Current Presentation and Product Rules

These rules describe current, product-owner-approved behaviour. They were moved out of the always-loaded CLAUDE.md so that sessions read them only when working on the affected surfaces. Engineering ownership rules for the Dashboard live in src/MediaEngine.Web/CLAUDE.md. When rules conflict, the most recent dated section wins.

Grouping, cards, Home, and detail pages

Current product rule: a Series is the lane-level shelf shown in Read, Watch, or Listen. A broader Universe/Collection is shown on /collections only when a shared series/franchise/universe relationship connects multiple shelves. Watch has separate TV Shows and Series shelves: TV show identities never share the movie Series row, while Series contains only movie groups dynamically aligned from trusted library metadata. TV shows may appear as show cards with one or more owned episodes, but non-TV/non-music series cards require at least two distinct owned works by default (lane_group_display.*.minimum_series_items). TV Timeline groups a show by its canonical premiere year, never the newest owned episode year; Network grouping renders the resolved network logo in the same identity position used for person-led group cards. A single owned movie/book/audiobook remains a normal item tile in its respective lane; audiobooks belong in Listen, not Read. A lane shelf such as owning multiple Matrix films stays in Watch without duplicating itself as a top-level Collection. Multiple formats of one work are variants, not collection triggers. Internal collection IDs may back a lane group, but user-facing surfaces must name and route by the group type: a TV show is a show, a book sequence is a series, and a curated rollup is a collection/list. Book, comic, and movie series cards preserve structural order while selecting at most four representative preview items; broader collections prefer cross-media breadth. Non-TV series and collection containers render through the fixed-size landscape MediaGroupTile: rest is artwork-led, with two to four slightly angled, overlapping images using actual portrait, square, or wide metadata. Home and Discover hover preserve the exact artwork and dimensions, add the purple boundary/glow, and reveal only a lightly shaded compact top overlay for type, title, and one status line. Direct grids instead embed an all-caps title, year, and owned count inside the bottom of the card; hover adds the glow and a small open cue without a type pill or cinematic replacement. There is no permanent copy column, child-title list, carousel, or child-level navigation. The retired artwork carousel and rotating collage must not be restored. The entire group card opens the group. TV shows remain on MediaTile; cinematic backdrop, logo, facts, and description hover is limited to Home and Discover. Existing item tiles remain on MediaTile.

Videos (Watch). Videos is the plain Watch kind (nothing is looked up) for courses, talks and downloads; it can hold several named libraries. Personal and phone footage belongs in View’s Personal videos, not here. Its tab on Watch shows standalone videos and series (a folder of videos, with optional sections for sub-folders) as cards. A series opens the show page and a standalone video opens the movie page, so Resume, Up Next, progress and Mark watched work as they do for TV. A Videos folder is read from its layout and local files only (YouTube ID in the name or .info.json, .nfo, then the cleaned file name); the YouTube lookup (YouTube kind only) sends only the video ID. Saved videos have no ratings, so they follow each profile’s “allow unrated” setting like every other unrated item; a folder marked “Suitable for limited profiles” also shows its unrated videos to profiles with a content limit. An item or series marked Explicit is never shown to such a profile.

Browse tabs and Unmatched (Watch, Listen, Read). Each lane shows one tab for every kind that has folders (Movies, TV Shows, YouTube, Music, Audiobooks, Books, Comics) and one for every named custom library (for example Lectures), in that order; a kind or library with no folders has no tab, and a person only sees the tabs for libraries they may see. Each library tab has an Unmatched filter chip that anyone who can see the library may use; it lists that library’s files the Engine could not match, flat, with no grouping. Administrators get Retry now, Keep as is and Look up again in an Unmatched item’s ”…” menu on its page; Keep as is asks first and the item stays under Unmatched, marked Kept (and out of the Unmatched count), until it is looked up again. Unmatched files never appear in the lanes, on Home, in shelves or in collections, and Search lists them in a separate “Unmatched” group, found by file name and tags, never mixed into the matched results.

Every card is one semantic link to its detail surface and contains no inline Read, Play, Listen, My List, reaction, remove, or details controls. Vertically wrapping MediaTileGrid results preserve the exact resting cover or group artwork on hover and keyboard focus, show a compact title and optional year below the art, and add only a stronger purple glow—no hover identity strip, scrim, background replacement, or popover. Direct browse cards omit redundant media/group pills such as TV Show inside the TV Shows route because the active navigation already supplies that context. Their filter areas provide a tile-size slider that changes width while retaining portrait, square, and landscape ratios; Music defaults smaller than the other formats. Movie and TV cinematic landscape expansion is reserved for Home and lane Discover shelves when background artwork supports it; its left-aligned rating, classification, year, and runtime row uses a compact translucent backing that hugs the text, with no inline actions. Touch never shows a hover preview or hover strip: a tap opens details, and a tile whose title only the preview carried (cinematic Movie/TV cards) shows its compact title and year under the art instead. On phones shelf rows run edge to edge with a 16 px gutter and cards are sized from the screen width, about 2.6 portrait or 2.4 square cards across and landscape series, collection, group and Continue Watching cards at 86% of the screen (at most 340 px, 320 px for Continue Watching), so the next card always peeks and no card is wider than the screen.

Phone Home shelves. Continue Across Media is one horizontal row on phones (tablets and desktops keep their per-type groups): newest activity first, started items only (an item never started is not in it), each card with its art, title, a thin progress bar only when there is real progress (never at zero), a small type icon and one line saying where you are (S1 E2 · 23 min left, Chapter 4, 42% read). A tap opens the card’s normal destination. When nothing has been started the whole section, header included, is not shown. Every Home shelf header (Recently Added, Watch, Read, Listen) reads title on the left and See All on the right as a 48 px target. The Recently Added filter chips (All, Watch, Read, Listen, View) stay in one row and scroll sideways instead of wrapping. Items still being matched keep their Still being matched tag, are drawn smaller and quieter, and sort after the matched items.

Home alone uses CinematicHeroCarousel/CinematicHeroSurface as a landing treatment; detail heroes continue sharing DetailHeroContent, and both use HeroBackdrop for foreground cover/album geometry and book decoration. Home uses an approximately 80svh desktop feature (72svh on short screens), with bounded cover-led composition for unknown, portrait or undersized sources; measured landscapes use the aspect-band framing policy. Phones and short landscape screens use content-sized composition. Detail heroes retain 95svh. Opposite edge arrows have 48px targets; the centered active dash is thicker, wider, and purple. Focus, hover, pause, and reduced motion suspend rotation. On touch the hero also moves with a horizontal swipe of more than 48 px (less vertical travel), and rotation is held while a finger is down. Home has no lane submenu. Its rows are Continue Across Media, Recently Added, then populated Watch, Read, Listen, and Collections & Lists; Fresh is retired. Recent filters All/Watch/Read/Listen/View retain the selected scope in /recently-added?type= and use added-at keyset paging. View contributes only independently authorized Mine assets, with fresh render-time media grants and native viewer navigation. Untouched TV features use show art; started Home TV keeps the show title, shows Sx Ey · Episode Title, and uses the exact owned episode still/synopsis/action with show-art fallback. Watch discovery remains rooted in show art. Shared explicit subject/state/episode contracts drive Engine spotlight selection, Continue, and sequence detail. Only partial long-form media has a purple artwork-edge progress strip; albums, tracks, and View omit completion bars. Resting movies/TV/books/comics use portrait frames, albums and audiobooks use square frames, and only Continue Watching uses landscape stills. Artwork is contained when its native ratio differs from its frame. Home shelves share one artwork height (on phones about 2.6 portrait cards across); only Home Watch discovery cards expand horizontally in their row; Watch browse grids, episode lists, and non-Watch cards remain outline-only. Cards retain one semantic detail link and partial long-form artwork-edge progress, without detached percentage captions. Read, Watch, Listen, and Collections retain their compact shared route navigation, viewport-anchored desktop rails, unboxed scoped filters, and existing downstream browsing behavior. On phones the filters on Watch, Read, Listen, Collections and Search collapse into one Filters (n) button that opens a bottom sheet holding the same controls (with Clear and a sticky Show N items button; filters still apply live), while the browse-mode strip scrolls sideways with a fade edge and the card-size slider is labelled in words (Card size: Medium); tablets and desktops keep the inline filter panel. With no hero, Home content starts below the top bar. A tile for an item still being matched or enriched shows a small soft dot before its caption title, with the tooltip “Still being matched”; the dot does not pulse under reduced motion. Where a tile shows a hover card, Movie/TV cards use the landscape banner layout only when real landscape art exists; otherwise the portrait art layout.

Phone Home hero (under 600 px). Phones replace the full-bleed carousel with PhoneHeroCard: one rounded, inset card whose height is the same for every slide and media type (about 55% of the space between the top bar and the bottom bar), so the first shelf header never moves and always sits above the bottom bar. The card has fixed slots: picture, title (two lines at most), one meta line, one full-width primary button (48 px at least) and at most two 48 px icon buttons (My List, More; Rate and the thumbs live in More). The picture ladder is a landscape backdrop with the title logo over it when there is one, then the cover at its own shape (it only ever shrinks), then a tinted placeholder tile that names the media type. The Engine’s stand-in cover is a 100 by 150 picture with no flag of its own, so a cover whose measured width is unknown or under 240 px counts as no artwork and gets the tile, never a stand-in drawn at its natural size; phones ask for the sized (m) rendition. Nothing rotates by itself: no timer, no arrows, no pause button; swipe and the labelled dots change slides, and the dots are real buttons inside a region with an accessible name. An item still being matched gets the placeholder (or its picture) plus a small “Still being matched” tag. The meta line comes from PhoneHeroPresentation.MetaLine (never raw decimal minutes: 101 min reads 1h 41m; right plurals; empty or zero parts hidden; movie year, runtime, rating; TV year and seasons, an episode S2 E6 and year; book author, year, pages; album artist, tracks, time; audiobook author, length). The title sits in a fixed two-line logo zone: a logo (however wide or tall) scales to fit inside it and a title with no logo is drawn as text in it, so the card never changes height. The primary button reads by type from the data the Engine already sends: unstarted Play (movie), Watch S1 E1 (TV, from the episode or the Engine’s label), Start Reading (book, comic), Listen (audiobook), Play album (music); started Resume S5 E1 with the time left (movie, episode), Continue Reading with the percent read, Continue Listening with the time left. Continue, Resume and “0%” never appear on an unstarted item, a time or percent suffix is shown only when the Engine supplied the number, and the button stays one 48 px line with an ellipsis. An album always plays from its first track because the hero carries no track position. The hero shows no synopsis: the text zone is full and a synopsis would either cover the picture or change the card height. Tablets and desktops keep the carousel above.

Canonical media, person, series, and standard-collection details use a full-width 95svh desktop cinematic stage so its lower navigation remains visible while native 16:9 artwork loses as little of the frame as possible. Edge-to-edge landscape art is pinned top-center beneath the translucent global app bar and translucent lower navigation; the bottom is deliberately darkened more heavily than the top so the source’s upper composition and hero copy remain legible. Music albums use the shared hero and lower navigation: the cover supplies a blurred atmosphere, a large sharp album/record composition is centered in the right half, identity and actions grow upward from the shared lower-left anchor, a compact Play button and circular Shuffle/My List/Rate/More controls share the action row, and MusicAlbum exposes Overview plus Details. Overview uses a proportional Tracks/Credits layout, keeps the borderless list with Show missing and no search, resolves identified artists into the same compact square clickable people cards used by movie and TV credits, and conditionally shows every other owned album from the exact canonical primary artist in a full-width More by shelf. Oversized provider box-set manifests are scoped to the canonical disc that represents the tagged local album; ordinary multi-disc albums retain their full sequence. Technical and source content belongs only to Details. Audiobooks retain the shared detail structure, chapter-level playback, and specialized player tools, use a substantially larger cover where viewport height permits, and keep Restart in More alongside the other shared actions. Audiobook Chapters remain embedded; Editions does not return, and lists contain neither Play All nor a second My List action. Structural details place their ordered sequence, collection, or owned-works array below the stage on Overview only, ending with an owned summary and an authoritative-total progress bar when available. Collections use a neutral no-backdrop hero and the same up-to-four representative artwork cluster as collection tiles at a dominant scale; they suppress contributor credits, expose only a functional Shuffle action, and use a compact row for the year range, total items, and applicable Read/Watch/Listen counts. Books and comics share a larger cover-only foreground envelope, as do poster-only movie/TV heroes; true landscape backdrops remain edge-to-edge. People use the same title, role-credit, facts, and synopsis typography as other detail pages, keep only the portrait treatment person-specific, and render one continuous page without tabs. Linked identities reuse cast/credit portrait cards. Explicit collective pseudonyms are the displayed and attributed author identity; linked real identities are not promoted unless explicitly credited on another work. Real multiple-author bylines retain order and use semicolons followed by one space. Person music credits collapse tracks into one album card and show roles/year without track counts. Role and lane filters render only when more than one real option exists. Utility actions use larger icon-left-of-label controls on a left-growing row beneath the primary action. Jump to appears beside the array heading only above ten entries; beside a Series heading on wider screens it is as wide as its longest entry, so entries do not wrap; a movie Series is one full-width rail of every movie (other runs page six at a time); every full-width row below the hero (the Series, episode or owned-works row, Also in this world, More by) is headed by the one shared collapse arrow (AppCollapsibleRow): collapsed it is a slim bar with its title and count, the person’s open or closed choice is remembered per kind of row in that browser, and a movie’s Series row starts collapsed only when it has nothing else to show (no other owned movie, no missing movie for Show missing, no other Series to switch to); track lists keep their scrollbar space, so Show missing never shifts the columns; alternate series/arc selectors align left and Show missing aligns right. Person works use managed portrait covers/posters or square album art, never cinematic landscape backgrounds, and prefer owned-asset canonical titles over parent collection labels. Overview combines attributed description or biography, a purpose-built cast/credits peek, and applicable series or collection context; Detail tabs per type: movie, TV show and season Overview, Cast, Details; episode Overview, Cast, Details; album Overview, Details; audiobook Overview, Tracks, Details; book and comic Overview, Credits, Details; series types and Collection Overview, Details; a Universe page Overview (with the owned items in it) and Details; a person one page with no tabs. Cast shows each actor with the role name they played, and links to the person. There is no Character page, no Characters, Portrayals or Relationships tab and no View Appearances button; character and place links across formats belong to the Universe plan. No detail page has a Universe or Related tab, on any device; the Universe explorer and Collections stay reachable from their own places, and a stale ?tab=universe or ?tab=related link falls back to the first tab. Details reads top to bottom: file facts, then History. File facts are whatever the data store already holds per item (file name and format, container, length, pages, video, audio and subtitle summary, language, and per file the size such as 1.4 GB or 312 MB, the date it was added such as 2026-10-16, the bitrate such as 6.2 Mbps or 256 kbps, and the audio and subtitle tracks when more than the summary already says); everything comes from stored rows and nothing is probed on page open, so a fact that is not stored is simply left out, shown on every device as a compact two-column list that wraps on phones, with one block per file when an item has several; groupings (shows, seasons, albums, series, collections) own no file and point to the items inside. When an AI feature plugin (Vibe tags, Description insights) has left anything for the item, a Suggested by Local AI panel marked AI follows the Details list with its short summary, vibes, themes, moods and content warnings; with the plugins off nothing AI shows anywhere. Library browse pages add Vibes and Themes filters beside Genre, listed only when at least one item has any, and carried in the page address as vibe and theme. The file path and History appear only to people who are already offered the Edit action, and History is a read-only list shown only on desktop-class screens, read from GET /library/items/{id}/history. Standard collection details use the same resolved membership as the Collections catalog. Listen playlists remain specialized lane-local surfaces. On phones the Listen song lists (All songs, album and artist songs, playlists) and the album details track list become card lists: each song shows its title, then artist and album, its length on the right, a 44px Favourite heart and a row menu (a bottom sheet) with Play next, Add to queue, Go to album and Go to artist; a playlist adds Move up, Move down (disabled at the ends) and a destructive Remove. Tapping a card plays it, and long song lists load 120 songs at a time behind a Show more songs button. Nothing on touch depends on drag or hover: drag handles and column resize grips appear only with a mouse at the desktop width, a playlist’s rows reorder from the row menu on touch and with Alt+Up / Alt+Down on a focused row on desktop and TV (the move is announced), and the row menu button is always visible on touch. Below 1024px the now-playing bar’s title block and transport share the width instead of holding fixed widths. On phones (the phone form factor) the hero is sized to its content under the top bar instead of filling the screen: the primary action is full width and 48px high, My List, Rate and More are 44px round icons with their names underneath, fact rows wrap as chips, genre chips keep a 44px tap box, and More opens a bottom sheet listing the same actions. The section tabs keep a 112px minimum width, fade at the edge that still has tabs and scroll the active tab into view; the episode and works rails swipe with the next card peeking, credits and people stay in one or two columns, and track rows fit the screen without sideways scrolling. Tablet and desktop keep the composition above.

A detail page never shows a button that goes nowhere: the main button exists only when there is something to play or read (Watch, Resume, Read, Listen, Play album, Explore Timeline), so a page with nothing playable, such as a track with no readable or listenable format, a show with no owned episode or a universe without a timeline, has no main button and no generic “Open” fallback. Every action the Engine sends either carries a route to open or is one the Dashboard handles itself (DetailActionKeys), and a test fails when one does neither. A detail page that cannot open says why in one of three ways: “not found” (also used for items outside the active profile’s access), “not allowed”, or “Engine unreachable” with a Retry button; only the connection failure offers Retry.

Picture sizes (right-sized pictures, October 2026)

Every picture loads at about the size it is drawn, never the downloaded original, except the artwork picker’s full view and downloads. The rule: ask for the smallest copy (tiny 96, small 320, medium 960, large 2160 px on the long side) that is at least the drawn size times the screen’s sharpness. Fixed-size pictures offer the next copy up to sharp screens; screen-wide pictures let the browser choose medium on phones and large on desktop and TV. A picture seen once is kept by the browser and not fetched again until it changes; an edited picture gets a new address and shows straight away. Photos in View keep their own sizes (160-2048).

Surface	Drawn (CSS px, long side)	Copy asked for
People list, Universe cast lists, family tree, Events/Added rows, table and song-row covers, Continue strip	32-64	tiny (96); small on sharp screens
Now playing bar, queue and history rows, editor thumbnails	48-128	tiny or small by drawn size; next copy up on sharp screens
Credit card faces and character pictures	up to 140	small
Home, Watch, Listen, Read tiles and shelves	128-342	small; medium on sharp screens (browser choice)
Search results, Listen album/artist art, Series and album rails	160-400	small or medium by drawn size
Tile hover panel, details cover, person portrait, full player, editor artwork preview	320-640	medium
Hero carousel, details and phone hero backgrounds	full width	medium on phones, large on desktop and TV (browser choice)
Artwork picker “full view” and downloads	full	original

Logos have no copies and load as stored. A new screen that draws an Engine picture without a size fails the build (PictureSizeGuardrailTests).

Shelves and View all grids (October 2026)

Approved by the product owner on 2026-10-16 and 2026-10-20.

Shelves. Every Home and lane shelf of titles shows up to 20 items (author and genre shelves too, still at most three of each). Every shelf with a See all link ends with a View all tile as tall as the row’s tiles (arrow and the words View all, a 48 px minimum target, reachable with a keyboard or TV remote, named “View all {shelf}”); the header link stays (See All on phones, View all elsewhere). The tile and the link go to the same place: the shelf’s View all grid, or, for shelves whose own page already lists everything, that page (Series, Artists, Playlists, Favorite Songs, audiobook series, Collections & Lists, and the Collections and For Me shelves).

Which shelves have a grid. Home Continue Across Media, Watch, Read and Listen; Read’s Continue reading, Recently added and author shelves; Watch’s Continue watching, TV Shows, Movies and genre shelves; Listen’s Continue listening, Recently played, recently updated albums, recently added audiobooks, New tracks added and Albums (the music shelves all open the albums grid in their own order); and My Library’s My List and Liked. Each grid is at /all/{lane}/{shelf} and shows the shelf’s whole list, not just the first 20.

The grid. The shelf’s title as the heading and a count (“312 titles”), then sort and filters, then tiles that load more as the person scrolls (a Load more button stays under the grid for keyboards, remotes and screen readers). TV episodes appear as one show card and tracks as one album card, exactly as on the shelf.

