Add consistent API request logging and a themed 404 page, bump to 0.4.0

Every app/api route handler now goes through withRouteLogging, which logs
a correlated reqId/method/path/status/duration for each request and turns
any uncaught error into a logged stack trace plus a clean JSON 500 instead
of Next's default opaque failure. proxy.ts logs rejected auth attempts, and
instrumentation.ts's onRequestError catches anything that still escapes a
route handler. Also adds a minimal not-found page matching the app's card
styling.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/(app)/control/page.tsx

@@ -1,5 +1,8 @@
+import type { Metadata } from "next";
 import { ButtplugConsoleLoader as ButtplugConsole } from "@/components/control/ButtplugConsoleLoader";
 
+export const metadata: Metadata = { title: "Control" };
+
 export default function ControlPage() {
   return (
     <div className="flex flex-col gap-6">

app/(app)/devices/page.tsx

@@ -1,11 +1,20 @@
+import type { Metadata } from "next";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { DevicesTable } from "@/components/devices/DevicesTable";
-import { listDevices } from "@/lib/db/queries/devices";
+import { PageNav } from "@/components/shared/PageNav";
+import { listDevicesPage } from "@/lib/db/queries/devices";
+import { parsePage } from "@/lib/pagination";
 
 export const dynamic = "force-dynamic";
+export const metadata: Metadata = { title: "Devices" };
 
-export default async function DevicesPage() {
+export default async function DevicesPage({
-  const devices = await listDevices();
+  searchParams,
+}: {
+  searchParams: Promise<{ page?: string }>;
+}) {
+  const page = parsePage((await searchParams).page);
+  const { items: devices, pageSize, total } = await listDevicesPage(page);
 
   return (
     <div className="flex flex-col gap-6">
@@ -17,8 +26,9 @@ export default async function DevicesPage() {
         <CardHeader>
           <CardTitle className="text-base">Known devices</CardTitle>
         </CardHeader>
-        <CardContent>
+        <CardContent className="flex flex-col gap-3">
           <DevicesTable devices={devices} />
+          <PageNav basePath="/devices" page={page} pageSize={pageSize} total={total} />
         </CardContent>
       </Card>
     </div>

app/(app)/recordings/[id]/page.tsx

@@ -1,12 +1,19 @@
 import Link from "next/link";
 import { notFound } from "next/navigation";
+import type { Metadata } from "next";
 import { Button } from "@/components/ui/button";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
-import { getRecording } from "@/lib/db/queries/recordings";
+import { getRecording, getRecordingName } from "@/lib/db/queries/recordings";
 import { Play } from "lucide-react";
 
 export const dynamic = "force-dynamic";
 
+export async function generateMetadata({ params }: { params: Promise<{ id: string }> }): Promise<Metadata> {
+  const { id } = await params;
+  const name = await getRecordingName(Number(id));
+  return { title: name ?? "Recording" };
+}
+
 function formatDuration(ms: number): string {
   const totalSeconds = Math.round(ms / 1000);
   return `${Math.floor(totalSeconds / 60)}:${(totalSeconds % 60).toString().padStart(2, "0")}`;

app/(app)/recordings/[id]/replay/page.tsx

@@ -1,4 +1,12 @@
+import type { Metadata } from "next";
 import { ReplayPlayerLoader } from "@/components/recordings/ReplayPlayerLoader";
+import { getRecordingName } from "@/lib/db/queries/recordings";
+
+export async function generateMetadata({ params }: { params: Promise<{ id: string }> }): Promise<Metadata> {
+  const { id } = await params;
+  const name = await getRecordingName(Number(id));
+  return { title: name ? `Replay ${name}` : "Replay" };
+}
 
 export default async function ReplayPage({ params }: { params: Promise<{ id: string }> }) {
   const { id } = await params;

app/(app)/recordings/page.tsx

@@ -1,11 +1,20 @@
+import type { Metadata } from "next";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { RecordingsTable } from "@/components/recordings/RecordingsTable";
-import { listRecordings } from "@/lib/db/queries/recordings";
+import { PageNav } from "@/components/shared/PageNav";
+import { listRecordingsPage } from "@/lib/db/queries/recordings";
+import { parsePage } from "@/lib/pagination";
 
 export const dynamic = "force-dynamic";
+export const metadata: Metadata = { title: "Recordings" };
 
-export default async function RecordingsPage() {
+export default async function RecordingsPage({
-  const recordings = await listRecordings();
+  searchParams,
+}: {
+  searchParams: Promise<{ page?: string }>;
+}) {
+  const page = parsePage((await searchParams).page);
+  const { items: recordings, pageSize, total } = await listRecordingsPage(page);
 
   return (
     <div className="flex flex-col gap-6">
@@ -17,8 +26,9 @@ export default async function RecordingsPage() {
         <CardHeader>
           <CardTitle className="text-base">Library</CardTitle>
         </CardHeader>
-        <CardContent>
+        <CardContent className="flex flex-col gap-3">
           <RecordingsTable recordings={recordings} />
+          <PageNav basePath="/recordings" page={page} pageSize={pageSize} total={total} />
         </CardContent>
       </Card>
     </div>

app/(app)/sessions/[id]/page.tsx

@@ -1,11 +1,18 @@
 import { notFound } from "next/navigation";
+import type { Metadata } from "next";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { SessionTimelineChart } from "@/components/sessions/SessionTimelineChart";
-import { getPlaySessionDetail } from "@/lib/db/queries/play-sessions";
+import { getPlaySessionDetail, getPlaySessionName } from "@/lib/db/queries/play-sessions";
 import { getSessionTimeline } from "@/lib/db/queries/stats";
 
 export const dynamic = "force-dynamic";
 
+export async function generateMetadata({ params }: { params: Promise<{ id: string }> }): Promise<Metadata> {
+  const { id } = await params;
+  const name = await getPlaySessionName(Number(id));
+  return { title: name ?? `Session #${id}` };
+}
+
 function formatDuration(ms: number | null): string {
   if (ms === null) return "-";
   const totalSeconds = Math.round(ms / 1000);

app/(app)/sessions/page.tsx

@@ -1,11 +1,20 @@
+import type { Metadata } from "next";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { SessionsTable } from "@/components/sessions/SessionsTable";
-import { listPlaySessions } from "@/lib/db/queries/play-sessions";
+import { PageNav } from "@/components/shared/PageNav";
+import { listPlaySessionsPage } from "@/lib/db/queries/play-sessions";
+import { parsePage } from "@/lib/pagination";
 
 export const dynamic = "force-dynamic";
+export const metadata: Metadata = { title: "Sessions" };
 
-export default async function SessionsPage() {
+export default async function SessionsPage({
-  const sessions = [...(await listPlaySessions())].reverse();
+  searchParams,
+}: {
+  searchParams: Promise<{ page?: string }>;
+}) {
+  const page = parsePage((await searchParams).page);
+  const { items: sessions, pageSize, total } = await listPlaySessionsPage(page);
 
   return (
     <div className="flex flex-col gap-6">
@@ -17,8 +26,9 @@ export default async function SessionsPage() {
         <CardHeader>
           <CardTitle className="text-base">History</CardTitle>
         </CardHeader>
-        <CardContent>
+        <CardContent className="flex flex-col gap-3">
           <SessionsTable sessions={sessions} />
+          <PageNav basePath="/sessions" page={page} pageSize={pageSize} total={total} />
         </CardContent>
       </Card>
     </div>

app/(app)/stats/page.tsx

@@ -1,3 +1,4 @@
+import type { Metadata } from "next";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { SessionsSummaryCards } from "@/components/stats/SessionsSummaryCards";
 import { DeviceUsageTable } from "@/components/stats/DeviceUsageTable";
@@ -5,6 +6,7 @@ import { RecordingLibraryStats } from "@/components/stats/RecordingLibraryStats"
 import { getDeviceCommandCounts, getDeviceUsageStats, getRecordingLibraryStats, getSessionsSummary } from "@/lib/db/queries/stats";
 
 export const dynamic = "force-dynamic";
+export const metadata: Metadata = { title: "Stats" };
 
 export default async function StatsPage() {
   const [sessionsSummary, deviceUsage, commandCounts, recordingStats] = await Promise.all([

app/api/auth/login/route.ts

@@ -3,21 +3,26 @@ import { z } from "zod";
 import { getEnv } from "@/lib/env";
 import { timingSafeStringEqual } from "@/lib/auth/timing-safe-compare";
 import { createSessionToken, sessionCookieOptions } from "@/lib/auth/session";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
+import { createLogger } from "@/lib/logger";
 
+const log = createLogger("auth");
 const bodySchema = z.object({ secret: z.string().min(1) });
 
