feat(audio-player): Resume Rewind select in the settings popover

The player window could only change Skip and Speed; resume rewind
lived exclusively on the profile page. The user-facing settings now
match Speed's precedent — changeable from the player, saved to the
account, applied immediately.

The select mirrors the default-speed row (CSP-safe @change bound to
one Alpine method; templ emits the option list from the shared
ResumeRewindOptions allow-list and the :selected expression against
the live resumeRewind field). Applying updates the running player's
value first — the next open/unpause uses it with no reload — then
PUTs audio_resume_rewind_seconds to the profile endpoint as the
string wire shape the server binds. normalizeResumeRewind gates the
select's value through 0/5/10 before both steps.

.gitignore

@@ -87,3 +87,4 @@ session-*.md
 # see docs/contributing/development.md → Media fixtures)
 internal/services/testdata/
 test-results
+.openchamber/

AGENTS.md

@@ -145,6 +145,17 @@ every user sees every library unless an admin hides one) is enforced by
   new pages/controls go into `tests/ui/COVERAGE.md`). Item-scoped
   gates may answer 404 as well as 403 (row invisible vs Go-level
   check — contract_pins 2026-10-29).
+- **Collections RLS (2026-10-31)**: `collections` and
+  `collection_items` are governed too — predicates
+  `app_can_read_collection` / `app_can_write_collection`, PURE over
+  their arguments (never query `collections`, so no policy recursion
+  under FORCE RLS). Reads: owner-or-admin; writes: owner, admin escape
+  for SYSTEM collections only. Future sharing = one EXISTS branch
+  inside the predicate functions, no policy migration. Registration
+  seeding declares the new user's identity (`rls.WithUser` in
+  `CreateDefaultCollectionsForUser` — the JWT does not exist yet);
+  test-harness writes to non-system collections must run as the row's
+  OWNER (`scopeExecAs`/`ownerSeedCtx`, not the admin handle).
 
 History: 2026-10-13 (`431fec0`) the series/media listing surfaces
 leaked hidden libraries; **2026-10-29 enforcement moved to RLS** — the

bruno/collections/add_auto_assign_rule.yml

@@ -1,41 +0,0 @@
-info:
-  name: Add Auto-Assign Rule
-  type: http
-  seq: 1
-
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/{{collection_id}}/rules'
-  auth: inherit
-  body:
-    type: json
-    data: |-
-      {
-        "field": "genre",
-        "operator": "equals",
-        "value": "Science Fiction",
-        "priority": 1,
-        "enabled": true
-      }
-settings:
-  encodeUrl: true
-  timeout: 0
-  followRedirects: true
-  maxRedirects: 5
-
-runtime:
-  scripts:
-    - type: tests
-      code: |-
-        test("status is 201", function() {
-          expect(res.status).to.eql(201);
-        });
-
-docs:
-  content: |-
-    # Add Auto-Assign Rule
-
-    `POST /api/collections/:id/rules` — auth: jwt.
-
-    Canonical reference: docs/developer/api/collections/add_auto_assign_rule.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
-  type: text/markdown

bruno/collections/create_collection.yml

@@ -16,7 +16,6 @@ http:
         "color": "#00FF00",
         "icon": "📖",
         "collection_type": "static",
-        "auto_assign_rules": [],
         "view_settings": { "kobo": { "view_mode": "grid" } }
       }
 settings:

bruno/collections/remove_auto_assign_rule.yml

@@ -1,31 +0,0 @@
-info:
-  name: Remove Auto-Assign Rule
-  type: http
-  seq: 13
-
-http:
-  method: DELETE
-  url: '{{base_url}}/api/collections/{{collection_id}}/rules/{{rule_id}}'
-  auth: inherit
-settings:
-  encodeUrl: true
-  timeout: 0
-  followRedirects: true
-  maxRedirects: 5
-
-runtime:
-  scripts:
-    - type: tests
-      code: |-
-        test("status is 204", function() {
-          expect(res.status).to.eql(204);
-        });
-
-docs:
-  content: |-
-    # Remove Auto-Assign Rule
-
-    `DELETE /api/collections/:id/rules/:ruleId` — auth: jwt.
-
-    Canonical reference: docs/developer/api/collections/remove_auto_assign_rule.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
-  type: text/markdown

bruno/collections/set_chain_order.yml

@@ -0,0 +1,29 @@
+info:
+  name: Set Collection Chain Order
+  type: http
+  seq: 13
+
+http:
+  method: PUT
+  url: '{{base_url}}/api/collections/{{collection_id}}/view-settings'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "chain_order": "newest"
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+docs:
+  content: |-
+    # Set Collection Chain Order
+
+    `PUT /api/collections/:id/view-settings` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/set_chain_order.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/test_rule.yml

@@ -1,48 +0,0 @@
-info:
-  name: Test Rule
-  type: http
-  seq: 15
-
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/test-rules'
-  auth: inherit
-  body:
-    type: json
-    data: |-
-      {
-        "rules": [
-          {
-            "field": "genre",
-            "operator": "equals",
-            "value": "Science Fiction"
-          },
-          {
-            "field": "author",
-            "operator": "contains",
-            "value": "Asimov"
-          }
-        ]
-      }
-settings:
-  encodeUrl: true
-  timeout: 0
-  followRedirects: true
-  maxRedirects: 5
-
-runtime:
-  scripts:
-    - type: tests
-      code: |-
-        test("status is 200", function() {
-          expect(res.status).to.eql(200);
-        });
-
-docs:
-  content: |-
-    # Test Rule
-
-    `POST /api/collections/test-rules` — auth: jwt.
-
-    Canonical reference: docs/developer/api/collections/test_rule.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
-  type: text/markdown

bruno/collections/update_collection.yml

@@ -15,7 +15,6 @@ http:
         "description": "Updated description",
         "color": "#33CCFF",
         "icon": "📚",
-        "auto_assign_rules": [],
         "view_settings": { "hide_finished": true },
         "hide_finished": ["true"],
         "show_up_next": ["true"]

bruno/collections/update_rule.yml

@@ -1,29 +0,0 @@
-info:
-  name: Update Collection Rule
-  type: http
-  seq: 17
-
-http:
-  method: PUT
-  url: '{{base_url}}/api/collections/{{collection_id}}/rules/{{rule_id}}'
-  auth: inherit
-  body:
-    type: json
-    data: |-
-      {
-        "enabled": false
-      }
-settings:
-  encodeUrl: true
-  timeout: 0
-  followRedirects: true
-  maxRedirects: 5
-
-docs:
-  content: |-
-    # Update Collection Rule
-
-    `PUT /api/collections/:id/rules/:ruleId` — auth: jwt.
-
-    Canonical reference: docs/developer/api/collections/update_rule.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
-  type: text/markdown

cmd/server/main.go

@@ -170,19 +170,25 @@ func main() {
 	opdsHandler := handlers.NewOPDSHandler(queries, libraryService, conversionService)
 	opdsHandler.SetSettings(registry)
 
-	collectionHandler := handlers.NewCollectionHandler(queries, libraryService, connManager)
-	dashboardService := services.NewDashboardService(queries)
-	dashboardHandler := handlers.NewDashboardHandler(queries)
+	// One composed-engine service shared by search AND the collection
+	// subsystem (item 3.2): tree-driven smart collections evaluate
+	// through the unified engine.
+	collectionSearchService := services.NewSearchService(queries, scopedDB)
+	collectionHandler := handlers.NewCollectionHandler(queries, libraryService, connManager, collectionSearchService)
+	dashboardService := services.NewDashboardService(queries, collectionSearchService)
+	dashboardHandler := handlers.NewDashboardHandler(queries, collectionSearchService)
 	seriesHandler := handlers.NewSeriesHandler(queries)
 	filtersHandler := handlers.NewFiltersHandler(queries)
 	mediaHandler := handlers.NewMediaHandler(queries, scopedDB, libraryService, progressService, annotationService)
 	matchingHandler := handlers.NewMatchingHandler(queries, connManager)
 	jobsHandler := handlers.NewJobsHandler(queries, worker)
 
-	// Podcast subsystem: fetcher service + sequential download worker +
-	// poller. One instance trio per server (per-feed locks dedupe).
+	// Podcast subsystem: fetcher service + concurrent download worker
+	// (§0 item 4: pool, fair share, admin tunables) + poller. One
+	// instance trio per server (per-feed locks dedupe).
 	podcastService := services.NewPodcastService(queries)
 	podcastWorker := services.NewPodcastDownloadWorker(queries, podcastService)
+	podcastWorker.SetSettings(registry)
 	podcastHandler := handlers.NewPodcastHandler(queries, podcastService, podcastWorker)
 
 	e := echo.New()

cmd/server/tests/audiobook_multifile_test.go

@@ -659,12 +659,14 @@ func TestAudiobookFolderSidecarEditDetected(t *testing.T) {
 	require.NoError(t, os.WriteFile(sidecar, []byte(`{"title":"Sidecar Real Titlz","series":["Sidecar Saga (Reading Order) #1"]}`), 0o644))
 	scanTestFolder(t, setup, admin, folder)
 	var collCount int
-	require.NoError(t, setup.DBPool.QueryRow(context.Background(),
+	// Owner-scoped read: collections RLS (2026-10-31) hides rows from
+	// the pool session's SeedIdentity.
+	require.NoError(t, database.NewScopedDB(setup.DBPool).QueryRow(ownerSeedCtx(admin),
 		`SELECT COUNT(*) FROM collections WHERE name = 'Sidecar Saga (Reading Order)' AND user_id = $1`, admin,
 	).Scan(&collCount))
 	require.Equal(t, 1, collCount, "reading-order sidecar edit creates the collection for an existing book")
 	scanTestFolder(t, setup, admin, folder)
-	require.NoError(t, setup.DBPool.QueryRow(context.Background(),
+	require.NoError(t, database.NewScopedDB(setup.DBPool).QueryRow(ownerSeedCtx(admin),
 		`SELECT COUNT(*) FROM collections WHERE name = 'Sidecar Saga (Reading Order)' AND user_id = $1`, admin,
 	).Scan(&collCount))
 	require.Equal(t, 1, collCount, "rescan is idempotent — no duplicate collection")

cmd/server/tests/collections_rls_test.go

@@ -0,0 +1,127 @@
+package main
+
+import (
+	"bytes"
+	"testing"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Collections RLS (2026-10-31): ownership enforcement moved to the DB
+// layer (p_collections_* + parent-checked collection_items policies in
+// schema.sql, predicates app_can_read/write_collection). The API surface
+// answers invisibility with 404 — including the write endpoints that
+// had NO app-level gate (Update/AddBooks, the flagged gap). Admin keeps
+// the escape; system collections stay per-user; registration still
+// seeds them (the seeding identity fix in
+// CreateDefaultCollectionsForUser is regression-pinned here).
+func TestCollectionsRLS(t *testing.T) {
+	setup := setupTestServer(t)
+	ownerToken := setup.RegularToken // user A: the harness regular user
+	adminToken := setup.Token
+	marker := fmt.Sprintf("rls%d", time.Now().UnixNano()%100000)
+
+	// User B: a second regular user via registration. The register
+	// endpoint is rate-limited — exactly one call. The response's
+	// access_token is B's identity for every probe below.
+	regEmail := fmt.Sprintf("%s@tests.bookhoard.internal", marker)
+	regBody := fmt.Sprintf(
+		`{"email":%q,"username":%q,"password":"Test@Pass123!"}`,
+		regEmail, "rlsb"+marker)
+	regResp, err := http.Post(setup.Server.URL+"/api/auth/register",
+		"application/json", bytes.NewReader([]byte(regBody)))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusCreated, regResp.StatusCode,
+		"registration must succeed — including the system-collection seeding that now runs under the new user's RLS identity")
+	var reg struct {
+		Token string `json:"access_token"`
+	}
+	require.NoError(t, json.NewDecoder(regResp.Body).Decode(&reg))
+	require.NotEmpty(t, reg.Token)
+	otherToken := reg.Token
+	_ = regResp.Body.Close()
+
+	// B's registration seeded B's OWN system collections — visible in
+	// B's list (this is the registration-seeding identity fix, live).
+	code, body := podcastAuthed(t, setup, otherToken, "GET", "/api/collections", "")
+	require.Equal(t, http.StatusOK, code)
+	assert.Contains(t, string(body), "Continue Reading",
+		"registration seeded the new user's system collections under RLS")
+
+	// A creates the target collection.
+	code, body = podcastAuthed(t, setup, ownerToken, "POST", "/api/collections",
+		`{"name":"test RLS Owner ` + marker + `"}`)
+	require.Equal(t, http.StatusCreated, code, "%s", string(body))
+	var coll struct {
+		ID string `json:"id"`
+	}
+	require.NoError(t, json.Unmarshal(body, &coll))
+	t.Cleanup(func() {
+		podcastAuthed(t, setup, ownerToken, "DELETE", "/api/collections/"+coll.ID, "")
+	})
+
+	// ── B (non-owner) probes A's collection: invisible = 404 ──
+	code, _ = podcastAuthed(t, setup, otherToken, "GET", "/api/collections/"+coll.ID, "")
+	require.Equal(t, http.StatusNotFound, code, "detail-by-id is RLS-invisible cross-user")
+
+	code, body = podcastAuthed(t, setup, otherToken, "GET", "/api/collections", "")
+	require.Equal(t, http.StatusOK, code)
+	assert.NotContains(t, string(body), "test RLS Owner "+marker,
+		"the list query stays user-scoped")
+
+	code, body = podcastAuthed(t, setup, otherToken, "PUT", "/api/collections/"+coll.ID,
+		`{"name":"renamed by B"}`)
+	require.Equal(t, http.StatusNotFound, code,
+		"update of an RLS-invisible row answers 404 (was: ungated success): %s", string(body))
+
+	code, body = podcastAuthed(t, setup, otherToken, "POST", "/api/collections/"+coll.ID+"/books",
+		`{"book_ids":[]}`)
+	require.Equal(t, http.StatusNotFound, code,
+		"AddBooks on an RLS-invisible collection answers 404 (the flagged ungated-write gap, closed at the DB)")
+
+	code, body = podcastAuthed(t, setup, otherToken, "PUT",
+		"/api/collections/"+coll.ID+"/view-settings", `{"chain_order":"newest"}`)
+	require.Equal(t, http.StatusNotFound, code,
+		"chain-order write on an invisible collection answers 404")
+
+	code, _ = podcastAuthed(t, setup, otherToken, "DELETE", "/api/collections/"+coll.ID, "")
+	require.Equal(t, http.StatusNoContent, code,
+		"DELETE touches no rows under RLS (silent no-op — no destructive action)")
+
+	// The no-op delete lied about nothing: A still owns the collection.
+	code, body = podcastAuthed(t, setup, ownerToken, "GET", "/api/collections/"+coll.ID, "")
+	require.Equal(t, http.StatusOK, code, "owner retains the collection after B's failed delete")
+
+	// ── admin escape: sees everything, as with media ──
+	code, _ = podcastAuthed(t, setup, adminToken, "GET", "/api/collections/"+coll.ID, "")
+	require.Equal(t, http.StatusOK, code, "admin persona sees collections (policy escape)")
+
+	// ── B's ownership works: B renames B's OWN system collection ──
+	// (positive control — B is not locked out of what B owns)
+	code, body = podcastAuthed(t, setup, otherToken, "GET", "/api/collections", "")
+	require.Equal(t, http.StatusOK, code)
+	var list struct {
+		Collections []struct {
+			ID   string `json:"id"`
+			Name string `json:"name"`
+		} `json:"collections"`
+	}
+	require.NoError(t, json.Unmarshal(body, &list))
+	var bSystem string
+	for _, c := range list.Collections {
+		if c.Name == "Continue Reading" {
+			bSystem = c.ID
+			break
+		}
+	}
+	require.NotEmpty(t, bSystem, "B owns the seeded system collections")
+	code, body = podcastAuthed(t, setup, otherToken, "PUT", "/api/collections/"+bSystem,
+		`{"name":"Continue Reading"}`)
+	require.Contains(t, []int{http.StatusOK, http.StatusCreated}, code,
+		"owner mutation of an OWN collection still works: %s", string(body))
+}

cmd/server/tests/collections_smart_test.go

@@ -56,36 +56,6 @@ func smartGetCollection(t *testing.T, setup *TestServerSetup, token, collectionI
 	return result
 }
 
-func smartPostRule(t *testing.T, setup *TestServerSetup, token, collectionID, field, operator, value string, enabled *bool) *http.Response {
-	t.Helper()
-	payload := map[string]interface{}{
-		"field":    field,
-		"operator": operator,
-		"value":    value,
-	}
-	if enabled != nil {
-		payload["enabled"] = *enabled
-	}
-	body, _ := json.Marshal(payload)
-	req, _ := http.NewRequest("POST", setup.Server.URL+"/api/collections/"+collectionID+"/rules", bytes.NewBuffer(body))
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+token)
-	resp, err := http.DefaultClient.Do(req)
-	require.NoError(t, err)
-	return resp
-}
-
-func smartDecodeRuleID(t *testing.T, resp *http.Response) string {
-	t.Helper()
-	defer func(Body io.ReadCloser) { _ = Body.Close() }(resp.Body)
-	var result map[string]interface{}
-	require.NoError(t, json.NewDecoder(resp.Body).Decode(&result))
-	rule := result["rule"].(map[string]interface{})
-	return rule["id"].(string)
-}
-
-// Data helpers -----------------------------------------------------------
-
 func smartCreateLibraryAndBooks(t *testing.T, setup *TestServerSetup, userID uuid.UUID, titlesByGenre map[string]string) (libraryID string, bookIDs []string) {
 	t.Helper()
 	ctx := context.Background()
@@ -145,81 +115,83 @@ func TestSmartCollections(t *testing.T) {
 	setup := setupTestServer(t)
 	adminID := getTestUserID(t, setup.DB)
 
-	t.Run("FirstRuleConvertsCollectionToSmart_LiveMembership", func(t *testing.T) {
+	t.Run("TreeCollectionLiveMembership", func(t *testing.T) {
+		// The unified engine (item 3.2): a collection created WITH a
+		// books-scope tree evaluates LIVE — stored links are ignored,
+		// only tree matches render.
 		_, bookIDs := smartCreateLibraryAndBooks(t, setup, adminID, map[string]string{
 			"Smart SF Book One": "Science Fiction",
 			"Smart SF Book Two": "Science Fiction",
 			"Smart FANT Book":   "Fantasy",
 		})
+		_ = bookIDs
 
-		// Rule evaluation ignores stored links: a static collection's own
-		// added item must NOT show up once the collection is smart.
-		collID := smartCreateCollection(t, setup, setup.Token, "Test Smart Live "+uuid.NewString()[:8], "static")
-
-		// Add one hand-picked book (a Fantasy one that the smart rule
-		// will not match — so it must vanish from the render).
-		addBody, _ := json.Marshal(map[string]interface{}{"book_ids": []string{bookIDs[2]}})
-		addReq, _ := http.NewRequest("POST", setup.Server.URL+"/api/collections/"+collID+"/books", bytes.NewBuffer(addBody))
-		addReq.Header.Set("Content-Type", "application/json")
-		addReq.Header.Set("Authorization", "Bearer "+setup.Token)
-		addResp, err := http.DefaultClient.Do(addReq)
+		tree := map[string]interface{}{
+			"scope": "books", "mode": "all",
+			"children": []map[string]interface{}{
+				{"field": "genre", "op": "is", "values": []string{"Science Fiction"}},
+			},
+		}
+		body, _ := json.Marshal(map[string]interface{}{
+			"name":        "Test Smart Tree " + uuid.NewString()[:8],
+			"filter_tree": tree,
+		})
+		req, _ := http.NewRequest("POST", setup.Server.URL+"/api/collections", bytes.NewBuffer(body))
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("Authorization", "Bearer "+setup.Token)
+		resp, err := http.DefaultClient.Do(req)
 		require.NoError(t, err)
-		require.Equal(t, http.StatusNoContent, addResp.StatusCode)
-		_ = addResp.Body.Close()
-
-		staticDetail := smartGetCollection(t, setup, setup.Token, collID)
-		assert.Equal(t, false, staticDetail["is_smart"])
-		assert.Equal(t, float64(1), staticDetail["book_count"], "static collection shows its stored link")
-
-		resp := smartPostRule(t, setup, setup.Token, collID, "genre", "equals", "Science Fiction", nil)
 		require.Equal(t, http.StatusCreated, resp.StatusCode)
+		var created struct {
+			ID string `json:"id"`
+		}
+		require.NoError(t, json.NewDecoder(resp.Body).Decode(&created))
 		_ = resp.Body.Close()
+		t.Cleanup(func() {
+			del, _ := http.NewRequest("DELETE", setup.Server.URL+"/api/collections/"+created.ID, nil)
+			del.Header.Set("Authorization", "Bearer "+setup.Token)
+			_, _ = http.DefaultClient.Do(del)
+		})
 
-		smartDetail := smartGetCollection(t, setup, setup.Token, collID)
-		assert.Equal(t, true, smartDetail["is_smart"], "rules presence derives the type")
-		assert.Equal(t, float64(2), smartDetail["book_count"], "live rule matches only")
-
-		memberTitles := smartLibraryTitleSet(t, smartDetail)
+		detail := smartGetCollection(t, setup, setup.Token, created.ID)
+		assert.Equal(t, true, detail["is_smart"], "tree presence derives the type")
+		memberTitles := smartLibraryTitleSet(t, detail)
 		assert.True(t, memberTitles["Smart SF Book One"])
 		assert.True(t, memberTitles["Smart SF Book Two"])
-		assert.False(t, memberTitles["Smart FANT Book"], "hand-picked link is ignored under smart evaluation (v1 no hybrid)")
-	})
-
-	t.Run("DisabledRuleExcludedFromLiveSet", func(t *testing.T) {
-		smartCreateLibraryAndBooks(t, setup, adminID, map[string]string{
-			"Smart Diss Book": "Science Fiction",
-		})
-		collID := smartCreateCollection(t, setup, setup.Token, "Test Smart Disabled "+uuid.NewString()[:8], "smart")
-
-		resp := smartPostRule(t, setup, setup.Token, collID, "genre", "equals", "Science Fiction", nil)
-		require.Equal(t, http.StatusCreated, resp.StatusCode)
-		ruleID := smartDecodeRuleID(t, resp)
-
-		assert.Equal(t, float64(1), smartGetCollection(t, setup, setup.Token, collID)["book_count"])
-
-		// Disable: membership drops to zero at once.
-		falseFlag := false
-		dBody, _ := json.Marshal(map[string]interface{}{"enabled": falseFlag})
-		dReq, _ := http.NewRequest("PUT", setup.Server.URL+"/api/collections/"+collID+"/rules/"+ruleID, bytes.NewBuffer(dBody))
-		dReq.Header.Set("Content-Type", "application/json")
-		dReq.Header.Set("Authorization", "Bearer "+setup.Token)
-		dResp, err := http.DefaultClient.Do(dReq)
-		require.NoError(t, err)
-		require.Equal(t, http.StatusOK, dResp.StatusCode)
-		_ = dResp.Body.Close()
-
-		assert.Equal(t, float64(0), smartGetCollection(t, setup, setup.Token, collID)["book_count"], "disabled rules never match")
+		assert.False(t, memberTitles["Smart FANT Book"], "the tree's AND governs membership live")
 	})
 
 	t.Run("SmartCollectionsRejectMembershipMutations", func(t *testing.T) {
 		smartCreateLibraryAndBooks(t, setup, adminID, map[string]string{
 			"Smart Guard Book": "Science Fiction",
 		})
-		collID := smartCreateCollection(t, setup, setup.Token, "Test Smart Guard "+uuid.NewString()[:8], "smart")
-
-		resp := smartPostRule(t, setup, setup.Token, collID, "genre", "equals", "Science Fiction", nil)
+		tree := map[string]interface{}{
+			"scope": "books", "mode": "all",
+			"children": []map[string]interface{}{
+				{"field": "genre", "op": "is", "values": []string{"Science Fiction"}},
+			},
+		}
+		body, _ := json.Marshal(map[string]interface{}{
+			"name":        "Test Smart Guard " + uuid.NewString()[:8],
+			"filter_tree": tree,
+		})
+		req, _ := http.NewRequest("POST", setup.Server.URL+"/api/collections", bytes.NewBuffer(body))
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("Authorization", "Bearer "+setup.Token)
+		resp, err := http.DefaultClient.Do(req)
+		require.NoError(t, err)
 		require.Equal(t, http.StatusCreated, resp.StatusCode)
+		var created struct {
+			ID string `json:"id"`
+		}
+		require.NoError(t, json.NewDecoder(resp.Body).Decode(&created))
 		_ = resp.Body.Close()
+		collID := created.ID
+		t.Cleanup(func() {
+			del, _ := http.NewRequest("DELETE", setup.Server.URL+"/api/collections/"+collID, nil)
+			del.Header.Set("Authorization", "Bearer "+setup.Token)
+			_, _ = http.DefaultClient.Do(del)
+		})
 
 		addBody, _ := json.Marshal(map[string]interface{}{"book_ids": []string{uuid.NewString()}})
 		addReq, _ := http.NewRequest("POST", setup.Server.URL+"/api/collections/"+collID+"/books", bytes.NewBuffer(addBody))
@@ -238,53 +210,10 @@ func TestSmartCollections(t *testing.T) {
 		_ = removeResp.Body.Close()
 	})
 
-	t.Run("RemoveLastRuleRevertsToStatic", func(t *testing.T) {
-		smartCreateLibraryAndBooks(t, setup, adminID, map[string]string{
-			"Smart Back Book": "Science Fiction",
-		})
-		collID := smartCreateCollection(t, setup, setup.Token, "Test Smart Revert "+uuid.NewString()[:8], "smart")
-
-		resp := smartPostRule(t, setup, setup.Token, collID, "tags", "contains", "no-such-tag", nil)
-		require.Equal(t, http.StatusCreated, resp.StatusCode)
-		ruleID := smartDecodeRuleID(t, resp)
-
-		smartDetail := smartGetCollection(t, setup, setup.Token, collID)
-		assert.Equal(t, true, smartDetail["is_smart"])
-
-		delReq, _ := http.NewRequest("DELETE", setup.Server.URL+"/api/collections/"+collID+"/rules/"+ruleID, nil)
-		delReq.Header.Set("Authorization", "Bearer "+setup.Token)
-		delResp, err := http.DefaultClient.Do(delReq)
-		require.NoError(t, err)
-		require.Equal(t, http.StatusOK, delResp.StatusCode)
-		_ = delResp.Body.Close()
-
-		staticDetail := smartGetCollection(t, setup, setup.Token, collID)
-		assert.Equal(t, false, staticDetail["is_smart"], "removing the last rule reverts to static")
-
-		// Membership mutations work again on the reverted static.
-		addBody, _ := json.Marshal(map[string]interface{}{"book_ids": []string{uuid.NewString()}})
-		addReq, _ := http.NewRequest("POST", setup.Server.URL+"/api/collections/"+collID+"/books", bytes.NewBuffer(addBody))
-		addReq.Header.Set("Content-Type", "application/json")
-		addReq.Header.Set("Authorization", "Bearer "+setup.Token)
-		addResp, err := http.DefaultClient.Do(addReq)
-		require.NoError(t, err)
-		assert.Equal(t, http.StatusNoContent, addResp.StatusCode)
-		_ = addResp.Body.Close()
-	})
-
-	t.Run("RuleValidationAndSystemCollections", func(t *testing.T) {
-		collID := smartCreateCollection(t, setup, setup.Token, "Test Smart Valid "+uuid.NewString()[:8], "static")
-
-		resp := smartPostRule(t, setup, setup.Token, collID, "not_a_field", "equals", "x", nil)
-		require.Equal(t, http.StatusBadRequest, resp.StatusCode)
-		_ = resp.Body.Close()
-
-		resp = smartPostRule(t, setup, setup.Token, collID, "genre", "equals", "Science Fiction", nil)
-		require.Equal(t, http.StatusCreated, resp.StatusCode)
-		_ = resp.Body.Close()
-
-		// System collections may never carry rules.
-		colls, err := setup.DB.GetCollectionsByUser(context.Background(), pgtype.UUID{Bytes: [16]byte(adminID), Valid: true})
+	t.Run("SystemCollectionsBlockedFromTheEditor", func(t *testing.T) {
+		// System collections may never carry rules/trees — the editor
+		// route refuses them (item 3.4: the page IS the editor).
+		colls, err := setup.DB.GetCollectionsByUser(ownerSeedCtx(pgtype.UUID{Bytes: [16]byte(adminID), Valid: true}), pgtype.UUID{Bytes: [16]byte(adminID), Valid: true})
 		require.NoError(t, err)
 		var systemID string
 		for _, c := range colls {
@@ -295,20 +224,46 @@ func TestSmartCollections(t *testing.T) {
 		}
 		require.NotEmpty(t, systemID, "admin user should have system collections")
 
-		sysResp := smartPostRule(t, setup, setup.Token, systemID, "genre", "equals", "x", nil)
-		require.Equal(t, http.StatusBadRequest, sysResp.StatusCode)
-		_ = sysResp.Body.Close()
+		req, _ := http.NewRequest("GET", setup.Server.URL+"/collections/"+systemID+"/rules", nil)
+		req.Header.Set("Authorization", "Bearer "+setup.Token)
+		resp, err := http.DefaultClient.Do(req)
+		require.NoError(t, err)
+		defer func(Body io.ReadCloser) { _ = Body.Close() }(resp.Body)
+		assert.NotEqual(t, http.StatusOK, resp.StatusCode,
+			"system collections never render the smart editor")
 	})
 
 	t.Run("CollectionsListRespectsIncludeAutoWithLiveCounts", func(t *testing.T) {
 		_, _ = smartCreateLibraryAndBooks(t, setup, adminID, map[string]string{
 			"Smart List Book": "Science Fiction",
 		})
-		collID := smartCreateCollection(t, setup, setup.Token, "Test Smart List "+uuid.NewString()[:8], "smart")
-
-		resp := smartPostRule(t, setup, setup.Token, collID, "genre", "equals", "Science Fiction", nil)
-		require.Equal(t, http.StatusCreated, resp.StatusCode)
-		_ = resp.Body.Close()
+		tree := map[string]interface{}{
+			"scope": "books", "mode": "all",
+			"children": []map[string]interface{}{
+				{"field": "genre", "op": "is", "values": []string{"Science Fiction"}},
+			},
+		}
+		body, _ := json.Marshal(map[string]interface{}{
+			"name":        "Test Smart List " + uuid.NewString()[:8],
+			"filter_tree": tree,
+		})
+		req2, _ := http.NewRequest("POST", setup.Server.URL+"/api/collections", bytes.NewBuffer(body))
+		req2.Header.Set("Content-Type", "application/json")
+		req2.Header.Set("Authorization", "Bearer "+setup.Token)
+		resp2, err := http.DefaultClient.Do(req2)
+		require.NoError(t, err)
+		require.Equal(t, http.StatusCreated, resp2.StatusCode)
+		var created struct {
+			ID string `json:"id"`
+		}
+		require.NoError(t, json.NewDecoder(resp2.Body).Decode(&created))
+		_ = resp2.Body.Close()
+		collID := created.ID
+		t.Cleanup(func() {
+			del, _ := http.NewRequest("DELETE", setup.Server.URL+"/api/collections/"+collID, nil)
+			del.Header.Set("Authorization", "Bearer "+setup.Token)
+			_, _ = http.DefaultClient.Do(del)
+		})
 
 		// Default list (the Android app's read): smart collections hidden.
 		req, _ := http.NewRequest("GET", setup.Server.URL+"/api/collections", nil)

cmd/server/tests/contract_pins_test.go

@@ -459,6 +459,8 @@ var bookInfoKeys = []string{
 	"media_item_id", "title", "author", "cover_image_path",
 	"has_conflict", "format_group", "badge",
 	"viewer_percentage", "library_name",
+	// Episode-collections extras (2.3 widening, every surface emits):
+	"is_episode", "feed_title", "download_state", "hidden",
 }
 
 func collectionURL(setup *TestServerSetup, id string) string {
@@ -498,8 +500,9 @@ func TestContractPin_CollectionsJSON(t *testing.T) {
 	// payload; docs/contract_pins.md changelog).
 	envelopeKeys := []string{
 		"id", "user_id", "name", "description", "color", "icon",
-		"auto_assign_rules", "view_settings", "books", "book_count",
+		"view_settings", "books", "book_count",
 		"is_smart", "created_at", "up_next",
+		"filter_tree", // item-3.2 widening (docs/contract_pins.md)
 	}
 
 	t.Run("user collection with library_id (badged branch)", func(t *testing.T) {
@@ -562,11 +565,14 @@ func TestContractPin_CollectionsJSON(t *testing.T) {
 		assertArrayItemShape(t, "collection books[] (no library)", books, bookInfoKeys, bookInfoKeys)
 	})
 
-	t.Run("smart collection (rules branch)", func(t *testing.T) {
+	t.Run("smart collection (tree branch)", func(t *testing.T) {
 		resp := doReq(t, "POST", setup.Server.URL+"/api/collections", map[string]interface{}{
 			"name": fmt.Sprintf("Test Contract Smart %d", time.Now().UnixNano()),
-			"auto_assign_rules": []map[string]interface{}{
-				{"id": "rule-1", "field": "genre", "operator": "equals", "value": "Science Fiction", "priority": 5},
+			"filter_tree": map[string]interface{}{
+				"scope": "books", "mode": "any",
+				"children": []map[string]interface{}{
+					{"field": "genre", "op": "is", "values": []string{"Science Fiction"}},
+				},
 			},
 		}, setup.Token)
 		defer resp.Body.Close()
@@ -761,6 +767,10 @@ func TestContractPin_MediaListBothBranches(t *testing.T) {
 		"declared_duration_seconds", "transcript_url", "chapters_url",
 		"hosts", "guests", "download_state", "download_error",
 		"download_attempts",
+		// §0 item 4 (2026-10-30 additive widening): the download pool's
+		// queue ticket — SEQUENCE-stamped at enqueue, NULL for scan rows
+		// and never-queued episodes. See docs/contract_pins.md changelog.
+		"download_queue_pos",
 	}
 	resolvedKeys := []string{
 		"id", "library_id", "title", "subtitle", "author", "authors", "isbn", "description",

cmd/server/tests/custom_section_builder_test.go

@@ -0,0 +1,157 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"bookhoard/internal/database"
+)
+
+// The custom-section builder's save, end to end (2026-10-31 tree
+// migration). The page posts the legacy rules vocabulary — rules as a
+// JSON-encoded ARRAY inside a STRING (it has done so since the page was
+// written, 2026-02-19; the save never once bound successfully before
+// the migration) — plus match_type, hand-picked book ids, and the
+// dashboard pin. The server converts the rules to a filter tree at
+// write time, attaches the manual picks, and the dashboard section
+// renders stored membership + the tree's live matches, deduped.
+func TestCustomSectionBuilderSave(t *testing.T) {
+	setup := setupTestServer(t)
+	adminToken := setup.Token
+	regToken := setup.RegularToken
+	marker := fmt.Sprintf("csb%d", time.Now().UnixNano()%100000)
+
+	libID := createTestLibraryWithFolder(t, setup.Server, adminToken, "test CSB Library "+marker, true)
+	libUUID, err := uuid.Parse(libID)
+	require.NoError(t, err)
+
+	// Two items the title rule matches, one it doesn't. Alpha is ALSO
+	// hand-picked — the section must render it once, not twice.
+	makeItem := func(title string) uuid.UUID {
+		id, cerr := setup.DB.CreateMediaItem(seedCtx(), database.CreateMediaItemParams{
+			LibraryID: pgtype.UUID{Bytes: libUUID, Valid: true},
+			Title:     title,
+			Authors:   []string{"CSB Author"},
+			FilePath:  fmt.Sprintf("/tmp/csb/%s-%s.epub", marker, strings.ReplaceAll(title, " ", "-")),
+			FileSize:  pgtype.Int8{Int64: 128, Valid: true},
+			MimeType:  pgtype.Text{String: "application/epub+zip", Valid: true},
+		})
+		require.NoError(t, cerr)
+		out, perr := uuid.FromBytes(id.ID.Bytes[:])
+		require.NoError(t, perr)
+		return out
+	}
+	alpha := makeItem("CSBRULE Alpha")
+	_ = makeItem("CSBRULE Beta")
+	manual := makeItem("CSB Manual Pick")
+	require.NotZero(t, alpha)
+
+	// The EXACT payload shape the builder page posts.
+	payload := fmt.Sprintf(`{
+		"library_id": %q,
+		"name": "test CSB Section %s",
+		"icon": "📚",
+		"description": "built by the custom-section builder",
+		"show_on_dashboard": true,
+		"auto_assign_rules": %[3]s,
+		"manual_book_ids": [%q, %q],
+		"match_type": "all"
+	}`, libID, marker,
+		`"[{\"field\":\"title\",\"operator\":\"contains\",\"value\":\"CSBRULE\"}]"`,
+		alpha.String(), manual.String())
+
+	code, body := podcastAuthed(t, setup, regToken, "POST", "/api/collections", payload)
+	require.Equal(t, http.StatusCreated, code, "%s", string(body))
+	var coll struct {
+		ID string `json:"id"`
+	}
+	require.NoError(t, json.Unmarshal([]byte(body), &coll))
+	collID := coll.ID
+	require.NotEmpty(t, collID)
+	t.Cleanup(func() {
+		podcastAuthed(t, setup, regToken, "DELETE", "/api/collections/"+collID, "")
+	})
+
+	// The converted tree round-trips: root mode from match_type, the
+	// rule as a qf child, and the collection IS smart with no
+	// collection_type sent.
+	code, body = podcastAuthed(t, setup, regToken, "GET", "/api/collections/"+collID, "")
+	require.Equal(t, http.StatusOK, code)
+	var detail struct {
+		IsSmart    bool `json:"is_smart"`
+		FilterTree struct {
+			Mode     string `json:"mode"`
+			Children []struct {
+				Field  string   `json:"field"`
+				Op     string   `json:"op"`
+				Values []string `json:"values"`
+			} `json:"children"`
+		} `json:"filter_tree"`
+	}
+	require.NoError(t, json.Unmarshal([]byte(body), &detail))
+	assert.True(t, detail.IsSmart, "converted rules make the collection smart")
+	assert.Equal(t, "all", detail.FilterTree.Mode, "match_type seeds the tree's root mode")
+	require.Len(t, detail.FilterTree.Children, 1)
+	assert.Equal(t, "title", detail.FilterTree.Children[0].Field)
+	assert.Equal(t, []string{"CSBRULE"}, detail.FilterTree.Children[0].Values)
+
+	// The dashboard section renders stored membership + live matches,
+	// deduped: Alpha (rule + manual), Beta (rule), Manual (manual).
+	code, body = podcastAuthed(t, setup, regToken, "GET",
+		"/api/dashboard/sections?library_id="+libID, "")
+	require.Equal(t, http.StatusOK, code, "%s", string(body))
+	var dash struct {
+		Sections []struct {
+			Title        string `json:"title"`
+			CollectionID string `json:"collection_id"`
+			Items        []struct {
+				Title string `json:"title"`
+			} `json:"items"`
+		} `json:"sections"`
+	}
+	require.NoError(t, json.Unmarshal([]byte(body), &dash))
+	var section *struct {
+		Title        string `json:"title"`
+		CollectionID string `json:"collection_id"`
+		Items        []struct {
+			Title string `json:"title"`
+		} `json:"items"`
+	}
+	for i := range dash.Sections {
+		if dash.Sections[i].CollectionID == collID {
+			section = &dash.Sections[i]
+			break
+		}
+	}
+	require.NotNil(t, section, "the custom section renders on the dashboard: %s", string(body))
+	titles := map[string]int{}
+	for _, it := range section.Items {
+		titles[it.Title]++
+	}
+	assert.Equal(t, 1, titles["CSBRULE Alpha"], "rule-matched AND hand-picked renders exactly once")
+	assert.Equal(t, 1, titles["CSBRULE Beta"], "rule match rides the tree")
+	assert.Equal(t, 1, titles["CSB Manual Pick"], "manual picks are attached")
+	assert.Len(t, section.Items, 3, "nothing else leaks into the section")
+}
+
+// TestCustomSectionBuilderBadRule pins the adapter's rejection path: a
+// rule the engine cannot honor is a 400 that names the field, never a
+// stored 500 at render time.
+func TestCustomSectionBuilderBadRule(t *testing.T) {
+	setup := setupTestServer(t)
+	regToken := setup.RegularToken
+
+	code, body := podcastAuthed(t, setup, regToken, "POST", "/api/collections",
+		`{"name":"test CSB Bad `+fmt.Sprint(time.Now().UnixNano())+`","auto_assign_rules":"[{\"field\":\"not_a_field\",\"operator\":\"contains\",\"value\":\"x\"}]"}`)
+	assert.Equal(t, http.StatusBadRequest, code, "%s", string(body))
+	assert.Contains(t, string(body), "section rule")
+}

cmd/server/tests/filter_builder_test.go

@@ -295,6 +295,115 @@ func TestFilterComposedSemantics(t *testing.T) {
 	assert.Equal(t, []string{"Sem Tide"}, got, "published_year at_least")
 }
 
+// TestFilterScopesAndEpisodeFields pins item 3.1: the books scope
+// excludes podcasts (the leak the composed head used to have), the
+// episodes scope is episodes only, episode fields evaluate in SQL
+// (feed-in, downloaded, played, published-date-within), and episode
+// fields are 400s in books trees.
+func TestFilterScopesAndEpisodeFields(t *testing.T) {
+	setup := setupTestServer(t)
+	t.Cleanup(func() { _ = setup.Close() })
+
+	regUUID := getRegularUserID(t, setup.DB)
+	builderFixtureLib(t, setup, regUUID, "Scope")
+
+	// Podcasts library + a subscribed feed with three downloaded
+	// episodes: two fresh/unplayed, one played (~finished) — the
+	// played-rule fixture.
+	feedLib, _ := createPodcastsLibrary(t, setup, "test Scope Podcasts")
+	feed, err := setup.DB.CreatePodcastFeed(adminSeedCtx(t, setup), database.CreatePodcastFeedParams{
+		LibraryID: feedLib.ID,
+		FeedUrl:   "https://feed.invalid/scope-probe.xml",
+		Title:     "Scope Probe Feed",
+	})
+	require.NoError(t, err)
+	epFresh := upsertTestEpisode(t, setup, feed, "scope-fresh", "Scope Fresh Episode", 1)
+	epPlayed := upsertTestEpisode(t, setup, feed, "scope-played", "Scope Played Episode", 2)
+	upsertTestEpisode(t, setup, feed, "scope-pending", "Scope Pending Episode", 3)
+	subscribeRaw(t, setup, regUUID, feed.ID)
+	adminScopeExec(t, setup, adminCtxValue(t, setup), `
+		UPDATE media_items SET download_state = 'downloaded', file_size = 1000,
+		       date_published = CURRENT_DATE WHERE id IN ($1, $2)`, epFresh.ID, epPlayed.ID)
+	adminScopeExec(t, setup, adminCtxValue(t, setup), `
+		INSERT INTO reading_progress (media_item_id, user_id, percentage)
+		VALUES ($1, $2, 1.0) ON CONFLICT (media_item_id, user_id)
+		DO UPDATE SET percentage = 1.0`, epPlayed.ID, regUUID)
+
+	feedID := uuid.UUID(feed.ID.Bytes).String()
+
+	qfScoped := func(scope string, children ...map[string]interface{}) url.Values {
+		b, _ := json.Marshal(map[string]interface{}{"scope": scope, "mode": "all", "children": children})
+		return url.Values{"qf": {string(b)}}
+	}
+	const booksScope = "books"
+	const episodesScope = "episodes"
+
+	search := func(p url.Values) []string {
+		rows := p
+		status, body := qfSearch(t, setup, setup.RegularToken, rows)
+		// 404 is the endpoint's pinned no-results contract — an empty set.
+		require.Contains(t, []int{http.StatusOK, http.StatusNotFound}, status, "qf must parse: %v", rows)
+		return qfTitles(t, body)
+	}
+
+	t.Run("books_scope_excludes_podcasts", func(t *testing.T) {
+		// An exact-ish title hits BOTH a book fixture ("Scope Tide") and
+		// the episode fixture if the head leaks; books scope must return
+		// the book, never the episodes.
+		got := search(qfScoped(booksScope, qfRule("title", "is", "Scope Tide")))
+		assert.Equal(t, []string{"Scope Tide"}, got, "books scope returns the book")
+		got = search(qfScoped(booksScope, qfRule("title", "is", "Scope Fresh Episode")))
+		assert.Empty(t, got,
+			"books scope must never return podcast episodes (the composed-head leak is CLOSED)")
+	})
+
+	t.Run("episodes_scope_is_episodes_only", func(t *testing.T) {
+		got := search(qfScoped(episodesScope, qfRule("title", "is", "Scope Fresh Episode")))
+		assert.Equal(t, []string{"Scope Fresh Episode"}, got,
+			"episodes scope: only episodes — books drop")
+	})
+
+	t.Run("episode_rules_evaluate_in_sql", func(t *testing.T) {
+		got := search(qfScoped(episodesScope,
+			qfRule("feed", "in", feedID)))
+		assert.ElementsMatch(t, []string{"Scope Fresh Episode", "Scope Played Episode", "Scope Pending Episode"},
+			got, "feed-in matches every episode of the feed (download state is a separate rule)")
+
+		got = search(qfScoped(episodesScope,
+			qfRule("downloaded", "is_true")))
+		assert.ElementsMatch(t, []string{"Scope Fresh Episode", "Scope Played Episode"},
+			got, "downloaded:true drops the pending episode")
+
+		got = search(qfScoped(episodesScope,
+			qfRule("played", "is_false"),
+			qfRule("downloaded", "is_true")))
+		assert.ElementsMatch(t, []string{"Scope Fresh Episode"}, got,
+			"played:false + downloaded = the unplayed playable episode (viewer progress)")
+
+		got = search(qfScoped(episodesScope,
+			qfRule("played", "is_true")))
+		assert.ElementsMatch(t, []string{"Scope Played Episode"}, got,
+			"played:true matches the finished episode")
+
+		got = search(qfScoped(episodesScope,
+			qfRule("published_date", "within_days", "7"),
+			qfRule("downloaded", "is_true")))
+		assert.ElementsMatch(t, []string{"Scope Fresh Episode", "Scope Played Episode"},
+			got, "published-within includes the dated episodes")
+	})
+
+	t.Run("episode_fields_are_400_in_books_scope", func(t *testing.T) {
+		p := qfScoped(booksScope, qfRule("played", "is_true"))
+		req, _ := http.NewRequest("GET", setup.Server.URL+"/api/media-items/search?"+p.Encode(), nil)
+		req.Header.Set("Authorization", "Bearer "+setup.RegularToken)
+		resp, err := http.DefaultClient.Do(req)
+		require.NoError(t, err)
+		defer func() { _ = resp.Body.Close() }()
+		assert.Equal(t, http.StatusBadRequest, resp.StatusCode,
+			"episode-only fields are rejected in books trees at parse time")
+	})
+}
+
 func TestFilterUserRelativeFields(t *testing.T) {
 	setup := setupTestServer(t)
 	t.Cleanup(func() { _ = setup.Close() })
@@ -346,12 +455,17 @@ func TestFilterUserRelativeFields(t *testing.T) {
 		aID, wickID, aID, tideID)
 
 	var collID pgtype.UUID
-	err := setup.DBPool.QueryRow(context.Background(),
+	// Seed as the OWNER (collections RLS, 2026-10-31): the insert
+	// predicate wants actor == owner, and the item/cleanup writes want
+	// the same identity — the admin write-escape covers SYSTEM rows only.
+	err := database.NewScopedDB(setup.DBPool).QueryRow(ownerSeedCtx(aID),
 		`INSERT INTO collections (user_id, name) VALUES ($1, $2) RETURNING id`,
 		aID, fmt.Sprintf("Test Builder Coll %d", time.Now().UnixNano())).Scan(&collID)
 	require.NoError(t, err)
-	t.Cleanup(func() { _ = setup.DB.DeleteCollection(ctx, collID) })
-	seedExec(t, setup.DBPool,
+	t.Cleanup(func() {
+		scopeExecAs(t, setup, aID, `DELETE FROM collections WHERE id = $1`, collID)
+	})
+	scopeExecAs(t, setup, aID,
 		`INSERT INTO collection_items (collection_id, media_item_id) VALUES ($1,$2)`, collID, tideID)
 
 	titlesFor := func(token string, qf string) []string {
@@ -433,7 +547,6 @@ func TestFilterSuggestionsUnderRules(t *testing.T) {
 	libUUID, _ := builderFixtureLib(t, setup, userID, "Sug")
 
 	// Add a second distinct author+genre pair (trigram-disjoint).
-	ctx := context.Background()
 	_, err := setup.DB.CreateMediaItem(seedCtx(), database.CreateMediaItemParams{
 		LibraryID: pgtype.UUID{Bytes: libUUID, Valid: true},
 		Title:     "Sug Dune",
@@ -537,6 +650,16 @@ func TestFilterSuggestionsUnderRules(t *testing.T) {
 	}
 	assert.True(t, found, "the visible library is offered")
 
+	// ID LOOKUP (2026-11-01): typing a stored ID resolves its label —
+	// the builder's post-Apply reload path resolves stored ids to names
+	// through this same call.
+	status, results = suggest("library", libUUID.String(), "")
+	require.Equal(t, http.StatusOK, status)
+	require.NotEmpty(t, results, "the id lookup returns its row")
+	assert.Equal(t, libUUID.String(), results[0]["value"])
+	disp, _ := results[0]["display"].(string)
+	assert.Contains(t, disp, "Test Builder", "the id resolves to the library NAME")
+
 	// BROWSE the library field UNDER rules (the blank-typed click): the
 	// id-source query must not choke on the unused typed parameter and
 	// must list exactly the library holding the surviving books.
@@ -561,16 +684,21 @@ func TestFilterSuggestionsUnderRules(t *testing.T) {
 	// offered with the surviving count; zero-match containers never are.
 	userA := getRegularUserID(t, setup.DB)
 	var collID pgtype.UUID
-	err = setup.DBPool.QueryRow(context.Background(),
+	// Seed as the OWNER (collections RLS, 2026-10-31) — same identity
+	// rule as the first seeding site in this file.
+	ownerID := pgtype.UUID{Bytes: [16]byte(userA), Valid: true}
+	err = database.NewScopedDB(setup.DBPool).QueryRow(ownerSeedCtx(ownerID),
 		`INSERT INTO collections (user_id, name) VALUES ($1, $2) RETURNING id`,
-		pgtype.UUID{Bytes: [16]byte(userA), Valid: true},
+		ownerID,
 		fmt.Sprintf("Test Builder Sug Coll %d", time.Now().UnixNano())).Scan(&collID)
 	require.NoError(t, err)
-	t.Cleanup(func() { _ = setup.DB.DeleteCollection(ctx, collID) })
+	t.Cleanup(func() {
+		scopeExecAs(t, setup, ownerID, `DELETE FROM collections WHERE id = $1`, collID)
+	})
 	var tideID pgtype.UUID
 	err = setup.DBPool.QueryRow(context.Background(), `SELECT id FROM media_items WHERE title = $1`, "Sug Tide").Scan(&tideID)
 	require.NoError(t, err)
-	seedExec(t, setup.DBPool,
+	scopeExecAs(t, setup, ownerID,
 		`INSERT INTO collection_items (collection_id, media_item_id) VALUES ($1, $2)`, collID, tideID)
 
 	status, results = suggest("collection", " ", "")
@@ -775,3 +903,85 @@ func TestFilterFlatEquivalence(t *testing.T) {
 	require.Equal(t, statusFlat, statusTree, "same result status")
 	assert.ElementsMatch(t, qfTitles(t, flatRows), qfTitles(t, treeRows))
 }
+
+// ---- deep group nesting (2026-11-01 group ALL/ANY header toggle): ----
+// the UI can now produce 3+-level mixed-mode trees; pin the engine's
+// parenthesized evaluation for the user's target structure
+// GROUP(GROUP(Field and (Field or Field)) or GROUP(Field and Field and
+// (Field or Field)) and GROUP(Field)) — plus a suggestion request
+// carrying a nested-any constraint (the mode-aware menu under real
+// nesting) — must be 200, never the empty-group 400.
+
+func TestFilterDeepGroupNesting(t *testing.T) {
+	setup := setupTestServer(t)
+	t.Cleanup(func() { _ = setup.Close() })
+
+	userID := getRegularUserID(t, setup.DB)
+	libUUID, _ := builderFixtureLib(t, setup, userID, "Deep")
+
+	titles := func(qf string) []string {
+		p := url.Values{"library_id": {libUUID.String()}, "qf": {qf}}
+		status, rows := qfSearch(t, setup, setup.RegularToken, p)
+		require.Contains(t, []int{http.StatusOK, http.StatusNotFound}, status)
+		return qfTitles(t, rows)
+	}
+
+	// root ALL[
+	//   ANY[ ALL[fantasy, ANY[>=250p, abridged]] ,  ALL[Dar, >=500p] ],
+	//   author not_contains Quill
+	// ]
+	// => Tide (fantasy + 300p), Wick (Dar + 700p); Fen dies at the root
+	// AND (Quill); Stone fails branch A (history) and branch B (Voss).
+	deep := map[string]interface{}{
+		"mode": "all",
+		"children": []interface{}{
+			map[string]interface{}{
+				"mode": "any",
+				"children": []interface{}{
+					map[string]interface{}{
+						"mode": "all",
+						"children": []interface{}{
+							qfRule("genre", "is", "fantasy"),
+							map[string]interface{}{
+								"mode": "any",
+								"children": []interface{}{
+									qfRule("page_count", "at_least", "250"),
+									qfRule("abridged", "is_true"),
+								},
+							},
+						},
+					},
+					map[string]interface{}{
+						"mode": "all",
+						"children": []interface{}{
+							qfRule("author", "contains", "Dar"),
+							qfRule("page_count", "at_least", "500"),
+						},
+					},
+				},
+			},
+			qfRule("author", "not_contains", "Quill"),
+		},
+	}
+	deepJSON, merr := json.Marshal(deep)
+	require.NoError(t, merr)
+	got := titles(string(deepJSON))
+	assert.ElementsMatch(t, []string{"Deep Tide", "Deep Wick"}, got,
+		"3-level mixed-mode nesting evaluates parenthesized")
+
+	// The same shape riding the SUGGEST endpoint (the mode-aware menu's
+	// constraint) — nested any must be a 200, never the empty-group 400.
+	p := url.Values{
+		"library_id": {libUUID.String()},
+		"author":     {""},
+		"limit":      {"20"},
+		"qf":         {string(deepJSON)},
+	}
+	req, _ := http.NewRequest("GET", setup.Server.URL+"/api/media-items/search?"+p.Encode(), nil)
+	req.Header.Set("Authorization", "Bearer "+setup.RegularToken)
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer func() { _ = resp.Body.Close() }()
+	assert.Equal(t, http.StatusOK, resp.StatusCode,
+		"a nested-any constraint rides the suggestion endpoint cleanly: %s", p.Encode())
+}

cmd/server/tests/playlist_collections_test.go

@@ -13,6 +13,8 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
+
+	"bookhoard/internal/database"
 )
 
 // A2c end-to-end: an ABS sidecar whose series array mixes a real series and
@@ -67,13 +69,14 @@ func TestPlaylistCollectionsEndToEnd(t *testing.T) {
 	require.NotEmpty(t, foundPath)
 
 	// (b) The playlist collection exists with provenance, dashboard pin,
-	// and the item at reading position 7.
+	// and the item at reading position 7. Owner-scoped read: collections
+	// RLS (2026-10-31) hides the row from the pool session's SeedIdentity.
 	adminUUIDStr := adminID.String()
 	var collID uuid.UUID
 	var collName, collDesc string
 	var showOnDashboard bool
 	var viewSettingsRaw []byte
-	require.NoError(t, setup.DBPool.QueryRow(context.Background(),
+	require.NoError(t, database.NewScopedDB(setup.DBPool).QueryRow(ownerSeedCtx(adminID),
 		`SELECT id, name, description, show_on_dashboard, view_settings
 		 FROM collections WHERE user_id = $1 AND name = 'The Tagged Saga (Reading Order)'`,
 		adminID).Scan(&collID, &collName, &collDesc, &showOnDashboard, &viewSettingsRaw))
@@ -85,7 +88,9 @@ func TestPlaylistCollectionsEndToEnd(t *testing.T) {
 
 	var position *int32
 	var itemCount int
-	require.NoError(t, setup.DBPool.QueryRow(context.Background(),
+	// Owner-scoped reads: collections RLS (2026-10-31) — items ride the
+	// parent's readability, so the pool session's SeedIdentity sees none.
+	require.NoError(t, database.NewScopedDB(setup.DBPool).QueryRow(ownerSeedCtx(adminID),
 		`SELECT ci.position, COUNT(*) OVER () FROM collection_items ci
 		 WHERE ci.collection_id = $1`, collID).Scan(&position, &itemCount))
 	require.Equal(t, 1, itemCount)
@@ -96,11 +101,11 @@ func TestPlaylistCollectionsEndToEnd(t *testing.T) {
 	// (c) Rescan: no duplicate collection, no duplicate membership.
 	scanTestFolder(t, setup, adminID, folder)
 	var collectionCount, membershipCount int
-	require.NoError(t, setup.DBPool.QueryRow(context.Background(),
+	require.NoError(t, database.NewScopedDB(setup.DBPool).QueryRow(ownerSeedCtx(adminID),
 		`SELECT COUNT(*) FROM collections WHERE user_id = $1 AND name = 'The Tagged Saga (Reading Order)'`,
 		adminID).Scan(&collectionCount))
 	require.Equal(t, 1, collectionCount)
-	require.NoError(t, setup.DBPool.QueryRow(context.Background(),
+	require.NoError(t, database.NewScopedDB(setup.DBPool).QueryRow(ownerSeedCtx(adminID),
 		`SELECT COUNT(*) FROM collection_items WHERE collection_id = $1`, collID).Scan(&membershipCount))
 	require.Equal(t, 1, membershipCount)
 
