fix(media): reconcile Gallery total and sanitize transcripts (#108)

[jerome-queck]

Closes #108

Summary

• Treat an initial cumulative Kaltura Gallery page as exhausted only when explicit cumulative metadata confirms that its entries meet the displayed total, even if Kaltura leaves an enabled no-op Load More control.
• Add the regression test that reproduces MH2500's live 2/2 catalogue with the stale control.
• Keep page-sized Gallery pages open until cumulative pagination is confirmed, avoiding premature truncation.
• Preserve fail-closed count reconciliation for incomplete and replacing-page catalogues.
• Remove llama.cpp startup/prompt echoes from local formatter output before it becomes a visible transcript, while preserving legitimate fenced Markdown.
• Reject formatter prompt leakage while allowing legitimate spoken text that happens to begin with the prompt opening.

Production evidence

• Fresh authenticated discovery completed for all eight active courses.
• MH2500 reconciled 2/2 Gallery entries; both recordings completed serially with source media and complete transcripts.
• Active digest: 374 appearances; 50 supported recordings complete; 324 intentionally unsupported/non-media shapes failed/retryable; zero queued/active.
• All 300 checked complete-job artifact paths exist on the intended Drive/RAID0 surfaces; RAID0 has 3.0 TiB available against the 100 GiB reserve.
• Additive current-semester sync downloaded 9 attachments and wrote 2 documents for CC0006-TUT, plus the newly visible ML0004 announcement.
• npm run verify -- all: 830/830 present.
• Repaired all 131 previously prompt-contaminated transcript derivatives: 70 formatter regenerations and 61 deterministic cleanups. Raw source transcripts and source digests were preserved.
• All 160 complete transcript artifacts validate against their raw segments; zero visible formatter prompts remain.
• Repaired and reloaded the media LaunchAgent on 2026-08-18 by moving launchd logs to local ~/Library/Logs; an explicit manual production run across all eight active courses and four provider lanes exited 0. The resulting active digest remains 374 total, 50 complete, 324 explicit red/unsupported, and zero queued or active.
• A one-time 09:30 LaunchAgent firing with --manual started from launchd, processed all eight active courses and four provider lanes, and exited 0; the normal daily 00:05 schedule was restored afterward.
• The normal 00:05 LaunchAgent has fired successfully on four scheduled nights, each with exit 0; the latest run completed around 00:10 with a green latest state and no queue lock. Production finishes before 04:00, so the deterministic worker test supplies the checkpoint/resume boundary evidence.

Validation

• node --test test/media-gallery-browser.test.mjs test/media-formatter.test.mjs test/media-transcript.test.mjs: 28/28 pass.
• npm run lint: pass.
• npm run format:check: pass.
• node --test test/media-worker.test.mjs: 17/17 pass, including the 04:00 checkpoint/resume case.
• git diff --check: pass.
• Owner runtime syntax check: pass.
• npm test: 365/366 pass. The existing environment-sensitive media-setup CLI test invokes the real ignored configuration and receives sandbox EPERM writing /Volumes/RAID0/Media/.runtime; unrelated to this diff.

Review

Standards

No findings.

Spec

No findings. Gallery pagination now requires explicit cumulative metadata before early exhaustion; formatter cleanup is anchored to a complete wrapper; prompt validation compares output occurrences against source speech.

Drift

#108 — Activate current-semester recording coverage: 10 of 10 criteria delivered, nothing beyond the brief.

Assisted-by: GPT-5
Co-authored-by: Codex noreply@openai.com