tautulli: reach plex through the mesh, written before Tautulli starts

Tautulli reached plex at 172.18.0.1, the gateway of a HAL network that goes away with HAL, and the plan was to retype it by hand in the window. Tautulli now requires plex-api, and where plex is comes from the binding. Tautulli keeps the connection only in config.ini, reads it at start and writes its whole config back on every shutdown; its API cannot set it and its settings form needs an admin login. So a step after start would be overwritten the moment the container is recreated. The write is made where nothing can overwrite it: the linuxserver image's custom-init runs plex/mesh-plex.py as root before Tautulli starts, and the server restarts on its binding and credential, so a moved plex or an accepted token lands. It writes only [PMS] keys, only when they differ, every other line byte for byte: pms_ip, pms_port, pms_ssl and pms_url from the binding; pms_identifier from plex's /identity; pms_token only when plex takes it. A minted value - before the operator accepts the server's X-Plex-Token for this pair - is never written, while the address still is, so Tautulli's own working token keeps working at plex's new address. A failure in custom-init is a log line nobody reads, so a run-once `plex` step, declared last so it gates nothing (ADR 0136), checks what the mesh can report: plex takes the credential (else it names the secret accept), Tautulli holds the bound URL, and Tautulli says it is connected. It writes nothing. The script is kept as plex/mesh-plex.py and plex/50-mesh-plex; module.json carries copies, and a test fails when they differ. Tests run the script with python3 against a fake plex (skipped where there is none) and the step against fakes; `npm test` builds first.
tautulli: its config is placed, it runs the build in use, and its runtime finds its own key
2026-09-30 13:09:43 +02:00 · 2026-09-29 23:41:47 +02:00
27 changed files with 885 additions and 1146 deletions
@@ -94,7 +94,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_BAZARR_URL": "http://127.0.0.1:${port:6767}",
+        "MESH_BAZARR_URL": "http://127.0.0.1:6767",
        "MESH_BAZARR_API_KEY_FILE": "/run/secrets/api-key",
        "MESH_BAZARR_CONFIG_FILE": "/run/config/config.json",
        "MESH_BAZARR_CONFIG_DIR": "/var/lib/bazarr/config"
@@ -76,7 +76,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_BOOKSHELF_URL": "http://127.0.0.1:${port:8787}",
+        "MESH_BOOKSHELF_URL": "http://127.0.0.1:8787",
        "MESH_BOOKSHELF_CONFIG_DIR": "/var/lib/bookshelf/config"
      },
      "artifact": "runtime"
@@ -1,19 +1,6 @@
 {
  "module": "lidarr",
  "version": "1",
-  "provides": [
-    {
-      "name": "lidarr-api",
-      "scope": "mesh"
-    }
-  ],
-  "serves": {
-    "lidarr-api": {
-      "scheme": "http",
-      "port": 8686,
-      "url-base": ""
-    }
-  },
  "capabilities": [
    "container-runtime"
  ],
@@ -88,7 +75,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_LIDARR_URL": "http://127.0.0.1:${port:8686}",
+        "MESH_LIDARR_URL": "http://127.0.0.1:8686",
        "MESH_LIDARR_CONFIG_DIR": "/var/lib/lidarr/config"
      },
      "artifact": "runtime"
@@ -81,7 +81,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NZBGET_URL": "http://127.0.0.1:${port:6789}",
+        "MESH_NZBGET_URL": "http://127.0.0.1:6789",
        "MESH_NZBGET_PASSWORD_FILE": "/run/secrets/password",
        "MESH_NZBGET_CONFIG_FILE": "/run/config/config.json",
        "MESH_NZBGET_CONFIG_DIR": "/var/lib/nzbget/config"
@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/ombi
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts servarr/settings.ts plex/settings.ts connections/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist

 FROM ${RUNTIME_BASE}
@@ -22,6 +22,3 @@ COPY --from=build /app/modules/ombi/dist /app/modules/ombi/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/ombi/dist/index.js,/app/modules/ombi/dist/tools/index.js
-# NOT dist/connections/index.js: that is a step the host runs to completion, named by the `connections`
-# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
-# serving sidecar too, and exit it.
@@ -1,66 +0,0 @@
-// ombi's connections step — run once by the host after ombi's server starts, and run again whenever
-// a binding or pair credential it reads changes (the container's `restart-on`, novox/hq ADR 0099).
-// It brings ombi's connections to Sonarr, Radarr, Lidarr (servarr/settings.ts) and Plex
-// (plex/settings.ts) in line with what the mesh bound.
-//
-// **A step, not a loop**, for the reason route-adapter gives: everything it does is a function of
-// files the mesh writes, and the host already knows when they change. It connects to no broker.
-//
-// Exits non-zero when any app could not be put right — a refused credential, an unreachable app, an
-// ombi that cannot reach it — so the node reports the step failed and the host runs it again on the
-// next apply. It is declared last in the manifest, so its failing gates nothing else of ombi's
-// (novox/hq ADR 0136). One app failing does not stop the others being put right.
-//
-// Reads, per provision, `<dir>/<provision>.json` (the binding) and `<dir>/<provision>.secret` (the
-// pair credential), where <dir> is MESH_CONNECTIONS_DIR. Never prints a key or a token.
-
-import { join } from "node:path";
-
-import { PLEX_PROVISION, reconcilePlex } from "../plex/settings.js";
-import { APPS, ombiReady, readBinding, readIfThere, reconcileApp, type Http, type Outcome } from "../servarr/settings.js";
-
-const dir = process.env.MESH_CONNECTIONS_DIR ?? "/run/connections";
-const url = process.env.MESH_OMBI_URL ?? "http://127.0.0.1:3579";
-const apiKey = (await readIfThere(process.env.MESH_OMBI_API_KEY_FILE))?.trim() ?? process.env.MESH_OMBI_API_KEY ?? "";
-const waitSeconds = Number(process.env.MESH_OMBI_WAIT_SECONDS ?? "180");
-
-// Every call bounded: an entry ombi keeps may name a host that no longer answers, and a step that
-// hangs on it holds the apply.
-const http: Http = { fetch: (u, init) => fetch(u, { ...init, signal: AbortSignal.timeout(20_000) }) };
-
-if (!apiKey) {
-  console.error("[ombi-connections] no ombi API key — ombi's own `api-key` secret has not been accepted");
-  process.exit(1);
-}
-const ombi = { url, apiKey };
-
-if (!(await ombiReady(http, ombi, waitSeconds * 1000))) {
-  console.error(`[ombi-connections] ombi did not answer at ${url} within ${waitSeconds}s`);
-  process.exit(1);
-}
-
-const inputs = async (provision: string) =>
-  [await readBinding(join(dir, `${provision}.json`)), await readIfThere(join(dir, `${provision}.secret`))] as const;
-
-const outcomes: Outcome[] = [];
-for (const spec of APPS) {
-  outcomes.push(await reconcileApp(http, ombi, spec, ...(await inputs(spec.provision))));
-}
-outcomes.push(await reconcilePlex(http, ombi, ...(await inputs(PLEX_PROVISION))));
-
-let failed = 0;
-for (const outcome of outcomes) {
-  switch (outcome.result) {
-    case "unchanged":
-      console.log(`[ombi-connections] ${outcome.app}: already as the mesh says; connection tested`);
-      break;
-    case "written":
-      console.log(`[ombi-connections] ${outcome.app}: wrote ${outcome.fields.join(", ")}; connection tested`);
-      break;
-    case "refused":
-      failed++;
-      console.error(`[ombi-connections] ${outcome.app}: ${outcome.problem}`);
-      break;
-  }
-}
-process.exitCode = failed > 0 ? 1 : 0;
@@ -28,15 +28,10 @@
      "path": "/var/lib/mesh/ombi",
      "mode": "0700"
    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
    {
      "id": "config",
      "type": "directory",
+      "path": "/services/ombi/config",
      "mode": "0700",
      "owner": "1000:1000"
    },
@@ -44,7 +39,7 @@
      "id": "server",
      "type": "container",
      "name": "ombi",
-      "image": "lscr.io/linuxserver/ombi@sha256:22d6ebadbaaa728571353e74dc2173719e0fb02d4eaec551a7e9d2ee99ef68ac",
+      "image": "lscr.io/linuxserver/ombi@sha256:a6f76ac521ba01eee2e9f0c23a3fed22e56630d97a04d5eeaeaa36c1e681640d",
      "env": {
        "PUID": "1000",
        "PGID": "1000",
@@ -54,7 +49,7 @@
        "3579"
      ],
      "volumes": [
-        "${dir:config}:/config"
+        "/services/ombi/config:/config"
      ]
    },
    {
@@ -73,64 +68,24 @@
      "volumes": [
        "/var/lib/mesh/ombi/broker:/run/secrets/broker:ro",
        "/var/lib/mesh/ombi/api-key:/run/secrets/api-key:ro",
-        "/var/lib/mesh/ombi/config.json:/run/config/config.json:ro"
+        "/var/lib/mesh/ombi/config.json:/run/config/config.json:ro",
+        "/services/ombi/config:/var/lib/ombi/config:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_OMBI_URL": "http://127.0.0.1:${port:3579}",
+        "MESH_OMBI_URL": "http://127.0.0.1:3579",
        "MESH_OMBI_API_KEY_FILE": "/run/secrets/api-key",
-        "MESH_OMBI_CONFIG_FILE": "/run/config/config.json"
+        "MESH_OMBI_CONFIG_FILE": "/run/config/config.json",
+        "MESH_OMBI_CONFIG_DIR": "/var/lib/ombi/config"
      },
      "restart-on": [
        "runtime-config"
      ],
      "artifact": "runtime"
-    },
-    {
-      "id": "connections",
-      "type": "container",
-      "name": "mesh-ombi-connections",
-      "network": "host",
-      "run-once": true,
-      "volumes": [
-        "/var/lib/mesh/ombi/api-key:/run/secrets/api-key:ro",
-        "${dir:state}/sonarr-api.json:/run/connections/sonarr-api.json:ro",
-        "${dir:state}/sonarr-api.secret:/run/connections/sonarr-api.secret:ro",
-        "${dir:state}/radarr-api.json:/run/connections/radarr-api.json:ro",
-        "${dir:state}/radarr-api.secret:/run/connections/radarr-api.secret:ro",
-        "${dir:state}/lidarr-api.json:/run/connections/lidarr-api.json:ro",
-        "${dir:state}/lidarr-api.secret:/run/connections/lidarr-api.secret:ro",
-        "${dir:state}/plex-api.json:/run/connections/plex-api.json:ro",
-        "${dir:state}/plex-api.secret:/run/connections/plex-api.secret:ro"
-      ],
-      "env": {
-        "MESH_OMBI_URL": "http://127.0.0.1:${port:3579}",
-        "MESH_OMBI_API_KEY_FILE": "/run/secrets/api-key",
-        "MESH_CONNECTIONS_DIR": "/run/connections"
-      },
-      "args": [
-        "run",
-        "/app/modules/ombi/dist/connections/index.js"
-      ],
-      "restart-on": [
-        "bound-sonarr-api",
-        "secret-sonarr-api",
-        "bound-radarr-api",
-        "secret-radarr-api",
-        "bound-lidarr-api",
-        "secret-lidarr-api",
-        "bound-plex-api",
-        "secret-plex-api"
-      ],
-      "artifact": "runtime"
    }
  ],
  "requires": [
-    "lidarr-api",
-    "plex-api",
-    "radarr-api",
-    "route",
-    "sonarr-api"
+    "route"
  ],
  "contributes": {
    "route": {
@@ -139,17 +94,7 @@
    }
  },
  "binds": {
-    "route": "${dir:state}/route.json",
-    "sonarr-api": "${dir:state}/sonarr-api.json",
-    "radarr-api": "${dir:state}/radarr-api.json",
-    "lidarr-api": "${dir:state}/lidarr-api.json",
-    "plex-api": "${dir:state}/plex-api.json"
-  },
-  "secrets": {
-    "sonarr-api": "${dir:state}/sonarr-api.secret",
-    "radarr-api": "${dir:state}/radarr-api.secret",
-    "lidarr-api": "${dir:state}/lidarr-api.secret",
-    "plex-api": "${dir:state}/plex-api.secret"
+    "route": "/var/lib/mesh/ombi/route.json"
  },
  "build": {
    "on": [
@@ -4,11 +4,6 @@
  "description": "ombi — media requests. Its API client, tools and events live here (novox/hq ADR 0039).",
  "type": "module",
  "private": true,
-  "scripts": {
-    "build": "tsc client.ts index.ts tools/index.ts servarr/settings.ts plex/settings.ts connections/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "typecheck": "tsc -p tsconfig.json",
-    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
-  },
  "dependencies": {
    "@novox/mesh-sdk": "^0.1.0"
  },
@@ -1,271 +0,0 @@
-// Where ombi reaches Plex — decided by the mesh, written into ombi by ombi's own API.
