fix: close playback progress readers between polls

YouTube returned an anti-bot challenge on the default network route. The same installed extractor succeeds over IPv4 without cookies. Apply the route choice to shared search, feed and metadata extraction.

Cargo.lock

@@ -79,6 +79,12 @@ version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
 [[package]]
 name = "base64"
 version = "0.23.1"
@@ -260,6 +266,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b"
 dependencies = [
+ "base64 0.22.1",
  "bitflags",
  "crossterm_winapi",
  "derive_more",
@@ -1445,6 +1452,7 @@ name = "tubular"
 version = "0.1.0"
 dependencies = [
  "clap",
+ "crossterm",
  "image",
  "libc",
  "ratatui",
@@ -1508,7 +1516,8 @@ version = "3.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9a7ac20be9b7726e0bbdbf974c059676d9acb1cd414961f570a4e8231cacd7fc"
 dependencies = [
- "base64",
+ "base64 0.23.1",
+ "flate2",
  "log",
  "percent-encoding",
  "rustls",
@@ -1524,7 +1533,7 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f86fd172ccca569e458f61b6bdd6220965a9ef36e672a6852953b51a0e1583be"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "http",
  "httparse",
  "log",

Cargo.toml

@@ -2,10 +2,11 @@
 name = "tubular"
 version = "0.1.0"
 edition = "2024"
-description = "A terminal YouTube and Miruro browser that opens selected videos in Terebi"
+description = "A terminal YouTube and AniList browser that opens selected videos in Terebi"
 
 [dependencies]
 clap = { version = "4.6.7", features = ["derive"] }
+crossterm = { version = "0.29.0", default-features = false, features = ["osc52"] }
 image = { version = "0.25.10", default-features = false, features = ["jpeg", "png", "webp"] }
 ratatui = { version = "0.30.2", default-features = false, features = ["crossterm", "unstable-rendered-line-info"] }
 ratatui-image = { version = "11.1.0", default-features = false, features = ["crossterm"] }
@@ -15,7 +16,7 @@ toml_edit = "0.25.17"
 time = "0.3.55"
 unicode-normalization = "0.1.25"
 unicode-segmentation = "1.13.3"
-ureq = { version = "3.4.2", default-features = false, features = ["rustls"] }
+ureq = { version = "3.4.2", default-features = false, features = ["rustls", "gzip"] }
 
 [target."cfg(unix)".dependencies]
 libc = "0.2.190"

README.md

@@ -1,16 +1,18 @@
 # tubular
 
-A modal terminal YouTube and Miruro browser built with Rust and [Ratatui](https://ratatui.rs/). Search for videos or anime episodes, organize YouTube channels and saved Miruro shows with overlapping tags, and open a selection in Terebi.
+A modal terminal YouTube and AniList browser built with Rust and [Ratatui](https://ratatui.rs/). Search videos or anime catalog titles, organize channels and saved shows with overlapping tags, and open a selection in Terebi. The explicitly separate Miruro legacy catalog and library remain accessible.
 
 ## Requirements
 
 - A recent stable Rust toolchain, including Cargo, to build and install.
-- [`yt-dlp`](https://github.com/yt-dlp/yt-dlp) on `PATH` for YouTube searches, feeds, and full descriptions; Miruro uses the native API client.
-- `curl` on `PATH` for YouTube thumbnails and Miruro cover art.
-- The **Terebi CLI** installed on `PATH`, together with its app bundle and streaming dependencies, for playback. YouTube requires `--new-instance --url … --progress-file PATH`; Miruro additionally requires `--source-file PATH` and version-2 episode progress support.
+- [`yt-dlp`](https://github.com/yt-dlp/yt-dlp) on `PATH` for YouTube searches, feeds, and full descriptions; AniList and legacy Miruro catalog requests use native HTTPS.
+- `curl` on `PATH` for thumbnails and anime cover art.
+- The **Terebi CLI** installed on `PATH`, together with its app bundle and streaming dependencies, for playback. Single videos use `--new-instance --url … --progress-file PATH`; queues require `--new-instance --queue-file PATH`. AniList playback requires the ZokoAnime sub resolver and version-2 `anilist` identity progress support; legacy Miruro retains its own resolver and identities.
 
 The default playback setup requires **macOS 15+**, since Terebi is a native macOS player. Install Terebi separately and follow its dependency/setup instructions; installing Tubular does not install the player.
 
+YouTube extraction uses IPv4 to avoid anti-bot failures on affected IPv6 routes. Terebi must be updated separately for the same playback fix; rebuilding Tubular alone does not change its bundled extractor invocation. No browser cookies are read.
+
 A terminal with native image support can display thumbnails and cover art using its graphics protocol. Other terminals fall back to colored half-block characters.
 
 ## Installation
@@ -32,18 +34,21 @@ cargo run --locked -- "rust programming"
 ## Usage
 
 ```sh
-tubular                       # Choose YouTube or Miruro
+tubular                       # Choose YouTube, AniList, or Miruro legacy
 tubular "rust programming"    # Choose a provider, then search this query
-tubular --miruro "apothecary"  # Skip the chooser and search Miruro directly
+tubular --anilist "Cowboy Bebop" # Native AniList catalog; resolve sub on selection
+tubular --miruro "apothecary"  # Explicit legacy Miruro browsing
 tubular --player /path/to/terebi "japanese podcast"
 tubular --help
 ```
 
-Startup shows a centered **YouTube / Miruro** selector. Use `j` / `k` or arrows to select and Enter to open that provider's separate interface; Esc, `q`, or Ctrl-C quits without opening a browser. Navigation, confirmation and Esc use the configured `selector.select.next`, `selector.select.previous`, `selector.open` and `selector.close` bindings; quit/interrupt bindings also apply. An initial CLI query searches whichever provider you select. `--miruro` bypasses the chooser; `--help` and `--default-config` remain noninteractive.
+Startup shows a centered **YouTube / AniList / Miruro legacy** selector. Use `j` / `k` or arrows to select and Enter to open; Esc, `q`, or Ctrl-C quits. Configured selector/quit keys apply. An initial CLI query searches only the chosen catalog. `--anilist` and `--miruro` bypass the chooser and are mutually exclusive; `--help` and `--default-config` remain noninteractive.
 
 After selection, the browser starts in **normal mode**. Press `i` to type a search; Enter submits a changed query and returns to normal mode. Esc returns without submitting.
 
-Both providers use the same layout: a cyan view heading, bordered search and results, a bordered status line, and a dim one-line key hint bar. Entries use two lines: the title above dimmed metadata. YouTube shows the channel and publication date beneath each video title, without separate channel/date columns; tagged channels remain cyan. The selected row uses black text on cyan with a `> ` marker; saved titles are green, watch-later titles magenta, and `✓` marks watched entries. Metadata and help open in centered cyan-bordered popups; bulk-removal confirmations use yellow borders. Miruro keeps its catalog navigation and title/episode metadata.
+In normal mode, `p` (`app.provider`) reopens the chooser with the current selection. Enter switches; Esc cancels; `q` or Ctrl-C quits. All three browser sessions retain their own queries, results, selection and history. Shared persisted state and pending progress follow the active browser, without mixing provider-scoped collections or show libraries. Switching never interrupts players or reapplies the initial CLI query.
+
+The browsers share a cyan view heading, bordered search/results/status, and a dim key hint bar. Rows place the title above metadata; YouTube channel/publication/duration behavior is unchanged. Saved titles are green, watch-later titles magenta, and `✓` marks watched entries. AniList and legacy Miruro reuse the anime catalog/series/episode interface, cover-art previews, overlapping show tags, checked queues and offline episode collections.
 YouTube's dimmed metadata row includes duration as `M:SS` or `H:MM:SS`, or `Unknown duration` when unavailable. Duration is retained in saved collections; older entries without duration remain readable.
 
 YouTube keeps fast flat listings, then resolves visible videos' original-preferred titles asynchronously, one metadata request at a time. Titles replace the listing text left to right at 20 ms per terminal column, using the smallest groups of whole user-perceived characters with matching column widths. Two narrow characters and one wide character therefore swap together after 40 ms, without shifting the untouched suffix or inserting temporary blanks. Only an exhausted shorter title is padded with trailing spaces; that padding disappears when the animation finishes. Offscreen changes apply immediately, and selection stays on the same video. Results are cached by video ID for the session; failures keep the listing title without automatic retries. This adds background yt-dlp requests, and opening video info can make a separate metadata request. “Original-preferred” uses the full extractor response, not a guarantee that YouTube will never return localized text.
@@ -55,19 +60,74 @@ terebi --new-instance --url 'https://www.youtube.com/watch?v=VIDEO_ID' \
   --progress-file '/private/session/progress.jsonl'
 ```
 
-Each selection opens an independent player instance without replacing existing playback. Tubular creates a private reporting session and consumes Terebi's progress records independently of the launcher. `--player` overrides the Terebi CLI executable; it is not a generic mpv/IINA adapter. Tubular reports launcher failures, while later streaming/playback errors appear in Terebi. Quitting Tubular leaves launched players running.
+Plain Enter opens one independent player instance without replacing existing playback. Ctrl+Enter appends to a running player's queue instead. Tubular creates a private reporting session per video and consumes Terebi's progress records independently of the launcher. `--player` overrides the Terebi CLI executable; it is not a generic mpv/IINA adapter. Tubular reports launcher failures, while later streaming/playback errors appear in Terebi. Quitting Tubular leaves launched players running.
 
-### Miruro browser
+### Multiple video selection
 
-Choose **Miruro** at startup or use `--miruro` to start directly. Its interface is **catalog → series → episodes**, with a separate saved-show library organized by overlapping category tags, without YouTube's Search/Feed tabs or channel controls.
+In video and episode lists, **Space** checks/unchecks the hovered row; **Esc** discards checks. **Enter** plays checked rows in the order they were checked, regardless of their current displayed order. Unchecking and rechecking a row moves it to the end. With no checks, Enter plays the hovered row. These controls also work in collection views and metadata previews; Miruro catalog titles and saved shows cannot be checked.
 
-Catalog autocomplete returns at most eight anime titles, without pagination. Titles show the available format, status, season/year and planned/listed episode counts; press `d` for cover art, a bold title, dimmed metadata and a synopsis excerpt, using the same info layout as YouTube. Press `d` again for the full scrollable synopsis and returned facts; another `d` returns to info, and Esc closes either mode. The series screen lists only actual returned episodes—not planned or absolute episode numbers—with titles, dates and durations when supplied. Selected episode details appear first, above the series synopsis and beside the series cover art in info mode. Listed counts do not guarantee that a supported Sun source is available.
+Selection and watched state share one marker slot: `*` for checked rows, otherwise `✓` for watched rows, otherwise blank. Checking a row only overrides its displayed marker, not its stored watch state. Category and tag selectors keep their checkboxes.
+
+In normal browsing, Esc discards checks even when none are selected; `-` remains back navigation. Popups and text inputs keep their existing Esc close/cancel behavior. Ctrl-Space remains an alternative way to clear checks.
+
+Checks belong to each cached view/screen and preserve check order by stable video identity through pagination and reordering. Refresh/replacement queries clear them; collection filtering/removal prunes checks for hidden/removed rows. Successful launcher creation clears checks, while immediate launch failures retain them. Saving, removing and marking watch status still affect the hovered video, not every checked row. Configure `video.select.toggle` and `video.select.clear`; terminals must transmit Ctrl-Space, or bind another chord.
+
+Two or more checked videos launch `terebi --new-instance --queue-file '/private/session/queue.json'`. The private version-1 manifest contains ordered canonical episode/video page URLs and one independent `progress_file` per item. Terebi reuses its queue navigation and resolves each item when selected, not in advance; no expiring playback sources are stored. Each item's watching/watched state and resume identity remain independent, including after Tubular restarts. Single-video launches retain the command above. See the [queue contract](docs/terebi-url-playback-handoff.md#ordered-stream-queue-handoff).
+
+**Ctrl+Return** (`video.enqueue`) sends the same checked rows in check order, or the hovered row when none are checked, to a running Terebi queue without replacing its current playback. The terminal must transmit the modified Return, or you can rebind the action. Enqueue always uses `terebi --enqueue --queue-file '/private/session/queue.json'`, even for one video, preserving independent per-item progress. If Terebi is not running, it starts with that queue. Plain Return still opens a new instance. These shortcuts do nothing on Miruro catalog titles or saved shows and do not submit text inputs.
+
+Tubular requests the Kitty keyboard protocol's escape-code disambiguation for its entire terminal session and restores the previous mode on exit. Supporting terminals can then distinguish Ctrl+Return from plain Return. A terminal or multiplexer that does not support/forward this protocol may still send identical bytes for both; Tubular cannot distinguish them. In that case, configure another key, for example `[keys.video]` with `enqueue = "alt+e"`.
+
+### AniList catalog and on-demand sub playback
+
+Choose **AniList** or use `--anilist`. Search/detail metadata comes directly from `https://graphql.anilist.co` through the existing native TLS client: gzip response compression, a 20-second timeout, no redirects, 2 MiB limits on both wire and decompressed response bodies, HTTP/content-type checks and GraphQL-error rejection. Searches return at most eight titles. Nullable artwork, descriptions, scores, planned totals and airing metadata remain unknown rather than being replaced with fabricated values.
+
+Opening an AniList search result builds catalog episode rows immediately from the metadata already fetched, without a second detail request. `r` still fetches fresh metadata; opening a saved-library show also fetches current detail. Back/forward retains the loaded screen.
+
+**Catalog episode numbers are not source availability.** A finished show's known total supplies catalog episode numbers; a releasing show's `nextAiringEpisode.episode - 1` supplies an airing/catalog count, separate from its planned total. Unreleased shows have no aired numbers. Missing totals/airing information remain unknown, not “zero episodes.” In an unknown-count series, press `i` (configured search/edit), enter a positive canonical episode number, then Enter to select it. Enter again launches that explicit episode. The direct source is **sub only**, never an automatic dub substitute. Numbers do not establish that a stream exists, including for specials or split seasons.
+
+AniList playable rows in series and offline episode collections have three aligned lines: title, existing metadata/watch markers, and a quiet source-check result. The third line starts as `Source check pending`, becomes `Checking source…`, then shows `ZokoAnime · sub`, `No source found` (only an explicit missing-episode response), or `Source check failed` (network/protection/malformed responses, manifest errors, an older CLI, or launcher failure). A positive check means a fresh source configuration and accessible valid root HLS manifest, **not** a guarantee that every segment or the full episode will play.
+
+Checks run progressively through the configured `--player` executable's headless `--check-source URL` command, one at a time: selected episode first, then only rows actually visible in the current viewport. There is no whole-series scan. Moving the cursor within visible rows lets the current check finish; scrolling it offscreen, navigating away, loading catalog metadata, opening a popup/input/provider chooser, or closing Tubular cancels pending work. Returning to an unobscured episode view resumes checks after its next rendered frame. Each check has a 30-second timeout and a 4 KiB output cap; cancellation kills and reaps the isolated CLI child without a background reader thread.
+
+Results are session-only by stable episode identity, including failures, so errors do not retry every tick. `r` clears this cache and refreshes the view. Checks do not change saved episodes, watched state, progress, config or stored metadata, and never store resolved URLs. Playback remains available for every status and always resolves the selected episode fresh; a check is not reused as playable media. An older Terebi CLI shows `Source check failed` without disabling playback. A successful handoff does not mark an episode watched.
+
+The second line retains series-average runtime (`25 min avg`), format and series year followed by collection/watch markers. Missing or zero average runtimes are omitted. These are series-level facts, not measured episode durations or individual air dates; legacy Miruro retains its episode-specific dates/durations and two-line rows. Every line reserves the same checked/watched marker width so its text aligns with the episode title.
+
+
+Identities are `anilist:<positive decimal AniList ID>:<positive episode>`, with both numbers bounded by Int32. The stable handoff is `https://zokoanime.video/stream/ani/ID/EPISODE/sub` (`ani`, not the broken `anilist` route). Sources, tokens and subtitle URLs are never stored in collections or playback snapshots. Queues use the same stable URL and per-item private progress files; version-2 reports identify `provider = "anilist"`, decimal-string `media_id`, and numeric `episode`.
+
+`anilist-library.toml` stores AniList shows/tags separately from the untouched `miruro-library.toml`. Shared episode collection/state files use exact provider-qualified keys and filter each catalog independently; `miruro:1:1` is not `anilist:1:1`. No opaque Miruro IDs, saved show metadata or old playback sessions are mapped or reinterpreted.
+
+The controls in the legacy table below also apply to AniList, except unknown-count series use `i` for explicit episode selection. Saved AniList shows reopen current native detail by ID. The display limit is 10,000 known catalog numbers; oversized counts report an error instead of truncating silently.
+
+Read-only native smoke (does not launch playback):
+
+```sh
+cargo run --locked --example anilist_probe
+cargo test --locked
+cargo run --locked -- --anilist "Cowboy Bebop"
+```
+
+The probe searches the real catalog, selects exact AniList ID 1, fetches detail, and emits the episode-1 identity/stable URL without checking a source. It does not prove playback. For a read-only provider smoke, run `terebi --check-source https://zokoanime.video/stream/ani/1/1/sub`; it prints one version-1 JSON line and does not launch the app. See `docs/anilist-direct-provider-feasibility.md` for historical native source/media evidence and outstanding AniList terms/distribution caveats.
+
+### Miruro legacy browser
+
+Choose **Miruro legacy** or use `--miruro`. This explicitly retained catalog has its own **catalog → series → returned episodes** session and saved-show library; it is never consulted for AniList browsing or playback.
+
+Catalog and episode-metadata requests use the official Miruro 2.0 mirrors (`miruro.cx`, `.pw`, `.ws`, `.to`, `.tv`, `.bz`), not their legacy `www.` versions. Each session starts with `.cx`, remembers the last working mirror, and tries each mirror at most once when a host is unreachable, blocked, redirected, unavailable, or returns an unexpected Content-Type/unreadable body. Requests have a shared 25-second budget with at most five seconds per mirror; rate limits and other invalid/unauthorized requests stop immediately. No per-request randomization, directory scraping, cookies, or Cloudflare bypass is used. If every mirror is blocked, browsing still fails with the number of mirrors attempted and the last failure. Playback retains Terebi's existing `barelystarted.miruro.tv` URL contract; catalog failover does not add playback-mirror support.
+
+Catalog autocomplete returns at most eight anime titles, without pagination. Titles show the available format, status, season/year and planned/listed episode counts; press `d` for cover art, a bold title, dimmed metadata and a synopsis excerpt, using the same info layout as YouTube. Press `d` again for the full scrollable synopsis and returned facts; another `d` returns to info, and Esc closes either mode. The series screen lists only actual returned episodes—not planned or absolute episode numbers—with titles, dates and durations when supplied. Selected episode details appear first, above the series synopsis and beside the series cover art in info mode. Listed counts do not guarantee a playable source; Terebi resolves playback.
 
 | Key | Miruro action |
 | --- | --- |
 | `i` / `/` | Edit the catalog query; Enter searches, Esc cancels |
+| `p` | Reopen the provider chooser in normal mode |
 | `j` / `k`, ↓ / ↑; `g` / `G`, Home / End | Select a title or episode |
-| Enter | Open a series, or resolve a fresh direct **ssub / sun** source and play the episode |
+| Space / Esc | Check/uncheck the hovered episode / discard episode checks |
+| Enter | Open a series, or play checked episodes in check order (hovered episode when none are checked) |
+| Ctrl+Return | Append checked episodes, or the hovered episode, to a running Terebi queue (`video.enqueue`) |
+| `y` | Copy the hovered episode's page URL (also in previews and offline collections; `video.copy_url`) |
 | `-` / `+` | Back / forward through cached screens, preserving query and selection |
 | `w` / `v` | Save the selected episode to watch later / saved episodes |
 | `s` | Edit the selected show's category tags; Enter saves the show, including with no tags |
@@ -85,11 +145,11 @@ These actions reuse the existing `[keys]` configuration; live hints and help omi
 
 Space checks categories for combined browsing; Enter opens their deduplicated union even when the filter hides them. With no checks, Enter opens the hovered category or All saved shows.
 
-Only episodes can have their watch status edited. Reopening a saved episode resolves new URLs; identity is the opaque Miruro catalog ID plus its returned episode number. Each interface shows only its provider's collections, while playback, watched state and storage remain shared. Episode markers show saved/watch-later/currently-watching membership and watched status; Terebi owns resume positions.
+Only episodes can have their watch status edited. Reopening a saved episode passes its stable identity to Terebi for fresh resolution; identity is the opaque Miruro catalog ID plus its returned episode number. Each interface shows only its provider's collections, while playback, watched state and storage remain shared. Episode markers show saved/watch-later/currently-watching membership and watched status; Terebi owns resume positions.
 
 Catalog results, series screens and saved-show lists use the returned `cover_url`; missing artwork leaves a text-only preview, and image failures do not hide metadata. Offline episode collections retain their stored text-only details. JPEG, PNG and WebP covers load, decode and resize off-thread, with native terminal graphics or proportional half-block rendering. The session image cache retains eight inactive images plus the current selection; a successful `r` refresh clears it.
 
-Stream and external VTT subtitle headers are supplied explicitly; Terebi selects the source's declared default subtitle. Sources requiring media redirects, cross-origin HLS, proxies, iframe playback, or provider-specific playlist rewriting fail explicitly. No provider/language fallback or automatic expired-source refresh is performed.
+Tubular owns catalog browsing, selection, collections and watched decisions. Terebi owns source resolution, stream/subtitle headers, subtitles, playback titles and optional timeline metadata. Miruro launches use `https://barelystarted.miruro.tv/watch/OPAQUE_ID/episode?ep=RETURNED_EPISODE`; `episode` is a non-identifying placeholder slug, not a title. No source file or collection migration is required. Current Terebi displays the generic title `Miruro episode N`; title enrichment and intro/outro bands in the controls progress bar remain Terebi work. No automatic skipping or skip buttons are requested. See the [Terebi URL-playback handoff](docs/terebi-url-playback-handoff.md) for canonical-route handling and acceptance scenarios; this is not a claim of implemented timeline UI.
 
 
 ## YouTube controls
@@ -101,19 +161,24 @@ These are the default bindings. Overrides in `[keys]` replace an action's bindin
 | Key | Action |
 | --- | --- |
 | `j` / `k`, ↓ / ↑ | Select the next / previous video |
-| Enter | Launch the selected video in Terebi |
+| Space / Esc | Check/uncheck the hovered video / discard checks |
+| Enter | Play checked videos in check order, or the hovered video when none are checked |
+| Ctrl+Return | Append checked videos, or the hovered video, to a running Terebi queue (`video.enqueue`) |
+| `p` | Reopen the provider chooser |
 | `o` | Open the selected YouTube video in the default browser (also works in previews; configurable as `video.open`) |
+| `y` | Copy the hovered video's page URL (also in previews and offline collections; `video.copy_url`) |
 | `g` / Home, `G` / End | Select the first / last loaded video |
 | `i` | Edit the current category/combined feed search; other views use general YouTube Search |
 | `/` | Go directly to general YouTube Search |
 | `F` (Shift-F) | Go directly to the subscription Feed |
 | `d` | Open video info; press again for the full description, again to return to info |
-| Esc | Close the preview; otherwise return to the previous view |
+| Esc | Close a preview first; otherwise discard multi-selection without navigating |
 | `-` | Return to the previous view |
 | `+` | Go forward after navigating back |
 | `c` | Browse saved categories |
 | `u` | Browse an individual saved channel |
 | `U` (Shift-U) | Open the selected video's channel |
+| `L` (Shift-L, in a channel view) | Browse that channel's public playlists |
 | `s` | Edit the selected channel's tags |
 | `S` | Edit tags for all saved channels in the current category |
 | `R` (Shift-R) | Rename the current category, including category-scoped collection views |
@@ -136,6 +201,8 @@ These are the default bindings. Overrides in `[keys]` replace an action's bindin
 
 **Ctrl-C quits from any mode or popup.**
 
+URL copying always uses the highlighted row, not the playback checks, and copies the same canonical page URL used for playback—not an expiring stream URL. It uses the terminal's OSC 52 clipboard support without external clipboard tools. Clipboard writes must be supported and enabled by your terminal and any multiplexer; Tubular can report sending the URL, but cannot confirm that the terminal accepted it. Text inputs and selectors keep `y` as ordinary input or ignore it.
+
 The bottom bar shows essential actions for the current context. Press `?` in normal mode—including selectors and previews—for the full reference. Scroll help with `j` / `k`, arrows, Ctrl-J / Ctrl-K, or PageDown / PageUp; `?` or Esc closes it without changing the underlying view or dialog. In text fields, `?` remains ordinary input.
 The overview groups shortcut/action rows under bold section headers such as `VIEWS AND VIDEOS`, with an empty line beneath each header. Shortcuts and action descriptions remain normal weight; the rows reflect configured bindings rather than showing internal action paths.
 
@@ -167,7 +234,7 @@ In terminals supporting bracketed paste, clipboard text is inserted in one opera
 
 ### Category search
 
-Press `i` in a category or combined-category feed to search only its channels' histories—not just already loaded videos. Enter submits a changed query and returns to normal mode; an unchanged query keeps cached results and pagination. Clear the field and submit to restore the ordinary upload feed. Esc leaves the draft unsubmitted.
+Press `i` in a category or combined-category feed to search only its channels' histories—not just already loaded videos. Enter submits a changed query and returns to normal mode; an unchanged query keeps cached results and pagination. Clear the field and submit to restore the ordinary channel catalog. Esc leaves the draft unsubmitted. Scoped queries still use YouTube's channel-search endpoint, which can omit music release tracks even when unfiltered browsing includes them.
 
 Each category and combined feed retains its own draft, submitted query, results, and pagination independently of general Search. Subsequent pages use the same scoped query and shared 60-video budget. Empty categories and failed scoped requests never fall back to global search. Search input in other views still opens general YouTube Search.
 
@@ -195,6 +262,12 @@ Combined feeds are not individual categories: `S`, `R`, and `Alt-w` / `Alt-v` re
 
 Press **`U` (Shift-U)** on a video to browse its creator directly, including channels you have not saved. This replaces the current temporary browsing tab without adding a subscription. Channel IDs are preferred; a valid handle is used when an ID is unavailable. Missing channel metadata leaves the current view unchanged. Unsaved channel views survive configuration changes for the session; explicitly removing a saved subscription still removes its channel view.
 
+### Channel playlists (`L`)
+
+Open a channel with `u` or `U`, then press **`L` (Shift-L)** in normal mode. Its public playlists load into a searchable selector: `j` / `k` or arrows move, `i` filters by title, and Enter opens the selected playlist. In filter mode, arrows or Ctrl-J / Ctrl-K move; Esc returns to normal mode, then closes. Closing cancels an in-flight playlist lookup; close and reopen to retry a failed lookup. Configure the shortcut with `channel.playlists`.
+
+Playlist videos use the ordinary video table, 60-row pagination, playback checks, previews, and collection controls. They retain playlist order rather than sorting newest-first; repeated video IDs appear once, like other video views. Playlist views share the temporary tab without changing subscriptions. `-` returns to the channel and `+` restores the playlist's cached rows and selection. `r` refreshes the playlist from page one.
+
 ### Channel tags (`s`, or `S` for bulk editing)
 
 When search results omit a channel handle, `s` reuses its saved mapping or looks up the handle from the channel's canonical ID before opening the editor. Esc cancels a pending lookup without saving. Failed lookups or mismatched channel metadata leave the config unchanged.
@@ -259,7 +332,7 @@ Bulk editing refuses to clear all tags when a target has no `[channels]` registr
 
 ## Watch later
 
-Watch later is **one stored collection**, deduplicated by YouTube video ID or stable Miruro episode identity, with provider-specific views. In YouTube, category lists are derived from saved videos' channel identities and the **current** subscription categories: adding or removing a channel from a category changes its watch-later list after saving tags or reloading config with `r`. Its combined list contains only YouTube videos. Miruro uses the flat episode lists described above. No category memberships are stored on individual videos.
+Watch later is **one stored collection**, deduplicated by YouTube video ID or exact provider-qualified AniList/Miruro episode identity, with separate provider views. YouTube category lists still derive from channel identities and current subscription categories; anime uses flat provider-local episode lists. No category memberships are stored on individual videos.
 
 In YouTube, `W` opens a searchable collection selector from any video view or preview. The All categories (combined) entry comes first, followed by configured categories; it remains available even when there are no categories. Navigate with `j` / `k` or arrows in normal mode, or press `i` to filter by name and use arrows / `Ctrl-j` / `Ctrl-k` while typing. `Enter` browses the selected match; with no matches it does nothing. `Esc` returns to normal mode, then closes the selector without navigating. Reopening clears the search. `Alt-w` still opens the current category's watch later directly.
 
@@ -284,11 +357,13 @@ Files are siblings of `config.toml`:
 - `currently-watching.toml`: versioned metadata for unfinished videos, added by playback or marked manually.
 - `watch-state.toml`: versioned global watched video IDs.
 - `miruro-library.toml`: versioned saved-show catalog metadata and overlapping category tags, independent of episode collections.
-- `playback-sessions/`: private per-launch progress streams, expected identities, metadata snapshots, durable admission/manual-edit markers, and Miruro source documents.
+- `playback-sessions/`: private per-video progress streams, expected identities, metadata snapshots, durable admission/manual-edit markers, and ordered `queue.json` manifests for multi-video launches.
 
 State writes are atomic and owner-only. Invalid state files or detected external edits are reported rather than overwritten; repair the file or restart before retrying. Each state file is limited to 8 MiB.
 
-Progress sessions survive Tubular exit so later player reports can be recovered on the next launch. Miruro source documents are `0600` files in `0700` session directories and remain unchanged, even after launcher exit or reported end/close; they contain private, expiring resource URLs and headers. Sessions are retained because CLI exit does not prove the independent GUI has finished; up to 4,096 are monitored. Close the corresponding players before removing their inactive session directories, then restart Tubular. Never remove an active player's directory.
+Progress sessions survive Tubular exit so later player reports can be recovered on the next launch. Session directories are `0700`; snapshots, identity markers and Terebi-created reports are owner-only. New Miruro launches contain no resolved-source documents or CDN credentials. Existing sessions from earlier versions remain readable and are not automatically removed. Sessions are retained because CLI exit does not prove the independent GUI has finished; up to 4,096 are monitored. Close the corresponding players before removing their inactive session directories, then restart Tubular. Never remove an active player's directory.
+
+Progress polling keeps byte offsets and partial records in memory, opening and closing each report for each poll. Historical sessions do not retain open report descriptors; late writes from running players are still consumed.
 
 ## Saved videos
 
@@ -345,7 +420,7 @@ This prints TOML to stdout and exits without reading or writing config, starting
 video.info.overview = "I"
 video.info.description = "d"
 video.info.hide = ["escape", "backspace"]
-view.history.previous = ["-", "escape"]
+view.history.previous = "-"
 view.history.next = "+"
 video.play = ["enter", "ctrl+p"]
 ```
@@ -358,7 +433,9 @@ Using the same binding for overview and description preserves the default cycle.
 
 ## Loading and previews
 
-General Search loads up to 60 results per page. Feed and category views, including scoped category searches, share a **60-video total request budget per load**, distributed fairly across active channels—not 60 per channel. Each channel retains its own offset; exhausted channels stop receiving requests, and feeds with more than 60 channels rotate through them across loads. Matching ranges are batched across at most four concurrent yt-dlp processes, with further batches queued. Individual channel views can use the full 60-row budget.
+General Search loads up to 60 results per page. Feed and category views, including scoped category searches, share a **60-video total request budget per load**, distributed fairly across active channels—not 60 per channel. Each channel retains its own offset; exhausted channels stop receiving requests, and feeds with more than 60 channels rotate through them across loads. Matching upload/search ranges are batched across at most four concurrent yt-dlp processes, with further batches queued. Release discovery and album extraction use the same four-process limit. Individual channel views can use the full 60-row budget.
+
+Unfiltered channel, Feed, and category browsing traverses each channel's uploads first, then the tracks in its **Releases** albums. Album tracks—not album links—consume the video budget; repeated tracks are deduplicated in the loaded results without refunding their raw-row quota. This includes artist catalogs whose music appears in general Search but not the channel's Videos tab. Channels without a Releases tab keep their uploads normally; other discovery or album failures remain page errors. Later pages re-traverse earlier releases to recover their track offsets, so large artist archives can take longer to load.
 
 In normal mode, forward video navigation authorizes prefetch when 20 loaded rows remain. Each successful page clears that intent, so short, duplicate-only, or unavailable batches do not immediately chain additional loads at startup. Only one page request runs at a time; insert mode and open popups pause automatic prefetch. A feed page is accepted only after every batch succeeds. Switching views cancels running and queued batches; returning resumes the same unaccepted per-channel ranges. Deep channel archives can get slower because yt-dlp offsets traverse earlier pages again.
 
@@ -374,7 +451,7 @@ Video info shows a thumbnail, title, author/publication details, and a clipped d
 
 ## Development
 
-[Miruro API notes](docs/miruro-api.md) document the native `tubular::miruro` wrapper, source-document projection, stable episode/progress contracts, and verification limits.
+[Miruro API notes](docs/miruro-api.md) document the native catalog-only `tubular::miruro` wrapper, stable episode/progress contracts and historical source/CDN research. The [Terebi URL-playback handoff](docs/terebi-url-playback-handoff.md) defines the playback interface and remaining title/timeline work.
 
 Unit tests live in `tests/unit/`, grouped by source module and loaded with `#[cfg(test)]` and `#[path]` so they retain access to private implementation details. Cargo runs them with the commands below; they are not separate integration-test crates.
 