Sorts. Recently added (the default), Title A–Z, Year (newest first, unknown years last) and Recently played (most recent first; never-played titles last, newest first). Continue and Recently played grids open on Recently played. On My List and Liked, Recently added means when the title was saved or liked. The sort chosen on a grid is remembered for the profile, on every device, per lane: Watch, Read, Listen, My List and Liked each keep their own. Continue and Recently played grids always open in their own order; re-sorting them lasts for that visit only. If the sort can’t be saved it still applies for that visit and a small notice says so.

Filters. Only the filters that mean something for that list are shown, and a filter with fewer than two choices is hidden: Media type (on mixed lists such as Home’s Watch, Read and Listen, My List and Liked; My List and Liked also offer Collections), Genre (not on a genre shelf’s grid), Format (EPUB, PDF and comic files for reading; 4K, HD and SD for watching; never for Listen) and Progress (Not started, In progress, Finished; never on Continue or Recently played grids, and not while the list includes music, which has no progress). A title matches a format when any copy the person may see has it; a show’s progress comes from its episodes. Each choice shows its count. On phones the sort and filters sit in the shared Filters bottom sheet (“Show N titles”); elsewhere they sit above the grid. Chosen filters show as removable chips with Clear all. Sort and filters are kept in the page address (replacing the history entry, so they add no Back steps), so reload and Back return to the same view.

States. The first load holds a skeleton grid the size of the tiles. A list that a filter empties says “Nothing matches these filters” with Clear filters; an empty list says “Nothing here yet”. A grid that doesn’t exist says “This list isn’t available” with a link Home. A failed page keeps what is loaded and offers Try again.

Who sees what. Grids are read from the same authorized projection as lane pages: the profile’s content limit, its lane (area) access and the libraries hidden from the profile apply, Documents never appear, a format from a copy in a library the account can’t see is never offered or counted, and My List and Liked only ever show the signed-in profile’s own lists (another profile’s private collection or playlist never appears even if its id was saved). The TV app’s “See all” reads the same full list.

Approved by the product owner on 2026-10-27 (Home page redesign spec, decisions D1 to D6).

Top banner (the hero). It holds at most five slides. Everything the person is in the middle of comes first, most recently touched first, then newly added items, newest first. A show is one slide: a show with an episode started shows that episode (Resume, or Watch Next Episode when the last one is finished) with the show’s logo; a show never started shows the series with “Start watching”. Book covers in the banner are the same size as on the item’s own page. Only items that have finished matching and have real artwork appear. The banner is built in two steps: the person’s settings decide which items are allowed, then an orderer puts only those in order. The default orderer is the order above; a plugin’s suggestion can lift a new item inside the “new” group but never ahead of something in progress. If a smarter orderer is added later and is off or fails, the default order applies.

Banner settings (Settings, Preferences, Home). Each profile can turn the banner off (Home then starts at its first row), choose one to five slides, allow or block Watch, Read and Listen items, and choose “continued plus new” or “continued only”. They only narrow what the banner picks from. The Engine applies them, so phones, TVs and browsers agree.

Plugin slides. A plugin may suggest an item for the banner with a short reason. The slide is drawn by the Library, labelled “Suggested by {plugin}” (plus “AI” when Local AI produced it) with the reason on hover, and only appears for an item that already passes every check above. Text with markup, script or an address, and icons that are not a plain icon name, are refused and the reason is logged. Each profile can switch a plugin’s slides off.

Pick up where you left off. One horizontal row of cards, one card per thing started, whatever its type (a show once, an album as “Recently played”). Each card has the cover, the type with its icon, the title, a subtitle, a progress bar with a line such as “42% watched”, and a round play button. The title opens the item’s page. With nothing started the row is not shown.

Recently Added filters. The pills are toggles: All, Watch, Read, Listen, View. A type with nothing in the library has no pill, and two or more can be on at once. The tiles are 25 percent smaller than shelf tiles.

One hover. Movie and TV tiles on Home and Watch share one hover: after a short pause the tile lifts a little and the preview fades in over it. The tile never changes width, so neighbours do not move. Pause, fade and hide use one set of timings, and moving straight from one tile to the next skips the pause. Nothing happens on touch screens or with reduced motion on.

Opening an item. Clicking a tile hands its cover, logo and backdrop to the item’s page, so the page shows the real picture and title straight away instead of grey boxes while the rest loads. A link typed or reloaded keeps the grey stand-ins.

When an item appears: Ready

Every library surface (Home, the hero, the shelves and lanes, Watch, Read, Listen, collections, People pages and the Library list) shows an item only when it is Ready. An item is Ready when it has been matched to a real title, is placed in its show or album (an episode under its show, a track under its album; books and comics that belong to no series stand alone), has its artwork (found, or searched for and settled), is not waiting in Needs Review, and has not been rejected. Wikidata and the later enrichment steps are not required, so items appear quickly and fill in by themselves while you already watch or read.

Ready is decided once by the Engine and is the only gate; no screen has its own rule. It is sticky: once an item is Ready, matching it again (a rematch, a refresh) does not make it disappear. It leaves only on a negative outcome: it lands in Needs Review, finds no match or fails, is rejected, loses its file, or loses its place in its show or album. When it is Ready again it returns without being announced a second time.

An item that is not Ready appears only on the live ingestion page (Settings, Library and Ingestion), which says what each one is still waiting for. Each item appears on its own as soon as it is Ready; nothing waits for the rest of a batch. “Added” means Ready: the “added” notice and the Recently Added entry happen at that moment, once per item.

Collections presentation

Current presentation rules: the Collections landing route is labeled Discovery, while Automatic, Curated, Shelves, and People retain their names. Shelves opens with Read, Watch, and Listen preview lanes and filters by Books, Movies, and Audiobooks. Albums and comic issue series remain native lane groups. Same-name duplicate contributor records collapse into one enriched shelf presentation. Discover rows show a small title and optional year for individual items, but group tiles do not repeat text they already embed. TV Shows rows keep episode counts but omit the redundant TV Show pill. Completed TV shows show a provider-backed premiere-to-finale year range; TV detail pages always keep the season selector visible, including when only one season is owned.

A curated collection (a manually built Custom collection) can never be empty. The editor does not let it be created or saved without at least one item and sends the chosen items with the create request; the Engine refuses to take out its last item or its last attached personal-media source (“A collection needs at least one item. Delete the collection instead.”) and refuses an update that would leave it empty. When the last item of a curated collection leaves the library the collection is deleted automatically and a “Removed the collection ‘X’ because its last item left the library.” entry is written to the activity history. Playlists, playlist folders and rule-driven (live) collections are not affected, and automatic collections follow the canonical metadata. Deleting a title from the library names each hand-picked collection it sits in, and a hand-picked collection left with nothing in it is deleted with the title. Automatic collections are never named (see Delete from library).

Delete from library

Delete from library is the one way to remove a title from the library. It is for administrators on a desktop with a fine, hover-capable pointer (EditorDeviceRule.CanEdit), and the Engine checks every call. It appears in three places and nowhere else:

Detail page. Delete from library… is the last entry in the page’s … menu, in red below a divider, whether or not Editing Mode is on. When Editing Mode is on it is also in the editing bar’s … menu. Both open the same dialog. It is offered only for single titles such as a movie, an episode, a book, an audiobook or a comic issue.

If someone else removes a title while you have it open, the page stays open with a notice that the title is no longer in the library, and Editing Mode ends. Anything you had typed in a field is kept on the notice with a Copy button, so it is not lost.

Listen song table. Each song row has a Delete icon, and selecting songs shows “N selected”, Delete… and Clear. Phones, touch-only devices and anyone who is not an administrator see neither.
Settings > Libraries > Excluded files. The files that stayed on disk, each with Add back.

The dialog first checks what will happen (“Checking what will be deleted…”) and then shows:

Files: every media file and sidecar, with its folder and size, each marked as deleted from disk or as staying where it is (in a read-only folder, the original of a merge, or a file that is protected or cannot be removed). Files that stay are excluded from future scans.
Hand-picked collections: each collection the title is in that someone made by hand, with a note that the title is taken out of it. A hand-picked collection left with nothing in it is deleted too, and the dialog names it. Automatic collections are never listed.
Progress: how many people have progress on the title. The count is shown, not their names, and the progress is removed.
Space freed, and “Files deleted from disk can’t be recovered.” when at least one file will be deleted.

The red button reads Delete from library and disk when at least one file will be deleted, and Delete from library when every file stays. Cancel has the focus when the dialog opens, and Escape cancels. Collections are sorted A to Z, and after five the list ends with “and N more”. The dialog warns when processing for the title will be stopped. If the plan has changed since the dialog opened, the dialog shows the updated list and nothing is deleted.

Library media has no recycle bin. Films, TV, books, audiobooks, comics and music can be downloaded again, so deletion is immediate after the confirmation. Only titles and songs can be deleted this way. A whole show, season, album or series, a single edition or file, and personal items in View cannot be deleted this way yet.

Universe page

A Universe has its own page, /universe/{qid}: a page to read, not a management screen. It is not a menu item and the phone dock does not change.

Finding it. Collections lists Universes in the Universes group; a Universe tile opens the page (a Universe without a Wikidata identity keeps the ordinary collection page). Search results for a Universe open it. The Universe details route (/details/universe/{id}) has one main button, Open Universe. An item page shows one quiet line under its title block, “Part of the Dune Universe” (a name that already ends in “Universe” is not given a second one, and one that starts with “The” does not get a second “the”: “Part of the Expanse Universe”), linking to the page; it appears only when the Library holds two or more Series, or two or more formats, in that Universe that the profile can see. It is never a tab and never a button row.

Sections, in order, each hidden when empty:

Hero: the Universe’s name, a stack of covers from its first Series, and one line of totals: “3 Series · 14 Works · 2 formats” (singular and plural are respected; a Universe made only of TV shows says “shows”; standalone works count toward the Work and format totals, and a Universe whose only visible works are standalone still opens). A small “Enrichment running” indicator, blue like the menu indicator, shows while the Engine is still learning about its works.
Series: one shelf per Series (or show) in the order the Engine gives it, numbered as the source gives it (decimals kept). “Also in this world” sits under its Series. Entries the Library does not own appear as dashed “Not in library” placeholders in their place only when the profile chose to see missing entries for that Series (its own choice, otherwise the media default); otherwise they are not drawn and the Series shows a quiet “N missing” count.
Standalone: works that belong to the Universe but to no Series, as one shelf.
Connections, evidence only, every row naming where it came from (“Source: Wikidata”, or the approved lore source’s name such as “Sources: Wikidata, Dune Wiki”): Cast (headshot, name, “as Character, Character”; a row opens Also appears in: every owned Work that shares one of that person’s characters, then more of the person’s own Work in the Library, each linking onward; the person’s page is one link away from there), Adaptations (“Title — Based on Source”, only real based-on, derivative or inspired-by links) and Characters (a read-only list: name, “In 3 of your works” and its source, the characters seen in the most works first; a row opens Also appears in for that character; the first 12 show with a “Show all” toggle that stays in place as “Show fewer”, at most 60 are listed with “Showing the 60 characters seen in the most works” when there are more; no portraits, no relationship graph, no character page). Spoiler respect, one rule for every place a character is named (Characters, Cast, Also appears in, the explorer graph): with your spoiler level on Up to where I am (the default) a character appears only once you have reached them. A character first seen in an episode you own that is later than the furthest episode you have started is left out, and one honest line under the list says “3 characters hidden to avoid spoilers”; a Cast row keeps the person and drops only those characters’ names (so the row has no “as …” when none remain); Also appears in for such a character says it is hidden to avoid spoilers and lists nothing. A character the Library cannot place within what you have watched or read, because it appears only in a show, film or book you have not started, or somewhere within a title with no episode to place it by (books and audiobooks never have chapter data), is listed last with its name, source and a quiet “No plot details” tag only: no work count and no description. It still opens Also appears in, which lists Works rather than plot. A character you have met in any one title it appears in (a film you finished, an episode you have reached) is shown, even when another title first sees them later. A character marked as a spoiler for a work you have not finished (or do not own) is hidden. With the level on Everything nothing is held back. You choose the level yourself in Settings, Preferences, Playback, Spoilers (Up to where I am / Everything); nobody else, not even a household administrator, can change it for you. The same rule covers every other place a character is named (Shy’s decision, 2026-10-20): the “as Character” lines on a title’s cast list and on a person’s page, and the people search, which neither matches nor names (“Plays …”) a character you have not reached. The actor always still shows, just without the hidden character names. A title you have finished shows everyone in it, even a character the Library cannot place at an episode. The admin-only Universe editor is a correction tool and is not filtered. Lists sit side by side as room allows on tablet and desktop, stacked on a phone. Desktop only, an Open the explorer link goes to /universe/{qid}/explore for paths and the family tree; the explorer’s adaptation tree likewise lists only real adaptation links, each with its source, and says plainly when there are none. With nothing recorded and enrichment not finished it says “Still learning about this Universe” with a quiet note such as “Details found for 6 of 14 works”; with nothing recorded and enrichment finished it says “No characters, cast or adaptations recorded for this Universe yet.” It never shows sample data. For administrators, when the Fandom lore plugin is off, a quiet “Add Fandom details” link goes to Settings, Plugins.

States. Loading shows skeletons for the hero and Series. If the Engine cannot be reached the page says “Can’t reach the Engine” with Retry. A Universe the profile cannot see (or that does not exist) says “This Universe isn’t available.” The page re-reads itself at most once every ten seconds while enrichment events arrive.

Editing. Desktop administrators who may edit the Universe see Edit in the hero. It asks for the administrator unlock, then opens the Universe editor in the same side drawer Editing Mode uses, beside the page, not as a modal; saving a change refreshes the page. Phones, tablets, TVs and everyone else see no Edit control. TV: cards and links are focusable in order with a visible focus ring and nothing is hover-only. Phone: no sideways page scroll, 16 px gutters, 44 px targets.

Helper apps. The Android, Apple and TV web apps show the same hero line, Series (in the same order) with “Also in this world” beneath each, and read-only Cast and Adaptations lists from GET /api/v1/universe/{qid}, with no graph, Standalone shelf, missing placeholders or editing; Roku lists the Universe’s Series only. Details: Native clients.

Phone companion

The companion is a read-only screen for following a story on a phone or tablet while something plays elsewhere, or while you read, at /companion and /companion/{workId}. It is offered on phones and tablets only: on a desktop or TV the title menu item and the Home card are hidden and the page says it is for phones and tablets (CompanionDeviceRule). It opens with one plain sentence saying what it is, with an (i) tooltip on how to use it. It is not a menu item and the phone dock does not change. It never edits anything; Editing Mode stays desktop-only.

Getting there. Home shows a Now playing card above the shelves only while the active profile is playing or has paused something on one of its devices (“Lanterns · S1E2, on Living Room TV”) with a Companion button; with one device the button follows it, with several the card says “and 1 more” and the button opens the companion to choose. Nothing playing means no card. Every title’s ”…” menu (film, episode, book, audiobook, comic issue) has a Companion item that opens /companion/{workId}: it holds that title and opens the episode or chapter list so you can pick where you are. On a phone the ”…” menu is the bottom sheet. Only the profile’s own devices are ever listed; what someone else in the house is playing is never shown.

The screen, one column on a phone and 44 px targets throughout: the title and your place (“Season 1 · Episode 2”, “Chapter 12: The Gate”, “Film”), whether you are following a device (“Following Living Room TV”) or holding a place you set; a small Up to here / Everything switch (the profile’s own Spoilers preference, the same one as Settings, Preferences, Playback, so changing it in either place changes both); buttons to open the item page and its Universe; the synopsis; Who’s here (characters up to your place, with source and performer, judged by the same spoiler rule as the Universe page; a character the Library cannot place is named with “No plot details”; characters held back are counted in one honest line); Where you’ve seen them (characters that also appear in other Works you own; a row opens Also appears in); Previously (the last episode you own before this one, with its synopsis); and a Change episode / Change chapter / Set my place button that opens the picker. Following refreshes about every five seconds; a place you set never changes by itself. When the followed device stops, the screen keeps where you were and says “Playback stopped.”

Honest limits. A Work with no character details says “No character details for this one yet.” (with the cast and synopsis it does have); a Work whose details exist but are all ahead of you says “Characters show up here as you reach them.”; a missing synopsis says “No synopsis for this one yet.”; books and audiobooks have no chapter-level source, so their characters show without plot details, and the screen says why. A book without a table of contents gets a chapter-number stepper instead of a list. A film is held as a whole (no scene data), and characters in a film you are watching are named without plot details until you have finished it. Nothing is ever invented to fill a gap. Characters never appear on item pages (they live on the Universe page, the companion and Also appears in).

Series rails and app shell

Canonical book, comic, and movie series containers show their sequence rail directly on Overview. Source numbering stays above each cover (decimal positions such as 1.5 are shown as the source gives them; a member with no position shows a dot, not a made-up number), connectors appear behind number nodes only between members that sit next to each other in the Engine’s order, and the current item uses a stronger purple frame glow without This book, This movie, or Up next labels. Only main-sequence members are numbered and counted in “x of y”. Supplementary, collected-content and broader-context members of the same Series appear in a separate Also in this world row under the rail, on the Series page and on the item page, and are never numbered with the run. A book Series, an audiobook Series and a TV show that share a name are separate Series. Completion remains a separate check state, and aria-current preserves accessible current-item context. Missing-item visibility inherits its media default from config/ui/library-preferences.json; the database stores only explicit profile-and-series overrides, which can be removed to restore config inheritance.

A standalone work (no collection, no series value and no parent) never shows a series or sequence panel on its details page. Opening any details page from a browse surface starts at the top, and Back restores the previous page’s scroll position.

MainLayout exposes My List as the active profile’s saved shortlist and delegates account actions to TopNavAccountMenu. Needs Review lives inside that permission-aware menu rather than in a standalone bell. SystemActivityIndicator uses ShellActivityState to combine ingestion (the Engine’s single queue snapshot), AI download/parsing, enrichment and durable-operation activity into one circular progress surface with exactly two states: blue (--tl-accent-secondary) while the Library is working and green (--tl-status-success) when it is idle, with no amber or other state. Playback does not light it (it is not Library work), and a queue that is only waiting for a missing tool keeps the indicator green, though missing tools and Needs Review items also appear in the administrator banner. It shows blue only while the Engine’s snapshot is under 15 seconds old and the live connection is up. The tooltip uses the live page’s words (“Found 508 files · 120 of 508 done · About 4 min left”, “Found 508 files · 120 of 508 done · Running for 4 min” when the Engine has no reliable estimate, “Waiting for media tools · 3 files are waiting” while tools are missing, or “Library is up to date · Last activity 3 minutes ago” when idle), the state is also written as text for assistive technology, and a click opens the live Ingestion page. The account menu offers My profile (the person’s Overview) and My activity (the Activity page under it), shows each person’s avatar beside their name in the profile switcher, offers Manage profiles to administrators, and offers Sign out for the current session, including local accounts. Below 600 px (the phone form factor) navigation is the three-tab floating dock, the hamburger menu and the section chips described under Phone navigation below. Tablets and desktops show the top navigation and no dock. At 840 px and narrower (portrait tablets, narrow desktop windows) the top bar stays the same but compact: the icon logo instead of the wordmark, the account button as the avatar alone, and the section labels scroll sideways in their own space if they still do not fit, so they never sit under Search, My List or library activity. TV uses the five-tab dock (Home, Libraries, Search, Downloads, Settings) from shell.intent_dock_items, where Libraries goes to the library surface the profile used last (Watch until one has been used; remembered per profile in browser storage under tuvima.last-library.v1.<profile id>), is active on Watch, Read, Listen, View, Collections and Recently added, and, tapped while already on one of those surfaces, opens the library switcher (a bottom sheet of six 56 px rows: Watch, Read, Listen, View, Collections, Recently added). Search opens the full-screen search overlay (on phones safe-area aware, with a visible Cancel button, the on-screen keyboard’s search action, and results as a one-column list of tappable rows). Downloads opens /downloads, which says downloads live in the Tuvima app; ShellDock.DownloadsMode switches between that page and dropping the tab. The older names Read, Watch, Listen, View and Collections stay valid in the TV list so saved settings still resolve. A Kids profile (restricted role) gets the simpler Kids shell: the top bar keeps only Watch, Listen and Read and My List, the phone dock is the same three tabs as everyone’s (the phone menu and chips list only Home, Watch, Listen and Read, with no Settings or Recently added; the TV switcher lists only Watch, Listen and Read and has no Settings tab), tiles are larger with rounder corners (.layout-kids tokens in wwwroot/app.css), the account menu drops My profile, Settings and Needs Review, keeps My activity (which opens the Kids page /my-activity rather than Settings) and shows a Kids badge. Content limits are separate and not part of the shell.