-//
-// **Why this exists.** ombi keeps its Plex servers in its own database (OmbiSettings.db), so the
-// mesh has no file to write `${bound:plex-api:at}` into. ombi requires `plex-api`; the mesh delivers
-// a binding (where plex is: `at`, and what it serves: `port`, `scheme`) and a pair credential (the
-// server owner's X-Plex-Token, accepted by the operator — plex.tv issues it and the mesh cannot
-// mint it). This step makes ombi's Plex settings say the same thing, beside its Servarr ones.
-//
-// **Which entry is plex's.** ombi may list several Plex servers. The one this provision names is
-// found by the server's own machineIdentifier, which plex answers at /identity — the same value
-// ombi stored when an operator loaded the server in its settings screen. That entry's connection is
-// brought in line; an entry for any other server is never touched.
-//
-// When no entry carries that identifier, an entry may still be this server reached another way:
-// ace's ombi holds one loaded from an older server and later retyped to plex's public name, so its
-// stored identifier is stale while its address answers as this plex. Each entry's OWN address is
-// asked for /identity, and an entry plex itself answers for is this server's — adopted: its
-// connection laid over and its identifier corrected (ombi builds its "view in Plex" links from it).
-// Nothing is guessed: an entry whose address is unreachable, or answers as another server, is left
-// as it was. Only when no entry is this server's either way is one added, named as plex names
-// itself — it is the mesh's, so later runs keep it true.
-//
-// **Only the connection, and only when it differs.** Host, port, TLS, base path and token — and the
-// identifier of an adopted entry. Whether Plex is enabled in ombi, watchlist import, the selected
-// libraries, the batch size and everything else an operator chose are left exactly as they are.
-//
-// **A token plex refuses is never written.** Until the operator accepts the server's token for this
-// pair, the mesh delivers a value it minted itself, which plex answers with 401 (or 400 on its own
-// network). Writing it would replace a working token in ombi with a dead one, so the token is tried
-// against plex first; refused, nothing is written and the step fails naming the `secret accept`.
-
-import { isLoopback, ombiCall, type Binding, type Http, type Ombi, type Outcome } from "../servarr/settings.js";
-
-/** The provision ombi requires for Plex — the manifest's `requires`, `binds` and `secrets` key. */
-export const PLEX_PROVISION = "plex-api";
-
-/** The connection fields ombi keeps for a Plex server — the only ones this step ever writes. */
-export interface PlexConnection {
-  ip: string;
-  port: number;
-  ssl: boolean;
-  subDir: string | null;
-  plexAuthToken: string;
-}
-
-export type PlexWanted = { ok: true; connection: PlexConnection; from: string } | { ok: false; problem: string };
-
-/** The connection the mesh says ombi should use, from the binding and the pair credential. */
-export function wantedPlex(binding: Binding | undefined, credential: string | undefined): PlexWanted {
-  if (!binding) {
-    return { ok: false, problem: `no binding for ${PLEX_PROVISION} was delivered — the mesh writes it before this step runs` };
-  }
-  const at = typeof binding.at === "string" ? binding.at.trim() : "";
-  const serves = binding.serves ?? {};
-  const port = Number(serves.port);
-  if (!at) return { ok: false, problem: `the ${PLEX_PROVISION} binding names no host (at)` };
-  if (isLoopback(at)) {
-    return {
-      ok: false,
-      problem:
-        `the ${PLEX_PROVISION} binding says plex is at ${at}, which from ombi's own container is ombi itself. ` +
-        `The mesh hands loopback to a machine that is not on the private network; put it on the private ` +
-        `network so plex has an address ombi can dial`,
-    };
-  }
-  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
-    return { ok: false, problem: `the ${PLEX_PROVISION} binding serves no usable port (${String(serves.port)})` };
-  }
-  const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http";
-  if (scheme !== "http" && scheme !== "https") {
-    return { ok: false, problem: `the ${PLEX_PROVISION} binding serves scheme ${scheme}, which ombi cannot dial` };
-  }
-  const token = (credential ?? "").trim();
-  if (!token) return { ok: false, problem: `the ${PLEX_PROVISION} credential is empty or was not delivered` };
-  return {
-    ok: true,
-    from: typeof binding.from === "string" ? binding.from : "",
-    connection: { ip: at, port, ssl: scheme === "https", subDir: null, plexAuthToken: token },
-  };
-}
-
-/** plex's base URL as the step dials it — the same host and port ombi will be given. */
-export function plexUrl(want: PlexConnection): string {
-  const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip;
-  return `${want.ssl ? "https" : "http"}://${host}:${want.port}`;
-}
-
-/** Which connection fields differ between an entry ombi holds and what the mesh says. Names only. */
-export function differingPlex(current: Record<string, unknown> | undefined, want: PlexConnection): (keyof PlexConnection)[] {
-  const now = current ?? {};
-  const out: (keyof PlexConnection)[] = [];
-  if (String(now.ip ?? "") !== want.ip) out.push("ip");
-  if (Number(now.port ?? 0) !== want.port) out.push("port");
-  if (Boolean(now.ssl) !== want.ssl) out.push("ssl");
-  const sub = typeof now.subDir === "string" && now.subDir.trim() !== "" ? now.subDir : null;
-  if (sub !== want.subDir) out.push("subDir");
-  if (String(now.plexAuthToken ?? "") !== want.plexAuthToken) out.push("plexAuthToken");
-  return out;
-}
-
-async function plexGet(http: Http, want: PlexConnection, path: string, withToken: boolean) {
-  const headers: Record<string, string> = { Accept: "application/json" };
-  if (withToken) headers["X-Plex-Token"] = want.plexAuthToken;
-  return http.fetch(`${plexUrl(want)}${path}`, { method: "GET", headers });
-}
-
-/**
- * Does plex take this token? `true` it does; `false` it refused it — 401 or 403, or 400, which is
- * what plex answers a token it never issued on a network it trusts. A thrown error when plex could
- * not be asked.
- */
-export async function plexTakes(http: Http, want: PlexConnection): Promise<{ takes: boolean; friendlyName?: string }> {
-  const res = await plexGet(http, want, "/", true);
-  if (res.status === 400 || res.status === 401 || res.status === 403) return { takes: false };
-  if (res.status < 200 || res.status >= 300) throw new Error(`plex answered ${res.status} at /`);
-  let friendlyName: string | undefined;
-  try {
-    const body = JSON.parse(await res.text()) as { MediaContainer?: { friendlyName?: unknown } };
-    if (typeof body.MediaContainer?.friendlyName === "string") friendlyName = body.MediaContainer.friendlyName;
-  } catch {
-    // a name is a nicety for a new entry, not a condition
-  }
-  return { takes: true, friendlyName };
-}
-
-/** The server's own machineIdentifier, which plex answers without a token. */
-export async function plexIdentity(http: Http, want: Pick<PlexConnection, "ip" | "port" | "ssl" | "subDir">): Promise<string> {
-  const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip;
-  const base = `${want.ssl ? "https" : "http"}://${host}:${want.port}${want.subDir ? `/${want.subDir.replace(/^\/+|\/+$/g, "")}` : ""}`;
-  const res = await http.fetch(`${base}/identity`, { method: "GET", headers: { Accept: "application/json" } });
-  if (res.status !== 200) throw new Error(`plex answered ${res.status} at /identity`);
-  const body = JSON.parse(await res.text()) as { MediaContainer?: { machineIdentifier?: unknown } };
-  const id = body.MediaContainer?.machineIdentifier;
-  if (typeof id !== "string" || id === "") throw new Error("plex's /identity names no machineIdentifier");
-  return id;
-}
-
-/** The remedy for a refused token, in the controller's own words (ADR 0092). */
-export function plexAcceptRemedy(from: string): string {
-  return (
-    `plex refuses the ${PLEX_PROVISION} credential the mesh delivered, so it was not written into ombi. ` +
-    `plex's token is issued by plex.tv and the mesh cannot make it: accept the server's own token for ` +
-    `this pair — \`secret accept <this node> ombi ${PLEX_PROVISION} --provider ${from || "<its node>"} ` +
-    `--from <file holding the server's X-Plex-Token>\``
-  );
-}
-
-/** The batch size ombi's settings screen fills in for a server it adds ("150 by default"). */
-const EPISODE_BATCH_SIZE = 150;
-
-/** ombi's server entries, as its settings document holds them (null on a fresh ombi). */
-export function serversOf(document: Record<string, unknown> | undefined): Record<string, unknown>[] {
-  const servers = document?.servers;
-  return Array.isArray(servers) ? (servers as Record<string, unknown>[]) : [];
-}
-
-/**
- * Which entries, holding another identifier, plex answers for at their own address — this server,
- * reached another way. Asked only when no entry carries the identifier. An entry that cannot be
- * asked is not this server's: nothing is guessed.
- */
-export async function answeringAs(http: Http, servers: Record<string, unknown>[], machineIdentifier: string): Promise<Set<number>> {
-  const out = new Set<number>();
-  if (servers.some((s) => s?.machineIdentifier === machineIdentifier)) return out;
-  for (const [i, s] of servers.entries()) {
-    const ip = typeof s?.ip === "string" ? s.ip.trim() : "";
-    const port = Number(s?.port);
-    if (!ip || !Number.isInteger(port) || port <= 0 || port > 65535) continue;
-    const subDir = typeof s.subDir === "string" && s.subDir.trim() !== "" ? s.subDir : null;
-    try {
-      if ((await plexIdentity(http, { ip, port, ssl: Boolean(s.ssl), subDir })) === machineIdentifier) out.add(i);
-    } catch {
-      // unreachable, or not a plex: not this server's
-    }
-  }
-  return out;
-}
-
-/**
- * ombi's Plex settings with this server's connection laid over them: every entry naming the
- * server's machineIdentifier — or adopted, its address answering as this server — gets the
- * connection (an adopted one also the identifier), every other entry is left as it was, and when
- * none is this server's one is added. Returns the document to save and the fields that changed.
- */
-export function withPlexServer(
-  document: Record<string, unknown> | undefined,
-  machineIdentifier: string,
-  want: PlexConnection,
-  name: string,
-  adopted: ReadonlySet<number> = new Set(),
-): { next: Record<string, unknown>; fields: string[]; added: boolean; entry: Record<string, unknown> } {
-  const doc = document ?? {};
-  const servers = serversOf(doc);
-  const fields = new Set<string>();
-  let entry: Record<string, unknown> | undefined;
-  const next = servers.map((s, i) => {
-    const adopt = adopted.has(i) && s?.machineIdentifier !== machineIdentifier;
-    if (s?.machineIdentifier !== machineIdentifier && !adopt) return s;
-    for (const f of differingPlex(s, want)) fields.add(f);
-    if (adopt) fields.add("machineIdentifier");
-    const laid = { ...s, machineIdentifier, ip: want.ip, port: want.port, ssl: want.ssl, subDir: want.subDir, plexAuthToken: want.plexAuthToken };
-    entry ??= laid;
-    return laid;
-  });
-  if (entry) return { next: { ...doc, servers: next }, fields: [...fields], added: false, entry };
-  const added: Record<string, unknown> = {
-    name,
-    machineIdentifier,
-    ip: want.ip,
-    port: want.port,
-    ssl: want.ssl,
-    subDir: want.subDir,
-    plexAuthToken: want.plexAuthToken,
-    episodeBatchSize: EPISODE_BATCH_SIZE,
-    plexSelectedLibraries: [],
-  };
-  return { next: { ...doc, servers: [...next, added] }, fields: ["server"], added: true, entry: added };
-}
-
-/**
- * Bring ombi's connection to plex in line with the mesh: check the token against plex, find the
- * server's entry by its machineIdentifier, write only the connection fields when they differ (or add
- * the entry), then have ombi test the connection from its own container. Never throws.
- */
-export async function reconcilePlex(http: Http, ombi: Ombi, binding: Binding | undefined, credential: string | undefined): Promise<Outcome> {
-  const app = "plex";
-  const w = wantedPlex(binding, credential);
-  // `in`, not `!w.ok`: the Dockerfile compiles without strict, where a boolean discriminant does not
-  // narrow.
