Session pins, presentable Media, Schedule sessions + runner, .tpschedule

Songs — session-only pins („Fixează sus"):
- App-global PinStore (@observable, in-memory → clears on quit); pinned
  songs float into a "Fixate" group on top of BOTH list and grid, pin
  toggle in the context menu + hover toggle on grid cards, clear-all in
  the group header. No SwiftData field — deliberately ephemeral.

Media — rebuilt as a presentable module (not a storage browser):
- Type tabs (Toate|Foto|Video|Audio) + rich grid: video thumbnails with
  duration badges, audio artwork, search on LibraryManager.mediaLibraryQuery;
  double-click/Enter presents. Old toolbar filter + MediaDetailPanel removed;
  selection flows through LibraryManager.selectedMediaItem (no notifications).
- MediaPresenter = THE one present path (grid, panel, session runner);
  fullscreen IMAGES now project (decoded inside the security scope into
  LiveContent.mediaImage, fit/fill honored); video fixed to use the shared
  VideoPlayerService (the old local instance never reached the output).
- Panel now mirrors Bible/Songs anatomy: PresentationPreviewCard with
  pendingMedia, prev/next stepping over the grid's exact ordering,
  StyleQuickSettings .media section (loop + fit/fill), PanelFooter format.
- MediaItem.durationSeconds (additive) probed async at import + backfilled.

Schedule — full sessions referencing real library content:
- ScheduleItem.payloadJSON stores stable refs (song = HistoryStore.songKey
  + optional arrangement, bible = translation + book/chapter/verse numbers,
  media = id + name fallback); title/content stay display snapshots.
- SessionService: per-itemType resolver registry (extensible), append/create;
  missing content resolves to a greyed ⚠ row that navigation skips.
- SessionRunner (app-global) is the ONLY presenter for schedule items:
  slide-by-slide next/prev (songs expand at present time with current song
  options), click-to-jump, one-shot Show; ScheduleView + SchedulePreviewPanel
  rewritten around it (duplicated show logic deleted).
- „Adaugă la sesiune" right-click menu shared by Bible verses, songs and
  media („Sesiune nouă…" creates a dated session instantly).
- Add-item sheet gains a real media picker; move up/down; start/stop.

Sessions import/export (.tpschedule):
- Flat versioned JSON (SessionArchive, format marker REQUIRED on import)
  with a requiredMedia manifest; media re-links by id then name on import,
  unresolved files listed to the operator. UTI com.robyrew.toppresenter.schedule.

Tabs: manual rename removed everywhere — auto-naming only, Schedule tab
titles itself from the selected session (name + date, unit-tested).

Tests: 142 pass (pins, media filter/stepping, session payload/resolution/
runner navigation, archive round-trip, tab naming). AGENTS.md updated.

