fix(player+lidarr): mini-player sync race; durable approve + dedup

player: setQueueFromTracks fast-starts a single source at player-index 0
while the full queue is broadcast, so the transient currentIndexStream→0
emission clobbered the correct mediaItem with queue.value[0] (the first
track). Mini bar / playlist marker pinned to the wrong track until a
later index event (~the "passive ~30s recovery"). Track a logical-index
base so the player→queue mapping stays correct during the fill window;
also fixes the latent forward-fill auto-advance off-by-base.

lidarr #50: approving no longer fails when Lidarr is down. Approve
records the decision durably first, then best-effort adds; the
reconciler idempotently (re)sends unconfirmed adds every tick until they
stick (new additive lidarr_add_confirmed_at; AddArtist/AddAlbum map
Lidarr's "already exists" 400 → ErrAlreadyExists). No failed-state or
expiry by design — Lidarr keeps trying, operator monitors.

lidarr #51: Create() is now idempotent — a non-terminal request for the
same MBID returns the existing row instead of inserting a duplicate.

Rewrites the obsolete LidarrUnreachable_503 test to assert the durable-
approve contract; threads a client factory into NewReconciler.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/lidarrrequests/reconciler.go

@@ -2,6 +2,7 @@ package lidarrrequests
 
 import (
 	"context"
+	"fmt"
 	"log/slog"
 	"time"
 
@@ -11,16 +12,20 @@ import (
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/eventbus"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/lidarr"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/lidarrconfig"
 )
 
 // Reconciler is a background worker that periodically scans approved
-// lidarr_requests and transitions them to completed when their target
-// track/album/artist has appeared in the local library (matched by MBID).
-// Errors per-row are logged at WARN and do not abort the tick.
+// lidarr_requests. For rows whose Lidarr add hasn't been confirmed it
+// (re)sends the add idempotently until it sticks; for confirmed rows it
+// transitions them to completed when their target track/album/artist has
+// appeared in the local library (matched by MBID). Errors per-row are
+// logged at WARN and do not abort the tick.
 type Reconciler struct {
 	pool      *pgxpool.Pool
 	lidarrCfg *lidarrconfig.Service
+	clientFn  func() *lidarr.Client
 	logger    *slog.Logger
 	bus       *eventbus.Bus
 	tick      time.Duration
@@ -28,12 +33,19 @@ type Reconciler struct {
 }
 
 // NewReconciler constructs a Reconciler with production defaults:
-// 5-minute tick, batch size 50. Pass nil for bus when no SSE publishing
-// is desired (tests, or environments without the event stream enabled).
-func NewReconciler(pool *pgxpool.Pool, cfg *lidarrconfig.Service, logger *slog.Logger, bus *eventbus.Bus) *Reconciler {
+// 5-minute tick, batch size 50. clientFn is the per-tick Lidarr client
+// factory (same pattern as Service) so config changes apply without a
+// restart; pass nil to disable the add-retry path. Pass nil for bus when
+// no SSE publishing is desired (tests, or environments without the event
+// stream enabled).
+func NewReconciler(pool *pgxpool.Pool, cfg *lidarrconfig.Service, clientFn func() *lidarr.Client, logger *slog.Logger, bus *eventbus.Bus) *Reconciler {
+	if clientFn == nil {
+		clientFn = func() *lidarr.Client { return nil }
+	}
 	return &Reconciler{
 		pool:      pool,
 		lidarrCfg: cfg,
+		clientFn:  clientFn,
 		logger:    logger,
 		bus:       bus,
 		tick:      5 * time.Minute,
@@ -118,7 +130,7 @@ func (r *Reconciler) tickOnce(ctx context.Context) error {
 	}
 
 	for _, row := range rows {
-		if err := r.reconcileRow(ctx, q, row); err != nil {
+		if err := r.reconcileRow(ctx, q, cfg, row); err != nil {
 			r.logger.Warn("lidarrrequests: reconciler row failed",
 				"request_id", row.ID,
 				"kind", row.Kind,
@@ -129,10 +141,23 @@ func (r *Reconciler) tickOnce(ctx context.Context) error {
 	return nil
 }
 
