fix(hub): stop badging every poster "unmatched" when TMDB is off

The dashed warning outline and the "?" flag say a TMDB lookup ran and came
back with nothing — that is how an operator finds the titles worth a "Fix
match". With TMDB switched off for the group no lookup is made at all:
media_meta_req answers confidence 0 for the whole library by design, so the
poster grid drew every card as a failure of the very thing the operator
chose, with no poster ever coming to clear it.

Poster mode now shows the file's own thumbnail plainly in that case, the
same as Flat does, and keeps the badge for what it was built for.

- PosterCard takes tmdbEnabled and gates both the outline and the "?" on
  `tmdbEnabled && !confident`. The title still falls back to the parsed
  filename exactly as before, and the ready/imageReady anti-flash gating is
  untouched.
- VideoDetailModal gates its "no confident match" paragraph the same way. A
  show still opens that modal with TMDB off — it is where the season list
  lives — so the card alone would have left the claim one click deeper.
- Its operator-only "Fix match" / "Rematch" buttons are gated too: both act
  on a match that does not exist, one opening a search the node answers
  empty, the other dropping a cached match never made. Those buttons are the
  only entry points to TmdbSearchOverlay and doRematch.
- Both props default to true, so a call site that forgets one keeps the badge
  rather than silently losing it.

search-page.js is deliberately left passing `enabled: true`: a cross-group
view has no single group's switch to read, and it never showed the operator
buttons anyway (isNodeAdmin={false}).

Recorded as §10.7 in docs/mediacenter.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V8EDjk6pkYZrCbo63m2x87

1 files changed, 45 insertions, 0 deletions

diff --git a/docs/mediacenter.md b/docs/mediacenter.md
index d714366..2b25011 100644
--- a/docs/mediacenter.md
+++ b/docs/mediacenter.md
@@ -947,6 +947,51 @@ Full design, the adversary this names, and what must not change:
 `docs/refactoring-search.md`. `test_search_source_merge.py` holds the rules,
 `test_search_media_merge.py` holds this symptom end to end.
 
+### 10.7 Every card badged "unmatched" when TMDB is off (2026-09-08)
+
+§10.1 gave an unmatched poster a badge: a dashed warning outline on the card
+plus a `?` next to the title, with `video.no_match` ("no confident TMDB match
+— showing the filename") as its tooltip, and the same sentence again at the
+top of the detail modal. That is a useful signal — it is how an operator finds
+the titles worth a "Fix match".
+
+It says the wrong thing when the group's operator has turned TMDB **off**
+(§5.5's per-group switch). No lookup was made, so nothing failed to match;
+`media_meta_req` answers `confidence: 0` for the whole library by design
+(`webrtc_server._do_media_meta_request`, the same silent degradation as "no
+client configured"). The poster grid therefore drew *every* card as a failure
+of the very thing the operator chose, and no poster was ever going to arrive
+to clear it.
+
+Poster mode now presents the file's own thumbnail plainly in that case —
+what Mode B (§4.2) does — and keeps the badge for what it was built for, a
+lookup that ran and came back with nothing:
+
+- `PosterCard` takes `tmdbEnabled` and derives `flagUnmatched = tmdbEnabled &&
+  !confident`, which gates both `video-card-unmatched` and the `?` span. The
+  title still falls back to the parsed filename exactly as before.
+- `VideoDetailModal` takes it too and gates its `video-detail-nomatch`
+  paragraph. A **show** still opens that modal with TMDB off — it is where the
+  season list lives, unlike a movie, which §V12's `onOpen` already sends
+  straight to the player — so suppressing it on the card alone would have left
+  the same claim one click deeper.
+- Both default the prop to `true`, so a call site that forgets it keeps the
+  badge rather than silently losing it.
+- The modal's operator-only **"Fix match" / "Rematch"** buttons are gated on
+  `isNodeAdmin && tmdbEnabled` for the same reason one step further on: both
+  act on a TMDB match that, with the switch off, does not exist. "Fix match"
+  opened a search the node answers with an empty result list (§5.7's silent
+  degradation) and "Rematch" dropped a cached match that was never made — two
+  dead buttons offered to the one person who already knows why. Nothing else
+  reaches `TmdbSearchOverlay` or `doRematch`; those buttons are their only
+  entry points, so gating them here is the whole change.
+
+Deliberately unchanged: `search-page.js` passes `tmdbConfig={{ enabled: true }}`
+because a cross-group view has no single group's switch to read, so a merged
+card there still badges — and, being `readOnly`/`isNodeAdmin={false}`, it never
+showed the operator buttons in the first place.
+
+
 ## 11. Acceptance before shipping
 
 1. Re-run the §3 validation (real TMDB calls, same corpus, same script