My List uses a heart everywhere: the top-bar My List button, the one My List heart in the top bar (the Read, Watch and Listen side menus carry no My List row of their own; Listen keeps Favorites under Music / Playlists), the Home hero and phone hero card, detail pages, saved Playlists, My Library and activity rows. The heart is outlined when the item is not saved and filled once it is (a toggle labelled Add to My List, then In My List); a menu or top-bar entry that only opens My List keeps its surface’s usual icon style. This supersedes the list-with-tick, ”+”/”✓” and ringed-planet glyphs in older notes below. A song’s Favorite heart in Listen is unchanged: it still adds the song to Favorites, which is separate from My List. The bookmark shape is reserved for real bookmarks. The account menu header shows the account email. The profile switcher appears only with more than one profile, and the menu includes Manage profiles (administrators) and, for this-computer-only accounts, a light red Secure your account card at the very top of the menu above the name (“Add a password to use the Library away from home. Phones and TVs at home keep working without one.” with Secure account and Not now; there is no avatar dot). Not now is remembered with the account, so it follows the person to any browser. There is no bar across the top of the screen for this-computer-only accounts: the prompt lives in the account menu card, Settings > Security (see below) and the “Add a password to your account first” toast.

Reversal. This replaces the five-tab phone dock (Home, Libraries, Search, Downloads, Settings, with no hamburger and the Libraries switcher sheet) that earlier revisions of this page described. The Libraries tab, the Downloads tab and the Settings tab are gone from the phone dock; the library switcher and the five-tab dock remain on TV only. Tablet, desktop and TV navigation are unchanged.

The phone shell has four parts, all on the phone form factor only (html[data-form-factor="phone"]):

Top bar. A fixed 56 px bar row: a 48 px hamburger on the left, the icon-only logo (tuvima-icon.svg, no wordmark), then on the right the Downloads icon (see below), My List, library activity and the account avatar. There is no search icon: Search is a dock tab, so there is one Search. The bar floats over the Home and details heroes with the same translucent gradient and blur as before, and is a solid surface on other pages.
Section chips. A fixed 48 px row under the bar (so the whole top chrome, --app-topbar-height, is 104 px): Read, Watch, Listen, View, Collections, in the order the desktop top bar uses, scrolling sideways with a fade at the edge that still has chips. The chip for the section the person is in is selected (aria-current="page", accent border and soft fill, and it scrolls into view). The row has one tab stop and the left and right arrow keys, Home and End move between chips. Held sideways (under 480 px tall) there is no room, so the row is dropped and the menu still lists every section.
Floating dock. A rounded pill of three 48 px tabs, the same for everyone including Kids: Home, Search (opens the full-screen search overlay) and My Library. It sits clear of the screen edges and the bottom safe area, has its own grid row so it never covers the last row of a page, and sits below the audio player. My Library opens the My Library page (/my-library, described below) and is selected there and on the personal grids behind its See All links (/for-me); the details-page + My List action keeps its name.
Menu. The hamburger opens a full-screen sheet (a native modal dialog: focus stays inside, Escape closes it, the browser’s Back also closes it and returns to the page, and focus goes back to the hamburger; it only animates when the person has not asked for reduced motion; every row is 56 px tall and labelled). It is generated from the same catalogue as the desktop top bar (ShellNavigation, so it cannot drift): Home, My Library (the dock tab’s page), Recently added, then the top bar lanes in the top bar’s order (Read, Watch, Listen, View, Collections), each with its icon. Photos and Documents are not separate entries: they live inside View. Below a divider: Settings, Switch profile (only when the household has more than one profile) and Sign out. Every entry appears only if the active profile may see it, using the same rules as the desktop bar and account menu, so a Kids profile sees Home, My Library, Watch, Listen and Read and Sign out only, and a profile that may not see Documents never meets the word in the menu, the chips or the dock.

The Downloads icon sits on the right of the top bar only where downloads actually work, which is the Tuvima app. The browser Dashboard cannot download, so ShellDock.DownloadsMode ships as ExplainNativeApp and the icon is hidden there; DownloadsTabMode.Available shows it.

On Home the phone hero card is sized from the chrome above and the dock below (--phone-hero-bottom-bar in PhoneHeroCard.razor.css is the one number that sets it), so adding the chips row did not move the first shelf header; the card is correspondingly shorter than when the bar was 65 px with no chips.

My Library page

My Library is the personal page, named like My Netflix. It combines Continue, My List and the other personal sections in one responsive column that phones show first; the desktop and tablet top bar is unchanged (its My List button lands on the same page). Route /my-library; the heading and the browser tab title say My Library. Old /for-me?view=my-list links land on it. See All on My List opens the My List grid (/all/personal/my-list) and on Liked the Liked grid (/all/personal/liked), the same View all grid every shelf uses (see Shelves and View all grids). Old /for-me?view=my-list&area=all and /for-me?view=liked links land on those grids; an older link that carries a lane area (area=read|watch|listen) still opens the filtered /for-me grid.

Top to bottom, each section hidden when it has nothing to show:

Profile header. Avatar, My Library and the profile name, a Switch profile button (only when the household has more than one profile) and a Settings link (never for Kids). No account editing.
Downloads card. A link to /downloads, shown only where downloads work (ShellDock.ShowsDownloadsInTopBar, that is DownloadsTabMode.Available, the Tuvima app). It is not rendered at all in the browser.
Continue. Every media type in one row, using PhoneContinueLogic and the phone Continue row (tablets and desktops keep the per-type groups). Source: GET /display/continue.
My List. Saved items, newest first (at most 20 on the shelf), with See All. Never hidden: when empty it keeps its title and says “Add titles with the My List heart”, with no buttons. Source: the saved ids resolved through the Engine’s direct item lookup (POST /display/items, see Personal pages resolve ids directly below).
Recent activity. A short preview of the Activity page (the latest six entries, music collapsed into one session tile), with See all opening the full list: /settings/overview/activity, or /my-activity for a Kids profile, which has no Settings. It replaces the old History shelf, so there is one list of what the profile did. Hidden when there is nothing yet. Source: GET /api/v1/activity/recent?limit=6, drawn with the Overview’s RecentActivityStrip.
Liked. Everything marked Like or Love, newest first (at most 20 on the shelf), with See All. Source: profile reactions resolved through the same item lookup.

Kids profiles get the same sections, narrowed by the Engine’s existing permission and content rules (every read is profile-scoped). A profile that may not see Documents never meets a Document item (they are hidden until the View settings say Documents are allowed). There are no editing controls on the page.

Loading. The header loads first, then every section loads in parallel. Until the header is in, only the heading and a header skeleton show. Each section holds a fixed-height skeleton (Continue about 285 px and every shelf 341 px at 390 px wide, the same height as the loaded row) and sections reveal top to bottom, so a section that turns out empty can only move skeletons below it, never content that is on screen. Artwork is the sized renditions only. A section whose read fails is left out and one quiet notice with Try again appears after the last section. On phones every shelf header, including this page’s, is one 48 px row with the title on the left and See All on the right.

Personal pages resolve ids directly. My Library and For Me turn the saved, liked and favorite ids into tiles with POST /api/v1/display/items (PersonalTileIndex.LookupAsync), not by reading the Read, Watch and Listen lane browse pages, so an item is never missing just because it sits past a lane page’s size. The Dashboard sends at most 200 ids per call (the Engine’s cap) and splits a longer list into several calls, one page back. The Engine answers from the same authorized projection as the lane pages, so the profile’s content limit and the profile’s lanes and hidden libraries apply exactly as they do on a lane page; an id the profile cannot see, a Collection or Playlist id (those come from the Collection catalogue and Playlist reads) and an id that does not exist all simply have no card. Documents are never returned, so a profile that may not see them cannot learn that one exists, and the Dashboard still hides any Document tile it is handed. Collections and Playlists keep their own reads. If the lookup or the recent-activity read fails, that section is left out and the quiet notice appears, rather than the row showing as empty.

The tv form factor (html[data-form-factor="tv"], no layout redesign) is a larger, remote-friendly presentation of the same pages. One block in wwwroot/app.css sets an 18px root font size, 56px dock targets with 14px labels, one step larger tile titles, a 48px shelf gutter and a 60ch maximum line length for hero subtitles and synopses. Phone and desktop layouts are unchanged. Every focusable control (tiles, dock items, chips, buttons, table rows, hero controls) shows one shared focus ring on keyboard or remote focus: the --tl-focus-ring colour with --tl-focus-ring-width and --tl-focus-ring-offset; text fields keep their own field focus styling. Spatial navigation (registerSpatialNav in wwwroot/app.js) moves focus with the arrow keys by on-screen position: left and right stay within a shelf, up and down move between shelves, the dock and the hero. Enter activates the focused control, Escape or Backspace go back, and the focused tile scrolls into view. It is always on in the tv form factor; on other form factors it starts after the first arrow key pressed while focus is on a shelf tile. It never acts inside text fields, selects, sliders or editable regions, or while a dialog is open.

TV episode routing and heroes

TV episodes are children of the show detail page, organized by season. A combined file (one file, several episodes) is named with its episode run when the organiser renames files, for example s01e01-e02; every episode it covers is shown as owned. Each owned episode has a show-scoped detail route opened from its still. Continue surfaces retain the episode still and playback target, identify it with compact copy such as Continue · S5 E1, and use actions such as Resume S5 E1. Episode detail heroes retain that episode’s still, synopsis, and genre. Root show heroes report owned episodes and target either the in-progress episode or the first owned episode. An unstarted show may retain the series hero while showing that episode’s facts; after progress, the hero switches to the episode still and Sx Ey description. Short provider show copy appears under the owned summary in a separated Series Description block. Detail heroes use one left-aligned column for written identity, logos, compact facts, actions, and description, and show at most two linked genres on their own non-wrapping line. Movie heroes use the movie description without a synopsis heading. The watch utility row does not repeat a Show details action.

Seasons open inside their show

A season has no page of its own. Opening one, from any address, shows its show’s page with that season selected in the season control and that season’s episodes listed; it never reads as “not found” while the show and at least one of the season’s episodes are visible to the profile. The address is the show’s with the season added (/details/tvshow/{show}?season={season}); /details/tvseason/{season} resolves to the same page. The chosen season is part of the address, so reloading keeps it, and the season control and episode list behave the same on phones, tablets and desktops. A season whose episodes the active profile cannot see reads as not found, like any other item the profile may not see.

No shareable links; titles open over the current page; the tab is remembered

A library is private, so detail pages have no shareable links and no link-copy action anywhere (not in the More menu of a detail page, the Home hero or the Listen page). Links between items inside the app use the item’s ID (/details/{type}/{id}). Target behaviour, built with the detail overlay: a title opens as an overlay over the page you were on; Back, the close button and Esc dismiss it and return to the page underneath; reloading while a title is open reopens that same title over Home so you keep your place.

The tab you choose on a detail page (and, on a show, the season) is written into the page address as tab and season by replacing the current history entry, so it never adds a Back step. Reloading, or coming back to the page, reopens that tab and season; a tab value that does not exist or is hidden for that title opens the default tab. Choosing a tab or season never reloads the page from the Engine, and a personal action such as marking something watched keeps the chosen tab and season.

One file, several episodes: the editor picker

When one video file holds several episodes of a season, the editor’s Matching tab shows a This file covers picker for that episode’s file. Each episode of the season is a tappable chip (E2 · Title); the file’s own episode is always ticked and locked, episodes that already have their own file are locked, and a file covers at most six episodes, all within one season. Save episodes replaces the list in one step, answers the file’s pending combined-media Review item, and records a History entry; saving the same list again changes nothing. Single-episode files see no change beyond the picker staying out of the way when the season has one episode. On phones the chips stack full width with 44px touch targets and the actions stay reachable inside the modal.

Whole miniseries moved to TV

When a Movies item turns out to be a TMDB miniseries and Move to TV is used from its “Found as a TV title” review card, the show appears under TV and the file covers every part TMDB lists, for example Season 1, Episodes 1 to 3, all shown as owned. The file is attached to the first episode, the others carry the “Same file as Episode 1” chip, and the file on disk is never moved or renamed. The same safety rules as any combined file apply: at most six parts, all in one season, numbered as an unbroken run from Episode 1. Only when TMDB’s parts cannot be listed that clearly (more than six, several seasons, a gap, or the episode list could not be fetched) is the file filed as a special instead (Specials, Season 0, Episode 1), the other episodes show as not owned, and the move’s message and the item’s History say why. The range can be corrected later with the This file covers picker.

Current Collections and linked-identity clarifications

Collections has one padded, viewport-bounded content scroller beside its anchored rail, with no second document scrollbar.
Automatic rollups prioritize trusted fictional-universe, franchise, and based-on/adaptation QIDs over lane-local structure, allowing qualifying comics and films such as Batman to share one rollup.
People counts collapse tracks to albums and episodes to shows.
Person names use the shared media-detail title family, scale, weight, responsive density, and lower-left identity anchor through the rendered person copy hook. Person dates, locations, and owned-title facts reuse the standard detail metadata row/item typography used by year, runtime, and genre. The portrait may remain centered independently; it must not vertically center the identity column.
Musical groups populate every canonical Wikidata has parts member through person_group_members and fully hydrate thin member identities; collective pen names remain alias relationships.

TV episode context and personal status (September 2026)

TV detail uses one profile-aware continuation policy: unstarted/reset shows retain series artwork, active shows use the current or next owned episode still, and explicit episode details stay episode-scoped. Completed owned runs offer rewatch with series artwork. Episodes use short episode synopsis text, never Wikipedia extracts. Missing catalogue entries have no synopsis or artwork and retain the Not in library placeholder. The episode rail scrolls without a four-card cap.

TMDB episode credits are stored separately from show aggregates; full credits support episode, season, and role filtering. Season coverage currently reflects owned episode evidence. More exposes media-appropriate personal completion/reset, history, Undo, Continue visibility, and applicable queue/playlist/collection utilities independently of metadata-edit permission. Revision checks prevent stale progress writes from reversing a reset; bookmarks, genuine consumption history, and music play counts are preserved.

These changes require fresh pre-beta ingestion. Runtime and responsive visual acceptance are pending; see the TV episode consistency proposal for validation status and remaining scope.

Long seasons

A show with up to 100 episodes lists every season and episode at once. (The Dashboard asks for the paged form; clients that do not ask still receive the whole list.) A longer show lists every season but loads one season’s episodes at a time, 50 per window, starting at the window that holds the episode being watched. A season longer than 50 episodes shows a small pager under the strip (“Episodes 51-100 of 1000” with earlier/later buttons, 44px targets, usable at phone, desktop and TV widths); a normal season shows no pager and looks exactly as before. Choosing another season fetches that season’s first window. The “owned / missing / total” counts always describe the whole season, not the window on screen. Next-episode playback and the player’s episode picker ask the Engine for the whole list, so they cross season and window boundaries.

Episodes stored in one file

When one video file holds several episodes, each covered episode in a season strip carries a quiet “Same file as Episode N” chip under its tile. The chip data arrives with the episode item (one batched lookup per page, no per-card requests). When the other episode is in the visible strip the chip is a 44px button that highlights it (press again to clear); otherwise it is plain text. It wraps on phone widths, follows the dark theme and needs no motion. Files without combined episodes look exactly as before.