-  if ("problem" in w) return { app, result: "refused", problem: w.problem };
-  const want = w.connection;
-
-  let name: string;
-  let machineIdentifier: string;
-  try {
-    const taken = await plexTakes(http, want);
-    if (!taken.takes) return { app, result: "refused", problem: plexAcceptRemedy(w.from) };
-    machineIdentifier = await plexIdentity(http, want);
-    name = taken.friendlyName || "Plex";
-  } catch (err) {
-    return { app, result: "refused", problem: `plex could not be asked whether it takes the token at ${want.ip}:${want.port}: ${message(err)}` };
-  }
-
-  try {
-    const document = (await ombiCall(http, ombi, "GET", "/Settings/Plex")) as Record<string, unknown> | undefined;
-    const adopted = await answeringAs(http, serversOf(document), machineIdentifier);
-    const laid = withPlexServer(document, machineIdentifier, want, name, adopted);
-    if (laid.fields.length > 0) {
-      const saved = await ombiCall(http, ombi, "POST", "/Settings/Plex", laid.next);
-      if (saved === false) return { app, result: "refused", problem: "ombi declined to save its Plex settings" };
-    }
-    // ombi's own test, from ombi's own container — the path the step's check above did not take.
-    const tested = await ombiCall(http, ombi, "POST", "/Tester/plex", laid.entry);
-    if (tested !== true) {
-      return {
-        app,
-        result: "refused",
-        problem:
-          `ombi cannot reach plex at ${want.ip}:${want.port} from its own container` +
-          (laid.fields.length > 0 ? `; its settings were written (${laid.fields.join(", ")})` : ""),
-      };
-    }
-    return laid.fields.length > 0 ? { app, result: "written", fields: laid.fields } : { app, result: "unchanged" };
-  } catch (err) {
-    return { app, result: "refused", problem: message(err) };
-  }
-}
-
-function message(err: unknown): string {
-  return err instanceof Error ? err.message : String(err);
-}
@@ -1,304 +0,0 @@
-// Where ombi reaches Sonarr, Radarr and Lidarr — decided by the mesh, written into ombi by ombi's
-// own API.
-//
-// **Why this exists.** ombi keeps its connection to each Servarr app in its own database
-// (OmbiSettings.db), not in a file, so the mesh has nowhere to write `${bound:sonarr-api:at}` for it.
-// ombi requires `sonarr-api`, `radarr-api` and `lidarr-api`; the mesh delivers, for each, a binding
-// (where the app is: `at`, and what it serves: `port`, `scheme`, `url-base`) and a pair credential
-// (the app's API key, accepted by the operator — a Servarr app has exactly one key and the mesh
-// cannot mint it). This step reads those files and makes ombi's settings say the same thing.
-//
-// **Only the connection, and only when it differs.** Host, port, TLS, base path and API key. The
-// quality profile, root folder, language profile, tags, "enabled" and every other choice an operator
-// made in ombi's settings screen are left exactly as they are: the mesh knows where the app is, not
-// what ombi should do with it. Radarr's 4K instance is a different Radarr and is not touched.
-//
-// **A credential the app refuses is never written.** Until the operator accepts the app's API key
-// for this pair, the mesh delivers a value it minted itself, which no Servarr app will ever accept
-// (novox/hq ADR 0092). Writing it would replace a working key in ombi with a dead one. So the key is
-// tried against the app first; refused, nothing for that app is written and the step fails naming
-// the `secret accept` that fixes it.
-//
-// Pure logic and a small HTTP seam, so it is tested against fake servers (test/servarr.test.ts).
-
-import { readFile } from "node:fs/promises";
-
-/** One Servarr app ombi connects to, and the shape of that connection in ombi's API. */
-export interface ServarrApp {
-  /** The app, as ombi's API names it: /Settings/<app>, /Tester/<app>. */
-  app: "sonarr" | "radarr" | "lidarr";
-  /** The provision it is required as — the manifest's `requires`, `binds` and `secrets` key. */
-  provision: string;
-  /** The app's own status endpoint, which answers 401 to a wrong key. */
-  statusPath: string;
-  /**
-   * Where the one connection sits in ombi's settings document. Radarr's is `{radarr, radarr4K}`
-   * (two Radarr instances); only `radarr` is this provision's.
-   */
-  within?: string;
-}
-
-export const APPS: readonly ServarrApp[] = [
-  { app: "sonarr", provision: "sonarr-api", statusPath: "/api/v3/system/status" },
-  { app: "radarr", provision: "radarr-api", statusPath: "/api/v3/system/status", within: "radarr" },
-  { app: "lidarr", provision: "lidarr-api", statusPath: "/api/v1/system/status" },
-];
-
-/** The connection fields ombi keeps for an app — the only ones this step ever writes. */
-export interface Connection {
-  ip: string;
-  port: number;
-  ssl: boolean;
-  /** ombi's name for the app's URL base; null when the app is served at the root. */
-  subDir: string | null;
-  apiKey: string;
-}
-
-/** What the mesh wrote at `binds.<provision>`: the binding document (controller's boundFile). */
-export interface Binding {
-  provision?: string;
-  from?: string;
-  at?: string;
-  as?: string;
-  serves?: Record<string, unknown>;
-}
-
-export type Wanted = { ok: true; connection: Connection; from: string } | { ok: false; problem: string };
-
-/**
- * The connection the mesh says ombi should use, from the binding and the pair credential.
- *
- * Refused rather than guessed when the binding cannot be dialled from ombi's own container: a
- * loopback `at` — what the mesh hands a machine that is not on the private network — is ombi's
- * container itself, not the app.
- */
-export function wanted(spec: ServarrApp, binding: Binding | undefined, credential: string | undefined): Wanted {
-  if (!binding) {
-    return { ok: false, problem: `no binding for ${spec.provision} was delivered — the mesh writes it before this step runs` };
-  }
-  const at = typeof binding.at === "string" ? binding.at.trim() : "";
-  const serves = binding.serves ?? {};
-  const port = Number(serves.port);
-  if (!at) {
-    return { ok: false, problem: `the ${spec.provision} binding names no host (at)` };
-  }
-  if (isLoopback(at)) {
-    return {
-      ok: false,
-      problem:
-        `the ${spec.provision} binding says ${spec.app} is at ${at}, which from ombi's own container is ` +
-        `ombi itself. The mesh hands loopback to a machine that is not on the private network; put it ` +
-        `on the private network so ${spec.app} has an address ombi can dial`,
-    };
-  }
-  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
-    return { ok: false, problem: `the ${spec.provision} binding serves no usable port (${String(serves.port)})` };
-  }
-  const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http";
-  if (scheme !== "http" && scheme !== "https") {
-    return { ok: false, problem: `the ${spec.provision} binding serves scheme ${scheme}, which ombi cannot dial` };
-  }
-  const key = (credential ?? "").trim();
-  if (!key) {
-    return { ok: false, problem: `the ${spec.provision} credential is empty or was not delivered` };
-  }
-  return {
-    ok: true,
-    from: typeof binding.from === "string" ? binding.from : "",
-    connection: { ip: at, port, ssl: scheme === "https", subDir: subDirOf(serves["url-base"]), apiKey: key },
-  };
-}
-
-/** ombi's `subDir`: the URL base with its slashes trimmed, null when there is none. */
-export function subDirOf(urlBase: unknown): string | null {
-  const trimmed = typeof urlBase === "string" ? urlBase.trim().replace(/^\/+|\/+$/g, "") : "";
-  return trimmed === "" ? null : trimmed;
-}
-
-export function isLoopback(host: string): boolean {
-  const h = host.toLowerCase();
-  return h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h);
-}
-
-/** Which connection fields differ between what ombi holds and what the mesh says. Names only. */
-export function differing(current: Record<string, unknown> | undefined, want: Connection): (keyof Connection)[] {
-  const now = current ?? {};
-  const out: (keyof Connection)[] = [];
-  if (String(now.ip ?? "") !== want.ip) out.push("ip");
-  if (Number(now.port ?? 0) !== want.port) out.push("port");
-  if (Boolean(now.ssl) !== want.ssl) out.push("ssl");
-  if (subDirOf(now.subDir) !== want.subDir) out.push("subDir");
-  if (String(now.apiKey ?? "") !== want.apiKey) out.push("apiKey");
-  return out;
-}
-
-/** ombi's settings for the app with the connection laid over them and nothing else changed. */
-export function withConnection(current: Record<string, unknown> | undefined, want: Connection): Record<string, unknown> {
-  return { ...(current ?? {}), ip: want.ip, port: want.port, ssl: want.ssl, subDir: want.subDir, apiKey: want.apiKey };
-}
-
-/** The app's base URL as the step dials it — the same host and port ombi will be given. */
-export function appUrl(want: Connection): string {
-  const scheme = want.ssl ? "https" : "http";
-  const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip;
-  return `${scheme}://${host}:${want.port}${want.subDir ? `/${want.subDir}` : ""}`;
-}
-
-/** How one app came out. */
-export type Outcome =
-  | { app: string; result: "unchanged" }
-  | { app: string; result: "written"; fields: string[] }
-  | { app: string; result: "refused"; problem: string };
-
-/** The HTTP the step needs, so a test can stand fakes in for ombi and the apps. */
-export interface Http {
-  fetch(url: string, init?: { method?: string; headers?: Record<string, string>; body?: string }): Promise<{
-    status: number;
-    text(): Promise<string>;
-  }>;
-}
-
-export interface Ombi {
-  url: string;
-  apiKey: string;
-}
-
-export async function ombiCall(http: Http, ombi: Ombi, method: string, path: string, body?: unknown): Promise<unknown> {
-  const res = await http.fetch(`${ombi.url.replace(/\/$/, "")}/api/v1${path}`, {
-    method,
-    headers: {
-      ApiKey: ombi.apiKey,
-      Accept: "application/json",
-      ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
-    },
-    body: body !== undefined ? JSON.stringify(body) : undefined,
-  });
-  const text = await res.text();
-  if (res.status < 200 || res.status >= 300) {
-    // The body is ombi's error, never a request echo, so it carries no key.
-    throw new Error(`ombi ${method} ${path} answered ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`);
-  }
-  return text ? (JSON.parse(text) as unknown) : undefined;
-}
-
-/**
- * Does the app take this key? `true` it does, `false` it refused it (401/403), and a thrown error
- * when it could not be asked — unreachable, or answering something that is neither.
- */
-export async function appTakes(http: Http, spec: ServarrApp, want: Connection): Promise<boolean> {
-  const res = await http.fetch(`${appUrl(want)}${spec.statusPath}`, {
-    method: "GET",
-    headers: { "X-Api-Key": want.apiKey, Accept: "application/json" },
-  });
-  if (res.status === 401 || res.status === 403) return false;
-  if (res.status >= 200 && res.status < 300) return true;
-  throw new Error(`${spec.app} answered ${res.status} at ${spec.statusPath}`);
-}
-
-/** The remedy for a refused key, in the controller's own words (ADR 0092). */
-export function acceptRemedy(spec: ServarrApp, from: string): string {
-  return (
-    `${spec.app} refuses the ${spec.provision} credential the mesh delivered, so it was not written ` +
-    `into ombi. A Servarr app has one API key and the mesh cannot make it: accept ${spec.app}'s own ` +
-    `key for this pair — \`secret accept <this node> ombi ${spec.provision} --provider ${from || "<its node>"} ` +
-    `--from <file holding ${spec.app}'s ApiKey>\``
-  );
-}
-
-/**
- * Bring ombi's connection to one app in line with the mesh: check the key against the app, compare,
- * write only the connection fields when they differ, then have ombi test the connection from its own
- * container. Never throws: every failure is an outcome with a reason.
- */
-export async function reconcileApp(
-  http: Http,
-  ombi: Ombi,
-  spec: ServarrApp,
-  binding: Binding | undefined,
-  credential: string | undefined,
-): Promise<Outcome> {
-  const w = wanted(spec, binding, credential);
-  // `in`, not `!w.ok`: the Dockerfile compiles without strict, where a boolean discriminant does not
-  // narrow.
-  if ("problem" in w) return { app: spec.app, result: "refused", problem: w.problem };
-  const want = w.connection;
-
-  try {
-    if (!(await appTakes(http, spec, want))) {
-      return { app: spec.app, result: "refused", problem: acceptRemedy(spec, w.from) };
-    }
-  } catch (err) {
-    return {
-      app: spec.app,
-      result: "refused",
-      problem: `${spec.app} could not be asked whether it takes the key at ${want.ip}:${want.port}: ${message(err)}`,
-    };
-  }
-
-  try {
-    const document = (await ombiCall(http, ombi, "GET", `/Settings/${spec.app}`)) as Record<string, unknown> | undefined;
-    const current = spec.within ? (document?.[spec.within] as Record<string, unknown> | undefined) : document;
-    const fields = differing(current, want);
-    if (fields.length > 0) {
-      const next = withConnection(current, want);
-      const body = spec.within ? { ...(document ?? {}), [spec.within]: next } : next;
-      const saved = await ombiCall(http, ombi, "POST", `/Settings/${spec.app}`, body);
-      if (saved === false) {
-        return { app: spec.app, result: "refused", problem: `ombi declined to save its ${spec.app} settings` };
-      }
-    }
-    // ombi's own test, from ombi's own container — the path the step's check above did not take.