Author: RobyRew

AGENTS.md

@@ -30,7 +30,10 @@ TopPresenter/
 │   ├── Constants.swift         WindowIdentifiers, SupportedBibleFormat, SupportedExportFormat,
 │   │                           USFMBookIDs, BibleBookCategory, PresentationDefaults
 │   ├── DataMigration.swift     SchemaV1 + TopPresenterMigrationPlan (SchemaMigrationPlan)
-│   ├── LibraryManager.swift    @Observable — Bible & Song navigation, search, verse caching
+│   ├── LibraryManager.swift    @Observable — Bible & Song navigation, search, verse caching,
+│   │                           selectedMediaItem/selectedSchedule mirrors (drive tab title + panels)
+│   ├── PinStore.swift          @Observable — session-only song pins („Fixează sus"); APP-GLOBAL
+│   │                           (one per app, injected beside historyStore), in-memory only
 │   └── PresentationManager.swift @Observable — live output state, screen management,
 │                               freeze/black/clear, all display settings (UserDefaults)
 │
@@ -57,6 +60,15 @@ TopPresenter/
 │   │   └── PowerPointSongImporter.swift (native Swift ZIP/XML parser)
 │   ├── Export/
 │   │   └── ExportService.swift         Bible (JSON/TXT/CSV) + Song (JSON/XML/TXT)
+│   ├── Media/
+│   │   └── MediaPresenter.swift        THE one way a MediaItem goes live (grid, panel, runner)
+│   ├── Sessions/
+│   │   ├── SessionModels.swift         SessionItemPayload (stable refs) + Draft + Resolution
+│   │   ├── SessionService.swift        resolver REGISTRY (SessionItemResolving per itemType),
+│   │   │                               append/create; new item kinds plug in here
+│   │   ├── SessionRunner.swift         @Observable APP-GLOBAL runner — THE one presenter for
+│   │   │                               schedule items (ScheduleView + panel never call pm.show*)
+│   │   └── SessionArchive.swift        .tpschedule flat-JSON import/export + requiredMedia manifest
 │   ├── Audio/
 │   │   └── AudioPlayerManager.swift    @Observable — AVAudioPlayer wrapper
 │   └── Video/
@@ -77,8 +89,8 @@ TopPresenter/
 │   │       └── CustomSlidesPreviewPanel.swift
 │   ├── Bible/         BibleView.swift, BibleExportSheet.swift
 │   ├── Songs/         SongsView.swift
-│   ├── Media/         MediaView.swift
-│   ├── Schedule/      ScheduleView.swift
+│   ├── Media/         MediaView.swift (presentable grid), MediaLibrary.swift (MediaKind + filter)
+│   ├── Schedule/      ScheduleView.swift, AddToSessionMenu.swift (shared right-click fragment)
 │   ├── CustomSlides/  CustomSlidesView.swift
 │   ├── Presentation/  PresentationOutputView.swift, TextBoxLayout.swift
 │   ├── Import/        BatchImportSheet.swift, BatchExportSheet.swift
@@ -181,8 +193,11 @@ TopPresenter/
 - The editor is called **"Editor de Teme"** everywhere (sheet title, toolbar, menu, footer button)
 - Editor tabs: Layout / Text / Fundal / **Tranziții** — NO output/hardware settings in the editor; screen/window-level/transition/disconnect live in Settings (⌘,) ▸ Proiecție (`ProjectionSettingsTab`) AND compactly in the right bar's **Ieșire** disclosure (StyleQuickSettings `.output`, beneath General). Themes describe the LOOK, Settings describe the DEVICE
 - **Per-presenter options** (`ContentOptions` keyed "bible"/"song"/"text", theme-persisted, resilient decoding): text transform (none/upper/lower), uppercase reference/title. Applied at RENDER time via `pm.displayFields(main:reference:translation:subtitle:contentKey:)` — output uses the live content key, the preview card uses its panel's `formatHint`. Extend ContentOptions (with decodeIfPresent defaults) when a presenter needs a new option
-- Media module output prefs (NOT theme): `videoLoopsByDefault`, `fullscreenVideoFillRaw` — live in Settings ▸ Proiecție ▸ Media
-- Toolbar rules: per-view items are conditional on `appState.selectedSidebarItem`; the Media filter Picker binds `@AppStorage("mediaTypeFilter")` which MediaView reads (never write UserDefaults directly from toolbar bindings); Freeze sits next to Black/Clear in the presentation group
+- Media module output prefs (NOT theme): `videoLoopsByDefault`, `fullscreenVideoFillRaw` — Settings ▸ Proiecție ▸ Media AND the Media panel's StyleQuickSettings `.media` section
+- Toolbar rules: per-view items are conditional on `appState.selectedSidebarItem`; the media kind filter lives in MediaView's OWN header (segmented `@AppStorage("mediaTypeFilter")` — the old toolbar Picker was removed, one filter UI); Freeze sits next to Black/Clear in the presentation group
