feat(soundtouchweb): make #622 auto-resume opt-in via settings.json

Automatically re-triggering content selection without a user action isn't something every operator wants, and we haven't independently confirmed the root cause generalises beyond the original report. Add Settings.AutoResumeOnSourceDisconnect (default false, hand-edit settings.json to enable, matching the TuneInStreamFormats precedent - no admin UI control yet). Wired through a WebApp hook so the standalone soundtouch-player build stays unaffected, and read fresh per drop so toggling the setting takes effect without a restart.
fix(soundtouchweb): auto-resume playback after an unsolicited SOURCE_DISCONNECTED (#622 )
2026-08-31 14:57:17 +00:00 · 2026-08-18 21:38:33 +02:00 · 2026-08-18 21:38:33 +02:00
24 changed files with 541 additions and 632 deletions
@@ -346,14 +346,6 @@ jobs:
          TAG_NAME="${{ needs.validate.outputs.tag }}"
          VERSION="${TAG_NAME#v}"

-          # Real per-platform links for the two most-used tools, generated
-          # from the deterministic `<binary>-<tag>-<os>-<arch>[.exe]` asset
-          # naming convention (see scripts/release/quick-downloads.sh),
-          # instead of requiring a scroll through the flat, alphabetical
-          # Assets list. Inline checksum link per row (à la Helm's release
-          # notes) instead of sending people to the combined checksums file.
-          QUICK_DOWNLOADS="$(scripts/release/quick-downloads.sh "$TAG_NAME" "${{ github.repository }}")"
-
          # Short, accurate header. GitHub's auto-generated "What's Changed"
          # + "Full Changelog" are appended after this (generate_release_notes).
          cat > release_notes.md << EOF
@@ -361,15 +353,13 @@ jobs:

          **Bose SoundTouch Toolkit.** Keep your Bose SoundTouch speakers alive after the Bose cloud shutdown. No Bose infrastructure required.

-          $QUICK_DOWNLOADS
-
          ## What's included

          Pre-built binaries for Linux (amd64, arm64, armv7), macOS (Intel & Apple Silicon), Windows (amd64), and FreeBSD (amd64):

-          - **soundtouch-service** (see above)
-          - **soundtouch-cli** (see above)
+          - **soundtouch-service**: local server that replaces the Bose cloud. Point your speaker at it and you keep full control; the built-in web UI on port 8000 handles setup.
          - **soundtouch-player**: standalone LAN web UI for device control: play/pause, volume, presets, live status. (Formerly \`soundtouch-web\`.)
+          - **soundtouch-cli**: command-line control of any device: playback, presets, sources, multiroom zones, discovery, and migration. Good for scripting and home automation.
          - **soundtouch-backup**: back up your Bose cloud account and each speaker's local state. \`soundtouch-backup all\` captures everything in one step.

          Not sure which file to grab? The [Downloads page](https://gesellix.github.io/Bose-SoundTouch/docs/downloads/) explains which tool you need and which \`<os>-<arch>\` build matches your computer.
@@ -424,62 +414,12 @@ jobs:
    if: github.event_name == 'release' && github.event.action == 'published'

    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ needs.validate.outputs.tag }}
-
      - name: Download release assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-assets
          path: ./release-assets

-      - name: Upgrade the Downloads footer with direct per-platform links
-        # This is the path real releases take: a maintainer hand-writes
-        # "Noteworthy" notes and publishes via the GitHub web UI, which
-        # fires this job, not create_release (workflow_dispatch only).
-        # _/releases/_TEMPLATE.md's convention is a trailing footer line:
-        #   ---
-        #   📦 **Downloads / installation:** <downloads page URL>
-        # Drop that line (if present) and append the quick-downloads
-        # block in its place. Always goes through the same append path
-        # (strip block + strip footer + append), whether or not a
-        # footer line is still there, so re-runs stay byte-for-byte
-        # idempotent instead of drifting on the 2nd run.
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          TAG_NAME="${{ needs.validate.outputs.tag }}"
-
-          scripts/release/quick-downloads.sh "$TAG_NAME" "${{ github.repository }}" > quick_downloads.md
-          gh release view "$TAG_NAME" --json body -q .body > existing_body.md
-
-          python3 - << 'PYEOF'
-          import re
-
-          with open("existing_body.md") as f:
-              body = f.read()
-          with open("quick_downloads.md") as f:
-              block = f.read().rstrip("\n")
-
-          # Drop a block this automation inserted on a previous run.
-          body = re.sub(r"\n*<!-- quick-downloads:start -->.*?<!-- quick-downloads:end -->\n*", "\n", body, flags=re.DOTALL)
-
-          # Drop the hand-authored footer line (first run only) so both
-          # cases converge on the same append below and re-runs stay
-          # byte-for-byte idempotent.
-          footer = re.compile(r"^📦 \*\*Downloads / installation:\*\*.*\n?", re.MULTILINE)
-          body = footer.sub("", body, count=1)
-
-          body = body.rstrip("\n") + "\n\n" + block + "\n"
-
-          with open("combined_notes.md", "w") as f:
-              f.write(body)
-          PYEOF
-
-          gh release edit "$TAG_NAME" --notes-file combined_notes.md
-
      - name: Upload additional assets to existing release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
@@ -15,7 +15,6 @@ import (

 	"github.com/gesellix/bose-soundtouch/pkg/models"
 	"github.com/gesellix/bose-soundtouch/pkg/service/constants"
-	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
 	"github.com/gesellix/bose-soundtouch/pkg/service/setup"
 	"github.com/urfave/cli/v2"
 	"golang.org/x/term"
@@ -675,9 +674,9 @@ func setupEnableSSHCmd() *cli.Command {
 			},
 			&cli.StringFlag{
 				Name: "account",
-				Usage: "Only used when the device is unpaired and --no-auto-pair is not set: account ID to pair with " +
-					"(empty = generate a fresh 7-digit one). Use this if you already know which account this device " +
-					"should end up on (e.g. to match one already in the datastore) rather than getting a random one now",
+				Usage: "Only used when the device is unpaired and --no-auto-pair is not set: 7-digit account ID to pair " +
+					"with (empty = generate one). Use this if you already know which account this device should end up " +
+					"on (e.g. to match one already in the datastore) rather than getting a random one now",
 			},
 			&cli.BoolFlag{
 				Name:  "no-reset-urls",
@@ -1975,7 +1974,7 @@ func setupPairCmd() *cli.Command {
 		Usage:  "Pair the speaker with an account via WebSocket SETUP state machine",
 		Before: RequireHost,
 		Flags: []cli.Flag{
-			&cli.StringFlag{Name: "account", Usage: "Account ID to pair with (empty = generate a fresh 7-digit one)"},
+			&cli.StringFlag{Name: "account", Usage: "7-digit account ID (empty = generate)"},
 			&cli.StringFlag{Name: "mode", Value: "full", Usage: "full (state machine) or bare (setMargeAccount only — experimental)"},
 			&cli.StringFlag{Name: "service-url", Value: "http://aftertouch.local:8000", Usage: "AfterTouch base URL (also populates <boseServer>/<updateServer> in setMargeAccount)"},
 			&cli.StringFlag{Name: "name", Usage: "Speaker name to set during pairing (empty = keep current)"},
@@ -1999,8 +1998,8 @@ func setupPairCmd() *cli.Command {
 				fmt.Printf("Generated account id: %s\n", accountID)
 			}

-			if !datastore.IsSafeIdentifier(accountID) {
-				return fmt.Errorf("invalid account id %q: must be a non-empty, path-safe identifier", accountID)
+			if !setup.IsValidAccountID(accountID) {
+				return fmt.Errorf("invalid account id %q: must be 7 digits", accountID)
 			}

 			switch mode {
@@ -1471,6 +1471,17 @@ func newEmbeddedWebApp(server *handlers.Server, serverURL, internalURL string, d
 		return err
 	}

+	// Opt-in (#622): hand-edit settings.json's auto_resume_on_source_disconnect
+	// to enable. Read fresh per drop so toggling it applies without a restart.
+	webApp.AutoResumeOnSourceDisconnect = func() bool {
+		settings, err := ds.GetSettings()
+		if err != nil {
+			return false
+		}
+
+		return settings.AutoResumeOnSourceDisconnect
+	}
+
 	// Keep the UI registry live as the service discovers or devices are added.
 	server.SetDevicesChangedHook(func() {
 		webApp.SeedExtraDevices()
@@ -17,17 +17,12 @@ then **which build** matches your computer.
 AfterTouch is a small set of separate programs. Most people run one or
 two of them.

-| Tool                 | What it does                                                                                   | You want this if…                                       |
-|----------------------|------------------------------------------------------------------------------------------------|---------------------------------------------------------|
-| `soundtouch-service` | The local cloud replacement ("AfterTouch"). Runs always-on and takes over from the Bose cloud. | You are migrating speakers off the Bose cloud.          |
-| `soundtouch-cli`     | Command-line control and setup (status, play, presets, groups, **migration**, …).              | You want to script things, or run a migration by hand.  |
-| `soundtouch-player`  | A browser control panel (radio browsing, device control).                                      | You want a web UI to browse radio and control speakers. |
-| `soundtouch-backup`  | Backs up your Bose cloud account and each speaker's local state.                               | You are preparing before a shutdown / factory reset.    |
-
-Most people only need **`soundtouch-service`** and **`soundtouch-cli`** — the
-release notes on each [GitHub release](https://github.com/gesellix/Bose-SoundTouch/releases/latest)
-link those two directly, one row per platform, so you don't have to hunt
-through the flat Assets list below.
+| Tool                 | What it does                                                                                   | You want this if…                                        |
+|----------------------|-----------------------------------------------------------------------------------------------|----------------------------------------------------------|
+| `soundtouch-service` | The local cloud replacement ("AfterTouch"). Runs always-on and takes over from the Bose cloud. | You are migrating speakers off the Bose cloud.           |
+| `soundtouch-player`  | A browser control panel (radio browsing, device control).                                      | You want a web UI to browse radio and control speakers.  |
+| `soundtouch-cli`     | Command-line control and setup (status, play, presets, groups, **migration**, …).              | You want to script things, or run a migration by hand.   |
+| `soundtouch-backup`  | Backs up your Bose cloud account and each speaker's local state.                                | You are preparing before a shutdown / factory reset.     |

 > Running a migration from the command line (for example the telnet
 > re-migration in the
@@ -33,30 +33,11 @@ func exists(path string) bool {
 	return err == nil
 }