-    const tested = (await ombiCall(http, ombi, "POST", `/Tester/${spec.app}`, withConnection(current, want))) as
-      | { isValid?: boolean; expectedSubDir?: string | null }
-      | undefined;
-    if (!tested?.isValid) {
-      const hint = tested?.expectedSubDir ? ` (ombi expected the base path ${tested.expectedSubDir})` : "";
-      return {
-        app: spec.app,
-        result: "refused",
-        problem:
-          `ombi cannot reach ${spec.app} at ${want.ip}:${want.port} from its own container${hint}` +
-          (fields.length > 0 ? `; its settings were written (${fields.join(", ")})` : ""),
-      };
-    }
-    return fields.length > 0 ? { app: spec.app, result: "written", fields } : { app: spec.app, result: "unchanged" };
-  } catch (err) {
-    return { app: spec.app, result: "refused", problem: message(err) };
-  }
-}
-
-/** Wait for ombi to answer, because the step runs right after its container starts. */
-export async function ombiReady(http: Http, ombi: Ombi, waitMs: number, pauseMs = 2000): Promise<boolean> {
-  const until = Date.now() + waitMs;
-  for (;;) {
-    try {
-      const res = await http.fetch(`${ombi.url.replace(/\/$/, "")}/api/v1/Status`, { method: "GET" });
-      if (res.status === 200) return true;
-    } catch {
-      // not listening yet
-    }
-    if (Date.now() >= until) return false;
-    await new Promise((r) => setTimeout(r, pauseMs));
-  }
-}
-
-/** A file the mesh wrote, or undefined when it is not there. */
-export async function readIfThere(path: string | undefined): Promise<string | undefined> {
-  if (!path) return undefined;
-  return readFile(path, "utf8").catch(() => undefined);
-}
-
-/** A binding file parsed, or undefined when absent or not JSON. */
-export async function readBinding(path: string | undefined): Promise<Binding | undefined> {
-  const raw = await readIfThere(path);
-  if (raw === undefined) return undefined;
-  try {
-    return JSON.parse(raw) as Binding;
-  } catch {
-    return undefined;
-  }
-}
-
-function message(err: unknown): string {
-  return err instanceof Error ? err.message : String(err);
-}
@@ -1,223 +0,0 @@
-// What holds ombi's Plex step (plex/settings.ts): the entry for the server plex says it is — found
-// by machineIdentifier — is made to say what the mesh bound (host, port, TLS, token) and nothing
-// else it keeps is touched; an entry for another server is left alone; an ombi with no entry for it
-// gets one; nothing is written when nothing differs; and a token plex refuses (the mesh's own minted
-// value, before the operator accepts the server's token) is never written, with the `secret accept`
-// that fixes it named.
-//
-// ombi and plex are fakes answering the routes the step touches as the real ones do (checked against
-// lscr.io/linuxserver/ombi 4.53.10 and plexinc/pms-docker 1.43.4: plex answers 401 to an unknown
-// token from another network and 400 on one it trusts; ombi's /Tester/plex answers a bare boolean).
-//
-// Imports the compiled step, as keycloak's tests do: plex/settings.ts imports its sibling with the
-// `.js` specifier the build needs, which Node's type stripping does not resolve to a `.ts` file.
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { differingPlex, reconcilePlex, wantedPlex, withPlexServer } from "../dist/plex/settings.js";
-import type { Binding, Http } from "../servarr/settings.ts";
-
-const TOKEN = "the-servers-own-token";
-const MACHINE = "5c47d9a165d10b622995d55b3ae1f168242f33bd";
-const OMBI = { url: "http://127.0.0.1:3579", apiKey: "ombi-key" };
-
-function binding(port = 32400, at = "ace.internal", scheme = "http"): Binding {
-  return { binding: 1, provision: "plex-api", from: "ace", at, as: "mesh_ace_ombi", serves: { scheme, port } } as Binding;
-}
-
-interface Call {
-  method: string;
-  url: string;
-  body?: unknown;
-}
-
-function fakes(plexSettings: Record<string, unknown>, opts: { reachable?: boolean; trusted?: boolean } = {}) {
-  const calls: Call[] = [];
-  const store = { plex: plexSettings };
-  const http: Http = {
-    async fetch(url, init) {
-      const method = init?.method ?? "GET";
-      const body = init?.body ? (JSON.parse(init.body) as unknown) : undefined;
-      calls.push({ method, url, body });
-      const reply = (status: number, value?: unknown) => ({
-        status,
-        text: async () => (value === undefined ? "" : JSON.stringify(value)),
-      });
-      const u = new URL(url);
-      // Other servers an entry may name: a friend's, and plex's own public name (the same server).
-      if (u.hostname === "10.0.0.9") return reply(200, { MediaContainer: { machineIdentifier: "another-server" } });
-      if (u.hostname === "gone.example") throw new Error("getaddrinfo ENOTFOUND");
-      if (u.hostname === "plex.zurag.be") {
-        if (u.pathname === "/identity") return reply(200, { MediaContainer: { machineIdentifier: MACHINE } });
-        return reply(401);
-      }
-      if (u.port === "32400" || u.hostname === "ace.internal") {
-        if (opts.reachable === false) throw new Error("connect ECONNREFUSED");
-        if (u.pathname === "/identity") return reply(200, { MediaContainer: { machineIdentifier: MACHINE } });
-        const token = init?.headers?.["X-Plex-Token"];
-        if (token !== TOKEN) return reply(opts.trusted ? 400 : 401);
-        return reply(200, { MediaContainer: { friendlyName: "ace", machineIdentifier: MACHINE } });
-      }
-      if (init?.headers?.ApiKey !== "ombi-key") return reply(401);
-      if (u.pathname === "/api/v1/Settings/Plex" && method === "GET") return reply(200, store.plex);
-      if (u.pathname === "/api/v1/Settings/Plex" && method === "POST") {
-        store.plex = body as Record<string, unknown>;
-        return reply(200, true);
-      }
-      if (u.pathname === "/api/v1/Tester/plex") {
-        const tried = body as { plexAuthToken?: string; ip?: string };
-        return reply(200, tried.plexAuthToken === TOKEN && tried.ip === "ace.internal");
-      }
-      return reply(404);
-    },
-  };
-  return { http, calls, store };
-}
-
-// What an operator's ombi holds: plex loaded through its public name, plus a friend's server.
-const operatorPlex = () => ({
-  enable: true,
-  enableWatchlistImport: true,
-  monitorAll: false,
-  installId: "b358a2a2-2ab0-4025-a3f3-450313c3c418",
-  servers: [
-    {
-      name: "ace", plexAuthToken: TOKEN, machineIdentifier: MACHINE, episodeBatchSize: 150,
-      serverHostname: "https://app.plex.tv", plexSelectedLibraries: [{ key: "1", title: "Films", enabled: true }],
-      ssl: true, subDir: null, ip: "plex.zurag.be", port: 443, id: 1,
-    },
-    {
-      name: "a friend", plexAuthToken: "their-token", machineIdentifier: "another-server", episodeBatchSize: 150,
-      plexSelectedLibraries: [], ssl: false, subDir: null, ip: "10.0.0.9", port: 32400, id: 2,
-    },
-  ],
-  id: 4,
-});
-
-test("the server's own entry gets the bound connection; its libraries and every other setting stay", async () => {
-  const f = fakes(operatorPlex());
-  const out = await reconcilePlex(f.http, OMBI, binding(), `${TOKEN}\n`);
-  assert.deepEqual(out, { app: "plex", result: "written", fields: ["ip", "port", "ssl"] });
-  const want = operatorPlex();
-  Object.assign(want.servers[0], { ip: "ace.internal", port: 32400, ssl: false });
-  assert.deepEqual(f.store.plex, want);
-});
-
-test("another server's entry is never touched", async () => {
-  const f = fakes(operatorPlex());
-  await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  const servers = f.store.plex.servers as Record<string, unknown>[];
-  assert.deepEqual(servers[1], operatorPlex().servers[1]);
-});
-
-test("nothing is written when ombi already says what the mesh says", async () => {
-  const doc = operatorPlex();
-  Object.assign(doc.servers[0], { ip: "ace.internal", port: 32400, ssl: false });
-  const f = fakes(doc);
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.deepEqual(out, { app: "plex", result: "unchanged" });
-  assert.equal(f.calls.filter((c) => c.method === "POST" && c.url.includes("/Settings/")).length, 0);
-});
-
-test("an ombi with no entry for this server gets one, named as plex names itself", async () => {
-  const fresh = { enable: false, enableWatchlistImport: false, monitorAll: false, installId: "x", servers: null, id: 0 };
-  const f = fakes(fresh);
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.deepEqual(out, { app: "plex", result: "written", fields: ["server"] });
-  assert.deepEqual(f.store.plex, {
-    ...fresh,
-    servers: [{
-      name: "ace", machineIdentifier: MACHINE, ip: "ace.internal", port: 32400, ssl: false, subDir: null,
-      plexAuthToken: TOKEN, episodeBatchSize: 150, plexSelectedLibraries: [],
-    }],
-  });
-  assert.equal(f.store.plex.enable, false, "whether plex is enabled in ombi is the operator's choice");
-});
-
-test("a token plex refuses is never written, and the accept that fixes it is named", async () => {
-  for (const trusted of [false, true]) {
-    const f = fakes(operatorPlex(), { trusted });
-    const out = await reconcilePlex(f.http, OMBI, binding(), "a-value-the-mesh-minted");
-    assert.equal(out.result, "refused");
-    const problem = (out as { problem: string }).problem;
-    assert.match(problem, /secret accept <this node> ombi plex-api --provider ace/);
-    assert.doesNotMatch(problem, /a-value-the-mesh-minted/);
-    assert.deepEqual(f.store.plex, operatorPlex(), "ombi's working settings were left alone");
-    assert.equal(f.calls.some((c) => c.url.includes("/api/v1/")), false, "ombi was not even asked");
-  }
-});
-
-test("a plex it cannot reach is reported, and ombi is left alone", async () => {
-  const f = fakes(operatorPlex(), { reachable: false });
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /could not be asked.*ECONNREFUSED/);
-  assert.deepEqual(f.store.plex, operatorPlex());
-});
-
-test("a loopback binding is refused: from ombi's container it is ombi itself", () => {
-  const w = wantedPlex(binding(32400, "127.0.0.1"), TOKEN);
-  assert.equal(w.ok, false);
-  assert.match((w as { problem: string }).problem, /private network/);
-});
-
-test("an https binding sets ombi's ssl flag; an empty subDir is none", () => {
-  const w = wantedPlex(binding(32400, "ace.internal", "https"), TOKEN);
-  assert.equal(w.ok && w.connection.ssl, true);
-  assert.deepEqual(
-    differingPlex({ ip: "h", port: 1, ssl: false, subDir: "", plexAuthToken: "k" }, { ip: "h", port: 1, ssl: false, subDir: null, plexAuthToken: "k" }),
-    [],
-  );
-});
-
-test("every entry naming the server is laid over, not only the first", () => {
-  const doc = { servers: [{ machineIdentifier: MACHINE, ip: "a" }, { machineIdentifier: MACHINE, ip: "b" }] };
-  const want = { ip: "ace.internal", port: 32400, ssl: false, subDir: null, plexAuthToken: TOKEN };
-  const laid = withPlexServer(doc, MACHINE, want, "ace");
-  assert.equal(laid.added, false);
-  assert.deepEqual((laid.next.servers as { ip: string }[]).map((s) => s.ip), ["ace.internal", "ace.internal"]);
-});
-
-// ace's own ombi: its one entry was loaded from an older server (a stale identifier) and retyped to
-// plex's public name, so it IS this server, reached another way (read from ace, 2026-09-30).
