kryten-webqueue 0.48.0__tar.gz → 0.48.1__tar.gz

{kryten_webqueue-0.48.0 → kryten_webqueue-0.48.1}/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [0.48.1] - 2026-09-23
+
+### Fixed
+
+- **Production 500 on `/catalog/browse` in partitioned SQLite mode**: `get_tags()` (facet
+  counts) unconditionally ran the monolith reserved-item exclusion subquery referencing
+  `saved_playlist_items`/`saved_playlists`, tables that live in `queue.sqlite3`, not
+  `catalog.sqlite3`. Every browse/search page load crashed with
+  `sqlite3.OperationalError: no such table: saved_playlist_items` once the site was
+  cut over to `layout="partitioned"`. `get_tags` now accepts `exclude_tokens`/
+  `is_partitioned`, and the `Database` facade resolves reserved/blackout exclusions via
+  the `queue` domain before calling it, matching the existing `browse`/`search` pattern.
+- **Reserved-item exclusion leak in partitioned mode**: `queue.get_reserved_media_ids()`
+  returns raw `media_id` values, which are usually CyTube manifest URLs, not bare
+  `friendly_token`s. `browse`, `browse_count`, `search`, and `search_count` were comparing
+  these raw values directly against `catalog.friendly_token`, so immutable/promo-pool
+  items whose playlist entry stored a manifest URL were **not excluded** from public
+  results. Added `catalog.resolve_friendly_tokens()` to resolve either shape back to
+  `friendly_token`, and all four call sites now use it via a shared
+  `Database._get_reserved_tokens()` helper.
+
 ## [0.48.0] - 2026-09-23
 
 ### Added

{kryten_webqueue-0.48.0 → kryten_webqueue-0.48.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: kryten-webqueue
-Version: 0.48.0
+Version: 0.48.1
 Summary: Netflix/Tubi-style catalog browser and pay-to-play queue management for CyTube
 Author: grobertson
 License-Expression: MIT

{kryten_webqueue-0.48.0 → kryten_webqueue-0.48.1}/deploy/nginx-queue.conf

@@ -13,8 +13,13 @@ server {
 
     add_header Strict-Transport-Security "max-age=31536000" always;
 
+    # Upstream application backend:
+    # - Local grindhouse service: http://127.0.0.1:2010
+    # - Cross-network Chandra-1 Podman container: http://chandra-1.local:2010
+
     # WebSocket upgrade
     location /ws {
+        # Use http://chandra-1.local:2010 when deployed to Chandra-1 Podman pod
         proxy_pass http://127.0.0.1:2010;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
@@ -28,6 +33,7 @@ server {
 
     # API + pages
     location / {
+        # Use http://chandra-1.local:2010 when deployed to Chandra-1 Podman pod
         proxy_pass http://127.0.0.1:2010;
         proxy_http_version 1.1;
         proxy_set_header Connection "";

{kryten_webqueue-0.48.0 → kryten_webqueue-0.48.1}/docs/DATABASE_ARCHITECTURE_PLAN.md

@@ -133,18 +133,29 @@ Upon completion of Part 1, the partitioned domain model directly maps to Postgre
 - `tmdb.*` — Persistent, queryable local TMDB dump index.
 
 ```
+┌─────────────────────────────────────────┐
+│          grindhouse.local Host          │
+│                                         │
+│   ┌─────────────────────────────────┐   │
+│   │           nginx proxy           │   │
+│   │    queue.dropsugar.co (SSL)     │   │
+│   └────────────────┬────────────────┘   │
+└────────────────────┼────────────────────┘
+                     │ LAN Reverse Proxy
+                     │ http://chandra-1.local:2010
+                     ▼
 ┌────────────────────────────────────────────────────────────────────────────────────────┐
 │                                 chandra-1 Host System                                  │
 │                                                                                        │
 │  ┌──────────────────────────────────────────────────────────────────────────────────┐  │
-│  │                            Podman Pod: kryten-webqueue                           │  │
+│  │                     Podman Container: webqueue-app                               │  │
 │  │                                                                                  │  │
-│  │  ┌─────────────────────────────┐           ┌──────────────────────────────────┐  │  │
-│  │  │    kryten-webqueue-app      │           │           nginx proxy            │  │  │
-│  │  │   (FastAPI + uvicorn)       │◄─────────►│     (Reverse Proxy + SSL)        │  │  │
-│  │  │   SQLAlchemy 2.0 (asyncpg)  │           │                                  │  │  │
-│  │  └──────────────┬──────────────┘           └────────────────┬─────────────────┘  │  │
-│  └─────────────────┼───────────────────────────────────────────┼────────────────────┘  │
+│  │  ┌─────────────────────────────┐                                                 │  │
+│  │  │    kryten-webqueue-app      │                                                 │  │
+│  │  │   (FastAPI + uvicorn:2010)  │                                                 │  │
+│  │  │   SQLAlchemy 2.0 (asyncpg)  │                                                 │  │
+│  │  └──────────────┬──────────────┘                                                 │  │
+│  └─────────────────┼───────────────────────────────────────────┬────────────────────┘  │
 │                    │                                           │                       │
 │                    ▼                                           ▼                       │
 │  ┌─────────────────────────────────────┐     ┌──────────────────────────────────────┐  │
@@ -156,6 +167,11 @@ Upon completion of Part 1, the partitioned domain model directly maps to Postgre
 └────────────────────────────────────────────────────────────────────────────────────────┘
 ```
 