-// maxSafeIdentifierLength bounds account/device IDs accepted from a
-// speaker or third-party pairing tool. Well under typical filesystem
-// path-component limits (255 bytes); generous for any realistic
-// margeAccountUUID or MAC-derived device ID.
-const maxSafeIdentifierLength = 128
-
-// IsSafeIdentifier returns true if the given identifier is safe to use
-// as a single path component (for account IDs, device IDs, etc.), and
-// safe to embed in the other places these values end up: XML sent to a
-// speaker, log lines, and datastore-key comparisons. It rejects empty
-// or overlong strings, path separators, and parent directory
-// references.
-//
-// The allowed character set intentionally excludes XML/HTML-special
-// characters (`< > & " '`), whitespace, and shell/URL metacharacters
-// (see #634's `postSetMargeAccount`, which interpolates an account ID
-// into an XML body, and `PairAccount`, which interpolates one into a
-// literal `envswitch accountid set <id>` telnet command line) even
-// though it accepts more than Bose's own 7-digit account format —
-// devices paired via third-party or manual tooling (e.g. the
-// USB-stick SSH-enable method) can report arbitrary margeAccountUUID
-// values such as "stick@local".
-func IsSafeIdentifier(id string) bool {
-	if id == "" || len(id) > maxSafeIdentifierLength {
+// isSafeIdentifier returns true if the given identifier is safe to use
+// as a single path component (for account IDs, device IDs, etc.).
+// It rejects empty strings, path separators, and parent directory references.
+func isSafeIdentifier(id string) bool {
+	if id == "" {
 		return false
 	}

@@ -65,17 +46,14 @@ func IsSafeIdentifier(id string) bool {
 		return false
 	}

-	// Letters, digits, and a conservative set of punctuation seen in
-	// real-world IDs: underscore, dash, dot, colon (MAC-like IDs), and
-	// '@' (e.g. "stick@local"). Everything else — including all XML,
-	// HTML, shell, and URL metacharacters, whitespace, and control
-	// characters — is rejected.
+	// Allow a conservative set of characters commonly found in IDs:
+	// letters, digits, underscore, dash, dot, and colon (for MAC-like IDs).
 	for i := 0; i < len(id); i++ {
 		c := id[i]
 		if (c >= 'a' && c <= 'z') ||
 			(c >= 'A' && c <= 'Z') ||
 			(c >= '0' && c <= '9') ||
-			c == '_' || c == '-' || c == '.' || c == ':' || c == '@' {
+			c == '_' || c == '-' || c == '.' || c == ':' {
 			continue
 		}

@@ -978,8 +956,6 @@ func (ds *DataStore) readPresetsLocked(account, device string) ([]models.Service
 	data, err := ds.rootReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
-			log.Printf("[Datastore] readPresetsLocked: no Presets.xml at %s — reporting no presets", sanitizeLog(path))
-
 			return []models.ServicePreset{}, false, nil
 		}

@@ -1323,8 +1299,6 @@ func (ds *DataStore) GetRecents(account, device string) ([]models.ServiceRecent,
 	data, err := ds.rootReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
-			log.Printf("[Datastore] GetRecents: no Recents.xml at %s — reporting no recents", sanitizeLog(path))
-
 			return []models.ServiceRecent{}, nil
 		}

@@ -1535,7 +1509,7 @@ func (ds *DataStore) SaveDeviceInfo(account, device string, info *models.Service
 		return fmt.Errorf("device ID/name cannot be empty")
 	}

-	if !IsSafeIdentifier(device) {
+	if !isSafeIdentifier(device) {
 		return fmt.Errorf("invalid device ID")
 	}

@@ -1543,7 +1517,7 @@ func (ds *DataStore) SaveDeviceInfo(account, device string, info *models.Service
 		return fmt.Errorf("account ID cannot be empty")
 	}

-	if !IsSafeIdentifier(account) {
+	if !isSafeIdentifier(account) {
 		return fmt.Errorf("invalid account ID")
 	}

@@ -1731,10 +1705,6 @@ func (ds *DataStore) SaveAccountInfo(accountID string, info *models.ServiceAccou
 		return nil
 	}

-	if !IsSafeIdentifier(accountID) {
-		return fmt.Errorf("invalid account ID")
-	}
-
 	dir := ds.AccountDir(accountID)
 	if err := ds.rootMkdirAll(dir, 0755); err != nil {
 		return err
@@ -2681,6 +2651,19 @@ type Settings struct {
 	// individual format tokens.
 	TuneInStreamFormats string `json:"tunein_stream_formats,omitempty"`

+	// AutoResumeOnSourceDisconnect, when true, re-issues a device's last
+	// playing content item if now_playing drops into an error source right
+	// after a healthy one, instead of leaving the speaker silent until a
+	// user manually re-selects it. See #622: some TuneIn streams disconnect
+	// the speaker's own audio pipeline (errorUpdate 1041
+	// SOURCE_DISCONNECTED) on their own, mid-playback, with the SoundTouch
+	// WebSocket control channel staying healthy throughout; the observed
+	// fix is exactly what pressing the preset again does. Opt-in (default
+	// false): this automatically re-triggers content selection without a
+	// user action, which not every operator wants. Hand-edit settings.json
+	// to enable — no admin UI control yet, matching TuneInStreamFormats.
+	AutoResumeOnSourceDisconnect bool `json:"auto_resume_on_source_disconnect,omitempty"`
+
 	// DefaultLanding selects what the root path "/" serves to a browser:
 	//   "chooser" (or empty) — the neutral landing page that links to the
 	//                          player and the admin/setup console;
@@ -2,7 +2,6 @@ package datastore

 import (
 	"os"
-	"strings"
 	"testing"

 	"github.com/gesellix/bose-soundtouch/pkg/models"
@@ -20,10 +19,6 @@ func TestIsSafeIdentifier(t *testing.T) {
 		{"abc-123", true},
 		{"abc.123", true},
 		{"00:11:22:33:44:55", true},
-		// #634: third-party/manual pairing tools (e.g. the USB-stick
-		// SSH-enable method) can report a non-numeric margeAccountUUID.
-		{"stick@local", true},
-		{strings.Repeat("a", maxSafeIdentifierLength), true},
 		{"", false},
 		{"/", false},
 		{"\\", false},
@@ -35,6 +30,7 @@ func TestIsSafeIdentifier(t *testing.T) {
 		{"a..b", false},
 		{"a b", false},
 		{"a!b", false},
+		{"a@b", false},
 		{"a#b", false},
 		{"a$b", false},
 		{"a%b", false},
@@ -43,17 +39,12 @@ func TestIsSafeIdentifier(t *testing.T) {
 		{"a*b", false},
 		{"a(b", false},
 		{"a)b", false},
-		{"a<b", false},
-		{"a>b", false},
-		{`a"b`, false},
-		{"a'b", false},
-		{strings.Repeat("a", maxSafeIdentifierLength+1), false},
 	}

 	for _, test := range tests {
-		result := IsSafeIdentifier(test.id)
+		result := isSafeIdentifier(test.id)
 		if result != test.expected {
-			t.Errorf("IsSafeIdentifier(%q) = %v; expected %v", test.id, result, test.expected)
+			t.Errorf("isSafeIdentifier(%q) = %v; expected %v", test.id, result, test.expected)
 		}
 	}
 }
@@ -81,8 +72,6 @@ func TestSaveDeviceInfo_Validation(t *testing.T) {
 		{"acc1", "dev/1", true, "invalid device ID"},
 		{"acc..1", "dev1", true, "invalid account ID"},
 		{"acc1", "dev..1", true, "invalid device ID"},
-		// #634: a non-numeric margeAccountUUID is now accepted.
-		{"stick@local", "dev1", false, ""},
 	}

 	for _, test := range tests {
@@ -96,40 +85,3 @@ func TestSaveDeviceInfo_Validation(t *testing.T) {
 		}
 	}
 }
-
-func TestSaveAccountInfo_Validation(t *testing.T) {
-	tmpDir, err := os.MkdirTemp("", "datastore-test")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(tmpDir)
-
-	ds := NewDataStore(tmpDir)
-
-	tests := []struct {
-		account string
-		wantErr bool
-		errMsg  string
-	}{
-		{"acc1", false, ""},
-		// #634: a non-numeric margeAccountUUID reported via
-		// POST /streaming/account (see HandleMargeCreateAccount) must
-		// be validated the same way SaveDeviceInfo already validates
-		// device-reported account IDs.
-		{"stick@local", false, ""},
-		{"acc/1", true, "invalid account ID"},
-		{"acc..1", true, "invalid account ID"},
-		{"a<b", true, "invalid account ID"},
-	}
-
-	for _, test := range tests {
-		err := ds.SaveAccountInfo(test.account, &models.ServiceAccountInfo{AccountID: test.account})
-		if (err != nil) != test.wantErr {
-			t.Errorf("SaveAccountInfo(%q) error = %v, wantErr %v", test.account, err, test.wantErr)
-			continue
-		}
-		if test.wantErr && err.Error() != test.errMsg {
-			t.Errorf("SaveAccountInfo(%q) error message = %q, want %q", test.account, err.Error(), test.errMsg)
-		}
-	}
-}
@@ -13,7 +13,6 @@ import (
 	"log"
 	"net"
 	"net/http"
-	"net/url"
 	"os"
 	"path/filepath"
 	"sort"
@@ -256,12 +255,7 @@ func (s *Server) addServiceHTTP(tw *tar.Writer, client *http.Client, devices []m
 		if !seenAccounts[dev.AccountID] {
 			seenAccounts[dev.AccountID] = true
 			pfx := "http/service/account-" + dev.AccountID
-			// url.PathEscape, not raw concatenation: account/device IDs can
-			// contain characters like '@' (#634) that are safe as datastore
-			// keys but would otherwise need escaping to survive as URL path
-			// segments intact (e.g. a literal '?' or '#' would truncate the
-			// path here, though IsSafeIdentifier already excludes those).
-			acct := base + "/streaming/account/" + url.PathEscape(dev.AccountID)
+			acct := base + "/streaming/account/" + dev.AccountID
 			tryAdd(pfx+"/full.xml", acct+"/full")
 			tryAdd(pfx+"/sources.xml", acct+"/sources")
 			tryAdd(pfx+"/presets.xml", acct+"/presets")
@@ -272,7 +266,7 @@ func (s *Server) addServiceHTTP(tw *tar.Writer, client *http.Client, devices []m
 		}