-const acesOmbi = () => ({
-  enable: true,
-  enableWatchlistImport: true,
-  servers: [{
-    name: "Nami", plexAuthToken: TOKEN, machineIdentifier: "76562198623e708eef85b46aedb72c8f2fe671aa", episodeBatchSize: 0,
-    plexSelectedLibraries: [1, 2, 3, 4, 5, 6].map((k) => ({ key: String(k), enabled: true })), ssl: true, subDir: null,
-    ip: "plex.zurag.be", port: 443, id: 1,
-  }],
-  id: 4,
-});
-
-test("an entry whose own address answers as this server is adopted: connection and identifier, nothing else", async () => {
-  const f = fakes(acesOmbi());
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.deepEqual(out, { app: "plex", result: "written", fields: ["ip", "port", "ssl", "machineIdentifier"] });
-  const want = acesOmbi();
-  Object.assign(want.servers[0], { ip: "ace.internal", port: 32400, ssl: false, machineIdentifier: MACHINE });
-  assert.deepEqual(f.store.plex, want, "one entry, still named Nami, its six libraries kept; none added");
-});
-
-test("an entry answering as another server, or not at all, is not adopted; this server gets its own", async () => {
-  const doc = {
-    servers: [
-      { name: "a friend", machineIdentifier: "stale-1", ip: "10.0.0.9", port: 32400, ssl: false, plexAuthToken: "theirs" },
-      { name: "gone", machineIdentifier: "stale-2", ip: "gone.example", port: 32400, ssl: false, plexAuthToken: "old" },
-    ],
-  };
-  const f = fakes(structuredClone(doc));
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.deepEqual(out, { app: "plex", result: "written", fields: ["server"] });
-  const servers = f.store.plex.servers as Record<string, unknown>[];
-  assert.deepEqual(servers.slice(0, 2), doc.servers, "both left exactly as they were");
-  assert.equal(servers[2].machineIdentifier, MACHINE);
-});
-
-test("no entry is probed once one carries the server's identifier", async () => {
-  const f = fakes(operatorPlex());
-  await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.equal(f.calls.some((c) => c.url.startsWith("http://10.0.0.9")), false, "the friend's server was not asked");
-});
@@ -1,147 +0,0 @@
-// What holds ombi's Servarr step (servarr/settings.ts): the connection ombi keeps for each app is
-// made to say what the mesh bound — host, port, TLS, base path, key — and nothing else it keeps is
-// touched; nothing is written when nothing differs; Radarr's 4K instance is left alone; and a key the
-// app refuses (the mesh's own minted value, before the operator accepts the app's key) is never
-// written, with the `secret accept` that fixes it named.
-//
-// ombi and the apps are fakes: the routes the step touches, answering as the real ones do (checked
-// against lscr.io/linuxserver/ombi 4.53.10 and the catalogue's pinned sonarr/radarr/lidarr).
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { APPS, differing, reconcileApp, subDirOf, wanted, type Binding, type Http, type ServarrApp } from "../servarr/settings.ts";
-
-const SONARR = APPS.find((a) => a.app === "sonarr") as ServarrApp;
-const RADARR = APPS.find((a) => a.app === "radarr") as ServarrApp;
-const LIDARR = APPS.find((a) => a.app === "lidarr") as ServarrApp;
-const THE_KEY = "the-apps-own-key";
-
-function binding(provision: string, port: number, at = "ace.internal"): Binding {
-  return { binding: 1, provision, from: "ace", at, as: "mesh_ace_ombi", serves: { scheme: "http", port, "url-base": "" } } as Binding;
-}
-
-interface Call {
-  method: string;
-  url: string;
-  body?: unknown;
-}
-
-/** ombi's settings store and the apps' key check, behind one fetch. */
-function fakes(settings: Record<string, unknown>, opts: { appKey?: string; reachable?: boolean } = {}) {
-  const calls: Call[] = [];
-  const appKey = opts.appKey ?? THE_KEY;
-  const http: Http = {
-    async fetch(url, init) {
-      const method = init?.method ?? "GET";
-      const body = init?.body ? (JSON.parse(init.body) as unknown) : undefined;
-      calls.push({ method, url, body });
-      const reply = (status: number, value?: unknown) => ({
-        status,
-        text: async () => (value === undefined ? "" : JSON.stringify(value)),
-      });
-      const u = new URL(url);
-      if (u.pathname.endsWith("/system/status")) {
-        if (opts.reachable === false) throw new Error("connect ECONNREFUSED");
-        return init?.headers?.["X-Api-Key"] === appKey ? reply(200, { version: "4" }) : reply(401);
-      }
-      if (init?.headers?.ApiKey !== "ombi-key") return reply(401);
-      const m = u.pathname.match(/^\/api\/v1\/(Settings|Tester)\/(\w+)$/);
-      if (!m) return reply(404);
-      const [, kind, app] = m;
-      if (kind === "Settings" && method === "GET") return reply(200, settings[app]);
-      if (kind === "Settings" && method === "POST") {
-        settings[app] = body;
-        return reply(200, true);
-      }
-      const tried = body as { apiKey?: string };
-      return reply(200, { isValid: tried.apiKey === appKey, expectedSubDir: null });
-    },
-  };
-  return { http, calls, settings };
-}
-
-const OMBI = { url: "http://127.0.0.1:3579", apiKey: "ombi-key" };
-
-const operatorSonarr = () => ({
-  enabled: true, apiKey: "old-key", qualityProfile: "3", seasonFolders: true, rootPath: "10",
-  qualityProfileAnime: "7", rootPathAnime: "9", languageProfile: 1, ssl: false, subDir: null,
-  ip: "sonarr", port: 8989, id: 5,
-});
-
-test("it writes the connection the mesh bound, and keeps every other setting ombi had", async () => {
-  const f = fakes({ sonarr: operatorSonarr() });
-  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), `${THE_KEY}\n`);
-  assert.deepEqual(out, { app: "sonarr", result: "written", fields: ["ip", "port", "apiKey"] });
-  assert.deepEqual(f.settings.sonarr, {
-    ...operatorSonarr(), ip: "ace.internal", port: 20101, apiKey: THE_KEY, ssl: false, subDir: null,
-  });
-  // Checked against the app itself, at the bound address, before anything was written.
-  assert.equal(f.calls[0].url, "http://ace.internal:20101/api/v3/system/status");
-});
-
-test("nothing is written when ombi already says what the mesh says", async () => {
-  const f = fakes({ sonarr: { ...operatorSonarr(), ip: "ace.internal", port: 20101, apiKey: THE_KEY } });
-  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), THE_KEY);
-  assert.deepEqual(out, { app: "sonarr", result: "unchanged" });
-  assert.equal(f.calls.filter((c) => c.method === "POST" && c.url.includes("/Settings/")).length, 0);
-});
-
-test("a key the app refuses is never written, and the accept that fixes it is named", async () => {
-  const f = fakes({ sonarr: operatorSonarr() });
-  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), "a-value-the-mesh-minted");
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /secret accept <this node> ombi sonarr-api --provider ace/);
-  assert.doesNotMatch((out as { problem: string }).problem, /a-value-the-mesh-minted/);
-  assert.deepEqual(f.settings.sonarr, operatorSonarr(), "ombi's working settings were left alone");
-  assert.equal(f.calls.some((c) => c.url.includes("/api/v1/")), false, "ombi was not even asked");
-});
-
-test("an app it cannot reach is reported, and ombi is left alone", async () => {
-  const f = fakes({ sonarr: operatorSonarr() }, { reachable: false });
-  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), THE_KEY);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /could not be asked.*ECONNREFUSED/);
-  assert.deepEqual(f.settings.sonarr, operatorSonarr());
-});
-
-test("radarr's connection is written inside its combined document, and the 4K instance is untouched", async () => {
-  const fourK = { enabled: true, apiKey: "4k-key", ip: "radarr4k", port: 7879, defaultQualityProfile: "9", id: 7 };
-  const f = fakes({ radarr: { radarr: { enabled: true, apiKey: "old", ip: "radarr", port: 7878, defaultRootPath: "/movies", id: 6 }, radarr4K: fourK } });
-  const out = await reconcileApp(f.http, OMBI, RADARR, binding("radarr-api", 20102), THE_KEY);
-  assert.equal(out.result, "written");
-  const doc = f.settings.radarr as { radarr: Record<string, unknown>; radarr4K: unknown };
-  assert.deepEqual(doc.radarr4K, fourK);
-  assert.equal(doc.radarr.ip, "ace.internal");
-  assert.equal(doc.radarr.port, 20102);
-  assert.equal(doc.radarr.defaultRootPath, "/movies");
-});
-
-test("lidarr is checked on its own API version", async () => {
-  const f = fakes({ lidarr: { enabled: true, apiKey: null, ip: null, port: 0, id: 0 } });
-  const out = await reconcileApp(f.http, OMBI, LIDARR, binding("lidarr-api", 20103), THE_KEY);
-  assert.equal(out.result, "written");
-  assert.equal(f.calls[0].url, "http://ace.internal:20103/api/v1/system/status");
-});
-
-test("a loopback binding is refused: from ombi's container it is ombi itself", () => {
-  const w = wanted(SONARR, binding("sonarr-api", 20101, "127.0.0.1"), THE_KEY);
-  assert.equal(w.ok, false);
-  assert.match((w as { problem: string }).problem, /private network/);
-});
-
-test("the base path is ombi's subDir, slashes trimmed; empty is none", () => {
-  assert.equal(subDirOf(""), null);
-  assert.equal(subDirOf("/sonarr/"), "sonarr");
-  assert.deepEqual(
-    differing({ ip: "h", port: 1, ssl: false, subDir: "", apiKey: "k" }, { ip: "h", port: 1, ssl: false, subDir: null, apiKey: "k" }),
-    [],
-  );
-});
-
-test("an https binding sets ombi's ssl flag", () => {
-  const b = binding("sonarr-api", 443);
-  (b.serves as Record<string, unknown>).scheme = "https";
-  const w = wanted(SONARR, b, THE_KEY);
-  assert.equal(w.ok && w.connection.ssl, true);
-});
@@ -8,5 +8,5 @@
    "skipLibCheck": true,
    "noEmit": true
  },
-  "include": ["client.ts", "index.ts", "tools/index.ts", "servarr/settings.ts", "plex/settings.ts", "connections/index.ts"]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }
@@ -82,7 +82,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_QBITTORRENT_URL": "http://127.0.0.1:${port:8080}",
+        "MESH_QBITTORRENT_URL": "http://127.0.0.1:8080",
        "MESH_QBITTORRENT_PASSWORD_FILE": "/run/secrets/password",
        "MESH_QBITTORRENT_CONFIG_FILE": "/run/config/config.json",
        "MESH_QBITTORRENT_CONFIG_DIR": "/var/lib/qbittorrent/config"
@@ -1,19 +1,6 @@
 {
  "module": "radarr",
  "version": "1",
-  "provides": [
-    {
-      "name": "radarr-api",
-      "scope": "mesh"
-    }
-  ],
-  "serves": {
-    "radarr-api": {
-      "scheme": "http",
-      "port": 7878,
-      "url-base": ""
-    }
-  },
  "capabilities": [
    "container-runtime"
  ],
@@ -88,7 +75,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RADARR_URL": "http://127.0.0.1:${port:7878}",
+        "MESH_RADARR_URL": "http://127.0.0.1:7878",
        "MESH_RADARR_CONFIG_DIR": "/var/lib/radarr/config"
      },
      "artifact": "runtime"
@@ -100,7 +100,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_SEARXNG_URL": "http://127.0.0.1:${port:8080}",
+        "MESH_SEARXNG_URL": "http://127.0.0.1:8080",
        "MESH_SEARXNG_CONFIG_FILE": "/run/config/config.json"
      },
      "restart-on": [
@@ -1,19 +1,6 @@
 {
  "module": "sonarr",
  "version": "1",
-  "provides": [
-    {
-      "name": "sonarr-api",
-      "scope": "mesh"
-    }
-  ],
-  "serves": {
-    "sonarr-api": {
-      "scheme": "http",
-      "port": 8989,
-      "url-base": ""
-    }
-  },
  "capabilities": [
    "container-runtime"
  ],
@@ -93,7 +80,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_SONARR_URL": "http://127.0.0.1:${port:8989}",
+        "MESH_SONARR_URL": "http://127.0.0.1:8989",
        "MESH_SONARR_CONFIG_DIR": "/var/lib/sonarr/config"
      },
      "artifact": "runtime"
@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/tautulli
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts plex/check.ts plex/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist

 FROM ${RUNTIME_BASE}
@@ -22,3 +22,6 @@ COPY --from=build /app/modules/tautulli/dist /app/modules/tautulli/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/tautulli/dist/index.js,/app/modules/tautulli/dist/tools/index.js
+# NOT dist/plex/index.js: that is a step the host runs to completion, named by the `plex`
+# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
+# serving sidecar too, and exit it.
@@ -41,6 +41,32 @@ function meshConfig(file?: string): Record<string, string> {
  catch { return {}; }
 }

+/**
+ * The API key Tautulli minted for itself, read from its own config.ini (mounted read-only).
+ *
+ * Tautulli owns this key: it writes it on first run and every client of its API — this runtime
+ * included — must present the same one. So the mesh does not mint or hold it; the one place it
+ * lives is the file Tautulli keeps, and a key regenerated in Tautulli's settings is simply read
+ * again on the next start. Undefined when there is no file or no key yet (a fresh install whose
+ * setup wizard has not run).