-export async function POST(req: Request) {
+export const POST = withRouteLogging("auth.login", async (req: Request) => {
   const parsed = bodySchema.safeParse(await req.json().catch(() => null));
   if (!parsed.success) {
     return NextResponse.json({ error: "secret is required" }, { status: 400 });
   }
 
   if (!timingSafeStringEqual(parsed.data.secret, getEnv().ACCESS_PASSWORD)) {
+    log.warn("login attempt with invalid secret");
     return NextResponse.json({ error: "invalid secret" }, { status: 401 });
   }
 
+  log.info("login succeeded");
   const token = await createSessionToken();
   const res = NextResponse.json({ ok: true });
   res.cookies.set({ ...sessionCookieOptions, value: token });
   return res;
-}
+});

app/api/auth/logout/route.ts

@@ -1,8 +1,9 @@
 import { NextResponse } from "next/server";
 import { SESSION_COOKIE_NAME } from "@/lib/auth/session";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
 
-export async function POST() {
+export const POST = withRouteLogging("auth.logout", async () => {
   const res = NextResponse.json({ ok: true });
   res.cookies.delete(SESSION_COOKIE_NAME);
   return res;
-}
+});

app/api/devices/[id]/route.ts

@@ -1,16 +1,20 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { renameDevice } from "@/lib/db/queries/devices";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
 
 const bodySchema = z.object({ displayName: z.string().min(1).max(120) });
 
-export async function PATCH(req: Request, { params }: { params: Promise<{ id: string }> }) {
+export const PATCH = withRouteLogging(
-  const { id } = await params;
+  "devices.rename",
-  const parsed = bodySchema.safeParse(await req.json().catch(() => null));
+  async (req: Request, { params }: { params: Promise<{ id: string }> }) => {
-  if (!parsed.success) {
+    const { id } = await params;
-    return NextResponse.json({ error: "displayName is required" }, { status: 400 });
+    const parsed = bodySchema.safeParse(await req.json().catch(() => null));
-  }
+    if (!parsed.success) {
-  const updated = await renameDevice(Number(id), parsed.data.displayName);
+      return NextResponse.json({ error: "displayName is required" }, { status: 400 });
-  if (!updated) return NextResponse.json({ error: "not found" }, { status: 404 });
+    }
-  return NextResponse.json({ device: updated });
+    const updated = await renameDevice(Number(id), parsed.data.displayName);
-}
+    if (!updated) return NextResponse.json({ error: "not found" }, { status: 404 });
+    return NextResponse.json({ device: updated });
+  },
+);

app/api/devices/route.ts

@@ -1,7 +1,8 @@
 import { NextResponse } from "next/server";
 import { listDevices } from "@/lib/db/queries/devices";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
 
-export async function GET() {
+export const GET = withRouteLogging("devices.list", async () => {
   const rows = await listDevices();
   return NextResponse.json({ devices: rows });
-}
+});

app/api/health/route.ts

@@ -1,11 +1,16 @@
 import { NextResponse } from "next/server";
 import { sqlite } from "@/lib/db/client";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
+import { createLogger } from "@/lib/logger";
 
-export async function GET() {
+const log = createLogger("health");
+
+export const GET = withRouteLogging("health.check", async () => {
   try {
     sqlite.prepare("select 1").get();
     return NextResponse.json({ status: "ok" });
-  } catch {
+  } catch (err) {
+    log.error("health check failed", { error: err instanceof Error ? err.message : String(err) });
     return NextResponse.json({ status: "error" }, { status: 500 });
   }
-}
+});

app/api/play-sessions/[id]/events/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { insertEvents } from "@/lib/db/queries/session-events";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
 
 const eventSchema = z.object({
   sessionDeviceId: z.number().int().positive(),
@@ -13,12 +14,15 @@ const eventSchema = z.object({
 
 const bodySchema = z.object({ events: z.array(eventSchema).max(2000) });
 
-export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+export const POST = withRouteLogging(
-  const { id } = await params;
+  "play-sessions.events.append",
-  const parsed = bodySchema.safeParse(await req.json().catch(() => null));
+  async (req: Request, { params }: { params: Promise<{ id: string }> }) => {
-  if (!parsed.success) {
+    const { id } = await params;
-    return NextResponse.json({ error: parsed.error.message }, { status: 400 });
+    const parsed = bodySchema.safeParse(await req.json().catch(() => null));
-  }
+    if (!parsed.success) {
-  await insertEvents(Number(id), parsed.data.events);
+      return NextResponse.json({ error: parsed.error.message }, { status: 400 });
-  return NextResponse.json({ inserted: parsed.data.events.length });
+    }
-}
+    await insertEvents(Number(id), parsed.data.events);
+    return NextResponse.json({ inserted: parsed.data.events.length });
+  },
+);

app/api/play-sessions/[id]/route.ts

@@ -1,40 +1,56 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { deletePlaySession, endPlaySession, getPlaySessionDetail } from "@/lib/db/queries/play-sessions";
+import { getRecordingsForSession } from "@/lib/db/queries/recordings";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
+import { createLogger } from "@/lib/logger";
 
+const log = createLogger("play-sessions");
 const patchSchema = z.object({ status: z.enum(["completed", "aborted"]) });
 
-export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+export const GET = withRouteLogging(
-  const { id } = await params;
+  "play-sessions.get",
-  const detail = await getPlaySessionDetail(Number(id));
+  async (_req: Request, { params }: { params: Promise<{ id: string }> }) => {
-  if (!detail) return NextResponse.json({ error: "not found" }, { status: 404 });
+    const { id } = await params;
-  return NextResponse.json(detail);
+    const detail = await getPlaySessionDetail(Number(id));
-}
+    if (!detail) return NextResponse.json({ error: "not found" }, { status: 404 });
+    return NextResponse.json(detail);
+  },
+);
 
-export async function PATCH(req: Request, { params }: { params: Promise<{ id: string }> }) {
+export const PATCH = withRouteLogging(
-  const { id } = await params;
+  "play-sessions.end",
-  const parsed = patchSchema.safeParse(await req.json().catch(() => null));
+  async (req: Request, { params }: { params: Promise<{ id: string }> }) => {
-  if (!parsed.success) {
+    const { id } = await params;
-    return NextResponse.json({ error: "status must be completed or aborted" }, { status: 400 });
+    const parsed = patchSchema.safeParse(await req.json().catch(() => null));
-  }
+    if (!parsed.success) {
-  const updated = await endPlaySession(Number(id), parsed.data);
+      return NextResponse.json({ error: "status must be completed or aborted" }, { status: 400 });
-  if (!updated) return NextResponse.json({ error: "not found" }, { status: 404 });
-  return NextResponse.json({ playSession: updated });
-}
-
-export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
-  const { id } = await params;
-  try {
-    await deletePlaySession(Number(id));
-    return NextResponse.json({ ok: true });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    if (message.includes("FOREIGN KEY") || message.includes("SQLITE_CONSTRAINT")) {
-      return NextResponse.json(
-        { error: "cannot delete a session that a saved recording still references" },
-        { status: 409 },
-      );
     }
-    throw err;
+    const updated = await endPlaySession(Number(id), parsed.data);
-  }
+    if (!updated) return NextResponse.json({ error: "not found" }, { status: 404 });
-}
+    return NextResponse.json({ playSession: updated });
+  },
+);
+
+export const DELETE = withRouteLogging(
+  "play-sessions.delete",
+  async (req: Request, { params }: { params: Promise<{ id: string }> }) => {
+    const { id } = await params;
+    const cascade = new URL(req.url).searchParams.get("cascade") === "true";
+    try {
+      await deletePlaySession(Number(id), { cascade });
+      return NextResponse.json({ ok: true });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (message.includes("FOREIGN KEY") || message.includes("SQLITE_CONSTRAINT")) {
+        log.warn("blocked session delete due to referencing recording", { sessionId: id, cascade });
+        const blockingRecordings = await getRecordingsForSession(Number(id));
+        return NextResponse.json(
+          { error: "cannot delete a session that a saved recording still references", recordings: blockingRecordings },
+          { status: 409 },
+        );
+      }
+      throw err;
+    }
+  },
+);

app/api/play-sessions/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { listPlaySessions, startPlaySession } from "@/lib/db/queries/play-sessions";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
 
 const deviceInputSchema = z.object({
   slotLabel: z.string().min(1),
@@ -16,16 +17,16 @@ const bodySchema = z.object({
   devices: z.array(deviceInputSchema).min(1),
 });
 
-export async function GET() {
+export const GET = withRouteLogging("play-sessions.list", async () => {
   const rows = await listPlaySessions();
   return NextResponse.json({ playSessions: rows });
-}
+});
 
-export async function POST(req: Request) {
+export const POST = withRouteLogging("play-sessions.start", async (req: Request) => {
   const parsed = bodySchema.safeParse(await req.json().catch(() => null));
   if (!parsed.success) {
     return NextResponse.json({ error: parsed.error.message }, { status: 400 });
   }
   const result = await startPlaySession(parsed.data);
   return NextResponse.json(result, { status: 201 });
-}
+});

app/api/recordings/[id]/route.ts

@@ -1,32 +1,42 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { deleteRecording, getRecording, renameRecording } from "@/lib/db/queries/recordings";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
 
 const patchSchema = z.object({
   name: z.string().min(1).max(160).optional(),
   description: z.string().max(2000).optional(),
 });
 
