fix(library): order album detail tracks by disc then track number (#1332)

* fix(library): order album detail tracks by disc then track number

Multi-disc album detail ordered tracks by track_number before disc_number, so
Play-All queued them interleaved (D1T1, D2T1, D1T2, D2T2, ...) instead of disc 1
in full, then disc 2. Order by (disc_number, track_number), matching the existing
convention in repos/track.rs. Adds a regression test.

* docs(changelog): note multi-disc album play order fix (#1332)

* fix(library): treat missing disc number as disc 1 in album ordering

Follow-up review. Album track ordering sorted NULL disc numbers last, but the
album UI renders a missing disc as disc 1 (discNumber ?? 1), so an untagged
disc-1 track was shown under Disc 1 while Play-All started with an explicit
disc 2. Order both album-track loaders — the scoped merge query and the direct
find_by_album query — by COALESCE(disc_number, 1), with id as the final
tie-break so equal disc/track metadata is deterministic across both paths.
Extends the regression test with a NULL-disc track and a duplicate disc/track
pair.

* fix(library): make album track order total across servers, cover direct loader

Re-review follow-up. The scoped album loader's `id` tie-break is only
server-local (the track primary key is (server_id, id)), so two cross-server
tracks surviving a merged album could tie on disc/track/id and be returned in an
arbitrary order. Add `server_id ASC` as the final key in both album-track loaders
so the Play-All order is total. Strengthen the direct find_by_album test to cover
the missing-disc (COALESCE) and duplicate-position (id) cases, and add a
multi-server regression asserting the tie resolves deterministically by server_id.

.dependency-cruiser.cjs

@@ -0,0 +1,91 @@
+// Architecture / layering guard for the feature-folder structure (PR #1225, group A1).
+//
+// Encodes the layering contract the restructure established:
+//
+//   lib                     (feature-free infra: api clients, format, i18n, util, media, server, navigation)
+//     ▲
+//   store / ui              (cross-cutting global stores; domain-agnostic primitives) — may import lib
+//     ▲
+//   cover / music-network   (top-level domains — peers; may import lib, store, ui)
+//     ▲
+//   features/<x>            (may import lib, store, ui, cover, music-network, other features via barrel only)
+//     ▲
+//   app                     (shell + bridges — may import anything)
+//
+// A lower layer may NOT import a higher one. Cross-feature access goes through the
+// `@/features/<x>` barrel only, never a deep path. No import cycles anywhere.
+//
+// Ratchet: current known violations (residual legacy dirs + documented inversions) are
+// captured in `.dependency-cruiser-known-violations.json` and ignored via `--ignore-known`
+// (see `npm run dep:check`). Any NEW violation fails CI. As the drain (group E) removes an
+// exception, regenerate the baseline so the count ratchets toward zero.
+
+/** @type {import('dependency-cruiser').IConfiguration} */
+module.exports = {
+  forbidden: [
+    {
+      name: 'no-circular',
+      severity: 'error',
+      comment: 'No import cycles anywhere under src/ — they make the module graph impossible to reason about.',
+      from: {},
+      to: { circular: true },
+    },
+    {
+      name: 'lib-is-the-floor',
+      severity: 'error',
+      comment:
+        'lib/** is feature-free infra and must not import a higher layer ' +
+        '(features, store, ui, app, cover, music-network).',
+      from: { path: '^src/lib/' },
+      to: { path: '^src/(features|store|ui|app|cover|music-network)/' },
+    },
+    {
+      name: 'no-core-to-feature',
+      severity: 'error',
+      comment:
+        'store/** and ui/** are cross-cutting core and must not import features or the app shell ' +
+        '(the inversions the seams removed — keep them out).',
+      from: { path: '^src/(store|ui)/' },
+      to: { path: '^src/(features|app)/' },
+    },
+    {
+      name: 'no-deep-cross-feature',
+      severity: 'error',
+      comment:
+        'A feature must reach another feature only through its `@/features/<x>` barrel (index), ' +
+        'never a deep path. Same-feature deep imports are fine.',
+      from: { path: '^src/features/([^/]+)/' },
+      to: {
+        path: '^src/features/([^/]+)/[^/]+',
+        pathNot: [
+          '^src/features/$1/', // same feature — allowed
+          '^src/features/[^/]+/index\\.(ts|tsx)$', // the barrel — allowed
+        ],
+      },
+    },
+  ],
+  options: {
+    doNotFollow: { path: 'node_modules' },
+    // Type-only edges are tolerated by the iron rule (erased at runtime), but the ratchet
+    // records whatever exists today regardless of kind; new edges of any kind fail.
+    tsPreCompilationDeps: true,
+    tsConfig: { fileName: 'tsconfig.json' },
+    enhancedResolveOptions: {
+      extensions: ['.ts', '.tsx', '.js', '.jsx', '.json'],
+      mainFields: ['module', 'main', 'types', 'typings'],
+    },
+    // The layering contract is about the production module graph. Tests, test helpers,
+    // ambient declarations and non-src trees are not part of it.
+    exclude: {
+      path: [
+        '\\.test\\.(ts|tsx)$',
+        '^src/test/',
+        '\\.d\\.ts$',
+        '^src/vite-env',
+      ],
+    },
+    reporterOptions: {
+      text: { highlightFocused: true },
+    },
+  },
+};

.github/dependabot.yml

@@ -0,0 +1,46 @@
+# Dependabot: security updates only (no scheduled version bumps).
+#
+# Version updates are disabled via open-pull-requests-limit: 0. GitHub still opens
+# PRs when Dependabot/npm/cargo audit reports a vulnerability (and related
+# transitive fixes in the same bump). Routine minor/patch upgrades are manual.
+#
+# Requires "Dependabot security updates" enabled in repo Settings → Code security.
+
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 0
+    labels:
+      - dependencies
+      - security
+    groups:
+      npm-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: cargo
+    directory: /src-tauri
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 0
+    labels:
+      - dependencies
+      - security
+    groups:
+      cargo-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+    ignore:
+      # Symphonia 0.6 is a coordinated migration (API break + isomp4 patch port).
+      # See workdocs: internal/collaboration/tasks/2026-05-symphonia-0.6-migration/
+      - dependency-name: symphonia
+        versions: [">= 0.6"]
+      - dependency-name: symphonia-adapter-libopus
+        versions: [">= 0.3"]

