feat: switch pixiv off — unregistered, unreachable, and refused at dispatch (406 phase 1)

Milestone 406 retires pixiv (rule 171) in two phases at the operator's explicit ask: switch it off, then later delete its code. This is the switch-off. Steps 2 and 3 ship together because each is a half-state of the other: unregistered but still in the extension, pixiv creator pages would offer a button the backend then refuses.

Reachability removed, never gated (rule 22 - no flag, no `if platform == "pixiv"`):
- platforms registry: pixiv unregistered, so /api/platforms, the source validator and quick-add all refuse it through their existing unknown-platform paths.
- NATIVE_INGESTER_PLATFORMS: pixiv removed.
- extension_service: pixiv's quick-add URL pattern removed (the Python half of the JS mirror).
- extension: pixiv's host permissions, content-script match, platform entry and artist pattern removed; popup's pixiv branches removed; and the whole pixiv PKCE OAuth flow cut out of background.js. That last one could not wait for phase 2 - a webRequest listener on a host the manifest no longer grants is at best dead and at worst a startup failure for the entire background script. On startup the extension now also removes any pixiv refresh token a browser still holds in storage, for the same reason as the server-side credential cleanup (3980).
- frontend: the extension card stops listing pixiv; SourceActions' copy of the native list drops it. platformColor keeps rendering a pixiv key so existing pixiv posts do not look broken.

The guard, and why a registry change alone was not enough. A source outlives its platform: the live instance still had one ENABLED pixiv source (step 1). Tracing it: the scheduler only selects enabled rows and every platform lookup uses .get(), so a disabled row is inert - but re-enabling it and pressing Check would have routed pixiv, no longer native, straight into the gallery-dl branch, which still has a pixiv extractor. And a worker can pick up a still-enabled row before a deploy's migration runs. So run_download and verify_source_credential - the two functions every download and credential probe pass through - now refuse any platform not in the registry: an unsupported_url failure for downloads, and an inconclusive (None, not False) verify, since nothing was probed so nothing was rejected. Generic by registration, so it covers deviantart's leftovers too. Positive-controlled: a supported gallery-dl platform must still reach gallery-dl, or a guard that refused everything would pass (rule 167).

Migration 0097 disables sources on retired platforms (pixiv, deviantart) and clears their failure state exactly as disabling through the app does (1285), so the stale row stops being scheduled and stops showing as failing. Nothing is deleted: removing a source can collide with uq_post_artist_external_id_null_source on real data, which is phase 2's step 6 to check. No post or image is touched.

Tests: the known-platform lists drop pixiv and gain retirement assertions beside deviantart's; pixiv's positive extension cases become negative guards; the pixiv sidecar post-URL test is deleted with the behaviour it tested; quick-add rejects a pixiv URL. The pixiv client/downloader/ingester suites stay - that code stays until phase 2.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SHQB1YukL3VyvMK8rcbmV9

extension/background/background.js

@@ -1,32 +1,35 @@
 /**
- * Background script — message router + Discord token capture
- * (webRequest) + Pixiv PKCE OAuth. Direct port of GS background.js;
- * api.js client points at FC instead of GS.
+ * Background script — message router + Discord token capture (webRequest).
+ * Direct port of GS background.js; api.js client points at FC instead of GS.
+ *
+ * pixiv's PKCE OAuth flow lived here until FC retired pixiv (milestone #406).
+ * It was removed together with pixiv's host permissions rather than left
+ * behind: a webRequest listener on a host the manifest no longer grants is at
+ * best dead and at worst a startup failure for the whole background script.
  */
 
 let discordToken = null;
 let discordTokenCapturedAt = null;
 
-let pixivRefreshToken = null;
-let pixivTokenCapturedAt = null;
-let pixivOAuthPending = null;
-
-const PIXIV_CLIENT_ID = 'MOBrBDS8blbauoSck0ZfDbtuzpyT';
-const PIXIV_CLIENT_SECRET = 'lsACyCD94FhDUtGTXi3QzcFE2uU1hqtDaKeqrdwj';
-const PIXIV_OAUTH_URL = 'https://app-api.pixiv.net/web/v1/login';
-const PIXIV_TOKEN_URL = 'https://oauth.secure.pixiv.net/auth/token';
-const PIXIV_REDIRECT_URI = 'https://app-api.pixiv.net/web/v1/users/auth/pixiv/callback';
-
 let initialized = false;
 
 async function ensureInitialized() {
   if (initialized) return;
   await api.init();
   await loadDiscordToken();
-  await loadPixivToken();
+  await forgetRetiredPixivToken();
   initialized = true;
 }
 