 		dpfx := "http/service/account-" + dev.AccountID + "/device-" + dev.DeviceID
-		dpath := base + "/streaming/account/" + url.PathEscape(dev.AccountID) + "/device/" + url.PathEscape(dev.DeviceID)
+		dpath := base + "/streaming/account/" + dev.AccountID + "/device/" + dev.DeviceID
 		tryAdd(dpfx+"/presets.xml", dpath+"/presets")
 		tryAdd(dpfx+"/recents.xml", dpath+"/recents")
 	}
@@ -679,28 +673,29 @@ func (s *Server) addSystemFiles(tw *tar.Writer) {
 // diagSettings is a copy of datastore.Settings with secrets zeroed out so the
 // struct can be marshalled into the archive without exposing credentials.
 type diagSettings struct {
-	ServerURL              string         `json:"server_url"`
-	HTTPSServerURL         string         `json:"https_server_url,omitempty"`
-	HTTPSServerURLOverride string         `json:"https_server_url_override,omitempty"`
-	RedactLogs             bool           `json:"redact_logs"`
-	LogBodies              bool           `json:"log_bodies"`
-	RecordInteractions     bool           `json:"record_interactions"`
-	DiscoveryInterval      string         `json:"discovery_interval,omitempty"`
-	DiscoveryEnabled       bool           `json:"discovery_enabled"`
-	DNSEnabled             bool           `json:"dns_enabled"`
-	DNSUpstream            []string       `json:"dns_upstream,omitempty"`
-	DNSBindAddr            string         `json:"dns_bind_addr,omitempty"`
-	InternalPaths          []string       `json:"internal_paths,omitempty"`
-	Shortcuts              map[string]int `json:"shortcuts,omitempty"`
-	SpotifyClientID        string         `json:"spotify_client_id,omitempty"`
-	SpotifyClientSecret    string         `json:"spotify_client_secret,omitempty"`
-	SpotifyRedirectURI     string         `json:"spotify_redirect_uri,omitempty"`
-	AmazonClientID         string         `json:"amazon_client_id,omitempty"`
-	AmazonClientSecret     string         `json:"amazon_client_secret,omitempty"`
-	AmazonRedirectURI      string         `json:"amazon_redirect_uri,omitempty"`
-	TrustForwardedHeaders  bool           `json:"trust_forwarded_headers,omitempty"`
-	TrustedProxyCIDRs      []string       `json:"trusted_proxy_cidrs,omitempty"`
-	TuneInStreamFormats    string         `json:"tunein_stream_formats,omitempty"`
+	ServerURL                    string         `json:"server_url"`
+	HTTPSServerURL               string         `json:"https_server_url,omitempty"`
+	HTTPSServerURLOverride       string         `json:"https_server_url_override,omitempty"`
+	RedactLogs                   bool           `json:"redact_logs"`
+	LogBodies                    bool           `json:"log_bodies"`
+	RecordInteractions           bool           `json:"record_interactions"`
+	DiscoveryInterval            string         `json:"discovery_interval,omitempty"`
+	DiscoveryEnabled             bool           `json:"discovery_enabled"`
+	DNSEnabled                   bool           `json:"dns_enabled"`
+	DNSUpstream                  []string       `json:"dns_upstream,omitempty"`
+	DNSBindAddr                  string         `json:"dns_bind_addr,omitempty"`
+	InternalPaths                []string       `json:"internal_paths,omitempty"`
+	Shortcuts                    map[string]int `json:"shortcuts,omitempty"`
+	SpotifyClientID              string         `json:"spotify_client_id,omitempty"`
+	SpotifyClientSecret          string         `json:"spotify_client_secret,omitempty"`
+	SpotifyRedirectURI           string         `json:"spotify_redirect_uri,omitempty"`
+	AmazonClientID               string         `json:"amazon_client_id,omitempty"`
+	AmazonClientSecret           string         `json:"amazon_client_secret,omitempty"`
+	AmazonRedirectURI            string         `json:"amazon_redirect_uri,omitempty"`
+	TrustForwardedHeaders        bool           `json:"trust_forwarded_headers,omitempty"`
+	TrustedProxyCIDRs            []string       `json:"trusted_proxy_cidrs,omitempty"`
+	TuneInStreamFormats          string         `json:"tunein_stream_formats,omitempty"`
+	AutoResumeOnSourceDisconnect bool           `json:"auto_resume_on_source_disconnect,omitempty"`
 }

 // addSettingsJSON serialises the service settings into the archive as
@@ -779,28 +774,29 @@ func (s *Server) addSettingsJSON(tw *tar.Writer) {
 	_, effectiveHTTPSURL := s.GetSettings()

 	ds := diagSettings{
-		ServerURL:              st.ServerURL,
-		HTTPSServerURL:         effectiveHTTPSURL,
-		HTTPSServerURLOverride: st.HTTPServerURL,
-		RedactLogs:             st.RedactLogs,
-		LogBodies:              st.LogBodies,
-		RecordInteractions:     st.RecordInteractions,
-		DiscoveryInterval:      st.DiscoveryInterval,
-		DiscoveryEnabled:       st.DiscoveryEnabled,
-		DNSEnabled:             st.DNSEnabled,
-		DNSUpstream:            st.DNSUpstream,
-		DNSBindAddr:            st.DNSBindAddr,
-		InternalPaths:          st.InternalPaths,
-		Shortcuts:              st.Shortcuts,
-		SpotifyClientID:        st.SpotifyClientID,
-		SpotifyClientSecret:    redact(st.SpotifyClientSecret),
-		SpotifyRedirectURI:     st.SpotifyRedirectURI,
-		AmazonClientID:         st.AmazonClientID,
-		AmazonClientSecret:     redact(st.AmazonClientSecret),
-		AmazonRedirectURI:      st.AmazonRedirectURI,
-		TrustForwardedHeaders:  st.TrustForwardedHeaders,
-		TrustedProxyCIDRs:      st.TrustedProxyCIDRs,
-		TuneInStreamFormats:    st.TuneInStreamFormats,
+		ServerURL:                    st.ServerURL,
+		HTTPSServerURL:               effectiveHTTPSURL,
+		HTTPSServerURLOverride:       st.HTTPServerURL,
+		RedactLogs:                   st.RedactLogs,
+		LogBodies:                    st.LogBodies,
+		RecordInteractions:           st.RecordInteractions,
+		DiscoveryInterval:            st.DiscoveryInterval,
+		DiscoveryEnabled:             st.DiscoveryEnabled,
+		DNSEnabled:                   st.DNSEnabled,
+		DNSUpstream:                  st.DNSUpstream,
+		DNSBindAddr:                  st.DNSBindAddr,
+		InternalPaths:                st.InternalPaths,
+		Shortcuts:                    st.Shortcuts,
+		SpotifyClientID:              st.SpotifyClientID,
+		SpotifyClientSecret:          redact(st.SpotifyClientSecret),
+		SpotifyRedirectURI:           st.SpotifyRedirectURI,
+		AmazonClientID:               st.AmazonClientID,
+		AmazonClientSecret:           redact(st.AmazonClientSecret),
+		AmazonRedirectURI:            st.AmazonRedirectURI,
+		TrustForwardedHeaders:        st.TrustForwardedHeaders,
+		TrustedProxyCIDRs:            st.TrustedProxyCIDRs,
+		TuneInStreamFormats:          st.TuneInStreamFormats,
+		AutoResumeOnSourceDisconnect: st.AutoResumeOnSourceDisconnect,
 	}

 	data, err := json.MarshalIndent(ds, "", "  ")
@@ -14,7 +14,6 @@ import (

 	"github.com/gesellix/bose-soundtouch/pkg/models"
 	"github.com/gesellix/bose-soundtouch/pkg/service/constants"
-	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
 	"github.com/gesellix/bose-soundtouch/pkg/service/marge"
 	"github.com/go-chi/chi/v5"
 )
@@ -65,11 +64,6 @@ func (s *Server) HandleMargeCreateAccount(w http.ResponseWriter, r *http.Request
 		}
 	}

-	if !datastore.IsSafeIdentifier(id) {
-		http.Error(w, "Invalid account ID", http.StatusBadRequest)
-		return
-	}
-
 	info := &models.ServiceAccountInfo{
 		AccountID:         id,
 		PreferredLanguage: req.PreferredLanguage,
@@ -6,7 +6,6 @@ import (
 	"net/http"
 	"strings"

-	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
 	"github.com/gesellix/bose-soundtouch/pkg/service/health"
 	"github.com/gesellix/bose-soundtouch/pkg/service/setup"
 	"github.com/go-chi/chi/v5"
@@ -62,12 +61,12 @@ type pairAccountResponse struct {
 	Error  string                  `json:"error,omitempty"`
 }

-// HandlePairAccount associates the device with the supplied account ID,
+// HandlePairAccount associates the device with the supplied 7-digit account ID,
 // trying HTTP /setMargeAccount first and falling back to telnet
 // `envswitch accountid set`.
 //
 // Query params:
-//   - account_id (required) — must pass datastore.IsSafeIdentifier
+//   - account_id (required) — must pass setup.IsValidAccountID
 func (s *Server) HandlePairAccount(w http.ResponseWriter, r *http.Request) {
 	deviceID := chi.URLParam(r, "deviceId")
 	if deviceID == "" {
@@ -76,8 +75,8 @@ func (s *Server) HandlePairAccount(w http.ResponseWriter, r *http.Request) {
 	}

 	accountID := r.URL.Query().Get("account_id")
-	if !datastore.IsSafeIdentifier(accountID) {
-		writeJSONError(w, http.StatusBadRequest, "account_id must be a non-empty, path-safe identifier")
+	if !setup.IsValidAccountID(accountID) {
+		writeJSONError(w, http.StatusBadRequest, "account_id must be exactly 7 digits")
 		return
 	}

@@ -146,7 +145,7 @@ func (s *Server) completeSpeakerPairingFix(target health.Target) (string, error)
 	}

 	accountID := target.Account
-	if !datastore.IsSafeIdentifier(accountID) {
+	if !setup.IsValidAccountID(accountID) {
 		known, _ := s.ds.ListAccounts()