.github/frontend-hot-path-files.txt

@@ -3,13 +3,8 @@
 # Mirrors `.github/hot-path-files.txt` for the Rust crates. Each entry is a
 # workspace-relative path; the gate script (`scripts/check-frontend-hot-path-
 # coverage.sh`) reads `coverage/coverage-summary.json` produced by
-# `vitest run --coverage` and warns when a listed file drops below the floor.
-#
-# Soft today (warnings only — the workflow carries `continue-on-error: true`).
-# Flip to a hard PR-blocker by removing `continue-on-error` from the
-# `frontend-tests` workflow at the start of M4 in the pre-refactor testing
-# plan (2026-05-11), once Phase 1–3 characterization tests have proven the
-# gate stable on a handful of real PRs.
+# `vitest run --coverage` and fails the frontend-tests coverage job when a
+# listed file drops below the floor.
 #
 # Curation rule (mirrors the backend list): a file belongs here when its
 # hot-path code dominates the file and ≥70 % is a reasonable floor. Files
@@ -18,25 +13,29 @@
 # OUTSIDE the gate until their tests grow. Add them as Phase 1–4 coverage
 # work lands.
 #
+# Paths follow the feature-folder layout (`src/features/**`, `src/lib/**`,
+# `src/cover/**`) after the frontend restructure; the files below moved out
+# of the old `src/utils/**` tree but their contents are unchanged.
+#
 # Deferred from the gate, with current coverage shown for reference:
-#   - src/store/playerStore.ts           (40 % — F1 closed under the 50 % floor; further coverage TBD)
+#   - src/features/playback/store/playerStore.ts  (40 % — F1 closed under the 50 % floor; further coverage TBD)
 #   - src/store/authStore.ts             (79 % — F2 cleared 60 % floor; staying out one or two PRs to verify stability)
-#   - src/api/subsonic.ts                (13 % — F3 covered the URL-builder + parser surface; async API endpoints need axios mocking, deferred)
+#   - src/lib/api/subsonic.ts            (13 % — F3 covered the URL-builder + parser surface; async API endpoints need axios mocking, deferred)
 
-# ── utils (already at or above threshold) ────────────────────────────
-src/utils/cover/coverArtRegisteredSizes.ts
-src/utils/server/serverDisplayName.ts
-src/utils/server/serverMagicString.ts
-src/utils/share/shareLink.ts
-src/utils/ui/dynamicColors.ts
-src/utils/playback/resolvePlaybackUrl.ts
-src/utils/share/copyEntityShareLink.ts
+# ── extracted helpers (already at or above threshold) ────────────────
+src/cover/coverArtRegisteredSizes.ts
+src/lib/server/serverDisplayName.ts
+src/lib/server/serverMagicString.ts
+src/lib/share/shareLink.ts
+src/lib/dom/dynamicColors.ts
+src/features/playback/utils/playback/resolvePlaybackUrl.ts
+src/lib/share/copyEntityShareLink.ts
 
 # ── M0: pure helpers extracted from playerStore.ts (2026-05-12) ──────
-src/utils/playback/shuffleArray.ts
-src/utils/audio/resolveReplayGainDb.ts
-src/utils/playback/songToTrack.ts
-src/utils/playback/buildInfiniteQueueCandidates.ts
+src/lib/util/shuffleArray.ts
+src/features/playback/utils/audio/resolveReplayGainDb.ts
+src/lib/media/songToTrack.ts
+src/features/playback/utils/playback/buildInfiniteQueueCandidates.ts
 
 # ── Phase B.1: pre-React bootstrap + window-kind detector (2026-05-12) ──
 src/app/windowKind.ts
@@ -46,4 +45,4 @@ src/app/bootstrap.ts
 src/app/MiniPlayerApp.tsx
 
 # ── stores (added as their tests grew past the floor) ────────────────
-src/store/previewStore.ts
+src/features/playback/store/previewStore.ts

.github/hot-path-files.txt

@@ -20,8 +20,7 @@
 #
 # Each line is a path relative to the workspace root (so `src-tauri/...`).
 # `#` for comments. CI runs cargo-llvm-cov + this gate; PRs that drop
-# any listed file below the threshold get a warning annotation today
-# and (after watching it run cleanly) eventually a hard fail.
+# any listed file below the threshold fail the rust-tests coverage job.
 
 # ── psysonic-syncfs ──────────────────────────────────────────────────
 src-tauri/crates/psysonic-syncfs/src/cache/fs_utils.rs

