for, func:get_ssh_client(request), call:get_settings_store, call:_request_machine_id, call:store.get_machine_config, call:_resolve_machine, call:str(machine.get("mode") or "local").strip().lower, call:machine.get, call:logger.info, call:LocalCommandClient, call:_ssh_client_from_machine_config, call:get_settings, call:_ssh_client_for, raise:HTTPException, func:get_mail_queue() → MailQueue, call:_get_mail_queue, func:get_settings_store() → SettingsStore, call:_get_settings_store, func:get_user_id(request) → str, call:get_settings_store, call:_request_jellyfin_service_id, call:_service_record, call:service.get("config", {}).get, call:str, call:get_jellyfin_client, call:client.users, raise:HTTPException | dep: logging, functools, typing, fastapi, media_library_viewer_api.clients.jellyfin, media_library_viewer_api.clients.jellyseerr, media_library_viewer_api.clients.local, media_library_viewer_api.clients.ssh, media_library_viewer_api.config, media_library_viewer_api.services.mail_queue, media_library_viewer_api.services.settings_store, media_library_viewer_api.services.secrets
+- dependencies.py | Provides FastAPI dependency injection functions that resolve and instantiate service clients like Jellyfin and SSH based on request query parameters. | exp: func:_request_machine_id(request: Request | None) → str | None, call:request.query_params.get, func:_request_jellyfin_service_id(request: Request | None) → str | None, call:request.query_params.get, func:_service_record(store: SettingsStore, service_type: str, service_id: str | None) → dict[str, Any] | None, call:store.get_service, call:candidate.get, call:store.list_services, call:s.get, call:row.get, call:decrypt_secrets, call:logger.exception, func:_jellyfin_client_for(cache_key: tuple[str, str, str]) → JellyfinClient, call:logger.info, call:url.rstrip, call:JellyfinClient, func:_ssh_client_for(cache_key: tuple[str, str, str, int, str, str | None, str | None, str | None, str | None]) → RemoteSSHClient, call:logger.info, call:RemoteSSHClient, call:client.connect, call:str, call:message.lower, call:logger.exception, raise:HTTPException, func:_resolve_machine(service: str, request) → dict[str, Any] | None, call:get_settings_store, call:_request_machine_id, call:store.get_machine, call:machine.get, call:store.list_machines_for_service, func:get_jellyfin_client(request) → JellyfinClient, call:get_settings_store, call:_request_jellyfin_service_id, call:_service_record, call:str, call:service.get("config", {}).get, call:service.get("secrets", {}).get, call:_jellyfin_client_for, raise:HTTPException, func:_ssh_client_from_machine_config(machine: dict[str, Any], store) → RemoteSSHClient, call:get_settings_store, call:get_settings, call:str(machine.get("ssh_key_id") or "").strip, call:machine.get, call:store.get_ssh_key, call:ssh_key.get, call:int, call:_ssh_client_for, func:get_ssh_client(request), call:get_settings_store, call:_request_machine_id, call:store.get_machine_config, call:_resolve_machine, call:str(machine.get("mode") or "local").strip().lower, call:machine.get, call:logger.info, call:LocalCommandClient, call:_ssh_client_from_machine_config, call:get_settings, call:_ssh_client_for, raise:HTTPException, func:get_mail_queue() → MailQueue, call:_get_mail_queue, func:get_settings_store() → SettingsStore, call:_get_settings_store, func:get_user_id(request) → str, call:get_settings_store, call:_request_jellyfin_service_id, call:_service_record, call:str(service.get("config", {}).get("user_id") or "").strip, call:service.get("config", {}).get, call:service.get("secrets", {}).get, call:_resolved_user_id, raise:HTTPException, func:_resolved_user_id(cache_key: tuple[str, str, str, str]) → str, call:_jellyfin_client_for, call:client.resolve_user_id | dep: logging, functools, typing, fastapi, media_library_viewer_api.clients.jellyfin, media_library_viewer_api.clients.local, media_library_viewer_api.clients.ssh, media_library_viewer_api.config, media_library_viewer_api.services.mail_queue, media_library_viewer_api.services.settings_store, media_library_viewer_api.services.secrets
 - jobs.py | Defines template-based remote SSH jobs with shell-safe rendering for a media library viewer API. | exp: class:JobTemplate, method:render(self, values: Mapping[str, str]) → str, call:shlex.quote, call:values.items, call:self.command_template.format, func:run_job(ssh: RemoteSSHClient, job_key: str, path: str, timeout) → CommandResult, call:template.render, call:logger.info, call:ssh.run | dep: logging, shlex, dataclasses, typing, media_library_viewer_api.clients.ssh
 - logging_utils.py | Configures structured JSON/text logging with secret-safe settings introspection and log field sanitization for a backend application. | exp: func:_json_formatter() → logging.Formatter, call:jsonlogger.JsonFormatter, func:_text_formatter() → logging.Formatter, call:logging.Formatter, func:configure_logging(level_name, log_format) → int, call:(level_name or os.getenv("LOG_LEVEL", "INFO")).upper, call:os.getenv, call:getattr, call:(log_format or os.getenv("LOG_FORMAT", "text")).lower, call:logging.StreamHandler, call:handler.setFormatter, call:_json_formatter, call:_text_formatter, call:logging.basicConfig, call:root.setLevel, call:logging.getLogger("media_library_viewer_api").setLevel, call:logging.getLogger("uvicorn").setLevel, call:logging.getLogger("uvicorn.error").setLevel, call:logging.getLogger("uvicorn.access").setLevel, call:logging.getLogger("paramiko").setLevel, call:logging.getLogger("urllib3").setLevel, func:_sanitize_url(url: str | None) → str, call:urlsplit, call:url.strip, call:url.rstrip, func:describe_settings(settings: object) → dict[str, str], call:str(getattr(settings, "log_level", "INFO") or "INFO").upper, call:getattr, call:str(getattr(settings, "log_format", "text") or "text").lower, call:bool, call:_sanitize_url, func:sanitize_log_extra(extra: dict[str, Any] | None) → dict[str, Any], call:extra.items, call:key.lower, call:any, call:lower_key.endswith | dep: logging, os, typing, urllib.parse, pythonjsonlogger
-- main.py | FastAPI application entrypoint that configures middleware, registers routers, manages startup/shutdown lifecycle, and exposes health/version/metrics endpoints. | exp: func:lifespan(app: FastAPI), call:get_settings, call:configure_logging, call:validate_auth_settings, call:validate_encryption_key, call:logger.info, call:describe_settings, call:get_settings_store().ensure_defaults, call:logger.exception, call:get_mail_queue, call:get_backup_poller, call:mail_queue.start, call:backup_poller.start, call:backup_poller.stop, call:mail_queue.stop, func:enforce_jwt_auth(request: Request, call_next), call:call_next, call:require_jwt_auth, func:log_requests(request: Request, call_next), call:time.perf_counter, call:get_request_id, call:set_current_request_id, call:sanitize_log_extra, call:logger.info, call:call_next, call:logger.exception, call:record_request, call:round, func:health_check() → dict[str, str], call:logger.debug, func:version_info() → dict[str, str], call:logger.debug, call:get_version_info, func:metrics() → Response, call:metrics_payload, call:FastAPIResponse | dep: logging, time, contextlib, uvicorn, fastapi, fastapi.middleware.cors, fastapi.responses, media_library_viewer_api.auth, media_library_viewer_api.config, media_library_viewer_api.dependencies, media_library_viewer_api.logging_utils, media_library_viewer_api.observability, media_library_viewer_api.routers, media_library_viewer_api.routers.settings, .services.backup_poller, .version, media_library_viewer_api.services.secrets, media_library_viewer_api.services.backup_poller, media_library_viewer_api.version
+- main.py | FastAPI application entrypoint that configures middleware, registers routers, manages startup/shutdown lifecycle, and exposes health, version, and metrics endpoints. | exp: func:_validate_prometheus_gateway_config() → None, call:get_settings_store, call:store.list_services, call:service.get, call:logger.warning, call:logger.exception, func:lifespan(app: FastAPI), call:get_settings, call:configure_logging, call:validate_auth_settings, call:validate_encryption_key, call:logger.info, call:describe_settings, call:get_settings_store().ensure_defaults, call:logger.exception, call:get_service_data_harness, call:_validate_prometheus_gateway_config, call:get_mail_queue, call:get_backup_poller, call:mail_queue.start, call:backup_poller.start, call:backup_poller.stop, call:mail_queue.stop, func:enforce_jwt_auth(request: Request, call_next), call:call_next, call:require_jwt_auth, func:log_requests(request: Request, call_next), call:time.perf_counter, call:get_request_id, call:set_current_request_id, call:sanitize_log_extra, call:logger.info, call:call_next, call:logger.exception, call:record_request, call:round, func:health_check() → dict[str, str], call:logger.debug, func:version_info() → dict[str, str], call:logger.debug, call:get_version_info, func:metrics() → Response, call:metrics_payload, call:FastAPIResponse | dep: logging, time, contextlib, uvicorn, fastapi, fastapi.middleware.cors, fastapi.responses, media_library_viewer_api.auth, media_library_viewer_api.config, media_library_viewer_api.dependencies, media_library_viewer_api.logging_utils, media_library_viewer_api.observability, media_library_viewer_api.routers, media_library_viewer_api.routers.settings, .services.backup_poller, .version, media_library_viewer_api.services.secrets, media_library_viewer_api.services.service_data, media_library_viewer_api.services.backup_poller, media_library_viewer_api.version
 - observability.py | Provides Prometheus metrics collection, request ID generation/correlation, and structured logging helpers for application observability. | exp: func:set_current_request_id(request_id: str | None) → None, call:_current_request_id.set, func:get_current_request_id() → str | None, call:_current_request_id.get, func:generate_request_id() → str, call:uuid.uuid4, func:get_request_id(request) → str, call:request.headers.get, call:header.strip, call:_current_request_id.get, call:generate_request_id, call:_current_request_id.set, func:metrics_payload() → tuple[bytes, str], call:generate_latest, func:record_request(request: Request, response: Response, duration_seconds: float) → None, call:str, call:REQUESTS_TOTAL.labels(method=method, path=path, status_code=status).inc, call:REQUEST_DURATION.labels(method=method, path=path).observe, func:record_ssh_command(machine_id: str, action: str, status: str, duration_seconds: float) → None, call:SSH_COMMANDS_TOTAL.labels(machine_id=machine_id or "unknown", action=action, status=status).inc, call:SSH_COMMAND_DURATION.labels(machine_id=machine_id or "unknown", action=action).observe, func:record_media_index_build(status: str, duration_seconds) → None, call:MEDIA_INDEX_BUILDS_TOTAL.labels(status=status).inc, call:MEDIA_INDEX_BUILD_DURATION.observe, func:record_backup_run(job_name: str, status: str, success) → None, call:BACKUP_RUNS_TOTAL.labels(job_name=job_name, status=status).inc, call:BACKUP_RUNS_LAST_SUCCESS.labels(job_name=job_name).set_to_current_time, func:record_mail_queue(status: str) → None, call:MAIL_QUEUE_SIZE.labels(status=status).inc, func:log_extra(request, **kwargs: Any) → dict[str, Any], call:get_request_id, call:extra.update | dep: uuid, contextvars, typing, fastapi, prometheus_client
 - path_utils.py | Maps Jellyfin media paths to SSH-accessible paths using media root anchoring or fallback prefixing. | exp: func:apply_remote_path_prefix(path: str, prefix: str) → str, call:(prefix or "").strip, call:normalized_prefix.rstrip, call:path.startswith, call:posixpath.normpath, call:logger.debug, call:posixpath.join, func:map_path_to_media_root(path: str, media_root: str) → str, call:(media_root or "").strip, call:posixpath.normpath, call:str(path).split, call:"/".join, call:path_absolute.startswith, call:logger.debug, call:posixpath.basename, call:raw_parts.index, call:posixpath.join, func:resolve_remote_media_path(path: str, media_root: str, fallback_prefix: str) → str, call:map_path_to_media_root, call:logger.debug, call:apply_remote_path_prefix | dep: logging, posixpath
 - utils.py | Provides UI-framework-independent formatting helpers and ffprobe output summarizers for video, audio, and subtitle streams. | exp: func:ticks_to_minutes(ticks: int | None) → int | None, call:round, func:human_size(num: int | float | None) → str, call:float, call:int, func:timestamp_to_local(ts: float | None) → str, call:datetime.fromtimestamp(ts).strftime, func:is_known_video_file(path: str | None) → bool, call:PurePosixPath(path).suffix.lower, func:format_duration(seconds: str | int | float | None) → str, call:float, call:str, call:int, func:format_bitrate(bit_rate: str | int | float | None) → str, call:float, call:str, func:_tags(stream: dict[str, Any]) → dict[str, Any], call:stream.get, func:_disposition(stream: dict[str, Any], key: str) → str, call:(stream.get("disposition") or {}).get, call:stream.get, func:_side_data_types(stream: dict[str, Any]) → str, call:stream.get, call:item.get, call:values.append, call:", ".join, func:ffprobe_format_summary(ffprobe: dict[str, Any]) → dict[str, str], call:ffprobe.get, call:fmt.get, call:format_duration, call:human_size, call:float, call:format_bitrate, call:str, func:summarize_video_streams(ffprobe: dict[str, Any]) → list[dict[str, Any]], call:ffprobe.get, call:stream.get, call:_tags, call:rows.append, call:format_bitrate, call:_side_data_types, call:tags.get, call:_disposition, func:summarize_audio_streams(ffprobe: dict[str, Any]) → list[dict[str, Any]], call:ffprobe.get, call:stream.get, call:_tags, call:rows.append, call:format_bitrate, call:tags.get, call:_disposition, func:summarize_subtitle_streams(ffprobe: dict[str, Any]) → list[dict[str, Any]], call:ffprobe.get, call:stream.get, call:_tags, call:rows.append, call:tags.get, call:_disposition, func:summarize_streams(ffprobe: dict[str, Any]) → list[dict[str, Any]], call:ffprobe.get, call:rows.append, call:format_bitrate, call:stream.get("tags", {}).get | dep: datetime, pathlib, typing
 - version.py | Provides version retrieval and formatting utilities for a backend service, falling back through environment variables, package metadata, and default values. | exp: func:get_backend_version() → str, call:os.getenv("APP_VERSION", "").strip, call:package_version, func:get_backend_build_info() → str, call:os.getenv("APP_BUILD_INFO", "").strip, call:os.getenv("GIT_COMMIT", "").strip, call:os.getenv("BUILD_COMMIT", "").strip, func:format_version_label(version: str, build_info: str) → str, call:version.strip, call:build_info.strip, func:get_version_info() → dict[str, str], call:get_backend_version, call:get_backend_build_info, call:format_version_label | dep: os, importlib.metadata
 ## arch
-Layered FastAPI architecture using dependency injection for cached service clients, Pydantic settings configuration, middleware-based OIDC/JWT/API-key authentication, Prometheus observability with structured logging, and template-based remote job execution.
+Layered FastAPI architecture using dependency injection, Pydantic settings, middleware-based auth (OIDC/JWT/API key), and modular utilities for configuration, logging, metrics, and path mapping.
 ## tags
-call:, settings, call:get, request, get, client, call:str, id
+call:, settings, call:get, request, id, get, call:str, client
 ## symbols
 - Settings
 - JobTemplate

backend/src/media_library_viewer_api/clients/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: backend/src/media_library_viewer_api/clients
 
