[tang-vu]

Ready for independent review (2026-09-15). Candidate 6c8a5566aaff7d653db87d20966211e1c931a0e7 has a successful GitHub check rollup and no base-branch conflict at this review snapshot. This supersedes earlier draft-status wording only. All validation gaps, migration requirements, live gates and independent human review requirements below remain in force; this is not a merge-ready approval.

Why this matters

Add an optional local audio library for audiobooks, recordings and generated speech. Operators can organize source audio, stream authenticated byte ranges and retain listening progress through container replacement using the existing Extensions lifecycle.

Contract

• Pin official Audiobookshelf 2.36.0 and its multi-platform digest. Run as UID/GID 1000 with a read-only root, dropped capabilities, bounded temporary scratch and loopback port 7833 by default. The manifest owns host-directory preparation.
• Keep config and metadata durable; mount original audio read-only. The documented first-run path requires loopback binding and creation of the owner with a strong password before any remote exposure. Process health does not prove owner setup is complete.
• Producer/consumer path: host recording -> read-only library mount -> authenticated scan -> stored library record -> authenticated playback session and HTTP byte ranges -> persisted listening progress. Source audio remains unchanged.
• Document unsupported writes against the read-only source mount, optional upstream online metadata/sharing features, full-directory backups, upgrade/rollback limits and preservation of data on disable. No podcast download directory or automatic external account is configured.
• Regenerate the complete catalog, including the pre-existing disabled pixel-inference metadata omitted from the checked-in baseline. This does not enable Pixel.

Overlap check

Searched open and closed PRs for Audiobookshelf and the new recipe/test production paths in the changed-file inventory; no implementation was found. #5012 generates speech through the CLI; this independently stores and serves an operator's audio library with listening progress. Trilium #5013 manages hierarchical notes, not playback. Port 7833 has no existing manifest/Compose collision. Shared catalog and library README changes are additive and will be checked on the batch integration head.

Validation

• Exact-image Linux amd64 under WSL: 2 passed (28-live, 199.21 seconds pytest; 214.71 seconds runner). Generate an eight-second MP3 with the shipped encoder, initialize the actual owner account, reject anonymous/wrong-password access, create and scan a Unicode library, start authenticated direct playback, verify HTTP 206 bytes and Content-Range against the source file, save progress, recreate the container, and retrieve the same library/playback/progress. Verify unchanged source bytes and clean up fixture containers/network.
• 36 manifest tests, scoped pre-commit hooks and git diff --check passed.
• Full local make gate reproduces the existing no-sudo Docker promotion/raw-sudo failure covered by fix(installer): honor unavailable sudo in Docker fallback #3158. No full local gate pass is claimed. The added path-filtered CI runs the exact-image HTTP/storage contract.

Review and limits

Candidate 6c8a5566aaff7d653db87d20966211e1c931a0e7: 33 successful CI checks, 4 conditionally skipped, including the real audio contract. Awaiting independent review of first-run ownership and durable storage. Runtime evidence covers Linux amd64; image metadata advertises amd64/arm64. Browser/mobile playback, transcoding, podcast downloads, online metadata matching, large libraries and existing-database upgrades were not tested. Health and API checks do not establish browser usability. No merge is requested before the declared live/review gates are resolved.

Final candidate 6c8a5566aaff7d653db87d20966211e1c931a0e7: 33 successful CI checks, 4 conditionally skipped; no pending or failed checks.

Batch integration receipt

This is one of 30 independently branched public-beta PRs. The published synthetic integration head is 61f4c6fccc81bea697f4941683fefb5089ba77f4, built from baseline d49ad4bbc760be319de7f4c9b9a93b1f18fe3922 in this reproducible order:

#4946 → #4948 → #4951 → #4954 → #4972 → #4960 → #4961 → #4957 → #4964 → #4967 → #4968 → #4971 → #4975 → #4976 → #4984 → #4982 → #4990 → #4988 → #4989 → #4997 → #5003 → #5006 → #5007 → #5009 → #5012 → #5011 → #5013 → #5014 → #5020 → #5021

Reconciliation preserved all 146 files owned by a single PR byte-for-byte against their exact candidate heads. The eight shared paths preserve both CLI STT/TTS commands and help, every added Makefile test, both environment schema additions and all Extensions UI behavior. LanguageTool and Kroki both remain headless API entries. Canonical regeneration yields 76 catalog entries and 47 library manifests; all README rows are retained. Shared-file changes need these additive resolutions when merged independently.

Combined validation: 2,852 API tests passed / 1 skipped; 1,082 UI tests passed; 47 manifests passed; all 12 added Makefile commands passed; 12 catalog boundary tests passed / 12 opt-in runtime tests skipped in this combined run. Individual exact-image results remain documented above. UI lint/build, scoped secret hooks, diff checks, four platform smoke tests and installer simulation passed. Compose plans for NVIDIA/AMD/Apple each contain 20 services and no duplicate published bindings across the core plus 12 new recipes; this is static plan evidence, not simultaneous startup or GPU inference.

The first unrestricted UI run timed out in two tests under concurrent load; the complete rerun used --maxWorkers=2 with unchanged assertions and timeouts and passed. ESLint reports zero errors and 603 warnings, including the existing JSX usage-detection pattern. Full local make gate still fails the no-sudo Docker baseline covered by #3158. BATS records 416 passed / 5 failed on this root/WSL host (platform detection, root preflight and a 15 GiB versus 20 GiB free-space expectation). Neither full local gate nor BATS is described as green.

This integration receipt supplements each PR's own regression and does not waive its independent review, live hardware/browser/upgrade gates or rollback requirements. The PRs remain drafts; none was merged upstream.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.