 		generated, genErr := setup.GenerateAccountID(known)
@@ -1,125 +0,0 @@
-package handlers
-
-import (
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"testing"
-
-	"github.com/gesellix/bose-soundtouch/pkg/models"
-	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
-	"github.com/gesellix/bose-soundtouch/pkg/service/setup"
-)
-
-// TestIssue634_NonNumericMargeAccountUUIDDoesNotLoseDevice reproduces
-// https://github.com/gesellix/Bose-SoundTouch/issues/634
-//
-// A SoundTouch 10 had SSH enabled via the USB-stick method (rather than
-// AfterTouch's own telnet-based enable-ssh flow) and, when discovered,
-// reported a `margeAccountUUID` of `stick@local` instead of the usual
-// 7-digit numeric Bose account ID. `handleDiscoveredDevice`
-// (pkg/service/handlers/server.go) passes MargeAccountUUID straight
-// through to DataStore.SaveDeviceInfo, which used to reject anything
-// containing "@" as an "invalid account ID" via isSafeIdentifier's
-// strict alnum-only allowlist. The device was never persisted at all.
-//
-// The fix widened datastore.IsSafeIdentifier to accept any device-reported
-// identifier that's safe to use as a path component / XML value /
-// telnet-command token, rather than requiring Bose's own 7-digit numeric
-// format. setup's separate, stricter 7-digit-only IsValidAccountID was
-// deleted outright in favor of calling datastore.IsSafeIdentifier directly
-// everywhere an account ID needs validating — one validator, not two. So
-// handleDiscoveredDevice needed no changes: it already passed
-// MargeAccountUUID through unmodified, and now the datastore accepts it.
-//
-// What this test locks in:
-//
-//   - A speaker reporting a non-numeric margeAccountUUID is saved
-//     under that account verbatim (not coerced to "default" — "default"
-//     remains reserved for a genuinely empty/unpaired margeAccountUUID).
-//
-// What this test would catch if it flipped:
-//
-//   - If IsSafeIdentifier's allowlist regresses to reject "@" again,
-//     GetDeviceInfo below would error with "invalid account ID" instead
-//     of returning the device — the #634 symptom.
-func TestIssue634_NonNumericMargeAccountUUIDDoesNotLoseDevice(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "issue634-*")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(tempDir)
-
-	const deviceInfoXML = `<info deviceID="001122334455">
-<name>Kitchen SoundTouch</name>
-<type>SoundTouch 10</type>
-<margeAccountUUID>stick@local</margeAccountUUID>
-<components>
-<component>
-<componentCategory>SCM</componentCategory>
-<softwareVersion>27.0.6.46330.5043500 epdbuild.trunk.hepdswbld04.2022-08-04T11:20:29</softwareVersion>
-<serialNumber>I6332527703739342000020</serialNumber>
-</component>
-<component>
-<componentCategory>PackagedProduct</componentCategory>
-<softwareVersion>27.0.6.46330.5043500 epdbuild.trunk.hepdswbld04.2022-08-04T11:20:29</softwareVersion>
-<serialNumber>069231P63364828AE</serialNumber>
-</component>
-</components>
-<margeURL>https://streaming.bose.com</margeURL>
-<networkInfo type="SCM">
-<macAddress>001122334455</macAddress>
-<ipAddress>203.0.113.10</ipAddress>
-</networkInfo>
-<moduleType>sm2</moduleType>
-<variant>rhino</variant>
-<variantMode>normal</variantMode>
-<countryCode>US</countryCode>
-<regionCode>US</regionCode>
-</info>`
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/info" {
-			w.Header().Set("Content-Type", "application/xml")
-			fmt.Fprint(w, deviceInfoXML)
-		} else {
-			http.NotFound(w, r)
-		}
-	}))
-	defer server.Close()
-
-	deviceIP := server.URL[len("http://"):]
-	ds := datastore.NewDataStore(tempDir)
-	sm := setup.NewManager(server.URL, ds, nil)
-
-	srv := NewServer(ds, sm, server.URL, false, false, false)
-
-	discoveredDevice := models.DiscoveredDevice{
-		Host:            deviceIP,
-		Name:            "Legacy Discovery Name",
-		ModelID:         "SoundTouch 10",
-		SerialNo:        "",
-		DiscoveryMethod: "UPnP",
-	}
-
-	t.Logf("Test scenario: /info reports non-numeric margeAccountUUID %q", "stick@local")
-
-	srv.handleDiscoveredDevice(discoveredDevice)
-
-	const (
-		expectedAccountID = "stick@local"
-		expectedDeviceID  = "001122334455"
-	)
-
-	deviceInfo, err := ds.GetDeviceInfo(expectedAccountID, expectedDeviceID)
-	if err != nil {
-		t.Fatalf("device was not saved under account %q: %v (this is the #634 symptom — "+
-			"SaveDeviceInfo rejects the raw margeAccountUUID as an invalid account ID)",
-			expectedAccountID, err)
-	}
-
-	if deviceInfo.Name != "Kitchen SoundTouch" {
-		t.Errorf("Name = %q, want %q", deviceInfo.Name, "Kitchen SoundTouch")
-	}
-}
@@ -598,19 +598,7 @@ async function fetchDevices() {
        if (devices.length === 0) {
            container.innerHTML = "No devices known yet.";
        } else {
-            // Built via DOM APIs rather than innerHTML/template strings: device
-            // fields (name, IDs, serials, ...) come from speakers and third-party
-            // pairing tools (see #634) and are not restricted to HTML/JS-safe
-            // characters, so they must never be parsed as markup or concatenated
-            // into inline event-handler attributes.
-            const table = document.createElement("table");
-            const headerRow = document.createElement("tr");
-            for (const label of ["Name & Model", "IP Address", "Device & Account ID", "Firmware & Serial", "Method", "Action"]) {
-                const th = document.createElement("th");
-                th.textContent = label;
-                headerRow.appendChild(th);
-            }
-            table.appendChild(headerRow);
+            let html = "<table><tr><th>Name & Model</th><th>IP Address</th><th>Device & Account ID</th><th>Firmware & Serial</th><th>Method</th><th>Action</th></tr>";

            // Clear and repopulate selectors
            const currentSyncVal = syncSelector.value;
@@ -624,83 +612,25 @@ async function fetchDevices() {

            devices.forEach((d) => {
                const methodLabel = d.discovery_method === "manual" ? "👤 Manual" : "🔍 Auto";
-
-                const nameModelCell = document.createElement("td");
-                nameModelCell.className = "col-name-model";
-                const nameDiv = document.createElement("div");
-                nameDiv.className = "col-name";
-                nameDiv.textContent = d.name;
-                const modelDiv = document.createElement("div");
-                modelDiv.className = "col-model";
-                modelDiv.style.cssText = "font-size: 0.8em; color: #666;";
-                modelDiv.textContent = d.product_code;
-                nameModelCell.append(nameDiv, modelDiv);
-
-                const ipCell = document.createElement("td");
-                ipCell.className = "col-ip";
-                ipCell.textContent = d.ip_address;
-
-                const idsCell = document.createElement("td");
-                idsCell.className = "col-ids";
-                const deviceIdDiv = document.createElement("div");
-                deviceIdDiv.className = "col-deviceid";
-                deviceIdDiv.textContent = d.device_id;
-                const accountIdDiv = document.createElement("div");
-                accountIdDiv.className = "col-accountid";
-                accountIdDiv.style.cssText = "font-size: 0.8em; color: #666;";
-                accountIdDiv.textContent = d.account_id || "default";
-                idsCell.append(deviceIdDiv, accountIdDiv);
-
-                const fwCell = document.createElement("td");
-                fwCell.className = "col-fw-serial";
-                const fwDiv = document.createElement("div");
-                fwDiv.className = "col-firmware";
-                fwDiv.textContent = d.firmware_version || "0.0.0";
-                const serialDiv = document.createElement("div");
-                serialDiv.className = "col-serial";
-                serialDiv.style.cssText = "font-size: 0.8em; color: #666;";
-                serialDiv.textContent = d.device_serial_number;
-                fwCell.append(fwDiv, serialDiv);
-
-                const methodCell = document.createElement("td");
-                methodCell.className = "col-method";
-                methodCell.textContent = methodLabel;
-
-                const makeActionButton = (label, onClick, extra) => {
-                    const btn = document.createElement("button");
-                    btn.textContent = label;
-                    btn.addEventListener("click", onClick);
-                    if (extra) Object.assign(btn, extra);
-                    return btn;
-                };
-
-                const actionCell = document.createElement("td");
-                actionCell.append(
-                    makeActionButton("Inspect", () => toggleDeviceSummary(d.device_id)),
-                    makeActionButton("Sync Data", () => prepareSync(d.device_id)),
-                    makeActionButton("Migrate", () => prepareMigration(d.device_id)),
-                    makeActionButton("Prime Spotify", () => primeSpotify(d.device_id), {
-                        id: `prime-spotify-${d.device_id}`,
-                        className: "btn-spotify",
-                    }),
-                    makeActionButton("Remove", () => removeDevice(d.device_id, d.name), {className: "btn-danger"}),
-                );
-                actionCell.querySelector(".btn-spotify").style.display = "none";
-
-                const row = document.createElement("tr");
-                row.id = `device-row-${d.device_id}`;
-                row.append(nameModelCell, ipCell, idsCell, fwCell, methodCell, actionCell);
-
-                const summaryRow = document.createElement("tr");
-                summaryRow.id = `device-summary-${d.device_id}`;
-                summaryRow.style.display = "none";
-                const summaryCell = document.createElement("td");
-                summaryCell.colSpan = 6;
-                summaryCell.id = `device-summary-cell-${d.device_id}`;
-                summaryCell.style.cssText = "background: #fafafa; padding: 12px;";
-                summaryRow.appendChild(summaryCell);
-
-                table.append(row, summaryRow);
+                html += `
+                    <tr id="device-row-${d.device_id}">
+                        <td class="col-name-model"><div class="col-name">${d.name}</div><div class="col-model" style="font-size: 0.8em; color: #666;">${d.product_code}</div></td>
+                        <td class="col-ip">${d.ip_address}</td>
+                        <td class="col-ids"><div class="col-deviceid">${d.device_id}</div><div class="col-accountid" style="font-size: 0.8em; color: #666;">${d.account_id || "default"}</div></td>
+                        <td class="col-fw-serial"><div class="col-firmware">${d.firmware_version || "0.0.0"}</div><div class="col-serial" style="font-size: 0.8em; color: #666;">${d.device_serial_number}</div></td>
+                        <td class="col-method">${methodLabel}</td>
+                        <td>
+                            <button onclick="toggleDeviceSummary('${d.device_id}')">Inspect</button>
+                            <button onclick="prepareSync('${d.device_id}')">Sync Data</button>
+                            <button onclick="prepareMigration('${d.device_id}')">Migrate</button>
+                            <button id="prime-spotify-${d.device_id}" class="btn-spotify" style="display: none;" onclick="primeSpotify('${d.device_id}')">Prime Spotify</button>
+                            <button class="btn-danger" onclick="removeDevice('${d.device_id}', '${d.name}')">Remove</button>
+                        </td>
+                    </tr>
+                    <tr id="device-summary-${d.device_id}" style="display: none;">
+                        <td colspan="6" id="device-summary-cell-${d.device_id}" style="background: #fafafa; padding: 12px;"></td>
+                    </tr>
+                `;

                const optSync = document.createElement("option");
                optSync.value = d.device_id;
@@ -719,7 +649,8 @@ async function fetchDevices() {
                    eventSelector.appendChild(optEvent);
                }
            });
-            container.replaceChildren(table);
+            html += "</table>";
+            container.innerHTML = html;