-// reconcileRow checks the library for a match and, if found, calls
-// CompleteLidarrRequest. It returns an error only for unexpected DB
-// failures; a no-match is not an error.
-func (r *Reconciler) reconcileRow(ctx context.Context, q *dbq.Queries, row dbq.LidarrRequest) error {
+// reconcileRow drives a request forward by one step. If Lidarr hasn't
+// confirmed the add yet it (re)sends it and returns — the import can't
+// land before Lidarr has the add, so there's nothing to match this tick.
+// Once confirmed, it checks the library for a match and, if found, calls
+// CompleteLidarrRequest. Returns an error only for unexpected failures
+// (the add retry's transient error included, so tickOnce logs WARN and
+// it's retried next tick — "Lidarr just keeps trying"); a no-match is
+// not an error.
+func (r *Reconciler) reconcileRow(ctx context.Context, q *dbq.Queries, cfg lidarrconfig.Config, row dbq.LidarrRequest) error {
+	if !row.LidarrAddConfirmedAt.Valid {
+		if err := r.ensureLidarrAdd(ctx, q, cfg, row); err != nil {
+			return err
+		}
+		// ensureLidarrAdd either confirmed the add or no-op'd (Lidarr
+		// client unavailable). Fall through to import-matching so an
+		// item already present in the library still completes this tick.
+	}
 	switch row.Kind {
 	case dbq.LidarrRequestKindArtist:
 		return r.reconcileArtist(ctx, q, row)
@@ -146,6 +171,26 @@ func (r *Reconciler) reconcileRow(ctx context.Context, q *dbq.Queries, row dbq.L
 	}
 }
 
+// ensureLidarrAdd (re)sends the Lidarr add for an approved request whose
+// add hasn't been confirmed. On success (including ErrAlreadyExists,
+// handled inside sendLidarrAdd) it stamps lidarr_add_confirmed_at so this
+// stops re-sending and the next tick moves to import-matching. A failure
+// is returned so tickOnce logs WARN and the row is retried next tick;
+// there is intentionally no failed-state or attempt cap — per product
+// decision Lidarr just keeps trying and the operator monitors Lidarr.
+func (r *Reconciler) ensureLidarrAdd(ctx context.Context, q *dbq.Queries, cfg lidarrconfig.Config, row dbq.LidarrRequest) error {
+	client := r.clientFn()
+	if client == nil {
+		// Lidarr disabled mid-flight; tickOnce already gates on
+		// cfg.Enabled, so this is just defensive — nothing to do.
+		return nil
+	}
+	if err := sendLidarrAdd(ctx, client, cfg, row); err != nil {
+		return fmt.Errorf("lidarr add retry: %w", err)
+	}
+	return q.MarkLidarrRequestAddConfirmed(ctx, row.ID)
+}
+
 func (r *Reconciler) reconcileArtist(ctx context.Context, q *dbq.Queries, row dbq.LidarrRequest) error {
 	var artistID pgtype.UUID
 	err := r.pool.QueryRow(ctx,

internal/lidarrrequests/reconciler_integration_test.go

@@ -121,7 +121,7 @@ func TestReconciler_MatchesArtistByMBID(t *testing.T) {
 		Kind: "artist", LidarrArtistMBID: artistMBID, ArtistName: "Boards of Canada",
 	})
 
-	rec := NewReconciler(pool, lidarrconfig.New(pool), newTestLogger(), nil)
+	rec := NewReconciler(pool, lidarrconfig.New(pool), nil, newTestLogger(), nil)
 	if err := rec.tickOnce(ctx); err != nil {
 		t.Fatalf("tickOnce: %v", err)
 	}
@@ -158,7 +158,7 @@ func TestReconciler_MatchesAlbumByMBID(t *testing.T) {
 		LidarrAlbumMBID: albumMBID, AlbumTitle: "Test Album",
 	})
 