 ## role
-Provides HTTP and command execution client wrappers for integrating with external media services (Jellyfin, Jellyseerr) and performing remote/local filesystem inspection.
+Collection of external service API clients and protocol wrappers that standardize communication with media servers, identity providers, torrent clients, and remote/local filesystems.
 ## parent
 index: backend/src/media_library_viewer_api/.pi-map.index.md
 map: backend/src/media_library_viewer_api/.pi-map.md
@@ -10,15 +10,18 @@ map: backend/src/media_library_viewer_api/.pi-map.md
 -
 ## files
 - __init__.py
+- authentik.py
+- http_timeout.py
 - jellyfin.py
 - jellyseerr.py
 - local.py
+- qbittorrent.py
 - ssh.py
 ## links
 index: backend/src/media_library_viewer_api/clients/.pi-map.index.md
 map: backend/src/media_library_viewer_api/clients/.pi-map.md
 ## workflows
 - change clients behavior
-  read: __init__.py, jellyfin.py, jellyseerr.py
+  read: __init__.py, authentik.py, http_timeout.py
 ## dirty
 -

backend/src/media_library_viewer_api/clients/.pi-map.md

@@ -4,28 +4,31 @@ dir: backend/src/media_library_viewer_api/clients
 index: backend/src/media_library_viewer_api/clients/.pi-map.index.md
 
 ## role
-Provides HTTP and command execution client wrappers for integrating with external media services (Jellyfin, Jellyseerr) and performing remote/local filesystem inspection.
+Collection of external service API clients and protocol wrappers that standardize communication with media servers, identity providers, torrent clients, and remote/local filesystems.
 ## files
 - __init__.py | Swaps the position of two tmux panes within a window or between windows | dep: tmux, sh
-- jellyfin.py | Provides a reusable, framework-agnostic HTTP client wrapper for the Jellyfin/Emby API with methods for browsing users, libraries, media items, and sessions. | exp: class:JellyfinClient, method:__init__(self, base_url: str, api_key: str, timeout), call:base_url.rstrip, call:self.base_url.endswith, call:requests.Session, call:self.session.headers.update, raise:ValueError, method:get(self, path: str, **params: Any) → Any, call:params.items, call:logger.debug, call:sorted, call:clean_params.keys, call:self.session.get, call:response.raise_for_status, call:logger.warning, call:response.json, raise:requests.HTTPError, method:users(self) → list[dict[str, Any]], call:self.get, call:logger.info, call:len, method:libraries(self, user_id: str) → list[dict[str, Any]], call:self.get(f"/Users/{user_id}/Views").get, call:logger.info, call:len, method:items(self, user_id: str, parent_id, start_index, limit, search, include_item_types, recursive, sort_by, sort_order) → dict[str, Any], call:logger.debug, call:self.get, call:str(recursive).lower, method:item_count(self, user_id: str, include_item_types: str, parent_id) → int, call:self.get, call:int, call:response.get, call:logger.debug, method:media_counts(self, user_id: str) → dict[str, int], call:self.item_count, method:library_item_counts(self, user_id: str, libraries: list[dict[str, Any]]) → list[dict[str, Any]], call:lib.get, call:self.item_count, call:results.append, method:sessions(self, active_within_seconds) → list[dict[str, Any]], call:self.get, call:cast, call:isinstance, method:active_sessions(self, active_within_seconds) → list[dict[str, Any]], call:self.sessions, call:session.get, call:logger.info, call:len, method:image_url(self, item_id: str, image_type) → str | dep: logging, typing, requests
+- authentik.py | API client wrapper for Authentik directory service providing paginated user browsing and search via REST API. | exp: class:AuthentikClient, method:__init__(self, base_url: str, api_token: str, timeout), call:base_url.rstrip, call:self.base_url.endswith, call:http_timeout, call:requests.Session, call:self.session.headers.update, raise:ValueError, method:get(self, path: str, **params: Any) → Any, call:params.items, call:logger.debug, call:sorted, call:clean_params.keys, call:self.session.get, call:response.raise_for_status, call:logger.warning, call:response.json, raise:requests.HTTPError, method:users(self, search, page, page_size) → dict[str, Any], call:self.get, call:isinstance, call:logger.warning, call:type, call:payload.get, call:int, call:pagination.get, call:logger.info, call:len | dep: logging, typing, requests, media_library_viewer_api.clients.http_timeout
-- jellyseerr.py | HTTP client wrapper for the Jellyseerr REST API to fetch user data and enrich Jellyfin user information | exp: class:JellyseerrClient, method:__init__(self, base_url: str, api_key: str, timeout), call:base_url.rstrip, call:self.base_url.endswith, call:requests.Session, call:self.session.headers.update, raise:ValueError, method:get(self, path: str, **params: Any) → Any, call:params.items, call:logger.debug, call:sorted, call:clean_params.keys, call:self.session.get, call:response.raise_for_status, call:logger.warning, call:response.json, raise:requests.HTTPError, method:absolute_url(self, path: str | None) → str, call:path.startswith, method:jellyfin_users(self) → list[dict[str, Any]], call:self.get, call:isinstance, call:logger.info, call:len, call:payload.get, method:users(self, page_size) → list[dict[str, Any]], call:max, call:int, call:self.get, call:isinstance, call:payload.get, call:results.extend, call:page_info.get, call:logger.debug, call:len, call:logger.info | dep: logging, typing, requests
+- http_timeout.py | Provides a helper function to build decoupled (connect, read) timeout tuples for the `requests` library, allowing different timeout budgets for connection and read phases. | exp: func:http_timeout(read_timeout, connect_timeout) → tuple[float, float], call:float
+- jellyfin.py | Wraps the Jellyfin/Emby HTTP API to provide methods for fetching users, libraries, media items, playback sessions, and image URLs as plain Python dictionaries. | exp: class:JellyfinClient, method:__init__(self, base_url: str, api_key: str, timeout), call:base_url.rstrip, call:self.base_url.endswith, call:http_timeout, call:requests.Session, call:self.session.headers.update, raise:ValueError, method:get(self, path: str, **params: Any) → Any, call:params.items, call:logger.debug, call:sorted, call:clean_params.keys, call:self.session.get, call:response.raise_for_status, call:logger.warning, call:response.json, raise:requests.HTTPError, method:users(self) → list[dict[str, Any]], call:self.get, call:logger.info, call:len, method:resolve_user_id(self, identifier: str | None) → str, call:self.users, call:any, call:str, call:u.get, call:next, call:logger.info, call:logger.warning, raise:RuntimeError, method:libraries(self, user_id: str) → list[dict[str, Any]], call:self.get(f"/Users/{user_id}/Views").get, call:logger.info, call:len, method:items(self, user_id: str, parent_id, start_index, limit, search, include_item_types, recursive, sort_by, sort_order) → dict[str, Any], call:logger.debug, call:self.get, call:str(recursive).lower, method:item_count(self, user_id: str, include_item_types: str, parent_id) → int, call:self.get, call:int, call:response.get, call:logger.debug, method:media_counts(self, user_id: str) → dict[str, int], call:self.item_count, method:library_item_counts(self, user_id: str, libraries: list[dict[str, Any]]) → list[dict[str, Any]], call:lib.get, call:self.item_count, call:results.append, method:sessions(self, active_within_seconds) → list[dict[str, Any]], call:self.get, call:cast, call:isinstance, method:active_sessions(self, active_within_seconds) → list[dict[str, Any]], call:self.sessions, call:session.get, call:logger.info, call:len, method:image_url(self, item_id: str, image_type) → str | dep: logging, typing, requests, media_library_viewer_api.clients.http_timeout
+- jellyseerr.py | HTTP API client for Jellyseerr that fetches and enriches Jellyfin user and request metadata. | exp: class:JellyseerrClient, method:__init__(self, base_url: str, api_key: str, timeout), call:base_url.rstrip, call:self.base_url.endswith, call:http_timeout, call:requests.Session, call:self.session.headers.update, raise:ValueError, method:get(self, path: str, **params: Any) → Any, call:params.items, call:logger.debug, call:sorted, call:clean_params.keys, call:self.session.get, call:response.raise_for_status, call:logger.warning, call:response.json, raise:requests.HTTPError, method:absolute_url(self, path: str | None) → str, call:path.startswith, method:_resolve_title(self, media_type: Any, tmdb_id: Any) → str, call:str, call:self.get, call:data.get, method:jellyfin_users(self) → list[dict[str, Any]], call:self.get, call:isinstance, call:logger.info, call:len, call:payload.get, method:users(self, page_size) → list[dict[str, Any]], call:max, call:int, call:self.get, call:isinstance, call:payload.get, call:results.extend, call:page_info.get, call:logger.debug, call:len, call:logger.info, method:request_count(self) → dict[str, int], call:self.get, call:isinstance, call:int, call:payload.get, call:logger.info, method:recent_requests(self, take) → list[dict[str, Any]], call:max, call:min, call:int, call:self.get, call:isinstance, call:payload.get, call:r.get, call:media.get, call:self._resolve_title, call:mapped.append, call:_label, call:(media or {}).get, method:open_requests(self, max_per_filter) → list[dict[str, Any]], call:self.get, call:isinstance, call:payload.get, call:r.get, call:media.get, call:self._resolve_title, call:results.append, call:_label, call:(media or {}).get, call:len, call:results.sort, call:logger.info, func:_label(value: Any, table: dict[int, str]) → str, call:table.get, call:int, call:str | dep: logging, typing, requests, media_library_viewer_api.clients.http_timeout
 - local.py | Provides a local command execution client that mirrors remote SSH helpers to run POSIX shell commands, list directories, stat paths, and run ffprobe on the API host for built-in local monitoring. | exp: class:CommandResult, class:LocalCommandClient, method:__init__(self, timeout), method:run(self, command: str, timeout) → CommandResult, call:logger.debug, call:subprocess.run, call:CommandResult, call:logger.warning, call:result.stderr.strip, call:result.stdout.strip, method:list_dir(self, path: str) → CommandResult, call:shlex.quote, call:self.run, method:stat_path(self, path: str) → CommandResult, call:shlex.quote, call:self.run, method:ffprobe_json(self, path: str) → dict[str, object], call:shlex.quote, call:self.run, call:json.loads, raise:RuntimeError | dep: json, logging, posixpath, shlex, subprocess, dataclasses
+- qbittorrent.py | Minimal read-only qBittorrent Web API client that authenticates via username/password and fetches/merges incremental sync/maindata snapshots with caching, locking, and exponential backoff. | exp: class:QbittorrentClient, method:__init__(self, base_url: str, username: str, password: str, timeout) → None, call:base_url.rstrip, call:self.base_url.endswith, call:http_timeout, call:requests.Session, call:threading.Lock, raise:ValueError, method:_login(self) → None, call:self._session.post, call:resp.raise_for_status, call:resp.text.strip, call:name.strip().upper, call:upper.startswith, call:resp.headers.get, call:set_cookie_hdr.split("=", 1)[0].strip, call:any, call:_is_session_cookie, call:resp.cookies.keys, call:bool, call:logger.info, call:sorted, raise:RuntimeError, method:_get(self, path: str, **params: Any) → dict[str, Any], call:self._login, call:self._session.get, call:logger.debug, call:resp.raise_for_status, call:resp.json, method:maindata(self) → dict[str, Any], call:time.time, call:self._snapshot.get, call:self._copy_snapshot, call:self._fetch_maindata_incremental, call:self._apply_update, call:min, call:logger.warning, raise:RuntimeError, method:_fetch_maindata_incremental(self) → dict[str, Any], call:self._get, method:_apply_update(self, update: dict[str, Any]) → None, call:bool, call:update.get, call:snap.clear, call:dict, call:list, call:isinstance, call:snap["server_state"].update, call:changed.items, call:snap["torrents"].pop, call:snap["categories"].update, call:snap["categories"].pop, method:_copy_snapshot(self) → dict[str, Any], call:dict, call:snap.get, call:list | dep: logging, threading, time, typing, requests, media_library_viewer_api.clients.http_timeout
 - ssh.py | Provides an SSH client wrapper for remote filesystem inspection and media analysis using paramiko, with POSIX shell command execution and host key management. | exp: class:CommandResult, class:RemoteSSHClient, method:__init__(self, host: str, username: str, port, key_filename, private_key, private_key_passphrase, password, known_hosts_path, timeout), raise:ValueError, method:connect(self) → paramiko.SSHClient, call:paramiko.SSHClient, call:client.load_system_host_keys, call:Path, call:bool, call:has_known_host, call:known_hosts_file.is_file, call:client.load_host_keys, call:client.set_missing_host_key_policy, call:paramiko.RejectPolicy, call:paramiko.AutoAddPolicy, call:self._load_private_key, call:client.connect, call:str(exc).lower, call:known_hosts_file.parent.mkdir, call:client.save_host_keys, raise:RuntimeError, method:close(self) → None, call:self._client.close, method:run(self, command: str, timeout) → CommandResult, call:self.connect, call:shlex.quote, call:logger.debug, call:client.exec_command, call:stdout.channel.recv_exit_status, call:CommandResult, call:stdout.read().decode, call:stderr.read().decode, call:logger.warning, call:result.stderr.strip, call:result.stdout.strip, method:list_dir(self, path: str) → CommandResult, call:shlex.quote, call:self.run, call:logger.info, method:stat_path(self, path: str) → CommandResult, call:shlex.quote, call:self.run, call:logger.info, method:ffprobe_json(self, path: str) → dict[str, Any], call:shlex.quote, call:self.run, call:logger.info, call:json.loads, raise:RuntimeError | dep: json, logging, posixpath, shlex, dataclasses, io, pathlib, typing, paramiko, media_library_viewer_api.services.known_hosts
 ## arch
-Client-wrapper pattern with framework-agnostic abstractions; parallel local/remote execution strategies via paramiko SSH and local subprocess; centralized REST API communication modules.
+Adapter/wrapper pattern around `requests` HTTP and SSH/paramiko protocols, with each client encapsulating authentication, data fetching, and response normalization into plain Python dictionaries.
 ## tags
-call:logger.info, call:logger.debug, call:self.get, call:shlex.quote, error, host, call:self.run, init
+call:logger.info, call:self.get, call:self., error, call:logger.debug, call:logger.warning, call:isinstance, client
 ## symbols
+- AuthentikClient
 - JellyfinClient
 - JellyseerrClient
 - CommandResult
 - LocalCommandClient
+- QbittorrentClient
 - RemoteSSHClient
 - __init__
-- get
-- users
 ## workflows
 - change clients behavior
-  read: __init__.py, jellyfin.py, jellyseerr.py
+  read: __init__.py, authentik.py, http_timeout.py
 ## dirty
 -

backend/src/media_library_viewer_api/clients/authentik.py

@@ -1,9 +1,7 @@
-"""Authentik directory API client.
+"""Read-only Authentik directory client.
 