Libraries settings refresh

Settings > Libraries has two levels, each its own address so Back and a reload keep the level. The overview (/settings/libraries) has four area tabs (Watch, Listen, Read, View; they filter, one is selected, and the selected area is kept in the address as ?area=) and, under them, one table of that area’s libraries, one row per library (so several libraries of one kind are each a row): Name (the library’s icon, in the area’s colour when the kind looks details up and a quiet grey when it does not), Content type (plain text with an icon), Access (Standard or Selected profiles; a Vault-protected library appears only while the Vault may be shown, with a lock chip), Folders and titles (one counts line, “3 folders · 1,284 titles”, “1 folder” or “Nothing added yet”; titles are left out when several libraries share a kind, because the Engine counts per media type), Status and a chevron. Status is Healthy, Needs review (the count of files that could not be matched, linking to Needs Review for the library), Empty, Folder offline (the folders at fault in a tooltip that also opens on keyboard focus) or Scanning, the worst first; nothing is claimed until the folder checks finish, and View rows (whose folders are never checked) show only counts. The whole row opens the library and highlights on hover, and the name is the real link for the keyboard. Search and a status filter sit above the table; an area with no library says “No Watch libraries yet” with one prominent Add library button (which opens the Add library dialog); a failed load says “Libraries could not be loaded” with Try again. The Import folder is one line under the table. View’s kinds appear in the View tab and open View’s own settings. A library page (/settings/libraries/{libraryId}, the library’s Id from the libraries file) has the breadcrumb Libraries > area > name in the Settings frame, the library’s content type, access, counts and status, the actions Scan now, Add folder and Add files, and a tab strip (?tab=): Folders (the folder table for that one library, LibraryFoldersPanel scoped to it), Access, File handling and Activity, plus Lookup for a kind with lookup settings (YouTube) or, for a Vault-protected library, its online lookup switch. Folders lists the library’s folders with the import destination; Access holds Standard, Selected profiles and (read-only, once created) Vault-protected; File handling holds Organization, File changes, Duplicates and Deleted files behind one Save changes bar; Activity lists only this library’s events. Scan now scans this library only, Add folder adds one folder to it and returns to its table with one confirmation, and Add files copies chosen server files into the import destination (disabled with “Choose an import folder first” until there is one). The older group and type addresses (/settings/libraries/watch, /settings/libraries/watch/movies, ?type=) redirect to the matching tab or library page. Add library is one centred dialog on a single screen, with no steps: Media area (Watch, Listen or Read), Name (prefilled from the content type, unique within its area), Content type (a kind that holds one library is greyed out once it has one; a kind that holds several stops at five), Access (Standard or Selected profiles, with a warning that only administrators see a Selected library until profiles are ticked; Vault-protected appears only for an administrator whose Vault mode is on and is never switched later) and First folder (the folder picker inline, which checks the folder as it is chosen: the media file count, and a plain refusal for a folder that overlaps another library’s folder, cannot be read or lacks room). A Watch folder that looks like phone or camera footage gets a hint with Add to View instead. Create saves the library with that folder, starts a scan and opens the new library’s page; Cancel creates nothing. The folder is Read-only unless the kind is one Library manages. View’s three kinds always exist and have no Add library entry. First-run setup’s Libraries step draws this same table and dialog in simple mode: Watch, Listen and Read only, Standard access only, no Vault, no Access column, no Import folder line, rows that do not open a page, and a note that Photos, personal videos, the Import folder and each library’s own settings are added after setup. View’s own settings are at Libraries > View, one page each for Photos, Personal videos and Documents, each with the same header and tabs as any library page: Folders, Access (View’s per-profile switches and Shared Library controls in place of Standard / Selected profiles) and File handling. The View tab has no Add library button. A new View folder is Managed by default, everything inside a folder is read (subfolders included, so there is no Include subfolders switch), and each source folder has one Show in Photos timeline switch that keeps its photos out of the Photos timeline; there is no separate Folders page in View. On a phone the cards, rows and counts are read-only, with a note to use a desktop or tablet to change folders. Each change saves immediately, and removing a folder keeps files on disk. First check. A folder added to a kind that looks details up is checked before Library changes anything in it: while its first files (50 by default) are identified, a Managed folder renames, moves and tags nothing and its row reads “Checking the first files…”. If more than half do not match, the folder pauses (an amber line, “Most files in this folder aren’t matching: 212 of 300. This is often the wrong kind or the wrong folder.”, and a Paused note on the library’s page) with Keep going, Change what this folder is and Remove the folder; nothing has been touched whichever is chosen. Plain kinds, the Vault, folders that already existed and first-run setup have no first check. Filing waits for the batch. Moves Library makes on its own (filing a matched file, re-filing after a kind change) join the same scheduled run as the tags, moves first, and Write now runs them at once; a file waiting for its move stays where it is and stays playable, and a file in use when its turn comes is tried again in a later run. A person’s own move in Editing Mode still happens at once. Change what this folder is. The folder row’s ”…” menu (and the paused line) offers Change what this folder is… for administrators on a desktop, except while a job runs on the folder, for Vault folders and in first-run setup. It asks “What is this folder?” with the other kinds of the folder’s own area only (never a kind of another area, never the current kind), the named-library choice where one applies, then states the impact before anything moves: how many files will move and, in a Managed folder, that they are re-filed into the new kind’s pattern in the next run; for a plain kind, that looked-up details (titles, descriptions, artwork, outside ids) are removed while the person’s own edits, progress, ratings and bookmarks stay; for a lookup kind, that the first check runs again and nothing is re-filed until it passes; that other apps pointing at the files will lose them (Managed only); and which profiles will not see the files (up to five names, then “and N others”). Change folder starts it as a folder job on the row (progress, Pause, Resume, Cancel, and a plain message if it finished with problems); Cancel sends nothing. A Read-only folder changes kind without moving anything, and a folder can always be changed back to its original kind. The Import folder is one line under the overview table, reading only “Not set” or “Set”, and opens its own page (/settings/libraries/import). Not set shows a short explanation and one “Set import folder” button; the picker opens on a suggested folder named Import beside Tuvima’s own library folder, accepted with one click. Once set, the panel shows the folder as a one-row table (Folder, Handling “Import”, Change and Remove) and then “Where imported files go”: one line per type with its managed New media folder, or “Add a managed folder to import ” with a Choose action that opens that type’s library page and highlights Add folder. When files of a type cannot be filed, the Engine’s one plain sentence appears under that line, and an offline destination reads “Folder unavailable”. First-run setup does not show it; the Import folder is set after setup. The import folder is never offered as a library folder, and a library folder cannot overlap it. Any other catalogued library (an older custom type, or a second library of a standard type) is its own row on its area’s tab of the overview so its folders can be seen and removed. Each library’s folders are one table on its Folders tab (Folder, Titles, Access, Scan, Import destination, plus a ”…” menu with Override file handling for this folder, Pause or Resume scanning, Label and Remove folder): each folder’s own icon says how Library treats it (a plain folder for Managed, full access; a folder with a lock for Read-only, with the words in its tooltip and accessible name; amber while Converting or Merging) and the menu’s Switch to Read-only or Switch to Managed switches a folder (Read-only to Managed counts the folder’s media files and asks honestly first: Tuvima will rename and reorganise the N files to its standard naming and write tags where the type allows, can take hours for a large folder with an estimate based on earlier jobs, you can keep using Tuvima meanwhile, other programs such as Plex or Jellyfin must rescan, it cannot be undone automatically but every move is logged, and nothing is deleted except exact duplicate copies; Preview first shows what would change without changing anything, Convert queues the organising job and Keep read-only changes nothing; a folder with no media files is switched after a plain question; Managed to Read-only stops any running job, undoes nothing and says renamed files keep their new names), a folder being converted shows its amber icon and reads Converting� with a progress bar, one sentence (“Organising 1,240 of 8,310 � about 2.5 h left”, “Queued behind Library Movies” or “Paused at 1,240 of 8,310”) and Pause, Resume and Cancel (Cancel asks first and keeps the folder Managed with the work done so far), and when the job ends the row says how it went (“8,290 organised, 20 could not be moved - see log”) with a Download log link and a toast with the same link; a managed folder’s menu also offers Organise files now; every folder’s menu offers Merge into… (next to Organise files now) unless it is the import destination, a job is open on it, it has already been merged, or the type has no other managed folder to receive the files: it opens a sheet with the managed folders of the type as a radio list (the import destination preselected), Copy (default: “Your folder is never changed”) or, only for a folder Tuvima manages, Move instead of copy (“each file is removed from drive E: only after its copy has been checked byte for byte; this frees space on drive E:”), the file count, size and room left on the target’s drive (the Merge button is off with a plain reason when there is not enough room), four honest lines (exact duplicates follow the “same file twice” setting; files Tuvima cannot name yet go to a From merge folder inside the target and wait in Review, where every file in that folder carries a From merge badge (decided by where the file is, so files already in Review or identified there show it too; from_merge on a review item); afterwards the folder reads “Merged into NAME on DATE”, is no longer scanned and is never removed automatically; it cannot be undone automatically but can be paused or stopped, and the log lists what remains), Preview first and Merge; the merge shows on the folder’s row as Merging… with the same progress line, Pause, Resume, Cancel (Stop merging keeps what was copied and reads “Merge stopped. Nothing was deleted. You can start it again.” after a Copy; after a Move it says the files already moved stay in the target and the rest are still in the source folder; either way the folder goes back to exactly the state it had before the merge, neither merging nor merged. Originals a merge left in the source folder are never deleted, moved or renamed by anything except the merge itself, so a stopped Copy merge on a Managed folder cannot lose them to the “same file twice” rule: with the copy and the original both present and identical, Keep one copy keeps both untouched and opens no Review item, until the person deletes them or merges the folder again as a Move (the merge itself is the only thing that removes an original, after checking its copy); starting the merge again skips files already copied and checked, adding no numbered duplicates) and Download log, and the Import panel’s hint points here; a folder added from a library page or the Add library dialog is Managed only for a kind Library normally manages, otherwise Read-only, and nothing else is asked (a folder can be merged into a managed folder later from its menu); changing a type’s naming (Tuvima standard, Keep original names, custom template) asks “Apply to existing files now” or “Only new files” when it has managed folders with files and never starts a long job silently (tags are not a naming change and never ask); folders are read-only under 840px of viewport width, so on phones and portrait tablets alike (nothing that adds, converts or merges is offered, in Settings or in first-run setup: Add Folder, Set import folder, Change, Remove, Choose, and the row menu are all hidden and cannot be focused, and so are the Advanced section (file handling, the duplicate rule and naming) and the hint that points at Merge into, and one note says “Add or change folders on a computer or tablet.”, with “You can continue and set them up later.” added in setup once a folder exists, or “You can skip this step and set up folders later.” before then) and TVs do not offer library settings; exactly one managed folder per library is the import destination (an As-is folder cannot be one) and tapping the circle on another managed folder moves it, and Files reads Named + tagged, Named (the type opted out of tags) or Not touched (read-only). A type with no managed folder shows “Add a managed folder to import or upload ” under the table. Under 840px each row becomes a stacked card (the table follows its own width; the Libraries panel stacks its type list and the folder picker stacks its drives at the same 840px, which is the one card breakpoint for folders), and only cards show the Show details button that unfolds Files. Files shows “Change in Advanced > TYPE” as visible text under its value (not in setup, which has no Advanced section); the actions column header is named Actions for assistive technology, the New media circles sit in a radio group named “Where new TYPE go”, and one live region for the whole table announces what is organising or merging. A library’s own file handling is its File handling tab; a collapsed Advanced section at the bottom still holds the server-wide duplicate rule, Embed artwork, and per-type tabs for naming (Tuvima standard, Keep original names or a validated custom template with a live example) and Update tags inside files (on by default). The global rows also hold the write-back schedule: “Write changes into files every [60] minutes” (1 to 1,440), a status line (“12 files waiting · Last run 10:00 · Next run 11:00”, “All files are up to date”, “Writing 240 of 1,200 files…” or “Writing files…” while a run is going), “N files couldn’t be written” with the list of files and reasons, “Photos, videos and PDFs in View are waiting for ExifTool” with a link to Tools, and Write now (administrators; disabled when nothing waits or a run is going); with write-back off the schedule is hidden, and phones see the status only. The editor’s Details Files card shows “Changes waiting to be written to the file · next run 11:00” or why the last write failed. View folder rows show “N files kept in Library only” beside the skipped note. Picking a folder that already holds files explains that it will be used read-only by default so other apps are not affected, with the option to let Tuvima manage it; an empty folder is managed. Personal photos & videos keeps its own flow (View root) and never creates a catalogued row; Settings opens it at Libraries > View > Photos, Personal videos or Documents. First-run setup shows a left sidebar of steps (a compact row on narrow screens) beside one stage card, and runs Name your server, Your account, Libraries (the shared Libraries screen, Continue or Skip for now), Language, Enhance your library, then All set (six sidebar entries; Recommended appears once, as the section heading). The server check has no step of its own: it runs silently after the server name is saved, shows only a short “Getting things ready” spinner, and moves on to Your account when it passes. If it fails, one plain message (the failing check’s own explanation and what to fix on the server) appears with a Retry button; storage folders are never listed or edited in setup, and Back, Next and the sidebar skip the check. “Restore a backup instead” is a small text link under the form on the first screen. Enhance your library has one button: “Skip for now” (the step is recorded as deferred and the sidebar shows Later) until at least one provider key is saved, then “Continue” (recorded as passed); the language choice is saved either way. The folder picker works like Plex’s Add Folder: drives and approved folders sit on the left (a compact row above the path bar on phones), clicking a folder opens it, and the address bar at the top is the selected folder, drawn as clickable segments (Explorer-style): clicking a segment goes there, a chevron after each segment lists the folders inside it, and clicking the empty end of the bar turns it into a text box with the full path selected, where Enter opens and checks the typed path and Esc (or leaving the box untouched) puts the segments back; a path that was typed but not entered stays in the box and keeps the confirm button off, and a path the Library cannot use is explained beside the box (the box is marked invalid and points at the message). It is shown by itself for the Import folder and the View root, and inline as the First folder section of the Add library dialog, where it has no confirm button and Create is enabled once the folder passes its checks. Only folders are listed, never files, and there are no checkmarks. Its title reads “Choose a folder” and its drive list “Pick a drive”. Its confirm button stays disabled until the address bar holds a valid folder. Read/write access, free space and file system are hidden unless there is a problem, which appears as plain-English text under the list. Arrow keys move the highlight, Enter opens the highlighted folder and Backspace goes up a level. Tuvima’s own library and import folders are never listed in the picker. Notices under the list reserve their space so the list never jumps. Home with no libraries shows one ‘Add a library’ panel and no Recently Added. First-run setup begins with Name your server (friendly name plus the .local network name stored as preferred_server_name), then the server checks. Folder validation is repeated at confirmation and commit. A folder is either managed (Tuvima may move, rename and tag its files) or used read-only (never touched, never a destination); the first managed folder added becomes the type’s destination and passes to the earliest-added remaining managed folder if it is removed. Other managed folders are tidied in place only: a file in a managed folder that is not marked New media is renamed to its standard name inside that same folder and is never moved into the New media folder, another folder or another drive (they keep what they have and receive nothing new; only files from the Import folder or staging are filed into New media), and a folder left half-organised by a cancelled conversion is tidied the same way over time. A name that differs only in letter case is renamed through a temporary name on every system and is never mistaken for a duplicate of itself, and a file is only removed as a duplicate after Tuvima has checked that the two names are different files. Per-library naming and tag writing and the server-wide duplicate rule (keep one, or keep both) are enforced in ingestion; populated View roots cannot be relocated through settings. The folder picker never lists Tuvima’s own folders (its data, configuration, logs, backups and keys, and its managed library, import and View folders), nor Windows hidden or system folders; browsing one directly or typing a path into one is refused with a plain message. When the server cannot be reached the picker says “Could not reach the server” with a Retry button, and only a genuinely empty list says there are no folders to browse.

Libraries settings and readable View storage

Libraries has no scope filter row and no separate View settings page; the View storage root is chosen on the Libraries screen. Adding a folder saves when the person chooses Add in the folder picker; removing a folder asks for confirmation and keeps files. Names and custom templates use focused Apply dialogs, while other settings save individually with conflict detection. There is no page-wide Save. Breadcrumbs remain shell-owned.

New Personal Spaces use View/Profiles/<stable-readable-label>/Timeline and named managed folders beneath Folders. Persisted label reservations survive profile deletion so another profile cannot silently inherit the former folder. Display-name changes do not rename storage. View/Shared is the server household’s Shared Library beside Profiles (every other household’s lives under View/Shared/Households/<id>, and people only ever see their own household’s); accepted contributions use verified transfer before managed-original cleanup. Existing obsolete View source state fails closed rather than moving originals or using compatibility paths. View source additions queue reconciliation in its dedicated hosted worker.

Setup, Operations, and View storage (September 2026)

Setup offers an optional 4–12 digit profile PIN alongside the administrator password, live password validation and reveal controls, and readable recovery codes. Media locations can be explicitly deferred and configured later through Libraries. Reloading setup must render fetched stage data after asynchronous initialization.

Setup has six steps: Name your server, Your account, Libraries, Language, Enhance your library, All set. The first step has no Back button, and its restore panel shows the file, when it was created and its entry count only. All set lists Your account, Libraries and Enhance your library (a deferred one offers a Set up link) and has no row for the silent server check unless that check is blocked; while something needs attention its subtitle says so. The server check (the preflight workflow step) runs silently after the name is saved and is hidden in the Dashboard; a failure shows one plain message with Retry. Restore a backup is on the first screen. Libraries is optional (Skip for now). Enhance your library has one button: Skip for now when nothing is entered, otherwise Continue. Tuvima’s own library folder is created automatically and never asked about. When a Required tool such as FFmpeg is missing and the Library can fetch it for this install, the silent server check downloads it by itself and shows “Getting your media tools” with the download’s progress (Continue stays available), then moves on when it is ready. If the download fails, or the Library cannot fetch the tool for this install, it shows “A few things to install” with each missing tool, what it affects, the plain reason and how to fix it for this install, a Check again button (which tries the download again) and Continue (setup never blocks on a tool). All set shows a missing or downloading Required tool as one short bubble (warning when missing, info while downloading) with what it holds back and a Next step, and names its rows Server, Your Account, Libraries and Enhance your library. An Optional tool such as Tesseract never stops setup and appears on All set as one quiet line with no warning colour (“Scanned documents won’t be readable until Tesseract is installed.”). Settings > Tools and requirements (/settings/tools) lists every tool and every Local AI model with the same wording and a state of Ready, Missing, Optional, Problem, Downloading or Installer ready; for anything not ready it shows what it affects, how to fix it and how many files are waiting for it, with Check again, Locate it (opens the folder picker on the folder that holds FFmpeg or Tesseract; the folder must contain the tool or the Library says so in one plain sentence), Download or Download again, Cancel while downloading, and Load and Unload for a ready model. The Local AI page keeps only AI settings (its Runtime page links to Tools and requirements for model files). Server administrators (nobody else, and never on a phone) see an attention banner above the breadcrumb on every Settings page: separate rounded bubbles, at most three, most urgent first, each with an icon, one sentence, one button and an X. A missing Required tool reads “FFmpeg is missing. Videos, music and audiobooks wait until FFmpeg is available.” with Install for me (or See tools when the Library cannot install it; red only when files are held back; a running download reads “Downloading FFmpeg 30%” with no button and no X; not shown on Tools and requirements itself), and Needs Review reads “3 items need review” with Review, which opens the Needs Review page (/settings/review: the whole list, a search box and every row action, for server administrators only; Recently Added no longer holds a review list). The X is remembered per profile and the line returns only when something new needs attention (more review items, another missing tool). The Settings menu shades Needs Review amber with its count and Local AI red with “Off” while its tools or libraries are missing (Tools and requirements is never shaded), and the shading stays after a line is dismissed. Local AI pages carry a permanent notice that cannot be dismissed while it is off (“Local AI is switched off until the tools and libraries it needs are downloaded.” with Download), and Network carries “Remote access is off, so the Library only works at home.” with Set up while remote access is not set up.

Operations and the navbar consume the same Engine queue progress snapshot, including outstanding identity and enrichment work. Live media selection includes identity-job updates, ranks active/recent groups before limiting, and preserves server order on refresh. Comic covers remain issue-scoped. TV and comic ingestion counts never display a provider denominator. Review counts remain visible throughout Settings. Processing details is removed.

The live ingestion panel on Library and Ingestion shows one compact status card: a progress bar averages every pipeline stage against the run’s total, with the line “N of M ready · current step · time left”. “Check folders for changes” sits in the ⋯ menu; folders are watched automatically, and the action forces a full re-check for network drives or changes made while Tuvima was off. Recently Added lists each item as soon as it is added, even while an import is running. In Settings, content scrolls within the section shell while the Settings menu stays fixed.

Now and Added on Library and Ingestion (October 2026). Under the status card, Now shows 5 to 10 of the items being worked on, most recently active first, with the Engine’s total as its count line (“212 items being added”). A row stays on screen at least 3 seconds and keeps its place while it is worked on; when an item finishes and has had its 3 seconds, the most recently active waiting item takes its place, so the list rotates as items finish without jumping. Every row has the same five columns in the same order on every media type: Title, Type, Step, Status, Details. Status shows its words for every state including Ready; a row that is not yet Ready says what it is waiting for (“Waiting for matching”, “Waiting for matching and its show”, “Waiting for its album and artwork”, “Waiting for artwork”), in the same words in its tooltip and the details drawer. A row is Ready only by the one Ready rule (matched, placed in its show or album, artwork settled), and Added counts it on the day it first became Ready. Details always shows five symbols (artwork, text, people, links, lyrics or subtitles); a symbol that does not apply to the type is a dim dash in its slot (“Doesn’t apply to books”), and every tooltip reads the same as the symbol’s accessible name. On a phone each row is a stacked list item with the same facts in the same order. Photos and personal videos are never rows: Now shows one count line (“2,300 photos in progress”). Under it, Added summarises what was fully added by type for each of the last few days (“Today: 212 movies, 140 episodes, 31 books”); each count and View all open the Activity log on its Added filter. There are no batches anywhere on this page: no batch history, no Open batch, no run links.

Waiting for media tools (October 2026). A video or audio file added while FFmpeg is missing is never failed. It is registered and identified like any other file, its technical inspection is held (media_inspection_holds), and Live Ingestion and Recently Added show it as Waiting for media tools with an hourglass icon instead of its usual status (Needs review and Failed still outrank it). While any visible item is waiting, a single notice reads “Some files are waiting for media tools. See Tools and requirements.” and links to /settings/tools. Whenever a tools check finds FFmpeg (at start-up, or when Check again is pressed) the Engine finishes the held files one at a time in the background, without a restart or a re-scan. A file that FFmpeg is installed for but still cannot read goes to Needs Review as “This file couldn’t be read. It may be damaged or incomplete.” (MediaInspectionFailed) and every other file keeps moving.

View uses the library page header and the Folders, Access and File handling tabs (Organization and File handling cards, Sharing & Access, and for Documents the text, organisation and rules panels). The configurable View library root contains Shared and Profiles; Shared Library is an authorization scope distinct from the physical base. Logical personal-space/source registration never creates directories. Uploads and accepted transfers create destination folders only at actual write time. Merely visiting View or adding a profile must leave unused storage empty.

The install banner records dismissal in browser/site local storage. Subsequent install events and navigation respect it.

View household section (October 2026)

The View scope pickers (Photos, Places) list your own space first, then a Household group naming each other person in the household, then the Shared Library. Another member’s space is read only: no Add media, no editing, hidden photos stay hidden, and sending one of their photos to the Shared Library always makes a copy. People in other households never appear. Everyone can open and send to their household’s Shared Library by default; a child profile can send only after a household administrator allows it. Household administrators (and server administrators) review contributions, and there is no curator role. A reviewer whose own Documents setting is off never learns that a document was sent: a contribution that holds only documents is not listed (and opening it by link is not found), a mixed one lists only its other items (and the log lines for them) with the single line “Includes items you cannot view” and no number, and approving, declining or retrying a contribution that holds documents is refused (the Dashboard does not offer those buttons). The same switch keeps documents out of Galleries (their items, counts and covers, including shared ones), the favourite, hide, archive and trash actions, the tag type-ahead and uploads (a document upload is refused before anything is stored).