-	rec := NewReconciler(pool, lidarrconfig.New(pool), newTestLogger(), nil)
+	rec := NewReconciler(pool, lidarrconfig.New(pool), nil, newTestLogger(), nil)
 	if err := rec.tickOnce(ctx); err != nil {
 		t.Fatalf("tickOnce: %v", err)
 	}
@@ -200,7 +200,7 @@ func TestReconciler_MatchesTrackViaAlbumMBID(t *testing.T) {
 		LidarrTrackMBID: trackMBID, TrackTitle: "Track One",
 	})
 
-	rec := NewReconciler(pool, lidarrconfig.New(pool), newTestLogger(), nil)
+	rec := NewReconciler(pool, lidarrconfig.New(pool), nil, newTestLogger(), nil)
 	if err := rec.tickOnce(ctx); err != nil {
 		t.Fatalf("tickOnce: %v", err)
 	}
@@ -234,7 +234,7 @@ func TestReconciler_NoMatchLeavesPending(t *testing.T) {
 		Kind: "artist", LidarrArtistMBID: "nonexistent-mbid-xyz", ArtistName: "Ghost Artist",
 	})
 
-	rec := NewReconciler(pool, lidarrconfig.New(pool), newTestLogger(), nil)
+	rec := NewReconciler(pool, lidarrconfig.New(pool), nil, newTestLogger(), nil)
 	if err := rec.tickOnce(ctx); err != nil {
 		t.Fatalf("tickOnce: %v", err)
 	}
@@ -278,7 +278,7 @@ func TestReconciler_AlreadyCompletedRowNotReprocessed(t *testing.T) {
 		t.Fatalf("CompleteLidarrRequest setup: %v", err)
 	}
 
-	rec := NewReconciler(pool, lidarrconfig.New(pool), newTestLogger(), nil)
+	rec := NewReconciler(pool, lidarrconfig.New(pool), nil, newTestLogger(), nil)
 	if err := rec.tickOnce(ctx); err != nil {
 		t.Fatalf("tickOnce: %v", err)
 	}
@@ -313,7 +313,7 @@ func TestReconciler_DisabledIsNoOp(t *testing.T) {
 		Kind: "artist", LidarrArtistMBID: artistMBID, ArtistName: "No-Op Artist",
 	})
 
-	rec := NewReconciler(pool, lidarrconfig.New(pool), newTestLogger(), nil)
+	rec := NewReconciler(pool, lidarrconfig.New(pool), nil, newTestLogger(), nil)
 	if err := rec.tickOnce(ctx); err != nil {
 		t.Fatalf("tickOnce: %v", err)
 	}
@@ -345,7 +345,7 @@ func TestReconciler_RunRunsAtLeastOneTick(t *testing.T) {
 		Kind: "artist", LidarrArtistMBID: mbid, ArtistName: "Run Artist",
 	})
 
-	rec := NewReconciler(pool, lidarrconfig.New(pool), newTestLogger(), nil)
+	rec := NewReconciler(pool, lidarrconfig.New(pool), nil, newTestLogger(), nil)
 	rec.tick = 25 * time.Millisecond
 
 	done := make(chan struct{})
@@ -399,7 +399,7 @@ func TestReconciler_TrackKindNoTracksInAlbumYet(t *testing.T) {
 		LidarrTrackMBID: "t-mbid-not-yet", TrackTitle: "Some Track",
 	})
 
-	rec := NewReconciler(pool, lidarrconfig.New(pool), newTestLogger(), nil)
+	rec := NewReconciler(pool, lidarrconfig.New(pool), nil, newTestLogger(), nil)
 	if err := rec.tickOnce(ctx); err != nil {
 		t.Fatalf("tickOnce: %v", err)
 	}
@@ -428,7 +428,7 @@ func TestReconciler_AlbumKindNoMatchInAlbumsTable(t *testing.T) {
 		LidarrAlbumMBID: "al-not-in-library", AlbumTitle: "Nope Album",
 	})
 