-Authentik is the user-directory source (replacing the Jellyfin-backed Users
+The client normalizes the subset of Authentik core data that Manage displays.
-page). This client wraps the Authentik REST API for browsing the user directory
+It deliberately does not fetch individual users or expose policy/provider data.
-with pagination and search. OIDC authentication is unchanged — this client is
-for the directory, not SSO.
 """
 
 from __future__ import annotations
@@ -13,13 +11,40 @@ from typing import Any
 
 import requests
 
+from media_library_viewer_api.clients.http_timeout import DEFAULT_READ_TIMEOUT, http_timeout
+
 logger = logging.getLogger(__name__)
 
+_MAX_COLLECTION_ITEMS = 10_000
+_PAGE_SIZE = 100
+
+
+def _text(value: Any) -> str:
+    return str(value).strip() if value is not None else ""
+
+
+def _identifier(item: dict[str, Any]) -> str:
+    for key in ("pk", "id", "uuid"):
+        value = _text(item.get(key))
+        if value:
+            return value
+    return ""
+
+
+def _page_total(payload: dict[str, Any], fallback: int) -> int:
+    pagination = payload.get("pagination")
+    if isinstance(pagination, dict):
+        try:
+            return max(0, int(pagination.get("count") or fallback))
+        except (TypeError, ValueError):
+            pass
+    return fallback
+
 
 class AuthentikClient:
-    """Small wrapper around the Authentik core directory API."""
+    """Small wrapper around Authentik's read-only core API."""
 
-    def __init__(self, base_url: str, api_token: str, timeout: float = 10.0):
+    def __init__(self, base_url: str, api_token: str, timeout: float = DEFAULT_READ_TIMEOUT):
         if not base_url:
             raise ValueError("Authentik base_url is required")
         if not api_token:
@@ -29,87 +54,139 @@ class AuthentikClient:
         if self.base_url.endswith("/api/v3"):
             self.base_url = self.base_url[:-7]
         self.api_token = api_token
-        self.timeout = timeout
+        self.timeout = http_timeout(timeout)
         self.session = requests.Session()
-        self.session.headers.update(
+        self.session.headers.update({"Authorization": f"Bearer {api_token}", "Accept": "application/json"})
-            {
-                "Authorization": f"Bearer {api_token}",
-                "Accept": "application/json",
-            }
-        )
 
     def get(self, path: str, **params: Any) -> Any:
         """GET an Authentik endpoint and include useful response text on errors."""
-        clean_params = {k: v for k, v in params.items() if v is not None and v != ""}
+        clean_params = {key: value for key, value in params.items() if value is not None and value != ""}
         logger.debug("Authentik GET %s params=%s", path, sorted(clean_params.keys()))
-        response = self.session.get(
+        response = self.session.get(f"{self.base_url}/api/v3{path}", params=clean_params, timeout=self.timeout)
-            f"{self.base_url}/api/v3{path}",
-            params=clean_params,
-            timeout=self.timeout,
-        )
         try:
             response.raise_for_status()
         except requests.HTTPError as exc:
             detail = response.text[:500]
-            logger.warning(
+            logger.warning("Authentik GET %s failed status=%s url=%s", path, response.status_code, response.url)
-                "Authentik GET %s failed status=%s url=%s",
+            raise requests.HTTPError(f"{response.status_code} for {response.url}: {detail}", response=response) from exc
-                path,
-                response.status_code,
-                response.url,
-            )
-            raise requests.HTTPError(
-                f"{response.status_code} for {response.url}: {detail}",
-                response=response,
-            ) from exc
-        logger.debug("Authentik GET %s ok status=%s", path, response.status_code)
         return response.json()
 
-    def users(
+    def users(self, search: str | None = None, page: int = 1, page_size: int = 50) -> dict[str, Any]:
+        """Return one raw user page for the directory and messaging surfaces."""
+        payload = self.get("/core/users/", search=search, page=page, page_size=page_size)
+        if not isinstance(payload, dict):
+            logger.warning("Authentik users payload was not a dict: %s", type(payload).__name__)
+            return {"items": [], "total": 0, "page": page, "page_size": page_size}
+        results = payload.get("results")
+        items = [item for item in results if isinstance(item, dict)] if isinstance(results, list) else []
+        return {"items": items, "total": _page_total(payload, len(items)), "page": page, "page_size": page_size}
+
+    def _collection(self, path: str, limit: int = _MAX_COLLECTION_ITEMS) -> dict[str, Any]:
+        """Read a paginated core collection with a hard cap and loop protection."""
+        try:
+            requested = max(1, min(int(limit), _MAX_COLLECTION_ITEMS))
+        except (TypeError, ValueError):
+            requested = _MAX_COLLECTION_ITEMS
+        items: list[dict[str, Any]] = []
+        page = 1
+        total = 0
+        while len(items) < requested:
+            payload = self.get(path, page=page, page_size=min(_PAGE_SIZE, requested - len(items)))
+            if not isinstance(payload, dict):
+                logger.warning("Authentik %s payload was not a dict: %s", path, type(payload).__name__)
+                break
+            results = payload.get("results")
+            page_items = [item for item in results if isinstance(item, dict)] if isinstance(results, list) else []
+            total = _page_total(payload, len(items) + len(page_items))
+            items.extend(page_items[: requested - len(items)])
+            if not page_items or len(items) >= total:
+                break
+            page += 1
+            if page > 100:  # defensive limit for malformed pagination responses
+                logger.warning("Authentik %s pagination stopped after 100 pages", path)
+                break
+        return {"items": items, "total": total or len(items)}
+
+    @staticmethod
+    def _normalize_group(item: dict[str, Any]) -> dict[str, str] | None:
+        group_id = _identifier(item)
+        if not group_id:
+            return None
+        name = _text(item.get("name") or item.get("display_name") or item.get("slug"))
+        return {"id": group_id, "name": name or f"Unnamed group ({group_id})"}
+
+    @staticmethod
+    def _normalize_application(item: dict[str, Any]) -> dict[str, str]:
+        app_id = _identifier(item)
+        return {
+            "id": app_id,
+            "name": _text(item.get("name") or item.get("slug") or item.get("meta_name")) or "Unnamed application",
+            "slug": _text(item.get("slug")),
+            "launch_url": _text(item.get("launch_url") or item.get("meta_launch_url")),
+        }
+
+    def groups(self, limit: int = _MAX_COLLECTION_ITEMS) -> dict[str, Any]:
+        """Return normalized groups; only display-safe identifiers and names are retained."""
+        raw = self._collection("/core/groups/", limit)
+        items = [normalized for item in raw["items"] if (normalized := self._normalize_group(item)) is not None]
+        return {"items": items, "total": raw["total"]}
+
+    def applications(self, limit: int = _MAX_COLLECTION_ITEMS) -> dict[str, Any]:
+        """Return normalized applications without provider, policy, or secret fields."""
+        raw = self._collection("/core/applications/", limit)
+        return {"items": [self._normalize_application(item) for item in raw["items"]], "total": raw["total"]}
+
+    @staticmethod
+    def _group_references(user: dict[str, Any]) -> list[str]:
+        """Extract group ids from release-dependent user reference shapes."""
+        raw = user.get("groups", user.get("group", []))
+        if not isinstance(raw, list):
+            raw = [raw] if raw is not None else []
+        ids: list[str] = []
+        for reference in raw:
+            if isinstance(reference, dict):
+                group_id = _identifier(reference)
+            else:
+                group_id = _text(reference)
+            if group_id and group_id not in ids:
+                ids.append(group_id)
+        return ids
+
+    def access_summaries(
         self,
         search: str | None = None,
         page: int = 1,
         page_size: int = 50,
     ) -> dict[str, Any]:
-        """Return a normalized page of Authentik users.
+        """Summarize user group references and privileged flags without N+1 user reads.
 
-        Calls ``GET /api/v3/core/users/`` and normalizes the paginated
+        This is directory metadata only: group membership plus the explicit
-        Authentik response into ``{items, total, page, page_size}``. Each item
+        ``is_superuser`` and ``is_staff`` fields. It does not evaluate policies
-        is the raw Authentik user dict (pk, username, name, email, avatar, …)
+        or claim to calculate effective authorization.
-        so the frontend can pick the fields it needs.
         """
-        payload = self.get(
+        users = self.users(search=search, page=page, page_size=page_size)
-            "/core/users/",
+        groups = self.groups()
-            search=search,
+        group_names = {group["id"]: group["name"] for group in groups["items"]}
-            page=page,
+        summaries: list[dict[str, Any]] = []
-            page_size=page_size,
+        for user in users["items"]:
-        )
+            group_ids = self._group_references(user)
-        if not isinstance(payload, dict):
+            summaries.append(
-            logger.warning("Authentik users payload was not a dict: %s", type(payload).__name__)
+                {
-            return {"items": [], "total": 0, "page": page, "page_size": page_size}
+                    "id": _identifier(user),
-
+                    "username": _text(user.get("username")),
-        results = payload.get("results")
+                    "name": _text(user.get("name")),
-        items: list[dict[str, Any]] = (
+                    "email": _text(user.get("email")),
-            [item for item in results if isinstance(item, dict)] if isinstance(results, list) else []
+                    "is_active": bool(user.get("is_active", True)),
-        )
+                    "is_superuser": bool(user.get("is_superuser", False)),
-
+                    "is_staff": bool(user.get("is_staff", False)),
-        pagination = payload.get("pagination") or {}
+                    "groups": [
-        total = 0
+                        {
-        if isinstance(pagination, dict):
+                            "id": group_id,
-            try:
+                            "name": group_names.get(group_id, f"Unknown group ({group_id})"),
-                total = int(pagination.get("count") or 0)
+                            "known": group_id in group_names,
-            except (TypeError, ValueError):
+                        }
-                total = 0
+                        for group_id in group_ids
-
+                    ],
-        logger.info(
+                }
-            "Authentik users page=%s page_size=%s -> %s items (total=%s)",
+            )
-            page,
+        return {"items": summaries, "total": users["total"], "page": users["page"], "page_size": users["page_size"]}
-            page_size,
-            len(items),
-            total,
-        )
-        return {
-            "items": items,
-            "total": total,
-            "page": page,
-            "page_size": page_size,
-        }

backend/src/media_library_viewer_api/clients/http_timeout.py

@@ -0,0 +1,36 @@
+"""Shared HTTP timeout helpers.
+
+``requests`` accepts a single integer timeout and applies it to BOTH the
+connect and read phases. For slow upstream services (large Jellyfin
+libraries, qBittorrent with many torrents), the read phase needs a much
+larger budget than connect. These helpers produce ``(connect, read)`` tuples
+so the two phases are decoupled.
+"""
+
+from __future__ import annotations
+
+#: Short connect timeout — fail fast on unreachable/dead hosts.
+DEFAULT_CONNECT_TIMEOUT = 5.0
+
+#: Generous read timeout — let slow responses complete.
+DEFAULT_READ_TIMEOUT = 60.0
+
+
+def http_timeout(
+    read_timeout: float | int | None = None,
+    connect_timeout: float = DEFAULT_CONNECT_TIMEOUT,
+) -> tuple[float, float]:
+    """Build a ``(connect, read)`` timeout tuple for ``requests``.
+
+    ``read_timeout`` is the per-response read budget (seconds). When omitted
+    or non-positive, :data:`DEFAULT_READ_TIMEOUT` applies.
+    """
+    effective_read = DEFAULT_READ_TIMEOUT
+    if read_timeout is not None:
+        try:
+            parsed = float(read_timeout)
+            if parsed > 0:
+                effective_read = parsed
+        except (TypeError, ValueError):
+            pass  # fall back to default on non-numeric input
+    return (connect_timeout, effective_read)

backend/src/media_library_viewer_api/clients/jellyfin.py

@@ -12,6 +12,8 @@ from typing import Any, cast
 
 import requests
 
+from media_library_viewer_api.clients.http_timeout import DEFAULT_READ_TIMEOUT, http_timeout
+
 logger = logging.getLogger(__name__)
 
 
@@ -35,7 +37,7 @@ DEFAULT_FIELDS = ",".join(
 class JellyfinClient:
     """Small wrapper around the Jellyfin/Emby-compatible HTTP API."""
 