            if (currentSyncVal) syncSelector.value = currentSyncVal;
            if (currentMigrationVal) migrationSelector.value = currentMigrationVal;
@@ -993,14 +924,7 @@ async function fetchAccountList() {
        const data = await response.json();
        const selector = document.getElementById("account-selector");
        if (selector) {
-            // Account IDs can contain non-alphanumeric characters (e.g.
-            // "stick@local", #634) — built via DOM APIs, not innerHTML.
-            selector.replaceChildren(...data.accounts.map(acc => {
-                const opt = document.createElement("option");
-                opt.value = acc;
-                opt.textContent = acc;
-                return opt;
-            }));
+            selector.innerHTML = data.accounts.map(acc => `<option value="${acc}">${acc}</option>`).join("");
            if (data.accounts.length > 0) {
                fetchAccountDetails(selector.value);
            }
@@ -1025,7 +949,7 @@ async function fetchAccountDetails(accountId) {
    try {
        const response = await fetch(`/api/mgmt/accounts/${encodeURIComponent(accountId)}`);
        if (!response.ok) {
-            if (metadataEl) metadataEl.innerHTML = `<span style="color:red">Failed to load account details: ${escapeHtml(response.statusText)}</span>`;
+            if (metadataEl) metadataEl.innerHTML = `<span style="color:red">Failed to load account details: ${response.statusText}</span>`;
            return;
        }
        const data = await response.json();
@@ -1040,7 +964,7 @@ async function fetchAccountDetails(accountId) {
            metadataEl.innerHTML = `
                ${warningNotice}
                <table style="width: 100%; font-size: 0.9em;">
-                    <tr><td style="padding: 4px"><strong>Account ID:</strong></td><td style="padding: 4px">${escapeHtml(data.account.account_id)}</td></tr>
+                    <tr><td style="padding: 4px"><strong>Account ID:</strong></td><td style="padding: 4px">${data.account.account_id}</td></tr>
                    <tr><td style="padding: 4px"><strong>Language:</strong></td><td style="padding: 4px">
                        <select id="account-language-select" style="font-size: 0.9em; padding: 2px;">
                            <option value="en" ${data.account.preferred_language === "en" || !data.account.preferred_language ? "selected" : ""}>en</option>
@@ -1059,7 +983,7 @@ async function fetchAccountDetails(accountId) {
                                }, {});
                                return Object.entries(grouped).map(([pName, settings]) => `
                                    <div style="margin-bottom: 8px;">
-                                        <strong>${escapeHtml(pName)}</strong>
+                                        <strong>${pName}</strong>
                                        <ul style="margin: 2px 0 0 0; padding-left: 20px; list-style-type: disc;">
                                            ${settings.map(s => {
                                                if ((s.provider_name === "SPOTIFY" || s.provider_id === "15") && s.key_name === "STREAMING_QUALITY") {
@@ -1067,9 +991,9 @@ async function fetchAccountDetails(accountId) {
                                                        <li style="margin-bottom: 4px;">
                                                            Music Streaming Quality:
                                                            <select class="provider-setting-select"
-                                                                    data-account-id="${escapeHtml(data.account.account_id)}"
-                                                                    data-provider-id="${escapeHtml(s.provider_id)}"
-                                                                    data-key="${escapeHtml(s.key_name)}"
+                                                                    data-account-id="${data.account.account_id}"
+                                                                    data-provider-id="${s.provider_id}"
+                                                                    data-key="${s.key_name}"
                                                                    style="font-size: 0.9em; padding: 2px; margin-left: 4px;">
                                                                <option value="1" ${s.value === "1" ? "selected" : ""}>Fastest Streaming - up to 128 kbit/s</option>
                                                                <option value="2" ${s.value === "2" ? "selected" : ""}>Balanced Quality and Speed - up to 192 kbit/s</option>
@@ -1079,7 +1003,7 @@ async function fetchAccountDetails(accountId) {
                                                        </li>
                                                    `;
                                                }
-                                                return `<li>${escapeHtml(s.key_name)}: ${escapeHtml(s.value)}</li>`;
+                                                return `<li>${s.key_name}: ${s.value}</li>`;
                                            }).join("")}
                                        </ul>
                                    </div>
@@ -1100,7 +1024,7 @@ async function fetchAccountDetails(accountId) {
                        statusEl.style.color = "#666";
                    }
                    try {
-                        const response = await fetch(`/api/mgmt/accounts/${encodeURIComponent(data.account.account_id)}/language`, {
+                        const response = await fetch(`/api/mgmt/accounts/${data.account.account_id}/language`, {
                            method: "POST",
                            headers: {
                                "Content-Type": "application/json",
@@ -1144,7 +1068,7 @@ async function fetchAccountDetails(accountId) {
                    }

                    try {
-                        const response = await fetch(`/api/mgmt/accounts/${encodeURIComponent(accID)}/provider-settings`, {
+                        const response = await fetch(`/api/mgmt/accounts/${accID}/provider-settings`, {
                            method: "POST",
                            headers: {
                                "Content-Type": "application/json",
@@ -1186,27 +1110,27 @@ async function fetchAccountDetails(accountId) {

            devicesEl.innerHTML = data.devices.map(device => `
                <div class="summary-box" style="margin-bottom: 15px; border-left: 5px solid #007bff; padding: 15px;">
-                    <div class="device-summary-header" data-toggle-target="device-details-${escapeHtml(device.device_id)}" style="display: flex; justify-content: space-between; cursor: pointer; align-items: center;">
-                        <h4 style="margin: 0">${escapeHtml(device.name || "Unnamed Device")} (${escapeHtml(device.product_code)})</h4>
+                    <div style="display: flex; justify-content: space-between; cursor: pointer; align-items: center;" onclick="toggleInfo('device-details-${device.device_id}')">
+                        <h4 style="margin: 0">${device.name || "Unnamed Device"} (${device.product_code})</h4>
                        <div style="font-size: 0.8em; color: #666">
-                            ${escapeHtml(device.ip_address)} | ${escapeHtml(device.device_id)} <span style="font-size: 1.2em; vertical-align: middle;">&#9662;</span>
+                            ${device.ip_address} | ${device.device_id} <span style="font-size: 1.2em; vertical-align: middle;">&#9662;</span>
                        </div>
                    </div>

-                    <div id="device-details-${escapeHtml(device.device_id)}" style="display: none; margin-top: 15px; padding-top: 10px; border-top: 1px solid #eee">
+                    <div id="device-details-${device.device_id}" style="display: none; margin-top: 15px; padding-top: 10px; border-top: 1px solid #eee">
                        <div style="display: grid; grid-template-columns: 1fr 1fr; gap: 20px">
                            <div>
                                <h5 style="margin: 10px 0 5px 0">Device Metadata</h5>
                                <div style="font-size: 0.85em; background: #f8f9fa; padding: 8px; border-radius: 4px; border: 1px solid #e9ecef">
-                                    <strong>Serial:</strong> ${escapeHtml(device.device_serial_number || device.serial_number || "N/A")}<br>
-                                    <strong>MAC:</strong> ${escapeHtml(device.mac_address || "N/A")}<br>
-                                    <strong>Version:</strong> ${escapeHtml(device.firmware_version || "N/A")}<br>
-                                    <strong>Discovery:</strong> ${escapeHtml(device.discovery_method || "N/A")}
+                                    <strong>Serial:</strong> ${device.device_serial_number || device.serial_number || "N/A"}<br>
+                                    <strong>MAC:</strong> ${device.mac_address || "N/A"}<br>
+                                    <strong>Version:</strong> ${device.firmware_version || "N/A"}<br>
+                                    <strong>Discovery:</strong> ${device.discovery_method || "N/A"}
                                </div>

                                <h5 style="margin: 15px 0 5px 0">Hardware Components</h5>
                                <ul style="font-size: 0.8em; padding-left: 20px; margin: 0">
-                                    ${device.components ? device.components.map(c => `<li><strong>${escapeHtml(c.category || c.type || 'Component')}</strong>: ${escapeHtml(c.firmware_version || 'N/A')} <br><small style="color:#777">S/N: ${escapeHtml(c.serial_number || 'N/A')}</small></li>`).join("") : "<li>No components found</li>"}
+                                    ${device.components ? device.components.map(c => `<li><strong>${c.category || c.type || 'Component'}</strong>: ${c.firmware_version || 'N/A'} <br><small style="color:#777">S/N: ${c.serial_number || 'N/A'}</small></li>`).join("") : "<li>No components found</li>"}
                                </ul>
                            </div>

@@ -1226,14 +1150,14 @@ async function fetchAccountDetails(accountId) {
                                                const account = (s.account && s.account !== s.username && s.account !== name) ? ` [${s.account}]` : "";
                                                const finalName = name || s.type || "Unknown Source";
                                                if (finalName) {
-                                                    sourceLabel = `<br><small style="color: #666; font-size: 0.85em;">via ${escapeHtml(finalName)}${escapeHtml(account)}</small>`;
+                                                    sourceLabel = `<br><small style="color: #666; font-size: 0.85em;">via ${finalName}${account}</small>`;
                                                }
                                            }
                                        }

                                        return `
                                            <div style="border: 1px solid #ddd; padding: 5px; font-size: 0.8em; background: ${p ? "#e6ffed" : "#f8f9fa"}; border-radius: 3px;">
-                                                <strong>#${i + 1}</strong>: ${escapeHtml(itemName)}${sourceLabel}
+                                                <strong>#${i + 1}</strong>: ${itemName}${sourceLabel}
                                            </div>
                                        `;
                                    }).join("")}
@@ -1251,13 +1175,13 @@ async function fetchAccountDetails(accountId) {
                                                const account = (s.account && s.account !== s.username && s.account !== sName) ? ` [${s.account}]` : "";
                                                const finalSName = sName || s.type || "Unknown Source";
                                                if (finalSName) {
-                                                    sourceLabel = `<br><small style="color: #666; font-size: 0.9em;">via ${escapeHtml(finalSName)}${escapeHtml(account)}</small>`;
+                                                    sourceLabel = `<br><small style="color: #666; font-size: 0.9em;">via ${finalSName}${account}</small>`;
                                                }
                                            }
                                            const dateRaw = r.last_played_at || r.created_on;
                                            const dateObj = dateRaw ? (isNaN(Number(dateRaw)) ? new Date(dateRaw) : new Date(Number(dateRaw) * 1000)) : null;
                                            const dateStr = dateObj ? dateObj.toLocaleString('sv-SE') : 'N/A'; // sv-SE produces YYYY-MM-DD HH:MM:SS with 24h time
-                                            return `<li>${escapeHtml(name)}${sourceLabel} <br><small style="color:#888">${escapeHtml(dateStr)}</small></li>`;
+                                            return `<li>${name}${sourceLabel} <br><small style="color:#888">${dateStr}</small></li>`;
                                        }).join("") : "<li>No recents</li>"}
                                    </ul>
                                </div>
@@ -1272,8 +1196,8 @@ async function fetchAccountDetails(accountId) {
                                    const usernameSuffix = (s.username && s.username !== "Local") ? ` (${s.username})` : "";
                                    const accountSuffix = (s.account && s.account !== s.username && s.account !== sourceName) ? ` [${s.account}]` : "";
                                    return `
-                                        <span style="background: #eefbff; color: #0056b3; border: 1px solid #b8daff; padding: 2px 8px; border-radius: 12px; font-size: 0.75em" title="Source Type: ${escapeHtml(s.type)}">
-                                            ${escapeHtml(sourceName)}${escapeHtml(usernameSuffix)}${escapeHtml(accountSuffix)}
+                                        <span style="background: #eefbff; color: #0056b3; border: 1px solid #b8daff; padding: 2px 8px; border-radius: 12px; font-size: 0.75em" title="Source Type: ${s.type}">
+                                            ${sourceName}${usernameSuffix}${accountSuffix}
                                        </span>
                                    `;
                                }).join("") : "<small style='color:#999'>None</small>"}
@@ -1282,17 +1206,10 @@ async function fetchAccountDetails(accountId) {
                    </div>
                </div>
            `).join("");
-
-            // data-toggle-target (not an inline onclick) avoids re-embedding
-            // speaker-controlled device_id inside a JS-string-in-HTML-attribute
-            // context, which HTML-escaping alone cannot make safe.
-            devicesEl.querySelectorAll(".device-summary-header").forEach(el => {
-                el.addEventListener("click", () => toggleInfo(el.dataset.toggleTarget));
-            });
        }

    } catch (error) {
-        if (metadataEl) metadataEl.innerHTML = `<span style="color:red">Error: ${escapeHtml(error.message)}</span>`;
+        if (metadataEl) metadataEl.innerHTML = `<span style="color:red">Error: ${error.message}</span>`;
        console.error("Failed to fetch account details", error);
    }
 }
@@ -1850,7 +1767,7 @@ async function fetchDeviceEvents(deviceId) {
    list.innerHTML = '<tr><td colspan="3" style="padding: 20px; text-align: center; color: #666;">Loading events...</td></tr>';

    try {
-        const response = await fetch(`/api/setup/devices/${encodeURIComponent(deviceId)}/events`);
+        const response = await fetch(`/api/setup/devices/${deviceId}/events`);
        const data = await response.json();
        const events = data.events;

