[jmlrt]

Summary

Documentation housekeeping split out of the Liked Songs PR (#57) scope audit, then extended with a FAQ, stale-reference fixes, agent/permission configuration hardening, and genericized test fixtures.

Changes

TODO backlog

• Note that sqlite.execute_many() and the liked-sync query parameterization landed with feat: add Liked Songs (saved tracks) support #57; keep the repo-wide f-string migration open
• Add web-UI backlog items, each scoped as a standalone PR: track selection with batch actions on the /tracks page, job page log following the last line, resizable columns on the tracks page
• Add TODO entries for the two workarounds documented in the FAQ: job cancellation in the web UI (cooperative cancel flag) and first-time Spotify auth in the web UI (paste-redirect-URL page)
• Remove personal-usage traces: drop the private toolbox reference from the random-playlist idea, genericize the duplicate-detection examples

FAQ

• Add FAQ.md covering setup/auth workflow, token cache location, Docker Compose usage, and stuck-job troubleshooting
• Clarify the redirect-URI behavior in the manual auth flow: the browser landing on 127.0.0.1:9090 (the REDIRECT_URI default) and showing "site can't be reached" is expected — nothing listens there during the manual flow; it works only because that URI matches the Spotify app registration

Stale references

• Repoint dead CLAUDE.md links to AGENTS.md across SPEC.md, CONTRIBUTING.md, README.md
• Fix the "Per CLAUDE.md Development Practices" attribution in CONTRIBUTING.md (the quoted rule lives in CONTRIBUTING itself)

Agent guidance and permissions (AGENTS.md, .vibe/config.toml)

• AGENTS.md: shell habits that keep commands inside the Vibe allowlist — plain git forms (no git -C), allowlisted search tools (grep/find, not rg/awk/sed), builtin file tools over shell for reads (read_file instead of sed -n/cat), verification via make test-unit/uv run pytest -k instead of one-off uv run python -c, and no routing around deliberate prompts
• .vibe/config.toml: self-sufficient least-privilege bash allowlist — Vibe read-only defaults plus safe make/uv/spfm entry points, local git workflow (add/commit), and gh auth status; make publish/build/clean, dependency changes, library-mutating spfm ops, git push and destructive git ops stay behind the approval prompt

Test fixtures

• Replace real artist/track names (Beatles, Queen, Pink Floyd, Guns N' Roses, AC/DC, Björk, JID, Anderson .Paak, Latto) with generic Test Artist/Test Track-style fixtures across the test suite and dupes.py algorithm comments; branch-sensitive duplicate-detection cases preserve name lengths, prefix tokens, apostrophes, feat-credit structure and remix markers so every code path is unchanged
• Remove the four dead sample_*_data fixtures in conftest.py (defined, never consumed)

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe vibe@mistral.ai

[Copilot]

🟢 Approval recommended

The documentation-only changes have no blocking issues; the remaining wording correction is minor.

1 open issue

• Mark parameterization changes as pending PR #57 merge · New

What changed in this PR

Updates spotfm’s backlog independently of the Liked Songs feature in #57. This is documentation-only; runtime behavior is unchanged.

Changes:

• Adds a parameterization progress note while keeping the repo-wide migration open.
• Defines standalone web UI tasks for batch track actions, automatic log scrolling, and resizable track columns.

File	Description
TODO.md	Updates parameterization tracking and adds three web UI backlog items.

_{Review effort: Balanced}