View > Documents (/view/documents, tab beside Galleries) browses, searches and opens the documents in View. It is shown only to profiles allowed to see Documents (on for everyone except child profiles until an administrator turns it on in Settings > Libraries > View > Who can see Documents); the Engine list, open, download and text actions follow the same switch, and a profile without it sees one plain “Documents are not available for this profile” page. The scope picker matches the other View pages. Cards (grid) and rows (list) show a first-page picture for PDFs and images or a typed tile with the extension for Word, spreadsheet, slide and text files, the title, the document date (or “Added” and the day it was added), kind chips (PDF, Word, Spreadsheet, Slides, Text, Scan, Protected) the correspondent and document type as chips, and up to three tags as read-only chips. Searching waits 300 ms after typing, asks the Engine’s contents index (title, file name, words, tags) for documents only and shows the matching words highlighted under the title; document words appear nowhere else: never in Home, global Search or Recommendations. Opening a PDF shows a full-window viewer (PDF.js, bundled locally) with page navigation, zoom, find (the search words are already entered) and Download original; Word, spreadsheet, slide and text files show their extracted words in a readable panel with Download original. Small notes under the title say how the words were read (Text read by OCR; password-protected so not searchable; very long so only the start is searchable; no searchable words found); a missing word layer on a photo is never shown as an error. On phones the scope and layout choices move into a bottom sheet and the list is one column; televisions can browse and open but have no Select mode.

View on phones and touch. Nothing in View depends on drag or hover on a touch device. The kind tabs under the Photos search (and on the Artwork Library) are one horizontal row of 44px chips that scrolls sideways, fades at the edge where more chips wait and brings the active chip into view; they never force the page wider than the screen. Photos are picked with Select in the page header (shown on touch devices only): tiles stop opening the viewer and become tap-to-select toggles with a checkmark and a pressed state, Space toggles the focused tile, and there is no long-press. A bar fixed above the dock (clear of the audio bar, with the side safe areas as padding) shows the count and Add to gallery, Share (the same Shared Library submission as on desktop), Download and Cancel; Favorite, Archive and Trash move into its three-dot menu, and Done or Cancel leaves Select mode and clears the selection. Touch tiles are never draggable (drag-to-gallery stays a mouse gesture) and the date heading’s select-all control stays visible. Phones may add the selection to an existing Gallery but never offer New Gallery or open the Gallery editor. Artwork Library cards keep their actions (Open, Manage usage) behind a three-dot row menu: a bottom sheet on phones, the shared popover elsewhere, with a visible focus ring and the card title and facts always shown on touch. In the photo lightbox every control is 44px, the arrows stay, and a quick horizontal swipe on a fitted photo moves to the next or previous photo (a zoomed photo pans instead, a pinch zooms, and videos are not swiped). Map zoom buttons are 44px and the attribution button sits clear of the dock on phones; the geolocate control is untouched. The Documents viewer is outside these rules.

Organising documents (tags, correspondents, types, dates, custom fields). Tags, correspondents, document types and custom fields are one list per install, shared by photos, videos and documents (tags) and by documents (the rest). A person sees only the names used on items they can open plus ones they created and have not used yet, and the counts are their own; a name that only appears on someone else’s private item is never listed, suggested or accepted by its id. Only the person who made a name, a server administrator, or a household administrator for names made in their own household can rename or delete it, and deleting never removes a document. A duplicate name in any letter case is refused with a plain message. On the Documents page a left filter rail (inside the “View options” sheet on phones) filters by tags (every chosen tag must be present), correspondent, type, a date range and choice or yes/no custom fields; each change reloads the list, counts come from the Engine, and “Clear all” resets them. On a pointer screen in the person’s own space each card has an “Edit details” button and the open document has an “Edit details” action; both open one small panel over the page with title, tags, correspondent, type, date, archive number, notes and the custom fields, saved with one Save. Phones and televisions only read and filter; they never open the editor. A document’s given date wins over the date in its file, then the day it was added. New documents wait in the Inbox (filing state inbox) and documents that existed before filing count as filed. See the Inbox paragraph below. The lists are managed in Settings > Libraries > View > Organising documents. The View shell loads the View settings once and the Documents page waits for it, so the two no longer load them twice. An empty library says “Documents added to View sources or the Import folder appear here.” with the Add media action.

Saved views, bulk editing, sorting and list export (Documents). At the top of the Documents filter rail sit the person’s Saved views: each is a shelf made from the filters they chose (tags where every one must be present, correspondent, type, a date range, choice or yes/no custom fields, the Inbox, and the words typed in the search box saved as “words in the document contain”). Save this view appears whenever the list has filters or search words and no saved view is applied (leave the applied view first: it is not copied into the new one) and the Trash is not showing; it asks for a name, then the view appears in the list. Tapping a saved view starts the list from it (tap it again to leave it); the other filters then narrow it further, so a person can open “Tax this month” and still pick one correspondent. Each row has a menu with Rename and Delete; deleting a view never touches the documents. A saved view is an ordinary Smart Gallery, so it also appears in Galleries for profiles that may use Documents; no second kind of shelf exists. It is always private: Gallery sharing refuses it (the Engine answers 403 “A saved Documents view is private and cannot be shared.”) because its rule can hold search words and it lists private documents. The date range can be a fixed span or a relative one (Last 7 days, Last 30 days, Last 90 days, This month, This year, Last year); a relative range is saved as the range and worked out again every time the view opens, so “Last 30 days” is always the last 30 days. Saved views are offered only in the person’s own space and never on televisions, and a profile that may not use Documents neither sees nor can create one (the Engine hides and refuses them, even if made before Documents was turned off). A saved view is never offered as a Collection source. The Gallery rule editor cannot show a saved view’s custom field conditions, so a view with custom fields is changed by saving it again from the Documents page.

Select mode and bulk editing (Documents). On a computer or tablet the Documents header has Select; it works in all three lists (All documents, Inbox, Trash). Cards show a checkbox, a click or tap on a card toggles it, and Shift and click selects every document between the last one picked and the one clicked. On a phone there is no Select button: pressing and holding a document for half a second starts selecting (the tap that ends the hold does not open the document), further taps add or remove documents, and Done selecting leaves select mode. Televisions have no select mode. Picking at least one document opens the selection bar (“3 selected”) with Organise (Add tags, Remove tags, Set correspondent, Set type, Set date, Mark filed), Favorite, Trash and a clear button; in the Trash view the bar offers Restore instead. Add tags, set correspondent or type and set date ask one small question first (a tag name or several, a correspondent or type name, a date, or “clear it instead”) and then apply to the whole selection; a new tag, correspondent or type name is added to the global lists like anywhere else. Mark filed files documents waiting in the Inbox exactly as they are, without taking their suggestions. Moving to the trash and restoring use the existing trash lifecycle and never delete a file. One call changes at most 500 documents (a longer selection is sent in batches and reported once). Afterwards a plain notice says what happened (“Updated all 12 documents.” or “Updated 9 of 12 documents. The rest were left as they were.”) and lists each reason with a count, for example “2 left as they were. In the Shared Library: only filing rules can change it.” or “1 left as it was. This document is not available.” Every document is checked on its own: one that belongs to someone else, is outside the person’s libraries, is not a document, or is in the Shared Library (only filing rules change those) is skipped with its reason and left exactly as it was, and one that fails never stops or half-changes the others. A value a person sets in bulk is recorded as the person’s, so an auto-filing rule never replaces it. Removing a tag that a rule added is not remembered: the rule can add it again the next time it runs.

Sorting the Documents list. The filter rail has Sort by: Newest date first (the default), Date added, Document date, Title (A to Z) and Correspondent (A to Z, documents without one last). The choice is remembered for the person’s profile in profile_view_preferences, so every device opens in the same order; if it cannot be saved the sort still applies for now and a small notice says so. A sorted list pages by position, so “Load more” never repeats or skips a document.

Exporting the list (CSV). Export list (CSV) at the bottom of the rail downloads the list exactly as filtered (search, filters, saved view and sort): title, file name, document date, correspondent, type, tags, archive number, one column per custom field the person can see, and the day it was added. It lists only documents the person can see, and never the words inside them or the notes. The file is UTF-8 with a byte-order mark so spreadsheets read accents correctly, one row per document with CRLF line ends, and values that begin with =, +, -, @, a tab or a carriage return get a single quote in front so they are read as text, never as a formula. At most 10,000 rows are exported; a longer list is cut and a plain notice says “Only the first 10,000 documents were exported. Narrow the list with filters or a saved view to export the rest.” There is no scheduled export and no ZIP of the files.

Documents Inbox and auto-filing rules. The first choice in the Documents filter rail is Inbox with a count (“12 to file”); next is All documents, which stays the default, and in the person’s own space a third choice, Trash, lists documents moved to the trash (Select works in all three). The View menu’s Documents tab shows the person’s own Inbox count as a badge only when it is above zero. In Inbox mode each result is an Inbox card: thumbnail, title, detected date (“Detected …”, or “File date …” when no date was found in the words and the file’s time is shown instead), and chips for the correspondent, type, suggested tags and, when a custom field named Amount exists, the suggested amount. A value a rule already filled in is shown instead of the suggestion. File accepts the card in one tap (Enter does the same on a computer when the card is focused) and sends exactly what the card shows (the suggestions as displayed, minus any cleared or switched off, plus typed values), so a suggestion that arrives while the card is open is never filed unseen; tapping the correspondent or type chip opens a small dialog to pick or type another name or clear it, tapping a tag chip switches it off or on, and “Add tag” adds one; File without changes only marks it filed. Suggestions are shown, never applied silently, except by a rule the person made. Filing works on phones in the person’s own space; television and other people’s spaces are read-only. Documents in the Shared Library show in its Inbox to everyone who can open it. A household administrator or the server administrator files them with the same File and File without changes actions, so a Shared Inbox can be emptied; everyone else, including child profiles, sees those cards read-only with the note “Filed by a household administrator”. Bulk editing skips Shared documents with a reason on each, except Mark filed, which administrators can use on them. An empty Inbox says “Your Inbox is empty.” A document is filed on arrival only when a matching rule files automatically; other matching rules leave it in the Inbox with their values filled in. Rules are made on the Auto-filing rules page (/view/documents/rules, the button in the Documents header on computers and tablets; everyone with Documents reaches their own, phones and tablets see a read-only list with “Edit on a computer”, televisions get a plain “not available here” page) and the same list also sits in Settings > Libraries > View for administrators: a plain list (name, a sentence saying what it does, on/off switch, up and down buttons for the running order, edit, delete), “Add rule” and “Apply rules to existing documents”, with an editor dialog (name, enabled, all/any, conditions: words contain, file name contains, folder contains, came from a source, file kind; actions: add tag, set correspondent, set type, set field, file automatically; “Test on my documents” lists up to ten matches). On phones and tablets the rule list is read-only with “Edit on a computer”. Rules never replace a value a person set, including one they cleared. Document words, notes and amounts appear only on the Documents page, never in Home, global Search or Recommendations. Home’s Recently Added lists photos and videos from View only: a document’s title, file name or id never appears there, for anyone, and Places and People discovery skip documents too. See How documents are filed.

Photos and Personal videos: Import, filing, duplicates and Tidy (October 2026)

Photos and Personal videos have one Import area, outside every library folder, shown with its path, how many files are waiting, Scan now and Add files on the library’s Folders tab. New files are filed as Year/Year-Month-Day/original name by the day they were taken; the layout is editable on File handling and applies to files filed later. Companion files (RAW with JPEG and sidecar, Live Photo with video) stay together under one base name. An exact copy is skipped and counted (“3 already in your library”); a file that cannot be used is refused with a plain reason, listed on the library’s Activity tab (counts and reasons only, never file names for a private library), kept in the Rejected area for 30 days and then removed. Folders tab rows for managed folders offer Tidy this folder by date (a confirmation says how many files are renamed in place and that new files wait until it finishes) and a nightly schedule. File handling shows Duplicates: groups of exact copies in the Shared Library or the administrator’s own library, with Keep this one (the others go to Trash) and Leave them. The Needs review link on a library opens Needs Review narrowed to that library.

View Trash and Empty Trash

Photos’ Trash filter and Documents’ Trash (in the person’s own space only) start with a header: “Items in Trash stay on your disk until you empty Trash.”, then the size line (“128 items · 4.2 GB”) on every device. On a computer (EditorDeviceRule.CanEdit) with something in Trash, a red Empty Trash… button sits beside it. On a phone or tablet the header shows “Empty Trash on a computer.” instead, with no button. Empty Trash empties the whole Trash, photos and documents together, one Trash per Personal Space, and its confirmation dialog lists photos, videos and documents separately. Empty Trash appears only in the person’s own space (Mine), so Shared Library and other people’s spaces never show it. Items in a read-only (linked) folder never show Move to Trash, and a mixed selection says how many were left out. Phones keep Move to Trash and Restore.

Settings

Settings opens at /settings with one sidebar. The Personal group is for everyone and opens on the person’s Overview (/settings/overview, also where the bare /settings address and the profile menu’s My profile go); it lists Overview (with Activity under it), Profiles (administrators only), Preferences (Playback, Listening, Reading) and Security (Devices), in that order. Server, Manage and Developer follow for the people allowed to see them. Old addresses redirect: /settings/profile and /settings/household go to Profiles and /settings/account goes to Security. Devices is a page under Security, not a Server page: /settings/devices, /settings/apps and /settings/network/apps no longer exist and do not redirect.

Settings > Overview. /settings/overview is the person’s own page and the first Personal entry (a Kids profile never reaches Settings, so it has no Overview). It shows the signed-in profile only: a header with their avatar, name, Joined {Month Year}, Edit profile and a small phone icon (Apps) that opens the Apps page; then a row of counts (In progress, Finished, and the time watched, read and listened in hours, each left out when the Engine has no total for it rather than shown as zero). The counts are the person’s lifetime totals from GET /api/v1/activity/summary, not a sample of their latest items; then Recent activity, a full-width strip and the first content row; then Your taste, a one-line summary of the top genres and moods with a See your taste link (/settings/overview/taste). There is no Manage profiles button, no separate My list row and no star ratings or likes on the page. Edit profile opens the profile editor sheet in its self-edit form: a person changes only their own name and picture (a colour or a photo), saved through the Engine’s self-service routes; the Kids switch, content limit, PIN and icons stay with administrators on the person’s page in Profiles. The page works on a phone: counts in two columns, buttons full width and the strip scrolling sideways. Photos (View) are not counted or shown. Page: OverviewPage; strip: RecentActivityStrip and RecentActivityTile; wording and marks: PersonalActivityPresentation.

Settings > Overview > Recent activity. Every tile is the same height and keeps its natural width by shape (portrait for books and comics, landscape for episodes and movies, square for music and audiobooks). Each shows its artwork, a thin progress bar along the bottom for a watched, read or listened item part way through (the shared AppArtworkProgress), a check instead of the bar once it is finished, and no bar for music or My list. Under it is one non-wrapping caption that starts with a verb so it cannot be read as the length of the item: Watched 52 m, Read 1 h 20 m, Listened 3 h 12 m (audiobooks), Played 1 h 05 m (music) or Added to My list. Titles are not printed. Music is one music session tile, a square collage of up to nine album covers (a different nine on each load) whose hover card says how many songs from how many albums. On a screen that can hover, hovering or focusing a tile opens a card built on AppPopover with a larger picture, the title, the episode or chapter, when it happened and how long; on a phone or any screen without hover there is no card and a tap opens the item (a music session, or an item whose record no longer points at anything, opens the Activity page, /settings/overview/activity). See all opens the Activity page too. With nothing yet the strip says Nothing yet — what you watch, read and listen to shows up here. The pictures are private to the person, so the browser loads them from the Dashboard route /engine-activity-artwork/{key}, which asks the Engine as the signed-in person.

Settings > Overview > Activity. /settings/overview/activity (the first child of Overview in the menu, before Taste; /my-activity is the same page outside Settings for a Kids profile and quick access, always the signed-in person’s own activity and always in the normal app layout) is the one list of everything the person watched, listened to, read and added to My list, newest first. Each row shows the time, the picture, the title with its episode (S2 E4 · Fear) or artist, what happened (Watched, Listened, Read, Played for a music session, Added to My list), how long, how far (the percent reached), how it ended (Finished or Stopped) and the device; a tap opens the item. No IP addresses, sign-in details, ratings or likes appear. Above the list: a search box (title and device; in a scope that includes other people also the person), type (Watched, Listened, Read, Added to My list), a from and to date, outcome (Any, Finished, Not finished), device, and the grouping By day, By week, By month or By title (the shared AppTimelineGroupingControl, extended with options), with Show every session (on in By title only) turning the title groups into a flat list. The filters show as removable chips (AppActiveFilterSummary); on a phone they sit behind one Filters button in a bottom sheet (BrowseFilterSheet). By title gives one entry per title that expands to its attempts, for example Started Sep 6, 30 m, stopped at 31% · Sep 9, 12 m, stopped at 43% · Sep 13, finished, 1 h 36 m in total. A music session is one row with its collage and a Show songs button that asks the Engine for that session’s songs. A slim date rail beside the list (AppTimelineNavigator, the one the View photos pages use) shows years opening to months with counts; it follows the filters and the scope, jumping to a period restarts the list at the end of that period (a chip From Sep 2026 back clears it), and on a phone it becomes the Jump to period picker. Load more pages the list with the Engine’s cursor, and the next page also loads by itself as the person scrolls near the end (the button stays for keyboards, remotes and screen readers; after a failed page it stops loading by itself until the person presses Load more again). Export downloads a CSV of exactly the current filters through the Dashboard route /engine-activity-export, which passes on only the filters (never paging or grouping). An administrator also gets a Scope control: a server administrator chooses Me, Everyone, a household or one person; a household administrator chooses Me, a person in their household or the household. Other scopes add a Person column, and only a server administrator sees Export for them. The Engine decides what any scope may show, logs a server administrator opening someone else’s activity, and asks for the administrator PIN when one is set (the page then shows the PIN pad, and asks again after it is entered). A link such as View activity on a person’s page opens the page with ?scope=profile:{id}; a scope the viewer could not choose is ignored. Only a server administrator sees the … menu with Delete history…: choose whose history and a date, see how many entries would go, type DELETE and confirm; members and household administrators have no delete control. Page: ActivityPage (rows: ActivityRow); wording and date maths: ActivityListPresentation.

Settings > Overview > Taste. /settings/overview/taste (a child of Overview in the Personal group; the breadcrumb reads Personal, Overview, Taste) shows what the Library has learned about a person’s taste in three plain groups, Genres, Moods and Eras, each value a chip. This layout is a placeholder until the taste design lands; who sees what will not change with it. On your own taste each chip has an X that hides it, and each group has an Add control (free text, with known values offered as small chips that narrow as you type; an era is a decade such as 1990s). A value you typed shows Added by you. Nothing you do rewrites what the Library learned: removals and additions are kept separately and applied when taste is shown, and the Overview’s one-line Your taste summary follows them. A summary, the media mix and when it was last worked out sit above the groups. Other people’s taste is always read-only (no X, no Add). A Scope filter appears for administrators only: a server administrator can pick Me, Everyone, a household or a person; a household administrator can pick Me, their own household or a person in it. It only offers choices; the Engine decides what each person may see and refuses the rest, and opening someone else’s taste is logged (taste.viewed_others, once per 30 minutes per actor and scope). A member sees no filter and only their own taste. The page works on a phone. Page: OverviewTastePage; Engine actions: /api/v1/taste.

Settings > Overview > Apps. /settings/overview/apps (no menu row; the breadcrumb reads Personal, Overview, Apps) is what a person needs to connect a phone or TV, and every signed-in person sees it. Get the app lists a button for each store that has a link in app_store_links (app_store, google_play, roku) in config/ui/global.json; all three ship blank, so nothing shows until an app is published. Server address shows At home and, once a secure outside address is set up, Away from home, each with Copy (from GET /network/app-addresses; an administrator without an outside address gets a link to Remote Access, anyone else is told to ask the server administrator). The QR code holds exactly one address and nothing else, never a key or a sign-in: the outside address when it is set, otherwise the one at home, with a label saying which. Scanning it fills in the app’s server field; the person still signs in as usual.