@@ -1990,7 +1907,7 @@ async function removeDevice(deviceId, name) {
    }

    try {
-        const response = await fetch(`/api/setup/devices/${encodeURIComponent(deviceId)}`, {
+        const response = await fetch(`/api/setup/devices/${deviceId}`, {
            method: "DELETE",
        });

@@ -4887,14 +4804,14 @@ async function toggleDeviceSummary(deviceId) {
        const resp = await fetch(`/api/setup/device-summary/${encodeURIComponent(deviceId)}`);
        if (!resp.ok) {
            const txt = await resp.text();
-            cell.innerHTML = `<span style="color:#c62828;">Summary failed: ${resp.status} ${escapeHtml(txt)}</span>`;
+            cell.innerHTML = `<span style="color:#c62828;">Summary failed: ${resp.status} ${escapeHTML(txt)}</span>`;
            return;
        }
        const data = await resp.json();
        cell.innerHTML = "";
        cell.appendChild(renderDeviceSummary(data));
    } catch (e) {
-        cell.innerHTML = `<span style="color:#c62828;">Summary failed: ${escapeHtml(e.message || String(e))}</span>`;
+        cell.innerHTML = `<span style="color:#c62828;">Summary failed: ${escapeHTML(e.message || String(e))}</span>`;
    }
 }

@@ -5099,3 +5016,12 @@ function unreachableBlock(probe) {

    return wrap;
 }
+
+function escapeHTML(s) {
+    return String(s)
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
@@ -215,7 +215,7 @@ func detectOrphanDefaultEntries(ds *datastore.DataStore, paired []models.Service

 			if speakerAccount != info.account {
 				log.Printf("[Health] consistency: speaker %s reports margeAccountUUID=%s but ListAllDevices picked %s — preferring the speaker's answer for orphan-deletion suggestions",
-					sanitizeLog(deviceID), sanitizeLog(speakerAccount), sanitizeLog(info.account))
+					deviceID, speakerAccount, info.account)
 			}
 		}

@@ -289,21 +289,21 @@ func deleteOrphanAccountEntry(ds *datastore.DataStore, target Target) (string, e
 		if speakerAccount := fetchSpeakerMargeAccount(ctx, speakerIP); speakerAccount != "" {
 			if speakerAccount == target.Account {
 				return "", fmt.Errorf("speaker %s reports margeAccountUUID=%s — refusing to delete <data-dir>/accounts/%s/devices/%s because it's the speaker's currently-active binding (re-paired since the consistency check ran?)",
-					sanitizeLog(target.Device), sanitizeLog(speakerAccount), sanitizeLog(target.Account), sanitizeLog(target.Device))
+					target.Device, speakerAccount, target.Account, target.Device)
 			}

 			log.Printf("[Health] deleteOrphanAccountEntry: speaker %s confirmed margeAccountUUID=%s; target account %s is stale, proceeding with delete",
-				sanitizeLog(target.Device), sanitizeLog(speakerAccount), sanitizeLog(target.Account))
+				target.Device, speakerAccount, target.Account)
 		} else {
 			log.Printf("[Health] deleteOrphanAccountEntry: speaker %s at %s not reachable for re-confirmation; relying on operator's Confirm click",
-				sanitizeLog(target.Device), sanitizeLog(speakerIP))
+				target.Device, speakerIP)
 		}
 	} else {
-		log.Printf("[Health] deleteOrphanAccountEntry: no IP recorded for device %s — skipping speaker re-probe", sanitizeLog(target.Device))
+		log.Printf("[Health] deleteOrphanAccountEntry: no IP recorded for device %s — skipping speaker re-probe", target.Device)
 	}

 	if target.Account == accountIDDefaultPlaceholder {
-		log.Printf("[Health] deleteOrphanAccountEntry: deleting the \"default\" placeholder entry for device %s; this is normal after pairing completed", sanitizeLog(target.Device))
+		log.Printf("[Health] deleteOrphanAccountEntry: deleting the \"default\" placeholder entry for device %s; this is normal after pairing completed", target.Device)
 	}

 	path := ds.AccountDeviceDir(target.Account, target.Device)
@@ -316,7 +316,7 @@ func deleteOrphanAccountEntry(ds *datastore.DataStore, target Target) (string, e
 	}

 	log.Printf("[Health] Removed orphan account entry %s (account=%s device=%s) at operator request",
-		path, sanitizeLog(target.Account), sanitizeLog(target.Device))
+		path, target.Account, target.Device)

 	return fmt.Sprintf("Removed stale account entry %s for device %s.", target.Account, target.Device), nil
 }
@@ -479,7 +479,7 @@ func reclassifyCanonicalSourceIDs(ds *datastore.DataStore, target Target) (strin
 	for i := range sources {
 		if newID, ok := rename[sources[i].ID]; ok {
 			log.Printf("[Health] Re-classify %s: id %s → %s (account=%s device=%s)",
-				sanitizeLog(sources[i].SourceKeyType), sanitizeLog(sources[i].ID), sanitizeLog(newID), sanitizeLog(target.Account), sanitizeLog(target.Device))
+				sources[i].SourceKeyType, sources[i].ID, newID, target.Account, target.Device)

 			sources[i].ID = newID

@@ -30,12 +30,9 @@ func suggestAccountForPairing(ds *datastore.DataStore, deviceID string) string {
 	return ""
 }

-// isSevenDigitAccountID is intentionally narrower than
-// datastore.IsSafeIdentifier: it filters suggestAccountForPairing's
-// candidates down to directories that look like a real Bose-issued
-// account, not merely safe-to-use ones (a device-reported value like
-// "stick@local", #634, is a safe identifier but not something to
-// suggest as a pre-existing "real" account to reuse).
+// isSevenDigitAccountID mirrors setup.IsValidAccountID without
+// importing the setup package (which would pull in SSH/telnet/certmgr
+// transitively — see the boundary comment near speakerInfoXML).
 func isSevenDigitAccountID(s string) bool {
 	if len(s) != 7 {
 		return false
@@ -1,13 +0,0 @@
-package health
-
-import "strings"
-
-// sanitizeLog strips newline characters from s to prevent log-injection
-// (CodeQL go/log-injection). Values from speakers (e.g. margeAccountUUID
-// read live via :8090/info) may contain attacker-controlled newlines.
-func sanitizeLog(s string) string {
-	s = strings.ReplaceAll(s, "\n", `\n`)
-	s = strings.ReplaceAll(s, "\r", `\r`)
-
-	return s
-}
@@ -752,13 +752,6 @@ func CreateAccountDevice(ds *datastore.DataStore, account, deviceID string) (mod
 	device.Presets = mapPresetsToFullResponse(presets, sources)
 	device.Recents = mapRecentsToFullResponse(recents, sources)

-	if len(device.Presets) != len(presets) {
-		log.Printf("[Marge] /full: device %s — read %d preset(s) from disk, embedding %d after source mapping",
-			sanitizeLog(deviceID), len(presets), len(device.Presets))
-	} else {
-		log.Printf("[Marge] /full: device %s — embedding %d preset(s)", sanitizeLog(deviceID), len(device.Presets))
-	}
-
 	return device, nil
 }

@@ -5,8 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"time"
-
-	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
 )

 // InitPlan describes everything required to take a factory-reset (or
@@ -252,8 +250,8 @@ func (m *Manager) runURLRewrite(plan InitPlan, emit func(StepKind, string, StepS
 // ID, or validating a user-supplied value.
 func (m *Manager) resolveAccountID(plan InitPlan, info *DeviceInfoXML, emit func(StepKind, string, StepStatus, error)) (InitPlan, error) {
 	if plan.AccountID != "" {
-		if !datastore.IsSafeIdentifier(plan.AccountID) {
-			invalidErr := fmt.Errorf("invalid AccountID %q: must be a non-empty, path-safe identifier", plan.AccountID)
+		if !IsValidAccountID(plan.AccountID) {
+			invalidErr := fmt.Errorf("invalid AccountID %q: must be exactly 7 digits", plan.AccountID)
 			emit(StepGenerateAccountID, "validate account ID", StatusFailed, invalidErr)

 			return plan, invalidErr
@@ -262,7 +260,7 @@ func (m *Manager) resolveAccountID(plan InitPlan, info *DeviceInfoXML, emit func
 		return plan, nil
 	}

-	if info.MargeAccountUUID != "" && datastore.IsSafeIdentifier(info.MargeAccountUUID) {
+	if info.MargeAccountUUID != "" && IsValidAccountID(info.MargeAccountUUID) {
 		plan.AccountID = info.MargeAccountUUID
 		emit(StepGenerateAccountID, "reuse existing margeAccountUUID="+plan.AccountID, StatusOK, nil)

@@ -9,8 +9,6 @@ import (
 	"strings"
 	"testing"
 	"time"
-
-	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
 )

 // fakeSession is a StateMachine that records the order of
@@ -197,13 +195,11 @@ func TestExecuteInitPlan_ReusesExistingAccountUUID(t *testing.T) {
 }

 func TestExecuteInitPlan_GeneratesAccountWhenDeviceUUIDInvalid(t *testing.T) {
-	// Devices that report an unsafe/malformed UUID (e.g. containing a path
-	// separator) must not be reused — we treat them as factory-reset for ID
-	// purposes. A merely non-numeric UUID (e.g. "stick@local", #634) IS
-	// reused now; see resolveAccountID/datastore.IsSafeIdentifier.
+	// Devices that report a non-7-digit UUID (e.g. a stale local value) must
+	// not be reused — we treat them as factory-reset for ID purposes.
 	info := &fakeInfoResponder{
 		deviceID:       "AABBCCDDEEFF",
-		paired:         "not/valid",
+		paired:         "not-7-digits",
 		postInitPaired: "", // we'll learn the generated ID from the result
 	}
 	sess := &fakeSession{}
@@ -224,11 +220,11 @@ func TestExecuteInitPlan_GeneratesAccountWhenDeviceUUIDInvalid(t *testing.T) {
 		t.Fatalf("ExecuteInitPlan: %v", err)
 	}

-	if !datastore.IsSafeIdentifier(got.AccountID) {
-		t.Errorf("got.AccountID = %q, want a valid generated ID", got.AccountID)
+	if !IsValidAccountID(got.AccountID) {
+		t.Errorf("got.AccountID = %q, want a valid 7-digit ID", got.AccountID)
 	}

-	if got.AccountID == "not/valid" {
+	if got.AccountID == "not-7-digits" {
 		t.Error("orchestrator should not reuse an invalid UUID")
 	}
 }
@@ -240,7 +236,7 @@ func TestExecuteInitPlan_RejectsInvalidSuppliedAccountID(t *testing.T) {

 	plan := InitPlan{
 		DeviceIP:       "192.0.2.10",
-		AccountID:      "abc/def",
+		AccountID:      "abc",
 		SkipURLRewrite: true,
 	}