+The public hostname `https://queue.dropsugar.co/` terminates TLS via Let's Encrypt Nginx on
+`grindhouse.local`. During the Chandra-1 cutover, the Nginx reverse proxy configuration on
+`grindhouse.local` (`/etc/nginx/sites-available/queue.conf`) is updated to forward HTTP and
+WebSocket traffic across the local network to `http://chandra-1.local:2010`.
+
 ### 2.2 Core Technical Specifications
 
 1. **ORM & Driver**: **SQLAlchemy 2.0 with `asyncpg`** (`create_async_engine`, `async_sessionmaker`, `AsyncSession`).

{kryten_webqueue-0.48.0 → kryten_webqueue-0.48.1}/docs/postgres-cutover.md

@@ -80,15 +80,73 @@ sudo systemctl start webqueue-app.service
 sudo systemctl status webqueue-app.service --no-pager
 ```
 
-### Step 6: Smoke Testing & Health Verification
+Verify local health inside `chandra-1`:
 ```bash
 curl -I http://127.0.0.1:2010/auth/login
 curl -s http://127.0.0.1:2010/queue/next-schedule
 ```
 
+### Step 6: Update Grindhouse Nginx Reverse Proxy Across Network
+The public website `https://queue.dropsugar.co/` terminates SSL via Let's Encrypt Nginx on `grindhouse.local`. Update its upstream to proxy across the LAN to `chandra-1.local:2010`.
+
+On `grindhouse.local`:
+1. Edit `/etc/nginx/sites-available/queue.conf`:
+```nginx
+    # WebSocket upgrade
+    location /ws {
+        proxy_pass http://chandra-1.local:2010;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 86400;
+    }
+
+    # API + pages
+    location / {
+        proxy_pass http://chandra-1.local:2010;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+```
+
+2. Test and reload Nginx:
+```bash
+sudo nginx -t
+sudo systemctl reload nginx
+```
+
+### Step 7: Public Smoke Testing & Verification
+Test public endpoints through the reverse proxy:
+```bash
+curl -I https://queue.dropsugar.co/auth/login
+curl -s https://queue.dropsugar.co/queue/next-schedule
+```
+Monitor logs on `chandra-1`:
+```bash
+sudo journalctl -u webqueue-app.service -f
+```
+
 ---
 
 ## 3. Rollback & Forward Repair Policy
 
-- **Pre-Cutover Failure**: If ETL validation fails or container startup fails before DNS/traffic cutover, immediately restart `kryten-webqueue.service` on `grindhouse.local`. SQLite databases remain untouched and consistent.
-- **Post-Cutover Failure**: Once traffic is switched and PostgreSQL accepts writes (new spend requests, logins, completions), recovery is a **forward repair in PostgreSQL**. The retained SQLite snapshot is preserved read-only for forensics.
+- **Pre-Cutover Failure**: If ETL validation fails, container startup fails on `chandra-1`, or initial smoke tests fail before Nginx is updated:
+  1. Do not update or revert Nginx on `grindhouse.local` (`proxy_pass http://127.0.0.1:2010;`).
+  2. Restart `kryten-webqueue.service` on `grindhouse.local`:
+     ```bash
+     sudo systemctl start kryten-webqueue.service
+     ```
+  3. The SQLite databases remain untouched and consistent.
+- **Traffic Rollback (if Nginx was already switched but app has issues)**:
+  1. Revert `/etc/nginx/sites-available/queue.conf` on `grindhouse.local` to point back to `http://127.0.0.1:2010`.
+  2. Reload Nginx: `sudo nginx -t && sudo systemctl reload nginx`.