-export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+export const GET = withRouteLogging(
-  const { id } = await params;
+  "recordings.get",
-  const result = await getRecording(Number(id));
+  async (_req: Request, { params }: { params: Promise<{ id: string }> }) => {
-  if (!result) return NextResponse.json({ error: "not found" }, { status: 404 });
+    const { id } = await params;
-  return NextResponse.json(result);
+    const result = await getRecording(Number(id));
-}
+    if (!result) return NextResponse.json({ error: "not found" }, { status: 404 });
+    return NextResponse.json(result);
+  },
+);
 
-export async function PATCH(req: Request, { params }: { params: Promise<{ id: string }> }) {
+export const PATCH = withRouteLogging(
-  const { id } = await params;
+  "recordings.update",
-  const parsed = patchSchema.safeParse(await req.json().catch(() => null));
+  async (req: Request, { params }: { params: Promise<{ id: string }> }) => {
-  if (!parsed.success) {
+    const { id } = await params;
-    return NextResponse.json({ error: "invalid body" }, { status: 400 });
+    const parsed = patchSchema.safeParse(await req.json().catch(() => null));
-  }
+    if (!parsed.success) {
-  const updated = await renameRecording(Number(id), parsed.data);
+      return NextResponse.json({ error: "invalid body" }, { status: 400 });
-  if (!updated) return NextResponse.json({ error: "not found" }, { status: 404 });
+    }
-  return NextResponse.json({ recording: updated });
+    const updated = await renameRecording(Number(id), parsed.data);
-}
+    if (!updated) return NextResponse.json({ error: "not found" }, { status: 404 });
+    return NextResponse.json({ recording: updated });
+  },
+);
 
-export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+export const DELETE = withRouteLogging(
-  const { id } = await params;
+  "recordings.delete",
-  await deleteRecording(Number(id));
+  async (_req: Request, { params }: { params: Promise<{ id: string }> }) => {
-  return NextResponse.json({ ok: true });
+    const { id } = await params;
-}
+    await deleteRecording(Number(id));
+    return NextResponse.json({ ok: true });
+  },
+);

app/api/recordings/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { createRecording, listRecordings } from "@/lib/db/queries/recordings";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
 
 const bodySchema = z.object({
   sourcePlaySessionId: z.number().int().positive(),
@@ -8,16 +9,16 @@ const bodySchema = z.object({
   description: z.string().max(2000).optional(),
 });
 
-export async function GET() {
+export const GET = withRouteLogging("recordings.list", async () => {
   const rows = await listRecordings();
   return NextResponse.json({ recordings: rows });
-}
+});
 
-export async function POST(req: Request) {
+export const POST = withRouteLogging("recordings.create", async (req: Request) => {
   const parsed = bodySchema.safeParse(await req.json().catch(() => null));
   if (!parsed.success) {
     return NextResponse.json({ error: parsed.error.message }, { status: 400 });
   }
   const recording = await createRecording(parsed.data);
   return NextResponse.json({ recording }, { status: 201 });
-}
+});

app/api/stats/devices/route.ts

@@ -1,9 +1,10 @@
 import { NextResponse } from "next/server";
 import { getDeviceCommandCounts, getDeviceUsageStats } from "@/lib/db/queries/stats";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
 
-export async function GET() {
+export const GET = withRouteLogging("stats.devices", async () => {
   const [usage, commandCounts] = await Promise.all([getDeviceUsageStats(), getDeviceCommandCounts()]);
   const commandCountByDevice = new Map(commandCounts.map((c) => [c.deviceId, c.commandCount]));
   const devices = usage.map((d) => ({ ...d, commandCount: commandCountByDevice.get(d.deviceId) ?? 0 }));
   return NextResponse.json({ devices });
-}
+});

app/api/stats/recordings/route.ts

@@ -1,7 +1,8 @@
 import { NextResponse } from "next/server";
 import { getRecordingLibraryStats } from "@/lib/db/queries/stats";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
 
-export async function GET() {
+export const GET = withRouteLogging("stats.recordings", async () => {
   const stats = await getRecordingLibraryStats();
   return NextResponse.json(stats);
-}
+});

app/api/stats/sessions/[id]/timeline/route.ts

@@ -1,9 +1,13 @@
 import { NextResponse } from "next/server";
 import { getSessionTimeline } from "@/lib/db/queries/stats";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
 
-export async function GET(req: Request, { params }: { params: Promise<{ id: string }> }) {
+export const GET = withRouteLogging(
-  const { id } = await params;
+  "stats.session-timeline",
-  const bucketMs = Number(new URL(req.url).searchParams.get("bucketMs") ?? 1000);
+  async (req: Request, { params }: { params: Promise<{ id: string }> }) => {
-  const timeline = await getSessionTimeline(Number(id), bucketMs);
+    const { id } = await params;
-  return NextResponse.json({ timeline });
+    const bucketMs = Number(new URL(req.url).searchParams.get("bucketMs") ?? 1000);
-}
+    const timeline = await getSessionTimeline(Number(id), bucketMs);
+    return NextResponse.json({ timeline });
+  },
+);

app/api/stats/sessions/route.ts

@@ -1,7 +1,8 @@
 import { NextResponse } from "next/server";
 import { getSessionsSummary } from "@/lib/db/queries/stats";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
 
-export async function GET() {
+export const GET = withRouteLogging("stats.sessions", async () => {
   const summary = await getSessionsSummary();
   return NextResponse.json(summary);
-}
+});

app/globals.css

@@ -176,6 +176,17 @@
 .bp-led[data-on="true"] {
   background: var(--primary);
 }
+/* Header connection indicator: state-driven color, distinct from the
+   transmit-dot's boolean data-on above. */
+.bp-led[data-state="scanning"] {
+  background: var(--muted-foreground);
+}
+.bp-led[data-state="connected"] {
+  background: var(--primary);
+}
+.bp-led[data-state="recording"] {
+  background: var(--destructive);
+}
 
 /* Thin panel seam - a hardware "trim line," not a plain UI divider. */
 .bp-hairline {
@@ -193,15 +204,21 @@
 @keyframes bp-pulse-glow {
   0%,
   100% {
-    box-shadow: 0 0 0 0 color-mix(in srgb, var(--primary) 55%, transparent);
+    box-shadow: 0 0 0 0 color-mix(in srgb, var(--bp-pulse-color, var(--primary)) 55%, transparent);
   }
   50% {
-    box-shadow: 0 0 0 6px color-mix(in srgb, var(--primary) 0%, transparent);
+    box-shadow: 0 0 0 6px color-mix(in srgb, var(--bp-pulse-color, var(--primary)) 0%, transparent);
   }
 }
 .bp-pulse {
   animation: bp-pulse-glow 2s ease-in-out infinite;
 }
+.bp-led[data-state="scanning"] {
+  --bp-pulse-color: var(--muted-foreground);
+}
+.bp-led[data-state="recording"] {
+  --bp-pulse-color: var(--destructive);
+}
 
 @media (prefers-reduced-motion: reduce) {
   .bp-pulse {

app/layout.tsx

@@ -10,7 +10,7 @@ const spaceGrotesk = Space_Grotesk({ subsets: ["latin"], variable: "--font-displ
 const jetbrainsMono = JetBrains_Mono({ subsets: ["latin"], variable: "--font-mono" });
 
 export const metadata: Metadata = {
-  title: "SEXY",
+  title: { default: "Sexy", template: "%s · Sexy" },
   description: "Bluetooth toy control console",
 };
 

app/login/page.tsx

@@ -1,8 +1,11 @@
 import { Suspense } from "react";
+import type { Metadata } from "next";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
 import { LoginForm } from "@/components/auth/LoginForm";
 import { BrandMark } from "@/components/layout/BrandMark";
 