.github/scripts/ci-ok-aggregate.mjs

@@ -0,0 +1,231 @@
+/**
+ * Path-aware ci-ok gate: wait for required workflow job checks on a ref, then pass
+ * or fail. Mirrors path filters in frontend-tests.yml, eslint.yml, rust-tests.yml.
+ */
+
+const FRONTEND_PATH_RE =
+  /^(src\/|package\.json$|package-lock\.json$|vitest\.config\.ts$|vite\.config\.ts$|tsconfig\.json$|eslint\.config\.mjs$|\.dependency-cruiser\.cjs$|\.dependency-cruiser-known-violations\.json$|\.github\/workflows\/frontend-tests\.yml$|\.github\/workflows\/eslint\.yml$|\.github\/frontend-hot-path-files\.txt$|scripts\/check-frontend-hot-path-coverage\.sh$|scripts\/check-css-import-graph\.mjs$)/;
+
+const RUST_PATH_RE = /^(src-tauri\/|\.github\/workflows\/rust-tests\.yml$)/;
+
+const FRONTEND_JOBS = [
+  'vitest run',
+  'tsc --noEmit',
+  'vitest --coverage (baseline + hot-path file gate)',
+  'eslint',
+  'dependency-cruiser',
+];
+
+const RUST_JOBS = [
+  'cargo test --workspace',
+  'cargo clippy --workspace',
+  'cargo llvm-cov (baseline + hot-path file gate)',
+];
+
+const POLL_MS = 30_000;
+const TIMEOUT_MS = 90 * 60 * 1000;
+const OK_CONCLUSIONS = new Set(['success', 'neutral', 'skipped']);
+
+/**
+ * GitHub API hiccups (5xx, secondary rate limits, dropped connections) must
+ * not fail the gate — the answer is to poll again, not to go red while the
+ * real jobs are green. 4xx config errors (401/404 …) still throw.
+ */
+export function isTransientApiError(err) {
+  const status = typeof err?.status === 'number' ? err.status : 0;
+  return status === 0 || status === 429 || status >= 500;
+}
+
+export async function withTransientRetry(label, fn, core, attempts = 5, delayMs = POLL_MS) {
+  for (let attempt = 1; ; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      if (!isTransientApiError(err) || attempt >= attempts) {
+        throw err;
+      }
+      // err.message can be a whole HTML error page — log only the status.
+      core.info(
+        `${label}: transient API error (status=${err?.status ?? 'network'}), retry ${attempt}/${attempts - 1} in ${delayMs / 1000}s`,
+      );
+      await new Promise((resolve) => setTimeout(resolve, delayMs));
+    }
+  }
+}
+
+export function pathTriggersFrontend(file) {
+  return FRONTEND_PATH_RE.test(file);
+}
+
+export function pathTriggersRust(file) {
+  return RUST_PATH_RE.test(file);
+}
+
+export function requiredJobNames(changedFiles) {
+  const names = [];
+  if (changedFiles.some(pathTriggersFrontend)) {
+    names.push(...FRONTEND_JOBS);
+  }
+  if (changedFiles.some(pathTriggersRust)) {
+    names.push(...RUST_JOBS);
+  }
+  return names;
+}
+
+export function newestChecksByName(checks, excludeRunId) {
+  const newest = new Map();
+  for (const check of checks) {
+    if (excludeRunId && (check.details_url || '').includes(`/actions/runs/${excludeRunId}/`)) {
+      continue;
+    }
+    const key = check.name;
+    const prev = newest.get(key);
+    if (!prev) {
+      newest.set(key, check);
+      continue;
+    }
+    const prevTime = Date.parse(prev.started_at || prev.completed_at || '') || 0;
+    const curTime = Date.parse(check.started_at || check.completed_at || '') || 0;
+    if (curTime >= prevTime) {
+      newest.set(key, check);
+    }
+  }
+  return newest;
+}
+
+export function evaluateRequiredJobs(required, newestByName) {
+  const pending = [];
+  const failures = [];
+
+  for (const name of required) {
+    const latest = newestByName.get(name);
+    if (!latest) {
+      pending.push(`${name}: not started`);
+      continue;
+    }
+    if (latest.status !== 'completed') {
+      pending.push(`${name}: status=${latest.status}`);
+      continue;
+    }
+    if (!OK_CONCLUSIONS.has(latest.conclusion || '')) {
+      failures.push(`${name}: conclusion=${latest.conclusion}`);
+    }
+  }
+
+  return { pending, failures, done: pending.length === 0 && failures.length === 0 };
+}
+
+export async function listChangedFiles(github, context) {
+  const { owner, repo } = context.repo;
+
+  if (context.eventName === 'pull_request') {
+    const files = await github.paginate(github.rest.pulls.listFiles, {
+      owner,
+      repo,
+      pull_number: context.payload.pull_request.number,
+      per_page: 100,
+    });
+    return files.map((f) => f.filename);
+  }
+
+  if (context.eventName === 'push') {
+    const before = context.payload.before;
+    const after = context.sha;
+    if (!before || /^0+$/.test(before)) {
+      const commit = await github.rest.repos.getCommit({ owner, repo, ref: after });
+      return commit.data.files?.map((f) => f.filename) ?? [];
+    }
+    const compare = await github.rest.repos.compareCommits({
+      owner,
+      repo,
+      base: before,
+      head: after,
+    });
+    return compare.data.files?.map((f) => f.filename) ?? [];
+  }
+
+  if (context.eventName === 'workflow_run') {
+    const pr = context.payload.workflow_run.pull_requests?.[0];
+    if (pr?.number) {
+      const files = await github.paginate(github.rest.pulls.listFiles, {
+        owner,
+        repo,
+        pull_number: pr.number,
+        per_page: 100,
+      });
+      return files.map((f) => f.filename);
+    }
+    const headSha = context.payload.workflow_run.head_sha;
+    const commit = await github.rest.repos.getCommit({ owner, repo, ref: headSha });
+    return commit.data.files?.map((f) => f.filename) ?? [];
+  }
+
+  return [];
+}
+
+export function resolveTargetSha(context) {
+  if (context.eventName === 'pull_request') {
+    return context.payload.pull_request.head.sha;
+  }
+  if (context.eventName === 'workflow_run') {
+    return context.payload.workflow_run.head_sha;
+  }
+  return context.sha;
+}
+
+export async function runCiOkAggregate(github, context, core) {
+  const { owner, repo } = context.repo;
+  const sha = resolveTargetSha(context);
+  const excludeRunId = String(context.runId);
+  const changedFiles = await withTransientRetry(
+    'listChangedFiles',
+    () => listChangedFiles(github, context),
+    core,
+  );
+  const required = requiredJobNames(changedFiles);
+
+  core.info(`ci-ok @ ${sha}; ${changedFiles.length} changed file(s)`);
+  if (required.length === 0) {
+    core.info('No path-filtered test workflows apply — ci-ok passes.');
+    return;
+  }
+  core.info(`Waiting for required job checks: ${required.join(', ')}`);
+
+  const deadline = Date.now() + TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    let checksAll;
+    try {
+      checksAll = await github.paginate(github.rest.checks.listForRef, {
+        owner,
+        repo,
+        ref: sha,
+        per_page: 100,
+      });
+    } catch (err) {
+      if (!isTransientApiError(err)) {
+        throw err;
+      }
+      // Same as an inconclusive poll: wait out the hiccup, the 90-minute
+      // deadline stays the backstop.
+      core.info(`checks.listForRef: transient API error (status=${err?.status ?? 'network'}) — retrying next poll`);
+      await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+      continue;
+    }
+    const newestByName = newestChecksByName(checksAll, excludeRunId);
+    const { pending, failures, done } = evaluateRequiredJobs(required, newestByName);
+
+    if (failures.length > 0) {
+      core.setFailed(`Required checks failed:\n${failures.join('\n')}`);
+      return;
+    }
+    if (done) {
+      core.info('All required checks are green.');
+      return;
+    }
+
+    core.info(`Pending (${pending.length}): ${pending.join('; ')}`);
+    await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+  }
+
+  core.setFailed(`Timed out after ${TIMEOUT_MS / 60_000} minutes waiting for: ${required.join(', ')}`);
+}