@@ -131,7 +136,9 @@ func TestPlaylistCollectionsEndToEnd(t *testing.T) {
 	// (e) hide_finished + Up Next + completion marker.
 	// Flip the collection's flag on, mark the single item finished for the
 	// admin, and the dashboard section becomes Complete with no items.
-	_, err = setup.DBPool.Exec(context.Background(),
+	// Owner-or-admin UPDATE policy: run as ADMIN (collections RLS,
+	// 2026-10-31).
+	adminScopeExec(t, setup, adminCtxValue(t, setup),
 		`UPDATE collections SET view_settings = view_settings || '{"hide_finished": true}'::jsonb WHERE id = $1`, collID)
 	require.NoError(t, err)
 	_, err = setup.DBPool.Exec(context.Background(),

cmd/server/tests/resume_rewind_test.go

@@ -0,0 +1,123 @@
+package main
+
+// Resume rewind (per-user server setting): seconds before the saved
+// position the audiobook/podcast player starts (0 = exact resume).
+// Contract: the profile endpoint owns reads/writes with a strict
+// 0/5/10 allow-list (the request shape is the keep_screen_awake string
+// precedent — the form select must be able to send an explicit Off),
+// and the chapters payload carries the value so every client (web +
+// Android, incl. the Auto service) gets it with its existing fetch.
+// All writes ride the fresh per-test regular user — the shared admin
+// account is never touched (AGENTS doctrine). Fixture book lives in a
+// test-named library that cascades away with the library delete.
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAudioResumeRewind(t *testing.T) {
+	setup := setupTestServer(t)
+	t.Cleanup(func() { _ = setup.Close() })
+
+	admin, _ := moveTestAdminID(t, setup)
+	libID, folder := audioTestLibrary(t, setup, fmt.Sprintf("Test Resume Rewind %d", time.Now().UnixNano()))
+	t.Cleanup(func() { deleteLibraries(t, setup, libID) })
+
+	// 664 Hz tone: not the shared helper's 440 or the speed test's 552,
+	// so the scanner's content dedup never skips this book.
+	writeTestTrackTone(t, filepath.Join(folder, "Rewind Book", "01 one.mp3"), 664)
+	scanTestFolder(t, setup, admin, folder)
+
+	var bookPath string
+	for _, item := range listLibraryAudioItems(t, setup, libID) {
+		if strings.Contains(filepath.ToSlash(item.FilePath), "Rewind Book") && bookPath == "" {
+			bookPath = item.FilePath
+		}
+	}
+	require.NotEmpty(t, bookPath, "Rewind Book item must exist")
+	book, found := findAudioItemByPath(t, setup, libID, bookPath)
+	require.True(t, found)
+	bookID := uuid.UUID(book.ID.Bytes)
+
+	client := &http.Client{}
+	token := setup.RegularToken
+	authed := func(method, url, body string) (*http.Response, func()) {
+		var req *http.Request
+		if body == "" {
+			req, _ = http.NewRequest(method, url, nil)
+		} else {
+			req, _ = http.NewRequest(method, url, strings.NewReader(body))
+			req.Header.Set("Content-Type", "application/json")
+		}
+		req.Header.Set("Authorization", "Bearer "+token)
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		return resp, func() { _ = resp.Body.Close() }
+	}
+	getPayload := func(itemID uuid.UUID) (rewind int) {
+		resp, closer := authed("GET", setup.Server.URL+"/api/media-items/"+itemID.String()+"/chapters", "")
+		defer closer()
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		var data struct {
+			ResumeRewindSeconds int `json:"resume_rewind_seconds"`
+		}
+		require.NoError(t, json.NewDecoder(resp.Body).Decode(&data))
+		return data.ResumeRewindSeconds
+	}
+	getProfileRewind := func() int {
+		resp, closer := authed("GET", setup.Server.URL+"/api/auth/profile", "")
+		defer closer()
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		var profile struct {
+			AudioResumeRewind int `json:"audio_resume_rewind_seconds"`
+		}
+		require.NoError(t, json.NewDecoder(resp.Body).Decode(&profile))
+		return profile.AudioResumeRewind
+	}
+
+	t.Run("defaults to off (exact resume)", func(t *testing.T) {
+		require.Equal(t, 0, getProfileRewind())
+		require.Equal(t, 0, getPayload(bookID))
+	})
+
+	t.Run("profile PUT selects 5 and rides the chapters payload", func(t *testing.T) {
+		resp, closer := authed("PUT", setup.Server.URL+"/api/auth/profile", `{"audio_resume_rewind_seconds":"5"}`)
+		defer closer()
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		require.Equal(t, 5, getProfileRewind())
+		require.Equal(t, 5, getPayload(bookID))
+	})
+
+	t.Run("non-allow-listed values are rejected and change nothing", func(t *testing.T) {
+		for _, body := range []string{`{"audio_resume_rewind_seconds":"7"}`, `{"audio_resume_rewind_seconds":"-5"}`, `{"audio_resume_rewind_seconds":"abc"}`} {
+			resp, closer := authed("PUT", setup.Server.URL+"/api/auth/profile", body)
+			require.Equal(t, http.StatusBadRequest, resp.StatusCode)
+			closer()
+		}
+		require.Equal(t, 5, getProfileRewind())
+	})
+
+	t.Run("explicit off resets to 0 everywhere", func(t *testing.T) {
+		resp, closer := authed("PUT", setup.Server.URL+"/api/auth/profile", `{"audio_resume_rewind_seconds":"0"}`)
+		defer closer()
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		require.Equal(t, 0, getProfileRewind())
+		require.Equal(t, 0, getPayload(bookID))
+	})
+
+	t.Run("JSON clients that omit the key leave it untouched", func(t *testing.T) {
+		resp, closer := authed("PUT", setup.Server.URL+"/api/auth/profile", `{"timezone":"UTC"}`)
+		defer closer()
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		require.Equal(t, 0, getProfileRewind())
+	})
+}

cmd/server/tests/scan_state_test.go

@@ -207,12 +207,13 @@ func TestScanManifestLifecycle(t *testing.T) {
 	require.NoError(t, os.WriteFile(opfPath, []byte(`{"title":"Manifesu Book","series":["Lifecycle Saga (Reading Order) #1"]}`), 0644))
 	scanTestFolder(t, setup, admin, folder)
 	var collCount int
-	require.NoError(t, setup.DBPool.QueryRow(context.Background(),
+	// Owner-scoped read: collections RLS (2026-10-31).
+	require.NoError(t, database.NewScopedDB(setup.DBPool).QueryRow(ownerSeedCtx(admin),
 		`SELECT COUNT(*) FROM collections WHERE name = 'Lifecycle Saga (Reading Order)' AND user_id = $1`, admin,
 	).Scan(&collCount))
 	assert.Equal(t, 1, collCount, "reading-order sidecar added to an existing book creates its collection")
 	scanTestFolder(t, setup, admin, folder)
-	require.NoError(t, setup.DBPool.QueryRow(context.Background(),
+	require.NoError(t, database.NewScopedDB(setup.DBPool).QueryRow(ownerSeedCtx(admin),
 		`SELECT COUNT(*) FROM collections WHERE name = 'Lifecycle Saga (Reading Order)' AND user_id = $1`, admin,
 	).Scan(&collCount))
 	assert.Equal(t, 1, collCount, "rescan is idempotent — no duplicate collection")

cmd/server/tests/test_helpers_test.go

@@ -329,6 +329,22 @@ func seedCtx() context.Context {
 	return rls.WithUser(context.Background(), rls.SeedIdentity)
 }
 
+// ownerSeedCtx returns a context carrying a fixture user's identity,
+// for seeding rows OWNED by that user. Collections RLS (2026-10-31):
+// the write predicates want actor == owner for non-system rows (the
+// admin write-escape covers SYSTEM collections only), and reads under
+// the pool session's SeedIdentity see nothing.
+func ownerSeedCtx(userID pgtype.UUID) context.Context {
+	return rls.WithUser(context.Background(), userID)
+}
+
+// scopeExecAs is adminScopeExec's generic form: raw SQL under ANY
+// declared identity. Use it (with the row's OWNER) for fixture writes
+// to non-system collections — see ownerSeedCtx.
+func scopeExecAs(t *testing.T, setup *TestServerSetup, userID pgtype.UUID, sql string, args ...any) {
+	adminScopeExec(t, setup, userID, sql, args...)
+}
+
 // seedExec runs a raw statement against the pool under the seed
 // identity. The bare pool bypasses ScopedDB (nothing reads the ctx for
 // the GUC), so governed tables need the identity declared manually
@@ -356,7 +372,12 @@ func uuidToPGType(u uuid.UUID) pgtype.UUID {
 
 // createDefaultCollectionsForUser creates the 4 default system collections for a user
 func createDefaultCollectionsForUser(t *testing.T, db *database.Queries, userID pgtype.UUID) {
-	ctx := context.Background()
+	// Owner-scoped seeding: the collections RLS policies (2026-10-31)
+	// need an acting identity, and the harness seeds before any JWT —
+	// the same bootstrap fix as CreateDefaultCollectionsForUser in
+	// internal/handlers/auth.go. Owner == actor, so SELECT sees the
+	// rows, the INSERT passes, and the heal-UPDATE passes.
+	ctx := rls.WithUser(context.Background(), userID)
 	// Canonical Title-case names — the same list the registration seed
 	// (CreateDefaultCollectionsForUser) and RestoreSystemCollection use.
 	// A stale kebab-case copy lived here once and duplicated every
@@ -596,10 +617,13 @@ func setupTestServer(t *testing.T) *TestServerSetup {
 	worker := services.NewWorker(3, connManager)
 	services.WorkerInstance = worker
 	jobsHandler := handlers.NewJobsHandler(queries, worker)
-	collectionHandler := handlers.NewCollectionHandler(queries, libraryService, connManager)
+	// One composed-engine service for search AND the collection
+	// subsystem (item 3.2 — mirrors main.go).
+	collectionSearchService := services.NewSearchService(queries, scopedDB)
+	collectionHandler := handlers.NewCollectionHandler(queries, libraryService, connManager, collectionSearchService)
 	filtersHandler := handlers.NewFiltersHandler(queries)
-	dashboardService := services.NewDashboardService(queries)
-	dashboardHandler := handlers.NewDashboardHandler(queries)
+	dashboardService := services.NewDashboardService(queries, collectionSearchService)
+	dashboardHandler := handlers.NewDashboardHandler(queries, collectionSearchService)
 	statisticsService := services.NewStatisticsService(queries)
 	statsHandler := handlers.NewStatsHandler(statisticsService)
 	seriesHandler := handlers.NewSeriesHandler(queries)
@@ -769,11 +793,15 @@ func setupTestServer(t *testing.T) *TestServerSetup {
 	// run's creates die on UNIQUE(user_id, name) — the "collections
 	// 500-panic" rot. System collections are skipped (permanent rows).
 	// Same convention as the library pass: names containing "test".
-	adminColls, cerr := queries.GetCollectionsByUser(ctx, pgtype.UUID{Bytes: adminUUID, Valid: true})
+	// Swept under the OWNER's identity: collections RLS (2026-10-31)
+	// makes unscoped reads return nothing, which would silently turn
+	// this cleanup into a no-op.
+	adminScope := rls.WithUser(ctx, pgtype.UUID{Bytes: adminUUID, Valid: true})
+	adminColls, cerr := queries.GetCollectionsByUser(adminScope, pgtype.UUID{Bytes: adminUUID, Valid: true})
 	if cerr == nil {
 		for _, coll := range adminColls {
 			if !coll.IsSystemCollection.Bool && strings.Contains(strings.ToLower(coll.Name), "test") {
-				queries.DeleteCollection(ctx, coll.ID)
+				queries.DeleteCollection(adminScope, coll.ID)
 			}
 		}
 	}
@@ -847,11 +875,13 @@ func setupTestServer(t *testing.T) *TestServerSetup {
 
 		// Same pass for test-created COLLECTIONS (the "collections
 		// 500-panic" rot: they lingered forever and poisoned later runs).
-		adminColls, cerr := queries.GetCollectionsByUser(ctx, pgtype.UUID{Bytes: adminUUID, Valid: true})
+		// Owner-scoped for the same RLS reason as the setup sweep.
+		adminScope := rls.WithUser(ctx, pgtype.UUID{Bytes: adminUUID, Valid: true})
+		adminColls, cerr := queries.GetCollectionsByUser(adminScope, pgtype.UUID{Bytes: adminUUID, Valid: true})
 		if cerr == nil {
 			for _, coll := range adminColls {
 				if !coll.IsSystemCollection.Bool && strings.Contains(strings.ToLower(coll.Name), "test") {
-					queries.DeleteCollection(ctx, coll.ID)
+					queries.DeleteCollection(adminScope, coll.ID)
 				}
 			}
 		}

database/schema/schema.sql

@@ -48,6 +48,14 @@ ALTER TABLE users ADD COLUMN IF NOT EXISTS default_audio_speed REAL NOT NULL DEF
 -- mid-session. On by default; the profile page's On/Off dropdown owns it.
 ALTER TABLE users ADD COLUMN IF NOT EXISTS keep_screen_awake BOOLEAN NOT NULL DEFAULT TRUE;
 
+-- Audio resume rewind: seconds before the saved position the
+-- audiobook/podcast player starts (on open-resume AND again on every
+-- genuine unpause — the re-orientation gap, never stacked). Strict
+-- allow-list 0/5/10 enforced handler-side; 0 = exact resume. The
+-- profile page's dropdown owns it; the chapters payload carries it to
+-- every client (web + Android, incl. the car path).
+ALTER TABLE users ADD COLUMN IF NOT EXISTS audio_resume_rewind_seconds INT NOT NULL DEFAULT 0;
+
 -- Create system_settings table
 CREATE TABLE IF NOT EXISTS system_settings (
     id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -102,7 +110,9 @@ INSERT INTO system_settings (setting_key, setting_value, description, setting_ty
 ('worker_pool_size', '3', 'Number of background worker goroutines', 'int', '1', '100', TRUE, 'performance'),
 ('worker_queue_cap', '100', 'Background worker job queue capacity', 'int', '1', '10000', TRUE, 'performance'),
 -- podcasts
-('podcast_poll_interval_seconds', '3600', 'How often to poll podcast feeds for new episodes (seconds; complete feeds back off)', 'int', '300', '604800', FALSE, 'podcasts')
+('podcast_poll_interval_seconds', '3600', 'How often to poll podcast feeds for new episodes (seconds; complete feeds back off)', 'int', '300', '604800', FALSE, 'podcasts'),
+('podcast_download_concurrency', '4', 'Podcast episode downloads in flight server-wide (the connection is the limit; fair-share spreads them across feeds)', 'int', '1', '16', FALSE, 'podcasts'),
+('podcast_download_speed_mbps', '0', 'Shared bandwidth cap for podcast downloads in megabits/second (0 = unlimited)', 'float', '0', '10000', FALSE, 'podcasts')
 ON CONFLICT (setting_key) DO NOTHING;
 
 -- Create refresh_tokens table
@@ -1339,7 +1349,9 @@ CREATE TABLE IF NOT EXISTS collections (
     description TEXT,
     color VARCHAR(7),
     icon VARCHAR(50),
-    auto_assign_rules JSONB,
+    -- The unified filter tree (plan item 3.2): when present the qf
+    -- engine drives membership; see FilterTree. NULL = static.
+    filter_tree JSONB,
     view_settings JSONB,
     show_on_dashboard BOOLEAN DEFAULT false,
     query_type TEXT DEFAULT 'filter',
@@ -1355,12 +1367,23 @@ CREATE TABLE IF NOT EXISTS collections (
 -- the row id (and everything referencing it) never churn.
 ALTER TABLE collections ADD COLUMN IF NOT EXISTS deleted_at TIMESTAMPTZ;
 
+-- Legacy rules-array columns RETIRED (2026-10-31): the unified filter
+-- tree is the only smart-membership storage. No production row ever
+-- carried a rules array or a non-default match mode (verified), so the
+-- columns drop clean; the DROPs are the idempotent heal for databases
+-- created before this change.
+ALTER TABLE collections DROP COLUMN IF EXISTS auto_assign_rules;
+ALTER TABLE collections DROP COLUMN IF EXISTS rule_match_mode;
+
+-- Smart collections in the UNIFIED filter engine (plan item 3.2): the
+-- qf tree (same DSL as saved filters, See FilterTree). NULL = static.
+ALTER TABLE collections ADD COLUMN IF NOT EXISTS filter_tree JSONB;
+
 CREATE INDEX IF NOT EXISTS idx_collections_user_id ON collections(user_id);
 
 -- Index for dashboard queries
 CREATE INDEX IF NOT EXISTS idx_collections_dashboard ON collections(user_id, show_on_dashboard, priority)
     WHERE show_on_dashboard = true;
-
 -- Create user_dashboard_preferences table
 CREATE TABLE IF NOT EXISTS user_dashboard_preferences (
     id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -1626,12 +1649,19 @@ CREATE INDEX IF NOT EXISTS idx_dictionary_word ON dictionary_cache(word);
 CREATE TABLE IF NOT EXISTS reader_settings (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  setting_key VARCHAR(50) NOT NULL,
+  setting_key VARCHAR(120) NOT NULL,
   setting_value JSONB NOT NULL,
   updated_at TIMESTAMPTZ DEFAULT NOW(),
   UNIQUE(user_id, setting_key)
 );
 
+-- Key-width headroom (podcast plan §10 R5, item 2.1): the composite
+-- `podcast_order:<uuid>` key sits at exactly 50 chars, and future
+-- per-feed/per-collection preference keys must not be forced to
+-- payload-stuff by a column width. Widening a varchar is metadata-only
+-- (no table rewrite); idempotent on every boot.
+ALTER TABLE reader_settings ALTER COLUMN setting_key TYPE VARCHAR(120);
+
 CREATE INDEX IF NOT EXISTS idx_reader_settings_user ON reader_settings(user_id);
 
 -- PDF bookmarks (custom user bookmarks)
@@ -1989,7 +2019,16 @@ ALTER TABLE media_items
     -- list renders this inline (D8/D19) — never Processing Issues.
     ADD COLUMN IF NOT EXISTS download_state VARCHAR(20) NOT NULL DEFAULT 'pending',
     ADD COLUMN IF NOT EXISTS download_error TEXT,
-    ADD COLUMN IF NOT EXISTS download_attempts INT NOT NULL DEFAULT 0;
+    ADD COLUMN IF NOT EXISTS download_attempts INT NOT NULL DEFAULT 0,
+    -- Monotonic queue ticket (Postgres SEQUENCE nextval at enqueue
+    -- time): the download pool claims in ticket order, so the enqueue
+    -- loop's ordering IS the download order (effective listening order
+    -- — §0 items 4/5). NULL for rows never queued.
+    ADD COLUMN IF NOT EXISTS download_queue_pos BIGINT;
+
+-- Queue ticket source: atomic across concurrent enqueues (per-feed
+-- locks serialize within a feed; the sequence covers across feeds).
+CREATE SEQUENCE IF NOT EXISTS podcast_queue_seq;
 
 -- Identity + ordering + worker-worklist indexes (all partial: scan
 -- rows never touch these columns).
@@ -1999,6 +2038,8 @@ CREATE INDEX IF NOT EXISTS idx_media_items_feed_pos
     ON media_items(source_feed_id, feed_position) WHERE source_feed_id IS NOT NULL;
 CREATE INDEX IF NOT EXISTS idx_media_items_feed_undownloaded
     ON media_items(source_feed_id) WHERE source_feed_id IS NOT NULL AND download_state <> 'downloaded';
+CREATE INDEX IF NOT EXISTS idx_media_items_queue
+    ON media_items(download_queue_pos) WHERE source = 'podcast_episode' AND download_state = 'queued';
 
 
 -- ============================================================
@@ -2141,3 +2182,117 @@ CREATE POLICY p_podcast_feeds_delete ON podcast_feeds
 -- policy's lookup table, and a user must always see their own
 -- subscription rows (subscribe -> visibility is a single INSERT).
 -- ============================================================
+-- ── collections + collection_items (2026-10-31): ownership at the DB ──
+-- layer, same doctrine as media_items/podcast_feeds above. The
+-- predicates live in FUNCTIONS (not inline) so a future sharing model
+-- edits exactly one place: add the share-table EXISTS branch inside
+-- app_can_read_collection / app_can_write_collection. The functions are
+-- PURE over their arguments — they never query collections — so the
+-- policies cannot recurse, FORCE RLS safe. Reads are authenticated-
+-- allow (household-readable: any signed-in identity, SeedIdentity
+-- harness included); WRITES are owner-or-admin — that is the
+-- enforcement of record for Update/Delete/AddBooks, which have no
+-- app-level gate.
+-- ===========================================================
+
+CREATE OR REPLACE FUNCTION app_is_admin() RETURNS BOOLEAN
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path = pg_catalog, public AS $$
+  SELECT EXISTS (
+    SELECT 1 FROM users u
+    WHERE u.id = NULLIF(current_setting('app.user_id', true), '')::uuid
+      AND u.role = 'admin'
+  );
+$$;
+
+CREATE OR REPLACE FUNCTION app_can_read_collection(
+  p_collection_id UUID, p_owner UUID
+) RETURNS BOOLEAN
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path = pg_catalog, public AS $$
+  SELECT NULLIF(current_setting('app.user_id', true), '') IS NOT NULL
+     AND (
+       p_owner = current_setting('app.user_id', true)::uuid
+       OR app_is_admin()
+       -- FUTURE SHARING slot: OR EXISTS (
+       --   SELECT 1 FROM collection_shares cs
+       --   WHERE cs.collection_id = p_collection_id
+       --     AND cs.shared_with_user_id = current_setting('app.user_id', true)::uuid)
+     );
+$$;
+
+CREATE OR REPLACE FUNCTION app_can_write_collection(
+  p_collection_id UUID, p_owner UUID, p_system BOOLEAN
+) RETURNS BOOLEAN
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path = pg_catalog, public AS $$
+  SELECT NULLIF(current_setting('app.user_id', true), '') IS NOT NULL
+     AND (
+       p_owner = current_setting('app.user_id', true)::uuid
+       OR (COALESCE(p_system, false) AND app_is_admin())
+       -- FUTURE SHARING slot: OR EXISTS (
+       --   SELECT 1 FROM collection_shares cs
+       --   WHERE cs.collection_id = p_collection_id
+       --     AND cs.shared_with_user_id = current_setting('app.user_id', true)::uuid
+       --     AND cs.permission IN ('edit'))
+     );
+$$;
+
+ALTER TABLE collections ENABLE ROW LEVEL SECURITY;
+ALTER TABLE collections FORCE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS p_collections_select ON collections;
+CREATE POLICY p_collections_select ON collections
+  FOR SELECT USING (app_can_read_collection(id, user_id));
+DROP POLICY IF EXISTS p_collections_insert ON collections;
+CREATE POLICY p_collections_insert ON collections
+  FOR INSERT WITH CHECK (
+    user_id = NULLIF(current_setting('app.user_id', true), '')::uuid
+    OR app_is_admin()
+  );
+DROP POLICY IF EXISTS p_collections_update ON collections;
+CREATE POLICY p_collections_update ON collections
+  FOR UPDATE
+  USING (app_can_write_collection(id, user_id, is_system_collection))
+  WITH CHECK (app_can_write_collection(id, user_id, is_system_collection));
+DROP POLICY IF EXISTS p_collections_delete ON collections;
+CREATE POLICY p_collections_delete ON collections
+  FOR DELETE USING (app_can_write_collection(id, user_id, is_system_collection));
+
+ALTER TABLE collection_items ENABLE ROW LEVEL SECURITY;
+ALTER TABLE collection_items FORCE ROW LEVEL SECURITY;
+
+-- Items ride their PARENT's accessibility: the collections SELECT
+-- policy auto-applies inside these EXISTS subqueries.
+DROP POLICY IF EXISTS p_collection_items_select ON collection_items;
+CREATE POLICY p_collection_items_select ON collection_items
+  FOR SELECT USING (EXISTS (
+    SELECT 1 FROM collections c
+    WHERE c.id = collection_items.collection_id
+  ));
+DROP POLICY IF EXISTS p_collection_items_insert ON collection_items;
+CREATE POLICY p_collection_items_insert ON collection_items
+  FOR INSERT WITH CHECK (EXISTS (
+    SELECT 1 FROM collections c
+    WHERE c.id = collection_items.collection_id
+      AND app_can_write_collection(c.id, c.user_id, c.is_system_collection)
+  ));
+DROP POLICY IF EXISTS p_collection_items_update ON collection_items;
+CREATE POLICY p_collection_items_update ON collection_items
+  FOR UPDATE
+  USING (EXISTS (
+    SELECT 1 FROM collections c
+    WHERE c.id = collection_items.collection_id
+      AND app_can_write_collection(c.id, c.user_id, c.is_system_collection)
+  ))
+  WITH CHECK (EXISTS (
+    SELECT 1 FROM collections c
+    WHERE c.id = collection_items.collection_id
+      AND app_can_write_collection(c.id, c.user_id, c.is_system_collection)
+  ));
+DROP POLICY IF EXISTS p_collection_items_delete ON collection_items;
+CREATE POLICY p_collection_items_delete ON collection_items
+  FOR DELETE USING (EXISTS (
+    SELECT 1 FROM collections c
+    WHERE c.id = collection_items.collection_id
+      AND app_can_write_collection(c.id, c.user_id, c.is_system_collection)
+  ));
+
+

docs/contract_pins.md

@@ -459,3 +459,281 @@ resolved unscoped map:
 Scan-sourced rows carry the inert defaults ('scan' / NULLs / 'pending');
 raw-row consumers that filter `source='scan'` (scanner paths) are unaffected.
 Nothing removed, nothing renamed.
+
+## 2026-10-30 — download_queue_pos joins media_items (additive widening)
+
+§0 item 4 of podcast-integration.md: the download pool's monotonic
+queue ticket. `download_queue_pos BIGINT` (NULL for scan rows and
+never-queued episodes) is stamped from the `podcast_queue_seq` SEQUENCE
+at enqueue time so claim order = enqueue order (the effective listening
+order). Raw-row pins (TestContractPin_MediaListBothBranches →
+rawRowKeys) whitelist the key. Nothing removed, nothing renamed.
+
+## 2026-10-30 — episode collections (additive widening, plan item 2/2.3/2.4)
+
+Two shapes widen, both ADDITIVE — nothing removed, nothing renamed:
+
+- **Collections envelope** (`GET /api/collections/:id` → envelopeKeys)
+  gains `rule_match_mode` (smart-collection match semantics, 'any'
+  legacy default | 'all'). Static collections emit the default value.
+- **BookInfo** (every card surface → bookInfoKeys) gains four STABLE
+  keys — `is_episode`, `feed_title`, `download_state`, `hidden` — the
+  episode-collections extras. Adapters that predate episode awareness
+  emit their zero values (`false`/`""`), matching the
+  viewer_percentage precedent (nil-representable, key always present).
+
+## 2026-10-30 — collections envelope gains filter_tree (additive widening, item 3.2)
+
+`GET /api/collections/:id` adds `filter_tree` to the envelope: the
+unified filter tree when the smart collection carries one (item 3.2 —
+tree-driven membership), `null` for legacy/static collections. The
+tree is the same qf DSL as saved filters (`{scope?, mode, children}`).
+Nothing removed, nothing renamed.
+
+## 2026-10-30 — rules endpoints RETIRED (filter-system unification, item 3.4)
+
+The per-rule CRUD endpoints and the preview endpoint are DELETED — the
+unified filter tree (item 3.2) is the only smart-membership authoring
+surface, and the rules PAGE is now the filter builder in the
+collection's scope:
+
+- `POST /api/collections/:id/rules`, `PUT/DELETE
+  /api/collections/:id/rules/:ruleId` — gone (legacy rule arrays still
+  EVALUATE until the collection is rewritten; conversions run at the
+  builder's first Apply via RulesToFilterTree).
+- `POST /api/collections/test-rules` — gone (the builder's live count
+  via /api/media-items/filter-count replaces the preview).
+- `POST /api/collections/preview` STAYS (the dashboard
+  custom-section-builder still consumes it — flagged for its own
+  migration, not silently broken).
+- Legacy compatibility KEPT: `auto_assign_rules` still round-trips in
+  the collections envelope; `PUT /api/collections/:id/match-mode`
+  still serves rules-array collections.
+
+Test-side deletions follow the asymmetry rule: subtests exercising the
+deleted endpoints are gone; their surviving SEMANTICS are pinned in
+their tree form (TestSmartCollections rewritten on trees,
+TestEpisodeCollectionsFilterTree, TestPodcastSmartCollections).
+
+## 2026-10-31 — collections RLS: cross-user detail/writes tighten to 404/no-op
+
+`collections` and `collection_items` joined the RLS-governed tables
+(policies `p_collections_*` / `p_collection_items_*`, predicates
+`app_can_read_collection` / `app_can_write_collection` — the same
+doctrine as the media_items family lens, 2026-10-29). Contract
+changes:
+
+- `GET /api/collections/:id` for another user's collection: was 200
+  (by-id readability), now 404 (row invisible).
+- `PUT /api/collections/:id` cross-user: was ungated success (no
+  app-level ownership check), now 404 — the RLS update touches no
+  rows, and the handler maps ErrNoRows to 404.
+- `POST /api/collections/:id/books` cross-user: was ungated, now 404
+  (rejectSmartMutation's GetCollectionData is RLS-invisible).
+- `DELETE /api/collections/:id` cross-user: still 204, but now a true
+  DB-level no-op (zero rows deleted) instead of an app-level free hit.
+- `PUT /api/collections/:id/view-settings` cross-user: 404 (the owner
+  gate stays as defense-in-depth; the DB is enforcement of record).
+- `PUT .../match-mode` and `.../items/order` keep their app-level 403
+  gates; the DB now backs them.
+- Reads: owner or admin (policy escape); non-owner non-admin users see
+  nothing, anonymous included. Future sharing rides the predicate
+  functions — one EXISTS branch in app_can_read/write_collection, no
+  policy migration.
+
+Test-side: TestCollectionsRLS pins the cross-user matrix end-to-end;
+fixture writes to non-system collections run as the row's OWNER
+(scopeExecAs/ownerSeedCtx) because the admin write-escape covers
+system collections only.
+
+## 2026-10-31 — legacy collection rules surface RETIRED (tree-only storage)
+
+The pre-tree rules machinery is gone — no production row ever carried a
+rules array or a non-default match mode (verified in the dev DB), the
+web never reads the envelope keys, and the Android app consumes none of
+it. Deletions:
+
+- `PUT /api/collections/:id/match-mode` — endpoint retired (it had no
+  doc page). The tree's root `mode` owns any|all semantics now.
+- Envelope: `auto_assign_rules` and `rule_match_mode` are REMOVED from
+  the create/list/detail/update payloads. This entry retracts the
+  2026-10-30 pins that listed them. `collection_type` and `is_smart`
+  stay.
+- Request: `auto_assign_rules`/`rule_match_mode` are no longer accepted
+  on create/update. A create carrying `auto_assign_rules` answers 400
+  naming the retirement — the custom-section builder's legacy save
+  (already failing to bind, verified live) fails loudly instead of
+  silently creating a hollow static section.
+- Storage: the `collections.auto_assign_rules` and
+  `collections.rule_match_mode` columns are DROPPED (idempotent
+  `DROP COLUMN IF EXISTS` in schema.sql).
+- Service: the rules CRUD layer (AddRule/SetRuleEnabled/RemoveRule +
+  validateRule + the UpdateCollectionRulesJSON query),
+  ParseRules/EnabledRules/IsSmartCollection, RulesToFilterTree (+ the
+  SSR preload branch), and the legacy branch of EvaluateSmartMembership
+  are deleted. IsCollectionSmart = tree presence.
+
+KEPT (live consumers): `POST /api/collections/preview` still accepts
+`rules` and evaluates them in memory (the custom-section builder's
+preview button); `include_auto` on the list stays (the Android app
+sends it). The builder's SAVE remains the flagged §12 tree migration.
+
+## 2026-10-31 — custom-section builder save: the flagged tree migration lands
+
+Supersedes the same-day retirement entry's loud-400 stance for the
+builder's payload. `POST /api/collections` now ACCEPTS the builder's
+shape and adapts it at write time:
+
+- `auto_assign_rules` (JSON-encoded array — string or bare) converts to
+  a filter tree via the restored `RulesToFilterTree`; converted trees
+  validate under `ParseFilterTree`, so an unhonorable rule is a 400 at
+  write naming the problem.
+- `match_type` seeds the tree's root mode (`any` default).
+- `manual_book_ids` attach to the created collection after create
+  (unparsable ids skipped — the AddBooks leniency).
+- `show_on_dashboard` persists (new create field).
+- `library_id` remains selection context only (not stored).
+
+Dashboard sections: smart user sections evaluate their tree LIVE —
+`GetUserCollectionItems` merges stored membership with the composed
+engine's matches (deduped, library-scoped, capped at the section
+limit). This exposed and fixed a real wiring bug: every production
+`NewDashboardService` call omitted the search service, so tree
+evaluation through the dashboard could never work (the test harness
+wired it correctly — the gap was production-only). The dashboard
+handler and both inline sites now receive it, and evaluation failures
+log instead of silently emptying a section.
+
+## 2026-11-01 — feed operator vocabulary collapsed (Option A): one name per semantic
+
+The feed field's menu offered `is`/`isn't` alongside `in`/`isn't in` —
+exact synonyms (the clause compiles both pairs to the same `ANY`). The
+MENUS now offer `in`/`isn't in` (+ has/missing) only. This is an
+offered-vocabulary narrowing, not a parse change:
+
+- Stored trees and saved filters carrying `feed is X` / `feed is_not X`
+  PARSE AND EVALUATE FOREVER (`legacyFieldOps` accepts the synonyms at
+  validation — the stored wire is never invalidated).
+- The fields payload (the client's operator menus) no longer carries
+  the duplicates.
+- Client id-cells are uniform: every operator on an id-valued field
+  accepts a set, so all id cells say "pick one or more" and accumulate
+  picks — no per-operator placeholder/pick distinction to explain.
+
+## 2026-11-01 — id labels resolve at render (SSR embed): refresh keeps names
+
+Pages that render a filter tree embed the tree's id→name map at render
+time (`data-id-labels` on the builder mount) — the collection editor
+(stored tree) and the bookshelf (URL `qf`). Before this, refresh showed
+raw uuids: only ids persist in trees; the client's id→label cache dies
+with the page, and the quiet suggest fetch reused the MEDIA-CONSTRAINED
+facet, so an id whose media doesn't match the tree's sibling rules got
+no row and no label (live repro: `feed in [A,B,C] AND title contains
+Chapter` labeled one feed of three — two feeds had no "Chapter"
+episodes).
+
+- `SearchService.FilterTreeLabels` reads the ENTITY tables (no media
+  join, no tree constraint): podcast_feeds and collections are
+  RLS-governed through the scoped handle (invisible ids resolve to
+  nothing); libraries mirror the facet's visibility join; added_by is a
+  plain username lookup. A zero-episode feed resolves its title —
+  pinned (TestRulesPageEmbedsIdLabels), as is the hidden-library
+  non-resolution.
+- The bookshelf drawer also HYDRATES at component init now (no
+  data-tree mount → read the form): the parent's x-init
+  (initBookshelf) runs BEFORE the nested builder component exists
+  (Alpine initializes parents first), so its builderData() call was
+  null and a URL-qf refresh left the drawer with an empty seeded rule
+  while the grid stayed filtered. Init-order contract pinned in
+  filter_builder.test.ts.
+- The quiet suggest fetch remains only as a fallback for trees the SSR
+  never saw (client-side apply flows); embedded labels make it a no-op
+  on refresh.
+
+## 2026-11-01 — unset podcast order defaults to reversed (audiobook-first)
+
+The per-feed listening order (the D5 `podcast_order:<feedID>` KV shown
+in the Order dropdown) resolved its UNSET state to "native" — feed
+document order, which runs newest-first for classic RSS, so an
+audiobook feed played its LAST chapter first. The unset default is now
+`reverse` at every resolution site of that one setting: the podcast
+page list + dropdown (`podcastOrderForFeed`), the player's feed chain
+(reader.go), and the download worker (`orderOverrideFor`).
+
+- Stored overrides are untouched: anyone who picked an order keeps it
+  (native remains a valid, savable choice).
+- No ordering semantics changed — `OrderEpisodes` and the four-option
+  vocabulary are as they were; only the unset fallback flipped.
+- Pinned: the player sequence config carries `"order":"reverse"` and
+  feed position 1 plays LAST for an unset feed; the podcast page's
+  dropdown renders `reverse` selected (TestPodcastPlayerOrderControl,
+  replacing the former native pin).
+
+## 2026-11-01 — new podcast smart collections are BORN reversed
+
+`POST /api/collections` with an EPISODES-scope `filter_tree` seeds
+`view_settings.chain_order = "reverse"` on the new row (merge semantics:
+an explicit client `chain_order` is never clobbered). The dropdown's
+default selection and the chain/page behavior come from the STORED
+value — no resolution-logic changes; books-scope smart collections and
+statics get nothing seeded; existing collections are untouched.
+
+Pinned (TestSmartCollectionBornReversed): episodes seed, explicit-keep,
+books-scope no-seed, static no-seed; TestEpisodeCollectionsFilterTree's
+born-reversed chain/page pins replace the former native expectations
+(which changelog here per the expectation-change rule). One misplaced
+pin from 81e54f89 was corrected while flipping: the API envelope's
+match list is NOT chain-ordered and never was — order pins live on the
+SSR page and the reader chain.
+
+## 2026-11-01 — label endpoint replaces the suggest-facet fallback
+
+`GET /api/filter/labels?field=X&ids=a,b,c` names id-kind filter values
+from their source tables (entity rows only — no media join, no tree
+constraint; visibility/RLS ride the request identity). Non-id fields
+are a 400; ids truncate at the same 100 cap the SSR embed uses.
+
+The client's label resolution (`resolveIdLabels`/`resolveLabelsAsync`)
+now uses ONLY this endpoint. The former fallback — the quiet suggest
+fetch through the MEDIA-CONSTRAINED facet — is deleted: it labeled only
+the ids whose media matched the tree's sibling rules (the live feed
+repro), which mattered exactly where the SSR embed can't reach:
+applying a SAVED filter from a cold bookshelf. The apply flow now
+resolves through the endpoint and rebuilds the chips bar when labels
+land. Pinned (TestFilterLabelsEndpoint): a zero-episode feed resolves
+its title, comma-joined ids resolve together, an unsubscribed feed id
+stays unnamed (RLS), non-id fields are 400.
+
+## 2026-11-01 — the rules-Apply path seeds the reversed default too
+
+PUT /api/collections/:id carrying an EPISODES-scope filter_tree seeds
+`chain_order = "reverse"` when neither the request nor the stored
+view_settings names one — the creation seed's twin: a static collection
+becoming smart lands with the same default a born-smart one gets.
+Explicit values (client-sent or stored — e.g. a deliberate native)
+are never clobbered. Pinned (TestSmartCollectionBornReversed):
+apply-seeds-when-unordered, respects stored native, respects client
+native.
+
+TestPodcastSmartCollections' acceptance pin updated with the same flip:
+the briefing acceptance now starts from the page's FIRST card (feed
+position 5 — the born-reversed default's book order) and chains into
+feed position 1. The acceptance meaning is unchanged: play from what
+you see, chained back-to-back within the live briefing set.
+
+## 2026-11-01 — audio resume rewind setting
+
+- `GET /api/media-items/:id/chapters` gained one ADDITIVE response key:
+  `resume_rewind_seconds` (int, the requesting user's setting; 0 for
+  anonymous). Existing keys unchanged. The web player and the Android
+  app both gate the value through the 0/5/10 allow-list, so servers
+  without the key (absent → 0) degrade to exact resume.
+- `GET /api/auth/profile` now always carries
+  `audio_resume_rewind_seconds` (int, never omitted — 0 is a real
+  value, exact resume). `PUT /api/auth/profile` accepts the key as the
+  keep_screen_awake-style STRING ("0"/"5"/"10") so the profile form's
+  select can send an explicit Off; JSON clients that omit it leave the
+  column untouched, and anything outside {0,5,10} is 400.
+  Pinned (TestAudioResumeRewind): default 0, PUT "5" rides the
+  chapters payload, non-allow-listed rejections change nothing,
+  explicit "0" resets everywhere, omitted key leaves it untouched.

docs/developer/api/collections/add_auto_assign_rule.md

@@ -1,89 +0,0 @@
----
-method: POST
-path: /api/collections/:id/rules
-auth: jwt
-area: collections
----
-<!-- source: internal/handlers/collections.go:877 CollectionHandler.AddRule -->
-
-# Add Auto-Assign Rule
-
-Add an automatic book assignment rule to a collection.
-
-**Endpoint**: `POST /api/collections/{id}/rules`
-**Auth**: Required
-**Content-Type**: `application/json`
-
-## Path Parameters
-
-| Parameter | Type          | Required | Description     |
-| --------- | ------------- | -------- | --------------- |
-| id        | string (UUID) | Yes      | Collection UUID |
-
-## Request Body
-
-| Field    | Type          | Required | Description                                                                                                       |
-| -------- | ------------- | -------- | ----------------------------------------------------------------------------------------------------------------- |
-| field    | string        | Yes      | Field to match on (genre, author, series, language, publisher, copyright_year, tags)                              |
-| operator | string        | Yes      | Comparison operator (equals, not_equals, contains, not_contains, starts_with, ends_with, greater_than, less_than) |
-| value    | string/number | Yes      | Value to compare against                                                                                          |
-| priority | integer       | No       | Rule priority (1 = highest, default: 1)                                                                           |
-| enabled  | boolean       | No       | Whether rule is active (default: true)                                                                            |
-
-### Supported Fields
-
-| Field          | Type   | Description                           |
-| -------------- | ------ | ------------------------------------- |
-| genre          | string | Book genre                            |
-| author         | string | Book author                           |
-| series         | string | Book series name                      |
-| language       | string | Book language                         |
-| publisher      | string | Publisher name                        |
-| copyright_year | number | Publication year (numeric comparison) |
-| tags           | string | Book tags                             |
-
-### Supported Operators
-
-| Operator     | Type   | Description                           |
-| ------------ | ------ | ------------------------------------- |
-| equals       | all    | Exact match                           |
-| not_equals   | all    | Not equal                             |
-| contains     | string | Contains substring (case-insensitive) |
-| not_contains | string | Does not contain                      |
-| starts_with  | string | Starts with (case-insensitive)        |
-| ends_with    | string | Ends with (case-insensitive)          |
-| greater_than | number | Greater than                          |
-| less_than    | number | Less than                             |
-
-### Example Request
-
-```json example-request
-{
-  "field": "genre",
-  "operator": "equals",
-  "value": "Science Fiction",
-  "priority": 1,
-  "enabled": true
-}
-```
-
-## Response (201 Created)
-
-```json example-response
-{
-  "collection_id": null,
-  "is_smart": null,
-  "rule": null
-}
-```
-
-## Error Responses
-
-| Code | Description                         |
-| ---- | ----------------------------------- |
-| 400  | Invalid request (validation failed) |
-| 401  | Authentication required             |
-| 404  | Collection not found                |
-| 500  | Internal server error               |
-
-## Try It Out

docs/developer/api/collections/create_collection.md

@@ -23,7 +23,6 @@ Creating a collection whose name already exists for the user returns **409**.
   "color": "#00FF00",
   "icon": "📖",
   "collection_type": "static",
-  "auto_assign_rules": [],
   "view_settings": { "kobo": { "view_mode": "grid" } }
 }
 ```
@@ -39,7 +38,6 @@ Creating a collection whose name already exists for the user returns **409**.
   "color": "#00FF00",
   "icon": "📖",
   "collection_type": "static",
-  "auto_assign_rules": null,
   "view_settings": { "kobo": { "view_mode": "grid" } },
   "book_count": 0,
   "created_at": "2026-10-24 13:57:01.81234 +0000 UTC"
@@ -57,20 +55,13 @@ RFC3339. Treat it as display text; do not parse it as an ISO timestamp.
 | description | string | no | |
 | color | string | no | hex color, e.g. `"#FF5733"` |
 | icon | string | no | emoji |
-| collection_type | string | no | `"static"` (default) or `"smart"`; also implied by non-empty `auto_assign_rules` |
-| auto_assign_rules | array | no | rule objects, see below |
+| collection_type | string | no | `"static"` (default) or `"smart"`; also implied by a `filter_tree` |
 | view_settings | object | no | per-device display preferences |
-
-### Auto-assign rule object
-
-| Field | Type | Required | Notes |
-| ----- | ---- | -------- | ----- |
-| id | string | no | rule id |
-| field | string | yes | one of `genre`, `series`, `author`, `language`, `publisher`, `copyright_year`, `tags` |
-| operator | string | yes | one of `equals`, `not_equals`, `contains`, `not_contains`, `starts_with`, `ends_with`, `greater_than`, `less_than` |
-| value | string | yes | value to compare against |
-| priority | number | no | 1-10; higher values take precedence |
-| enabled | boolean | no | absent = enabled (rules written before this field existed keep matching) |
+| filter_tree | object | no | the unified filter tree (qf DSL); presence makes the collection smart |
+| auto_assign_rules | string \| array | no | custom-section-builder payload — converted to `filter_tree` at write (see custom-section-builder doc) |
+| match_type | string | no | builder payload: `any` (default) or `all` — seeds the converted tree's root mode |
+| manual_book_ids | string\[\] | no | builder payload: attached to the collection after create |
+| show_on_dashboard | boolean | no | pins the collection as a dashboard section |
 
 ## Errors
 

docs/developer/api/collections/get_collection.md

@@ -27,7 +27,6 @@ GET /api/collections/550e8400-e29b-41d4-a716-446655440000
   "description": "Books I want to read soon",
   "color": "#00FF00",
   "icon": "📖",
-  "auto_assign_rules": null,
   "view_settings": { "kobo": { "view_mode": "grid" } },
   "books": [],
   "book_count": 0,
@@ -57,8 +56,8 @@ GET /api/collections/550e8400-e29b-41d4-a716-446655440000
 | description | string | |
 | color | string | |
 | icon | string | |
-| auto_assign_rules | array \| null | |
 | view_settings | object | |
+| filter_tree | object \| null | the unified filter tree (qf DSL); null = static |
 | books | array | book cards in this collection |
 | book_count | number | length of `books` |
 | is_smart | boolean | |

docs/developer/api/collections/list_collections.md

@@ -29,7 +29,6 @@ GET /api/collections?include_auto=true&sort_by=name
       "description": "Books I want to read soon",
       "color": "#00FF00",
       "icon": "📖",
-      "auto_assign_rules": null,
       "created_at": "2026-10-24 13:57:01.81234 +0000 UTC",
       "book_count": 12,
       "is_smart": false
@@ -65,7 +64,6 @@ GET /api/collections?include_auto=true&sort_by=name
 | description | string | |
 | color | string | |
 | icon | string | |
-| auto_assign_rules | array \| null | raw rules JSON; non-null implies smart |
 | created_at | string | Go `time.String()` format |
 | book_count | number | live count; respects `library_id` for smart collections |
 | is_smart | boolean | |

docs/developer/api/collections/remove_auto_assign_rule.md

@@ -1,46 +0,0 @@
----
-method: DELETE
-path: /api/collections/:id/rules/:ruleId
-auth: jwt
-area: collections
----
-<!-- source: internal/handlers/collections.go:960 CollectionHandler.RemoveRule -->
-
-# Remove Auto-Assign Rule
-
-Remove an automatic book assignment rule from a collection.
-
-**Endpoint**: `DELETE /api/collections/{collectionId}/rules/{ruleId}`
-**Auth**: Required
-**Content-Type**: `application/json`
-
-## Path Parameters
-
-| Parameter    | Type          | Required | Description     |
-| ------------ | ------------- | -------- | --------------- |
-| collectionId | string (UUID) | Yes      | Collection UUID |
-| ruleId       | string (UUID) | Yes      | Rule UUID       |
-
-## Response (204 No Content)
-
-Rule deleted successfully. No response body.
-
-```json example-response
-{
-  "collection_id": "550e8400-e29b-41d4-a716-446655440000",
-  "is_smart": true
-}
-```
-
-`is_smart` reflects the collection state AFTER removal — removing the
-last rule converts a smart collection back to static.
-
-## Error Responses
-
-| Code | Description                  |
-| ---- | ---------------------------- |
-| 401  | Authentication required      |
-| 404  | Collection or rule not found |
-| 500  | Internal server error        |
-
-## Try It Out

docs/developer/api/collections/set_chain_order.md

@@ -0,0 +1,48 @@
+---
+method: PUT
+path: /api/collections/:id/view-settings
+auth: jwt
+area: collections
+---
+<!-- source: internal/handlers/collections.go CollectionHandler.SetCollectionChainOrder -->
+
+# Set Collection Chain Order
+
+Sets the curated listening order for the collection's episode sequence
+(plan §10 R2): the chain producer (`buildSmartCollectionSequenceContext`)
+plays `Play as Sequence` in this order. The key merges into the
+collection's `view_settings` JSONB — playlist toggles that share the
+document survive the write. Owner-only.
+
+## Example request
+
+```json example-request
+{
+  "chain_order": "newest"
+}
+```
+
+## Example response
+
+```json example-response
+{
+  "id": "550e8400-e29b-41d4-a716-446655440000",
+  "chain_order": "newest",
+  "view_settings": { "chain_order": "newest" }
+}
+```
+
+## Fields
+
+| Field | Type | Required | Notes |
+| ----- | ---- | -------- | ----- |
+| chain_order | string | Yes | One of `native`, `newest`, `oldest`, `reverse`; `native`/empty removes the stored key |
+
+## Errors
+
+| Status | Body | When |
+| ------ | ---- | ---- |
+| 400 | `{"error": "invalid collection id"}` | malformed id |
+| 400 | `{"error": "chain_order must be one of: native, newest, oldest, reverse"}` | unknown order |
+| 404 | `{"error": "collection not found"}` | unknown id |
+| 401 / 403 | — | missing JWT / not the owner |

docs/developer/api/collections/test_rule.md

@@ -1,79 +0,0 @@
----
-method: POST
-path: /api/collections/test-rules
-auth: jwt
-area: collections
----
-<!-- source: internal/handlers/collections.go:996 CollectionHandler.TestRules -->
-
-# Test Rule
-
-Test which books would match given rules without saving.
-
-**Endpoint**: `POST /api/collections/test-rules`
-**Auth**: Required
-**Content-Type**: `application/json`
-
-## Request Body
-
-| Field | Type  | Required | Description                   |
-| ----- | ----- | -------- | ----------------------------- |
-| rules | array | Yes      | Array of rule objects to test |
-
-### Rule Object
-
-| Field    | Type          | Required | Description                                                                                                       |
-| -------- | ------------- | -------- | ----------------------------------------------------------------------------------------------------------------- |
-| field    | string        | Yes      | Field to match on (genre, author, series, language, publisher, copyright_year, tags)                              |
-| operator | string        | Yes      | Comparison operator (equals, not_equals, contains, not_contains, starts_with, ends_with, greater_than, less_than) |
-| value    | string/number | Yes      | Value to compare against                                                                                          |
-
-### Example Request
-
-```json example-request
-{
-  "rules": [
-    {
-      "field": "genre",
-      "operator": "equals",
-      "value": "Science Fiction"
-    },
-    {
-      "field": "author",
-      "operator": "contains",
-      "value": "Asimov"
-    }
-  ]
-}
-```
-
-## Response (200 OK)
-
-```json example-response
-{
-  "matches": [
-    {
-      "media_item_id": "660e8400-e29b-41d4-a716-446655440000",
-      "title": "Foundation",
-      "author": "Isaac Asimov",
-      "cover_image_path": "/covers/foundation.jpg",
-      "match_reason": "Matched rule: genre equals Science Fiction"
-    }
-  ],
-  "total": 42
-}
-```
-
-## Use Case
-
-Test rules before creating a collection to verify correct book matching. This endpoint shows which books would be added without actually modifying any collections.
-
-## Error Responses
-
-| Code | Description                         |
-| ---- | ----------------------------------- |
-| 400  | Invalid request (validation failed) |
-| 401  | Authentication required             |
-| 500  | Internal server error               |
-
-## Try It Out

docs/developer/api/collections/update_collection.md

@@ -24,7 +24,6 @@ set `view_settings.hide_finished` / `view_settings.show_up_next` directly.
   "description": "Updated description",
   "color": "#33CCFF",
   "icon": "📚",
-  "auto_assign_rules": [],
   "view_settings": { "hide_finished": true },
   "hide_finished": ["true"],
   "show_up_next": ["true"]
@@ -41,7 +40,6 @@ set `view_settings.hide_finished` / `view_settings.show_up_next` directly.
   "description": "Updated description",
   "color": "#33CCFF",
   "icon": "📚",
-  "auto_assign_rules": null,
   "view_settings": { "hide_finished": true, "show_up_next": true },
   "created_at": "2026-10-24 13:57:01.81234 +0000 UTC"
 }
@@ -57,8 +55,8 @@ set `view_settings.hide_finished` / `view_settings.show_up_next` directly.
 | description | string | no | |
 | color | string | no | |
 | icon | string | no | |
-| auto_assign_rules | array | no | replaces the whole rule set (rule object shape: see Create Collection) |
 | view_settings | object | no | merged into stored settings |
+| filter_tree | object | no | replaces the stored filter tree (omitting it keeps the stored one) |
 | hide_finished | array | no | single-element string array `["true"]`/`["false"]`; merged into view_settings |
 | show_up_next | array | no | same shape as `hide_finished` |
 

docs/developer/api/collections/update_rule.md

@@ -1,45 +0,0 @@
----
-method: PUT
-path: /api/collections/:id/rules/:ruleId
-auth: jwt
-area: collections
----
-<!-- source: internal/handlers/collections.go:922 CollectionHandler.UpdateRule (SetRuleEnabled) -->
-
-# Update Collection Rule
-
-Despite the route name, this endpoint **toggles a rule's enabled state only**.
-It does not update the rule's field/operator/value — rules are replaced wholesale
-via [Create Collection](create_collection.md) (`auto_assign_rules`) or added via
-the rules endpoint.
-
-## Example request
-
-```json example-request
-{
-  "enabled": false
-}
-```
-
-## Example response
-
-```json example-response
-{
-  "collection_id": "550e8400-e29b-41d4-a716-446655440000",
-  "is_smart": true
-}
-```
-
-## Request fields
-
-| Field | Type | Required | Notes |
-| ----- | ---- | -------- | ----- |
-| enabled | boolean | yes | toggles the rule on/off |
-
-## Errors
-
-| Status | Body | When |
-| ------ | ---- | ---- |
-| 400 | `{"error": "invalid collection id"}` / `{"error": "rule id required"}` / `{"error": "invalid request"}` | malformed |
-| 404 | `{"error": "rule not found"}` | no such rule |
-| 500 | `{"error": "..."}` | unexpected server error |

docs/developer/api/custom-section-builder.md

@@ -68,6 +68,15 @@ Creates a new custom collection with filter rules and/or manual book selection.
 
 **Request Body:**
 
+**Save contract (2026-10-31 tree migration):** the rules array travels
+as a JSON-encoded string and the server converts it to a filter tree at
+write time — `match_type` seeds the tree's root mode (`any` default),
+`manual_book_ids` attach to the created collection, and
+`show_on_dashboard` persists. `library_id` is selection context only
+(sections scope to the dashboard's active library at render). Invalid
+rules are a 400 at write naming the problem; the section renders stored
+picks + the tree's live matches, deduped.
+
 ```json
 {
   "name": "My Custom Section",

docs/developer/api/libraries/add_library_folder.md

@@ -41,7 +41,8 @@ Add a folder to an existing library (Admin only).
   "id": "uuid",
   "library_id": "uuid",
   "folder_path": "/path/to/comics",
-  "created_at": "2026-01-31T10:00:00Z"
+  "created_at": "2026-01-31T10:00:00Z",
+  "purpose": "scan"
 }
 ```
 

docs/developer/api/libraries/create_library.md

@@ -42,7 +42,8 @@ Create a new library (Admin only).
   "created_at": "2026-01-31T10:00:00Z",
   "created_by_admin_id": null,
   "library_type_id": null,
-  "updated_at": null
+  "updated_at": null,
+  "allow_member_feeds": false
 }
 ```
 

docs/developer/api/libraries/get_library.md

@@ -43,7 +43,8 @@ Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
   "created_at": null,
   "created_by_admin_id": null,
   "library_type_id": null,
-  "updated_at": null
+  "updated_at": null,
+  "allow_member_feeds": false
 }
 ```
 

docs/developer/api/libraries/get_library_folders.md

@@ -18,7 +18,8 @@ Lists the filesystem folders configured for a library.
     "id": "aa0e8400-e29b-41d4-a716-446655440000",
     "library_id": "990e8400-e29b-41d4-a716-446655440000",
     "folder_path": "/books/manga",
-    "created_at": "2026-01-01T00:00:00Z"
+    "created_at": "2026-01-01T00:00:00Z",
+    "purpose": "scan"
   }
 ]
 ```

docs/developer/api/libraries/get_visible_libraries.md

@@ -42,7 +42,8 @@ A top-level JSON **array** of library rows:
     "updated_at": "2026-01-31T10:00:00Z",
     "type_name": "ebooks",
     "type_description": "Ebook libraries",
-    "is_visible": true
+    "is_visible": true,
+    "allow_member_feeds": false
   }
 ]
 ```

docs/developer/api/libraries/update_library.md

@@ -46,7 +46,8 @@ Update a library's information.
   "created_at": "2026-02-08T10:00:00Z",
   "updated_at": "2026-02-08T11:00:00Z",
   "created_by_admin_id": null,
-  "description": null
+  "description": null,
+  "allow_member_feeds": false
 }
 ```
 

docs/developer/api/media-items/create_media_item.md

@@ -164,7 +164,23 @@ Tags and contributors are automatically normalized:
   "summary": null,
   "total_characters": null,
   "volume": null,
-  "web_url": null
+  "web_url": null,
+  "source": null,
+  "source_feed_id": null,
+  "feed_position": null,
+  "episode_number": null,
+  "season_number": null,
+  "episode_guid": null,
+  "enclosure_url": null,
+  "chapters_url": null,
+  "transcript_url": null,
+  "hosts": null,
+  "guests": null,
+  "declared_duration_seconds": null,
+  "download_state": null,
+  "download_attempts": null,
+  "download_queue_pos": null,
+  "download_error": null
 }
 ```
 

docs/developer/api/media-items/search_media_items.md

@@ -231,7 +231,23 @@ Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
     "total_characters": null,
     "updated_at": null,
     "volume": null,
-    "web_url": null
+    "web_url": null,
+    "source": null,
+    "source_feed_id": null,
+    "feed_position": null,
+    "episode_number": null,
+    "season_number": null,
+    "episode_guid": null,
+    "enclosure_url": null,
+    "chapters_url": null,
+    "transcript_url": null,
+    "hosts": null,
+    "guests": null,
+    "declared_duration_seconds": null,
+    "download_state": null,
+    "download_attempts": null,
+    "download_queue_pos": null,
+    "download_error": null
   }
 ]
 ```

docs/developer/api/media-items/update_media_item.md

@@ -128,7 +128,23 @@ Update media item metadata (Admin only).
   "tags_search": null,
   "total_characters": null,
   "volume": null,
-  "web_url": null
+  "web_url": null,
+  "source": null,
+  "source_feed_id": null,
+  "feed_position": null,
+  "episode_number": null,
+  "season_number": null,
+  "episode_guid": null,
+  "enclosure_url": null,
+  "chapters_url": null,
+  "transcript_url": null,
+  "hosts": null,
+  "guests": null,
+  "declared_duration_seconds": null,
+  "download_state": null,
+  "download_attempts": null,
+  "download_queue_pos": null,
+  "download_error": null
 }
 ```
 

docs/developer/api/users/get_profile.md

@@ -36,6 +36,8 @@ Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
   "first_name": "John",
   "last_name": "Doe",
   "role": "user",
+  "default_audio_speed": 1.5,
+  "audio_resume_rewind_seconds": 5,
   "keep_screen_awake": true
 }
 ```

docs/developer/openapi.yaml

@@ -229,7 +229,6 @@ paths:
                 "color": "#00FF00",
                 "icon": "📖",
                 "collection_type": "static",
-                "auto_assign_rules": [],
                 "view_settings": { "kobo": { "view_mode": "grid" } }
               }
       responses:
@@ -277,33 +276,6 @@ paths:
       responses:
         '200':
           description: Success
-  "/api/collections/test-rules":
-    post:
-      tags: [collections]
-      summary: "Test Rule"
-      security:
-        - bearerAuth: []
-      requestBody:
-        content:
-          application/json:
-            example: |-
-              {
-                "rules": [
-                  {
-                    "field": "genre",
-                    "operator": "equals",
-                    "value": "Science Fiction"
-                  },
-                  {
-                    "field": "author",
-                    "operator": "contains",
-                    "value": "Asimov"
-                  }
-                ]
-              }
-      responses:
-        '200':
-          description: OK
   "/api/collections/{id}":
     delete:
       tags: [collections]
@@ -335,7 +307,6 @@ paths:
                 "description": "Updated description",
                 "color": "#33CCFF",
                 "icon": "📚",
-                "auto_assign_rules": [],
                 "view_settings": { "hide_finished": true },
                 "hide_finished": ["true"],
                 "show_up_next": ["true"]
@@ -409,38 +380,10 @@ paths:
       responses:
         '200':
           description: Success
-  "/api/collections/{id}/rules":
-    post:
-      tags: [collections]
-      summary: "Add Auto-Assign Rule"
-      security:
-        - bearerAuth: []
-      requestBody:
-        content:
-          application/json:
-            example: |-
-              {
-                "field": "genre",
-                "operator": "equals",
-                "value": "Science Fiction",
-                "priority": 1,
-                "enabled": true
-              }
-      responses:
-        '201':
-          description: Created
-  "/api/collections/{id}/rules/{ruleId}":
-    delete:
-      tags: [collections]
-      summary: "Remove Auto-Assign Rule"
-      security:
-        - bearerAuth: []
-      responses:
-        '204':
-          description: No Content
+  "/api/collections/{id}/view-settings":
     put:
       tags: [collections]
-      summary: "Update Collection Rule"
+      summary: "Set Collection Chain Order"
       security:
         - bearerAuth: []
       requestBody:
@@ -448,11 +391,11 @@ paths:
           application/json:
             example: |-
               {
-                "enabled": false
+                "chain_order": "newest"
               }
       responses:
         '200':
-          description: Success
+          description: OK
   "/api/conflicts":
     get:
       tags: [conflicts]

docs/index.md

@@ -17,6 +17,11 @@ Complete guide to Bookhoard documentation. Find what you need quickly.
 - **Sync Configuration**
   - [Universal Sync Guide](user/sync-guide.md) - Understanding sync, book matching, conflicts
 
