[Serph91P]

Summary

Closes #946.

Preserve the authoritative legacy max_streams_per_streamer value when the existing recording codec control saves. The panel carries the loaded value into its update event and the recording service includes it in its explicit POST allowlist. Zero remains zero. Legacy callers without this field first recover it through GET; if that read cannot provide a value, saving fails rather than silently resetting retention.

No backend/model/schema, UI option, styling, dependencies, build configuration, budget or workflow changes. Existing codec behavior is retained.

Verification

• Eight new panel → Pinia store → service regressions observed RED before the fix; GREEN afterward. Initial and delayed hydration cover limits 7 and 0; legacy missing-field recovery and unknown authoritative values are covered.
• Entire frontend unit suite: 645 passed, 4 existing skipped. Type checks, lint, tokens, generated foundation and foundation negative gates passed.
• Original unchanged Python codec module: 27 passed.
• Actual REAL production SPA → native FastAPI factory/router → isolated file-backed SQLite: H.264, H.265, H.264, combined h264,h265 saved through the visible control. Each survived navigation away/back and document reload. HTTP GET and 15 independent ORM session readbacks preserved all unrelated recording columns semantically, limit 7, and global prefer_higher_quality=false. No fulfilled API responses, failed HTTP responses or page errors. Existing cleanup JSON normalization adds a null timeframe; policy values remain unchanged.
• Native synthetic local setup/login only; lifecycle disabled to prevent background/provider work. Only Twitch token lookup is stubbed to None; codec router, persistence and Streamlink configuration generation are real. No capture, operator credentials, production DB or provider acceptance claimed.
• REAL and MOCK builds plus explicit source/artifact provenance verification passed. Build-output, precache, UX06 and unchanged output budgets passed. Application JS: REAL 1,191,926 raw / 380,003 gzip; MOCK 1,195,720 raw / 380,962 gzip under the unchanged 1,196,533 / 381,000 limits. The actual HLS worker allowance remains unchanged; the MOCK gzip budget has only 38 bytes left.
• Full Settings Loader regressions: REAL 34 passed and MOCK 34 passed across desktop/mobile. Its synthetic recording GET now includes the real schema's retention field, and its exact transport assertion requires 7; no guard/assertion/timeout/skip was relaxed.
• Final head 45ae3c056e0ef3f7c8996b7956202d86668f3811, tree 3ac4ee83b1bb8ce8d97923f80dd3ccb85b621107: all 23 remote checks succeeded, including all seven repository-required checks from GitHub Actions App 15368. Tests run 41603427065: backend 1,092 passed / 20 skipped plus 12 migration tests; frontend 645 passed / 4 skipped, 45 foundation gates; browser suite 244 passed / 46 existing skips plus foundation 5+1+5. Integration job 125811896458 verified concurrent fresh PostgreSQL first boot, 48/48 distinct successful migrations, restart-stable key and the real HTTP surface.
• Original security reports at this head (run 41603426991): npm 27 findings (25 moderate, 2 low; zero high/critical), pip-audit 75 dependencies / zero vulnerabilities, Bandit high/high zero findings, Trivy image zero high/critical with libpng 1.6.59-r0. Hadolint still reports six entries (four warnings, two notes). Existing repository/ref alerts were not dismissed. This is not an all-clean claim.
• Four owned --rm test containers, source/dependency/build copies and the owned Graphify cache were cleaned up after preserving evidence. The clean candidate worktree is retained for independent review and owner integration.

Review boundary

Same-card independent review covers this retention/codec contract, not the unrelated #842 backend work or #950 player correction. No merge, release or deployment authorization is implied. Existing security alerts are not described as all-clean.

Owner integration acceptance

• Integration base: develop at 1a364a25433623ebad481deeeb769197c72e3e0d; candidate 45ae3c056e0ef3f7c8996b7956202d86668f3811, tree 3ac4ee83b1bb8ce8d97923f80dd3ccb85b621107. The CI merge ref f010380369c09459424033d12b7ecc6002232a86 has those two parents and the identical tested tree.
• Same-card independent review approved this exact head, without blockers, should-fix findings or gate relaxation.
• Owner independently repeated the full 645-unit / 45-foundation suite, types, lint (0 errors / 135 warnings), tokens, generated foundation, REAL 34 + MOCK 34 normal Settings Loader cases, parity 1440/light, foundation capture → E2E → package (5+1+5), determinism and genuinely mode-bound REAL/MOCK provenance, precache, UX06 and unchanged budgets. Original 27 codec API tests passed in a network-isolated disposable container.
• Fresh REAL production SPA → native FastAPI/router → two owned SQLite fixtures (limits 7 and 0), each starting authoritatively at H.265: 8 visible UI saves total, POST + GET + 28 fresh ORM sessions plus two process-external read-only SQLite queries. H.264, H.265 and combined choices survive navigation and full reload. All unrelated recording columns remain semantically equal, including limit 7/0, disabled recording, quality, filename/preset, chapters, cleanup and global prefer_higher_quality=false. Zero API fulfills/page errors/failed HTTP responses. Only provider-token lookup returns None; lifespan disabled, network isolated, no capture/production-auth/provider/device acceptance claimed.
• Current head still has 23/23 successful checks and all seven required checks from App 15368. Owner read original test/security/integration logs and npm/pip/Bandit artifacts against the exact base: unchanged npm 25 moderate + 2 low (only suggested glob.fixAvailable differs), identical pip report (75 dependencies, no findings), identical Bandit content except scan timestamp. Existing Dockerfile/ref alerts are not dismissed; no all-clean claim. MOCK retains only 38 gzip bytes of headroom.
• Delivered by normal authorized merge 04f753760e9ffe3cd216cf001933668801f9c3af to develop. Actual merge tree/parents match the tested candidate. All three postmerge workflows completed/success: Tests 41610250599, Security 41610250455, existing develop automation 41610250552. Original Global recording codec selector does not read or persist the actual codec setting #946 is CLOSED/COMPLETED with all three criteria checked; exact completion evidence. Only Global recording codec selector does not read or persist the actual codec setting #946 delivery, not overall product acceptance; no manual release or deployment. Owned test containers/temp/worktree/verification branch cleaned; foreign resources preserved.