.github/scripts/ci-ok-aggregate.test.mjs

@@ -0,0 +1,128 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  evaluateRequiredJobs,
+  isTransientApiError,
+  newestChecksByName,
+  pathTriggersFrontend,
+  pathTriggersRust,
+  requiredJobNames,
+  withTransientRetry,
+} from './ci-ok-aggregate.mjs';
+
+test('pathTriggersFrontend matches frontend workflow paths', () => {
+  assert.equal(pathTriggersFrontend('src/App.tsx'), true);
+  assert.equal(pathTriggersFrontend('eslint.config.mjs'), true);
+  assert.equal(pathTriggersFrontend('README.md'), false);
+});
+
+test('pathTriggersRust matches rust workflow paths', () => {
+  assert.equal(pathTriggersRust('src-tauri/src/lib.rs'), true);
+  assert.equal(pathTriggersRust('src/App.tsx'), false);
+});
+
+test('requiredJobNames unions frontend and rust jobs', () => {
+  const names = requiredJobNames(['src/foo.ts', 'src-tauri/bar.rs']);
+  assert.ok(names.includes('eslint'));
+  assert.ok(names.includes('cargo test --workspace'));
+});
+
+test('evaluateRequiredJobs fails on red conclusions', () => {
+  const newest = newestChecksByName([
+    {
+      name: 'eslint',
+      status: 'completed',
+      conclusion: 'failure',
+      started_at: '2026-01-01T00:00:00Z',
+      details_url: '',
+    },
+  ]);
+  const result = evaluateRequiredJobs(['eslint'], newest);
+  assert.equal(result.done, false);
+  assert.equal(result.failures.length, 1);
+});
+
+test('evaluateRequiredJobs passes when all required jobs succeeded', () => {
+  const checks = ['eslint', 'vitest run'].map((name) => ({
+    name,
+    status: 'completed',
+    conclusion: 'success',
+    started_at: '2026-01-01T00:00:00Z',
+    details_url: '',
+  }));
+  const result = evaluateRequiredJobs(['eslint', 'vitest run'], newestChecksByName(checks));
+  assert.equal(result.done, true);
+});
+
+test('isTransientApiError treats 5xx, 429 and network errors as transient', () => {
+  assert.equal(isTransientApiError({ status: 503 }), true);
+  assert.equal(isTransientApiError({ status: 500 }), true);
+  assert.equal(isTransientApiError({ status: 429 }), true);
+  assert.equal(isTransientApiError(new Error('socket hang up')), true);
+  assert.equal(isTransientApiError({ status: 404 }), false);
+  assert.equal(isTransientApiError({ status: 401 }), false);
+});
+
+const silentCore = { info: () => {} };
+
+test('withTransientRetry retries transient errors and returns the late success', async () => {
+  let calls = 0;
+  const result = await withTransientRetry(
+    'test',
+    async () => {
+      calls += 1;
+      if (calls < 3) {
+        const err = new Error('unavailable');
+        err.status = 503;
+        throw err;
+      }
+      return 'ok';
+    },
+    silentCore,
+    5,
+    1,
+  );
+  assert.equal(result, 'ok');
+  assert.equal(calls, 3);
+});
+
+test('withTransientRetry rethrows non-transient errors immediately', async () => {
+  let calls = 0;
+  await assert.rejects(
+    withTransientRetry(
+      'test',
+      async () => {
+        calls += 1;
+        const err = new Error('not found');
+        err.status = 404;
+        throw err;
+      },
+      silentCore,
+      5,
+      1,
+    ),
+    /not found/,
+  );
+  assert.equal(calls, 1);
+});
+
+test('withTransientRetry gives up after the attempt budget', async () => {
+  let calls = 0;
+  await assert.rejects(
+    withTransientRetry(
+      'test',
+      async () => {
+        calls += 1;
+        const err = new Error('unavailable');
+        err.status = 503;
+        throw err;
+      },
+      silentCore,
+      3,
+      1,
+    ),
+    /unavailable/,
+  );
+  assert.equal(calls, 3);
+});

.github/workflows/ci-main.yml

@@ -1,15 +1,30 @@
 name: ci-main
 
 on:
-  push:
-    branches: [main]
   pull_request:
     branches: [main]
+  push:
+    branches: [main]
+  workflow_run:
+    workflows: [frontend-tests, rust-tests, eslint]
+    types: [completed]
   workflow_dispatch:
 
+permissions:
+  contents: read
+  checks: read
+  pull-requests: read
+
 jobs:
   ci-ok:
     runs-on: ubuntu-latest
     steps:
-      - name: ci sentinel
-        run: echo "main CI sentinel is green"
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha || github.sha }}
+      - name: aggregate required checks
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const { runCiOkAggregate } = await import('${{ github.workspace }}/.github/scripts/ci-ok-aggregate.mjs');
+            await runCiOkAggregate(github, context, core);