+- **Filters**
+  - [Filters — the complete guide](user/filters/index.md) - rules, groups (ALL/ANY), saved filters, smart collections
+  - [Filter cookbook](user/filters/cookbook.md) - ready-made recipes, exact clicks
+  - [Every filter field](user/filters/fields.md) - the generated, always-current reference
+
 - **Frontend & Settings** (Coming Soon)
   - Frontend Guide
   - User Areas Guide

docs/user/filters/cookbook.md

@@ -0,0 +1,78 @@
+# Filter cookbook
+
+Real questions, exact clicks. Every recipe uses the same builder described in
+[the guide](index.md) — same fields, same rules, wherever filters live.
+
+Recipes marked **collection** become smart collections that stay current forever; the rest are
+drawer filters you can save with a name.
+
+---
+
+## "New chapters of 7th Son, automatically" — collection
+
+1. **Collections** → open (or create) a collection → **Rules**.
+2. The scope is already *Episodes*. Add a rule: **Feed** → **in** → pick
+   *7th Son: Book One* (it becomes a chip — hit the × if you pick wrong).
+3. Add a second rule: **Title** → **contains** → `Chapter`.
+4. The header should read **MATCH ALL** (it does by default — every rule must match).
+5. **Apply to Collection**. Done: new chapters appear on their own, and the listening order
+   starts at **Feed order (reversed)** — chapter 1 first.
+
+---
+
+## "Lewis Carroll or George Orwell" — drawer
+
+1. **Filters** on the All Books page. Add: **Author** → **contains** → `Carroll`.
+2. Add a second rule: **Author** → **contains** → `Orwell`.
+3. Click the group header **MATCH ALL** once — it flips to **MATCH ANY** (or click the `AND`
+   chip between the two rules, same effect).
+4. **Apply Filters**. Either author is enough.
+
+*Flip it back to ALL and you'd get only books they both wrote — which is none, and the counter
+will tell you so before you apply.*
+
+---
+
+## "Long fantasy books I haven't started" — drawer
+
+1. **Genre** → **is** → `fantasy`.
+2. **Page count** → **at least** → `400`.
+3. **My reading** → **Reading status** → **is** → *Unfinished* (or your app's wording — the
+   status list is the fixed dropdown on that field).
+4. **MATCH ALL** stays on: all three must hold.
+5. Apply — then **Save** it as *"Big unread fantasy"* and it's in the Load menu forever.
+
+---
+
+## "Downloaded podcast episodes I haven't played" — collection
+
+1. A collection with an Episodes scope (see the first recipe — drop the Title rule if you want
+   whole feeds).
+2. **Downloaded** → **is true**.
+3. **Played** → **is false**.
+4. **MATCH ALL** on. **Apply to Collection**.
+
+---
+
+## "Added to my library this month" — drawer
+
+1. **Date added** → **within the last** → `30` (the days box — the field's page in
+   [Every filter field](fields.md) has its exact questions).
+2. Optionally **MATCH ALL** with **Library** → **in** → your audiobooks library.
+3. Save as *"New arrivals"*.
+
+---
+
+## "A dashboard shelf that builds itself" — dashboard
+
+1. Create a collection with the rules above (or open one).
+2. On the dashboard, add a section pointed at that collection.
+3. The shelf re-fills itself as your library changes — no maintenance.
+
+---
+
+## Sharing a filtered view
+
+Apply any filter, then copy the address bar. The filter rides in the URL — send it to another
+user of your server and they open the same narrowed view (they see it through their own
+libraries, not yours).

docs/user/filters/fields.md

@@ -0,0 +1,755 @@
+<!-- GENERATED by TestFieldReferenceDocIsCurrent (internal/services/filter_docs_test.go)
+     from the filter registry — the same source the real menus render. DO NOT EDIT by hand:
+     regenerate with FILTER_DOCS_REGEN=1 go test ./internal/services -run TestFieldReferenceDocIsCurrent -->
+
+# Every filter field
+
+This is the complete list of everything the filters can ask about, generated straight from the
+same source the app's menus render — it cannot drift from what you see in the UI.
+
+Filters come in two worlds:
+
+- **Books** — rules about books and your reading of them.
+- **Episodes** — rules about podcast episodes (feeds, downloaded, played).
+
+Every rule is **a field + a question + your values**. The "Ask" column is the question;
+the "Your values" column is what you provide. The **default** question is what a new rule
+starts with.
+
+## Books
+
+### Book facts
+
+**Title** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Subtitle** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Description** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Summary** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| has | has a value *(default)* |
+| missing | is empty or missing |
+
+**Language** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Page count** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**Chapter count** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**Total characters** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**Community rating** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**Date added** — Type a number of days.
+
+| Ask | Means |
+| --- | --- |
+| within the last | — *(default)* |
+| between | falls between two numbers |
+| is empty | — |
+
+**Date imported** — Type a number of days.
+
+| Ask | Means |
+| --- | --- |
+| within the last | — *(default)* |
+| between | falls between two numbers |
+| is empty | — |
+
+**Web URL** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| has | has a value *(default)* |
+| missing | is empty or missing |
+
+**Metadata notes** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| has | has a value *(default)* |
+| missing | is empty or missing |
+
+**ISBN** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| is | is one of the ones you pick |
+| isn't | matches anything but this |
+| has | has a value *(default)* |
+| missing | is empty or missing |
+
+**ASIN** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| is | is one of the ones you pick |
+| isn't | matches anything but this |
+| has | has a value *(default)* |
+| missing | is empty or missing |
+
+**File size** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**File availability** — Choose from a fixed list of options.
+
+| Ask | Means |
+| --- | --- |
+| is | matches exactly *(default)* |
+| isn't | matches anything but this |
+
+**Explicit** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| is true | is switched on *(default)* |
+| is false | is switched off |
+
+**Abridged** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| is true | is switched on *(default)* |
+| is false | is switched off |
+
+**Manually edited** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| is true | is switched on *(default)* |
+| is false | is switched off |
+
+**Cover** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| has | has a value *(default)* |
+| missing | is empty or missing |
+
+**Added by** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| is | is one of the ones you pick |
+| has | has a value *(default)* |
+| missing | is empty or missing |
+
+### Comics & manga
+
+**Series** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Series number** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**Series count** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**Volume** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**Format group** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| is | is one of the ones you pick *(default)* |
+| isn't | matches anything but this |
+
+**File type (mime)** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| is | is one of the ones you pick *(default)* |
+| isn't | matches anything but this |
+
+**Reflowable** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| is true | is switched on *(default)* |
+| is false | is switched off |
+
+**Fixed layout** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| is true | is switched on *(default)* |
+| is false | is switched off |
+
+**Black & white** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| is true | is switched on *(default)* |
+| is false | is switched off |
+
+**Manga type** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| is | is one of the ones you pick *(default)* |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Reading direction** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| is | is one of the ones you pick *(default)* |
+| isn't | matches anything but this |
+| is empty | — |
+
+### Library
+
+**Library** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| is | is one of the ones you pick *(default)* |
+| isn't | matches anything but this |
+
+### My reading
+
+**Reading status** — Choose from a fixed list of options.
+
+| Ask | Means |
+| --- | --- |
+| is | matches exactly *(default)* |
+
+**Progress percent** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**Last read** — Type a number of days.
+
+| Ask | Means |
+| --- | --- |
+| within the last | — *(default)* |
+| between | falls between two numbers |
+| is empty | — |
+
+**My rating** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| is | matches exactly |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| unrated | — |
+
+**Has review** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| has | has a value *(default)* |
+| missing | is empty or missing |
+
+**Notes** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| has | has a value *(default)* |
+| missing | is empty or missing |
+| within the last | — |
+
+**Highlights** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| has | has a value *(default)* |
+| missing | is empty or missing |
+| within the last | — |
+
+**Note text** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is empty | — |
+
+**Highlight text** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is empty | — |
+
+**Time spent (minutes)** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+
+**Pages read** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+
+**In collection** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| in | is one of the ones you pick (any one is enough) *(default)* |
+| isn't in | is none of the ones you pick |
+| in any | is in at least one of the collections you pick |
+| in none | — |
+
+### People
+
+**Author** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Narrator** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Contributor** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+### Publishing
+
+**Publisher** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Imprint** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Edition** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Published year** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**Published date** — Type a number of days.
+
+| Ask | Means |
+| --- | --- |
+| within the last | — *(default)* |
+| between | falls between two numbers |
+| is empty | — |
+
+### Topics
+
+**Genre** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Tags** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Story arc** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Age rating** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| is | is one of the ones you pick *(default)* |
+| isn't | matches anything but this |
+| is empty | — |
+
+## Podcast episodes
+
+### Book facts
+
+**Title** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Description** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Language** — Type words.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is | matches exactly |
+| isn't | matches anything but this |
+| is empty | — |
+
+**Chapter count** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**Date added** — Type a number of days.
+
+| Ask | Means |
+| --- | --- |
+| within the last | — *(default)* |
+| between | falls between two numbers |
+| is empty | — |
+
+**Date imported** — Type a number of days.
+
+| Ask | Means |
+| --- | --- |
+| within the last | — *(default)* |
+| between | falls between two numbers |
+| is empty | — |
+
+**File size** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**File availability** — Choose from a fixed list of options.
+
+| Ask | Means |
+| --- | --- |
+| is | matches exactly *(default)* |
+| isn't | matches anything but this |
+
+**Explicit** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| is true | is switched on *(default)* |
+| is false | is switched off |
+
+### Comics & manga
+
+**File type (mime)** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| is | is one of the ones you pick *(default)* |
+| isn't | matches anything but this |
+
+### Episodes
+
+**Feed** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| in | is one of the ones you pick (any one is enough) *(default)* |
+| isn't in | is none of the ones you pick |
+| has | has a value |
+| missing | is empty or missing |
+
+**Downloaded** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| is true | is switched on *(default)* |
+| is false | is switched off |
+
+**Played** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| is true | is switched on |
+| is false | is switched off *(default)* |
+
+### Library
+
+**Library** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| is | is one of the ones you pick *(default)* |
+| isn't | matches anything but this |
+
+### My reading
+
+**Progress percent** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**Last read** — Type a number of days.
+
+| Ask | Means |
+| --- | --- |
+| within the last | — *(default)* |
+| between | falls between two numbers |
+| is empty | — |
+
+**My rating** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| is | matches exactly |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| unrated | — |
+
+**Has review** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| has | has a value *(default)* |
+| missing | is empty or missing |
+
+**Notes** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| has | has a value *(default)* |
+| missing | is empty or missing |
+| within the last | — |
+
+**Highlights** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| has | has a value *(default)* |
+| missing | is empty or missing |
+| within the last | — |
+
+**Note text** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is empty | — |
+
+**Highlight text** — No value needed — the question is the whole rule.
+
+| Ask | Means |
+| --- | --- |
+| contains | contains these words *(default)* |
+| doesn't contain | does NOT contain these words |
+| is empty | — |
+
+**Time spent (minutes)** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+
+**In collection** — Pick from a dropdown of real names — picks become removable chips, and you can pick several.
+
+| Ask | Means |
+| --- | --- |
+| in | is one of the ones you pick (any one is enough) *(default)* |
+| isn't in | is none of the ones you pick |
+| in any | is in at least one of the collections you pick |
+| in none | — |
+
+### Publishing
+
+**Published year** — Type a number.
+
+| Ask | Means |
+| --- | --- |
+| between | falls between two numbers |
+| at least | is at least this *(default)* |
+| at most | is at most this |
+| is empty | — |
+
+**Published date** — Type a number of days.
+
+| Ask | Means |
+| --- | --- |
+| within the last | — *(default)* |
+| between | falls between two numbers |
+| is empty | — |
+
+---
+
+*Anything here that doesn't match what the app actually shows is a bug — this page is generated
+from the app's own menus and a test fails if they ever disagree.*

docs/user/filters/index.md

@@ -0,0 +1,91 @@
+# Filters — the complete guide
+
+Filters answer one question: *of everything in my library, show me the ones that match.*
+
+You'll meet the same filter system in three places:
+
+| Place | What it's for |
+| --- | --- |
+| **The Filters drawer** (All Books / Podcasts pages) | A quick, temporary narrowing of what you see. Save it if you want to keep it. |
+| **Smart collections** (a collection's **Rules** page) | A filter that *lives* — the collection's contents update automatically forever. |
+| **Dashboard sections** | The same rules, feeding a shelf on your home screen. |
+
+One system, one set of skills, three payoffs.
+
+## Two worlds: Books and Episodes
+
+Rules about **books** (authors, series, your reading progress) and rules about **podcast episodes**
+(feeds, downloaded, played) are two different worlds. The field menus only show the fields that
+make sense where you are — you'll never see a podcast field on the All Books page. The complete
+list of every field is in [Every filter field](fields.md).
+
+## Anatomy of a rule
+
+Every rule is **a field + a question + your values**:
+
+> **Author** *contains* `asc`
+
+> **Feed** *in* `7th Son: Book One`
+
+> **Page count** *at least* `400`
+
+The field is *what* you're asking about. The question (contains, at least, is empty…) is *how*.
+Your values are *what counts as a match*. The complete questions per field are in
+[Every filter field](fields.md).
+
+## Picking values
+
+Two kinds of value boxes:
+
+- **Dropdown boxes** (Feed, Library, Collection, Added by): start typing and real names appear,
+  with live counts of how much matches. Click to pick — each pick becomes a **chip** with a little
+  **×** to remove it. Pick as many as you like; *any one of them* matching is enough.
+- **Typed boxes** (Author, Title, Page count…): just type. Several words means "contains these
+  words"; number boxes take numbers; date boxes take a number of days.
+
+The dropdown's counts are **live under your other rules**: if you've already narrowed to
+*Title contains Chapter*, the feed menu shows how many Chapter-titled episodes each of your feeds
+has. Rules already picked disappear from their own menu (removing a chip brings them back).
+
+## Groups: ALL and ANY
+
+When you have several rules, the group header — **MATCH ALL** or **MATCH ANY** — decides how they
+combine:
+
+- **MATCH ALL** — *every* rule must match. (The default, and what you want almost always.)
+- **MATCH ANY** — *at least one* rule matching is enough. This is how you ask for
+  "Lewis Carroll **or** George Orwell".
+
+**Click the header to switch it.** It says what it does, and clicking flips it.
+
+`+ group` adds a nested group with its own header (**GROUP ALL / GROUP ANY**), so bigger shapes
+build naturally:
+
+> Match ALL: Author *contains* `Carroll` **AND** GROUP ANY (Title contains `Alice` **OR** Title
+> contains `Wonderland`)
+
+For fine-tuning inside an ALL group, the small **AND / OR** chip between two rules mixes them —
+click `AND` and it becomes `OR`, joining those neighbors together. (The header switch and these
+chips are two different tools: the header sets the group's overall combine; a chip makes just two
+neighboring rules special.)
+
+## The live count
+
+While you build, the counter at the bottom — *N books match* — runs your rules against the real
+library. It's the exact number you'll get when you apply.
+
+## Defaults worth knowing
+
+- **Podcast listening order**: podcast pages and new podcast collections start at
+  **Feed order (reversed)** — book order, chapter 1 first. Change it per feed or collection from
+  the order dropdown; your choice sticks.
+- **Hidden libraries** (family lens) never match — a filter can't accidentally surface a library
+  that's hidden from you.
+- **Episodes that aren't downloaded** stay out of playback chains (they still appear in lists).
+
+## Keeping a filter
+
+- **Save** (drawer): name it; it appears in the **Load** menu from then on.
+- **Apply to Collection** (rules page): the filter becomes the smart collection — live forever.
+- Filtered views are **shareable**: the URL carries the filter, so a bookmark or sent link opens
+  the same view.

docs/user/searching-and-filtering.md

@@ -35,3 +35,12 @@ You can combine tags with other filters:
 - Tags use fuzzy matching - "Sci Fi" will match "Science Fiction"
 - Best matching tags appear first in results
 - Autocomplete shows existing tags as you type with relevance scores
+
+
+## The complete filter guide
+
+The filters described above are one system that also powers smart collections and dashboard
+sections — groups with ALL/ANY, saved filters, and every field listed. The full manual lives in
+[this folder](filters/index.md): the [guide](filters/index.md), the
+[cookbook](filters/cookbook.md) of ready-made recipes, and the generated
+[field reference](filters/fields.md).

internal/database/db.go

@@ -1,6 +1,6 @@
 // Code generated by sqlc. DO NOT EDIT.
 // versions:
-//   sqlc v1.31.1
+//   sqlc v1.31.0
 
 package database
 

internal/database/models.go

@@ -1,6 +1,6 @@
 // Code generated by sqlc. DO NOT EDIT.
 // versions:
-//   sqlc v1.31.1
+//   sqlc v1.31.0
 
 package database
 
@@ -34,7 +34,7 @@ type Collections struct {
 	Description        pgtype.Text        `db:"description" json:"description"`
 	Color              pgtype.Text        `db:"color" json:"color"`
 	Icon               pgtype.Text        `db:"icon" json:"icon"`
-	AutoAssignRules    []byte             `db:"auto_assign_rules" json:"auto_assign_rules"`
+	FilterTree         []byte             `db:"filter_tree" json:"filter_tree"`
 	ViewSettings       []byte             `db:"view_settings" json:"view_settings"`
 	ShowOnDashboard    pgtype.Bool        `db:"show_on_dashboard" json:"show_on_dashboard"`
 	QueryType          pgtype.Text        `db:"query_type" json:"query_type"`
@@ -355,6 +355,7 @@ type MediaItems struct {
 	DownloadState           string             `db:"download_state" json:"download_state"`
 	DownloadError           pgtype.Text        `db:"download_error" json:"download_error"`
 	DownloadAttempts        int32              `db:"download_attempts" json:"download_attempts"`
+	DownloadQueuePos        pgtype.Int8        `db:"download_queue_pos" json:"download_queue_pos"`
 }
 
 type MediaNotes struct {
@@ -639,18 +640,19 @@ type UserDashboardPreferencesGlobal struct {
 }
 
 type Users struct {
-	ID                pgtype.UUID        `db:"id" json:"id"`
-	Email             string             `db:"email" json:"email"`
-	Username          string             `db:"username" json:"username"`
-	PasswordHash      string             `db:"password_hash" json:"password_hash"`
-	FirstName         pgtype.Text        `db:"first_name" json:"first_name"`
-	LastName          pgtype.Text        `db:"last_name" json:"last_name"`
-	Role              string             `db:"role" json:"role"`
-	Theme             pgtype.Text        `db:"theme" json:"theme"`
-	MaxDevices        pgtype.Int4        `db:"max_devices" json:"max_devices"`
-	CreatedAt         pgtype.Timestamptz `db:"created_at" json:"created_at"`
-	Timezone          pgtype.Text        `db:"timezone" json:"timezone"`
-	UpdatedAt         pgtype.Timestamptz `db:"updated_at" json:"updated_at"`
-	DefaultAudioSpeed float32            `db:"default_audio_speed" json:"default_audio_speed"`
-	KeepScreenAwake   bool               `db:"keep_screen_awake" json:"keep_screen_awake"`
+	ID                       pgtype.UUID        `db:"id" json:"id"`
+	Email                    string             `db:"email" json:"email"`
+	Username                 string             `db:"username" json:"username"`
+	PasswordHash             string             `db:"password_hash" json:"password_hash"`
+	FirstName                pgtype.Text        `db:"first_name" json:"first_name"`
+	LastName                 pgtype.Text        `db:"last_name" json:"last_name"`
+	Role                     string             `db:"role" json:"role"`
+	Theme                    pgtype.Text        `db:"theme" json:"theme"`
+	MaxDevices               pgtype.Int4        `db:"max_devices" json:"max_devices"`
+	CreatedAt                pgtype.Timestamptz `db:"created_at" json:"created_at"`
+	Timezone                 pgtype.Text        `db:"timezone" json:"timezone"`
+	UpdatedAt                pgtype.Timestamptz `db:"updated_at" json:"updated_at"`
+	DefaultAudioSpeed        float32            `db:"default_audio_speed" json:"default_audio_speed"`
+	KeepScreenAwake          bool               `db:"keep_screen_awake" json:"keep_screen_awake"`
+	AudioResumeRewindSeconds int32              `db:"audio_resume_rewind_seconds" json:"audio_resume_rewind_seconds"`
 }

internal/database/querier.go

@@ -1,6 +1,6 @@
 // Code generated by sqlc. DO NOT EDIT.
 // versions:
-//   sqlc v1.31.1
+//   sqlc v1.31.0
 
 package database
 
@@ -32,6 +32,11 @@ type Querier interface {
 	BulkUpdateFormatGroups(ctx context.Context) error
 	BulkUpdateProgressFromSync(ctx context.Context, arg BulkUpdateProgressFromSyncParams) ([]interface{}, error)
 	CheckForProgressConflicts(ctx context.Context, arg CheckForProgressConflictsParams) (int64, error)
+	// Atomic claim (§0 item 4): converts queued -> downloading in ONE
+	// statement. Two claimants racing on the same row: exactly one UPDATE
+	// matches download_state='queued'; the loser gets no rows (ErrNoRows).
+	// This is the SKIP-LOCKED guarantee without a second round-trip.
+	ClaimQueuedPodcastEpisode(ctx context.Context, id pgtype.UUID) (MediaItems, error)
 	// Cleanup expired OPDS tokens
 	CleanupExpiredOpdsTokens(ctx context.Context) error
 	CleanupExpiredRefreshTokens(ctx context.Context, dollar_1 float64) error
@@ -257,11 +262,25 @@ type Querier interface {
 	// rename can't spawn duplicates on the next scan.
 	GetCollectionByImportedSeries(ctx context.Context, arg GetCollectionByImportedSeriesParams) (Collections, error)
 	GetCollectionByUserAndName(ctx context.Context, arg GetCollectionByUserAndNameParams) (Collections, error)
+	// The collection queue's downloaded episodes in collection order
+	// (plan item 2.3 "Play collection as sequence"): position-first, then
+	// added_at. INNER JOIN — the chain steps only through episodes the
+	// requester can see (RLS drops unsubscribed feeds) and that are
+	// downloaded (invariant 6: un-downloaded episodes are never tracked).
+	GetCollectionEpisodesOrdered(ctx context.Context, collectionID pgtype.UUID) ([]GetCollectionEpisodesOrderedRow, error)
 	// Get collection items
 	// A2c: position-first ordering (playlist reading order); un-positioned
 	// legacy items keep added_at ASC after the positioned tail — NOT DESC,
 	// which walked a playlist backwards.
 	GetCollectionItems(ctx context.Context, collectionID pgtype.UUID) ([]GetCollectionItemsRow, error)
+	// Episode-collections detail (plan item 2.3): the collection's full
+	// membership for the SSR detail page, with per-row visibility. LEFT
+	// JOIN + RLS: rows whose media is invisible to the requester
+	// (unsubscribed episode — or a family-lens hidden book) survive with
+	// NULL media columns and visible=false, so the page can render an
+	// "unavailable" hint instead of silently vanishing them. Rows visible
+	// but archived/missing-scan keep the old INNER-JOIN behavior (dropped).
+	GetCollectionItemsDetailed(ctx context.Context, collectionID pgtype.UUID) ([]GetCollectionItemsDetailedRow, error)
 	// The excluded filter lives here (was: callers filtered ci.excluded in
 	// Go over a 69-field row + a 45-field converter to MediaItems; embed
 	// returns the real row so neither exists).
@@ -446,8 +465,6 @@ type Querier interface {
 	// GetMediaScanState reads one item's manifest (per-item rescan paths
 	// and the manifest integration tests).
 	GetMediaScanState(ctx context.Context, mediaItemID pgtype.UUID) (MediaScanState, error)
-	// Sequential download worker's claim source (single worker, day one).
-	GetNextQueuedEpisode(ctx context.Context) (MediaItems, error)
 	GetNextRetryTime(ctx context.Context) (interface{}, error)
 	GetNotStartedItems(ctx context.Context, arg GetNotStartedItemsParams) ([]MediaItems, error)
 	// Get OPDS token
@@ -582,12 +599,6 @@ type Querier interface {
 	GetUserSettingByKey(ctx context.Context, arg GetUserSettingByKeyParams) ([]byte, error)
 	GetUserVisibleLibraries(ctx context.Context, userID pgtype.UUID) ([]GetUserVisibleLibrariesRow, error)
 	GetVisibleLibraryMediaCounts(ctx context.Context, userID pgtype.UUID) ([]GetVisibleLibraryMediaCountsRow, error)
-	// Smart ("dynamic") collections: rules are evaluated LIVE at render, so
-	// membership comes from the candidate book set instead of collection_items.
-	// The set is scoped to the requesting user's visible libraries (family
-	// lens enforced at the source) and live items only — the same filters the
-	// static collection paths apply.
-	GetVisibleLiveMediaForRules(ctx context.Context, arg GetVisibleLiveMediaForRulesParams) ([]MediaItems, error)
 	HasRecentConflictResolution(ctx context.Context, arg HasRecentConflictResolutionParams) (bool, error)
 	// Soft-dismiss one row (ownership is checked by the caller against the
 	// device's user_id before calling this).
@@ -599,6 +610,12 @@ type Querier interface {
 	// Link unlinked book to media item
 	LinkUnlinkedBook(ctx context.Context, arg LinkUnlinkedBookParams) (UnlinkedBooks, error)
 	ListAllConflictsByUserAndStatus(ctx context.Context, arg ListAllConflictsByUserAndStatusParams) ([]ListAllConflictsByUserAndStatusRow, error)
+	// Admin all-podcasts view (§0 item 8 / Phase-4 item 1): EVERY feed from
+	// EVERY user with its maintenance aggregates. Runs under the first-
+	// admin identity (invariant 12 — same contract as the poller). Sorted
+	// by disk usage DESC: the maintenance question is "what's eating the
+	// disk", so the hogs surface first.
+	ListAllPodcastFeedsAdmin(ctx context.Context) ([]ListAllPodcastFeedsAdminRow, error)
 	ListAllSyncQueueItems(ctx context.Context, arg ListAllSyncQueueItemsParams) ([]ListAllSyncQueueItemsRow, error)
 	ListConflictsByUser(ctx context.Context, userID pgtype.UUID) ([]ListConflictsByUserRow, error)
 	// ============================================
@@ -656,6 +673,11 @@ type Querier interface {
 	// Item-side projections COALESCE to keep them non-nullable strings;
 	// the display file path falls back to the issue's own for row-less rows.
 	ListProcessingIssuesByLibrary(ctx context.Context, libraryID pgtype.UUID) ([]ListProcessingIssuesByLibraryRow, error)
+	// Fair-share candidate scan (§0 item 4): the download pool claims in
+	// TICKET order (download_queue_pos = SEQUENCE nextval at enqueue — the
+	// enqueue loop's ordering IS the download order, item 5). The worker
+	// groups these per feed and prefers the least-recently-served feed.
+	ListQueuedPodcastEpisodes(ctx context.Context) ([]ListQueuedPodcastEpisodesRow, error)
 	ListSyncConflictsByMediaItem(ctx context.Context, arg ListSyncConflictsByMediaItemParams) ([]SyncConflicts, error)
 	ListSyncConflictsByUser(ctx context.Context, userID pgtype.UUID) ([]ListSyncConflictsByUserRow, error)
 	// Download All + policy union worklist.
@@ -668,6 +690,9 @@ type Querier interface {
 	ListUsers(ctx context.Context) ([]ListUsersRow, error)
 	// First consecutive scan that cannot find the file on disk.
 	MarkMediaItemMissing(ctx context.Context, id pgtype.UUID) error
+	// SetPodcastEpisodeDownloading RETIRED (§0 item 4): the pair
+	// GetNextQueuedEpisode + SetPodcastEpisodeDownloading raced under
+	// concurrency; ClaimQueuedPodcastEpisode does both atomically.
 	// SUCCESS-only write (invariant 7): the file is on disk and probed.
 	// ffprobe facts (real duration via audio_metadata, precise size/mime)
 	// reconcile the feed's declared values.
@@ -710,6 +735,17 @@ type Querier interface {
 	ReorderCollectionItems(ctx context.Context, arg ReorderCollectionItemsParams) error
 	// Re-parent all child rows of p_source onto p_target (defined in schema.sql)
 	ReparentMediaItemChildren(ctx context.Context, arg ReparentMediaItemChildrenParams) error
+	// Admin file deletion (§0 item 8): ONE downloaded episode's disk file
+	// was removed — reset the row to pending and clear the download-derived
+	// facts. file_path is deliberately KEPT: it is the fetch-maintained
+	// layout (written at fetch time, not download time), so a re-download
+	// lands on the same path. The poll upsert never touches download_state,
+	// so a deleted file stays deleted (invariant 2: polling never deletes;
+	// admins delete knowingly).
+	ResetPodcastEpisodeFileDeleted(ctx context.Context, id pgtype.UUID) error
+	// Same reset for EVERY downloaded episode of a feed (per-feed
+	// "Delete files" action on the admin view).
+	ResetPodcastFeedFilesDeleted(ctx context.Context, sourceFeedID pgtype.UUID) (int64, error)
 	ResetSystemCollectionMetadata(ctx context.Context, arg ResetSystemCollectionMetadataParams) error
 	ResolveHashConflict(ctx context.Context, arg ResolveHashConflictParams) error
 	// Ledger self-heal (faceted plan Phase 11): a scan that processes the
@@ -734,6 +770,14 @@ type Querier interface {
 	RevokeOpdsToken(ctx context.Context, token string) error
 	RevokeRefreshToken(ctx context.Context, token pgtype.UUID) error
 	SearchAuthorValues(ctx context.Context, arg SearchAuthorValuesParams) ([]SearchAuthorValuesRow, error)
+	// Episode picker scope (plan item 2.3): YOUR subscriptions' episodes.
+	// The podcasts exclusion in SearchMediaItemsUnified stays (books
+	// surfaces never list podcasts — plan §9); THIS query is the episode
+	// picker's dedicated scope. Visibility is the engine's job (D20): the
+	// media_items policy drops episodes from unsubscribed feeds and the
+	// podcast_feeds join is governed the same way — non-subscribers see
+	// nothing here without any Go-side clause.
+	SearchEpisodesForPicker(ctx context.Context, q_ string) ([]SearchEpisodesForPickerRow, error)
 	SearchGenreValues(ctx context.Context, arg SearchGenreValuesParams) ([]SearchGenreValuesRow, error)
 	SearchLanguageValues(ctx context.Context, arg SearchLanguageValuesParams) ([]SearchLanguageValuesRow, error)
 	// Search Media Items queries
@@ -753,10 +797,11 @@ type Querier interface {
 	SetDeviceSyncEnabled(ctx context.Context, arg SetDeviceSyncEnabledParams) (Devices, error)
 	// Library Visibility queries
 	SetLibraryVisibility(ctx context.Context, arg SetLibraryVisibilityParams) (LibraryVisibility, error)
-	// Worker claim: pending|failed -> queued. Attempts incremented at
-	// claim time so a crashed worker still counts the try.
+	// Enqueue: pending|failed -> queued, stamped with the NEXT QUEUE TICKET
+	// (§0 items 4/5) so claim order = enqueue order (the effective
+	// listening order the enqueue loop applied). Attempts increment at
+	// enqueue so a crashed worker still counts the try.
 	SetPodcastEpisodeDownloadQueued(ctx context.Context, id pgtype.UUID) (int64, error)
-	SetPodcastEpisodeDownloading(ctx context.Context, id pgtype.UUID) error
 	// Manual retry (same endpoint as download): reset to pending so the
 	// worker re-claims it; the reason text clears with the fresh attempt.
 	SetPodcastEpisodePending(ctx context.Context, id pgtype.UUID) error
@@ -775,11 +820,12 @@ type Querier interface {
 	UnignoreUnlinkedBook(ctx context.Context, id pgtype.UUID) error
 	// Update collection
 	UpdateCollection(ctx context.Context, arg UpdateCollectionParams) (Collections, error)
-	// Replace ONLY the auto_assign_rules document (rule CRUD: read-modify-write
-	// of the JSONB without touching metadata stale clients did not send).
-	UpdateCollectionRulesJSON(ctx context.Context, arg UpdateCollectionRulesJSONParams) (Collections, error)
 	// A2c §2.4: provenance + playlist flags on an existing collection without
 	// touching the rest of the row.
+	// (Historical bug, fixed 2026-10-30: this wrote `updated_at = NOW()` but
+	// collections has no updated_at column — the scanner's series-import
+	// call has been failing silently, its error discarded. Fixed by
+	// dropping the phantom column write.)
 	UpdateCollectionViewSettings(ctx context.Context, arg UpdateCollectionViewSettingsParams) error
 	UpdateDashboardPreferences(ctx context.Context, arg UpdateDashboardPreferencesParams) (UserDashboardPreferences, error)
 	UpdateDevice(ctx context.Context, arg UpdateDeviceParams) (Devices, error)
@@ -848,6 +894,7 @@ type Querier interface {
 	UpdateSystemSetting(ctx context.Context, arg UpdateSystemSettingParams) error
 	// Update universal progress
 	UpdateUniversalProgress(ctx context.Context, arg UpdateUniversalProgressParams) (ReadingProgress, error)
+	UpdateUserAudioResumeRewind(ctx context.Context, arg UpdateUserAudioResumeRewindParams) error
 	UpdateUserDefaultAudioSpeed(ctx context.Context, arg UpdateUserDefaultAudioSpeedParams) error
 	UpdateUserKeepScreenAwake(ctx context.Context, arg UpdateUserKeepScreenAwakeParams) error
 	UpdateUserMaxDevices(ctx context.Context, arg UpdateUserMaxDevicesParams) (Users, error)

internal/database/queries/queries.sql

@@ -30,6 +30,7 @@ SELECT
     u.timezone,
     u.default_audio_speed,
     u.keep_screen_awake,
+    u.audio_resume_rewind_seconds,
     (SELECT COUNT(*) FROM devices WHERE user_id = u.id) as device_count
 FROM users u
 WHERE u.id = $1;
@@ -526,6 +527,9 @@ UPDATE users SET default_audio_speed = $2, updated_at = NOW() WHERE id = $1;
 -- name: UpdateUserKeepScreenAwake :exec
 UPDATE users SET keep_screen_awake = $2, updated_at = NOW() WHERE id = $1;
 
+-- name: UpdateUserAudioResumeRewind :exec
+UPDATE users SET audio_resume_rewind_seconds = $2, updated_at = NOW() WHERE id = $1;
+
 -- Per-book playback speed preference (player plan §8).
 
 -- name: GetAudioPlaybackSpeed :one
@@ -932,6 +936,26 @@ ORDER BY
   mi.title ASC
 LIMIT sqlc.narg('limit') OFFSET sqlc.narg('offset');
 
+-- name: SearchEpisodesForPicker :many
+-- Episode picker scope (plan item 2.3): YOUR subscriptions' episodes.
+-- The podcasts exclusion in SearchMediaItemsUnified stays (books
+-- surfaces never list podcasts — plan §9); THIS query is the episode
+-- picker's dedicated scope. Visibility is the engine's job (D20): the
+-- media_items policy drops episodes from unsubscribed feeds and the
+-- podcast_feeds join is governed the same way — non-subscribers see
+-- nothing here without any Go-side clause.
+SELECT mi.id, mi.title, mi.author, mi.cover_image_path, mi.library_id,
+       mi.format_group, mi.download_state,
+       pf.title AS feed_title
+FROM media_items mi
+JOIN podcast_feeds pf ON mi.source_feed_id = pf.id
+WHERE mi.source = 'podcast_episode'
+  AND mi.archived_at IS NULL
+  AND mi.missing_scan_count = 0
+  AND (sqlc.arg('q')::text = '' OR mi.title ILIKE '%' || sqlc.arg('q')::text || '%')
+ORDER BY pf.title ASC, mi.feed_position ASC NULLS LAST
+LIMIT 60;
+
 -- name: SearchAuthorValues :many
 SELECT
   mi.author as value,
@@ -3469,14 +3493,18 @@ DELETE FROM device_file_aliases WHERE id = $1;
 
 -- Create collection
 -- name: CreateCollection :one
-INSERT INTO collections (user_id, name, description, color, icon, auto_assign_rules, view_settings, show_on_dashboard)
+INSERT INTO collections (user_id, name, description, color, icon, view_settings, show_on_dashboard, filter_tree)
 VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
 RETURNING *;
 
 -- A2c §2.4: provenance + playlist flags on an existing collection without
 -- touching the rest of the row.
 -- name: UpdateCollectionViewSettings :exec
-UPDATE collections SET view_settings = $2, updated_at = NOW() WHERE id = $1;
+-- (Historical bug, fixed 2026-10-30: this wrote `updated_at = NOW()` but
+-- collections has no updated_at column — the scanner's series-import
+-- call has been failing silently, its error discarded. Fixed by
+-- dropping the phantom column write.)
+UPDATE collections SET view_settings = $2 WHERE id = $1;
 
 -- Get collection
 -- name: GetCollection :one
@@ -3504,16 +3532,11 @@ SET
     description = $3,
     color = $4,
     icon = $5,
-    auto_assign_rules = $6,
-    view_settings = $7
+    view_settings = $6,
+    filter_tree = $7
 WHERE id = $1
 RETURNING *;
 
--- Replace ONLY the auto_assign_rules document (rule CRUD: read-modify-write
--- of the JSONB without touching metadata stale clients did not send).
--- name: UpdateCollectionRulesJSON :one
-UPDATE collections SET auto_assign_rules = $2 WHERE id = $1 RETURNING *;
-
 -- Delete collection
 -- name: DeleteCollection :exec
 DELETE FROM collections WHERE id = $1;
@@ -3576,6 +3599,42 @@ WHERE ci.collection_id = $1
   AND mi.missing_scan_count = 0
 ORDER BY ci.position ASC NULLS LAST, ci.added_at ASC;
 
+-- name: GetCollectionItemsDetailed :many
+-- Episode-collections detail (plan item 2.3): the collection's full
+-- membership for the SSR detail page, with per-row visibility. LEFT
+-- JOIN + RLS: rows whose media is invisible to the requester
+-- (unsubscribed episode — or a family-lens hidden book) survive with
+-- NULL media columns and visible=false, so the page can render an
+-- "unavailable" hint instead of silently vanishing them. Rows visible
+-- but archived/missing-scan keep the old INNER-JOIN behavior (dropped).
+SELECT ci.media_item_id, ci.position, ci.added_at,
+       (mi.id IS NOT NULL)::bool AS visible,
+       mi.title, mi.author, mi.cover_image_path, mi.format_group,
+       mi.source, mi.download_state,
+       pf.title AS feed_title
+FROM collection_items ci
+LEFT JOIN media_items mi ON ci.media_item_id = mi.id
+LEFT JOIN podcast_feeds pf ON mi.source_feed_id = pf.id
+WHERE ci.collection_id = $1
+  AND (mi.id IS NULL OR (mi.archived_at IS NULL AND mi.missing_scan_count = 0))
+ORDER BY ci.position ASC NULLS LAST, ci.added_at ASC;
+
+-- name: GetCollectionEpisodesOrdered :many
+-- The collection queue's downloaded episodes in collection order
+-- (plan item 2.3 "Play collection as sequence"): position-first, then
+-- added_at. INNER JOIN — the chain steps only through episodes the
+-- requester can see (RLS drops unsubscribed feeds) and that are
+-- downloaded (invariant 6: un-downloaded episodes are never tracked).
+SELECT mi.id, mi.title, mi.feed_position, mi.date_published
+FROM collection_items ci
+JOIN media_items mi ON ci.media_item_id = mi.id
+WHERE ci.collection_id = $1
+  AND mi.source = 'podcast_episode'
+  AND mi.download_state = 'downloaded'
+  AND mi.archived_at IS NULL
+  AND mi.missing_scan_count = 0
+ORDER BY ci.position ASC NULLS LAST, ci.added_at ASC;
+
 -- Get collections for book
 -- name: GetCollectionsForBook :many
 SELECT c.*
@@ -3967,8 +4026,8 @@ RETURNING *;
 DELETE FROM collection_items WHERE collection_id = $1;
 
 -- name: CreateSystemCollection :one
-INSERT INTO collections (user_id, name, description, icon, color, show_on_dashboard, query_type, priority, is_system_collection, auto_assign_rules)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, true, 'null'::jsonb)
+INSERT INTO collections (user_id, name, description, icon, color, show_on_dashboard, query_type, priority, is_system_collection)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, true)
 RETURNING *;
 
 -- name: ResetSystemCollectionMetadata :exec
@@ -4084,19 +4143,6 @@ LIMIT sqlc.narg('limit');
 -- name: CountCollectionItems :one
 SELECT COUNT(*) FROM collection_items WHERE collection_id = $1;
 
--- Smart ("dynamic") collections: rules are evaluated LIVE at render, so
--- membership comes from the candidate book set instead of collection_items.
--- The set is scoped to the requesting user's visible libraries (family
--- lens enforced at the source) and live items only — the same filters the
--- static collection paths apply.
--- name: GetVisibleLiveMediaForRules :many
-SELECT mi.* FROM media_items mi
-WHERE (sqlc.narg('library_id')::uuid IS NULL OR mi.library_id = sqlc.narg('library_id')::uuid)
-  AND (sqlc.narg('visible_library_ids')::uuid[] IS NULL OR mi.library_id = ANY(sqlc.narg('visible_library_ids')::uuid[]))
-  AND mi.archived_at IS NULL
-  AND mi.missing_scan_count = 0
-ORDER BY mi.title ASC;
-
 -- Live item count for a STATIC collection (rule-free cards on the
 -- collections page); same live filter as GetCollectionItems, plus the
 -- future-hybrid excluded exclusion and an optional library scope.
@@ -4698,6 +4744,68 @@ WHERE feed_id = $1;
 -- name: CountPodcastFeedSubscribers :one
 SELECT COUNT(*) FROM podcast_subscriptions WHERE feed_id = $1;
 
+-- name: ListAllPodcastFeedsAdmin :many
+-- Admin all-podcasts view (§0 item 8 / Phase-4 item 1): EVERY feed from
+-- EVERY user with its maintenance aggregates. Runs under the first-
+-- admin identity (invariant 12 — same contract as the poller). Sorted
+-- by disk usage DESC: the maintenance question is "what's eating the
+-- disk", so the hogs surface first.
+SELECT f.id, f.title, f.host, f.last_fetched_at, f.library_id,
+       l.name AS library_name,
+       (SELECT COUNT(*) FROM media_items m
+         WHERE m.source_feed_id = f.id AND m.source = 'podcast_episode') AS episode_total,
+       (SELECT COUNT(*) FROM media_items m
+         WHERE m.source_feed_id = f.id AND m.source = 'podcast_episode'
+           AND m.download_state = 'downloaded') AS episode_downloaded,
+       (SELECT COALESCE(SUM(m.file_size), 0)::BIGINT FROM media_items m
+         WHERE m.source_feed_id = f.id AND m.source = 'podcast_episode'
+           AND m.download_state = 'downloaded') AS disk_bytes,
+       (SELECT COUNT(*) FROM podcast_subscriptions s
+         WHERE s.feed_id = f.id) AS subscriber_count,
+       (SELECT COALESCE(string_agg(u.username, ', ' ORDER BY u.username), '')::TEXT
+          FROM podcast_subscriptions s
+          JOIN users u ON u.id = s.user_id
+         WHERE s.feed_id = f.id) AS subscriber_names
+FROM podcast_feeds f
+JOIN libraries l ON l.id = f.library_id
+ORDER BY 9 DESC, f.title ASC;
+
+-- name: ResetPodcastEpisodeFileDeleted :exec
+-- Admin file deletion (§0 item 8): ONE downloaded episode's disk file
+-- was removed — reset the row to pending and clear the download-derived
+-- facts. file_path is deliberately KEPT: it is the fetch-maintained
+-- layout (written at fetch time, not download time), so a re-download
+-- lands on the same path. The poll upsert never touches download_state,
+-- so a deleted file stays deleted (invariant 2: polling never deletes;
+-- admins delete knowingly).
+UPDATE media_items
+SET download_state = 'pending',
+    download_error = NULL,
+    download_attempts = 0,
+    file_size = NULL,
+    mime_type = NULL,
+    cover_image_path = NULL,
+    audio_metadata = NULL,
+    chapter_count = NULL,
+    updated_at = NOW()
+WHERE id = $1 AND source = 'podcast_episode' AND download_state = 'downloaded';
+
+-- name: ResetPodcastFeedFilesDeleted :execrows
+-- Same reset for EVERY downloaded episode of a feed (per-feed
+-- "Delete files" action on the admin view).
+UPDATE media_items
+SET download_state = 'pending',
+    download_error = NULL,
+    download_attempts = 0,
+    file_size = NULL,
+    mime_type = NULL,
+    cover_image_path = NULL,
+    audio_metadata = NULL,
+    chapter_count = NULL,
+    updated_at = NOW()
+WHERE source_feed_id = $1 AND source = 'podcast_episode'
+  AND download_state = 'downloaded';
+
 -- name: ListPodcastFeedsForPolling :many
 -- Poller worklist (admin identity): every feed with its validators and
 -- the back-off flag (is_complete feeds poll rarely, never disappear).
@@ -4862,10 +4970,13 @@ SELECT * FROM media_items
 WHERE id = $1 AND source = 'podcast_episode';
 
 -- name: SetPodcastEpisodeDownloadQueued :execrows
--- Worker claim: pending|failed -> queued. Attempts incremented at
--- claim time so a crashed worker still counts the try.
+-- Enqueue: pending|failed -> queued, stamped with the NEXT QUEUE TICKET
+-- (§0 items 4/5) so claim order = enqueue order (the effective
+-- listening order the enqueue loop applied). Attempts increment at
+-- enqueue so a crashed worker still counts the try.
 UPDATE media_items
 SET download_state = 'queued',
+    download_queue_pos = nextval('podcast_queue_seq'),
     download_error = NULL,
     download_attempts = download_attempts + 1,
     updated_at = NOW()
@@ -4873,10 +4984,9 @@ WHERE id = $1
   AND source = 'podcast_episode'
   AND download_state IN ('pending', 'failed');
 
--- name: SetPodcastEpisodeDownloading :exec
-UPDATE media_items
-SET download_state = 'downloading', updated_at = NOW()
-WHERE id = $1 AND source = 'podcast_episode';
+-- SetPodcastEpisodeDownloading RETIRED (§0 item 4): the pair
+-- GetNextQueuedEpisode + SetPodcastEpisodeDownloading raced under
+-- concurrency; ClaimQueuedPodcastEpisode does both atomically.
 
 -- name: MarkPodcastEpisodeDownloaded :one
 -- SUCCESS-only write (invariant 7): the file is on disk and probed.
@@ -4964,12 +5074,26 @@ WHERE s.user_id = sqlc.arg('user_id')
        OR COALESCE(f.publisher, '') ILIKE '%' || sqlc.arg('search_query')::text || '%')
 ORDER BY COALESCE(s.display_name, f.title) ASC;
 
--- name: GetNextQueuedEpisode :one
--- Sequential download worker's claim source (single worker, day one).
-SELECT * FROM media_items
+-- name: ListQueuedPodcastEpisodes :many
+-- Fair-share candidate scan (§0 item 4): the download pool claims in
+-- TICKET order (download_queue_pos = SEQUENCE nextval at enqueue — the
+-- enqueue loop's ordering IS the download order, item 5). The worker
+-- groups these per feed and prefers the least-recently-served feed.
+SELECT id, source_feed_id FROM media_items
 WHERE source = 'podcast_episode' AND download_state = 'queued'
-ORDER BY updated_at ASC
-LIMIT 1;
+ORDER BY download_queue_pos ASC NULLS LAST;
+
+-- name: ClaimQueuedPodcastEpisode :one
+-- Atomic claim (§0 item 4): converts queued -> downloading in ONE
+-- statement. Two claimants racing on the same row: exactly one UPDATE
+-- matches download_state='queued'; the loser gets no rows (ErrNoRows).
+-- This is the SKIP-LOCKED guarantee without a second round-trip.
+UPDATE media_items
+SET download_state = 'downloading', updated_at = NOW()
+WHERE id = $1
+  AND source = 'podcast_episode'
+  AND download_state = 'queued'
+RETURNING media_items.*;
 
 -- name: CountQueuedEpisodes :one
 SELECT COUNT(*) FROM media_items

internal/database/settings_registry.go

@@ -25,6 +25,7 @@ import (
 // SettingType enumerates the value types stored in system_settings.setting_type.
 const (
 	SettingTypeInt        = "int"
+	SettingTypeFloat      = "float"
 	SettingTypeBool       = "bool"
 	SettingTypeString     = "string"
 	SettingTypeStringList = "string_list"
@@ -83,6 +84,8 @@ var SettingDefaults = []SettingDefault{
 	{Key: "worker_pool_size", Value: "3", Type: SettingTypeInt, Min: "1", Max: "100", RequiresRestart: true, Category: "performance", Group: "Worker Pool", Description: "Number of background worker goroutines"},
 	{Key: "worker_queue_cap", Value: "100", Type: SettingTypeInt, Min: "1", Max: "10000", RequiresRestart: true, Category: "performance", Group: "Worker Pool", Description: "Background worker job queue capacity"},
 	{Key: "podcast_poll_interval_seconds", Value: "3600", Type: SettingTypeInt, Min: "300", Max: "604800", Category: "podcasts", Group: "Podcasts", Description: "How often to poll podcast feeds for new episodes (seconds; complete feeds back off)"},
+	{Key: "podcast_download_concurrency", Value: "4", Type: SettingTypeInt, Min: "1", Max: "16", Category: "podcasts", Group: "Podcasts", Description: "Podcast episode downloads in flight server-wide (the connection is the limit; fair-share spreads them across feeds)"},
+	{Key: "podcast_download_speed_mbps", Value: "0", Type: SettingTypeFloat, Min: "0", Max: "10000", Category: "podcasts", Group: "Podcasts", Description: "Shared bandwidth cap for podcast downloads in megabits/second (0 = unlimited)"},
 }
 
 // defaultBy indexes SettingDefaults by key for O(1) lookup.
@@ -173,6 +176,26 @@ func (r *SettingsRegistry) getInt(key string) int {
 	return n
 }
 
+func (r *SettingsRegistry) getFloat(key string) float64 {
+	d := defaultBy[key]
+	v := r.raw(key)
+	f, err := strconv.ParseFloat(v, 64)
+	if err != nil {
+		f, _ = strconv.ParseFloat(d.Value, 64)
+	}
+	if d.Min != "" {
+		if mn, err := strconv.ParseFloat(d.Min, 64); err == nil && f < mn {
+			f = mn
+		}
+	}
+	if d.Max != "" {
+		if mx, err := strconv.ParseFloat(d.Max, 64); err == nil && f > mx {
+			f = mx
+		}
+	}
+	return f
+}
+
 func (r *SettingsRegistry) getBool(key string) bool {
 	v := r.raw(key)
 	b, err := strconv.ParseBool(v)
@@ -189,13 +212,24 @@ func (r *SettingsRegistry) ScanPollInterval() time.Duration {
 	return time.Duration(r.getInt("scan_poll_interval_seconds")) * time.Second
 }
 
-// PodcastPollInterval is the feed-poller tick (live setting; the poller
-// re-reads it every cycle — writes go through the settings API path,
-// AGENTS.md gotcha #2).
+// PodcastPollInterval is how often the poller checks feeds, as a
+// duration (live setting; the poller re-reads it every cycle — writes
+// go through the settings API path, AGENTS.md gotcha #2).
 func (r *SettingsRegistry) PodcastPollInterval() time.Duration {
 	return time.Duration(r.getInt("podcast_poll_interval_seconds")) * time.Second
 }
 
+// PodcastDownloadConcurrency: episode downloads in flight server-wide
+// (the connection is the limit; fair-share spreads them across feeds).
+func (r *SettingsRegistry) PodcastDownloadConcurrency() int {
+	return r.getInt("podcast_download_concurrency")
+}
+
+// PodcastDownloadSpeedMbps: shared bandwidth cap (0 = unlimited).
+func (r *SettingsRegistry) PodcastDownloadSpeedMbps() float64 {
+	return r.getFloat("podcast_download_speed_mbps")
+}
+
 // AutoScanEnabled reports whether auto-scanning is on.
 func (r *SettingsRegistry) AutoScanEnabled() bool { return r.getBool("auto_scan_enabled") }
 

internal/database/settings_registry_test.go

@@ -36,6 +36,21 @@ func TestSettingDefaults(t *testing.T) {
 			if _, err := strconv.ParseBool(d.Value); err != nil {
 				t.Errorf("bool setting %s default %q is not a bool", d.Key, d.Value)
 			}
+		case SettingTypeFloat:
+			f, err := strconv.ParseFloat(d.Value, 64)
+			if err != nil {
+				t.Errorf("float setting %s default %q is not a float", d.Key, d.Value)
+			}
+			if d.Min != "" {
+				if mn, err := strconv.ParseFloat(d.Min, 64); err == nil && f < mn {
+					t.Errorf("float setting %s default %q below min %q", d.Key, d.Value, d.Min)
+				}
+			}
+			if d.Max != "" {
+				if mx, err := strconv.ParseFloat(d.Max, 64); err == nil && f > mx {
+					t.Errorf("float setting %s default %q above max %q", d.Key, d.Value, d.Max)
+				}
+			}
 		case SettingTypeString:
 			if d.Value == "" {
 				t.Errorf("string setting %s has empty default", d.Key)

internal/docs/handler.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io/fs"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"bookhoard/templates"
@@ -24,7 +25,23 @@ type DocsHandler struct {
 	docsFS   fs.FS
 }
 
+// resolveDocsPath — the docs folder lives at the repo root, but `go test`
+// runs test binaries from the PACKAGE directory (/cmd/server/tests), so a
+// plain relative "docs" resolves to a folder that doesn't exist there and
+// every /docs route 404s in tests (2026-11-01). Walk upward, bounded,
+// until the folder is real; prod (/app) matches on the first try.
+func resolveDocsPath(p string) string {
+	for i := 0; i < 6; i++ {
+		if fi, err := os.Stat(filepath.Join(p, "index.md")); err == nil && !fi.IsDir() {
+			return p
+		}
+		p = filepath.Join("..", p)
+	}
+	return "docs"
+}
+
 func NewDocsHandler(docsPath string) *DocsHandler {
+	docsPath = resolveDocsPath(docsPath)
 	// Create goldmark renderer with syntax highlighting
 	md := goldmark.New(
 		goldmark.WithExtensions(
@@ -74,10 +91,23 @@ func (h *DocsHandler) LoadDocument(docPath string) (*templates.Document, error)
 		}
 	}
 
-	// Read the markdown file
+	// Read the markdown file. Folder URLs resolve to their index page:
+	// /docs/user/filters → user/filters/index.md (2026-11-01 — the
+	// filter manual is a folder: guide + cookbook + generated field
+	// reference).
 	content, err := fs.ReadFile(h.docsFS, docPath)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read document: %w", err)
+		if !strings.HasSuffix(docPath, "index.md") {
+			alt := strings.TrimSuffix(docPath, ".md") + "/index.md"
+			if altContent, altErr := fs.ReadFile(h.docsFS, alt); altErr == nil {
+				docPath = alt
+				content = altContent
+			} else {
+				return nil, fmt.Errorf("failed to read document: %w", err)
+			}
+		} else {
+			return nil, fmt.Errorf("failed to read document: %w", err)
+		}
 	}
 
 	// Convert markdown to HTML

internal/docs/navigation.go

@@ -321,10 +321,23 @@ func (h *DocsHandler) BuildNavigation(currentPath string) *templates.Navigation
 	return nav
 }
 
-// containsURL reports whether currentPath is one of the given doc URLs.
+// normalizeDocURL — folder-index pages SERVE at their directory URL
+// (/docs/user/filters) while their nav entry carries the /index suffix
+// (/docs/user/filters/index): same page, two spellings. Both sidebar
+// checks (expansion + highlight) compare normalized forms, so folder
+// pages expand and highlight like file pages — no per-page special
+// cases (2026-11-01, the filter manual's folder).
+func normalizeDocURL(u string) string {
+	u = strings.TrimRight(u, "/")
+	return strings.TrimSuffix(u, "/index")
+}
+
+// containsURL reports whether currentPath is one of the given doc URLs
+// (folder-index URLs normalized — see normalizeDocURL).
 func containsURL(currentPath string, urls []string) bool {
+	current := normalizeDocURL(currentPath)
 	for _, u := range urls {
-		if currentPath == u {
+		if current == normalizeDocURL(u) {
 			return true
 		}
 	}

internal/docs/navigation_test.go

@@ -4,6 +4,8 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+
+	"bookhoard/templates"
 )
 
 func TestPlaceDoc(t *testing.T) {
@@ -205,3 +207,41 @@ func TestBuildNavigationNothingCurrent(t *testing.T) {
 		t.Errorf("expected zero sections open when nothing matches (docs home / 404 renders fully closed), got %d", open)
 	}
 }
+
+// TestBuildNavigationFolderIndex (2026-11-01): folder-index pages serve
+// at their directory URL (/docs/user/filters) while their nav entries
+// carry /index (/docs/user/filters/index) — the sidebar must EXPAND the
+// containing section/group and HIGHLIGHT the index item for the folder
+// URL, exactly like a file page. The filter manual's folder is the
+// first page of this shape.
+func TestBuildNavigationFolderIndex(t *testing.T) {
+	// The REAL docs tree: the Filters group only exists because the
+	// filter manual (guide/cookbook/fields) lives in user/filters/.
+	handler := NewDocsHandler("../../docs")
+	nav := handler.BuildNavigation("/docs/user/filters")
+
+	var userGuide *templates.NavSection
+	for i := range nav.Sections {
+		if nav.Sections[i].Title == "User Guide" {
+			userGuide = &nav.Sections[i]
+		}
+	}
+	if userGuide == nil {
+		t.Fatal("User Guide section missing")
+	}
+	if userGuide.Collapsed {
+		t.Error("User Guide section must expand for /docs/user/filters")
+	}
+	var filters *templates.NavGroup
+	for i := range userGuide.Groups {
+		if userGuide.Groups[i].Title == "Filters" {
+			filters = &userGuide.Groups[i]
+		}
+	}
+	if filters == nil {
+		t.Fatal("Filters group missing from User Guide")
+	}
+	if filters.Collapsed {
+		t.Error("Filters group must expand for its folder URL")
+	}
+}

internal/docs/schema.go

@@ -49,7 +49,7 @@ var Schemas = map[string]Schema{
 		Response: json.RawMessage(`{
 			"id": "", "user_id": "", "name": "", "description": "",
 			"color": "", "icon": "", "collection_type": "",
-			"auto_assign_rules": null, "view_settings": {},
+			"view_settings": {},
 			"book_count": 0, "created_at": ""
 		}`),
 	},
@@ -62,7 +62,7 @@ var Schemas = map[string]Schema{
 	"GET /api/collections/:id": {
 		Response: json.RawMessage(`{
 			"id": "", "user_id": "", "name": "", "description": "",
-			"color": "", "icon": "", "auto_assign_rules": null,
+			"color": "", "icon": "",
 			"view_settings": {}, "books": [], "book_count": 0,
 			"is_smart": false, "up_next": [], "created_at": ""
 		}`),
@@ -71,7 +71,7 @@ var Schemas = map[string]Schema{
 		Request: handlers.UpdateCollectionRequest{},
 		Response: json.RawMessage(`{
 			"id": "", "user_id": "", "name": "", "description": "",
-			"color": "", "icon": "", "auto_assign_rules": null,
+			"color": "", "icon": "",
 			"view_settings": {}, "created_at": ""
 		}`),
 	},
@@ -601,15 +601,14 @@ var Schemas = map[string]Schema{
 		Request:  json.RawMessage(`{"item_ids": []}`),
 		Response: json.RawMessage(`{"status": "reordered"}`),
 	},
-	"PUT /api/collections/:id/rules/:ruleId": {
-		// Handler is SetRuleEnabled: toggle only, request {enabled required},
-		// response {collection_id, is_smart}.
-		Request: json.RawMessage(`{"enabled": false}`),
+	"PUT /api/collections/:id/view-settings": {
+		// Merges chain_order into the collection's view_settings JSONB
+		// (playlist toggles share the doc and are preserved).
+		Request: json.RawMessage(`{"chain_order": "newest"}`),
 		Response: json.RawMessage(`{
-			"collection_id": "", "is_smart": false
+			"id": "", "chain_order": "", "view_settings": {}
 		}`),
 	},
-
 	// --- Beam batch 7: scanner ---
 	"POST /api/scanner/scan": {
 		Request: handlers.ScanLibraryRequest{},
@@ -835,22 +834,6 @@ var Schemas = map[string]Schema{
 	"DELETE /api/devices/:id/file-aliases/:aliasId": {
 		Response: json.RawMessage(`{"message": ""}`),
 	},
-	"POST /api/collections/:id/rules": {
-		// First rule converts a static collection to smart.
-		Request: handlers.AddRuleRequest{},
-		Response: json.RawMessage(`{
-			"collection_id": "", "rule": {}, "is_smart": false
-		}`),
-	},
-	"DELETE /api/collections/:id/rules/:ruleId": {
-		Response: json.RawMessage(`{
-			"collection_id": "", "is_smart": false
-		}`),
-	},
-	"POST /api/collections/test-rules": {
-		Request:  handlers.TestRulesRequest{},
-		Response: json.RawMessage(`{"matches": [], "total": 0}`),
-	},
 	"POST /api/collections/:id/books": {
 		// Bulk add: {operations: [{collection_id, book_ids:[...]}]}.
 		Request: json.RawMessage(`{

internal/handlers/auth.go

@@ -6,6 +6,7 @@ package handlers
 import (
 	"bookhoard/internal/database"
 	"bookhoard/internal/middleware"
+	"bookhoard/internal/rls"
 	"bookhoard/internal/setupstatus"
 	"context"
 	"errors"
@@ -15,6 +16,7 @@ import (
 	"math"
 	"net/http"
 	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -125,6 +127,10 @@ type UserProfile struct {
 	DefaultAudioSpeed float64 `json:"default_audio_speed,omitempty"`
 	// Whether the web reader/player should hold a Screen Wake Lock.
 	KeepScreenAwake bool `json:"keep_screen_awake"`
+	// Resume rewind: seconds before the saved position the audio
+	// player starts (open-resume and every genuine unpause). 0 is a
+	// real value (exact resume) — never omitted.
+	AudioResumeRewind int `json:"audio_resume_rewind_seconds"`
 }
 
 type ProfileUpdateRequest struct {
@@ -141,6 +147,11 @@ type ProfileUpdateRequest struct {
 	// Per the SPEEDS list bounds; the profile select always sends it,
 	// JSON clients omit it (0 = untouched).
 	DefaultAudioSpeed float64 `json:"default_audio_speed,omitempty" form:"default_audio_speed" validate:"omitempty,min=0.25,max=4"`
+	// Resume rewind seconds, as the form select sends it ("0"/"5"/"10").
+	// The string shape (keep_screen_awake precedent) lets the form
+	// select an explicit 0=Off while JSON clients that omit it decode
+	// as "" and leave the column untouched.
+	AudioResumeRewind string `json:"audio_resume_rewind_seconds,omitempty" form:"audio_resume_rewind_seconds" validate:"omitempty,oneof=0 5 10"`
 }
 