+export const metadata: Metadata = { title: "Log in" };
+
 export default function LoginPage() {
   return (
     <div className="flex min-h-dvh items-center justify-center p-4">
@@ -10,7 +13,7 @@ export default function LoginPage() {
         <CardHeader>
           <div className="flex items-center gap-2">
             <BrandMark size={32} />
-            <CardTitle className="font-heading bp-gradient-text text-2xl">SEXY</CardTitle>
+            <CardTitle className="font-heading bp-gradient-text text-2xl">Sexy</CardTitle>
           </div>
           <CardDescription>Enter the shared access secret to continue.</CardDescription>
         </CardHeader>

app/manifest.ts

@@ -2,8 +2,8 @@ import type { MetadataRoute } from "next";
 
 export default function manifest(): MetadataRoute.Manifest {
   return {
-    name: "SEXY",
+    name: "Sexy",
-    short_name: "SEXY",
+    short_name: "Sexy",
     description: "Bluetooth toy control console",
     start_url: "/",
     display: "standalone",

app/not-found.tsx

@@ -0,0 +1,26 @@
+import Link from "next/link";
+import type { Metadata } from "next";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent } from "@/components/ui/card";
+import { BrandMark } from "@/components/layout/BrandMark";
+
+export const metadata: Metadata = { title: "Not found" };
+
+export default function NotFound() {
+  return (
+    <div className="flex min-h-dvh items-center justify-center p-4">
+      <Card className="bp-glass w-full max-w-sm">
+        <CardContent className="flex flex-col items-center gap-4 py-4 text-center">
+          <BrandMark size={32} />
+          <div className="space-y-1">
+            <p className="bp-readout bp-gradient-text text-4xl font-semibold">404</p>
+            <p className="text-sm text-muted-foreground">This page doesn&apos;t exist.</p>
+          </div>
+          <Button asChild size="sm">
+            <Link href="/">Back to dashboard</Link>
+          </Button>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

components/control/ButtplugConsole.tsx

@@ -45,6 +45,8 @@ export function ButtplugConsole() {
   const setActuatorValue = useButtplugStore((s) => s.setActuatorValue);
   const batteryLevels = useButtplugStore((s) => s.batteryLevels);
   const setBatteryLevel = useButtplugStore((s) => s.setBatteryLevel);
+  const removeDevice = useButtplugStore((s) => s.removeDevice);
+  const setRecording = useButtplugStore((s) => s.setRecording);
   const storeError = useButtplugStore((s) => s.error);
 
   const [activeSession, setActiveSession] = useState<ActivePlaySession | null>(null);
@@ -136,6 +138,7 @@ export function ButtplugConsole() {
         sessionDeviceIdByDeviceIndex,
       });
       setElapsedMs(0);
+      setRecording(true);
     } catch {
       toast.error("Could not start session.");
     } finally {
@@ -147,6 +150,7 @@ export function ButtplugConsole() {
     if (!activeSession) return;
     setSessionBusy(true);
     eventBuffer.stop();
+    setRecording(false);
     await fetch(`/api/play-sessions/${activeSession.id}`, {
       method: "PATCH",
       headers: { "Content-Type": "application/json" },
@@ -197,6 +201,17 @@ export function ButtplugConsole() {
     device.actuators.forEach((a) => setActuatorValue(device.index, a.featureIndex, 0));
   }
 
+  async function handleDisconnectDevice(device: ConnectedDeviceInfo) {
+    // Buttplug's protocol has no per-device disconnect message - only a
+    // whole-client disconnect() and stop() (halts actuators). Stopping it and
+    // removing it from local state is the closest equivalent: the card
+    // disappears and it stops receiving commands, though the underlying BLE
+    // link may persist until the whole client disconnects.
+    const liveDevice = await getDevice(device.index);
+    await liveDevice?.stop().catch(() => {});
+    removeDevice(device.index);
+  }
+
   if (!supported) {
     return (
       <Card className="bp-glass">
@@ -249,6 +264,7 @@ export function ButtplugConsole() {
               }
               onActuatorChange={(featureIndex, value) => void handleActuatorChange(device, featureIndex, value)}
               onStop={() => void handleStopDevice(device)}
+              onDisconnect={() => void handleDisconnectDevice(device)}
             />
           ))}
         </div>

components/control/DeviceCard.tsx

@@ -4,7 +4,7 @@ import { Card, CardContent, CardHeader } from "@/components/ui/card";
 import { Button } from "@/components/ui/button";
 import { ActuatorSlider } from "./ActuatorSlider";
 import type { ConnectedDeviceInfo } from "@/lib/buttplug/types";
-import { Battery, BatteryFull, BatteryLow, BatteryMedium, BatteryWarning } from "lucide-react";
+import { Battery, BatteryFull, BatteryLow, BatteryMedium, BatteryWarning, Unlink } from "lucide-react";
 
 interface DeviceCardProps {
   device: ConnectedDeviceInfo;
@@ -13,6 +13,7 @@ interface DeviceCardProps {
   transmittingFeatureIndex: number | null;
   onActuatorChange: (featureIndex: number, value: number) => void;
   onStop: () => void;
+  onDisconnect: () => void;
 }
 
 function BatteryIndicator({ level }: { level: number }) {
@@ -32,6 +33,7 @@ export function DeviceCard({
   transmittingFeatureIndex,
   onActuatorChange,
   onStop,
+  onDisconnect,
 }: DeviceCardProps) {
   return (
     <Card className="bp-glass">
@@ -47,6 +49,9 @@ export function DeviceCard({
           <Button variant="outline" size="sm" onClick={onStop}>
             Stop
           </Button>
+          <Button variant="ghost" size="icon-sm" onClick={onDisconnect} aria-label="Disconnect device">
+            <Unlink className="size-3.5" />
+          </Button>
         </div>
       </CardHeader>
       <div className="bp-hairline mx-4" />

components/devices/DevicesTable.tsx

@@ -38,8 +38,8 @@ function DeviceNameCell({ device }: { device: DeviceRow }) {
 
   return (
     <div className="flex items-center gap-2">
-      <Input value={value} onChange={(e) => setValue(e.target.value)} className="h-8 max-w-48" />
+      <Input value={value} onChange={(e) => setValue(e.target.value)} className="h-8 w-40 min-w-40" />
-      <Button size="sm" variant="outline" onClick={handleSave} disabled={saving}>
+      <Button size="sm" variant="outline" onClick={handleSave} disabled={saving} className="shrink-0">
         Save
       </Button>
     </div>

components/layout/ConnectionStatus.tsx

@@ -1,18 +1,28 @@
 "use client";
 
 import { useButtplugStore } from "@/lib/buttplug/store";
-import { cn } from "@/lib/utils";
+
+type IndicatorState = "scanning" | "connected" | "recording";
 
 export function ConnectionStatus() {
-  const connected = useButtplugStore((s) => s.connected);
+  const scanning = useButtplugStore((s) => s.scanning);
+  const recording = useButtplugStore((s) => s.recording);
   const deviceCount = useButtplugStore((s) => Object.keys(s.devices).length);
 
-  return (
+  // Priority: an active recording is the most important thing to surface,
-    <div className="flex items-center gap-2 rounded-md border border-border bg-card/60 px-3 py-1 text-xs">
+  // then whether toys are actually connected, then a bare scan-in-progress -
-      <span className={cn("bp-led", connected && "bp-pulse")} data-on={connected} aria-hidden />
+  // this is deliberately independent of the Buttplug client's own `connected`
-      <span className="bp-readout text-muted-foreground">
+  // flag, which goes true as soon as the embedded server initializes (i.e. as
-        {connected ? `${deviceCount} device${deviceCount === 1 ? "" : "s"} connected` : "not connected"}
+  // soon as scanning starts), not when a device is actually paired.
-      </span>
+  const state: IndicatorState | null = recording
-    </div>
+    ? "recording"
-  );
+    : deviceCount > 0
+      ? "connected"
+      : scanning
+        ? "scanning"
+        : null;
+
+  if (!state) return null;
+
+  return <span className="bp-led bp-pulse" data-state={state} aria-hidden />;
 }

components/layout/NavBar.tsx

@@ -57,7 +57,7 @@ export function NavBar() {
       <div className="mx-auto flex h-14 max-w-6xl items-center gap-3 px-4">
         <Link href="/" className="mr-2 flex items-center gap-2">
           <BrandMark size={26} />
-          <span className="font-heading bp-gradient-text text-lg font-semibold">SEXY</span>
+          <span className="font-heading bp-gradient-text text-lg font-semibold">Sexy</span>
         </Link>
 
         <nav className="hidden items-center gap-1 md:flex">

components/recordings/ReplayPlayer.tsx

@@ -8,7 +8,7 @@ import { Button } from "@/components/ui/button";
 import { Slider } from "@/components/ui/slider";
 import { DeviceScanPanel } from "@/components/control/DeviceScanPanel";
 import { DeviceRemapDialog } from "./DeviceRemapDialog";
-import { getButtplugClientHandle, startScanning, stopScanning } from "@/lib/buttplug/client";
+import { disconnectAll, getButtplugClientHandle, getDevice, startScanning, stopScanning } from "@/lib/buttplug/client";
 import { eventBuffer } from "@/lib/buttplug/event-buffer";
 import { RecordingPlayer, type RecordingEventRow } from "@/lib/buttplug/player";
 import { useButtplugStore } from "@/lib/buttplug/store";
@@ -35,13 +35,19 @@ export function ReplayPlayer({ recordingId }: { recordingId: number }) {
   const router = useRouter();
   const scanning = useButtplugStore((s) => s.scanning);
   const devices = useButtplugStore((s) => s.devices);
+  const setActuatorValue = useButtplugStore((s) => s.setActuatorValue);
+  const removeDevice = useButtplugStore((s) => s.removeDevice);
   const connectedDevices = useMemo(() => Object.values(devices), [devices]);
 
   const [data, setData] = useState<RecordingResponse | null>(null);
   const [showRemap, setShowRemap] = useState(false);
+  const [starting, setStarting] = useState(false);
   const [player, setPlayer] = useState<RecordingPlayer | null>(null);
   const [playing, setPlaying] = useState(false);
   const [elapsedMs, setElapsedMs] = useState(0);
+  const [replayTargets, setReplayTargets] = useState<{ slotLabel: string; deviceName: string }[]>([]);
+  const [replayDeviceIndexes, setReplayDeviceIndexes] = useState<number[]>([]);
+  const [activeSessionId, setActiveSessionId] = useState<number | null>(null);
 
   useEffect(() => {
     fetch(`/api/recordings/${recordingId}`)
@@ -50,69 +56,111 @@ export function ReplayPlayer({ recordingId }: { recordingId: number }) {
       .catch(() => toast.error("Could not load recording"));
   }, [recordingId]);
 