-    def __init__(self, base_url: str, api_key: str, timeout: int = 30):
+    def __init__(self, base_url: str, api_key: str, timeout: float = DEFAULT_READ_TIMEOUT):
         if not base_url:
             raise ValueError("Jellyfin URL is required")
         if not api_key:
@@ -47,7 +49,8 @@ class JellyfinClient:
         if self.base_url.endswith("/web"):
             self.base_url = self.base_url[:-4]
         self.api_key = api_key
-        self.timeout = timeout
+        # timeout is the per-response READ timeout (seconds); connect timeout is fixed at 5s.
+        self.timeout = http_timeout(timeout)
         self.session = requests.Session()
         self.session.headers.update(
             {
@@ -87,6 +90,32 @@ class JellyfinClient:
         logger.info("Jellyfin returned %s visible users", len(users))
         return users
 
+    def resolve_user_id(self, identifier: str | None) -> str:
+        """Resolve a configured user identifier to Jellyfin's internal Id.
+
+        The service ``user_id`` config field accepts either the internal Jellyfin
+        Id (a hash) or a username (e.g. ``'admin'``). Jellyfin's
+        ``/Users/{id}/...`` endpoints reject usernames with HTTP 400
+        (``"The value 'admin' is not valid."``), so any caller must resolve
+        usernames to the real Id before hitting user-scoped endpoints.
+
+        Resolution order: exact ``Id`` match → ``Name`` match → first visible
+        user. Raises if the API key cannot see any users.
+        """
+        users = self.users()
+        if not users:
+            raise RuntimeError("No Jellyfin users visible to this API key")
+        if identifier:
+            if any(str(u.get("Id")) == identifier for u in users):
+                return identifier
+            match = next((u for u in users if str(u.get("Name", "")) == identifier), None)
+            if match:
+                resolved = str(match["Id"])
+                logger.info("Resolved Jellyfin username %r to Id %s", identifier, resolved)
+                return resolved
+            logger.warning("Jellyfin user identifier %r not found; using first user", identifier)
+        return str(users[0]["Id"])
+
     def libraries(self, user_id: str) -> list[dict[str, Any]]:
         """Return top-level library views visible to the selected Jellyfin user."""
         items = self.get(f"/Users/{user_id}/Views").get("Items", [])

backend/src/media_library_viewer_api/clients/jellyseerr.py

@@ -11,13 +11,33 @@ from typing import Any
 
 import requests
 
+from media_library_viewer_api.clients.http_timeout import DEFAULT_READ_TIMEOUT, http_timeout
+
 logger = logging.getLogger(__name__)
 
+# Jellyseerr numeric status enums (see Overseerr/Jellyseerr source).
+_REQUEST_STATUS: dict[int, str] = {1: "pending", 2: "approved", 3: "declined"}
+_MEDIA_STATUS: dict[int, str] = {
+    1: "unknown",
+    2: "pending",
+    3: "processing",
+    4: "partially_available",
+    5: "available",
+}
+_REQUEST_TYPE: dict[int, str] = {1: "movie", 2: "tv"}
+
+
+def _label(value: Any, table: dict[int, str]) -> str:
+    try:
+        return table.get(int(value), str(value))
+    except (TypeError, ValueError):
+        return str(value) if value is not None else ""
+
 
 class JellyseerrClient:
     """Small wrapper around the Jellyseerr REST API."""
 
-    def __init__(self, base_url: str, api_key: str, timeout: int = 30):
+    def __init__(self, base_url: str, api_key: str, timeout: float = DEFAULT_READ_TIMEOUT):
         if not base_url:
             raise ValueError("Jellyseerr URL is required")
         if not api_key:
@@ -27,7 +47,8 @@ class JellyseerrClient:
         if self.base_url.endswith("/api/v1"):
             self.base_url = self.base_url[:-7]
         self.api_key = api_key
-        self.timeout = timeout
+        # timeout is the per-response READ timeout (seconds); connect timeout is fixed at 5s.
+        self.timeout = http_timeout(timeout)
         self.session = requests.Session()
         self.session.headers.update(
             {
@@ -35,6 +56,7 @@ class JellyseerrClient:
                 "Accept": "application/json",
             }
         )
+        self._title_cache: dict[tuple[str, str], str] = {}
 
     def get(self, path: str, **params: Any) -> Any:
         """GET a Jellyseerr endpoint and include useful response text on errors."""
@@ -63,6 +85,26 @@ class JellyseerrClient:
             path = f"/{path}"
         return f"{self.base_url}{path}"
 
+    def _resolve_title(self, media_type: Any, tmdb_id: Any) -> str:
+        """Resolve a media title via /movie/{tmdbId} or /tv/{tmdbId}, cached.
+
+        Jellyseerr's /request list doesn't include titles; they live on the
+        Movie/Series records. Cached per (type, tmdbId) so repeated polls reuse.
+        """
+        if not tmdb_id:
+            return ""
+        key = (str(media_type or ""), str(tmdb_id))
+        if key in self._title_cache:
+            return self._title_cache[key]
+        try:
+            is_tv = str(media_type) in ("2", "tv")
+            data = self.get(f"/{'tv' if is_tv else 'movie'}/{tmdb_id}")
+            title = str(data.get("name" if is_tv else "title") or "")
+        except Exception:
+            title = ""
+        self._title_cache[key] = title
+        return title
+
     def jellyfin_users(self) -> list[dict[str, Any]]:
         """Return Jellyfin-linked users known to Jellyseerr.
 
@@ -133,3 +175,102 @@ class JellyseerrClient:
 
         logger.info("Jellyseerr returned %s users", len(results))
         return results
+
+    def request_count(self) -> dict[str, int]:
+        """Return normalized request counts from /api/v1/request/count.
+
+        Jellyseerr reports pending/approved/declined/processing/available/total.
+        Missing keys default to 0 so callers can rely on a stable shape.
+        """
+        payload = self.get("/request/count")
+        if not isinstance(payload, dict):
+            payload = {}
+        keys = ("total", "pending", "approved", "declined", "processing", "available")
+        counts = {k: int(payload.get(k) or 0) for k in keys}
+        logger.info(
+            "Jellyseerr request counts total=%s pending=%s processing=%s",
+            counts["total"],
+            counts["pending"],
+            counts["processing"],
+        )
+        return counts
+
+    def recent_requests(self, take: int = 20) -> list[dict[str, Any]]:
+        """Return the most recently modified requests with resolved titles."""
+        take = max(1, min(int(take), 100))
+        payload = self.get("/request", sort="modified", skip=0, take=take)
+        if not isinstance(payload, dict):
+            return []
+        results = payload.get("results") or []
+        items = [r for r in results if isinstance(r, dict)] if isinstance(results, list) else []
+        mapped: list[dict[str, Any]] = []
+        for r in items:
+            media = r.get("media") or {}
+            tmdb_id = media.get("tmdbId")
+            name = r.get("title") or media.get("title") or media.get("name") or ""
+            if not name and tmdb_id:
+                name = self._resolve_title(r.get("type"), tmdb_id)
+            if not name:
+                name = media.get("externalServiceSlug") or ""
+            mapped.append(
+                {
+                    "id": r.get("id"),
+                    "type": _label(r.get("type"), _REQUEST_TYPE),
+                    "name": name or "—",
+                    "status": _label(r.get("status"), _REQUEST_STATUS),
+                    "media_status": _label((media or {}).get("status"), _MEDIA_STATUS),
+                    "created_at": r.get("createdAt"),
+                }
+            )
+        return mapped
+
+    def open_requests(self, max_per_filter: int = 100) -> list[dict[str, Any]]:
+        """Return open (pending + approved) requests with resolved titles.
+
+        Fetches pending and approved requests via Jellyseerr's filter param
+        (not all 800+ historical requests), then resolves titles from
+        /movie/{tmdbId} or /tv/{tmdbId}. Titles are cached on the client so
+        subsequent polls are instant.
+        """
+        results: list[dict[str, Any]] = []
+        take = 50
+        for filter_val in ("pending", "approved"):
+            skip = 0
+            while skip < max_per_filter:
+                payload = self.get("/request", filter=filter_val, sort="added", skip=skip, take=take)
+                if not isinstance(payload, dict):
+                    break
+                page = payload.get("results") or []
+                items = [r for r in page if isinstance(r, dict)] if isinstance(page, list) else []
+                for r in items:
+                    media = r.get("media") or {}
+                    tmdb_id = media.get("tmdbId") or r.get("tmdbId")
+                    # Diagnostic: log the first request's shape once so we can verify tmdbId.
+                    if not results and filter_val == "pending":
+                        logger.info(
+                            "Jellyseerr request sample: keys=%s media_keys=%s tmdbId=%s",
+                            sorted(r.keys()),
+                            sorted(media.keys()) if isinstance(media, dict) else "N/A",
+                            tmdb_id,
+                        )
+                    name = r.get("title") or media.get("title") or media.get("name") or ""
+                    if not name and tmdb_id:
+                        name = self._resolve_title(r.get("type"), tmdb_id)
+                    if not name:
+                        name = media.get("externalServiceSlug") or ""
+                    results.append(
+                        {
+                            "id": r.get("id"),
+                            "type": _label(r.get("type"), _REQUEST_TYPE),
+                            "name": name or "—",
+                            "status": _label(r.get("status"), _REQUEST_STATUS),
+                            "media_status": _label((media or {}).get("status"), _MEDIA_STATUS),
+                            "created_at": r.get("createdAt"),
+                        }
+                    )
+                if len(items) < take:
+                    break
+                skip += len(items)
+        results.sort(key=lambda r: r.get("created_at") or 0, reverse=True)
+        logger.info("Jellyseerr returned %s open requests (with titles)", len(results))
+        return results

backend/src/media_library_viewer_api/clients/qbittorrent.py

@@ -0,0 +1,251 @@
+"""Minimal qBittorrent Web API client (read-only: sync/maindata only).
+
+Modeled on :class:`~media_library_viewer_api.clients.jellyfin.JellyfinClient`'s
+session pattern. Authentication uses username/password login which stores an
+SID cookie in the requests session. The client re-logins transparently on 403.
+"""
+
+from __future__ import annotations
+
+import logging
+import threading
+import time
+from typing import Any
+
+import requests
+
+from media_library_viewer_api.clients.http_timeout import DEFAULT_READ_TIMEOUT, http_timeout
+
+logger = logging.getLogger(__name__)
+
+# qBittorrent's built-in web server is effectively single-threaded; collapse
+# concurrent widget polls onto one fetch and back off when it struggles.
+MAINDATA_CACHE_TTL = 3.0  # seconds a snapshot is served without re-hitting qBittorrent
+MAINDATA_BACKOFF_MAX = 30.0  # cap exponential backoff after repeated failures
+
+
+class QbittorrentClient:
+    """Small wrapper around the qBittorrent Web API.
+
+    Only the endpoints needed by the dashboard widgets are implemented
+    (currently just ``/sync/maindata``). All calls share a single
+    :class:`requests.Session` that carries the login cookie.
+    """
+
+    def __init__(self, base_url: str, username: str, password: str, timeout: float = DEFAULT_READ_TIMEOUT) -> None:
+        if not base_url:
+            raise ValueError("qBittorrent base_url is required")
+        if not username:
+            raise ValueError("qBittorrent username is required")
+
+        self.base_url = base_url.rstrip("/")
+        if not self.base_url.endswith("/api/v2"):
+            self.base_url += "/api/v2"
+        self._username = username
+        self._password = password
+        # timeout is the per-response READ timeout (seconds); connect timeout is fixed at 5s.
+        self.timeout = http_timeout(timeout)
+        self._session = requests.Session()
+        self._logged_in = False
+        # /sync/maindata is the only hot endpoint. Maintain a rid-merged
+        # snapshot (incremental updates -> small payloads), a short-TTL cache
+        # + lock so concurrent widgets share one fetch, and back off when
+        # qBittorrent is struggling rather than piling on (its web server is
+        # single-threaded and otherwise hangs the Web UI for everyone).
+        self._rid: int | None = None
+        self._snapshot: dict[str, Any] = {
+            "server_state": {},
+            "torrents": {},
+            "categories": {},
+            "tags": [],
+            "trackers": [],
+        }
+        self._maindata_lock = threading.Lock()
+        self._maindata_fetched_at: float = 0.0
+        self._maindata_ttl: float = MAINDATA_CACHE_TTL
+        self._backoff_until: float = 0.0
+        self._consecutive_failures = 0
+
+    def _login(self) -> None:
+        """POST username/password to ``/auth/login``; store the SID cookie.
+
+        qBittorrent replies with the plain text ``"Ok."`` and a ``SID`` cookie
+        on success, ``"Fails."`` on bad credentials, and ``403 Forbidden`` when
+        the source IP is banned (too many failed attempts). The ``Referer``
+        header is required by qBittorrent's CSRF protection.
+
+        Any other body — in particular an *empty* 200 — means the request did not
+        reach qBittorrent's login handler, almost always because ``base_url`` is
+        wrong (wrong host/port/path) or a reverse proxy is misrouting
+        ``/api/v2/auth/login``. We surface a diagnostic error in that case
+        instead of the useless ``"login failed: "`` message.
+        """
+        resp = self._session.post(
+            f"{self.base_url}/auth/login",
+            data={"username": self._username, "password": self._password},
+            timeout=self.timeout,
+            headers={"Referer": self.base_url},
+        )
+        # 502/503/504 come from the reverse proxy when qBittorrent is down,
+        # starting up, or can't answer within the proxy's forwarding timeout
+        # (qBittorrent's PBKDF2 password check is intentionally slow, so a
+        # flood of concurrent logins can trip this). Surface it clearly rather
+        # than as a bare HTTPError.
+        if resp.status_code in (502, 503, 504):
+            raise RuntimeError(
+                f"qBittorrent is unreachable: reverse proxy returned HTTP {resp.status_code} "
+                f"for {resp.url}. qBittorrent may be down, starting up, or unable to "
+                "answer within the proxy's forwarding timeout."
+            )
+        resp.raise_for_status()
+        body = resp.text.strip()
+
+        # qBittorrent signals a successful login with the body "Ok." and/or by
+        # setting a session cookie. The cookie is named "SID" in older versions
+        # and "QBT_SID" / "QBT_SID_<port>" in newer ones. Some setups return 204
+        # No Content with the cookie and no body, and ``requests`` doesn't always
+        # populate the cookie jar, so check both the jar and the raw Set-Cookie
+        # header. qBittorrent only sets this cookie on a valid login.
+        def _is_session_cookie(name: str) -> bool:
+            upper = name.strip().upper()
+            return upper == "SID" or upper.startswith("QBT_SID")
+
+        set_cookie_hdr = resp.headers.get("Set-Cookie", "") or ""
+        first_cookie_name = set_cookie_hdr.split("=", 1)[0].strip()
+        sid_ok = any(_is_session_cookie(k) for k in resp.cookies.keys()) or (
+            bool(first_cookie_name) and _is_session_cookie(first_cookie_name)
+        )
+        if body == "Ok." or sid_ok:
+            self._logged_in = True
+            logger.info("qBittorrent login successful for %s", self.base_url)
+            return
+        if body == "Fails.":
+            raise RuntimeError(f"qBittorrent login failed (HTTP {resp.status_code}): invalid username or password")
+        cookie_names = sorted(resp.cookies.keys()) or (["<unparsed>"] if set_cookie_hdr else [])
+        raise RuntimeError(
+            f"Unexpected response from qBittorrent login endpoint (HTTP {resp.status_code}, "
+            f"body={body!r}, cookies={cookie_names}). Expected the text 'Ok.' or a session "
+            "cookie (SID / QBT_SID) from /api/v2/auth/login — this usually means base_url does "
+            "not reach the qBittorrent Web API (check the URL, path, and any reverse proxy in "
+            "front of qBittorrent)."
+        )
+
+    def _get(self, path: str, **params: Any) -> dict[str, Any]:
+        """GET an endpoint with auto-login on first call and re-login on 403."""
+        if not self._logged_in:
+            self._login()
+        url = f"{self.base_url}{path}"
+        resp = self._session.get(url, params=params, timeout=self.timeout)
+        if resp.status_code == 403:
+            logger.debug("qBittorrent 403 on %s, re-logging in", path)
+            self._logged_in = False
+            self._login()
+            resp = self._session.get(url, params=params, timeout=self.timeout)
+        resp.raise_for_status()
+        return resp.json()
+
+    def maindata(self) -> dict[str, Any]:
+        """Return the current ``/sync/maindata`` snapshot.
+
+        Uses qBittorrent's incremental ``rid`` protocol (first call is a full
+        update, subsequent calls send the last rid and get a small diff that is
+        merged into the cached snapshot), so payloads stay small. A short-TTL
+        cache + lock collapses concurrent widget polls onto a single fetch, and
+        on repeated failures the client backs off instead of hammering
+        qBittorrent's single-threaded web server (serving the last good
+        snapshot when available).
+
+        Returns a dict with ``server_state`` and ``torrents``.
+        """
+        now = time.time()
+        with self._maindata_lock:
+            # Serve a fresh-enough cached snapshot without re-hitting qBittorrent.
+            if self._snapshot.get("torrents") and (now - self._maindata_fetched_at) < self._maindata_ttl:
+                return self._copy_snapshot()
+            # While backing off, don't pile on; serve stale or raise.
+            if now < self._backoff_until:
+                if self._snapshot.get("torrents"):
+                    return self._copy_snapshot()
+                raise RuntimeError(
+                    "qBittorrent maindata unavailable (backing off after repeated failures)"
+                )
+            try:
+                update = self._fetch_maindata_incremental()
+                self._apply_update(update)
+            except Exception as exc:
+                self._consecutive_failures += 1
+                delay = min(2 ** self._consecutive_failures, MAINDATA_BACKOFF_MAX)
+                self._backoff_until = time.time() + delay
+                logger.warning(
+                    "qBittorrent maindata fetch failed (#%s); backing off %.0fs: %s",
+                    self._consecutive_failures,
+                    delay,
+                    exc,
+                )
+                if self._snapshot.get("torrents"):
+                    return self._copy_snapshot()
+                raise RuntimeError(f"qBittorrent maindata failed: {exc}") from exc
+            self._maindata_fetched_at = time.time()
+            self._consecutive_failures = 0
+            self._backoff_until = 0.0
+            return self._copy_snapshot()
+
+    def _fetch_maindata_incremental(self) -> dict[str, Any]:
+        """GET /sync/maindata, sending the last rid for an incremental update."""
+        params: dict[str, Any] = {}
+        if self._rid is not None:
+            params["rid"] = self._rid
+        return self._get("/sync/maindata", **params)
+
+    def _apply_update(self, update: dict[str, Any]) -> None:
+        """Merge a full or partial maindata update into the cached snapshot."""
+        is_full = bool(update.get("full_update")) or self._rid is None
+        self._rid = update.get("rid", self._rid)
+        snap = self._snapshot
+        if is_full:
+            snap.clear()
+            snap["server_state"] = dict(update.get("server_state") or {})
+            snap["torrents"] = dict(update.get("torrents") or {})
+            snap["categories"] = dict(update.get("categories") or {})
+            snap["tags"] = list(update.get("tags") or [])
+            snap["trackers"] = list(update.get("trackers") or [])
+            return
+        # Partial update — merge the diff.
+        server_state = update.get("server_state")
+        if isinstance(server_state, dict):
+            snap["server_state"].update(server_state)
+        changed = update.get("torrents")
+        if isinstance(changed, dict):
+            for hash_, fields in changed.items():
+                if fields is None:
+                    snap["torrents"].pop(hash_, None)
+                else:
+                    previous = snap["torrents"].get(hash_)
+                    snap["torrents"][hash_] = (
+                        {**previous, **fields}
+                        if isinstance(previous, dict) and isinstance(fields, dict)
+                        else fields
+                    )
+        for hash_ in update.get("torrents_removed") or []:
+            snap["torrents"].pop(hash_, None)
+        categories = update.get("categories")
+        if isinstance(categories, dict):
+            snap["categories"].update(categories)
+        for name in update.get("categories_removed") or []:
+            snap["categories"].pop(name, None)
+        if "tags" in update:
+            snap["tags"] = list(update.get("tags") or [])
+        if "trackers" in update:
+            snap["trackers"] = list(update.get("trackers") or [])
+
+    def _copy_snapshot(self) -> dict[str, Any]:
+        """Return a shallow, race-safe copy of the current snapshot."""
+        snap = self._snapshot
+        return {
+            "rid": self._rid,
+            "server_state": dict(snap.get("server_state") or {}),
+            "torrents": dict(snap.get("torrents") or {}),
+            "categories": dict(snap.get("categories") or {}),
+            "tags": list(snap.get("tags") or []),
+            "trackers": list(snap.get("trackers") or []),
+        }