+// A browser that authenticated pixiv before the retirement still holds a live
+// OAuth refresh token in extension storage. Nothing reads it any more, and a
+// credential for a service FC no longer uses is a liability with no benefit
+// (the same reasoning as the server-side cleanup, issue #3980). Removing keys
+// that are absent is a no-op, so this is safe on every startup.
+async function forgetRetiredPixivToken() {
+  await browser.storage.local.remove(['pixivRefreshToken', 'pixivTokenCapturedAt']);
+}
+
 browser.runtime.onInstalled.addListener(() => ensureInitialized());
 browser.runtime.onStartup.addListener(() => ensureInitialized());
 ensureInitialized().catch(e => console.error('init failed:', e));
@@ -141,98 +144,6 @@ async function saveDiscordToken(token) {
   await browser.storage.local.set({ discordToken: token, discordTokenCapturedAt });
 }
 
-// ---- Pixiv PKCE OAuth ----
-
-async function loadPixivToken() {
-  const s = await browser.storage.local.get(['pixivRefreshToken', 'pixivTokenCapturedAt']);
-  pixivRefreshToken = s.pixivRefreshToken || null;
-  pixivTokenCapturedAt = s.pixivTokenCapturedAt || null;
-}
-
-async function savePixivToken(token) {
-  pixivRefreshToken = token;
-  pixivTokenCapturedAt = new Date().toISOString();
-  await browser.storage.local.set({ pixivRefreshToken: token, pixivTokenCapturedAt });
-}
-
-function generateCodeVerifier() {
-  const a = new Uint8Array(32);
-  crypto.getRandomValues(a);
-  return base64UrlEncode(a);
-}
-
-async function generateCodeChallenge(verifier) {
-  const data = new TextEncoder().encode(verifier);
-  const hash = await crypto.subtle.digest('SHA-256', data);
-  return base64UrlEncode(new Uint8Array(hash));
-}
-
-function base64UrlEncode(buf) {
-  return btoa(String.fromCharCode(...buf)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
-}
-
-async function initiatePixivOAuth() {
-  const codeVerifier = generateCodeVerifier();
-  const codeChallenge = await generateCodeChallenge(codeVerifier);
-
-  const params = new URLSearchParams({
-    code_challenge: codeChallenge,
-    code_challenge_method: 'S256',
-    client: 'pixiv-android',
-  });
-  const tab = await browser.tabs.create({ url: `${PIXIV_OAUTH_URL}?${params}` });
-
-  return new Promise((resolve, reject) => {
-    pixivOAuthPending = { codeVerifier, tabId: tab.id, resolve, reject };
-    setTimeout(() => {
-      if (pixivOAuthPending && pixivOAuthPending.tabId === tab.id) {
-        pixivOAuthPending = null;
-        reject(new Error('Pixiv OAuth timed out (5 min)'));
-      }
-    }, 5 * 60 * 1000);
-  });
-}
-
-browser.webRequest.onBeforeRedirect.addListener(
-  async (details) => {
-    if (!pixivOAuthPending) return;
-    if (details.tabId !== pixivOAuthPending.tabId) return;
-    const url = new URL(details.redirectUrl);
-    const code = url.searchParams.get('code');
-    if (!code) return;
-    const verifier = pixivOAuthPending.codeVerifier;
-    const resolve = pixivOAuthPending.resolve;
-    const reject = pixivOAuthPending.reject;
-    pixivOAuthPending = null;
-    try {
-      const tokenResp = await fetch(PIXIV_TOKEN_URL, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: new URLSearchParams({
-          client_id: PIXIV_CLIENT_ID,
-          client_secret: PIXIV_CLIENT_SECRET,
-          code,
-          code_verifier: verifier,
-          grant_type: 'authorization_code',
-          include_policy: 'true',
-          redirect_uri: PIXIV_REDIRECT_URI,
-        }),
-      });
-      const body = await tokenResp.json();
-      if (!body.refresh_token) {
-        reject(new Error(`Pixiv token exchange failed: ${JSON.stringify(body)}`));
-        return;
-      }
-      await savePixivToken(body.refresh_token);
-      try { await browser.tabs.remove(details.tabId); } catch {}
-      resolve(body.refresh_token);
-    } catch (e) {
-      reject(e);
-    }
-  },
-  { urls: ['https://app-api.pixiv.net/web/v1/users/auth/pixiv/callback*'] },
-);
-
 // Extract → verify → upload one cookie-auth platform. Returns a structured
 // outcome so the two callers (EXPORT_COOKIES single, EXPORT_ALL_COOKIES) shape
 // their own response + skip semantics. Verifies the captured cookies are
@@ -277,8 +188,6 @@ browser.runtime.onMessage.addListener(async (msg) => {
           }
         } else if (key === 'discord') {
           status[key] = { hasToken: !!discordToken, capturedAt: discordTokenCapturedAt };
-        } else if (key === 'pixiv') {
-          status[key] = { hasToken: !!pixivRefreshToken, capturedAt: pixivTokenCapturedAt };
         } else {
           status[key] = {};
         }
@@ -306,13 +215,6 @@ browser.runtime.onMessage.addListener(async (msg) => {
           await api.uploadCredentials('discord', 'token', discordToken);
           return { success: true };
         }
-        if (key === 'pixiv') {
-          if (!pixivRefreshToken) {
-            await initiatePixivOAuth();
-          }
-          await api.uploadCredentials('pixiv', 'token', pixivRefreshToken);
-          return { success: true };
-        }
         return { error: 'Unsupported platform.' };
       } catch (e) {
         return { error: e.message };