 // Register handles POST /api/auth/register
@@ -550,6 +561,7 @@ func (h *AuthHandler) GetProfile(c *echo.Context) error {
 		Theme:             user.Theme.String,
 		DefaultAudioSpeed: float64(user.DefaultAudioSpeed),
 		KeepScreenAwake:   user.KeepScreenAwake,
+		AudioResumeRewind: int(user.AudioResumeRewindSeconds),
 	})
 }
 
@@ -714,6 +726,24 @@ func (h *AuthHandler) UpdateProfile(c *echo.Context) error {
 		}
 	}
 
+	// Resume-rewind preference. The form select always sends it
+	// ("0"/"5"/"10"); JSON clients that omit it decode as "" and leave
+	// the column untouched. Strict allow-list — the three choices the
+	// UI offers are the only values the API accepts.
+	if req.AudioResumeRewind != "" {
+		rewind, err := strconv.Atoi(req.AudioResumeRewind)
+		if err != nil || (rewind != 0 && rewind != 5 && rewind != 10) {
+			return c.JSON(http.StatusBadRequest, map[string]string{"error": "audio_resume_rewind_seconds must be 0, 5, or 10"})
+		}
+		err = h.db.UpdateUserAudioResumeRewind(c.Request().Context(), database.UpdateUserAudioResumeRewindParams{
+			ID:                       targetUserUUID,
+			AudioResumeRewindSeconds: int32(rewind),
+		})
+		if err != nil {
+			return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		}
+	}
+
 	// Keep-screen-awake preference. The form dropdown always sends it
 	// ("true"/"false"); JSON clients that omit it decode as "" and leave
 	// the column untouched.
@@ -1145,6 +1175,11 @@ func (h *AuthHandler) generateJWT(userID string) (string, error) {
 }
 
 func (h *AuthHandler) CreateDefaultCollectionsForUser(ctx context.Context, userID pgtype.UUID) error {
+	// Registration runs BEFORE the JWT exists — the request context
+	// carries no identity, and the collections RLS insert policy
+	// (2026-10-31) would reject the five system-collection seeds.
+	// Declare the new user as the actor: owner == actor, policy passes.
+	ctx = rls.WithUser(ctx, userID)
 	defaultCollections := []struct {
 		Name        string
 		Description string

internal/handlers/cards.go

@@ -43,6 +43,21 @@ type BookInfo struct {
 	// it empty rather than pay a join).
 	ViewerPercentage *float64 `json:"viewer_percentage"`
 	LibraryName      string   `json:"library_name"`
+	// Episode-collections extras (plan item 2.3): populated only by the
+	// collection-detail adapter. IsEpisode renders the episode-row
+	// variant in the grid; FeedTitle disambiguates same-named episodes;
+	// DownloadState gates the play affordance. Hidden=true means the
+	// LEFT JOIN missed under RLS (unsubscribed episode, or a
+	// family-lens hidden book) — the row renders as an "unavailable"
+	// hint instead of silently vanishing. Adapters that don't load
+	// visibility leave Hidden false (cards stay fully rendered). The
+	// four keys are NOT omitempty: every BookInfo surface emits the
+	// same stable key set (the viewer_percentage precedent —
+	// contract-pin widening, docs/contract_pins.md 2026-10-30).
+	IsEpisode     bool   `json:"is_episode"`
+	FeedTitle     string `json:"feed_title"`
+	DownloadState string `json:"download_state"`
+	Hidden        bool   `json:"hidden"`
 }
 
 // LibraryTypeMap builds libraryID→library-type-name for badge resolution
@@ -151,8 +166,7 @@ func BookCardsFromCollectionDashRows(rows []database.GetCollectionItemsForDashbo
 			ID:          uuid.UUID(mi.ID.Bytes),
 			Title:       mi.Title,
 			Author:      utils.PgTextString(mi.Author),
-			LibraryID:   mi.LibraryID,
-			CoverPath:   mi.CoverImagePath,
+			LibraryID:   mi.LibraryID,			CoverPath:   mi.CoverImagePath,
 			FormatGroup: mi.FormatGroup,
 			LibraryType: libTypes[uuid.UUID(mi.LibraryID.Bytes).String()],
 		}))
@@ -180,6 +194,39 @@ func BookCardsFromCollectionItemRows(rows []database.GetCollectionItemsRow, libT
 	return cards
 }
 
+// BookCardsFromCollectionDetailed builds cards from the
+// GetCollectionItemsDetailed rows (plan item 2.3): the collection's
+// full membership with per-row visibility. RLS-invisible rows
+// (unsubscribed episode, family-lens hidden book) become Hidden cards
+// — the grid renders them as "unavailable" hint rows; episode rows
+// carry feed title + download state for the play affordance. Unknown
+// library types resolve no badge; hidden rows need none anyway.
+func BookCardsFromCollectionDetailed(rows []database.GetCollectionItemsDetailedRow, libTypes map[string]string) []BookInfo {
+	cards := make([]BookInfo, 0, len(rows))
+	for _, r := range rows {
+		if !r.Visible {
+			cards = append(cards, BookInfo{
+				MediaItemID: uuid.UUID(r.MediaItemID.Bytes).String(),
+				Hidden:      true,
+			})
+			continue
+		}
+		isEpisode := r.Source.String == "podcast_episode"
+		card := buildBookCard(cardSource{
+			ID:          uuid.UUID(r.MediaItemID.Bytes),
+			Title:       utils.PgTextString(r.Title),
+			Author:      utils.PgTextString(r.Author),
+			CoverPath:   r.CoverImagePath,
+			FormatGroup: r.FormatGroup.String,
+		})
+		card.IsEpisode = isEpisode
+		card.FeedTitle = r.FeedTitle.String
+		card.DownloadState = r.DownloadState.String
+		cards = append(cards, card)
+	}
+	return cards
+}
+
 // BookCardsFromUnified builds cards from search-unified rows. Those
 // rows carry the library type name as a SQL column, so this adapter
 // needs no LibraryTypeMap query at all — and the viewer's own

internal/handlers/collections.go

@@ -9,7 +9,6 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"strconv"
 	"strings"
 	"time"
 
@@ -26,32 +25,128 @@ type CollectionHandler struct {
 	connManager       *wsync.ConnectionManager
 }
 
-func NewCollectionHandler(db *database.Queries, libraryService *services.LibraryService, connManager *wsync.ConnectionManager) *CollectionHandler {
+func NewCollectionHandler(db *database.Queries, libraryService *services.LibraryService, connManager *wsync.ConnectionManager, search ...*services.SearchService) *CollectionHandler {
 	return &CollectionHandler{
 		db:                db,
-		collectionService: services.NewCollectionService(db),
+		collectionService: services.NewCollectionService(db, search...),
 		libraryService:    libraryService,
 		connManager:       connManager,
 	}
 }
 
 type CreateCollectionRequest struct {
-	Name            string                 `form:"name" json:"name" validate:"required"`
-	Description     string                 `form:"description" json:"description"`
-	Color           string                 `form:"color" json:"color"`
-	Icon            string                 `form:"icon" json:"icon"`
-	CollectionType  string                 `form:"collection_type" json:"collection_type"` // "static" (default) or "smart" (rule-based)
-	AutoAssignRules []services.Rule        `form:"auto_assign_rules" json:"auto_assign_rules"`
+	Name           string `form:"name" json:"name" validate:"required"`
+	Description    string `form:"description" json:"description"`
+	Color          string `form:"color" json:"color"`
+	Icon           string `form:"icon" json:"icon"`
+	CollectionType string `form:"collection_type" json:"collection_type"` // "static" (default) or "smart"
+	// Custom-section builder payload (adapted 2026-10-31): the page
+	// posts the legacy rules vocabulary — rules as a JSON-encoded array
+	// (a string), a match_type select, hand-picked book ids, and the
+	// dashboard pin. The server converts rules → filter tree at write
+	// time and attaches the manual picks; storage stays tree-only.
+	AutoAssignRules json.RawMessage        `json:"auto_assign_rules"`
+	MatchType       string                 `json:"match_type"`
+	ManualBookIDs   []string               `json:"manual_book_ids"`
+	LibraryID       string                 `json:"library_id"` // selection context only — not stored
+	ShowOnDashboard bool                   `json:"show_on_dashboard"`
 	ViewSettings    map[string]interface{} `form:"view_settings" json:"view_settings"`
+	// The unified filter tree (item 3.2): when present the collection's
+	// smart membership runs through the qf engine. INVALID trees are a
+	// 400 (ParseFilterTree at the handler); a tree supersedes
+	// auto_assign_rules. Persisted as-is (any). RawMessage for
+	// round-trip safety. JSON bodies bind FilterTree; FORM bodies
+	// (the create modal's urlencoded hx-post) bind FilterTreeForm —
+	// echo's binder cannot set an any-typed field from a form string
+	// (the create-modal seed POST 400'd "invalid request" on it,
+	// 2026-10-31).
+	FilterTree any `json:"filter_tree"`
+	// FilterTreeForm mirrors filter_tree for application/x-www-form-
+	// urlencoded submissions: the raw JSON as a string, validated by
+	// the same parseRequestFilterTree path.
+	FilterTreeForm string `form:"filter_tree"`
+}
+
+// parseBuilderRules decodes the custom-section builder's rules payload:
+// the page posts JSON.stringify(rules) — a JSON string CONTAINING the
+// array (it has done so since the page was written, 2026-02-19) — while
+// JSON clients may post the array directly. Null/empty = no rules.
+func parseBuilderRules(raw json.RawMessage) ([]services.Rule, error) {
+	if len(raw) == 0 || string(raw) == "null" {
+		return nil, nil
+	}
+	var rules []services.Rule
+	if raw[0] == '"' {
+		var encoded string
+		if err := json.Unmarshal(raw, &encoded); err != nil {
+			return nil, err
+		}
+		if strings.TrimSpace(encoded) == "" {
+			return nil, nil
+		}
+		return rules, json.Unmarshal([]byte(encoded), &rules)
+	}
+	return rules, json.Unmarshal(raw, &rules)
+}
+
+// treeFilterJSON returns the request's filter tree as JSON storage
+// bytes (nil when none): object payloads marshal; strings (a legacy
+// double-encoded client, the custom-section builder's known bug class)
+// are written verbatim after object-attempt.
+func treeFilterJSON(payload any) ([]byte, error) {
+	switch v := payload.(type) {
+	case nil:
+		return nil, nil
+	case map[string]interface{}:
+		b, err := json.Marshal(v)
+		if err != nil {
+			return nil, err
+		}
+		return b, nil
+	case string:
+		return []byte(v), nil
+	default:
+		return nil, fmt.Errorf("filter_tree must be an object")
+	}
+}
+
+// parseRequestFilterTree validates the request's tree against the
+// engine grammar (ParseFilterTree) so an invalid tree is a 400, never
+// a stored 500 at render time.
+func parseRequestFilterTree(payload any) ([]byte, error) {
+	b, err := treeFilterJSON(payload)
+	if err != nil || b == nil {
+		return b, err
+	}
+	if _, err := services.ParseFilterTree(string(b)); err != nil {
+		return nil, fmt.Errorf("invalid filter_tree: %w", err)
+	}
+	return b, nil
+}
+
+// resolveTreePayload — the tree payload from either transport: JSON
+// bodies carry the object in FilterTree, form bodies (the create
+// modal's urlencoded hx-post) the raw JSON string in FilterTreeForm.
+func resolveTreePayload(jsonTree any, formTree string) any {
+	if formTree != "" {
+		return formTree
+	}
+	return jsonTree
 }
 
 type UpdateCollectionRequest struct {
-	Name            string                 `form:"name" json:"name" validate:"required"`
-	Description     string                 `form:"description" json:"description"`
-	Color           string                 `form:"color" json:"color"`
-	Icon            string                 `form:"icon" json:"icon"`
-	AutoAssignRules []services.Rule        `form:"auto_assign_rules" json:"auto_assign_rules"`
-	ViewSettings    map[string]interface{} `form:"view_settings" json:"view_settings"`
+	Name string `form:"name" json:"name" validate:"required"`
+	// The unified filter tree (item 3.2): when present the collection's
+	// smart membership runs through the qf engine. INVALID trees are a
+	// 400 (ParseFilterTree at the handler). JSON bodies bind FilterTree; form bodies bind
+	// FilterTreeForm (echo's binder cannot set an any-typed field from
+	// a form string — see CreateCollectionRequest).
+	FilterTree     any                    `json:"filter_tree"`
+	FilterTreeForm string                 `form:"filter_tree"`
+	Description    string                 `form:"description" json:"description"`
+	Color          string                 `form:"color" json:"color"`
+	Icon           string                 `form:"icon" json:"icon"`
+	ViewSettings   map[string]interface{} `form:"view_settings" json:"view_settings"`
 	// A2c §3.3: playlist toggles — merged into view_settings server-side
 	// (nil = untouched). []string because the form posts a hidden "false"
 	// sibling next to the checkbox; the LAST value wins. JSON clients may
@@ -89,15 +184,14 @@ type DeviceMappingSummary struct {
 // CollectionSummary is one entry in GET /api/collections. Package-level so
 // the docs schema registry (internal/docs) can pin the response shape.
 type CollectionSummary struct {
-	ID              uuid.UUID       `json:"id"`
-	Name            string          `json:"name"`
-	Description     string          `json:"description"`
-	Color           string          `json:"color"`
-	Icon            string          `json:"icon"`
-	AutoAssignRules json.RawMessage `json:"auto_assign_rules"`
-	CreatedAt       string          `json:"created_at"`
-	BookCount       int             `json:"book_count"`
-	IsSmart         bool            `json:"is_smart"`
+	ID          uuid.UUID `json:"id"`
+	Name        string    `json:"name"`
+	Description string    `json:"description"`
+	Color       string    `json:"color"`
+	Icon        string    `json:"icon"`
+	CreatedAt   string    `json:"created_at"`
+	BookCount   int       `json:"book_count"`
+	IsSmart     bool      `json:"is_smart"`
 }
 
 // BookCollectionSummary is one entry in GET /api/collections/:id/books —
@@ -138,6 +232,55 @@ func (h *CollectionHandler) CreateCollection(c *echo.Context) error {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
 	}
 
+	// Custom-section builder adapter: convert the posted rules to a
+	// filter tree at WRITE time (the save-fix — the page's payload had
+	// never once bound successfully before this).
+	builderRules, rulesErr := parseBuilderRules(req.AutoAssignRules)
+	if rulesErr != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "auto_assign_rules: " + rulesErr.Error()})
+	}
+	matchMode := req.MatchType
+	if matchMode != services.RuleMatchAll && matchMode != services.RuleMatchAny {
+		matchMode = services.RuleMatchAny
+	}
+	treeJSON, treeErr := parseRequestFilterTree(resolveTreePayload(req.FilterTree, req.FilterTreeForm))
+	if treeErr != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": treeErr.Error()})
+	}
+	if treeJSON == nil && len(builderRules) > 0 {
+		tree, cerr := services.RulesToFilterTree(builderRules, matchMode)
+		if cerr != nil {
+			return c.JSON(http.StatusBadRequest, map[string]string{"error": "section rule: " + cerr.Error()})
+		}
+		b, merr := json.Marshal(tree)
+		if merr != nil {
+			return c.JSON(http.StatusInternalServerError, map[string]string{"error": merr.Error()})
+		}
+		// The strict-parse guarantee holds for converted trees too: an
+		// invalid tree is a 400 at write, never a stored 500 at render.
+		if _, verr := services.ParseFilterTree(string(b)); verr != nil {
+			return c.JSON(http.StatusBadRequest, map[string]string{"error": "section rule: " + verr.Error()})
+		}
+		treeJSON = b
+	}
+	// New podcast smart collections are BORN with the reversed listening
+	// default (2026-11-01 user request): seed chain_order into
+	// view_settings at creation — the dropdown shows "Feed order
+	// (reversed)" selected and the chain/page machinery reads the stored
+	// value exactly as if picked. Episodes-scope trees only (books have
+	// no episode chain); merge semantics never clobber a value the
+	// request itself sent; existing collections are untouched.
+	if treeJSON != nil {
+		if t, perr := services.ParseFilterTree(string(treeJSON)); perr == nil &&
+			t.FilterScope() == services.ScopeEpisodes {
+			if req.ViewSettings == nil {
+				req.ViewSettings = map[string]interface{}{}
+			}
+			if _, exists := req.ViewSettings["chain_order"]; !exists {
+				req.ViewSettings["chain_order"] = "reverse"
+			}
+		}
+	}
 	collection, err := h.collectionService.CreateCollection(
 		c.Request().Context(),
 		userUUID,
@@ -145,8 +288,9 @@ func (h *CollectionHandler) CreateCollection(c *echo.Context) error {
 		req.Description,
 		req.Color,
 		req.Icon,
-		req.AutoAssignRules,
 		req.ViewSettings,
+		req.ShowOnDashboard,
+		treeJSON,
 	)
 	if err != nil {
 		if errors.Is(err, services.ErrCollectionNameTaken) {
@@ -155,20 +299,30 @@ func (h *CollectionHandler) CreateCollection(c *echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
 	}
 
+	// Manual picks: a section = rules + hand-picked books. Attach after
+	// create; unparsable ids are skipped (same leniency as AddBooks).
+	for _, bookIDStr := range req.ManualBookIDs {
+		bookID, perr := uuid.Parse(bookIDStr)
+		if perr != nil {
+			continue
+		}
+		_ = h.collectionService.AddBookToCollection(c.Request().Context(),
+			uuid.UUID(collection.ID.Bytes), bookID, userUUID)
+	}
+
 	bookCount := int32(0)
-	isSmart := req.CollectionType == "smart" || len(req.AutoAssignRules) > 0
+	isSmart := req.CollectionType == "smart" || treeJSON != nil
 	response := map[string]interface{}{
-		"id":                uuid.UUID(collection.ID.Bytes).String(),
-		"user_id":           uuid.UUID(collection.UserID.Bytes).String(),
-		"name":              collection.Name,
-		"description":       utils.PgTextString(collection.Description),
-		"color":             utils.PgTextString(collection.Color),
-		"icon":              utils.PgTextString(collection.Icon),
-		"collection_type":   map[bool]string{true: "smart", false: "static"}[isSmart],
-		"auto_assign_rules": collection.AutoAssignRules,
-		"view_settings":     collection.ViewSettings,
-		"book_count":        bookCount,
-		"created_at":        collection.CreatedAt.Time.String(),
+		"id":              uuid.UUID(collection.ID.Bytes).String(),
+		"user_id":         uuid.UUID(collection.UserID.Bytes).String(),
+		"name":            collection.Name,
+		"description":     utils.PgTextString(collection.Description),
+		"color":           utils.PgTextString(collection.Color),
+		"icon":            utils.PgTextString(collection.Icon),
+		"collection_type": map[bool]string{true: "smart", false: "static"}[isSmart],
+		"view_settings":   collection.ViewSettings,
+		"book_count":      bookCount,
+		"created_at":      collection.CreatedAt.Time.String(),
 	}
 
 	// Add redirect header for HTMX requests
@@ -197,7 +351,7 @@ func (h *CollectionHandler) GetCollections(c *echo.Context) error {
 
 	response := make([]CollectionSummary, 0, len(collections))
 	for _, col := range collections {
-		isSmart := h.collectionService.IsSmartCollection(col.AutoAssignRules)
+		isSmart := services.IsCollectionSmart(col)
 		if !includeAuto && isSmart {
 			// Legacy default for API clients (the Android app pre-dates
 			// smart collections): rule-driven collections stay opt-in so
@@ -213,12 +367,12 @@ func (h *CollectionHandler) GetCollections(c *echo.Context) error {
 			}
 		}
 		if isSmart {
-			rules := h.collectionService.ParseRules(col.AutoAssignRules)
 			visibleIDs, visErr := h.userVisibleLibraryIDs(c)
 			if visErr == nil {
-				matches, evalErr := h.collectionService.EvaluateSmartCollection(c.Request().Context(), rules, services.SmartEvalOptions{
-					LibraryID:  libUUID,
-					VisibleIDs: visibleIDs,
+				matches, evalErr := h.collectionService.EvaluateSmartMembership(c.Request().Context(), col, services.SmartEvalOptions{
+					LibraryID:    libUUID,
+					VisibleIDs:   visibleIDs,
+					ViewerUserID: MustGetAuthenticatedUser(c).ID,
 				})
 				if evalErr == nil {
 					bookCount = len(matches)
@@ -235,15 +389,14 @@ func (h *CollectionHandler) GetCollections(c *echo.Context) error {
 		}
 
 		response = append(response, CollectionSummary{
-			ID:              col.ID.Bytes,
-			Name:            col.Name,
-			Description:     utils.PgTextString(col.Description),
-			Color:           utils.PgTextString(col.Color),
-			Icon:            utils.PgTextString(col.Icon),
-			AutoAssignRules: col.AutoAssignRules,
-			CreatedAt:       col.CreatedAt.Time.String(),
-			BookCount:       bookCount,
-			IsSmart:         isSmart,
+			ID:          col.ID.Bytes,
+			Name:        col.Name,
+			Description: utils.PgTextString(col.Description),
+			Color:       utils.PgTextString(col.Color),
+			Icon:        utils.PgTextString(col.Icon),
+			CreatedAt:   col.CreatedAt.Time.String(),
+			BookCount:   bookCount,
+			IsSmart:     isSmart,
 		})
 	}
 
@@ -286,17 +439,17 @@ func (h *CollectionHandler) GetCollection(c *echo.Context) error {
 		libUUID = pgtype.UUID{Bytes: parsed, Valid: true}
 	}
 
-	isSmart := h.collectionService.IsSmartCollection(collection.AutoAssignRules)
+	isSmart := services.IsCollectionSmart(collection)
 	libTypes := LibraryTypeMap(c.Request().Context(), h.db)
 	if isSmart {
-		rules := h.collectionService.ParseRules(collection.AutoAssignRules)
 		visibleIDs, err := h.userVisibleLibraryIDs(c)
 		if err != nil {
 			return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
 		}
-		matches, evalErr := h.collectionService.EvaluateSmartCollection(c.Request().Context(), rules, services.SmartEvalOptions{
-			LibraryID:  libUUID,
-			VisibleIDs: visibleIDs,
+		matches, evalErr := h.collectionService.EvaluateSmartMembership(c.Request().Context(), collection, services.SmartEvalOptions{
+			LibraryID:    libUUID,
+			VisibleIDs:   visibleIDs,
+			ViewerUserID: MustGetAuthenticatedUser(c).ID,
 		})
 		if evalErr != nil {
 			return c.JSON(http.StatusInternalServerError, map[string]string{"error": evalErr.Error()})
@@ -305,7 +458,7 @@ func (h *CollectionHandler) GetCollection(c *echo.Context) error {
 	} else if collection.IsSystemCollection.Bool && collection.QueryType.Valid && collection.QueryType.String != "" && collection.QueryType.String != "filter" {
 		user := c.Get("user").(database.Users)
 		userUUID := uuid.UUID(user.ID.Bytes)
-		dashboardSvc := services.NewDashboardService(h.db)
+		dashboardSvc := services.NewDashboardService(h.db, h.collectionService.Search())
 		sections, secErr := dashboardSvc.GetDashboardSections(c.Request().Context(), userUUID, libUUID, 1000, []string{}, []string{})
 		if secErr != nil {
 			return c.JSON(http.StatusInternalServerError, map[string]string{"error": secErr.Error()})
@@ -403,19 +556,19 @@ func (h *CollectionHandler) GetCollection(c *echo.Context) error {
 	}
 
 	return c.JSON(http.StatusOK, map[string]interface{}{
-		"id":                uuid.UUID(collection.ID.Bytes).String(),
-		"user_id":           uuid.UUID(collection.UserID.Bytes).String(),
-		"name":              collection.Name,
-		"description":       utils.PgTextString(collection.Description),
-		"color":             utils.PgTextString(collection.Color),
-		"icon":              utils.PgTextString(collection.Icon),
-		"auto_assign_rules": json.RawMessage(collection.AutoAssignRules),
-		"view_settings":     viewSettings,
-		"books":             bookList,
-		"book_count":        len(bookList),
-		"is_smart":          isSmart,
-		"up_next":           upNext,
-		"created_at":        collection.CreatedAt.Time.String(),
+		"id":            uuid.UUID(collection.ID.Bytes).String(),
+		"user_id":       uuid.UUID(collection.UserID.Bytes).String(),
+		"name":          collection.Name,
+		"description":   utils.PgTextString(collection.Description),
+		"color":         utils.PgTextString(collection.Color),
+		"icon":          utils.PgTextString(collection.Icon),
+		"view_settings": viewSettings,
+		"filter_tree":   treeEnvelope(collection.FilterTree),
+		"books":         bookList,
+		"book_count":    len(bookList),
+		"is_smart":      isSmart,
+		"up_next":       upNext,
+		"created_at":    collection.CreatedAt.Time.String(),
 	})
 }
 
@@ -450,6 +603,31 @@ func (h *CollectionHandler) UpdateCollection(c *echo.Context) error {
 		req.ViewSettings["show_up_next"] = *v
 	}
 
+	treeJSON, treeErr := parseRequestFilterTree(resolveTreePayload(req.FilterTree, req.FilterTreeForm))
+	if treeErr != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": treeErr.Error()})
+	}
+	// Applying a tree to a collection with NO curated listening order
+	// seeds the reversed default (2026-11-01 — the creation seed's twin):
+	// a static collection becoming smart lands with the same default a
+	// born-smart one gets. Triple-guarded: the client's explicit
+	// chain_order wins, a STORED chain_order is never clobbered, and
+	// only episodes-scope trees seed (books have no episode chain).
+	if treeJSON != nil && (req.ViewSettings == nil || req.ViewSettings["chain_order"] == nil) {
+		if t, perr := services.ParseFilterTree(string(treeJSON)); perr == nil &&
+			t.FilterScope() == services.ScopeEpisodes {
+			if existing, gerr := h.collectionService.GetCollection(c.Request().Context(), collectionID); gerr == nil {
+				var stored map[string]interface{}
+				_ = json.Unmarshal(existing.ViewSettings, &stored)
+				if stored == nil || stored["chain_order"] == nil {
+					if req.ViewSettings == nil {
+						req.ViewSettings = map[string]interface{}{}
+					}
+					req.ViewSettings["chain_order"] = "reverse"
+				}
+			}
+		}
+	}
 	collection, err := h.collectionService.UpdateCollection(
 		c.Request().Context(),
 		collectionID,
@@ -457,23 +635,28 @@ func (h *CollectionHandler) UpdateCollection(c *echo.Context) error {
 		req.Description,
 		req.Color,
 		req.Icon,
-		req.AutoAssignRules,
 		req.ViewSettings,
+		treeJSON,
 	)
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			// Collections RLS: another user's collection is INVISIBLE —
+			// the update touched no rows. Answer 404, not a 500 that
+			// reads like a bug (2026-10-31 collections RLS).
+			return c.JSON(http.StatusNotFound, map[string]string{"error": "collection not found"})
+		}
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
 	}
 
 	response := map[string]interface{}{
-		"id":                uuid.UUID(collection.ID.Bytes).String(),
-		"user_id":           uuid.UUID(collection.UserID.Bytes).String(),
-		"name":              collection.Name,
-		"description":       utils.PgTextString(collection.Description),
-		"color":             utils.PgTextString(collection.Color),
-		"icon":              utils.PgTextString(collection.Icon),
-		"auto_assign_rules": json.RawMessage(collection.AutoAssignRules),
-		"view_settings":     json.RawMessage(collection.ViewSettings),
-		"created_at":        collection.CreatedAt.Time.String(),
+		"id":            uuid.UUID(collection.ID.Bytes).String(),
+		"user_id":       uuid.UUID(collection.UserID.Bytes).String(),
+		"name":          collection.Name,
+		"description":   utils.PgTextString(collection.Description),
+		"color":         utils.PgTextString(collection.Color),
+		"icon":          utils.PgTextString(collection.Icon),
+		"view_settings": json.RawMessage(collection.ViewSettings),
+		"created_at":    collection.CreatedAt.Time.String(),
 	}
 
 	// Add redirect header for HTMX requests
@@ -484,6 +667,99 @@ func (h *CollectionHandler) UpdateCollection(c *echo.Context) error {
 	return c.JSON(http.StatusCreated, response)
 }
 
+// ValidChainOrders — the collection chain's listening-order vocabulary
+// (plan §10 R2: a collection's playback order is CURATED on the
+// collection, not a player-side knob). Mirrors OrderEpisodes' orders;
+// "" means native (the pre-chain-order default).
+var ValidChainOrders = map[string]bool{"": true, "native": true, "newest": true, "oldest": true, "reverse": true}
+
+// CollectionChainOrder resolves a collection row's curated chain order
+// from its view_settings JSONB — "" (native) when absent/unknown. The
+// episode chain producer routes OrderEpisodes through this; the
+// view-settings PUT writes the key (SetCollectionChainOrder).
+func CollectionChainOrder(viewSettings []byte) string {
+	if len(viewSettings) == 0 {
+		return ""
+	}
+	var vs map[string]interface{}
+	if json.Unmarshal(viewSettings, &vs) != nil {
+		return ""
+	}
+	if s, ok := vs["chain_order"].(string); ok && ValidChainOrders[s] {
+		return s
+	}
+	return ""
+}
+
+// SetCollectionChainOrder — PUT /api/collections/:id/view-settings with
+// {"chain_order": "..."}: merges the key into the collection's stored
+// view_settings (the playlist toggles share that JSONB — a blind write
+// would clobber them). The episode chain producer
+// (buildSmartCollectionSequenceContext) honors it.
+func (h *CollectionHandler) SetCollectionChainOrder(c *echo.Context) error {
+	collectionID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid collection id"})
+	}
+
+	var req struct {
+		ChainOrder string `json:"chain_order"`
+	}
+	if err := c.Bind(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
+	}
+	if !ValidChainOrders[req.ChainOrder] {
+		return c.JSON(http.StatusBadRequest, map[string]string{
+			"error": "chain_order must be one of: native, newest, oldest, reverse"})
+	}
+
+	collection, err := h.collectionService.GetCollection(c.Request().Context(), collectionID)
+	if err != nil {
+		return c.JSON(http.StatusNotFound, map[string]string{"error": "collection not found"})
+	}
+	// Same owner gate as the sibling config mutation (ReorderItems) —
+	// my endpoint writes the row, so it must not let a non-owner flip
+	// someone else's chain order.
+	if u, ok := c.Get("user").(database.Users); ok {
+		owns, err := h.collectionService.UserOwnsCollection(c.Request().Context(), collectionID, uuid.UUID(u.ID.Bytes))
+		if err != nil || !owns {
+			return c.JSON(http.StatusForbidden, map[string]string{"error": "only the collection owner can change it"})
+		}
+	} else {
+		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "no user in context"})
+	}
+
+	settings := map[string]interface{}{}
+	if len(collection.ViewSettings) > 0 {
+		if uerr := json.Unmarshal(collection.ViewSettings, &settings); uerr != nil {
+			return c.JSON(http.StatusInternalServerError, map[string]string{"error": "corrupt view_settings"})
+		}
+	}
+	if req.ChainOrder == "" || req.ChainOrder == "native" {
+		// Both spellings mean the default — drop the key entirely so the
+		// stored doc stays clean.
+		delete(settings, "chain_order")
+	} else {
+		settings["chain_order"] = req.ChainOrder
+	}
+	blob, err := json.Marshal(settings)
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+	}
+	if err := h.db.UpdateCollectionViewSettings(c.Request().Context(), database.UpdateCollectionViewSettingsParams{
+		ID:           pgtype.UUID{Bytes: collectionID, Valid: true},
+		ViewSettings: blob,
+	}); err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+	}
+
+	return c.JSON(http.StatusOK, map[string]interface{}{
+		"id":            uuid.UUID(collection.ID.Bytes).String(),
+		"chain_order":   req.ChainOrder,
+		"view_settings": settings,
+	})
+}
+
 func (h *CollectionHandler) DeleteCollection(c *echo.Context) error {
 	collectionID, err := uuid.Parse(c.Param("id"))
 	if err != nil {
@@ -851,278 +1127,25 @@ func (h *CollectionHandler) rejectSmartMutation(c *echo.Context, collectionID uu
 	if err != nil {
 		return echo.NewHTTPError(http.StatusNotFound, "collection not found")
 	}
-	if h.collectionService.IsSmartCollection(collection.AutoAssignRules) {
-		return echo.NewHTTPError(http.StatusBadRequest, "smart collections are rule-based — membership is managed by the collection's rules, not by hand")
+	if services.IsCollectionSmart(collection) {
+		return echo.NewHTTPError(http.StatusBadRequest, "smart collections are tree-based — membership is managed by the collection's filter tree, not by hand")
 	}
 	return nil
 }
 
-type AddRuleRequest struct {
-	Field    string `json:"field" validate:"required"`
-	Operator string `json:"operator" validate:"required"`
-	Value    string `json:"value" validate:"required"`
-	Enabled  *bool  `json:"enabled"`
-	Priority int    `json:"priority"`
+// treeEnvelope renders the stored filter tree for the envelope: nil
+// (static collections) serializes as null, trees as the object.
+func treeEnvelope(t []byte) any {
+	if len(t) == 0 {
+		return nil
+	}
+	var v interface{}
+	if json.Unmarshal(t, &v) == nil {
+		return v
+	}
+	return nil
 }
 
-// AddRule handles POST /api/collections/:id/rules — appends one rule to
-// the ruleset. The first rule converts a static collection to smart.
-func (h *CollectionHandler) AddRule(c *echo.Context) error {
-	collectionID, err := uuid.Parse(c.Param("id"))
-	if err != nil {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid collection id"})
-	}
-
-	collection, err := h.GetCollectionData(c, collectionID)
-	if err != nil {
-		return c.JSON(http.StatusNotFound, map[string]string{"error": "collection not found"})
-	}
-	if collection.IsSystemCollection.Bool {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": "system collections cannot have rules"})
-	}
-
-	var req AddRuleRequest
-	if err := c.Bind(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
-	}
-	if err := c.Validate(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
-	}
-
-	updated, rule, err := h.collectionService.AddRule(c.Request().Context(), collectionID, services.Rule{
-		Field:    req.Field,
-		Operator: req.Operator,
-		Value:    req.Value,
-		Enabled:  req.Enabled,
-		Priority: req.Priority,
-	})
-	if err != nil {
-		var ruleErr *services.RuleValidationError
-		if errors.As(err, &ruleErr) {
-			return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
-		}
-		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
-	}
-
-	return c.JSON(http.StatusCreated, map[string]interface{}{
-		"collection_id": uuid.UUID(updated.ID.Bytes).String(),
-		"rule":          rule,
-		"is_smart":      h.collectionService.IsSmartCollection(updated.AutoAssignRules),
-	})
-}
-
-// UpdateRule handles PUT /api/collections/:id/rules/:ruleId — currently
-// the enabled toggle; the payload may only carry {"enabled": bool}.
-func (h *CollectionHandler) UpdateRule(c *echo.Context) error {
-	collectionID, err := uuid.Parse(c.Param("id"))
-	if err != nil {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid collection id"})
-	}
-	ruleID := c.Param("ruleId")
-	if ruleID == "" {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": "rule id required"})
-	}
-
-	var req struct {
-		Enabled *bool `json:"enabled" validate:"required"`
-	}
-	if err := c.Bind(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
-	}
-	if err := c.Validate(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
-	}
-
-	updated, err := h.collectionService.SetRuleEnabled(c.Request().Context(), collectionID, ruleID, *req.Enabled)
-	if err != nil {
-		if strings.Contains(err.Error(), "rule not found") {
-			return c.JSON(http.StatusNotFound, map[string]string{"error": err.Error()})
-		}
-		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
-	}
-
-	return c.JSON(http.StatusOK, map[string]interface{}{
-		"collection_id": uuid.UUID(updated.ID.Bytes).String(),
-		"is_smart":      h.collectionService.IsSmartCollection(updated.AutoAssignRules),
-	})
-}
-
-// RemoveRule handles DELETE /api/collections/:id/rules/:ruleId.
-func (h *CollectionHandler) RemoveRule(c *echo.Context) error {
-	collectionID, err := uuid.Parse(c.Param("id"))
-	if err != nil {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid collection id"})
-	}
-	ruleID := c.Param("ruleId")
-	if ruleID == "" {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": "rule id required"})
-	}
-
-	updated, err := h.collectionService.RemoveRule(c.Request().Context(), collectionID, ruleID)
-	if err != nil {
-		if strings.Contains(err.Error(), "rule not found") {
-			return c.JSON(http.StatusNotFound, map[string]string{"error": err.Error()})
-		}
-		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
-	}
-
-	return c.JSON(http.StatusOK, map[string]interface{}{
-		"collection_id": uuid.UUID(updated.ID.Bytes).String(),
-		"is_smart":      h.collectionService.IsSmartCollection(updated.AutoAssignRules),
-	})
-}
-
-type TestRulesRequest struct {
-	Rules []map[string]interface{} `json:"rules" validate:"required"`
-}
-
-type BookMatch struct {
-	MediaItemID    string `json:"media_item_id"`
-	Title          string `json:"title"`
-	Author         string `json:"author"`
-	CoverImagePath string `json:"cover_image_path"`
-	MatchReason    string `json:"match_reason"`
-}
-
-func (h *CollectionHandler) TestRules(c *echo.Context) error {
-	var req TestRulesRequest
-	if err := c.Bind(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
-	}
-	if err := c.Validate(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
-	}
-
-	// Candidates mirror what smart collections actually evaluate against:
-	// the requester's visible libraries and live items only — the preview
-	// must not promise matches the live render will never produce.
-	visibleIDs, err := h.userVisibleLibraryIDs(c)
-	if err != nil {
-		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
-	}
-	var visibleArg []pgtype.UUID
-	if len(visibleIDs) > 0 {
-		visibleArg = visibleIDs
-	}
-	mediaItems, err := h.db.GetVisibleLiveMediaForRules(c.Request().Context(), database.GetVisibleLiveMediaForRulesParams{
-		LibraryID:         pgtype.UUID{},
-		VisibleLibraryIds: visibleArg,
-	})
-	if err != nil {
-		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to load media items"})
-	}
-
-	var matches []BookMatch
-	for _, item := range mediaItems {
-		matchReason := h.checkRulesAgainstBook(item, req.Rules)
-		if matchReason != "" {
-			author := ""
-			if item.Author.Valid {
-				author = item.Author.String
-			}
-
-			matches = append(matches, BookMatch{
-				MediaItemID:    uuid.UUID(item.ID.Bytes).String(),
-				Title:          item.Title,
-				Author:         author,
-				CoverImagePath: utils.ResolveMediaURL(item.LibraryID, item.CoverImagePath),
-				MatchReason:    matchReason,
-			})
-		}
-	}
-
-	return c.JSON(http.StatusOK, map[string]interface{}{
-		"matches": matches,
-		"total":   len(matches),
-	})
-}
-
-func (h *CollectionHandler) checkRulesAgainstBook(item database.MediaItems, rules []map[string]interface{}) string {
-	for _, rule := range rules {
-		field, _ := rule["field"].(string)
-		operator, _ := rule["operator"].(string)
-		value, _ := rule["value"].(string)
-
-		if h.evaluateRule(item, field, operator, value) {
-			return fmt.Sprintf("Matched rule: %s %s %s", field, operator, value)
-		}
-	}
-	return ""
-}
-
-func (h *CollectionHandler) evaluateRule(item database.MediaItems, field, operator, value string) bool {
-	var itemValue string
-
-	switch field {
-	case "genre":
-		if item.Genre.Valid {
-			itemValue = item.Genre.String
-		}
-	case "series":
-		if item.Series.Valid {
-			itemValue = item.Series.String
-		}
-	case "author":
-		if item.Author.Valid {
-			itemValue = item.Author.String
-		}
-	case "language":
-		if item.Language.Valid {
-			itemValue = item.Language.String
-		}
-	case "publisher":
-		if item.Publisher.Valid {
-			itemValue = item.Publisher.String
-		}
-	case "copyright_year":
-		if item.CopyrightYear.Valid {
-			itemValue = fmt.Sprintf("%d", item.CopyrightYear.Int32)
-		}
-	case "tags":
-		if len(item.Tags) > 0 {
-			itemValue = strings.Join(item.Tags, ", ")
-		}
-	}
-
-	return h.compareValues(itemValue, operator, value)
-}
-
-func (h *CollectionHandler) compareValues(itemValue, operator, ruleValue string) bool {
-	switch operator {
-	case "equals":
-		return itemValue == ruleValue
-	case "not_equals":
-		return itemValue != ruleValue
-	case "contains":
-		return strings.Contains(strings.ToLower(itemValue), strings.ToLower(ruleValue))
-	case "not_contains":
-		return !strings.Contains(strings.ToLower(itemValue), strings.ToLower(ruleValue))
-	case "starts_with":
-		return strings.HasPrefix(strings.ToLower(itemValue), strings.ToLower(ruleValue))
-	case "ends_with":
-		return strings.HasSuffix(strings.ToLower(itemValue), strings.ToLower(ruleValue))
-	case "greater_than":
-		itemNum, err1 := strconv.Atoi(itemValue)
-		ruleNum, err2 := strconv.Atoi(ruleValue)
-		if err1 != nil || err2 != nil {
-			return false
-		}
-		return itemNum > ruleNum
-	case "less_than":
-		itemNum, err1 := strconv.Atoi(itemValue)
-		ruleNum, err2 := strconv.Atoi(ruleValue)
-		if err1 != nil || err2 != nil {
-			return false
-		}
-		return itemNum < ruleNum
-	}
-	return false
-}
-
-// Bulk Operations
-
-// POST /api/collections/bulk-add-books
-// Bulk add books to multiple collections
 func (h *CollectionHandler) HandleBulkAddBooks(c *echo.Context) error {
 	user := c.Get("user").(database.Users)
 	userUUID := uuid.UUID(user.ID.Bytes)
@@ -1268,9 +1291,12 @@ func (h *CollectionHandler) PreviewCollection(c *echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "Failed to load library items"})
 	}
 
+	// Book-scope preview (the rules page remains books-first until the
+	// filter-unification pass); no viewer progress loaded here, so
+	// played/unplayed rules preview at the no-progress default.
 	var matchedItems []database.MediaItems
 	for _, item := range allItems {
-		evaluations := h.collectionService.EvaluateRules(item, req.Rules)
+		evaluations := h.collectionService.EvaluateRules(item, 0, req.Rules)
 		for _, eval := range evaluations {
 			if eval.Matches {
 				matchedItems = append(matchedItems, item)

internal/handlers/collections_chain_order_test.go

@@ -0,0 +1,30 @@
+package handlers
+
+import "testing"
+
+// The collection chain's curated order (plan §10 R2): the resolver
+// reads view_settings.chain_order, tolerates absent/corrupt docs, and
+// refuses unknown orders (they mean native).
+func TestCollectionChainOrder(t *testing.T) {
+	cases := []struct {
+		name string
+		vs   string
+		want string
+	}{
+		{"absent doc", "", ""},
+		{"empty object", `{}`, ""},
+		{"reverse", `{"chain_order":"reverse"}`, "reverse"},
+		{"newest", `{"chain_order":"newest"}`, "newest"},
+		{"merged with toggles", `{"hide_finished":true,"chain_order":"oldest"}`, "oldest"},
+		{"unknown order means native", `{"chain_order":"shuffle"}`, ""},
+		{"non-string means native", `{"chain_order":3}`, ""},
+		{"corrupt doc means native", `not json`, ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := CollectionChainOrder([]byte(tc.vs)); got != tc.want {
+				t.Fatalf("CollectionChainOrder(%s) = %q, want %q", tc.vs, got, tc.want)
+			}
+		})
+	}
+}

internal/handlers/collections_rules_test.go

@@ -1,415 +0,0 @@
-package handlers
-
-import (
-	"testing"
-
-	"bookhoard/internal/database"
-
-	"github.com/jackc/pgx/v5/pgtype"
-	"github.com/stretchr/testify/assert"
-)
-
-// Test collection rule matching with various operators
-
-func TestEvaluateRule_Equals_StringMatch(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Genre: pgtype.Text{String: "Science Fiction", Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "genre", "equals", "Science Fiction")
-	assert.True(t, result)
-}
-
-func TestEvaluateRule_Equals_NoMatch(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Genre: pgtype.Text{String: "Fantasy", Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "genre", "equals", "Science Fiction")
-	assert.False(t, result)
-}
-
-func TestEvaluateRule_NotEquals_Matches(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Genre: pgtype.Text{String: "Fantasy", Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "genre", "not_equals", "Science Fiction")
-	assert.True(t, result)
-}
-
-func TestEvaluateRule_NotEquals_NoMatch(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Genre: pgtype.Text{String: "Science Fiction", Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "genre", "not_equals", "Science Fiction")
-	assert.False(t, result)
-}
-
-func TestEvaluateRule_Contains_Matches(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Author: pgtype.Text{String: "Isaac Asimov", Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "author", "contains", "asimov")
-	assert.True(t, result)
-}
-
-func TestEvaluateRule_Contains_NoMatch(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Author: pgtype.Text{String: "Isaac Asimov", Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "author", "contains", "clarke")
-	assert.False(t, result)
-}
-
-func TestEvaluateRule_NotContains_Matches(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Author: pgtype.Text{String: "Isaac Asimov", Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "author", "not_contains", "clarke")
-	assert.True(t, result)
-}
-
-func TestEvaluateRule_StartsWith_Matches(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Series: pgtype.Text{String: "Foundation", Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "series", "starts_with", "Foun")
-	assert.True(t, result)
-}
-
-func TestEvaluateRule_StartsWith_NoMatch(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Series: pgtype.Text{String: "Foundation", Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "series", "starts_with", "Robots")
-	assert.False(t, result)
-}
-
-func TestEvaluateRule_EndsWith_Matches(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Series: pgtype.Text{String: "Foundation", Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "series", "ends_with", "tion")
-	assert.True(t, result)
-}
-
-func TestEvaluateRule_GreaterThan_Matches(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		CopyrightYear: pgtype.Int4{Int32: 2021, Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "copyright_year", "greater_than", "2000")
-	assert.True(t, result)
-}
-
-func TestEvaluateRule_GreaterThan_NoMatch(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		CopyrightYear: pgtype.Int4{Int32: 1999, Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "copyright_year", "greater_than", "2000")
-	assert.False(t, result)
-}
-
-func TestEvaluateRule_LessThan_Matches(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		CopyrightYear: pgtype.Int4{Int32: 1999, Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "copyright_year", "less_than", "2000")
-	assert.True(t, result)
-}
-
-func TestEvaluateRule_LessThan_NoMatch(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		CopyrightYear: pgtype.Int4{Int32: 2021, Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "copyright_year", "less_than", "2000")
-	assert.False(t, result)
-}
-
-func TestEvaluateRule_NullField(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Genre: pgtype.Text{Valid: false}, // NULL
-	}
-
-	result := handler.evaluateRule(item, "genre", "equals", "Science Fiction")
-	assert.False(t, result, "Should return false for NULL fields")
-}
-
-func TestCompareValues_CaseInsensitive(t *testing.T) {
-	handler := &CollectionHandler{}
-
-	result := handler.compareValues("Science Fiction", "contains", "science fiction")
-	assert.True(t, result, "Contains should be case-insensitive")
-
-	result = handler.compareValues("Science Fiction", "contains", "SCIENCE FICTION")
-	assert.True(t, result)
-}
-
-func TestCompareValues_EmptyString(t *testing.T) {
-	handler := &CollectionHandler{}
-
-	result := handler.compareValues("", "contains", "test")
-	assert.False(t, result, "Empty string should not contain anything")
-
-	result = handler.compareValues("test", "contains", "")
-	assert.True(t, result, "Non-empty string contains empty string")
-}
-
-func TestCompareValues_NumericEdgeCases(t *testing.T) {
-	handler := &CollectionHandler{}
-
-	result := handler.compareValues("0", "greater_than", "-1")
-	assert.True(t, result)
-
-	result = handler.compareValues("9999", "less_than", "10000")
-	assert.True(t, result)
-}
-
-// Test rule checking with multiple rules
-
-func TestCheckRulesAgainstBook_MatchesFirstRule(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Genre: pgtype.Text{String: "Science Fiction", Valid: true},
-	}
-
-	rules := []map[string]interface{}{
-		{
-			"field":    "genre",
-			"operator": "equals",
-			"value":    "Science Fiction",
-		},
-		{
-			"field":    "author",
-			"operator": "contains",
-			"value":    "Asimov",
-		},
-	}
-
-	reason := handler.checkRulesAgainstBook(item, rules)
-	assert.NotEmpty(t, reason, "Should match at least one rule")
-	assert.Contains(t, reason, "genre")
-}
-
-func TestCheckRulesAgainstBook_MatchesSecondRule(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Genre:         pgtype.Text{String: "Fantasy", Valid: true},
-		Author:        pgtype.Text{String: "Isaac Asimov", Valid: true},
-		CopyrightYear: pgtype.Int4{Int32: 2021, Valid: true},
-	}
-
-	rules := []map[string]interface{}{
-		{
-			"field":    "genre",
-			"operator": "equals",
-			"value":    "Science Fiction",
-		},
-		{
-			"field":    "author",
-			"operator": "contains",
-			"value":    "Asimov",
-		},
-	}
-
-	reason := handler.checkRulesAgainstBook(item, rules)
-	assert.NotEmpty(t, reason, "Should match second rule")
-	assert.Contains(t, reason, "author")
-}
-
-func TestCheckRulesAgainstBook_NoMatches(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Genre:         pgtype.Text{String: "Mystery", Valid: true},
-		Author:        pgtype.Text{String: "Agatha Christie", Valid: true},
-		CopyrightYear: pgtype.Int4{Int32: 1950, Valid: true},
-	}
-
-	rules := []map[string]interface{}{
-		{
-			"field":    "genre",
-			"operator": "equals",
-			"value":    "Science Fiction",
-		},
-		{
-			"field":    "author",
-			"operator": "contains",
-			"value":    "Asimov",
-		},
-	}
-
-	reason := handler.checkRulesAgainstBook(item, rules)
-	assert.Empty(t, reason, "Should not match any rules")
-}
-
-func TestCheckRulesAgainstBook_EmptyRules(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Genre: pgtype.Text{String: "Science Fiction", Valid: true},
-	}
-
-	rules := []map[string]interface{}{}
-
-	reason := handler.checkRulesAgainstBook(item, rules)
-	assert.Empty(t, reason, "Empty rules should return empty reason")
-}
-
-// Test complex rule scenarios
-
-func TestComplexRule_MultipleConditions(t *testing.T) {
-	handler := &CollectionHandler{}
-
-	// Book: "Foundation" by Isaac Asimov, Sci-Fi, 1951
-	item := database.MediaItems{
-		Title:         "Foundation",
-		Author:        pgtype.Text{String: "Isaac Asimov", Valid: true},
-		Genre:         pgtype.Text{String: "Science Fiction", Valid: true},
-		CopyrightYear: pgtype.Int4{Int32: 1951, Valid: true},
-		Series:        pgtype.Text{String: "Foundation", Valid: true},
-	}
-
-	tests := []struct {
-		name     string
-		field    string
-		operator string
-		value    string
-		expected bool
-	}{
-		{
-			name:     "Match genre exactly",
-			field:    "genre",
-			operator: "equals",
-			value:    "Science Fiction",
-			expected: true,
-		},
-		{
-			name:     "Match author substring",
-			field:    "author",
-			operator: "contains",
-			value:    "asimov",
-			expected: true,
-		},
-		{
-			name:     "Match year greater than",
-			field:    "copyright_year",
-			operator: "greater_than",
-			value:    "1950",
-			expected: true,
-		},
-		{
-			name:     "Match year less than",
-			field:    "copyright_year",
-			operator: "less_than",
-			value:    "2000",
-			expected: true,
-		},
-		{
-			name:     "Match series starts with",
-			field:    "series",
-			operator: "starts_with",
-			value:    "Found",
-			expected: true,
-		},
-		{
-			name:     "Match series ends with",
-			field:    "series",
-			operator: "ends_with",
-			value:    "tion",
-			expected: true,
-		},
-		{
-			name:     "No match for genre",
-			field:    "genre",
-			operator: "equals",
-			value:    "Fantasy",
-			expected: false,
-		},
-		{
-			name:     "No match for author",
-			field:    "author",
-			operator: "contains",
-			value:    "Tolkien",
-			expected: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := handler.evaluateRule(item, tt.field, tt.operator, tt.value)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// Test edge cases and error handling
-
-func TestEvaluateRule_InvalidOperator(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Genre: pgtype.Text{String: "Science Fiction", Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "genre", "invalid_operator", "Science Fiction")
-	assert.False(t, result, "Invalid operator should return false")
-}
-
-func TestEvaluateRule_NonExistentField(t *testing.T) {
-	handler := &CollectionHandler{}
-	item := database.MediaItems{
-		Genre: pgtype.Text{String: "Science Fiction", Valid: true},
-	}
-
-	result := handler.evaluateRule(item, "nonexistent_field", "equals", "value")
-	assert.False(t, result, "Non-existent field should return false")
-}
-
-func TestCompareValues_InvalidOperator(t *testing.T) {
-	handler := &CollectionHandler{}
-
-	result := handler.compareValues("test", "invalid_op", "value")
-	assert.False(t, result, "Invalid comparison operator should return false")
-}
-
-func TestCompareValues_NumericConversion(t *testing.T) {
-	handler := &CollectionHandler{}
-
-	// Valid numeric strings
-	result := handler.compareValues("100", "greater_than", "99")
-	assert.True(t, result)
-
-	result = handler.compareValues("99", "less_than", "100")
-	assert.True(t, result)
-
-	// Invalid numeric strings (should return false)
-	result = handler.compareValues("abc", "greater_than", "100")
-	assert.False(t, result, "Non-numeric string should not compare as greater than")
-
-	result = handler.compareValues("100", "greater_than", "xyz")
-	assert.False(t, result, "Non-numeric value should not allow comparison")
-}

internal/handlers/collections_test.go

@@ -3,95 +3,12 @@ package handlers
 import (
 	"testing"
 
-	"bookhoard/internal/database"
 	"bookhoard/internal/utils"
 
 	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/stretchr/testify/assert"
 )
 
-func TestCompareValues_Equals(t *testing.T) {
-	handler := &CollectionHandler{}
-
-	result := handler.compareValues("Science Fiction", "equals", "Science Fiction")
-	assert.True(t, result)
-
-	result = handler.compareValues("Science Fiction", "equals", "Fantasy")
-	assert.False(t, result)
-}
-
-func TestCompareValues_Contains(t *testing.T) {
-	handler := &CollectionHandler{}
-
-	result := handler.compareValues("Isaac Asimov", "contains", "asimov")
-	assert.True(t, result)
-
-	result = handler.compareValues("Isaac Asimov", "contains", "clarke")
-	assert.False(t, result)
-}
-
-func TestCompareValues_GreaterThan(t *testing.T) {
-	handler := &CollectionHandler{}
-
-	result := handler.compareValues("2021", "greater_than", "2000")
-	assert.True(t, result)
-
-	result = handler.compareValues("1999", "greater_than", "2000")
-	assert.False(t, result)
-}
-
-func TestCompareValues_NotEquals(t *testing.T) {
-	handler := &CollectionHandler{}
-
-	result := handler.compareValues("Science Fiction", "not_equals", "Fantasy")
-	assert.True(t, result)
-
-	result = handler.compareValues("Science Fiction", "not_equals", "Science Fiction")
-	assert.False(t, result)
-}
-
-func TestEvaluateRule_Genre(t *testing.T) {
-	item := database.MediaItems{
-		Genre: pgtype.Text{String: "Science Fiction", Valid: true},
-	}
-
-	handler := &CollectionHandler{}
-
-	result := handler.evaluateRule(item, "genre", "equals", "Science Fiction")
-	assert.True(t, result)
-
-	result = handler.evaluateRule(item, "genre", "equals", "Fantasy")
-	assert.False(t, result)
-}
-
-func TestEvaluateRule_Author(t *testing.T) {
-	item := database.MediaItems{
-		Author: pgtype.Text{String: "Isaac Asimov", Valid: true},
-	}
-
-	handler := &CollectionHandler{}
-
-	result := handler.evaluateRule(item, "author", "contains", "asimov")
-	assert.True(t, result)
-
-	result = handler.evaluateRule(item, "author", "contains", "clarke")
-	assert.False(t, result)
-}
-
-func TestEvaluateRule_CopyrightYear(t *testing.T) {
-	item := database.MediaItems{
-		CopyrightYear: pgtype.Int4{Int32: 2021, Valid: true},
-	}
-
-	handler := &CollectionHandler{}
-
-	result := handler.evaluateRule(item, "copyright_year", "greater_than", "2000")
-	assert.True(t, result)
-
-	result = handler.evaluateRule(item, "copyright_year", "less_than", "2000")
-	assert.False(t, result)
-}
-
 func TestTextToString(t *testing.T) {
 	tests := []struct {
 		name     string

internal/handlers/dashboard.go

@@ -18,10 +18,10 @@ type DashboardHandler struct {
 	dashboardService *services.DashboardService
 }
 
-func NewDashboardHandler(db *database.Queries) *DashboardHandler {
+func NewDashboardHandler(db *database.Queries, search ...*services.SearchService) *DashboardHandler {
 	return &DashboardHandler{
 		db:               db,
-		dashboardService: services.NewDashboardService(db),
+		dashboardService: services.NewDashboardService(db, search...),
 	}
 }
 

internal/handlers/media.go

@@ -243,6 +243,36 @@ func NewMediaHandler(db *database.Queries, raw database.DBTX, libraryService *se
 
 // ExecuteSearch performs search and returns results with count
 // Public wrapper for shared search logic used by both JSON and HTML endpoints
+// SearchService exposes the shared search engine for SSR surfaces
+// that render a filter tree (the collection editor and bookshelf pages
+// resolve id labels through it — 2026-11-01).
+func (h *MediaHandler) SearchService() *services.SearchService { return h.searchService }
+
+// ResolveFilterLabels — GET /api/filter/labels?field=X&ids=a,b,c names
+// id-kind filter values straight from their source tables: the client
+// path that never touches a server render (applying a SAVED filter
+// from a cold bookshelf) would otherwise fall back to the suggest
+// facet, whose rows are media-constrained and label only the ids whose
+// media matches the tree's sibling rules (2026-11-01 feed repro).
+// Visibility/RLS ride the request identity, same as the SSR embed.
+func (h *MediaHandler) ResolveFilterLabels(c *echo.Context) error {
+	user := c.Get("user").(database.Users)
+	field := c.QueryParam("field")
+	if !services.IsIDValuedField(field) {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "field is not an id-valued filter field"})
+	}
+	ids := services.ParseUUIDValues(strings.Split(c.QueryParam("ids"), ","))
+	if len(ids) == 0 {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "ids required"})
+	}
+	if len(ids) > services.MaxResolveIDs {
+		ids = ids[:services.MaxResolveIDs]
+	}
+	labels := h.SearchService().ResolveFieldLabels(
+		c.Request().Context(), user.ID, field, ids)
+	return c.JSON(http.StatusOK, map[string]interface{}{"labels": labels})
+}
+
 func (h *MediaHandler) ExecuteSearch(ctx context.Context, params services.SearchParams) ([]database.SearchMediaItemsUnifiedRow, int, error) {
 	return h.searchService.ExecuteSearch(ctx, params)
 }
@@ -1881,6 +1911,17 @@ func (mh *MediaHandler) DeleteMediaItem(c *echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
 	}
 