Settings > Profiles. Profiles is an editing page for administrators (a server administrator, or a household administrator for their own household); a member never sees it in the menu, and opening /settings/profiles as a member lands on their first available page. A member changes their own name, picture and details from Edit profile on their Overview and looks after sign-in under Security. The page is the people list and nothing else: no card or stats for the open profile (those belong to the Overview). One 56 px row per person shows their avatar, name, their sign-in email in a small line under the name (or No sign-in; read-only here, because a server administrator attaches and removes sign-ins in Users and Sign-in), badges (You, Household administrator, Server administrator, Kids, PIN) and an Edit button that opens that person’s own page at /settings/profiles/{profileId}. People are grouped under their household’s name; a household administrator sees only their own household, and a server administrator sees every household, their own first. The last row of each group is Add profile (it opens the editor sheet and adds to that group’s household) while the household has fewer than eight people; at eight the Engine refuses and its sentence is shown as it is. A server administrator also gets Add household, which opens the Households page (under Users and Sign-in) with the name box ready. Each group’s header carries Export this household (computer or tablet only, never on a phone; a household administrator sees it for their own household, a server administrator for every one) with the line “Download a file with this household’s profiles, their sign-ins, progress, bookmarks and favourites. Anyone with this file can sign in as these people. Keep it somewhere safe.” It asks to confirm it’s you, then downloads a .zip with a short busy state; a failure is one plain sentence (the Engine’s own when it gives one, otherwise “The file couldn’t be made. Try again.”, or “The file couldn’t be saved. Try again.” when the browser refuses it). There is no “Users in your household” panel: household administrators look after profiles, not users. There is no Switch action anywhere on this page: switching profile happens only in the top-bar profile menu. Kids profiles never reach Settings: the links are hidden, and a typed address or old link to any /settings page sends a Kids profile to Home. The picker’s Manage profiles button and the account menu’s Manage profiles item open this page for administrators (a television keeps managing in place on the picker, which also still honours ?manage=1 and ?add=1).

Settings > Users and Sign-in > Households. /settings/access/households is the Households page, a child of Users and Sign-in in the Manage group and open to server administrators only (a household administrator sees neither the menu row nor the page). The old /settings/profiles/households address was retired with no redirect. It lists every household with its name and how many people and sign-ins it holds, and offers Add household (a name), Rename and Remove on each. Remove asks first; the Engine refuses while the household still has people, sign-ins or shared photos, and its plain sentence is shown as it is. While the server administrator’s own sign-in has no email and password (or passkey), the Engine refuses a second household: the page shows its sentence (Set an email and password for your own sign-in first. A Library with several households must not be open to anyone who reaches it.) with a Set an email and password button that opens Settings > Security. With one household the Library may still be used without passwords.

Settings > Playback. Playback is about watching only: How you watch. shows Autoplay next episode, Resume where you left off, and Skip back and Skip forward, each saved as soon as it changes, and nothing the player does not honour (there is no default-speed row). Below those, the Subtitles & audio group (the #subtitles anchor, which Settings > Profiles > a person > Subtitles opens) sets Audio language and Subtitle language (a common-language list; a saved language that is not in it stays selectable) and Show subtitles (Auto (only when audio is not my language), Always or Off), and the Subtitle appearance card shows a dark sample frame with one subtitle line that follows Text size (Small, Medium or Large) and the Background switch as they change; subtitle position and style are not shown. An administrator can open /settings/playback?profile={id} to edit another household profile; the page then reads How (name) watches. with that profile’s avatar, a Settings > Profiles > name > Playback breadcrumb and a link back to the profile, and it shows “You can’t change this person’s settings.” with no controls when the Engine refuses. If the Engine cannot be reached when the page opens, it shows “Playback settings could not be loaded.” with a Retry button and no controls (it never shows defaults that a change could save over the profile’s real choices). Each change re-reads the profile’s current settings and changes only that one field before saving, so a change made on another device in the meantime is kept; if that re-read fails, the page shows the error and saves nothing.

Settings > Listening. How you listen. groups Skip (Skip back 10/15/30 s, Skip forward 15/30/60 s, Resume rewind 0/5/10/15/30 s) and Sleep timer (Default length from the profile’s sleep timer lengths, or Off, and an Offer end of chapter switch), each saved as soon as it changes; it has no speed, skip-silence, crossfade or output rows. Administrators open /settings/listening?profile={id} for another household profile with the same heading, breadcrumb, back link and refusal message as the Playback page. It loads and saves the same way as Playback: an unreachable Engine shows an error with Retry and no controls, and each change is merged into a fresh read of the profile’s settings.

Settings > Reading. How you read. sets the profile’s reading defaults, with a live sample paragraph at the top that follows the chosen theme, typeface, text size and line spacing, then Look (Theme: Light, Sepia, Dark or Match app; Typeface: Book’s own, Serif or Sans; Text size 12 to 32 px; Line spacing 1.2 to 2.4) and Layout (Page width: Narrow, Standard or Wide; Layout: Paginated or Scrolled), each saved as soon as it changes. Administrators open /settings/reading?profile={id} for another household profile with the same heading (How (name) reads.), breadcrumb, back link and refusal message as the Listening page, and the same load error with Retry and merge-on-save behaviour.

Settings > Security. /settings/security is short row lists, not a wall of cards. Account details starts with Add a password (status “Anyone who can reach Tuvima can use this account until you do”, opening the Secure your account form) only while the account works only on this computer; the Security entry in the Settings navigation carries an attention dot in that same state until the person chooses Not now on the profile menu card; after that the dot is gone and the page starts with a quiet note (“Your account has no password, so it only works at home. Add one any time below.”). The Secure your account form explains that a password is for using the Library away from home. Account details then shows Password (Set, or “Not set · works on this computer only”), Email (the address, or “None · only needed away from home”) and, only once a password exists, Extra protection (Off, Passkey added, Two-step codes on, or both). Everyone who is signed in gets an Access list with Sign out everywhere else (asks to confirm, then signs out every other session of their own account and never the one in use, so a member who loses a phone can end its session without an administrator); Devices is a child of Security in the Settings menu (/settings/security/devices), open to everyone who is signed in except Kids profiles; this page carries no Devices row and no paired-devices table. Each row opens a sheet (a bottom sheet on phones, a dialog from 641 px): Password opens the change-password form, or the Secure your account form when there is no password yet; Email is read-only with “Ask an administrator to change it”; Extra protection stacks Passkeys, Two-step codes, Linked sign-ins (only when a provider is set up) and Recovery codes. A third list, Your photos, has one row, Who viewed your photos (“Server administrators who opened them, newest first”), for everyone who is signed in; it opens a read-only sheet with a Who / Opened / When table (stacked cards on phones), newest first, with times in UTC, 25 at a time with Show more up to the latest 100 (a failed Show more says Couldn’t load more and keeps the list). There are no delete or clear controls. The Engine answers only about the signed-in person’s own photos (a household administrator also sees views of the household’s Shared Library, never another person’s personal-space views). With nothing recorded the sheet says Nobody else has looked at your photos; if the list cannot be loaded it says so and shows no entries.

Settings > Users and Sign-in > Users. A user is a sign-in: an email with its password, passkeys and two-step codes, attached to one profile. The page lists one row per user: the email, the profile it opens, the household, and a small badge only when it matters (No password, Two-step on, Disabled). There is no access editing here: what a person may see and do (administrator roles, libraries, Read, Watch, Listen and View, content limits) is set on their profile, under Settings > Profiles. The page is for server administrators only; everyone else sees “Administrator access is required to manage users.” and nothing to manage, and the handlers refuse as well as the buttons. A row’s ”…” menu offers Change email, Set temporary password, Turn off two-step codes (only when the user has them), Export (only for a user with an email) and Delete sign-in. The toolbar offers Import a user and Add a sign-in. Add a sign-in opens the side drawer: choose A profile without a sign-in (listed with its household) or A new person (a name, a household that already exists or A new household with its name, and a Kids profile tick that starts off), an email, and how they sign in the first time, Send an invitation (a code, a link and a QR code, shown once) or Set a temporary password (shown once). When the Engine refuses (a second household while a server administrator has no password, eight profiles in a household, a profile that already has a sign-in, an email already in use) its sentence is shown as it is and the form stays open. Change email saves and says “Their profile and everything in it are unchanged.” Management is computer or tablet only; a phone shows the read-only list (“Manage on a computer or tablet.”).

Deleting a sign-in. Deleting a user removes the sign-in only; the profile and everything in it stay. The drawer asks the Engine first (GET /access/users/{id}/deletion-preview) and says what will happen: “Delete the sign-in mom@home.com? Mom’s profile and everything in it stay in Household 1. You can attach a new sign-in to it later.” When it is the last sign-in that can look after a household that is not the default one, the household goes with its profiles, and the drawer says so: “This is the last sign-in that can look after Household 2. Deleting it removes Household 2 and its profiles: Pat, Sam, Leo, with their progress, bookmarks, lists, photos and videos.” Photos and videos, theirs and the household’s Shared Library, are deleted with the household and never moved into another household (users spec D18), so there is no photo choice. If the Engine would refuse, its reason is shown and there is no Delete button (the Library’s only server administrator, for example). The profiles that were shown travel with the delete (DELETE /access/users/{id}?profiles=), so the Engine refuses if the list has changed. Household administrators no longer delete users; they delete profiles under Settings > Profiles. Computer or tablet only, never on a phone.

Settings > Profiles > a person. /settings/profiles/{profileId} is one page per person, a short list of rows in the style of Netflix’s Manage profile and preferences, the same for your own profile and, for administrators, anyone in the household. The person is the profile: roles and access live here, and the sign-in is only the way in. The header shows a large avatar, the name, a role line (Server administrator, Household administrator, Profile or Kids profile) and badges (You, Household administrator, Server administrator, Kids, PIN). Grouped lists follow. Profile: Profile details (shown to administrators only, because the editor saves through administrator-only Engine actions; status such as Kids · PG, Everything or Everything · PIN set; opens the profile editor sheet for this person) and Sign-in (read-only: the user’s email or No sign-in; on your own page it links to Security; for another person it says Managed by the server administrator in Users and Sign-in and links there for a server administrator, plain text for a household administrator). Preferences: Playback, Listening, Reading and Subtitles, each linking to its settings page. Roles (administrators, not on a member’s own page): a Household administrator switch and, for a server administrator looking at someone in the Library’s own household, a Server administrator switch. A switch that cannot be changed is disabled with the reason beneath it (no sign-in attached, a Kids profile, the household’s last household administrator, the Library’s last server administrator, or a server administrator’s profile seen by a household administrator); a refusal from the Engine is shown as it is. Access (administrators): Libraries and lanes (status such as Read, Watch · all libraries or Read, Watch · Watch: 1 hidden) opens a sheet with the Read / Watch / Listen / View switches; the lanes are saved with Save through PUT /access/profiles/{id}/access. Under each lane the person has, a Libraries list shows one tick per library in that lane, all ticked unless an administrator unticked it for this person; it appears only when the lane has more than one library, never names a Vault library, saves straight away when a tick changes (“Hidden from Sam” / “Shown to Sam”) and is read only on a phone. A new library is ticked for everyone with its lane. A household administrator is offered only the lanes their own profile holds; a library hidden from their own profile shows greyed with Hidden from you once it is hidden from the person too and cannot be ticked, though they can still hide it from someone. A server administrator can change everything, and the Engine’s refusal is shown in the sheet. A server administrator’s profile reads Everything and opens nothing. Another person’s links carry ?profile={profileId}; your own omit it. The Profile list also has a Devices row that opens /settings/security/devices?profile={profileId} and, for administrators, View activity. An Administrator PIN group appears on a profile that holds an administrator role and has a sign-in, only on your own profile or for a server administrator: an Ask for a PIN to open administrator settings switch (off by default; it asks for the profile’s own PIN, so the profile needs one first) and, once on, how long an unlock lasts. It saves straight away. A red Delete profile row sits at the bottom only when the rules allow it (administrators; never the profile in use, the household’s last household administrator, a server administrator’s profile for a household administrator, or the household’s only person) and opens the editor sheet straight on the delete confirmation: Everything personal in this profile goes: progress, bookmarks, lists and history. Their sign-in (email) is removed too. with the photos choice Move to Shared (selected) or Delete and a red Delete button; the Engine’s refusal is shown as it is, and deleting returns to the Profiles list. Your own profile is always open to you; another person’s only to a household or server administrator, and anyone else is sent back to the Profiles list. If the Engine refuses to share someone’s settings the page says You can’t change this person’s settings. and keeps the Profile rows. Rows are 56 px tall (larger on television), the whole row is the link or button, and focus is always visible. The page title and breadcrumb use the person’s name. Phones get a Profiles back link at the top, one column and 16 px gutters; desktop is about 720 px wide.

Settings > Security > Devices. /settings/security/devices is the one page for everything that is signed in to Tuvima, a child of Security in the Personal group (phones included, MobileAvailability.Full); Security itself still opens on the sign-in page. Every signed-in person except a Kids profile can open it; there is no Devices entry under Server. It stacks two cards. Paired devices lists the phones and TVs paired to the server, each with a type icon (Android, Apple, TV, browser, or a generic device) taken from the platform and app name the device reported when it paired, and Sign out after a confirmation, plus the Backs up to choice for phones when the viewer is an administrator. Signed-in browsers lists where people are signed in, each with Sign out after a confirmation; a This device tag marks the viewer’s own browser, which has no button. What the lists hold is decided by the Engine: a member sees only their own devices and browsers; a household administrator also sees their own household’s ordinary members (never a server administrator or another household administrator); a server administrator sees everyone’s. Administrators get a Household filter (server administrators only) and a Profile filter above the cards, both starting at All; they only narrow what the Engine returned, and choosing a household drops a chosen profile that is not in it. Browsers are grouped by person (avatar, name, and the email or No email) for administrators; a member’s browsers are one plain list. With nothing paired or nobody else signed in the cards say so, and with a filter that matches nothing they say No paired devices match and No sign-ins match. A household administrator who turned on an administrator PIN is asked for it once, as on Profiles. The address to type in an app is not on this page.

Settings > Server pages, grouped by the question being asked (October 2026). How do people reach the server? Network and Remote Access (/settings/network) opens on connection status (Test Connection and Connection Status) and has three children: Local Network, Remote Access (HTTPS proxy, Tailscale) and Advanced (reset). It has no Streaming page: /settings/network/streaming no longer exists and does not redirect. How is video and audio sent and prepared? Streaming (/settings/delivery, formerly Playback and Delivery) opens on Limits and Quality: Remote Streaming Quality (with Automatic Upload Protection), Upload Capacity (with the bandwidth test) and Concurrent Remote Streaming, moved from Network, saved with the same network settings as before. On a phone only the read-only Upload Capacity and Concurrent Remote Streaming cards show. Its children are Hardware Acceleration (/settings/delivery/hardware, the one place the setting is changed), Optimized Copies (/settings/delivery/optimized-copies, stacked cards for prepared download quality and maximum active encodes, scheduling, optimized copy storage and the active encode jobs, with one Save button for the settings) and Diagnostics (/settings/delivery/diagnostics, the playback tools and services checks plus a “Playback delivery needs attention” alert when FFmpeg is missing or the Engine reports warnings). User-facing text says “optimized copies”, never “variants” (the code still uses the word). /settings/delivery/scheduling, /storage and /active-jobs no longer exist and do not redirect. Is the server healthy? System (/settings/system) opens on a resources summary in three cards, all read from the machine and repeated every 10 seconds while the page is open: This server (version, how long it has been running, and the address at home and outside your home, moved from the Network overview’s old Server information block), Processor and memory (“The Library uses N% of the processor”, “X of Y memory”) and Storage (used and free space for each drive that holds the library or the data store, which of them live there, and the data store’s size). It shows the same on a phone (summary only), and it has no Local AI setup reminder: the red menu item and the page notices already say it. Tools and requirements (/settings/tools) also holds Playback tools and services (active encode jobs, configured profiles, FFmpeg: the old Current status card) beside the existing Tools and Local AI models cards. Local AI (/settings/ai) opens on Features (Enabled features and Feature readiness) and its children are Runtime (/settings/ai/models: resource profile, benchmark, runtime settings and runtime diagnostics, desktop and tablet only), Vocabulary and Automation; Local AI keeps today’s content until the Developer tools spec rebuilds it. Plugins (/settings/plugins) is one page with no children: the installed plugins first, then Available plugins (desktop and tablet only: the saved copy of the plugin directory with its last-checked time, Check now, a switch that turns the lookup off, a quiet “N new plugins available” line, a trust label on every entry (Official, Verified or Not verified, with the plain warning beside Not verified), and an Install button that is drawn only when the Engine says installing is supported, which opens the same approval step as switching a plugin on), then Plugin details (a plugin picker with Health & Jobs, Capabilities & AI permissions and Danger Zone stacked beneath it).

Settings > System > Backup and recovery (October 2026). Plain words, no password option, no per-item lists. Under the Create backup button: “Backups hold your settings and your own progress, bookmarks and favourites. They do not include your media files or folders. Back those up with your computer’s own backup tool.” and, below it, “Anyone with this file can see your settings and sign in as you. Keep it somewhere safe.” A standard warning bubble says “{n} items are matched by exact file only and may lose progress if the file changes.” (“1 item is matched …”) and is hidden when the count is 0. A made backup shows its file name and size. After a restore, while anything is still waiting and for 7 days after, Backup status shows one line: “{attached} items got their progress and bookmarks back. {waiting} are waiting for their files; they’ll return if the files do, and are cleared after {days} days.” (only the first sentence when nothing is waiting; only “{waiting} items are waiting for their files; they’ll return if the files do, and are cleared after {days} days.” when nothing has come back yet; no line when both are zero). Administrators on desktop and tablet choose “Keep restored progress waiting for” 30, 60, 90 (default), 180 or 365 days, saved straight away; another stored value is shown as one more choice. The first look at a backup (Test restore, and the file chosen in first-run setup) shows “{profiles} profiles and your settings”, “{n} items of progress, bookmarks and favourites, which come back as their titles are found again” and “Media files and folders are not included.”; a refused file shows the Engine’s one sentence as it is. Nothing here names the Vault or adult-video titles; every count is a total.

Settings > System > Logs and Scheduled tasks (October 2026). Logs (/settings/system/logs, server administrators only, desktop and tablet) is the System child between Tools and requirements and Backup and recovery. It has four sections as in-page tabs, opening on Events (?tab=technical, ?tab=retention and ?tab=export open the others): Events is the Activity log (ingestion spec WP12), one flat, time-stamped, searchable log of what the Library did, 50 rows a page with “1–50 of 1,234” and Previous/Next. Filters, in order: Added, Needs Review, Failed, System and All (?filter=added and so on; All is the default). Each row shows the time, a symbol for its kind, a plain headline (a title, a file name, “3,000 photos”, “Couldn’t find FFmpeg”, “TMDB isn’t responding”, “Refused a download of FFmpeg”) and a plain detail line written by the Engine, with the media type when known; a row about one item links to it. Photos and personal videos arrive as one count row per scan or quiet spell, never one row per file. The search matches names and details. The live ingestion page’s View all opens Events on Added, and the old /operations/activity and /operations/timeline addresses open Events on All; the old list of items being added at /settings/ingestion?view=all is retired and opens Events on Added. Technical log reads the Engine’s own log files newest first, with Time (last hour, 24 hours, 7 days or all), Level (everything, warnings and errors, errors only), Area (Ingestion, Playback, Network, Providers, Security, AI, Other) and a text search; an error keeps its detail behind “Show details” and older lines load 100 at a time. Retention sets how long and how much is kept: system activity (default 90 days, at most 500,000 events) and Engine log files (default 90 days, at most 1,024 MB in all), with what is stored now. Export makes one text file for a bug report: pick the time (last hour to 30 days), the level (errors only, warnings and errors, everything), any areas, optionally one run or item id, and whether to include events; a live line says “About 12,400 lines, 1.8 MB” before Download. Keys, tokens, sign-in details and file and folder names are hidden in the file (a switch keeps the last part of each file name, never the folders). Old events and files are removed quietly every night; nothing is shown when that happens, and personal activity (what people watched, listened to and read) is not part of it. Tools and requirements ends with a Scheduled tasks card listing every recurring Engine task: who owns it and where its schedule is set, when it runs in plain words, when it last ran (done, failed or skipped with a short reason, or “Has not run yet”) and when it runs next. Last-run records are kept across restarts.

