0.4.0 Beta 21 - Profile sync, chosen-source binge playback, and recovery fixes

Update every device you use with the same VortX account. Beta 21 repairs profile creation and edit propagation across Apple, Android and the website, keeps your chosen add-on/release preferred for the next episode and batch downloads, and closes specific playback-error, manual-seek and preview-exit failures. It also includes owner-scoped add-on changes and Mac window-control repairs. Apple build 259, Android version code 240.

This is a fresh release from current reviewed source, not an older beta checkout. It retains the working iPhone/iPad startup and touch-player fixes from Beta 20 and the earlier Android feature set. It uses the Latest beta channel while keeping its beta name.

What's fixed

New profiles and profile edits can travel between your devices. Apple settings notifications previously kept restarting an outgoing-sync delay even when no real syncable setting changed. That could leave incoming peer changes waiting behind a pending push. Only genuine changes now schedule that push, and suppressed restore notifications cannot escape into a delayed task and re-arm it.

An older device cannot treat an unrelated push as a newer profile edit. Profile merges now carry the actual roster modification clock instead of losing it on the push-side merge. Equal-content pulls still adopt the valid peer watermark. Local edits strictly advance the clock even if the device clock moves backward; malformed clocks are rejected. Remote imports do not manufacture a new local editing time.

Apple and Android exchange the full roster; dashboard edits preserve other fields. Apple now reads and writes the full roster carrier used by Android as well as its settings carrier, reconciles them by their own clocks, and treats a lossy profile summary as missing-ID information rather than permission to clear full same-ID settings. Incomplete full carriers are rejected. Generic settings restoration no longer overwrites the roster or this device's active viewer before the profile merge runs.

Android applies pending website profile edits. Dashboard-created profiles and sparse name, avatar, appearance, playback, PIN and disabled-add-on edits are consumed on the current account's push/pull path. Omitted properties preserve the stored record, including account bindings and discovery preferences. Invalid rows cannot consume a newer edit clock or clear valid state. Website 4K limits are translated to Android's real quality scale instead of accidentally filtering out every recognized 4K result. Deletes retain their tombstones.

A dashboard Save changes what you edited, not an old copy of everything. The separately deployed website now merges target-only edits against the latest account document, deep-merges playback preferences, keeps unknown sibling fields and pending creates/deletes, and preserves explicit PIN or disabled-add-on clears. Library actions cannot reactivate an already-acknowledged stale profile edit. UUID casing is consistent across edits, overlays, deletes and PIN handling. The edit clock advances beyond both the website clock and the native roster clock, including fractional timestamps and browser clock rollback; unsafe overflow fails before mutation.

Changing a profile is different from switching the viewer. The profile's shared properties sync. Which profile is selected stays local to each device, so a phone's selection does not unexpectedly switch the TV. These fixes require updated native clients as well as the deployed dashboard. They do not certify every broader library/Continue Watching sync path or migrate the pre-existing global roster clock into an account-specific schema.

Your selected add-on and release stay preferred for binge watching. Accepted explicit source choices retain their supplying add-on and binge group. Next/Previous, next-episode preloading, Continue Watching's episode-navigation resolver and batch-download selection now prefer that same release before generic picks. Pins retain precedence. Ordinary fresh Watch/source-list ordering keeps its existing behavior; automatic continuity does not rearrange the visible list. Unavailable or filtered preferred sources still fall through to ordered alternatives rather than stranding the episode.

A stalled preferred resolver cannot consume the whole episode handoff budget. Episode and batch selection use the same frozen candidate list. The complete resolution operation—including the local Usenet leg—is bounded, not just the TorBox cloud branch. Cancellation, replacement ownership and the caller's deadline are checked before using the result or enqueueing a download. Quality variants keep their supplying add-on instead of losing that identity along the route.

Batch downloads learn only a real accepted choice. A no-op because the episode is already queued, or a failed record, cannot replace the remembered series choice. Transfer retries continue after the accepted candidate without retrying already rejected candidates. This is chosen-release continuity, not a promise that every add-on exposes identical binge-group metadata or every provider link can resolve.

Playback errors stay errors instead of hiding an old stream behind them. Terminal failure retires asynchronous recovery and native AVPlayer activity. Later callbacks cannot remove the error overlay or restart the outgoing item. Retry keeps the episode that actually failed to resolve, including through timeout, duplicate and rejected-command cases, rather than silently using the episode last played successfully. The failed target is retired only after an accepted replacement.