-	rec := NewReconciler(pool, lidarrconfig.New(pool), newTestLogger(), nil)
+	rec := NewReconciler(pool, lidarrconfig.New(pool), nil, newTestLogger(), nil)
 	if err := rec.tickOnce(ctx); err != nil {
 		t.Fatalf("tickOnce: %v", err)
 	}

internal/lidarrrequests/service.go

@@ -84,6 +84,23 @@ func (s *Service) Create(ctx context.Context, userID pgtype.UUID, p CreateParams
 		return dbq.LidarrRequest{}, err
 	}
 	q := dbq.New(s.pool)
+	// Dedup: if a non-terminal request for this MBID already exists,
+	// return it instead of inserting a duplicate. The Discover/search UI
+	// already hides requested candidates; this backstops races and direct
+	// API callers so we don't accrue duplicate request rows. Match on the
+	// new request's own-kind MBID (mirrors HasNonTerminalRequestForMBID).
+	dedupMBID := p.LidarrArtistMBID
+	switch p.Kind {
+	case "album":
+		dedupMBID = p.LidarrAlbumMBID
+	case "track":
+		dedupMBID = p.LidarrTrackMBID
+	}
+	if existing, derr := q.GetNonTerminalRequestForMBID(ctx, dedupMBID); derr == nil {
+		return existing, nil
+	} else if !errors.Is(derr, pgx.ErrNoRows) {
+		return dbq.LidarrRequest{}, fmt.Errorf("create: dedup check: %w", derr)
+	}
 	row, err := q.CreateLidarrRequest(ctx, dbq.CreateLidarrRequestParams{
 		UserID:           userID,
 		Kind:             dbq.LidarrRequestKind(p.Kind),
@@ -145,11 +162,14 @@ func (s *Service) ListForUser(ctx context.Context, userID pgtype.UUID, limit int
 	})
 }
 
-// Approve transitions a pending request to approved, snapshotting the
-// chosen quality profile + root folder, then calls Lidarr to actually
-// add the artist/album, then triggers a library scan. If Lidarr returns
-// an error, the request stays pending — the admin sees the error and
-// can retry without losing the request.
+// Approve records the admin's approval DURABLY first (snapshotting the
+// chosen quality profile + root folder), then makes a best-effort Lidarr
+// add and triggers a library scan. The add is no longer a gate: if Lidarr
+// is unreachable the request still becomes approved and the reconciler
+// idempotently (re)sends the add on each tick until it sticks (see
+// sendLidarrAdd + Reconciler.ensureLidarrAdd) — "Lidarr just keeps
+// trying" without the admin re-clicking. Pre-conditions (lidarr disabled,
+// not pending, defaults incomplete) still fail fast before any approval.
 func (s *Service) Approve(ctx context.Context, requestID pgtype.UUID, adminID pgtype.UUID, ov ApproveOverrides) (dbq.LidarrRequest, error) {
 	cfg, err := s.lidarrCfg.Get(ctx)
 	if err != nil {
@@ -182,23 +202,62 @@ func (s *Service) Approve(ctx context.Context, requestID pgtype.UUID, adminID pg
 		return dbq.LidarrRequest{}, ErrDefaultsIncomplete
 	}
 