@@ -384,10 +461,10 @@ cargo test --locked
 cargo clippy --locked --all-targets -- -D warnings
 ```
 
-Read-only native Miruro smoke (search → detail/episodes → fresh sources → HLS master/subtitle):
+Read-only native Miruro smoke (search → detail/episodes):
 
 ```sh
 cargo run --locked --example miruro_probe
 ```
 
-This uses the documented research title and direct Sun provider, stops on errors/protection pages, and does not download media segments or save tokenized URLs. The sample can become unavailable; passing it proves resource retrieval, not full player playback.
+This uses the documented research title and stops on errors/protection pages. The sample can become unavailable; passing it proves catalog retrieval, not Terebi playback. Earlier source/HLS/subtitle probe results remain historical evidence in the API notes.

docs/anilist-direct-provider-feasibility.md

@@ -0,0 +1,139 @@
+# AniList catalog and direct streaming feasibility
+
+Observed **2026-10-25**. Research only: no application/player implementation, browser automation, GUI playback, protection bypass, remote mutation, or persisted stream URLs. This investigation follows the proposed AniList catalog → independently resolved episode path, not another Miruro mirror change.
+
+## Decision
+
+**The catalog-to-native-media path works for a sample without Miruro.** AniList's native GraphQL interface returned catalog metadata, and ZokoAnime accepted both the returned MAL ID and its working AniList-ID route. Fresh HLS and English subtitles were retrieved; FFmpeg decoded a video frame at the start and after seeking to ten minutes.
+
+**This is not yet a drop-in Terebi integration.** The sampled playlist crosses CDN origins that Terebi deliberately rejects, and no authoritative ZokoAnime episode-inventory interface was found in the inspected documentation/selector. Do not replace the browsing UI, synthesize available episodes from AniList totals, or disable the player's origin checks on the strength of this sample.
+
+Evidence labels: **Observed** = executed bounded native requests/media probes; **Source** = inspected first-party documentation/JavaScript or maintained extractor code; **[INFERENCE]** = recommendation or implication not exercised in Tubular/Terebi.
+
+## Discovery and exact identity mapping
+
+**Source:** current [ani-cli master][ani-cli] identifies itself as version 5.1.6 and uses `hianime.at`, not the historical AllAnime interface. Its search/episode/server flow selects a ZokoAnime embed and reads its static source configuration. This is extractor-source evidence, not a recommendation to execute ani-cli or use its browser User-Agent/cipher configuration.
+
+**Observed:** default native `ureq` search for Cowboy Bebop returned separate series, movie and special entries. Selecting the exact TV-series entry yielded 26 actual episode links. Episode 1's declared sub server pointed to:
+
+```text
+https://zokoanime.video/stream/mal/1/1/sub
+```
+
+The [ZokoAnime site][zoko] and [documentation][zoko-docs] advertise MAL/AniList-ID embeds. Their deployed [selector implementation][selector] emits source values `mal` and **`ani`**, whereas the [documentation implementation][docs-js] describes `anilist`.
+
+**Observed discrepancy:** `/stream/anilist/1/1/sub` returned HTTP 404 JSON, `Route GET:/stream/anilist/1/1/sub not found`. `/stream/ani/1/1/sub` returned a playable configuration. Use the demonstrated `ani` route or AniList's `idMal`, not the prose's broken `anilist` route.
+
+AniList's [media interface][media] exposes both identifiers. The exact first catalog query was:
+
+```graphql
+query {
+  Media(id: 1, type: ANIME) {
+    id
+    idMal
+    title { romaji english }
+    format
+    status
+    episodes
+  }
+}
+```
+
+**Observed:** unauthenticated POST `https://graphql.anilist.co` returned HTTP 200 `application/json`, with AniList ID 1, MAL ID 1, title Cowboy Bebop, format TV, status FINISHED and total 26. After this query, the direct ZokoAnime lookup used only the returned identifier; no Miruro or HiAnime request participated in that lookup.
+
+A second native GraphQL query established the split-season and movie identifiers below. Route success means a source configuration was returned, not that every episode or the semantic content was visually verified.
+
+| Catalog entry | AniList ID | MAL ID | Catalog total | Direct lookup observed |
+| --- | ---: | ---: | ---: | --- |
+| Cowboy Bebop | 1 | 1 | 26 | `ani` and `mal`, episode 1: source + English subtitle; `ani`, episode 26: configuration present |
+| Attack on Titan Season 3 Part 2 | 104578 | 38524 | 10 | `ani`, episode 1: source + English/Spanish/Portuguese subtitles |
+| Cowboy Bebop: The Movie | 5 | 5 | 1 | `ani`, episode 1: configuration present |
+
+**[INFERENCE]:** no external mapping dataset or title matching is needed for these routes. [Fribb/anime-lists][fribb] offers catalog-ID and TVDB/TMDB season/offset mappings, but it is unnecessary for this demonstrated direct-ID path and does not establish ZokoAnime's episode availability. No dataset was downloaded/adopted or its license relied on.
+
+## Native request and media evidence
+
+The temporary Rust probe used the project's existing `ureq 3.4.2`/rustls transport, normal certificate verification, default User-Agent, a 20-second global timeout, zero automatic redirects and a 2 MiB text-body limit. No cookies, authentication, browser impersonation, cipher tuning, challenge solution or proxy was supplied. Resource requests used `Referer: https://zokoanime.video/`; whether that header is mandatory was not tested.
+
+Bodies were captured in memory; only metadata and redacted summaries were surfaced. Player JavaScript was inspected, never executed. The embed's `window.__P` configuration uses the Base64/XOR JSON transform explicitly implemented in [its own decoder][obfuscate]; no DRM, challenge or ad-verification protocol was implemented. Advertising scripts and view/telemetry actions were not requested.
+
+| Resource | HTTP | Content-Type | Body bytes / result |
+| --- | ---: | --- | --- |
+| [HiAnime title search][search] | 200 | text/html | 250238 bytes; series/movie/special candidates |
+| [Selected series][series] | 200 | text/html | 186932 bytes |
+| [Actual episode list][episodes] | 200 | application/json | 25926 bytes; 26 links; episode 1 ID 21418, title Asteroid Blues |
+| [Episode 1 servers][servers] | 200 | application/json | 1936 bytes; ZokoAnime and HD-1 for sub/dub |
+| [Direct MAL episode embed][mal-embed] | 200 | text/html | 1832 bytes; source + English subtitle configuration |
+| [Direct AniList episode embed][ani-embed] | 200 | text/html | 1832 bytes; source + English subtitle configuration |
+| Fresh HLS master, URL redacted | 200 | application/vnd.apple.mpegurl | 98 bytes; one advertised variant |
+| HLS variant, URL redacted | 200 | application/vnd.apple.mpegurl | 38193 bytes; 353 segments; ENDLIST; no EXT-X-KEY tags |
+| English subtitle, URL redacted | 200 | text/vtt | 14466 bytes; WEBVTT; 217 cue arrows |
+
+**Observed native media:** `ffprobe 9.0.2` exited 0 and reported H.264 video at 1448×1080, AAC audio at 48000 Hz, and duration 1483.145982 seconds. The manifest advertised 1920×1080; the decoded stream dimensions are the stronger evidence. No audio track/language equivalence across other items was verified.
+
+Two bounded `ffmpeg` runs, each capped at 30 seconds, requested one video frame with input seeks of 0 and 600 seconds. Both exited 0 with `frame=1` and `progress=end`. Final `ffprobe` and decode checks explicitly set `tls_verify=1` and `max_redirects=0`, used `http,https,tcp,tls` protocols only, five-second socket timeouts, 1 MiB probe size, two-second analysis duration, and `extension_picky=0`. The latter permits segment-content probing rather than trusting CDN filename extensions; Terebi already uses the same setting. No whole-episode download or GUI playback occurred.
+
+### Missing episodes are not HTTP errors
+
+**Observed:** [episode 27][missing] of the finished 26-episode sample returned **HTTP 200 `text/html`**, but no `window.__P` configuration. Its visible page said “Error 404 / Not found” and that there was nothing to play. Status/MIME alone cannot establish availability. The resolver must recognize missing configuration as unavailable, not a successful empty source.
+
+**Source:** AniList's `episodes` field is the amount when complete; its [streamingEpisodes][streaming-episodes] links are legal streaming-site links, not a general native-stream inventory. The inspected ZokoAnime documentation exposes a numbered embed lookup, and the player selector takes a manually entered episode number. No authoritative episode-list interface was established. The HiAnime listing proves the sample's inventory but would add another aggregation dependency if used in production.
+
+**[INFERENCE]:** episodic browsing needs a separate availability decision: obtain a supported inventory, or explicitly distinguish catalog episode numbers from provider-confirmed playable episodes and resolve on demand. This report does not choose or silently change Tubular's current available-episodes-only behavior. Split seasons, movies and specials still need explicit mapping semantics; the sampled routes are not universal proof.
+
+## Terebi compatibility and security
+
+**Observed:** the master and variant were on `hls.dramahot.top`, while their segment URLs named `hls1.drama1.cfd`. URLs/query tokens are deliberately not retained here.
+
+**Source:** current [`resolvedIOOpen`][player-policy] rejects any resource whose origin differs from the initial source's origin, and rejects redirects before forwarding custom headers. [`StreamURL.parse`][url-parse] has a dedicated Miruro case only; other hosts enter the YouTube path, not a ZokoAnime resolver. Existing Miruro identity/progress/state must not be reused to disguise this provider.
+
+**[INFERENCE]:** the sampled manifest would fail the current protected HLS path despite generic FFmpeg being able to decode it. Native FFmpeg success is not Terebi acceptance, subtitle rendering, resume/progress, or complete playback proof. No Terebi source or security policy was changed or exercised with this provider.
+
+A future integration needs a separately reviewed, origin-scoped resource/header policy for the concrete CDN relationships, or a demonstrably compatible source. Do not simply remove the origin comparison, globally allow cross-origin redirects, or forward headers to arbitrary manifest hosts.
+
+## Recommendation and remaining prerequisites
+
+- **Go for a focused implementation design:** AniList catalog → exact AniList/MAL ID → ZokoAnime native resolver is demonstrated independently of Miruro. Keep catalog/selection in Tubular and fresh source/subtitle resolution in Terebi. Do not add a general multi-provider framework or mapping database for this one path.
+- **Before replacing browsing:** settle authoritative episode availability versus explicitly labeled on-demand resolution. Keep unknown/missing distinct from zero and from network/protection errors.
+- **Before native player integration:** decide the narrow cross-origin policy and provider-correct identity/progress contract; map or explicitly retain existing Miruro-keyed collections rather than reinterpreting them.
+- **Before distribution:** review [AniList's terms][terms]. They prohibit mass collection, API use as backup/storage, and competing non-complementary list/tracker services. Tubular's local watched-state makes applicability worth clarifying; this investigation does not establish permission. ZokoAnime advertises iframe integration, but no stable documented raw-media/native interface or distribution-rights guarantee was established.
+- **Known limits:** small point-in-time sample; no ongoing-series inventory, dub media decode, special-numbering coverage, full episode playback, source expiry/IP-binding, uptime, geographical availability or rights verification. ZokoAnime may itself have upstream dependencies; only independence from Miruro on the exercised path is proven.
+
+### Reproduction record
+
+The executed temporary harness was built with `cargo build --locked --example direct_provider_probe` and called as `target/debug/examples/direct_provider_probe URL`; AniList POST payloads and resource Referer values were passed through environment variables. A Python subprocess driver kept response bodies and fresh URLs in memory, applied the first-party static config decoder and invoked `ffprobe`/`ffmpeg` directly. The temporary Rust source, binary and driver state were removed after this report; that Cargo example is **not a retained runnable command**. No permanent tests were added for research-only work.
+
+For a fresh ordinary-HTTPS metadata/status check, the following requests reproduce the public request shapes; the native results above were obtained with ureq, not these curl commands:
+
+```sh
+curl --silent --show-error --max-time 20 \
+  -H 'Content-Type: application/json' \
+  --data '{"query":"query { Media(id: 1, type: ANIME) { id idMal title { romaji } episodes } }"}' \
+  https://graphql.anilist.co
+
+curl --silent --show-error --max-time 20 --output /dev/null \
+  --write-out 'HTTP %{http_code}; %{content_type}\n' \
+  https://zokoanime.video/stream/ani/1/1/sub
+```
+
+Re-run source resolution before any media check; never save or publish resolved tokenized URLs. The first-party configuration decoder and native media flags above document the exercised method without retaining credentials or stale media URLs.
+
+[ani-cli]: https://raw.githubusercontent.com/pystardust/ani-cli/master/ani-cli
+[zoko]: https://zokoanime.video/
+[zoko-docs]: https://zokoanime.video/docs
+[selector]: https://zokoanime.video/assets/player-CiFNLeyH.js
+[docs-js]: https://zokoanime.video/assets/docs-sIsMGsz7.js
+[obfuscate]: https://zokoanime.video/core/obfuscate.js?v=23
+[media]: https://docs.anilist.co/reference/object/media
+[terms]: https://docs.anilist.co/guide/terms-of-use
+[streaming-episodes]: https://docs.anilist.co/reference/object/mediastreamingepisode
+[fribb]: https://github.com/Fribb/anime-lists
+[search]: https://hianime.at/search?keyword=Cowboy+Bebop
+[series]: https://hianime.at/cowboy-bebop-1281
+[episodes]: https://hianime.at/api/theme/episode/list/1281
+[servers]: https://hianime.at/api/theme/episode/servers?episodeId=21418
+[mal-embed]: https://zokoanime.video/stream/mal/1/1/sub
+[ani-embed]: https://zokoanime.video/stream/ani/1/1/sub
+[missing]: https://zokoanime.video/stream/ani/1/27/sub
+[player-policy]: ../../terebi/Sources/Core/player.cpp#L111-L126
+[url-parse]: ../../terebi/Sources/App/StreamResolver.swift#L8-L35

docs/miruro-api.md

@@ -1,6 +1,8 @@
 # Miruro API research
 
-Observed **2026-10-12**, scoped to **https://barelystarted.miruro.tv**. These are reverse-engineering notes, not an official API specification. Tubular includes a native API module, Miruro catalog/episode browsing, and direct Sun playback through Terebi's implemented source/progress contracts.
+Observed **2026-10-12**, scoped to **https://barelystarted.miruro.tv**; ownership split updated **2026-10-22**. These are reverse-engineering notes, not an official API specification. Tubular now owns catalog/detail retrieval and stable identity; Terebi resolves episode URLs. Source/CDN investigations below are historical evidence, not the current launch path.
+
+**Mirror update (2026-10-25):** the [official directory](https://www.miruro.com/#domains) links Miruro 2.0 at `https://miruro.cx`, `https://miruro.pw`, `https://miruro.ws`, `https://miruro.to`, `https://miruro.tv`, and `https://miruro.bz`; `www.` hosts are labeled Legacy. Tubular now uses these six explicit origins for catalog/detail requests. Local native `ureq` and curl probes received **403 `text/html`** from all six autocomplete endpoints; curl returned Cloudflare block pages. Thus live schema/ID compatibility and successful browsing on these mirrors remain unverified. The original `cargo run --locked --example miruro_probe` now exercises all six and reports `Miruro request failed on 6/6 mirrors`, rather than stopping at the obsolete browsing origin. Endpoint/schema evidence below remains the historical snapshot, not a claim of current mirror access.
 
 Evidence labels:
 
@@ -8,7 +10,7 @@ Evidence labels:
 - **Frontend:** behavior read from deployed first-party JavaScript; not necessarily a server-side guarantee.
 - **Unknown:** not established by those sources or requests.
 
-**Transport distinction:** research requests returned JSON, while a local `curl` source-validation request returned **403 `text/html`**, a Cloudflare block page. A subsequent local Rust `ureq` probe passed the search → detail/episodes → sources → HLS master/subtitle path without bypass machinery. Native access is proven for that client and sample, not every transport, network, provider or future request. Inspect HTTP status and Content-Type before decoding; stop on protection pages rather than treating them as empty results.
+**Transport distinction (historical):** research requests returned JSON, while a local `curl` source-validation request returned **403 `text/html`**, a Cloudflare block page. A subsequent local Rust `ureq` probe passed the search → detail/episodes → sources → HLS master/subtitle path without bypass machinery. Native access was proven for that client and sample, not every transport, network, provider or future request. Inspect HTTP status and Content-Type before decoding; never treat protection pages as empty results. The current client can try the next explicitly listed official mirror, but cannot restore access when every mirror blocks it.
 
 ## Endpoint map
 
@@ -52,7 +54,7 @@ The minimum evidenced flow is:
 4. Fetch `/api/sources?id=<opaque id>&n=<selected number>` immediately before playback.
 5. Choose a returned track/provider/server with direct streams; preserve that server's headers and runtime configuration. Iframe-only servers are not native media URLs.
 
-**Frontend:** [link helpers][link-helpers] generate `/info/<id>/<slug>` and `/watch/<id>/<slug>?ep=<number>`. The canonical title is the shorter trimmed English/Romaji title when both exist, otherwise the available English/Romaji, then native title/ID. Slugging applies Unicode NFD, removes combining accents, lowercases, removes non-ASCII-alphanumeric/non-whitespace/non-hyphen characters, trims, hyphenates whitespace, and collapses repeated hyphens. Display-language preference is separate. Missing/wrong-slug behavior is untested; preserve the deployed helper's convention rather than assuming an arbitrary slug works.
+**Frontend (2026-10-12):** [link helpers][link-helpers] generate `/info/<id>/<slug>` and `/watch/<id>/<slug>?ep=<number>`, with title-derived canonical slugs. **2026-10-22:** a placeholder watch slug returned a canonical-route redirect envelope; see the [URL handoff](terebi-url-playback-handoff.md#url-and-canonical-route-handling). Slugs are not episode identity. Tubular does not derive playback routes from display titles.
 
 ## Search and discovery contracts
 
@@ -192,7 +194,7 @@ Resolved watch `episodesData` has:
 
 Watch `episodes[].id` is the number rendered as a string, **not a provider episode ID**. `aniskip` times are seconds; they differ in naming from detail `skip_times`. `/api/sources` does not carry those fields. **Frontend:** watch converts `op`/`mixed-op` to intro and `ed`/`mixed-ed` to outro, filters wrong episodes/invalid intervals and optional provider/vote/duration constraints, then recomputes skips using player-reported duration. No separate skip endpoint was found. Missing/invalid episode behavior and last-episode boundaries are untested.
 
-## Source-resolution and playback contract
+## Historical source-resolution and playback research (2026-10-12)
 
 ### Plain source response
 
@@ -263,7 +265,7 @@ Observed `providerOrder`: `sun, bee, pewe, hop, ally, kiwi, moo, bonk, knob, nun
 - The browser loads [strm.cx/client.js][strm-client], renders `<strmcx-embed>`, and calls `setSession` with local player state/source/subtitle/skip data over `strmcx/v1` messaging. This was **not required for the tested source or direct-resource GETs**. It is not evidence of an authenticated API session prerequisite.
 - strm client contains a best-effort `POST /v1/embeds`; it was source-inspected only, not invoked. Iframe providers and unrelated comment/telemetry endpoints were not exercised.
 
-Tubular's direct Sun integration preserves fresh URLs and explicitly supplies the selected server's headers to both its stream and verified VTT subtitle resources. Terebi owns native HLS resolution and subtitle loading; other providers' proxies, headers and playlist transforms remain unverified and unsupported. See [the adopted integration contract](#tubular--terebi-integration).
+The former Tubular direct Sun integration supplied fresh URLs and headers to stream and VTT resources. That projection has been removed; Terebi now owns native URL resolution, HLS and subtitles. Other providers' transforms remain unverified by this research. See [the current integration](#tubular--terebi-integration).
 
 ## SvelteKit route data
 
@@ -387,32 +389,31 @@ console.log(response.status, response.headers.get('content-type'));
 console.log(await response.text());
 ```
 
-## Native Rust wrapper and verified probe
+## Native Rust catalog wrapper
 
-The local probe succeeded using Rust 1.90.0, `ureq` 3.4.2, rustls 0.23.45 and the `ring` TLS provider. Its isolated scratch project was removed after the exercised path was extracted into [src/miruro.rs](../src/miruro.rs). The client uses ordinary TLS verification, no cookies, no browser impersonation, no clearance tokens and no retry/alternate transport.
+The historical native probe succeeded using Rust 1.90.0, `ureq` 3.4.2, rustls 0.23.45 and the `ring` TLS provider. The current `tubular::miruro` module retains catalog/detail retrieval, the bounded route decoder and stable identity, not source resolution. It uses ordinary TLS verification, no cookies, impersonation, clearance tokens or alternate transport.
 
-Library interface, exposed as `tubular::miruro`:
+Current library interface:
 
 | Call | Result / contract |
 | --- | --- |
-| `Client::default()` | Reusable blocking HTTP agent; 25-second global request timeout; no automatic redirects |
+| `Client::default()` | Reusable blocking HTTP agent; six official 2.0 mirrors; sticky successful origin; 25-second total request budget, at most five seconds per attempt; no automatic redirects |
 | `client.search(query)` | `io::Result<Vec<serde_json::Value>>`; trimmed, nonempty autocomplete query; no cursor pagination |
 | `client.detail(id, slug)` | `io::Result<Detail>`; decoded `media` JSON and `episodes: Vec<Value>`; validates returned media ID |
-| `client.sources(id, episode)` | `io::Result<Value>`; fresh full response preserving headers/config/subtitles; validates positive episode and returned episodeNumber/tracks |
-| `client.source_document(id, episode, title)` | `io::Result<SourceDocument>`; fresh validated direct `ssub/sun` HLS/VTT projection for Terebi |
 | `Identity::new(id, episode)`, `Identity::from_key(key)` | Validated catalog namespace/episode identity; `key()` is `miruro:<opaque ID>:<episode>` |
+| `identity.watch_url()` | Validates identity and produces `https://barelystarted.miruro.tv/watch/<opaque ID>/episode?ep=<returned episode>` |
 
-The raw methods preserve JSON metadata rather than freezing every deployment-specific field into a second schema. `source_document` deliberately selects only direct Sun soft-subtitle playback; it does not guess another provider or implement a player. IDs/slugs are validated as nonempty ASCII alphanumeric/hyphen/underscore path segments. HTTP failures remain errors (`PermissionDenied` for 401/403); HTML and unexpected Content-Types are rejected, not converted to empty results. No tokenized URLs appear in its error messages. Successful bodies are limited to 2 MiB.
+Raw catalog methods preserve JSON metadata without a second deployment-specific schema. IDs/slugs are validated path segments; HTTP/HTML/Content-Type failures remain errors, not empty results. Successful bodies are limited to 2 MiB. Source selection, resource headers and subtitles belong to Terebi.
+
+The client starts at `miruro.cx` and remembers the last origin whose response passed HTTP, Content-Type and bounded-body checks. On transport/body failures, unexpected Content-Type, HTTP 301–308, 403, 404, 408 or 5xx, it tries the remaining origins once in directory order. Other HTTP errors, including 400, 401 and 429, stop immediately; rotating mirrors must not circumvent rate limits. Exhaustion reports the attempted/total mirror count and last origin/error. JSON/route decoding and detail-ID validation remain mandatory and do not trigger additional fallback. The directory is not scraped at runtime, and requests are not randomized. Playback URLs deliberately retain `barelystarted.miruro.tv`: current Terebi admits and resolves only that hostname, so playback failover requires a separate player change.
 
 Its private route decoder resolves only the needed detail value and episode promise, using separate value tables and promise IDs. Unrelated sidebar promises are not returned. It supports the JSON-shaped tables verified on this path, **not arbitrary devalue**: tagged special types and negative sentinels are explicit errors, never silently coerced to null. Out-of-range references, rejected/missing/duplicate episode chunks, cycles/excessive depth and decoded-size amplification are rejected. Depth is bounded to 64 and expanded values share a 2 MiB size budget. These are wrapper safety limits, not Miruro server limits.
 
-Run the retained live smoke:
+The retained `cargo run --locked --example miruro_probe` smoke now covers search → detail/episodes only, not sources or playback.
 
-```sh
-cargo run --locked --example miruro_probe
-```
+### Historical wrapper/source probe evidence (before URL cutover)
 
-Actual output from the extracted wrapper:
+The output and verification below describe the former source-capable wrapper, not the current example:
 
 ```text
 search: 8 records; selected Miruro ID OERe_a0YS4h-DlsBDOeXwX7HOO6316tw
@@ -425,44 +426,33 @@ PASS: native search -> detail/episodes -> sources -> HLS master + subtitle; no m
 
 The preceding scratch probe also reported HTTP 200 for search (`application/json`), detail (`text/sveltekit-data`, seven records), and sources (`application/json`). Detail decoding found two episodes and selected `episode_number:1`; source decoding found two tracks. The master and default subtitle were fetched using the actual returned `Origin: https://ultracloud.cc` and `Referer: https://ultracloud.cc/`. URL/header necessity and full playback were not tested.
 
-The [example](../examples/miruro_probe.rs) deliberately uses the documented title and `ssub/sun` provider, and limits resource requests to HTTPS `*.keeply.top` without redirects. It fails explicitly if that sample disappears or changes instead of silently choosing a different provider. It fetches no nested playlist, media segment, key, sprite or download page, and saves no tokens/bodies. This is an explicit network smoke command, not a network-dependent unit test.
+The former source-capable example used the documented title and `ssub/sun`, limiting requests to HTTPS `*.keeply.top` without redirects. It fetched no nested playlist, media segment, key, sprite or download page and saved no tokens/bodies. Those resource requests are no longer in the catalog example.
 
 Wrapper-extraction verification, before TUI integration: `cargo test --locked` passed all 164 tests, including the episode-promise regression; `cargo clippy --locked --all-targets -- -D warnings` passed; `rustfmt --edition 2024 --check src/lib.rs src/miruro.rs examples/miruro_probe.rs` passed. The decoder regression covers independent tables, out-of-order unrelated chunks, preserved episode/absolute numbers and nulls, unresolved/rejected promises, bad references/cycles, unsupported tags and route redirects.
 
 ## Tubular → Terebi integration
 
-`tubular` offers a centered YouTube/Miruro startup selector; an initial query follows the chosen provider. `tubular --miruro "apothecary"` bypasses it and starts the dedicated Miruro interface directly. `src/miruro_ui.rs` owns catalog → series → episodes navigation, synopsis/metadata presentation, cached screen history and flat episode collections; YouTube retains its separate Search/Feed/category interface. Catalog Enter opens actual returned episodes; episode Enter resolves fresh sources off-thread. Autocomplete is limited to eight titles, without invented pagination. `src/miruro_browser.rs` supplies native catalog/series/episode models and one worker for bounded network work; changing views/queries or episode selections invalidates stale source responses rather than launching obsolete selections. Canonical title/slug rules follow the [deployed helper][link-helpers], including Unicode NFD normalization.
+The startup selector and `--miruro` open the dedicated catalog → series → episodes interface. `miruro_ui` owns navigation, metadata presentation, cached history and collections; `miruro_browser` supplies catalog/episode models and catalog/detail worker requests. Autocomplete returns at most eight titles. Episode Enter passes a stable URL to Terebi; no Tubular source request or projection remains.
 
 Both browsers share `src/ui.rs` for layout, search editing/cursor scrolling, selection styling and loading animation. Miruro uses the same full-width results/status chrome and centered metadata/help/removal popups as YouTube, while preserving its own catalog/episode rows and navigation. Press `d` for metadata; arrows/Ctrl-j/k scroll it, while plain j/k change the selected row.
 
 Titles normalizing to an empty slug fail explicitly; the wrapper does not guess an alternative detail route. This does not reject accented Latin titles, which use NFD decomposition.
 
-### Source document and launch
+### URL launch and ownership
 
-`Client::source_document` chooses the first nonempty server/first direct HLS stream from the returned `ssub` track's `sun` provider. It requires native playback, `proxy:false`, and no enabled HLS host/query rewriting. Missing/unsupported sources are errors; no alternate language/provider, embed, proxy or refresh fallback is added.
-
-| Terebi source-v1 field | Projection |
-| --- | --- |
-| `url` | Selected stream URL, unchanged, including its query tokens |
-| `headers` | Selected server map, without trimming or rewriting |
-| `identity` | `{provider:"miruro", media_id:<opaque catalog ID>, episode:<returned episode_number>}`; not slug/external ID/absolute number/array index/playback provider |
-| `title` | Episode display title |
-| `subtitles` | Selected Sun provider's VTT tracks; other external formats excluded |
-| Track `url`, `language`, `label`, `default` | Returned `file` and subtitle metadata |
-| Track `headers` | Explicit selected Sun server map, verified for Sun resources only; no general inheritance rule |
-
-Projection validates HTTP(S) resource URLs, header syntax/values, case-insensitive duplicate headers, identities, control characters, 32-track/64-header limits and at most one default subtitle. Session creation also enforces the 1 MiB serialized source-document limit. Miruro media IDs allow at most 512 ASCII letters/digits/`-`/`_`; episodes range from 1 through 2147483647.
-
-`State::miruro_session` binds the source identity to the selected episode, creates a unique private session directory (`0700`), writes immutable `source.json` (`0600`) and metadata/identity snapshots, and returns a **nonexistent** progress destination. `PlayerLaunch::start_source` passes absolute filesystem paths, not resource URLs/header values:
+Both providers use `State::progress_file(video)` and `PlayerLaunch::start(&video.id, player, progress_file)`. Miruro's `Identity::from_key(id)?.watch_url()?` produces:
 