What administrators can change for others. A server administrator can open every household’s people, and a household administrator can open the people in their own household (up to eight). Neither can open another household, and a household administrator cannot change a server administrator’s profile. From a person’s page an administrator can edit the profile (name, colour, icon, content limit and PIN), add a person or remove one (never the profile in use, a household’s last household administrator or, for a household administrator, a server administrator), make a person with a sign-in a household administrator, and change Libraries and lanes (a household administrator hands out only the lanes their own profile holds and never shows again a library that is hidden from their own profile). Only a server administrator creates, deletes or changes users (Users and Sign-in) and makes a profile in the Library’s own household a server administrator. An administrator can also edit another person’s Playback, Listening and Reading settings through the ?profile={id} links; if the Engine refuses, the page says so.

Shared AI storage (September 2026)

Local app/test builds load versioned native AI dependencies from TUVIMA_AI_RUNTIME_DIR and model weights from TUVIMA_MODELS_DIR. Provision through tools/Install-AiRuntime.ps1; do not add native package copies back to ordinary build outputs. The workstation uses E:\Resources\AI Models (llama/whisper directly beneath it) and sibling AI Runtimes. Windows installer and Docker builds explicitly bundle deployment assets. See docs/guides/shared-ai-storage.md and AGENTS.md for setup, verification and workspace retention. Repos holds only Library and Wikidata; keep at most two temporary worktrees outside Repos and retire them after integration.

Shared editor and Universe graph rules

Treat structural media placement, authored-container canonical title/order, and the knowledge graph as separate models. Stage 2 establishes canonical Work identity; bounded Stage 3 enriches grounded entities, qualified graph links, and graph-owned artwork without silently changing authored containers or structural placement.
Editing is desktop-only. One rule, EditorDeviceRule.CanEdit, decides: the form factor is desktop AND the browser reports a fine, hover-capable primary pointer (pointer: fine and hover: hover). Phone, tablet, TV, a native app shell, an unknown form factor and a browser that cannot report its pointer all mean no, so an iPad asking for the desktop site cannot edit while a touch laptop with a mouse can. The browser snapshot (detectDeviceSnapshot, refreshed on resize and when a pointer is plugged in or removed) and the server circuit (DeviceContextService.CanEdit) feed the same rule, and every Dashboard edit handler refuses when it is false, not only the hidden buttons: the media, collection and gallery launchers return NotAvailableOnThisDevice with the toast “Edit on a computer”, Editing Mode will not start, a pencil will not open and a field will not save. No Edit, Correct, Rematch, Edit artwork, New/Edit Gallery, New Collection or New Smart Playlist control renders off the desktop, and a window dragged to tablet width leaves Editing Mode by itself. Phones, tablets, TVs, cars and native apps are consumption-only in the Dashboard: no pencils, no Edit button, no drawer and no Dashboard edit routes. The Engine never sees the device: its permission check still decides who may edit, and it does not block coarse-pointer or touch devices. The phone More sheet may keep one disabled row reading “Edit on a computer” where Edit sat; tablets show nothing about editing, and a menu that held only Edit is removed. Needs Review stays a desktop workflow (phones keep its summary only; Review off the desktop does nothing).
Editing on the details page (the universal editor). A person with edit permission, on a device that can edit, sees Edit in the page’s ”…” menu; choosing it shows a sticky editing bar (Editing, the tools Details, Artwork and Match, Cancel and Save changes) and a right-hand panel beside the page. The state lives on the page: it ends on Done, Cancel or leaving the page, and a deep link never starts in edit mode. Nothing is saved while editing: every change is staged, shown on the page at once, counted on the Save button (“Save 3 changes”) and listed in Review changes, which opens when Save is pressed and saves only on Save N changes. Provider facts are read-only with the provider’s name and a Reset to provider value where a local value exists. The same bar and panel serve every way in: a title, an album track, an episode, several ticked rows (songs, tracks, episodes, library tables: the bar shows N selected and the panel is titled “Edit N songs”), Needs Review (Review opens the item’s own page on the Match tool and a saved match closes its review items), Recently Added and library lists (Edit opens the item’s page in edit mode), a song’s ”…” menu or Edit button (album page, that song ticked, Edit panel open) and the player’s lyrics button (the album page behind the player). There is no pop-up editor for a single item and no drawer. Moving a song, episode or audiobook part is always match first; a book, comic or movie is never moved into a Series by hand. Esc closes the panel, focus returns to the control that opened it, and unsaved input is guarded: Cancel and leaving the page ask “Unsaved changes”. Single people, Universes, series shelves and curated collections keep their own editor dialogs until they move over.
One write-back control. Whether a save also updates the files on disk is the library’s Save changes into the files setting in Settings > Libraries (per library, identical for every item type and every way in). The editor never offers a second switch: Review changes shows a small read-only line (“Files will be updated: On” or “Off”) with a Change in Settings link, and only when the library allows it a Update the files when this is saved tick box for that one save. Unticking it saves the changes to the library and leaves the files alone.
The normal media editor uses one stable parent header with adjacent child selectors and a single highlighted editing target. Keep audiobook chapter-title overrides under Chapters. Match information belongs at the top of Details, never in header/selector badges; inherited canonical identity needs no status label. Retail Match owns provider identity plus proposed structural placement; preview previous/target paths before Apply. Do not expose Change Type in the normal editor or Review Queue.
Universe/entity editing remains content within SharedMediaEditorShell, opened from the authorized Edit actions on the Universe Explore surface or its selected entity. Media detail pages link actual accessible Universe relationships; media editors contain no Universe shortcut or mode switch. Keep the Universe header stable and preserve the existing dirty-state guard for category/entity navigation.
The Universe explorer (/universe/{Qid}/explore) works on phones: the graph is a full-width canvas at most 70% of the viewport height with pinch-zoom, drag-pan and 44 px Zoom in, Zoom out, Fit and Reset buttons, and on every device a label-sorted list of every entity (type and relationship count, one real button per row) sits beside or under it, so a keyboard, remote or screen reader can reach each node and open the same detail panel a graph tap opens.
Follow server-readable section capabilities; label/filter Organization Members and Event Participants as their own projections without replacing the full Relationships section. Keep the Universe category rail in one row and use keyboard-accessible, anchored, viewport-bounded category/sibling selector popovers.
Managed EntityAsset artwork is owned by its Universe/entity target. Preserve work-scoped role/context/anchor/time/spoiler qualifiers and provenance. Do not conflate real-world dates, structural order, in-universe narrative time, and editor History.

Shelf editing and owner artwork

Structural shelves edit their own parent Work through the shared editor. The Engine declares supported artwork slots and automatic-group presentation; do not duplicate media/scope capability switches in the Dashboard. Shelves preview up to four ordered owned covers, accept a shelf-owned custom cover, and can restore the automatic stack. Title and description overrides remain local presentation choices and must agree across editor, detail, and browse. Group routes and membership resolve by structural owner identity rather than a customized display title. Season selectors use managed SeasonPoster artwork and episodes use EpisodeStill; absent owner artwork remains a placeholder.

Editor Details names the active editing target independently of the stable parent header and shows compact Retail/Canonical match checks. TV matching is exposed only on episode targets, never series or seasons; the inherited canonical record remains visible for context without an editor jump to the series. Match searches retain the current identity until the user explicitly applies or overrides a result. Logo previews preserve the complete image at its natural ratio.

October 2026 remediation follow-up

Home previews reserve resting shelf geometry before expansion and use a bounded cinematic layout for movies/TV, with artwork and logo only; Home Continue retains episode identity and truthful progress. Home Watch discovery cards expand in-row to a landscape background at the resting cover height, shifting neighboring cards horizontally; a movie or show with no landscape background keeps its cover and only highlights; Watch pages and episode lists highlight only; non-Watch cards remain outline-only. Shelf arrows have dedicated rails and minimum 44px targets. Continue groups have natural whole-card widths, 32px dividers/gaps and stack below 1280px. Shared book foreground height, perspective, page/spine geometry and proportional shadow live in HeroBackdrop; detail stages retain 95svh. Known small Home sources use backdrop framing; unknown dimensions use the conservative fallback.

The shared primary action uses the larger default requested by the product owner for Play, Read, Listen, Resume and Continue: 22rem wide and 4.6rem high, capped to the available phone width (on phones it is full width and 48px high, and the round icons are 44px). Plain actions use larger text/icons; continued actions show a second percentage line and embedded progress. Adjacent My List, Rate and More are 56px circles; Shuffle remains a circle beside album Play. Restart belongs in More and preserves existing query/fragment state while starting at position zero. Progress includes a visible watched/read/listened percentage and a slim strip inside the primary action. Rate choices are Likes/Dislikes; only a song’s Love/heart adds it to Favorites. My List is saved-item state, not a rating. Song menus operate on the selected song and use guarded active-profile/snapshot identity.

Home refreshes are coalesced and profile-bounded: progress is limited to once per minute, library-state changes to once per 15 seconds, new media to a two-second debounce, pause to five seconds, and dismissal/stop to immediate refresh. Transport ticks do not rebuild shelves or Recently Added. Background Recently Added refresh keeps the mounted cards visible and deduplicates paging.

Audio, phone/popout and Watch/View video use PlaybackSeekRail: total duration sits at the right end and toggles to remaining time; elapsed time stays visible at the left end and also appears in the focused/hovered/dragged seek bubble. Chapter name/time shares that bubble. Speed uses the bounded 0.5–3.0 slider in 0.05 steps with reset to 1×; stored rate precision is retained until changed. Sleep retains its existing select and authoritative deadline. While no timer is running the sleep select shows the profile’s default length (Settings > Listening) as its current value, or Off when the default is Off; a running timer always wins, and starting, changing and cancelling behave as before. The End of chapter and End of next chapter choices are hidden when the profile turned Offer end of chapter off.

Watch/View video use shared bottom chrome, a Back affordance, control hover/focus holds, and one subtitle-positioning owner in playback-chrome.js. Active cues sit 12px above the seek rail while controls show and restore authored settings when hidden or detached. Up Next uses owned eligibility and separates Up Next/Episodes/Chapters; no provider-only episode is promoted. The end-of-episode card counts down and advances on its own while Autoplay next episode is on; with it off the card still appears with the next episode and Play next episode now, but there is no countdown and the player holds at the end until the viewer chooses. Native cue animation is browser-dependent and is not promised. Video starts from the signed-in profile’s Subtitles & audio defaults (read through IUserPlaybackPreferencesAccessor when the player opens): the audio track in the profile’s Audio language is chosen when the title has one and the player can switch to it, and Show subtitles decides the subtitle (VideoPresentationResolver.ChooseTrackDefaults): Auto shows the Subtitle language only when the audio that plays is not already in that language (when it is, the player makes no change, so the file’s own default or forced track still shows). The audio that plays is the profile’s Audio language track when the player can switch audio tracks; with a single track, or where the browser cannot switch audio (direct play in Chrome or Firefox), it is the file’s own default track, and a track with no known language counts as the profile’s Audio language. Always shows it (a full track before a forced one), Off starts with captions off, and a language the title has no track for leaves the player’s own choice. A title’s own Set preferred version subtitle and anything the viewer picks in the Captions or Audio sheet always win over the profile defaults. Cue text size and background come from the same profile: Small, Medium and Large are 2.2, 2.8 and 3.6 percent of the screen height (never under 14 px), with a 60 percent black box behind the text or, with Background off, text with a soft shadow only. VideoPlaybackHost sets data-subtitle-size and data-subtitle-background, wwwroot/app.css turns them into --tl-subtitle-size and --tl-subtitle-bg, and the ::cue rule there reads those variables. Track discovery and Find better subtitles are unchanged.

On a touch screen the video controls fade out three seconds after the last touch while playing and return on any tap or when paused; double-tapping the left or right third of the picture skips 10 seconds back or forward with a ripple and a count, double-tapping the middle toggles play, a first portrait play on a phone shows a one-time “Turn your phone for full screen” hint, a phone turned to landscape asks for fullscreen, and at 450px height or less the title line is hidden so the controls fit one row. The lock screen shows the video’s title, show name or year, season or series, and cover.

Lyrics content omits the former version/provider toolbar. Enhanced LRC strips inline timestamps into independently timed words, uses native audio time, and keeps client highlighting separate from server render updates. Only explicit instrumental markers, explicit word-end gaps, known intro/outro boundaries produce three-dot sections; ordinary long line spacing never invents a musical break. Three configurable durations live in config/ui/playback-client.json. Unknown duration prefers timed lyrics. The empty state explains where lyrics come from and offers Look up lyrics now and Add a lyrics file to any profile (using a lyrics source is not an administrator function; switching a source on or off is). A source line names where shown lyrics came from (LRCLIB, or a file next to the song). The desktop Lyrics card has a close button. The player no longer opens the pop-up editor for lyrics.

Editor artwork previews are padded and contained. Open full size opens the authenticated original image in a new tab and removes rendition-size query parameters. Canonical entity artwork lookup avoids an expensive full-detail composition when a cover claim exists. No ten-minute cache was added because invalidation ownership is not yet established.

Retail identity confidence now uses the eight typed per-media matrices in config/pipelines.json, synchronized defaults, required/optional missing policies and terminal eligibility caps. Genre is excluded. Nullable field_scores is additive in Contracts and complete evidence persists with the candidate. See docs/architecture/scoring-and-cascade.md; canonical claim trust and Wikidata scores retain their own owners.

Product owner visual corrections October 4 2026

The latest product-owner reference supersedes earlier hover and smaller-button guidance. All Continue Watching movies and episodes keep their still and exact resting dimensions; hover/focus reveals a compact in-place identity overlay without JavaScript expansion. Books, comics, music, audiobooks, and other non-Watch media use only a subtle outline and register no preview mouse events. Only Home enables changing previews through the explicit IsHomeSurface parameter. Its movie/show discovery cards widen within the row toward 16:9, shifting neighbors horizontally while retaining the artwork height and showing only the full landscape artwork and logo with a slight highlight. Never mount a floating preview or use a viewport-based 900–1280px expansion. Watch pages, browse grids, detail episode lists, and every other surface only highlight cover art and episode stills. Home and Watch Continue Watching keep their landscape episode still and exact dimensions, with S{n} E{n} · Episode title above the show name. They show no percentage text; the accessible progress label remains, and hover/focus makes the artwork-edge strip subtly thicker and brighter. Continue cover art for books and audio only highlights. Episode overlays show season/episode number and the canonical episode name, with the show title as a persistent caption underneath. Continue projection prefers asset/work episode_title over a generic show title. Media/group cards still have one detail link; group artwork composition remains fixed.

All hero Play/Read/Listen/Continue actions use the same larger 22rem by 4.6rem button, bounded to the available width on phones. A continued action includes the applicable percent watched/read/listened; a plain action centers larger text and icon. Song menus use intrinsic content width, the same shared item-height/typography/padding tokens as detail menus, and the shared circular song action row in full Now Playing. Obsolete overflow-menu geometry overrides are removed. The audio seek rail and end time sit inside the dock, centered together above the controls; desktop reserves 104px and phone 88px plus safe area. Playback ownership and guarded personal-action identities remain unchanged.

Home discovery hover is artwork-and-logo only. Preserve the complete landscape image without synopsis or fact overlays. Freeze artwork and shelf height through opening and closing so only neighbors in the same row shift horizontally. Home Continue scrollers reserve 8px on each side for the first and last card highlight; packed group widths include these gutters.

Continue groups show at least two whole cards when two are available on desktop and tablet. Desktop groups wrap rather than shrinking below two; narrower non-mobile layouts give each group a full row. Mobile may show one card. Preserve natural artwork dimensions and the 8px highlight gutters when allocating group widths.

Movie/TV compact card captions omit the generic subtitle (including series position such as Movie 1 in a series). Retain the title and canonical year; other media retain author/artist subtitles and Continue retains truthful progress context.

Continue Watching, Reading, and Listening share one artwork height (80% of the Home shelf artwork height). Landscape Watch cards retain 16:9 and gain horizontal width. On narrow non-mobile full-width rows, cap the shared height to fit two landscape cards plus rails, gap, and highlight gutters; all media scale together so height parity and the two-card minimum both hold.

The app primary purple is #8852FC, with #A46FFF hover and matching RGB soft/glow tokens. Player surfaces use #0F131E background, #121623 surface, #30364A tracks, #F7F7FA text and #9EA4BC secondary text. Dock timeline shows elapsed time on the left and toggleable total/remaining time on the right. Music dock exposes the existing song rating control beside Favorite/More; Likes remain distinct from Favorites. Lyrics uses a quotation speech-bubble glyph. An open rating control and its hero action row rise above sibling controls.

Sign-in rejects stale, missing, mismatched, or unreadable antiforgery tokens with HTTP 400 and a freshly tokenized sign-in form. The expired-form notice requests a new submission; rejected credentials never reach the Engine. A local return destination is preserved, while credential fields are cleared. Other security actions retain their existing validation.

Use on this computer (Dashboard). On the computer that runs Tuvima (never a container, another device, or a visitor behind a tunnel or proxy), the setup administrator step first offers Use on this computer (recommended: name only; an email is asked for later, with the password, when the account is secured for use away from home) or Set a password now (today’s form); the first choice says You can add a password later. You’ll need one before adding another household. Choosing the first sends sign_in = this_computer with the Dashboard’s own original_client_ingress. While the account has no password, opening Tuvima from this computer or the home network skips the sign-in page entirely: the Dashboard goes straight to the Who’s using Tuvima? picker when there are several profiles, otherwise to Home, with no “Continue as” screen. After an explicit sign-out the sign-in page is shown with a single Go back in as button instead, so signing out sticks. Once any password exists the sign-in page returns as normal, and visitors through a tunnel or proxy never skip it. The sign-in page shows the email and password form only while some enabled account has an email and a password to use; with only the no-password owner it shows just the Go back in as button, and a copy of the page that is only prerendered or opened in the background goes back in by itself as soon as it is really on screen (never after an explicit sign-out). Every Engine call from a this-computer visitor carries X-Tuvima-Client-Ingress: this_computer, because the Engine refuses a this-computer-only session without it. While signed in this way no bar is shown: the account menu shows the Secure your account card (Secure account goes to /settings/security; Not now hides it for good), and Settings > Security shows a dot on its navigation entry until Not now and starts with Add a password.

Playback song rating, Favorite and More use the same outline 22px glyph sizing and circular 44px target. Song overflow omits Like/Dislike when the direct Rate control is rendered; surfaces without a direct Rate control retain those menu actions. Detail rating circles keep their existing appearance.

Rate hover, focus, and selected-choice highlights are circular and contained within their 44px targets and padded choice pill. Playback Rate keeps the shared circular border at rest; its open/hover highlight is circular, matching the choice buttons.

Player panels and shared controls (October 5 2026)

The phone full player and the popout share PlaybackFullPlayer as one screen with no bottom sheets. The default view is artwork, followed by progress, transport, mode buttons, and volume.

Modes. Lyrics and Queue (music), or Chapters, Bookmarks, and History (audiobooks), replace the artwork with a PlaybackPanelCard. Selecting the active mode returns to artwork.
Controls. Lyrics and Queue triggers are icon-only, with tooltips and accessible names. Volume is shown on every surface, including phones. Audiobook Speed and Sleep live in More.
Dock cards. The Lyrics card and the combined Queue & History card preview on hover and stay open when pinned. Only one dock card is open at a time.
Queue. Upcoming occurrences reorder by drag, keyboard, or row menu through the guarded reorder-upcoming command, using the expected queue revision and saved occurrence IDs. The current item never moves.
History. clear-history clears only the player’s recent music list, after confirmation.
Output. The main audio owner applies output selection through setSinkId. The control appears only where named output devices are already permitted, and it never requests microphone access.
Quality and Media Session. A Lossless or Hi-Res Lossless badge requires known lossless direct delivery. Media Session metadata and actions bind to the main owner.
Identity links. Player identity links use detailOrigin.fresh, so the destination opens at the top, including the detail shell’s .context-sidebar-shell__main scroller. Ordinary Back restoration is preserved.
Shared controls. Dashboard controls use first-party Components/Shared/App* primitives, including AppSelect/AppTypedSelect, AppTooltip, AppRangeSlider, AppProgressBar, and AppSpinner. Their native HTML, SVG, CSS and JavaScript own sizing, appearance, focus and expanded/selected semantics. Pages use the shared components rather than reimplementing their controls. A tooltip (AppTooltip, AppInfoTip, playback-tooltip.js) is a manual popover in the browser’s top layer and, when a modal dialog is open, sits inside that dialog, so a dialog or its backdrop can never cover it. A section heading carries one (i) (AppInfoTip), never one per option; quiet explanations are AppQuietNote lines, and amber is only for problems.
Intrinsic selectors. Selectors such as the series selector size to the selected label within the available width, then ellipsize with a full-label tooltip.
Follow-up. Shared controls and Release CSS minification now use first-party ownership. Bundle acceptance still requires measured Release assets and paired visual evidence; broader per-render interop optimization remains separate.
Docs toolchain. The documentation toolchain requires Astro Starlight, pinned in the tuvima-docs repository.