+  3. Start `kryten-webqueue.service` on `grindhouse.local`.
+- **Post-Cutover Forward Repair**: Once production traffic is accepted by PostgreSQL (user logins, new spend requests, play completions), recovery is a **forward repair in PostgreSQL**. The retained SQLite snapshot is preserved read-only for forensics.

{kryten_webqueue-0.48.0 → kryten_webqueue-0.48.1}/docs/postgres-migration/PRD-postgres-migration.md

@@ -28,6 +28,9 @@ The following decisions are fixed for this sprint:
 - One PostgreSQL database named `webqueue` owns all five schemas. `tmdb` is a schema, not a
   separate database, so catalog enrichment can use relational queries when needed.
 - The application runs as a rootful Podman Quadlet service on `chandra-1`.
+- Public traffic on `https://queue.dropsugar.co/` terminates TLS at Nginx on `grindhouse.local`.
+  During cutover, Nginx on `grindhouse.local` (`/etc/nginx/sites-available/queue.conf`) is updated
+  to reverse-proxy HTTP and WebSocket (`/ws`) traffic across the local network to `http://chandra-1.local:2010`.
 - PostgreSQL is host-managed on `chandra-1`. The rootful application container connects through
   an explicitly configured host-gateway address; it must not use `localhost`.
 - The migration uses a maintenance window and a forward-fix rollback policy. There is no

{kryten_webqueue-0.48.0 → kryten_webqueue-0.48.1}/docs/postgres-migration/SPEC-Sortie-6-tests-cutover-release.md

@@ -66,12 +66,19 @@ python -m kryten_webqueue.migrate_sqlite_to_pg --data-dir /path/to/sqlite/data -
 # 5. Grant runtime/pruner roles only after verification, then start the rootful Quadlet.
 sudo systemctl start webqueue-app.service
 
-# 6. Verify health and smoke test browse/search/queue/OTP/device-key/job-log paths.
+# 6. Update Nginx reverse proxy on grindhouse.local to forward across the LAN:
+#    In /etc/nginx/sites-available/queue.conf:
+#    proxy_pass http://chandra-1.local:2010; (for /ws and /)
+#    sudo nginx -t && sudo systemctl reload nginx
+
+# 7. Verify health and smoke test public HTTPS and WebSocket paths:
+curl -f https://queue.dropsugar.co/auth/login
 curl -f http://127.0.0.1:2010/api/public/v1/state
 ```
 
 If a gate fails before PostgreSQL receives production writes, restart the unchanged SQLite
-service. Once PostgreSQL accepts a write, recovery is a forward repair using request identifiers
+service and revert the Nginx proxy_pass on grindhouse.local back to http://127.0.0.1:2010.
+Once PostgreSQL accepts a write, recovery is a forward repair using request identifiers
 and audit records; the retained SQLite snapshot is not an automatic rollback target.
 
 ## 4. Implementation Plan

{kryten_webqueue-0.48.0 → kryten_webqueue-0.48.1}/kryten_webqueue/catalog/db/__init__.py

@@ -182,6 +182,7 @@ _DOMAIN_METHOD_MAP: dict[str, str] = {
     "get_item_edit_history": "catalog",
     "get_items_by_tokens": "catalog",
     "get_hidden_category_and_tag_tokens": "catalog",
+    "resolve_friendly_tokens": "catalog",
     "get_people": "catalog",
     "get_studios": "catalog",
     "upsert_person": "catalog",
@@ -333,6 +334,16 @@ class Database(
 