 ```sh
-terebi --new-instance --source-file '/private/session/source.json' \
+terebi --new-instance \
+  --url 'https://barelystarted.miruro.tv/watch/OPAQUE_ID/episode?ep=RETURNED_EPISODE' \
   --progress-file '/private/session/progress.jsonl'
 ```
 
-Terebi exclusively creates the report (`0600`). CLI exit acknowledges only launch acceptance, not successful media opening or completion. Tubular retains source/report files across launcher exit, final events, and Tubular shutdown because the independent GUI may still need them. The existing 4,096-session cap and explicit inactive-session cleanup apply; close the corresponding players before removing their session directories. Private source documents contain expiring URLs/headers; watched/collection state contains only stable identity and display metadata.
+The literal `episode` slug is non-identifying. Terebi's parser uses opaque ID plus episode; metadata acquisition must safely resolve canonical-route redirect envelopes. See the actionable [Terebi URL-playback handoff](terebi-url-playback-handoff.md).
 
-Terebi's implemented transport preserves headers on master/variant/segment/key/init requests and probes Sun's image-suffixed media/subtitle resources by content/declared VTT format. All media redirects and foreign-origin HLS resources are rejected; subtitle redirects must stay on their initial origin. Terebi does not refresh expired sources. These restrictions remain visible errors, not silent provider switches.
+Tubular registers the expected stable identity in a private reporting session before launch. Terebi exclusively creates the report (`0600`); session directories remain private (`0700`). CLI exit acknowledges launch acceptance, not media readiness. Retention, the 4,096-session cap, explicit inactive-session cleanup and restart recovery remain unchanged; close corresponding players before removing sessions. No new `source.json`, source-v2 contract, segment file, persistent `Video` fields or collection migration is required.
+
+Terebi owns fresh sources, headers, subtitles, playback titles, resume and optional timeline metadata for both direct and Tubular URL launches. Current native URL/progress support is not title/timeline completion: the title is currently `Miruro episode N`; title enrichment and intro/outro progress-bar bands remain Terebi work. Optional metadata failure must not prevent playback. No caller-specific source fallback, automatic skipping or skip buttons are requested.
 
 ### Progress and collections
 
@@ -476,9 +466,9 @@ Tubular validates the version, namespace, media ID, episode, event and numeric f
 
 Matching acknowledged positive positions admit currently-watching entries. Watched status retains `completion_eligible && duration_seconds > 0 && position_seconds / duration_seconds >= 0.95`; null duration is ineligible. Seeking near the end can satisfy it. Launch/window closure alone cannot. Duplicate records, partial trailing lines and later reports recovered after Tubular restart retain the existing session-consumption behavior.
 
-Watch later, saved videos, currently watching and watched state accept stable episode keys `miruro:<opaque ID>:<canonical episode>`. Catalog results use opaque media IDs in native `Media` rows, not fabricated video/episode keys; they are not saveable/playable episode identities. Saved episode playback resolves fresh sources; CDN addresses/tokens never become collection keys. Playback and persisted state remain shared, but each interface filters collections before display, selection, counts and removal. Miruro has no YouTube channel identity, so its flat episode lists exclude category/tag/channel actions and YouTube extraction/thumbnails. Planned/listed counts are metadata, not a claim of supported source availability; only actual returned episode numbers are offered for playback.
+Collections and watched state use `miruro:<opaque ID>:<canonical episode>`. Catalog rows are not playable episode identities. Saved and old snapshot playback needs only that key, not a canonical slug, title-derived route or stored source URL. Terebi resolves fresh resources; CDN tokens never become collection keys. Each interface filters shared collections by provider. Only actual returned episode numbers are selectable; planned counts do not guarantee source availability.
 
-### Integration verification
+### Historical source-file integration verification (before URL cutover)
 
 The actual Tubular terminal workflow was exercised with isolated `$XDG_CONFIG_HOME` state and the updated Terebi developer bundle selected by `--player`: autocomplete returned eight titles; the selected title returned two episodes; episode 1 was saved to both collections, freshly resolved, and launched through `State::miruro_session` / `PlayerLaunch::start_source`.
 

docs/miruro-segments.md

@@ -0,0 +1,122 @@
+# Miruro video-segment feasibility
+
+Investigated **2026-10-22**, scoped to **https://barelystarted.miruro.tv**. Investigation only: no production changes, media playback, playlist/segment/subtitle downloads, browser testing, or remote mutations.
+
+**Conclusion (updated after the approved ownership split):** Miruro supplies optional episode-relative opening/ending intervals. Terebi must acquire and display them through its native episode-URL resolver; Tubular owns catalog/selection/collections/watched decisions only. Current Terebi does not display these intervals. The former source-file recommendation below is superseded by the [URL-playback handoff](terebi-url-playback-handoff.md). Availability is sparse; actual media-duration bounds are necessary but do not prove alignment across cuts.
+
+Evidence labels: **Observed** = responses obtained today; **Frontend** = today's deployed first-party JavaScript, not a server guarantee; **Earlier** = the 2026-10-12 investigation in [miruro-api.md](miruro-api.md); **Recommendation** = proposed minimum behavior, not implemented.
+
+## Live metadata
+
+**Observed — historical native Tubular probe before URL cutover:** the then-existing `Client::detail`, `Client::sources`, and `SourceDocument::from_sources` path ran against the [detail route][detail] and [sources endpoint][sources]. The temporary example was removed afterward; `cargo run --locked --example miruro_segments_probe` describes that investigation, **not a permanent runnable command**. Source resolution/projection has since been removed from Tubular. Safe output projection:
+
+```text
+detail: 3 episodes
+episode 1: absolute_number=49 duration_seconds=1500
+  skip_times=[{kind:op,start_seconds:63.313,end_seconds:153.237},
+              {kind:ed,start_seconds:1335.252,end_seconds:1425.384}]
+episode 2: absolute_number=50 duration_seconds=1500 skip_times=[]
+episode 3: absolute_number=51 duration_seconds=1500 skip_times=[]
+sources top-level keys: config episodeNumber providerOrder tracks
+projected source-document keys: headers identity subtitles title url version
+```
+
+Those are episode **1** intervals, not absolute episode 49 or a provider-specific episode identifier. Two empty arrays show why metadata must remain optional; they do not establish that those episodes have no opening/ending.
+
+**Observed — watch metadata:** JavaScript `fetch` of the [watch route][watch] returned **HTTP 200**, **`text/sveltekit-data`**, 33,483 text characters. The newline-delimited SvelteKit response contained an `episodesData` promise chunk; decoding its indexed table yielded:
+
+```json
+{
+  "episodes": [
+    {"number": 1, "duration": 1500},
+    {"number": 2, "duration": 1500},
+    {"number": 3, "duration": 1500}
+  ],
+  "currentEpisode": {"number": 1},
+  "prevEpisode": null,
+  "nextEpisode": {"number": 2},
+  "aniskip": [
+    {"episode": 1, "type": "op", "start": 63.313, "end": 153.237},
+    {"episode": 1, "type": "ed", "start": 1335.252, "end": 1425.384}
+  ]
+}
+```
+
+This is an abbreviated projection: episode objects have additional descriptive fields. The two `aniskip` objects are complete and have **no `provider`, `votes`, or `episode_length`**. Both routes express these intervals in seconds, retaining fractional precision; `skip_times` uses `kind/start_seconds/end_seconds`, whereas watch uses `type/start/end` plus the episode number. The sampled values match across both routes. `/api/sources` contains no segment field; a source-only request cannot recover these sampled intervals.
+
+**Earlier vs current:** [miruro-api.md](miruro-api.md#detail-episodes-and-watch-data) recorded two available episodes on 2026-10-12; today's probes found three. Its detail/watch shapes and episode-1 intervals are revalidated above. Its old hashed frontend links are not today's deployment. The current watch Content-Type is `text/sveltekit-data`, so do not assume every route-data response is `application/json`. Native `ureq` success and previous curl/Cloudflare failure are transport-specific observations, not permission or an availability guarantee.
+
+## Deployed first-party normalization
+
+**Frontend:** today's [homepage][home] imports [`app.Bj5KeT2s.js`][app], whose route dictionary maps `/watch/[id]/[slug]` to node 11, [`11.DKyvW9qB.js`][client]. In that watch bundle, function `wn` and sets `xn`/`Sn` implement this complete mapping:
+
+| Input `type` | Emitted player segment |
+| --- | --- |
+| `op`, `mixed-op` | `{kind:"intro", start, end}` |
+| `ed`, `mixed-ed` | `{kind:"outro", start, end}` |
+| Any other value, including `recap` | No segment from this normalizer |
+
+Only `op` and `ed` occurred in today's metadata. The mixed variants are **frontend-supported**, not live-observed API records. There is no evidenced exhaustive server enum, recap interval, preview interval, provider-specific interval, or mixed-kind decomposition. In particular, `mixed-op` is treated as one whole intro interval, not split into opening and recap portions.
+
+The algorithm in `wn(records, episodeNumber, duration)` is:
+
+1. Return `[]` when records are empty, the episode is null, or duration is absent/nonpositive.
+2. Reject a record when its optional `provider`, lowercased, contains `crunchyroll`; its `episode` is not strictly equal to the selected episode number; or `(votes ?? 0) < 0`.
+3. Require finite `start` and `end`, `start >= 0`, `end > start`, and `end <= duration` (an end exactly at duration is allowed).
+4. When `episode_length` is a positive number, require `abs(episode_length - duration) / duration <= 0.05`. Missing/non-number/nonpositive lengths bypass this comparison. This optional field was absent in the sample, so catalog duration 1500 does **not** trigger that 5% check by itself.
+5. Sort survivors by descending `(votes ?? 0)`. Take the first opening-kind record and the first ending-kind record. Emit intro first, then outro; at most two segments. It does not merge, scale, shift, trim, or resolve overlapping intro/outro intervals.
+
+Useful anchors in the minified [bundle][client]: `Cn=.05`, `function wn`, `provider?.toLowerCase().includes(\`crunchyroll\`)`, `episode_length`, and `strmcx-duration-change`. The provider check concerns the **metadata record's provenance**, not equality with the currently selected stream provider; the algorithm has no selected-provider argument. Vote/provider/duration-length rules are consumer behavior, not evidence that Miruro currently returns those optional fields.
+
+**Frontend timing/lifecycle:** the player component starts with empty segments and resets them, together with duration, during source resolution. A `strmcx-duration-change` event with positive numeric duration invokes `wn` using player-reported duration, the selected episode number, and watch `aniskip`. The normalized array is passed as `segments` to the strm.cx session, separately from the `options.autoskip` preference. Catalog `episode.duration` is not used as the normalization duration. Iframe playback takes a separate embedded-URL path rather than this direct-player session; the inspected code does not establish segment handoff to an arbitrary iframe provider.
+
+## Limits and minimum recommendation
+
+- **Observed:** metadata exists and is not tied to an expiring source URL. **Unknown:** coverage across the catalog, a stable/public metadata contract, how timings were generated, non-opening/ending availability, and alignment across providers/dubs/cuts. Merely being in bounds does not prove synchronization with a particular cut.
+- **Recommendation:** reuse the existing detail episode metadata; retain selected episode identity, optional raw kinds, and fractional second boundaries alongside it. Normalize only the four evidenced opening/ending kinds for initial intro/outro behavior. Do not relabel recap or unknown kinds as intro/outro or invent missing intervals.
+- **Approved seam (supersedes the earlier source-session recommendation):** Terebi's existing episode-URL resolver owns optional metadata acquisition and validation against actual media duration. Direct and Tubular launches must use the same path. No source-document version change, separate segment file, new endpoint or Tubular metadata persistence is required. Preserve optional provenance/reference-length fields if available; do not invent fields absent from the sample or claim bounds prove synchronization.
+- **Recommendation:** address every launch path, including saved/watch-later/currently-watching reopening, rather than enriching only a currently open catalog episode.
+
+## Tubular → Terebi seam
+
+The approved implementation contract and acceptance scenarios are consolidated in [Terebi URL-playback handoff](terebi-url-playback-handoff.md). Tubular launches the stable opaque ID and returned episode number through `PlayerLaunch::start`, using a non-identifying `episode` watch slug. Old/offline snapshots need no new fields or migration. Terebi owns canonical-route resolution, title enrichment and optional timeline metadata; title text is not identity.
+
+The requested UI is **intro/outro bands in the controls progress bar only**, not automatic skipping or skip buttons. Validate episode binding, finite ordered nonnegative times and actual-duration bounds; clear metadata on media replacement. Empty, unavailable or invalid metadata must not prevent ordinary playback, and unknown kinds must not be relabeled.
+
+### Historical source-file decoder evidence (superseded transport)
+
+Before this cutover, Tubular retained `skip_times` in browsing metadata but omitted it from generic `Video` snapshots and source documents. Terebi's source-v1 decoder did not retain intervals. The following isolated decoder observation explains why adding JSON fields alone would not have implemented timeline display; it is not a recommendation to restore source files.
+
+**Observed — actual decoder smoke:** compiled the existing `ResolvedSource.swift` with a temporary Foundation-only harness, then called `ResolvedSource.load(from:)` on synthetic local source documents. No player/network/GUI was started.
+
+```text
+interval-array: accepted; segments absent from ResolvedSource
+wrong-type: accepted; segments absent from ResolvedSource
+version-2: rejected
+```
+
+Thus merely adding `segments` to a version-1 JSON file would silently discard it, even with a malformed value. Changing the version alone also does not work. This is a source-document version, independent of the existing version-2 progress records.
+
+The earlier recommendation to introduce a new source-document version and carry intervals through Tubular is **superseded**. No source-v2 or segment file is required. Terebi's native URL resolver already owns `/api/sources`; it must additionally acquire title and optional episode metadata via canonical route data for all callers. See the handoff for lifecycle and acceptance requirements. Existing source-v1 decoder observations above remain historical evidence only.
+
+
+## Fetch record
+
+All requests were read-only. Static source was inspected, not executed as a webpage. No expiring source URL/token was printed or saved.
+
+```javascript
+// Research eval JavaScript transport; each response's status/type was inspected.
+await fetch("https://barelystarted.miruro.tv/");
+await fetch("https://barelystarted.miruro.tv/_app/immutable/entry/app.Bj5KeT2s.js");
+await fetch("https://barelystarted.miruro.tv/_app/immutable/nodes/11.DKyvW9qB.js");
+await fetch("https://barelystarted.miruro.tv/watch/OERe_a0YS4h-DlsBDOeXwX7HOO6316tw/the-apothecary-diaries-season-3/__data.json?ep=1");
+```
+
+The homepage/app were first fetched with the static `read` tool (`:raw` for imports); the watch bundle was read and then fetched with eval: **200 `text/javascript`**, 84,045 characters. Watch route: **200 `text/sveltekit-data`**, 33,483 characters; only decoded episode/segment metadata was printed, never `sourcesData`. The native detail/source probe is documented above. The decoder smoke used `swiftc -parse-as-library ../terebi/Sources/App/ResolvedSource.swift <temporary harness> -o <temporary binary>`, followed by running that binary. Both temporary source harnesses and the decoder's generated fixture/binary were removed. No test suites, linters, formatters, full application builds or UI smoke tests were run; only the native metadata probe and isolated decoder harness were compiled and executed.
+
+[home]: https://barelystarted.miruro.tv/
+[app]: https://barelystarted.miruro.tv/_app/immutable/entry/app.Bj5KeT2s.js
+[client]: https://barelystarted.miruro.tv/_app/immutable/nodes/11.DKyvW9qB.js
+[detail]: https://barelystarted.miruro.tv/info/OERe_a0YS4h-DlsBDOeXwX7HOO6316tw/the-apothecary-diaries-season-3/__data.json
+[watch]: https://barelystarted.miruro.tv/watch/OERe_a0YS4h-DlsBDOeXwX7HOO6316tw/the-apothecary-diaries-season-3/__data.json?ep=1
+[sources]: https://barelystarted.miruro.tv/api/sources?id=OERe_a0YS4h-DlsBDOeXwX7HOO6316tw&n=1

docs/wco-feasibility.md

@@ -0,0 +1,121 @@
+# WCO feasibility investigation
+
+Observed **2026-10-20 UTC**. Scope: adding Western-cartoon browsing and native playback to Tubular, using ordinary HTTPS without browser automation, challenge/login/premium bypass, fabricated ad-verification results, or weakened TLS. No production implementation was added.
+
+## Decision
+
+**Browsing is feasible for the sampled catalog. Native video extraction and playback are not established.** The current declared free-player route reaches a JavaScript ad-verification step; investigation stopped before submitting that verification or requesting the post-gate player. Separately, the current Tubular/Terebi source and progress contracts reject an honest WCO identity.
+
+Do not build another full browser UI or weaken Terebi's network policy on this evidence alone. The missing prerequisite is a legitimately obtained final media URL, its required headers, and a successful native decode/seek probe. Nothing below demonstrates that WCO cannot ever support a native client.
+
+Evidence labels:
+
+- **Observed:** live requests or an executed check in this investigation.
+- **Source:** current site markup, JavaScript, or implementation inspection.
+- **[INFERENCE]:** architectural implication, not verified WCO playback.
+
+## Live native HTTP evidence
+
+A temporary Rust example used the project's existing `ureq 3.4.2` dependency with its `rustls` feature: default agent, TLS verification enabled, 25-second global timeout, `http_status_as_error(false)`, and zero automatic redirects. Responses were bounded to 512 KiB, or 4 KiB for the artwork signature check. No cookies, browser impersonation, proxy, script execution, or challenge solution was supplied. Player/initialization requests carried their referring page explicitly.
+
+| Resource | Transport | HTTP | Content-Type | Body bytes read |
+| --- | --- | ---: | --- | ---: |
+| [Cartoon directory][directory] | ureq/rustls | 200 | text/html | 311285 |
+| [OTGW series][otgw] | ureq/rustls | 200 | text/html | 42840 |
+| [Adventure Time series][adventure] | ureq/rustls | 200 | text/html | 148050 |
+| [OTGW episode 1][episode] | ureq/rustls | 200 | text/html | 39154 |
+| Episode's declared iframe, `embed.wcostream.com/inc/embed/index.php` | ureq/rustls | 200 | text/html | 9177 |
+| [Declared player initialization][preinit] | ureq/rustls | 200 | application/javascript | 3871 |
+| [OTGW cover][cover] | ureq/rustls | 200 | image/jpeg | 4096 |
+| Same OTGW episode-1 URL | Python urllib | 403 | text/html | 5601 |
+| Same OTGW episode-1 URL | curl | 403 | text/html | 5580 |
+
+**Observed:** the cover prefix has a JPEG signature. Full image decoding was not tested. Native successful page responses contained neither the Cloudflare challenge markers checked nor the explicit premium-only marker. Python's episode response contained Cloudflare's “Just a moment”; curl independently returned 403 HTML. Accessibility is transport-dependent; successful web-reader access alone would not have established local native access.
+
+## Smallest catalog integration
+
+**Observed/Source:** the directory and series metadata are server-rendered. No JavaScript execution is needed to read the sampled listings.
+
+1. `GET /cartoon-list`; parse `#ddmcc_container` title/series links.
+2. Filter that Western-cartoon directory locally. The site's own directory search performs case-insensitive substring filtering, not another API request.
+3. Fetch the selected series page for description, genres, cover reference, season labels, and `#episodeList a.dark-episode-item` entries.
+4. Preserve the provider's actual playable-item labels and opaque page paths.
+
+The global search form declares **POST `/search`**, with `catara=<query>` and `konuara=series` or `episodes`; the input declares a 40-character maximum. This is a markup contract, **not a successful live POST probe**. Local directory filtering avoids depending on that unverified endpoint for Western-cartoon title search. [Site form][otgw]; [reference search implementation][kodi-search].
+
+Series identity should use the observed canonical provider path, not a slug generated from the display title or the numeric artwork filename. The directory contains historical paths such as `/anime/american-dad-season-1` for “American Dad!”. Long-term URL stability has not been established. [Directory][directory].
+
+Artwork is available through `og:image` and `#sidebar_cat img.img5`; normalize scheme-relative references. Sidebar prose and genre links are available, but quality varies: Adventure Time's synopsis describes its pilot rather than the whole series. No episode runtime, publication date, or chapter timestamps were established.
+
+### Identity and ordering traps
+
+- OTGW has **eight page entries covering ten numbered segments**: 1–6 separately, 7–8 together, 9–10 together. These eight links were also extracted from the native response.
+- Adventure Time season 1 labels one video “Episode 1 Slumber Party Panic / Trouble in Lumpy Space”; season 10 has a combined “Episode 13–16 Come Along with Me”. Pilot, specials, Distant Lands and Side Quests coexist on the series page.
+- Map `data-season` through `#seasonFilter option[value]`; preserve the token and label. Adventure Time includes `s-1-0`, labeled “Special: Distant Lands”.
+- Read the direct title span, not all anchor text: quality/finale badges are separate metadata.
+- Preserve source order initially. It is mostly descending, but not consistently numerically sorted.
+- Use an opaque episode-page identity, not series ID plus an assumed single positive episode number. Do not synthesize chapters, segment boundaries, or separate watched states from slash-separated titles.
+
+Sources: [OTGW][otgw], [Adventure Time][adventure]. The current Miruro identity cannot be reused unchanged: [`src/miruro.rs:28-77`](../src/miruro.rs).
+
+## Actual page-to-player boundary
+
+**Observed:** ordinary native requests reached this sequence:
+
+1. The episode HTML contains a statically encoded iframe string. Its visible script applies Base64 decoding, retains decimal digits, subtracts a page-supplied constant, then constructs characters. This transform was decoded as data; no downloaded JavaScript was executed.
+2. The decoded iframe targets `embed.wcostream.com/inc/embed/index.php` with episode query parameters.
+3. That iframe returns an **“Announcement”** document, not an MP4/HLS URL. Its close button is initially disabled, with a 10-second countdown and a 12-second fallback timer.
+4. The document loads [`/inc/embed/pre-init.js?v2`][preinit]. That script generates a browser nonce, performs DOM ad-bait and script-loading checks, and sends an `/ad-verify` beacon containing the nonce, video ID and `clear`/`blocked` result.
+5. Closing the announcement normally navigates to `video-js.php`, using `AdGate.buildUrl()` to append the nonce. The page also has a fallback navigation if `AdGate` is unavailable; that fallback was not requested to skip verification.
+
+**Boundary:** no `/ad-verify` request was submitted; no DOM results were fabricated, scripts executed, announcement flow skipped, alternative player endpoint substituted, premium workaround invoked, or post-gate player/media requested. Server-side enforcement of the nonce was **not tested**. A script containing a gate is not proof that every WCO stream is inaccessible to a native client.
+
+The [Kodi resolver][kodi-resolver] is reference code, not a proven current contract. It rewrites `index.php` to `video-js-new.php`, parses internal source JSON, resolves media redirects, and contains separate premium-workaround paths. Those behaviors were not transplanted or exercised. Its recent maintenance does not establish that this sample is playable through Tubular's permitted flow.
+
+**Unverified:** current source-JSON schema after the gate; final media type/codecs; required headers/cookies; redirect chain; URL expiration/IP binding; byte-range/seek support; nested HLS origins; subtitles; actual Terebi playback. No episode media was downloaded.
+
+## Actual Tubular/Terebi compatibility
+
+### Executed source-contract smoke
+
+A temporary Foundation-only Swift executable compiled **the actual** `../terebi/Sources/App/ResolvedSource.swift` unchanged. It validated a synthetic, otherwise valid source document with provider `miruro`, then changed only the provider to `wco` and required rejection. The synthetic example URL was not fetched.
+
+Observed output, exit 0:
+
+```text
+Actual Terebi validator: Miruro control accepted; identical document with provider=wco rejected
+```
+
+This proves source-contract rejection, not anything about live media decoding. No player UI was launched.
+
+### Required integration changes if usable media is established
+
+- **Provider selection:** Tubular's chooser is Boolean/two-way, not a third-provider interface: `src/main.rs:3674-3698,3762-3774`.
+- **Honest stable identity:** Tubular's `Identity` validation/key parsing and Terebi's source validator hardcode Miruro. WCO needs a provider-correct opaque playback-item identity that accommodates paired episodes and specials. Do not disguise WCO media as Miruro. `src/miruro.rs:28-77`; `../terebi/Sources/App/ResolvedSource.swift:84-102`.
+- **Native admission and safety:** native progress identity validation accepts only canonical YouTube URLs or `miruro:`. Resolved-source security classification also uses `starts_with("miruro:")`. Updating Swift admission alone is insufficient and would not apply the protected resolved-source path. `../terebi/Sources/Core/progress_reporter.cpp:62-90`; `../terebi/Sources/Core/player.cpp:565-567,1460-1466`.
+- **Progress/state:** native version-2 reporting emits a literal Miruro provider. Tubular sessions, snapshot validation, report admission and provider-specific collection filtering also need coordinated changes. Broadening the Miruro identity parser without updating its UI callers would mix WCO records into Miruro collections. `../terebi/Sources/Core/progress_reporter.cpp:163-186`; `src/video_state.rs:379-396,651-669`; `src/miruro_ui.rs:265-268,989-990,1938-1941`.
+- **Reuse, not another player:** the existing source launcher already passes private source/progress files to Terebi. Resume storage is identity-keyed. No new playback framework is indicated. `src/youtube.rs:937-981`; `../terebi/Sources/App/TerebiApp.swift:516-524,1525-1530`; `../terebi/Sources/App/PlaybackProgress.swift:24-35,54-57`.
+
+**[INFERENCE] Direct MP4 should fit the general native media architecture.** Source-file validation is not HLS-only; native FFmpeg opens input without forcing a demuxer and discovers audio/video streams. The HLS-only rule belongs to Miruro's Sun projection, not the general source document. WCO must not be routed through that projection. `src/miruro.rs:101-178`; `../terebi/Sources/Core/player.cpp:543-547,565-580`.
+
+The existing protected network path rejects **all media redirects**, even same-origin redirects, and requires HLS variants/segments/keys/init resources to share the initial media origin. Preserve that policy. A resolver would need to obtain an already-final acceptable URL through a separately reviewed extraction flow; no need for redirect/cross-origin support has yet been established. `../terebi/Sources/Core/player.cpp:111-126,532-537`.
+
+The existing `resolved-playback-check` is not an unchanged subtitle-free WCO smoke: it requires a default subtitle and two cues. The full player suite also requires graphical/audio resources. Neither was run. See `../terebi/Checks/resolved-playback.swift:24-80` and `../terebi/README.md:178-190`.
+
+## Recommendation and limits
+
+- **Go:** a native WCO catalog is evidenced for the sampled directory, two shows, episode page and cover host.
+- **Not yet go:** do not implement end-to-end WCO playback on the strength of catalog access or old extractor code.
+- **Next prerequisite:** observe/document an authorized normal free-player route through the verification boundary, or obtain a supported native playback interface. Browser observation would need explicit permission and would not itself prove native extraction. Do not emulate successful ad-verification results or weaken security to create a passing demo.
+- **Then:** resolve one real item, inspect only bounded media/manifest data with explicit headers, and verify native decode, duration and seek behavior before implementing browsing/state changes. Test a combined entry as well as a single episode before claiming identity correctness.
+
+Investigation changes are this report only; temporary HTTP/Swift probes and response files were removed. No application behavior, player source, dependency, remote state, or persistent stream token was changed. Findings are a point-in-time sample, not a service reliability or distribution-rights guarantee.
+
+[directory]: https://www.wco.tv/cartoon-list
+[otgw]: https://www.wco.tv/anime/over-the-garden-wall
+[adventure]: https://www.wco.tv/anime/adventure-time
+[episode]: https://www.wco.tv/over-the-garden-wall-episode-1-the-old-grist-mill
+[preinit]: https://embed.wcostream.com/inc/embed/pre-init.js?v2
+[cover]: https://images.wcostream.com/catimg/161158.jpg
+[kodi-search]: https://github.com/christianhaitian/plugin.video.watchnixtoons2/blob/kodi19/lib/plugin.py#L1201-L1263
+[kodi-resolver]: https://github.com/christianhaitian/plugin.video.watchnixtoons2/blob/kodi19/lib/plugin.py#L1353-L1641

examples/anilist_probe.rs

@@ -0,0 +1,37 @@
+//! Read-only native smoke: cargo run --locked --example anilist_probe
+use std::io;
+use tubular::{
+    anilist::{Client, catalog_count},
+    anime::Identity,
+};
+
+fn main() -> io::Result<()> {
+    let client = Client::default();
+    let results = client.search("Cowboy Bebop")?;
+    let media = results
+        .iter()
+        .find(|media| media["id"] == "1")
+        .ok_or_else(|| io::Error::other("Exact Cowboy Bebop AniList ID 1 absent from search"))?;
+    let id = media["id"]
+        .as_str()
+        .ok_or_else(|| io::Error::other("Missing catalog ID"))?;
+    let detail = client.detail(id)?;
+    let count = catalog_count(&detail)?.ok_or_else(|| io::Error::other("Catalog count unknown"))?;
+    if count == 0 {
+        return Err(io::Error::other("No catalog episode number 1"));
+    }
+    let identity = Identity::anilist(id.into(), 1)?;
+    println!(
+        "native search: {} records; exact AniList ID {id}",
+        results.len()
+    );
+    println!(
+        "detail: {count} catalog episode numbers; selected episode 1; source not checked by this probe"
+    );
+    println!("identity: {}", identity.key());
+    println!("watch URL: {}", identity.watch_url()?);
+    println!(
+        "PASS: native AniList search -> exact detail -> catalog episode -> stable sub URL (no source check or playback request)"
+    );
+    Ok(())
+}

examples/miruro_probe.rs

@@ -1,9 +1,8 @@
 //! Live read-only smoke: cargo run --locked --example miruro_probe
-//! Uses the documented research title and direct Sun provider; no media segments.
-use std::{io, time::Duration};
+//! Exercises native catalog metadata and stable episode URLs; no playback requests.
+use std::io;
 
-use serde_json::{Map, Value};
-use tubular::miruro::Client;
+use tubular::{anime::Identity, miruro::Client};
 
 fn invalid(message: &str) -> io::Error {
     io::Error::new(io::ErrorKind::InvalidData, message)
@@ -28,132 +27,11 @@ fn main() -> io::Result<()> {
         .and_then(|number| u32::try_from(number).ok())
         .ok_or_else(|| invalid("No episode metadata available"))?;
     println!(
-        "detail: {} episodes; selected episode {number}",
+        "detail: {} returned episodes; selected episode {number}",
         detail.episodes.len()
     );
-    let sources = client.sources(id, number)?;
-    let tracks = sources["tracks"]
-        .as_array()
-        .ok_or_else(|| invalid("Missing tracks"))?;
-    let provider = tracks
-        .iter()
-        .find(|track| track["track"] == "ssub")
-        .and_then(|track| track["providers"].as_array())
-        .and_then(|providers| {
-            providers
-                .iter()
-                .find(|provider| provider["provider"] == "sun")
-        })
-        .ok_or_else(|| invalid("Direct Sun soft-subtitle provider not returned"))?;
-    let server = provider["servers"]
-        .as_array()
-        .and_then(|servers| {
-            servers.iter().find(|server| {
-                server["streams"]
-                    .as_array()
-                    .is_some_and(|streams| !streams.is_empty())
-            })
-        })
-        .ok_or_else(|| invalid("No direct Sun stream returned"))?;
-    let headers = server["headers"]
-        .as_object()
-        .ok_or_else(|| invalid("Missing server headers"))?;
-    println!(
-        "sources: {} tracks; selected ssub/sun; {} server headers retained",
-        tracks.len(),
-        headers.len()
-    );
-    let agent = ureq::Agent::config_builder()
-        .timeout_global(Some(Duration::from_secs(25)))
-        .http_status_as_error(false)
-        .max_redirects(0)
-        .build()
-        .new_agent();
-    let master = resource(
-        &agent,
-        "hls_master",
-        server["streams"][0]["url"]
-            .as_str()
-            .ok_or_else(|| invalid("Missing stream URL"))?,
-        headers,
-    )?;
-    if !master.starts_with("#EXTM3U") || !master.contains("#EXT-X-STREAM-INF:") {
-        return Err(invalid("Expected an HLS master playlist"));
-    }
-    let subtitle = provider["subtitles"]
-        .as_array()
-        .and_then(|subtitles| {
-            subtitles
-                .iter()
-                .find(|subtitle| subtitle["default"] == true)
-        })
-        .ok_or_else(|| invalid("No default subtitle returned"))?;
-    let subtitle = resource(
-        &agent,
-        "subtitle",
-        subtitle["file"]
-            .as_str()
-            .ok_or_else(|| invalid("Missing subtitle URL"))?,
-        headers,
-    )?;
-    if !subtitle.starts_with("WEBVTT") || !subtitle.contains(" --> ") {
-        return Err(invalid("Expected timed VTT subtitles"));
-    }
-    println!(
-        "PASS: native search -> detail/episodes -> sources -> HLS master + subtitle; no media segments or tokens saved"
-    );
+    let identity = Identity::miruro(id.into(), number)?;
+    println!("watch URL: {}", identity.watch_url()?);
+    println!("PASS: native search -> detail/episodes -> stable watch URL; no playback requests");
     Ok(())
 }
-
-fn resource(
-    agent: &ureq::Agent,
-    label: &str,
-    url: &str,
-    headers: &Map<String, Value>,
-) -> io::Result<String> {
-    let uri: ureq::http::Uri = url
-        .parse()
-        .map_err(|_| invalid("Invalid Sun resource URL"))?;
-    if uri.scheme_str() != Some("https")
-        || !uri.host().is_some_and(|host| host.ends_with(".keeply.top"))
-        || uri
-            .authority()
-            .is_some_and(|authority| authority.as_str().contains('@'))
-        || uri.port_u16().is_some_and(|port| port != 443)
-    {
-        return Err(invalid(
-            "Smoke only permits the verified Sun HTTPS CDN; no redirects",
-        ));
-    }
-    let mut request = agent.get(url);
-    for (name, value) in headers {
-        request = request.header(
-            name.as_str(),
-            value
-                .as_str()
-                .ok_or_else(|| invalid("Invalid server header"))?,
-        );
-    }
-    let mut response = request
-        .call()
-        .map_err(|_| io::Error::other("Sun resource HTTP transport failed"))?;
-    let status = response.status().as_u16();
-    let mime = response.body().mime_type().unwrap_or("missing");
-    println!("{label}: HTTP {status}; Content-Type {mime}");
-    let expected = if label == "subtitle" {
-        "text/vtt"
-    } else {
-        "application/vnd.apple.mpegurl"
-    };
-    if status != 200 || mime != expected {
-        return Err(invalid(
-            "Resource failed or returned unexpected content; stopping without retry",
-        ));
-    }
-    response
-        .body_mut()
-        .with_config()
-        .limit(2 * 1024 * 1024)
-        .read_to_string()
-        .map_err(|_| invalid("Resource response unreadable, timed out, or exceeded 2 MiB"))
-}

src/anilist.rs

@@ -0,0 +1,223 @@
+//! AniList metadata only. Episode numbers are catalog information, never stream availability.
+use crate::anime::positive_decimal;
+use serde_json::{Value, json};
+use std::{io, time::Duration};
+
+const FIELDS: &str = "id title { english romaji native } format status episodes season seasonYear description(asHtml: false) coverImage { extraLarge large medium } bannerImage duration averageScore genres source countryOfOrigin nextAiringEpisode { episode }";
+const BODY_LIMIT: u64 = 2 * 1024 * 1024;
+
+pub struct Client {
+    agent: ureq::Agent,
+}
+impl Default for Client {
+    fn default() -> Self {
+        Self {
+            agent: ureq::Agent::config_builder()
+                .timeout_global(Some(Duration::from_secs(20)))
+                .http_status_as_error(false)
+                .max_redirects(0)
+                .build()
+                .new_agent(),
+        }
+    }
+}
+impl Client {
+    pub fn search(&self, query: &str) -> io::Result<Vec<Value>> {
+        let query = query.trim();
+        if query.is_empty() || query.len() > 4096 {
+            return Err(invalid("AniList query must contain 1–4096 bytes"));
+        }
+        let mut response = self.query(&format!("query ($search: String!) {{ Page(page: 1, perPage: 8) {{ media(search: $search, type: ANIME, sort: SEARCH_MATCH) {{ {FIELDS} }} }} }}"), json!({"search": query}))?;