+- **Tabs auto-name only (v10.4)** — the manual "Rename Tab" toolbar button/alert was REMOVED; `autoTabTitle` in MainControlView derives per module (bible: "(RO) EDC100 – ref", songs, media, schedule: session name + date via the testable `MainControlView.scheduleTabDetail(name:date:)`). Don't reintroduce `@SceneStorage("tabCustomName")`
+- **Media is a PRESENTABLE module (v10.4)**: MediaView = type tabs (Toate|Foto|Video|Audio) + rich grid (video/audio `durationSeconds` badges, artwork thumbnails via async `MediaThumbnailFactory`) + search on `libraryManager.mediaLibraryQuery`; selection = `libraryManager.selectedMediaItem` (NO notifications). The panel mirrors Bible/Songs anatomy and steps prev/next through `MediaLibrary.filter(...)` — THE one ordering shared with the grid. ALL "present media" paths go through `MediaPresenter.present` (fullscreen image = `pm.showMedia(kind:"image")` decodes the NSImage inside the caller's security scope → `LiveContent.mediaImage`; video = shared `VideoPlayerService`; audio = plays only, never claims the output). New media kinds = a `MediaKind` case + classify rule + icon
+- **Sessions (v10.4)**: `ScheduleItem.payloadJSON` (= `SessionItemPayload`, resilient Codable) stores STABLE refs — song `HistoryStore.songKey` (+ optional versionID/versionName), bible translation-abbrev + book/chapter/verse numbers, media id + name fallback; `title/content/subtitle` remain display SNAPSHOTS. Resolution via `SessionService.resolve` (registry of `SessionItemResolving` per itemType — extend there, don't grow a switch); misses → `.missing` (greyed row + ⚠, runner skips). `SessionRunner` (app-global @Observable) is THE ONLY presenter for schedule items — slide-by-slide next/prev (songs expand via `buildSongSlides` with the CURRENT song options at present time), jump-to-item, `presentOnce` for one-shots. „Adaugă la sesiune" = shared `AddToSessionMenu` fragment in the Bible verse / song / media context menus („Sesiune nouă…" creates instantly, no sheet). `.tpschedule` = FLAT JSON (`SessionArchive`, schemaVersion 1, format "TopPresenter Session" REQUIRED on import) + `requiredMedia` manifest; media re-links by id→name on import — media files are NOT embedded
 - **Sidebar (v10.2)** = `SidebarItem.contentItems` (bible/songs/media/schedule/customSlides) in the top `List`, + a PINNED bottom group (`utilityItems` = `.history`, `.account` as selectable destinations, plus a **Settings** button via `@Environment(\.openSettings)`). `.history`→`HistoryView`, `.account`→`ProfileView` (local prefs, `@AppStorage` only — no login) route through `ContentAreaView`; both return `EmptyView` in `PreviewPanelView` and the preview column is HIDDEN for them in `MainControlView` (full-width). Any new switch over `SidebarItem` must handle `.history` + `.account`
 - **Single output window**: locate it via `presentationWindows` (plural) and call `dedupePresentationWindows()` (closes extras) at the top of `showPresentationWindow`/`movePresentationWindow`/`positionOnScreen` + after the launch auto-open (guarded by `hasPresentationWindow`); the presentation `WindowGroup` is `.restorationBehavior(.disabled)`. This killed the "two overlapping outputs" (state-restoration + auto-open) bug — don't reintroduce an unguarded `openWindow(.presentation)`
 - **Song verified flag + edit log (v10.2)**: `Song.verified` (Bool, round-trips through GOAT — `songDictV2` writes `"verified"`, `TopPresenterSongImporter` reads it), `Song.modifiedDate` (drives the Recente sort), `Song.editLogJSON`→`editLog: [SongEditEntry]` (coarse change log, INTERNAL — not exported). The song editor snapshots the song to GOAT on open (`ExportService.exportSongToTopPresenterJSON`); **Renunță** reverts via `ImportService.applyResult(_:to:modelContext:)` (the GOAT→Song builder extracted from `createSongFromResult` — clears + rebuilds versions/sections, reused by import too); **Gata** diffs old↔new via `ImportService.summarizeChanges(old:new:)` → appends edit-log entries. `SectionEditorCard` uses `@FocusState` so clicking a section drives the editor preview. Library: verified badge in `songBadges`, "Doar verificate" filter + `verificat`/✓ search token, sort header chips (`SongSortKey` = A-Z/Artist/Carte/Limbă/Recente). Song slide thumbnails have PREVIEW + trash (delete = remove the section behind the slide, `.confirmationDialog`)
@@ -342,8 +357,9 @@ Unsigned builds require users to right-click → Open, or run `xattr -cr TopPres
 |-------------|-----------|-------|
 | Bible | `"format"` | `"TopPresenter Bible"` |
 | Songs | `"format"` | `"TopPresenter Songs"` |
+| Session (.tpschedule) | `"format"` | `"TopPresenter Session"` |
 
