The write-ahead log makes a single commit atomic but cannot rebuild a
database whose value type has changed, because its cells hold positional
MessagePack. Add a second, independent history of field-named JSON records
so a database can be reconstructed from any schema version the application
still knows how to migrate.
BPlusTreeRecoveryJournal owns the only mutation path: it appends and syncs a
journal record before touching the B+Tree, so a crash can only leave recovery
ahead - which open() repairs by rebuilding through staged publication - and
never leave the database ahead of its own history.
- recovery/format.rs: bounded frames (magic, length, BLAKE3) around JSON
payloads, with a hash chain and torn-tail tolerance.
- recovery/schema.rs: RecoverySchema, plus the one-step-at-a-time migration
loop; a record is only ever decoded at the current version.
- recovery/generation.rs: immutable manifests, the CURRENT pointer, crash-safe
generation selection, verified checkpoint publication and bounded pruning.
- v3: BPlusTreeMetadata::Recovery carries database id, schema fingerprint,
schema version and applied revision in the database header. Existing
metadata encoding is unchanged.
The schema fingerprint deliberately excludes the version, so raising
CURRENT_VERSION migrates an existing database instead of rejecting it.
New Features
Dialogs can now be stacked, allowing multiple dialogs to remain open while keeping only the topmost dialog interactive.
Added improved dialog layering and dismissal behavior for nested dialogs.
Improvements
Updated the Yew framework and related routing and hooks libraries.
Improved dialog handling so background layers remain visible without responding to clicks or results.
feat: complete DVR and improve streaming, security, configuration, and UI
Complete the Digital Video Recorder subsystem and add a broad set of
reliability, security, streaming, configuration, processing, and Web UI
improvements across Tuliprox.
DVR:
* complete live recording and provider-aware VOD download support
* add recording queue, workers, scheduling, and recurring recording rules
* add conflict detection and capacity-aware scheduling
* add pause, resume, retry, edit, cancel, and delete workflows
* add recording quotas and configurable retention policies
* add crash recovery and startup reconciliation
* add durable lifecycle notifications with per-channel retries
* add DVR health monitoring and diagnostic tooling
* add secure access to recordings, thumbnails, and subtitles
* add WebSocket notifications for recording and rule changes
* add Web UI management for recordings, rules, progress, and task state
* add RBAC, configuration, documentation, and i18n support
Streaming and HLS:
* fix shared-stream idle handling and release dead provider streams correctly
* stop tee streams when both client and cache consumers are gone
* cancel provisioning probes when client streams terminate
* fix transient HLS origin work accounting and intermittent 503 responses
* make stream buffer byte limits configurable
* make shared subscriber idle timeout configurable
* make initial HLS manifest wait timeout configurable
* add configurable TS chunk packet count
* add configurable HLS refresh failure backoff
* centralize redirect limits and retry jitter handling
* improve provider DNS refresh behavior and failover tuning
* preserve UTF-8 characters in catchup templates
* improve stream history validation and persistence error handling
Security:
* use constant-time credential comparisons
* harden library and media path handling against traversal and symlink escapes
* only trust forwarded client IP headers from configured trusted proxies
* redact credentials and sensitive URL data from logs
* reject invalid authentication status-code configuration
* deny users with unresolved plans or invalid content filters
* improve authentication error handling across proxy and HLS endpoints
Configuration and reliability:
* prevent invalid api-proxy.yml reloads from terminating the running server
* fully validate API proxy configuration before persisting changes
* log configuration and EPG cleanup failures instead of silently discarding them
* keep the last valid configuration active after failed hot reloads
* align backend and shared media-server validation
* remove duplicated path and normalization logic
* improve DNS-store recovery and Windows rename fallback handling
* reject invalid duration, timestamp, and numeric conversions safely
* fix playlist bouquet save error handling
* fix provider record update detection
* fix cache boundary handling
* improve startup and persistence failure diagnostics
Filtering, search, sorting, and processing:
* add field-scoped playlist explorer search
* centralize shared stream-history search field definitions
* extend the filter DSL with string, set, and numeric operators
* add EPG ID, channel number, and detected quality as filterable fields
* add filter dry-run preview API with match statistics and samples
* report filter syntax errors with line and column information
* add natural numeric-aware sorting
* add quality-aware channel deduplication
* add accent-independent deduplication
* move natural sorting and quality detection helpers into shared code
* persist explorer search-field selection across reloads
User plans and content access:
* add reusable API user plans for capability tiers
* support inherited cluster and connection limits with per-user overrides
* add plan-level and user-level content filters
* enforce content filters across Xtream, M3U, direct playback, resource access,
stream info, short EPG, categories, and XMLTV
* add trial plans with automatic expiry and Trial status
* add plan selection and content filtering to the user editor
* add full plan management to the API configuration Web UI
* migrate the API user database to schema V7 with plan and filter persistence
Web UI and accessibility:
* add live logging console to the stats page
* improve login error handling and prevent duplicate authentication requests
* add keyboard navigation to tabs, menus, tables, and search
* add ARIA roles, labels, validation state, and live-region feedback
* add confirmation dialogs for destructive actions
* add unsaved-change warnings and Ctrl/Cmd+S shortcuts
* add loading, progress, empty, and in-flight states across views
* improve dropdown and single-selection behavior
* add clipboard and credential-copy helpers
* persist table pagination and explorer search preferences
* improve error recovery when UI context providers are unavailable
* remove multiple panic-prone unwrap and browser API paths
* replace remaining hardcoded UI strings with translation keys
Maintenance:
* resolve backend and frontend compiler and Clippy warnings
* update packages and test fixtures
* consolidate duplicated helpers and validation logic
* improve documentation for configuration, filters, plans, DVR, and REST APIs
* add and update tests for migrations, filters, deduplication, sorting,
configuration, streaming, and accessibility behavior
New Features
- Added first-class Stalker/Ministra portal support, including live, VOD, series, playback-link refresh, and bulk EPG ingestion.