+        let Some(Value::Array(items)) = response.pointer_mut("/Page/media").map(Value::take) else {
+            return Err(invalid("AniList search is missing its media array"));
+        };
+        if items.len() > 8 {
+            return Err(invalid("AniList search exceeded eight results"));
+        }
+        let mut ids = std::collections::HashSet::new();
+        items
+            .into_iter()
+            .map(|item| {
+                let media = normalize(item)?;
+                if !ids.insert(media["id"].as_str().unwrap().to_owned()) {
+                    return Err(invalid("AniList returned duplicate IDs"));
+                }
+                Ok(media)
+            })
+            .collect()
+    }
+    pub fn detail(&self, id: &str) -> io::Result<Value> {
+        let id_number = positive_decimal(id)?;
+        let mut response = self.query(
+            &format!("query ($id: Int!) {{ Media(id: $id, type: ANIME) {{ {FIELDS} }} }}"),
+            json!({"id": id_number}),
+        )?;
+        let media = response
+            .get_mut("Media")
+            .filter(|v| !v.is_null())
+            .map(Value::take)
+            .ok_or_else(|| {
+                io::Error::new(io::ErrorKind::NotFound, "AniList catalog title not found")
+            })?;
+        let media = normalize(media)?;
+        if media["id"].as_str() != Some(id) {
+            return Err(invalid("AniList detail ID does not match request"));
+        }
+        Ok(media)
+    }
+    fn query(&self, query: &str, variables: Value) -> io::Result<Value> {
+        let body = json!({"query": query, "variables": variables}).to_string();
+        let mut response = self
+            .agent
+            .post("https://graphql.anilist.co")
+            .header("Content-Type", "application/json")
+            .header("Accept", "application/json")
+            .send(body.as_str())
+            .map_err(|_| io::Error::other("AniList network request failed"))?;
+        let status = response.status().as_u16();
+        if status != 200 {
+            return Err(io::Error::new(
+                match status {
+                    401 | 403 => io::ErrorKind::PermissionDenied,
+                    404 => io::ErrorKind::NotFound,
+                    _ => io::ErrorKind::Other,
+                },
+                format!("AniList HTTP {status}"),
+            ));
+        }
+        if response.body().mime_type() != Some("application/json") {
+            return Err(invalid("AniList returned non-JSON content"));
+        }
+        let body = crate::read_catalog_body(response.body_mut(), BODY_LIMIT)
+            .map_err(|_| invalid("AniList body unreadable, timed out, or exceeded 2 MiB"))?;
+        decode(&body)
+    }
+}
+fn decode(body: &str) -> io::Result<Value> {
+    let mut value: Value =
+        serde_json::from_str(body).map_err(|_| invalid("Malformed AniList JSON"))?;
+    if let Some(errors) = value.get("errors").filter(|v| !v.is_null()) {
+        let errors = errors
+            .as_array()
+            .ok_or_else(|| invalid("Malformed AniList GraphQL errors"))?;
+        if !errors.is_empty() {
+            return Err(io::Error::other(
+                "AniList GraphQL request failed (catalog data not accepted)",
+            ));
+        }
+    }
+    value
+        .get_mut("data")
+        .filter(|v| v.is_object())
+        .map(Value::take)
+        .ok_or_else(|| invalid("AniList response is missing data"))
+}
+/// Normalize metadata field names to the existing anime UI, retaining explicit nulls.
+fn normalize(mut media: Value) -> io::Result<Value> {
+    let id = media
+        .get("id")
+        .and_then(Value::as_u64)
+        .and_then(|n| u32::try_from(n).ok())
+        .filter(|n| *n > 0 && *n <= i32::MAX as u32)
+        .ok_or_else(|| invalid("Invalid AniList catalog ID"))?;
+    let object = media
+        .as_object_mut()
+        .ok_or_else(|| invalid("Invalid AniList media"))?;
+    object.insert("id".into(), Value::String(id.to_string()));
+    object.insert("catalog_provider".into(), Value::String("anilist".into()));
+    for (source, target) in [
+        ("episodes", "episode_count"),
+        ("seasonYear", "season_year"),
+        ("duration", "episode_duration_minutes"),
+        ("averageScore", "average_score"),
+        ("countryOfOrigin", "country_of_origin"),
+    ] {
+        let value = object.get(source).cloned().unwrap_or(Value::Null);
+        object.insert(target.into(), value);
+    }
+    let cover = object
+        .get("coverImage")
+        .and_then(|v| {
+            v.get("extraLarge")
+                .and_then(Value::as_str)
+                .or_else(|| v.get("large").and_then(Value::as_str))
+        })
+        .map(str::to_owned);
+    object.insert(
+        "cover_url".into(),
+        cover.map(Value::String).unwrap_or(Value::Null),
+    );
+    let count = catalog_count(&media)?;
+    media.as_object_mut().unwrap().insert(
+        "catalog_count".into(),
+        count.map(|n| json!(n)).unwrap_or(Value::Null),
+    );
+    Ok(media)
+}
+/// Finished totals are catalog numbers; releasing totals remain plans, not aired episodes.
+pub fn catalog_count(media: &Value) -> io::Result<Option<u32>> {
+    let number = |value: Option<&Value>| -> io::Result<Option<u32>> {
+        match value {
+            None | Some(Value::Null) => Ok(None),
+            Some(value) => value
+                .as_u64()
+                .and_then(|n| u32::try_from(n).ok())
+                .filter(|n| *n <= i32::MAX as u32)
+                .map(Some)
+                .ok_or_else(|| invalid("Invalid AniList episode count")),
+        }
+    };
+    let total = number(media.get("episode_count"))?;
+    match media.get("status").and_then(Value::as_str) {
+        Some("FINISHED") => Ok(total),
+        Some("NOT_YET_RELEASED") => Ok(Some(0)),
+        Some("RELEASING") => {
+            let next = number(media.pointer("/nextAiringEpisode/episode"))?;
+            if next == Some(0) {
+                return Err(invalid("Invalid AniList next airing episode"));
+            }
+            let aired = next.map(|n| n - 1);
+            if aired.zip(total).is_some_and(|(aired, total)| aired > total) {
+                return Err(invalid("AniList aired count exceeds planned total"));
+            }
+            Ok(aired)
+        }
+        _ => Ok(None),
+    }
+}
+fn invalid(message: &str) -> io::Error {
+    io::Error::new(io::ErrorKind::InvalidData, message)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn catalog_boundaries_and_graphql_errors() {
+        let finished = normalize(json!({"id":1,"status":"FINISHED","episodes":26})).unwrap();
+        assert_eq!(catalog_count(&finished).unwrap(), Some(26));
+        let ongoing = normalize(
+            json!({"id":2,"status":"RELEASING","episodes":24,"nextAiringEpisode":{"episode":5}}),
+        )
+        .unwrap();
+        assert_eq!(catalog_count(&ongoing).unwrap(), Some(4));
+        for status in ["RELEASING", "HIATUS", "CANCELLED", "FINISHED"] {
+            assert_eq!(
+                catalog_count(&normalize(json!({"id":2,"status":status,"episodes":null})).unwrap())
+                    .unwrap(),
+                None
+            );
+        }
+        assert!(
+            normalize(
+                json!({"id":2,"status":"RELEASING","episodes":2,"nextAiringEpisode":{"episode":5}})
+            )
+            .is_err()
+        );
+        assert!(normalize(json!({"id":0})).is_err());
+        assert!(decode(r#"{"data":{"Media":{"id":1}},"errors":[{"message":"bad"}]}"#).is_err());
+        assert!(decode(r#"{"data":null}"#).is_err());
+        assert!(decode(r#"{"errors":{},"data":{}}"#).is_err());
+        assert!(decode(r#"{"data":{"Media":null}}"#).unwrap()["Media"].is_null());
+    }
+}

src/anime.rs

@@ -0,0 +1,145 @@
+//! Stable identities for the two explicitly separate anime catalogs.
+use serde::{Deserialize, Serialize};
+use std::io;
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum Provider {
+    AniList,
+    #[default]
+    Miruro,
+}
+impl Provider {
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::AniList => "AniList",
+            Self::Miruro => "Miruro legacy",
+        }
+    }
+    pub fn key(self) -> &'static str {
+        match self {
+            Self::AniList => "anilist",
+            Self::Miruro => "miruro",
+        }
+    }
+    pub fn identity(self, media_id: String, episode: u32) -> io::Result<Identity> {
+        let identity = Identity {
+            provider: self.key().into(),
+            media_id,
+            episode,
+        };
+        identity.validate()?;
+        Ok(identity)
+    }
+    pub fn includes(self, key: &str) -> bool {
+        Identity::from_key(key).is_ok_and(|identity| identity.provider == self.key())
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct Identity {
+    pub provider: String,
+    pub media_id: String,
+    pub episode: u32,
+}
+impl Identity {
+    pub fn miruro(media_id: String, episode: u32) -> io::Result<Self> {
+        Provider::Miruro.identity(media_id, episode)
+    }
+    pub fn anilist(media_id: String, episode: u32) -> io::Result<Self> {
+        Provider::AniList.identity(media_id, episode)
+    }
+    pub fn validate(&self) -> io::Result<()> {
+        if self.episode == 0 || self.episode > i32::MAX as u32 {
+            return Err(invalid("Invalid anime episode number"));
+        }
+        match self.provider.as_str() {
+            "anilist" => {
+                positive_decimal(&self.media_id)?;
+            }
+            "miruro"
+                if !self.media_id.is_empty()
+                    && self.media_id.len() <= 512
+                    && self
+                        .media_id
+                        .bytes()
+                        .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'-' | b'_')) => {}
+            _ => return Err(invalid("Invalid anime catalog identity")),
+        }
+        Ok(())
+    }
+    pub fn key(&self) -> String {
+        format!("{}:{}:{}", self.provider, self.media_id, self.episode)
+    }
+    pub fn watch_url(&self) -> io::Result<String> {
+        self.validate()?;
+        Ok(match self.provider.as_str() {
+            "anilist" => format!(
+                "https://zokoanime.video/stream/ani/{}/{}/sub",
+                self.media_id, self.episode
+            ),
+            _ => format!(
+                "https://barelystarted.miruro.tv/watch/{}/episode?ep={}",
+                self.media_id, self.episode
+            ),
+        })
+    }
+    pub fn from_key(key: &str) -> io::Result<Self> {
+        let mut parts = key.split(':');
+        let provider = parts.next().unwrap_or("");
+        let media_id = parts.next().unwrap_or("");
+        let episode = positive_decimal(parts.next().unwrap_or(""))?;
+        if parts.next().is_some() {
+            return Err(invalid("Invalid anime episode key"));
+        }
+        let identity = Self {
+            provider: provider.into(),
+            media_id: media_id.into(),
+            episode,
+        };
+        identity.validate()?;
+        Ok(identity)
+    }
+}
+pub(crate) fn positive_decimal(text: &str) -> io::Result<u32> {
+    if text.starts_with('0') || text.is_empty() || !text.bytes().all(|b| b.is_ascii_digit()) {
+        return Err(invalid("Expected canonical positive decimal Int32"));
+    }
+    text.parse::<u32>()
+        .ok()
+        .filter(|n| *n <= i32::MAX as u32)
+        .ok_or_else(|| invalid("Expected canonical positive decimal Int32"))
+}
+fn invalid(message: &str) -> io::Error {
+    io::Error::new(io::ErrorKind::InvalidData, message)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn canonical_provider_isolation() {
+        let ani = Identity::anilist("1".into(), 1).unwrap();
+        assert_eq!(ani.key(), "anilist:1:1");
+        assert_eq!(
+            ani.watch_url().unwrap(),
+            "https://zokoanime.video/stream/ani/1/1/sub"
+        );
+        assert_ne!(ani.key(), Identity::miruro("1".into(), 1).unwrap().key());
+        assert!(!Provider::Miruro.includes(&ani.key()));
+        for key in [
+            "anilist:01:1",
+            "anilist:0:1",
+            "anilist:+1:1",
+            "anilist:1:01",
+            "anilist:1:0",
+            "anilist:2147483648:1",
+            "anilist:1:2147483648",
+            "anilist:1:1:2",
+            "other:1:1",
+        ] {
+            assert!(Identity::from_key(key).is_err(), "{key}");
+        }
+        assert_eq!(Identity::from_key(&ani.key()).unwrap(), ani);
+    }
+}

src/keys.rs

@@ -104,6 +104,7 @@ macro_rules! actions {
 actions! {
     Interrupt, "app.interrupt", "Exit immediately", ALL, ["ctrl+c"];
     Quit, "app.quit", "Quit the application", &[Context::Normal, Context::Info, Context::Description, Context::CollectionNormal, Context::CollectionInfo, Context::CollectionDescription, Context::Help], ["q"];
+    ProviderChoose, "app.provider", "Choose the browsing provider", &[Context::Normal, Context::CollectionNormal], ["p"];
     Help, "help.toggle", "Open or close keyboard help", NON_TEXT, ["?"];
     InputSubmit, "input.submit", "Submit search, browse selector, leave tag filter, stage new tag or save category name", TEXT, ["enter"];
     InputCancel, "input.cancel", "Leave text input without submitting", TEXT, ["escape"];
@@ -113,24 +114,29 @@ actions! {
     SearchEdit, "search.edit", "Edit general or current-category search", VIEW, ["i"];
     ViewSearch, "view.search", "Go to general YouTube Search", VIEW, ["/"];
     ViewFeed, "view.feed", "Go to the combined subscription Feed", VIEW, ["F"];
-    ViewPrevious, "view.history.previous", "Go back in view history", VIEW, ["-", "escape"];
+    ViewPrevious, "view.history.previous", "Go back in view history", VIEW, ["-"];
     ViewNext, "view.history.next", "Go forward in view history", VIEW, ["+"];
     ViewTabNext, "view.tab.next", "Select the next view tab", VIEW, ["tab", "ctrl+tab"];
     ViewTabPrevious, "view.tab.previous", "Select the previous view tab", VIEW, ["shift+tab"];
     ViewRefresh, "view.refresh", "Refresh the current view and configuration", VIEW, ["r"];
-    VideoPlay, "video.play", "Play the selected video", VIEW, ["enter"];
+    VideoPlay, "video.play", "Play checked videos in check order, or the selected video", VIEW, ["enter"];
+    VideoEnqueue, "video.enqueue", "Append checked videos in check order, or the selected video, to Terebi's queue", VIEW, ["ctrl+enter"];
     VideoOpen, "video.open", "Open the selected YouTube video in the default browser", VIEW, ["o"];
+    VideoCopyUrl, "video.copy_url", "Copy the selected video's URL to the terminal clipboard", VIEW, ["y"];
     VideoNext, "video.select.next", "Select the next video", VIEW, ["j", "down", "ctrl+j"];
     VideoPrevious, "video.select.previous", "Select the previous video", VIEW, ["k", "up", "ctrl+k"];
     VideoFirst, "video.select.first", "Select the first video", VIEW, ["g", "home"];
     VideoLast, "video.select.last", "Select the last video", VIEW, ["G", "end"];
+    VideoToggle, "video.select.toggle", "Toggle the selected video's playback check", VIEW, ["space"];
+    VideoClear, "video.select.clear", "Discard playback checks in the current view", VIEW, ["escape", "ctrl+space"];
     InfoOverview, "video.info.overview", "Show the video overview", VIEW, ["d"];
     InfoDescription, "video.info.description", "Show the video description", VIEW, ["d"];
     InfoHide, "video.info.hide", "Close the video preview", &[Context::Info, Context::Description, Context::CollectionInfo, Context::CollectionDescription], ["escape"];
     CategoryBrowse, "category.browse", "Browse categories", VIEW, ["c"];
     ChannelBrowse, "channel.browse", "Browse subscribed channels", VIEW, ["u"];
     VideoChannel, "video.channel", "Open the selected video's channel", VIEW, ["U"];
-    ChannelTags, "channel.tags", "Edit the selected YouTube channel's or Miruro show's category tags", VIEW, ["s"];
+    ChannelPlaylists, "channel.playlists", "Browse the current channel's playlists", &[Context::Normal], ["L"];
+    ChannelTags, "channel.tags", "Edit the selected YouTube channel's or anime show's category tags", VIEW, ["s"];
     CategoryTags, "category.tags", "Edit category tags for all channels in this category", VIEW, ["S"];
     CategoryRename, "category.rename", "Rename the current or selected category", &[Context::Normal, Context::CollectionNormal, Context::SelectorNormal, Context::TagList], ["R"];
     CategorySave, "category.save", "Save the combined category view as a new category", VIEW, ["P"];
@@ -146,15 +152,15 @@ actions! {
     WatchingBrowse, "view.watching.browse", "Browse started, unfinished videos", VIEW, ["C"];
     WatchStatusWatching, "video.status.watching", "Mark the selected video as watching", VIEW, ["m"];
     WatchStatusWatched, "video.status.watched", "Mark the selected video as watched", VIEW, ["M"];
-    SelectorNext, "selector.select.next", "Select the next category or channel", &[Context::SelectorNormal], ["j", "down"];
-    SelectorPrevious, "selector.select.previous", "Select the previous category or channel", &[Context::SelectorNormal], ["k", "up"];
+    SelectorNext, "selector.select.next", "Select the next category, channel, or playlist", &[Context::SelectorNormal], ["j", "down"];
+    SelectorPrevious, "selector.select.previous", "Select the previous category, channel, or playlist", &[Context::SelectorNormal], ["k", "up"];
     SelectorInputNext, "selector.input.next", "Select the next match while editing the filter", &[Context::SelectorInput], ["down", "ctrl+j"];
     SelectorInputPrevious, "selector.input.previous", "Select the previous match while editing the filter", &[Context::SelectorInput], ["up", "ctrl+k"];
-    SelectorEdit, "selector.edit", "Edit the category, channel, or collection filter", &[Context::SelectorNormal], ["i"];
-    SelectorOpen, "selector.open", "Open the selected category, channel, or collection", &[Context::SelectorNormal], ["enter"];
+    SelectorEdit, "selector.edit", "Edit the category, channel, playlist, or collection filter", &[Context::SelectorNormal], ["i"];
+    SelectorOpen, "selector.open", "Open the selected category, channel, playlist, or collection", &[Context::SelectorNormal], ["enter"];
     SelectorPin, "selector.pin", "Toggle category pinning (category picker only)", &[Context::SelectorNormal], ["p"];
     SelectorToggle, "selector.toggle", "Check a category for combined browsing (category picker only)", &[Context::SelectorNormal], ["space"];
-    SelectorClose, "selector.close", "Close the category, channel, or collection picker", &[Context::SelectorNormal], ["escape"];
+    SelectorClose, "selector.close", "Close the category, channel, playlist, or collection picker", &[Context::SelectorNormal], ["escape"];
     TagNext, "tags.select.next", "Select the next category tag", &[Context::TagList], ["j", "down"];
     TagPrevious, "tags.select.previous", "Select the previous category tag", &[Context::TagList], ["k", "up"];
     TagEdit, "tags.edit", "Edit the category tag filter", &[Context::TagList], ["i"];
@@ -479,11 +485,24 @@ impl Bindings {
                 "VIEWS AND VIDEOS",
                 &[
                     (&[VideoNext, VideoPrevious], "Select next / previous video"),
-                    (&[VideoPlay], "Play the selected video in Terebi"),
+                    (
+                        &[VideoPlay],
+                        "Play checked videos in check order, or the selected video",
+                    ),
+                    (
+                        &[VideoEnqueue],
+                        "Append checked videos in check order, or the selected video, to Terebi's queue",
+                    ),
+                    (
+                        &[VideoToggle],
+                        "Check / uncheck the selected video for playback",
+                    ),
+                    (&[VideoClear], "Clear playback checks in the current view"),
                     (
                         &[VideoOpen],
                         "Open the selected YouTube video in the default browser",
                     ),
+                    (&[VideoCopyUrl], "Copy the selected video's URL"),
                     (
                         &[WatchStatusWatching],
                         "Mark selected as watching (clear watched)",
@@ -501,6 +520,10 @@ impl Bindings {
                     ),
                     (&[VideoChannel], "Browse the selected video's channel"),
                     (&[ChannelBrowse], "Choose a saved channel"),
+                    (
+                        &[ChannelPlaylists],
+                        "Browse the current channel's playlists",
+                    ),
                     (&[CategoryBrowse], "Choose a saved category"),
                     (&[ChannelTags], "Edit the selected channel's tags"),
                     (&[CategoryTags], "Edit all channels in a category"),
@@ -518,6 +541,10 @@ impl Bindings {
                     (&[VideoFirst], "First loaded video"),
                     (&[VideoLast], "Last loaded video"),
                     (&[ViewRefresh], "Reload config and refresh"),
+                    (
+                        &[ProviderChoose],
+                        "Choose the browsing provider (NORMAL only)",
+                    ),
                     (&[Help], "Open / close this reference"),
                     (&[Quit, Interrupt], "Quit"),
                 ],
@@ -593,7 +620,7 @@ impl Bindings {
                 ],
             ),
             (
-                "CHANNEL / CATEGORY / COLLECTION SELECTOR",
+                "CHANNEL / CATEGORY / PLAYLIST / COLLECTION SELECTOR",
                 &[
                     (&[SelectorNext, SelectorPrevious], "Move in NORMAL mode"),
                     (&[SelectorEdit], "Enter filter INSERT mode"),
@@ -767,7 +794,7 @@ fn overlap_winner(context: Context, first: Action, second: Action) -> Option<Act
             },
         );
     }
-    if pair(InfoHide, ViewPrevious)
+    if (pair(InfoHide, ViewPrevious) || pair(InfoHide, VideoClear))
         && matches!(
             context,
             Context::Info

src/lib.rs

@@ -1 +1,76 @@
+pub mod anilist;
+pub mod anime;
 pub mod miruro;
+
+/// Bound both wire bytes and decoded text: ureq's limit precedes decompression.
+fn read_catalog_body(body: &mut ureq::Body, limit: u64) -> std::io::Result<String> {
+    use std::io::Read;
+
+    let mut text = String::new();
+    body.with_config()
+        .limit(limit)
+        .reader()
+        .take(limit + 1)
+        .read_to_string(&mut text)?;
+    if text.len() as u64 > limit {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidData,
+            "Catalog response exceeded decoded body limit",
+        ));
+    }
+    Ok(text)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn compressed_catalog_bodies_keep_the_decoded_size_limit() {
+        use std::{io::Write, net::TcpListener, thread};
+
+        // Gzip of 64 spaces: fits the 32-byte wire limit, exceeds the decoded limit.
+        const GZIP: &[u8] = &[
+            31, 139, 8, 0, 0, 0, 0, 0, 2, 255, 83, 80, 160, 12, 0, 0, 95, 100, 117, 189, 64, 0, 0,
+            0,
+        ];
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let url = format!("http://{}", listener.local_addr().unwrap());
+        let server = thread::spawn(move || {
+            use std::io::{BufRead, BufReader};
+            for _ in 0..2 {
+                let (mut stream, _) = listener.accept().unwrap();
+                stream
+                    .set_read_timeout(Some(std::time::Duration::from_secs(5)))
+                    .unwrap();
+                let mut request = BufReader::new(&mut stream);
+                let mut line = String::new();
+                while request.read_line(&mut line).unwrap() > 0 {
+                    if line == "\r\n" {
+                        break;
+                    }
+                    line.clear();
+                }
+                write!(stream, "HTTP/1.1 200 OK\r\nContent-Encoding: gzip\r\nContent-Length: {}\r\nConnection: close\r\n\r\n", GZIP.len()).unwrap();
+                stream.write_all(GZIP).unwrap();
+            }
+        });
+        let agent = ureq::Agent::config_builder()
+            .timeout_global(Some(std::time::Duration::from_secs(5)))
+            .build()
+            .new_agent();
+        let mut response = agent.get(&url).call().unwrap();
+        assert_eq!(
+            read_catalog_body(response.body_mut(), 64).unwrap(),
+            " ".repeat(64)
+        );
+        let mut response = agent.get(&url).call().unwrap();
+        assert_eq!(
+            read_catalog_body(response.body_mut(), 32)
+                .unwrap_err()
+                .kind(),
+            std::io::ErrorKind::InvalidData
+        );
+        server.join().unwrap();
+    }
+}

src/miruro.rs

@@ -1,22 +1,33 @@
-//! Blocking access to the deployed Miruro catalog and source API.
+//! Blocking access to the deployed Miruro catalog and stable episode identities.
 //!
-//! See `docs/miruro-api.md`. Source URLs are ephemeral. Playback projection is
-//! limited to direct Sun soft-subtitle sources; no proxy, iframe or retry fallback.
+//! See `docs/miruro-api.md`. Terebi owns playback source resolution, headers,
+//! subtitles and playback metadata.
 use std::{
-    collections::{BTreeMap, HashSet},
     io,
     mem::size_of,
-    time::Duration,
+    sync::atomic::{AtomicUsize, Ordering},
+    time::{Duration, Instant},
 };
 
-use serde::{Deserialize, Serialize};
+#[cfg(test)]
+use crate::anime::Identity;
 use serde_json::{Map, Value};
 
-const BASE: &str = "https://barelystarted.miruro.tv";
+// Miruro 2.0 links from https://www.miruro.com/#domains; www hosts are legacy.
+const MIRRORS: &[&str] = &[
+    "https://miruro.cx",
+    "https://miruro.pw",
+    "https://miruro.ws",
+    "https://miruro.to",
+    "https://miruro.tv",
+    "https://miruro.bz",
+];
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(25);
 const BODY_LIMIT: u64 = 2 * 1024 * 1024;
 
 pub struct Client {
     agent: ureq::Agent,
+    preferred: AtomicUsize,
 }
 
 /// Catalog metadata and available episode metadata, not a playback guarantee.
@@ -25,271 +36,16 @@ pub struct Detail {
     pub episodes: Vec<Value>,
 }
 
-/// Stable catalog identity, never a CDN address or playback-provider name.
-#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-pub struct Identity {
-    pub provider: String,
-    pub media_id: String,
-    pub episode: u32,
-}
-
-impl Identity {
-    pub fn new(media_id: String, episode: u32) -> io::Result<Self> {
-        let identity = Self {
-            provider: "miruro".into(),
-            media_id,
-            episode,
-        };
-        identity.validate()?;
-        Ok(identity)
-    }
-
-    pub fn validate(&self) -> io::Result<()> {
-        if self.provider != "miruro"
-            || self.media_id.len() > 512
-            || self.episode == 0
-            || self.episode > i32::MAX as u32
-        {
-            return Err(invalid("Invalid Miruro episode identity"));
-        }
-        validate_segment(&self.media_id)
-    }
-
-    pub fn key(&self) -> String {
-        format!("miruro:{}:{}", self.media_id, self.episode)
-    }
-
-    pub fn from_key(key: &str) -> io::Result<Self> {
-        let (media_id, episode) = key
-            .strip_prefix("miruro:")
-            .and_then(|rest| rest.split_once(':'))
-            .ok_or_else(|| invalid("Invalid Miruro episode key"))?;
-        if episode.starts_with('0') || !episode.bytes().all(|byte| byte.is_ascii_digit()) {
-            return Err(invalid("Noncanonical Miruro episode key"));
-        }
-        Self::new(
-            media_id.into(),
-            episode
-                .parse()
-                .map_err(|_| invalid("Invalid Miruro episode number"))?,
-        )
-    }
-}
-
-#[derive(Clone, Debug, Serialize)]
-pub struct Subtitle {
-    pub url: String,
-    pub format: String,
-    pub language: String,
-    pub label: String,
-    pub default: bool,
-    pub headers: BTreeMap<String, String>,
-}
-
-#[derive(Clone, Debug, Serialize)]
-pub struct SourceDocument {
-    pub version: u32,
-    pub url: String,
-    pub headers: BTreeMap<String, String>,
-    pub identity: Identity,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    pub subtitles: Vec<Subtitle>,
-}
-
-impl SourceDocument {
-    pub fn validate(&self) -> io::Result<()> {
-        if self.version != 1
-            || self.subtitles.len() > 32
-            || self.subtitles.iter().filter(|track| track.default).count() > 1
-        {
-            return Err(invalid(
-                "Invalid source document version or subtitle limits",
-            ));
-        }
-        if self
-            .title
-            .as_ref()
-            .is_some_and(|title| title.chars().any(char::is_control))
-        {
-            return Err(invalid("Invalid source title"));
-        }
-        self.identity.validate()?;
-        validate_url(&self.url)?;
-        validate_headers(&self.headers)?;
-        for track in &self.subtitles {
-            if track.format != "vtt" {
-                return Err(invalid("Only external VTT subtitles are supported"));
-            }
-            if track.label.chars().any(char::is_control)
-                || track.language.chars().any(char::is_control)
-            {
-                return Err(invalid("Invalid subtitle label or language"));
-            }
-            validate_url(&track.url)?;
-            validate_headers(&track.headers)?;
-        }
-        Ok(())
-    }
-
-    /// No provider/language fallback: take the first direct ssub/Sun server.
-    pub fn from_sources(sources: &Value, identity: Identity, title: &str) -> io::Result<Self> {
-        identity.validate()?;
-        if sources["episodeNumber"].as_u64() != Some(u64::from(identity.episode)) {
-            return Err(invalid(
-                "Resolved source episode does not match its identity",
-            ));
-        }
-        let config = &sources["config"]["sun"];
-        if config["player"] != "native"
-            || config["proxy"] != false
-            || config["hls"]["segments"]["enabled"] == true
-            || config["hls"]["query"]["enabled"] == true
-        {
-            return Err(invalid("Sun requires unsupported proxy or HLS rewriting"));
-        }
-        let provider = sources["tracks"]
-            .as_array()
-            .and_then(|tracks| tracks.iter().find(|track| track["track"] == "ssub"))
-            .and_then(|track| track["providers"].as_array())
-            .and_then(|providers| {
-                providers
-                    .iter()
-                    .find(|provider| provider["provider"] == "sun")
-            })
-            .ok_or_else(|| invalid("Direct Sun soft-subtitle source is unavailable"))?;
-        let server = provider["servers"]
-            .as_array()
-            .and_then(|servers| {
-                servers.iter().find(|server| {
-                    server["streams"]
-                        .as_array()
-                        .is_some_and(|streams| !streams.is_empty())
-                })
-            })
-            .ok_or_else(|| invalid("Direct Sun stream is unavailable"))?;
-        let stream = &server["streams"][0];
-        if !matches!(
-            stream["format"].as_str(),
-            Some("hls" | "m3u8" | "application/vnd.apple.mpegurl" | "application/x-mpegurl")
-        ) || !stream["embed"].is_null()
-        {
-            return Err(invalid("Selected Sun stream is not direct HLS"));
-        }
-        let headers = source_headers(&server["headers"])?;
-        let mut subtitles = Vec::new();
-        for subtitle in provider["subtitles"]
-            .as_array()
-            .ok_or_else(|| invalid("Missing Sun subtitle array"))?
-        {
-            if subtitle["format"] != "vtt" {
-                continue;
-            }
-            if subtitles.len() == 32 {
-                return Err(invalid("Source subtitle limit exceeded"));
-            }
-            subtitles.push(Subtitle {
-                url: source_string(subtitle, "file")?,
-                format: "vtt".into(),
-                language: source_string(subtitle, "language")?,
-                label: source_string(subtitle, "label")?,
-                default: subtitle["default"]
-                    .as_bool()
-                    .ok_or_else(|| invalid("Invalid subtitle default flag"))?,
-                // Verified for direct Sun only. These are explicit resource headers,
-                // not an inheritance rule for other providers.
-                headers: headers.clone(),
-            });
-        }
-        let document = Self {
-            version: 1,
-            url: source_string(stream, "url")?,
-            headers,
-            identity,
-            title: Some(title.into()),
-            subtitles,
-        };
-        document.validate()?;
-        Ok(document)
-    }
-}
-
-fn source_string(value: &Value, field: &str) -> io::Result<String> {
-    value
-        .get(field)
-        .and_then(Value::as_str)
-        .map(str::to_owned)
-        .ok_or_else(|| invalid("Missing or invalid resolved source field"))
-}
-
-fn source_headers(value: &Value) -> io::Result<BTreeMap<String, String>> {
-    if value.is_null() {
-        return Ok(BTreeMap::new());
-    }
-    let headers = value
-        .as_object()
-        .ok_or_else(|| invalid("Invalid source header map"))?;
-    if headers.len() > 64 {
-        return Err(invalid("Source header limit exceeded"));
-    }
-    headers
-        .iter()
-        .map(|(key, value)| {
-            Ok((
-                key.clone(),
-                value
-                    .as_str()
-                    .ok_or_else(|| invalid("Invalid source header value"))?
-                    .into(),
-            ))
-        })
-        .collect()
-}
-
-fn validate_url(url: &str) -> io::Result<()> {
-    let uri: ureq::http::Uri = url.parse().map_err(|_| invalid("Invalid source URL"))?;
-    if !matches!(uri.scheme_str(), Some("http" | "https"))
-        || uri.host().is_none_or(str::is_empty)
-        || uri
-            .authority()
-            .is_some_and(|authority| authority.as_str().contains('@'))
-        || url.chars().any(char::is_control)
-    {
-        return Err(invalid(
-            "Source URLs must be absolute HTTP(S) without credentials",
-        ));
-    }
-    Ok(())
-}
-
-fn validate_headers(headers: &BTreeMap<String, String>) -> io::Result<()> {
-    if headers.len() > 64 {
-        return Err(invalid("Source header limit exceeded"));
-    }
-    let mut names = HashSet::with_capacity(headers.len());
-    for (name, value) in headers {
-        let name = ureq::http::HeaderName::from_bytes(name.as_bytes())
-            .map_err(|_| invalid("Invalid source header name"))?;
-        if !names.insert(name)
-            || value.chars().any(char::is_control)
-            || ureq::http::HeaderValue::from_str(value).is_err()
-        {
-            return Err(invalid("Invalid or duplicate source header"));
-        }
-    }
-    Ok(())
-}
-
 impl Default for Client {
     fn default() -> Self {
         Self {
             agent: ureq::Agent::config_builder()
-                .timeout_global(Some(Duration::from_secs(25)))
+                .timeout_global(Some(REQUEST_TIMEOUT))
                 .http_status_as_error(false)
                 .max_redirects(0)
                 .build()
                 .new_agent(),
+            preferred: AtomicUsize::new(0),
         }
     }
 }
@@ -333,49 +89,43 @@ impl Client {
         Ok(detail)
     }
 
-    /// Fresh source data, preserving tracks, headers, subtitles and runtime config.
-    /// `episode` is the returned episode_number, not absolute_number or array index.
-    pub fn sources(&self, id: &str, episode: u32) -> io::Result<Value> {
-        validate_segment(id)?;
-        if episode == 0 {
-            return Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
-                "Episode must be positive",
-            ));
-        }
-        let body = self.get(
-            "/api/sources",
-            &[("id", id), ("n", &episode.to_string())],
-            &["application/json"],
-        )?;
-        let value: Value = serde_json::from_str(&body).map_err(invalid)?;
-        if value.get("episodeNumber").and_then(Value::as_u64) != Some(u64::from(episode))
-            || !value.get("tracks").is_some_and(Value::is_array)
-        {
-            return Err(invalid(
-                "Miruro sources did not match the requested episode",
-            ));
-        }
-        Ok(value)
-    }
-
-    pub fn source_document(
-        &self,
-        id: &str,
-        episode: u32,
-        title: &str,
-    ) -> io::Result<SourceDocument> {
-        let identity = Identity::new(id.into(), episode)?;
-        SourceDocument::from_sources(&self.sources(id, episode)?, identity, title)
-    }
-
     fn get(&self, path: &str, query: &[(&str, &str)], types: &[&str]) -> io::Result<String> {
-        let mut response = self
+        self.get_from(MIRRORS, path, query, types)
+    }
+
+    fn get_from(
+        &self,
+        mirrors: &[&str],
+        path: &str,
+        query: &[(&str, &str)],
+        types: &[&str],
+    ) -> io::Result<String> {
+        let started = Instant::now();
+        let first = self.preferred.load(Ordering::Relaxed) % mirrors.len();
+        let mut last_error = io::Error::new(io::ErrorKind::TimedOut, "Miruro request timed out");
+        let mut attempts = 0;
+        for offset in 0..mirrors.len() {
+            let Some(remaining) = REQUEST_TIMEOUT.checked_sub(started.elapsed()) else {
+                break;
+            };
+            let index = (first + offset) % mirrors.len();
+            let base = mirrors[index];
+            attempts += 1;
+            let response = self
                 .agent
-            .get(format!("{BASE}{path}"))
+                .get(format!("{base}{path}"))
                 .query_pairs(query.iter().copied())
-            .call()
-            .map_err(|_| io::Error::other("Miruro HTTP transport failed"))?;
+                .config()
+                .timeout_global(Some(remaining.min(Duration::from_secs(5))))
+                .build()
+                .call();
+            let mut response = match response {
+                Ok(response) => response,
+                Err(_) => {
+                    last_error = io::Error::other(format!("{base}: HTTP transport failed"));
+                    continue;
+                }
+            };
             let status = response.status().as_u16();
             let mime = response.body().mime_type().unwrap_or("missing");
             if status != 200 {
@@ -384,20 +134,36 @@ impl Client {
                     404 => io::ErrorKind::NotFound,
                     _ => io::ErrorKind::Other,
                 };
-            return Err(io::Error::new(
-                kind,
-                format!("Miruro HTTP {status} ({mime}); no retry attempted"),
-            ));
+                last_error = io::Error::new(kind, format!("{base}: HTTP {status} ({mime})"));
+                // Do not rotate hosts to work around rate limits or invalid requests.
+                if !matches!(status, 301..=308 | 403 | 404 | 408 | 500..=599) {
+                    return Err(last_error);
+                }
+                continue;
             }
             if !types.contains(&mime) {
-            return Err(invalid(format!("Unexpected Miruro Content-Type: {mime}")));
