feat: switch pixiv off — unregistered, unreachable, and refused at dispatch (406 phase 1)

Milestone 406 retires pixiv (rule 171) in two phases at the operator's explicit ask: switch it off, then later delete its code. This is the switch-off. Steps 2 and 3 ship together because each is a half-state of the other: unregistered but still in the extension, pixiv creator pages would offer a button the backend then refuses.

Reachability removed, never gated (rule 22 - no flag, no `if platform == "pixiv"`):
- platforms registry: pixiv unregistered, so /api/platforms, the source validator and quick-add all refuse it through their existing unknown-platform paths.
- NATIVE_INGESTER_PLATFORMS: pixiv removed.
- extension_service: pixiv's quick-add URL pattern removed (the Python half of the JS mirror).
- extension: pixiv's host permissions, content-script match, platform entry and artist pattern removed; popup's pixiv branches removed; and the whole pixiv PKCE OAuth flow cut out of background.js. That last one could not wait for phase 2 - a webRequest listener on a host the manifest no longer grants is at best dead and at worst a startup failure for the entire background script. On startup the extension now also removes any pixiv refresh token a browser still holds in storage, for the same reason as the server-side credential cleanup (3980).
- frontend: the extension card stops listing pixiv; SourceActions' copy of the native list drops it. platformColor keeps rendering a pixiv key so existing pixiv posts do not look broken.

The guard, and why a registry change alone was not enough. A source outlives its platform: the live instance still had one ENABLED pixiv source (step 1). Tracing it: the scheduler only selects enabled rows and every platform lookup uses .get(), so a disabled row is inert - but re-enabling it and pressing Check would have routed pixiv, no longer native, straight into the gallery-dl branch, which still has a pixiv extractor. And a worker can pick up a still-enabled row before a deploy's migration runs. So run_download and verify_source_credential - the two functions every download and credential probe pass through - now refuse any platform not in the registry: an unsupported_url failure for downloads, and an inconclusive (None, not False) verify, since nothing was probed so nothing was rejected. Generic by registration, so it covers deviantart's leftovers too. Positive-controlled: a supported gallery-dl platform must still reach gallery-dl, or a guard that refused everything would pass (rule 167).

Migration 0097 disables sources on retired platforms (pixiv, deviantart) and clears their failure state exactly as disabling through the app does (1285), so the stale row stops being scheduled and stops showing as failing. Nothing is deleted: removing a source can collide with uq_post_artist_external_id_null_source on real data, which is phase 2's step 6 to check. No post or image is touched.

Tests: the known-platform lists drop pixiv and gain retirement assertions beside deviantart's; pixiv's positive extension cases become negative guards; the pixiv sidecar post-URL test is deleted with the behaviour it tested; quick-add rejects a pixiv URL. The pixiv client/downloader/ingester suites stay - that code stays until phase 2.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SHQB1YukL3VyvMK8rcbmV9

backend/app/services/download_backends.py

@@ -28,12 +28,32 @@ from .patreon_ingester import PatreonIngester
 from .patreon_resolver import extract_vanity, resolve_campaign_id_for_source
 from .pixiv_client import user_id_from_url
 from .pixiv_ingester import PixivIngester
+from .platforms import known_platform_keys
 from .subscribestar_ingester import SubscribeStarIngester
 