backend/src/media_library_viewer_api/dependencies.py

@@ -1,12 +1,12 @@
 """Dependency injection for FastAPI.
 
 Provides access to service-specific Jellyfin/Jellyseerr clients and
-machine-specific SSH clients via FastAPI's request context.
+remote-machine SSH clients via FastAPI's request context.
 
 - Jellyfin/Jellyseerr are selected with a ``jellyfin_service_id`` query
   parameter (resolved against the service registry); the backend falls back to
   the first enabled ``jellyfin``/``jellyseerr`` service instance.
-- SSH/Files transport is selected with ``machine_id`` as before.
+- SSH/Files transport is selected with an enabled ``remote_machine`` ``service_id``.
 """
 
 from __future__ import annotations
@@ -18,9 +18,7 @@ from typing import Any
 from fastapi import HTTPException, Request
 
 from media_library_viewer_api.clients.jellyfin import JellyfinClient
-from media_library_viewer_api.clients.local import LocalCommandClient
 from media_library_viewer_api.clients.ssh import RemoteSSHClient
-from media_library_viewer_api.config import get_settings
 from media_library_viewer_api.services.mail_queue import MailQueue
 from media_library_viewer_api.services.mail_queue import get_mail_queue as _get_mail_queue
 from media_library_viewer_api.services.settings_store import SettingsStore
@@ -29,11 +27,11 @@ from media_library_viewer_api.services.settings_store import get_settings_store
 logger = logging.getLogger(__name__)
 
 
-def _request_machine_id(request: Request | None) -> str | None:
+def _request_remote_machine_service_id(request: Request | None) -> str | None:
     if request is None:
         return None
-    machine_id = request.query_params.get("machine_id")
+    service_id = request.query_params.get("service_id")
-    return machine_id or None
+    return service_id or None
 
 
 def _request_jellyfin_service_id(request: Request | None) -> str | None:
@@ -80,87 +78,10 @@ def _jellyfin_client_for(cache_key: tuple[str, str, str]) -> JellyfinClient:
     return JellyfinClient(url, api_key)
 
 
-@lru_cache(maxsize=32)
+def get_jellyfin_client(request: Request) -> JellyfinClient:
-def _ssh_client_for(
+    """Return a Jellyfin client for the selected enabled service instance."""
-    cache_key: tuple[str, str, str, int, str, str | None, str | None, str | None, str | None],
-) -> RemoteSSHClient:
-    machine_id, host, username, port, key_filename, password, private_key, private_key_passphrase, known_hosts_path = (
-        cache_key
-    )
-    logger.info(
-        "Creating SSH client machine_id=%s host=%s user=%s port=%s key=%s password=%s private_key=%s passphrase=%s",
-        machine_id or "<default>",
-        host or "<unset>",
-        username or "<unset>",
-        port,
-        key_filename or "<unset>",
-        "set" if password else "missing",
-        "set" if private_key else "missing",
-        "set" if private_key_passphrase else "missing",
-    )
-    client = RemoteSSHClient(
-        host=host,
-        username=username,
-        port=port,
-        key_filename=key_filename or None,
-        private_key=private_key or None,
-        private_key_passphrase=private_key_passphrase or None,
-        password=password or None,
-        known_hosts_path=known_hosts_path or None,
-    )
-    try:
-        client.connect()
-    except RuntimeError as exc:
-        message = str(exc)
-        lowered = message.lower()
-        logger.exception("Failed to establish SSH connection to %s", host or "<unset>")
-        if "banner" in lowered:
-            raise HTTPException(
-                status_code=502,
-                detail=(
-                    f"SSH banner not received from {host}:{port}. "
-                    "Confirm the host, port, and firewall; the backend could not complete the SSH handshake."
-                ),
-            ) from exc
-        if "authentication failed" in lowered or "no authentication methods available" in lowered:
-            raise HTTPException(
-                status_code=401,
-                detail=(
-                    f"SSH authentication failed for {host}:{port}. "
-                    "Check the selected key, passphrase, username, or password."
-                ),
-            ) from exc
-        raise HTTPException(status_code=502, detail=message) from exc
-    except Exception:
-        logger.exception("Failed to establish SSH connection to %s", host or "<unset>")
-        raise
-    return client
-
-
-def _resolve_machine(service: str, request: Request | None = None) -> dict[str, Any] | None:
-    """Resolve an SSH/Files machine for the given transport service.
-
-    Jellyfin/Jellyseerr are resolved against the service registry, not here.
-    """
     store = get_settings_store()
-    machine_id = _request_machine_id(request)
+    service = _service_record(store, "jellyfin", _request_jellyfin_service_id(request))
-    if machine_id:
-        machine = store.get_machine(machine_id)
-        if machine and (service in machine.get("services", []) or service == "ssh"):
-            return machine
-        return machine
-    if service == "ssh":
-        machines = store.list_machines_for_service("files") or store.list_machines_for_service("monitoring")
-    else:
-        machines = store.list_machines_for_service(service)
-    return machines[0] if machines else None
-
-
-def get_jellyfin_client(request: Request = None) -> JellyfinClient:
-    """Return a Jellyfin client for the selected Jellyfin service instance."""
-    store = get_settings_store()
-    service_id = _request_jellyfin_service_id(request)
-    service = _service_record(store, "jellyfin", service_id)
     if service is None:
         raise HTTPException(
             status_code=503,
@@ -173,83 +94,25 @@ def get_jellyfin_client(request: Request = None) -> JellyfinClient:
             status_code=503,
             detail="Jellyfin service is missing base_url or api_key. Edit it on the Services page.",
         )
-    cache_key = (service["id"], base_url, api_key)
+    return _jellyfin_client_for((service["id"], base_url, api_key))
-    return _jellyfin_client_for(cache_key)
 
 
-def _ssh_client_from_machine_config(machine: dict[str, Any], store: SettingsStore | None = None) -> RemoteSSHClient:
+def get_ssh_client(request: Request) -> RemoteSSHClient:
-    """Build a RemoteSSHClient from a machine config dict."""
+    """Return SSH transport for the requested enabled remote-machine service."""
-    store = store or get_settings_store()
+    from media_library_viewer_api.services.task_runner import build_ssh_client
-    known_hosts_path = get_settings().ssh_known_hosts_file
+    from media_library_viewer_api.widgets.sources import build_service_record
-    key_data = None
-    key_passphrase = None
-    ssh_key_id = str(machine.get("ssh_key_id") or "").strip()
-    if ssh_key_id:
-        ssh_key = store.get_ssh_key(ssh_key_id)
-        if ssh_key:
-            key_data = ssh_key.get("private_key") or None
-            key_passphrase = ssh_key.get("passphrase") or None
-    if not key_data and machine.get("ssh_private_key"):
-        key_data = machine.get("ssh_private_key") or None
-        key_passphrase = machine.get("ssh_private_key_passphrase") or None
-    cache_key = (
-        machine["id"],
-        machine["host"],
-        machine["username"],
-        int(machine.get("port") or 22),
-        f"{machine.get('key_directory')}/{machine.get('key_name')}"
-        if machine.get("key_directory") and machine.get("key_name")
-        else "",
-        machine.get("password") or None,
-        key_data,
-        key_passphrase,
-        str(known_hosts_path),
-    )
-    return _ssh_client_for(cache_key)
 
-
-def get_ssh_client(request: Request = None):
-    """Return a command client for the selected machine or legacy env fallback."""
     store = get_settings_store()
-    machine_id = _request_machine_id(request)
+    service_id = _request_remote_machine_service_id(request)
-    machine = store.get_machine_config(machine_id) if machine_id else None
+    if not service_id:
-    if machine is None:
+        raise HTTPException(status_code=400, detail="service_id is required for remote file and job operations")
-        machine_ref = _resolve_machine("ssh", request)
+    row = store.get_service(service_id)
-        machine = store.get_machine_config(machine_ref["id"]) if machine_ref else None
+    if not row or row.get("service_type") != "remote_machine" or not row.get("enabled", True):
-    if machine and str(machine.get("mode") or "local").strip().lower() == "local":
+        raise HTTPException(status_code=404, detail="Enabled remote machine service not found")
-        logger.info("Creating LocalCommandClient machine_id=%s", machine["id"])
+    try:
-        return LocalCommandClient()
+        return build_ssh_client(store, build_service_record(store, row))
-    if machine and machine.get("host") and machine.get("username"):
+    except ValueError as exc:
-        return _ssh_client_from_machine_config(machine, store)
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
-
-    settings = get_settings()
-    logger.info(
-        "Creating SSH client from legacy env host=%s user=%s port=%s key_dir=%s key_name=%s password=%s",
-        settings.ssh_host or "<unset>",
-        settings.ssh_username or "<unset>",
-        settings.ssh_port,
-        settings.ssh_key_directory or "<unset>",
-        settings.ssh_key_name or "<unset>",
-        "set" if settings.ssh_password else "missing",
-    )
-    if not settings.ssh_key_path:
-        raise HTTPException(
-            status_code=503,
-            detail="No SSH machine is configured and SSH key settings must be configured",
-        )
-    return _ssh_client_for(
-        (
-            "legacy",
-            settings.ssh_host,
-            settings.ssh_username,
-            settings.ssh_port,
-            settings.ssh_key_path,
-            settings.ssh_password or None,
-            None,
-            None,
-            str(settings.ssh_known_hosts_file),
-        )
-    )
 
 
 def get_mail_queue() -> MailQueue:
@@ -262,18 +125,42 @@ def get_settings_store() -> SettingsStore:
     return _get_settings_store()
 
