v1.1.0-beta.055 - fix(correctness): Deluge magnet, Metron over-fire, KOReader sync, ghost-series data-loss
🧲 Deluge magnet downloads silently broken (audit High #7)
- The magnet branch called core.add_torrent_magents (typo) — Deluge returns JSON-RPC errors with HTTP 200, so axios didn't throw, the code logged success, and the request wedged in DOWNLOADING with no recovery. Fixed to core.add_torrent_magnet and now throw on a non-null res.data.error so a failed add can't masquerade as success
🧭 Metron resolver fired for every ComicVine file + cache cross-contamination (audit High #6)
- metadata-extractor: the
else if (!metronId && seriesName)ran a live Metron name-search for essentially every series-named file lacking a Metron id — including normal CV files — and could flip the source to METRON. Now gated on actual Metron evidence (a Metron issue id). Also namespaced the shared volumeResolutionCache by provider (CV: / METRON:) so a CV volume id and a Metron series id for the same series+year can't alias
📖 KOReader sync blocked by middleware (audit Medium #13)
- /api/koreader wasn't in the middleware public allowlist, so devices (no NextAuth cookie; self-auth via x-auth-key) were 401'd before their handler ran. Added it; /api/profile/koreader is unaffected (different prefix)
🛟 Ghost-series purge caused data loss on transient outages (audit Medium #14)
- A full scan hard-deleted any series whose folder failed existsSync (cascading to ReadProgress + custom metadata), so a transient SMB/subfolder hiccup destroyed read progress + curated metadata. Added a 24h grace window (first-missing time persisted in a scan_missing_series SystemSetting); a series is purged only after staying gone past the window. Counter persistence is best-effort — a write failure defers purging, never deletes early
🧪 Tests
- deluge method-name + HTTP-200-error-throw; koreader public (and profile/koreader still gated); ghost-series grace window (first-miss kept, >24h purged)
✅ Verification
- tsc clean; eslint . 0 errors; vitest 270 passed (+6)