+ */
+export function keyOfTautulli(dir?: string): string | undefined {
+  if (!dir) return undefined;
+  let ini: string;
+  try { ini = readFileSync(`${dir.replace(/\/$/, "")}/config.ini`, "utf8"); }
+  catch { return undefined; }
+  let section = "";
+  for (const raw of ini.split(/\r?\n/)) {
+    const line = raw.trim();
+    const header = /^\[(.+)\]$/.exec(line);
+    if (header) { section = header[1]; continue; }
+    if (section !== "General") continue;
+    const kv = /^api_key\s*=\s*"?([^"]*)"?$/.exec(line);
+    if (kv && kv[1]) return kv[1];
+  }
+  return undefined;
+}
+
 export class TautulliClient {
  readonly baseUrl: string;

@@ -52,15 +78,16 @@ export class TautulliClient {
  }

  /**
-   * Build from the module's resolved environment. The API key is read from MESH_TAUTULLI_APIKEY
-   * (Tautulli mints it in Settings → Web Interface); the base URL defaults to the local container.
+   * Build from the module's resolved environment. The API key is the one Tautulli minted for
+   * itself (Settings → Web Interface), read from its config.ini under MESH_TAUTULLI_CONFIG_DIR;
+   * MESH_TAUTULLI_APIKEY still wins where it is set. The base URL defaults to the local container.
   * Throws when no key is configured — the module then contributes nothing rather than failing.
   */
  static fromEnv(env: NodeJS.ProcessEnv = process.env): TautulliClient {
    const cfg = meshConfig(env.MESH_TAUTULLI_CONFIG_FILE);
    const url = cfg.url ?? (env.MESH_TAUTULLI_URL ?? `http://127.0.0.1:${env.TAUTULLI_PORT ?? "8181"}`);
-    const apiKey = cfg.apiKey ?? env.MESH_TAUTULLI_APIKEY;
-    if (!apiKey) throw new Error("no Tautulli API key — set MESH_TAUTULLI_APIKEY");
+    const apiKey = cfg.apiKey ?? env.MESH_TAUTULLI_APIKEY ?? keyOfTautulli(env.MESH_TAUTULLI_CONFIG_DIR);
+    if (!apiKey) throw new Error("no Tautulli API key — Tautulli's config.ini has none yet (finish its setup and enable the API)");
    return new TautulliClient(url, apiKey);
  }

@@ -4,6 +4,11 @@
  "description": "tautulli — Plex watch statistics. Its API client, tools and events live here (novox/hq ADR 0039).",
  "type": "module",
  "private": true,
+  "scripts": {
+    "build": "tsc client.ts index.ts tools/index.ts plex/check.ts plex/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
+  },
  "dependencies": {
    "@novox/mesh-sdk": "^0.1.0"
  },
@@ -0,0 +1,8 @@
+#!/bin/bash
+# Run by the linuxserver image's custom-init each time Tautulli's container starts, as root, before
+# Tautulli: puts where the mesh says plex is into Tautulli's config.ini (mesh-plex.py says why).
+#
+# Written by the mesh from the tautulli module's manifest. Editing it here lasts until the next apply.
+PY=/lsiopy/bin/python3
+[ -x "$PY" ] || PY=python3
+exec "$PY" /run/mesh/mesh-plex.py
@@ -0,0 +1,175 @@
+// Whether Tautulli reaches Plex as the mesh says — the half of tautulli's plex-api consumer the
+// mesh can see fail.
+//
+// **The write is not here.** Tautulli keeps its Plex connection only in config.ini, rewrites that
+// file from memory on every shutdown, and has no API command that sets it; so the write happens in
+// the server container itself, before Tautulli starts (plex/mesh-plex.py, run by the image's
+// custom-init). A failure there is a line in Tautulli's log that nobody reads. This step runs after
+// the server, as a run-once container declared last, and fails the node's report when:
+//
+//   - the pair credential is one plex refuses — the mesh's own minted value, before the operator
+//     accepts the server's X-Plex-Token for this pair — naming the `secret accept` that fixes it;
+//   - Tautulli is not pointed where the binding says (the start-time write did not land);
+//   - Tautulli is pointed there and still not connected to plex (its own connection state).
+//
+// It writes nothing, to Tautulli or to plex. Pure logic and a small HTTP seam, tested against fakes
+// (test/plex.test.ts).
+
+/** What the mesh wrote at `binds.plex-api`: the binding document (controller's boundFile). */
+export interface Binding {
+  provision?: string;
+  from?: string;
+  at?: string;
+  as?: string;
+  serves?: Record<string, unknown>;
+}
+
+export const PROVISION = "plex-api";
+
+export interface Wanted {
+  url: string;
+  token: string;
+  from: string;
+}
+
+/** The HTTP the step needs, so a test can stand fakes in for Tautulli and plex. */
+export interface Http {
+  fetch(url: string, init?: { method?: string; headers?: Record<string, string> }): Promise<{
+    status: number;
+    text(): Promise<string>;
+  }>;
+}
+
+export type Outcome = { result: "connected"; url: string } | { result: "refused"; problem: string };
+
+function isLoopback(host: string): boolean {
+  const h = host.toLowerCase();
+  return h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h);
+}
+
+/** The URL Tautulli should hold as pms_url — the same one mesh-plex.py writes. */
+export function wanted(binding: Binding | undefined, credential: string | undefined): Wanted | { problem: string } {
+  if (!binding) return { problem: `no binding for ${PROVISION} was delivered — the mesh writes it before this step runs` };
+  const at = typeof binding.at === "string" ? binding.at.trim() : "";
+  const serves = binding.serves ?? {};
+  const port = Number(serves.port);
+  const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http";
+  if (!at) return { problem: `the ${PROVISION} binding names no host (at)` };
+  if (isLoopback(at)) {
+    return {
+      problem:
+        `the ${PROVISION} binding says plex is at ${at}, which from Tautulli's container is Tautulli itself; ` +
+        `the mesh hands loopback to a machine that is not on the private network`,
+    };
+  }
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+    return { problem: `the ${PROVISION} binding serves no usable port (${String(serves.port)})` };
+  }
+  if (scheme !== "http" && scheme !== "https") return { problem: `the ${PROVISION} binding serves scheme ${scheme}, which Tautulli cannot dial` };
+  const token = (credential ?? "").trim();
+  if (!token) return { problem: `the ${PROVISION} credential is empty or was not delivered` };
+  const host = at.includes(":") && !at.startsWith("[") ? `[${at}]` : at;
+  return { url: `${scheme}://${host}:${port}`, token, from: typeof binding.from === "string" ? binding.from : "" };
+}
+
+/** The remedy for a refused token, in the controller's own words (ADR 0092). */
+export function acceptRemedy(from: string): string {
+  return (
+    `plex refuses the ${PROVISION} credential the mesh delivered, so Tautulli was not given it. plex's ` +
+    `token is issued by plex.tv and the mesh cannot make it: accept the server's own token for this pair — ` +
+    `\`secret accept <this node> tautulli ${PROVISION} --provider ${from || "<its node>"} ` +
+    `--from <file holding the server's X-Plex-Token>\``
+  );
+}
+
+/** Does plex take the token? 401/403, or 400 on a network plex trusts, is a refusal. */
+export async function plexTakes(http: Http, want: Wanted): Promise<boolean> {
+  const res = await http.fetch(`${want.url}/`, { method: "GET", headers: { "X-Plex-Token": want.token, Accept: "application/json" } });
+  if (res.status === 400 || res.status === 401 || res.status === 403) return false;
+  if (res.status >= 200 && res.status < 300) return true;
+  throw new Error(`plex answered ${res.status} at /`);
+}
+
+export interface Tautulli {
+  url: string;
+  apiKey: string;
+}
+
+/** One Tautulli API command's `data`, or a thrown error. The error never carries the key. */
+export async function tautulliCmd(http: Http, t: Tautulli, cmd: string): Promise<any> {
+  const q = new URLSearchParams({ apikey: t.apiKey, cmd });
+  const res = await http.fetch(`${t.url.replace(/\/$/, "")}/api/v2?${q.toString()}`, { method: "GET" });
+  const text = await res.text();
+  if (res.status !== 200) throw new Error(`Tautulli ${cmd} answered ${res.status}`);
+  const body = (JSON.parse(text) as { response?: { result?: string; message?: string; data?: unknown } }).response ?? {};
+  if (body.result !== "success") throw new Error(`Tautulli ${cmd}: ${body.message ?? "error"}`);
+  return body.data;
+}
+
+/** Wait for Tautulli to answer, because the step runs right after its container starts. */
+export async function tautulliReady(http: Http, t: Tautulli, waitMs: number, pauseMs = 2000): Promise<boolean> {
+  const until = Date.now() + waitMs;
+  for (;;) {
+    try {
+      const res = await http.fetch(`${t.url.replace(/\/$/, "")}/status`, { method: "GET" });
+      if (res.status === 200) return true;
+    } catch {
+      // not listening yet
+    }
+    if (Date.now() >= until) return false;
+    await new Promise((r) => setTimeout(r, pauseMs));
+  }
+}
+
+/**
+ * Check Tautulli against the mesh: the token plex takes, the URL Tautulli holds, and Tautulli's own
+ * connection state, polled for `connectMs` because Tautulli connects to plex a moment after start.
+ * Never throws.
+ */
+export async function check(
+  http: Http,
+  t: Tautulli,
+  binding: Binding | undefined,
+  credential: string | undefined,
+  connectMs = 60_000,
+  pauseMs = 3000,
+): Promise<Outcome> {
+  const w = wanted(binding, credential);
+  if ("problem" in w) return { result: "refused", problem: w.problem };
+  try {
+    if (!(await plexTakes(http, w))) return { result: "refused", problem: acceptRemedy(w.from) };
+  } catch (err) {
+    return { result: "refused", problem: `plex could not be asked whether it takes the token at ${w.url}: ${message(err)}` };
+  }
+  try {
+    const info = (await tautulliCmd(http, t, "get_server_info")) as { pms_url?: unknown } | undefined;
+    const holds = typeof info?.pms_url === "string" ? info.pms_url : "";
+    if (holds.replace(/\/$/, "") !== w.url) {
+      return {
+        result: "refused",
+        problem:
+          `Tautulli reaches plex at ${holds || "nothing"}, not ${w.url} as the mesh says. Its container writes ` +
+          `this into config.ini as it starts (custom-init 50-mesh-plex); its log says why it did not`,
+      };
+    }
+    const until = Date.now() + connectMs;
+    for (;;) {
+      // server_status answers {connected}, not wrapped in `data` on every version: accept both.
+      const status = (await tautulliCmd(http, t, "server_status")) as { connected?: unknown } | undefined;
+      if (status?.connected === true) return { result: "connected", url: w.url };
+      if (Date.now() >= until) {
+        return {
+          result: "refused",
+          problem: `Tautulli holds ${w.url} and is not connected to plex there — its log says why (a token plex no longer takes, or plex down)`,
+        };
+      }
+      await new Promise((r) => setTimeout(r, pauseMs));
+    }
+  } catch (err) {
+    return { result: "refused", problem: message(err) };
+  }
+}
+
+function message(err: unknown): string {
+  return err instanceof Error ? err.message : String(err);
+}
@@ -0,0 +1,47 @@
+// tautulli's plex step — run once by the host after Tautulli's server container, and again whenever
+// its binding, its pair credential or the server changed (the container's `restart-on`, novox/hq
+// ADR 0099). It checks; it writes nothing (plex/check.ts says why, and where the write is).
+//
+// Exits non-zero when Tautulli does not reach plex as the mesh says, so the node reports the step
+// failed. Declared last in the manifest, so its failing gates nothing else of tautulli's (novox/hq
+// ADR 0136). Never prints a key or a token.