+                last_error = invalid(format!("{base}: unexpected Content-Type {mime}"));
+                continue;
             }
-        response
-            .body_mut()
-            .with_config()
-            .limit(BODY_LIMIT)
-            .read_to_string()
-            .map_err(|_| invalid("Miruro response was unreadable, timed out, or exceeded 2 MiB"))
+            match crate::read_catalog_body(response.body_mut(), BODY_LIMIT) {
+                Ok(body) => {
+                    self.preferred.store(index, Ordering::Relaxed);
+                    return Ok(body);
+                }
+                Err(_) => {
+                    last_error = invalid(format!(
+                        "{base}: response unreadable, timed out, or exceeded 2 MiB"
+                    ));
+                }
+            }
+        }
+        Err(io::Error::new(
+            last_error.kind(),
+            format!(
+                "Miruro request failed on {attempts}/{} mirrors; last error: {last_error}",
+                mirrors.len()
+            ),
+        ))
     }
 }
 

src/miruro_browser.rs

@@ -5,7 +5,10 @@ use std::{
     sync::mpsc::{self, Receiver, SyncSender},
     thread,
 };
-use tubular::miruro::{Client, Detail, Identity, SourceDocument};
+use tubular::{
+    anime::{Identity, Provider},
+    miruro::{Client, Detail},
+};
 use unicode_normalization::UnicodeNormalization;
 
 #[derive(Clone, Debug)]
@@ -28,7 +31,7 @@ pub struct Episode {
 
 impl Episode {
     pub fn snapshot(&self, media: &Media) -> Video {
-        video(
+        let mut snapshot = video(
             self.identity.key(),
             format!(
                 "{} · Episode {}{}",
@@ -40,7 +43,11 @@ impl Episode {
                     .unwrap_or_default()
             ),
             self.aired_on.clone(),
-        )
+        );
+        if self.identity.provider == "anilist" {
+            snapshot.channel = Some("AniList".into());
+        }
+        snapshot
     }
 }
 
@@ -53,12 +60,10 @@ pub struct Series {
 pub enum Request {
     Search(String),
     Episodes { media_id: String, slug: String },
-    Source(Video),
 }
 pub enum Response {
     Catalog(Vec<Media>),
     Series(Series),
-    Source(Video, Box<SourceDocument>),
 }
 
 // One running request, no queued network requests. The UI retains only its newest intent.
@@ -69,26 +74,30 @@ pub struct Worker {
     generation: u64,
 }
 impl Worker {
-    pub fn new() -> Self {
+    pub fn new(provider: Provider) -> Self {
         let (sender, requests) = mpsc::sync_channel::<(u64, Request)>(1);
         let (results, receiver) = mpsc::sync_channel(1);
         thread::spawn(move || {
             let client = Client::default();
+            let anilist = tubular::anilist::Client::default();
             while let Ok((generation, request)) = requests.recv() {
-                let result = match request {
-                    Request::Search(query) => client
+                let result = match (provider, request) {
+                    (Provider::Miruro, Request::Search(query)) => client
                         .search(&query)
                         .and_then(catalog)
                         .map(Response::Catalog),
-                    Request::Episodes { media_id, slug } => client
+                    (Provider::Miruro, Request::Episodes { media_id, slug }) => client
                         .detail(&media_id, &slug)
                         .and_then(|detail| series(&media_id, detail))
                         .map(Response::Series),
-                    Request::Source(video) => Identity::from_key(&video.id)
-                        .and_then(|id| {
-                            client.source_document(&id.media_id, id.episode, &video.title)
-                        })
-                        .map(|source| Response::Source(video, Box::new(source))),
+                    (Provider::AniList, Request::Search(query)) => anilist
+                        .search(&query)
+                        .and_then(catalog)
+                        .map(Response::Catalog),
+                    (Provider::AniList, Request::Episodes { media_id, .. }) => anilist
+                        .detail(&media_id)
+                        .and_then(anilist_series)
+                        .map(Response::Series),
                 };
                 if results.send((generation, result)).is_err() {
                     break;
@@ -104,11 +113,11 @@ impl Worker {
     }
     pub fn submit(&mut self, generation: u64, request: Request) -> io::Result<()> {
         if self.busy {
-            return Err(io::Error::other("Miruro worker is busy"));
+            return Err(io::Error::other("Anime catalog worker is busy"));
         }
         self.sender
             .try_send((generation, request))
-            .map_err(|_| io::Error::other("Miruro worker unavailable"))?;
+            .map_err(|_| io::Error::other("Anime catalog worker unavailable"))?;
         self.busy = true;
         self.generation = generation;
         Ok(())
@@ -124,7 +133,7 @@ impl Worker {
                 self.busy = false;
                 Some((
                     self.generation,
-                    Err(io::Error::other("Miruro worker stopped")),
+                    Err(io::Error::other("Anime catalog worker stopped")),
                 ))
             }
             Err(_) => None,
@@ -210,7 +219,7 @@ fn media(metadata: Value) -> io::Result<Media> {
         .and_then(Value::as_str)
         .ok_or_else(|| invalid("Miruro catalog ID is missing"))?
         .to_owned();
-    Identity::new(id.clone(), 1)?;
+    Identity::miruro(id.clone(), 1)?;
     Ok(Media {
         id,
         title: title(&metadata)?,
@@ -250,7 +259,7 @@ pub fn series(media_id: &str, detail: Detail) -> io::Result<Series> {
                 .and_then(Value::as_u64)
                 .and_then(|n| u32::try_from(n).ok())
                 .ok_or_else(|| invalid("Miruro episode number is invalid"))?;
-            let identity = Identity::new(media_id.to_owned(), number)?;
+            let identity = Identity::miruro(media_id.to_owned(), number)?;
             if !seen.insert(number) {
                 return Err(invalid("Miruro returned duplicate episode numbers"));
             }
@@ -273,6 +282,46 @@ pub fn series(media_id: &str, detail: Detail) -> io::Result<Series> {
     Ok(Series { media, episodes })
 }
 
+pub fn media_provider(media: &Media) -> Provider {
+    if media
+        .metadata
+        .get("catalog_provider")
+        .and_then(Value::as_str)
+        == Some("anilist")
+    {
+        Provider::AniList
+    } else {
+        Provider::Miruro
+    }
+}
+
+pub fn anilist_episode(media: &Media, number: u32) -> io::Result<Episode> {
+    let identity = Identity::anilist(media.id.clone(), number)?;
+    Ok(Episode {
+        identity,
+        title: None,
+        synopsis: Some("Catalog numbering does not guarantee a stream. Visible episodes are checked separately for ZokoAnime sub sources; playback always resolves fresh.".into()),
+        aired_on: None,
+        duration_seconds: None,
+        metadata: Value::Null,
+    })
+}
+
+pub fn anilist_series(metadata: Value) -> io::Result<Series> {
+    let media = media(metadata)?;
+    Identity::anilist(media.id.clone(), 1)?;
+    let count = tubular::anilist::catalog_count(&media.metadata)?;
+    if count.is_some_and(|count| count > 10000) {
+        return Err(invalid(
+            "AniList catalog exceeds the 10000 episode display limit",
+        ));
+    }
+    let episodes = (1..=count.unwrap_or(0))
+        .map(|number| anilist_episode(&media, number))
+        .collect::<io::Result<Vec<_>>>()?;
+    Ok(Series { media, episodes })
+}
+
 #[cfg(test)]
 #[path = "../tests/unit/miruro_browser.rs"]
 mod tests;

src/source_check.rs

@@ -0,0 +1,375 @@
+//! Session-only availability checks. Never retain resolved media or provider diagnostics.
+use std::{
+    collections::BTreeMap,
+    ffi::OsStr,
+    io::{self, Read},
+    process::{Child, ChildStdout, Stdio},
+    time::{Duration, Instant},
+};
+
+use serde::Deserialize;
+use tubular::anime::{Identity, Provider};
+
+const TIMEOUT: Duration = Duration::from_secs(30);
+const OUTPUT_LIMIT: usize = 4096;
+
+#[derive(Clone, Copy, Debug, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub(super) enum Status {
+    Available,
+    Unavailable,
+    Failed,
+}
+impl Status {
+    pub(super) fn label(self) -> &'static str {
+        match self {
+            Self::Available => "ZokoAnime · sub",
+            Self::Unavailable => "No source found",
+            Self::Failed => "Source check failed",
+        }
+    }
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Reply {
+    version: u32,
+    provider: String,
+    track: String,
+    status: Status,
+}
+fn decode(bytes: &[u8], success: bool) -> Status {
+    if !success || bytes.len() > OUTPUT_LIMIT {
+        return Status::Failed;
+    }
+    let Ok(text) = std::str::from_utf8(bytes) else {
+        return Status::Failed;
+    };
+    let text = text.strip_suffix('\n').unwrap_or(text);
+    if text.contains(['\n', '\r']) {
+        return Status::Failed;
+    }
+    match serde_json::from_str::<Reply>(text) {
+        Ok(reply)
+            if reply.version == 1 && reply.provider == "zokoanime" && reply.track == "sub" =>
+        {
+            reply.status
+        }
+        _ => Status::Failed,
+    }
+}
+
+struct Job {
+    child: Child,
+    stdout: ChildStdout,
+    bytes: Vec<u8>,
+    deadline: Instant,
+    eof: bool,
+}
+impl Job {
+    fn start(player: &OsStr, key: &str, now: Instant) -> io::Result<Self> {
+        let identity = Identity::from_key(key)?;
+        if identity.provider != Provider::AniList.key() {
+            return Err(io::Error::other("Unsupported source check"));
+        }
+        let mut command = crate::youtube::isolated_command(player);
+        command.arg("--check-source").arg(identity.watch_url()?);
+        Self::spawn(&mut command, now)
+    }
+    fn spawn(command: &mut std::process::Command, now: Instant) -> io::Result<Self> {
+        let mut child = command
+            .stdin(Stdio::null())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::null())
+            .spawn()?;
+        let stdout = child.stdout.take().expect("piped stdout");
+        let mut job = Self {
+            child,
+            stdout,
+            bytes: Vec::new(),
+            deadline: now + TIMEOUT,
+            eof: false,
+        };
+        job.nonblocking()?;
+        Ok(job)
+    }
+    #[cfg(unix)]
+    fn nonblocking(&mut self) -> io::Result<()> {
+        use std::os::fd::AsRawFd;
+        let fd = self.stdout.as_raw_fd();
+        // SAFETY: stdout owns this live descriptor; preserve the existing flags.
+        let flags = unsafe { libc::fcntl(fd, libc::F_GETFL) };
+        if flags < 0 || unsafe { libc::fcntl(fd, libc::F_SETFL, flags | libc::O_NONBLOCK) } < 0 {
+            return Err(io::Error::last_os_error());
+        }
+        Ok(())
+    }
+    #[cfg(not(unix))]
+    fn nonblocking(&mut self) -> io::Result<()> {
+        Err(io::Error::other(
+            "Source checks require nonblocking process pipes",
+        ))
+    }
+    fn poll(&mut self, now: Instant) -> Option<Status> {
+        if now >= self.deadline {
+            return Some(Status::Failed);
+        }
+        // Each poll consumes at most the protocol limit plus one byte, even from a noisy CLI.
+        let mut buffer = [0; OUTPUT_LIMIT + 1];
+        while !self.eof {
+            let remaining = OUTPUT_LIMIT + 1 - self.bytes.len();
+            match self.stdout.read(&mut buffer[..remaining]) {
+                Ok(0) => self.eof = true,
+                Ok(count) => {
+                    self.bytes.extend_from_slice(&buffer[..count]);
+                    if self.bytes.len() > OUTPUT_LIMIT {
+                        return Some(Status::Failed);
+                    }
+                }
+                Err(error) if error.kind() == io::ErrorKind::WouldBlock => break,
+                Err(error) if error.kind() == io::ErrorKind::Interrupted => break,
+                Err(_) => return Some(Status::Failed),
+            }
+        }
+        match self.child.try_wait() {
+            Ok(Some(status)) if self.eof => Some(decode(&self.bytes, status.success())),
+            Ok(_) => None,
+            Err(_) => Some(Status::Failed),
+        }
+    }
+}
+impl Drop for Job {
+    fn drop(&mut self) {
+        // The isolated group may still have descendants holding stdout after the leader exits.
+        #[cfg(unix)]
+        unsafe {
+            libc::kill(-(self.child.id() as i32), libc::SIGKILL);
+        }
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+    }
+}
+
+struct Active {
+    generation: u64,
+    key: String,
+    job: Job,
+}
+#[derive(Default)]
+pub(super) struct Checks {
+    cache: BTreeMap<String, Status>,
+    active: Option<Active>,
+}
+impl Checks {
+    pub(super) fn cancel(&mut self) {
+        self.active = None;
+    }
+    pub(super) fn clear(&mut self) {
+        self.cancel();
+        self.cache.clear();
+    }
+    pub(super) fn status(&self, key: &str) -> Option<Status> {
+        self.cache.get(key).copied()
+    }
+    pub(super) fn label(&self, key: &str) -> &'static str {
+        if let Some(status) = self.status(key) {
+            status.label()
+        } else if self.active.as_ref().is_some_and(|active| active.key == key) {
+            "Checking source…"
+        } else {
+            "Source check pending"
+        }
+    }
+    fn next<'a>(&self, visible: &'a [String], selected: Option<&'a str>) -> Option<&'a str> {
+        selected
+            .filter(|key| {
+                visible.iter().any(|item| item.as_str() == *key) && !self.cache.contains_key(*key)
+            })
+            .or_else(|| {
+                visible
+                    .iter()
+                    .find(|key| !self.cache.contains_key(*key))
+                    .map(String::as_str)
+            })
+    }
+    fn finish(
+        &mut self,
+        generation: u64,
+        result_generation: u64,
+        key: String,
+        status: Status,
+        visible: &[String],
+    ) {
+        if generation == result_generation && visible.contains(&key) {
+            self.cache.insert(key, status);
+        }
+    }
+    pub(super) fn update(
+        &mut self,
+        generation: u64,
+        visible: &[String],
+        selected: Option<&str>,
+        player: &OsStr,
+        now: Instant,
+    ) {
+        if self
+            .active
+            .as_ref()
+            .is_some_and(|active| active.generation != generation || !visible.contains(&active.key))
+        {
+            self.cancel();
+        }
+        // Cursor moves do not starve a check that is still visible. New selection gets the next turn.
+        if let Some(status) = self.active.as_mut().and_then(|active| active.job.poll(now)) {
+            let active = self.active.take().expect("completed check");
+            self.finish(generation, active.generation, active.key, status, visible);
+        }
+        if self.active.is_none()
+            && let Some(key) = self.next(visible, selected)
+        {
+            let key = key.to_owned();
+            match Job::start(player, &key, now) {
+                Ok(job) => {
+                    self.active = Some(Active {
+                        generation,
+                        key,
+                        job,
+                    })
+                }
+                Err(_) => {
+                    self.cache.insert(key, Status::Failed);
+                }
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn clock() -> Instant {
+        // All transitions derive from this fixed injected instant; no sleeps or wall-clock assertions.
+        *std::sync::LazyLock::force(&CLOCK)
+    }
+    static CLOCK: std::sync::LazyLock<Instant> = std::sync::LazyLock::new(Instant::now);
+    #[test]
+    fn protocol_distinguishes_missing_from_failure_and_rejects_other_output() {
+        for (status, expected) in [
+            ("available", Status::Available),
+            ("unavailable", Status::Unavailable),
+            ("failed", Status::Failed),
+        ] {
+            let text = format!(
+                r#"{{"version":1,"provider":"zokoanime","track":"sub","status":"{status}"}}"#
+            );
+            assert_eq!(decode(text.as_bytes(), true), expected);
+            assert_eq!(decode(text.as_bytes(), false), Status::Failed);
+        }
+        for text in [
+            "",
+            "old CLI help",
+            r#"{"version":2,"provider":"zokoanime","track":"sub","status":"available"}"#,
+            r#"{"version":1,"provider":"other","track":"sub","status":"available"}"#,
+            r#"{"version":1,"provider":"zokoanime","track":"dub","status":"available"}"#,
+        ] {
+            assert_eq!(decode(text.as_bytes(), true), Status::Failed);
+        }
+        assert_eq!(decode(&vec![b' '; OUTPUT_LIMIT + 1], true), Status::Failed);
+        assert_eq!(decode(b"{}\n{}", true), Status::Failed);
+    }
+    #[test]
+    fn selected_then_visible_and_no_retry_until_refresh() {
+        let mut checks = Checks::default();
+        let visible = vec!["anilist:1:3".into(), "anilist:1:4".into()];
+        assert_eq!(
+            checks.next(&visible, Some("anilist:1:4")),
+            Some("anilist:1:4")
+        );
+        assert_eq!(
+            checks.next(&visible, Some("anilist:1:99")),
+            Some("anilist:1:3")
+        );
+        for key in &visible {
+            checks.finish(1, 1, key.clone(), Status::Failed, &visible);
+        }
+        assert_eq!(checks.next(&visible, Some("anilist:1:4")), None);
+        checks.clear();
+        assert_eq!(
+            checks.next(&visible, Some("anilist:1:4")),
+            Some("anilist:1:4")
+        );
+    }
+    #[test]
+    fn late_generation_or_offscreen_results_do_not_enter_cache() {
+        let mut checks = Checks::default();
+        let visible: Vec<String> = vec!["anilist:1:3".into()];
+        checks.finish(2, 1, visible[0].clone(), Status::Available, &visible);
+        checks.finish(2, 2, "anilist:1:2".into(), Status::Available, &visible);
+        assert!(checks.cache.is_empty());
+        checks.finish(2, 2, visible[0].clone(), Status::Unavailable, &visible);
+        assert_eq!(checks.cache.get(&visible[0]), Some(&Status::Unavailable));
+    }
+    #[cfg(unix)]
+    fn waiting_job() -> Job {
+        let mut command = crate::youtube::isolated_command(OsStr::new("/bin/sh"));
+        command.args(["-c", "kill -STOP $$"]);
+        Job::spawn(&mut command, clock()).unwrap()
+    }
+    #[cfg(unix)]
+    #[test]
+    fn injected_timeout_and_drop_reap_the_child() {
+        let mut job = waiting_job();
+        let pid = job.child.id();
+        assert_eq!(job.poll(clock() + TIMEOUT), Some(Status::Failed));
+        drop(job);
+        let mut status = 0;
+        assert_eq!(
+            unsafe { libc::waitpid(pid as i32, &mut status, libc::WNOHANG) },
+            -1
+        );
+        assert_eq!(
+            io::Error::last_os_error().raw_os_error(),
+            Some(libc::ECHILD)
+        );
+    }
+    #[cfg(unix)]
+    #[test]
+    fn cancel_offscreen_or_generation_but_not_visible_deselection() {
+        let visible: Vec<String> = vec!["anilist:1:3".into(), "anilist:1:4".into()];
+        let mut checks = Checks {
+            active: Some(Active {
+                generation: 7,
+                key: visible[0].clone(),
+                job: waiting_job(),
+            }),
+            ..Checks::default()
+        };
+        checks.update(
+            7,
+            &visible,
+            Some(&visible[1]),
+            OsStr::new("/missing-player"),
+            clock(),
+        );
+        assert_eq!(checks.active.as_ref().unwrap().key, visible[0]);
+        checks.update(7, &[], None, OsStr::new("/missing-player"), clock());
+        assert!(checks.active.is_none());
+        assert!(checks.cache.is_empty());
+        checks.active = Some(Active {
+            generation: 7,
+            key: visible[0].clone(),
+            job: waiting_job(),
+        });
+        checks.update(8, &[], None, OsStr::new("/missing-player"), clock());
+        assert!(checks.active.is_none());
+    }
+    #[cfg(unix)]
+    #[test]
+    fn old_cli_exit_without_protocol_is_failed_without_blocking_playback_contract() {
+        let mut job = Job::start(OsStr::new("/usr/bin/true"), "anilist:1:1", clock()).unwrap();
+        job.child.wait().unwrap();
+        assert_eq!(job.poll(clock()), Some(Status::Failed));
+        assert!(Job::start(OsStr::new("/usr/bin/true"), "miruro:1:1", clock()).is_err());
+        assert!(Job::start(OsStr::new("/missing-player"), "anilist:1:1", clock()).is_err());
+    }
+}

src/ui.rs

@@ -2,6 +2,13 @@ use std::time::Duration;
 
 use ratatui::{
     Frame,
+    crossterm::{
+        clipboard::CopyToClipboard,
+        event::{
+            KeyboardEnhancementFlags, PopKeyboardEnhancementFlags, PushKeyboardEnhancementFlags,
+        },
+        execute,
+    },
     layout::{Constraint, Layout, Rect},
     style::{Color, Style},
     text::{Line, Span},
@@ -12,6 +19,34 @@ pub const ACCENT: Style = Style::new().fg(Color::Cyan);
 pub const SELECTED: Style = Style::new().fg(Color::Black).bg(Color::Cyan);
 pub const SELECTION_MARKER: &str = "> ";
 
+// Keep modified Return distinct from Return on terminals supporting the Kitty protocol.
+pub struct KeyboardProtocol;
+
+impl KeyboardProtocol {
+    pub fn enable() -> std::io::Result<Self> {
+        execute!(
+            std::io::stdout(),
+            PushKeyboardEnhancementFlags(KeyboardEnhancementFlags::DISAMBIGUATE_ESCAPE_CODES)
+        )?;
+        Ok(Self)
+    }
+}
+
+impl Drop for KeyboardProtocol {
+    fn drop(&mut self) {
+        let _ = execute!(std::io::stdout(), PopKeyboardEnhancementFlags);
+    }
+}
+
+pub fn copy_video_url(id: &str) -> String {
+    let result = crate::youtube::video_url(id)
+        .and_then(|url| execute!(std::io::stdout(), CopyToClipboard::to_clipboard_from(url)));
+    match result {
+        Ok(()) => "Video URL sent to terminal clipboard.".into(),
+        Err(error) => format!("Cannot copy video URL: {error}"),
+    }
+}
+
 pub fn browser_layout(area: Rect, header_height: u16) -> [Rect; 5] {
     Layout::vertical([
         Constraint::Length(header_height),

src/video_state.rs

@@ -1,7 +1,7 @@
 use std::{
     collections::BTreeSet,
     fs::{self, File, OpenOptions, ReadDir},
-    io::{self, Read, Write},
+    io::{self, Read, Seek, SeekFrom, Write},
     path::{Path, PathBuf},
     sync::atomic::{AtomicU64, Ordering},
 };
@@ -10,13 +10,12 @@ use serde::Deserialize;
 use toml_edit::{Array, ArrayOfTables, DocumentMut, Table, value};
 
 use crate::youtube::{Video, valid_video_id, validate_video};
-use tubular::miruro::{Identity, SourceDocument};
+use tubular::anime::{Identity, Provider};
 
 const MAX_STATE_BYTES: u64 = 8 * 1024 * 1024;
 const MAX_LINE: usize = 16 * 1024;
 const STREAM_BYTES: usize = 16 * 1024;
 const MAX_STREAMS: usize = 4096;
-const MAX_SOURCE_BYTES: usize = 1024 * 1024;
 const MAX_SHOWS: usize = 4096;
 const MAX_SHOW_TAGS: usize = 256;
 const MAX_TAG_BYTES: usize = 256;
@@ -135,6 +134,9 @@ pub struct State {
     watch_state: StoredFile,
     library: StoredFile,
     saved_shows: Vec<SavedShow>,
+    other_library: StoredFile,
+    other_shows: Vec<SavedShow>,
+    catalog: Provider,
     watched: BTreeSet<String>,
     pending: BTreeSet<String>,
     sessions: PathBuf,
@@ -159,6 +161,20 @@ impl State {
         let (library, document) = StoredFile::open(parent.join("miruro-library.toml"))?;
         let saved_shows = load_shows(&document)
             .map_err(|e| invalid(format!("{}: {e}", library.path.display())))?;
+        let (other_library, document) = StoredFile::open(parent.join("anilist-library.toml"))?;
+        let other_shows = load_shows(&document)
+            .map_err(|e| invalid(format!("{}: {e}", other_library.path.display())))?;
+        if saved_shows
+            .iter()
+            .any(|show| crate::miruro_browser::media_provider(&show.media) != Provider::Miruro)
+            || other_shows
+                .iter()
+                .any(|show| crate::miruro_browser::media_provider(&show.media) != Provider::AniList)
+        {
+            return Err(invalid(
+                "Saved-show library contains a different catalog provider",
+            ));
+        }
         let completed: Vec<_> = watching.ids.intersection(&watched).cloned().collect();
         if !completed.is_empty() {
             watching.remove(&completed)?;
@@ -170,6 +186,9 @@ impl State {
             watch_state,
             library,
             saved_shows,
+            other_library,
+            other_shows,
+            catalog: Provider::Miruro,
             watched,
             pending: BTreeSet::new(),
             sessions: parent.join("playback-sessions"),
@@ -180,6 +199,14 @@ impl State {
         })
     }
 
+    pub fn select_catalog(&mut self, provider: Provider) {
+        if self.catalog != provider {
+            std::mem::swap(&mut self.library, &mut self.other_library);
+            std::mem::swap(&mut self.saved_shows, &mut self.other_shows);
+            self.catalog = provider;
+        }
+    }
+
     fn collection(&self, kind: CollectionKind) -> &Collection {
         match kind {
             CollectionKind::WatchLater => &self.watch_later,
@@ -216,6 +243,9 @@ impl State {
         tags: &BTreeSet<String>,
     ) -> io::Result<()> {
         validate_show(media)?;
+        if crate::miruro_browser::media_provider(media) != self.catalog {
+            return Err(invalid("Cannot save a show into another catalog's library"));
+        }
         if tags.len() > MAX_SHOW_TAGS {
             return Err(invalid("A saved show cannot have more than 256 tags"));
         }
@@ -228,7 +258,7 @@ impl State {
             .iter()
             .position(|show| show.media.id == media.id);
         if index.is_none() && self.saved_shows.len() >= MAX_SHOWS {
-            return Err(invalid("Miruro library exceeds the 4096 show limit"));
+            return Err(invalid("Anime library exceeds the 4096 show limit"));
         }
         let show = SavedShow {
             media: media.clone(),
@@ -255,7 +285,7 @@ impl State {
     }
 
     pub fn remove_show(&mut self, id: &str) -> io::Result<()> {
-        Identity::new(id.into(), 1)?;
+        self.catalog.identity(id.into(), 1)?;
         if !self.saved_shows.iter().any(|show| show.media.id == id) {
             return check_original(&self.library.path, self.library.original.as_deref());
         }
@@ -347,6 +377,23 @@ impl State {
         Ok(())
     }
 
+    pub fn progress_files(&mut self, videos: &[Video]) -> io::Result<Vec<PathBuf>> {
+        if videos.len() > MAX_STREAMS.saturating_sub(self.streams.len()) {
+            return Err(invalid(
+                "Playback session limit reached; remove inactive playback-sessions directories and restart",
+            ));
+        }
+        // Validate the entire batch before creating any retained sessions.
+        let mut snapshots = videos.to_vec();
+        for video in &mut snapshots {
+            validate_snapshot(video, false)?;
+        }
+        snapshots
+            .iter()
+            .map(|video| self.create_progress_file(video))
+            .collect()
+    }
+
     pub fn progress_file(&mut self, video: &Video) -> io::Result<PathBuf> {
         if self.streams.len() >= MAX_STREAMS {
             return Err(invalid(
@@ -355,6 +402,10 @@ impl State {
         }
         let mut video = video.clone();
         validate_snapshot(&mut video, false)?;
+        self.create_progress_file(&video)
+    }
+
+    fn create_progress_file(&mut self, video: &Video) -> io::Result<PathBuf> {
         fs::create_dir_all(self.sessions.parent().unwrap_or(Path::new(".")))?;
         private_directory(&self.sessions, true)?;
         let directory = loop {
@@ -370,32 +421,12 @@ impl State {
             }
         };
         let (mut snapshot, _) = StoredFile::open(directory.join("video.toml"))?;
-        snapshot.save(video_document(std::iter::once(&video)))?;
+        snapshot.save(video_document(std::iter::once(video)))?;
         let path = directory.join("progress.jsonl");
         self.streams.push(ProgressStream::new(path.clone()));
         Ok(path)
     }
 
-    pub fn miruro_session(
-        &mut self,
-        video: &Video,
-        source: &SourceDocument,
-    ) -> io::Result<(PathBuf, PathBuf)> {
-        source.validate()?;
-        if Identity::from_key(&video.id)? != source.identity {
-            return Err(invalid("Source identity must match the playback episode"));
-        }
-        let contents = serde_json::to_vec(source).map_err(|e| invalid(e.to_string()))?;
-        if contents.len() > MAX_SOURCE_BYTES {
-            return Err(invalid("Playback source exceeds the 1 MiB limit"));
-        }
-        let progress_file = self.progress_file(video)?;
-        let source_file = progress_file.with_file_name("source.json");
-        atomic_write(&source_file, None, &contents)?;
-        register_identity(&progress_file, &video.id)?;
-        Ok((source_file, progress_file))
-    }
-
     pub fn poll_progress(&mut self) -> io::Result<bool> {
         let mut error = self.discover().err();
         let count = self.streams.len().min(16);
@@ -502,7 +533,7 @@ impl State {
 }
 
 fn validate_show(media: &crate::miruro_browser::Media) -> io::Result<()> {
-    Identity::new(media.id.clone(), 1)?;
+    crate::miruro_browser::media_provider(media).identity(media.id.clone(), 1)?;
     if media.title.len() > MAX_LINE
         || media.title.trim().is_empty()
         || media.title.chars().any(char::is_control)
@@ -528,7 +559,7 @@ fn load_shows(document: &DocumentMut) -> io::Result<Vec<SavedShow>> {
         .iter()
         .any(|(key, _)| !matches!(key, "version" | "shows"))
     {
-        return Err(invalid("Unknown Miruro library field"));
+        return Err(invalid("Unknown anime library field"));
     }
     let Some(item) = document.get("shows") else {
         return Ok(Vec::new());
@@ -540,7 +571,7 @@ fn load_shows(document: &DocumentMut) -> io::Result<Vec<SavedShow>> {
         .as_array_of_tables()
         .ok_or_else(|| invalid("shows must be an array of tables"))?;
     if tables.len() > MAX_SHOWS {
-        return Err(invalid("Miruro library exceeds the 4096 show limit"));
+        return Err(invalid("Anime library exceeds the 4096 show limit"));
     }
     let mut shows = Vec::new();
     let mut ids = BTreeSet::new();
@@ -648,19 +679,24 @@ fn validate_snapshot(video: &mut Video, require_channel: bool) -> io::Result<()>
             ));
         }
     }
-    if video.id.starts_with("miruro:") {
-        Identity::from_key(&video.id)?;
+    if video.id.starts_with("miruro:") || video.id.starts_with("anilist:") {
+        let identity = Identity::from_key(&video.id)?;
+        let expected_channel = if identity.provider == "anilist" {
+            "AniList"
+        } else {
+            "Miruro"
+        };
         if video.title.trim().is_empty() || video.title.chars().any(char::is_control) {
             return Err(invalid(
-                "Miruro episode title must be nonempty and contain no controls",
+                "Anime episode title must be nonempty and contain no controls",
             ));
         }
-        if video.channel.as_deref() != Some("Miruro")
+        if video.channel.as_deref() != Some(expected_channel)
             || video.channel_id.is_some()
             || video.uploader_id.is_some()
         {
             return Err(invalid(
-                "Miruro episodes must not contain YouTube channel identities",
+                "Anime episode channel must match its catalog, without YouTube channel identities",
             ));
         }
         return Ok(());
@@ -983,7 +1019,7 @@ pub(crate) fn register_identity(progress_file: &Path, id: &str) -> io::Result<()
 #[serde(untagged)]
 enum ProgressRecord {
     YouTube(YouTubeProgress),
-    Miruro(MiruroProgress),
+    Anime(AnimeProgress),
 }
 
 #[derive(Deserialize)]
@@ -998,7 +1034,7 @@ struct YouTubeProgress {
 
 #[derive(Deserialize)]
 #[serde(deny_unknown_fields)]
-struct MiruroProgress {
+struct AnimeProgress {
     version: u32,
     event: String,
     media_identity: Identity,
@@ -1015,7 +1051,7 @@ struct ProgressStream {
     seen: bool,
     status_edited: bool,
     started: bool,
-    file: Option<File>,
+    offset: u64,
     partial: Vec<u8>,
     discarding: bool,
     failed: bool,
@@ -1032,7 +1068,7 @@ impl ProgressStream {
             seen: false,
             status_edited: false,
             started: false,
-            file: None,
+            offset: 0,
             partial: Vec::new(),
             discarding: false,
             failed: false,
@@ -1067,9 +1103,7 @@ impl ProgressStream {
             }
             Err(e) if e.kind() == io::ErrorKind::NotFound && valid_video_id(id) => None,
             Err(e) if e.kind() == io::ErrorKind::NotFound => {
-                return Err(invalid(
-                    "Miruro sessions require their bound video metadata",
-                ));
+                return Err(invalid("Anime sessions require their bound video metadata"));
             }
             Err(e) => return Err(e),
         };
@@ -1150,12 +1184,13 @@ impl ProgressStream {
         pending: &mut BTreeSet<String>,
         watched: &BTreeSet<String>,
     ) -> io::Result<Option<io::Error>> {
-        if self.file.is_none() {
         self.prepare()?;
-            self.file = Some(regular_file(&self.path, true)?);
-        }
+        // Keep a cursor, not a descriptor, for each retained playback session.
+        let mut file = regular_file(&self.path, true)?;
+        file.seek(SeekFrom::Start(self.offset))?;
         let mut buffer = [0; STREAM_BYTES];
-        let size = self.file.as_mut().unwrap().read(&mut buffer)?;
+        let size = file.read(&mut buffer)?;
+        self.offset += size as u64;
         let mut error = None;
         for &byte in &buffer[..size] {
             if byte == b'\n' {
@@ -1198,7 +1233,7 @@ impl ProgressStream {
     ) -> io::Result<()> {
         let record: ProgressRecord =
             serde_json::from_slice(&self.partial).map_err(|e| self.record_error(e))?;
-        let miruro_key;
+        let anime_key;
         let (id, event, position, duration, eligible) = match &record {
             ProgressRecord::YouTube(record) if record.version == 1 => {
                 let id = record
@@ -1214,14 +1249,14 @@ impl ProgressStream {
                     record.completion_eligible,
                 )
             }
-            ProgressRecord::Miruro(record) if record.version == 2 => {
+            ProgressRecord::Anime(record) if record.version == 2 => {
                 record
                     .media_identity
                     .validate()
                     .map_err(|e| self.record_error(e))?;
-                miruro_key = record.media_identity.key();
+                anime_key = record.media_identity.key();
                 (
-                    miruro_key.as_str(),
+                    anime_key.as_str(),
                     record.event.as_str(),
                     record.position_seconds,
                     record.duration_seconds,

src/youtube.rs

@@ -1,8 +1,9 @@
 use std::{
-    collections::VecDeque,
+    collections::{BTreeSet, VecDeque},
     ffi::OsStr,
+    fs::{self, OpenOptions},
     io::{self, Read},
-    path::Path,
+    path::PathBuf,
     process::{Child, Command, Stdio},
     sync::mpsc::{self, Receiver, TryRecvError},
     thread,
@@ -10,6 +11,8 @@ use std::{
 
 use serde::{Deserialize, Serialize};
 
+mod catalog;
+
 pub const PAGE_SIZE: usize = 60;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -129,6 +132,12 @@ pub struct Page {
     pub feed_progress: Vec<FeedProgress>,
 }
 
+#[derive(Deserialize)]
+pub struct Playlist {
+    pub id: String,
+    pub title: String,
+}
+
 #[derive(Clone, Deserialize, Serialize)]
 pub struct Video {
     pub id: String,
@@ -189,6 +198,97 @@ pub fn search_results(output: &str) -> Result<Page, String> {
     })
 }
 
+pub fn channel_playlists(output: &str) -> Result<Vec<Playlist>, String> {
+    let results: SearchResults = serde_json::from_str(output)
+        .map_err(|error| format!("Invalid channel playlists response: {error}"))?;
+    let mut ids = BTreeSet::new();
+    Ok(results
+        .entries
+        .into_iter()
+        .filter_map(|entry| {
+            let mut playlist: Playlist = serde_json::from_str(entry.get()).ok()?;
+            if !valid_playlist_id(&playlist.id) {
+                return None;
+            }
+            playlist.title.retain(|c| !c.is_control());
+            if playlist.title.trim().is_empty() || !ids.insert(playlist.id.clone()) {
+                return None;
+            }
+            Some(playlist)
+        })
+        .collect())
+}
+
+pub fn playlist_results(output: &str) -> Result<Page, String> {
+    let results: SearchResults = serde_json::from_str(output)
+        .map_err(|error| format!("Invalid playlist response: {error}"))?;
+    if results
+        .channel_id
+        .as_deref()
+        .is_some_and(|id| !valid_channel_id(id))
+        || results
+            .uploader_id
+            .as_deref()
+            .is_some_and(|handle| handle.chars().any(char::is_control))
+    {
+        return Err("Playlist returned invalid YouTube creator metadata".into());
+    }
+    let has_more = results.entries.len() >= PAGE_SIZE;
+    let videos = results
+        .entries
+        .into_iter()
+        .filter_map(|entry| {
+            let mut video = listed_video(entry)?;
+            // A playlist owner is not necessarily the creator of each video.
+            let same_creator = video
+                .channel_id
+                .as_ref()
+                .is_none_or(|id| Some(id) == results.channel_id.as_ref())
+                && video
+                    .uploader_id
+                    .as_ref()
+                    .is_none_or(|id| Some(id) == results.uploader_id.as_ref());
+            if same_creator && (video.channel_id.is_some() || video.uploader_id.is_some()) {
+                if video.channel_id.is_none() {
+                    video.channel_id = results.channel_id.clone();
+                }
+                if video.uploader_id.is_none() {
+                    video.uploader_id = results.uploader_id.clone();
+                }
+                if video.channel.is_none() {
+                    video.channel = results.channel.clone();
+                }
+            }
+            validate_video(&mut video).ok()?;
+            Some(video)
+        })
+        .collect();
+    Ok(Page {
+        videos,
+        has_more,
+        feed_progress: Vec::new(),
+    })
+}
+
+fn valid_playlist_id(id: &str) -> bool {
+    if !id
+        .bytes()
+        .all(|c| c.is_ascii_alphanumeric() || c == b'-' || c == b'_')
+    {
+        return false;
+    }
+    // Match yt-dlp's YouTube playlist families, including music releases.
+    matches!(id, "RDMM" | "WL" | "LL" | "LM")
+        || [
+            "PL", "LL", "EC", "UU", "FL", "RD", "UL", "TL", "PU", "OLAK5uy_",
+        ]
+        .iter()
+        .any(|prefix| {
+            id.strip_prefix(*prefix)
+                .is_some_and(|suffix| suffix.len() >= 10)
+        })
+}
+
 fn valid_channel_id(id: &str) -> bool {