 
-def get_user_id(request: Request = None) -> str:
+def get_user_id(request: Request) -> str:
-    """Return the configured Jellyfin user ID or discover the first available one."""
+    """Return the Jellyfin user Id, resolving a configured username if needed.
+
+    The service ``user_id`` config field accepts either the internal Jellyfin Id
+    or a username (e.g. ``'admin'``). Jellyfin's ``/Users/{id}/...`` endpoints
+    reject usernames with HTTP 400 (``"The value 'admin' is not valid."``), so
+    always resolve to the internal Id before use. Resolution is cached per
+    (service, base_url, api_key, configured) so repeated dashboard/media requests
+    don't re-list users on every call.
+    """
     store = get_settings_store()
     service_id = _request_jellyfin_service_id(request)
     service = _service_record(store, "jellyfin", service_id)
-    if service and service.get("config", {}).get("user_id"):
+    if service is None:
-        return str(service["config"]["user_id"])
-    client = get_jellyfin_client(request)
-    users = client.users()
-    if not users:
         raise HTTPException(
             status_code=503,
-            detail="No Jellyfin users found and no user_id configured on the service",
+            detail="No Jellyfin service is configured. Add a Jellyfin service on the Services page.",
         )
-    return users[0]["Id"]
+    configured = str(service.get("config", {}).get("user_id") or "").strip()
+    base_url = str(service.get("config", {}).get("base_url") or "")
+    api_key = str(service.get("secrets", {}).get("api_key") or "")
+    if not base_url or not api_key:
+        raise HTTPException(
+            status_code=503,
+            detail="Jellyfin service is missing base_url or api_key. Edit it on the Services page.",
+        )
+    return _resolved_user_id((service["id"], base_url, api_key, configured))
+
+
+@lru_cache(maxsize=64)
+def _resolved_user_id(cache_key: tuple[str, str, str, str]) -> str:
+    """Resolve a configured Jellyfin identifier (Id or username) to the internal Id.
+
+    Keyed by (service_id, base_url, api_key, configured) so a credentials change
+    or a different configured user busts the cache automatically.
+    """
+    service_id, base_url, api_key, configured = cache_key
+    client = _jellyfin_client_for((service_id, base_url, api_key))
+    return client.resolve_user_id(configured or None)

backend/src/media_library_viewer_api/domain/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: backend/src/media_library_viewer_api/domain
 
 ## role
-Domain layer providing data normalization and transformation helpers for Jellyfin media data and dashboard summaries.
+Provides domain logic for normalizing media API data and building dashboard summaries for the media library viewer application.
 ## parent
 index: backend/src/media_library_viewer_api/.pi-map.index.md
 map: backend/src/media_library_viewer_api/.pi-map.md

backend/src/media_library_viewer_api/domain/.pi-map.md

@@ -4,13 +4,13 @@ dir: backend/src/media_library_viewer_api/domain
 index: backend/src/media_library_viewer_api/domain/.pi-map.index.md
 
 ## role
-Domain layer providing data normalization and transformation helpers for Jellyfin media data and dashboard summaries.
+Provides domain logic for normalizing media API data and building dashboard summaries for the media library viewer application.
 ## files
 - __init__.py | Swaps the position of two tmux panes within a window or between windows | dep: tmux, sh
 - dashboard.py | Provides domain helper functions for building dashboard data, specifically normalizing Jellyfin session activity rows and computing backup job summaries. | exp: func:_map_sessions_to_activity_rows(sessions: list[dict[str, Any]]) → list[dict[str, Any]], call:session.get, call:bool, call:item.get, call:play_state.get, call:transcoding.get, call:transcode_type.append, call:results.append, call:", ".join, func:build_backup_dashboard_summary(store: SettingsStore) → BackupDashboardSummary, call:store.list_backup_jobs, call:len, call:int, call:time.time, call:store.list_backup_runs, call:recent_runs.append, call:sum, call:store.list_backup_alerts, call:failed_runs.append, call:max, call:BackupDashboardSummary, call:round | dep: time, typing, media_library_viewer_api.models.backups, media_library_viewer_api.services.settings_store
 - media.py | Flattens inconsistent Jellyfin API JSON into normalized dictionaries for SQLite indexing and frontend display. | exp: func:first_media_source(item: dict[str, Any]) → dict[str, Any], call:item.get, func:media_streams(item: dict[str, Any], stream_type) → list[dict[str, Any]], call:item.get, call:streams.extend, call:source.get, call:str(stream.get("Type") or stream.get("codec_type") or "").lower, call:stream.get, call:stream_type.lower, func:stream_value(stream: dict[str, Any], *keys: str) → Any, func:is_hdr_item(item: dict[str, Any]) → bool, call:media_streams, call:stream_value, call:" ".join, call:str(value).lower, call:any, func:format_date_added(value: str | None) → str, call:pd.to_datetime(value).strftime, call:str, func:timestamp_date_added(value: str | None) → int | None, call:int, call:pd.to_datetime(value).timestamp, func:format_rate_bits_decimal(bits_per_second: float | int | str | None) → str, call:float, call:str, func:normalize_media_item(item: dict[str, Any], library_id, library_name) → dict[str, Any], call:first_media_source, call:media_streams, call:source.get, call:item.get, call:stream_value, call:is_hdr_item, call:int, call:ticks_to_minutes, call:human_size, call:format_rate_bits_decimal, call:video.get, call:format_date_added, call:timestamp_date_added, func:display_media_row(row: dict[str, Any]) → dict[str, Any], call:row.get, call:human_size, call:format_rate_bits_decimal | dep: typing, media_library_viewer_api.utils, pandas
 ## arch
-Stateless functional modules that transform inconsistent upstream API JSON into normalized dictionaries for persistence and display.
+Functional utility module pattern with pure helper functions that transform external API JSON into normalized domain objects.
 ## tags
 media, backup, call:item.get, call:str, date, added, dashboard, call:store.list
 ## symbols

backend/src/media_library_viewer_api/integrations/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: backend/src/media_library_viewer_api/integrations
 
 ## role
-Provides a plugin-style integration framework for declaring and registering external service connections (e.g., Grafana, Jellyfin, Prometheus) with config schemas, secrets, and widget definitions for the media library viewer API.
+Provides a pluggable integration layer for connecting to and monitoring external self-hosted services (e.g., Jellyfin, Prometheus, qBittorrent, Nextcloud) with unified config schemas, connection testing, and widget definitions.
 ## parent
 index: backend/src/media_library_viewer_api/.pi-map.index.md
 map: backend/src/media_library_viewer_api/.pi-map.md
@@ -11,12 +11,13 @@ map: backend/src/media_library_viewer_api/.pi-map.md
 ## files
 - __init__.py
 - alertmanager.py
+- authentik.py
+- backups.py
 - base.py
-- grafana.py
 - jellyfin.py
-- jellyseerr.py
 - nextcloud.py
 - prometheus.py
+- qbittorrent.py
 - registry.py
 - ssh_tasks.py
 ## links
@@ -24,6 +25,6 @@ index: backend/src/media_library_viewer_api/integrations/.pi-map.index.md
 map: backend/src/media_library_viewer_api/integrations/.pi-map.md
 ## workflows
 - change integrations behavior
-  read: __init__.py, alertmanager.py, base.py
+  read: __init__.py, alertmanager.py, authentik.py
 ## dirty
 -

backend/src/media_library_viewer_api/integrations/.pi-map.md

@@ -4,33 +4,34 @@ dir: backend/src/media_library_viewer_api/integrations
 index: backend/src/media_library_viewer_api/integrations/.pi-map.index.md
 
 ## role
-Provides a plugin-style integration framework for declaring and registering external service connections (e.g., Grafana, Jellyfin, Prometheus) with config schemas, secrets, and widget definitions for the media library viewer API.
+Provides a pluggable integration layer for connecting to and monitoring external self-hosted services (e.g., Jellyfin, Prometheus, qBittorrent, Nextcloud) with unified config schemas, connection testing, and widget definitions.
 ## files
 - __init__.py | Defines a closed registry module for service integrations.
-- alertmanager.py | Defines the Alertmanager service integration configuration, widget definitions, and alert summarization logic for a media library viewer API. | exp: class:AlertmanagerConfig, class:AlertmanagerAlertsWidgetConfig, func:summarize_alerts(alerts: list[dict[str, Any]], severity_filter) → dict[str, Any], call:alert.get, call:labels.get, call:by_severity.get, call:open_alerts.append, call:annotations.get, call:open_alerts.sort, call:len | dep: typing, media_library_viewer_api.integrations.base
+- alertmanager.py | Defines a service integration for Prometheus Alertmanager, providing configuration models, connection testing, alert summarization, and widget definitions for displaying active alerts. | exp: class:AlertmanagerConfig, class:AlertmanagerAlertsWidgetConfig, func:summarize_alerts(alerts: list[dict[str, Any]], severity_filter) → dict[str, Any], call:alert.get, call:labels.get, call:by_severity.get, call:open_alerts.append, call:annotations.get, call:open_alerts.sort, call:len, func:test_connection(config: dict[str, Any], secrets: dict[str, str], store: SettingsStore) → TestResult, call:str(config.get("base_url") or "").rstrip, call:config.get, call:int, call:secrets.get, call:requests.get, call:resp.raise_for_status, call:resp.json, call:payload.get("versionInfo", {}).get, call:TestResult, call:translate_connection_error | dep: typing, requests, media_library_viewer_api.integrations.base, media_library_viewer_api.services.settings_store
-- base.py | Provides abstract base classes and dataclass definitions for declaring external service integrations with config schemas, secret fields, and widget kinds. | exp: class:ServiceConfigBase, class:WidgetConfigBase, class:SecretField, class:WidgetKind, class:ServiceDefinition, method:widget_kind(self, kind: str) → WidgetKind | None, func:_validate_service_base_url(value: Any) → str, call:isinstance, call:value.strip, call:text.lower, call:lowered.startswith, raise:ValueError, func:widget_kind(kind: str, name: str, description: str, model_cls: type[WidgetConfigBase], default_config, refresh_interval_ms) → WidgetKind, call:model_cls.model_json_schema, call:schema.pop, call:WidgetKind, call:dict, func:validate_config(model_cls: type[BaseModel], config: dict[str, Any] | None) → dict[str, Any], call:model_cls.model_validate, call:instance.model_dump | dep: dataclasses, typing, pydantic
+- authentik.py | Defines the Authentik service integration for user-directory access, including connection config, API token secret management, and a connection test. | exp: class:AuthentikConfig, func:test_connection(config: dict[str, Any], secrets: dict[str, str], store: SettingsStore) → TestResult, call:str(config.get("base_url") or "").rstrip, call:config.get, call:secrets.get, call:float, call:AuthentikClient, call:client.users, call:result.get, call:isinstance, call:TestResult, call:translate_connection_error | dep: typing, media_library_viewer_api.clients.authentik, media_library_viewer_api.integrations.base, media_library_viewer_api.services.settings_store, media_library_viewer_api.clients.authentik.AuthentikClient
-- grafana.py | Defines the Grafana service integration configuration, including connection settings, API key secrets, and dashboard link widget support. | exp: class:GrafanaConfig, class:GrafanaLinkWidgetConfig | dep: media_library_viewer_api.integrations.base
+- backups.py | Defines a Backups service type with configuration and summary widget for monitoring backup jobs, run history, and alerting. | exp: class:BackupsConfig, class:BackupsSummaryWidgetConfig | dep: media_library_viewer_api.integrations.base
-- jellyfin.py | Defines the Jellyfin service configuration and activity widget for a media library viewer API integration. | exp: class:JellyfinConfig, class:JellyfinActivityWidgetConfig | dep: media_library_viewer_api.integrations.base
+- base.py | Provides base classes and utility functions for defining external service integrations, including config schemas, secrets, widgets, and connection error translation. | exp: class:ServiceConfigBase, class:WidgetConfigBase, class:SecretField, class:WidgetKind, class:TestResult, class:ServiceDefinition, method:widget_kind(self, kind: str) → WidgetKind | None, func:_validate_service_base_url(value: Any) → str, call:isinstance, call:value.strip, call:text.lower, call:lowered.startswith, raise:ValueError, func:widget_kind(kind: str, name: str, description: str, model_cls: type[WidgetConfigBase], default_config, refresh_interval_ms) → WidgetKind, call:model_cls.model_json_schema, call:schema.pop, call:WidgetKind, call:dict, func:validate_config(model_cls: type[BaseModel], config: dict[str, Any] | None) → dict[str, Any], call:model_cls.model_validate, call:instance.model_dump, func:translate_connection_error(exc: Exception, context) → TestResult, call:str, call:message.lower, call:isinstance, call:TestResult | dep: asyncio, dataclasses, typing, requests, pydantic, media_library_viewer_api.services.settings_store
-- jellyseerr.py | Defines the Jellyseerr service configuration and its service definition schema for integration as a request management companion to Jellyfin. | exp: class:JellyseerrConfig | dep: media_library_viewer_api.integrations.base
+- jellyfin.py | Defines the Jellyfin service integration configuration, connection testing, and widget definitions for a media library viewer API. | exp: class:JellyfinConfig, class:JellyfinActivityWidgetConfig, class:JellyfinNowPlayingWidgetConfig, class:JellyfinRequestStatWidgetConfig, class:JellyfinRequestsOverviewWidgetConfig, func:test_connection(config: dict[str, Any], secrets: dict[str, str], store: SettingsStore) → TestResult, call:str, call:config.get, call:secrets.get, call:int, call:JellyfinClient, call:client.users, call:TestResult, call:len, call:translate_connection_error | dep: typing, media_library_viewer_api.clients.jellyfin, media_library_viewer_api.integrations.base, media_library_viewer_api.services.settings_store, media_library_viewer_api.clients.jellyfin.JellyfinClient, media_library_viewer_api.services.settings_store.SettingsStore
-- nextcloud.py | Defines the Nextcloud service configuration model and service definition for integration into the media library viewer API. | exp: class:NextcloudConfig | dep: media_library_viewer_api.integrations.base
+- nextcloud.py | Defines a Nextcloud service integration with connection testing and configuration for a media library viewer API. | exp: class:NextcloudConfig, func:test_connection(config: dict[str, Any], secrets: dict[str, str], store: SettingsStore) → TestResult, call:str(config.get("base_url") or "").rstrip, call:config.get, call:requests.get, call:resp.raise_for_status, call:resp.json, call:payload.get, call:TestResult, call:translate_connection_error | dep: typing, requests, media_library_viewer_api.integrations.base, media_library_viewer_api.services.settings_store
-- prometheus.py | Defines the service definition and configuration models for integrating Prometheus as a metrics data source with PromQL query widgets. | exp: class:PrometheusConfig, class:PrometheusMetricWidgetConfig | dep: media_library_viewer_api.integrations.base
+- prometheus.py | Defines the Prometheus service integration for a media library viewer API, including connection testing via a Grafana gateway and configuration models for metric, chart, gauge, and mean widgets. | exp: class:PrometheusConfig, class:PrometheusMetricWidgetConfig, class:PrometheusChartWidgetConfig, class:PrometheusGaugeWidgetConfig, class:PrometheusMeanWidgetConfig, func:test_connection(config: dict[str, Any], secrets: dict[str, str], store: SettingsStore) → TestResult, call:str(config.get("grafana_url") or "").rstrip, call:config.get, call:secrets.get, call:int, call:TestResult, call:requests.post, call:resp.raise_for_status, call:translate_connection_error | dep: typing, requests, media_library_viewer_api.integrations.base, media_library_viewer_api.services.settings_store
-- registry.py | Provides a closed registry of service definitions with lookup and enumeration functions. | exp: func:list_service_types() → list[str], call:sorted, func:get_service_definition(service_type: str) → ServiceDefinition | None, call:SERVICE_DEFINITIONS.get, func:get_widget_kind(service_type: str, widget_kind: str) → WidgetKind | None, call:get_service_definition, call:definition.widget_kind, func:require_service_definition(service_type: str) → ServiceDefinition, call:get_service_definition, raise:ValueError | dep: media_library_viewer_api.integrations.alertmanager, media_library_viewer_api.integrations.base, media_library_viewer_api.integrations.grafana, media_library_viewer_api.integrations.jellyfin, media_library_viewer_api.integrations.jellyseerr, media_library_viewer_api.integrations.nextcloud, media_library_viewer_api.integrations.prometheus, media_library_viewer_api.integrations.ssh_tasks
+- qbittorrent.py | Defines the qBittorrent service integration, including connection config models, secret fields, widget definitions (totals, active, speed), and a connection test function. | exp: class:QbittorrentConfig, class:QbittorrentWidgetConfig, class:QbittorrentSpeedWidgetConfig, func:test_connection(config: dict[str, Any], secrets: dict[str, str], store: SettingsStore) → TestResult, call:config.get, call:secrets.get, call:int, call:QbittorrentClient, call:client.maindata, call:data.get("server_state", {}).get, call:TestResult, call:str(exc).lower, call:translate_connection_error | dep: typing, media_library_viewer_api.clients.qbittorrent, media_library_viewer_api.integrations.base, media_library_viewer_api.services.settings_store, media_library_viewer_api.clients.qbittorrent.QbittorrentClient, media_library_viewer_api.services.settings_store.SettingsStore
-- ssh_tasks.py | Defines a service configuration for an SSH task runner that executes reusable saved tasks over SSH and records run history. | exp: class:SshTasksConfig, class:SshTaskOutputWidgetConfig | dep: media_library_viewer_api.integrations.base
+- registry.py | Maintains a closed registry of service definitions and provides lookup functions to query available services, their types, and widget kinds. | exp: func:list_service_types() → list[str], call:sorted, func:get_service_definition(service_type: str) → ServiceDefinition | None, call:SERVICE_DEFINITIONS.get, func:get_widget_kind(service_type: str, widget_kind: str) → WidgetKind | None, call:get_service_definition, call:definition.widget_kind, func:require_service_definition(service_type: str) → ServiceDefinition, call:get_service_definition, raise:ValueError | dep: media_library_viewer_api.integrations.alertmanager, media_library_viewer_api.integrations.authentik, media_library_viewer_api.integrations.backups, media_library_viewer_api.integrations.base, media_library_viewer_api.integrations.jellyfin, media_library_viewer_api.integrations.nextcloud, media_library_viewer_api.integrations.prometheus, media_library_viewer_api.integrations.qbittorrent, media_library_viewer_api.integrations.ssh_tasks
+- ssh_tasks.py | Defines a service plugin that runs reusable saved tasks over SSH by managing connection configuration, secrets, and connection testing. | exp: class:SshTasksConfig, class:SshTaskOutputWidgetConfig, func:test_connection(config: dict[str, Any], secrets: dict[str, str], store: SettingsStore) → TestResult, call:str(config.get("host") or "").strip, call:config.get, call:int, call:ServiceRecord, call:build_ssh_client, call:client.connect, call:str(exc).lower, call:TestResult, call:translate_connection_error, call:client.close | dep: typing, media_library_viewer_api.integrations.base, media_library_viewer_api.services.settings_store, media_library_viewer_api.services.task_runner, media_library_viewer_api.widgets.sources
 ## arch
-Registry pattern with abstract base classes and dataclass-driven configuration models; each integration is a self-contained module registered in a closed registry that supports lookup, enumeration, and declarative widget/kind definitions.
+Registry-based plugin pattern with a shared base class defining standard interfaces (config models, secrets, widgets, connection tests) that each service integration implements and registers with a central closed registry for dynamic discovery.
 ## tags
-config, service, widget, integrations, base, media_library_viewer_api, definition, kind
+config, connection, widget, media_library_viewer_api, service, error, integrations, test
 ## symbols
 - AlertmanagerConfig
 - AlertmanagerAlertsWidgetConfig
+- AuthentikConfig
+- BackupsConfig
+- BackupsSummaryWidgetConfig
 - ServiceConfigBase
 - WidgetConfigBase
 - SecretField
-- WidgetKind
-- ServiceDefinition
-- GrafanaConfig
 ## workflows
 - change integrations behavior
-  read: __init__.py, alertmanager.py, base.py
+  read: __init__.py, alertmanager.py, authentik.py
 ## dirty
 -