-All TopPresenter exports embed this identifier so importers can reliably distinguish them from generic JSON.
+All TopPresenter exports embed this identifier so importers can reliably distinguish them from generic JSON. Import MUST check the field is PRESENT (strict probe) — resilient decoders default it, which would accept foreign JSON. UTIs: `com.robyrew.toppresenter.theme` (package) + `com.robyrew.toppresenter.schedule` (public.json).
 
 ---
 

Info.plist

@@ -39,6 +39,23 @@
 				</array>
 			</dict>
 		</dict>
+		<dict>
+			<key>UTTypeIdentifier</key>
+			<string>com.robyrew.toppresenter.schedule</string>
+			<key>UTTypeDescription</key>
+			<string>TopPresenter Session</string>
+			<key>UTTypeConformsTo</key>
+			<array>
+				<string>public.json</string>
+			</array>
+			<key>UTTypeTagSpecification</key>
+			<dict>
+				<key>public.filename-extension</key>
+				<array>
+					<string>tpschedule</string>
+				</array>
+			</dict>
+		</dict>
 	</array>
 	<key>CFBundleDocumentTypes</key>
 	<array>
@@ -52,6 +69,16 @@
 				<string>com.robyrew.toppresenter.theme</string>
 			</array>
 		</dict>
+		<dict>
+			<key>CFBundleTypeName</key>
+			<string>TopPresenter Session</string>
+			<key>CFBundleTypeRole</key>
+			<string>Viewer</string>
+			<key>LSItemContentTypes</key>
+			<array>
+				<string>com.robyrew.toppresenter.schedule</string>
+			</array>
+		</dict>
 	</array>
 </dict>
 </plist>

TopPresenter/Core/AppCommands.swift

@@ -249,9 +249,9 @@ extension Notification.Name {
     static let deleteBibleModule = Notification.Name("TopPresenter.deleteBibleModule")
     static let deleteSongCollection = Notification.Name("TopPresenter.deleteSongCollection")
 
-    // Panel communication (content area → preview panel)
-    static let mediaItemSelected = Notification.Name("TopPresenter.mediaItemSelected")
-    static let scheduleSelected = Notification.Name("TopPresenter.scheduleSelected")
+    // Panel communication (content area → preview panel).
+    // Media/schedule selection now flows through LibraryManager (selectedMediaItem /
+    // selectedSchedule) — no notification round-trips.
     static let slideSelected = Notification.Name("TopPresenter.slideSelected")
 
     // Content area toolbar actions

TopPresenter/Core/LibraryManager.swift

@@ -56,8 +56,16 @@ final class LibraryManager {
     var songSlideCount: Int = 1
 
     // MARK: - Media State
-    /// The media item highlighted in the Media view — drives the tab title.
+    /// The media item highlighted in the Media view — drives the tab title and
+    /// the right panel's preview + prev/next stepping.
     var selectedMediaItem: MediaItem?
+    /// Media grid search — on the manager so the panel steps the SAME filtered
+    /// ordering the grid shows (mirrors songLibraryQuery).
+    var mediaLibraryQuery: String = ""
+
+    // MARK: - Schedule State
+    /// The session highlighted in the Schedule view — drives the tab title.
+    var selectedSchedule: ServiceSchedule?
 
     // MARK: - Bible Navigation
     /// Switch translation while staying on the same passage where possible.