A manual seek supersedes an old automatic resume. New viewer seek intent cancels obsolete initial-resume work so an old watchdog cannot later reinstall its previous target after the viewer has moved elsewhere. Timeline and resume-intent contracts cover this boundary. This is a specific state repair, not a claim that every source's nonzero-offset playback freeze is solved.

A requested mpv seek time is no longer mistaken for completed recovery. mpv can report its requested target before playback has restarted. Shared Apple seek accounting now carries source/generation-owned restart evidence, requires explicit non-seeking and non-EOF state, and revalidates queued callbacks before retiring a resume watchdog or completing paused recovery. An EOF-shaped restart or ambiguous overlapping command cannot certify completion. Paused and audio-only restart samples need no forced Play or advancing clock. Raw timeline feedback remains available. This is stronger restart/EOF accounting, not unconditional decoded-picture proof or a fix claim for the separate AIOStreams HTTP/VideoToolbox stall.

Exiting a preview belongs to the original playback session. Preview stop/close retains the original source, position and pause choice, and restores them only under the matching session owner. A stale preview completion cannot take over a newer source or episode.

Closing the skip editor saves your real position, not its preview. Preview return runs before progress/scrobble decisions. A same-media source or player change uses the original owned position; if the preview began while paused, the accepted replacement also stays paused. A new episode, newer Play action, rejected switch or obsolete mount cannot inherit that temporary handoff. Ordinary new playback retains its autoplay default.

Downloaded episodes resume from their own saved progress. iPhone, iPad and Mac now look up the download's library/episode identity instead of starting every completed file at zero or borrowing the detail page's resident title. The asynchronous lookup checks account ownership and the actual active profile before and after waiting, plus cancellation, the current completed record and the file's continued existence.

Mac has functional native window controls and one detail Back. The standard traffic-light controls are explicitly enabled and their titlebar container is placed above the content for interaction, while the hidden-titlebar/hidden-toolbar architecture is retained. The detail route suppresses the native Back item when it uses the custom app Back. This does not restore the old vertical sidebar or recreate the native toolbar that previously crashed.

Mac Search has a visible search field again. The dedicated page owns its glass search field, suggestions, clear and keyboard-submit actions. The global search popover remains a shortcut rather than replacing the page's main control; the crashing native-toolbar search route is not reintroduced.

Add-on removals and order edits retain their account ownership. Apple removal/re-add and ordering receipts use the captured account namespace rather than whichever account is active when deferred work completes. Settings restoration preserves local tombstone stamps instead of overwriting them. The public web client also records account-owned removal intent and installs current descriptors without reviving a stale local deletion. These are targeted ownership repairs, not a claim that every end-to-end website install or QR pairing report is closed.

Seek diagnostics distinguish accepted boundaries from ambiguous old events. The Mac mpv witness checks the recovery policy's accepted phase before attributing the event to a current resume target. A delayed event from a superseded seek is no longer labelled as proof that the newer seek began. The standalone credential compiler harness also follows current real policy dependencies in normal and generated fixtures, while retaining its eight credential/owner/root-integrity gates.

Retained from Beta 20 and earlier

The iPhone/iPad playback-startup crash repair, compact touch player, fourteen actual seek-bar styles, pinch Fit/Fill, horizontal Mac/wide-iPad navigation, reachable phone detail controls and Search, selected add-on highlighting and verified Mac disk-image sizing remain. See the Beta 20 notes.

Android retains direct Newznab/NZB indexers, multiple ordered NNTP servers, Trakt episode intent/artwork fencing, phone Library controls, remote add-on ordering, Home rail backup/sync, receipt-checked native history and the earlier playback/source ownership repairs. The configurable intro/credits auto-skip countdown with Off and Cancel, watched-download controls and earlier Apple playback/subtitle work are retained too. See the Beta 18 and Beta 17 notes for those full lists.

Android

This beta includes both distribution variants. Each APK serves phones and Android TV and includes arm64-v8a, armeabi-v7a and x86_64; the filenames describe the engine, not a phone/TV split.

• VortX-0.4.0-full-mpv-universal.apk: sideloaded MPV build with Media3 fallback.
• VortX-0.4.0-play-media3-universal.apk: Media3 build without GPL-native player libraries.
• VortX-0.4.0-play-media3.aab: matching distribution bundle, not an installable APK.

Android TV can actually use next-episode preloading and automatic advance. Its player host now wires the same halfway prewarm policy, ended callback and binge-prompt counter as the phone host. The continuation belongs to the profile and ViewModel that mounted the file: an owner change cannot launch another viewer's selected episode, and a preference-driven ViewModel rebuild does not unnecessarily stop healthy playback.