     id.len() == 24
         && id.starts_with("UC")
@@ -387,6 +487,7 @@ const MAX_EXTRACTORS: usize = 4;
 pub struct Job {
     children: Vec<Extraction>,
     queued: VecDeque<Command>,
+    feed: Option<catalog::FeedExpansion>,
 }
 
 struct Extraction {
@@ -485,8 +586,42 @@ impl Job {
         ]))
     }
 
+    pub fn channel_playlists(channel: &str) -> io::Result<Self> {
+        let channel = crate::config::normalize_channel(channel)?;
+        Self::spawn(extractor().args([
+            "--flat-playlist",
+            "--dump-single-json",
+            &format!("{channel}/playlists"),
+        ]))
+    }
+
+    pub fn playlist(id: &str, start: usize) -> io::Result<Self> {
+        if !valid_playlist_id(id) {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                "Invalid YouTube playlist ID",
+            ));
+        }
+        let end = page_end(start)?;
+        Self::spawn(extractor().args([
+            "--flat-playlist",
+            "--playlist-start",
+            &start.to_string(),
+            "--playlist-end",
+            &end.to_string(),
+            "--extractor-args",
+            "youtubetab:approximate_date",
+            "--dump-single-json",
+            &format!("https://www.youtube.com/playlist?list={id}"),
+        ]))
+    }
+
     pub fn feed(channels: &[String], requests: &[FeedRequest], query: &str) -> io::Result<Self> {
-        Self::spawn_all(feed_commands(channels, requests, query)?)
+        let mut job = Self::spawn_all(feed_commands(channels, requests, query)?)?;
+        if query.is_empty() {
+            job.feed = Some(catalog::FeedExpansion::new(channels, requests));
+        }
+        Ok(job)
     }
 
     pub fn channel(id: &str) -> io::Result<Self> {
@@ -518,6 +653,7 @@ impl Job {
         Ok(Self {
             children: vec![Extraction::spawn(command)?],
             queued: VecDeque::new(),
+            feed: None,
         })
     }
 
@@ -525,6 +661,7 @@ impl Job {
         let mut job = Self {
             children: Vec::new(),
             queued: VecDeque::new(),
+            feed: None,
         };
         // Dropping job also cancels started children if any initial spawn fails.
         for mut command in commands {
@@ -538,6 +675,17 @@ impl Job {
     }
 
     pub fn poll(&mut self) -> Option<Result<String, String>> {
+        if let Some(mut feed) = self.feed.take() {
+            let result = feed.poll(self);
+            if result.is_none() {
+                self.feed = Some(feed);
+            }
+            return result;
+        }
+        self.poll_extractions()
+    }
+
+    fn poll_extractions(&mut self) -> Option<Result<String, String>> {
         if self.children.is_empty() {
             return None;
         }
@@ -791,7 +939,7 @@ fn read_thumbnail(pipe: impl Read) -> io::Result<Vec<u8>> {
     Ok(bytes)
 }
 
-fn isolated_command(program: &OsStr) -> Command {
+pub(crate) fn isolated_command(program: &OsStr) -> Command {
     let mut command = Command::new(program);
     #[cfg(unix)]
     {
@@ -803,7 +951,13 @@ fn isolated_command(program: &OsStr) -> Command {
 
 fn extractor() -> Command {
     let mut command = isolated_command(OsStr::new("yt-dlp"));
-    command.args(["--ignore-config", "--no-warnings", "--socket-timeout", "15"]);
+    command.args([
+        "--ignore-config",
+        "--force-ipv4",
+        "--no-warnings",
+        "--socket-timeout",
+        "15",
+    ]);
     command
 }
 
@@ -842,6 +996,16 @@ fn failure(errors: &Receiver<io::Result<String>>, fallback: String) -> Option<Re
     }
 }
 
+pub fn video_url(id: &str) -> io::Result<String> {
+    if valid_video_id(id) {
+        Ok(format!("https://www.youtube.com/watch?v={id}"))
+    } else {
+        tubular::anime::Identity::from_key(id)
+            .and_then(|identity| identity.watch_url())
+            .map_err(|error| io::Error::new(io::ErrorKind::InvalidInput, error))
+    }
+}
+
 pub fn open_in_browser(id: &str) -> io::Result<Receiver<Result<(), String>>> {
     if !valid_video_id(id) {
         return Err(io::Error::new(
@@ -855,7 +1019,7 @@ pub fn open_in_browser(id: &str) -> io::Result<Receiver<Result<(), String>>> {
         "xdg-open"
     };
     let child = isolated_command(OsStr::new(opener))
-        .arg(format!("https://www.youtube.com/watch?v={id}"))
+        .arg(video_url(id)?)
         .stdin(Stdio::null())
         .stdout(Stdio::null())
         .stderr(Stdio::piped())
@@ -894,70 +1058,85 @@ pub struct PlayerLaunch {
 }
 
 impl PlayerLaunch {
-    pub fn start(id: &str, player: &OsStr, progress_file: &Path) -> io::Result<Self> {
-        if !valid_video_id(id) {
-            return Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
-                "Invalid YouTube video ID",
-            ));
-        }
-        crate::video_state::register_identity(progress_file, id)?;
-        let mut command = isolated_command(player);
-        command
-            .args([
-                "--new-instance",
-                "--url",
-                &format!("https://www.youtube.com/watch?v={id}"),
-            ])
-            .arg("--progress-file")
-            .arg(progress_file);
-        Self::launch(command)
-    }
-
-    /// Session files are owned and retained by video_state, not by this launcher.
-    pub fn start_source(
-        source_file: &Path,
+    pub fn start(
+        videos: &[Video],
         player: &OsStr,
-        progress_file: &Path,
+        state: &mut crate::video_state::State,
+        enqueue: bool,
     ) -> io::Result<Self> {
-        if !std::fs::symlink_metadata(source_file)?.is_file() {
+        if videos.is_empty() {
             return Err(io::Error::new(
                 io::ErrorKind::InvalidInput,
-                "Source document must be a regular file",
+                "No videos selected",
             ));
         }
-        let source_file = std::fs::canonicalize(source_file)?;
-        let parent = std::fs::canonicalize(progress_file.parent().ok_or_else(|| {
-            io::Error::new(io::ErrorKind::InvalidInput, "Missing progress directory")
-        })?)?;
-        if source_file.parent() != Some(parent.as_path())
-            || progress_file
-                .file_name()
-                .is_none_or(|name| name != "progress.jsonl")
-        {
-            return Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
-                "Source and progress must share their private session directory",
-            ));
-        }
-        let progress_file = parent.join("progress.jsonl");
-        match std::fs::symlink_metadata(&progress_file) {
-            Err(error) if error.kind() == io::ErrorKind::NotFound => {}
-            Err(error) => return Err(error),
-            Ok(_) => {
-                return Err(io::Error::new(
-                    io::ErrorKind::AlreadyExists,
-                    "Progress destination must not exist",
-                ));
-            }
-        }
         let mut command = isolated_command(player);
+        command.arg(if enqueue {
+            "--enqueue"
+        } else {
+            "--new-instance"
+        });
+        if let [video] = videos
+            && !enqueue
+        {
+            let url = video_url(&video.id)?;
+            let report = state.progress_file(video)?;
+            crate::video_state::register_identity(&report, &video.id)?;
             command
-            .arg("--new-instance")
-            .arg("--source-file")
-            .arg(source_file)
+                .args(["--url", &url])
                 .arg("--progress-file")
-            .arg(progress_file);
+                .arg(report);
+            return Self::launch(command);
+        }
+        let mut ids = BTreeSet::new();
+        let urls = videos
+            .iter()
+            .map(|video| {
+                if !ids.insert(video.id.as_str()) {
+                    return Err(io::Error::new(
+                        io::ErrorKind::InvalidInput,
+                        "Duplicate queue identity",
+                    ));
+                }
+                video_url(&video.id)
+            })
+            .collect::<io::Result<Vec<_>>>()?;
+        let reports = state.progress_files(videos)?;
+        #[derive(Serialize)]
+        struct QueueItem {
+            url: String,
+            progress_file: PathBuf,
+        }
+        #[derive(Serialize)]
+        struct Queue {
+            version: u8,
+            items: Vec<QueueItem>,
+        }
+        let items = videos
+            .iter()
+            .zip(urls)
+            .zip(reports)
+            .map(|((video, url), report)| {
+                crate::video_state::register_identity(&report, &video.id)?;
+                let parent = fs::canonicalize(report.parent().expect("session directory"))?;
+                Ok(QueueItem {
+                    url,
+                    progress_file: parent.join("progress.jsonl"),
+                })
+            })
+            .collect::<io::Result<Vec<_>>>()?;
+        let manifest = items[0].progress_file.with_file_name("queue.json");
+        let mut options = OpenOptions::new();
+        options.write(true).create_new(true);
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::OpenOptionsExt;
+            options.mode(0o600);
+        }
+        let file = options.open(&manifest)?;
+        serde_json::to_writer(&file, &Queue { version: 1, items })?;
+        file.sync_all()?;
+        command.arg("--queue-file").arg(manifest);
         Self::launch(command)
     }
 

src/youtube/catalog.rs

@@ -0,0 +1,343 @@
+use super::*;
+use serde_json::value::RawValue;
+
+#[derive(Deserialize, Serialize)]
+struct Playlist<T> {
+    entries: Vec<T>,
+    channel: Option<String>,
+    channel_id: Option<String>,
+    uploader_id: Option<String>,
+    #[serde(skip_serializing)]
+    playlist_count: Option<usize>,
+    #[serde(rename = "_type", skip_serializing)]
+    kind: Option<String>,
+}
+
+impl<T> Playlist<T> {
+    fn validate(&self, start: usize, count: usize) -> Result<(), String> {
+        if self.kind.as_deref().is_some_and(|kind| kind != "playlist") {
+            return Err("Invalid catalog playlist type".into());
+        }
+        if self
+            .channel_id
+            .as_deref()
+            .is_some_and(|id| !valid_channel_id(id))
+        {
+            return Err("Catalog returned an invalid YouTube channel ID".into());
+        }
+        if self.entries.len() > count {
+            return Err("Catalog returned more rows than requested".into());
+        }
+        match self.playlist_count {
+            Some(total) if total.saturating_sub(start - 1).min(count) != self.entries.len() => {
+                Err("Catalog playlist count did not match its rows".into())
+            }
+            _ => Ok(()),
+        }
+    }
+
+    fn exhausted_total(&self, start: usize) -> Result<usize, String> {
+        match self.playlist_count {
+            Some(total) => Ok(total),
+            None if start == 1 || !self.entries.is_empty() => (start - 1)
+                .checked_add(self.entries.len())
+                .ok_or_else(|| "Catalog playlist count overflow".into()),
+            None => Err("Exhausted catalog playlist has no total count".into()),
+        }
+    }
+}
+
+fn playlist(output: &str, start: usize, count: usize) -> Result<Playlist<Box<RawValue>>, String> {
+    let playlist: Playlist<Box<RawValue>> = serde_json::from_str(output)
+        .map_err(|error| format!("Invalid catalog response: {error}"))?;
+    playlist.validate(start, count)?;
+    Ok(playlist)
+}
+
+struct FeedChannel {
+    channel: String,
+    request: FeedRequest,
+    playlist: Option<Playlist<Box<RawValue>>>,
+    releases: Option<ChannelReleases>,
+    job: Option<Job>,
+}
+
+pub(super) struct FeedExpansion {
+    channels: Vec<FeedChannel>,
+    uploads_complete: bool,
+}
+
+impl FeedExpansion {
+    pub(super) fn new(channels: &[String], requests: &[FeedRequest]) -> Self {
+        Self {
+            channels: requests
+                .iter()
+                .map(|&request| FeedChannel {
+                    channel: channels[request.channel].clone(),
+                    request,
+                    playlist: None,
+                    releases: None,
+                    job: None,
+                })
+                .collect(),
+            uploads_complete: false,
+        }
+    }
+
+    fn full_uploads(&self, output: &str) -> Result<bool, String> {
+        // Borrow raw rows on the ordinary uploads-only path; return its output unchanged.
+        let mut playlists =
+            serde_json::Deserializer::from_str(output).into_iter::<Playlist<&RawValue>>();
+        for channel in &self.channels {
+            let playlist = playlists
+                .next()
+                .ok_or_else(|| "Feed returned fewer playlists than requested".to_owned())?
+                .map_err(|error| format!("Invalid catalog response: {error}"))?;
+            playlist.validate(channel.request.start, channel.request.count)?;
+            if playlist.entries.len() < channel.request.count {
+                return Ok(false);
+            }
+        }
+        if let Some(extra) = playlists.next() {
+            extra.map_err(|error| format!("Invalid catalog response: {error}"))?;
+            return Err("Feed returned more playlists than requested".into());
+        }
+        Ok(true)
+    }
+
+    fn accept_uploads(&mut self, output: &str) -> Result<(), String> {
+        let mut playlists =
+            serde_json::Deserializer::from_str(output).into_iter::<Playlist<Box<RawValue>>>();
+        for channel in &mut self.channels {
+            let playlist = playlists
+                .next()
+                .ok_or_else(|| "Feed returned fewer playlists than requested".to_owned())?
+                .map_err(|error| format!("Invalid catalog response: {error}"))?;
+            playlist.validate(channel.request.start, channel.request.count)?;
+            let remaining = channel.request.count - playlist.entries.len();
+            if remaining != 0 {
+                // Beyond-end requests need the extractor's total to locate release tracks.
+                let skip = (channel.request.start - 1)
+                    .saturating_sub(playlist.exhausted_total(channel.request.start)?);
+                channel.releases = Some(ChannelReleases::new(
+                    channel.channel.clone(),
+                    skip,
+                    remaining,
+                ));
+            }
+            channel.playlist = Some(playlist);
+        }
+        if let Some(extra) = playlists.next() {
+            extra.map_err(|error| format!("Invalid catalog response: {error}"))?;
+            return Err("Feed returned more playlists than requested".into());
+        }
+        self.uploads_complete = true;
+        Ok(())
+    }
+
+    pub(super) fn poll(&mut self, uploads: &mut Job) -> Option<Result<String, String>> {
+        if !self.uploads_complete {
+            let output = match uploads.poll_extractions()? {
+                Ok(output) => output,
+                Err(error) => return Some(Err(error)),
+            };
+            match self.full_uploads(&output) {
+                Ok(true) => return Some(Ok(output)),
+                Ok(false) => {}
+                Err(error) => return Some(Err(error)),
+            }
+            if let Err(error) = self.accept_uploads(&output) {
+                return Some(Err(error));
+            }
+        }
+        match self.poll_releases() {
+            Ok(false) => None,
+            Err(error) => Some(Err(error)),
+            Ok(true) => {
+                let mut output = Vec::new();
+                for channel in &self.channels {
+                    if !output.is_empty() {
+                        output.push(b'\n');
+                    }
+                    if let Err(error) =
+                        serde_json::to_writer(&mut output, channel.playlist.as_ref().unwrap())
+                    {
+                        return Some(Err(format!("Cannot encode catalog response: {error}")));
+                    }
+                }
+                Some(String::from_utf8(output).map_err(|error| error.to_string()))
+            }
+        }
+    }
+
+    fn poll_releases(&mut self) -> Result<bool, String> {
+        let mut active = self
+            .channels
+            .iter()
+            .filter(|channel| channel.job.is_some())
+            .count();
+        let mut complete = true;
+        for channel in &mut self.channels {
+            let Some(releases) = &mut channel.releases else {
+                continue;
+            };
+            if let Some(job) = &mut channel.job {
+                if let Some(result) = job.poll_extractions() {
+                    channel.job = None;
+                    active -= 1;
+                    match result {
+                        Ok(output) => releases.accept(&output)?,
+                        Err(error) => releases.accept_error(error)?,
+                    }
+                }
+            }
+            if releases.done() {
+                let entries = channel.releases.take().unwrap().into_entries();
+                channel.playlist.as_mut().unwrap().entries.extend(entries);
+            } else {
+                complete = false;
+                if channel.job.is_none() && active < MAX_EXTRACTORS {
+                    channel.job = Some(
+                        Job::spawn(&mut releases.command().map_err(|error| error.to_string())?)
+                            .map_err(|error| error.to_string())?,
+                    );
+                    active += 1;
+                }
+            }
+        }
+        Ok(complete)
+    }
+}
+
+// ponytail: each Feed page revisits albums; index offsets if traversal becomes costly.
+struct ChannelReleases {
+    channel: String,
+    skip: usize,
+    count: usize,
+    entries: Vec<Box<RawValue>>,
+    albums: VecDeque<String>,
+    discovery_start: usize,
+    discovery_exhausted: bool,
+}
+
+impl ChannelReleases {
+    fn new(channel: String, skip: usize, count: usize) -> Self {
+        Self {
+            channel,
+            skip,
+            count,
+            entries: Vec::new(),
+            albums: VecDeque::new(),
+            discovery_start: 1,
+            discovery_exhausted: false,
+        }
+    }
+
+    fn command(&self) -> io::Result<Command> {
+        let (start, count, url) = match self.albums.front() {
+            Some(id) => (
+                self.skip.checked_add(1).ok_or_else(|| {
+                    io::Error::new(io::ErrorKind::InvalidInput, "Release track offset overflow")
+                })?,
+                self.count - self.entries.len(),
+                format!("https://www.youtube.com/playlist?list={id}"),
+            ),
+            None => (
+                self.discovery_start,
+                PAGE_SIZE,
+                format!("{}/releases", self.channel),
+            ),
+        };
+        let end = range_end(start, count)?;
+        let mut command = extractor();
+        command.args([
+            "--flat-playlist",
+            "--playlist-start",
+            &start.to_string(),
+            "--playlist-end",
+            &end.to_string(),
+            "--extractor-args",
+            "youtubetab:approximate_date",
+            "--dump-single-json",
+            &url,
+        ]);
+        Ok(command)
+    }
+
+    fn accept(&mut self, output: &str) -> Result<(), String> {
+        if self.albums.front().is_some() {
+            let remaining = self.count - self.entries.len();
+            let start = self
+                .skip
+                .checked_add(1)
+                .ok_or("Release track offset overflow")?;
+            let playlist = playlist(output, start, remaining)?;
+            if playlist.entries.len() < remaining {
+                self.skip = self.skip.saturating_sub(playlist.exhausted_total(start)?);
+            }
+            self.entries.extend(playlist.entries);
+            self.albums.pop_front();
+        } else {
+            let playlist = playlist(output, self.discovery_start, PAGE_SIZE)?;
+            let end =
+                range_end(self.discovery_start, PAGE_SIZE).map_err(|error| error.to_string())?;
+            self.discovery_exhausted = playlist.entries.len() < PAGE_SIZE
+                || playlist.playlist_count.is_some_and(|count| count <= end);
+            #[derive(Deserialize)]
+            struct Album {
+                id: String,
+            }
+            for entry in playlist.entries {
+                let album: Album = serde_json::from_str(entry.get())
+                    .map_err(|error| format!("Invalid release album: {error}"))?;
+                if album.id.is_empty()
+                    || album.id.len() > 128
+                    || !album
+                        .id
+                        .bytes()
+                        .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
+                {
+                    return Err("Release album has an invalid YouTube playlist ID".into());
+                }
+                self.albums.push_back(album.id);
+            }
+            if !self.discovery_exhausted {
+                self.discovery_start = end
+                    .checked_add(1)
+                    .ok_or("Release discovery offset overflow")?;
+            }
+        }
+        Ok(())
+    }
+
+    fn accept_error(&mut self, error: String) -> Result<(), String> {
+        // Only the optional tab's exact extractor error is ordinary exhaustion.
+        if self.albums.is_empty()
+            && error
+                .trim_end()
+                .ends_with("This channel does not have a releases tab")
+            && !error
+                .lines()
+                .rev()
+                .skip(1)
+                .any(|line| line.trim_start().starts_with("ERROR:"))
+        {
+            self.discovery_exhausted = true;
+            Ok(())
+        } else {
+            Err(error)
+        }
+    }
+
+    fn done(&self) -> bool {
+        self.entries.len() == self.count || (self.discovery_exhausted && self.albums.is_empty())
+    }
+
+    fn into_entries(self) -> Vec<Box<RawValue>> {
+        self.entries
+    }
+}
+
+#[cfg(test)]
+#[path = "../../tests/unit/youtube_catalog.rs"]
+mod tests;

tests/unit/app.rs

@@ -27,32 +27,36 @@ fn startup_provider_selection_preserves_query_and_handles_boundaries_and_cancel(
         provider_selection(&mut selected, Some(Action::SelectorPrevious)),
         Continue(())
     );
-    for (action, miruro) in [(Action::SelectorOpen, false), (Action::SelectorNext, true)] {
-        if action == Action::SelectorNext {
-            assert_eq!(
-                provider_selection(&mut selected, Some(action)),
-                Continue(())
-            );
-            assert_eq!(
-                provider_selection(&mut selected, Some(action)),
-                Continue(())
-            );
-        }
+    for (index, provider) in [
+        BrowseProvider::YouTube,
+        BrowseProvider::AniList,
+        BrowseProvider::Miruro,
+    ]
+    .into_iter()
+    .enumerate()
+    {
+        selected = index;
         let Break(Some(choice)) = provider_selection(&mut selected, Some(Action::SelectorOpen))
         else {
             panic!("Selected provider must open");
         };
-        assert_eq!(choice, miruro);
+        assert_eq!(choice, provider);
         let mut options = Options::parse_from(["tubular", "initial query"]);
-        options.miruro = choice;
+        options.miruro = choice == BrowseProvider::Miruro;
+        options.anilist = choice == BrowseProvider::AniList;
         assert_eq!(options.query.as_deref(), Some("initial query"));
-        assert_eq!(options.miruro, miruro);
-        if !miruro {
+        if choice == BrowseProvider::YouTube {
             let app = App::new(options, PathBuf::new(), config::Config::default());
             assert_eq!(app.views[0].query, "initial query");
             assert_eq!(app.views[app.view_index].source, ViewSource::Search);
         }
     }
+    assert_eq!(
+        provider_selection(&mut selected, Some(Action::SelectorNext)),
+        Continue(())
+    );
+    assert_eq!(selected, PROVIDERS.len() - 1);
+    assert!(Options::try_parse_from(["tubular", "--miruro", "--anilist"]).is_err());
     for action in [Action::SelectorClose, Action::Quit, Action::Interrupt] {
         assert_eq!(provider_selection(&mut selected, Some(action)), Break(None));
     }
@@ -67,6 +71,213 @@ fn app(args: &[&str]) -> App {
     )
 }
 
+#[test]
+fn playback_checks_preserve_check_order_across_feed_sort_and_clear_on_replacement() {
+    let mut app = app(&["tubular"]);
+    app.view_index = 1;
+    app.feed_channels = vec!["https://www.youtube.com/@fixture".into()];
+    finish_feed_fixture(
+        &mut app,
+        r#"{"entries":[{"id":"jNQXAC9IVRw","title":"Old","timestamp":100},{"id":"rQ_J9WH6CGk","title":"New","timestamp":200}]}"#,
+        true,
+    );
+    let view = &mut app.views[1];
+    view.selection.select(Some(1));
+    view.toggle_checked();
+    view.selection.select(Some(0));
+    view.toggle_checked();
+    assert_eq!(
+        view.playback_videos()
+            .iter()
+            .map(|video| video.id.as_str())
+            .collect::<Vec<_>>(),
+        ["jNQXAC9IVRw", "rQ_J9WH6CGk"],
+    );
+    finish_feed_fixture(
+        &mut app,
+        r#"{"entries":[{"id":"l-GaaivVJCE","title":"Newest","timestamp":300}]}"#,
+        false,
+    );
+    let view = &mut app.views[1];
+    assert_eq!(view.selection.selected(), Some(1));
+    assert_eq!(
+        view.playback_videos()
+            .iter()
+            .map(|video| video.id.as_str())
+            .collect::<Vec<_>>(),
+        ["jNQXAC9IVRw", "rQ_J9WH6CGk"],
+    );
+    view.selection.select(Some(2));
+    view.toggle_checked();
+    view.toggle_checked();
+    assert_eq!(
+        view.playback_videos()
+            .iter()
+            .map(|video| video.id.as_str())
+            .collect::<Vec<_>>(),
+        ["rQ_J9WH6CGk", "jNQXAC9IVRw"],
+    );
+    view.reset();
+    assert!(view.checked.is_empty());
+    // Old rows remain during refresh, but checks made there cannot leak into replacement data.
+    view.toggle_checked();
+    assert!(!view.checked.is_empty());
+    view.accept_page(
+        youtube::search_results(r#"{"entries":[{"id":"rQ_J9WH6CGk","title":"Replacement"}]}"#)
+            .unwrap(),
+        false,
+    )
+    .unwrap();
+    assert!(view.checked.is_empty());
+    assert_eq!(view.playback_videos()[0].title, "Replacement");
+}
+
+#[test]
+fn playback_checks_are_local_to_views_and_previews_and_pruned_with_collections() {
+    let mut app = app(&["tubular"]);
+    let videos = youtube::search_results(
+        r#"{"entries":[{"id":"jNQXAC9IVRw","title":"First","uploader_id":"@creator"},{"id":"rQ_J9WH6CGk","title":"Second","uploader_id":"@creator"}]}"#,
+    ).unwrap().videos;
+    app.views[0].videos = videos.clone();
+    app.views[0].selection.select(Some(0));
+    app.views[0].loaded = true;
+    app.views[1].loaded = true;
+    app.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    app.switch_view(1);
+    assert!(app.views[1].checked.is_empty());
+    app.switch_view(0);
+    assert!(app.views[0].checked.contains(&videos[0].id));
+    app.mode = Mode::Insert;
+    app.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    assert_eq!(app.views[0].checked.len(), 1);
+    app.mode = Mode::Normal;
+    for preview in [
+        None,
+        Some(PreviewMode::Info),
+        Some(PreviewMode::Description),
+    ] {
+        app.preview = preview;
+        app.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::CONTROL));
+        assert!(app.views[0].checked.is_empty());
+        app.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+        assert!(app.views[0].checked.contains(&videos[0].id));
+    }
+    app.preview = None;
+    for video in &videos {
+        app.video_state
+            .save(CollectionKind::WatchLater, video)
+            .unwrap();
+    }
+    app.browse_collection(CollectionKind::WatchLater);
+    let index = app.view_index;
+    app.views[index].selection.select(Some(0));
+    app.views[index].toggle_checked();
+    app.views[index].selection.select(Some(1));
+    app.views[index].toggle_checked();
+    let removed = app.views[index].videos[1].id.clone();
+    app.remove_collection();
+    assert!(!app.views[index].checked.contains(&removed));
+    assert_eq!(app.views[index].checked.len(), 1);
+    assert_eq!(app.views[index].playback_videos().len(), 1);
+    app.views[index].watch_filter = WatchFilter::Watched;
+    app.rebuild_collections();
+    assert!(app.views[index].videos.is_empty());
+    assert!(app.views[index].checked.is_empty());
+    app.views[index].watch_filter = WatchFilter::All;
+    app.rebuild_collections();
+    app.views[index].toggle_checked();
+    // Refresh is a replacement even for locally rebuilt collection views.
+    app.load_view();
+    assert!(app.views[index].checked.is_empty());
+    assert_eq!(app.views[0].checked.len(), 1);
+    // An empty category exercises query replacement entirely offline.
+    app.config.categories.insert("Empty".into(), Vec::new());
+    let mut view = View::new("Empty".into(), ViewSource::Category("Empty".into()));
+    view.videos = videos;
+    view.selection.select(Some(0));
+    view.toggle_checked();
+    view.query = "replacement query".into();
+    app.views.push(view);
+    app.view_index = app.views.len() - 1;
+    app.search();
+    assert!(app.views[app.view_index].checked.is_empty());
+    assert!(app.job.is_none());
+}
+
+#[test]
+fn playback_checks_render_independently_and_live_hints_use_configured_keys() {
+    let mut app = app(&["tubular"]);
+    let document =
+        "[keys.video.select]\ntoggle = 'f20'\nclear = 'f21'\n[keys.video]\nenqueue = 'f22'\n"
+            .parse::<toml_edit::DocumentMut>()
+            .unwrap();
+    app.config.keys = keys::Bindings::from_toml(document.get("keys")).unwrap();
+    app.key_hints = KeyHints::new(&app.config.keys);
+    for context in [
+        Context::Normal,
+        Context::Info,
+        Context::Description,
+        Context::CollectionNormal,
+        Context::CollectionInfo,
+        Context::CollectionDescription,
+    ] {
+        for key in ["F20", "F21", "F22"] {
+            assert!(app.key_hints.footer(context).contains(key));
+            assert!(app.key_hints.preview.iter().all(|hint| hint.contains(key)));
+            assert!(app.config.keys.help_text().to_string().contains(key));
+        }
+    }
+    app.views[0].videos = youtube::search_results(
+        r#"{"entries":[{"id":"jNQXAC9IVRw","title":"Checked"},{"id":"rQ_J9WH6CGk","title":"Unchecked"}]}"#,
+    ).unwrap().videos;
+    for (index, video) in app.views[0].videos.iter_mut().enumerate() {
+        video.id = format!("offline:{index}");
+    }
+    app.views[0].selection.select(Some(0));
+    app.key(KeyEvent::new(KeyCode::F(20), KeyModifiers::NONE));
+    let mut terminal = ratatui::Terminal::new(ratatui::backend::TestBackend::new(100, 24)).unwrap();
+    terminal
+        .draw(|frame| app.draw(frame, Duration::ZERO))
+        .unwrap();
+    let rendered: String = terminal
+        .backend()
+        .buffer()
+        .content
+        .iter()
+        .map(|cell| cell.symbol())
+        .collect();
+    assert!(rendered.contains("1 checked"));
+    app.key(KeyEvent::new(KeyCode::F(21), KeyModifiers::NONE));
+    assert!(app.views[0].checked.is_empty());
+}
+
+#[test]
+fn playback_checks_survive_spawn_failure_clear_after_spawn_and_fall_back_to_hover() {
+    for modifiers in [KeyModifiers::NONE, KeyModifiers::CONTROL] {
+        let mut app = app(&["tubular"]);
+        app.views[0].videos = youtube::search_results(
+        r#"{"entries":[{"id":"jNQXAC9IVRw","title":"First"},{"id":"rQ_J9WH6CGk","title":"Second"}]}"#,
+    ).unwrap().videos;
+        app.views[0].selection.select(Some(1));
+        assert_eq!(app.views[0].playback_videos()[0].id, "rQ_J9WH6CGk");
+        app.views[0].toggle_checked();
+        app.views[0].selection.select(Some(0));
+        app.options.player = "/nonexistent/tubular-test-player".into();
+        app.key(KeyEvent::new(KeyCode::Enter, modifiers));
+        assert!(app.player_launch.is_none());
+        assert!(app.views[0].checked.iter().any(|id| id == "rQ_J9WH6CGk"));
+        assert_eq!(app.views[0].playback_videos()[0].id, "rQ_J9WH6CGk");
+        app.options.player = "/usr/bin/true".into();
+        app.key(KeyEvent::new(KeyCode::Enter, modifiers));
+        assert!(app.player_launch.is_some());
+        assert!(app.views[0].checked.is_empty());
+        assert_eq!(app.views[0].playback_videos()[0].id, "jNQXAC9IVRw");
+        app.player_launch = None;
+        app.key(KeyEvent::new(KeyCode::Enter, modifiers));
+        assert!(app.player_launch.is_some());
+    }
+}
+
 #[test]
 fn title_viewport_tracks_selected_two_line_rows_and_resize_without_changing_identity() {
     let mut app = app(&["tubular"]);
@@ -1849,62 +2060,6 @@ fn collection_contexts_preserve_modal_priorities_and_cancel_bulk_from_each_previ
     }
 }
 
-#[test]
-fn configured_removal_hints_follow_collection_views_and_previews() {
-    let mut app = app(&["tubular"]);
-    let document =
-        "[keys]\nview.collection.remove.selected = 'f8'\nview.collection.remove.bulk = 'f9'\n"
-            .parse::<toml_edit::DocumentMut>()
-            .unwrap();
-    app.apply_config(config::Config {
-        keys: keys::Bindings::from_toml(document.get("keys")).unwrap(),
-        ..Default::default()
-    });
-    app.views[0].videos = youtube::search_results(
-        r#"{"entries":[{"id":"jNQXAC9IVRw","title":"First","uploader_id":"@creator"}]}"#,
-    )
-    .unwrap()
-    .videos;
-    app.views[0].loaded = true;
-    app.views[0].selection.select(Some(0));
-    app.save_collection(CollectionKind::WatchLater);
-    app.save_collection(CollectionKind::Saved);
-    app.remember_description("jNQXAC9IVRw".into(), "Cached description.".into());
-    let mut terminal = ratatui::Terminal::new(ratatui::backend::TestBackend::new(320, 80)).unwrap();
-    for kind in [
-        None,
-        Some(CollectionKind::WatchLater),
-        Some(CollectionKind::Saved),
-    ] {
-        app.switch_view(0);
-        if let Some(kind) = kind {
-            app.browse_collection(kind);
-        }
-        for preview in [
-            None,
-            Some(PreviewMode::Info),
-            Some(PreviewMode::Description),
-        ] {
-            app.preview = preview;
-            terminal
-                .draw(|frame| app.draw(frame, Duration::ZERO))
-                .unwrap();
-            let buffer = terminal.backend().buffer();
-            let rendered: String = buffer.content.iter().map(|cell| cell.symbol()).collect();
-            assert_eq!(rendered.contains("F8"), kind.is_some());
-            assert_eq!(rendered.contains("F9"), kind.is_some());
-            if preview == Some(PreviewMode::Info) {
-                let popup = preview_area(buffer.area);
-                let title: String = (popup.x..popup.right())
-                    .map(|x| buffer[(x, popup.y)].symbol())
-                    .collect();
-                assert_eq!(title.contains("F8"), kind.is_some());
-                assert_eq!(title.contains("F9"), kind.is_some());
-            }
-        }
-    }
-}
-
 #[test]
 fn bulk_removal_snapshots_saved_categories_and_watch_filters_independently() {
     let root = std::env::temp_dir().join(format!("tubular-collection-bulk-{}", std::process::id()));
@@ -3496,7 +3651,7 @@ fn forward_navigation_skips_unsubscribed_views() {
 }
 
 #[test]
-fn escape_and_minus_restore_view_history_without_consuming_modal_escape() {
+fn minus_restores_view_history_without_consuming_modal_escape() {
     let mut app = app(&["tubular"]);
     app.apply_config(config::Config {
         categories: [("Category".into(), Vec::new())].into(),
@@ -3537,7 +3692,7 @@ fn escape_and_minus_restore_view_history_without_consuming_modal_escape() {
         app.views[app.view_index].source,
         ViewSource::Channel("beta".into())
     );
-    app.key(KeyEvent::new(KeyCode::Esc, KeyModifiers::NONE));
+    app.key(KeyEvent::new(KeyCode::Char('-'), KeyModifiers::NONE));
     assert_eq!(
         app.views[app.view_index].source,
         ViewSource::Channel("alpha".into())
@@ -3553,7 +3708,7 @@ fn escape_and_minus_restore_view_history_without_consuming_modal_escape() {
         app.views[app.view_index].source,
         ViewSource::Category("Category".into())
     );
-    app.key(KeyEvent::new(KeyCode::Esc, KeyModifiers::NONE));
+    app.key(KeyEvent::new(KeyCode::Char('-'), KeyModifiers::NONE));
     assert_eq!(app.views[app.view_index].source, ViewSource::Search);
     app.key(KeyEvent::new(KeyCode::Char('-'), KeyModifiers::NONE));
     assert_eq!(app.views[app.view_index].source, ViewSource::Search);
@@ -3589,11 +3744,83 @@ fn back_history_uses_source_identity_after_config_reorders_or_removes_views() {
         channels: [("@Alpha".into(), "alpha".into())].into(),
         ..Default::default()
     });
-    app.key(KeyEvent::new(KeyCode::Esc, KeyModifiers::NONE));
+    app.key(KeyEvent::new(KeyCode::Char('-'), KeyModifiers::NONE));
     assert_eq!(app.views[app.view_index].source, ViewSource::Search);
     assert!(app.job.is_none());
 }
 
+#[test]
+fn channel_playlists_filter_open_in_provider_order_and_retain_history_and_config() {
+    let mut app = app(&["tubular"]);
+    let press = |app: &mut App, code| {
+        app.key(KeyEvent::new(code, KeyModifiers::NONE));
+    };
+    press(&mut app, KeyCode::Char('L'));
+    assert!(app.browser.is_none());
+    let channel = ViewSource::Channel("https://www.youtube.com/@RustVideos".into());
+    let mut view = View::new("@RustVideos".into(), channel.clone());
+    view.loaded = true;
+    app.views.push(view);
+    app.switch_view(app.views.len() - 1);
+    press(&mut app, KeyCode::Char('L'));
+    assert_eq!(app.browser.as_ref().unwrap().kind, BrowserKind::Playlists);
+    app.finish_playlists(Ok(r#"{"entries":[{"id":"PLJ5MFiMfElFA","title":"Conference"},{"id":"PLJ5MFiMfElFB","title":"Tutorials"}]}"#.into()));
+    press(&mut app, KeyCode::Char('i'));
+    app.paste("tutor");
+    assert_eq!(
+        app.browser.as_ref().unwrap().selected_choice().unwrap().0,
+        "Tutorials"
+    );
+    press(&mut app, KeyCode::Enter);
+    assert!(app.browser.is_none());
+    let playlist = ViewSource::Playlist("PLJ5MFiMfElFB".into());
+    assert_eq!(app.views[app.view_index].source, playlist);
+    app.finish_page(Ok(r#"{"entries":[{"id":"jNQXAC9IVRw","title":"First","timestamp":100},{"id":"rQ_J9WH6CGk","title":"Second","timestamp":200}]}"#.into()));
+    let view = &app.views[app.view_index];
+    assert_eq!(
+        view.videos
+            .iter()
+            .map(|video| video.title.as_str())
+            .collect::<Vec<_>>(),
+        ["First", "Second"]
+    );
+    assert!(!view.has_more);
+    press(&mut app, KeyCode::Char('j'));
+    press(&mut app, KeyCode::Char(' '));
+    assert_eq!(
+        app.views[app.view_index].playback_videos()[0].id,
+        "rQ_J9WH6CGk"
+    );
+    press(&mut app, KeyCode::Char('-'));
+    assert_eq!(app.views[app.view_index].source, channel);
+    press(&mut app, KeyCode::Char('+'));
+    assert_eq!(app.views[app.view_index].source, playlist);
+    assert_eq!(app.views[app.view_index].selection.selected(), Some(1));
+    app.apply_config(config::Config {