extension/lib/platforms.js

@@ -60,14 +60,6 @@ const PLATFORMS = {
     urlPattern: /^https?:\/\/(www\.)?discord\.com/,
     note: 'Open Discord in browser to capture token',
   },
-  pixiv: {
-    name: 'Pixiv',
-    domains: ['.pixiv.net', 'www.pixiv.net', 'pixiv.net'],
-    authType: 'token',
-    color: '#0096FA',
-    urlPattern: /^https?:\/\/(www\.)?pixiv\.net/,
-    note: 'Click to authenticate via OAuth',
-  },
 };
 
 /**
@@ -88,7 +80,6 @@ const PLATFORM_ARTIST_PATTERNS = {
   patreon:       /^https?:\/\/(www\.)?patreon\.com\/(?:cw\/|c\/)?(?!(?:home|search|messages|notifications|library|settings|posts)(?:[\/?#]|$))[^/?#]+/i,
   subscribestar: /^https?:\/\/(www\.)?subscribestar\.(com|adult)\/(?!feed$|messages$|library$)[^/?#]+\/?$/i,
   hentaifoundry: /^https?:\/\/(www\.)?hentai-foundry\.com\/user\/[^/?#]+/i,
-  pixiv:         /^https?:\/\/(www\.)?pixiv\.net\/(en\/)?users\/\d+/i,
 };
 
 function getPlatformFromUrl(url) {

extension/manifest.json

@@ -32,9 +32,6 @@
     "*://*.subscribestar.adult/*",
     "*://*.hentai-foundry.com/*",
     "*://*.discord.com/*",
-    "*://*.pixiv.net/*",
-    "*://app-api.pixiv.net/*",
-    "*://oauth.secure.pixiv.net/*",
     "*://*/*"
   ],
 
@@ -59,8 +56,7 @@
         "*://*.patreon.com/*",
         "*://*.subscribestar.com/*",
         "*://*.subscribestar.adult/*",
-        "*://*.hentai-foundry.com/*",
-        "*://*.pixiv.net/*"
+        "*://*.hentai-foundry.com/*"
       ],
       "js": ["lib/platforms.js", "content/content-script.js"],
       "css": ["content/content-script.css"],

extension/popup/popup.js

@@ -108,7 +108,7 @@ function createPlatformCard(key, platform, status) {
   card.className = 'platform-card';
   card.dataset.platform = key;
 
-  const isTokenOnly = platform.authType === 'token' && !['discord', 'pixiv'].includes(key);
+  const isTokenOnly = platform.authType === 'token' && key !== 'discord';
   const discordNeedsToken = key === 'discord' && !status.hasToken;
   if (isTokenOnly || discordNeedsToken) card.classList.add('disabled');
 