 # Platforms whose download + verify go through the native ingester rather than
 # gallery-dl. gallery-dl still serves the rest (hentaifoundry, discord) until
-# they migrate too.
-NATIVE_INGESTER_PLATFORMS = frozenset({"patreon", "subscribestar", "pixiv"})
+# they migrate too. pixiv left this set when it was retired (milestone #406).
+NATIVE_INGESTER_PLATFORMS = frozenset({"patreon", "subscribestar"})
+
+
+def _unsupported_platform_message(platform: str) -> str | None:
+    """Why `platform` may not be downloaded or verified, or None if it may.
+
+    A source can outlive its platform. Retiring one (DeviantArt #3069, pixiv
+    #406) unregisters it, but its `Source` rows — and the `enabled` flag on
+    them — are data, and data survives a deploy. So this refuses at the two
+    functions every download and every credential probe pass through, instead
+    of trusting the scheduler's `enabled` filter and every future caller to
+    agree.
+
+    Without it a retired platform does not fail: it falls through to the
+    gallery-dl branch, which is precisely where a platform lands once it is no
+    longer native — and gallery-dl still has an extractor for it.
+    """
+    if platform in known_platform_keys():
+        return None
+    return f"{platform!r} is not a supported platform (retired or unknown)"
 
 # Mirrors patreon_resolver._CAMPAIGNS_URL — surfaced in resolution-failure
 # messages so the operator sees the exact lookup endpoint that was hit.
@@ -80,6 +100,13 @@ async def run_download(
     backfill state machine and owns phase 3.
     """
     platform = ctx["platform"]
+    refusal = _unsupported_platform_message(platform)
+    if refusal is not None:
+        return DownloadResult(
+            success=False, url=ctx["url"], artist_slug=ctx["artist_slug"],
+            platform=platform,
+            error_type=ErrorType.UNSUPPORTED_URL, error_message=refusal,
+        ), None
     if uses_native_ingester(platform):
         return await _run_native_ingester(
             ctx, source_config, mode, gdl, sync_session_factory
@@ -217,6 +244,11 @@ async def verify_source_credential(
     network / nothing to test). Callers don't branch on platform — they call
     this and render the result.
     """
+    refusal = _unsupported_platform_message(platform)
+    if refusal is not None:
+        # Inconclusive rather than False: nothing was probed, so nothing was
+        # rejected. False would tell the operator their credential is bad.
+        return None, refusal
     if uses_native_ingester(platform):
         # Native ingester platforms verify via their own lightweight auth probe.
         # SubscribeStar's probe takes the creator URL directly; Patreon's

backend/app/services/extension_service.py

@@ -55,10 +55,6 @@ _PLATFORM_PATTERNS: list[tuple[str, re.Pattern[str]]] = [
         r"^https?://(?:www\.)?hentai-foundry\.com/user/(?P<slug>[^/?#]+)",
         re.IGNORECASE,
     )),
-    ("pixiv", re.compile(
-        r"^https?://(?:www\.)?pixiv\.net/(?:en/)?users/(?P<slug>\d+)",
-        re.IGNORECASE,
-    )),
 ]
 
 

backend/app/services/platforms/__init__.py

@@ -11,7 +11,11 @@ Lifted from GallerySubscriber's
 and ~/.../extension/lib/platforms.js. Five platforms; auth_type and
 URL patterns match GS exactly so the existing browser extension
 hits FC unmodified. deviantart was dropped at #3069 (2026-08-27) —
-FC downloaders are art-dedicated services only.
+FC downloaders are art-dedicated services only. pixiv was retired at
+milestone #406 (2026-09-13, rule #171): unregistered here first, which
+switches it off everywhere this registry is consulted; `pixiv.py` and the
+pixiv client/downloader/ingester stay in the tree, uncalled, until the
+milestone's phase 2 deletes them.
 """
 
 from .base import (
@@ -22,7 +26,6 @@ from .base import (
 from .discord import INFO as _DISCORD
 from .hentaifoundry import INFO as _HENTAIFOUNDRY
 from .patreon import INFO as _PATREON
-from .pixiv import INFO as _PIXIV
 from .subscribestar import INFO as _SUBSCRIBESTAR
 
 PLATFORMS: dict[str, PlatformInfo] = {
@@ -32,7 +35,6 @@ PLATFORMS: dict[str, PlatformInfo] = {
         _SUBSCRIBESTAR,
         _HENTAIFOUNDRY,
         _DISCORD,
-        _PIXIV,
     )
 }