backend/src/media_library_viewer_api/integrations/alertmanager.py

@@ -2,23 +2,30 @@
 
 from __future__ import annotations
 
-from typing import Any
+from typing import TYPE_CHECKING, Any
+
+import requests
 
 from media_library_viewer_api.integrations.base import (
     SecretField,
     ServiceBaseUrl,
     ServiceConfigBase,
     ServiceDefinition,
+    TestResult,
     WidgetConfigBase,
+    translate_connection_error,
     widget_kind,
 )
 
+if TYPE_CHECKING:
+    from media_library_viewer_api.services.settings_store import SettingsStore
+
 
 class AlertmanagerConfig(ServiceConfigBase):
     """Non-secret Alertmanager connection config."""
 
     base_url: ServiceBaseUrl
-    timeout_seconds: int = 5
+    timeout_seconds: int = 15
 
 
 class AlertmanagerAlertsWidgetConfig(WidgetConfigBase):
@@ -68,6 +75,28 @@ def summarize_alerts(
     }
 
 
+def test_connection(
+    config: dict[str, Any],
+    secrets: dict[str, str],
+    store: SettingsStore,
+) -> TestResult:
+    """GET /api/v2/status with optional bearer auth."""
+    try:
+        base_url = str(config.get("base_url") or "").rstrip("/")
+        timeout = int(config.get("timeout_seconds") or 15)
+        headers: dict[str, str] = {}
+        api_key = str(secrets.get("api_key") or "")
+        if api_key:
+            headers["Authorization"] = f"Bearer {api_key}"
+        resp = requests.get(f"{base_url}/api/v2/status", headers=headers, timeout=timeout)
+        resp.raise_for_status()
+        payload = resp.json()
+        version = str(payload.get("versionInfo", {}).get("version", "") or "connected")
+        return TestResult(ok=True, detail="Connected to Alertmanager.", evidence=version)
+    except Exception as exc:
+        return translate_connection_error(exc, context="Alertmanager")
+
+
 DEFINITION = ServiceDefinition(
     service_type="alertmanager",
     name="Alertmanager",
@@ -86,4 +115,5 @@ DEFINITION = ServiceDefinition(
             refresh_interval_ms=30_000,
         ),
     ],
+    test_callable=test_connection,
 )

backend/src/media_library_viewer_api/integrations/authentik.py

@@ -1,35 +1,85 @@
-"""Authentik service definition.
+"""Authentik service definition for read-only directory and access metadata."""
-
-Authentik is the user-directory source (replacing the Jellyfin-backed Users
-page). Its directory API is queried via :class:`AuthentikClient` and surfaced
-on the Authentik service page (Users + Messaging tabs). OIDC authentication
-is unchanged -- this service type is for the directory, not SSO.
-"""
 
 from __future__ import annotations
 
+from typing import TYPE_CHECKING, Any
+
+from pydantic import Field
+
+from media_library_viewer_api.clients.authentik import AuthentikClient
 from media_library_viewer_api.integrations.base import (
     SecretField,
     ServiceBaseUrl,
     ServiceConfigBase,
     ServiceDefinition,
+    TestResult,
+    WidgetConfigBase,
+    translate_connection_error,
+    widget_kind,
 )
 
+if TYPE_CHECKING:
+    from media_library_viewer_api.services.settings_store import SettingsStore
+
+
+def test_connection(config: dict[str, Any], secrets: dict[str, str], store: SettingsStore) -> TestResult:
+    """Probe the least-expensive Authentik directory endpoint."""
+    try:
+        client = AuthentikClient(
+            base_url=str(config.get("base_url") or "").rstrip("/"),
+            api_token=str(secrets.get("api_token") or ""),
+            timeout=float(config.get("timeout_seconds") or 60),
+        )
+        result = client.users(page=1, page_size=1)
+        return TestResult(ok=True, detail="Connected to Authentik.", evidence=f"{result.get('total', 0)} users")
+    except Exception as exc:
+        return translate_connection_error(exc, context="Authentik")
+
 
 class AuthentikConfig(ServiceConfigBase):
     """Non-secret Authentik connection config."""
 
     base_url: ServiceBaseUrl
-    timeout_seconds: int = 10
+    timeout_seconds: int = Field(default=60, ge=1, le=300)
+
+
+class AuthentikListWidgetConfig(WidgetConfigBase):
+    """Bounded display count for read-only Authentik list widgets."""
+
+    limit: int = Field(default=10, ge=1, le=50)
 
 
 DEFINITION = ServiceDefinition(
     service_type="authentik",
     name="Authentik",
-    description="User directory and identity provider integration.",
+    description="Read-only user directory, groups, and application access metadata.",
     config_model=AuthentikConfig,
-    secret_fields=[
+    secret_fields=[SecretField(key="api_token", label="API token", required=True)],
-        SecretField(key="api_token", label="API token", required=True),
+    widget_kinds=[
+        widget_kind(
+            kind="access_summary",
+            name="User access summary",
+            description="User group memberships and explicit staff/superuser status; not effective authorization.",
+            model_cls=AuthentikListWidgetConfig,
+            default_config={"limit": 10},
+            refresh_interval_ms=60_000,
+        ),
+        widget_kind(
+            kind="groups",
+            name="Groups",
+            description="Read-only Authentik group list.",
+            model_cls=AuthentikListWidgetConfig,
+            default_config={"limit": 10},
+            refresh_interval_ms=60_000,
+        ),
+        widget_kind(
+            kind="applications",
+            name="Applications",
+            description="Read-only Authentik application list.",
+            model_cls=AuthentikListWidgetConfig,
+            default_config={"limit": 10},
+            refresh_interval_ms=60_000,
+        ),
     ],
-    widget_kinds=[],
+    test_callable=test_connection,
 )

backend/src/media_library_viewer_api/integrations/base.py

@@ -1,7 +1,7 @@
 """Base classes for service integrations.
 
 A *service definition* is a closed, compile-time description of an external service
-the app can talk to (Grafana, Jellyfin, …). Each definition declares:
+the app can talk to (Jellyfin, Prometheus, …). Each definition declares:
 
 * its non-secret ``config_schema`` (derived from a Pydantic model),
 * the secret fields it accepts (API keys / tokens),
@@ -15,16 +15,21 @@ map. There is no runtime plugin loading.
 
 from __future__ import annotations
 
+import asyncio
 from dataclasses import dataclass, field
-from typing import Annotated, Any
+from typing import TYPE_CHECKING, Annotated, Any, Callable
 
+import requests
 from pydantic import BaseModel, BeforeValidator, Field
 
+if TYPE_CHECKING:
+    from media_library_viewer_api.services.settings_store import SettingsStore
+
 
 def _validate_service_base_url(value: Any) -> str:
     """Require an absolute http(s) URL for service ``base_url`` fields.
 
-    Relative hosts (e.g. ``grafana.example.com``) break downstream HTTP clients
+    Relative hosts (e.g. ``example.com``) break downstream HTTP clients
     because ``requests`` treats them as relative paths, so we fail fast with a
     clear error instead of letting the call silently malfunction.
     """
@@ -93,6 +98,20 @@ class WidgetKind:
     config_model: type[WidgetConfigBase] | None = None
 
 
+@dataclass(frozen=True)
+class TestResult:
+    """Outcome of a credential/connectivity test for a service instance."""
+
+    ok: bool
+    detail: str
+    evidence: str | None = None
+
+
+#: A test routine receives (config, secrets, store). The store is needed for
+#: remote_machine (SSH-key resolution). Other types ignore it.
+TestCallable = Callable[[dict[str, Any], dict[str, str], "SettingsStore"], TestResult]
+
+
 @dataclass(frozen=True)
 class ServiceDefinition:
     """Closed description of an external service type."""
@@ -103,6 +122,7 @@ class ServiceDefinition:
     config_model: type[ServiceConfigBase]
     secret_fields: list[SecretField]
     widget_kinds: list[WidgetKind]
+    test_callable: TestCallable | None = None
 