- Added Stalker configuration and batch/CSV support in the Web UI.
- Added playlist preview and playback handling for Stalker inputs, with support for partial refreshes.
Shared HLS cache session feature and aligns the runtime, cache, provisioning, recovery, custom-response, and documentation paths with the new shared-session model.
* perf: binary-search EPG programme lookup
Replaces the linear position() scan with a binary search via partition_point for EPG programmes. Reduces complexity to O(log p).
* perf: cache interned PlaylistItemType label
Avoids repetitive hash-map lookups during sorting and filtering. The five fixed labels are now interned once via OnceLock and returned as a cheap Arc clone.
* perf: avoid per-event String allocation in web-UI XMLTV parser
Uses borrowed Cow types instead of allocating a new String for every element name. Tracks the active text state using a small TextTag enum.
* perf: throttle per-chunk download control poll
Throttles the control_signal lock polling to a 200ms interval on multi-GB downloads to prevent CPU thrashing. Immediate actions (pause/cancel) remain guaranteed via control_notify.
* perf: pre-size filtered channel buffers in apply_filter_to_playlist
Pre-allocates the filtered channel vector based on the source group length. Eliminates step-by-step reallocations on large playlists.
* fix: surface playlist cache load failures instead of silent empty fallback
Replaces silent error swallowing with real error logging (distinguishing missing files from corruption) while preserving the empty fallback behavior.
* perf: remove redundant first drain loop in get_remote_content_as_file
Removes a dead, redundant loop. The stream body is now consumed only once, allowing the idle timeout to protect the transfer correctly.
* perf: back off instead of busy-spinning on empty client-stream chunks
Introduces a short Sleep backoff (Poll::Pending) when a provider sends continuous empty keep-alive chunks. Prevents the CPU from spinning hot.
* perf: make library orphan cleanup linear instead of O(n^2)
Reduces the complexity of cleaning up orphaned entries from O(n^2) to linear O(n). Loads the metadata library only once and pre-computes partitions.
* perf: indexed batched merge for series expansion instead of O(n^2) scans
Replaces expensive O(n^2) scans during series expansion with index-based batch processing. Builds temporary lookup indexes and merges groups linearly.
* perf: pre-size group flatten buffers to reduce reallocation churn
Pre-allocates target merge vectors and category indexes to eliminate repeated memory reallocations when flattening large target playlists.
* perf: stream custom provider playlist endpoint instead of materializing it
Switches from full in-memory materialization to lazy conversion and streaming of JSON/binary responses. Massively reduces the memory footprint.
* refactor: centralize InputType batch/family checks behind enum helpers
Moves scattered matches! checks for M3u/Xtream types into centralized enum helpers (is_batch(), etc.) to prevent logic drift.
* refactor: centralize XMLTV tag/attribute literals into named constants
Replaces hardcoded inline strings in the XMLTV parser with named constants (EPG_TAG_TITLE, etc.) as a single source of truth.
* refactor: derive GeoIpUpdateError Display/Error via thiserror
Replaces manual Display and Error implementations with the thiserror macro, allowing new error variants to self-document their formatting.
* refactor: attach per-cluster facts to XtreamCluster instead of scattered matches
Centralizes redundant API actions and collection name mappings directly onto the XtreamCluster struct instead of using scattered match blocks.
* refactor: centralize PlaylistItemType video/series classification
Introduces is_video() / is_series() on the enum to unify duplicate matches! checks across filters, probes, and tracking modules.
* feat: add per-stage summary logs to VOD/series resolve queueing
Adds a concise debug summary per processing stage (total counters and elapsed time) to make hot-path diagnostics easier without raising the log level.
* refactor: generate ItemField get/set from a single direct-field list
Uses a callback macro to synchronously generate both getter and setter blocks for directly-bound fields (Name, Url, etc.) from a single master list.
* refactor: derive input-type routing from a single capability descriptor
Bundles InputType behaviors (backends, connection rules) into a single capabilities() descriptor to prevent bugs when adding new variants.
* refactor: derive output-format routing from a single capability descriptor
Centralizes output format features (filter, EPG, and cache support) into a single TargetCapabilities descriptor instead of spreading logic across no-op match arms.
DarkBreakpoint