+	// Invariant 2 (podcast plan §10, absolute form): episode rows are
+	// removed ONLY when the whole feed is removed — the feed must match
+	// its XML until then. Same segregation as the edit path (D9/D10):
+	// episodes are fetcher-owned; delete FILES via the podcast surfaces
+	// (feed page / admin podcast view) instead.
+	if media.Source == "podcast_episode" {
+		return c.JSON(http.StatusConflict, map[string]string{
+			"error": "podcast episodes are removed only by removing the whole feed — delete the episode's files instead (feed page or admin podcast view)",
+		})
+	}
+
 	// Storage-down guard (see HandleBulkDelete): refuse while the library
 	// storage is unreachable so the cascade can't destroy annotations for
 	// a file that will re-import on the next scan.
@@ -2548,6 +2589,13 @@ func ParseMediaSearchParams(c searchParamSource) services.SearchParams {
 		tree, err := services.ParseFilterTree(qf)
 		if err != nil {
 			params.FilterParseErr = err.Error()
+		} else if len(tree.Children) == 0 {
+			// A qf with no rules is not a browse query: the deep-link
+			// contract answers 400 (pinned). The empty root gained
+			// meaning only as a STORED collection seed — where the
+			// composers define it as matching nothing. As a query it
+			// would silently mean "everything", so reject at the wire.
+			params.FilterParseErr = "qf tree has no rules"
 		} else {
 			params.FilterTree = tree
 		}
@@ -3053,13 +3101,18 @@ func (mh *MediaHandler) GetAudioChapters(c *echo.Context) error {
 	// 1.0 IN the payload so the player applies it with zero extra round
 	// trips; default_playback_speed powers the dropdown's "(default)"
 	// marker. Speed is a preference, so this rides the authenticated
-	// user — anonymous readers just get 1.0.
+	// user — anonymous readers just get 1.0. The resume rewind rides
+	// the same user row (0 = exact resume).
 	playbackSpeed, defaultSpeed := 1.0, 1.0
+	resumeRewind := 0
 	if userID, ok := c.Get("user_id").(string); ok {
 		if userUUID, err := uuid.Parse(userID); err == nil {
 			userRow, err := mh.db.GetUser(c.Request().Context(), pgtype.UUID{Bytes: userUUID, Valid: true})
-			if err == nil && userRow.DefaultAudioSpeed > 0 {
-				defaultSpeed = float64(userRow.DefaultAudioSpeed)
+			if err == nil {
+				if userRow.DefaultAudioSpeed > 0 {
+					defaultSpeed = float64(userRow.DefaultAudioSpeed)
+				}
+				resumeRewind = int(userRow.AudioResumeRewindSeconds)
 			}
 			bookSpeed, err := mh.db.GetAudioPlaybackSpeed(c.Request().Context(), database.GetAudioPlaybackSpeedParams{
 				UserID:      pgtype.UUID{Bytes: userUUID, Valid: true},
@@ -3082,6 +3135,7 @@ func (mh *MediaHandler) GetAudioChapters(c *echo.Context) error {
 		"tracks":                 tracks,
 		"playback_speed":         playbackSpeed,
 		"default_playback_speed": defaultSpeed,
+		"resume_rewind_seconds":  resumeRewind,
 	})
 }
 

internal/handlers/podcast.go

@@ -9,7 +9,7 @@ package handlers
 import (
 	"context"
 	"encoding/json"
-	"fmt"
+	"log"
 	"sort"
 
 	"bookhoard/internal/database"
@@ -38,8 +38,11 @@ type PodcastHandler struct {
 // EpisodeListRenderer renders the post-action episode list for an htmx
 // request. includePolicySelect additionally out-of-band-swaps the
 // auto-download select (Download All flips the caller's policy — the
-// dropdown must reflect it immediately, issue #3).
-type EpisodeListRenderer func(c *echo.Context, feedID string, includePolicySelect bool) error
+// dropdown must reflect it immediately, issue #3);
+// includeOrderSelect likewise rides along for the order endpoint (the
+// "Reverse feed order" button flips to reverse — the dropdown must
+// mirror the server state, §0 item 3).
+type EpisodeListRenderer func(c *echo.Context, feedID string, includePolicySelect, includeOrderSelect bool) error
 
 // SetEpisodeListRenderer wires the renderer (router-only; product wiring).
 func (h *PodcastHandler) SetEpisodeListRenderer(r EpisodeListRenderer) {
@@ -48,13 +51,127 @@ func (h *PodcastHandler) SetEpisodeListRenderer(r EpisodeListRenderer) {
 
 // hxEpisodeList answers an htmx action with the refreshed partial when
 // a renderer is wired; otherwise falls back to 204 + HX-Trigger.
-func (h *PodcastHandler) hxEpisodeList(c *echo.Context, feedID string, includePolicySelect bool) error {
+func (h *PodcastHandler) hxEpisodeList(c *echo.Context, feedID string, includePolicySelect, includeOrderSelect bool) error {
 	if h.episodeListRenderer != nil {
-		return h.episodeListRenderer(c, feedID, includePolicySelect)
+		return h.episodeListRenderer(c, feedID, includePolicySelect, includeOrderSelect)
 	}
 	return hxAccepted(c, "")
 }
 
+// AdminDeleteFeedFiles POST /api/podcasts/feeds/:id/delete-files —
+// admin-only (§0 item 8): delete every downloaded episode file of the
+// feed; rows reset to pending. HX answers HX-Refresh (the admin table
+// re-renders with fresh aggregates).
+func (h *PodcastHandler) AdminDeleteFeedFiles(c *echo.Context) error {
+	user := MustGetAuthenticatedUser(c)
+	if user.Role != "admin" {
+		return c.JSON(http.StatusForbidden, map[string]string{"error": "admin only"})
+	}
+	feedID, err := parseUUID(c.Param("id"))
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid feed id"})
+	}
+	// media_items writes run under the first-admin identity (invariant
+	// 12 — same contract as the fetcher/worker).
+	actx, err := h.worker.AdminCtx(c.Request().Context())
+	if err != nil {
+		return podcastErrorResponse(c, err)
+	}
+	reset, err := h.podcasts.AdminDeleteFeedFiles(actx, feedID)
+	if err != nil {
+		return podcastErrorResponse(c, err)
+	}
+	log.Printf("[PODCAST] admin: deleted files for %d episode(s) of feed %s (user %s)", reset, feedID, user.Username)
+	if isHXRequest(c) {
+		c.Response().Header().Set("HX-Refresh", "true")
+		return c.JSON(http.StatusOK, map[string]interface{}{"reset_episodes": reset})
+	}
+	return c.JSON(http.StatusOK, map[string]interface{}{"reset_episodes": reset})
+}
+
+// AdminDeleteEpisodeFile POST /api/podcasts/episodes/:id/delete-file —
+// admin-only (§0 item 8): ONE episode's file deleted, row reset to
+// pending. HX answers with the refreshed episode list.
+func (h *PodcastHandler) AdminDeleteEpisodeFile(c *echo.Context) error {
+	user := MustGetAuthenticatedUser(c)
+	if user.Role != "admin" {
+		return c.JSON(http.StatusForbidden, map[string]string{"error": "admin only"})
+	}
+	episodeID, err := parseUUID(c.Param("eid"))
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid episode id"})
+	}
+	actx, err := h.worker.AdminCtx(c.Request().Context())
+	if err != nil {
+		return podcastErrorResponse(c, err)
+	}
+	if err := h.podcasts.AdminDeleteEpisodeFile(actx, episodeID); err != nil {
+		return podcastErrorResponse(c, err)
+	}
+	log.Printf("[PODCAST] admin: deleted file of episode %s (user %s)", episodeID, user.Username)
+	if isHXRequest(c) {
+		// Re-render the episode list: the row needs its fresh state. The
+		// episode's feed id comes from the row we just reset.
+		if ep, err := h.db.GetPodcastEpisode(actx, episodeID); err == nil && ep.SourceFeedID.Valid {
+			return h.hxEpisodeList(c, ep.SourceFeedID.String(), false, false)
+		}
+		return hxAccepted(c, "")
+	}
+	return c.JSON(http.StatusOK, map[string]string{"message": "file deleted"})
+}
+
+// AdminDeleteEpisodeFilesBulk POST /api/podcasts/feeds/:id/episodes/delete-files —
+// admin-only (§0 item 8): multi-select file deletion. Body carries the
+// CHECKED boxes' values (form-encoded, repeated episode-file-select
+// keys — hx-include gathers them; parsed directly, never bound: the
+// repeated-key wire is another echo-bind gotcha). Each id is validated
+// to belong to THIS feed; rows reset to pending, files removed.
+func (h *PodcastHandler) AdminDeleteEpisodeFilesBulk(c *echo.Context) error {
+	user := MustGetAuthenticatedUser(c)
+	if user.Role != "admin" {
+		return c.JSON(http.StatusForbidden, map[string]string{"error": "admin only"})
+	}
+	feedID, err := parseUUID(c.Param("id"))
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid feed id"})
+	}
+	if err := c.Request().ParseForm(); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
+	}
+	rawIDs := c.Request().PostForm["episode-file-select"]
+	if len(rawIDs) == 0 {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "no episodes selected"})
+	}
+	actx, err := h.worker.AdminCtx(c.Request().Context())
+	if err != nil {
+		return podcastErrorResponse(c, err)
+	}
+
+	deleted := 0
+	for _, raw := range rawIDs {
+		episodeID, perr := parseUUID(raw)
+		if perr != nil {
+			continue
+		}
+		// The checkbox list only renders this feed's rows, but the wire
+		// is user-controlled: a forged id for a foreign feed's episode
+		// is refused (feed-match guard), not silently applied.
+		ep, gerr := h.db.GetPodcastEpisode(actx, episodeID)
+		if gerr != nil || ep.SourceFeedID != feedID {
+			continue
+		}
+		if derr := h.podcasts.AdminDeleteEpisodeFile(actx, episodeID); derr == nil {
+			deleted++
+		}
+	}
+	log.Printf("[PODCAST] admin: bulk-deleted files for %d/%d episode(s) of feed %s (user %s)",
+		deleted, len(rawIDs), feedID, user.Username)
+	if isHXRequest(c) {
+		return h.hxEpisodeList(c, feedID.String(), false, false)
+	}
+	return c.JSON(http.StatusOK, map[string]interface{}{"deleted": deleted})
+}
+
 // flipSubscriptionToAll implements issue #3: Download All (button or
 // add-feed checkbox) sets the CALLER's subscription policy to 'all' —
 // per-user, never global (files are shared D6, policies are not). The
@@ -74,6 +191,7 @@ func (h *PodcastHandler) flipSubscriptionToAll(ctx context.Context, userID, feed
 		AutoDownload:      "all",
 		AutoDownloadCount: pgtype.Int4{}, // all needs no count
 	})
+	log.Printf("[PODCAST] flip: user %s → policy 'all' for feed %s (Download All / add checkbox)", userID, feedID)
 }
 
 func NewPodcastHandler(db *database.Queries, svc *services.PodcastService, worker *services.PodcastDownloadWorker) *PodcastHandler {
@@ -83,9 +201,35 @@ func NewPodcastHandler(db *database.Queries, svc *services.PodcastService, worke
 // ---- request/response shapes ----
 
 type AddPodcastFeedRequest struct {
-	LibraryID   string `json:"library_id" form:"library_id" validate:"required"`
-	URL         string `json:"url" form:"url" validate:"required"`
-	DownloadAll bool   `json:"download_all" form:"download_all"`
+	LibraryID   string   `json:"library_id" form:"library_id" validate:"required"`
+	URL         string   `json:"url" form:"url" validate:"required"`
+	DownloadAll FlexBool `json:"download_all" form:"download_all"`
+	// DownloadOrder: the initial listening order for THIS feed, applied
+	// only with DownloadAll (§0 item 5c) — it both seeds the queue in
+	// listening order and sets the caller's order override. ""/"feed" =
+	// no override row.
+	DownloadOrder string `json:"download_order,omitempty" form:"download_order"`
+}
+
+// FlexBool binds checkbox-style booleans on every wire. echo bool-binds
+// via strconv.ParseBool, which accepts "true"/"1" but REJECTS the
+// browser-native checkbox value "on" — and a bind failure is fatal for
+// the WHOLE request (the add modal would 400 "invalid request" on any
+// form variant that posts "on"). §0 item 2 (2026-10-30).
+//
+// A checkbox only contributes its field when CHECKED, so for form
+// posts presence really is the signal — JSON's native bool binding
+// ("false"→false) is unaffected. Absence on either wire = false.
+type FlexBool bool
+
+func (b *FlexBool) UnmarshalParam(v string) error {
+	switch strings.ToLower(strings.TrimSpace(v)) {
+	case "false", "0", "off", "n", "no":
+		*b = false
+	default:
+		*b = true // "true", "on", "yes", "checked", "1" — or any truthy variant
+	}
+	return nil
 }
 
 type UpdatePodcastSubscriptionRequest struct {
@@ -130,11 +274,11 @@ func podcastErrorResponse(c *echo.Context, err error) error {
 // feed counts are tens, not thousands; no facet SQL needed).
 type podcastFeedSummary struct {
 	Feed
-	SubscribedAt   string `json:"subscribed_at"`
-	EpisodeTotal   int    `json:"episode_total"`
-	DownloadedN    int    `json:"episode_downloaded"`
-	UndownloadedN  int    `json:"episode_undownloaded"`
-	NewEpisodes    bool   `json:"new_episodes"`
+	SubscribedAt  string `json:"subscribed_at"`
+	EpisodeTotal  int    `json:"episode_total"`
+	DownloadedN   int    `json:"episode_downloaded"`
+	UndownloadedN int    `json:"episode_undownloaded"`
+	NewEpisodes   bool   `json:"new_episodes"`
 }
 
 // AddFeed POST /api/podcasts/feeds
@@ -157,7 +301,23 @@ func (h *PodcastHandler) AddFeed(c *echo.Context) error {
 		return podcastErrorResponse(c, err)
 	}
 	if req.DownloadAll && res.Feed != nil {
-		if _, err := h.worker.QueueFeedDownloads(c.Request().Context(), res.Feed.ID); err != nil {
+		// §0 item 5c: the add modal's order dropdown is the feed's
+		// INITIAL listening order — it IS the download order (the queue
+		// seeds in that order below). 'feed'/'native' = no override row.
+		order := "native"
+		switch req.DownloadOrder {
+		case "reverse", "oldest", "newest":
+			order = req.DownloadOrder
+			payload, _ := json.Marshal(map[string]string{"order": order})
+			if err := h.db.UpsertUserSettingByKey(c.Request().Context(), database.UpsertUserSettingByKeyParams{
+				UserID: user.ID, SettingKey: podcastOrderSettingKey(res.Feed.ID.String()), SettingValue: payload,
+			}); err != nil {
+				// subscription + queue stand; the dropdown just won't
+				// preselect it (surfaced on the next order set).
+				_ = err
+			}
+		}
+		if _, err := h.worker.QueueFeedDownloadsAs(c.Request().Context(), user.ID, res.Feed.ID); err != nil {
 			// subscription stands; download-all failure surfaces via the
 			// episode list states.
 		}
@@ -245,10 +405,10 @@ func (h *PodcastHandler) GetFeed(c *echo.Context) error {
 		episodeViews = append(episodeViews, episodeView(&eps[i]))
 	}
 	return c.JSON(http.StatusOK, map[string]interface{}{
-		"feed":            feedWithSubscription(&feed, sub, subFound == nil),
-		"episodes":        episodeViews,
-		"gap_count":       countGaps(episodeViews),
-		"undownloaded":    len(episodeViews) - countDownloaded(episodeViews),
+		"feed":               feedWithSubscription(&feed, sub, subFound == nil),
+		"episodes":           episodeViews,
+		"gap_count":          countGaps(episodeViews),
+		"undownloaded":       len(episodeViews) - countDownloaded(episodeViews),
 		"has_library_access": true, // RLS already gated the row; kept for client convenience
 	})
 }
@@ -305,7 +465,7 @@ func (h *PodcastHandler) UpdateSubscription(c *echo.Context) error {
 	if isHXRequest(c) {
 		// Policy changes feed the auto-download union on the next poll.
 		_, _ = h.worker.ApplyAutoPolicies(ctx, feedID)
-		return h.hxEpisodeList(c, feedID.String(), true)
+		return h.hxEpisodeList(c, feedID.String(), true, false)
 	}
 	return c.JSON(http.StatusOK, updated)
 }
@@ -344,7 +504,7 @@ func (h *PodcastHandler) RefreshFeed(c *echo.Context) error {
 		return podcastErrorResponse(c, err)
 	}
 	if isHXRequest(c) {
-		return h.hxEpisodeList(c, feedID.String(), false)
+		return h.hxEpisodeList(c, feedID.String(), false, false)
 	}
 	return c.JSON(http.StatusOK, map[string]string{"message": "refreshed"})
 }
@@ -387,7 +547,8 @@ func (h *PodcastHandler) DownloadEpisodes(c *echo.Context) error {
 	eidRaw := c.Param("eid")
 	if eidRaw == "all" {
 		// Download All affordance: exactly the non-downloaded set (pin).
-		queued, err := h.worker.QueueFeedDownloads(ctx, feedID)
+		// Queues in the CALLER's listening order (§0 item 5b).
+		queued, err := h.worker.QueueFeedDownloadsAs(ctx, user.ID, feedID)
 		if err != nil {
 			return podcastErrorResponse(c, err)
 		}
@@ -395,7 +556,7 @@ func (h *PodcastHandler) DownloadEpisodes(c *echo.Context) error {
 			// Download All flips the caller's policy to all (issue #3)
 			// — the oob select keeps the dropdown honest.
 			h.flipSubscriptionToAll(ctx, user.ID, feedID)
-			return h.hxEpisodeList(c, feedID.String(), true)
+			return h.hxEpisodeList(c, feedID.String(), true, false)
 		}
 		return c.JSON(http.StatusAccepted, map[string]interface{}{"queued": queued})
 	}
@@ -407,7 +568,7 @@ func (h *PodcastHandler) DownloadEpisodes(c *echo.Context) error {
 		return podcastErrorResponse(c, err)
 	}
 	if isHXRequest(c) {
-		return h.hxEpisodeList(c, feedID.String(), false)
+		return h.hxEpisodeList(c, feedID.String(), false, false)
 	}
 	return c.JSON(http.StatusAccepted, map[string]string{"message": "queued"})
 }
@@ -480,9 +641,10 @@ func podcastOrderSettingKey(feedID string) string {
 	return "podcast_order:" + feedID
 }
 
-// podcastOrderValid: native (feed position) | oldest | newest.
+// podcastOrderValid native (feed position) | reverse (position DESC,
+// no dates) | oldest | newest.
 func podcastOrderValid(o string) bool {
-	return o == "native" || o == "oldest" || o == "newest"
+	return services.ValidPodcastEpisodeOrder(o)
 }
 
 // GetFeedOrder reads the caller's effective order for a feed
@@ -515,7 +677,7 @@ func (h *PodcastHandler) SetFeedOrder(c *echo.Context) error {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid feed id"})
 	}
 	var req struct {
-		Order string `json:"order" form:"order" validate:"required,oneof=native oldest newest"`
+		Order string `json:"order" form:"order" validate:"required,oneof=native reverse oldest newest"`
 	}
 	if err := c.Bind(&req); err != nil {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
@@ -541,7 +703,7 @@ func (h *PodcastHandler) SetFeedOrder(c *echo.Context) error {
 		}
 	}
 	if isHXRequest(c) {
-		return h.hxEpisodeList(c, feedID.String(), false)
+		return h.hxEpisodeList(c, feedID.String(), false, true)
 	}
 	return c.JSON(http.StatusOK, map[string]string{"order": req.Order})
 }
@@ -567,19 +729,11 @@ func (h *PodcastHandler) GetFeedSequence(c *echo.Context) error {
 	for i := range eps {
 		views = append(views, episodeView(&eps[i]))
 	}
-	sortSlice(views, func(a, b PodcastEpisodeView) bool {
-		switch order {
-		case "oldest":
-			return episodeSortKey(a) < episodeSortKey(b)
-		case "newest":
-			return episodeSortKey(a) > episodeSortKey(b)
-		default: // native: feed position (fetch-maintained)
-			if a.FeedPosition != b.FeedPosition {
-				return a.FeedPosition < b.FeedPosition
-			}
-			return a.Date < b.Date
-		}
-	})
+	// Effective listening order (order consolidation §0 item 5a).
+	services.OrderEpisodes(views, order,
+		func(v PodcastEpisodeView) int32 { return int32(v.FeedPosition) },
+		func(v PodcastEpisodeView) string { return v.Date },
+	)
 
 	sequence := make([]PodcastEpisodeView, 0, len(views))
 	gaps := make([]PodcastEpisodeView, 0)
@@ -598,12 +752,6 @@ func (h *PodcastHandler) GetFeedSequence(c *echo.Context) error {
 	})
 }
 
-// episodeSortKey: chronological key for oldest/newest (date, then
-// native position as the same-day tiebreaker).
-func episodeSortKey(v PodcastEpisodeView) string {
-	return v.Date + fmt.Sprintf("%06d", v.FeedPosition)
-}
-
 // sortSlice: sort.Slice with a controller-friendly wrapper.
 func sortSlice[T any](s []T, less func(a, b T) bool) {
 	sort.Slice(s, func(i, j int) bool { return less(s[i], s[j]) })

internal/handlers/refresh_token.go

@@ -74,6 +74,23 @@ func (h *AuthHandler) RefreshAccessToken(c *echo.Context) error {
 
 // Logout handles POST /api/auth/logout
 func (h *AuthHandler) Logout(c *echo.Context) error {
+	// Clear the HttpOnly session cookie — the SSR pages authenticate
+	// with it, and JavaScript cannot clear an HttpOnly cookie by
+	// design. Without this, "logout" wiped localStorage but left the
+	// cookie session alive for up to session_duration_seconds (the
+	// fake-signout bug: users roamed every cookie-authed page). The
+	// cookie is cleared BEFORE anything else — even a malformed body
+	// must sign the browser out.
+	c.SetCookie(&http.Cookie{
+		Name:     "token",
+		Value:    "",
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   secure == "true",
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   -1, // delete
+	})
+
 	var req RefreshTokenRequest
 	if err := c.Bind(&req); err != nil {
 		return c.JSON(http.StatusOK, map[string]string{"message": "logged out successfully"})

internal/handlers/system_settings.go

@@ -178,6 +178,21 @@ func validateSettingValue(def database.SettingDefault, value string) error {
 		if _, err := strconv.ParseBool(value); err != nil {
 			return fmt.Errorf("value must be true or false")
 		}
+	case database.SettingTypeFloat:
+		f, err := strconv.ParseFloat(value, 64)
+		if err != nil {
+			return fmt.Errorf("value must be a number")
+		}
+		if def.Min != "" {
+			if mn, err := strconv.ParseFloat(def.Min, 64); err == nil && f < mn {
+				return fmt.Errorf("value must be >= %s", def.Min)
+			}
+		}
+		if def.Max != "" {
+			if mx, err := strconv.ParseFloat(def.Max, 64); err == nil && f > mx {
+				return fmt.Errorf("value must be <= %s", def.Max)
+			}
+		}
 	case database.SettingTypeString:
 		if value == "" {
 			return fmt.Errorf("value must not be empty")

internal/router/collections.go

@@ -17,17 +17,16 @@ func registerCollectionsRoutes(cfg *Config) {
 	collections.GET("/:id/books", cfg.CollectionHandler.GetBookCollections)
 	collections.POST("/:id/books", cfg.CollectionHandler.AddBooks)
 	collections.PUT("/:id/items/order", cfg.CollectionHandler.ReorderItems)
+	// The chain's listening order lives ON the collection (plan §10 R2):
+	// merges into view_settings; the episode chain producer honors it.
+	collections.PUT("/:id/view-settings", cfg.CollectionHandler.SetCollectionChainOrder)
 	collections.DELETE("/:id/books/:bookId", cfg.CollectionHandler.RemoveBook)
 	collections.POST("/:id/books/bulk-remove", cfg.CollectionHandler.BulkRemoveBooks)
 	collections.POST("/bulk-add-books", cfg.CollectionHandler.HandleBulkAddBooks)
-	collections.POST("/test-rules", cfg.CollectionHandler.TestRules)
 	collections.POST("/preview", cfg.CollectionHandler.PreviewCollection)
 
 	// Smart collection rule CRUD (the rules builder persists through
 	// these; type follows rules presence — first rule = smart).
-	collections.POST("/:id/rules", cfg.CollectionHandler.AddRule)
-	collections.PUT("/:id/rules/:ruleId", cfg.CollectionHandler.UpdateRule)
-	collections.DELETE("/:id/rules/:ruleId", cfg.CollectionHandler.RemoveRule)
 
 	// Device shelf mapping routes
 	deviceCollections := protected.Group("/devices/:id/collections")

internal/router/frontend.go

@@ -14,6 +14,7 @@ import (
 
 	"bookhoard/internal/config"
 	"bookhoard/internal/database"
+	"bookhoard/internal/rls"
 	"bookhoard/internal/handlers"
 	"bookhoard/internal/services"
 	"bookhoard/internal/utils"
@@ -408,9 +409,19 @@ func registerFrontendRoutes(cfg *Config) {
 			}
 		}
 
+		// SSR id-label resolution for a URL-carried qf tree: the drawer's
+		// value cells show NAMES from first paint instead of raw uuids
+		// (2026-11-01 — same story as the collection editor above).
+		labelsJSON := "{}"
+		if qfRaw := c.QueryParam("qf"); qfRaw != "" {
+			if t, perr := services.ParseFilterTree(qfRaw); perr == nil {
+				labelsJSON = resolveTreeLabelsJSON(c, cfg, user.ID, t)
+			}
+		}
+
 		var buf bytes.Buffer
 		bookInfoList = handlers.MarkActiveConflicts(c.Request().Context(), cfg.Queries, pgtype.UUID{Bytes: userUUID, Valid: true}, bookInfoList)
-		err = templates.BookShelf(user, libData, libraryID, errorMsg, savedFilters, bookInfoList, limit, offset, totalCount).Render(c.Request().Context(), &buf)
+		err = templates.BookShelf(user, libData, libraryID, errorMsg, savedFilters, bookInfoList, limit, offset, totalCount, labelsJSON).Render(c.Request().Context(), &buf)
 		if err != nil {
 			return err
 		}
@@ -561,13 +572,17 @@ func registerFrontendRoutes(cfg *Config) {
 		colData := make([]templates.CollectionData, len(collections))
 		colService := cfg.CollectionHandler.CollectionService()
 		for i, col := range collections {
-			isSmart := colService.IsSmartCollection(col.AutoAssignRules)
+			isSmart := services.IsCollectionSmart(col)
 			bookCount := 0
 			if isSmart {
-				matches, evalErr := colService.EvaluateSmartCollection(c.Request().Context(),
-					colService.ParseRules(col.AutoAssignRules), services.SmartEvalOptions{
-						LibraryID:  libScope,
-						VisibleIDs: visibleIDs,
+				matches, evalErr := colService.EvaluateSmartMembership(c.Request().Context(),
+					col, services.SmartEvalOptions{
+						LibraryID:    libScope,
+						VisibleIDs:   visibleIDs,
+						ViewerUserID: func() pgtype.UUID {
+							uid, _ := uuid.Parse(user.ID)
+							return uuidToPGType(uid)
+						}(),
 					})
 				if evalErr == nil {
 					bookCount = len(matches)
@@ -695,6 +710,35 @@ func registerFrontendRoutes(cfg *Config) {
 			return renderErrorPage(c, "System collections cannot have rules", "not_allowed")
 		}
 
+		// The editor's vocabulary + prefill (item 3.4): the unified
+		// builder in the collection's scope. A stored tree renders
+		// as-is. (The legacy rules-array preload retired 2026-10-31
+		// with the rules-array storage — the tree is the only form.)
+		scope := "books"
+		treeJSON := "{}"
+		var parsedTree *services.FilterTree
+		if len(collection.FilterTree) > 0 {
+			if t, perr := services.ParseFilterTree(string(collection.FilterTree)); perr == nil {
+				scope = t.FilterScope()
+				if b, merr := json.Marshal(t); merr == nil {
+					treeJSON = string(b)
+				}
+				parsedTree = t
+			}
+		}
+		fieldsPayload, merr := json.Marshal(services.FilterFieldsPayload(scope))
+		if merr != nil {
+			fieldsPayload = []byte("[]")
+		}
+		fieldsJSON := string(fieldsPayload)
+
+		// SSR id-label resolution: the stored tree arrives as bare ids;
+		// embed the id→name map so value cells render NAMES at first
+		// paint (2026-11-01: the client's pick-time cache dies with the
+		// page, and the quiet suggest fetch can't label ids whose media
+		// doesn't match the tree's sibling rules — raw uuids on refresh).
+		labelsJSON := resolveTreeLabelsJSON(c, cfg, user.ID, parsedTree)
+
 		colData := templates.CollectionData{
 			ID:          collectionID,
 			Name:        collection.Name,
@@ -702,11 +746,11 @@ func registerFrontendRoutes(cfg *Config) {
 			Color:       utils.PgTextString(collection.Color),
 			Icon:        utils.PgTextString(collection.Icon),
 			IsSystem:    collection.IsSystemCollection.Bool,
-			IsSmart:     cfg.CollectionHandler.CollectionService().IsSmartCollection(collection.AutoAssignRules),
+			IsSmart:     services.IsCollectionSmart(collection),
 		}
 
 		var buf bytes.Buffer
-		err = templates.CollectionRules(user, colData).Render(c.Request().Context(), &buf)
+		err = templates.CollectionRules(user, colData, fieldsJSON, treeJSON, scope, labelsJSON).Render(c.Request().Context(), &buf)
 		if err != nil {
 			return err
 		}
@@ -1507,8 +1551,7 @@ func registerFrontendRoutes(cfg *Config) {
 
 	// Admin hash conflicts page: content-duplicate groups flagged during hash
 	// backfill or rescan, resolved by keeping all copies or merging into one.
-	frontendProtected.GET("/admin/hash-conflicts", handlers.AdminMiddleware(func(c *echo.Context) error {
-		user, err := getTemplateUserWithTheme(c, cfg)
+	frontendProtected.GET("/admin/hash-conflicts", handlers.AdminMiddleware(func(c *echo.Context) error {		user, err := getTemplateUserWithTheme(c, cfg)
 		if err != nil {
 			return renderErrorPage(c, "Error loading user", "user_load_error")
 		}
@@ -1562,6 +1605,62 @@ func registerFrontendRoutes(cfg *Config) {
 		return c.HTML(http.StatusOK, buf.String())
 	}))
 
+	// Admin all-podcasts view (§0 item 8): every feed from every user with
+	// maintenance aggregates (disk usage first). The aggregate read runs
+	// under the FIRST-ADMIN identity — the RLS admin escape (invariant
+	// 12, poller/fetcher contract) — so admins see feeds from libraries
+	// hidden even from them.
+	frontendProtected.GET("/admin/podcasts", handlers.AdminMiddleware(func(c *echo.Context) error {
+		user, err := getTemplateUserWithTheme(c, cfg)
+		if err != nil {
+			return renderErrorPage(c, "Error loading user", "user_load_error")
+		}
+
+		adminUUID, err := cfg.Queries.GetFirstAdmin(context.Background())
+		if err != nil {
+			return renderErrorPage(c, "Error loading podcasts", "podcasts_load_error")
+		}
+		// cfg.Queries is ScopedDB-backed: the context identity is all the
+		// aggregate read needs.
+		actx := rls.WithUser(c.Request().Context(), adminUUID)
+
+		rows, err := cfg.Queries.ListAllPodcastFeedsAdmin(actx)
+		if err != nil {
+			return renderErrorPage(c, "Error loading podcasts", "podcasts_load_error")
+		}
+
+		feeds := make([]templates.AdminPodcastFeedData, 0, len(rows))
+		var totalBytes int64
+		totalDownloaded, totalEpisodes := 0, 0
+		for _, r := range rows {
+			lastFetch := "never"
+			if r.LastFetchedAt.Valid {
+				lastFetch = r.LastFetchedAt.Time.In(utils.UserLocation(user.Timezone)).Format("Jan 2, 2006 15:04")
+			}
+			feeds = append(feeds, templates.AdminPodcastFeedData{
+				ID:                uuid.UUID(r.ID.Bytes).String(),
+				Title:             r.Title,
+				Host:              r.Host.String,
+				LibraryName:       r.LibraryName,
+				Subscribers:       int(r.SubscriberCount),
+				SubscriberNames:   r.SubscriberNames,
+				EpisodeTotal:      int(r.EpisodeTotal),
+				EpisodeDownloaded: int(r.EpisodeDownloaded),
+				DiskBytes:         r.DiskBytes,
+				LastFetched:       lastFetch,
+			})
+			totalBytes += r.DiskBytes
+			totalEpisodes += int(r.EpisodeTotal)
+			totalDownloaded += int(r.EpisodeDownloaded)
+		}
+
+		var buf bytes.Buffer
+		if err := templates.AdminPodcasts(user, feeds, len(feeds), totalDownloaded, totalEpisodes, totalBytes).Render(c.Request().Context(), &buf); err != nil {
+			return err
+		}
+		return c.HTML(http.StatusOK, buf.String())
+	}))
+
 	// Admin users page
 	frontendProtected.GET("/admin/users", handlers.AdminMiddleware(func(c *echo.Context) error {
 		user, err := getTemplateUserWithTheme(c, cfg)

internal/router/helpers.go

@@ -2,6 +2,7 @@ package router
 
 import (
 	"context"
+	"encoding/json"
 	"log"
 	"net/http"
 	"net/url"
@@ -75,6 +76,7 @@ func getTemplateUserWithTheme(c *echo.Context, cfg *Config) (templates.User, err
 		LastName:          utils.PgTextString(userDB.LastName),
 		CreatedAt:         userDB.CreatedAt.Time,
 		DefaultAudioSpeed: float64(userDB.DefaultAudioSpeed),
+		AudioResumeRewind: int(userDB.AudioResumeRewindSeconds),
 		KeepScreenAwake:   userDB.KeepScreenAwake,
 		ShowPodcastsNav:   showPodcasts,
 	}, nil
@@ -270,6 +272,15 @@ func visibleLibraryIDsFor(c *echo.Context, cfg *Config) (map[string]bool, []pgty
 // collectionDataFromRow builds the template collection payload shared by
 // the collection detail page and its books-grid partial.
 func collectionDataFromRow(collection database.Collections, collectionID string, isSmart bool, bookCount int) templates.CollectionData {
+	chainOrder := ""
+	if len(collection.ViewSettings) > 0 {
+		var vs map[string]interface{}
+		if json.Unmarshal(collection.ViewSettings, &vs) == nil {
+			if s, ok := vs["chain_order"].(string); ok {
+				chainOrder = s
+			}
+		}
+	}
 	return templates.CollectionData{
 		ID:          collectionID,
 		Name:        collection.Name,
@@ -278,6 +289,7 @@ func collectionDataFromRow(collection database.Collections, collectionID string,
 		Icon:        collection.Icon.String,
 		IsSystem:    collection.IsSystemCollection.Bool,
 		IsSmart:     isSmart,
+		ChainOrder:  chainOrder,
 		BookCount:   bookCount,
 	}
 }
@@ -286,25 +298,72 @@ func collectionDataFromRow(collection database.Collections, collectionID string,
 // detail page and the books-grid partial: smart evaluation, a dashboard
 // query section, or manual membership. Callers resolve the scope:
 // libUUID/libScope/isAll/scoped per their own resolution rules.
+// resolveTreeLabelsJSON — SSR id-label resolution for a page-rendered
+// filter tree: walks the tree's id-kind rules, resolves uuids to display
+// names through the search engine (RLS/visibility ride the request
+// identity), and returns the JSON map embedded into the builder mount.
+// Best-effort: any failure yields "{}" and the page renders with the
+// client's fallbacks intact (2026-11-01, filter_labels.go for the WHY).
+func resolveTreeLabelsJSON(c *echo.Context, cfg *Config, userID string, tree *services.FilterTree) string {
+	if tree == nil || len(tree.Children) == 0 {
+		return "{}"
+	}
+	userUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return "{}"
+	}
+	labels := cfg.MediaHandler.SearchService().FilterTreeLabels(
+		c.Request().Context(), pgtype.UUID{Bytes: userUUID, Valid: true}, tree)
+	if len(labels) == 0 {
+		return "{}"
+	}
+	b, merr := json.Marshal(labels)
+	if merr != nil {
+		return "{}"
+	}
+	return string(b)
+}
+
 func (cfg *Config) collectionBooksForScope(c *echo.Context, userUUID uuid.UUID, collUUID pgtype.UUID, collection database.Collections, collectionID string, libUUID pgtype.UUID, libScope pgtype.UUID, scoped bool, visibleIDs []pgtype.UUID) (books []handlers.BookInfo, isSmart bool, errCode string) {
 	colService := cfg.CollectionHandler.CollectionService()
-	isSmart = colService.IsSmartCollection(collection.AutoAssignRules)
+	isSmart = services.IsCollectionSmart(collection)
 	libTypes := handlers.LibraryTypeMap(c.Request().Context(), cfg.Queries)
 
 	if isSmart {
 		// Smart (dynamic) collection: membership is evaluated live —
-		// visible libraries, live items only, any enabled rule matches.
-		matches, evalErr := colService.EvaluateSmartCollection(c.Request().Context(),
-			colService.ParseRules(collection.AutoAssignRules), services.SmartEvalOptions{
-				LibraryID:  libScope,
-				VisibleIDs: visibleIDs,
+		// visible libraries, live items only, rules applied under the
+		// collection's match mode (item 2.4: any|all), with the
+		// viewer's progress feeding played/unplayed rules.
+		matches, evalErr := colService.EvaluateSmartMembership(c.Request().Context(),
+			collection, services.SmartEvalOptions{
+				LibraryID:    libScope,
+				VisibleIDs:   visibleIDs,
+				ViewerUserID: pgtype.UUID{Bytes: userUUID, Valid: true},
 			})
 		if evalErr != nil {
 			return nil, isSmart, "books_load_error"
 		}
+		// The visible order IS the play order: the curated listening
+		// order (view_settings.chain_order, §10 R2) re-orders the
+		// episode cards exactly as the sequence producer will play
+		// them, so the select's effect is visible and Play launches
+		// from the card the user sees first (2026-11-01 user report:
+		// the select changed nothing on the page).
+		services.OrderEpisodeMedia(matches, handlers.CollectionChainOrder(collection.ViewSettings))
 		books = handlers.BookCardsFromMediaItems(matches, libTypes)
+		// Episode-awareness for smart matches (item 2.5): episode cards
+		// carry the play affordance (chain via ?queue=collection:).
+		// BookCardsFromMediaItems preserves match order, so a parallel
+		// walk is enough; feed titles stay empty here (batch lookup is
+		// polish, not acceptance).
+		for i := range books {
+			if i < len(matches) && matches[i].Source == "podcast_episode" {
+				books[i].IsEpisode = true
+				books[i].DownloadState = matches[i].DownloadState
+			}
+		}
 	} else if collection.IsSystemCollection.Bool && collection.QueryType.Valid && collection.QueryType.String != "" && collection.QueryType.String != "filter" {
-		dashboardSvc := services.NewDashboardService(cfg.Queries)
+		dashboardSvc := services.NewDashboardService(cfg.Queries, cfg.CollectionHandler.CollectionService().Search())
 		sections, secErr := dashboardSvc.GetDashboardSections(c.Request().Context(), userUUID, libUUID, 1000, []string{}, []string{})
 		if secErr != nil {
 			return nil, isSmart, "books_load_error"
@@ -331,11 +390,17 @@ func (cfg *Config) collectionBooksForScope(c *echo.Context, userUUID uuid.UUID,
 				books = handlers.BookCardsFromCollectionDashRows(collItems, libTypes)
 			}
 		} else {
-			collItems, collErr := cfg.Queries.GetCollectionItems(c.Request().Context(), collUUID)
+			// Episode collections (plan item 2.3): the detailed query
+			// keeps RLS-invisible rows as Hidden cards (unsubscribed
+			// episodes render an "unavailable" hint) and tags episode
+			// rows with feed title + download state. Same position
+			// ordering; the legacy INNER-JOIN shape remains on the
+			// library-scoped branch above.
+			collItems, collErr := cfg.Queries.GetCollectionItemsDetailed(c.Request().Context(), collUUID)
 			if collErr != nil {
 				collItems = nil
 			}
-			books = handlers.BookCardsFromCollectionItemRows(collItems, libTypes)
+			books = handlers.BookCardsFromCollectionDetailed(collItems, libTypes)
 		}
 	}
 	return books, isSmart, ""

internal/router/podcast.go

@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"net/http"
 
+	"bookhoard/internal/handlers"
 	"bookhoard/templates"
 
 	"github.com/labstack/echo/v5"
@@ -20,7 +21,7 @@ func registerPodcastRoutes(cfg *Config) {
 	// refreshed partial directly — no event indirection to miss. The
 	// view assembly lives here (templates) while the action logic lives
 	// in the handler; this closure is the sanctioned seam.
-	cfg.PodcastHandler.SetEpisodeListRenderer(func(c *echo.Context, feedID string, includePolicySelect bool) error {
+	cfg.PodcastHandler.SetEpisodeListRenderer(func(c *echo.Context, feedID string, includePolicySelect, includeOrderSelect bool) error {
 		user, err := getTemplateUserWithTheme(c, cfg)
 		if err != nil {
 			return err
@@ -48,6 +49,14 @@ func registerPodcastRoutes(cfg *Config) {
 				return err
 			}
 		}
+		if includeOrderSelect {
+			// §0 item 3: out-of-band swap of the order select — the
+			// "Reverse feed order" button flips to reverse; the
+			// dropdown mirrors the server state immediately.
+			if err := templates.PodcastOrderSelectOOB(data.Feed.ID, data.Order).Render(c.Request().Context(), &buf); err != nil {
+				return err
+			}
+		}
 		return c.HTML(http.StatusOK, buf.String())
 	})
 
@@ -65,4 +74,10 @@ func registerPodcastRoutes(cfg *Config) {
 	feeds.POST("/refresh", cfg.PodcastHandler.RefreshFeed)
 	feeds.POST("/episodes/:eid/download", cfg.PodcastHandler.DownloadEpisodes)
 	feeds.DELETE("", cfg.PodcastHandler.DeleteFeed) // admin-only (handler checks role)
+
+	// Admin maintenance (§0 item 8): file deletion frees the disk and
+	// resets rows to pending. Handler checks admin role.
+	feeds.POST("/delete-files", handlers.AdminMiddleware(cfg.PodcastHandler.AdminDeleteFeedFiles))
+	feeds.POST("/episodes/delete-files", handlers.AdminMiddleware(cfg.PodcastHandler.AdminDeleteEpisodeFilesBulk))
+	feeds.POST("/episodes/:eid/delete-file", handlers.AdminMiddleware(cfg.PodcastHandler.AdminDeleteEpisodeFile))
 }

internal/router/podcast_page.go

@@ -9,6 +9,7 @@ package router
 import (
 	"bookhoard/internal/database"
 	"bookhoard/internal/handlers"
+	"bookhoard/internal/services"
 	"bookhoard/internal/utils"
 	"bookhoard/templates"
 	"bytes"
@@ -105,9 +106,9 @@ func buildPodcastsPageData(c *echo.Context, cfg *Config) (*templates.PodcastsPag
 	}
 	for _, lib := range libs {
 		data.Libraries = append(data.Libraries, templates.LibraryData{
-			ID:          uuid.UUID(lib.ID.Bytes).String(),
-			Name:        lib.Name,
-			TypeName:    "podcasts",
+			ID:       uuid.UUID(lib.ID.Bytes).String(),
+			Name:     lib.Name,
+			TypeName: "podcasts",
 		})
 	}
 
@@ -132,30 +133,30 @@ func buildPodcastsPageData(c *echo.Context, cfg *Config) (*templates.PodcastsPag
 		total, _ := cfg.Queries.CountPodcastEpisodesForFeed(ctx, row.ID)
 		downloaded, _ := cfg.Queries.CountDownloadedEpisodes(ctx, row.ID)
 		data.Feeds = append(data.Feeds, templates.PodcastFeedCard{
-			ID:           uuid.UUID(row.ID.Bytes).String(),
-			LibraryID:    uuid.UUID(row.LibraryID.Bytes).String(),
-			Title:        row.Title,
-			DisplayName:  row.DisplayName.String,
-			Description:  firstLine(row.Description.String, 220),
-			Host:         row.Host.String,
-			Publisher:    row.Publisher.String,
-			Language:     row.Language.String,
-			Tags:         row.Tags,
-			Explicit:     row.Explicit,
-			ArtworkPath:  row.ArtworkPath.String,
-			FeedType:     row.FeedType.String,
-			Medium:       row.Medium.String,
-			IsComplete:   row.IsComplete,
-			FeedURL:      row.FeedUrl,
-			LastFetched:  pgTimeDisplay(row.LastFetchedAt, utils.PgTextString(user.Timezone)),
-			SubscribedAt: pgTimeDisplay(row.SubscribedAt, utils.PgTextString(user.Timezone)),
-			EpisodeTotal: int(total),
-			DownloadedN:  int(downloaded),
-			UndownloadedN: int(total) - int(downloaded),
-			NewEpisodes:  total-downloaded > 0,
-			AutoDownload: row.AutoDownload,
+			ID:                uuid.UUID(row.ID.Bytes).String(),
+			LibraryID:         uuid.UUID(row.LibraryID.Bytes).String(),
+			Title:             row.Title,
+			DisplayName:       row.DisplayName.String,
+			Description:       firstLine(row.Description.String, 220),
+			Host:              row.Host.String,
+			Publisher:         row.Publisher.String,
+			Language:          row.Language.String,
+			Tags:              row.Tags,
+			Explicit:          row.Explicit,
+			ArtworkPath:       row.ArtworkPath.String,
+			FeedType:          row.FeedType.String,
+			Medium:            row.Medium.String,
+			IsComplete:        row.IsComplete,
+			FeedURL:           row.FeedUrl,
+			LastFetched:       pgTimeDisplay(row.LastFetchedAt, utils.PgTextString(user.Timezone)),
+			SubscribedAt:      pgTimeDisplay(row.SubscribedAt, utils.PgTextString(user.Timezone)),
+			EpisodeTotal:      int(total),
+			DownloadedN:       int(downloaded),
+			UndownloadedN:     int(total) - int(downloaded),
+			NewEpisodes:       total-downloaded > 0,
+			AutoDownload:      row.AutoDownload,
 			AutoDownloadCount: int(row.AutoDownloadCount.Int32),
-			Subscribed:   true,
+			Subscribed:        true,
 		})
 		if cont := continueByFeed[uuid.UUID(row.ID.Bytes).String()]; cont != nil {
 			card := &data.Feeds[len(data.Feeds)-1]
@@ -253,7 +254,7 @@ func buildPodcastDetailData(c *echo.Context, cfg *Config, user templates.User, f
 		UserID: actor.ID, SourceFeedID: feedID,
 	})
 	progressByItem := make(map[string]struct {
-		Pct     float64
+		Pct      float64
 		LastRead pgtype.Timestamptz
 	}, len(progressRows))
 	for _, p := range progressRows {
@@ -268,29 +269,29 @@ func buildPodcastDetailData(c *echo.Context, cfg *Config, user templates.User, f
 	subscriberCount, _ := cfg.Queries.CountPodcastFeedSubscribers(ctx, feedID)
 
 	card := templates.PodcastFeedCard{
-		ID:          uuid.UUID(feed.ID.Bytes).String(),
-		LibraryID:   uuid.UUID(feed.LibraryID.Bytes).String(),
-		Title:       feed.Title,
-		DisplayName: sub.DisplayName.String,
-		Description: feed.Description.String,
-		Host:        feed.Host.String,
-		Publisher:   feed.Publisher.String,
-		Language:    feed.Language.String,
-		Tags:        feed.Tags,
-		Explicit:    feed.Explicit,
-		ArtworkPath: feed.ArtworkPath.String,
-		FeedType:    feed.FeedType.String,
-		Medium:      feed.Medium.String,
-		IsComplete:  feed.IsComplete,
-		FeedURL:     feed.FeedUrl,
-		LastFetched: pgTimeDisplay(feed.LastFetchedAt, user.Timezone),
-		EpisodeTotal: int(total),
-		DownloadedN:  int(downloaded),
-		UndownloadedN: int(total) - int(downloaded),
-		NewEpisodes:  total-downloaded > 0,
-		AutoDownload: sub.AutoDownload,
+		ID:                uuid.UUID(feed.ID.Bytes).String(),
+		LibraryID:         uuid.UUID(feed.LibraryID.Bytes).String(),
+		Title:             feed.Title,
+		DisplayName:       sub.DisplayName.String,
+		Description:       feed.Description.String,
+		Host:              feed.Host.String,
+		Publisher:         feed.Publisher.String,
+		Language:          feed.Language.String,
+		Tags:              feed.Tags,
+		Explicit:          feed.Explicit,
+		ArtworkPath:       feed.ArtworkPath.String,
+		FeedType:          feed.FeedType.String,
+		Medium:            feed.Medium.String,
+		IsComplete:        feed.IsComplete,
+		FeedURL:           feed.FeedUrl,
+		LastFetched:       pgTimeDisplay(feed.LastFetchedAt, user.Timezone),
+		EpisodeTotal:      int(total),
+		DownloadedN:       int(downloaded),
+		UndownloadedN:     int(total) - int(downloaded),
+		NewEpisodes:       total-downloaded > 0,
+		AutoDownload:      sub.AutoDownload,
 		AutoDownloadCount: int(sub.AutoDownloadCount.Int32),
-		Subscribed:   sub.ID.Valid,
+		Subscribed:        sub.ID.Valid,
 	}
 
 	rows := make([]templates.PodcastEpisodeRow, 0, len(eps))
@@ -316,46 +317,45 @@ func buildPodcastDetailData(c *echo.Context, cfg *Config, user templates.User, f
 		rowID := uuid.UUID(ep.ID.Bytes).String()
 		p := progressByItem[rowID]
 		dateDisplay := ""
+		dateSort := ""
 		if ep.DatePublished.Valid {
+			dateSort = ep.DatePublished.Time.Format("2006-01-02")
 			dateDisplay = ep.DatePublished.Time.In(utils.UserLocation(user.Timezone)).Format("Jan 2, 2006")
 		}
 		rows = append(rows, templates.PodcastEpisodeRow{
-			ID:           uuid.UUID(ep.ID.Bytes).String(),
-			FeedID:       uuid.UUID(ep.SourceFeedID.Bytes).String(),
-			Title:        ep.Title,
-			Description:  firstLine(ep.Description.String, 200),
-			Date:         dateDisplay,
-			Position:     int(ep.FeedPosition.Int32),
-			Duration:     templates.FormatEpisodeDuration(int(ep.DeclaredDurationSeconds.Int32)),
-			Size:         templates.FormatEpisodeSize(ep.FileSize.Int64),
-			PlayURL:      "/readers/" + uuid.UUID(ep.ID.Bytes).String(),
-			ListenPct:    p.Pct,
-			Downloaded:   ep.DownloadState == "downloaded",
+			ID:            uuid.UUID(ep.ID.Bytes).String(),
+			FeedID:        uuid.UUID(ep.SourceFeedID.Bytes).String(),
+			Title:         ep.Title,
+			Description:   firstLine(ep.Description.String, 200),
+			Date:          dateDisplay,
+			SortDate:      dateSort,
+			Position:      int(ep.FeedPosition.Int32),
+			Duration:      templates.FormatEpisodeDuration(int(ep.DeclaredDurationSeconds.Int32)),
+			Size:          templates.FormatEpisodeSize(ep.FileSize.Int64),
+			PlayURL:       "/readers/" + uuid.UUID(ep.ID.Bytes).String(),
+			ListenPct:     p.Pct,
+			Downloaded:    ep.DownloadState == "downloaded",
 			DownloadState: ep.DownloadState,
 			DownloadError: ep.DownloadError.String,
 		})
 	}
 	// Order override reshapes the LIST too (the sequence endpoint is the
 	// strict downloaded-only view; the list shows everything in the
-	// chosen order so pending episodes stay visible).
-	if order == "oldest" || order == "newest" {
-		sort.SliceStable(rows, func(a, b int) bool {
-			ka := rows[a].Date + itoaPad(rows[a].Position)
-			kb := rows[b].Date + itoaPad(rows[b].Position)
-			if order == "newest" {
-				return ka > kb
-			}
-			return ka < kb
-		})
-	}
+	// chosen order so pending episodes stay visible). Consolidated sort
+	// (§0 item 5a) — SortDate is the lexical pub-date key so the
+	// tiebreak is chronological even in display-tz date strings.
+	services.OrderEpisodes(rows, order,
+		func(r templates.PodcastEpisodeRow) int32 { return int32(r.Position) },
+		func(r templates.PodcastEpisodeRow) string { return r.SortDate },
+	)
 
 	detail := &templates.PodcastDetailData{
-		Feed:     card,
-		Episodes: rows,
-		GapCount: gaps,
-		Order:    order,
-		IsAdmin:  actor.Role == "admin",
-		IsSerial: feed.FeedType.String == "serial" || feed.Medium.String == "audiobook",
+		Feed:            card,
+		Episodes:        rows,
+		GapCount:        gaps,
+		Order:           order,
+		IsAdmin:         actor.Role == "admin",
+		IsSerial:        feed.FeedType.String == "serial" || feed.Medium.String == "audiobook",
 		SubscriberCount: int(subscriberCount),
 	}
 
@@ -381,6 +381,13 @@ func buildPodcastDetailData(c *echo.Context, cfg *Config, user templates.User, f
 }
 
 // podcastOrderForFeed reads the caller's order override (D5).
+//
+// The UNSET default is "reverse" (2026-11-01 user request): the platform
+// is audiobook-first and feed document order runs newest-first, so
+// native starts a book at its LAST chapter. This is the same per-feed
+// setting the Order dropdown shows — page list, player chain, and
+// download queue all resolve through it. Stored overrides are untouched:
+// anyone who picked an order keeps exactly what they picked.
 func podcastOrderForFeed(cfg *Config, c *echo.Context, feedID string) string {
 	user := handlers.MustGetAuthenticatedUser(c)
 	row, err := cfg.Queries.GetUserSettingByKey(c.Request().Context(), database.GetUserSettingByKeyParams{
@@ -388,48 +395,56 @@ func podcastOrderForFeed(cfg *Config, c *echo.Context, feedID string) string {
 		SettingKey: "podcast_order:" + feedID,
 	})
 	if err != nil {
-		return "native"
+		return "reverse"
 	}
 	var v struct {
 		Order string `json:"order"`
 	}
 	if err := json.Unmarshal(row, &v); err != nil {
-		return "native"
+		return "reverse"
 	}
-	switch v.Order {
-	case "oldest", "newest":
-		return v.Order
+	if !services.ValidPodcastEpisodeOrder(v.Order) {
+		return "reverse"
 	}
-	return "native"
+	return v.Order
 }
 
 // facetValuesFromCards derives the filter bar values.
-func facetValuesFromCards(feeds []templates.PodcastFeedCard) map[string][]string {
-	hosts, tags, langs := map[string]bool{}, map[string]bool{}, map[string]bool{}
+// facetValuesFromCards derives the filter-bar values with feed counts,
+// sorted by frequency DESC then alphabetically — the top of each group
+// is what a user with hundreds of feeds actually filters by.
+func facetValuesFromCards(feeds []templates.PodcastFeedCard) map[string][]templates.FacetValue {
+	hosts, tags, langs := map[string]int{}, map[string]int{}, map[string]int{}
 	for _, f := range feeds {
 		if f.Host != "" {
-			hosts[f.Host] = true
+			hosts[f.Host]++
 		}
 		for _, t := range f.Tags {
-			tags[t] = true
+			tags[t]++
 		}
 		if f.Language != "" {
-			langs[f.Language] = true
+			langs[f.Language]++
 		}
 	}
-	return map[string][]string{
-		"hosts":    sortedSet(hosts),
-		"tags":     sortedSet(tags),
-		"language": sortedSet(langs),
+	return map[string][]templates.FacetValue{
+		"hosts":    sortedFacet(hosts),
+		"tags":     sortedFacet(tags),
+		"language": sortedFacet(langs),
 	}
 }
 
-func sortedSet(set map[string]bool) []string {
-	out := make([]string, 0, len(set))
-	for k := range set {
-		out = append(out, k)
+// sortedFacet: count DESC, then value ASC (stable, scannable).
+func sortedFacet(set map[string]int) []templates.FacetValue {
+	out := make([]templates.FacetValue, 0, len(set))
+	for k, n := range set {
+		out = append(out, templates.FacetValue{Value: k, Count: n})
 	}
-	sort.Strings(out)
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Count != out[j].Count {
+			return out[i].Count > out[j].Count
+		}
+		return out[i].Value < out[j].Value
+	})
 	return out
 }
 
@@ -455,7 +470,6 @@ func itoaPad(n int) string {
 	return fmt.Sprintf("%06d", n)
 }
 
-
 // parsePodcastUUID parses an id path param (handlers.parseUUID is
 // package-private).
 func parsePodcastUUID(s string) (pgtype.UUID, error) {

internal/router/reader.go

@@ -9,9 +9,8 @@ import (
 	"bookhoard/templates"
 	"bytes"
 	"encoding/json"
-	"fmt"
 	"net/http"
-	"sort"
+	"strings"
 
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5/pgtype"
@@ -168,6 +167,17 @@ func registerReaderRoutes(cfg *Config) {
 // reads; non-subscribers never reach this path in the first place.
 func buildPodcastSequenceContext(c *echo.Context, cfg *Config, item *database.MediaItems, userID pgtype.UUID, libraryType string) *templates.PodcastSequenceContext {
 	ctx := c.Request().Context()
+	// Queue override (plan item 2.3): ?queue=collection:<id> plays the
+	// episode inside an Up Next collection chain. Absent/malformed/
+	// not-owned ids fall back to the feed queue — the reader page must
+	// never hard-fail on a stale link.
+	if q := c.QueryParam("queue"); strings.HasPrefix(q, "collection:") {
+		if collID, err := uuid.Parse(strings.TrimPrefix(q, "collection:")); err == nil {
+			if seq := buildCollectionSequenceContext(c, cfg, item, userID, collID); seq != nil {
+				return seq
+			}
+		}
+	}
 	eps, err := cfg.Queries.ListPodcastEpisodes(ctx, item.SourceFeedID)
 	if err != nil || len(eps) == 0 {
 		return nil
@@ -177,8 +187,11 @@ func buildPodcastSequenceContext(c *echo.Context, cfg *Config, item *database.Me
 		return nil
 	}
 