     @property
     def config_schema(self) -> dict[str, Any]:
@@ -148,3 +168,58 @@ def validate_config(model_cls: type[BaseModel], config: dict[str, Any] | None) -
     """Validate a config dict against a Pydantic model and return the cleaned dict."""
     instance = model_cls.model_validate(config or {})
     return instance.model_dump(exclude_none=True)
+
+
+def translate_connection_error(exc: Exception, *, context: str = "") -> TestResult:
+    """Map a common connection/auth exception to a human-friendly TestResult.
+
+    Handles patterns extracted from ``test_machine_ssh`` (settings.py) plus
+    HTTP-client patterns from the widget sources. Each per-type test routine
+    calls this for unexpected exceptions, but handles its **type-specific**
+    auth failures directly (e.g., qBit ``"Fails."``).
+    """
+    message = str(exc)
+    lowered = message.lower()
+
+    # Auth failures (HTTP 401/403)
+    if isinstance(exc, requests.HTTPError):
+        status_code = exc.response.status_code if exc.response is not None else 0
+        if status_code in (401, 403):
+            return TestResult(
+                ok=False,
+                detail=f"Authentication failed — the service rejected the credentials ({status_code}).",
+            )
+    if "authentication failed" in lowered or "no authentication methods available" in lowered:
+        return TestResult(ok=False, detail="Authentication failed — check the credentials, API key, or SSH key.")
+
+    # Timeout (before OSError check, since requests.Timeout is a subclass of OSError)
+    if isinstance(exc, (requests.Timeout, TimeoutError, asyncio.TimeoutError)):
+        return TestResult(ok=False, detail="Connection timed out — the service did not respond in time.")
+
+    # Connection refused / DNS / unreachable
+    if isinstance(exc, (requests.ConnectionError, ConnectionRefusedError, OSError)):
+        if (
+            "name or service not known" in lowered
+            or "nodename nor servname" in lowered
+            or "getaddrinfo failed" in lowered
+        ):
+            return TestResult(ok=False, detail="Host not found — check the URL/hostname for typos.")
+        return TestResult(
+            ok=False,
+            detail="Connection refused — the service is not reachable at the configured address.",
+        )
+
+    # SSL / certificate errors
+    if "ssl" in lowered or "certificate" in lowered:
+        return TestResult(ok=False, detail="SSL/TLS error — the service's certificate is invalid or untrusted.")
+
+    # SSH banner (from test_machine_ssh pattern)
+    if "protocol banner" in lowered:
+        return TestResult(
+            ok=False,
+            detail="SSH banner not received — confirm the SSH service is running and the port is correct.",
+        )
+
+    # Fallback
+    prefix = f"{context}: " if context else ""
+    return TestResult(ok=False, detail=f"{prefix}{message[:200]}")

backend/src/media_library_viewer_api/integrations/grafana.py

@@ -1,47 +0,0 @@
-"""Grafana service definition."""
-
-from __future__ import annotations
-
-from media_library_viewer_api.integrations.base import (
-    SecretField,
-    ServiceBaseUrl,
-    ServiceConfigBase,
-    ServiceDefinition,
-    WidgetConfigBase,
-    widget_kind,
-)
-
-
-class GrafanaConfig(ServiceConfigBase):
-    """Non-secret Grafana connection config."""
-
-    base_url: ServiceBaseUrl
-    timeout_seconds: int = 5
-
-
-class GrafanaLinkWidgetConfig(WidgetConfigBase):
-    """Deep-link to a Grafana dashboard or panel."""
-
-    dashboard_uid: str
-    panel_id: int | None = None
-
-
-DEFINITION = ServiceDefinition(
-    service_type="grafana",
-    name="Grafana",
-    description="Dashboards, metrics, and logs.",
-    config_model=GrafanaConfig,
-    secret_fields=[
-        SecretField(key="api_key", label="API key", helper="Service account token (optional)"),
-    ],
-    widget_kinds=[
-        widget_kind(
-            kind="link",
-            name="Dashboard link",
-            description="Deep-link to a Grafana dashboard or panel.",
-            model_cls=GrafanaLinkWidgetConfig,
-            default_config={"dashboard_uid": ""},
-            refresh_interval_ms=0,
-        ),
-    ],
-)

backend/src/media_library_viewer_api/integrations/jellyfin.py

@@ -2,31 +2,54 @@
 
 from __future__ import annotations
 
+from typing import TYPE_CHECKING, Any, Literal
+
+from media_library_viewer_api.clients.jellyfin import JellyfinClient
 from media_library_viewer_api.integrations.base import (
     SecretField,
     ServiceBaseUrl,
     ServiceConfigBase,
     ServiceDefinition,
+    TestResult,
     WidgetConfigBase,
+    translate_connection_error,
     widget_kind,
 )
 
+if TYPE_CHECKING:
+    from media_library_viewer_api.services.settings_store import SettingsStore
+
+
+def test_connection(
+    config: dict[str, Any],
+    secrets: dict[str, str],
+    store: SettingsStore,
+) -> TestResult:
+    """Call JellyfinClient.users() — the lightest authenticated probe."""
+    try:
+        base_url = str(config.get("base_url") or "")
+        api_key = str(secrets.get("api_key") or "")
+        timeout = int(config.get("timeout_seconds") or 60)
+        client = JellyfinClient(base_url, api_key, timeout=timeout)
+        users = client.users()
+        return TestResult(ok=True, detail="Connected to Jellyfin.", evidence=f"{len(users)} users")
+    except Exception as exc:
+        return translate_connection_error(exc, context="Jellyfin")
+
 
 class JellyfinConfig(ServiceConfigBase):
     """Non-secret Jellyfin connection config.
 
-    The optional ``jellyseerr_url`` / ``jellyseerr_api_key`` fields carry the
+    The optional ``jellyseerr_url`` field pairs a Jellyseerr companion with this
-    paired Jellyseerr companion config, absorbed from the former standalone
+    Jellyfin instance; the matching ``jellyseerr_api_key`` is a secret field on
-    ``jellyseerr`` service type (see OpenSpec change ``services-as-hub-ia``).
+    the service. When both are set, the Jellyfin service page renders a Requests
-    When both are set, the Jellyfin service page renders a Requests tab backed
+    tab backed by Jellyseerr.
-    by Jellyseerr.
     """
 
     base_url: ServiceBaseUrl
     user_id: str = ""
-    timeout_seconds: int = 10
+    timeout_seconds: int = 60
     jellyseerr_url: str = ""
-    jellyseerr_api_key: str = ""
 
 
 class JellyfinActivityWidgetConfig(WidgetConfigBase):
@@ -36,6 +59,31 @@ class JellyfinActivityWidgetConfig(WidgetConfigBase):
     pass
 
 
+class JellyfinNowPlayingWidgetConfig(WidgetConfigBase):
+    """Only show sessions with active playback (not idle/paused)."""
+
+    pass
+
+
+class JellyfinRequestStatWidgetConfig(WidgetConfigBase):
+    """A single Jellyseerr request stat (e.g. pending / approved / total)."""
+
+    stat: Literal[
+        "total",
+        "pending",
+        "approved",
+        "declined",
+        "processing",
+        "available",
+    ] = "pending"
+
+
+class JellyfinRequestsOverviewWidgetConfig(WidgetConfigBase):
+    """Grid of all Jellyseerr request stats + a recent-requests list."""
+
+    pass
+
+
 DEFINITION = ServiceDefinition(
     service_type="jellyfin",
     name="Jellyfin",
@@ -43,6 +91,12 @@ DEFINITION = ServiceDefinition(
     config_model=JellyfinConfig,
     secret_fields=[
         SecretField(key="api_key", label="API key", required=True),
+        SecretField(
+            key="jellyseerr_api_key",
+            label="Jellyseerr API key",
+            required=False,
+            helper="Enables the Requests tab + request-stats widgets (optional).",
+        ),
     ],
     widget_kinds=[
         widget_kind(
@@ -53,5 +107,30 @@ DEFINITION = ServiceDefinition(
             default_config={},
             refresh_interval_ms=30_000,
         ),
+        widget_kind(
+            kind="now_playing",
+            name="Now Playing",
+            description="Only sessions actively playing media.",
+            model_cls=JellyfinNowPlayingWidgetConfig,
+            default_config={},
+            refresh_interval_ms=30_000,
+        ),
+        widget_kind(
+            kind="stat",
+            name="Request stat",
+            description="A single Jellyseerr request statistic (e.g. pending requests).",
+            model_cls=JellyfinRequestStatWidgetConfig,
+            default_config={"stat": "pending"},
+            refresh_interval_ms=60_000,
+        ),
+        widget_kind(
+            kind="stats_overview",
+            name="Requests overview",
+            description="All Jellyseerr request stats plus a recent-requests list.",
+            model_cls=JellyfinRequestsOverviewWidgetConfig,
+            default_config={},
+            refresh_interval_ms=60_000,
+        ),
     ],
+    test_callable=test_connection,
 )

backend/src/media_library_viewer_api/integrations/nextcloud.py

@@ -6,13 +6,39 @@ dashboard widgets yet; its service page holds connection config only.
 
 from __future__ import annotations
 
+from typing import TYPE_CHECKING, Any
+
+import requests
+
 from media_library_viewer_api.integrations.base import (
     SecretField,
     ServiceBaseUrl,
     ServiceConfigBase,
     ServiceDefinition,
+    TestResult,
+    translate_connection_error,
 )
 
+if TYPE_CHECKING:
+    from media_library_viewer_api.services.settings_store import SettingsStore
+
+
+def test_connection(
+    config: dict[str, Any],
+    secrets: dict[str, str],
+    store: SettingsStore,
+) -> TestResult:
+    """GET {base_url}/status.php (unauthenticated server probe)."""
+    try:
+        base_url = str(config.get("base_url") or "").rstrip("/")
+        resp = requests.get(f"{base_url}/status.php", timeout=(5.0, 60.0))
+        resp.raise_for_status()
+        payload = resp.json()
+        version = str(payload.get("version", "") or "connected")
+        return TestResult(ok=True, detail="Connected to Nextcloud.", evidence=version)
+    except Exception as exc:
+        return translate_connection_error(exc, context="Nextcloud")
+
 
 class NextcloudConfig(ServiceConfigBase):
     """Non-secret Nextcloud connection config."""
@@ -30,4 +56,5 @@ DEFINITION = ServiceDefinition(
         SecretField(key="app_password", label="App password", required=True),
     ],
     widget_kinds=[],
+    test_callable=test_connection,
 )

backend/src/media_library_viewer_api/integrations/prometheus.py

@@ -2,21 +2,78 @@
 
 from __future__ import annotations
 
+from typing import TYPE_CHECKING, Any, Literal
+
+import requests
+
 from media_library_viewer_api.integrations.base import (
     SecretField,
     ServiceBaseUrl,
     ServiceConfigBase,
     ServiceDefinition,
+    TestResult,
     WidgetConfigBase,
+    translate_connection_error,
     widget_kind,
 )
 
+if TYPE_CHECKING:
+    from media_library_viewer_api.services.settings_store import SettingsStore
+
+
+def test_connection(
+    config: dict[str, Any],
+    secrets: dict[str, str],
+    store: SettingsStore,
+) -> TestResult:
+    """POST {grafana_url}/api/ds/query with expr 'up' via the Grafana gateway."""
+    try:
+        grafana_url = str(config.get("grafana_url") or "").rstrip("/")
+        api_key = str(secrets.get("grafana_api_key") or "")
+        datasource_uid = str(config.get("datasource_uid") or "prometheus")
+        timeout = int(config.get("timeout_seconds") or 60)
+        if not grafana_url:
+            return TestResult(ok=False, detail="Grafana gateway URL is required.")
+        if not api_key:
+            return TestResult(ok=False, detail="Grafana API key is required.")
+        body = {
+            "queries": [
+                {
+                    "datasource": {"uid": datasource_uid, "type": "prometheus"},
+                    "expr": "up",
+                    "format": "time_series",
+                    "intervalMs": 15000,
+                    "maxDataPoints": 1,
+                    "refId": "A",
+                }
+            ],
+            "from": "now-1m",
+            "to": "now",
+        }
+        resp = requests.post(
+            f"{grafana_url}/api/ds/query",
+            json=body,
+            timeout=timeout,
+            headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
+        )
+        resp.raise_for_status()
+        return TestResult(
+            ok=True,
+            detail="Grafana gateway reachable.",
+            evidence="Gateway reachable; datasource responded.",
+        )
+    except requests.HTTPError as exc:
+        return translate_connection_error(exc, context="Prometheus via Grafana")
+    except Exception as exc:
+        return translate_connection_error(exc, context="Prometheus via Grafana")
+
 
 class PrometheusConfig(ServiceConfigBase):
-    """Non-secret Prometheus connection config."""
+    """Non-secret Prometheus-via-Grafana gateway config."""
 
-    base_url: ServiceBaseUrl
+    grafana_url: ServiceBaseUrl
-    timeout_seconds: int = 10
+    datasource_uid: str = "prometheus"
+    timeout_seconds: int = 60
 
 
 class PrometheusMetricWidgetConfig(WidgetConfigBase):
@@ -25,13 +82,56 @@ class PrometheusMetricWidgetConfig(WidgetConfigBase):
     promql: str
 
 
+class PrometheusChartWidgetConfig(WidgetConfigBase):
+    """A PromQL range query rendered as a multi-series line chart (SC-101..SC-104)."""
+
+    promql: str
+    window: Literal["5m", "15m", "30m", "1h", "3h", "6h", "12h", "24h", "2d", "7d", "14d", "30d"] = "1h"
+    # Display scaling for the Y axis + tooltip. "none" shows raw values; the
+    # others auto/force a decimal-prefix unit (kB/MB/GB, kbps/Mbps, etc.).
+    unit: Literal[
+        "none",
+        "bytes",
+        "bytes_per_sec",
+        "bits_per_sec",
+        "bits",
+        "percent",
+        "seconds",
+    ] = "none"
+    scale: Literal["auto", "k", "m", "g", "t"] = "auto"
+
+
+class PrometheusGaugeWidgetConfig(WidgetConfigBase):
+    """A PromQL instant query rendered as a gauge with optional threshold bands (SC-109..SC-111)."""
+
+    promql: str
+    warn_at: float | None = None
+    crit_at: float | None = None
+    min: float | None = None
+    max: float | None = None
+    unit: str | None = None
+
+
+class PrometheusMeanWidgetConfig(WidgetConfigBase):
+    """A PromQL range query averaged client-side into a single value (SC-112..SC-114)."""
+
+    promql: str
+    window: Literal["5m", "15m", "30m", "1h", "3h", "6h", "12h", "24h", "2d", "7d", "14d", "30d"] = "1h"
+    unit: str | None = None
+
+
 DEFINITION = ServiceDefinition(
     service_type="prometheus",
     name="Prometheus",
     description="Metrics storage and PromQL queries.",
     config_model=PrometheusConfig,
     secret_fields=[
-        SecretField(key="api_key", label="API key", helper="Optional bearer token"),
+        SecretField(
+            key="grafana_api_key",
+            label="Grafana API key",
+            required=True,
+            helper="Service account token or API key for the Grafana gateway",
+        ),
     ],
     widget_kinds=[
         widget_kind(
@@ -42,5 +142,30 @@ DEFINITION = ServiceDefinition(
             default_config={"promql": ""},
             refresh_interval_ms=30_000,
         ),
+        widget_kind(
+            kind="chart",
+            name="Chart",
+            description="Multi-series line chart from a PromQL range query.",
+            model_cls=PrometheusChartWidgetConfig,
+            default_config={"promql": "", "window": "1h"},
+            refresh_interval_ms=60_000,
+        ),
+        widget_kind(
+            kind="gauge",
+            name="Gauge",
+            description="Instant query rendered as a gauge with optional threshold bands.",
+            model_cls=PrometheusGaugeWidgetConfig,
+            default_config={"promql": ""},
+            refresh_interval_ms=30_000,
+        ),
+        widget_kind(
+            kind="mean",
+            name="Mean",
+            description="Average value of a PromQL query over a time window.",
+            model_cls=PrometheusMeanWidgetConfig,
+            default_config={"promql": "", "window": "1h"},
+            refresh_interval_ms=60_000,
+        ),
     ],
+    test_callable=test_connection,
 )