+  useEffect(() => {
+    return () => {
+      void disconnectAll();
+    };
+  }, []);
+
+  async function resetReplayDevices() {
+    await Promise.all(
+      replayDeviceIndexes.map(async (deviceIndex) => {
+        const liveDevice = await getDevice(deviceIndex);
+        await liveDevice?.stop().catch(() => {});
+        devices[deviceIndex]?.actuators.forEach((a) => setActuatorValue(deviceIndex, a.featureIndex, 0));
+      }),
+    );
+  }
+
   async function handleConfirmRemap(mapping: Map<number, number>) {
     if (!data) return;
     setShowRemap(false);
+    setStarting(true);
 
-    const orderedSlots = data.recording.deviceSlots.filter((s) => mapping.has(s.sourceSessionDeviceId));
+    try {
-    const body = {
+      const orderedSlots = data.recording.deviceSlots.filter((s) => mapping.has(s.sourceSessionDeviceId));
-      kind: "replay" as const,
+      const targets = orderedSlots.map((slot) => {
-      replayedRecordingId: data.recording.id,
-      devices: orderedSlots.map((slot) => {
         const deviceIndex = mapping.get(slot.sourceSessionDeviceId)!;
         const device = connectedDevices.find((d) => d.index === deviceIndex)!;
-        return { slotLabel: slot.slotLabel, bleName: device.name };
+        return { slotLabel: slot.slotLabel, deviceName: device.displayName ?? device.name };
-      }),
+      });
-    };
 
-    const res = await fetch("/api/play-sessions", {
+      const body = {
-      method: "POST",
+        kind: "replay" as const,
-      headers: { "Content-Type": "application/json" },
+        replayedRecordingId: data.recording.id,
-      body: JSON.stringify(body),
+        devices: orderedSlots.map((slot, i) => ({ slotLabel: slot.slotLabel, bleName: targets[i].deviceName })),
-    });
+      };
-    if (!res.ok) {
-      toast.error("Could not start replay session");
-      return;
-    }
-    const result: { session: { id: number; startedAt: number }; sessionDevices: { id: number }[] } =
-      await res.json();
 
-    eventBuffer.start(result.session.id, result.session.startedAt);
+      const res = await fetch("/api/play-sessions", {
-    const sessionDeviceIdToDeviceIndex = new Map<number, number>();
+        method: "POST",
-    orderedSlots.forEach((slot, i) => {
+        headers: { "Content-Type": "application/json" },
-      const deviceIndex = mapping.get(slot.sourceSessionDeviceId)!;
+        body: JSON.stringify(body),
-      const newSessionDeviceId = result.sessionDevices[i]?.id;
+      });
-      if (newSessionDeviceId !== undefined) {
+      if (!res.ok) {
-        eventBuffer.registerSessionDevice(deviceIndex, newSessionDeviceId);
+        toast.error("Could not start replay session");
-        sessionDeviceIdToDeviceIndex.set(slot.sourceSessionDeviceId, deviceIndex);
+        return;
       }
-    });
+      const result: { session: { id: number; startedAt: number }; sessionDevices: { id: number }[] } =
+        await res.json();
 
-    const actuatorsByDeviceIndex = new Map<number, ActuatorInfo[]>(
+      eventBuffer.start(result.session.id, result.session.startedAt);
-      connectedDevices.map((d) => [d.index, d.actuators]),
+      const sessionDeviceIdToDeviceIndex = new Map<number, number>();
-    );
+      orderedSlots.forEach((slot, i) => {
+        const deviceIndex = mapping.get(slot.sourceSessionDeviceId)!;
+        const newSessionDeviceId = result.sessionDevices[i]?.id;
+        if (newSessionDeviceId !== undefined) {
+          eventBuffer.registerSessionDevice(deviceIndex, newSessionDeviceId);
+          sessionDeviceIdToDeviceIndex.set(slot.sourceSessionDeviceId, deviceIndex);
+        }
+      });
 
-    const { runtime } = await getButtplugClientHandle();
+      const actuatorsByDeviceIndex = new Map<number, ActuatorInfo[]>(
-    const instance = new RecordingPlayer({
+        connectedDevices.map((d) => [d.index, d.actuators]),
-      events: data.events,
+      );
-      sessionDeviceIdToDeviceIndex,
+
-      actuatorsByDeviceIndex,
+      // Reset every actuator on every device that will take part in this replay before
-      runtime,
+      // the first scheduled event fires, so playback always starts from a known-zero
-      onProgress: (elapsed) => setElapsedMs(elapsed),
+      // state rather than whatever intensity was left over from manual control.
-      onComplete: async () => {
+      const deviceIndexes = new Set(sessionDeviceIdToDeviceIndex.values());
-        setPlaying(false);
+      await Promise.all(
-        eventBuffer.stop();
+        [...deviceIndexes].map(async (deviceIndex) => {
-        await fetch(`/api/play-sessions/${result.session.id}`, {
+          const liveDevice = await getDevice(deviceIndex);
-          method: "PATCH",
+          await liveDevice?.stop().catch(() => {});
-          headers: { "Content-Type": "application/json" },
+          actuatorsByDeviceIndex.get(deviceIndex)?.forEach((a) => setActuatorValue(deviceIndex, a.featureIndex, 0));
-          body: JSON.stringify({ status: "completed" }),
+        }),
-        });
+      );
-        toast.success("Replay finished");
+
-      },
+      const { runtime } = await getButtplugClientHandle();
-    });
+      const instance = new RecordingPlayer({
-    setPlayer(instance);
+        events: data.events,
-    instance.play();
+        durationMs: data.recording.durationMs,
-    setPlaying(true);
+        sessionDeviceIdToDeviceIndex,
+        actuatorsByDeviceIndex,
+        runtime,
+        onProgress: (elapsed) => setElapsedMs(elapsed),
+        onError: (message) => toast.error(`Replay command failed: ${message}`),
+        onComplete: async () => {
+          setPlaying(false);
+          eventBuffer.stop();
+          await fetch(`/api/play-sessions/${result.session.id}`, {
+            method: "PATCH",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ status: "completed" }),
+          }).catch(() => {});
+          toast.success("Replay finished");
+        },
+      });
+      setReplayTargets(targets);
+      setReplayDeviceIndexes([...deviceIndexes]);
+      setActiveSessionId(result.session.id);
+      setPlayer(instance);
+      instance.play();
+      setPlaying(true);
+    } catch {
+      toast.error("Could not start replay");
+    } finally {
+      setStarting(false);
+    }
   }
 