     # --- Decoupled Cross-Domain Orchestrations ---
 
+    async def _get_reserved_tokens(self) -> set[str]:
+        """Reserved (immutable/promo) media_ids resolved to friendly_tokens.
+
+        queue.db stores media_id as either a bare token or a manifest URL, so
+        the raw values must be resolved through catalog.db before comparing
+        against friendly_token.
+        """
+        raw = await self.queue.get_reserved_media_ids()
+        return await self.catalog.resolve_friendly_tokens(raw)
+
     async def browse(
         self,
         *,
@@ -357,7 +368,7 @@ class Database(
                     recently_played_days
                 )
                 exclude_set.update(hidden)
-            reserved = await self.queue.get_reserved_media_ids()
+            reserved = await self._get_reserved_tokens()
             exclude_set.update(reserved)
             blackouts = await self.queue.get_active_blackout_tokens()
             if not show_hidden:
@@ -425,7 +436,7 @@ class Database(
                     recently_played_days
                 )
                 exclude_set.update(hidden)
-            reserved = await self.queue.get_reserved_media_ids()
+            reserved = await self._get_reserved_tokens()
             exclude_set.update(reserved)
             if not show_hidden:
                 blackouts = await self.queue.get_active_blackout_tokens()
@@ -483,7 +494,7 @@ class Database(
                     recently_played_days
                 )
                 exclude_set.update(hidden)
-            reserved = await self.queue.get_reserved_media_ids()
+            reserved = await self._get_reserved_tokens()
             exclude_set.update(reserved)
             blackouts = await self.queue.get_active_blackout_tokens()
             if not show_hidden:
@@ -554,7 +565,7 @@ class Database(
                     recently_played_days
                 )
                 exclude_set.update(hidden)
-            reserved = await self.queue.get_reserved_media_ids()
+            reserved = await self._get_reserved_tokens()
             exclude_set.update(reserved)
             if not show_hidden:
                 blackouts = await self.queue.get_active_blackout_tokens()
@@ -612,6 +623,38 @@ class Database(
             self, username, page=page, per_page=per_page
         )
 
+    async def get_tags(
+        self,
+        *,
+        limit: int = 100,
+        show_hidden: bool = False,
+        min_duration_sec: int = 0,
+        max_duration_sec: int | None = None,
+        **kwargs: Any,
+    ) -> list[dict]:
+        if self._layout == "partitioned":
+            exclude_set: set[str] = await self._get_reserved_tokens()
+            if not show_hidden:
+                blackouts = await self.queue.get_active_blackout_tokens()
+                exclude_set.update(blackouts)
+            return await self.catalog.get_tags(
+                limit=limit,
+                show_hidden=show_hidden,
+                min_duration_sec=min_duration_sec,
+                max_duration_sec=max_duration_sec,
+                exclude_tokens=exclude_set,
+                is_partitioned=True,
+            )
+
+        return await _CatalogMixin.get_tags(
+            self,
+            limit=limit,
+            show_hidden=show_hidden,
+            min_duration_sec=min_duration_sec,
+            max_duration_sec=max_duration_sec,
+            is_partitioned=False,
+        )
+
     async def get_item(self, friendly_token: str) -> dict | None:
         if self._layout == "partitioned":
             item = await self.catalog.get_item(friendly_token, is_partitioned=True)

{kryten_webqueue-0.48.0 → kryten_webqueue-0.48.1}/kryten_webqueue/catalog/db/_catalog.py

@@ -916,6 +916,8 @@ class _CatalogMixin:
         show_hidden: bool = False,
         min_duration_sec: int = 0,
         max_duration_sec: int | None = None,
+        exclude_tokens: set[str] | list[str] | None = None,
+        is_partitioned: bool = False,
     ) -> list[dict]:
         """Most-used tags that have at least one catalog item, for facets.
 
@@ -929,16 +931,25 @@ class _CatalogMixin:
             WHERE 1=1
         """
         params: list = []
-        resv_sql, resv_params = _reserved_exclusion("c")
-        sql += resv_sql
-        params.extend(resv_params)
+        if not is_partitioned:
+            resv_sql, resv_params = _reserved_exclusion("c")
+            sql += resv_sql
+            params.extend(resv_params)
+            if not show_hidden:
+                bo_sql, bo_params = _blackout_exclusion("c")
+                sql += bo_sql
+                params.extend(bo_params)
         if not show_hidden:
-            bo_sql, bo_params = _blackout_exclusion("c")
-            sql += bo_sql
-            params.extend(bo_params)
             ph = ",".join("?" * len(HIDDEN_TAG_NAMES))
             sql += f" AND t.name NOT IN ({ph})"
             params.extend(HIDDEN_TAG_NAMES)
+        if exclude_tokens:
+            tokens_list = [t for t in exclude_tokens if t]
+            for i in range(0, len(tokens_list), 500):
+                chunk = tokens_list[i : i + 500]
+                ph = ",".join("?" * len(chunk))
+                sql += f" AND c.friendly_token NOT IN ({ph}) "
+                params.extend(chunk)
         if min_duration_sec > 0 or max_duration_sec is not None:
             dur_sql, dur_params = _duration_range_filter(
                 "c", min_duration_sec or None, max_duration_sec

