- downloads.js: use durationMs (Spotify) before trackTimeMillis (iTunes) - server: read durationMs from top-level body, not only from tracks[0] - server: also grab durationMs + trackNum from iTunes in the Spotify path Without durationMs the duration filter never ran, allowing a 58s fan video to pass all text filters and be downloaded instead of the actual song. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>