   if (!data) {
@@ -136,41 +184,98 @@ export function ReplayPlayer({ recordingId }: { recordingId: number }) {
                 <DeviceScanPanel scanning={scanning} onScan={() => void startScanning()} onStopScan={() => void stopScanning()} />
                 <Button
                   onClick={async () => {
-                    await getButtplugClientHandle();
+                    try {
-                    setShowRemap(true);
+                      await getButtplugClientHandle();
+                      setShowRemap(true);
+                    } catch {
+                      toast.error("Could not connect to Buttplug client");
+                    }
                   }}
-                  disabled={connectedDevices.length === 0}
+                  disabled={connectedDevices.length === 0 || starting}
                 >
-                  Match devices & replay
+                  {starting ? "Starting..." : "Match devices & replay"}
                 </Button>
               </div>
             </>
           ) : (
             <div className="flex flex-col gap-3">
+              {replayTargets.length > 0 && (
+                <div className="flex flex-wrap gap-2">
+                  {replayTargets.map((t) => (
+                    <span
+                      key={t.slotLabel}
+                      className="bp-readout rounded-md border border-border bg-card/60 px-2 py-1 text-xs text-muted-foreground"
+                    >
+                      {t.slotLabel} → {t.deviceName}
+                    </span>
+                  ))}
+                </div>
+              )}
               <Slider
                 value={[elapsedMs]}
                 max={data.recording.durationMs}
                 onValueChange={([v]) => player.seek(v)}
               />
               <div className="flex items-center justify-between">
-                <span className="text-xs text-muted-foreground">
+                <span className="bp-readout text-xs text-muted-foreground">
                   {formatTime(elapsedMs)} / {formatTime(data.recording.durationMs)}
                 </span>
-                <Button
+                <div className="flex items-center gap-2">
-                  size="icon"
+                  <Button
-                  variant="outline"
+                    size="icon"
-                  onClick={() => {
+                    variant="outline"
-                    if (playing) {
+                    onClick={async () => {
-                      player.pause();
+                      if (playing) {
+                        player.pause();
+                        setPlaying(false);
+                      } else {
+                        player.play();
+                        setPlaying(true);
+                      }
+                      // Toggling either way leaves the toy holding whatever intensity was
+                      // last sent - zero it out so pause always actually stops the device,
+                      // and resume always starts from a clean, known state.
+                      await resetReplayDevices();
+                    }}
+                    aria-label={playing ? "Pause" : "Play"}
+                  >
+                    {playing ? <Pause className="size-4" /> : <Play className="size-4" />}
+                  </Button>
+                  <Button
+                    size="sm"
+                    variant="ghost"
+                    onClick={async () => {
+                      player.stop();
                       setPlaying(false);
-                    } else {
+                      setElapsedMs(0);
-                      player.play();
+                      eventBuffer.stop();
-                      setPlaying(true);
+                      if (activeSessionId !== null) {
-                    }
+                        await fetch(`/api/play-sessions/${activeSessionId}`, {
-                  }}
+                          method: "PATCH",
-                >
+                          headers: { "Content-Type": "application/json" },
-                  {playing ? <Pause className="size-4" /> : <Play className="size-4" />}
+                          body: JSON.stringify({ status: "aborted" }),
-                </Button>
+                        }).catch(() => {});
+                      }
+                      // Fully disconnect every device that took part in this replay,
+                      // not just stop the player - see handleDisconnectDevice in
+                      // ButtplugConsole for why "stop + remove from store" is the
+                      // closest equivalent Buttplug's protocol allows per-device.
+                      await Promise.all(
+                        replayDeviceIndexes.map(async (deviceIndex) => {
+                          const liveDevice = await getDevice(deviceIndex);
+                          await liveDevice?.stop().catch(() => {});
+                          removeDevice(deviceIndex);
+                        }),
+                      );
+                      setPlayer(null);
+                      setReplayTargets([]);
+                      setReplayDeviceIndexes([]);
+                      setActiveSessionId(null);
+                    }}
+                  >
+                    Stop
+                  </Button>
+                </div>
               </div>
             </div>
           )}

components/sessions/SessionsTable.tsx

@@ -1,13 +1,27 @@
 "use client";
 
+import { useState } from "react";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
 import { Trash2 } from "lucide-react";
 import { toast } from "sonner";
 
+interface BlockingRecording {
+  id: number;
+  name: string;
+}
+
 export interface SessionRow {
   id: number;
   name: string | null;
@@ -27,6 +41,8 @@ function formatDuration(ms: number | null): string {
 
 export function SessionsTable({ sessions }: { sessions: SessionRow[] }) {
   const router = useRouter();
+  const [conflict, setConflict] = useState<{ id: number; recordings: BlockingRecording[] } | null>(null);
+  const [deleting, setDeleting] = useState(false);
 
   async function handleDelete(id: number) {
     const res = await fetch(`/api/play-sessions/${id}`, { method: "DELETE" });
@@ -34,7 +50,22 @@ export function SessionsTable({ sessions }: { sessions: SessionRow[] }) {
       toast.success("Session deleted");
       router.refresh();
     } else if (res.status === 409) {
-      toast.error("A saved recording still references this session");
+      const body: { recordings?: BlockingRecording[] } = await res.json().catch(() => ({}));
+      setConflict({ id, recordings: body.recordings ?? [] });
+    } else {
+      toast.error("Could not delete session");
+    }
+  }
+
+  async function handleCascadeDelete() {
+    if (!conflict) return;
+    setDeleting(true);
+    const res = await fetch(`/api/play-sessions/${conflict.id}?cascade=true`, { method: "DELETE" });
+    setDeleting(false);
+    if (res.ok) {
+      toast.success("Session and recording deleted");
+      setConflict(null);
+      router.refresh();
     } else {
       toast.error("Could not delete session");
     }
@@ -45,41 +76,66 @@ export function SessionsTable({ sessions }: { sessions: SessionRow[] }) {
   }
 
   return (
-    <Table>
+    <>
-      <TableHeader>
+      <Table>
-        <TableRow>
+        <TableHeader>
-          <TableHead>Session</TableHead>
+          <TableRow>
-          <TableHead>Kind</TableHead>
+            <TableHead>Session</TableHead>
-          <TableHead>Status</TableHead>
+            <TableHead>Kind</TableHead>
-          <TableHead>Started</TableHead>
+            <TableHead>Status</TableHead>
-          <TableHead>Duration</TableHead>
+            <TableHead>Started</TableHead>
-          <TableHead className="text-right">Actions</TableHead>
+            <TableHead>Duration</TableHead>
-        </TableRow>
+            <TableHead className="text-right">Actions</TableHead>
-      </TableHeader>
-      <TableBody>
-        {sessions.map((s) => (
-          <TableRow key={s.id}>
-            <TableCell className="font-medium">
-              <Link href={`/sessions/${s.id}`} className="hover:underline">
-                {s.name ?? `Session #${s.id}`}
-              </Link>
-            </TableCell>
-            <TableCell>
-              <Badge variant={s.kind === "live" ? "default" : "secondary"}>{s.kind}</Badge>
-            </TableCell>
-            <TableCell className="text-muted-foreground">{s.status}</TableCell>
-            <TableCell className="bp-readout text-muted-foreground">
-              {new Date(s.startedAt).toLocaleString()}
-            </TableCell>
-            <TableCell className="bp-readout">{formatDuration(s.durationMs)}</TableCell>
-            <TableCell className="text-right">
-              <Button variant="ghost" size="icon-sm" onClick={() => void handleDelete(s.id)} aria-label="Delete">
-                <Trash2 className="size-3.5" />
-              </Button>
-            </TableCell>
           </TableRow>
-        ))}
+        </TableHeader>
-      </TableBody>
+        <TableBody>
-    </Table>
+          {sessions.map((s) => (
+            <TableRow key={s.id}>
+              <TableCell className="font-medium">
+                <Link href={`/sessions/${s.id}`} className="hover:underline">
+                  {s.name ?? `Session #${s.id}`}
+                </Link>
+              </TableCell>
+              <TableCell>
+                <Badge variant={s.kind === "live" ? "default" : "secondary"}>{s.kind}</Badge>
+              </TableCell>
+              <TableCell className="text-muted-foreground">{s.status}</TableCell>
+              <TableCell className="bp-readout text-muted-foreground">
+                {new Date(s.startedAt).toLocaleString()}
+              </TableCell>
+              <TableCell className="bp-readout">{formatDuration(s.durationMs)}</TableCell>
+              <TableCell className="text-right">
+                <Button variant="ghost" size="icon-sm" onClick={() => void handleDelete(s.id)} aria-label="Delete">
+                  <Trash2 className="size-3.5" />
+                </Button>
+              </TableCell>
+            </TableRow>
+          ))}
+        </TableBody>
+      </Table>
+
+      <Dialog open={conflict !== null} onOpenChange={(open) => !open && setConflict(null)}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Delete session and recording?</DialogTitle>
+            <DialogDescription>
+              This session has a saved recording
+              {conflict && conflict.recordings.length > 0
+                ? ` (${conflict.recordings.map((r) => r.name).join(", ")})`
+                : ""}{" "}
+              that still points to it. Deleting the session will also delete that recording.
+            </DialogDescription>
+          </DialogHeader>
+          <DialogFooter>
+            <Button variant="ghost" onClick={() => setConflict(null)}>
+              Cancel
+            </Button>
+            <Button variant="destructive" onClick={() => void handleCascadeDelete()} disabled={deleting}>
+              {deleting ? "Deleting..." : "Delete both"}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </>
   );
 }

