LVI checkpoint — 2026-10-12

Status: project aborted by the operator (2026-10-12). Reason given: the tag is only a shortcut for people who already have VLC, and those people can download the file and open it themselves.

Scope: [lvi] BBCode mod (LVIBBC.php v1.0.1), SMF 2.0.19 test forum at /smf20, VLC 3.0.24 on the operator's Windows PC. Live forum not touched.

---

1. Problem & Resolution

Proven (with the evidence that proved it)

Finding	Evidence
VLC's web interface works as a control route. Setup: Tools > Preferences > All > Interface > Main interfaces, tick Web; under Lua > Lua HTTP set a password; username stays blank; address http://127.0.0.1:8080/. It only answers while VLC is running.	Login prompt, then VLC's status XML (<version>3.0.24 Vetinari</version>); 127.0.0.1:8080 unreachable once VLC was closed.
Route D (new tab to VLC's web interface, password in the URL) plays a file:// URL. The tab always shows VLC's XML reply; that is expected.	file:///C:/Users/Admin/Downloads/mmedia%20files/03_Track_3.mp3 played.
Routes E/F (.m3u / .xspf download) launch VLC with no VLC setup.	Both files opened VLC.
VLC fetches media as a guest. With guests denied, SMF answers with an HTML login page (200, text/html, about 500 bytes). VLC logs couldn't guess format / garbage at input from 509 / EOF reached.	curl.exe header check and the stripped body: "not allowed to download or view attachments on this board".
Granting Guests View attachments on the board fixed it, and the forum mp3 (attach=93) then played from the .m3u.	Operator: "it plays". Content-Length: 12132337.
[lvi=N] means attachment ID N, not a position. Position forms are [lvi=0] and [lvi=attach-NN] (media files only, 0-indexed). The error "Attachment #N not found, not approved, pending save, or not visible to you" means no attachment has that ID.	LVIBBC.php v1.0.1 source, validateAttachment().

Unresolved

• 3GP (attach=94, 260 KB) would not play from the forum URL, but plays from disk after a curl download.
  • Server reply for the 3GP was chunked with no Content-Length; the mp3 (11.8 MB) and mp4 (7.47 MB) replies had one.
  • The first bytes of the file are ftyp then mdat with no moov between them. That suggests the index is at the end of the file, but this was inferred from a text rendering of the file start, not checked.
  • Hypothesis, unproven: no length plus index at the end means VLC cannot seek to find the index over http.
  • The VLC log that showed HTTP 404 was for /smf20/Silly2.3gp, a path that does not exist. It says nothing about the hypothesis.
• Untested: an ffmpeg -c copy -movflags +faststart copy; turning off SMF's compressed-output setting (option name and effect not verified); whether the mp4 plays in VLC from its forum URL.
• Audio was very quiet when played via E/F. VLC's own volume read 243/256, so the cause is not VLC's volume. Not explained.
• The Wikimedia https .ogg test URL never played. Not explained; not related to the forum route.

Errors made in this session (Claude)

• Said Content-Type would become audio/mpeg; SMF sends application/octet-stream for all attachments (harmless to VLC).
• First read "Attachment #1" as a position, not an ID.
• Stated the index-at-end conclusion and the length theory more firmly than the evidence allowed.

---

2. Risk Analysis

State left behind

• Test forum (/smf20): Guests have View attachments on the General Discussion board. Test system only.
• Test forum: LVI and its [lvi] tag are installed, with CollabCore. Nothing on the live forum.
• Operator's PC: VLC's Web interface is enabled with a password. It is reachable only while VLC runs. The listening address was not checked.

Never tested

• Live forum, SMF 2.1.x, browsers other than the operator's, non-Windows machines.
• Members-only attachments. By design VLC cannot fetch these (no login). Signed per-click links were noted as a later step, never built.
• What happens on a visitor's machine where .m3u is not associated with VLC.

Design limits that came out of the testing

• Works only for attachments guests may download.
• The visitor needs VLC installed and registered for .m3u.
• Route D needs VLC running with the web interface set up on that visitor's machine.

---

3. Code Change

None delivered this session.

Item	Version	Status
LVIBBC.php	1.0.1 (2026-10-07)	unchanged
LVI_browser_test.html	1.0.0 (2026-10-07)	unchanged

One suggestion was offered and not made: reword the error text "Attachment #N" to "Attachment ID N" so it cannot be read as a position.

Release card: not applicable, no code delivered.

---

If ever resumed

1. Run the faststart copy of the 3GP and play it through [lvi=ID]. That settles the length / index hypothesis.
2. Decide the guest-attachment policy for the live forum first; the whole design depends on it.