+        categories: [("Unrelated".into(), Vec::new())].into(),
+        ..Default::default()
+    });
+    assert_eq!(app.views[app.view_index].source, playlist);
+    assert_eq!(app.temporary_view, Some(playlist));
+    assert_eq!(app.views[app.view_index].selection.selected(), Some(1));
+    assert!(app.config.subscriptions().is_empty());
+    press(&mut app, KeyCode::Char('-'));
+    press(&mut app, KeyCode::Char('L'));
+    app.finish_playlists(Err("Extractor failed".into()));
+    assert_eq!(
+        app.browser.as_ref().unwrap().error.as_deref(),
+        Some("Extractor failed")
+    );
+    press(&mut app, KeyCode::Esc);
+    assert!(app.browser.is_none());
+    press(&mut app, KeyCode::Char('L'));
+    app.finish_playlists(Ok(r#"{"entries":[]}"#.into()));
+    assert!(app.browser.as_ref().unwrap().choices.is_empty());
+    assert!(app.browser.as_ref().unwrap().error.is_none());
+    press(&mut app, KeyCode::Esc);
+    assert_eq!(app.views[app.view_index].source, channel);
+}
+
 #[test]
 fn video_channel_shortcut_reuses_saved_views_and_requires_valid_identity() {
     let mut app = app(&["tubular"]);
@@ -5921,3 +6148,19 @@ fn search_without_a_handle_can_tag_a_registered_channel() {
     );
     std::fs::remove_file(path).unwrap();
 }
+
+#[test]
+fn escape_discards_checks_without_consuming_view_history() {
+    let mut app = app(&["tubular"]);
+    app.views[0].loaded = true;
+    app.views[1].loaded = true;
+    app.switch_view(1);
+    app.views[1].checked.push("jNQXAC9IVRw".into());
+    app.key(KeyEvent::new(KeyCode::Esc, KeyModifiers::NONE));
+    assert!(app.views[1].checked.is_empty());
+    assert_eq!(app.view_index, 1);
+    app.key(KeyEvent::new(KeyCode::Esc, KeyModifiers::NONE));
+    assert_eq!(app.view_index, 1);
+    app.key(KeyEvent::new(KeyCode::Char('-'), KeyModifiers::NONE));
+    assert_eq!(app.view_index, 0);
+}

tests/unit/keys.rs

@@ -15,6 +15,152 @@ fn press(
     bindings.resolve(context, KeyEvent::new(code, modifiers))
 }
 
+#[test]
+fn playback_checks_are_configurable_in_views_without_stealing_modal_space() {
+    let defaults = Bindings::default();
+    let overrides = configured("[keys.video.select]\ntoggle = 'f20'\nclear = 'f21'\n").unwrap();
+    for &context in ALL {
+        for (action, modifiers, override_code) in [
+            (Action::VideoToggle, KeyModifiers::NONE, KeyCode::F(20)),
+            (Action::VideoClear, KeyModifiers::CONTROL, KeyCode::F(21)),
+        ] {
+            let expected = VIEW.contains(&context).then_some(action);
+            assert_eq!(
+                press(&defaults, context, KeyCode::Char(' '), modifiers)
+                    .filter(|resolved| *resolved == action),
+                expected,
+            );
+            assert_eq!(
+                press(&overrides, context, override_code, KeyModifiers::NONE),
+                expected,
+            );
+            assert_ne!(
+                press(&overrides, context, KeyCode::Char(' '), modifiers),
+                Some(action),
+            );
+        }
+    }
+    assert_eq!(
+        press(
+            &defaults,
+            Context::TagList,
+            KeyCode::Char(' '),
+            KeyModifiers::NONE
+        ),
+        Some(Action::TagToggle),
+    );
+    assert_eq!(
+        press(
+            &defaults,
+            Context::SelectorNormal,
+            KeyCode::Char(' '),
+            KeyModifiers::NONE
+        ),
+        Some(Action::SelectorToggle),
+    );
+}
+
+#[test]
+fn enqueue_is_configurable_and_only_active_in_video_views() {
+    let defaults = Bindings::default();
+    let overrides = configured("[keys.video]\nenqueue = 'f22'\n").unwrap();
+    for &context in ALL {
+        let expected = VIEW.contains(&context).then_some(Action::VideoEnqueue);
+        for modifiers in [KeyModifiers::CONTROL] {
+            assert_eq!(
+                press(&defaults, context, KeyCode::Enter, modifiers),
+                expected
+            );
+            assert_ne!(
+                press(&overrides, context, KeyCode::Enter, modifiers),
+                Some(Action::VideoEnqueue),
+            );
+        }
+        assert_eq!(
+            press(&defaults, context, KeyCode::Enter, KeyModifiers::SUPER),
+            None
+        );
+        assert_eq!(
+            press(&overrides, context, KeyCode::F(22), KeyModifiers::NONE),
+            expected,
+        );
+    }
+    assert_eq!(
+        press(
+            &defaults,
+            Context::Normal,
+            KeyCode::Enter,
+            KeyModifiers::NONE
+        ),
+        Some(Action::VideoPlay),
+    );
+    assert!(configured("[keys.video]\nenqueue = 'enter'\n").is_err());
+}
+
+#[test]
+fn provider_choice_is_configurable_and_normal_only() {
+    let defaults = Bindings::default();
+    let overrides = configured("[keys.app]\nprovider = 'alt+p'\n").unwrap();
+    for &context in ALL {
+        let expected = matches!(context, Context::Normal | Context::CollectionNormal)
+            .then_some(Action::ProviderChoose);
+        assert_eq!(
+            press(&defaults, context, KeyCode::Char('p'), KeyModifiers::NONE)
+                .filter(|action| *action == Action::ProviderChoose),
+            expected,
+        );
+        assert_eq!(
+            press(&overrides, context, KeyCode::Char('p'), KeyModifiers::ALT),
+            expected,
+        );
+        assert_ne!(
+            press(&overrides, context, KeyCode::Char('p'), KeyModifiers::NONE),
+            Some(Action::ProviderChoose),
+        );
+    }
+}
+
+#[test]
+fn channel_playlists_are_configurable_and_normal_only() {
+    let defaults = Bindings::default();
+    let overrides = configured("[keys.channel]\nplaylists = 'alt+l'\n").unwrap();
+    for &context in ALL {
+        let expected = (context == Context::Normal).then_some(Action::ChannelPlaylists);
+        for (code, modifiers) in [
+            (KeyCode::Char('L'), KeyModifiers::NONE),
+            (KeyCode::Char('L'), KeyModifiers::SHIFT),
+            (KeyCode::Char('l'), KeyModifiers::SHIFT),
+        ] {
+            assert_eq!(press(&defaults, context, code, modifiers), expected);
+            assert_ne!(
+                press(&overrides, context, code, modifiers),
+                Some(Action::ChannelPlaylists),
+            );
+        }
+        assert_eq!(
+            press(&defaults, context, KeyCode::Char('l'), KeyModifiers::NONE),
+            None,
+        );
+        assert_eq!(
+            press(&overrides, context, KeyCode::Char('l'), KeyModifiers::ALT),
+            expected,
+        );
+    }
+    assert!(default_config().contains("channel.playlists = [\"L\"]"));
+    assert!(defaults.help_text().to_string().lines().any(|line| {
+        line.trim_start().starts_with("L ")
+            && line.contains("Browse the current channel's playlists")
+    }));
+    assert!(overrides.help_text().to_string().lines().any(|line| {
+        line.trim_start().starts_with("Alt+l ")
+            && line.contains("Browse the current channel's playlists")
+    }));
+    let collision = configured("[keys.channel]\nplaylists = 'u'\n")
+        .unwrap_err()
+        .to_string();
+    assert!(collision.contains("channel.playlists") && collision.contains("channel.browse"));
+}
+
 #[test]
 fn only_section_headers_are_bold_in_the_grouped_overview() {
     use ratatui::{
@@ -321,6 +467,9 @@ fn collection_removal_defaults_are_scoped_and_inherit_view_actions() {
         (Context::Description, Context::CollectionDescription),
     ] {
         for &(key, action) in &bindings.contexts[ordinary as usize] {
+            if action == Action::ChannelPlaylists {
+                continue;
+            }
             assert_eq!(
                 bindings.resolve(collection, KeyEvent::new(key.code, key.modifiers)),
                 Some(action),
@@ -329,7 +478,8 @@ fn collection_removal_defaults_are_scoped_and_inherit_view_actions() {
         }
         assert_eq!(
             bindings.contexts[collection as usize].len(),
-            bindings.contexts[ordinary as usize].len() + 2,
+            bindings.contexts[ordinary as usize].len() + 2
+                - usize::from(ordinary == Context::Normal),
         );
     }
 }

tests/unit/miruro.rs

@@ -1,75 +1,54 @@
 use super::*;
 
 #[test]
-fn source_projection_rejects_unsafe_or_unsupported_playback_contracts() {
-    let sources = serde_json::json!({
-        "episodeNumber": 1,
-        "config": { "sun": { "player": "native", "proxy": false } },
-        "tracks": [{ "track": "ssub", "providers": [{
-            "provider": "sun",
-            "servers": [{
-                "headers": { "Origin": "https://ultracloud.cc", "Referer": "https://ultracloud.cc/" },
-                "streams": [{ "url": "https://vault.keeply.top/master.m3u8?token=secret", "format": "hls", "embed": null }]
-            }],
-            "subtitles": [{
-                "file": "https://vault.keeply.top/english.jpeg", "format": "vtt",
-                "language": "en", "label": "English", "default": true
-            }]
-        }] }]
-    });
-    let identity = Identity::new("catalog".into(), 1).unwrap();
-    let source = SourceDocument::from_sources(&sources, identity.clone(), "Episode 1").unwrap();
+fn watch_url_preserves_stable_identity_and_validates_mutable_fields() {
+    let identity = Identity::from_key("miruro:OERe_a0YS4h-DlsBDOeXwX7HOO6316tw:1").unwrap();
+    assert_eq!(identity.key(), "miruro:OERe_a0YS4h-DlsBDOeXwX7HOO6316tw:1");
+    assert_eq!(
+        identity.watch_url().unwrap(),
+        "https://barelystarted.miruro.tv/watch/OERe_a0YS4h-DlsBDOeXwX7HOO6316tw/episode?ep=1"
+    );
     assert_eq!(Identity::from_key(&identity.key()).unwrap(), identity);
     assert_ne!(
-        Identity::new("catalog".into(), 2).unwrap().key(),
-        source.identity.key()
+        Identity::miruro(identity.media_id.clone(), 2)
+            .unwrap()
+            .key(),
+        identity.key()
     );
     for key in [
         "miruro:catalog:01",
         "miruro:catalog:0",
         "miruro:catalog:2147483648",
         "miruro:catalog/:1",
+        "miruro:catalog:+1",
+        "miruro::1",
     ] {
         assert!(Identity::from_key(key).is_err());
     }
-    for (pointer, value) in [
-        ("/episodeNumber", serde_json::json!(49)),
-        ("/config/sun/proxy", serde_json::json!({"segments": true})),
-        (
-            "/tracks/0/providers/0/servers/0/streams/0/url",
-            serde_json::json!("file:///secret"),
-        ),
-        (
-            "/tracks/0/providers/0/servers/0/streams/0/embed",
-            serde_json::json!({"url": "https://embed.example"}),
-        ),
-        (
-            "/tracks/0/providers/0/servers/0/headers/origin",
-            serde_json::json!("secret"),
-        ),
-        (
-            "/tracks/0/providers/0/servers/0/headers/Referer",
-            serde_json::json!("secret\r\nX-Injected: true"),
-        ),
+    for invalid in [
+        Identity {
+            provider: "youtube".into(),
+            ..identity.clone()
+        },
+        Identity {
+            media_id: "catalog/".into(),
+            ..identity.clone()
+        },
+        Identity {
+            media_id: "a".repeat(513),
+            ..identity.clone()
+        },
+        Identity {
+            episode: 0,
+            ..identity.clone()
+        },
+        Identity {
+            episode: i32::MAX as u32 + 1,
+            ..identity.clone()
+        },
     ] {
-        let mut invalid_sources = sources.clone();
-        if let Some(field) = invalid_sources.pointer_mut(pointer) {
-            *field = value;
-        } else {
-            invalid_sources["tracks"][0]["providers"][0]["servers"][0]["headers"]["origin"] = value;
+        assert!(invalid.watch_url().is_err());
     }
-        let error = SourceDocument::from_sources(&invalid_sources, identity.clone(), "Episode 1")
-            .unwrap_err();
-        assert!(!error.to_string().contains("secret"));
-    }
-    let mut invalid_source = source;
-    invalid_source
-        .subtitles
-        .push(invalid_source.subtitles[0].clone());
-    assert!(invalid_source.validate().is_err());
-    invalid_source.subtitles[1].default = false;
-    invalid_source.subtitles[1].format = "srt".into();
-    assert!(invalid_source.validate().is_err());
 }
 
 #[test]
@@ -106,3 +85,105 @@ fn episodes_resolve_by_promise_id_with_independent_tables_or_fail_explicitly() {
         io::ErrorKind::NotFound
     );
 }
+
+#[test]
+fn mirror_failover_remembers_success_and_stops_on_rate_limits_and_bad_requests() {
+    use std::{
+        io::{BufRead, BufReader, Write},
+        net::TcpListener,
+        thread,
+    };
+
+    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+    let base = format!("http://{}", listener.local_addr().unwrap());
+    let server = thread::spawn(move || {
+        for (path, status, mime, body) in [
+            ("/one/catalog?q=anime", 403, "text/html", "blocked"),
+            ("/two/catalog?q=anime", 200, "text/html", "protection page"),
+            (
+                "/three/catalog?q=anime",
+                200,
+                "application/json",
+                r#"{"data":[{"id":"series"}]}"#,
+            ),
+            ("/three/detail", 503, "text/html", "unavailable"),
+            (
+                "/one/detail",
+                200,
+                "text/sveltekit-data",
+                "episode metadata",
+            ),
+            ("/one/limited", 429, "text/html", "rate limited"),
+            ("/one/bad-query", 400, "application/json", "{}"),
+            ("/one/exhausted", 403, "text/html", "blocked"),
+            ("/two/exhausted", 404, "text/html", "gone"),
+            ("/three/exhausted", 502, "text/html", "unavailable"),
+            ("/one/recovered", 200, "application/json", r#"{"data":[]}"#),
+        ] {
+            let (mut stream, _) = listener.accept().unwrap();
+            stream
+                .set_read_timeout(Some(Duration::from_secs(5)))
+                .unwrap();
+            let mut reader = BufReader::new(&stream);
+            let mut line = String::new();
+            reader.read_line(&mut line).unwrap();
+            assert_eq!(line.trim_end(), format!("GET {path} HTTP/1.1"));
+            loop {
+                line.clear();
+                reader.read_line(&mut line).unwrap();
+                if line == "\r\n" {
+                    break;
+                }
+            }
+            write!(
+                stream,
+                "HTTP/1.1 {status} Response\r\nContent-Type: {mime}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
+                body.len()
+            ).unwrap();
+        }
+    });
+    let bases = [
+        format!("{base}/one"),
+        format!("{base}/two"),
+        format!("{base}/three"),
+    ];
+    let mirrors: Vec<_> = bases.iter().map(String::as_str).collect();
+    let client = Client::default();
+    let body = client
+        .get_from(
+            &mirrors,
+            "/catalog",
+            &[("q", "anime")],
+            &["application/json"],
+        )
+        .unwrap();
+    assert_eq!(
+        serde_json::from_str::<Value>(&body).unwrap()["data"][0]["id"],
+        "series"
+    );
+    assert_eq!(
+        client
+            .get_from(&mirrors, "/detail", &[], &["text/sveltekit-data"])
+            .unwrap(),
+        "episode metadata"
+    );
+    for (path, status) in [("/limited", 429), ("/bad-query", 400)] {
+        let error = client
+            .get_from(&mirrors, path, &[], &["application/json"])
+            .unwrap_err();
+        assert!(error.to_string().contains(&format!("HTTP {status}")));
+    }
+    let error = client
+        .get_from(&mirrors, "/exhausted", &[], &["application/json"])
+        .unwrap_err();
+    assert!(error.to_string().contains("failed on 3/3 mirrors"));
+    assert!(error.to_string().contains("HTTP 502"));
+    let body = client
+        .get_from(&mirrors, "/recovered", &[], &["application/json"])
+        .unwrap();
+    assert_eq!(
+        serde_json::from_str::<Value>(&body).unwrap()["data"],
+        serde_json::json!([])
+    );
+    server.join().unwrap();
+}

tests/unit/miruro_browser.rs

@@ -67,3 +67,31 @@ fn catalog_and_actual_episode_numbers_remain_distinct() {
         ""
     );
 }
+
+#[test]
+fn anilist_catalog_numbers_are_not_planned_totals_or_stream_claims() {
+    let metadata = serde_json::json!({"id":"1","catalog_provider":"anilist","title":{"romaji":"Cowboy Bebop"},"status":"FINISHED","episode_count":26,"catalog_count":26});
+    let series = anilist_series(metadata).unwrap();
+    assert_eq!(series.episodes.len(), 26);
+    assert_eq!(
+        series.episodes.last().unwrap().identity.key(),
+        "anilist:1:26"
+    );
+    let snapshot = series.episodes[0].snapshot(&series.media);
+    assert_eq!(snapshot.channel.as_deref(), Some("AniList"));
+    assert_eq!(
+        crate::youtube::video_url(&snapshot.id).unwrap(),
+        "https://zokoanime.video/stream/ani/1/1/sub"
+    );
+    let ongoing = anilist_series(serde_json::json!({"id":"2","catalog_provider":"anilist","title":{"romaji":"Ongoing"},"status":"RELEASING","episode_count":24,"nextAiringEpisode":{"episode":4},"catalog_count":3})).unwrap();
+    assert_eq!(ongoing.episodes.len(), 3);
+    let unknown = anilist_series(serde_json::json!({"id":"3","catalog_provider":"anilist","title":{"romaji":"Unknown"},"status":"RELEASING","episode_count":null,"catalog_count":null})).unwrap();
+    assert!(unknown.episodes.is_empty());
+    assert!(unknown.media.metadata["catalog_count"].is_null());
+    assert_eq!(
+        anilist_episode(&unknown.media, 42).unwrap().identity.key(),
+        "anilist:3:42"
+    );
+    assert!(anilist_episode(&unknown.media, 0).is_err());
+    assert!(anilist_episode(&unknown.media, i32::MAX as u32 + 1).is_err());
+}

tests/unit/miruro_ui.rs

@@ -1,12 +1,12 @@
 use super::*;
+use clap::Parser;
 use ratatui::crossterm::event::KeyModifiers;
 use std::{
-    collections::BTreeMap,
     fs,
     io::Write,
     sync::atomic::{AtomicU64, Ordering},
 };
-use tubular::miruro::{Detail, SourceDocument};
+use tubular::miruro::Detail;
 
 struct Directory(PathBuf);
 impl Directory {
@@ -27,6 +27,7 @@ impl Directory {
             player: self.0.join("missing-player").into_os_string(),
             default_config: false,
             miruro: true,
+            anilist: false,
             query: query.map(str::to_owned),
         };
         Browser::new(
@@ -53,16 +54,6 @@ fn series(media: &Media) -> miruro_browser::Series {
             serde_json::json!({"episode_number":7, "absolute_number":53, "title":null, "duration_seconds":null}),
         ] }).unwrap()
 }
-fn source(video: &Video, token: &str) -> SourceDocument {
-    SourceDocument {
-        version: 1,
-        url: format!("https://vault.keeply.top/master.m3u8?token={token}"),
-        headers: BTreeMap::new(),
-        identity: Identity::from_key(&video.id).unwrap(),
-        title: Some(video.title.clone()),
-        subtitles: Vec::new(),
-    }
-}
 fn catalog_results(browser: &mut Browser) {
     browser.accept(
         browser.generation,
@@ -77,19 +68,6 @@ fn enter_series(browser: &mut Browser) {
     let result = series(media);
     browser.accept(browser.generation, Ok(Response::Series(result)));
 }
-fn sources(directory: &Directory) -> Vec<Value> {
-    let path = directory.0.join("playback-sessions");
-    if !path.exists() {
-        return Vec::new();
-    }
-    fs::read_dir(path)
-        .unwrap()
-        .map(|entry| {
-            serde_json::from_slice(&fs::read(entry.unwrap().path().join("source.json")).unwrap())
-                .unwrap()
-        })
-        .collect()
-}
 
 #[test]
 fn metadata_popup_scrolls_and_closes_without_moving_the_episode_selection() {
@@ -188,7 +166,7 @@ fn catalog_series_back_forward_keep_native_query_selection_and_actual_episodes()
 }
 
 #[test]
-fn latest_intent_and_navigation_reject_stale_catalog_series_and_sources() {
+fn latest_intent_and_navigation_reject_stale_catalog_and_series() {
     let directory = Directory::new();
     let mut browser = directory.browser(Some("old"));
     let old = browser.generation;
@@ -214,30 +192,10 @@ fn latest_intent_and_navigation_reject_stale_catalog_series_and_sources() {
     };
     let data = series(media);
     browser.accept(browser.generation, Ok(Response::Series(data)));
-    let video = browser.screen().selected_video().unwrap();
-    browser.open();
-    let stale = browser.generation;
-    browser.history(false);
-    browser.accept(
-        stale,
-        Ok(Response::Source(
-            video.clone(),
-            Box::new(source(&video, "stale")),
-        )),
+    assert_eq!(
+        browser.screen().selected_video().unwrap().id,
+        "miruro:first:3"
     );
-    assert!(sources(&directory).is_empty());
-    browser.history(true);
-    browser.open();
-    let stale = browser.generation;
-    browser.refresh();
-    browser.accept(
-        stale,
-        Ok(Response::Source(
-            video.clone(),
-            Box::new(source(&video, "refreshed-away")),
-        )),
-    );
-    assert!(sources(&directory).is_empty());
 }
 
 #[test]
@@ -274,12 +232,9 @@ fn manual_watch_status_refreshes_filters_and_preserves_other_providers() {
     assert!(!browser.state.is_watched(&episode.id));
     browser.preview = None;
     browser.collection(CollectionKind::Watching);
-    browser.open();
-    assert!(browser.pending.is_some());
     browser.key(KeyEvent::new(KeyCode::Char('M'), KeyModifiers::NONE));
     assert!(browser.state.is_watched(&episode.id));
     assert_eq!(browser.screen().len(), 0);
-    assert!(browser.pending.is_none());
     browser.collection(CollectionKind::WatchLater);
     browser.key(KeyEvent::new(KeyCode::Char('f'), KeyModifiers::NONE));
     assert_eq!(browser.screen().len(), 0);
@@ -336,8 +291,6 @@ fn offline_collections_and_filtered_bulk_removal_never_touch_youtube() {
     }
     browser.collection(CollectionKind::Saved);
     assert_eq!(browser.screen().len(), 1);
-    browser.open();
-    assert!(matches!(&browser.pending, Some(Request::Source(video)) if video.id == episode.id));
     browser.remove(true);
     assert_eq!(
         browser.removal.as_ref().unwrap().1.as_slice(),
@@ -351,10 +304,8 @@ fn offline_collections_and_filtered_bulk_removal_never_touch_youtube() {
             .state
             .contains(CollectionKind::WatchLater, &episode.id)
     );
-    let (_, report) = browser
-        .state
-        .miruro_session(&episode, &source(&episode, "progress"))
-        .unwrap();
+    let report = browser.state.progress_file(&episode).unwrap();
+    crate::video_state::register_identity(&report, &episode.id).unwrap();
     let mut output = fs::OpenOptions::new();
     output.write(true).create_new(true);
     #[cfg(unix)]
@@ -391,89 +342,33 @@ fn offline_collections_and_filtered_bulk_removal_never_touch_youtube() {
 }
 
 #[test]
-fn selected_episode_and_offline_reopen_write_fresh_validated_source_sessions() {
+fn launcher_failure_does_not_mark_series_or_offline_episodes_as_started() {
     let directory = Directory::new();
     let mut browser = directory.browser(Some("anime"));
     catalog_results(&mut browser);
     enter_series(&mut browser);
-    let first = browser.screen().selected_video().unwrap();
-    browser.open();
-    let stale = browser.generation;
     browser.select(Action::VideoNext);
-    browser.accept(
-        stale,
-        Ok(Response::Source(
-            first.clone(),
-            Box::new(source(&first, "not-selected")),
-        )),
-    );
-    assert!(sources(&directory).is_empty());
     let selected = browser.screen().selected_video().unwrap();
     assert_eq!(Identity::from_key(&selected.id).unwrap().episode, 7);
-    browser.save(CollectionKind::Saved);
-    browser.collection(CollectionKind::Saved);
     browser.open();
-    browser.pending = None;
-    browser.accept(
-        browser.generation,
-        Ok(Response::Source(
-            selected.clone(),
-            Box::new(source(&first, "wrong-identity")),
-        )),
-    );
-    assert!(sources(&directory).is_empty());
-    browser.open();
-    browser.pending = None;
-    let mut invalid = source(&selected, "private-token");
-    invalid
-        .headers
-        .insert("X-Invalid".into(), "private-header\nvalue".into());
-    browser.accept(
-        browser.generation,
-        Ok(Response::Source(selected.clone(), Box::new(invalid))),
-    );
-    assert!(sources(&directory).is_empty());
-    assert!(!browser.status.contains("private-token"));
-    assert!(!browser.status.contains("private-header"));
-    for token in ["fresh-one", "fresh-two"] {
-        browser.open();
-        assert!(
-            matches!(&browser.pending, Some(Request::Source(video)) if video.id == selected.id && video.title == selected.title)
-        );
-        browser.pending = None; // Deliver the real source response without a network request.
-        browser.accept(
-            browser.generation,
-            Ok(Response::Source(
-                selected.clone(),
-                Box::new(source(&selected, token)),
-            )),
-        );
-    }
-    let written = sources(&directory);
-    assert_eq!(written.len(), 2);
-    assert!(
-        written
-            .iter()
-            .all(|source| source["identity"]["episode"] == 7
-                && source["identity"]["media_id"] == "first")
-    );
-    assert!(
-        written
-            .iter()
-            .any(|source| source["url"].as_str().unwrap().ends_with("fresh-one"))
-    );
-    assert!(
-        written
-            .iter()
-            .any(|source| source["url"].as_str().unwrap().ends_with("fresh-two"))
-    );
-    assert!(!browser.state.is_watched(&selected.id)); // Spawn failure/CLI completion is not progress.
+    assert!(browser.screen().error.is_some());
+    assert!(!browser.state.is_watched(&selected.id));
     assert!(
         !browser
             .state
             .contains(CollectionKind::Watching, &selected.id)
     );
-    assert!(browser.screen().error.is_some()); // Native launch errors remain visible.
+    browser.save(CollectionKind::Saved);
+    browser.collection(CollectionKind::Saved);
+    browser.open();
+    assert!(browser.screen().error.is_some());
+    assert!(!browser.state.is_watched(&selected.id));
+    assert!(
+        !browser
+            .state
+            .contains(CollectionKind::Watching, &selected.id)
+    );
+    assert!(browser.state.contains(CollectionKind::Saved, &selected.id));
 }
 
 #[test]
@@ -681,3 +576,498 @@ fn empty_errors_and_query_controls_do_not_create_results_or_commands() {
     assert!(!browser.key(KeyEvent::new(KeyCode::Char('q'), KeyModifiers::NONE)));
     assert!(browser.key(KeyEvent::new(KeyCode::F(9), KeyModifiers::NONE)));
 }
+
+#[test]
+fn episode_checks_preserve_check_order_and_cached_screen_history() {
+    use ratatui::{Terminal, backend::TestBackend};
+
+    let directory = Directory::new();
+    let mut browser = directory.browser(Some("anime"));
+    catalog_results(&mut browser);
+    enter_series(&mut browser);
+    browser.select(Action::VideoLast);
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    browser.select(Action::VideoFirst);
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    let ids = |browser: &Browser| {
+        browser
+            .screen()
+            .playback_videos()
+            .into_iter()
+            .map(|video| video.id)
+            .collect::<Vec<_>>()
+    };
+    assert_eq!(ids(&browser), ["miruro:first:7", "miruro:first:3"]);
+    assert!(browser.hints().contains("play checked"));
+    assert!(browser.hints().contains("clear checks"));
+    let mut terminal = Terminal::new(TestBackend::new(120, 32)).unwrap();
+    terminal
+        .draw(|frame| browser.draw(frame, Duration::ZERO))
+        .unwrap();
+    let text: String = terminal
+        .backend()
+        .buffer()
+        .content
+        .iter()
+        .map(|cell| cell.symbol())
+        .collect();
+    assert!(text.contains("2 checked"));
+    browser.select(Action::VideoLast);
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    assert_eq!(ids(&browser), ["miruro:first:3"]);
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    assert_eq!(ids(&browser), ["miruro:first:3", "miruro:first:7"]);
+
+    if let Content::Series {
+        data: Some(data), ..
+    } = &mut browser.screen_mut().content
+    {
+        data.reverse();
+    }
+    browser.screen_mut().rebuild_display();
+    assert_eq!(ids(&browser), ["miruro:first:3", "miruro:first:7"]);
+    browser.history(false);
+    assert!(browser.screen().checked.is_empty());
+    browser.history(true);
+    assert_eq!(ids(&browser), ["miruro:first:3", "miruro:first:7"]);
+    browser.screen_mut().selection.select(None);
+    assert_eq!(ids(&browser), ["miruro:first:3", "miruro:first:7"]);
+    browser.select(Action::VideoLast);
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::CONTROL));
+    assert!(browser.screen().checked.is_empty());
+    assert_eq!(ids(&browser), ["miruro:first:3"]);
+
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    browser.refresh();
+    assert!(browser.screen().checked.is_empty());
+    // Checks made against old metadata while loading must not survive replacement.
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    let replacement = series(browser.screen().selected_media().unwrap());
+    browser.accept(browser.generation, Ok(Response::Series(replacement)));
+    assert!(browser.screen().checked.is_empty());
+    assert_eq!(ids(&browser), ["miruro:first:3"]);
+}
+
+#[test]
+fn catalog_and_saved_show_rows_cannot_be_checked() {
+    let directory = Directory::new();
+    let mut browser = directory.browser(Some("anime"));
+    catalog_results(&mut browser);
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    let generation = browser.generation;
+    browser.key(KeyEvent::new(KeyCode::Enter, KeyModifiers::CONTROL));
+    assert_eq!(browser.generation, generation);
+    assert!(matches!(browser.screen().content, Content::Catalog { .. }));
+    assert!(browser.player.is_none());
+    assert!(browser.screen().checked.is_empty());
+    assert!(browser.screen().playback_videos().is_empty());
+    assert!(!browser.bindings().iter().any(|(action, _)| {
+        matches!(
+            action,
+            Action::VideoToggle | Action::VideoClear | Action::VideoEnqueue
+        )
+    }));
+    browser
+        .state
+        .save_show(&media("first"), &BTreeSet::new())
+        .unwrap();
+    browser.library(BTreeSet::new());
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    let generation = browser.generation;
+    browser.key(KeyEvent::new(KeyCode::Enter, KeyModifiers::SUPER));
+    assert_eq!(browser.generation, generation);
+    assert!(matches!(browser.screen().content, Content::Library { .. }));
+    assert!(browser.player.is_none());
+    assert!(browser.screen().checked.is_empty());
+    assert!(browser.screen().playback_videos().is_empty());
+    enter_series(&mut browser);
+    assert_eq!(browser.screen().len(), 2);
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    assert_eq!(browser.screen().checked, ["miruro:first:3"]);
+    browser.edit_search();
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    assert_eq!(browser.input.as_deref(), Some(" "));
+    assert!(browser.screen().checked.is_empty());
+    browser.input = None;
+    browser.history(false);
+    assert_eq!(browser.screen().checked, ["miruro:first:3"]);
+}
+
+#[test]
+fn collection_checks_prune_hidden_and_removed_episodes_without_resurrection() {
+    let directory = Directory::new();
+    let mut browser = directory.browser(Some("anime"));
+    catalog_results(&mut browser);
+    enter_series(&mut browser);
+    let first = browser.screen().selected_video().unwrap();
+    browser.save(CollectionKind::WatchLater);
+    browser.select(Action::VideoNext);
+    let second = browser.screen().selected_video().unwrap();
+    browser.save(CollectionKind::WatchLater);
+    browser
+        .state
+        .set_watch_status(&first, WatchStatus::Watched)
+        .unwrap();
+    browser.collection(CollectionKind::WatchLater);
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    browser.select(Action::VideoNext);
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    assert_eq!(browser.screen().checked.len(), 2);
+    browser.rebuild_collections();
+    assert_eq!(browser.screen().checked.len(), 2);
+    browser.key(KeyEvent::new(KeyCode::Char('f'), KeyModifiers::NONE));
+    assert_eq!(browser.screen().checked, [second.id.clone()]);
+    assert_eq!(browser.screen().playback_videos()[0].id, second.id);
+    browser.key(KeyEvent::new(KeyCode::Char('f'), KeyModifiers::NONE));
+    assert!(browser.screen().checked.is_empty());
+    assert_eq!(browser.screen().selected_video().unwrap().id, first.id);
+    browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+    browser.remove(false);
+    assert!(browser.screen().checked.is_empty());
+    assert!(browser.screen().playback_videos().is_empty());
+    browser.key(KeyEvent::new(KeyCode::Char('f'), KeyModifiers::NONE));
+    assert_eq!(browser.screen().len(), 1);
+    assert!(browser.screen().checked.is_empty());
+    assert_eq!(browser.screen().playback_videos()[0].id, second.id);
+}
+
+#[cfg(unix)]
+#[test]
+fn episode_launch_retains_checks_on_failure_and_clears_only_after_spawn() {
+    for modifiers in [KeyModifiers::NONE, KeyModifiers::CONTROL] {
+        let directory = Directory::new();
+        let mut browser = directory.browser(Some("anime"));
+        catalog_results(&mut browser);
+        enter_series(&mut browser);
+        let first = browser.screen().selected_video().unwrap();
+        browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+        browser.select(Action::VideoNext);
+        let hovered = browser.screen().selected_video().unwrap();
+        browser.save(CollectionKind::Saved);
+        browser.set_watch_status(WatchStatus::Watching);
+        assert!(!browser.state.contains(CollectionKind::Saved, &first.id));
+        assert!(!browser.state.contains(CollectionKind::Watching, &first.id));
+        assert!(browser.state.contains(CollectionKind::Saved, &hovered.id));
+        assert!(
+            browser
+                .state
+                .contains(CollectionKind::Watching, &hovered.id)
+        );
+        browser.key(KeyEvent::new(KeyCode::Enter, modifiers));
+        assert!(browser.screen().error.is_some());
+        assert_eq!(browser.screen().checked, [first.id.clone()]);
+        assert_eq!(browser.screen().playback_videos()[0].id, first.id);
+        browser.key(KeyEvent::new(KeyCode::Char(' '), KeyModifiers::NONE));
+        browser.options.player = "/usr/bin/true".into();
+        browser.key(KeyEvent::new(KeyCode::Enter, modifiers));
+        assert!(browser.screen().error.is_none());
+        assert!(browser.player.is_some());
+        assert!(browser.screen().checked.is_empty());
+        assert_eq!(browser.screen().playback_videos()[0].id, hovered.id);
+    }
+}
+
+#[test]
+fn anilist_search_results_open_without_waiting_for_another_catalog_request() {
+    let directory = Directory::new();
+    let path = directory.0.join("config.toml");
+    fs::write(&path, "").unwrap();
+    let mut browser = Browser::new(
+        Options::parse_from(["tubular", "--anilist", "Cowboy Bebop"]),
+        path.clone(),
+        config::Config::default(),
+        State::open(&path).unwrap(),
+    );
+    let media = miruro_browser::catalog(vec![serde_json::json!({
+        "id":"1", "catalog_provider":"anilist",
+        "title":{"romaji":"Cowboy Bebop"}, "status":"FINISHED",
+        "episode_count":26, "catalog_count":26, "description":"Search synopsis"
+    })])
+    .unwrap();
+    browser.accept(browser.generation, Ok(Response::Catalog(media)));
+    browser.pending = None;
+    browser.key(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
+    assert_eq!(
+        browser.screen().selected_video().map(|video| video.id),
+        Some("anilist:1:1".into()),
+        "opening a complete search result must expose episodes immediately"
+    );
+    assert!(browser.pending.is_none());
+    assert!(browser.screen().overview.contains("Search synopsis"));
+    browser.select(Action::VideoLast);
+    assert_eq!(
+        browser.screen().selected_video().unwrap().id,
+        "anilist:1:26"
+    );
+
+    browser.refresh();
+    assert!(
+        matches!(&browser.pending, Some(Request::Episodes { media_id, .. }) if media_id == "1")
+    );
+    let refreshed = miruro_browser::anilist_series(serde_json::json!({
+        "id":"1", "catalog_provider":"anilist", "title":{"romaji":"Cowboy Bebop"},
+        "status":"FINISHED", "episode_count":27
+    }))
+    .unwrap();
+    browser.accept(browser.generation, Ok(Response::Series(refreshed)));
+    assert_eq!(browser.screen().len(), 27);
+}
+
+#[test]
+fn anilist_unknown_count_allows_explicit_selection_and_provider_local_collections() {
+    let directory = Directory::new();
+    let path = directory.0.join("config.toml");
+    let options = Options::parse_from(["tubular", "--anilist"]);
+    let mut browser = Browser::new(
+        options,
+        path.clone(),
+        config::Config::default(),
+        State::open(&path).unwrap(),
+    );
+    let series = miruro_browser::anilist_series(serde_json::json!({"id":"1","catalog_provider":"anilist","title":{"romaji":"Unknown total"},"status":"RELEASING","episode_count":null,"catalog_count":null})).unwrap();
+    browser.push(Screen::new(Content::Series {
+        media: series.media,
+        data: Some(series.episodes),
+    }));
+    browser.edit_search();
+    assert!(browser.episode_input);
+    browser.input = Some("7".into());
+    browser.key(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
+    let selected = browser.screen().selected_video().unwrap();
+    assert_eq!(selected.id, "anilist:1:7");
+    browser.save(CollectionKind::Saved);
+    let mut legacy = selected.clone();
+    legacy.id = "miruro:1:7".into();
+    legacy.channel = Some("Miruro".into());
+    browser.state.save(CollectionKind::Saved, &legacy).unwrap();
+    browser.collection(CollectionKind::Saved);
+    assert_eq!(browser.screen().len(), 1);
+    assert_eq!(browser.screen().selected_video().unwrap().id, selected.id);
+    browser.history(false);
+    for invalid in ["0", "01", "-1", "2147483648"] {
+        browser.select_episode(invalid);
+        assert!(browser.screen().error.is_some());
+        assert_eq!(browser.screen().len(), 1);
+    }
+    browser.select_episode("8");
+    assert!(browser.screen().error.is_none());
+    browser.screen_mut().toggle_checked();
+    browser.select_episode("7");
+    browser.screen_mut().toggle_checked();
+    let queue = browser.screen().playback_videos();
+    assert_eq!(
+        queue
+            .iter()
+            .map(|video| video.id.as_str())
+            .collect::<Vec<_>>(),
+        ["anilist:1:8", "anilist:1:7"]
+    );
+    assert_eq!(
+        crate::youtube::video_url(&queue[0].id).unwrap(),
+        "https://zokoanime.video/stream/ani/1/8/sub"
+    );
+    browser.key(KeyEvent::new(KeyCode::Char('/'), KeyModifiers::NONE));
+    assert!(matches!(browser.screen().content, Content::Catalog { .. }));
+    assert!(!browser.episode_input);
+}
+
+fn anilist_browser(directory: &Directory, count: u32) -> Browser {
+    let mut browser = directory.browser(None);
+    browser.provider = Provider::AniList;