.github/workflows/eslint.yml

@@ -0,0 +1,66 @@
+name: eslint
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'package.json'
+      - 'package-lock.json'
+      - 'vitest.config.ts'
+      - 'vite.config.ts'
+      - 'tsconfig.json'
+      - 'eslint.config.mjs'
+      - '.dependency-cruiser.cjs'
+      - '.dependency-cruiser-known-violations.json'
+      - '.github/workflows/eslint.yml'
+      - '.github/frontend-hot-path-files.txt'
+      - 'scripts/check-frontend-hot-path-coverage.sh'
+      - 'scripts/check-css-import-graph.mjs'
+  push:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'package.json'
+      - 'package-lock.json'
+      - 'vitest.config.ts'
+      - 'vite.config.ts'
+      - 'tsconfig.json'
+      - 'eslint.config.mjs'
+      - '.dependency-cruiser.cjs'
+      - '.dependency-cruiser-known-violations.json'
+      - '.github/workflows/eslint.yml'
+      - '.github/frontend-hot-path-files.txt'
+      - 'scripts/check-frontend-hot-path-coverage.sh'
+      - 'scripts/check-css-import-graph.mjs'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  eslint:
+    name: eslint
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 'lts/*'
+          cache: 'npm'
+      - run: npm ci
+      - name: eslint
+        run: npm run lint
+
+  dependency-cruiser:
+    name: dependency-cruiser
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 'lts/*'
+          cache: 'npm'
+      - run: npm ci
+      - name: layering + cycle guard
+        run: npm run dep:check

.github/workflows/frontend-tests.yml

@@ -10,6 +10,7 @@ on:
       - 'vitest.config.ts'
       - 'vite.config.ts'
       - 'tsconfig.json'
+      - 'eslint.config.mjs'
       - '.github/workflows/frontend-tests.yml'
       - '.github/frontend-hot-path-files.txt'
       - 'scripts/check-frontend-hot-path-coverage.sh'
@@ -23,6 +24,7 @@ on:
       - 'vitest.config.ts'
       - 'vite.config.ts'
       - 'tsconfig.json'
+      - 'eslint.config.mjs'
       - '.github/workflows/frontend-tests.yml'
       - '.github/frontend-hot-path-files.txt'
       - 'scripts/check-frontend-hot-path-coverage.sh'
@@ -38,9 +40,9 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: 'lts/*'
           cache: 'npm'
       - run: npm ci
       - name: vitest
@@ -51,34 +53,31 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: 'lts/*'
           cache: 'npm'
       - run: npm ci
+      - run: npm run prebuild:release-notes
       - name: tsc
         run: npx tsc --noEmit
 
   coverage:
     name: vitest --coverage (baseline + hot-path file gate)
-    # Two-layer gate: the script exits 1 when any listed file drops below the
-    # threshold (warning annotations show in the PR checks panel), but
-    # `continue-on-error: true` keeps it from BLOCKING merges. Drop the flag
-    # to flip the gate hard once we've watched a few PRs run cleanly.
     runs-on: ubuntu-24.04
-    continue-on-error: true
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: 'lts/*'
           cache: 'npm'
       - name: install jq
         run: sudo apt-get update && sudo apt-get install -y jq
       - run: npm ci
+      - run: npm run prebuild:release-notes
       - name: vitest run --coverage
         run: npx vitest run --coverage
-      - name: hot-path file coverage soft gate
+      - name: hot-path file coverage gate
         run: bash scripts/check-frontend-hot-path-coverage.sh
       - uses: actions/upload-artifact@v4
         with:

.github/workflows/promote-main-to-next.yml

@@ -75,7 +75,7 @@ jobs:
           set -euo pipefail
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add package.json package-lock.json src-tauri/Cargo.toml src-tauri/tauri.conf.json
+          git add package.json package-lock.json src-tauri/Cargo.toml src-tauri/Cargo.lock src-tauri/tauri.conf.json
           if git diff --cached --quiet; then
             echo "No version bump changes to commit."
             exit 0

.github/workflows/promote-next-to-release.yml

@@ -47,7 +47,7 @@ jobs:
           set -euo pipefail
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add package.json package-lock.json src-tauri/Cargo.toml src-tauri/tauri.conf.json
+          git add package.json package-lock.json src-tauri/Cargo.toml src-tauri/Cargo.lock src-tauri/tauri.conf.json
           if git diff --cached --quiet; then
             echo "No finalization changes to commit."
             exit 0