@@ -1,7 +1,6 @@
 package setup

 import (
-	"bytes"
 	"crypto/rand"
 	"encoding/xml"
 	"errors"
@@ -12,8 +11,6 @@ import (
 	"net/http"
 	"strings"
 	"time"
-
-	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
 )

 // PairAccountTimeouts bounds every step of the pairing call so a wedged
@@ -47,8 +44,8 @@ func (m *Manager) PairAccount(deviceIP, accountID string, t TelnetClient) (PairA
 		logs   strings.Builder
 	)

-	if !datastore.IsSafeIdentifier(accountID) {
-		return result, "", fmt.Errorf("invalid account ID %q: must be a non-empty, path-safe identifier", accountID)
+	if !IsValidAccountID(accountID) {
+		return result, "", fmt.Errorf("invalid account ID %q: must be exactly 7 digits", accountID)
 	}

 	supported, supportedErr := m.probeSetMargeAccount(deviceIP)
@@ -87,9 +84,6 @@ func (m *Manager) PairAccount(deviceIP, accountID string, t TelnetClient) (PairA

 	result.TelnetAttempted = true

-	// Safe to concatenate: datastore.IsSafeIdentifier (checked above) rejects
-	// any whitespace or control characters, so accountID can't smuggle extra
-	// tokens into this single-line telnet command.
 	cmd := "envswitch accountid set " + accountID

 	resp, err := t.SendCommand(cmd)
@@ -141,8 +135,8 @@ func (m *Manager) EnsureMargeAccountPaired(deviceIP, wantAccountID string, t Tel
 		}

 		target = generated
-	} else if !datastore.IsSafeIdentifier(target) {
-		return "", false, "", fmt.Errorf("invalid account id %q: must be a non-empty, path-safe identifier", target)
+	} else if !IsValidAccountID(target) {
+		return "", false, "", fmt.Errorf("invalid account id %q: must be exactly 7 digits", target)
 	}

 	_, pairLogs, pairErr := m.PairAccount(deviceIP, target, t)
@@ -202,18 +196,9 @@ func (m *Manager) probeSetMargeAccount(deviceIP string) (bool, error) {
 func (m *Manager) postSetMargeAccount(deviceIP, accountID string) error {
 	url := buildDeviceURL(deviceIP, "/setMargeAccount")

-	// accountID is XML-escaped rather than interpolated raw:
-	// datastore.IsSafeIdentifier already excludes '<', '>', '&', '\'', '"'
-	// (see #634), but escaping here too means this stays well-formed even
-	// if that gate is ever bypassed.
-	var escapedAccountID bytes.Buffer
-	if err := xml.EscapeText(&escapedAccountID, []byte(accountID)); err != nil {
-		return fmt.Errorf("escape account ID: %w", err)
-	}
-
 	body := fmt.Sprintf(
 		`<PairDeviceWithAccount><accountId>%s</accountId><userAuthToken>aftertouch</userAuthToken></PairDeviceWithAccount>`,
-		escapedAccountID.String(),
+		accountID,
 	)

 	client := &http.Client{
@@ -327,6 +312,23 @@ func buildDeviceURL(deviceIP, path string) string {
 	return "http://" + deviceIP + ":8090" + path
 }

+// IsValidAccountID reports whether s is a syntactically valid SoundTouch
+// account ID — exactly 7 numeric digits, the format used by every
+// Bose-cloud-issued ID we have observed in captures.
+func IsValidAccountID(s string) bool {
+	if len(s) != 7 {
+		return false
+	}
+
+	for _, ch := range s {
+		if ch < '0' || ch > '9' {
+			return false
+		}
+	}
+
+	return true
+}
+
 // GenerateAccountID returns a fresh 7-digit account ID that does not collide
 // with any value in known. It uses crypto/rand and re-rolls on collision.
 func GenerateAccountID(known []string) (string, error) {
@@ -10,8 +10,6 @@ import (
 	"strings"
 	"testing"
 	"time"
-
-	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
 )

 // fakeDevice spins up an httptest.Server that pretends to be the SoundTouch
@@ -315,7 +313,7 @@ func TestEnsureMargeAccountPaired_UnpairedGeneratesAndPairs(t *testing.T) {
 		t.Error("alreadyPaired should be false for an unpaired device")
 	}

-	if !datastore.IsSafeIdentifier(accountID) {
+	if !IsValidAccountID(accountID) {
 		t.Errorf("accountID %q is not a valid generated ID", accountID)
 	}

@@ -354,7 +352,7 @@ func TestEnsureMargeAccountPaired_RejectsInvalidWantAccountID(t *testing.T) {

 	m := NewManager("", nil, nil)

-	_, _, _, err := m.EnsureMargeAccountPaired(d.addr, "not/valid", nil)
+	_, _, _, err := m.EnsureMargeAccountPaired(d.addr, "not-7-digits", nil)
 	if err == nil {
 		t.Fatal("expected an error for an invalid --account value")
 	}
@@ -477,9 +475,28 @@ func TestPreflightInitPlan_UnrecognisedStatusFailsClosed(t *testing.T) {
 	}
 }

-// Account-ID format validation is now solely datastore.IsSafeIdentifier's
-// responsibility (see datastore.TestIsSafeIdentifier); setup no longer has
-// its own account-ID validator to test.
+func TestIsValidAccountID(t *testing.T) {
+	cases := []struct {
+		in   string
+		want bool
+	}{
+		{"1234567", true},
+		{"0000000", true},
+		{"9999999", true},
+		{"", false},
+		{"123456", false},
+		{"12345678", false},
+		{"123456a", false},
+		{"-123456", false},
+		{" 123456", false},
+	}
+
+	for _, tc := range cases {
+		if got := IsValidAccountID(tc.in); got != tc.want {
+			t.Errorf("IsValidAccountID(%q) = %v, want %v", tc.in, got, tc.want)
+		}
+	}
+}

 func TestGenerateAccountID_AvoidsCollisions(t *testing.T) {
 	id, err := GenerateAccountID(nil)
@@ -487,7 +504,7 @@ func TestGenerateAccountID_AvoidsCollisions(t *testing.T) {
 		t.Fatalf("GenerateAccountID(nil): %v", err)
 	}

-	if !datastore.IsSafeIdentifier(id) {
+	if !IsValidAccountID(id) {
 		t.Errorf("generated ID %q is not valid", id)
 	}