-	// Effective order override (D5): reader_settings KV.
-	order := "native"
+	// Effective order override (D5): reader_settings KV. UNSET defaults
+	// to "reverse" (2026-11-01: audiobook-first — native document order
+	// starts a book at its last chapter); the same default the podcast
+	// page's Order dropdown shows. Stored overrides are untouched.
+	order := "reverse"
 	if row, err := cfg.Queries.GetUserSettingByKey(ctx, database.GetUserSettingByKeyParams{
 		UserID:     userID,
 		SettingKey: "podcast_order:" + uuid.UUID(item.SourceFeedID.Bytes).String(),
@@ -186,7 +199,7 @@ func buildPodcastSequenceContext(c *echo.Context, cfg *Config, item *database.Me
 		var v struct {
 			Order string `json:"order"`
 		}
-		if json.Unmarshal(row, &v) == nil && (v.Order == "oldest" || v.Order == "newest") {
+		if json.Unmarshal(row, &v) == nil && services.ValidPodcastEpisodeOrder(v.Order) {
 			order = v.Order
 		}
 	}
@@ -215,17 +228,11 @@ func buildPodcastSequenceContext(c *echo.Context, cfg *Config, item *database.Me
 			pos:   ep.FeedPosition.Int32,
 		})
 	}
-	sort.SliceStable(ordered, func(a, b int) bool {
-		ka := ordered[a].date + fmt.Sprintf("%06d", ordered[a].pos)
-		kb := ordered[b].date + fmt.Sprintf("%06d", ordered[b].pos)
-		if order == "newest" {
-			return ka > kb
-		}
-		if order == "oldest" {
-			return ka < kb
-		}
-		return ordered[a].pos < ordered[b].pos
-	})
+	// Effective listening order (order consolidation §0 item 5a).
+	services.OrderEpisodes(ordered, order,
+		func(e seqEp) int32 { return e.pos },
+		func(e seqEp) string { return e.date },
+	)
 
 	idx := -1
 	for i, ep := range ordered {
@@ -239,8 +246,13 @@ func buildPodcastSequenceContext(c *echo.Context, cfg *Config, item *database.Me
 	}
 
 	seq := &templates.PodcastSequenceContext{
-		FeedURL:      "/podcasts/" + uuid.UUID(item.SourceFeedID.Bytes).String(),
-		FeedTitle:    feed.Title,
+		FeedURL:   "/podcasts/" + uuid.UUID(item.SourceFeedID.Bytes).String(),
+		FeedTitle: feed.Title,
+		// R2: this producer is the feed queue. The player's order
+		// control renders only for this source.
+		Source:       "feed",
+		FeedID:       uuid.UUID(item.SourceFeedID.Bytes).String(),
+		Order:        order,
 		EpisodeIndex: idx + 1,
 		IndexTotal:   len(ordered),
 	}
@@ -253,3 +265,170 @@ func buildPodcastSequenceContext(c *echo.Context, cfg *Config, item *database.Me
 	}
 	return seq
 }
+
+// buildCollectionSequenceContext is the COLLECTION queue producer (plan
+// item 2.3, §10 R2: same context shape, different owner). The queue is
+// the collection's ordered downloaded episodes — the collection's
+// order IS content (R1), so no feed-order override applies here and
+// the player's order control stays hidden (source=collection).
+// Ownership gates the chain: collections are user-scoped app state
+// (no RLS on the table), and a foreign or deleted collection id falls
+// back to the feed queue. Prev/next URLs carry ?queue=collection:<id>
+// so the chain survives hops; backToDetail lands on the collection.
+func buildCollectionSequenceContext(c *echo.Context, cfg *Config, item *database.MediaItems, userID pgtype.UUID, collID uuid.UUID) *templates.PodcastSequenceContext {
+	ctx := c.Request().Context()
+	owns, err := cfg.CollectionHandler.CollectionService().UserOwnsCollection(ctx, collID, uuid.UUID(userID.Bytes))
+	if err != nil || !owns {
+		return nil
+	}
+	coll, err := cfg.Queries.GetCollection(ctx, pgtype.UUID{Bytes: collID, Valid: true})
+	if err != nil {
+		return nil
+	}
+	// Smart collections compute their membership live (R1: computed
+	// order, never written back) — evaluate the rules for THIS viewer
+	// and chain the downloaded episode matches in native feed order
+	// (R3: every listening order routes through OrderEpisodes).
+	if services.IsCollectionSmart(coll) {
+		return buildSmartCollectionSequenceContext(c, cfg, item, userID, coll)
+	}
+	// Downloaded episodes in collection order (SQL orders; RLS scopes
+	// the join — unsubscribed feeds drop out and the chain skips them).
+	eps, err := cfg.Queries.GetCollectionEpisodesOrdered(ctx, pgtype.UUID{Bytes: collID, Valid: true})
+	if err != nil || len(eps) == 0 {
+		return nil
+	}
+	// The curated listening order applies to static episode playlists
+	// too (§10 R2): native/"" keeps the manual position order (the SQL
+	// order above); reverse flips it; oldest/newest re-key on
+	// publication date with feed position as the tiebreak.
+	switch order := handlers.CollectionChainOrder(coll.ViewSettings); order {
+	case "reverse":
+		for i, j := 0, len(eps)-1; i < j; i, j = i+1, j-1 {
+			eps[i], eps[j] = eps[j], eps[i]
+		}
+	case "oldest", "newest":
+		services.OrderEpisodes(eps, order,
+			func(e database.GetCollectionEpisodesOrderedRow) int32 { return e.FeedPosition.Int32 },
+			func(e database.GetCollectionEpisodesOrderedRow) string {
+				if e.DatePublished.Valid {
+					return e.DatePublished.Time.Format("2006-01-02")
+				}
+				return ""
+			})
+	}
+
+	currentID := uuid.UUID(item.ID.Bytes).String()
+	idx := -1
+	for i, ep := range eps {
+		if uuid.UUID(ep.ID.Bytes).String() == currentID {
+			idx = i
+			break
+		}
+	}
+	if idx < 0 {
+		return nil // current episode not downloaded (or not in sequence)
+	}
+
+	queueParam := "?queue=collection:" + collID.String()
+	seq := &templates.PodcastSequenceContext{
+		FeedURL:      "/collections/" + collID.String(),
+		FeedTitle:    coll.Name,
+		Source:       "collection",
+		EpisodeIndex: idx + 1,
+		IndexTotal:   len(eps),
+	}
+	if idx > 0 {
+		seq.PrevURL = "/readers/" + uuid.UUID(eps[idx-1].ID.Bytes).String() + queueParam
+	}
+	if idx < len(eps)-1 {
+		seq.NextURL = "/readers/" + uuid.UUID(eps[idx+1].ID.Bytes).String() + queueParam
+		seq.NextTitle = eps[idx+1].Title
+	}
+	return seq
+}
+
+// buildSmartCollectionSequenceContext chains a SMART collection's live
+// membership (plan item 2.5 acceptance: "Daily Fiction" → Play =
+// today's episodes back-to-back). The rules evaluate for the requesting
+// user (mode from the collection; family lens via the visible set);
+// episode matches that are downloaded chain in native feed order.
+// Books and un-downloaded matches never enter the queue (invariant 6).
+func buildSmartCollectionSequenceContext(c *echo.Context, cfg *Config, item *database.MediaItems, userID pgtype.UUID, coll database.Collections) *templates.PodcastSequenceContext {
+	ctx := c.Request().Context()
+	colService := cfg.CollectionHandler.CollectionService()
+	visibleIDs, err := cfg.CollectionHandler.UserVisibleLibraryIDs(c)
+	if err != nil {
+		visibleIDs = nil
+	}
+	matches, err := colService.EvaluateSmartMembership(ctx, coll, services.SmartEvalOptions{
+		VisibleIDs:   visibleIDs,
+		ViewerUserID: userID,
+	})
+	if err != nil {
+		return nil
+	}
+
+	type seqEp struct {
+		id    string
+		title string
+		date  string
+		pos   int32
+	}
+	ordered := make([]seqEp, 0, len(matches))
+	currentID := uuid.UUID(item.ID.Bytes).String()
+	for _, m := range matches {
+		if m.Source != "podcast_episode" || m.DownloadState != "downloaded" {
+			continue
+		}
+		date := ""
+		if m.DatePublished.Valid {
+			date = m.DatePublished.Time.Format("2006-01-02")
+		}
+		ordered = append(ordered, seqEp{
+			id:    uuid.UUID(m.ID.Bytes).String(),
+			title: m.Title,
+			date:  date,
+			pos:   m.FeedPosition.Int32,
+		})
+	}
+	if len(ordered) == 0 {
+		return nil
+	}
+	// Plan §10 R2: the collection's CURATED listening order (stored in
+	// view_settings.chain_order, set from the detail header) — not a
+	// player-side knob. "" / native / unknown all mean feed order.
+	services.OrderEpisodes(ordered, handlers.CollectionChainOrder(coll.ViewSettings),
+		func(e seqEp) int32 { return e.pos },
+		func(e seqEp) string { return e.date },
+	)
+
+	idx := -1
+	for i, ep := range ordered {
+		if ep.id == currentID {
+			idx = i
+			break
+		}
+	}
+	if idx < 0 {
+		return nil
+	}
+
+	collID := uuid.UUID(coll.ID.Bytes).String()
+	queueParam := "?queue=collection:" + collID
+	seq := &templates.PodcastSequenceContext{
+		FeedURL:      "/collections/" + collID,
+		FeedTitle:    coll.Name,
+		Source:       "collection",
+		EpisodeIndex: idx + 1,
+		IndexTotal:   len(ordered),
+	}
+	if idx > 0 {
+		seq.PrevURL = "/readers/" + ordered[idx-1].id + queueParam
+	}
+	if idx < len(ordered)-1 {
+		seq.NextURL = "/readers/" + ordered[idx+1].id + queueParam
+		seq.NextTitle = ordered[idx+1].title
+	}
+	return seq
+}

internal/router/search.go

@@ -16,6 +16,10 @@ func registerSearchRoutes(cfg *Config) {
 	// JWT middleware for protected routes
 	jwtMiddleware := createJWTMiddleware(cfg)
 	protected := e.Group("/api", jwtMiddleware)
+	// Filter label resolution (2026-11-01): names id-kind filter values
+	// from their source tables for trees the server didn't render (the
+	// cold saved-filter apply). Visibility/RLS ride the request identity.
+	protected.GET("/filter/labels", cfg.MediaHandler.ResolveFilterLabels)
 	// Search endpoint - returns JSON or HTML based on HX-Request header
 	protected.GET("/media-items/search", func(c *echo.Context) error {
 		// Check if HTMX request (expects HTML)
@@ -41,6 +45,24 @@ func handleSearchHTML(c *echo.Context, cfg *Config) error {
 	if !ok {
 		return c.String(http.StatusUnauthorized, "Unauthorized")
 	}
+
+	// Episode picker scope (plan item 2.3): ?scope=episodes&show_checkbox=true
+	// swaps the book cards for YOUR subscriptions' episodes — visibility
+	// is the RLS policy's job (D20), the Go side adds nothing. The books
+	// branch keeps its podcasts exclusion; this is the only door in.
+	if c.QueryParam("scope") == "episodes" && c.QueryParam("show_checkbox") == "true" {
+		eps, err := cfg.Queries.SearchEpisodesForPicker(c.Request().Context(), c.QueryParam("q"))
+		if err != nil {
+			log.Printf("Episode picker search error: %v", err)
+			return c.HTML(http.StatusInternalServerError, `<div style="color: red;">Search error</div>`)
+		}
+		var buf bytes.Buffer
+		if err := templates.EpisodePickerGrid(eps).Render(c.Request().Context(), &buf); err != nil {
+			return err
+		}
+		return c.HTML(http.StatusOK, buf.String())
+	}
+
 	// Extract filters via the SHARED parser (handlers.ParseMediaSearchParams)
 	// — the HTMX grid partial and the JSON endpoint can never disagree on
 	// which facet params exist or how they parse. (This branch previously

internal/services/collection_service.go

@@ -6,7 +6,9 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"strconv"
 	"strings"
+	"time"
 
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5"
@@ -30,24 +32,6 @@ type Rule struct {
 	Enabled *bool `json:"enabled,omitempty"`
 }
 
-// Known rule fields and operators — the rules builder UI and the
-// persisted JSONB documents must agree with this vocabulary.
-var ruleFields = map[string]bool{
-	"genre": true, "series": true, "author": true, "language": true,
-	"publisher": true, "copyright_year": true, "tags": true,
-}
-
-var ruleOperators = map[string]bool{
-	"equals": true, "not_equals": true, "contains": true, "not_contains": true,
-	"starts_with": true, "ends_with": true, "greater_than": true, "less_than": true,
-}
-
-// RuleValidationError reports a rule payload the evaluator could never
-// honor (unknown field/operator, empty value).
-type RuleValidationError struct{ Msg string }
-
-func (e *RuleValidationError) Error() string { return e.Msg }
-
 // RuleEvaluation represents the result of evaluating a rule
 type RuleEvaluation struct {
 	RuleID     string  `json:"rule_id"`
@@ -58,27 +42,28 @@ type RuleEvaluation struct {
 // CollectionService handles collection management
 type CollectionService struct {
 	db *database.Queries
+	// search powers the unified-engine path (item 3.2): tree-driven
+	// smart collections evaluate via ComposedLiveMedia. Optional —
+	// nil disables tree evaluation (legacy-only services, which keeps
+	// every existing constructor call site valid).
+	search *SearchService
 }
 
-// NewCollectionService creates a new collection service
-func NewCollectionService(db *database.Queries) *CollectionService {
-	return &CollectionService{
-		db: db,
+// NewCollectionService creates a new collection service. search is
+// optional (variadic for constructor compatibility) — required for
+// TREE-driven smart collections (item 3.2), ignored otherwise.
+func NewCollectionService(db *database.Queries, search ...*SearchService) *CollectionService {
+	svc := &CollectionService{db: db}
+	if len(search) > 0 {
+		svc.search = search[0]
 	}
+	return svc
 }
 
-// CreateCollection creates a new collection
-func (s *CollectionService) CreateCollection(ctx context.Context, userID uuid.UUID, name, description, color, icon string, autoAssignRules []Rule, viewSettings map[string]any) (database.Collections, error) {
-	// Convert rules to JSONB ([]byte)
-	var rulesJSON []byte
-	if len(autoAssignRules) > 0 {
-		var err error
-		rulesJSON, err = json.Marshal(autoAssignRules)
-		if err != nil {
-			return database.Collections{}, fmt.Errorf("failed to marshal auto-assign rules: %v", err)
-		}
-	}
-
+// CreateCollection creates a new collection. filterTree (item 3.2), when
+// present, makes it smart — the qf engine is the only membership source
+// (the legacy rules-array storage retired 2026-10-31).
+func (s *CollectionService) CreateCollection(ctx context.Context, userID uuid.UUID, name, description, color, icon string, viewSettings map[string]any, showOnDashboard bool, filterTree []byte) (database.Collections, error) {
 	// Convert view settings to JSONB ([]byte)
 	var settingsJSON []byte
 	if len(viewSettings) > 0 {
@@ -95,8 +80,9 @@ func (s *CollectionService) CreateCollection(ctx context.Context, userID uuid.UU
 		Description:     pgtype.Text{String: description, Valid: description != ""},
 		Color:           pgtype.Text{String: color, Valid: color != ""},
 		Icon:            pgtype.Text{String: icon, Valid: icon != ""},
-		AutoAssignRules: rulesJSON,
 		ViewSettings:    settingsJSON,
+		FilterTree:      filterTree,
+		ShowOnDashboard: pgtype.Bool{Bool: showOnDashboard, Valid: true},
 	})
 
 	if err != nil {
@@ -132,14 +118,17 @@ func (s *CollectionService) GetUserCollections(ctx context.Context, userID uuid.
 	return collections, nil
 }
 
-// UpdateCollection updates a collection
-func (s *CollectionService) UpdateCollection(ctx context.Context, collectionID uuid.UUID, name, description, color, icon string, autoAssignRules []Rule, viewSettings map[string]any) (database.Collections, error) {
+// UpdateCollection rewrites the collection row. filterTree semantics:
+// nil = leave the stored tree untouched (forms don't send trees).
+func (s *CollectionService) UpdateCollection(ctx context.Context, collectionID uuid.UUID, name, description, color, icon string, viewSettings map[string]any, filterTree []byte) (database.Collections, error) {
 	// A2c §3.3: the edit form carries only the toggles it renders — merge
 	// them OVER the stored view_settings so provenance keys
 	// (imported_from_series) and anything else on the row survive.
-	if len(viewSettings) > 0 {
-		existing, err := s.db.GetCollection(ctx, pgtype.UUID{Bytes: collectionID, Valid: true})
-		if err == nil && len(existing.ViewSettings) > 0 {
+	if existing, err := s.db.GetCollection(ctx, pgtype.UUID{Bytes: collectionID, Valid: true}); err == nil {
+		if filterTree == nil {
+			filterTree = existing.FilterTree // nil = untouched (forms don't send trees)
+		}
+		if len(viewSettings) > 0 && len(existing.ViewSettings) > 0 {
 			var stored map[string]any
 			if json.Unmarshal(existing.ViewSettings, &stored) == nil {
 				merged := stored
@@ -149,18 +138,18 @@ func (s *CollectionService) UpdateCollection(ctx context.Context, collectionID u
 				viewSettings = merged
 			}
 		}
-	}
-
-	// Convert rules to JSONB ([]byte)
-	var rulesJSON []byte
-	if len(autoAssignRules) > 0 {
-		var err error
-		rulesJSON, err = json.Marshal(autoAssignRules)
-		if err != nil {
-			return database.Collections{}, fmt.Errorf("failed to marshal auto-assign rules: %v", err)
+		// Same convention as filterTree: a NIL view_settings payload
+		// means untouched — keep the stored doc. Without this, an edit
+		// that carries no settings wrote NULL over the row and silently
+		// dropped every stored key (chain_order, imported provenance);
+		// the 2026-10-31 chain-order test pinned exactly this clobber.
+		if viewSettings == nil && len(existing.ViewSettings) > 0 {
+			var stored map[string]any
+			if json.Unmarshal(existing.ViewSettings, &stored) == nil && len(stored) > 0 {
+				viewSettings = stored
+			}
 		}
 	}
-
 	// Convert view settings to JSONB ([]byte)
 	var settingsJSON []byte
 	if len(viewSettings) > 0 {
@@ -172,17 +161,17 @@ func (s *CollectionService) UpdateCollection(ctx context.Context, collectionID u
 	}
 
 	collection, err := s.db.UpdateCollection(ctx, database.UpdateCollectionParams{
-		ID:              pgtype.UUID{Bytes: collectionID, Valid: true},
-		Name:            name,
-		Description:     pgtype.Text{String: description, Valid: description != ""},
-		Color:           pgtype.Text{String: color, Valid: color != ""},
-		Icon:            pgtype.Text{String: icon, Valid: icon != ""},
-		AutoAssignRules: rulesJSON,
-		ViewSettings:    settingsJSON,
+		ID:           pgtype.UUID{Bytes: collectionID, Valid: true},
+		Name:         name,
+		Description:  pgtype.Text{String: description, Valid: description != ""},
+		Color:        pgtype.Text{String: color, Valid: color != ""},
+		Icon:         pgtype.Text{String: icon, Valid: icon != ""},
+		ViewSettings: settingsJSON,
+		FilterTree:   filterTree,
 	})
 
 	if err != nil {
-		return database.Collections{}, fmt.Errorf("failed to update collection: %v", err)
+		return database.Collections{}, fmt.Errorf("failed to update collection: %w", err)
 	}
 
 	return collection, nil
@@ -260,162 +249,7 @@ func (s *CollectionService) GetBookCollections(ctx context.Context, mediaItemID
 	}
 
 	return collections, nil
-}
-
-// ParseRules decodes a collection's auto_assign_rules JSONB into typed
-// rules. "null", empty, and malformed docs mean "no rules".
-func (s *CollectionService) ParseRules(raw []byte) []Rule {
-	if len(raw) == 0 {
-		return nil
-	}
-	var rules []Rule
-	if err := json.Unmarshal(raw, &rules); err != nil {
-		return nil
-	}
-	return rules
-}
-
-// IsSmartCollection derives the collection type: a non-empty ruleset
-// makes it SMART (live-matched), an empty/absent ruleset makes it STATIC
-// (stored collection_items links).
-func (s *CollectionService) IsSmartCollection(raw []byte) bool {
-	return len(s.ParseRules(raw)) > 0
-}
-
-// EnabledRules filters a ruleset down to the rules that participate in
-// live evaluation (absent enabled = enabled for backward compatibility).
-func (s *CollectionService) EnabledRules(rules []Rule) []Rule {
-	enabled := make([]Rule, 0, len(rules))
-	for _, rule := range rules {
-		if rule.Enabled == nil || *rule.Enabled {
-			enabled = append(enabled, rule)
-		}
-	}
-	return enabled
-}
-
-// validateRule checks a rule payload the evaluator will have to honor.
-func (s *CollectionService) validateRule(rule Rule) error {
-	if !ruleFields[rule.Field] {
-		return &RuleValidationError{Msg: "unknown rule field: " + rule.Field}
-	}
-	if !ruleOperators[rule.Operator] {
-		return &RuleValidationError{Msg: "unknown rule operator: " + rule.Operator}
-	}
-	if strings.TrimSpace(rule.Value) == "" {
-		return &RuleValidationError{Msg: "rule value is required"}
-	}
-	if rule.Priority < 0 || rule.Priority > 10 {
-		return &RuleValidationError{Msg: "priority must be between 0 and 10"}
-	}
-	return nil
-}
-
-// AddRule appends a rule to the collection's ruleset, generating an id
-// when the caller did not supply one. Adding the first rule CONVERTS a
-// static collection to smart (type is derived from rules presence).
-func (s *CollectionService) AddRule(ctx context.Context, collectionID uuid.UUID, rule Rule) (database.Collections, Rule, error) {
-	if err := s.validateRule(rule); err != nil {
-		return database.Collections{}, Rule{}, err
-	}
-
-	collection, err := s.GetCollection(ctx, collectionID)
-	if err != nil {
-		return database.Collections{}, Rule{}, err
-	}
-
-	rules := s.ParseRules(collection.AutoAssignRules)
-	if rule.ID == "" {
-		rule.ID = uuid.NewString()
-	}
-	rules = append(rules, rule)
-
-	rulesJSON, marshalErr := json.Marshal(rules)
-	if marshalErr != nil {
-		return database.Collections{}, Rule{}, fmt.Errorf("failed to marshal rules: %w", marshalErr)
-	}
-
-	updated, err := s.db.UpdateCollectionRulesJSON(ctx, database.UpdateCollectionRulesJSONParams{
-		ID:              pgtype.UUID{Bytes: collectionID, Valid: true},
-		AutoAssignRules: rulesJSON,
-	})
-	if err != nil {
-		return database.Collections{}, Rule{}, fmt.Errorf("failed to save rules: %w", err)
-	}
-	return updated, rule, nil
-}
-
-// SetRuleEnabled flips a single rule's enabled flag in place.
-func (s *CollectionService) SetRuleEnabled(ctx context.Context, collectionID uuid.UUID, ruleID string, enabled bool) (database.Collections, error) {
-	collection, err := s.GetCollection(ctx, collectionID)
-	if err != nil {
-		return database.Collections{}, err
-	}
-	rules := s.ParseRules(collection.AutoAssignRules)
-	found := false
-	for i := range rules {
-		if rules[i].ID == ruleID {
-			rules[i].Enabled = &enabled
-			found = true
-			break
-		}
-	}
-	if !found {
-		return database.Collections{}, fmt.Errorf("rule not found: %s", ruleID)
-	}
-
-	rulesJSON, marshalErr := json.Marshal(rules)
-	if marshalErr != nil {
-		return database.Collections{}, fmt.Errorf("failed to marshal rules: %w", marshalErr)
-	}
-
-	updated, err := s.db.UpdateCollectionRulesJSON(ctx, database.UpdateCollectionRulesJSONParams{
-		ID:              pgtype.UUID{Bytes: collectionID, Valid: true},
-		AutoAssignRules: rulesJSON,
-	})
-	if err != nil {
-		return database.Collections{}, fmt.Errorf("failed to save rules: %w", err)
-	}
-	return updated, nil
-}
-
-// RemoveRule deletes a single rule from the ruleset. Removing the LAST
-// rule converts the collection back to static (type is derived).
-func (s *CollectionService) RemoveRule(ctx context.Context, collectionID uuid.UUID, ruleID string) (database.Collections, error) {
-	collection, err := s.GetCollection(ctx, collectionID)
-	if err != nil {
-		return database.Collections{}, err
-	}
-	rules := s.ParseRules(collection.AutoAssignRules)
-	kept := make([]Rule, 0, len(rules))
-	found := false
-	for _, rule := range rules {
-		if rule.ID == ruleID {
-			found = true
-			continue
-		}
-		kept = append(kept, rule)
-	}
-	if !found {
-		return database.Collections{}, fmt.Errorf("rule not found: %s", ruleID)
-	}
-
-	rulesJSON, marshalErr := json.Marshal(kept)
-	if marshalErr != nil {
-		return database.Collections{}, fmt.Errorf("failed to marshal rules: %w", marshalErr)
-	}
-
-	updated, err := s.db.UpdateCollectionRulesJSON(ctx, database.UpdateCollectionRulesJSONParams{
-		ID:              pgtype.UUID{Bytes: collectionID, Valid: true},
-		AutoAssignRules: rulesJSON,
-	})
-	if err != nil {
-		return database.Collections{}, fmt.Errorf("failed to save rules: %w", err)
-	}
-	return updated, nil
-}
-
-// SmartEvalOptions scopes a smart collection's live evaluation.
+} // EnabledRules filters a ruleset down to the rules that participate in// validateRule checks a rule payload the evaluator will have to honor.// AddRule appends a rule to the collection's ruleset, generating an id// SetRuleEnabled flips a single rule's enabled flag in place.// RemoveRule deletes a single rule from the ruleset. Removing the LAST// SmartEvalOptions scopes a smart collection's live evaluation.
 type SmartEvalOptions struct {
 	// LibraryID, when valid, restricts matching to one library (the
 	// detail page's library switcher).
@@ -423,54 +257,98 @@ type SmartEvalOptions struct {
 	// VisibleIDs is the requesting user's visible-library set (family
 	// lens). Empty means no visible-library filter.
 	VisibleIDs []pgtype.UUID
+	// ViewerUserID scopes the candidate query's progress join — the
+	// played/unplayed rule is per-user. Zero UUID = no viewer (played
+	// rules then see "unplayed" for everything, honestly).
+	ViewerUserID pgtype.UUID
 }
 
-// EvaluateSmartCollection resolves a smart collection's membership LIVE:
-// every visible live book matched by at least one enabled rule is in.
-// No stored links are consulted — "truly dynamic," always current.
-func (s *CollectionService) EvaluateSmartCollection(ctx context.Context, rules []Rule, opts SmartEvalOptions) ([]database.MediaItems, error) {
-	enabled := s.EnabledRules(rules)
-	if len(enabled) == 0 {
-		return []database.MediaItems{}, nil
-	}
+// IsCollectionSmart is the ONE smart detection: a collection is smart
+// when it carries the unified filter tree (item 3.2). Every surface
+// routes through this. (The legacy rules-array branch retired
+// 2026-10-31 — the tree is the only smart storage.)
+func IsCollectionSmart(coll database.Collections) bool {
+	return len(coll.FilterTree) > 0
+}
 
-	var visibleArg []pgtype.UUID
-	if len(opts.VisibleIDs) > 0 {
-		visibleArg = opts.VisibleIDs
-	}
-	items, err := s.db.GetVisibleLiveMediaForRules(ctx, database.GetVisibleLiveMediaForRulesParams{
-		LibraryID:         opts.LibraryID,
-		VisibleLibraryIds: visibleArg,
-	})
+// Search exposes the composed search engine the service was built with
+// (nil when the constructor omitted it) — callers composing secondary
+// services that evaluate trees (the dashboard service) pass it through.
+func (s *CollectionService) Search() *SearchService { return s.search }
+
+// IsCollectionSmartColl is IsCollectionSmart on the service handle —
+// the dashboard service composes this service and calls the detector
+// through it (no import cycle, one detection definition).
+func (s *CollectionService) IsCollectionSmartColl(coll database.Collections) bool {
+	return IsCollectionSmart(coll)
+}
+
+// EvaluateSmartMembership is THE single smart evaluator (item 3.2):
+// tree-bearing collections evaluate through the unified filter engine.
+func (s *CollectionService) EvaluateSmartMembership(ctx context.Context, coll database.Collections, opts SmartEvalOptions) ([]database.MediaItems, error) {
+	return s.evaluateTreeMembership(ctx, coll, opts)
+}
+
+func (s *CollectionService) evaluateTreeMembership(ctx context.Context, coll database.Collections, opts SmartEvalOptions) ([]database.MediaItems, error) {
+	tree, err := ParseFilterTree(string(coll.FilterTree))
 	if err != nil {
-		return nil, fmt.Errorf("failed to load candidate books: %w", err)
+		return nil, fmt.Errorf("collection %s has an invalid filter tree: %v", coll.ID, err)
 	}
-
-	matches := make([]database.MediaItems, 0, len(items))
-	for _, item := range items {
-		if s.mediaItemMatchesAnyRule(item, enabled) {
-			matches = append(matches, item)
-		}
+	if s.search == nil {
+		return nil, errors.New("tree collections require the search service (constructor wiring)")
 	}
-	return matches, nil
+	return s.search.ComposedLiveMedia(ctx, opts.ViewerUserID, opts.LibraryID, opts.VisibleIDs, tree)
 }
 
-func (s *CollectionService) mediaItemMatchesAnyRule(item database.MediaItems, rules []Rule) bool {
-	for _, rule := range rules {
-		if s.mediaItemMatchesRule(item, rule) {
-			return true
-		}
-	}
-	return false
+// episodeFinished is THE canonical finished definition (same predicate
+// as hide_finished): viewer progress percentage >= 0.999.
+func episodeFinished(viewerPercentage float64) bool {
+	return viewerPercentage >= 0.999
 }
 
-func (s *CollectionService) mediaItemMatchesRule(item database.MediaItems, rule Rule) bool {
-	if rule.Enabled != nil && !*rule.Enabled {
+// FieldMatches is THE single rule evaluator (the rules-builder preview
+// delegates here too — one vocabulary, one semantics). Episode/user-state
+// fields (feed/played/downloaded/published_within) evaluate directly;
+// everything else extracts a string and hits the generic comparator.
+func (s *CollectionService) FieldMatches(item database.MediaItems, viewerPercentage float64, field, operator, value string) bool {
+	switch field {
+	case "feed":
+		if !item.SourceFeedID.Valid {
+			return false
+		}
+		feedID := uuid.UUID(item.SourceFeedID.Bytes).String()
+		for _, raw := range strings.Split(value, ",") {
+			if strings.TrimSpace(raw) == feedID {
+				return true
+			}
+		}
 		return false
+	case "played":
+		wantPlayed := value == "true"
+		return episodeFinished(viewerPercentage) == wantPlayed
+	case "downloaded":
+		wantDownloaded := value == "true"
+		return (item.DownloadState == "downloaded") == wantDownloaded
+	case "published_within":
+		if !item.DatePublished.Valid {
+			return false
+		}
+		days, err := strconv.Atoi(strings.TrimSpace(value))
+		if err != nil || days < 0 {
+			return false
+		}
+		cutoff := time.Now().UTC().AddDate(0, 0, -days)
+		return item.DatePublished.Time.After(cutoff)
 	}
 
 	var fieldValue string
-	switch rule.Field {
+	switch field {
+	case "title":
+		fieldValue = item.Title
+	case "description":
+		if item.Description.Valid {
+			fieldValue = item.Description.String
+		}
 	case "genre":
 		if item.Genre.Valid {
 			fieldValue = item.Genre.String
@@ -501,11 +379,14 @@ func (s *CollectionService) mediaItemMatchesRule(item database.MediaItems, rule
 		}
 	}
 
-	return s.evaluateRule(fieldValue, rule.Operator, rule.Value)
+	return s.evaluateRule(fieldValue, operator, value)
 }
 
-// EvaluateRules evaluates auto-assign rules for a media item
-func (s *CollectionService) EvaluateRules(mediaItem database.MediaItems, rules []Rule) []RuleEvaluation {
+// EvaluateRules evaluates auto-assign rules for a media item — the
+// rules-builder preview's per-rule view. viewerPercentage is the
+// requesting user's progress for this item (0 = none), so played /
+// unplayed rules preview honestly (plan item 2.4).
+func (s *CollectionService) EvaluateRules(mediaItem database.MediaItems, viewerPercentage float64, rules []Rule) []RuleEvaluation {
 	var evaluations []RuleEvaluation
 
 	// Sort rules by priority (higher priority first)
@@ -527,40 +408,7 @@ func (s *CollectionService) EvaluateRules(mediaItem database.MediaItems, rules [
 		}
 		eval := RuleEvaluation{
 			RuleID:  rule.ID,
-			Matches: false,
-		}
-
-		switch rule.Field {
-		case "genre":
-			if mediaItem.Genre.Valid {
-				eval.Matches = s.evaluateRule(mediaItem.Genre.String, rule.Operator, rule.Value)
-			}
-		case "series":
-			if mediaItem.Series.Valid {
-				eval.Matches = s.evaluateRule(mediaItem.Series.String, rule.Operator, rule.Value)
-			}
-		case "author":
-			if mediaItem.Author.Valid {
-				eval.Matches = s.evaluateRule(mediaItem.Author.String, rule.Operator, rule.Value)
-			}
-		case "language":
-			if mediaItem.Language.Valid {
-				eval.Matches = s.evaluateRule(mediaItem.Language.String, rule.Operator, rule.Value)
-			}
-		case "publisher":
-			if mediaItem.Publisher.Valid {
-				eval.Matches = s.evaluateRule(mediaItem.Publisher.String, rule.Operator, rule.Value)
-			}
-		case "copyright_year":
-			if mediaItem.CopyrightYear.Valid {
-				yearStr := fmt.Sprintf("%d", mediaItem.CopyrightYear.Int32)
-				eval.Matches = s.evaluateRule(yearStr, rule.Operator, rule.Value)
-			}
-		case "tags":
-			if len(mediaItem.Tags) > 0 {
-				tagsStr := strings.Join(mediaItem.Tags, ", ")
-				eval.Matches = s.evaluateRule(tagsStr, rule.Operator, rule.Value)
-			}
+			Matches: s.FieldMatches(mediaItem, viewerPercentage, rule.Field, rule.Operator, rule.Value),
 		}
 
 		// Calculate confidence based on rule type and priority
@@ -654,6 +502,121 @@ func compareNumbers(a, b, op string) bool {
 }
 
 // CreateDeviceShelfMapping creates a shelf mapping for a device
+
+// ── Custom-section-builder adapter (2026-10-31) ──────────────────
+// The builder posts the legacy rules vocabulary; these convert it to a
+// qf tree at WRITE time — one-way upgrade, storage stays tree-only.
+// (The 2026-10-31 retirement deleted these as READ-time conversion;
+// the builder's tree migration revived them as the single write path.)
+
+// The builder's match_type select: "any" (OR) | "all" (AND).
+const (
+	RuleMatchAny = "any"
+	RuleMatchAll = "all"
+)
+
+// The builder posts the legacy rules vocabulary; these convert it to a
+// qf tree at WRITE time — one-way upgrade, storage stays tree-only.
+// (The 2026-10-31 retirement deleted these as READ-time conversion;
+// the builder's tree migration revived them as the single write path.)
+
+// RulesToFilterTree converts a legacy rules array + its match mode
+// into a qf tree so a collection upgrades to the unified engine at its
+// first edit (item 3.2): zero-rewrite back-compat at read, one-way
+// upgrade at write. Episode rules map mechanically (feed→in-list,
+// played/downloaded→booleans, published_within→published_date
+// within_days); legacy operators without an engine equivalent
+// (starts_with/ends_with) fall back to contains — documented, and the
+// operator labels stay in the rules docs.
+func RulesToFilterTree(rules []Rule, matchMode string) (*FilterTree, error) {
+	children := make([]FilterChild, 0, len(rules))
+	scope := ""
+	for _, r := range rules {
+		child, err := ruleToFilterChild(r)
+		if err != nil {
+			return nil, err
+		}
+		if episodeOnlyFields[r.Field] {
+			scope = ScopeEpisodes
+		}
+		children = append(children, child)
+	}
+	if len(children) == 0 {
+		return nil, fmt.Errorf("no rules to convert")
+	}
+	mode := RuleMatchAny
+	if matchMode == RuleMatchAll {
+		mode = RuleMatchAll
+	}
+	return &FilterTree{Scope: scope, Mode: mode, Children: children}, nil
+}
+
+func ruleToFilterChild(r Rule) (FilterChild, error) {
+	child := FilterChild{Field: r.Field}
+	switch r.Field {
+	case "feed":
+		// The rules format stores comma-separated feed IDs in one value.
+		child.Op = OpIn
+		child.Values = splitRuleValues(r.Value)
+		return child, nil
+	case "downloaded":
+		child.Op = isTrueFalse(r.Value == "true")
+		return child, nil
+	case "played":
+		child.Op = isTrueFalse(r.Value == "true")
+		return child, nil
+	case "published_within":
+		child.Field = "published_date"
+		child.Op = OpWithinDays
+		child.Values = []string{r.Value}
+		return child, nil
+	}
+	// Registry fields: legacy operators → engine operators.
+	switch r.Operator {
+	case "equals":
+		child.Op = OpIs
+	case "not_equals":
+		child.Op = OpIsNot
+	case "contains":
+		child.Op = OpContains
+	case "not_contains":
+		child.Op = OpNotContains
+	case "greater_than":
+		child.Op = OpAtLeast
+	case "less_than":
+		child.Op = OpAtMost
+	case "in":
+		child.Op = OpIn
+		child.Values = splitRuleValues(r.Value)
+	case "starts_with", "ends_with":
+		// No engine equivalent — contains is the honest nearest.
+		child.Op = OpContains
+	default:
+		return FilterChild{}, fmt.Errorf("legacy rule operator %q has no filter-engine equivalent", r.Operator)
+	}
+	child.Values = []string{r.Value}
+	return child, nil
+}
+
+func isTrueFalse(b bool) string {
+	if b {
+		return OpIsTrue
+	}
+	return OpIsFalse
+}
+
+func splitRuleValues(v string) []string {
+	parts := strings.Split(v, ",")
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		p = strings.TrimSpace(p)
+		if p != "" {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
 func (s *CollectionService) CreateDeviceShelfMapping(ctx context.Context, collectionID, deviceID uuid.UUID, deviceShelfName, syncDirection string) (database.DeviceShelfMappings, error) {
 	mapping, err := s.db.CreateDeviceShelfMapping(ctx, database.CreateDeviceShelfMappingParams{
 		CollectionID:    pgtype.UUID{Bytes: collectionID, Valid: true},

internal/services/collection_service_test.go

@@ -24,7 +24,7 @@ func TestEvaluateRules_Equality(t *testing.T) {
 		},
 	}
 
-	evaluations := service.EvaluateRules(mediaItem, rules)
+	evaluations := service.EvaluateRules(mediaItem, 0, rules)
 
 	if len(evaluations) != 1 {
 		t.Fatalf("expected 1 evaluation, got %d", len(evaluations))
@@ -56,7 +56,7 @@ func TestEvaluateRules_NoMatch(t *testing.T) {
 		},
 	}
 
-	evaluations := service.EvaluateRules(mediaItem, rules)
+	evaluations := service.EvaluateRules(mediaItem, 0, rules)
 
 	if len(evaluations) != 1 {
 		t.Fatalf("expected 1 evaluation, got %d", len(evaluations))
@@ -88,7 +88,7 @@ func TestEvaluateRules_Contains(t *testing.T) {
 		},
 	}
 
-	evaluations := service.EvaluateRules(mediaItem, rules)
+	evaluations := service.EvaluateRules(mediaItem, 0, rules)
 
 	if len(evaluations) != 1 {
 		t.Fatalf("expected 1 evaluation, got %d", len(evaluations))
@@ -128,7 +128,7 @@ func TestEvaluateRules_PriorityOrder(t *testing.T) {
 		},
 	}
 
-	evaluations := service.EvaluateRules(mediaItem, rules)
+	evaluations := service.EvaluateRules(mediaItem, 0, rules)
 
 	if len(evaluations) != 2 {
 		t.Fatalf("expected 2 evaluations, got %d", len(evaluations))
@@ -164,7 +164,7 @@ func TestEvaluateRules_CopyrightYear(t *testing.T) {
 		},
 	}
 
-	evaluations := service.EvaluateRules(mediaItem, rules)
+	evaluations := service.EvaluateRules(mediaItem, 0, rules)
 
 	if len(evaluations) != 1 {
 		t.Fatalf("expected 1 evaluation, got %d", len(evaluations))
@@ -190,7 +190,7 @@ func TestEvaluateRules_MissingField(t *testing.T) {
 		},
 	}
 
-	evaluations := service.EvaluateRules(mediaItem, rules)
+	evaluations := service.EvaluateRules(mediaItem, 0, rules)
 
 	if len(evaluations) != 1 {
 		t.Fatalf("expected 1 evaluation, got %d", len(evaluations))
@@ -218,7 +218,7 @@ func TestEvaluateRules_CaseInsensitive(t *testing.T) {
 		},
 	}
 
-	evaluations := service.EvaluateRules(mediaItem, rules)
+	evaluations := service.EvaluateRules(mediaItem, 0, rules)
 
 	if len(evaluations) != 1 {
 		t.Fatalf("expected 1 evaluation, got %d", len(evaluations))
@@ -253,7 +253,7 @@ func TestEvaluateRules_PriorityBoost(t *testing.T) {
 		},
 	}
 
-	evaluations := service.EvaluateRules(mediaItem, rules)
+	evaluations := service.EvaluateRules(mediaItem, 0, rules)
 
 	if len(evaluations) != 2 {
 		t.Fatalf("expected 2 evaluations, got %d", len(evaluations))
@@ -276,3 +276,8 @@ func TestEvaluateRules_PriorityBoost(t *testing.T) {
 		t.Errorf("expected higher priority rule to be first, got %s", evaluations[0].RuleID)
 	}
 }
+
+// TestRulesToFilterTree retired 2026-10-31 with the function it tested:
+// rules-array storage is gone, the filter tree is the only smart
+// membership. (Tests of deleted behavior are deleted — the asymmetry
+// rule.)

internal/services/dashboard_service.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log"
 
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5"
@@ -17,10 +18,10 @@ type DashboardService struct {
 	collectionService *CollectionService
 }
 
-func NewDashboardService(db *database.Queries) *DashboardService {
+func NewDashboardService(db *database.Queries, search ...*SearchService) *DashboardService {
 	return &DashboardService{
 		db:                db,
-		collectionService: NewCollectionService(db),
+		collectionService: NewCollectionService(db, search...),
 	}
 }
 
@@ -293,52 +294,44 @@ func (s *DashboardService) getUserCollectionItems(ctx context.Context, coll data
 
 	// The query filters excluded rows in SQL and embeds the media row,
 	// so the items are MediaItems as-is.
-	var manualNonExcluded []database.MediaItems
+	items := make([]database.MediaItems, 0, len(manualItems))
+	seen := make(map[uuid.UUID]bool, len(manualItems))
 	for _, row := range manualItems {
-		manualNonExcluded = append(manualNonExcluded, row.MediaItems)
+		id := uuid.UUID(row.MediaItems.ID.Bytes)
+		if !seen[id] {
+			items = append(items, row.MediaItems)
+			seen[id] = true
+		}
 	}
 
-	var autoItems []database.MediaItems
-	if len(coll.AutoAssignRules) > 0 {
-		var rules []Rule
-		if err := json.Unmarshal(coll.AutoAssignRules, &rules); err == nil && len(rules) > 0 {
-			allLibraryItems, err := s.db.GetLibraryItems(ctx, libraryID)
-			if err == nil {
-				for _, item := range allLibraryItems {
-					alreadyInCollection := false
-					for _, manualItem := range manualNonExcluded {
-						manualUUID := uuid.UUID(manualItem.ID.Bytes)
-						itemUUID := uuid.UUID(item.ID.Bytes)
-						if manualUUID == itemUUID {
-							alreadyInCollection = true
-							break
-						}
-					}
-					if alreadyInCollection {
-						continue
-					}
-
-					evaluations := s.collectionService.EvaluateRules(item, rules)
-					for _, eval := range evaluations {
-						if eval.Matches {
-							autoItems = append(autoItems, item)
-							break
-						}
-					}
-				}
+	// Smart sections (custom sections are rules + manual picks): the
+	// tree's LIVE membership rides along, scoped to the dashboard's
+	// active library and the viewing user (played rules are per-user).
+	// Evaluated items dedupe against the stored ones and the section
+	// caps at its limit. (Custom-section builder tree migration,
+	// 2026-10-31 — the rules-array branch this replaces evaluated the
+	// same way, minus the library scoping.)
+	if s.collectionService.IsCollectionSmartColl(coll) {
+		matches, evalErr := s.collectionService.EvaluateSmartMembership(ctx, coll, SmartEvalOptions{
+			LibraryID:    libraryID,
+			ViewerUserID: pgtype.UUID{Bytes: userID, Valid: true},
+		})
+		if evalErr != nil {
+			log.Printf("dashboard: smart section %s evaluation failed: %v", coll.Name, evalErr)
+		}
+		for _, m := range matches {
+			id := uuid.UUID(m.ID.Bytes)
+			if !seen[id] {
+				items = append(items, m)
+				seen[id] = true
 			}
 		}
 	}
 
-	var finalItems []database.MediaItems
-	finalItems = append(finalItems, manualNonExcluded...)
-	finalItems = append(finalItems, autoItems...)
-
-	if len(finalItems) > limit {
-		finalItems = finalItems[:limit]
+	if len(items) > limit {
+		items = items[:limit]
 	}
-
-	return finalItems, nil
+	return items, nil
 }
 
 func (s *DashboardService) GetDashboardPreferences(ctx context.Context, userID uuid.UUID, libraryID pgtype.UUID) (database.UserDashboardPreferences, error) {

internal/services/filter_docs_test.go

@@ -0,0 +1,157 @@
+package services
+
+import (
+	"fmt"
+	"os"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// The user manual's field reference (docs/user/filters/fields.md) is
+// GENERATED from FilterFieldsPayload — the single source of truth the
+// real menus render from — and pinned by this test: if the registry
+// changes without regenerating the docs, this fails. Docs cannot drift
+// from working code (2026-11-01, user decision).
+//
+// Regenerate with: FILTER_DOCS_REGEN=1 go test ./internal/services -run TestFieldReferenceDocIsCurrent
+
+const fieldRefPath = "../../docs/user/filters/fields.md"
+
+func TestFieldReferenceDocIsCurrent(t *testing.T) {
+	doc := GenerateFieldReferenceDoc()
+	if os.Getenv("FILTER_DOCS_REGEN") == "1" {
+		if err := os.WriteFile(fieldRefPath, []byte(doc), 0o644); err != nil {
+			t.Fatalf("write field reference: %v", err)
+		}
+		t.Log("rewrote " + fieldRefPath)
+		return
+	}
+	existing, err := os.ReadFile(fieldRefPath)
+	if err != nil {
+		t.Fatalf("docs/user/filters/fields.md is missing — regenerate with FILTER_DOCS_REGEN=1 go test ./internal/services -run TestFieldReferenceDocIsCurrent: %v", err)
+	}
+	if string(existing) != doc {
+		t.Fatal("docs/user/filters/fields.md is STALE — the filter registry changed without regenerating the docs. " +
+			"Run FILTER_DOCS_REGEN=1 go test ./internal/services -run TestFieldReferenceDocIsCurrent and commit the refreshed file.")
+	}
+}
+
+// kindPhrase — what the value cell looks like for a user, per value kind.
+func kindPhrase(kind string) string {
+	switch kind {
+	case VKText:
+		return "Type words."
+	case VKNumber:
+		return "Type a number."
+	case VKDays:
+		return "Type a number of days."
+	case VKId:
+		return "Pick from a dropdown of real names — picks become removable chips, and you can pick several."
+	case VKFixed:
+		return "Choose from a fixed list of options."
+	case VKNone:
+		return "No value needed — the question is the whole rule."
+	}
+	return ""
+}
+
+// opPhrase — what each operator asks, in user words.
+func opPhrase(op, kind string) string {
+	switch op {
+	case "contains":
+		return "contains these words"
+	case "not_contains":
+		return "does NOT contain these words"
+	case "is":
+		if kind == VKId {
+			return "is one of the ones you pick"
+		}
+		return "matches exactly"
+	case "is_not", "isn't":
+		return "matches anything but this"
+	case "in":
+		return "is one of the ones you pick (any one is enough)"
+	case "not_in":
+		return "is none of the ones you pick"
+	case "in_any":
+		return "is in at least one of the collections you pick"
+	case "none_of":
+		return "is in none of the collections you pick"
+	case "has":
+		return "has a value"
+	case "missing":
+		return "is empty or missing"
+	case "is_true":
+		return "is switched on"
+	case "is_false":
+		return "is switched off"
+	case "between":
+		return "falls between two numbers"
+	case "at_least":
+		return "is at least this"
+	case "at_most":
+		return "is at most this"
+	}
+	return "—"
+}
+
+func GenerateFieldReferenceDoc() string {
+	var b strings.Builder
+	b.WriteString("<!-- GENERATED by TestFieldReferenceDocIsCurrent (internal/services/filter_docs_test.go)\n")
+	b.WriteString("     from the filter registry — the same source the real menus render. DO NOT EDIT by hand:\n")
+	b.WriteString("     regenerate with FILTER_DOCS_REGEN=1 go test ./internal/services -run TestFieldReferenceDocIsCurrent -->\n\n")
+	b.WriteString("# Every filter field\n\n")
+	b.WriteString("This is the complete list of everything the filters can ask about, generated straight from the\n")
+	b.WriteString("same source the app's menus render — it cannot drift from what you see in the UI.\n\n")
+	b.WriteString("Filters come in two worlds:\n\n")
+	b.WriteString("- **Books** — rules about books and your reading of them.\n")
+	b.WriteString("- **Episodes** — rules about podcast episodes (feeds, downloaded, played).\n\n")
+	b.WriteString("Every rule is **a field + a question + your values**. The \"Ask\" column is the question;\n")
+	b.WriteString("the \"Your values\" column is what you provide. The **default** question is what a new rule\n")
+	b.WriteString("starts with.\n\n")
+
+	for _, scope := range []string{ScopeBooks, ScopeEpisodes} {
+		scopeTitle := "Books"
+		if scope == ScopeEpisodes {
+			scopeTitle = "Podcast episodes"
+		}
+		fmt.Fprintf(&b, "## %s\n\n", scopeTitle)
+
+		fields := FilterFieldsPayload(scope)
+		groups := []string{}
+		byGroup := map[string][]FilterFieldWire{}
+		for _, f := range fields {
+			if _, seen := byGroup[f.Group]; !seen {
+				groups = append(groups, f.Group)
+			}
+			byGroup[f.Group] = append(byGroup[f.Group], f)
+		}
+		sort.Strings(groups)
+		for _, g := range groups {
+			fmt.Fprintf(&b, "### %s\n\n", g)
+			for _, f := range byGroup[g] {
+				fmt.Fprintf(&b, "**%s** — %s\n\n", f.Label, kindPhrase(f.ValueKind))
+				lines := make([]string, 0, len(f.Ops))
+				for _, op := range f.Ops {
+					label := op.Label
+					if label == "" {
+						label = op.Key
+					}
+					def := ""
+					if op.Key == f.DefaultOp {
+						def = " *(default)*"
+					}
+					lines = append(lines, fmt.Sprintf("| %s | %s%s |", label, opPhrase(op.Key, f.ValueKind), def))
+				}
+				b.WriteString("| Ask | Means |\n| --- | --- |\n")
+				b.WriteString(strings.Join(lines, "\n"))
+				b.WriteString("\n\n")
+			}
+		}
+	}
+	b.WriteString("---\n\n")
+	b.WriteString("*Anything here that doesn't match what the app actually shows is a bug — this page is generated\n")
+	b.WriteString("from the app's own menus and a test fails if they ever disagree.*\n")
+	return b.String()
+}

internal/services/filter_labels.go

@@ -0,0 +1,151 @@
+package services
+
+import (
+	"context"
+	"log"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+// ════════════════════════════════════════════════════════════════════
+// SSR id-label resolution (2026-11-01): pages that render a filter tree
+// (the collection editor's stored tree, the bookshelf's URL qf) embed
+// the id→name map so value cells show NAMES at first paint.
+//
+// Why not reuse the suggest facet: its rows are media-constrained
+// (INNER JOIN media_items + the other rules as a constraint), so an id
+// whose media doesn't match the tree's sibling rules returns NO row and
+// its label is lost — live repro: feed-in-3 + title-contains-Chapter
+// labeled one feed of three. A label is a property of the ENTITY row,
+// not of what currently matches: resolution reads the source tables
+// directly, no media join, no tree constraint.
+//
+// Scoping rides the request identity through s.raw (the ScopedDB —
+// every statement declares app.user_id): podcast_feeds and collections
+// are RLS-governed (an invisible feed/collection resolves to nothing),
+// libraries mirror the facet's explicit visibility join, and users
+// (added_by) are plain lookups — the viewer already holds the id from
+// a legal pick, the resolver only names it.
+// ════════════════════════════════════════════════════════════════════
+
+// MaxResolveIDs bounds one field's resolution query (picks accumulate
+// per rule; menus cap far below this). The label endpoint truncates to
+// the same cap.
+const MaxResolveIDs = 100
+
+// IsIDValuedField — whether the field's values are entity ids (the
+// label endpoint's accepted universe: id-kind + a known source).
+func IsIDValuedField(field string) bool {
+	f, ok := FilterFieldByKey(field)
+	if !ok {
+		return false
+	}
+	return valueKindFor(f.Kind, field) == VKId && f.Suggest != ""
+}
+
+// ParseUUIDValues splits comma-joined picks into uuids, skipping junk.
+func ParseUUIDValues(values []string) []uuid.UUID {
+	return parseUUIDValues(values)
+}
+
+// FilterTreeLabels resolves every id-kind rule value in the tree to its
+// display name. Best-effort by design: a resolve failure degrades to
+// fewer labels (cells fall back to raw ids — the pre-fix behavior),
+// never a failed page render. Returns uuid → display.
+func (s *SearchService) FilterTreeLabels(ctx context.Context, userID pgtype.UUID, tree *FilterTree) map[string]string {
+	labels := map[string]string{}
+	if tree == nil {
+		return labels
+	}
+
+	// Collect ids per field, split comma-joined picks (the builder
+	// stores one comma-joined value per multi-pick), cap the query.
+	byField := map[string][]uuid.UUID{}
+	var walk func(children []FilterChild)
+	walk = func(children []FilterChild) {
+		for _, c := range children {
+			if len(c.Children) > 0 {
+				walk(c.Children)
+				continue
+			}
+			if c.Field == "" || len(c.Values) == 0 {
+				continue
+			}
+			f, ok := FilterFieldByKey(c.Field)
+			if !ok || f.Suggest == "" {
+				continue
+			}
+			if valueKindFor(f.Kind, c.Field) != VKId {
+				continue
+			}
+			for _, id := range parseUUIDValues(c.Values) {
+				if len(byField[c.Field]) >= MaxResolveIDs {
+					return
+				}
+				byField[c.Field] = append(byField[c.Field], id)
+			}
+		}
+	}
+	walk(tree.Children)
+
+	for field, ids := range byField {
+		for k, v := range s.ResolveFieldLabels(ctx, userID, field, ids) {
+			labels[k] = v
+		}
+	}
+	return labels
+}
+
+// ResolveFieldLabels names one field's picked ids against its source
+// table — the shared core of the SSR embed and the label endpoint.
+// Unknown fields resolve to nothing (the caller validates).
+func (s *SearchService) ResolveFieldLabels(ctx context.Context, userID pgtype.UUID, field string, ids []uuid.UUID) map[string]string {
+	labels := map[string]string{}
+	f, ok := FilterFieldByKey(field)
+	if !ok {
+		return labels
+	}
+	idArgs := make([]uuid.UUID, len(ids))
+	copy(idArgs, ids)
+	var sqlStr string
+	var args []any
+	switch f.Suggest {
+	case suggestLibrary:
+		// The facet's visibility shape, minus the media join: a
+		// hidden library is invisible even by id (family lens).
+		sqlStr = `SELECT l.id::text, l.name
+FROM libraries l
+LEFT JOIN library_visibility lv ON l.id = lv.library_id AND lv.user_id = $2
+WHERE COALESCE(lv.is_visible, true) = true AND l.id = ANY($1)`
+		args = []any{idArgs, userID}
+	case suggestFeed:
+		// RLS-governed (subscription + visibility predicate): an
+		// unsubscribed feed id resolves to nothing.
+		sqlStr = `SELECT id::text, title FROM podcast_feeds WHERE id = ANY($1)`
+		args = []any{idArgs}
+	case suggestCollection:
+		// RLS-governed (app_can_read_collection).
+		sqlStr = `SELECT id::text, name FROM collections WHERE id = ANY($1)`
+		args = []any{idArgs}
+	case suggestAddedBy:
+		sqlStr = `SELECT id::text, username FROM users WHERE id = ANY($1)`
+		args = []any{idArgs}
+	default:
+		return labels
+	}
+	rows, err := s.raw.Query(ctx, sqlStr, args...)
+	if err != nil {
+		log.Printf("[filter-labels] resolve %q failed: %v", field, err)
+		return labels
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var v, display string
+		if err := rows.Scan(&v, &display); err != nil {
+			break
+		}
+		labels[v] = display
+	}
+	return labels
+}

internal/services/filter_query.go

@@ -9,6 +9,7 @@ import (
 	"bookhoard/internal/database"
 
 	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
@@ -75,11 +76,20 @@ JOIN libraries l ON mi.library_id = l.id
 JOIN library_types lt ON l.library_type_id = lt.id
 LEFT JOIN library_visibility lv ON l.id = lv.library_id AND lv.user_id = `
 
-// headWhere renders the mandatory WHERE head: the family lens +
-// integrity facts, plus the optional library scope (validated upstream —
-// an explicit out-of-scope library never reaches the SQL).
-func (b *filterBuilder) headWhere(libraryID pgtype.UUID) string {
+// headWhere renders the mandatory WHERE head: the SCOPE (books excludes
+// podcasts; episodes is episodes only — plan item 3.1 closes the leak
+// where the composed head happily returned episodes on All-Books
+// queries), the family lens, integrity facts, plus the optional library
+// scope (validated upstream — an explicit out-of-scope library never
+// reaches the SQL).
+func (b *filterBuilder) headWhere(libraryID pgtype.UUID, scope string) string {
 	w := "COALESCE(lv.is_visible, true) = true AND mi.archived_at IS NULL AND mi.missing_scan_count = 0"
+	switch scope {
+	case ScopeEpisodes:
+		w += " AND mi.source = 'podcast_episode'"
+	default: // books — the default legacy scope
+		w += " AND mi.library_type_name <> 'podcasts'"
+	}
 	if libraryID.Valid {
 		w += " AND mi.library_id = " + b.bind(libraryID)
 	}
@@ -369,6 +379,24 @@ func clauseFileAvailability(r FilterRule, b *filterBuilder) string {
 }
 
 // clauseAddedBy — the admin who added the book.
+// parseUUIDValues — the wire shape for id-valued rules: the builder's
+// pick loop stores picked ids as ONE comma-joined value
+// (["id1,id2"]), while hand-written trees may carry separate elements.
+// Both are legal; split on commas, trim, and keep what parses. An
+// unsplit parse matched NOTHING for multi-picks (2026-11-01 user
+// report: two feeds in "feeds in" matched zero episodes).
+func parseUUIDValues(values []string) []uuid.UUID {
+	ids := make([]uuid.UUID, 0, len(values))
+	for _, v := range values {
+		for _, part := range strings.Split(v, ",") {
+			if id, err := uuid.Parse(strings.TrimSpace(part)); err == nil {
+				ids = append(ids, id)
+			}
+		}
+	}
+	return ids
+}
+
 func clauseAddedBy(r FilterRule, b *filterBuilder) string {
 	switch r.Op {
 	case OpIs:
@@ -600,12 +628,7 @@ func clauseCollection(r FilterRule, b *filterBuilder) string {
 		}
 		return "(NOT " + ex + ")"
 	}
-	ids := make([]uuid.UUID, 0, len(r.Values))
-	for _, v := range r.Values {
-		if id, err := uuid.Parse(v); err == nil {
-			ids = append(ids, id)
-		}
-	}
+	ids := parseUUIDValues(r.Values)
 	ex := fmt.Sprintf(`(EXISTS (
 	SELECT 1 FROM collection_items ci
 	JOIN collections c ON c.id = ci.collection_id
@@ -623,12 +646,7 @@ func clauseCollection(r FilterRule, b *filterBuilder) string {
 // library IDs; visibility is enforced by the mandatory head regardless
 // (a rule naming a hidden library simply matches nothing).
 func clauseLibrary(r FilterRule, b *filterBuilder) string {
-	ids := make([]uuid.UUID, 0, len(r.Values))
-	for _, v := range r.Values {
-		if id, err := uuid.Parse(v); err == nil {
-			ids = append(ids, id)
-		}
-	}
+	ids := parseUUIDValues(r.Values)
 	if r.Op == OpIs {
 		return "(l.id = ANY(" + b.bind(ids) + "::uuid[]))"
 	}
@@ -637,6 +655,45 @@ func clauseLibrary(r FilterRule, b *filterBuilder) string {
 
 // ─── tree → SQL ──────────────────────────────────────────────────────
 
+// clauseFeed — the episode's source feed (episodes scope, item 3.1).
+// Values are podcast-feed UUIDs; visibility rides RLS (podcast_feeds is
+// governed by the same subscription predicate as episodes, so a rule
+// naming an unsubscribed feed matches nothing).
+func clauseFeed(r FilterRule, b *filterBuilder) string {
+	b.needJoin("pf", "LEFT JOIN podcast_feeds pf ON pf.id = mi.source_feed_id")
+	ids := parseUUIDValues(r.Values)
+	in := "(pf.id = ANY(" + b.bind(ids) + "::uuid[]))"
+	switch r.Op {
+	case OpIs, OpIn:
+		return in
+	default:
+		return "(NOT " + in + ")"
+	}
+}
+
+// clauseDownloaded — the episode's download state (episodes scope).
+// is_true = the playable file is on disk; is_false = anything else.
+func clauseDownloaded(r FilterRule, b *filterBuilder) string {
+	if r.Op == OpIsTrue {
+		return "(mi.download_state = 'downloaded')"
+	}
+	return "(mi.download_state <> 'downloaded')"
+}
+
+// clausePlayed — THE episode finished predicate (episodes scope): the
+// viewer's progress >= 0.999, the same definition as hide_finished and
+// the item-2.4 rules engine. Ties to the viewer via the shared
+// reading_progress join (R2/D5 lineage: progress is per-user).
+func clausePlayed(r FilterRule, b *filterBuilder) string {
+	b.readingProgress()
+	if r.Op == OpIsTrue {
+		return "(COALESCE(rp.percentage, 0) >= 0.999)"
+	}
+	return "(COALESCE(rp.percentage, 0) < 0.999)"
+}
+
+// ─── tree → SQL (end) ─────────────────────────────────────────────────
+
 // buildGroupClause renders a group: children joined by the group mode,
 // each child a rule clause or a nested group. A group ANDs into its
 // parent.
@@ -742,14 +799,13 @@ func (s *SearchService) ComposedSearch(ctx context.Context, params SearchParams)
 	// Build the WHERE first — clause construction requests the
 	// user-relative JOINs lazily, and joinBlock() must render AFTER
 	// they are collected.
-	whereSQL := b.headWhere(params.LibraryID) + treeWhere(params.FilterTree, b) + `
+	whereSQL := b.headWhere(params.LibraryID, params.FilterTree.FilterScope()) + treeWhere(params.FilterTree, b) + `
   AND (` + libBind + `::uuid IS NULL OR mi.library_id = ` + libBind + `::uuid)
   AND (` + qBind + ` = '' OR ` + composedQueryBlock(qBind, exactBind) + `)`
 	sqlStr := composedSelect + filterFrom + b.userIDBind +
 		b.joinBlock() + `
 WHERE ` + whereSQL +
 		composedSortOrder(sortBind, qBind, exactBind) + ` ` + limitBind + ` OFFSET ` + offsetBind
-	fmt.Printf("[DEBUG COMPOSED] %s\n", sqlStr)
 
 	rows, err := s.raw.Query(ctx, sqlStr, b.args...)
 	if err != nil {
@@ -821,12 +877,62 @@ func composedQueryBlock(qBind, exactBind string) string {
 	))`
 }
 
