fix(proxy): synthesize stable nzb_id for first-time-seen /learn/imported

When a release posted to /learn/imported has no existing nfo_cache row,
the prior code used previous_nzb_id="" — which is the PRIMARY KEY of
nfo_cache. Every subsequent first-time-seen learn event would
INSERT OR REPLACE the empty-key row, clobbering the previous one.

Fix: when no previous nzb_id is known, derive a stable synthetic ID
from sha256(release_name)[:16] with an "ffp:" prefix. Two distinct
release names map to two distinct cache rows.

Tests: regression test posts two new releases and asserts both are
present in nfo_cache afterwards (with distinct ffp: nzb_ids). Pre-fix
this test FAILS with only the second release present.

Also rolls in the install scaffold fixes from earlier today:
- arr-ffprobe-real-install.sh: extract ffprobe from
  /app/sonarr/bin/ffprobe (linuxserver image's actual location), not
  /usr/bin/ffprobe.
- arr-on-import-learn.sh: prefer /config/bin/ffprobe-real (uses the
  existing /config bind-mount Sonarr/Radarr already have, no Cosmos
  compose edit needed), fall back to /opt/ffprobe-real if a bind-mount
  install is used.

205 tests pass.

Author: duck-vps

arr-ffprobe-real-install.sh

@@ -20,9 +20,10 @@ PROW_KEY=${PROWLARR_API_KEY:-19e327d9fccc40d9be7bd0f87eb39b04}
 # ---------- 1. Extract real ffprobe ---------------------------------------
 if [ ! -x "$FFPROBE_REAL" ]; then
     echo "[1/3] Extracting real ffprobe binary..."
-    # Use linuxserver/sonarr (which ships a working ffprobe before our stub overlays it)
+    # linuxserver/sonarr ships ffprobe at /app/sonarr/bin/ffprobe (radarr image
+    # has it at /app/radarr/bin/ffprobe — either works since both are static).
     cid=$(docker create lscr.io/linuxserver/sonarr:latest)
-    docker cp "$cid:/usr/bin/ffprobe" "$FFPROBE_REAL"
+    docker cp "$cid:/app/sonarr/bin/ffprobe" "$FFPROBE_REAL"
     docker rm "$cid" >/dev/null
     chmod +x "$FFPROBE_REAL"
     echo "    -> $FFPROBE_REAL ($("$FFPROBE_REAL" -version | head -1))"

arr-on-import-learn.sh

@@ -28,8 +28,12 @@ release="${radarr_moviefile_scenename:-$sonarr_episodefile_scenename}"
 [ -z "$release" ] && exit 0
 [ -f "$file" ] || exit 0
 
-# Real ffprobe — bind-mounted into the container at /opt/ffprobe-real
-ffprobe_bin=/opt/ffprobe-real
+# Real ffprobe — placed at /config/bin/ffprobe-real by the install scaffold
+# (the /config bind-mount that Sonarr/Radarr already have, no Cosmos compose
+# changes needed). Falls back to /opt/ffprobe-real if a bind-mount install
+# is used instead.
+ffprobe_bin=/config/bin/ffprobe-real
+[ -x "$ffprobe_bin" ] || ffprobe_bin=/opt/ffprobe-real
 [ -x "$ffprobe_bin" ] || exit 0
 
 # Run ffprobe; bail silently if it errors

dksubs-proxy.py

@@ -691,9 +691,16 @@ async def _handle_learn_imported(request) -> "web.Response":
             log(f"/learn/imported audit insert failed: {e!r}", "WARN")
 
     # Update cache (ffprobe overrides any prior source).
-    # Re-use the existing nzb_id so INSERT OR REPLACE updates the same row.
+    # If the release was already known, re-use its nzb_id so INSERT OR
+    # REPLACE updates the same row. If NOT known (no previous entry), an
+    # empty nzb_id would collide with every other first-time-seen learn
+    # event because nzb_id is the primary key. Synthesize a stable
+    # release-name-derived ID instead: `ffp:<sha256(release_name)[:16]>`.
+    cache_nzb_id = previous_nzb_id or (
+        "ffp:" + hashlib.sha256(release_name.encode("utf-8")).hexdigest()[:16]
+    )
     try:
-        await cache_set(previous_nzb_id, actual_tag, release_name, source="ffprobe")
+        await cache_set(cache_nzb_id, actual_tag, release_name, source="ffprobe")
     except Exception as e:
         log(f"/learn/imported cache_set failed: {e!r}", "WARN")
 

tests/test_learn_endpoint.py

@@ -115,3 +115,67 @@ async def test_learn_endpoint_mismatch_classification(proxy, cache_db, monkeypat
         assert result == expected_mismatch, (
             f"predicted={predicted} actual={actual} expected={expected_mismatch} got={result}"
         )
+
+
+@pytest.mark.asyncio
+async def test_learn_endpoint_synthesizes_nzb_id_when_release_is_new(
+    proxy, cache_db, monkeypatch,
+):
+    """Two different releases with NO previous cache entry must NOT collide
+    on the same empty primary key. Each gets a stable synthetic nzb_id
+    derived from its release_name so INSERT OR REPLACE doesn't clobber
+    the other."""
+    monkeypatch.setattr(proxy, "PROWLARR_API_KEY", "k")
+
+    from aiohttp.test_utils import make_mocked_request
+
+    async def post(body_json: str):
+        req = make_mocked_request(
+            "POST", "/learn/imported",
+            headers={"X-Api-Key": "k", "Content-Type": "application/json"},
+        )
+        async def text(): return body_json
+        req.text = text
+        return await proxy._handle_learn_imported(req)
+
+    # First release — new to cache
+    resp1 = await post(json.dumps({
+        "release_name": "FirstRelease.2026.NORDiC.1080p-FOO",
+        "audio_languages": ["dan", "eng"],
+        "subtitle_languages": ["dan"],
+    }))
+    assert resp1.status == 200
+
+    # Second release — also new to cache
+    resp2 = await post(json.dumps({
+        "release_name": "SecondRelease.2026.NORDiC.1080p-BAR",
+        "audio_languages": ["dan", "eng"],
+        "subtitle_languages": ["dan"],
+    }))
+    assert resp2.status == 200
+
+    # BOTH releases must be present in nfo_cache after the two POSTs.
+    # Pre-fix bug: both writes used nzb_id='' which is the PK, so the
+    # second INSERT OR REPLACE clobbered the first.
+    async with cache_db.execute(
+        "SELECT nzb_id, release_name FROM nfo_cache "
+        "WHERE release_name IN (?, ?)",
+        ("FirstRelease.2026.NORDiC.1080p-FOO",
+         "SecondRelease.2026.NORDiC.1080p-BAR"),
+    ) as cur:
+        rows = await cur.fetchall()
+
+    rel_names = {r[1] for r in rows}
+    assert "FirstRelease.2026.NORDiC.1080p-FOO" in rel_names, (
+        f"first release lost from cache: {rows!r}"
+    )
+    assert "SecondRelease.2026.NORDiC.1080p-BAR" in rel_names
+
+    # The synthetic IDs must be distinct (no PK collision)
+    ids = {r[0] for r in rows}
+    assert len(ids) == 2, f"expected 2 distinct nzb_ids, got: {ids!r}"
+    # Synthetic IDs should be predictable: ffp:<hash>
+    for nid in ids:
+        assert nid.startswith("ffp:"), (
+            f"new-release nzb_id should be synthetic 'ffp:...', got {nid!r}"
+        )