components/shared/PageNav.tsx

@@ -0,0 +1,53 @@
+import Link from "next/link";
+import { Button } from "@/components/ui/button";
+import { ChevronLeft, ChevronRight } from "lucide-react";
+
+interface PageNavProps {
+  basePath: string;
+  page: number;
+  pageSize: number;
+  total: number;
+}
+
+export function PageNav({ basePath, page, pageSize, total }: PageNavProps) {
+  const totalPages = Math.max(1, Math.ceil(total / pageSize));
+  if (totalPages <= 1) return null;
+
+  const from = total === 0 ? 0 : (page - 1) * pageSize + 1;
+  const to = Math.min(page * pageSize, total);
+
+  return (
+    <div className="flex items-center justify-between gap-4 pt-2">
+      <span className="bp-readout text-xs text-muted-foreground">
+        {from}-{to} of {total}
+      </span>
+      <div className="flex items-center gap-2">
+        {page > 1 ? (
+          <Button asChild variant="outline" size="icon-sm">
+            <Link href={`${basePath}?page=${page - 1}`} aria-label="Previous page">
+              <ChevronLeft className="size-3.5" />
+            </Link>
+          </Button>
+        ) : (
+          <Button variant="outline" size="icon-sm" disabled aria-label="Previous page">
+            <ChevronLeft className="size-3.5" />
+          </Button>
+        )}
+        <span className="bp-readout text-xs text-muted-foreground">
+          {page} / {totalPages}
+        </span>
+        {page < totalPages ? (
+          <Button asChild variant="outline" size="icon-sm">
+            <Link href={`${basePath}?page=${page + 1}`} aria-label="Next page">
+              <ChevronRight className="size-3.5" />
+            </Link>
+          </Button>
+        ) : (
+          <Button variant="outline" size="icon-sm" disabled aria-label="Next page">
+            <ChevronRight className="size-3.5" />
+          </Button>
+        )}
+      </div>
+    </div>
+  );
+}

instrumentation.ts

@@ -1,3 +1,5 @@
+import { createLogger } from "@/lib/logger";
+
 export async function register() {
   // Only the Node.js server runtime touches better-sqlite3; the Edge
   // middleware runtime must never import this module.
@@ -6,3 +8,26 @@ export async function register() {
     runMigrations();
   }
 }
+
+export async function onRequestError(
+  error: unknown,
+  request: { path: string; method: string; headers: Record<string, string | string[]> },
+  context: { routerKind: string; routePath: string; routeType: string },
+) {
+  const log = createLogger("uncaught");
+
+  // Safety net for errors that escape a route handler's own try/catch (e.g. a
+  // bug in code that never reaches withRouteLogging, or a rendering error) -
+  // route handlers wrapped in withRouteLogging already log and convert their
+  // own errors to a JSON 500, so this rarely double-logs the same failure.
+  const digest = typeof error === "object" && error !== null && "digest" in error ? String(error.digest) : undefined;
+  log.error("unhandled error", {
+    message: error instanceof Error ? error.message : String(error),
+    digest,
+    stack: error instanceof Error ? error.stack : undefined,
+    path: request.path,
+    method: request.method,
+    routePath: context.routePath,
+    routeType: context.routeType,
+  });
+}

lib/api/with-route-logging.ts

@@ -0,0 +1,43 @@
+import { NextResponse } from "next/server";
+import { randomUUID } from "node:crypto";
+import { createLogger } from "@/lib/logger";
+
+const log = createLogger("api");
+
+type RouteHandler<Ctx> = (req: Request, ctx: Ctx) => Promise<Response> | Response;
+
+/**
+ * Wraps an App Router route handler with consistent request/response logging:
+ * a reqId (also echoed as `x-request-id`), method/path, status, and duration on
+ * every call, plus a logged stack trace and JSON 500 for anything the handler
+ * doesn't catch itself. Every export in app/api/** goes through this so log
+ * shape and error handling stay uniform across routes instead of being
+ * reimplemented per file.
+ */
+export function withRouteLogging<Ctx = unknown>(routeName: string, handler: RouteHandler<Ctx>): RouteHandler<Ctx> {
+  return async (req, ctx) => {
+    const reqId = randomUUID();
+    const start = performance.now();
+    const { pathname, search } = new URL(req.url);
+    const reqLog = log.child({ reqId, route: routeName, method: req.method });
+
+    reqLog.debug("request start", { path: pathname + search });
+
+    try {
+      const res = await handler(req, ctx);
+      const durationMs = Math.round(performance.now() - start);
+      const level = res.status >= 500 ? "error" : res.status >= 400 ? "warn" : "info";
+      reqLog[level]("request end", { status: res.status, durationMs });
+      res.headers.set("x-request-id", reqId);
+      return res;
+    } catch (err) {
+      const durationMs = Math.round(performance.now() - start);
+      reqLog.error("request failed", {
+        durationMs,
+        error: err instanceof Error ? err.message : String(err),
+        stack: err instanceof Error ? err.stack : undefined,
+      });
+      return NextResponse.json({ error: "internal error", reqId }, { status: 500 });
+    }
+  };
+}

lib/buttplug/player.ts

@@ -14,6 +14,11 @@ export interface RecordingEventRow {
 
 export interface PlayerOptions {
   events: RecordingEventRow[];
+  /** The recording's actual duration (recordings.durationMs from the DB) - this is the source
+   *  of truth for playback length, NOT the last event's timestamp: a recording can run for a
+   *  while after its last command (e.g. the user stopped the toy but let the session continue),
+   *  so deriving duration from events would end playback early and misreport it as "finished". */
+  durationMs: number;
   /** Recording's session_device_id -> currently-connected device index, from the remap step. */
   sessionDeviceIdToDeviceIndex: Map<number, number>;
   actuatorsByDeviceIndex: Map<number, ActuatorInfo[]>;
@@ -21,6 +26,7 @@ export interface PlayerOptions {
   speed?: number;
   onProgress?: (elapsedMs: number, durationMs: number) => void;
   onComplete?: () => void;
+  onError?: (message: string) => void;
 }
 
 /**
@@ -37,7 +43,7 @@ export class RecordingPlayer {
   private playing = false;
 
   constructor(private readonly options: PlayerOptions) {
-    this.durationMs = options.events.at(-1)?.tsMs ?? 0;
+    this.durationMs = options.durationMs;
   }
 
   get isPlaying(): boolean {
@@ -108,29 +114,32 @@ export class RecordingPlayer {
     const deviceIndex = this.options.sessionDeviceIdToDeviceIndex.get(event.sessionDeviceId);
     if (deviceIndex === undefined) return;
 
-    const device = await getDevice(deviceIndex);
+    try {
-    if (!device) return;
+      const device = await getDevice(deviceIndex);
+      if (!device) return;
 
-    eventBuffer.record({
+      if (event.commandType === "stop") {
-      deviceIndex,
+        await device.stop();
-      commandType: event.commandType,
+      } else {
-      featureIndex: event.featureIndex,
+        const actuator = this.options.actuatorsByDeviceIndex
-      value: event.value,
+          .get(deviceIndex)
-      durationMs: event.durationMs ?? undefined,
+          ?.find((a) => a.featureIndex === event.featureIndex);
-    });
+        const feature = findFeature(device, event.featureIndex);
+        if (!actuator || !feature) return;
 
-    if (event.commandType === "stop") {
+        const cmd = buildOutputCommand(this.options.runtime, actuator, event.value, event.durationMs ?? undefined);
-      await device.stop();
+        await feature.runOutput(cmd);
-      return;
+      }
+
+      eventBuffer.record({
+        deviceIndex,
+        commandType: event.commandType,
+        featureIndex: event.featureIndex,
+        value: event.value,
+        durationMs: event.durationMs ?? undefined,
+      });
+    } catch (err) {
+      this.options.onError?.(err instanceof Error ? err.message : String(err));
     }
-
-    const actuator = this.options.actuatorsByDeviceIndex
-      .get(deviceIndex)
-      ?.find((a) => a.featureIndex === event.featureIndex);
-    const feature = findFeature(device, event.featureIndex);
-    if (!actuator || !feature) return;
-
-    const cmd = buildOutputCommand(this.options.runtime, actuator, event.value, event.durationMs ?? undefined);
-    await feature.runOutput(cmd);
   }
 }

lib/buttplug/store.ts

@@ -7,6 +7,8 @@ export const actuatorKey = (deviceIndex: number, featureIndex: number): string =
 interface ButtplugStoreState {
   connected: boolean;
   scanning: boolean;
+  /** Whether a play session is actively being recorded (see ButtplugConsole's session lifecycle). */
+  recording: boolean;
   devices: Record<number, ConnectedDeviceInfo>;
   /** Last-known slider value per `${deviceIndex}:${featureIndex}`, for UI display only. */
   actuatorValues: Record<string, number>;
@@ -15,6 +17,7 @@ interface ButtplugStoreState {
   error: string | null;
   setConnected: (connected: boolean) => void;
   setScanning: (scanning: boolean) => void;
+  setRecording: (recording: boolean) => void;
   upsertDevice: (device: ConnectedDeviceInfo) => void;
   removeDevice: (index: number) => void;
   setActuatorValue: (deviceIndex: number, featureIndex: number, value: number) => void;
@@ -26,12 +29,14 @@ interface ButtplugStoreState {
 export const useButtplugStore = create<ButtplugStoreState>((set) => ({
   connected: false,
   scanning: false,
+  recording: false,
   devices: {},
   actuatorValues: {},
   batteryLevels: {},
   error: null,
   setConnected: (connected) => set({ connected }),
   setScanning: (scanning) => set({ scanning }),
+  setRecording: (recording) => set({ recording }),
   upsertDevice: (device) => set((s) => ({ devices: { ...s.devices, [device.index]: device } })),
   removeDevice: (index) =>
     set((s) => {
@@ -48,5 +53,6 @@ export const useButtplugStore = create<ButtplugStoreState>((set) => ({
   setBatteryLevel: (deviceIndex, level) =>
     set((s) => ({ batteryLevels: { ...s.batteryLevels, [deviceIndex]: level } })),
   setError: (message) => set({ error: message }),
-  reset: () => set({ connected: false, scanning: false, devices: {}, actuatorValues: {}, batteryLevels: {} }),
+  reset: () =>
+    set({ connected: false, scanning: false, recording: false, devices: {}, actuatorValues: {}, batteryLevels: {} }),
 }));