+// ComposedLiveMedia — full media rows matching the tree: the TREE path
+// of the smart-collection evaluator (item 3.2). Same filters as
+// ComposedSearch (scope head, family lens via the visibility join,
+// tree clause, optional visible-library belt) but SELECT mi.* so
+// collection surfaces get the whole media row (episode-card stamping,
+// feed position for the replay chain). Replaces the candidate query's
+// Sqlc embed for tree collections; ordering matches the legacy
+// candidate query (title ASC).
+func (s *SearchService) ComposedLiveMedia(ctx context.Context, userID, libraryID pgtype.UUID, visibleIDs []pgtype.UUID, tree *FilterTree) ([]database.MediaItems, error) {
+	// A rules-LESS tree (root with zero children — legal since the
+	// episodes scope door seeds one at create-modal time) matches
+	// NOTHING, mirroring the legacy engine's zero-enabled-rules → empty
+	// convention (EvaluateSmartCollection). Without this guard the
+	// composed query degrades to the bare scope head below and a fresh
+	// Episodes collection would swallow every episode in the library.
+	if len(tree.Children) == 0 {
+		return []database.MediaItems{}, nil
+	}
+	b := newFilterBuilder(userID)
+	head := b.headWhere(libraryID, tree.FilterScope()) + treeWhere(tree, b)
+	visibleClause := ""
+	if len(visibleIDs) > 0 {
+		visibleClause = " AND (l.id = ANY(" + b.bind(visibleIDs) + "::uuid[])"
+		if libraryID.Valid {
+			// Redundant by construction; keep SQL valid either way.
+			visibleClause += " OR l.id = " + b.bind(libraryID)
+		}
+		visibleClause += ")"
+	}
+	sqlStr := "SELECT mi.* " + filterFrom + b.userIDBind +
+		b.joinBlock() + `
+WHERE ` + head + visibleClause + `
+ORDER BY mi.title ASC`
+
+	rows, err := s.raw.Query(ctx, sqlStr, b.args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	// Name-based decoding:mi.* column order and the struct order stay
+	// decoupled (position-based scanning would silently break the next
+	// schema append).
+	return pgx.CollectRows(rows, pgx.RowToStructByName[database.MediaItems])
+}
+
 // ComposedCount — the live match count for the builder (rules + scope,
 // no pagination): a true COUNT(*), not the page length.
 func (s *SearchService) ComposedCount(ctx context.Context, userID, libraryID pgtype.UUID, tree *FilterTree) (int, error) {
+	// Same empty-tree convention as ComposedLiveMedia: rules-less means
+	// zero matches, not "everything".
+	if len(tree.Children) == 0 {
+		return 0, nil
+	}
 	b := newFilterBuilder(userID)
 	libBind := b.bind(libraryID)
-	whereSQL := b.headWhere(libraryID) + treeWhere(tree, b) + `
+	whereSQL := b.headWhere(libraryID, tree.FilterScope()) + treeWhere(tree, b) + `
   AND (` + libBind + `::uuid IS NULL OR mi.library_id = ` + libBind + `::uuid)`
 	sqlStr := `SELECT COUNT(*) ` + filterFrom + b.userIDBind +
 		b.joinBlock() + `
@@ -921,6 +1027,14 @@ func (s *SearchService) ComposedFieldValues(ctx context.Context, p ComposedSugge
 		return s.composedIDSourceValues(ctx, b, p,
 			"users u JOIN media_items mi ON mi.added_by_admin_id = u.id",
 			"u.id::text", "u.username", "", limitBind, libBind)
+	case suggestFeed:
+		// The viewer's feed universe — RLS (podcast_feeds subscription
+		// predicate + admin escape) scopes both suggestions and matches.
+		return s.composedIDSourceValues(ctx, b, p,
+			"podcast_feeds pf",
+			"pf.id::text", "pf.title",
+			"JOIN media_items mi ON mi.source_feed_id = pf.id",
+			limitBind, libBind)
 	default:
 		// Column / array sources: the value expr mirrors the field's
 		// match column (tags via the *_search column, like the flat
@@ -956,7 +1070,7 @@ func (s *SearchService) ComposedFieldValues(ctx context.Context, p ComposedSugge
 		scoreExpr = fmt.Sprintf("CASE WHEN %s = '' THEN 0 ELSE word_similarity(%s, src.value) END AS score", tb, tb)
 	}
 
-	whereSQL := b.headWhere(p.LibraryID) + `
+	whereSQL := b.headWhere(p.LibraryID, p.Tree.FilterScope()) + `
   AND (` + libBind + `::uuid IS NULL OR mi.library_id = ` + libBind + `::uuid)` +
 		treeWhere(p.Tree, b) + `
   AND src.value IS NOT NULL AND src.value <> ''` + typedFilter
@@ -1001,9 +1115,16 @@ func (s *SearchService) composedIDSourceValues(ctx context.Context, b *filterBui
 	fromTables, valueExpr, displayExpr, joinMedia, limitBind, libBind string) ([]FieldValue, error) {
 	// The typed bind happens HERE and only when non-blank — an unused
 	// parameter is a 42P18 error (the blank-browse case binds nothing).
+	// Typing filters the NAME (ILIKE) — and also exact-matches a
+	// comma-separated ID list: the builder resolves a freshly ingested
+	// tree's stored ids to labels with the same call (2026-11-01: the
+	// library cell reverted to raw ids after Apply — labels only ever
+	// came from suggestion picks).
 	nameFilter := ""
 	if p.Typed != "" {
-		nameFilter = " AND " + displayExpr + " ILIKE '%' || " + b.bind(p.Typed) + " || '%'"
+		tb := b.bind(p.Typed)
+		nameFilter = " AND (" + displayExpr + " ILIKE '%' || " + tb + " || '%'" +
+			" OR " + valueExpr + "::text = ANY(string_to_array(" + tb + ", ',')))"
 	}
 	sqlStr := `SELECT ` + valueExpr + ` AS value, ` + displayExpr + ` AS display, COUNT(mi.id) AS count
 FROM ` + fromTables + `

internal/services/filter_registry.go

@@ -87,6 +87,7 @@ const (
 	suggestHighlight  SuggestSource = "highlight_text"
 	suggestLibrary    SuggestSource = "library"    // visibility-scoped libraries
 	suggestCollection SuggestSource = "collection" // the viewer's collections
+	suggestFeed       SuggestSource = "feed"       // the viewer's subscribed feeds (RLS-governed)
 	suggestAddedBy    SuggestSource = "added_by"   // admins who added books in scope
 )
 
@@ -99,8 +100,27 @@ const (
 	GroupComics    = "Comics & manga"
 	GroupMyReading = "My reading"
 	GroupLibrary   = "Library"
+	// Episodes (plan item 3.1, filter-system unification): fields that
+	// only make sense on podcast-episode rows. Hidden in the books
+	// scope ("hide podcasts from the rules on the all books page, but
+	// allow them in collections").
+	GroupEpisodes = "Episodes"
 )
 
+// Filter scopes (plan item 3.1): which row universe a tree matches.
+// The top-level `scope` key on the qf tree declares it; absent = books
+// (every existing saved tree and every legacy client stays valid).
+const (
+	ScopeBooks    = "books"
+	ScopeEpisodes = "episodes"
+)
+
+// episodeOnlyFields are meaningful ONLY in the episodes scope — a
+// books-scope tree using one is a user error (400 at parse).
+var episodeOnlyFields = map[string]bool{
+	"feed": true, "downloaded": true, "played": true,
+}
+
 // FilterRule is one leaf: field + operator + values (all bound params).
 type FilterRule struct {
 	Field  string
@@ -112,10 +132,21 @@ type FilterRule struct {
 // children are rules or nested groups. Groups AND/OR their children
 // together; a group ANDs into its parent.
 type FilterTree struct {
+	Scope    string        `json:"scope,omitempty"`
 	Mode     string        `json:"mode"`
 	Children []FilterChild `json:"children"`
 }
 
+// FilterScope resolves the tree's row universe: an absent scope key is
+// the books scope (legacy trees, saved filters, every pre-unification
+// client). nil-safe (suggest paths can carry a nil tree).
+func (t *FilterTree) FilterScope() string {
+	if t != nil && t.Scope == ScopeEpisodes {
+		return ScopeEpisodes
+	}
+	return ScopeBooks
+}
+
 // FilterChild is one node: a rule (Field set) or a group (Mode set).
 type FilterChild struct {
 	Field    string        `json:"field,omitempty"`
@@ -135,6 +166,146 @@ type FilterField struct {
 	DefaultOp string   // operator a new rule starts on (field-switch reset)
 	Clause    func(r FilterRule, b *filterBuilder) string
 	Suggest   SuggestSource
+	// Scopes limits the field to the listed scopes (nil = available in
+	// every scope — most book fields no-op against episode rows since
+	// episode rows carry NULLs there). Episode-only fields declare
+	// exactly [ScopeEpisodes]; the books scope rejects them at parse.
+	Scopes []string
+}
+
+// InScope reports whether the field may appear in a scope tree.
+func (f FilterField) InScope(scope string) bool {
+	if len(f.Scopes) == 0 {
+		return true
+	}
+	for _, s := range f.Scopes {
+		if s == scope {
+			return true
+		}
+	}
+	return false
+}
+
+// FilterOpWire is one operator's presentation contract (item 3.3):
+// THE system carries both grammar and rendering in one place — the
+// frontend renders this wire, it invents nothing.
+type FilterOpWire struct {
+	Key     string `json:"key"`
+	Label   string `json:"label"`
+	Negated bool   `json:"negated,omitempty"`
+	// Values is the value-cell arity: "many" (one multi-value input),
+	// "one", "two", or "none".
+	Values string `json:"values"`
+}
+
+var filterOps = map[string]FilterOpWire{
+	OpContains:    {Key: OpContains, Label: "contains", Values: "many"},
+	OpNotContains: {Key: OpNotContains, Label: "doesn't contain", Negated: true, Values: "many"},
+	OpIs:          {Key: OpIs, Label: "is", Values: "many"},
+	OpIsNot:       {Key: OpIsNot, Label: "isn't", Negated: true, Values: "many"},
+	OpEmpty:       {Key: OpEmpty, Label: "is empty", Values: "none"},
+	OpIsTrue:      {Key: OpIsTrue, Label: "is true", Values: "none"},
+	OpIsFalse:     {Key: OpIsFalse, Label: "is false", Values: "none"},
+	OpBetween:     {Key: OpBetween, Label: "between", Values: "two"},
+	OpAtLeast:     {Key: OpAtLeast, Label: "at least", Values: "one"},
+	OpAtMost:      {Key: OpAtMost, Label: "at most", Values: "one"},
+	OpWithinDays:  {Key: OpWithinDays, Label: "within the last", Values: "one"},
+	OpHas:         {Key: OpHas, Label: "has", Values: "none"},
+	OpMissing:     {Key: OpMissing, Label: "missing", Values: "none"},
+	OpUnrated:     {Key: OpUnrated, Label: "unrated", Values: "none"},
+	OpIn:          {Key: OpIn, Label: "in", Values: "many"},
+	OpNotIn:       {Key: OpNotIn, Label: "isn't in", Negated: true, Values: "many"},
+	OpInAny:       {Key: OpInAny, Label: "in any", Values: "none"},
+	OpInNone:      {Key: OpInNone, Label: "in none", Negated: true, Values: "none"},
+}
+
+// FilterFieldWire is one field's presentation entry (the registry's
+// wire face): the frontend menu is scope-filtered OFF this list.
+type FilterFieldWire struct {
+	Key       string         `json:"key"`
+	Label     string         `json:"label"`
+	Group     string         `json:"group"`
+	ValueKind string         `json:"valueKind"`
+	Ops       []FilterOpWire `json:"ops"`
+	DefaultOp string         `json:"defaultOp"`
+	Suggest   bool           `json:"suggest"`
+	Options   []string       `json:"options,omitempty"`
+}
+
+// valueKinds — what the value cell renders (the registry's Kind mapped
+// to frontend-cell semantics).
+const (
+	VKText   = "text"
+	VKNumber = "number"
+	VKDays   = "days"
+	VKId     = "id"
+	VKFixed  = "fixed"
+	VKNone   = "none"
+)
+
+// valueKindFor maps the SQL-facing Kind to the cell semantics.
+func valueKindFor(kind FilterKind, key string) string {
+	switch kind {
+	case KindScalarFuzzy, KindArrayFuzzy, KindText:
+		return VKText
+	case KindEnum, KindStatus, KindLibrary, KindCollection, KindIdentifier:
+		return VKId
+	case KindBool:
+		return VKNone
+	case KindNumber, KindDate:
+		if kind == KindDate {
+			return VKDays
+		}
+		return VKNumber
+	case KindPresence, KindNoteText:
+		return VKNone
+	}
+	if key == "added_by" {
+		return VKId
+	}
+	return VKNone
+}
+
+// FilterFieldsPayload is THE builder vocabulary for one scope: group-
+// ordered wire fields (registry order), each with its ops' presentation.
+// The frontend renders this; it hardcodes nothing.
+func FilterFieldsPayload(scope string) []FilterFieldWire {
+	suggestKnown := map[SuggestSource]bool{
+		suggestAuthor: true, suggestNarrator: true, suggestContrib: true,
+		suggestPublisher: true, suggestTags: true, suggestColumn: true,
+		suggestSeries: true, suggestLibrary: true, suggestCollection: true,
+		suggestAddedBy: true, suggestFeed: true,
+	}
+	presented := make(map[string]bool)
+	out := []FilterFieldWire{}
+	for _, f := range filterFields {
+		if !f.InScope(scope) {
+			continue
+		}
+		if presented[f.Key] {
+			continue
+		}
+		presented[f.Key] = true
+		ops := make([]FilterOpWire, 0, len(f.Ops))
+		for _, opKey := range f.Ops {
+			ops = append(ops, filterOps[opKey])
+		}
+		wire := FilterFieldWire{
+			Key:       f.Key,
+			Label:     f.Label,
+			Group:     f.Group,
+			ValueKind: valueKindFor(f.Kind, f.Key),
+			Ops:       ops,
+			DefaultOp: f.DefaultOp,
+			Suggest:   suggestKnown[f.Suggest],
+		}
+		if domain, ok := fixedDomains[f.Key]; ok {
+			wire.ValueKind = VKFixed
+			wire.Options = domain
+		}
+		out = append(out, wire)
+	}
+	return out
 }
 
 // opsWithValue / opsWithoutValue drive validation.
@@ -154,41 +325,54 @@ var fixedDomains = map[string][]string{
 var filterFields = []FilterField{
 	// ── People ────────────────────────────────────────────────────
 	{Key: "author", Label: "Author", Group: GroupPeople, Kind: KindArrayFuzzy,
-		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		Clause: clauseAuthorArray, Suggest: suggestAuthor},
 	{Key: "narrator", Label: "Narrator", Group: GroupPeople, Kind: KindArrayFuzzy,
-		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		Clause: clauseArrayFuzzyFactory("mi.narrators"), Suggest: suggestNarrator},
 	{Key: "contributor", Label: "Contributor", Group: GroupPeople, Kind: KindArrayFuzzy,
-		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		Clause: clauseArrayFuzzyFactory("mi.contributors"), Suggest: suggestContrib},
 
 	// ── Publishing ────────────────────────────────────────────────
 	{Key: "publisher", Label: "Publisher", Group: GroupPublish, Kind: KindArrayFuzzy,
-		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		Clause: clauseArrayFuzzyFactory("mi.publishers"), Suggest: suggestPublisher},
 	{Key: "imprint", Label: "Imprint", Group: GroupPublish, Kind: KindScalarFuzzy,
-		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		Clause: clauseScalarFuzzyFactory("mi.imprint"), Suggest: suggestColumn},
 	{Key: "edition", Label: "Edition", Group: GroupPublish, Kind: KindScalarFuzzy,
-		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		Clause: clauseScalarFuzzyFactory("mi.edition"), Suggest: suggestColumn},
 	{Key: "published_year", Label: "Published year", Group: GroupPublish, Kind: KindNumber,
 		Ops: []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
 		Clause: clausePublishedYear, Suggest: suggestNone},
+	{Key: "published_date", Label: "Published date", Group: GroupPublish, Kind: KindDate,
+		Ops: []string{OpWithinDays, OpBetween, OpEmpty}, DefaultOp: OpWithinDays,
+		Clause: clauseDateFactory("mi.date_published"), Suggest: suggestNone},
 
 	// ── Topics ────────────────────────────────────────────────────
 	{Key: "genre", Label: "Genre", Group: GroupTopics, Kind: KindScalarFuzzy,
-		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		Clause: clauseScalarFuzzyFactory("mi.genre"), Suggest: suggestColumn},
 	{Key: "tags", Label: "Tags", Group: GroupTopics, Kind: KindArrayFuzzy,
-		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		Clause: clauseArrayFuzzyFactory("mi.tags_search"), Suggest: suggestTags},
 	{Key: "story_arc", Label: "Story arc", Group: GroupTopics, Kind: KindScalarFuzzy,
-		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		Clause: clauseScalarFuzzyFactory("mi.story_arc"), Suggest: suggestColumn},
 	{Key: "age_rating", Label: "Age rating", Group: GroupTopics, Kind: KindEnum,
-		Ops: []string{OpIs, OpIsNot, OpEmpty}, DefaultOp: OpIs,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpIs, OpIsNot, OpEmpty}, DefaultOp: OpIs,
 		Clause: clauseEnumFactory("mi.age_rating"), Suggest: suggestColumn},
 
 	// ── Book facts ────────────────────────────────────────────────
@@ -196,28 +380,33 @@ var filterFields = []FilterField{
 		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		Clause: clauseScalarFuzzyFactory("mi.title"), Suggest: suggestColumn},
 	{Key: "subtitle", Label: "Subtitle", Group: GroupBookFacts, Kind: KindText,
-		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		Clause: clauseScalarFuzzyFactory("mi.subtitle"), Suggest: suggestColumn},
 	{Key: "description", Label: "Description", Group: GroupBookFacts, Kind: KindText,
 		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		Clause: clauseScalarFuzzyFactory("mi.description"), Suggest: suggestNone},
 	{Key: "summary", Label: "Summary", Group: GroupBookFacts, Kind: KindPresence,
-		Ops: []string{OpHas, OpMissing}, DefaultOp: OpHas,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpHas, OpMissing}, DefaultOp: OpHas,
 		Clause: clausePresenceFactory("mi.summary"), Suggest: suggestNone},
 	{Key: "language", Label: "Language", Group: GroupBookFacts, Kind: KindScalarFuzzy,
 		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		Clause: clauseLanguage, Suggest: suggestColumn},
 	{Key: "page_count", Label: "Page count", Group: GroupBookFacts, Kind: KindNumber,
-		Ops: []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
 		Clause: clauseNumberFactory("mi.page_count", parseNumberInt), Suggest: suggestNone},
 	{Key: "chapter_count", Label: "Chapter count", Group: GroupBookFacts, Kind: KindNumber,
 		Ops: []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
 		Clause: clauseNumberFactory("mi.chapter_count", parseNumberInt), Suggest: suggestNone},
 	{Key: "total_characters", Label: "Total characters", Group: GroupBookFacts, Kind: KindNumber,
-		Ops: []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
 		Clause: clauseNumberFactory("mi.total_characters", parseNumberInt), Suggest: suggestNone},
 	{Key: "community_rating", Label: "Community rating", Group: GroupBookFacts, Kind: KindNumber,
-		Ops: []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
 		Clause: clauseNumberFactory("mi.community_rating", parseNumberFloat), Suggest: suggestNone},
 	{Key: "added_at", Label: "Date added", Group: GroupBookFacts, Kind: KindDate,
 		Ops: []string{OpWithinDays, OpBetween, OpEmpty}, DefaultOp: OpWithinDays,
@@ -226,16 +415,20 @@ var filterFields = []FilterField{
 		Ops: []string{OpWithinDays, OpBetween, OpEmpty}, DefaultOp: OpWithinDays,
 		Clause: clauseDateFactory("mi.imported_at"), Suggest: suggestNone},
 	{Key: "web_url", Label: "Web URL", Group: GroupBookFacts, Kind: KindPresence,
-		Ops: []string{OpHas, OpMissing}, DefaultOp: OpHas,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpHas, OpMissing}, DefaultOp: OpHas,
 		Clause: clausePresenceFactory("mi.web_url"), Suggest: suggestNone},
 	{Key: "metadata_notes", Label: "Metadata notes", Group: GroupBookFacts, Kind: KindPresence,
-		Ops: []string{OpHas, OpMissing}, DefaultOp: OpHas,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpHas, OpMissing}, DefaultOp: OpHas,
 		Clause: clausePresenceFactory("mi.metadata_notes"), Suggest: suggestNone},
 	{Key: "isbn", Label: "ISBN", Group: GroupBookFacts, Kind: KindIdentifier,
-		Ops: []string{OpIs, OpIsNot, OpHas, OpMissing}, DefaultOp: OpHas,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpIs, OpIsNot, OpHas, OpMissing}, DefaultOp: OpHas,
 		Clause: clauseIdentifierFactory("mi.isbn"), Suggest: suggestNone},
 	{Key: "asin", Label: "ASIN", Group: GroupBookFacts, Kind: KindIdentifier,
-		Ops: []string{OpIs, OpIsNot, OpHas, OpMissing}, DefaultOp: OpHas,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpIs, OpIsNot, OpHas, OpMissing}, DefaultOp: OpHas,
 		Clause: clauseIdentifierFactory("mi.asin"), Suggest: suggestNone},
 	{Key: "file_size", Label: "File size", Group: GroupBookFacts, Kind: KindNumber,
 		Ops: []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
@@ -247,10 +440,12 @@ var filterFields = []FilterField{
 		Ops: []string{OpIsTrue, OpIsFalse}, DefaultOp: OpIsTrue,
 		Clause: clauseBoolFactory("mi.explicit"), Suggest: suggestNone},
 	{Key: "abridged", Label: "Abridged", Group: GroupBookFacts, Kind: KindBool,
-		Ops: []string{OpIsTrue, OpIsFalse}, DefaultOp: OpIsTrue,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpIsTrue, OpIsFalse}, DefaultOp: OpIsTrue,
 		Clause: clauseBoolFactory("mi.abridged"), Suggest: suggestNone},
 	{Key: "manually_edited", Label: "Manually edited", Group: GroupBookFacts, Kind: KindBool,
-		Ops: []string{OpIsTrue, OpIsFalse}, DefaultOp: OpIsTrue,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpIsTrue, OpIsFalse}, DefaultOp: OpIsTrue,
 		// metadata_overrides is NOT NULL TEXT[] — '{}' means untouched.
 		Clause: func(r FilterRule, b *filterBuilder) string {
 			switch r.Op {
@@ -262,53 +457,66 @@ var filterFields = []FilterField{
 			return "TRUE"
 		}, Suggest: suggestNone},
 	{Key: "cover", Label: "Cover", Group: GroupBookFacts, Kind: KindPresence,
-		Ops: []string{OpHas, OpMissing}, DefaultOp: OpHas,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpHas, OpMissing}, DefaultOp: OpHas,
 		Clause: clauseCover, Suggest: suggestNone},
 	{Key: "added_by", Label: "Added by", Group: GroupBookFacts, Kind: KindIdentifier,
-		Ops: []string{OpIs, OpHas, OpMissing}, DefaultOp: OpHas,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpIs, OpHas, OpMissing}, DefaultOp: OpHas,
 		Clause: clauseAddedBy, Suggest: suggestAddedBy},
 
 	// ── Comics & manga ────────────────────────────────────────────
 	{Key: "series", Label: "Series", Group: GroupComics, Kind: KindScalarFuzzy,
-		Ops: []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpContains, OpNotContains, OpIs, OpIsNot, OpEmpty}, DefaultOp: OpContains,
 		// Full series membership: the primary series column AND the
 		// additional series held in alternate_info — a book whose
 		// membership of X is secondary must not hide.
 		Clause: clauseSeriesMembership, Suggest: suggestSeries},
 	{Key: "series_number", Label: "Series number", Group: GroupComics, Kind: KindNumber,
-		Ops: []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
 		Clause: clauseNumberFactory("mi.series_number", parseNumberFloat), Suggest: suggestNone},
 	{Key: "series_count", Label: "Series count", Group: GroupComics, Kind: KindNumber,
-		Ops: []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
 		Clause: clauseNumberFactory("mi.series_count", parseNumberInt), Suggest: suggestNone},
 	{Key: "volume", Label: "Volume", Group: GroupComics, Kind: KindNumber,
-		Ops: []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
 		Clause: clauseNumberFactory("mi.volume", parseNumberInt), Suggest: suggestNone},
 	{Key: "format_group", Label: "Format group", Group: GroupComics, Kind: KindEnum,
-		Ops: []string{OpIs, OpIsNot}, DefaultOp: OpIs,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpIs, OpIsNot}, DefaultOp: OpIs,
 		Clause: clauseEnumFactory("mi.format_group"), Suggest: suggestColumn},
 	{Key: "mime_type", Label: "File type (mime)", Group: GroupComics, Kind: KindEnum,
 		Ops: []string{OpIs, OpIsNot}, DefaultOp: OpIs,
 		Clause: clauseEnumFactory("mi.mime_type"), Suggest: suggestColumn},
 	{Key: "is_reflowable", Label: "Reflowable", Group: GroupComics, Kind: KindBool,
-		Ops: []string{OpIsTrue, OpIsFalse}, DefaultOp: OpIsTrue,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpIsTrue, OpIsFalse}, DefaultOp: OpIsTrue,
 		Clause: clauseBoolFactory("mi.is_reflowable"), Suggest: suggestNone},
 	{Key: "has_fixed_layout", Label: "Fixed layout", Group: GroupComics, Kind: KindBool,
-		Ops: []string{OpIsTrue, OpIsFalse}, DefaultOp: OpIsTrue,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpIsTrue, OpIsFalse}, DefaultOp: OpIsTrue,
 		Clause: clauseBoolFactory("mi.has_fixed_layout"), Suggest: suggestNone},
 	{Key: "is_black_and_white", Label: "Black & white", Group: GroupComics, Kind: KindBool,
-		Ops: []string{OpIsTrue, OpIsFalse}, DefaultOp: OpIsTrue,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpIsTrue, OpIsFalse}, DefaultOp: OpIsTrue,
 		Clause: clauseBoolFactory("mi.is_black_and_white"), Suggest: suggestNone},
 	{Key: "manga_type", Label: "Manga type", Group: GroupComics, Kind: KindEnum,
-		Ops: []string{OpIs, OpIsNot, OpEmpty}, DefaultOp: OpIs,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpIs, OpIsNot, OpEmpty}, DefaultOp: OpIs,
 		Clause: clauseEnumFactory("mi.manga_type"), Suggest: suggestColumn},
 	{Key: "reading_direction", Label: "Reading direction", Group: GroupComics, Kind: KindEnum,
-		Ops: []string{OpIs, OpIsNot, OpEmpty}, DefaultOp: OpIs,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpIs, OpIsNot, OpEmpty}, DefaultOp: OpIs,
 		Clause: clauseEnumFactory("mi.reading_direction"), Suggest: suggestColumn},
 
 	// ── My reading (user-relative — the VIEWER's rows) ────────────
 	{Key: "status", Label: "Reading status", Group: GroupMyReading, Kind: KindStatus,
-		Ops: []string{OpIs}, DefaultOp: OpIs,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpIs}, DefaultOp: OpIs,
 		Clause: clauseStatus, Suggest: suggestNone},
 	{Key: "progress_percent", Label: "Progress percent", Group: GroupMyReading, Kind: KindNumber,
 		Ops: []string{OpBetween, OpAtLeast, OpAtMost, OpEmpty}, DefaultOp: OpAtLeast,
@@ -341,7 +549,8 @@ var filterFields = []FilterField{
 		Ops: []string{OpBetween, OpAtLeast, OpAtMost}, DefaultOp: OpAtLeast,
 		Clause: clauseTimeSpent, Suggest: suggestNone},
 	{Key: "pages_read", Label: "Pages read", Group: GroupMyReading, Kind: KindNumber,
-		Ops: []string{OpBetween, OpAtLeast, OpAtMost}, DefaultOp: OpAtLeast,
+		Scopes: []string{ScopeBooks},
+		Ops:    []string{OpBetween, OpAtLeast, OpAtMost}, DefaultOp: OpAtLeast,
 		Clause: clausePagesRead, Suggest: suggestNone},
 	{Key: "collection", Label: "In collection", Group: GroupMyReading, Kind: KindCollection,
 		// Membership mirrors the collection page: excluded items and
@@ -349,6 +558,27 @@ var filterFields = []FilterField{
 		Ops: []string{OpIn, OpNotIn, OpInAny, OpInNone}, DefaultOp: OpIn,
 		Clause: clauseCollection, Suggest: suggestCollection},
 
+	// ── Episodes (podcast-episode rows; episodes scope only) ──────
+	// Plan item 3.1 / §0 item 3: the filter engine gains the episode
+	// fields so smart episode collections can ride the SAME engine.
+	// `feed` suggests the viewer's subscribed feeds (RLS governs both
+	// suggest and match); `downloaded` reads the download state;
+	// `played` is THE finished predicate (viewer progress >= 0.999 —
+	// the same definition as hide_finished, item 2.4).
+	{Key: "feed", Label: "Feed", Group: GroupEpisodes, Kind: KindIdentifier,
+		// One name per semantic (2026-11-01, Option A): is/is_not were
+		// exact synonyms of in/not_in (the clause compiles both to the
+		// same ANY). Stored trees carrying the legacy keys keep
+		// parsing — see legacyFieldOps.
+		Ops: []string{OpIn, OpNotIn, OpHas, OpMissing}, DefaultOp: OpIn,
+		Clause: clauseFeed, Suggest: suggestFeed, Scopes: []string{ScopeEpisodes}},
+	{Key: "downloaded", Label: "Downloaded", Group: GroupEpisodes, Kind: KindBool,
+		Ops: []string{OpIsTrue, OpIsFalse}, DefaultOp: OpIsTrue,
+		Clause: clauseDownloaded, Suggest: suggestNone, Scopes: []string{ScopeEpisodes}},
+	{Key: "played", Label: "Played", Group: GroupEpisodes, Kind: KindBool,
+		Ops: []string{OpIsTrue, OpIsFalse}, DefaultOp: OpIsFalse,
+		Clause: clausePlayed, Suggest: suggestNone, Scopes: []string{ScopeEpisodes}},
+
 	// ── Library (holding structure + family lens) ─────────────────
 	{Key: "library", Label: "Library", Group: GroupLibrary, Kind: KindLibrary,
 		// Values are library IDs; the menu only ever offers the viewer's
@@ -405,13 +635,21 @@ func FilterFieldKeys() []string {
 }
 
 // fieldOpsAllowed reports whether op is allowed on the field.
+// legacyFieldOps — operator synonyms still ACCEPTED at parse for
+// trees saved before the vocabulary collapse (2026-11-01): feed once
+// offered is/is_not alongside in/not_in with identical semantics. The
+// menus offer one name per field; stored trees parse forever.
+var legacyFieldOps = map[string]map[string]bool{
+	"feed": {OpIs: true, OpIsNot: true},
+}
+
 func fieldOpsAllowed(f FilterField, op string) bool {
 	for _, o := range f.Ops {
 		if o == op {
 			return true
 		}
 	}
-	return false
+	return legacyFieldOps[f.Key][op]
 }
 
 // maxFilterDepth bounds group nesting (BookOrbit allows 5; the UI
@@ -426,30 +664,41 @@ func ParseFilterTree(raw string) (*FilterTree, error) {
 	if err := json.Unmarshal([]byte(raw), &t); err != nil {
 		return nil, fmt.Errorf("invalid qf JSON: %w", err)
 	}
-	if err := validateGroup(&FilterChild{Mode: t.Mode, Children: t.Children}, 1); err != nil {
+	if t.Scope != "" && t.Scope != ScopeBooks && t.Scope != ScopeEpisodes {
+		return nil, fmt.Errorf("filter scope must be books|episodes, got %q", t.Scope)
+	}
+	if err := validateGroup(&FilterChild{Mode: t.Mode, Children: t.Children}, 1, t.FilterScope()); err != nil {
 		return nil, err
 	}
 	return &t, nil
 }
 
-func validateGroup(g *FilterChild, depth int) error {
+func validateGroup(g *FilterChild, depth int, scope string) error {
 	if depth > maxFilterDepth {
 		return fmt.Errorf("filter group nesting deeper than %d", maxFilterDepth)
 	}
 	if g.Mode != "all" && g.Mode != "any" {
 		return fmt.Errorf("filter group mode must be all|any, got %q", g.Mode)
 	}
-	if len(g.Children) == 0 {
+	// The ROOT arrives as depth 1 (call convention below), so "depth > 1"
+	// exempts exactly the root: an EMPTY ROOT is legal as of the episodes
+	// scope door — the create modal seeds
+	// `{"scope":"episodes","mode":"all","children":[]}` so a fresh
+	// Episodes smart collection has a stored scope before its first
+	// rule. Nested empty groups stay invalid, and the composers define
+	// the semantics: zero children matches nothing (mirrors
+	// EvaluateSmartCollection's zero-rules convention).
+	if len(g.Children) == 0 && depth > 1 {
 		return fmt.Errorf("filter group has no children")
 	}
 	for _, c := range g.Children {
 		if c.Field == "" && c.Mode != "" {
-			if err := validateGroup(&c, depth+1); err != nil {
+			if err := validateGroup(&c, depth+1, scope); err != nil {
 				return err
 			}
 			continue
 		}
-		if err := validateRule(c); err != nil {
+		if err := validateRule(c, scope); err != nil {
 			return err
 		}
 	}
@@ -475,11 +724,18 @@ var numericParsers = map[string]func(string) (any, error){
 	"pages_read":       parseNumberFloat,
 }
 
-func validateRule(c FilterChild) error {
+func validateRule(c FilterChild, scope string) error {
 	f, ok := FilterFieldByKey(c.Field)
 	if !ok {
 		return fmt.Errorf("unknown filter field %q", c.Field)
 	}
+	// Episode-only fields are a user error in a books tree (plan item
+	// 3.1: "hide podcasts from the rules on the all books page"). The
+	// reverse is NOT an error: book fields that no-op against episode
+	// rows (NULLs) are allowed in episodes trees.
+	if scope == ScopeBooks && episodeOnlyFields[c.Field] {
+		return fmt.Errorf("field %q only exists in the episodes scope", c.Field)
+	}
 	if !fieldOpsAllowed(f, c.Op) {
 		return fmt.Errorf("operator %q not allowed on field %q", c.Op, c.Field)
 	}

internal/services/filter_registry_test.go

@@ -55,6 +55,15 @@ func TestFilterRegistryCompleteness(t *testing.T) {
 		"pages_read", "collection",
 		// holding structure
 		"library",
+		// episode quantifier (item 3.1)
+		"published_date",
+	}
+	// Episode-scope fields (item 3.1): they declare exactly the
+	// episodes scope; no other field declares a scope restriction.
+	for _, key := range []string{"feed", "downloaded", "played"} {
+		assert.True(t, seen[key], "episode filter field %q missing from the registry", key)
+		f, _ := FilterFieldByKey(key)
+		assert.Equal(t, []string{ScopeEpisodes}, f.Scopes, "%q must be episodes-scope only", key)
 	}
 	for _, key := range mandated {
 		assert.True(t, seen[key], "mandated filter field %q missing from the registry", key)
@@ -88,7 +97,11 @@ func TestFilterParseValidation(t *testing.T) {
 		"12345678-1234-1234-1234-123456789012" + `"]}]}`)
 
 	invalid(`{not json`, "invalid qf JSON")
-	invalid(`{"mode":"all","children":[]}`, "no children")
+	// An EMPTY ROOT is legal since the episodes scope door (the create
+	// modal seeds one; semantics = matches nothing) — see
+	// TestEmptyRootTreeSeedsEpisodesScope. A NESTED empty group stays
+	// invalid:
+	invalid(`{"mode":"all","children":[{"mode":"any","children":[]}]}`, "no children")
 	invalid(`{"mode":"sometimes","children":[{"field":"author","op":"contains","values":["x"]}]}`, "mode must be all|any")
 	invalid(`{"mode":"all","children":[{"field":"not_a_field","op":"is","values":["x"]}]}`, "unknown filter field")
 	invalid(`{"mode":"all","children":[{"field":"author","op":"explodes","values":["x"]}]}`, "not allowed on field")
@@ -102,6 +115,39 @@ func TestFilterParseValidation(t *testing.T) {
 	invalid(`{"mode":"all","children":[{"field":"author","op":"contains"}]}`, "needs a value")
 }
 
+func TestFilterScopeValidation(t *testing.T) {
+	valid := func(raw string) {
+		_, err := ParseFilterTree(raw)
+		require.NoError(t, err, "expected %s to parse", raw)
+	}
+	invalid := func(raw, wantContain string) {
+		_, err := ParseFilterTree(raw)
+		require.Error(t, err, "expected %s to be rejected", raw)
+		require.Contains(t, err.Error(), wantContain)
+	}
+
+	// Legacy trees (no scope key) stay valid — the default is books.
+	valid(`{"mode":"all","children":[{"field":"author","op":"contains","values":["Voss"]}]}`)
+
+	// Books trees REJECT episode-only fields (the item-3 hide rule).
+	invalid(`{"scope":"books","mode":"all","children":[{"field":"played","op":"is_true"}]}`,
+		"only exists in the episodes scope")
+	invalid(`{"mode":"all","children":[{"field":"downloaded","op":"is_true"}]}`,
+		"only exists in the episodes scope")
+
+	// Episodes trees carry the episode fields.
+	valid(`{"scope":"episodes","mode":"all","children":[
+		{"field":"feed","op":"in","values":["12345678-1234-1234-1234-123456789012"]},
+		{"field":"downloaded","op":"is_true"},
+		{"field":"played","op":"is_false"},
+		{"field":"published_date","op":"within_days","values":["7"]},
+		{"field":"title","op":"contains","values":["news"]}]}`)
+
+	// Unknown scope values are rejected.
+	invalid(`{"scope":"manga","mode":"all","children":[{"field":"title","op":"contains","values":["x"]}]}`,
+		"scope must be books|episodes")
+}
+
 func TestFilterParseDepthCap(t *testing.T) {
 	// Nesting beyond maxFilterDepth is rejected.
 	raw := `{"mode":"all","children":[`
@@ -129,3 +175,102 @@ func TestFilterFieldsByGroupOrdering(t *testing.T) {
 		require.NotEmpty(t, g.Fields, "group %s must not be empty", g.Group)
 	}
 }
+
+// The episodes scope door (2026-10-31): the create modal seeds an EMPTY
+// episodes root so a fresh Episodes smart collection has a stored scope
+// before its first rule. The parser accepts an empty ROOT (nested empty
+// groups stay invalid), and the composers define the semantics — zero
+// children matches NOTHING, mirroring EvaluateSmartCollection's
+// zero-rules convention (a bare scope head would match everything).
+func TestEmptyRootTreeSeedsEpisodesScope(t *testing.T) {
+	tree, err := ParseFilterTree(`{"scope":"episodes","mode":"all","children":[]}`)
+	if err != nil {
+		t.Fatalf("ParseFilterTree(seed): %v", err)
+	}
+	if got := tree.FilterScope(); got != ScopeEpisodes {
+		t.Fatalf("FilterScope = %q, want %q", got, ScopeEpisodes)
+	}
+	if len(tree.Children) != 0 {
+		t.Fatalf("children = %d, want 0", len(tree.Children))
+	}
+
+	// Nested empty groups remain invalid.
+	nested := `{"mode":"all","children":[{"mode":"any","children":[]}]}`
+	if _, err := ParseFilterTree(nested); err == nil {
+		t.Fatal("nested empty group must stay invalid")
+	}
+}
+
+// The episodes-scope vocabulary leads with what the scope can match:
+// book-only metadata (people, publishing metadata, series/comics,
+// book identifiers) is hidden from the menu. Parse still accepts them
+// (their composed clauses simply match nothing on episode rows) — this
+// pins the AUTHORING surface, not the grammar.
+func TestEpisodesScopeHidesBookOnlyFields(t *testing.T) {
+	episodes := FilterFieldsPayload(ScopeEpisodes)
+	keys := map[string]bool{}
+	for _, f := range episodes {
+		keys[f.Key] = true
+	}
+	hidden := []string{"author", "narrator", "publisher", "isbn", "series", "format_group", "subtitle"}
+	for _, k := range hidden {
+		if keys[k] {
+			t.Errorf("episodes vocabulary must not offer book-only field %q", k)
+		}
+	}
+	for _, want := range []string{"feed", "downloaded", "played", "published_date", "title"} {
+		if !keys[want] {
+			t.Errorf("episodes vocabulary must offer %q", want)
+		}
+	}
+
+	// The books scope keeps the book fields and still rejects episode
+	// fields.
+	books := FilterFieldsPayload(ScopeBooks)
+	bkeys := map[string]bool{}
+	for _, f := range books {
+		bkeys[f.Key] = true
+	}
+	if !bkeys["author"] || bkeys["feed"] {
+		t.Fatalf("books vocabulary wrong: author=%v feed=%v", bkeys["author"], bkeys["feed"])
+	}
+}
+
+// ── 2026-11-01, Option A: one operator name per semantic ────────────
+// feed's MENU offers in/not_in only (is/is_not were exact synonyms);
+// trees saved before the collapse keep parsing forever.
+
+func TestFeedVocabularyCollapse(t *testing.T) {
+	f, ok := FilterFieldByKey("feed")
+	require.True(t, ok)
+	for _, o := range f.Ops {
+		assert.NotEqual(t, OpIs, o, "the feed menu must not offer the is synonym")
+		assert.NotEqual(t, OpIsNot, o, "the feed menu must not offer the is_not synonym")
+	}
+	assert.Contains(t, f.Ops, OpIn)
+	assert.Contains(t, f.Ops, OpNotIn)
+
+	// The payload (the client's menus) carries the same collapse.
+	for _, wf := range FilterFieldsPayload(ScopeEpisodes) {
+		if wf.Key != "feed" {
+			continue
+		}
+		for _, op := range wf.Ops {
+			assert.NotEqual(t, OpIs, op.Key, "payload must not offer is on feed")
+		}
+		return
+	}
+	t.Fatal("feed missing from the episodes payload")
+}
+
+func TestFeedLegacyOpsStillParse(t *testing.T) {
+	// Stored trees from before the collapse: is/is_not on feed parse
+	// and validate like their in/not_in twins.
+	legacy := `{"scope":"episodes","mode":"any","children":[
+		{"field":"feed","op":"is","values":["11111111-1111-1111-1111-111111111111"]},
+		{"field":"feed","op":"is_not","values":["22222222-2222-2222-2222-222222222222"]}
+	]}`
+	tree, err := ParseFilterTree(legacy)
+	require.NoError(t, err, "legacy feed is/is_not trees parse forever")
+	require.Len(t, tree.Children, 2)
+}

internal/services/media_scanner.go

@@ -433,7 +433,6 @@ func (s *MediaScanner) upsertPlaylistCollection(ctx context.Context, entry Serie
 		UserID:          owner,
 		Name:            entry.Name,
 		Description:     pgtype.Text{String: description, Valid: true},
-		AutoAssignRules: nil, // jsonb NULL — an empty []byte encodes as bytea and 22P02s
 		ViewSettings:    viewSettings,
 		ShowOnDashboard: pgtype.Bool{Bool: true, Valid: true}, // playlists land on the dashboard by design; hide via dashboard prefs
 	})

internal/services/podcast_order.go

@@ -0,0 +1,87 @@
+package services
+
+import (
+	"bookhoard/internal/database"
+	"fmt"
+	"sort"
+)
+
+// Podcast episode ordering — THE single source of order truth (§0 item
+// 3 + item 5a, 2026-10-30). Every surface (sequence JSON, reader chain
+// context, SSR page list, download queueing) routes through
+// OrderEpisodes; per-surface sort blocks were the drift risk (three
+// near-identical comparators existed by hand).
+
+// PodcastEpisodeOrder values:
+//   - native:  feed position ASC, date ASC tiebreak (fetch-maintained order)
+//   - reverse: feed position DESC, date DESC tiebreak ("Reverse feed
+//     order" — no pub dates involved, so Scribl's messy/all-equal
+//     migrated podiobooks dates can't break it)
+//   - oldest / newest: chronological by pub date string (2006-01-02 or
+//     anything lexical-comparable), position as same-date tiebreak
+func ValidPodcastEpisodeOrder(o string) bool {
+	return o == "native" || o == "reverse" || o == "oldest" || o == "newest"
+}
+
+// OrderEpisodes sorts eps in place into the given order. Accessor
+// functions supply each episode's feed position and pub date key
+// (LEN lexical-comparable, e.g. RFC3339 or 2006-01-02).
+func OrderEpisodes[T any](eps []T, order string, pos func(T) int32, date func(T) string) {
+	switch order {
+	case "reverse":
+		sort.SliceStable(eps, func(i, j int) bool {
+			if pos(eps[i]) != pos(eps[j]) {
+				return pos(eps[i]) > pos(eps[j])
+			}
+			return date(eps[i]) > date(eps[j])
+		})
+	case "oldest", "newest":
+		sort.SliceStable(eps, func(i, j int) bool {
+			ka := date(eps[i]) + episodePosKey(pos(eps[i]))
+			kb := date(eps[j]) + episodePosKey(pos(eps[j]))
+			if order == "newest" {
+				return ka > kb
+			}
+			return ka < kb
+		})
+	default: // native
+		sort.SliceStable(eps, func(i, j int) bool {
+			if pos(eps[i]) != pos(eps[j]) {
+				return pos(eps[i]) < pos(eps[j])
+			}
+			return date(eps[i]) < date(eps[j])
+		})
+	}
+}
+
+// OrderEpisodeMedia applies the curated listening order to a media
+// match list — the SMART collection page renders exactly what the
+// sequence will play (2026-11-01 user report: flipping the order select
+// changed nothing on the page, and Play launches from the first card).
+// Non-episode match lists are left untouched (title order stays).
+func OrderEpisodeMedia(items []database.MediaItems, order string) {
+	anyEpisode := false
+	for _, m := range items {
+		if m.Source == "podcast_episode" {
+			anyEpisode = true
+			break
+		}
+	}
+	if !anyEpisode {
+		return
+	}
+	OrderEpisodes(items, order,
+		func(m database.MediaItems) int32 { return m.FeedPosition.Int32 },
+		func(m database.MediaItems) string {
+			if m.DatePublished.Valid {
+				return m.DatePublished.Time.Format("2006-01-02")
+			}
+			return ""
+		})
+}
+
+// episodePosKey: zero-padded position so lexical date keys tiebreak
+// numerically.
+func episodePosKey(pos int32) string {
+	return fmt.Sprintf("%06d", pos)
+}

internal/services/podcast_service.go

@@ -542,6 +542,66 @@ func (s *PodcastService) DeleteFeedFiles(ctx context.Context, feed *database.Pod
 	_ = os.Remove(filepath.Join(root, feedSlug(feed.Title, feed.ID)))
 }
 
+// AdminDeleteEpisodeFile (§0 item 8): ONE downloaded episode's file is
+// removed from disk and its row reset to pending (facts cleared,
+// file_path kept — fetch-maintained layout). Runs under the first-admin
+// identity (caller supplies the admin ctx — invariant 12). The poll
+// upsert never touches download_state, so the file stays deleted.
+func (s *PodcastService) AdminDeleteEpisodeFile(ctx context.Context, episodeID pgtype.UUID) error {
+	ep, err := s.db.GetPodcastEpisode(ctx, episodeID)
+	if err != nil {
+		return errNotFound("episode not found")
+	}
+	if !ep.SourceFeedID.Valid {
+		return fmt.Errorf("episode has no feed reference")
+	}
+	if ep.DownloadState != "downloaded" {
+		return nil // nothing on disk; idempotent no-op
+	}
+	feed, err := s.db.GetPodcastFeed(ctx, ep.SourceFeedID)
+	if err != nil {
+		return fmt.Errorf("feed lookup: %w", errNotFound("feed not found"))
+	}
+	root, err := s.downloadRootAbs(ctx, &feed)
+	if err != nil {
+		return err
+	}
+	if ep.FilePath != "" {
+		_ = os.Remove(filepath.Join(root, ep.FilePath))
+		base := filepath.Join(root, strings.TrimSuffix(ep.FilePath, filepath.Ext(ep.FilePath)))
+		_ = os.Remove(base + ".cover.jpg")
+	}
+	return s.db.ResetPodcastEpisodeFileDeleted(ctx, episodeID)
+}
+
+// AdminDeleteFeedFiles (§0 item 8): every DOWNLOADED episode of the
+// feed loses its disk file; rows reset to pending. Returns how many
+// rows were reset. Poll upsert never touches download_state → a
+// refresh re-lists metadata but does NOT re-materialize files.
+func (s *PodcastService) AdminDeleteFeedFiles(ctx context.Context, feedID pgtype.UUID) (int64, error) {
+	feed, err := s.db.GetPodcastFeed(ctx, feedID)
+	if err != nil {
+		return 0, errNotFound("feed not found")
+	}
+	eps, err := s.db.ListPodcastEpisodes(ctx, feedID)
+	if err != nil {
+		return 0, err
+	}
+	root, err := s.downloadRootAbs(ctx, &feed)
+	if err != nil {
+		return 0, err
+	}
+	for _, ep := range eps {
+		if ep.DownloadState != "downloaded" || ep.FilePath == "" {
+			continue
+		}
+		_ = os.Remove(filepath.Join(root, ep.FilePath))
+		base := filepath.Join(root, strings.TrimSuffix(ep.FilePath, filepath.Ext(ep.FilePath)))
+		_ = os.Remove(base + ".cover.jpg")
+	}
+	return s.db.ResetPodcastFeedFilesDeleted(ctx, feedID)
+}
+
 // downloadRootAbs resolves the podcasts library's single download root
 // (purpose='podcast') as an absolute filesystem path.
 func (s *PodcastService) downloadRootAbs(ctx context.Context, feed *database.PodcastFeeds) (string, error) {

internal/services/podcast_worker.go

@@ -1,11 +1,21 @@
-// Podcast download worker (plan §7 / D6 / D8 / D19): ONE sequential
-// worker (day one) driving the episode state machine
+// Podcast download worker (plan §7 / D6 / D8 / D19; pool since §0 item
+// 4): a download-manager-style pool driving the episode state machine
 //
 //	pending → queued → downloading → downloaded
 //	                              ↘ failed (+ download_error)
 //
 // queued rows are the DB-backed worklist — the state is persisted so
 // the episode list ALWAYS renders truth (no in-memory queue to lose).
+// Each queue ticket (download_queue_pos, a SEQUENCE nextval at
+// enqueue) makes the enqueue loop's ordering the download order.
+//
+// Concurrency: up to podcast_download_concurrency episodes in flight
+// server-wide (default 4, admin-tunable live 1–16). Fair share: the
+// claim prefers the feed least-recently-served, so several books
+// download in parallel while chapters within a book land in ticket
+// order (start listening while the rest catch up). Bandwidth: an
+// optional shared token bucket (podcast_download_speed_mbps, 0 =
+// unlimited) paces all workers together.
 //
 // Idempotency: a download request for an episode whose file already
 // exists and probes cleanly re-marks it downloaded without re-fetching
@@ -29,10 +39,10 @@ import (
 	"fmt"
 	"io"
 	"log"
-	"os"
-	"path/filepath"
 	"net/http"
 	"net/url"
+	"os"
+	"path/filepath"
 	"strings"
 	"sync"
 	"time"
@@ -48,25 +58,64 @@ const maxAutoDownloadAttempts = 5
 
 // PodcastDownloadWorker processes queued episode downloads.
 type PodcastDownloadWorker struct {
-	db  *database.Queries
-	svc *PodcastService
-	wake chan struct{}
+	db       *database.Queries
+	svc      *PodcastService
+	settings *database.SettingsRegistry
+	wake     chan struct{}
+
+	// Fair-share bookkeeping (§0 item 4): feed UUID string → last
+	// time the pool served it. Claim prefers the smallest value;
+	// never-served feeds (missing key) go first. Guarded by fairMu.
+	fairMu     sync.Mutex
+	lastServed map[string]time.Time
+
+	// Shared bandwidth bucket across all pool workers (§0 item 4).
+	limiter bandwidthLimiter
 
 	// Live byte-progress slots for in-flight downloads (issue #1).
 	// Keyed by episode UUID string; guarded by progMu.
-	progMu  sync.Mutex
+	progMu   sync.Mutex
 	progress map[string]*episodeProgress
 }
 
 func NewPodcastDownloadWorker(db *database.Queries, svc *PodcastService) *PodcastDownloadWorker {
 	return &PodcastDownloadWorker{
-		db:      db,
-		svc:     svc,
-		wake:    make(chan struct{}, 1),
-		progress: make(map[string]*episodeProgress),
+		db:         db,
+		svc:        svc,
+		wake:       make(chan struct{}, 1),
+		lastServed: make(map[string]time.Time),
+		progress:   make(map[string]*episodeProgress),
 	}
 }
 
+// SetSettings wires the live settings registry (admin tunables:
+// concurrency + bandwidth cap). Without it the worker runs on the
+// registered defaults (4 in flight, unlimited speed) — the test
+// harness constructs workers without settings.
+func (w *PodcastDownloadWorker) SetSettings(r *database.SettingsRegistry) {
+	w.settings = r
+}
+
+// concurrency re-reads the live setting each drain cycle.
+func (w *PodcastDownloadWorker) concurrency() int {
+	if w.settings == nil {
+		return 4 // registered default
+	}
+	if n := w.settings.PodcastDownloadConcurrency(); n >= 1 {
+		return n
+	}
+	return 4
+}
+
+// refillLimiter re-syncs the shared bucket's rate (bytes/sec) from the
+// live setting; 0 = unlimited.
+func (w *PodcastDownloadWorker) refillLimiter() {
+	if w.settings == nil {
+		return
+	}
+	w.limiter.setRate(int64(w.settings.PodcastDownloadSpeedMbps() * 125000)) // Mbps → bytes/sec
+}
+
 // Wake nudges the loop (new work queued).
 func (w *PodcastDownloadWorker) Wake() {
 	select {
@@ -93,21 +142,129 @@ func (w *PodcastDownloadWorker) Start(ctx context.Context) {
 	}()
 }
 
-// drain processes queued episodes until the queue is empty.
+// DrainNow runs one bounded pool round synchronously — the test hook
+// and the future admin "retry now" seam (normally the wake channel
+// drives rounds).
+func (w *PodcastDownloadWorker) DrainNow(ctx context.Context) {
+	w.drain(ctx)
+}
+
+// drain runs one pool round: up to concurrency() claim-loop goroutines
+// each claim (fair-share) → download → settle, until the queue is
+// empty. The cap setting is re-read every round — live-tunable.
 func (w *PodcastDownloadWorker) drain(ctx context.Context) {
-	for {
-		if ctx.Err() != nil {
-			return
-		}
-		acted, err := w.processNext(ctx)
+	if ctx.Err() != nil {
+		return
+	}
+	w.refillLimiter()
+	limit := w.concurrency()
+	var wg sync.WaitGroup
+	for i := 0; i < limit; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for {
+				if ctx.Err() != nil {
+					return
+				}
+				ep, ok := w.claimNext(ctx)
+				if !ok {
+					return // queue drained (or nothing claimable)
+				}
+				w.runOne(ctx, ep)
+			}
+		}()
+	}
+	wg.Wait()
+}
+
+// claimNext atomically claims the next queued episode, preferring the
+// feed least-recently-served (fair share — books proceed in parallel)
+// and the earliest queue ticket within a feed (chapters land in
+// enqueue order). Returns ok=false when nothing is claimable.
+func (w *PodcastDownloadWorker) claimNext(ctx context.Context) (database.MediaItems, bool) {
+	actx, err := w.svc.adminCtx(ctx)
+	if err != nil {
+		return database.MediaItems{}, false
+	}
+	cands, err := w.db.ListQueuedPodcastEpisodes(actx)
+	if err != nil || len(cands) == 0 {
+		return database.MediaItems{}, false
+	}
+
+	// Group per feed preserving ticket order (the SQL scan is ordered).
+	perFeed := make(map[pgtype.UUID][]pgtype.UUID, 8)
+	for _, c := range cands {
+		perFeed[c.SourceFeedID] = append(perFeed[c.SourceFeedID], c.ID)
+	}
+
+	w.fairMu.Lock()
+	defer w.fairMu.Unlock()
+	pickFeed := pickFeedToServe(perFeed, w.lastServed)
+	if !pickFeed.Valid {
+		return database.MediaItems{}, false
+	}
+
+	// Claim the head ticket of the chosen feed; if another claimant
+	// won it meanwhile (retry raced), fall through the feed's tickets.
+	for _, id := range perFeed[pickFeed] {
+		ep, err := w.db.ClaimQueuedPodcastEpisode(actx, id)
 		if err != nil {
-			log.Printf("[PODCAST-DL] worker step: %v", err)
-			return
+			continue // claimed elsewhere / state moved on
 		}
-		if !acted {
-			return
+		w.lastServed[pickFeed.String()] = time.Now()
+		return ep, true
+	}
+	return database.MediaItems{}, false
+}
+
+// pickFeedToServe chooses the feed least-recently-served (never-served
+// first); among never-served feeds the first encountered wins (any is
+// equally fair). Unit-testable seam for the fair-share rule.
+func pickFeedToServe(perFeed map[pgtype.UUID][]pgtype.UUID, lastServed map[string]time.Time) pgtype.UUID {
+	var pick pgtype.UUID
+	var best time.Time
+	haveNever := false
+	for feed := range perFeed {
+		last, seen := lastServed[feed.String()]
+		if !seen {
+			if !haveNever {
+				pick, haveNever = feed, true
+			}
+			continue
+		}
+		if haveNever {
+			continue // a never-served feed already won
+		}
+		if !pick.Valid || last.Before(best) {
+			pick, best = feed, last
 		}
 	}
+	return pick
+}
+
+// runOne downloads a claimed episode and settles the row either way
+// (failed/rejected: state + reason persist; metadata/file facts
+// untouched — invariant 7, write-after-success only).
+func (w *PodcastDownloadWorker) runOne(ctx context.Context, ep database.MediaItems) {
+	actx, err := w.svc.adminCtx(ctx)
+	if err != nil {
+		return
+	}
+	if err := w.runPipeline(actx, ep); err != nil {
+		_ = w.db.MarkPodcastEpisodeFailed(actx, database.MarkPodcastEpisodeFailedParams{
+			ID:            ep.ID,
+			DownloadError: pgtypeText(err.Error()),
+			Column3:       false, // auto failure: never resets the attempt budget
+		})
+		log.Printf("[PODCAST-DL] episode %s failed: %v", ep.ID, err)
+	}
+}
+
+// AdminCtx exposes the worker's first-admin identity (tests use it for
+// worker-scope DB statements).
+func (w *PodcastDownloadWorker) AdminCtx(ctx context.Context) (context.Context, error) {
+	return w.svc.adminCtx(ctx)
 }
 
 // QueueEpisode marks one episode queued (manual download / retry path).
@@ -141,9 +298,12 @@ func (w *PodcastDownloadWorker) QueueEpisode(ctx context.Context, episodeID, fee
 	return nil
 }
 