TopPresenter/Core/PinStore.swift

@@ -0,0 +1,45 @@
+//
+//  PinStore.swift
+//  TopPresenter
+//
+//  Session-only song pins („Fixează sus"). App-global — one store shared by every
+//  window/tab (LibraryManager is per-window, so pins there would diverge) — and
+//  deliberately in-memory only: pins clear when the app quits, by construction.
+//  No SwiftData field, no UserDefaults. Keyed by Song.id (ephemeral ⇒ UUID is fine).
+//
+
+import Foundation
+import Observation
+
+@Observable
+final class PinStore {
+    /// IDs of the songs pinned for this app run.
+    private(set) var pinnedSongIDs: Set<UUID> = []
+
+    var hasPins: Bool { !pinnedSongIDs.isEmpty }
+
+    func isPinned(_ id: UUID) -> Bool { pinnedSongIDs.contains(id) }
+
+    func togglePin(_ id: UUID) {
+        if pinnedSongIDs.contains(id) {
+            pinnedSongIDs.remove(id)
+        } else {
+            pinnedSongIDs.insert(id)
+        }
+    }
+
+    func clearPins() { pinnedSongIDs.removeAll() }
+
+    /// Splits an already-filtered/sorted list into (pinned, rest), preserving the
+    /// input order in both halves. Pure + static so it's unit-testable.
+    /// (MainActor like its callers — Song is a @Model.)
+    static func partition(_ songs: [Song], pinnedIDs: Set<UUID>) -> (pinned: [Song], rest: [Song]) {
+        guard !pinnedIDs.isEmpty else { return ([], songs) }
+        var pinned: [Song] = []
+        var rest: [Song] = []
+        for song in songs {
+            if pinnedIDs.contains(song.id) { pinned.append(song) } else { rest.append(song) }
+        }
+        return (pinned, rest)
+    }
+}

TopPresenter/Core/PresentationManager.swift

@@ -2840,9 +2840,17 @@ final class PresentationManager {
 
     /// Marks the output as showing full-screen video.
     func showVideo() {
+        showMedia(kind: "video", url: nil)
+    }
+
+    /// Marks the output as showing full-screen media (image or video). Images are
+    /// decoded HERE — inside the caller's security scope — so the output window
+    /// never re-opens the sandboxed file; video renders via the shared VideoPlayerService.
+    func showMedia(kind: String, url: URL?) {
         guard !isFrozen else { return }
+        let image: NSImage? = (kind == "image") ? url.flatMap { NSImage(contentsOf: $0) } : nil
         presentContent { [self] in
-            liveContent.setVideo()
+            liveContent.setMedia(kind: kind, url: url, image: image)
             liveContent.isLive = true
             isBlackScreen = false
         }

TopPresenter/Models/PresentationModels.swift

@@ -48,6 +48,9 @@ final class MediaItem {
     @Attribute(.externalStorage) var thumbnailData: Data?
     /// Security-scoped bookmark data for persistent file access
     @Attribute(.externalStorage) var bookmarkData: Data?
+    /// Playable length in seconds (video/audio; 0 = unknown/not applicable).
+    /// Additive with inline default — lightweight migration, backfilled lazily.
+    var durationSeconds: Double = 0
 
     init(name: String, filePath: String, mediaType: String) {
         self.id = UUID()
@@ -207,7 +210,11 @@ final class ScheduleItem {
     var content: String
     var subtitle: String
     var order: Int
-    var referenceID: String?  // UUID string of the referenced Bible verse or song
+    var referenceID: String?  // legacy, unused — kept for stored data compatibility
+    /// Stable library reference (SessionItemPayload as JSON). "{}" for legacy
+    /// free-form items. Additive with inline default — lightweight migration.
+    /// title/content/subtitle stay as DISPLAY SNAPSHOTS captured at add-time.
+    var payloadJSON: String = "{}"
 
     var schedule: ServiceSchedule?
 