.github/workflows/reusable-channel-publish.yml

@@ -35,7 +35,70 @@ on:
         type: boolean
 
 jobs:
+  # Refresh npmDepsHash + flake.lock on the channel branch *before* tagging.
+  # Promote workflows push with GITHUB_TOKEN (no downstream workflow runs), and the
+  # old post-tag verify-nix PR landed after app-v* tags were already cut.
+  prepare-nix-sources:
+    if: ${{ inputs.verify_nix }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    outputs:
+      source_commit_sha: ${{ steps.final-sha.outputs.value }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.target_branch }}
+      - name: install Nix
+        uses: DeterminateSystems/nix-installer-action@v15
+      - name: configure Cachix (managed signing)
+        uses: cachix/cachix-action@v15
+        with:
+          name: psysonic
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: compute npmDepsHash from package-lock.json
+        id: npm-hash
+        run: |
+          set -euo pipefail
+          HASH="$(nix run nixpkgs/nixos-unstable#prefetch-npm-deps -- package-lock.json)"
+          echo "hash=$HASH" >> "$GITHUB_OUTPUT"
+          echo "Computed npmDepsHash: $HASH"
+      - name: write npmDepsHash into nix/upstream-sources.json
+        run: |
+          set -euo pipefail
+          HASH='${{ steps.npm-hash.outputs.hash }}'
+          jq --arg h "$HASH" '.npmDepsHash = $h' nix/upstream-sources.json > nix/upstream-sources.json.new
+          mv nix/upstream-sources.json.new nix/upstream-sources.json
+      - name: refresh flake.lock (nixpkgs pin)
+        run: nix flake update --accept-flake-config
+      - name: verify nix build + push to Cachix
+        run: |
+          set -euo pipefail
+          nix build .#psysonic --accept-flake-config --no-link --print-build-logs
+          nix path-info --recursive .#psysonic | cachix push psysonic
+      - name: commit and push refreshed lock and hash (if changed)
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add flake.lock nix/upstream-sources.json
+          if git diff --cached --quiet; then
+            echo "flake.lock / nix/upstream-sources.json unchanged — nothing to commit."
+            exit 0
+          fi
+          VERSION="$(node -p 'require("./package.json").version')"
+          git commit -m "chore(nix): refresh lock + npmDepsHash for v${VERSION}"
+          git push origin "HEAD:${{ inputs.target_branch }}"
+      - name: capture source commit sha
+        id: final-sha
+        run: |
+          set -euo pipefail
+          echo "value=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
   create-release:
+    needs: prepare-nix-sources
+    if: ${{ !cancelled() && !failure() && (needs.prepare-nix-sources.result == 'success' || needs.prepare-nix-sources.result == 'skipped') }}
     permissions:
       contents: write
     runs-on: ubuntu-latest
@@ -47,7 +110,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
         with:
-          ref: ${{ inputs.source_ref }}
+          ref: ${{ inputs.verify_nix && needs.prepare-nix-sources.outputs.source_commit_sha || inputs.source_ref }}
       - name: setup node
         uses: actions/setup-node@v5
         with:
@@ -113,18 +176,32 @@ jobs:
       - name: extract changelog
         id: changelog
         run: |
+          set -euo pipefail
           VERSION="${{ steps.get-version.outputs.version }}"
-          BODY=$(awk "/^## \[$VERSION\]/{found=1; next} found && /^## \[/{exit} found{print}" CHANGELOG.md)
-          if [ -z "$BODY" ]; then
-            BASE_VERSION="$(node -e 'const v=process.argv[1]; const m=v.match(/^(\d+\.\d+\.\d+)/); if(m){process.stdout.write(m[1]);}' "$VERSION")"
-            if [ -n "$BASE_VERSION" ] && [ "$BASE_VERSION" != "$VERSION" ]; then
-              BODY=$(awk "/^## \[$BASE_VERSION\]/{found=1; next} found && /^## \[/{exit} found{print}" CHANGELOG.md)
-            fi
+          BODY=""
+          if node scripts/extract-release-section.mjs CHANGELOG.md "$VERSION" --allow-empty > /tmp/changelog-body.md; then
+            BODY="$(cat /tmp/changelog-body.md)"
           fi
           EOF_MARKER=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
           echo "body<<$EOF_MARKER" >> "$GITHUB_OUTPUT"
           echo "$BODY" >> "$GITHUB_OUTPUT"
           echo "$EOF_MARKER" >> "$GITHUB_OUTPUT"
+      - name: extract what's new for release asset
+        id: whats-new
+        run: |
+          set -euo pipefail
+          VERSION="${{ steps.get-version.outputs.version }}"
+          CHANNEL="${{ inputs.channel }}"
+          if ! node scripts/extract-release-section.mjs WHATS_NEW.md "$VERSION" > /tmp/whats-new.md; then
+            if [ "$CHANNEL" = "release" ]; then
+              echo "::error::WHATS_NEW.md has no section for version $VERSION (required for stable release)"
+              exit 1
+            fi
+            echo "::warning::WHATS_NEW.md has no section for $VERSION — skipping whats-new.md asset"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "skip=false" >> "$GITHUB_OUTPUT"
       - name: create or update release
         id: create-release
         uses: actions/github-script@v9
@@ -174,6 +251,14 @@ jobs:
               prerelease,
             });
             return data.id;
+      - name: upload whats-new.md release asset
+        if: steps.whats-new.outputs.skip != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          RELEASE_TAG="${{ steps.tag.outputs.value }}"
+          gh release upload "$RELEASE_TAG" /tmp/whats-new.md --clobber
 
   build-macos-windows:
     if: ${{ inputs.build_platform_artifacts }}
@@ -194,7 +279,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
         with:
-          ref: ${{ inputs.source_ref }}
+          ref: ${{ needs.create-release.outputs.source_commit_sha }}
       - name: setup node
         uses: actions/setup-node@v5
         with:
@@ -268,7 +353,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
         with:
-          ref: ${{ inputs.source_ref }}
+          ref: ${{ needs.create-release.outputs.source_commit_sha }}
       - name: generate latest.json
         env:
           VERSION: ${{ needs.create-release.outputs.package_version }}
@@ -290,7 +375,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
         with:
-          ref: ${{ inputs.source_ref }}
+          ref: ${{ needs.create-release.outputs.source_commit_sha }}
       - name: install dependencies
         run: |
           sudo apt-get update
@@ -325,68 +410,6 @@ jobs:
             \( -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" \) \
             | xargs gh release upload "$RELEASE_TAG" --clobber
 