+
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import { keyOfTautulli } from "../client.js";
+import { check, tautulliReady, PROVISION, type Binding, type Http } from "./check.js";
+
+const dir = process.env.MESH_PLEX_DIR ?? "/run/plex";
+const url = process.env.MESH_TAUTULLI_URL ?? "http://127.0.0.1:8181";
+const waitSeconds = Number(process.env.MESH_TAUTULLI_WAIT_SECONDS ?? "180");
+
+const http: Http = { fetch: (u, init) => fetch(u, init) };
+const read = (path: string) => readFile(path, "utf8").catch(() => undefined);
+
+const apiKey = keyOfTautulli(process.env.MESH_TAUTULLI_CONFIG_DIR);
+if (!apiKey) {
+  console.error("[tautulli-plex] Tautulli's config.ini holds no API key yet — it writes one on its first start");
+  process.exit(1);
+}
+const tautulli = { url, apiKey };
+
+if (!(await tautulliReady(http, tautulli, waitSeconds * 1000))) {
+  console.error(`[tautulli-plex] Tautulli did not answer at ${url} within ${waitSeconds}s`);
+  process.exit(1);
+}
+
+let binding: Binding | undefined;
+try {
+  const raw = await read(join(dir, `${PROVISION}.json`));
+  binding = raw === undefined ? undefined : (JSON.parse(raw) as Binding);
+} catch {
+  binding = undefined;
+}
+const outcome = await check(http, tautulli, binding, await read(join(dir, `${PROVISION}.secret`)));
+if (outcome.result === "connected") {
+  console.log(`[tautulli-plex] Tautulli reaches plex at ${outcome.url} as the mesh says; connected`);
+} else {
+  console.error(`[tautulli-plex] ${outcome.problem}`);
+  process.exitCode = 1;
+}
@@ -0,0 +1,260 @@
+# Where Tautulli reaches Plex — decided by the mesh, written into Tautulli's config.ini before
+# Tautulli starts.
+#
+# Written by the mesh from the tautulli module's manifest, and run by the linuxserver image's
+# custom-init (50-mesh-plex) each time the `server` container starts, as root, before Tautulli.
+# Editing it here lasts until the next apply.
+#
+# WHY BEFORE START, AND NOT A STEP AFTER IT. Tautulli keeps its Plex connection only in config.ini
+# ([PMS]), reads that file at start, and writes its whole in-memory config back on every shutdown.
+# A step editing the file while Tautulli runs is overwritten the moment the container is recreated;
+# its API has no command that sets the connection, and its settings form needs an admin login. The
+# one moment the file is Tautulli's to read and nobody's to overwrite is here: after the old
+# container stopped (and wrote), before the new one reads. The container restarts on its binding
+# and credential (`restart-on`), so a plex that moves or a token that is accepted lands here.
+#
+# WHAT IT WRITES, AND WHEN. Only [PMS] keys, and only when they differ from what the mesh says:
+#   pms_ip, pms_port, pms_ssl, pms_url   - from the binding; always, when the binding is usable
+#   pms_identifier                       - plex's own machineIdentifier, when plex answers /identity
+#   pms_token                            - the pair credential, ONLY when plex takes it
+# Every other key and section, comment and ordering stays as it was, byte for byte.
+#
+# A TOKEN PLEX REFUSES IS NEVER WRITTEN. Until the operator accepts the server's X-Plex-Token for
+# this pair, the mesh delivers a value it minted, which plex answers with 401 (400 on a network it
+# trusts). Writing it would replace a working token with a dead one. The address is still written:
+# it is right whatever the token, and Tautulli's existing token keeps working at the new address.
+# The refusal is loud here and in the `plex` step, which fails naming the `secret accept`.
+#
+# Never prints the token. Exits 0 even on a refusal: custom-init ignores the code, and Tautulli
+# starting on what it had is better than not starting. The step after the server is what fails.
+
+import json
+import os
+import re
+import sys
+import tempfile
+import time
+import urllib.error
+import urllib.request
+
+BINDING = os.environ.get("MESH_PLEX_BINDING", "/run/mesh/plex-api.json")
+SECRET = os.environ.get("MESH_PLEX_SECRET", "/run/mesh/plex-api.secret")
+CONFIG = os.environ.get("MESH_TAUTULLI_CONFIG", "/config/config.ini")
+WAIT = float(os.environ.get("MESH_PLEX_WAIT_SECONDS", "60"))
+PROVISION = "plex-api"
+
+
+def say(message):
+    print("[mesh-plex] " + message, flush=True)
+
+
+def is_loopback(host):
+    h = host.lower()
+    return h in ("localhost", "::1", "[::1]") or h.startswith("127.")
+
+
+def wanted_address(binding):
+    """The [PMS] address keys the binding says, or a reason it cannot say them."""
+    if not isinstance(binding, dict):
+        return None, "no binding for %s was delivered" % PROVISION
+    at = binding.get("at")
+    at = at.strip() if isinstance(at, str) else ""
+    serves = binding.get("serves") if isinstance(binding.get("serves"), dict) else {}
+    try:
+        port = int(serves.get("port"))
+    except (TypeError, ValueError):
+        port = 0
+    scheme = serves.get("scheme") or "http"
+    if not at:
+        return None, "the %s binding names no host (at)" % PROVISION
+    if is_loopback(at):
+        return None, (
+            "the %s binding says plex is at %s, which from Tautulli's container is Tautulli itself; "
+            "the mesh hands loopback to a machine that is not on the private network" % (PROVISION, at))
+    if not 0 < port < 65536:
+        return None, "the %s binding serves no usable port (%r)" % (PROVISION, serves.get("port"))
+    if scheme not in ("http", "https"):
+        return None, "the %s binding serves scheme %s, which Tautulli cannot dial" % (PROVISION, scheme)
+    host = "[%s]" % at if ":" in at and not at.startswith("[") else at
+    url = "%s://%s:%d" % (scheme, host, port)
+    return {"pms_ip": at, "pms_port": str(port), "pms_ssl": "1" if scheme == "https" else "0", "pms_url": url}, None
+
+
+def plex_get(url, path, token=None):
+    """(status, parsed JSON or None); raises OSError when plex cannot be asked."""
+    headers = {"Accept": "application/json"}
+    if token is not None:
+        headers["X-Plex-Token"] = token
+    request = urllib.request.Request(url + path, headers=headers)
+    try:
+        with urllib.request.urlopen(request, timeout=10) as response:
+            body = response.read()
+            try:
+                return response.status, json.loads(body)
+            except ValueError:
+                return response.status, None
+    except urllib.error.HTTPError as err:
+        return err.code, None
+
+
+def ask_plex(url, token):
+    """(takes: True/False/None, machineIdentifier or None). None: plex could not be asked in time."""
+    deadline = time.monotonic() + WAIT
+    while True:
+        try:
+            status, _ = plex_get(url, "/", token)
+            if status in (400, 401, 403):
+                takes = False
+            elif 200 <= status < 300:
+                takes = True
+            else:
+                raise OSError("plex answered %d at /" % status)
+            identifier = None
+            status, body = plex_get(url, "/identity")
+            if status == 200 and isinstance(body, dict):
+                value = (body.get("MediaContainer") or {}).get("machineIdentifier")
+                identifier = value if isinstance(value, str) and value else None
+            return takes, identifier
+        except OSError as err:
+            if time.monotonic() >= deadline:
+                say("plex could not be asked at %s: %s" % (url, err))
+                return None, None
+            time.sleep(3)
+
+
+SECTION = re.compile(r"^\s*\[([^\]]+)\]\s*$")
+KEY = re.compile(r"^(\s*)([A-Za-z0-9_]+)(\s*=\s*)(.*?)\s*$")
+
+
+def unquoted(value):
+    if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
+        return value[1:-1]
+    return value
+
+
+def plain(value):
+    """ConfigObj reads a value unquoted unless it holds one of these; none of ours should."""
+    return not re.search(r"[#,\"'\r\n]", value) and value == value.strip()
+
+
+def laid_over(text, wanted):
+    """config.ini's text with [PMS] saying `wanted`, and the names of the keys that changed."""
+    lines = text.splitlines(True)
+    if lines and not lines[-1].endswith("\n"):
+        lines[-1] += "\n"
+    changed = []
+    start = end = None
+    for i, line in enumerate(lines):
+        m = SECTION.match(line)
+        if m:
+            if start is not None:
+                end = i
+                break
+            if m.group(1).strip() == "PMS":
+                start = i
+    if start is None:
+        if lines and lines[-1].strip():
+            lines.append("\n")
+        lines.append("[PMS]\n")
+        start, end = len(lines) - 1, len(lines)
+    elif end is None:
+        end = len(lines)
+    seen = set()
+    for i in range(start + 1, end):
+        m = KEY.match(lines[i])
+        if not m or m.group(2) not in wanted:
+            continue
+        key = m.group(2)
+        seen.add(key)
+        if unquoted(m.group(4)) != wanted[key]:
+            lines[i] = "%s%s%s%s\n" % (m.group(1), key, m.group(3), wanted[key])
+            changed.append(key)
+    missing = [k for k in wanted if k not in seen]
+    # Insert after the section's last key, not after the blank lines that separate it from the next.
+    at = end
+    while at > start + 1 and not lines[at - 1].strip():
+        at -= 1
+    for key in missing:
+        lines.insert(at, "%s = %s\n" % (key, wanted[key]))
+        at += 1
+        changed.append(key)
+    return "".join(lines), changed
+
+
+def write_config(text):
+    """Replace config.ini whole, keeping its owner and mode; a new one takes the directory's owner."""
+    directory = os.path.dirname(CONFIG) or "."
+    try:
+        st = os.stat(CONFIG)
+        uid, gid, mode = st.st_uid, st.st_gid, st.st_mode & 0o7777
+    except FileNotFoundError:
+        st = os.stat(directory)
+        uid, gid, mode = st.st_uid, st.st_gid, 0o644
+    fd, tmp = tempfile.mkstemp(prefix=".config.ini.", dir=directory)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            f.write(text)
+        os.chmod(tmp, mode)
+        try:
+            os.chown(tmp, uid, gid)
+        except PermissionError:
+            pass
+        os.replace(tmp, CONFIG)
+    except BaseException:
+        if os.path.exists(tmp):
+            os.unlink(tmp)
+        raise
+
+
+def read(path):
+    try:
+        with open(path, encoding="utf-8") as f:
+            return f.read()
+    except FileNotFoundError:
+        return None
+
+
+def main():
+    raw = read(BINDING)
+    try:
+        binding = json.loads(raw) if raw is not None else None
+    except ValueError:
+        binding = None
+    address, problem = wanted_address(binding)
+    if problem:
+        say("left Tautulli's Plex connection as it was: " + problem)
+        return 0
+    wanted = dict(address)
+    token = (read(SECRET) or "").strip()
+    takes, identifier = ask_plex(address["pms_url"], token) if token else (False, None)
+    if identifier:
+        wanted["pms_identifier"] = identifier
+    frm = binding.get("from") or "<its node>"
+    if not token:
+        say("no %s credential was delivered; only the address was written" % PROVISION)
+    elif takes and plain(token):
+        wanted["pms_token"] = token
+    elif takes is False:
+        say("plex refuses the %s credential the mesh delivered, so it was not written; the address was. "
+            "plex's token is issued by plex.tv and the mesh cannot make it: accept the server's own token "
+            "for this pair - `secret accept <this node> tautulli %s --provider %s --from <file holding the "
+            "server's X-Plex-Token>`" % (PROVISION, PROVISION, frm))
+    elif takes:
+        say("the %s credential holds characters config.ini cannot carry unquoted; it was not written" % PROVISION)
+    else:
+        say("plex could not be asked whether it takes the %s credential; only the address was written" % PROVISION)
+    if not all(plain(v) for v in wanted.values()):
+        say("the %s binding holds characters config.ini cannot carry unquoted; nothing was written" % PROVISION)
+        return 0
+    before = read(CONFIG)
+    after, changed = laid_over(before or "", wanted)
+    if not changed:
+        say("Tautulli's Plex connection is already as the mesh says (%s)" % address["pms_url"])
+        return 0
+    write_config(after)
+    say("wrote %s into Tautulli's [PMS] (%s)" % (", ".join(changed), address["pms_url"]))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -0,0 +1,266 @@
+// What holds tautulli's plex-api consumer — both halves.
+//
+// The write (plex/mesh-plex.py, run in the server container before Tautulli starts): [PMS] is made
+// to say what the mesh bound and every other line of config.ini stays byte for byte; nothing is
+// written when nothing differs; a token plex refuses is never written, while the address still is;
+// a config.ini that does not exist yet is started with [PMS] alone. Run with the machine's python3
+// against a fake plex; skipped where there is no python3.
+//
+// The check (plex/check.ts, the step declared last): a refused token fails naming the `secret
+// accept`; a Tautulli pointed elsewhere, or not connected, fails; one pointed where the binding says
+// and connected passes.
+//
+// And the manifest carries exactly the files in plex/ — they are the source, module.json the copy.