lib/db/queries/devices.ts

@@ -1,11 +1,23 @@
-import { eq } from "drizzle-orm";
+import { desc, eq, sql } from "drizzle-orm";
 import { db } from "@/lib/db/client";
 import { devices, type DeviceCapabilities } from "@/lib/db/schema";
+import { PAGE_SIZE, type Page } from "@/lib/pagination";
 
 export async function listDevices() {
   return db.select().from(devices).orderBy(devices.lastConnectedAt);
 }
 
+export async function listDevicesPage(page: number, pageSize = PAGE_SIZE): Promise<Page<typeof devices.$inferSelect>> {
+  const [{ count }] = await db.select({ count: sql<number>`count(*)` }).from(devices);
+  const items = await db
+    .select()
+    .from(devices)
+    .orderBy(desc(devices.lastConnectedAt))
+    .limit(pageSize)
+    .offset((page - 1) * pageSize);
+  return { items, page, pageSize, total: count };
+}
+
 export async function getDevice(id: number) {
   const [row] = await db.select().from(devices).where(eq(devices.id, id));
   return row;

lib/db/queries/play-sessions.ts

@@ -1,9 +1,10 @@
-import { eq } from "drizzle-orm";
+import { desc, eq, sql } from "drizzle-orm";
 import { db } from "@/lib/db/client";
-import { playSessions, sessionDevices, devices } from "@/lib/db/schema";
+import { playSessions, sessionDevices, devices, recordings } from "@/lib/db/schema";
 import { upsertDeviceByBleName } from "./devices";
 import { incrementPlayCount } from "./recordings";
 import type { DeviceCapabilities } from "@/lib/db/schema";
+import { PAGE_SIZE, type Page } from "@/lib/pagination";
 
 export interface StartSessionDeviceInput {
   slotLabel: string;
@@ -86,6 +87,23 @@ export async function listPlaySessions() {
   return db.select().from(playSessions).orderBy(playSessions.startedAt);
 }
 
+export async function listPlaySessionsPage(page: number, pageSize = PAGE_SIZE): Promise<Page<typeof playSessions.$inferSelect>> {
+  const [{ count }] = await db.select({ count: sql<number>`count(*)` }).from(playSessions);
+  const items = await db
+    .select()
+    .from(playSessions)
+    .orderBy(desc(playSessions.startedAt))
+    .limit(pageSize)
+    .offset((page - 1) * pageSize);
+  return { items, page, pageSize, total: count };
+}
+
+/** Lightweight name-only lookup for page titles - avoids getPlaySessionDetail's device join. */
+export async function getPlaySessionName(id: number): Promise<string | null | undefined> {
+  const [row] = await db.select({ name: playSessions.name }).from(playSessions).where(eq(playSessions.id, id));
+  return row?.name;
+}
+
 export async function getPlaySessionDetail(id: number) {
   const [session] = await db.select().from(playSessions).where(eq(playSessions.id, id));
   if (!session) return undefined;
@@ -107,6 +125,9 @@ export async function getPlaySessionDetail(id: number) {
   return { session, devices: sessionDeviceRows };
 }
 
-export async function deletePlaySession(id: number) {
+export async function deletePlaySession(id: number, options?: { cascade?: boolean }) {
+  if (options?.cascade) {
+    await db.delete(recordings).where(eq(recordings.sourcePlaySessionId, id));
+  }
   await db.delete(playSessions).where(eq(playSessions.id, id));
 }

lib/db/queries/recordings.ts

@@ -1,7 +1,8 @@
-import { desc, eq } from "drizzle-orm";
+import { desc, eq, sql } from "drizzle-orm";
 import { db } from "@/lib/db/client";
 import { recordings, sessionDevices, devices, playSessions, type RecordingDeviceSlot } from "@/lib/db/schema";
 import { getEventsForSession } from "./session-events";
+import { PAGE_SIZE, type Page } from "@/lib/pagination";
 
 /**
  * A recording is a thin pointer over an already-captured play_session, not a
@@ -60,6 +61,30 @@ export async function listRecordings() {
   return db.select().from(recordings).orderBy(desc(recordings.createdAt));
 }
 
+export async function listRecordingsPage(page: number, pageSize = PAGE_SIZE): Promise<Page<typeof recordings.$inferSelect>> {
+  const [{ count }] = await db.select({ count: sql<number>`count(*)` }).from(recordings);
+  const items = await db
+    .select()
+    .from(recordings)
+    .orderBy(desc(recordings.createdAt))
+    .limit(pageSize)
+    .offset((page - 1) * pageSize);
+  return { items, page, pageSize, total: count };
+}
+
+export async function getRecordingsForSession(playSessionId: number) {
+  return db
+    .select({ id: recordings.id, name: recordings.name })
+    .from(recordings)
+    .where(eq(recordings.sourcePlaySessionId, playSessionId));
+}
+
+/** Lightweight name-only lookup for page titles - avoids getRecording's event-table join. */
+export async function getRecordingName(id: number): Promise<string | undefined> {
+  const [row] = await db.select({ name: recordings.name }).from(recordings).where(eq(recordings.id, id));
+  return row?.name;
+}
+
 export async function getRecording(id: number) {
   const [recording] = await db.select().from(recordings).where(eq(recordings.id, id));
   if (!recording) return undefined;

lib/logger.ts

@@ -34,14 +34,21 @@ export interface Logger {
   info(message: string, fields?: LogFields): void;
   warn(message: string, fields?: LogFields): void;
   error(message: string, fields?: LogFields): void;
+  /** Returns a logger that merges `bindings` into every call's fields - for attaching
+   * per-request context (reqId, route) without threading it through every log call. */
+  child(bindings: LogFields): Logger;
 }
 
 /** Scoped logger. `scope` is the bracketed tag, e.g. createLogger("api") -> "[api]". */
-export function createLogger(scope: string): Logger {
+export function createLogger(scope: string, bindings?: LogFields): Logger {
+  const log = (level: LogLevel, message: string, fields?: LogFields) =>
+    write(level, scope, message, bindings || fields ? { ...bindings, ...fields } : undefined);
+
   return {
-    debug: (message, fields) => write("debug", scope, message, fields),
+    debug: (message, fields) => log("debug", message, fields),
-    info: (message, fields) => write("info", scope, message, fields),
+    info: (message, fields) => log("info", message, fields),
-    warn: (message, fields) => write("warn", scope, message, fields),
+    warn: (message, fields) => log("warn", message, fields),
-    error: (message, fields) => write("error", scope, message, fields),
+    error: (message, fields) => log("error", message, fields),
+    child: (extra) => createLogger(scope, { ...bindings, ...extra }),
   };
 }

lib/pagination.ts

@@ -0,0 +1,13 @@
+export const PAGE_SIZE = 20;
+
+export function parsePage(value: string | string[] | undefined): number {
+  const n = Number(Array.isArray(value) ? value[0] : value);
+  return Number.isInteger(n) && n > 0 ? n : 1;
+}
+
+export interface Page<T> {
+  items: T[];
+  page: number;
+  pageSize: number;
+  total: number;
+}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sexy",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "private": true,
   "scripts": {
     "dev": "next dev",

proxy.ts

@@ -1,5 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
 import { SESSION_COOKIE_NAME, verifySessionToken } from "@/lib/auth/session";
+import { createLogger } from "@/lib/logger";
+
+const log = createLogger("auth");
 
 export default async function proxy(req: NextRequest) {
   const { pathname } = req.nextUrl;
@@ -13,9 +16,11 @@ export default async function proxy(req: NextRequest) {
   }
 
   if (pathname.startsWith("/api/")) {
+    log.warn("rejected unauthenticated request", { path: pathname, method: req.method });
     return NextResponse.json({ error: "unauthorized" }, { status: 401 });
   }
 
+  log.warn("redirecting unauthenticated request to login", { path: pathname });
   const loginUrl = new URL("/login", req.url);
   loginUrl.searchParams.set("from", pathname);
   return NextResponse.redirect(loginUrl);