@@ -260,6 +267,13 @@ final class LiveContent {
     /// deck, item within schedule) — drives "show only on first/last slide".
     var slideIndex: Int = 0
     var slideCount: Int = 1
+    /// Live full-screen media: "image" | "video" (audio never claims the output).
+    var mediaKind: String = ""
+    /// Resolved URL of the live full-screen media (image rendering reads it).
+    var mediaURL: URL? = nil
+    /// Image decoded at present time (inside the file's security scope), so the
+    /// output window never has to re-open the sandboxed file itself.
+    var mediaImage: NSImage? = nil
 
     var isFirstSlide: Bool { slideIndex <= 0 }
     var isLastSlide: Bool { slideIndex >= slideCount - 1 }
@@ -294,6 +308,9 @@ final class LiveContent {
         clearSongMeta()
         slideIndex = 0
         slideCount = 1
+        mediaKind = ""
+        mediaURL = nil
+        mediaImage = nil
     }
 
     private func clearRichSources() {
@@ -361,13 +378,22 @@ final class LiveContent {
     }
 
     func setVideo() {
+        setMedia(kind: "video", url: nil)
+    }
+
+    /// Marks the output as showing full-screen media (image or video). Audio
+    /// plays through AudioPlayerManager and never claims the visual output.
+    func setMedia(kind: String, url: URL?, image: NSImage? = nil) {
         self.mainText = ""
         self.reference = ""
         self.subtitle = ""
         self.translationName = ""
         self.contentType = .media
         self.mainRuns = []
         clearRichSources()
+        self.mediaKind = kind
+        self.mediaURL = url
+        self.mediaImage = image
     }
 }
 

TopPresenter/Services/Media/MediaPresenter.swift

@@ -0,0 +1,59 @@
+//
+//  MediaPresenter.swift
+//  TopPresenter
+//
+//  THE one way a MediaItem goes live — used by the Media grid (double-click/Enter),
+//  the right panel's Proiectează button, and the session runner. Handles security
+//  scope, the loop default, and kind dispatch: image/video claim the visual output;
+//  audio plays through AudioPlayerManager and leaves the output untouched.
+//
+
+import Foundation
+import AVFoundation
+
+enum MediaPresenter {
+    /// Present a media item on the live output (image/video) or play it (audio).
+    static func present(_ item: MediaItem,
+                        pm: PresentationManager,
+                        video: VideoPlayerService,
+                        audio: AudioPlayerManager) {
+        guard let url = item.resolvedURL else { return }
+        let accessing = url.startAccessingSecurityScopedResource()
+        defer { if accessing { url.stopAccessingSecurityScopedResource() } }
+
+        switch MediaKind(rawValue: item.mediaType) ?? .image {
+        case .image:
+            pm.showMedia(kind: "image", url: url)
+        case .video:
+            video.loadVideo(url: url)
+            video.isLooping = pm.videoLoopsByDefault
+            video.play()
+            pm.showMedia(kind: "video", url: url)
+        case .audio:
+            audio.loadAudio(url: url)
+            audio.play()
+        }
+        backfillDurationIfNeeded(item, url: url)
+    }
+
+    /// Use an image (or GIF/video) as the global output background.
+    static func setAsBackground(_ item: MediaItem, pm: PresentationManager) {
+        guard let url = item.resolvedURL else { return }
+        let accessing = url.startAccessingSecurityScopedResource()
+        defer { if accessing { url.stopAccessingSecurityScopedResource() } }
+        pm.setBackgroundMedia(from: url)
+    }
+
+    /// Lazily fill `durationSeconds` for video/audio imported before the field
+    /// existed (or when import-time probing failed). Fire-and-forget.
+    static func backfillDurationIfNeeded(_ item: MediaItem, url: URL) {
+        guard item.durationSeconds <= 0, item.mediaType != "image" else { return }
+        Task { @MainActor in
+            let asset = AVURLAsset(url: url)
+            if let duration = try? await asset.load(.duration) {
+                let seconds = CMTimeGetSeconds(duration)
+                if seconds.isFinite, seconds > 0 { item.durationSeconds = seconds }
+            }
+        }
+    }
+}