+//
+// Fakes answer as the real ones do (checked against lscr.io/linuxserver/tautulli 2.18.1-ls244 and
+// plexinc/pms-docker 1.43.4: plex answers 401 to an unknown token from another network, 400 on one
+// it trusts). Imports the compiled step, as keycloak's tests do.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { execFile, spawnSync } from "node:child_process";
+import { createServer, type Server } from "node:http";
+import { mkdtempSync, readFileSync, statSync, writeFileSync, existsSync } from "node:fs";
+import { networkInterfaces, tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { check, type Binding, type Http } from "../dist/plex/check.js";
+
+const here = fileURLToPath(new URL("..", import.meta.url));
+const TOKEN = "the-servers-own-token";
+const MACHINE = "5c47d9a165d10b622995d55b3ae1f168242f33bd";
+
+// ---- the manifest carries the files ------------------------------------------------------------
+
+test("module.json carries plex/mesh-plex.py and plex/50-mesh-plex exactly", () => {
+  const m = JSON.parse(readFileSync(join(here, "module.json"), "utf8")) as { resources: { id: string; content?: string }[] };
+  const byId = (id: string) => m.resources.find((r) => r.id === id)?.content;
+  assert.equal(byId("plex-init-code"), readFileSync(join(here, "plex/mesh-plex.py"), "utf8"));
+  assert.equal(byId("plex-init"), readFileSync(join(here, "plex/50-mesh-plex"), "utf8"));
+  // Nothing in them the mesh would read as a placeholder.
+  assert.doesNotMatch(byId("plex-init-code") ?? "", /\$\{/);
+  assert.doesNotMatch(byId("plex-init") ?? "", /\$\{/);
+});
+
+// ---- the write: mesh-plex.py -------------------------------------------------------------------
+
+const python = spawnSync("python3", ["--version"]).status === 0 ? "python3" : undefined;
+
+/** An address of this machine that is not loopback, which the script refuses as plex's. */
+function outwardAddress(): string | undefined {
+  for (const list of Object.values(networkInterfaces())) {
+    for (const a of list ?? []) if (a.family === "IPv4" && !a.internal) return a.address;
+  }
+  return undefined;
+}
+const outward = outwardAddress();
+
+function fakePlex(opts: { trusted?: boolean } = {}): Promise<{ server: Server; port: number }> {
+  const server = createServer((req, res) => {
+    if (req.url === "/identity") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ MediaContainer: { machineIdentifier: MACHINE } }));
+      return;
+    }
+    if (req.headers["x-plex-token"] !== TOKEN) {
+      res.writeHead(opts.trusted ? 400 : 401);
+      res.end();
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ MediaContainer: { friendlyName: "ace" } }));
+  });
+  return new Promise((resolve) => server.listen(0, "0.0.0.0", () => resolve({ server, port: (server.address() as { port: number }).port })));
+}
+
+// An operator's config.ini, shaped as Tautulli writes it: plex at HAL's network gateway.
+const OPERATOR_INI = [
+  "[General]",
+  "first_run_complete = 1",
+  "api_key = 0123456789abcdef0123456789abcdef",
+  "",
+  "[PMS]",
+  "pms_identifier = " + MACHINE,
+  "pms_ip = 172.18.0.1",
+  "pms_is_remote = 0",
+  "pms_name = ace",
+  "pms_port = 32400",
+  'pms_token = "' + TOKEN + '"',
+  "pms_ssl = 0",
+  "pms_url = http://172.18.0.1:32400",
+  "pms_url_manual = 0",
+  "",
+  "[Monitoring]",
+  "monitor_pms_updates = 0",
+  "",
+].join("\n");
+
+function runScript(dir: string, at: string, port: number, credential: string, wait = "5") {
+  writeFileSync(join(dir, "plex-api.json"), JSON.stringify({ binding: 1, provision: "plex-api", from: "ace", at, serves: { scheme: "http", port } }));
+  writeFileSync(join(dir, "plex-api.secret"), credential + "\n");
+  // Asynchronously: the fake plex answers from this same process, so a blocking spawn would starve it.
+  return new Promise<{ status: number; out: string }>((resolve) => {
+    execFile(python as string, [join(here, "plex/mesh-plex.py")], {
+    env: {
+      ...process.env,
+      MESH_PLEX_BINDING: join(dir, "plex-api.json"),
+      MESH_PLEX_SECRET: join(dir, "plex-api.secret"),
+      MESH_TAUTULLI_CONFIG: join(dir, "config.ini"),
+      MESH_PLEX_WAIT_SECONDS: wait,
+    },
+    encoding: "utf8",
+    }, (err, stdout, stderr) => resolve({ status: err ? Number((err as { code?: unknown }).code ?? 1) : 0, out: `${stdout}${stderr}` }));
+  });
+}
+
+const skip = !python ? "no python3 here" : !outward ? "no non-loopback address to serve a fake plex on" : false;
+
+test("the write: [PMS] says what the mesh bound, and every other line stays", { skip }, async () => {
+  const { server, port } = await fakePlex();
+  try {
+    const dir = mkdtempSync(join(tmpdir(), "mesh-plex-"));
+    writeFileSync(join(dir, "config.ini"), OPERATOR_INI);
+    const r = await runScript(dir, outward as string, port, TOKEN);
+    assert.equal(r.status, 0);
+    // The token was already the server's (quoted, as ConfigObj may write it): not rewritten.
+    assert.match(r.out, /wrote pms_ip, pms_port, pms_url into Tautulli's \[PMS\]/);
+    const url = `http://${outward}:${port}`;
+    const expected = OPERATOR_INI
+      .replace("pms_ip = 172.18.0.1", `pms_ip = ${outward}`)
+      .replace("pms_port = 32400", `pms_port = ${port}`)
+      .replace("pms_url = http://172.18.0.1:32400", `pms_url = ${url}`);
+    assert.equal(readFileSync(join(dir, "config.ini"), "utf8"), expected);
+    assert.doesNotMatch(r.out, new RegExp(TOKEN));
+
+    // Again: nothing differs, nothing is written.
+    const before = statSync(join(dir, "config.ini")).mtimeMs;
+    const again = await runScript(dir, outward as string, port, TOKEN);
+    assert.match(again.out, /already as the mesh says/);
+    assert.equal(statSync(join(dir, "config.ini")).mtimeMs, before);
+  } finally {
+    server.close();
+  }
+});
+
+test("the write: a token plex refuses is never written; the address still is", { skip }, async () => {
+  for (const trusted of [false, true]) {
+    const { server, port } = await fakePlex({ trusted });
+    try {
+      const dir = mkdtempSync(join(tmpdir(), "mesh-plex-"));
+      writeFileSync(join(dir, "config.ini"), OPERATOR_INI);
+      const r = await runScript(dir, outward as string, port, "a-value-the-mesh-minted");
+      assert.equal(r.status, 0, "custom-init ignores the code; Tautulli starts on what it had");
+      assert.match(r.out, /secret accept <this node> tautulli plex-api --provider ace/);
+      assert.doesNotMatch(r.out, /a-value-the-mesh-minted/);
+      const ini = readFileSync(join(dir, "config.ini"), "utf8");
+      assert.match(ini, new RegExp(`pms_token = "${TOKEN}"`), "the working token stays");
+      assert.match(ini, new RegExp(`pms_ip = ${outward!.replace(/\./g, "\\.")}\n`));
+    } finally {
+      server.close();
+    }
+  }
+});
+
+test("the write: a Tautulli with no config.ini yet is started with [PMS] alone", { skip }, async () => {
+  const { server, port } = await fakePlex();
+  try {
+    const dir = mkdtempSync(join(tmpdir(), "mesh-plex-"));
+    await runScript(dir, outward as string, port, TOKEN);
+    assert.equal(
+      readFileSync(join(dir, "config.ini"), "utf8"),
+      `[PMS]\npms_ip = ${outward}\npms_port = ${port}\npms_ssl = 0\npms_url = http://${outward}:${port}\n` +
+        `pms_identifier = ${MACHINE}\npms_token = ${TOKEN}\n`,
+    );
+  } finally {
+    server.close();
+  }
+});
+
+test("the write: a plex that cannot be asked gets its address written and no token", { skip }, async () => {
+  const { server, port } = await fakePlex();
+  await new Promise((r) => server.close(r)); // nothing listens there now
+  const dir = mkdtempSync(join(tmpdir(), "mesh-plex-"));
+  writeFileSync(join(dir, "config.ini"), OPERATOR_INI);
+  const r = await runScript(dir, outward as string, port, TOKEN, "0");
+  assert.match(r.out, /could not be asked/);
+  const ini = readFileSync(join(dir, "config.ini"), "utf8");
+  assert.match(ini, new RegExp(`pms_url = http://${outward!.replace(/\./g, "\\.")}:${port}\n`));
+  assert.match(ini, new RegExp(`pms_token = "${TOKEN}"`), "left exactly as it was");
+});
+
+test("the write: a loopback binding writes nothing", { skip: !python ? "no python3 here" : false }, async () => {
+  const dir = mkdtempSync(join(tmpdir(), "mesh-plex-"));
+  writeFileSync(join(dir, "config.ini"), OPERATOR_INI);
+  const r = await runScript(dir, "127.0.0.1", 32400, TOKEN, "0");
+  assert.match(r.out, /private network/);
+  assert.equal(readFileSync(join(dir, "config.ini"), "utf8"), OPERATOR_INI);
+  assert.equal(existsSync(join(dir, "config.ini")), true);
+});
+
+// ---- the check: plex/check.ts ------------------------------------------------------------------
+
+function binding(at = "ace.internal", port = 32400): Binding {
+  return { provision: "plex-api", from: "ace", at, serves: { scheme: "http", port } };
+}
+
+function fakes(opts: { holds?: string; connected?: boolean; trusted?: boolean } = {}) {
+  const calls: string[] = [];
+  const http: Http = {
+    async fetch(url, init) {
+      calls.push(url);
+      const reply = (status: number, value?: unknown) => ({ status, text: async () => (value === undefined ? "" : JSON.stringify(value)) });
+      const u = new URL(url);
+      if (u.hostname === "ace.internal") {
+        return init?.headers?.["X-Plex-Token"] === TOKEN ? reply(200, {}) : reply(opts.trusted ? 400 : 401);
+      }
+      if (u.searchParams.get("apikey") !== "tautulli-key") return reply(401);
+      const cmd = u.searchParams.get("cmd");
+      if (cmd === "get_server_info") {
+        return reply(200, { response: { result: "success", data: { pms_url: opts.holds ?? "http://ace.internal:32400", pms_ip: "ace.internal" } } });
+      }
+      if (cmd === "server_status") {
+        return reply(200, { response: { result: "success", data: { result: "success", connected: opts.connected ?? true } } });
+      }
+      return reply(404);
+    },
+  };
+  return { http, calls };
+}
+
+const TAUTULLI = { url: "http://127.0.0.1:8181", apiKey: "tautulli-key" };
+
+test("the check: pointed where the binding says and connected passes", async () => {
+  const f = fakes();
+  assert.deepEqual(await check(f.http, TAUTULLI, binding(), TOKEN, 0, 0), { result: "connected", url: "http://ace.internal:32400" });
+});
+
+test("the check: a token plex refuses fails naming the accept, and never prints it", async () => {
+  for (const trusted of [false, true]) {
+    const f = fakes({ trusted });
+    const out = await check(f.http, TAUTULLI, binding(), "a-value-the-mesh-minted", 0, 0);
+    assert.equal(out.result, "refused");
+    const problem = (out as { problem: string }).problem;
+    assert.match(problem, /secret accept <this node> tautulli plex-api --provider ace/);
+    assert.doesNotMatch(problem, /a-value-the-mesh-minted/);
+    assert.equal(f.calls.some((c) => c.includes("/api/v2")), false, "Tautulli was not even asked");
+  }
+});
+
+test("the check: a Tautulli pointed elsewhere fails, naming where it points", async () => {
+  const out = await check(fakes({ holds: "http://172.18.0.1:32400" }).http, TAUTULLI, binding(), TOKEN, 0, 0);
+  assert.equal(out.result, "refused");
+  assert.match((out as { problem: string }).problem, /at http:\/\/172\.18\.0\.1:32400, not http:\/\/ace\.internal:32400/);
+});
+
+test("the check: pointed right but not connected fails", async () => {
+  const out = await check(fakes({ connected: false }).http, TAUTULLI, binding(), TOKEN, 0, 0);
+  assert.equal(out.result, "refused");
+  assert.match((out as { problem: string }).problem, /not connected/);
+});
+
+test("the check: a loopback binding is refused", async () => {
+  const out = await check(fakes().http, TAUTULLI, binding("127.0.0.1"), TOKEN, 0, 0);
+  assert.equal(out.result, "refused");
+  assert.match((out as { problem: string }).problem, /private network/);
+});
@@ -8,5 +8,5 @@
    "skipLibCheck": true,
    "noEmit": true
  },
-  "include": ["client.ts", "index.ts", "tools/index.ts"]
+  "include": ["client.ts", "index.ts", "tools/index.ts", "plex/check.ts", "plex/index.ts"]
 }