@@ -0,0 +1,98 @@
+package soundtouchweb
+
+import (
+	"log"
+	"time"
+
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+	"github.com/gesellix/bose-soundtouch/pkg/service/soundtouchweb/webtypes"
+)
+
+// autoResumeBackoff is the delay before re-issuing a dropped content item,
+// giving a transient upstream hiccup a moment to clear before retrying.
+const autoResumeBackoff = 2 * time.Second
+
+// autoResumeState tracks what ConnectDeviceWebSocket needs to decide whether
+// a now_playing transition should trigger an auto-resume. Split out from the
+// WebSocket goroutine so the decision can be unit tested without a live
+// connection.
+//
+// resumeAttempts only labels log lines — it is never used to cap retries.
+// A resume is gated on wasError being false (see observe), which already
+// means at most one attempt ever fires per drop: if the attempt fails and
+// the source stays in error, every following event has wasError=true and
+// nothing fires again until a genuine recovery is observed. A station that
+// keeps recovering and re-dropping (the reported #622 pattern — a TuneIn
+// stream disconnecting the speaker on a fixed cycle, indefinitely, while
+// otherwise healthy) is exactly the case this should keep resuming forever.
+type autoResumeState struct {
+	lastGoodContentItem *models.ContentItem
+	resumeAttempts      int
+}
+
+// observe updates the state for a new now_playing event and reports whether
+// the caller should fire an auto-resume for item, plus a label for the log
+// line. prevSource is the source seen on the previous event.
+//
+// #622: some TuneIn stations disconnect the speaker's audio pipeline on
+// their own (errorUpdate 1041 SOURCE_DISCONNECTED, observed ~5m35s into
+// playback on one reporter's setup) even though the SoundTouch WebSocket
+// control channel stays healthy throughout. The firmware does not recover
+// on its own, so a fresh transition into an error source right after a
+// healthy one — the speaker dropping a source it didn't choose to leave, as
+// opposed to the user picking a new one — re-issues the last content item,
+// exactly what pressing the physical preset button again does.
+func (s *autoResumeState) observe(prevSource string, np *models.NowPlaying) (item *models.ContentItem, attempt int, shouldResume bool) {
+	wasError := isErrorSource(prevSource)
+	nowError := isErrorSource(np.Source)
+
+	if !nowError {
+		if np.ContentItem != nil {
+			s.lastGoodContentItem = np.ContentItem
+		}
+
+		return nil, 0, false
+	}
+
+	if wasError || s.lastGoodContentItem == nil {
+		return nil, 0, false
+	}
+
+	s.resumeAttempts++
+
+	return s.lastGoodContentItem, s.resumeAttempts, true
+}
+
+// autoResumePlayback re-selects item on conn's device after autoResumeBackoff.
+// It runs in its own goroutine (never on the WebSocket read loop) so a slow
+// or hanging /select call can't stall processing of further device events.
+func autoResumePlayback(conn *webtypes.DeviceConnection, deviceID string, item *models.ContentItem, attempt int) {
+	autoResumePlaybackAfter(conn, deviceID, item, attempt, autoResumeBackoff)
+}
+
+// autoResumePlaybackAfter is autoResumePlayback with an injectable delay so
+// tests don't have to wait out the real backoff.
+func autoResumePlaybackAfter(conn *webtypes.DeviceConnection, deviceID string, item *models.ContentItem, attempt int, delay time.Duration) {
+	timer := time.NewTimer(delay)
+	defer timer.Stop()
+
+	select {
+	case <-timer.C:
+	case <-conn.Done():
+		return
+	}
+
+	if conn.Client == nil {
+		return
+	}
+
+	if err := conn.Client.SelectContentItem(item); err != nil {
+		log.Printf("[play] device=%q auto-resume attempt %d failed: %v",
+			sanitizeLog(deviceID), attempt, err)
+
+		return
+	}
+
+	log.Printf("[play] device=%q auto-resume attempt %d re-selected source=%q location=%q",
+		sanitizeLog(deviceID), attempt, sanitizeLog(item.Source), sanitizeLog(item.Location))
+}
@@ -0,0 +1,190 @@
+package soundtouchweb
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gesellix/bose-soundtouch/pkg/client"
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+	"github.com/gesellix/bose-soundtouch/pkg/service/soundtouchweb/webtypes"
+)
+
+func tuneInNowPlaying(source string) *models.NowPlaying {
+	return &models.NowPlaying{
+		Source: source,
+		ContentItem: &models.ContentItem{
+			Source:   "TUNEIN",
+			Type:     "stationurl",
+			Location: "/v1/playback/station/s119025",
+			ItemName: "Arabella Lovesongs",
+		},
+	}
+}
+
+func TestAutoResumeState_HealthyRemembersContentItemAndDoesNotResume(t *testing.T) {
+	s := &autoResumeState{}
+
+	item, attempt, shouldResume := s.observe("", tuneInNowPlaying("TUNEIN"))
+	if shouldResume {
+		t.Fatalf("shouldResume = true on a healthy source, want false")
+	}
+
+	if item != nil || attempt != 0 {
+		t.Errorf("item/attempt = %v/%d, want nil/0", item, attempt)
+	}
+
+	if s.lastGoodContentItem == nil {
+		t.Fatal("lastGoodContentItem was not recorded from a healthy now_playing")
+	}
+}
+
+func TestAutoResumeState_FreshErrorAfterHealthyTriggersResume(t *testing.T) {
+	s := &autoResumeState{}
+
+	// Prime with a healthy TUNEIN event, matching the WS handler calling
+	// observe once per event with the source seen on the previous call.
+	s.observe("", tuneInNowPlaying("TUNEIN"))
+
+	item, attempt, shouldResume := s.observe("TUNEIN", tuneInNowPlaying("INVALID_SOURCE"))
+	if !shouldResume {
+		t.Fatal("shouldResume = false on a fresh error transition, want true")
+	}
+
+	if attempt != 1 {
+		t.Errorf("attempt = %d, want 1", attempt)
+	}
+
+	if item == nil || item.Location != "/v1/playback/station/s119025" {
+		t.Errorf("item = %+v, want the last healthy ContentItem", item)
+	}
+}
+
+func TestAutoResumeState_DoesNotResumeWithoutAPriorGoodContentItem(t *testing.T) {
+	s := &autoResumeState{}
+
+	// No healthy event was ever observed, so there's nothing to restore.
+	_, _, shouldResume := s.observe("", tuneInNowPlaying("INVALID_SOURCE"))
+	if shouldResume {
+		t.Fatal("shouldResume = true with no prior good ContentItem, want false")
+	}
+}
+
+func TestAutoResumeState_DoesNotResumeOnRepeatedErrorEvents(t *testing.T) {
+	s := &autoResumeState{}
+
+	s.observe("", tuneInNowPlaying("TUNEIN"))
+	s.observe("TUNEIN", tuneInNowPlaying("INVALID_SOURCE")) // first resume, attempt 1
+
+	// A second consecutive error event (wasError=true this time) must not
+	// fire another resume — one attempt per drop, not per event.
+	_, _, shouldResume := s.observe("INVALID_SOURCE", tuneInNowPlaying("INVALID_SOURCE"))
+	if shouldResume {
+		t.Fatal("shouldResume = true on a repeated error event, want false")
+	}
+}
+
+func TestAutoResumeState_KeepsResumingIndefinitelyAcrossRepeatedDrops(t *testing.T) {
+	s := &autoResumeState{}
+
+	s.observe("", tuneInNowPlaying("TUNEIN"))
+
+	// The reported #622 pattern: the same station drops and (once resumed)
+	// recovers repeatedly, indefinitely, on a fixed cycle. Each fresh drop
+	// after a genuine recovery must keep resuming — there is no cap.
+	const cycles = 20
+
+	for i := 1; i <= cycles; i++ {
+		_, attempt, shouldResume := s.observe("TUNEIN", tuneInNowPlaying("INVALID_SOURCE"))
+		if !shouldResume {
+			t.Fatalf("cycle %d: shouldResume = false, want true", i)
+		}
+
+		if attempt != i {
+			t.Errorf("cycle %d: attempt label = %d, want %d", i, attempt, i)
+		}
+
+		s.observe("INVALID_SOURCE", tuneInNowPlaying("TUNEIN")) // the resume worked
+	}
+}
+
+func TestAutoResumeState_StopsRetryingAfterAFailedResume(t *testing.T) {
+	s := &autoResumeState{}
+
+	s.observe("", tuneInNowPlaying("TUNEIN"))
+
+	_, _, shouldResume := s.observe("TUNEIN", tuneInNowPlaying("INVALID_SOURCE"))
+	if !shouldResume {
+		t.Fatal("shouldResume = false on the first drop, want true")
+	}
+
+	// The resume attempt itself failed (or the station is genuinely gone):
+	// the speaker keeps reporting the same error source on further events.
+	// wasError is now true, so nothing should fire again without a genuine
+	// recovery in between — this is what keeps a truly dead station from
+	// being retried forever.
+	for i := 0; i < 5; i++ {
+		_, _, shouldResume := s.observe("INVALID_SOURCE", tuneInNowPlaying("INVALID_SOURCE"))
+		if shouldResume {
+			t.Fatalf("iteration %d: shouldResume = true on a persisting error, want false", i)
+		}
+	}
+}
+
+func TestAutoResumePlaybackAfter_ReselectsContentItem(t *testing.T) {
+	speaker, captured := setupSpeakerMock(t, nil)
+	defer speaker.Close()
+
+	c := client.NewClient(&client.Config{Host: speaker.URL})
+	conn := webtypes.NewDeviceConnection(c, &models.DeviceInfo{DeviceID: "DEVICEID01"})
+
+	item := &models.ContentItem{Source: "TUNEIN", Type: "stationurl", Location: "/v1/playback/station/s119025", ItemName: "Arabella Lovesongs"}
+
+	done := make(chan struct{})
+	go func() {
+		autoResumePlaybackAfter(conn, "DEVICEID01", item, 1, 0)
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("autoResumePlaybackAfter did not return in time")
+	}
+
+	body, ok := captured["/select"]
+	if !ok {
+		t.Fatalf("no /select request captured; requests: %v", captured)
+	}
+
+	if !strings.Contains(body, `source="TUNEIN"`) || !strings.Contains(body, "/v1/playback/station/s119025") {
+		t.Errorf("/select body = %q, want it to carry the TUNEIN content item", body)
+	}
+}
+
+func TestAutoResumePlaybackAfter_StopsWhenConnectionClosed(t *testing.T) {
+	speaker, captured := setupSpeakerMock(t, nil)
+	defer speaker.Close()
+
+	c := client.NewClient(&client.Config{Host: speaker.URL})
+	conn := webtypes.NewDeviceConnection(c, &models.DeviceInfo{DeviceID: "DEVICEID01"})
+	conn.Close()
+
+	item := &models.ContentItem{Source: "TUNEIN", Type: "stationurl", Location: "/v1/playback/station/s119025"}
+
+	done := make(chan struct{})
+	go func() {
+		autoResumePlaybackAfter(conn, "DEVICEID01", item, 1, time.Hour)
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("autoResumePlaybackAfter did not return promptly after conn.Close()")
+	}
+
+	if _, ok := captured["/select"]; ok {
+		t.Error("/select was called after the connection was closed, want no request")
+	}
+}
@@ -78,6 +78,15 @@ type WebApp struct {
 	// removal only prunes the in-memory registry).
 	RemoveDeviceHook func(deviceID string) error

+	// AutoResumeOnSourceDisconnect, when set and returning true, makes
+	// ConnectDeviceWebSocket re-issue a device's last playing content item
+	// after an unsolicited drop into an error source (#622). Opt-in: the
+	// embedded build wires it to Settings.AutoResumeOnSourceDisconnect
+	// (settings.json, default false); standalone soundtouch-player leaves it
+	// nil, which disables the behaviour. Read once per drop rather than
+	// cached, so toggling the setting takes effect without a restart.
+	AutoResumeOnSourceDisconnect func() bool
+
 	discoveryStatus atomic.Value // stores *webtypes.DiscoveryStatus
 }

@@ -166,6 +166,12 @@ func (app *WebApp) ConnectDeviceWebSocket(deviceID string, conn *webtypes.Device
 	// error source is logged once per transition into it, not on every event.
 	var prevSource string

+	// resumeState survives both the speaker's own WebSocket reconnects and
+	// this loop's outer reconnects (declared once, outside the loop) so an
+	// auto-resume can fire regardless of which layer last re-established
+	// the connection.
+	resumeState := &autoResumeState{}
+
 	for {
 		// Stop if the device was removed from the registry (conn.Close()).
 		select {
@@ -189,6 +195,11 @@ func (app *WebApp) ConnectDeviceWebSocket(deviceID string, conn *webtypes.Device
 				logNowPlayingError(deviceID, np.Source, np.SourceAccount)
 			}

+			if item, attempt, shouldResume := resumeState.observe(prevSource, np); shouldResume &&
+				app.AutoResumeOnSourceDisconnect != nil && app.AutoResumeOnSourceDisconnect() {
+				go autoResumePlayback(conn, deviceID, item, attempt)
+			}
+
 			prevSource = np.Source

 			conn.UpdateStatus(func(s *webtypes.DeviceStatus) {
@@ -1,59 +0,0 @@
-#!/usr/bin/env bash
-# Emits a "Quick downloads" markdown section with real, direct download
-# links for soundtouch-service and soundtouch-cli, one row per platform.
-# Asset URLs are deterministic (<binary>-<tag>-<os>-<arch>[.exe]), so this
-# needs no GitHub API call to build them.
-#
-# Usage: quick-downloads.sh <tag-name> <owner/repo>
-# Output goes to stdout, wrapped in <!-- quick-downloads:start/end -->
-# markers so callers can find-and-replace a previously inserted block.
-
-set -euo pipefail
-
-TAG_NAME="$1"
-REPOSITORY="$2"
-BASE_URL="https://github.com/${REPOSITORY}/releases/download/${TAG_NAME}"
-
-# suffix|human label, same order as docs/content/docs/downloads/_index.md
-PLATFORMS=(
-  "linux-arm64|Raspberry Pi (64-bit) / ARM64 Linux"
-  "linux-armv7|Raspberry Pi (32-bit) / ARMv7"
-  "linux-amd64|Linux (64-bit PC)"
-  "darwin-arm64|macOS (Apple Silicon)"
-  "darwin-amd64|macOS (Intel)"
-  "windows-amd64.exe|Windows (64-bit)"
-  "freebsd-amd64|FreeBSD (64-bit)"
-)
-
-build_table() {
-  local BINARY_NAME=$1
-  echo "| Platform | Download | Checksum |"
-  echo "|---|---|---|"
-  for ENTRY in "${PLATFORMS[@]}"; do
-    local SUFFIX="${ENTRY%%|*}"
-    local LABEL="${ENTRY##*|}"
-    local FILENAME="${BINARY_NAME}-${TAG_NAME}-${SUFFIX}"
-    echo "| ${LABEL} | [${FILENAME}](${BASE_URL}/${FILENAME}) | [sha256](${BASE_URL}/${FILENAME}.sha256) |"
-  done
-}
-
-SERVICE_TABLE="$(build_table soundtouch-service)"
-CLI_TABLE="$(build_table soundtouch-cli)"
-
-cat << EOF
-<!-- quick-downloads:start -->
-## Quick downloads
-
-Most people only need one of these two:
-
-**soundtouch-service** — the local server that replaces the Bose cloud. Point your speaker at it and you keep full control; the built-in web UI on port 8000 handles setup.
-
-$SERVICE_TABLE
-
-**soundtouch-cli** — command-line control of any device: playback, presets, sources, multiroom zones, discovery, and migration. Good for scripting and home automation.
-
-$CLI_TABLE
-
-Everything else (soundtouch-player, soundtouch-backup, other platforms, Docker, install scripts): [Downloads page](https://gesellix.github.io/Bose-SoundTouch/docs/downloads/).
-<!-- quick-downloads:end -->
-EOF