Back cancels an in-flight episode handoff instead of reopening the player later. Both Android hosts retire route-owned auto-pick authority. A generation lease is rechecked after asynchronous source assembly, so a consumed request cannot survive Back or replace a newer request. Source and episode actions cannot overlap a pending TV advance/retry. Accepted manual source changes invalidate an obsolete next-episode warm choice; rejected choices do not teach a new release.

The Android profile and TV binge repairs are new in this release. They do not establish complete Apple-style appearance, full feature parity, or physical Shield/Fire TV playback acceptance.

Verification and remaining limits

The earlier reviewed profile/continuity base passed Apple profile/seek/source/failure contracts and parity checks, four silent arm64 Apple Release builds, 28 Android profile tests and 57 website tests plus the website production build. The live dashboard script matches that tested build. The additional Mac Search/download/preview, Android TV handoff and shared mpv settlement changes have separate scoped source reviews. Updated iOS, Mac and tvOS Lite Release compilation passed without launching media. The final Apple parity, timeline, terminal-failure, continuity, download-resume, mpv-settlement and release-orchestration checks passed; the selected Android TV/lease/preload/focus/episode/ranking regressions passed in both Full and Play variants. Exact-commit CI and fresh release packaging remain required before publication. The credential harness's normal-root eight GREEN gates and a bounded synthetic-positive fixture passed; the full hostile self-test batch was not rerun for this maintenance change.

Release publication separately requires exact tagged source, fresh packages, Apple launch/package checks, both native engines and their callable ABI exports, Android production signing and packaged versions, checksums, immutable artifact provenance and public update-feed verification. Source tests and build success are not physical cross-device acceptance.

This beta does not claim that all playback complaints are gone. Sustained Dolby Vision stalls/fallback, AIOStreams nonzero-offset freezes, NNTP throughput, frame pacing, hardware output and source/player switching still require fresh device diagnostics where no initiating defect has been proven. A successful unit test is not evidence of provider uptime or uninterrupted overnight playback. Wider library/CW/account isolation, website installation/QR flows and visual redesign/parity remain separate work.

Please test

• Create a profile on one updated device, then check another signed into the same VortX account. Change its name/avatar and preferences from the app and dashboard, then confirm the changes arrive without restarting or shuffling the roster. Keep each device's chosen viewer local.
• Edit a profile that has its own account, PIN or discovery settings; changing a name must not clear unrelated properties. Delete a test profile and confirm it does not return from an older device snapshot.
• Choose a specific add-on/release, then try automatic next episode, manual Next/Previous and preloading from Continue Watching. Check that the preferred release is used when available and a failed candidate can still fall back.
• Try a batch download with the chosen release, including an already-queued episode and a failed candidate; neither should incorrectly teach a different series choice.
• Resume, manually seek elsewhere, and wait beyond the previous watchdog interval. The old resume target must not take over again. Exit a preview and check the original position and pause choice.
• Pause, begin an intro preview, then change source or player: the original position and paused choice must survive. Resume a downloaded episode on phone, iPad or Mac, then check that changing profile during a slow lookup cannot open it for the wrong viewer.
• Fail an episode resolution, then Retry: it must target the failed episode, keep a useful error and avoid restarting the outgoing item under that error.
• On Mac, check close/minimize/zoom, the single detail Back and the visible Search field. On Android TV, check automatic advance and Next from Continue Watching, then press Back during a slow source assembly and confirm playback does not reopen. On Android, create/edit profiles from the dashboard and compare the resulting 4K preference.
• Export diagnostics promptly if playback remains blank, stalled or starts at the wrong point, including build, episode, add-on/provider and preceding action.

Install

The Apple IPAs are unsigned distribution packages and must be re-signed through your usual sideloading/signing service. The Mac package has its own ad-hoc signature, described below.

Apple TV. Use VortX-tvOS-v0.4.0-beta.21-ci.ipa for Full or VortX-tvOS-lite-v0.4.0-beta.21-ci.ipa for Lite through your usual signing service.

iPhone and iPad. Use VortX-iOS-v0.4.0-beta.21-ci.ipa; both devices use the same IPA. Apple installation guide.

Mac. Use VortX-macOS-v0.4.0-beta.21-ci.dmg. This is an Apple Silicon, ad-hoc-signed package, not a notarized release. Mac installation guide.

Android. Install the signed APK for the engine you want. Signer/provenance evidence is in SIGNING_PROVENANCE.txt; Android and Apple checksum manifests accompany the packages.

The public release and the AltStore / SideStore source are updated only after the protected publication gates pass. Actual in-app notification delivery on each installed device remains a device-level check.