{kryten_webqueue-0.48.0 → kryten_webqueue-0.48.1}/kryten_webqueue/catalog/db/_catalog_db.py

@@ -55,3 +55,27 @@ class _CatalogDB(_CatalogMixin, _PeopleMixin, _EnrichmentMixin, _MOTDMixin, _Dom
         """
         rows = await self._fetch_all(sql, [*HIDDEN_CATEGORY_NAMES, *HIDDEN_TAG_NAMES])
         return {r["friendly_token"] for r in rows if r.get("friendly_token")}
+
+    async def resolve_friendly_tokens(
+        self, identifiers: list[str] | set[str]
+    ) -> set[str]:
+        """Resolve a mix of bare friendly_tokens and manifest URLs to friendly_tokens.
+
+        queue.db stores playlist item media_id as either shape; this maps both
+        back to the canonical friendly_token so cross-domain exclusion filters
+        (reserved/promo items) match regardless of which shape was recorded.
+        """
+        ids = [i for i in identifiers if i]
+        if not ids:
+            return set()
+        tokens: set[str] = set()
+        for i in range(0, len(ids), 500):
+            chunk = ids[i : i + 500]
+            ph = ",".join("?" * len(chunk))
+            rows = await self._fetch_all(
+                f"SELECT friendly_token FROM catalog "
+                f"WHERE friendly_token IN ({ph}) OR manifest_url IN ({ph})",
+                [*chunk, *chunk],
+            )
+            tokens.update(r["friendly_token"] for r in rows if r.get("friendly_token"))
+        return tokens

{kryten_webqueue-0.48.0 → kryten_webqueue-0.48.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kryten-webqueue"
-version = "0.48.0"
+version = "0.48.1"
 description = "Netflix/Tubi-style catalog browser and pay-to-play queue management for CyTube"
 readme = "README.md"
 license = "MIT"

{kryten_webqueue-0.48.0 → kryten_webqueue-0.48.1}/tests/test_multi_db_connection.py

@@ -195,3 +195,65 @@ async def test_partitioned_is_restricted_decoupling(partitioned_db):
 
     # Now is_restricted is True
     assert await partitioned_db.is_restricted("tok_restricted") is True
+
+
+async def test_partitioned_get_tags_decoupled(partitioned_db):
+    """Regression test: get_tags must not reference saved_playlist_items in catalog.db.
+
+    Previously crashed with 'sqlite3.OperationalError: no such table:
+    saved_playlist_items' because get_tags ran the monolith reserved-item
+    exclusion subquery unconditionally, even in partitioned mode.
+    """
+    for i in range(1, 4):
+        token = f"tag_movie_{i}"
+        await partitioned_db.catalog.insert_catalog(
+            {
+                "friendly_token": token,
+                "title": f"Tag Movie {i}",
+                "manifest_url": f"https://dropsugar.com/cytube/{token}.json",
+                "synced_at": "2026-01-01T00:00:00Z",
+            }
+        )
+        tag_id = await partitioned_db.upsert_tag("actionpacked")
+        await partitioned_db.set_catalog_tags(token, [tag_id])
+
+    tags = await partitioned_db.get_tags()
+    assert any(t["name"] == "actionpacked" for t in tags)
+
+
+async def test_partitioned_reserved_exclusion_resolves_manifest_url(partitioned_db):
+    """Regression test: reserved-item exclusion must resolve queue.db media_id
+    (usually a manifest URL) back to friendly_token before filtering catalog.db,
+    or immutable/promo-pool items leak into public browse/search/tags.
+    """
+    manifest_url = "https://dropsugar.com/cytube/reserved_by_url.json"
+    await partitioned_db.catalog.insert_catalog(
+        {
+            "friendly_token": "tok_reserved_by_url",
+            "title": "Reserved By URL",
+            "manifest_url": manifest_url,
+            "synced_at": "2026-01-01T00:00:00Z",
+        }
+    )
+    await partitioned_db.catalog.insert_catalog(
+        {
+            "friendly_token": "tok_public",
+            "title": "Public Item",
+            "manifest_url": "https://dropsugar.com/cytube/public.json",
+            "synced_at": "2026-01-01T00:00:00Z",
+        }
+    )
+
+    pl_id = await partitioned_db.queue.create_saved_playlist(
+        name="Immutable Event", description=None, is_immutable=True, created_by="admin"
+    )
+    # media_id stored as the manifest URL, the common real-world shape.
+    await partitioned_db.queue.append_playlist_items(
+        pl_id,
+        [{"media_type": "cm", "media_id": manifest_url, "title": "Reserved By URL"}],
+    )
+
+    items = await partitioned_db.browse(show_hidden=False)
+    tokens = [i["friendly_token"] for i in items]
+    assert "tok_public" in tokens
+    assert "tok_reserved_by_url" not in tokens