-  verify-nix:
-    if: ${{ inputs.verify_nix }}
-    needs: create-release
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-          ref: ${{ inputs.target_branch }}
-      - name: install Nix
-        uses: DeterminateSystems/nix-installer-action@v15
-      - name: configure Cachix (managed signing)
-        uses: cachix/cachix-action@v15
-        with:
-          name: psysonic
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      - name: compute npmDepsHash from package-lock.json
-        id: npm-hash
-        run: |
-          set -euo pipefail
-          HASH="$(nix run nixpkgs/nixos-unstable#prefetch-npm-deps -- package-lock.json)"
-          echo "hash=$HASH" >> "$GITHUB_OUTPUT"
-          echo "Computed npmDepsHash: $HASH"
-      - name: write npmDepsHash into nix/upstream-sources.json
-        run: |
-          set -euo pipefail
-          HASH='${{ steps.npm-hash.outputs.hash }}'
-          jq --arg h "$HASH" '.npmDepsHash = $h' nix/upstream-sources.json > nix/upstream-sources.json.new
-          mv nix/upstream-sources.json.new nix/upstream-sources.json
-      - name: refresh flake.lock (nixpkgs pin)
-        run: nix flake update --accept-flake-config
-      - name: verify nix build + push to Cachix
-        run: |
-          set -euo pipefail
-          nix build .#psysonic --accept-flake-config --no-link --print-build-logs
-          nix path-info --recursive .#psysonic | cachix push psysonic
-      - name: open + auto-merge PR with refreshed lock and hash (if changed)
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add flake.lock nix/upstream-sources.json
-          if git diff --cached --quiet; then
-            echo "flake.lock / nix/upstream-sources.json unchanged — nothing to commit."
-            exit 0
-          fi
-          VERSION="${{ needs.create-release.outputs.package_version }}"
-          BRANCH="chore/nix-lock-refresh-${{ inputs.target_branch }}-v${VERSION}"
-          git checkout -b "$BRANCH"
-          git commit -m "chore(nix): refresh lock + npmDepsHash for v${VERSION}"
-          git push origin "$BRANCH"
-          gh pr create \
-            --base "${{ inputs.target_branch }}" \
-            --head "$BRANCH" \
-            --title "chore(nix): refresh lock + npmDepsHash for v${VERSION}" \
-            --body "Auto-generated for the \`${{ inputs.channel }}\` channel after v${VERSION}: refreshes \`flake.lock\` and \`nix/upstream-sources.json\`."
-
   bump-main-to-next-dev:
     if: ${{ inputs.channel == 'release' }}
     needs: create-release
@@ -447,7 +470,7 @@ jobs:
           set -euo pipefail
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add package.json package-lock.json src-tauri/Cargo.toml src-tauri/tauri.conf.json
+          git add package.json package-lock.json src-tauri/Cargo.toml src-tauri/Cargo.lock src-tauri/tauri.conf.json
           if git diff --cached --quiet; then
             echo "No dev version bump required."
             exit 0
@@ -463,4 +486,4 @@ jobs:
             --base main \
             --head "$BRANCH" \
             --title "chore(release): bump main to ${VERSION}" \
-            --body "Auto-generated after stable release: updates \`package.json\`, \`package-lock.json\`, \`src-tauri/Cargo.toml\`, and \`src-tauri/tauri.conf.json\` to the next development version."
+            --body "Auto-generated after stable release: updates \`package.json\`, \`package-lock.json\`, \`src-tauri/Cargo.toml\`, \`src-tauri/Cargo.lock\`, and \`src-tauri/tauri.conf.json\` to the next development version."

.github/workflows/rust-tests.yml

@@ -59,13 +59,7 @@ jobs:
 
   coverage:
     name: cargo llvm-cov (baseline + hot-path file gate)
-    # Layered: the gate script exits 1 when any hot-path file drops below
-    # threshold (see scripts/check-hot-path-coverage.sh) — the failure is
-    # visible in the PR's checks panel. `continue-on-error: true` keeps it
-    # from BLOCKING merges. Drop continue-on-error to flip the gate to a
-    # PR-blocker once we've watched a few PRs run cleanly.
     runs-on: ubuntu-24.04
-    continue-on-error: true
     steps:
       - uses: actions/checkout@v5
       - name: install Linux build dependencies
@@ -89,7 +83,7 @@ jobs:
           mkdir -p target/llvm-cov
           cargo llvm-cov --workspace --lcov --output-path lcov.info
           cargo llvm-cov --workspace --json --output-path target/llvm-cov/cov.json
-      - name: hot-path function coverage soft gate
+      - name: hot-path file coverage gate
         run: bash scripts/check-hot-path-coverage.sh
       - uses: actions/upload-artifact@v4
         with:

.github/workflows/winget-publish.yml

@@ -0,0 +1,21 @@
+name: Publish to WinGet
+on:
+  release:
+    types: [released]
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Derive winget version from app-v* tag
+        id: ver
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: echo "value=${TAG#app-v}" >> "$GITHUB_OUTPUT"
+
+      - name: Submit to WinGet Community Repository
+        uses: vedantmgoyal9/winget-releaser@v2
+        with:
+          identifier: Psychotoxical.Psysonic
+          version: ${{ steps.ver.outputs.value }}
+          installers-regex: 'Psysonic_.*_x64-setup\.exe$'
+          token: ${{ secrets.WINGET_TOKEN }}

.gitignore

@@ -37,6 +37,13 @@ src-tauri/lcov.info
 # Frontend test coverage
 coverage/
 
+# Generated at build/test/dev time (scripts/generate-release-notes-bundle.mjs).
+# Ignore the contents (not the dir) so the committed tauri-specta FE↔BE contract
+# snapshot below can be re-included — a `!` exception cannot escape an ignored dir.
+src/generated/*
+# ...except the committed tauri-specta contract snapshot, so CI diffs catch drift.
+!src/generated/bindings.ts
+
 # Documentation
 CLAUDE.md
 
@@ -63,3 +70,4 @@ result-*
 dev.sh
 shell.nix
 prod.sh
+tsconfig.tsbuildinfo

CONTRIBUTING.md

@@ -41,7 +41,7 @@ Open pull requests against `main`. `next` and `release` are maintainer-driven pr
 - **AUR packaging problems** — follow the AUR links in [README](README.md); those packages are maintained separately from this repository.
 - **Large features or UX overhauls** — consider discussing in chat or opening an issue early so effort aligns with product direction.
 - **Changes to the Tauri boundary** — read [The Rust ↔ frontend (Tauri) contract](#the-rust--frontend-tauri-contract) before opening a PR; reviewers will ask for a clear justification.
-- **Security issues** — please do **not** open a public issue. Reach a maintainer privately via Discord or Telegram first; we'll coordinate disclosure from there.
+- **Security issues** — please do **not** open a public issue. See [SECURITY.md](SECURITY.md) for how to report vulnerabilities privately (Discord or Telegram).
 