@@ -141,7 +141,6 @@ function createPlatformCard(key, platform, status) {
 
 function statusText(s, platform, key) {
   if (key === 'discord') return s.hasToken ? 'Token captured — ready' : 'Open Discord to capture token';
-  if (key === 'pixiv') return s.hasToken ? 'Token captured — ready' : 'Click to authenticate via OAuth';
   if (platform.authType === 'token') return 'Manual token entry required';
   if (s.error) return 'Error checking cookies';
   if (!s.hasCookies || !s.cookieCount) return 'No cookies — log in first';
@@ -149,7 +148,6 @@ function statusText(s, platform, key) {
 }
 function statusClass(s, platform, key) {
   if (key === 'discord') return s.hasToken ? 'ready' : 'no-cookies';
-  if (key === 'pixiv') return s.hasToken ? 'ready' : 'no-cookies';
   if (platform.authType === 'token') return 'no-cookies';
   if (s.error) return 'error';
   if (!s.hasCookies || !s.cookieCount) return 'no-cookies';

extension/test/platforms.spec.js

@@ -18,7 +18,6 @@ describe('getPlatformFromUrl', () => {
     expect(getPlatformFromUrl('https://subscribestar.adult/someone')).toBe('subscribestar')
     expect(getPlatformFromUrl('https://www.hentai-foundry.com/user/someone')).toBe('hentaifoundry')
     expect(getPlatformFromUrl('https://discord.com/channels/@me')).toBe('discord')
-    expect(getPlatformFromUrl('https://www.pixiv.net/en/users/123')).toBe('pixiv')
   })
 
   it('accepts http as well as https, with or without www', () => {
@@ -32,6 +31,15 @@ describe('getPlatformFromUrl', () => {
     expect(getPlatformFromUrl('')).toBe(null)
   })
 
+  it('returns null for pixiv, retired at milestone #406', () => {
+    // Retired on the operator's platform-focus decision (rule #171). Same guard
+    // as deviantart's below, and for the same reason: an absence nothing asserts
+    // is an absence a later edit can quietly undo.
+    expect(getPlatformFromUrl('https://www.pixiv.net/en/users/12345')).toBe(null)
+    expect(PLATFORMS.pixiv).toBeUndefined()
+    expect(PLATFORM_ARTIST_PATTERNS.pixiv).toBeUndefined()
+  })
+
   it('returns null for deviantart, retired at #3069', () => {
     // The 2026-07-05 product decision (FC downloaders = art-dedicated services
     // only) left deviantart wired for seven weeks. Asserting the negative is
@@ -80,12 +88,6 @@ describe('isArtistPage', () => {
     )
   })
 
-  it('matches Pixiv numeric user pages, with or without the /en/ prefix', () => {
-    expect(isArtistPage('https://www.pixiv.net/users/12345', 'pixiv')).toBe(true)
-    expect(isArtistPage('https://www.pixiv.net/en/users/12345', 'pixiv')).toBe(true)
-    expect(isArtistPage('https://www.pixiv.net/en/artworks/999', 'pixiv')).toBe(false)
-  })
-
   it('returns false for a platform with no artist pattern (discord)', () => {
     expect(isArtistPage('https://discord.com/channels/@me', 'discord')).toBe(false)
   })
@@ -123,8 +125,7 @@ describe('platform table integrity', () => {
     const samples = {
       patreon: 'https://www.patreon.com/cw/Atole',
       subscribestar: 'https://subscribestar.adult/someone',
-      hentaifoundry: 'https://www.hentai-foundry.com/user/someone',
-      pixiv: 'https://www.pixiv.net/en/users/12345'
+      hentaifoundry: 'https://www.hentai-foundry.com/user/someone'
     }
     for (const [key, url] of Object.entries(samples)) {
       expect(isArtistPage(url, key), `${key} artist pattern`).toBe(true)
@@ -179,8 +180,9 @@ describe('manifest.json agrees with the platform table', () => {
     for (const h of manifest.host_permissions) {
       if (h === '*://*/*') continue
       const host = hostOf(h)
-      // pixiv's OAuth/API hosts are pixiv infrastructure, not creator pages,
-      // so they are matched by suffix rather than by the domains list.
+      // Suffix matching lets a platform's infrastructure subdomains belong to
+      // it without listing each one. (It was added for pixiv's OAuth hosts,
+      // which left with pixiv at milestone #406; the rule itself is general.)
       const claimed = Object.values(PLATFORMS).some(
         (p) => p.domains.includes(host) || p.domains.some((d) => host.endsWith(d))
       )