Make catalog pruning require complete snapshots and preserve retained titles

[OneHotTake]

Large catalog unions counted one absence per 500-ID batch, so a title could reach the three-sync pruning threshold during a single run. Skipped providers and partial catalog failures could also count as complete observations, and retirement did not reliably preserve owned or watched aliases.

This change requires a complete snapshot of every planned provider and every selected catalog before observing absences. Failed or missing pages, repeated pages before the configured cap, interval-skipped providers and an empty combined snapshot defer pruning. Partial results remain available for import.

• Count each absent broad-feed title once per complete sync using the entire ID union.
• Reset invalid older absence counters once, atomically with a durable policy marker; preserve catalog, user, block and retry state.
• Retire only eligible broad-feed rows, including unpublished metadata. Recheck ownership, typed IMDb/TMDB aliases, active external lists, collections, playback history, pins, saves, favorites and progress under the publication lock.
• Check all native versions, every user and series episodes. Unknown or failed native evidence retains the title. Existing paths must be safely inside configured managed roots; pathless metadata retirement authorizes no file deletion.
• Leave STRM removal to existing orphan cleanup rather than recursively delete directories. Report actual retired rows, not candidate or removed-file counts.

Validation: exact pinned Emby 4.10.0.40 ABI build passed 199/199 tests, zero skipped, and published the release DLL. The added tests use real SQLite persistence and controlled native adapters. Repository checks and diff checks passed. No production deployment, file deletion or playback claim is made by this PR.

Rollout: back up the database/configuration first. Three fresh successful observations are required after the one-time reset. Additive indexes and the policy marker can remain on binary rollback, but older binaries still have unsafe pruning; defer broad catalog sync while running them. Never restore an old database over newer user or acquisition state.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-30T17:03:03.305405Z	cac8b69	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cac8b6960d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Include the candidate's TMDB alias in native retention lookup

When a catalog row has an IMDb AioId and a populated TmdbId, but the matching owned or watched Emby item exposes only its TMDB ID, this builds only an IMDb query because the method receives just aioId. The native lookup then returns no match and permits retirement, bypassing the owned-media and user-state protections this change is intended to enforce. Pass the candidate's aliases and media type—or the full CatalogItem—and query both typed IDs, as OwnedMediaPreferenceService.BuildProviderIds already does.

AGENTS.md reference: AGENTS.md:L13-L14

Useful? React with 👍 / 👎.