kryten_webqueue-0.48.1/tests/test_postgres_live.py

@@ -0,0 +1,87 @@
+"""Integration test suite verifying live PostgreSQL webqueue database on chandra-1."""
+
+import os
+import pytest
+import asyncpg
+
+
+CHANDRA_PG_DSN = os.getenv(
+    "KRYTEN_WEBQUEUE_PG_DSN",
+    "postgresql://kryten:kryten_secret_password@chandra-1.local:5432/webqueue",
+)
+
+
+@pytest.fixture
+async def pg_conn():
+    try:
+        conn = await asyncpg.connect(CHANDRA_PG_DSN, timeout=5)
+        yield conn
+        await conn.close()
+    except (OSError, asyncpg.PostgresError) as exc:
+        pytest.skip(f"Chandra-1 PostgreSQL not reachable from this environment: {exc}")
+
+
+async def test_live_postgres_schemas_and_extensions(pg_conn):
+    """Verify webqueue database contains all 5 schemas and pg_trgm."""
+    schemas = await pg_conn.fetch(
+        "SELECT schema_name FROM information_schema.schemata WHERE schema_name IN ('catalog', 'queue', 'jobs', 'users', 'tmdb')"
+    )
+    found_schemas = {r["schema_name"] for r in schemas}
+    assert found_schemas == {"catalog", "queue", "jobs", "users", "tmdb"}
+
+    ext = await pg_conn.fetchval("SELECT 1 FROM pg_extension WHERE extname = 'pg_trgm'")
+    assert ext == 1
+
+
+async def test_live_postgres_table_counts(pg_conn):
+    """Verify row counts in live migrated schemas."""
+    catalog_count = await pg_conn.fetchval("SELECT count(*) FROM catalog.catalog")
+    assert catalog_count >= 9900
+
+    people_count = await pg_conn.fetchval("SELECT count(*) FROM catalog.people")
+    assert people_count >= 36000
+
+    job_logs_count = await pg_conn.fetchval("SELECT count(*) FROM jobs.job_run_logs")
+    assert job_logs_count >= 500000
+
+    playlists_count = await pg_conn.fetchval(
+        "SELECT count(*) FROM queue.saved_playlists"
+    )
+    assert playlists_count >= 30
+
+    watchlist_count = await pg_conn.fetchval(
+        "SELECT count(*) FROM users.user_watchlist"
+    )
+    assert watchlist_count >= 1700
+
+
+async def test_live_postgres_full_text_search(pg_conn):
+    """Verify tsvector full-text search with GIN index on catalog.catalog."""
+    rows = await pg_conn.fetch(
+        """
+        SELECT friendly_token, title, ts_rank(search_vector, websearch_to_tsquery('english', 'Terminator')) AS rank
+        FROM catalog.catalog
+        WHERE search_vector @@ websearch_to_tsquery('english', 'Terminator')
+        ORDER BY rank DESC
+        LIMIT 5;
+        """
+    )
+    assert len(rows) > 0
+    titles = [r["title"] for r in rows]
+    assert any("Terminator" in t for t in titles)
+
+
+async def test_live_postgres_trigram_fuzzy_matching(pg_conn):
+    """Verify pg_trgm fuzzy matching handles typos like 'Terminatr'."""
+    rows = await pg_conn.fetch(
+        """
+        SELECT friendly_token, title, similarity(title, 'Terminatr') AS sim
+        FROM catalog.catalog
+        WHERE similarity(title, 'Terminatr') > 0.3
+        ORDER BY sim DESC
+        LIMIT 5;
+        """
+    )
+    assert len(rows) > 0
+    top_title = rows[0]["title"]
+    assert "Terminator" in top_title