Bookmarks in videos and audiobooks (October 21 2026)

One word everywhere: Bookmarks (Videos spec D43, D43a). Books, audiobooks and videos all call a saved spot a Bookmark; the audiobook player keeps its Bookmarks panel as it was, and nothing about stored data, internal names or wire names changes.

The panel. In the video player, Bookmarks (a bookmark glyph in the right-hand controls) opens one panel with Add and Saved, the same panel the audiobook player uses. On phones it opens as the usual full overlay sheet. Add opens first and captures the playing position at the moment the panel opens, so the moment is not lost while typing; it shows the chapter name (or “Position in video”), a preview button, a short note (200 characters) and an optional longer description (4,000), each with a counter.
Saved. Newest first, with Replay (jump and play), delete with an inline confirmation, and a note button that expands the short note and the longer description. Reloading Saved is explicit, and an unknown save outcome asks for a reload before another try.
Progress rail. Every bookmark is a small tick beside the chapter ticks. Pointing at one (a tap on touch) opens a quick-look card with the time, the short note and, when there is one, More for the longer description, plus Jump here. A tap keeps the card open until Close.
Personal and shared. A bookmark belongs to the profile and the title it was made on. Only a server administrator sees the Share with everyone switch (off for every new bookmark) and can delete a shared bookmark; the Engine refuses anyone else (403 on save, not found on delete). A shared bookmark has another tick shade and a small “Everyone” label, and everyone who can see the title sees it.
Vault. A bookmark on a Vault video, personal or shared, is not listed, counted or found unless Vault mode is on; locked sessions get not found.
Bookmark packs (Videos spec D46, video player only). At the bottom of Saved: Export (choose which of your own personal bookmarks, name and optional author typed by the person and never taken from the profile, a Review step that says the pack holds no file paths, profile names or watch history, then Save pack file) and Import (pick a pack file; the Engine says whether it is for this title). A pack for another title offers nothing to add; a pack for a different cut says why (running time or edition) and offers Align by chapter or Skip; a pack already on the title says so. Added packs are listed below, each with a switch (off removes its ticks and rows without deleting it), its read-only rows (Play only, no delete or edit) and Remove pack. Pack ticks have their own shade, and the quick-look card names the pack and author. Pack bookmarks belong to the importing profile and follow the bookmark rules (a file the caller cannot see is not found). The Vault shows no Export or Import, and the Engine answers not found for a Vault export, locked or not.
Files and backups. A pack is a ZIP like a library backup (manifest plus one JSON payload, nothing secret, no password). A library recovery point already contains every bookmark kind, so one restore brings them all back.
Not in this release. Scene range UI (“Play this part”: the end time is stored and carried in packs, but the Add panel does not set it yet), audiobook descriptions or sharing, and community sharing or the Popular Bookmarks plugin (D47/D48) are not built.

Export and import people (October 22 2026; households October 23 2026)

Moving one person to another Library (backup and restore spec D19). Only the server administrator exports (users spec D16): everyone else is just a user of the platform and is never offered an export. Every export asks the administrator to confirm it is them first (the usual “Confirm it’s you” step), because the file holds what is needed to sign in as that person.

Export my data. One row in Settings → Security → Account details, for the server administrator only (it is not drawn for anyone else, household administrators included, and the Engine answers 403): the title “Export my data”, the line “Download a file with your sign-in, profiles, progress, bookmarks and favourites. Anyone with this file can sign in as you. Keep it somewhere safe.” and an Export button that downloads a .zip. A short busy state shows while the file is made; a failure is one plain sentence (the Engine’s own when it gives one, otherwise “The file couldn’t be made. Try again.”).
Export a user. For administrators only, in Settings → Manage → Users and Sign-in → Users: Export in a row’s ”…” menu, beside Change email, only for a user that has an email. It follows the page’s own rule for management: computer or tablet only, never on a phone, and the row menu does not exist on the phone card layout.
Import a user. An Import a user button beside the Invite buttons (same visibility: server administrators, computer or tablet). It opens the page’s side drawer: choose a .zip (a file over 256 MB is refused with “This file is too large to be a user export.”), then a preview of what is in it and nothing is added yet: “Household: {name}” when the file names one, each profile by name (with “Kids profile” and “limited to {rating}” where the file says so, and “no sign-in” for a profile with none; an administrator role in the file is not shown and is not carried, because an import never carries roles), the number of items of progress, bookmarks and favourites (“which return as their titles are found”), and when someone else made the file the line “They’ll need to set up two-step sign-in again after they sign in.” Then the choices:
- Sign-ins: one block per sign-in with an Email field starting as the file’s email and an Import without a sign-in tick. An email already used in this Library shows “Someone here already signs in with this email. Choose a different one, or import without a sign-in.” and Import waits until it is changed or the tick is set. A sign-in the Engine says cannot move (its outside sign-in is linked to someone here, for example) shows the Engine’s sentence and arrives without a sign-in.
- Put them in: A household that exists (a choice of the households here, each with how many people it holds; “That household has room for {n} more, and the file has {m}. A household can have up to 8 people.” when it is too small, and Import waits) or A new household (its name, and Who looks after it?: a person from the file who keeps a sign-in and is not a Kids profile). When the server administrator has no email and password yet, the second household shows the Engine’s sentence (“Set an email and password for your own sign-in first. A Library with several households must not be open to anyone who reaches it.”) with a Set an email and password button instead of the name field.
- Keep their access (only when the file has any): off by default; ticked, Read, Watch, Listen and View arrive as the file had them. Hidden libraries never travel (library ids differ between Libraries), so everything in the person’s areas is visible.
- The summary line: “They arrive as ordinary members (Kids profiles stay Kids) with no access, so they won’t see any libraries until you give them access.” (or “…with the Read, Watch, Listen and View access the file had” when kept).
Import adds them and closes the drawer with “{names} {was/were} added to {household}. Choose what they can see on their profile, under Profiles.” When something clashes when Import is pressed, the Engine’s sentence is shown as it is, in the standard alert, the choices stay as they were and can be changed. The Engine never imports a role: nobody arrives as a server or household administrator, except the person chosen to look after a household the import creates.
Export this household. On Settings → Profiles, one Export this household button at the top of each household’s group, with the line “Download a file with this household’s profiles, their sign-ins, progress, bookmarks and favourites. Anyone with this file can sign in as these people. Keep it somewhere safe.” Server administrator only, computer or tablet (never a phone); household administrators do not see it (POST /access/households/{id}/export answers them 403).
Copy. Plain words and “the Library”; nothing about the product’s name in sentences.

Who’s using Tuvima? (October 9 2026)

/who is a full-screen page with no main navigation. It shows the signed-in user’s household’s profiles (never another household’s) as a Netflix-style grid: avatar or initial, name, a lock tag when the profile has a PIN and a Child tag for restricted profiles. Picking a profile switches to it; a profile with a PIN always asks for that PIN first (this is what stops a child profile switching into an adult one), and a wrong PIN counts toward the lockout only for people connecting from outside. There is no “always open as” setting.

Every interactive sign-in (password, two-step, passkey, outside sign-in, accepting an invitation, this computer) lands on this page with no profile in use yet (users spec D3): the sign-in’s own profile is already selected (highlighted and focused, with a Continue as {name} button, so Dad’s email selects Dad and Mom’s selects Mom) and nothing opens until someone is clicked or Enter is pressed; a profile with a PIN asks for it. Until then the Engine allows only this page’s needs (listing the household’s profiles and their pictures, choosing one, signing out). A household of one person without a PIN is opened for them. The page is also opened from the account menu’s Who’s watching? item (shown only with more than one profile). The same menu lists the other people in the household for a one-tap switch: switching is free unless the profile has a PIN, so a Kids profile can switch to anyone, and a person with a PIN opens the number pad inside the menu; a wrong PIN, a lockout or a refusal is shown there with nothing changed. Administrator screens appear only while the active profile holds the role, so a household administrator who switches to a server administrator’s profile (and its PIN, if set) can then act as one. The list reuses the profiles the page already loaded, so opening the menu adds no Engine requests. An account with one profile never sees it. Administrators in a household that has a Child profile and an adult profile without a PIN see one gentle note: Set PINs on adult profiles so children can’t switch into them. Nothing is blocked. Restricted profiles still never reach admin areas.

Manage profiles on the picker (October 10 2026)

Administrators (server or household) see a Manage profiles button under the grid, and an Add profile tile while the household has fewer than eight people. Kids (restricted) profiles never see either, and nobody else does: the Engine only lets administrators change people. Manage profiles turns the grid into edit mode: every face shows a pencil, tapping one opens the profile editor sheet (name, avatar, Kids, content limit, PIN, delete) instead of opening the profile, and Done returns to normal. The page also opens in this mode at /who?manage=1, and with the Add profile sheet open at /who?add=1; both stay on the page even for a one-person household.

Adding creates a household person (optionally a Kids profile and a PIN) and then uploads the chosen photo. Saving an existing person changes name, colour and icon first, then the PIN (set, change or remove), then the photo (a new photo, or removal when a colour or icon replaces it). A Kids profile can’t be switched to an adult one afterwards. Delete is offered for everyone except the last profile, a household’s last household administrator and the profile that is open right now. Deleting asks what to do with the person’s personal photos: Move to Shared (the default, in a folder and tag named From ; managed files move, linked originals are copied and left where they are) or Delete, and says that the person’s sign-in goes with the profile. Everything personal (history, progress, bookmarks, lists, taste picks) is always removed and library files are never touched. The Engine’s refusals (eight people, the last household administrator) are shown in its own sentence. If any photo can’t be kept, nothing is removed. Every change needs a recent sign-in (the usual Confirm it’s you prompt) and, when administrator protection is on, the administrator PIN, which the page asks for once and then repeats the change.

Content limit per profile (October 10 2026)

Every profile has its own What can this person watch? setting, chosen by an administrator in the profile editor: Everything, G, PG, PG-13 or R. It is separate from the Kids label, so a parent can allow an eight-year-old PG-13 or limit an adult. A new Kids profile starts on PG, everyone else on Everything. The editor shows the choice as a five-step segmented control with a one-line explanation, plus a Show items with no rating switch (off by default, shown only while a limit is set) because music, personal videos and some imports carry no rating.

The editor sheet is compact: a large avatar preview with one Change button that opens a Colour / Icon / Photo sub-panel (collapsed on open, closed again after a colour or icon is picked; the “replaces the current photo” note shows only on the Photo tab). Kids profile, content limit, the unrated switch and PIN share one row style (label and one-line hint left, control right, at least 44 px tall); the PIN row shows No PIN or PIN set with Set / Change / Remove buttons and opens the PIN pad inline only while changing. It is a bottom sheet on phones and a centred dialog about 560 px wide elsewhere.

The Engine enforces the limit, not the screens. Ratings from every vocabulary (film G to NC-17, TV-Y to TV-MA, UK and plain ages such as 12, 15, 18, and book or comic labels such as Everyone, Teen, Mature) are placed on one ladder; anything above the profile’s step, and anything unrated unless allowed, is removed before a list, search, Home shelf, collection, Continue Watching row, detail page, file, stream or player queue is built. A TV episode takes its rating from the episode, then its show. A change applies on the person’s next request. A limited item is reported as not found. Changing the limit needs the same sign-in checks and administrator PIN as any other profile change.

Dashboard UI bugfix policy (October 6 2026)

Watch and View video remove Back and expose exactly one Close action at the top right. Watch Close opens the movie detail or the show detail scoped to the current owned episode, including when Close is pressed while episode metadata is loading. View Close invokes its hosting listing callback and preserves that listing’s scroll position. View Info is a visibly selected toggle with aria-pressed and Show/Hide information tooltips; its panel has no separate Close button. Click-pinned desktop Lyrics and Queue & History cards persist through outside clicks, focus loss and page navigation; their own trigger, Escape from inside the card, or player shutdown closes them. Hover previews still dismiss on leave and opening another dock card replaces the previous one. Ordinary menus retain ordinary dismissal. Owned audiobook totals count distinct works across chapter files and editions; music remains file-based and physical ingestion totals are labelled Files. Vertical wheel scrolling remains native over cards; horizontal shelf motion is guarded only during active desktop Home expansion.

Continue Watching on Home and Watch uses episode stills, a main S{n} E{n} · Episode title line and a show-name caption. Percentage text is removed while accessible progress remains. Hover/focus increases the artwork-edge progress strip by 2px with the shared brighter accent, without changing card geometry. TV episode rails start at the first owned card with an 8px highlight gutter and a disabled/hidden previous arrow; Season and Jump to share one controls row, the redundant watched-status line is removed, and Show missing belongs beside the owned summary. Detail hero utility circles use the same 24-unit outline playback glyph family and 56px targets. Native switches retain the pre-migration track/thumb geometry, thumb elevation and state colours through the shared controls layer.

Global search: “File missing” rows (October 2026)

After a restore, items that were in your backup but whose files are not back yet are not in the Library, so ordinary search cannot find them. Global search (the overlay and /search) lists the signed-in person’s own waiting items in a separate File missing section, always last and never the top result. Each row shows the title, the show, album or series it belongs to, the year and a plain “File missing” note. It has no link, no artwork, no Play and no “See all”, and the row is not focusable like a link. Only the person’s own items appear (never another profile’s), never an adult-video (Vault) title, and never a View item (photos, documents and the like), at most 10 rows. Once the file returns and the saved progress and bookmarks are put back, the row disappears. The “N results” count and the top result are only titles you can open. The section appears under All and under Titles.

Vault mode and the Vault (Dashboard)

Where the Engine says yes, and only there. The Dashboard asks the Engine whether the signed-in profile can use Vault mode. A profile that is Off, a Kids or content-limited profile and any app get “not found”, so the profile page, the profile menu, Search, the navigation and Add folder draw nothing about it: no switch, no check, no PIN pad, no word. It is not disabled, it is absent. A Kids profile is not even asked.
One PIN. There is no separate Vault PIN. The profile’s own PIN is the only PIN: it protects switching to the profile, and, when the person turns the matching switch on, their admin pages and Vault mode. Wrong tries at any of these doors count together (five wrong tries pause the PIN for fifteen minutes). A profile without a PIN simply has no PIN questions; admin pages and, if the administrator allowed it, Vault mode open without one.
The switch and the button. A person who can use it finds a Vault mode switch on their own profile page (the single place to turn it on), an optional “Show a Vault mode check in the top menu” switch and a choice “Turn Vault mode off after being idle for” (5, 15, 30 or 60 minutes, or Never when no PIN is asked; 60 minutes unless changed). Pressing Vault mode asks for the profile PIN on a number pad when the profile asks for one, otherwise it turns on at once and stays on. Vault mode belongs to the device session: pressing Escape twice, the menu check, switching profile, signing out and closing the app all switch it off and return to Home, and it switches itself off after the idle time while real use of the page keeps it on.
The area. While Vault mode is on a fourth entry, Vault, joins Read, Watch, Listen and View, and Search gets a separate Vault group. The area has a Blur toggle at its top (and at the top of the Vault search results) that starts blurred every time the area unlocks, viewing options (layout, group by, sort, covers, titles) remembered per profile on that device, and the views Recently added, Scenes, Folders, Unmatched, Images, Performers, Studios and Tags. The tab title is plain.
Administrators. The profile page of an adult offers two switches for Vault mode: “Vault mode for X” and “Ask for their PIN to open Vault mode” (on when Vault mode is first turned on for a profile that has a PIN; turning it off first says “Anyone using this profile will be able to open the Vault.”). Asking for a PIN needs the profile to have one, and a PIN that either switch depends on cannot be removed until the switch is off. Granting access asks for the administrator’s own profile PIN again, and an administrator with no profile PIN is asked to set one first. Separately, each administrator profile has “Ask for my PIN on admin pages” (off by default; needs a PIN). Vault library settings sit inside the area, and the third Add folder choice (Vault) appears only for administrators while Vault mode is on.
Vault libraries in Settings > Libraries. There is no Vault card or tile. A Vault library is an ordinary library whose Access is Vault-protected, chosen only in the Add library dialog and never switched later; each content type has at most one ordinary and one Vault library. The choice, the library’s row, its Access display, Add as a Vault folder and Move to Vault are drawn only for a server administrator whose Vault mode is unlocked (not a Kids profile); for anyone else there is no row, word or hint. Move to Vault shows a preview only for now and moves nothing. A Vault library’s Lookup tab has a “Look up details online” switch (off by default) that is stored but sends nothing until a later update, and its Activity tab points to the Vault.

Book reader pictures, highlights, bookmarks and settings

Pictures. Every EPUB opens in this one reader. It opens the book file once and unpacks pictures itself, so illustrations, maps, inline figures, CSS backgrounds and full-page covers appear on every device without separate picture requests. A picture whose label inside the book is missing or wrong is still shown (the reader works out the kind from the file). A picture that is damaged or unsupported shows a small “Picture unavailable” note in its place and the rest of the page is untouched. Pictures from outside the book are never fetched. The old chapter-by-chapter reader and the ?reader=new switch are gone; reading statistics were not carried over (in-book text search was brought back, see Search below).
Tools. The top bar of the new reader has Search in this book, Contents, Bookmark this page, Bookmarks and highlights, and Reading settings. Each opens one panel: a side panel on tablets and desktops, a bottom sheet on phones (about three quarters of the height at most), closed by the scrim, its Close button or Escape.
Search. The magnifier in the top bar (or Ctrl or Cmd + F while the book has focus, since the browser’s own Find cannot see inside a book) opens a panel with a search box. Press Enter or the magnifier with two or more letters and the reader looks through every page of the book on the device, ignoring capital letters and accents. Each place found shows the contents entry it sits under and the words around it with the match marked; choosing one closes the panel and goes there, and the matches on the pages shown stay outlined until the next search. The list stops at 50 places and says so; a search with no matches says so plainly. Nothing is sent anywhere.
Highlights. Selecting text shows a small toolbar under the selection with five colours and “highlight and add a note”. Tapping an existing highlight opens a card with its colour, its note, Delete and Done; closing the card saves a changed note. Highlights are saved per profile, anchored by a standard EPUB position (CFI range), so they stay on the same words when the text size or width changes. Highlights made in the old reader are not shown. Devices without text selection (a TV remote) can still see highlights and use bookmarks, contents and settings.
Bookmarks. “Bookmark this page” saves the current place with the section name and percent as its label; a place that is already bookmarked says so instead of adding a duplicate. The list opens a bookmark, newest first, and deletes it.
Settings. Theme (light, dark, sepia, auto), text size, line spacing, typeface (the book’s own, serif, sans), page width (narrow, standard, wide) and layout (pages or one scroll). They apply immediately. The reader opens with the profile’s reading defaults (/settings/reading), setting by setting: a setting the person changed in the reader on this device wins over the profile value, and a setting never changed on this device uses the profile value (so a later change to the profile still reaches it). A change in the reader is remembered on the device and also saved to the profile a moment later, and only the setting that changed is written to either. Reset to my defaults in the reader’s settings panel clears this device’s choices, including any saved before this feature, and shows the profile’s values again.
Keyboard and remote. Arrow keys, Page Up/Down and Space turn pages while the page has focus; while a toolbar, panel or card has focus, the arrow keys are left to it so a remote can move between controls. Enter or OK on the page shows or hides the bars. Escape closes the card, then the panel, then leaves the book.
Phones and TVs. Bars respect safe areas, panels become bottom sheets under 600px, and controls grow on screens 1600px and wider.
Nothing spills past the page. On reflowable books every element is held to its page column: wide tables and fixed-width blocks shrink to fit, long unbroken words and dotted leaders wrap, and white-space: nowrap is set back to normal, so a printed contents list on a front page never leaves a clipped continuation on the next page. Fixed-layout books are left exactly as published. scripts/visual-qa/book-reader/run-checks.mjs measures this at 390, 820, 1280 and 1920 px.