+    browser.options.anilist = true;
+    browser.options.miruro = false;
+    browser.state.select_catalog(Provider::AniList);
+    let series = miruro_browser::anilist_series(serde_json::json!({
+        "id":"1", "catalog_provider":"anilist", "title":{"romaji":"Dragon Ball"},
+        "status":"FINISHED", "episode_count":count, "catalog_count":count,
+        "episode_duration_minutes":25, "format":"TV", "season_year":1986
+    }))
+    .unwrap();
+    browser.push(Screen::new(Content::Series {
+        media: series.media,
+        data: Some(series.episodes),
+    }));
+    browser
+}
+
+#[test]
+fn source_candidates_use_rendered_offset_and_three_line_viewport_not_series_size() {
+    use ratatui::{Terminal, backend::TestBackend};
+    let directory = Directory::new();
+    let mut browser = anilist_browser(&directory, 153);
+    let mut terminal = Terminal::new(TestBackend::new(80, 24)).unwrap();
+    terminal
+        .draw(|frame| browser.draw(frame, Duration::ZERO))
+        .unwrap();
+    let initial = browser.source_visible.clone();
+    assert!(initial.len() < 153);
+    assert_eq!(initial.first().unwrap(), "anilist:1:1");
+    let [_, _, content, _, _] = ui::browser_layout(terminal.backend().buffer().area, 1);
+    assert_eq!(
+        initial.len(),
+        usize::from(content.height.saturating_sub(2)) / 3
+    );
+    browser.select(Action::VideoLast);
+    terminal
+        .draw(|frame| browser.draw(frame, Duration::ZERO))
+        .unwrap();
+    let offset = browser.screen().selection.offset();
+    assert!(offset > 0);
+    assert_eq!(
+        browser.source_visible.first().unwrap(),
+        &format!("anilist:1:{}", offset + 1)
+    );
+    assert!(browser.source_visible.contains(&"anilist:1:153".into()));
+    assert!(
+        !browser
+            .source_visible
+            .iter()
+            .any(|key| initial.contains(key))
+    );
+    let selection = browser.screen().selected_key().unwrap().to_owned();
+    let now = Instant::now(); // Inject one fixed clock for every scheduler transition in this test.
+    browser.update_source_checks(now);
+    assert_eq!(
+        browser.source_checks.status(&selection),
+        Some(source_check::Status::Failed)
+    );
+    assert_eq!(browser.screen().selected_key(), Some(selection.as_str()));
+    browser.update_source_checks(now);
+    assert_eq!(browser.screen().selected_key(), Some(selection.as_str()));
+    assert_eq!(browser.screen().len(), 153);
+}
+
+#[test]
+fn source_eligibility_pauses_under_popups_loading_and_catalogs_then_resumes_from_frame() {
+    let directory = Directory::new();
+    let mut browser = anilist_browser(&directory, 10);
+    let candidates = |browser: &mut Browser| {
+        browser.update_visible_sources(8);
+        browser.source_visible.clone()
+    };
+    assert_eq!(candidates(&mut browser), ["anilist:1:1", "anilist:1:2"]);
+    browser.help = Some(0);
+    assert!(candidates(&mut browser).is_empty());
+    browser.help = None;
+    browser.preview = Some(PreviewMode::Info);
+    assert!(candidates(&mut browser).is_empty());
+    browser.preview = None;
+    browser.input = Some(String::new());
+    assert!(candidates(&mut browser).is_empty());
+    browser.input = None;
+    browser.removal = Some((CollectionKind::Saved, vec![]));
+    assert!(candidates(&mut browser).is_empty());
+    browser.removal = None;
+    browser.modal = Some(LibraryModal::Categories {
+        names: vec![],
+        checked: BTreeSet::new(),
+        picker: Picker::default(),
+    });
+    assert!(candidates(&mut browser).is_empty());
+    browser.modal = None;
+    browser.request(
+        Request::Episodes {
+            media_id: "1".into(),
+            slug: String::new(),
+        },
+        Intent::Series("1".into()),
+    );
+    assert!(candidates(&mut browser).is_empty());
+    browser.invalidate();
+    assert!(browser.source_visible.is_empty());
+    assert_eq!(candidates(&mut browser).len(), 2);
+    browser.history(false);
+    assert!(candidates(&mut browser).is_empty());
+    browser.history(true);
+    assert_eq!(candidates(&mut browser).len(), 2);
+    browser.provider = Provider::Miruro;
+    assert!(candidates(&mut browser).is_empty());
+}
+
+#[test]
+fn source_checks_are_session_only_and_collection_rows_keep_selection_checks_and_watch_state() {
+    use ratatui::{Terminal, backend::TestBackend};
+    let directory = Directory::new();
+    let mut browser = anilist_browser(&directory, 10);
+    let video = browser.screen().selected_video().unwrap();
+    browser.save(CollectionKind::Saved);
+    browser.set_watch_status(WatchStatus::Watched);
+    browser.collection(CollectionKind::Saved);
+    browser.screen_mut().toggle_checked();
+    let checks = browser.screen().checked.clone();
+    let saved = fs::read(directory.0.join("saved-videos.toml")).unwrap();
+    let watch = fs::read(directory.0.join("watch-state.toml")).unwrap();
+    let config = fs::read(&browser.config_path).unwrap();
+    let mut terminal = Terminal::new(TestBackend::new(80, 24)).unwrap();
+    terminal
+        .draw(|frame| browser.draw(frame, Duration::ZERO))
+        .unwrap();
+    assert_eq!(
+        browser.source_visible.as_slice(),
+        std::slice::from_ref(&video.id)
+    );
+    assert_eq!(browser.rows()[0].height(), 3);
+    let now = Instant::now(); // Fixed injected clock; no elapsed-time dependency.
+    browser.update_source_checks(now);
+    assert_eq!(
+        browser.source_checks.status(&video.id),
+        Some(source_check::Status::Failed)
+    );
+    assert_eq!(browser.screen().selected_key(), Some(video.id.as_str()));
+    assert_eq!(browser.screen().checked, checks);
+    assert!(browser.state.is_watched(&video.id));
+    assert_eq!(
+        fs::read(directory.0.join("saved-videos.toml")).unwrap(),
+        saved
+    );
+    assert_eq!(
+        fs::read(directory.0.join("watch-state.toml")).unwrap(),
+        watch
+    );
+    assert_eq!(fs::read(&browser.config_path).unwrap(), config);
+    browser.refresh();
+    assert_eq!(browser.source_checks.status(&video.id), None);
+    assert_eq!(browser.screen().selected_key(), Some(video.id.as_str()));
+    browser.provider = Provider::Miruro;
+    assert_eq!(browser.rows()[0].height(), 2);
+}
+
+#[test]
+fn episode_three_lines_align_after_shared_marker_and_leave_metadata_second() {
+    use ratatui::{Terminal, backend::TestBackend};
+    let directory = Directory::new();
+    let mut browser = anilist_browser(&directory, 2);
+    let video = browser.screen().selected_video().unwrap();
+    browser.set_watch_status(WatchStatus::Watched);
+    let mut terminal = Terminal::new(TestBackend::new(100, 30)).unwrap();
+    terminal
+        .draw(|frame| browser.draw(frame, Duration::ZERO))
+        .unwrap();
+    let buffer = terminal.backend().buffer();
+    let find = |needle: &str| {
+        (0..buffer.area.height)
+            .find_map(|y| {
+                let line = (0..buffer.area.width)
+                    .map(|x| buffer[(x, y)].symbol())
+                    .collect::<String>();
+                line.find(needle)
+                    .map(|byte| (line[..byte].chars().count(), y))
+            })
+            .unwrap()
+    };
+    let title = find("Episode 1");
+    let metadata = find("25 min avg");
+    let source = find(browser.source_checks.label(&video.id));
+    assert_eq!(metadata, (title.0, title.1 + 1));
+    assert_eq!(source, (title.0, title.1 + 2));
+    assert_eq!(browser.screen().selected_key(), Some(video.id.as_str()));
+    for metadata in ["25 min avg", "TV", "1986 series"] {
+        assert!(browser.screen().rows[0].details.contains(metadata));
+    }
+    browser.screen_mut().toggle_checked();
+    terminal
+        .draw(|frame| browser.draw(frame, Duration::ZERO))
+        .unwrap();
+    assert!(browser.state.is_watched(&video.id));
+    assert_eq!(browser.screen().checked, [video.id]);
+}

tests/unit/video_state.rs

@@ -59,7 +59,7 @@ fn record(id: &str, event: &str, eligible: bool, position: f64) -> String {
 
 fn miruro_video(episode: u32) -> Video {
     Video {
-        id: Identity::new("opaque_Show-1".into(), episode)
+        id: Identity::miruro("opaque_Show-1".into(), episode)
             .unwrap()
             .key(),
         title: format!("Example show · Episode {episode}"),
@@ -278,17 +278,6 @@ fn miruro_library_does_not_overwrite_external_creations_or_edits() {
     assert_eq!(fs::read(&path).unwrap(), changed);
 }
 
-fn miruro_source(video: &Video) -> SourceDocument {
-    SourceDocument {
-        version: 1,
-        url: "https://cdn.example/video.m3u8?token=private-token".into(),
-        headers: [("Referer".into(), "https://player.example/".into())].into(),
-        identity: Identity::from_key(&video.id).unwrap(),
-        title: Some(video.title.clone()),
-        subtitles: Vec::new(),
-    }
-}
-
 fn miruro_record(
     video: &Video,
     event: &str,
@@ -591,6 +580,70 @@ fn watched_write_failure_keeps_memory_unchanged_and_retries_consumed_reports() {
     assert!(!state.poll_progress().unwrap());
 }
 
+#[cfg(unix)]
+#[test]
+fn historical_progress_sessions_leave_descriptors_available_for_subprocesses() {
+    const CHILD: &str = "TUBULAR_PROGRESS_DESCRIPTOR_TEST";
+    if std::env::var_os(CHILD).is_none() {
+        let output = std::process::Command::new(std::env::current_exe().unwrap())
+            .args([
+                "--exact",
+                "video_state::tests::historical_progress_sessions_leave_descriptors_available_for_subprocesses",
+                "--test-threads=1",
+            ])
+            .env(CHILD, "1")
+            .output()
+            .unwrap();
+        assert!(
+            output.status.success(),
+            "{}\n{}",
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr)
+        );
+        return;
+    }
+
+    // Isolate the process-wide limit from the rest of the test suite.
+    let mut limit = libc::rlimit {
+        rlim_cur: 0,
+        rlim_max: 0,
+    };
+    // SAFETY: limit is valid writable storage; only this child process is affected.
+    unsafe {
+        assert_eq!(libc::getrlimit(libc::RLIMIT_NOFILE, &mut limit), 0);
+        limit.rlim_cur = limit.rlim_cur.min(64);
+        assert_eq!(libc::setrlimit(libc::RLIMIT_NOFILE, &limit), 0);
+    }
+
+    let directory = TestDirectory::new();
+    let mut state = State::open(&directory.config()).unwrap();
+    let video = video();
+    let reports = state.progress_files(&vec![video.clone(); 96]).unwrap();
+    for report in &reports {
+        register_identity(report, &video.id).unwrap();
+        append(report, record(&video.id, "progress", false, 0.0).as_bytes());
+    }
+    let last = reports.last().unwrap();
+    let completion = record(&video.id, "closed", true, 95.0);
+    append(last, &completion.as_bytes()[..completion.len() - 1]);
+    drop(state);
+
+    let mut state = State::open(&directory.config()).unwrap();
+    for _ in 0..12 {
+        state.poll_progress().unwrap();
+    }
+    assert!(!state.is_watched(&video.id));
+    append(last, b"\n");
+    for _ in 0..6 {
+        state.poll_progress().unwrap();
+    }
+    assert!(state.is_watched(&video.id));
+    let output = std::process::Command::new("/usr/bin/true")
+        .output()
+        .expect("progress monitoring must leave descriptors available for subprocess pipes");
+    assert!(output.status.success());
+}
+
 #[test]
 fn partial_reports_survive_restart_and_bad_siblings_do_not_block_completion() {
     let directory = TestDirectory::new();
@@ -1092,17 +1145,16 @@ fn watching_and_session_snapshots_reject_oversized_files() {
 }
 
 #[test]
-fn miruro_sessions_recover_collections_and_watching_without_persisting_sources_in_state() {
+fn miruro_sessions_recover_collections_and_watching_without_source_files() {
     let directory = TestDirectory::new();
     let video = miruro_video(1);
     let mut state = State::open(&directory.config()).unwrap();
     for kind in [CollectionKind::WatchLater, CollectionKind::Saved] {
         state.save(kind, &video).unwrap();
     }
-    let source = miruro_source(&video);
-    let (source_file, report) = state.miruro_session(&video, &source).unwrap();
-    let source_bytes = fs::read(&source_file).unwrap();
-    assert_eq!(source_bytes, serde_json::to_vec(&source).unwrap());
+    let report = state.progress_file(&video).unwrap();
+    register_identity(&report, &video.id).unwrap();
+    assert!(!report.with_file_name("source.json").exists());
     assert!(!report.exists());
     assert_eq!(
         fs::read_to_string(report.with_file_name("video-id")).unwrap(),
@@ -1112,7 +1164,6 @@ fn miruro_sessions_recover_collections_and_watching_without_persisting_sources_i
     {
         use std::os::unix::fs::PermissionsExt;
         for path in [
-            &source_file,
             &report.with_file_name("video-id"),
             &report.with_file_name("video.toml"),
         ] {
@@ -1172,18 +1223,6 @@ fn miruro_sessions_recover_collections_and_watching_without_persisting_sources_i
         assert_eq!(stored.timestamp, video.timestamp);
         assert_eq!(stored.publication_date, video.publication_date);
     }
-    for path in [
-        directory.0.join("watch-later.toml"),
-        directory.0.join("saved-videos.toml"),
-        directory.0.join("currently-watching.toml"),
-        directory.0.join("watch-state.toml"),
-        report.with_file_name("video.toml"),
-    ] {
-        let contents = fs::read_to_string(path).unwrap();
-        assert!(!contents.contains("private-token"));
-        assert!(!contents.contains("cdn.example"));
-    }
-    assert_eq!(fs::read(source_file).unwrap(), source_bytes);
     assert!(report.exists());
 }
 
@@ -1193,9 +1232,8 @@ fn miruro_v2_requires_matching_episode_eligible_known_duration_and_threshold() {
         let directory = TestDirectory::new();
         let mut state = State::open(&directory.config()).unwrap();
         let video = miruro_video(1);
-        let (_, report) = state
-            .miruro_session(&video, &miruro_source(&video))
-            .unwrap();
+        let report = state.progress_file(&video).unwrap();
+        register_identity(&report, &video.id).unwrap();
         append(
             &report,
             miruro_record(&miruro_video(2), event, true, 100.0, Some(100.0)).as_bytes(),
@@ -1232,9 +1270,8 @@ fn miruro_v2_rejects_invalid_wire_schemas_numbers_and_namespaces() {
     let directory = TestDirectory::new();
     let mut state = State::open(&directory.config()).unwrap();
     let video = miruro_video(1);
-    let (_, report) = state
-        .miruro_session(&video, &miruro_source(&video))
-        .unwrap();
+    let report = state.progress_file(&video).unwrap();
+    register_identity(&report, &video.id).unwrap();
     let valid = miruro_record(&video, "progress", true, 100.0, Some(100.0));
     for line in [
         valid.replace("\"version\":2", "\"version\":1"),
@@ -1264,9 +1301,8 @@ fn miruro_partial_reports_and_bad_siblings_recover_after_restart() {
     let directory = TestDirectory::new();
     let mut state = State::open(&directory.config()).unwrap();
     let video = miruro_video(1);
-    let (source, report) = state
-        .miruro_session(&video, &miruro_source(&video))
-        .unwrap();
+    let report = state.progress_file(&video).unwrap();
+    register_identity(&report, &video.id).unwrap();
     let completion = miruro_record(&video, "closed", true, 95.0, Some(100.0));
     append(&report, &completion.as_bytes()[..completion.len() - 1]);
     assert!(!state.poll_progress().unwrap());
@@ -1274,9 +1310,8 @@ fn miruro_partial_reports_and_bad_siblings_recover_after_restart() {
     let mut state = State::open(&directory.config()).unwrap();
     assert!(!state.poll_progress().unwrap());
     let other = miruro_video(2);
-    let (_, bad) = state
-        .miruro_session(&other, &miruro_source(&other))
-        .unwrap();
+    let bad = state.progress_file(&other).unwrap();
+    register_identity(&bad, &other.id).unwrap();
     append(&bad, b"not json\n");
     append(&report, b"\n");
     assert!(state.poll_progress().is_err());
@@ -1285,7 +1320,6 @@ fn miruro_partial_reports_and_bad_siblings_recover_after_restart() {
     assert!(state.poll_progress().unwrap());
     assert!(!state.poll_progress().unwrap());
     drop(state);
-    assert!(source.exists());
     assert!(report.exists());
     let state = State::open(&directory.config()).unwrap();
     assert!(state.is_watched(&video.id));
@@ -1339,23 +1373,15 @@ fn miruro_state_rejects_catalog_rows_bad_titles_and_youtube_metadata() {
 }
 
 #[test]
-fn miruro_source_sessions_validate_binding_size_and_maximum_identity_marker() {
+fn miruro_sessions_recover_the_maximum_identity_marker() {
     let directory = TestDirectory::new();
     let mut state = State::open(&directory.config()).unwrap();
     let mut video = miruro_video(i32::MAX as u32);
-    video.id = Identity::new("a".repeat(512), i32::MAX as u32)
+    video.id = Identity::miruro("a".repeat(512), i32::MAX as u32)
         .unwrap()
         .key();
-    let mut source = miruro_source(&video);
-    source.identity.episode -= 1;
-    assert!(state.miruro_session(&video, &source).is_err());
-    assert!(state.streams.is_empty());
-    source.identity = Identity::from_key(&video.id).unwrap();
-    source.title = Some("x".repeat(MAX_SOURCE_BYTES));
-    assert!(state.miruro_session(&video, &source).is_err());
-    assert!(state.streams.is_empty());
-    source.title = None;
-    let (_, report) = state.miruro_session(&video, &source).unwrap();
+    let report = state.progress_file(&video).unwrap();
+    register_identity(&report, &video.id).unwrap();
     append(
         &report,
         miruro_record(&video, "ended", true, 95.0, Some(100.0)).as_bytes(),
@@ -1375,9 +1401,8 @@ fn miruro_recovery_rejects_missing_snapshots_and_overlong_identity_markers() {
         let directory = TestDirectory::new();
         let mut state = State::open(&directory.config()).unwrap();
         let video = miruro_video(1);
-        let (_, report) = state
-            .miruro_session(&video, &miruro_source(&video))
-            .unwrap();
+        let report = state.progress_file(&video).unwrap();
+        register_identity(&report, &video.id).unwrap();
         if missing_snapshot {
             fs::remove_file(report.with_file_name("video.toml")).unwrap();
         } else {
@@ -1433,3 +1458,119 @@ fn youtube_v1_reports_keep_canonical_urls_and_unknown_field_tolerance() {
     assert!(state.poll_progress().unwrap());
     assert!(state.is_watched(&video.id));
 }
+
+#[test]
+fn player_launch_rejects_invalid_and_duplicate_batch_identities_before_creating_sessions() {
+    use crate::youtube::PlayerLaunch;
+    use std::ffi::OsStr;
+
+    let directory = TestDirectory::new();
+    let mut state = State::open(&directory.config()).unwrap();
+    for id in [
+        "",
+        "--help",
+        "jNQXAC9IVRw&list=other",
+        "日本語",
+        "miruro:opaque_Show-1:0",
+        "miruro:opaque_Show-1:01",
+        "miruro:opaque_Show-1:2147483648",
+        "miruro:../other:1",
+        "miruro:opaque_Show-1:1&ep=2",
+        "miruro-series:opaque_Show-1",
+    ] {
+        let mut invalid_video = video();
+        invalid_video.id = id.into();
+        assert!(matches!(
+            PlayerLaunch::start(&[video(), invalid_video], OsStr::new("terebi"), &mut state, false),
+            Err(error) if error.kind() == io::ErrorKind::InvalidInput
+        ));
+    }
+    for videos in [vec![], vec![video(), video()]] {
+        assert!(matches!(
+            PlayerLaunch::start(&videos, OsStr::new("terebi"), &mut state, false),
+            Err(error) if error.kind() == io::ErrorKind::InvalidInput
+        ));
+    }
+    assert!(!state.sessions.exists());
+    assert!(state.streams.is_empty());
+}
+
+#[test]
+fn progress_batch_prevalidates_snapshots_and_session_capacity() {
+    let directory = TestDirectory::new();
+    let mut state = State::open(&directory.config()).unwrap();
+    let mut invalid_video = miruro_video(2);
+    invalid_video.title = "invalid\nmetadata".into();
+    assert!(state.progress_files(&[video(), invalid_video]).is_err());
+    assert!(!state.sessions.exists());
+    assert!(state.streams.is_empty());
+    for _ in 0..MAX_STREAMS - 1 {
+        state
+            .streams
+            .push(ProgressStream::new(directory.0.join("unused.jsonl")));
+    }
+    assert!(state.progress_files(&[video(), miruro_video(2)]).is_err());
+    assert!(!state.sessions.exists());
+    assert_eq!(state.streams.len(), MAX_STREAMS - 1);
+}
+
+#[test]
+fn anilist_library_and_progress_are_isolated_from_opaque_miruro_ids() {
+    let directory = TestDirectory::new();
+    let mut state = State::open(&directory.config()).unwrap();
+    let mut legacy_show = show();
+    legacy_show.id = "1".into();
+    legacy_show.metadata["id"] = serde_json::json!("1");
+    state
+        .save_show(&legacy_show, &["Legacy".into()].into())
+        .unwrap();
+    let legacy_bytes = fs::read(directory.0.join("miruro-library.toml")).unwrap();
+    state.select_catalog(Provider::AniList);
+    assert!(state.shows().is_empty());
+    assert!(state.save_show(&legacy_show, &BTreeSet::new()).is_err());
+    let mut ani_show = legacy_show.clone();
+    ani_show.metadata["catalog_provider"] = serde_json::json!("anilist");
+    state.save_show(&ani_show, &["New".into()].into()).unwrap();
+    let mut ani = miruro_video(1);
+    ani.id = Identity::anilist("1".into(), 1).unwrap().key();
+    ani.channel = Some("AniList".into());
+    let mut legacy = miruro_video(1);
+    legacy.id = Identity::miruro("1".into(), 1).unwrap().key();
+    for item in [&ani, &legacy, &video()] {
+        state.save(CollectionKind::Saved, item).unwrap();
+    }
+    let report = state.progress_file(&ani).unwrap();
+    register_identity(&report, &ani.id).unwrap();
+    append(
+        &report,
+        miruro_record(&legacy, "ended", true, 100.0, Some(100.0)).as_bytes(),
+    );
+    append(
+        &report,
+        miruro_record(&ani, "progress", false, 20.0, Some(100.0)).as_bytes(),
+    );
+    drop(state);
+    let mut state = State::open(&directory.config()).unwrap();
+    assert!(state.poll_progress().unwrap());
+    assert!(state.contains(CollectionKind::Watching, &ani.id));
+    assert!(!state.is_watched(&ani.id));
+    assert!(!state.is_watched(&legacy.id));
+    append(
+        &report,
+        miruro_record(&ani, "ended", true, 95.0, Some(100.0)).as_bytes(),
+    );
+    assert!(state.poll_progress().unwrap());
+    assert!(state.is_watched(&ani.id));
+    assert!(!state.is_watched(&legacy.id));
+    assert!(state.contains(CollectionKind::Saved, &legacy.id));
+    assert_eq!(state.shows()[0].tags, ["Legacy".into()].into());
+    state.select_catalog(Provider::AniList);
+    assert_eq!(state.shows()[0].tags, ["New".into()].into());
+    assert_eq!(
+        fs::read(directory.0.join("miruro-library.toml")).unwrap(),
+        legacy_bytes
+    );
+    let mut forged = ani.clone();
+    forged.channel = Some("Miruro".into());
+    assert!(state.progress_file(&forged).is_err());
+}

tests/unit/youtube.rs

@@ -532,14 +532,36 @@ mod subprocesses {
         assert_reaped(pid);
     }
 }
-
 #[test]
-fn player_launch_rejects_unsafe_video_ids_before_spawning() {
-    for id in ["", "--help", "jNQXAC9IVRw&list=other", "日本語"] {
-        assert!(matches!(
-            PlayerLaunch::start(id, OsStr::new("terebi"), Path::new("progress.jsonl")),
-            Err(error) if error.kind() == io::ErrorKind::InvalidInput
-        ));
+fn video_urls_preserve_provider_identity_and_reject_invalid_keys() {
+    assert_eq!(
+        video_url("jNQXAC9IVRw").unwrap(),
+        "https://www.youtube.com/watch?v=jNQXAC9IVRw"
+    );
+    assert_eq!(
+        video_url("miruro:opaque_ID-7:3").unwrap(),
+        "https://barelystarted.miruro.tv/watch/opaque_ID-7/episode?ep=3"
+    );
+    assert_eq!(
+        video_url("anilist:1:3").unwrap(),
+        "https://zokoanime.video/stream/ani/1/3/sub"
+    );
+    for id in [
+        "",
+        "--help",
+        "jNQXAC9IVRw&list=other",
+        "miruro:id:0",
+        "miruro:id:03",
+        "miruro:../id:3",
+        "anilist:01:3",
+        "anilist:1:03",
+        "anilist:1:0",
+        "anilist:1:2147483648",
+    ] {
+        assert_eq!(
+            video_url(id).unwrap_err().kind(),
+            io::ErrorKind::InvalidInput
+        );
     }
 }
 
@@ -765,6 +787,120 @@ fn search_sanitizes_display_metadata_and_rejects_invalid_envelopes() {
     }
 }
 
+#[test]
+fn channel_playlist_listing_uses_flat_ids_sanitizes_and_deduplicates() {
+    // yt-dlp's /playlists tab returns URL rows, not nested playlist contents.
+    let playlists = channel_playlists(
+        r#"{"_type":"playlist","entries":[
+            {"_type":"url","ie_key":"YoutubeTab","id":"PLJ5MFiMfElFA","title":"Rust\u001b"},
+            null,42,{},{"id":"PLJ5MFiMfElFA","title":"Duplicate"},
+            {"id":"PLabcdefghij&list=other","title":"Unsafe"},
+            {"id":"rQ_J9WH6CGk","title":"Video"},
+            {"id":"PLabcdefghij","title":null},
+            {"id":"PLabcdefghij","title":"\u001b\n"},
+            {"id":"OLAK5uy_abcdefghij","title":"Release"}
+        ]}"#,
+    )
+    .unwrap();
+    assert_eq!(
+        playlists
+            .iter()
+            .map(|playlist| (playlist.id.as_str(), playlist.title.as_str()))
+            .collect::<Vec<_>>(),
+        [("PLJ5MFiMfElFA", "Rust"), ("OLAK5uy_abcdefghij", "Release")]
+    );
+    assert!(channel_playlists(r#"{"entries":[]}"#).unwrap().is_empty());
+    for output in ["not JSON", "{}", r#"{"entries":null}"#, r#"{"entries":{}}"#] {
+        assert!(channel_playlists(output).is_err());
+        assert!(playlist_results(output).is_err());
+    }
+}
+
+#[test]
+fn playlist_ids_are_safe_and_support_music_and_legacy_families() {
+    for id in [
+        "PLJ5MFiMfElFA",
+        "OLAK5uy_abcdefghij-_",
+        "UUabcdefghij",
+        "RDabcdefghij",
+        "RDMM",
+        "WL",
+        "LL",
+        "LM",
+    ] {
+        assert!(valid_playlist_id(id), "{id}");
+        assert!(matches!(
+            Job::playlist(id, 0),
+            Err(error) if error.kind() == io::ErrorKind::InvalidInput
+        ));
+    }
+    for id in [
+        "",
+        "--bad",
+        "PLshort",
+        "PLabcdefghij&x=1",
+        "PLabcdefghij#x",
+        "PLabcdefghij/",
+    ] {
+        assert!(!valid_playlist_id(id), "{id}");
+        assert!(matches!(
+            Job::playlist(id, 1),
+            Err(error) if error.kind() == io::ErrorKind::InvalidInput
+        ));
+    }
+    assert!(Job::channel_playlists("https://example.com/@channel").is_err());
+}
+
+#[test]
+fn playlists_preserve_order_repeats_and_creator_identity_with_raw_pagination() {
+    let mut entries = vec![serde_json::Value::Null; PAGE_SIZE];
+    entries[0] = serde_json::json!({
+        "id":"l-GaaivVJCE","title":"First\u{1b}","timestamp":100
+    });
+    entries[1] = serde_json::json!({
+        "id":"SLV9AJxnb1U","title":"Second","timestamp":300,
+        "channel":"Another creator","channel_id":"UC4QobU6STFB0P71PMvOGN5A"
+    });
+    entries[2] = serde_json::json!({"id":"bad","title":"Invalid"});
+    entries[3] = serde_json::json!({"id":"jNQXAC9IVRw","title":null});
+    entries[4] = serde_json::json!({
+        "id":"jNQXAC9IVRw","title":"Members only","availability":"subscriber_only"
+    });
+    entries[5] = entries[0].clone();
+    entries[6] = serde_json::json!({
+        "id":"rQ_J9WH6CGk","title":"Owner upload","channel_id":"UCaYhcUwRBNscFNUKTjgPFiA"
+    });
+    let output = serde_json::json!({
+        "channel_id":"UCaYhcUwRBNscFNUKTjgPFiA","uploader_id":"@RustVideos",
+        "channel":"Rust\u{1b}","entries":entries
+    });
+    let page = playlist_results(&output.to_string()).unwrap();
+    assert!(page.has_more);
+    assert!(page.feed_progress.is_empty());
+    assert_eq!(
+        page.videos
+            .iter()
+            .map(|video| video.id.as_str())
+            .collect::<Vec<_>>(),
+        ["l-GaaivVJCE", "SLV9AJxnb1U", "l-GaaivVJCE", "rQ_J9WH6CGk"]
+    );
+    assert_eq!(page.videos[0].title, "First");
+    assert_eq!(page.videos[0].channel, None);
+    assert_eq!(page.videos[0].channel_id, None);
+    assert_eq!(page.videos[0].uploader_id, None);
+    assert_eq!(page.videos[3].channel.as_deref(), Some("Rust"));
+    assert_eq!(page.videos[3].uploader_id.as_deref(), Some("@RustVideos"));
+    assert_eq!(page.videos[1].channel.as_deref(), Some("Another creator"));
+    assert_eq!(
+        page.videos[1].channel_id.as_deref(),
+        Some("UC4QobU6STFB0P71PMvOGN5A")
+    );
+    assert_eq!(page.videos[1].uploader_id, None);
+    assert!(!playlist_results(r#"{"entries":[]}"#).unwrap().has_more);
+    assert!(playlist_results(r#"{"channel_id":"invalid","entries":[]}"#).is_err());
+    assert!(playlist_results(r#"{"uploader_id":"@bad\u001b","entries":[]}"#).is_err());
+}
+
 #[test]
 fn feeds_merge_newest_first_deduplicate_and_inherit_channel_identity() {
     let output = r#"{"channel_id":"UCaYhcUwRBNscFNUKTjgPFiA","uploader_id":"@RustVideos","channel":"Rust\u001b","entries":[null,{"id":"l-GaaivVJCE","title":"Older","timestamp":100},{"id":"jNQXAC9IVRw","title":"Unknown","timestamp":null}]}

tests/unit/youtube_catalog.rs

@@ -0,0 +1,271 @@
+use super::super::{FeedCursor, PAGE_SIZE, feed_results};
+use super::*;
+use serde_json::{Value, json};
+
+const CHANNEL: &str = "https://www.youtube.com/channel/UCaaaaaaaaaaaaaaaaaaaaaa";
+const CHANNEL_ID: &str = "UCaaaaaaaaaaaaaaaaaaaaaa";
+
+fn album(index: usize) -> Value {
+    json!({"id": format!("PL{index:032}"), "_type": "url"})
+}
+
+fn track(id: &str, title: &str, timestamp: i64) -> Value {
+    json!({"id": id, "title": title, "timestamp": timestamp})
+}
+
+fn response(entries: Vec<Value>, total: Option<usize>) -> String {
+    json!({"entries": entries, "playlist_count": total}).to_string()
+}
+
+fn accept(releases: &mut ChannelReleases, entries: Vec<Value>, total: Option<usize>) {
+    // Construct, but never execute, the next extractor request.
+    releases.command().unwrap();
+    releases.accept(&response(entries, total)).unwrap();
+}
+
+fn range(releases: &ChannelReleases) -> (usize, usize) {
+    let command = releases.command().unwrap();
+    let args: Vec<_> = command.get_args().collect();
+    let value = |flag: &str| {
+        args.windows(2).find(|pair| pair[0] == flag).unwrap()[1]
+            .to_str()
+            .unwrap()
+            .parse::<usize>()
+            .unwrap()
+    };
+    (value("--playlist-start"), value("--playlist-end"))
+}
+
+fn feed_output(releases: ChannelReleases) -> String {
+    assert!(releases.done());
+    let entries = releases.into_entries();
+    json!({"channel_id": CHANNEL_ID, "entries": entries}).to_string()
+}
+
+#[test]
+fn mixed_feed_merges_uploads_and_release_tracks_without_advancing_other_channels() {
+    let mut cursor = FeedCursor::default();
+    let requests = cursor.plan(2).unwrap();
+    let channels = vec![CHANNEL.into(), "https://www.youtube.com/@ordinary".into()];
+    let mut expansion = FeedExpansion::new(&channels, &requests);
+    let uploads = json!({
+        "channel_id": CHANNEL_ID,
+        "uploader_id": "@artist",
+        "playlist_count": 3,
+        "entries": [
+            track("aaaaaaaaaaa", "Upload", 100),
+            track("ddddddddddd", "Second upload", 100),
+            track("eeeeeeeeeee", "Third upload", 100)
+        ]
+    });
+    let ordinary = json!({
+        "entries": (0..30).map(|index| {
+            track(&format!("b{index:010}"), "Ordinary upload", 50)
+        }).collect::<Vec<_>>()
+    });
+    expansion
+        .accept_uploads(&format!("{uploads}\n{ordinary}"))
+        .unwrap();
+    let releases = expansion.channels[0].releases.as_mut().unwrap();
+    accept(releases, vec![album(1)], Some(1));
+    let mut tracks = vec![
+        track("aaaaaaaaaaa", "Release duplicate", 200),
+        track("ccccccccccc", "peppermint parkway", 300),
+    ];
+    tracks.resize(27, Value::Null);
+    accept(releases, tracks, Some(27));
+
+    let mut finished_uploads = Job::spawn_all(std::iter::empty::<Command>()).unwrap();
+    let output = expansion.poll(&mut finished_uploads).unwrap().unwrap();
+    let page = feed_results(&output, &requests).unwrap();
+    assert_eq!(
+        page.feed_progress
+            .iter()
+            .map(|p| p.count)
+            .collect::<Vec<_>>(),
+        [30, 30]
+    );
+    assert_eq!(page.videos.len(), 34);
+    assert_eq!(page.videos[0].id, "ccccccccccc");
+    assert_eq!(page.videos[0].channel_id.as_deref(), Some(CHANNEL_ID));
+    assert_eq!(page.videos[0].uploader_id.as_deref(), Some("@artist"));
+    assert_eq!(page.videos[1].title, "Release duplicate");
+    cursor.accept(&page.feed_progress).unwrap();
+    assert!(
+        cursor
+            .plan(2)
+            .unwrap()
+            .iter()
+            .all(|request| request.start == 31)
+    );
+}
+
+#[test]
+fn release_tracks_reach_the_feed_without_refunding_filtered_or_duplicate_rows() {
+    let mut cursor = FeedCursor::default();
+    let requests = cursor.plan(1).unwrap();
+    let mut releases = ChannelReleases::new(CHANNEL.into(), 0, requests[0].count);
+    accept(&mut releases, vec![album(1), album(2)], Some(2));
+    accept(
+        &mut releases,
+        vec![
+            track("aaaaaaaaaaa", "Older upload duplicate", 100),
+            json!({"id": "bbbbbbbbbbb", "title": "Members", "availability": "subscriber_only"}),
+            json!({"id": "invalid", "title": "Invalid video ID"}),
+        ],
+        Some(3),
+    );
+    assert!(!releases.done());
+    assert_eq!(range(&releases), (1, PAGE_SIZE - 3));
+    let mut second_album = vec![
+        track("aaaaaaaaaaa", "Newer release duplicate", 200),
+        track("ccccccccccc", "peppermint parkway", 300),
+    ];
+    second_album.resize(PAGE_SIZE - 3, Value::Null);
+    accept(&mut releases, second_album, None);
+
+    let page = feed_results(&feed_output(releases), &requests).unwrap();
+    assert_eq!(page.feed_progress[0].count, PAGE_SIZE);
+    assert!(page.has_more);
+    assert_eq!(page.videos.len(), 2);
+    assert_eq!(page.videos[0].id, "ccccccccccc");
+    assert_eq!(page.videos[0].title, "peppermint parkway");
+    assert_eq!(page.videos[1].title, "Newer release duplicate");
+    assert!(
+        page.videos
+            .iter()
+            .all(|video| video.channel_id.as_deref() == Some(CHANNEL_ID))
+    );
+    cursor.accept(&page.feed_progress).unwrap();
+    assert_eq!(cursor.plan(1).unwrap()[0].start, PAGE_SIZE + 1);
+}
+
+#[test]
+fn release_skip_subtracts_exhausted_album_totals_even_when_the_requested_start_is_past_end() {
+    for (skip, second_range) in [(3, (1, 2)), (5, (3, 4)), (8, (6, 7))] {
+        let mut releases = ChannelReleases::new(CHANNEL.into(), skip, 2);
+        accept(&mut releases, vec![album(1), album(2), album(3)], Some(3));
+        assert_eq!(range(&releases), (skip + 1, skip + 2));
+        // yt-dlp returns the exact album total even if the range starts beyond it.
+        accept(&mut releases, vec![], Some(3));
+        assert_eq!(range(&releases), second_range);
+        if skip == 8 {
+            accept(&mut releases, vec![], Some(4));
+            assert_eq!(range(&releases), (2, 3));
+        }
+        accept(
+            &mut releases,
+            vec![
+                track("ddddddddddd", "First selected track", 200),
+                track("eeeeeeeeeee", "Second selected track", 100),
+            ],
+            None,
+        );
+        let request = super::super::FeedRequest {
+            channel: 0,
+            start: skip + 1,
+            count: 2,
+        };
+        let page = feed_results(&feed_output(releases), &[request]).unwrap();
+        assert_eq!(page.feed_progress[0].count, 2);
+        assert_eq!(
+            page.videos
+                .iter()
+                .map(|video| video.id.as_str())
+                .collect::<Vec<_>>(),
+            ["ddddddddddd", "eeeeeeeeeee"]
+        );
+    }
+}
+
+#[test]
+fn discovery_continues_after_sixty_albums_and_keeps_later_tracks() {
+    let mut releases = ChannelReleases::new(CHANNEL.into(), 0, 2);
+    assert_eq!(range(&releases), (1, 60));
+    accept(&mut releases, (0..60).map(album).collect(), None);
+    for _ in 0..60 {
+        assert!(!releases.done());
+        accept(&mut releases, vec![], Some(0));
+    }
+    assert!(!releases.done());
+    assert_eq!(range(&releases), (61, 120));
+    accept(&mut releases, vec![album(60)], Some(61));
+    accept(
+        &mut releases,
+        vec![track("fffffffffff", "Track on album 61", 100)],
+        Some(1),
+    );
+    let request = super::super::FeedRequest {
+        channel: 0,
+        start: 1,
+        count: 2,
+    };
+    let page = feed_results(&feed_output(releases), &[request]).unwrap();
+    assert_eq!(page.videos.len(), 1);
+    assert_eq!(page.videos[0].title, "Track on album 61");
+    assert_eq!(page.feed_progress[0].count, 1);
+    assert!(!page.has_more);
+}
+
+#[test]
+fn only_missing_releases_tab_during_discovery_is_normal_exhaustion() {
+    let missing = "ERROR: [youtube:tab] channel: This channel does not have a releases tab";
+    let mut ordinary = ChannelReleases::new(CHANNEL.into(), 0, 2);
+    ordinary.command().unwrap();
+    ordinary.accept_error(missing.into()).unwrap();
+    assert!(ordinary.done());
+    assert!(ordinary.into_entries().is_empty());
+
+    for error in [
+        "ERROR: network timeout",
+        "ERROR: This channel does not have a releases tab; retry later",
+    ] {
+        let mut discovery = ChannelReleases::new(CHANNEL.into(), 0, 2);
+        discovery.command().unwrap();
+        assert_eq!(discovery.accept_error(error.into()).unwrap_err(), error);
+    }
+    for error in [missing, "ERROR: album is private"] {
+        let mut releases = ChannelReleases::new(CHANNEL.into(), 0, 2);
+        accept(&mut releases, vec![album(1)], Some(1));
+        releases.command().unwrap();
+        assert_eq!(releases.accept_error(error.into()).unwrap_err(), error);
+    }
+}
+
+#[test]
+fn malformed_envelopes_and_exhaustion_counts_are_errors_not_empty_catalogs() {
+    for output in [
+        "not JSON",
+        "{}",
+        r#"{"entries":null,"playlist_count":0}"#,
+        r#"{"entries":[],"playlist_count":"0"}"#,
+        r#"{"entries":[],"playlist_count":-1}"#,
+    ] {
+        let mut releases = ChannelReleases::new(CHANNEL.into(), 0, 2);
+        releases.command().unwrap();
+        assert!(
+            releases.accept(output).is_err(),
+            "accepted malformed discovery: {output}"
+        );
+        let mut releases = ChannelReleases::new(CHANNEL.into(), 0, 2);
+        accept(&mut releases, vec![album(1)], Some(1));
+        releases.command().unwrap();
+        assert!(
+            releases.accept(output).is_err(),
+            "accepted malformed album: {output}"
+        );
+    }
+}
+
+#[test]
+fn empty_discovery_needs_no_total_but_skipping_an_empty_album_does() {
+    let mut discovery = ChannelReleases::new(CHANNEL.into(), 0, 2);
+    accept(&mut discovery, vec![], None);
+    assert!(discovery.done());
+    assert!(discovery.into_entries().is_empty());
+
+    let mut releases = ChannelReleases::new(CHANNEL.into(), 5, 2);
+    accept(&mut releases, vec![album(1), album(2)], Some(2));
+    releases.command().unwrap();
+    assert!(releases.accept(&response(vec![], None)).is_err());
+}