-// QueueFeedDownloads implements "Download All" (D8): queue exactly the
-// non-downloaded set — pending AND failed rows (retry is the same path).
-func (w *PodcastDownloadWorker) QueueFeedDownloads(ctx context.Context, feedID pgtype.UUID) (int, error) {
+// QueueFeedDownloadsAs is Download All honoring the CALLER's listening
+// order (§0 item 5b): episodes queue in the feed's effective order (the
+// caller's override, feed-native fallback). Tickets (§0 item 4) make
+// that queue order the download order — "getting the last chapter
+// first doesn't help me". userID zero = no override (feed order).
+func (w *PodcastDownloadWorker) QueueFeedDownloadsAs(ctx context.Context, userID, feedID pgtype.UUID) (int, error) {
 	actx, err := w.svc.adminCtx(ctx)
 	if err != nil {
 		return 0, err
@@ -156,6 +316,27 @@ func (w *PodcastDownloadWorker) QueueFeedDownloads(ctx context.Context, feedID p
 	if err != nil {
 		return 0, err
 	}
+
+	// THE order helper (§0 item 5a) — same semantics as the sequence,
+	// reader chain, and page list; no per-surface sort drift. UNSET
+	// defaults to "reverse" (2026-11-01, audiobook-first: chapter order
+	// downloads first so listening can start while the rest fetches).
+	order := "reverse"
+	if userID.Valid {
+		order = w.orderOverrideFor(actx, userID, feedID)
+	}
+	// THE order helper (§0 item 5a) — same semantics as the sequence,
+	// reader chain, and page list; no per-surface sort drift.
+	OrderEpisodes(eps, order,
+		func(ep database.MediaItems) int32 { return ep.FeedPosition.Int32 },
+		func(ep database.MediaItems) string {
+			if ep.DatePublished.Valid {
+				return ep.DatePublished.Time.Format("2006-01-02")
+			}
+			return ""
+		},
+	)
+
 	queued := 0
 	for _, ep := range eps {
 		if _, err := w.db.SetPodcastEpisodeDownloadQueued(actx, ep.ID); err == nil {
@@ -166,6 +347,26 @@ func (w *PodcastDownloadWorker) QueueFeedDownloads(ctx context.Context, feedID p
 	return queued, nil
 }
 
+// orderOverrideFor reads a user's podcast_order override via the
+// reader_settings KV (the D5 storage; "reverse" when absent/invalid —
+// the 2026-11-01 audiobook-first default, same as every other
+// resolution site of this setting).
+func (w *PodcastDownloadWorker) orderOverrideFor(ctx context.Context, userID, feedID pgtype.UUID) string {
+	row, err := w.db.GetUserSettingByKey(ctx, database.GetUserSettingByKeyParams{
+		UserID: userID, SettingKey: "podcast_order:" + feedID.String(),
+	})
+	if err != nil {
+		return "reverse"
+	}
+	var v struct {
+		Order string `json:"order"`
+	}
+	if json.Unmarshal(row, &v) != nil || !ValidPodcastEpisodeOrder(v.Order) {
+		return "reverse"
+	}
+	return v.Order
+}
+
 // ApplyAutoPolicies unions subscriber policies for a feed (D6: most
 // aggressive wins for what ARRIVES — deletion stays admin-only) and
 // queues the target set, respecting the auto-retry attempt cap.
@@ -228,33 +429,6 @@ func (w *PodcastDownloadWorker) ApplyAutoPolicies(ctx context.Context, feedID pg
 	return queued, nil
 }
 
-// processNext claims and processes one queued episode. Returns false
-// when the queue was empty.
-func (w *PodcastDownloadWorker) processNext(ctx context.Context) (bool, error) {
-	actx, err := w.svc.adminCtx(ctx)
-	if err != nil {
-		return false, err
-	}
-	ep, err := w.db.GetNextQueuedEpisode(actx)
-	if err != nil {
-		return false, nil // empty queue (or read failure — logged upstream)
-	}
-
-	_ = w.db.SetPodcastEpisodeDownloading(actx, ep.ID)
-
-	if err := w.runPipeline(actx, ep); err != nil {
-		// failed/rejected: state + reason persist; metadata/file facts
-		// untouched (invariant 7 — write-after-success only).
-		_ = w.db.MarkPodcastEpisodeFailed(actx, database.MarkPodcastEpisodeFailedParams{
-			ID:            ep.ID,
-			DownloadError: pgtypeText(err.Error()),
-			Column3:       false, // auto failure: never resets the attempt budget
-		})
-		log.Printf("[PODCAST-DL] episode %s failed: %v", ep.ID, err)
-	}
-	return true, nil
-}
-
 // runPipeline: fetch enclosure (SSRF/size guards) → temp file → MIME/
 // size validation → ffprobe reconcile → move into place → SUCCESS-only
 // row update.
@@ -398,6 +572,42 @@ func (w *PodcastDownloadWorker) EpisodeProgress(episodeID pgtype.UUID) (received
 	return p.Received, p.Total, true
 }
 
+// ---- shared bandwidth bucket (§0 item 4) ----
+// One leaky-bucket-with-reservations limiter across ALL pool workers:
+// each caller reserves the next slot of bandwidth and sleeps outside
+// the lock — reservation order = transmission order, and N workers
+// share one cap instead of N caps.
+
+type bandwidthLimiter struct {
+	mu   sync.Mutex
+	rate int64     // bytes per second; <=0 = unlimited
+	next time.Time // when the currently-reserved budget runs out
+}
+
+func (l *bandwidthLimiter) setRate(bytesPerSec int64) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.rate = bytesPerSec
+}
+
+// take reserves n bytes of bandwidth and returns how long the caller
+// must wait before sending them (0 when free flow).
+func (l *bandwidthLimiter) take(n int64) time.Duration {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if l.rate <= 0 {
+		return 0
+	}
+	now := time.Now()
+	if l.next.Before(now) {
+		l.next = now
+	}
+	d := time.Duration(float64(n) / float64(l.rate) * float64(time.Second))
+	start := l.next // my window begins when earlier reservations end
+	l.next = start.Add(d)
+	return start.Sub(now)
+}
+
 // streamEnclosure performs the SSRF-guarded enclosure download straight
 // to tmpPath while updating the progress slot. Returns bytes received
 // and the authoritative total (0 when unknown). Scheme and size guards
@@ -456,6 +666,15 @@ func (w *PodcastDownloadWorker) streamEnclosure(ctx context.Context, ep database
 			if received > maxEnclosureCapBytes {
 				return received, total, fmt.Errorf("rejected: enclosure exceeds %d byte cap", maxEnclosureCapBytes)
 			}
+			// Shared bandwidth cap: pace against the server-wide
+			// bucket (0 rate = unlimited, take returns 0).
+			if wait := w.limiter.take(int64(n)); wait > 0 {
+				select {
+				case <-ctx.Done():
+					return received, total, fmt.Errorf("download failed: cancelled")
+				case <-time.After(wait):
+				}
+			}
 			w.addProgress(ep.ID, int64(n))
 			if _, werr := out.Write(buf[:n]); werr != nil {
 				return received, total, fmt.Errorf("write: %w", werr)
@@ -496,13 +715,13 @@ func (w *PodcastDownloadWorker) markDownloaded(ctx context.Context, ep database.
 	}
 
 	_, err = w.db.MarkPodcastEpisodeDownloaded(ctx, database.MarkPodcastEpisodeDownloadedParams{
-		ID:           ep.ID,
-		FilePath:     ep.FilePath,
-		FileSize:     pgtypeInt8(info.Size()),
-		MimeType:     pgtypeText(strings.TrimSpace(pickMimeType(ep, absPath))),
+		ID:             ep.ID,
+		FilePath:       ep.FilePath,
+		FileSize:       pgtypeInt8(info.Size()),
+		MimeType:       pgtypeText(strings.TrimSpace(pickMimeType(ep, absPath))),
 		CoverImagePath: coverRel,
-		AudioMetadata: audioPayloadJSONB(payload),
-		ChapterCount: chapterCount,
+		AudioMetadata:  audioPayloadJSONB(payload),
+		ChapterCount:   chapterCount,
 	})
 	if err != nil {
 		return fmt.Errorf("mark downloaded: %w", err)

internal/services/podcast_worker_test.go

@@ -0,0 +1,80 @@
+// Unit tests for the §0 item 4 download-pool mechanics: the shared
+// bandwidth bucket (reservation math, unlimited passthrough) and the
+// fair-share feed pick (never-served first, least-recently-served
+// after). Pure logic — no DB.
+package services
+
+import (
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/stretchr/testify/assert"
+)
+
+func uuidOf(s string) pgtype.UUID {
+	var u pgtype.UUID
+	_ = u.Scan(s)
+	return u
+}
+
+func TestBandwidthLimiter(t *testing.T) {
+	t.Run("zero rate is unlimited", func(t *testing.T) {
+		var l bandwidthLimiter
+		l.setRate(0)
+		assert.Zero(t, l.take(1<<20), "unlimited → no wait, ever")
+		assert.Zero(t, l.take(1<<20))
+	})
+
+	t.Run("reservations share one bucket", func(t *testing.T) {
+		var l bandwidthLimiter
+		l.setRate(1_000_000) // 1 MB/s
+		start := time.Now()
+
+		w1 := l.take(1_000_000) // first caller: free flow
+		w2 := l.take(1_000_000) // second caller: waits one full second
+		w3 := l.take(1_000_000) // third caller: waits two seconds
+
+		assert.Less(t, int64(w1), int64(50*time.Millisecond), "first reservation starts immediately")
+		assert.GreaterOrEqual(t, int64(w2), int64(900*time.Millisecond), "second waits ~1s at 1MB/s")
+		assert.GreaterOrEqual(t, int64(w3), int64(1900*time.Millisecond), "third waits ~2s — SHARED bucket, not per-worker")
+		assert.Less(t, time.Since(start), 100*time.Millisecond, "take() only reserves — callers sleep outside the lock")
+	})
+
+	t.Run("idle bucket recovers", func(t *testing.T) {
+		var l bandwidthLimiter
+		l.setRate(1_000_000)
+		_ = l.take(1_000_000)
+		l.next = time.Now().Add(-time.Second) // simulate a second of idle flow
+		assert.Less(t, int64(l.take(500_000)), int64(50*time.Millisecond),
+			"budget accrued while idle → next take flows immediately")
+	})
+}
+
+func TestPickFeedToServe(t *testing.T) {
+	a, b, c := uuidOf("00000000-0000-0000-0000-00000000000a"),
+		uuidOf("00000000-0000-0000-0000-00000000000b"),
+		uuidOf("00000000-0000-0000-0000-00000000000c")
+	all := map[pgtype.UUID][]pgtype.UUID{a: {}, b: {}, c: {}}
+
+	t.Run("never-served beats served", func(t *testing.T) {
+		served := map[string]time.Time{
+			a.String(): time.Now().Add(-time.Hour),
+			b.String(): time.Now().Add(-time.Minute),
+		}
+		assert.Equal(t, c, pickFeedToServe(all, served), "c was never served → c wins even though a starved longest")
+	})
+
+	t.Run("least-recently-served wins", func(t *testing.T) {
+		served := map[string]time.Time{
+			a.String(): time.Now().Add(-time.Hour),  // starved longest
+			b.String(): time.Now().Add(-time.Minute), // served recently
+		}
+		two := map[pgtype.UUID][]pgtype.UUID{a: {}, b: {}}
+		assert.Equal(t, a, pickFeedToServe(two, served))
+	})
+
+	t.Run("empty queue picks nothing", func(t *testing.T) {
+		assert.False(t, pickFeedToServe(map[pgtype.UUID][]pgtype.UUID{}, nil).Valid)
+	})
+}

templates/admin_archived_templ.go

@@ -45,7 +45,7 @@ func AdminArchived(user User, items []ArchivedItem, retentionDays int) templ.Com
 		var templ_7745c5c3_Var3 string
 		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var2).String())
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_archived.templ`, Line: 1, Col: 0}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_archived.templ`, Line: 1, Col: 0}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var3)
 		if templ_7745c5c3_Err != nil {
@@ -79,7 +79,7 @@ func AdminArchived(user User, items []ArchivedItem, retentionDays int) templ.Com
 			var templ_7745c5c3_Var4 string
 			templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(retentionDays)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_archived.templ`, Line: 30, Col: 70}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_archived.templ`, Line: 30, Col: 70}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
 			if templ_7745c5c3_Err != nil {
@@ -135,7 +135,7 @@ func AdminArchived(user User, items []ArchivedItem, retentionDays int) templ.Com
 				var templ_7745c5c3_Var5 string
 				templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(item.Title)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_archived.templ`, Line: 65, Col: 82}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_archived.templ`, Line: 65, Col: 82}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
 				if templ_7745c5c3_Err != nil {
@@ -153,7 +153,7 @@ func AdminArchived(user User, items []ArchivedItem, retentionDays int) templ.Com
 					var templ_7745c5c3_Var6 string
 					templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(item.Author)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_archived.templ`, Line: 67, Col: 66}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_archived.templ`, Line: 67, Col: 66}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
 					if templ_7745c5c3_Err != nil {
@@ -171,7 +171,7 @@ func AdminArchived(user User, items []ArchivedItem, retentionDays int) templ.Com
 				var templ_7745c5c3_Var7 string
 				templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(item.FilePath)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_archived.templ`, Line: 69, Col: 103}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_archived.templ`, Line: 69, Col: 103}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
 				if templ_7745c5c3_Err != nil {
@@ -184,7 +184,7 @@ func AdminArchived(user User, items []ArchivedItem, retentionDays int) templ.Com
 				var templ_7745c5c3_Var8 string
 				templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(item.LibraryName)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_archived.templ`, Line: 71, Col: 86}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_archived.templ`, Line: 71, Col: 86}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
 				if templ_7745c5c3_Err != nil {
@@ -197,7 +197,7 @@ func AdminArchived(user User, items []ArchivedItem, retentionDays int) templ.Com
 				var templ_7745c5c3_Var9 string
 				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(item.Status)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_archived.templ`, Line: 72, Col: 83}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_archived.templ`, Line: 72, Col: 83}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
 				if templ_7745c5c3_Err != nil {
@@ -215,7 +215,7 @@ func AdminArchived(user User, items []ArchivedItem, retentionDays int) templ.Com
 					var templ_7745c5c3_Var10 string
 					templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.ResolveAttributeValue(item.ID)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_archived.templ`, Line: 77, Col: 41}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_archived.templ`, Line: 77, Col: 41}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var10)
 					if templ_7745c5c3_Err != nil {
@@ -228,7 +228,7 @@ func AdminArchived(user User, items []ArchivedItem, retentionDays int) templ.Com
 					var templ_7745c5c3_Var11 string
 					templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.ResolveAttributeValue(item.MatchID)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_archived.templ`, Line: 78, Col: 46}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_archived.templ`, Line: 78, Col: 46}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var11)
 					if templ_7745c5c3_Err != nil {
@@ -241,7 +241,7 @@ func AdminArchived(user User, items []ArchivedItem, retentionDays int) templ.Com
 					var templ_7745c5c3_Var12 string
 					templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.ResolveAttributeValue("Merge this archived copy's reading data into the active copy \"" + item.MatchTitle + "\" (" + item.MatchLibraryName + ") and remove the archived entry")
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_archived.templ`, Line: 80, Col: 174}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_archived.templ`, Line: 80, Col: 174}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var12)
 					if templ_7745c5c3_Err != nil {
@@ -267,7 +267,7 @@ func AdminArchived(user User, items []ArchivedItem, retentionDays int) templ.Com
 				var templ_7745c5c3_Var13 string
 				templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.ResolveAttributeValue(item.ID)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_archived.templ`, Line: 88, Col: 37}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_archived.templ`, Line: 88, Col: 37}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var13)
 				if templ_7745c5c3_Err != nil {
@@ -288,7 +288,7 @@ func AdminArchived(user User, items []ArchivedItem, retentionDays int) templ.Com
 				var templ_7745c5c3_Var14 string
 				templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(item.ID)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_archived.templ`, Line: 97, Col: 43}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_archived.templ`, Line: 97, Col: 43}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
 				if templ_7745c5c3_Err != nil {

templates/admin_hash_conflicts_templ.go

@@ -59,7 +59,7 @@ func HashConflictCard(conflict HashConflictData) templ.Component {
 		var templ_7745c5c3_Var2 string
 		templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.ResolveAttributeValue("conflict-" + conflict.ID)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 27, Col: 53}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 27, Col: 53}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var2)
 		if templ_7745c5c3_Err != nil {
@@ -80,7 +80,7 @@ func HashConflictCard(conflict HashConflictData) templ.Component {
 		var templ_7745c5c3_Var3 string
 		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d copies", len(conflict.Items)))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 33, Col: 87}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 33, Col: 87}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3))
 		if templ_7745c5c3_Err != nil {
@@ -93,7 +93,7 @@ func HashConflictCard(conflict HashConflictData) templ.Component {
 		var templ_7745c5c3_Var4 string
 		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(conflict.LibraryName)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 36, Col: 62}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 36, Col: 62}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
 		if templ_7745c5c3_Err != nil {
@@ -106,7 +106,7 @@ func HashConflictCard(conflict HashConflictData) templ.Component {
 		var templ_7745c5c3_Var5 string
 		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(conflict.SHAShort)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 38, Col: 55}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 38, Col: 55}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
 		if templ_7745c5c3_Err != nil {
@@ -119,7 +119,7 @@ func HashConflictCard(conflict HashConflictData) templ.Component {
 		var templ_7745c5c3_Var6 string
 		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.ResolveAttributeValue("/api/admin/hash-conflicts/" + conflict.ID + "/resolve")
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 46, Col: 70}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 46, Col: 70}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var6)
 		if templ_7745c5c3_Err != nil {
@@ -132,7 +132,7 @@ func HashConflictCard(conflict HashConflictData) templ.Component {
 		var templ_7745c5c3_Var7 string
 		templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.ResolveAttributeValue("#conflict-" + conflict.ID)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 48, Col: 43}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 48, Col: 43}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var7)
 		if templ_7745c5c3_Err != nil {
@@ -194,7 +194,7 @@ func HashConflictItemCardWrapper(item HashConflictItemData, conflictID string) t
 		var templ_7745c5c3_Var9 string
 		templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(item.Title)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 71, Col: 82}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 71, Col: 82}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
 		if templ_7745c5c3_Err != nil {
@@ -212,7 +212,7 @@ func HashConflictItemCardWrapper(item HashConflictItemData, conflictID string) t
 			var templ_7745c5c3_Var10 string
 			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(item.Author)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 73, Col: 82}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 73, Col: 82}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
 			if templ_7745c5c3_Err != nil {
@@ -230,7 +230,7 @@ func HashConflictItemCardWrapper(item HashConflictItemData, conflictID string) t
 		var templ_7745c5c3_Var11 string
 		templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(item.FilePath)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 75, Col: 89}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 75, Col: 89}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
 		if templ_7745c5c3_Err != nil {
@@ -243,7 +243,7 @@ func HashConflictItemCardWrapper(item HashConflictItemData, conflictID string) t
 		var templ_7745c5c3_Var12 string
 		templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%.1f MB", float64(item.FileSize)/(1024*1024)))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 77, Col: 64}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 77, Col: 64}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
 		if templ_7745c5c3_Err != nil {
@@ -261,7 +261,7 @@ func HashConflictItemCardWrapper(item HashConflictItemData, conflictID string) t
 			var templ_7745c5c3_Var13 string
 			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(item.UsageSummary)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 79, Col: 85}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 79, Col: 85}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
 			if templ_7745c5c3_Err != nil {
@@ -279,7 +279,7 @@ func HashConflictItemCardWrapper(item HashConflictItemData, conflictID string) t
 			var templ_7745c5c3_Var14 string
 			templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(item.UsageSummary)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 81, Col: 43}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 81, Col: 43}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
 			if templ_7745c5c3_Err != nil {
@@ -297,7 +297,7 @@ func HashConflictItemCardWrapper(item HashConflictItemData, conflictID string) t
 		var templ_7745c5c3_Var15 string
 		templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.ResolveAttributeValue("/api/admin/hash-conflicts/" + conflictID + "/resolve")
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 87, Col: 68}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 87, Col: 68}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var15)
 		if templ_7745c5c3_Err != nil {
@@ -310,7 +310,7 @@ func HashConflictItemCardWrapper(item HashConflictItemData, conflictID string) t
 		var templ_7745c5c3_Var16 string
 		templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf(`{"action": "keep", "keep_uuid": "%s"}`, item.ID))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 88, Col: 75}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 88, Col: 75}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var16)
 		if templ_7745c5c3_Err != nil {
@@ -323,7 +323,7 @@ func HashConflictItemCardWrapper(item HashConflictItemData, conflictID string) t
 		var templ_7745c5c3_Var17 string
 		templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.ResolveAttributeValue("#conflict-" + conflictID)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 89, Col: 41}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 89, Col: 41}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var17)
 		if templ_7745c5c3_Err != nil {
@@ -383,7 +383,7 @@ func AdminHashConflicts(user User, conflicts []HashConflictData) templ.Component
 		var templ_7745c5c3_Var20 string
 		templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var19).String())
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_hash_conflicts.templ`, Line: 1, Col: 0}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_hash_conflicts.templ`, Line: 1, Col: 0}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var20)
 		if templ_7745c5c3_Err != nil {

templates/admin_library_templ.go

@@ -47,7 +47,7 @@ func AdminLibrary(user User, libraries []LibraryData, users []User, archivedCoun
 		var templ_7745c5c3_Var3 string
 		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var2).String())
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 1, Col: 0}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 1, Col: 0}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var3)
 		if templ_7745c5c3_Err != nil {
@@ -89,7 +89,7 @@ func AdminLibrary(user User, libraries []LibraryData, users []User, archivedCoun
 			var templ_7745c5c3_Var4 string
 			templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(archivedCount)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 44, Col: 41}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 44, Col: 41}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
 			if templ_7745c5c3_Err != nil {
@@ -220,7 +220,7 @@ func LibraryTypeOptions(types []database.LibraryTypes) templ.Component {
 			var templ_7745c5c3_Var6 string
 			templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.ResolveAttributeValue(t.Name)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 185, Col: 24}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 185, Col: 24}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var6)
 			if templ_7745c5c3_Err != nil {
@@ -233,7 +233,7 @@ func LibraryTypeOptions(types []database.LibraryTypes) templ.Component {
 			var templ_7745c5c3_Var7 string
 			templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(LibraryTypeDisplayName(t.Name))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 185, Col: 59}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 185, Col: 59}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
 			if templ_7745c5c3_Err != nil {
@@ -303,7 +303,7 @@ func LibraryList(user User, libraries []LibraryData, users []User) templ.Compone
 				var templ_7745c5c3_Var9 string
 				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(library.Name)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 209, Col: 92}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 209, Col: 92}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
 				if templ_7745c5c3_Err != nil {
@@ -321,7 +321,7 @@ func LibraryList(user User, libraries []LibraryData, users []User) templ.Compone
 					var templ_7745c5c3_Var10 string
 					templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(library.Description)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 211, Col: 95}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 211, Col: 95}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
 					if templ_7745c5c3_Err != nil {
@@ -343,7 +343,7 @@ func LibraryList(user User, libraries []LibraryData, users []User) templ.Compone
 				var templ_7745c5c3_Var11 string
 				templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(library.TypeName)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 216, Col: 26}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 216, Col: 26}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
 				if templ_7745c5c3_Err != nil {
@@ -365,7 +365,7 @@ func LibraryList(user User, libraries []LibraryData, users []User) templ.Compone
 					var templ_7745c5c3_Var12 string
 					templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(library.FolderCount)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 221, Col: 30}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 221, Col: 30}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
 					if templ_7745c5c3_Err != nil {
@@ -383,7 +383,7 @@ func LibraryList(user User, libraries []LibraryData, users []User) templ.Compone
 				var templ_7745c5c3_Var13 string
 				templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.ResolveAttributeValue("/api/libraries/" + library.ID + "/scan")
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 227, Col: 58}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 227, Col: 58}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var13)
 				if templ_7745c5c3_Err != nil {
@@ -404,7 +404,7 @@ func LibraryList(user User, libraries []LibraryData, users []User) templ.Compone
 				var templ_7745c5c3_Var14 string
 				templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(library.ID)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 237, Col: 32}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 237, Col: 32}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
 				if templ_7745c5c3_Err != nil {
@@ -425,7 +425,7 @@ func LibraryList(user User, libraries []LibraryData, users []User) templ.Compone
 				var templ_7745c5c3_Var15 string
 				templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.ResolveAttributeValue("library-panel-" + library.ID)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 246, Col: 44}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 246, Col: 44}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var15)
 				if templ_7745c5c3_Err != nil {
@@ -500,7 +500,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 				var templ_7745c5c3_Var17 string
 				templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(folder.FolderPath)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 268, Col: 99}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 268, Col: 99}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
 				if templ_7745c5c3_Err != nil {
@@ -513,7 +513,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 				var templ_7745c5c3_Var18 string
 				templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.ResolveAttributeValue("/api/libraries/" + libraryID + "/scan")
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 271, Col: 57}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 271, Col: 57}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var18)
 				if templ_7745c5c3_Err != nil {
@@ -526,7 +526,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 				var templ_7745c5c3_Var19 string
 				templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.ResolveAttributeValue(hxValsFolderScan(folder.FolderPath))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 272, Col: 53}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 272, Col: 53}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var19)
 				if templ_7745c5c3_Err != nil {
@@ -547,7 +547,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 				var templ_7745c5c3_Var20 string
 				templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.ResolveAttributeValue("/admin/library/" + libraryID + "/folders")
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 283, Col: 62}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 283, Col: 62}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var20)
 				if templ_7745c5c3_Err != nil {
@@ -560,7 +560,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 				var templ_7745c5c3_Var21 string
 				templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.ResolveAttributeValue(hxValsFolderDelete(folder.FolderPath))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 284, Col: 55}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 284, Col: 55}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var21)
 				if templ_7745c5c3_Err != nil {
@@ -573,7 +573,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 				var templ_7745c5c3_Var22 string
 				templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.ResolveAttributeValue("#library-panel-" + libraryID)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 285, Col: 49}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 285, Col: 49}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var22)
 				if templ_7745c5c3_Err != nil {
@@ -604,7 +604,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 		var templ_7745c5c3_Var23 string
 		templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.ResolveAttributeValue("/admin/library/" + libraryID + "/folders")
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 295, Col: 80}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 295, Col: 80}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var23)
 		if templ_7745c5c3_Err != nil {
@@ -617,7 +617,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 		var templ_7745c5c3_Var24 string
 		templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.ResolveAttributeValue("#library-panel-" + libraryID)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 295, Col: 124}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 295, Col: 124}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var24)
 		if templ_7745c5c3_Err != nil {
@@ -630,7 +630,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 		var templ_7745c5c3_Var25 string
 		templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.ResolveAttributeValue("folder-input-" + libraryID)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 299, Col: 37}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 299, Col: 37}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var25)
 		if templ_7745c5c3_Err != nil {
@@ -643,7 +643,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 		var templ_7745c5c3_Var26 string
 		templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.ResolveAttributeValue(libraryID)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 306, Col: 32}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 306, Col: 32}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var26)
 		if templ_7745c5c3_Err != nil {
@@ -656,7 +656,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 		var templ_7745c5c3_Var27 string
 		templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.ResolveAttributeValue("folder-input-" + libraryID)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 307, Col: 52}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 307, Col: 52}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var27)
 		if templ_7745c5c3_Err != nil {
@@ -713,7 +713,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 				var templ_7745c5c3_Var28 string
 				templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.ResolveAttributeValue("/admin/library/" + libraryID + "/visibility")
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 336, Col: 63}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 336, Col: 63}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var28)
 				if templ_7745c5c3_Err != nil {
@@ -726,7 +726,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 				var templ_7745c5c3_Var29 string
 				templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.ResolveAttributeValue(`{"user_id": "` + u.ID + `"}`)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 337, Col: 47}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 337, Col: 47}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var29)
 				if templ_7745c5c3_Err != nil {
@@ -739,7 +739,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 				var templ_7745c5c3_Var30 string
 				templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.ResolveAttributeValue("#library-panel-" + libraryID)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 339, Col: 49}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 339, Col: 49}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var30)
 				if templ_7745c5c3_Err != nil {
@@ -752,7 +752,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 				var templ_7745c5c3_Var31 string
 				templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(u.Username)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 342, Col: 76}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 342, Col: 76}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
 				if templ_7745c5c3_Err != nil {
@@ -765,7 +765,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 				var templ_7745c5c3_Var32 string
 				templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinStringErrs(u.Email)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 343, Col: 75}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 343, Col: 75}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
 				if templ_7745c5c3_Err != nil {
@@ -793,7 +793,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 			var templ_7745c5c3_Var33 templ.SafeURL
 			templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinURLErrs("/admin/libraries/" + libraryID + "/issues")
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 352, Col: 57}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 352, Col: 57}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
 			if templ_7745c5c3_Err != nil {
@@ -820,7 +820,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 				var templ_7745c5c3_Var34 string
 				templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(issueCount)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 357, Col: 24}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 357, Col: 24}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
 				if templ_7745c5c3_Err != nil {
@@ -847,7 +847,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 		var templ_7745c5c3_Var35 string
 		templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.ResolveAttributeValue(libraryID)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 366, Col: 28}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 366, Col: 28}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var35)
 		if templ_7745c5c3_Err != nil {
@@ -860,7 +860,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 		var templ_7745c5c3_Var36 string
 		templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.ResolveAttributeValue(library.Name)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 367, Col: 33}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 367, Col: 33}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var36)
 		if templ_7745c5c3_Err != nil {
@@ -873,7 +873,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 		var templ_7745c5c3_Var37 string
 		templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.ResolveAttributeValue(library.Description)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 368, Col: 40}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 368, Col: 40}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var37)
 		if templ_7745c5c3_Err != nil {
@@ -894,7 +894,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 		var templ_7745c5c3_Var38 string
 		templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.ResolveAttributeValue(libraryID)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 376, Col: 30}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 376, Col: 30}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var38)
 		if templ_7745c5c3_Err != nil {
@@ -907,7 +907,7 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 		var templ_7745c5c3_Var39 string
 		templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.ResolveAttributeValue(library.Name)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 377, Col: 35}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 377, Col: 35}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var39)
 		if templ_7745c5c3_Err != nil {
@@ -965,7 +965,7 @@ func FolderBrowserContent(currentPath string, parentPath string, entries []DirEn
 		var templ_7745c5c3_Var41 string
 		templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.JoinStringErrs(currentPath)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 392, Col: 89}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 392, Col: 89}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var41))
 		if templ_7745c5c3_Err != nil {
@@ -983,7 +983,7 @@ func FolderBrowserContent(currentPath string, parentPath string, entries []DirEn
 			var templ_7745c5c3_Var42 string
 			templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.ResolveAttributeValue("/admin/library/browse?path=" + parentPath + "&target_input=" + targetInput + "&library_id=" + libraryID)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 398, Col: 117}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 398, Col: 117}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var42)
 			if templ_7745c5c3_Err != nil {
@@ -1014,7 +1014,7 @@ func FolderBrowserContent(currentPath string, parentPath string, entries []DirEn
 			var templ_7745c5c3_Var43 string
 			templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.ResolveAttributeValue("/admin/library/browse?path=" + entry.Path + "&target_input=" + targetInput + "&library_id=" + libraryID)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 411, Col: 118}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 411, Col: 118}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var43)
 			if templ_7745c5c3_Err != nil {
@@ -1035,7 +1035,7 @@ func FolderBrowserContent(currentPath string, parentPath string, entries []DirEn
 			var templ_7745c5c3_Var44 string
 			templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.JoinStringErrs(entry.Name)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 416, Col: 40}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 416, Col: 40}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var44))
 			if templ_7745c5c3_Err != nil {
@@ -1053,7 +1053,7 @@ func FolderBrowserContent(currentPath string, parentPath string, entries []DirEn
 		var templ_7745c5c3_Var45 string
 		templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.ResolveAttributeValue(targetInput)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 423, Col: 35}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 423, Col: 35}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var45)
 		if templ_7745c5c3_Err != nil {
@@ -1066,7 +1066,7 @@ func FolderBrowserContent(currentPath string, parentPath string, entries []DirEn
 		var templ_7745c5c3_Var46 string
 		templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.ResolveAttributeValue(currentPath)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_library.templ`, Line: 424, Col: 35}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 424, Col: 35}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var46)
 		if templ_7745c5c3_Err != nil {

templates/admin_podcasts.templ

@@ -0,0 +1,127 @@
+package templates
+
+// Admin all-podcasts view (§0 item 8 / Phase-4 item 1): EVERY feed from
+// EVERY user with its maintenance aggregates, sorted by disk usage.
+// The maintenance surface for the podcast subsystem — files are the
+// disk hogs, so the hogs surface first. Actions: Refresh (re-fetch),
+// Delete files (rows → pending, disk freed), Remove feed (rows + files
+// + subscriptions gone — the same admin delete the detail page offers).
+
+// AdminPodcastFeedData is one row of the admin all-podcasts table.
+type AdminPodcastFeedData struct {
+	ID                string
+	Title             string
+	Host              string
+	LibraryName       string
+	Subscribers       int
+	SubscriberNames   string
+	EpisodeTotal      int
+	EpisodeDownloaded int
+	DiskBytes         int64
+	LastFetched       string
+}
+
+templ AdminPodcasts(user User, feeds []AdminPodcastFeedData, totalFeeds int, totalDownloaded int, totalEpisodes int, totalBytes int64) {
+	<!DOCTYPE html>
+	<html lang="en">
+		<head>
+			<meta charset="UTF-8"/>
+			<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
+			<title>All Podcasts - Bookhoard</title>
+			<link href="/static/style.css" rel="stylesheet"/>
+			<script type="module" src={ "/static/main.js?v=" + MainJSVersion() }></script>
+		</head>
+		<body class={ "theme-" + user.Theme }>
+			@Header(user, "/admin/podcasts")
+			<main class="container mx-auto px-4 py-8">
+				<div class="flex flex-wrap items-center justify-between gap-3 mb-4">
+					<h1 class="text-2xl font-bold" style="color: var(--text-primary)">All Podcasts</h1>
+					<div class="text-sm tabular-nums" style="color: var(--text-secondary)">
+						{ podcastInt(totalFeeds) } feeds · { podcastInt(totalDownloaded) }/{ podcastInt(totalEpisodes) } episodes downloaded · { FormatEpisodeSize(totalBytes) } on disk
+					</div>
+				</div>
+				<p class="text-sm mb-6" style="color: var(--text-secondary)">
+					Maintenance view: every feed from every user. "Delete files" frees the disk and
+					resets episodes to pending (they re-download on demand — a feed refresh will NOT
+					re-materialize them). "Remove feed" deletes rows, files and subscriptions for everyone.
+				</p>
+				if len(feeds) == 0 {
+					<div class="card p-6 text-center text-sm" style="color: var(--text-secondary)">No podcast feeds exist yet.</div>
+				} else {
+					<div class="oc-table card">
+						<table class="w-full text-sm">
+							<thead>
+								<tr class="text-left text-xs uppercase tracking-wide" style="color: var(--text-secondary); border-bottom: 1px solid var(--border);">
+									<th class="px-4 py-3">Feed</th>
+									<th class="px-4 py-3">Library</th>
+									<th class="px-4 py-3">Subscribers</th>
+									<th class="px-4 py-3 text-right">Downloaded</th>
+									<th class="px-4 py-3 text-right">Disk</th>
+									<th class="px-4 py-3">Last fetch</th>
+									<th class="px-4 py-3 text-right">Actions</th>
+								</tr>
+							</thead>
+							<tbody>
+								for _, f := range feeds {
+									<tr style="border-bottom: 1px solid var(--border);" id={ "admin-feed-" + f.ID }>
+										<td class="px-4 py-3">
+											<a href={ "/podcasts/" + f.ID } class="font-medium hover:underline" style="color: var(--text-primary)">{ f.Title }</a>
+											if f.Host != "" {
+												<div class="text-xs" style="color: var(--text-secondary)">{ f.Host }</div>
+											}
+										</td>
+										<td class="px-4 py-3" style="color: var(--text-secondary)">{ f.LibraryName }</td>
+										<td class="px-4 py-3">
+											if f.Subscribers > 0 {
+												<span title={ f.SubscriberNames } style="color: var(--text-primary)">{ podcastInt(f.Subscribers) }</span>
+											} else {
+												<span class="badge" style="background-color: var(--surface-secondary); color: var(--text-secondary)">orphaned</span>
+											}
+										</td>
+										<td class="px-4 py-3 text-right tabular-nums" style="color: var(--text-primary)">
+											{ podcastInt(f.EpisodeDownloaded) }/{ podcastInt(f.EpisodeTotal) }
+										</td>
+										<td class="px-4 py-3 text-right tabular-nums" style="color: var(--text-primary)">{ FormatEpisodeSize(f.DiskBytes) }</td>
+										<td class="px-4 py-3 text-xs" style="color: var(--text-secondary)">{ f.LastFetched }</td>
+										<td class="px-4 py-3">
+											<div class="flex justify-end gap-2">
+												<button
+													class="btn btn-secondary text-xs"
+													hx-post={ "/api/podcasts/feeds/" + f.ID + "/refresh" }
+													hx-swap="none"
+													title="Check the feed for new episodes now"
+												>
+													Refresh
+												</button>
+												if f.EpisodeDownloaded > 0 {
+													<button
+														class="btn btn-secondary text-xs"
+														hx-post={ "/api/podcasts/feeds/" + f.ID + "/delete-files" }
+														hx-confirm={ "Delete the " + podcastInt(f.EpisodeDownloaded) + " downloaded file(s) of \"" + f.Title + "\"? Episodes reset to pending; a feed refresh will not re-materialize them." }
+														hx-swap="none"
+														style="color: var(--status-warning, #d97706);"
+													>
+														Delete files
+													</button>
+												}
+												<button
+													class="btn btn-secondary text-xs"
+													hx-delete={ "/api/podcasts/feeds/" + f.ID }
+													hx-confirm={ "ADMIN: remove \"" + f.Title + "\" for everyone? Episode rows AND downloaded files are deleted." }
+													hx-swap="none"
+													style="color: var(--status-danger);"
+												>
+													Remove
+												</button>
+											</div>
+										</td>
+									</tr>
+								}
+							</tbody>
+						</table>
+					</div>
+				}
+			</main>
+		</body>
+	</html>
+}

templates/admin_podcasts_templ.go

@@ -0,0 +1,424 @@
+// Code generated by templ - DO NOT EDIT.
+
+// templ: version: v0.3.1020
+package templates
+
+//lint:file-ignore SA4006 This context is only used if a nested component is present.
+
+import "github.com/a-h/templ"
+import templruntime "github.com/a-h/templ/runtime"
+
+// Admin all-podcasts view (§0 item 8 / Phase-4 item 1): EVERY feed from
+// EVERY user with its maintenance aggregates, sorted by disk usage.
+// The maintenance surface for the podcast subsystem — files are the
+// disk hogs, so the hogs surface first. Actions: Refresh (re-fetch),
+// Delete files (rows → pending, disk freed), Remove feed (rows + files
+// + subscriptions gone — the same admin delete the detail page offers).
+
+// AdminPodcastFeedData is one row of the admin all-podcasts table.
+type AdminPodcastFeedData struct {
+	ID                string
+	Title             string
+	Host              string
+	LibraryName       string
+	Subscribers       int
+	SubscriberNames   string
+	EpisodeTotal      int
+	EpisodeDownloaded int
+	DiskBytes         int64
+	LastFetched       string
+}
+
+func AdminPodcasts(user User, feeds []AdminPodcastFeedData, totalFeeds int, totalDownloaded int, totalEpisodes int, totalBytes int64) templ.Component {
+	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
+		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
+		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
+			return templ_7745c5c3_CtxErr
+		}
+		templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
+		if !templ_7745c5c3_IsBuffer {
+			defer func() {
+				templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
+				if templ_7745c5c3_Err == nil {
+					templ_7745c5c3_Err = templ_7745c5c3_BufErr
+				}
+			}()
+		}
+		ctx = templ.InitializeContext(ctx)
+		templ_7745c5c3_Var1 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var1 == nil {
+			templ_7745c5c3_Var1 = templ.NopComponent
+		}
+		ctx = templ.ClearChildren(ctx)
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<!doctype html><html lang=\"en\"><head><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>All Podcasts - Bookhoard</title><link href=\"/static/style.css\" rel=\"stylesheet\"><script type=\"module\" src=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var2 string
+		templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.ResolveAttributeValue("/static/main.js?v=" + MainJSVersion())
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 32, Col: 69}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var2)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\"></script></head>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var3 = []any{"theme-" + user.Theme}
+		templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var3...)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "<body class=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var4 string
+		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var3).String())
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 1, Col: 0}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var4)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = Header(user, "/admin/podcasts").Render(ctx, templ_7745c5c3_Buffer)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "<main class=\"container mx-auto px-4 py-8\"><div class=\"flex flex-wrap items-center justify-between gap-3 mb-4\"><h1 class=\"text-2xl font-bold\" style=\"color: var(--text-primary)\">All Podcasts</h1><div class=\"text-sm tabular-nums\" style=\"color: var(--text-secondary)\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var5 string
+		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(podcastInt(totalFeeds))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 40, Col: 30}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, " feeds · ")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var6 string
+		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(podcastInt(totalDownloaded))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 40, Col: 71}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "/")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var7 string
+		templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(podcastInt(totalEpisodes))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 40, Col: 101}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, " episodes downloaded · ")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var8 string
+		templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(FormatEpisodeSize(totalBytes))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 40, Col: 158}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, " on disk</div></div><p class=\"text-sm mb-6\" style=\"color: var(--text-secondary)\">Maintenance view: every feed from every user. \"Delete files\" frees the disk and resets episodes to pending (they re-download on demand — a feed refresh will NOT re-materialize them). \"Remove feed\" deletes rows, files and subscriptions for everyone.</p>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if len(feeds) == 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<div class=\"card p-6 text-center text-sm\" style=\"color: var(--text-secondary)\">No podcast feeds exist yet.</div>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "<div class=\"oc-table card\"><table class=\"w-full text-sm\"><thead><tr class=\"text-left text-xs uppercase tracking-wide\" style=\"color: var(--text-secondary); border-bottom: 1px solid var(--border);\"><th class=\"px-4 py-3\">Feed</th><th class=\"px-4 py-3\">Library</th><th class=\"px-4 py-3\">Subscribers</th><th class=\"px-4 py-3 text-right\">Downloaded</th><th class=\"px-4 py-3 text-right\">Disk</th><th class=\"px-4 py-3\">Last fetch</th><th class=\"px-4 py-3 text-right\">Actions</th></tr></thead> <tbody>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			for _, f := range feeds {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "<tr style=\"border-bottom: 1px solid var(--border);\" id=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var9 string
+				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.ResolveAttributeValue("admin-feed-" + f.ID)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 66, Col: 86}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var9)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "\"><td class=\"px-4 py-3\"><a href=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var10 templ.SafeURL
+				templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinURLErrs("/podcasts/" + f.ID)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 68, Col: 40}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "\" class=\"font-medium hover:underline\" style=\"color: var(--text-primary)\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var11 string
+				templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(f.Title)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 68, Col: 123}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "</a> ")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if f.Host != "" {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "<div class=\"text-xs\" style=\"color: var(--text-secondary)\">")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var12 string
+					templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(f.Host)
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 70, Col: 78}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "</div>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "</td><td class=\"px-4 py-3\" style=\"color: var(--text-secondary)\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var13 string
+				templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(f.LibraryName)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 73, Col: 84}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</td><td class=\"px-4 py-3\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if f.Subscribers > 0 {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "<span title=\"")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var14 string
+					templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(f.SubscriberNames)
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 76, Col: 43}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "\" style=\"color: var(--text-primary)\">")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var15 string
+					templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(podcastInt(f.Subscribers))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 76, Col: 108}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "</span>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<span class=\"badge\" style=\"background-color: var(--surface-secondary); color: var(--text-secondary)\">orphaned</span>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</td><td class=\"px-4 py-3 text-right tabular-nums\" style=\"color: var(--text-primary)\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var16 string
+				templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(podcastInt(f.EpisodeDownloaded))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 82, Col: 44}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "/")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var17 string
+				templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(podcastInt(f.EpisodeTotal))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 82, Col: 75}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "</td><td class=\"px-4 py-3 text-right tabular-nums\" style=\"color: var(--text-primary)\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var18 string
+				templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(FormatEpisodeSize(f.DiskBytes))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 84, Col: 123}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</td><td class=\"px-4 py-3 text-xs\" style=\"color: var(--text-secondary)\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var19 string
+				templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(f.LastFetched)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 85, Col: 92}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</td><td class=\"px-4 py-3\"><div class=\"flex justify-end gap-2\"><button class=\"btn btn-secondary text-xs\" hx-post=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var20 string
+				templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.ResolveAttributeValue("/api/podcasts/feeds/" + f.ID + "/refresh")
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 90, Col: 65}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var20)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "\" hx-swap=\"none\" title=\"Check the feed for new episodes now\">Refresh</button> ")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if f.EpisodeDownloaded > 0 {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<button class=\"btn btn-secondary text-xs\" hx-post=\"")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var21 string
+					templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.ResolveAttributeValue("/api/podcasts/feeds/" + f.ID + "/delete-files")
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 99, Col: 71}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var21)
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "\" hx-confirm=\"")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var22 string
+					templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.ResolveAttributeValue("Delete the " + podcastInt(f.EpisodeDownloaded) + " downloaded file(s) of \"" + f.Title + "\"? Episodes reset to pending; a feed refresh will not re-materialize them.")
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 100, Col: 194}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var22)
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "\" hx-swap=\"none\" style=\"color: var(--status-warning, #d97706);\">Delete files</button> ")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "<button class=\"btn btn-secondary text-xs\" hx-delete=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var23 string
+				templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.ResolveAttributeValue("/api/podcasts/feeds/" + f.ID)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 109, Col: 54}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var23)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "\" hx-confirm=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var24 string
+				templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.ResolveAttributeValue("ADMIN: remove \"" + f.Title + "\" for everyone? Episode rows AND downloaded files are deleted.")
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_podcasts.templ`, Line: 110, Col: 122}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var24)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "\" hx-swap=\"none\" style=\"color: var(--status-danger);\">Remove</button></div></td></tr>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "</tbody></table></div>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "</main></body></html>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		return nil
+	})
+}
+
+var _ = templruntime.GeneratedTemplate

templates/admin_processing_issues_templ.go

@@ -45,7 +45,7 @@ func AdminProcessingIssues(user User, libraryID string, issues []ProcessingIssue
 		var templ_7745c5c3_Var3 string
 		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var2).String())
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 1, Col: 0}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 1, Col: 0}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var3)
 		if templ_7745c5c3_Err != nil {
@@ -66,7 +66,7 @@ func AdminProcessingIssues(user User, libraryID string, issues []ProcessingIssue
 		var templ_7745c5c3_Var4 string
 		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.ResolveAttributeValue(libraryID)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 21, Col: 73}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 21, Col: 73}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var4)
 		if templ_7745c5c3_Err != nil {
@@ -147,7 +147,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 				var templ_7745c5c3_Var6 string
 				templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(stats.ErrorCount)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 58, Col: 90}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 58, Col: 90}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
 				if templ_7745c5c3_Err != nil {
@@ -174,7 +174,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 				var templ_7745c5c3_Var7 string
 				templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(stats.WarningCount)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 67, Col: 92}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 67, Col: 92}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
 				if templ_7745c5c3_Err != nil {
@@ -201,7 +201,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 				var templ_7745c5c3_Var8 string
 				templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(stats.InfoCount)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 76, Col: 89}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 76, Col: 89}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
 				if templ_7745c5c3_Err != nil {
@@ -251,7 +251,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 				var templ_7745c5c3_Var9 string
 				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.ResolveAttributeValue("issue-" + issue.ID)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 107, Col: 51}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 107, Col: 51}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var9)
 				if templ_7745c5c3_Err != nil {
@@ -264,7 +264,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 				var templ_7745c5c3_Var10 string
 				templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.ResolveAttributeValue(issue.ID)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 107, Col: 78}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 107, Col: 78}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var10)
 				if templ_7745c5c3_Err != nil {
@@ -277,7 +277,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 				var templ_7745c5c3_Var11 string
 				templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(issue.Title)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 110, Col: 95}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 110, Col: 95}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
 				if templ_7745c5c3_Err != nil {
@@ -290,7 +290,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 				var templ_7745c5c3_Var12 string
 				templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(issue.IssueDescription)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 111, Col: 93}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 111, Col: 93}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
 				if templ_7745c5c3_Err != nil {
@@ -303,7 +303,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 				var templ_7745c5c3_Var13 string
 				templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(issue.IssueType)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 113, Col: 137}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 113, Col: 137}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
 				if templ_7745c5c3_Err != nil {
@@ -316,7 +316,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 				var templ_7745c5c3_Var14 string
 				templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(issue.FormatGroup)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 114, Col: 141}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 114, Col: 141}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
 				if templ_7745c5c3_Err != nil {
@@ -329,7 +329,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 				var templ_7745c5c3_Var15 string
 				templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(issue.FilePath)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 115, Col: 136}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 115, Col: 136}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
 				if templ_7745c5c3_Err != nil {
@@ -342,7 +342,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 				var templ_7745c5c3_Var16 string
 				templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(issue.LibraryTypeName)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 116, Col: 146}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 116, Col: 146}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
 				if templ_7745c5c3_Err != nil {
@@ -360,7 +360,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 					var templ_7745c5c3_Var17 string
 					templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(issue.Severity)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 121, Col: 59}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 121, Col: 59}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
 					if templ_7745c5c3_Err != nil {
@@ -378,7 +378,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 					var templ_7745c5c3_Var18 string
 					templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(issue.Severity)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 123, Col: 60}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 123, Col: 60}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
 					if templ_7745c5c3_Err != nil {
@@ -396,7 +396,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 					var templ_7745c5c3_Var19 string
 					templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(issue.Severity)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 125, Col: 63}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 125, Col: 63}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
 					if templ_7745c5c3_Err != nil {
@@ -414,7 +414,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 				var templ_7745c5c3_Var20 string
 				templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.ResolveAttributeValue("retryOne(" + JSONArg(issue.ID) + ")")
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 132, Col: 54}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 132, Col: 54}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var20)
 				if templ_7745c5c3_Err != nil {
@@ -440,7 +440,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 					var templ_7745c5c3_Var21 string
 					templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.ResolveAttributeValue("/api/libraries/" + libraryID + "/issues/" + issue.ID + "/" + issue.MediaItemID + "/resolve")
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 140, Col: 111}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 140, Col: 111}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var21)
 					if templ_7745c5c3_Err != nil {
@@ -453,7 +453,7 @@ func ProcessingIssuesContent(libraryID string, issues []ProcessingIssueData, sta
 					var templ_7745c5c3_Var22 string
 					templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.ResolveAttributeValue("#issue-" + issue.ID)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_processing_issues.templ`, Line: 141, Col: 41}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_processing_issues.templ`, Line: 141, Col: 41}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var22)
 					if templ_7745c5c3_Err != nil {

templates/admin_settings.templ

@@ -244,6 +244,20 @@ templ TunableSettingRow(e SettingEntry) {
 					}
 					class="input py-1.5 text-sm w-32"
 				/>
+			} else if e.Type == "float" {
+				<input
+					type="number"
+					step="any"
+					name="value"
+					value={ e.Value }
+					if e.Min != "" {
+						min={ e.Min }
+					}
+					if e.Max != "" {
+						max={ e.Max }
+					}
+					class="input py-1.5 text-sm w-32"
+				/>
 			} else {
 				<input
 					type="text"

templates/admin_settings_templ.go

@@ -50,7 +50,7 @@ func AdminSettings(user User, systemConfig map[string]string, scanSettings ScanS
 		var templ_7745c5c3_Var3 string
 		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var2).String())
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 1, Col: 0}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 1, Col: 0}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var3)
 		if templ_7745c5c3_Err != nil {
@@ -92,7 +92,7 @@ func AdminSettings(user User, systemConfig map[string]string, scanSettings ScanS
 			var templ_7745c5c3_Var4 string
 			templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(errorMessage)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 34, Col: 28}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 34, Col: 28}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
 			if templ_7745c5c3_Err != nil {
@@ -118,7 +118,7 @@ func AdminSettings(user User, systemConfig map[string]string, scanSettings ScanS
 		var templ_7745c5c3_Var5 string
 		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.ResolveAttributeValue(systemConfig["base_url"])
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 48, Col: 42}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 48, Col: 42}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var5)
 		if templ_7745c5c3_Err != nil {
@@ -395,7 +395,7 @@ func AdminSettings(user User, systemConfig map[string]string, scanSettings ScanS
 		var templ_7745c5c3_Var6 string
 		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(systemConfig["base_url"])
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 109, Col: 145}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 109, Col: 145}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
 		if templ_7745c5c3_Err != nil {
@@ -408,7 +408,7 @@ func AdminSettings(user User, systemConfig map[string]string, scanSettings ScanS
 		var templ_7745c5c3_Var7 string
 		templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(systemConfig["base_url"])
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 110, Col: 144}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 110, Col: 144}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
 		if templ_7745c5c3_Err != nil {
@@ -421,7 +421,7 @@ func AdminSettings(user User, systemConfig map[string]string, scanSettings ScanS
 		var templ_7745c5c3_Var8 string
 		templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(systemConfig["base_url"])
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 111, Col: 152}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 111, Col: 152}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
 		if templ_7745c5c3_Err != nil {
@@ -501,7 +501,7 @@ func ScanSettingsSection(scanSettings ScanSettingsData) templ.Component {
 		var templ_7745c5c3_Var10 string
 		templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", scanSettings.ScanPollIntervalSeconds))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 158, Col: 69}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 158, Col: 69}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var10)
 		if templ_7745c5c3_Err != nil {
@@ -593,7 +593,7 @@ func TunableSettingsSection(groups []SettingGroup, restartRequired bool) templ.C
 			var templ_7745c5c3_Var12 string
 			templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(g.Name)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 198, Col: 112}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 198, Col: 112}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
 			if templ_7745c5c3_Err != nil {
@@ -651,7 +651,7 @@ func TunableSettingRow(e SettingEntry) templ.Component {
 		var templ_7745c5c3_Var14 string
 		templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(e.Description)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 213, Col: 94}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 213, Col: 94}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
 		if templ_7745c5c3_Err != nil {
@@ -669,7 +669,7 @@ func TunableSettingRow(e SettingEntry) templ.Component {
 			var templ_7745c5c3_Var15 string
 			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(e.Key)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 215, Col: 74}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 215, Col: 74}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
 			if templ_7745c5c3_Err != nil {
@@ -687,7 +687,7 @@ func TunableSettingRow(e SettingEntry) templ.Component {
 			var templ_7745c5c3_Var16 string
 			templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(e.Key)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 217, Col: 74}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 217, Col: 74}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
 			if templ_7745c5c3_Err != nil {
@@ -705,7 +705,7 @@ func TunableSettingRow(e SettingEntry) templ.Component {
 		var templ_7745c5c3_Var17 string
 		templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.ResolveAttributeValue("#status-" + e.Key)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 224, Col: 33}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 224, Col: 33}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var17)
 		if templ_7745c5c3_Err != nil {
@@ -718,7 +718,7 @@ func TunableSettingRow(e SettingEntry) templ.Component {
 		var templ_7745c5c3_Var18 string
 		templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.ResolveAttributeValue(e.Key)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 228, Col: 48}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 228, Col: 48}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var18)
 		if templ_7745c5c3_Err != nil {
@@ -761,7 +761,7 @@ func TunableSettingRow(e SettingEntry) templ.Component {
 			var templ_7745c5c3_Var19 string
 			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.ResolveAttributeValue(e.Value)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 238, Col: 20}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 238, Col: 20}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var19)
 			if templ_7745c5c3_Err != nil {
@@ -779,7 +779,7 @@ func TunableSettingRow(e SettingEntry) templ.Component {
 				var templ_7745c5c3_Var20 string
 				templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.ResolveAttributeValue(e.Min)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 240, Col: 17}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 240, Col: 17}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var20)
 				if templ_7745c5c3_Err != nil {
@@ -798,7 +798,7 @@ func TunableSettingRow(e SettingEntry) templ.Component {
 				var templ_7745c5c3_Var21 string
 				templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.ResolveAttributeValue(e.Max)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 243, Col: 17}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 243, Col: 17}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var21)
 				if templ_7745c5c3_Err != nil {
@@ -813,26 +813,86 @@ func TunableSettingRow(e SettingEntry) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 104, "<input type=\"text\" name=\"value\" value=\"")
+		} else if e.Type == "float" {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 104, "<input type=\"number\" step=\"any\" name=\"value\" value=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var22 string
 			templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.ResolveAttributeValue(e.Value)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 251, Col: 20}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 252, Col: 20}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var22)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 105, "\" class=\"input py-1.5 text-sm w-40\"> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 105, "\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if e.Min != "" {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 106, " min=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var23 string
+				templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.ResolveAttributeValue(e.Min)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 254, Col: 17}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var23)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 107, "\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			if e.Max != "" {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 108, " max=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var24 string
+				templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.ResolveAttributeValue(e.Max)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 257, Col: 17}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var24)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 109, "\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 110, " class=\"input py-1.5 text-sm w-32\"> ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 111, "<input type=\"text\" name=\"value\" value=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var25 string
+			templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.ResolveAttributeValue(e.Value)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 265, Col: 20}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var25)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 112, "\" class=\"input py-1.5 text-sm w-40\"> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 106, "<button type=\"submit\" class=\"btn btn-secondary px-3 py-1.5 text-sm\" hx-disabled-elt=\"this\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 113, "<button type=\"submit\" class=\"btn btn-secondary px-3 py-1.5 text-sm\" hx-disabled-elt=\"this\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -840,20 +900,20 @@ func TunableSettingRow(e SettingEntry) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 107, "Save</button></form><span id=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 114, "Save</button></form><span id=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var23 string
-		templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.ResolveAttributeValue("status-" + e.Key)
+		var templ_7745c5c3_Var26 string
+		templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.ResolveAttributeValue("status-" + e.Key)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 260, Col: 30}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 274, Col: 30}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var23)
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var26)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 108, "\" class=\"text-xs w-24 text-right\" style=\"color: var(--text-secondary)\"></span></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 115, "\" class=\"text-xs w-24 text-right\" style=\"color: var(--text-secondary)\"></span></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -880,12 +940,12 @@ func AboutSection() templ.Component {
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
-		templ_7745c5c3_Var24 := templ.GetChildren(ctx)
-		if templ_7745c5c3_Var24 == nil {
-			templ_7745c5c3_Var24 = templ.NopComponent
+		templ_7745c5c3_Var27 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var27 == nil {
+			templ_7745c5c3_Var27 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 109, "<div class=\"mt-6 card p-6\"><div class=\"flex items-center gap-2 mb-4\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 116, "<div class=\"mt-6 card p-6\"><div class=\"flex items-center gap-2 mb-4\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -893,20 +953,20 @@ func AboutSection() templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 110, "<h3 class=\"text-lg font-semibold\" style=\"color: var(--text-primary)\">About</h3></div><div class=\"space-y-2 text-sm\" style=\"color: var(--text-secondary);\"><p><span class=\"font-medium uppercase tracking-wide text-xs\" style=\"color: var(--text-secondary)\">Version:</span> ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 117, "<h3 class=\"text-lg font-semibold\" style=\"color: var(--text-primary)\">About</h3></div><div class=\"space-y-2 text-sm\" style=\"color: var(--text-secondary);\"><p><span class=\"font-medium uppercase tracking-wide text-xs\" style=\"color: var(--text-secondary)\">Version:</span> ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var25 string
-		templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.JoinStringErrs(version.Version)
+		var templ_7745c5c3_Var28 string
+		templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(version.Version)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin_settings.templ`, Line: 274, Col: 134}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_settings.templ`, Line: 288, Col: 134}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var25))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 111, "</p></div></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 118, "</p></div></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}

templates/admin_templ.go

@@ -45,7 +45,7 @@ func Admin(user User, stats AdminStats) templ.Component {
 		var templ_7745c5c3_Var3 string
 		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var2).String())
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin.templ`, Line: 1, Col: 0}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin.templ`, Line: 1, Col: 0}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var3)
 		if templ_7745c5c3_Err != nil {
@@ -82,7 +82,7 @@ func Admin(user User, stats AdminStats) templ.Component {
 		var templ_7745c5c3_Var4 string
 		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(stats.LibraryCount)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin.templ`, Line: 33, Col: 92}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin.templ`, Line: 33, Col: 92}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
 		if templ_7745c5c3_Err != nil {
@@ -103,7 +103,7 @@ func Admin(user User, stats AdminStats) templ.Component {
 		var templ_7745c5c3_Var5 string
 		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(stats.MediaCount)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin.templ`, Line: 40, Col: 90}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin.templ`, Line: 40, Col: 90}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
 		if templ_7745c5c3_Err != nil {
@@ -124,7 +124,7 @@ func Admin(user User, stats AdminStats) templ.Component {
 		var templ_7745c5c3_Var6 string
 		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(stats.UserCount)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin.templ`, Line: 47, Col: 89}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin.templ`, Line: 47, Col: 89}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
 		if templ_7745c5c3_Err != nil {
@@ -145,7 +145,7 @@ func Admin(user User, stats AdminStats) templ.Component {
 		var templ_7745c5c3_Var7 string
 		templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(stats.DeviceCount)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/admin.templ`, Line: 54, Col: 91}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin.templ`, Line: 54, Col: 91}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
 		if templ_7745c5c3_Err != nil {