-	// Lidarr requires a metadata profile id on POST /api/v1/artist (and
-	// on /api/v1/album when it has to create the parent artist). Prefer
-	// the operator's pinned choice from cfg; fall back to fetching the
-	// list and using the first when nothing's been saved yet (operators
-	// upgrading from before metadata-profile support landed).
+	// Record the approval durably FIRST so a Lidarr outage can't lose the
+	// admin's decision. The snapshotted qp/rf also feed the reconciler's
+	// retry, so a deferred add uses exactly what the admin approved with.
+	approved, err := dbq.New(s.pool).ApproveLidarrRequest(ctx, dbq.ApproveLidarrRequestParams{
+		ID:               requestID,
+		QualityProfileID: int32Ptr(qp),
+		RootFolderPath:   strPtr(rf),
+		DecidedBy:        adminID,
+	})
+	if err != nil {
+		return dbq.LidarrRequest{}, fmt.Errorf("approve: persist: %w", err)
+	}
+
+	// Best-effort immediate add for the common (Lidarr-up) path. Any
+	// failure is deliberately swallowed: the request is already durably
+	// approved and the reconciler retries the add on its next tick,
+	// leaving lidarr_add_confirmed_at NULL until it succeeds.
+	if addErr := sendLidarrAdd(ctx, client, cfg, approved); addErr == nil {
+		_ = dbq.New(s.pool).MarkLidarrRequestAddConfirmed(ctx, requestID)
+	}
+	s.scanFn()
+	return approved, nil
+}
+
+// sendLidarrAdd performs the idempotent Lidarr add for an approved
+// request. Used by Service.Approve (best-effort, common path) and by the
+// Reconciler (retry path). qp/rf come from the request's snapshot (set at
+// Approve time) with a config-default fallback; the metadata profile is
+// resolved from config, falling back to Lidarr's first profile for
+// operators who upgraded from before metadata-profile support. Treats
+// lidarr.ErrAlreadyExists as success — the artist/album is already in
+// Lidarr, which is exactly the desired end state.
+func sendLidarrAdd(ctx context.Context, client *lidarr.Client, cfg lidarrconfig.Config, row dbq.LidarrRequest) error {
+	qp := cfg.DefaultQualityProfileID
+	if row.QualityProfileID != nil && *row.QualityProfileID != 0 {
+		qp = int(*row.QualityProfileID)
+	}
+	rf := cfg.DefaultRootFolderPath
+	if row.RootFolderPath != nil && *row.RootFolderPath != "" {
+		rf = *row.RootFolderPath
+	}
+	if qp == 0 || rf == "" {
+		return ErrDefaultsIncomplete
+	}
 	mdProfileID := cfg.DefaultMetadataProfileID
 	if mdProfileID == 0 {
 		mdProfiles, mdErr := client.ListMetadataProfiles(ctx)
 		if mdErr != nil {
-			return dbq.LidarrRequest{}, fmt.Errorf("approve: list metadata profiles: %w", mdErr)
+			return fmt.Errorf("list metadata profiles: %w", mdErr)
 		}
 		if len(mdProfiles) == 0 {
-			return dbq.LidarrRequest{}, fmt.Errorf("approve: no metadata profiles configured in lidarr")
+			return fmt.Errorf("no metadata profiles configured in lidarr")
 		}
 		mdProfileID = mdProfiles[0].ID
 	}
-
+	var err error
 	switch row.Kind {
 	case dbq.LidarrRequestKindArtist:
 		err = client.AddArtist(ctx, lidarr.AddArtistParams{
@@ -224,22 +283,10 @@ func (s *Service) Approve(ctx context.Context, requestID pgtype.UUID, adminID pg
 			RootFolderPath:    rf,
 		})
 	}
-	if err != nil {
-		return dbq.LidarrRequest{}, fmt.Errorf("approve: lidarr add: %w", err)
+	if err != nil && !errors.Is(err, lidarr.ErrAlreadyExists) {
+		return err
 	}
-
-	approved, err := dbq.New(s.pool).ApproveLidarrRequest(ctx, dbq.ApproveLidarrRequestParams{
-		ID:               requestID,
-		QualityProfileID: int32Ptr(qp),
-		RootFolderPath:   strPtr(rf),
-		DecidedBy:        adminID,
-	})
-	if err != nil {
-		// Lidarr accepted but our DB update failed; admin should retry.
-		return dbq.LidarrRequest{}, fmt.Errorf("approve: persist: %w", err)
-	}
-	s.scanFn()
-	return approved, nil
+	return nil
 }
 
 // Reject transitions a pending request to rejected, recording notes and