 ---
 
@@ -73,7 +73,7 @@ If you use **Nix**, `nix develop` (see [`flake.nix`](flake.nix)) provides the pi
 | Topic | Location |
 |--------|----------|
 | Frontend test stack (Vitest, Tauri/Subsonic mocks, store resets, i18n in tests) | [`src/test/README.md`](src/test/README.md) |
-| What CI runs for frontend / backend | [`frontend-tests.yml`](.github/workflows/frontend-tests.yml), [`rust-tests.yml`](.github/workflows/rust-tests.yml) |
+| What CI runs for frontend / backend | [`frontend-tests.yml`](.github/workflows/frontend-tests.yml), [`eslint.yml`](.github/workflows/eslint.yml), [`rust-tests.yml`](.github/workflows/rust-tests.yml) |
 | Frontend "hot path" files held to a coverage threshold | [`frontend-hot-path-files.txt`](.github/frontend-hot-path-files.txt), [`check-frontend-hot-path-coverage.sh`](scripts/check-frontend-hot-path-coverage.sh) |
 | Rust hot-path gate | [`hot-path-files.txt`](.github/hot-path-files.txt), [`check-hot-path-coverage.sh`](scripts/check-hot-path-coverage.sh) |
 | Nix packaging / release automation | [`flake.nix`](flake.nix), workflows under [`.github/workflows/`](.github/workflows/) |
@@ -84,11 +84,12 @@ If you use **Nix**, `nix develop` (see [`flake.nix`](flake.nix)) provides the pi
 
 1. **One pull request, one coherent goal.** Easier review, easier revert, fewer merge conflicts.
 2. **Match existing style** in touched files (naming, module layout, comment density). Avoid drive-by refactors unrelated to the task.
-3. **Linting and formatting:** there is no enforced JS/TS formatter or ESLint config in the repo today — `tsc --noEmit` is the only frontend gate beyond tests. For Rust, `cargo clippy --workspace --all-targets -- -D warnings` is the lint gate; `cargo fmt` is not currently required but won't hurt.
+3. **Linting and formatting:** ESLint (strict `eslint.config.mjs`) and **`npm run dep:check`** (dependency-cruiser layering/cycle guard) run in CI on frontend paths; run both locally before opening a frontend PR. `tsc --noEmit` is also required. For Rust, `cargo clippy --workspace --all-targets -- -D warnings` is the lint gate; `cargo fmt` is not currently required but won't hurt.
 4. **Commit messages:** a short **human-readable** summary of what changed and why; Conventional Commits-style prefixes (`feat:`, `fix:`, ...) are fine if you prefer them. Do not include meta references (IDEs, assistants, or how the message was produced) — only what matters for project history.
 5. **License:** new code must remain compatible with the project's GPLv3.
 6. **Tests:** when you change behaviour users rely on, add or update tests next to the code (see [`src/test/README.md`](src/test/README.md)). Purely visual tweaks may not need tests, but behavioural regressions should be covered where the suite can catch them.
 7. **i18n:** user-visible strings live in `src/locales/*.ts` (one TypeScript module per language) and are wired up in `src/i18n.ts`. English (`en.ts`) is the baseline — always add the key there. Other locales may be left for follow-up translation PRs if you don't speak the language, but keep the object shape consistent so missing keys are obvious.
+   - **Adding a new language (not just keys):** the Rust cluster-key normalizer (`src-tauri/crates/psysonic-library/src/identity/norm.rs`) folds diacritics/ligatures per shipped locale so library items match across servers. When a locale introduces a script or letters it does not yet cover, extend its decomposition table for that language and **bump `NORM_VERSION`** (existing `library-cluster.db` keys rebuild automatically). CJK locales are intentionally left verbatim. The module header carries the same checklist.
 
 ---
 
@@ -108,16 +109,37 @@ Align early: open an issue or chat thread before sending a PR that renames `invo
 
 ---
 
+## Frontend architecture and layering
+
+The frontend uses a feature-folder architecture (introduced in #1225) with a layering contract that CI enforces through **`npm run dep:check`** (dependency-cruiser). The rule is simple: **a lower layer must never import a higher one.**
+
+```
+lib  →  store / ui  →  cover / music-network  →  features/<x>  →  app
+```
+
+- **`lib/**` is the floor** — feature-free infrastructure (API clients, formatting, i18n, util, media, server, navigation). It must **not** import from `store`, `ui`, `features`, `cover`, `music-network`, or `app`. If a `lib` helper needs auth/server state, pass it in as an argument or keep the helper in the layer that owns that state (`store` or `features`) — do not reach into a store from `lib`.
+- **`store` / `ui`** may import `lib` only.
+- **`cover` / `music-network`** are top-level domains and may import `lib`, `store`, `ui`.
+- **`features/<x>`** may import `lib`, `store`, `ui`, `cover`, `music-network`, and other features — but cross-feature access goes **only** through the `@/features/<x>` barrel, never a deep path.
+- **`app`** (shell + bridges) may import anything.
+- **No import cycles** anywhere under `src/`.
+
+The authoritative rules and rationale live in [`.dependency-cruiser.cjs`](.dependency-cruiser.cjs) (its header documents the layers and the known-violation ratchet). Any **new** layering or cycle violation fails the `dependency-cruiser` job and blocks `ci-ok`, so run **`npm run dep:check`** locally before opening a frontend PR. The known-violations baseline in `.dependency-cruiser-known-violations.json` only ratchets **down** — don't regenerate it to silence a new violation; fix the import instead.
+
+---
+
 ## CI on pull requests to `main`
 
 PRs must target `main`. `next` and `release` are maintainer-driven promotion branches — don't target them directly.
 
 Workflows are path-filtered (see the YAML for exact `paths` / `paths-ignore`):
 
-- **Frontend** (`src/**`, lockfile, Vitest/Vite/tsconfig, etc.): `npm test` (Vitest), `npx tsc --noEmit`, then a coverage run.
+- **Frontend** (`src/**`, lockfile, Vitest/Vite/tsconfig, ESLint config, dependency-cruiser config, etc.): `npm run lint`, **`npm run dep:check`** (layering + cycle guard), `npm test` (Vitest), `npx tsc --noEmit`, then a coverage run.
 - **Rust** (`src-tauri/**`): `cargo test --workspace --all-targets`, `cargo clippy --workspace --all-targets -- -D warnings`, then coverage.
 
-Hot-path coverage gates are currently **soft** (warnings only — the workflow carries `continue-on-error: true`). They will be flipped to required when the floors stabilise; see the headers in [`frontend-hot-path-files.txt`](.github/frontend-hot-path-files.txt) and [`hot-path-files.txt`](.github/hot-path-files.txt) for the current state of each list.
+The **`ci-ok`** job in [`ci-main.yml`](.github/workflows/ci-main.yml) is the merge gate: it waits for every required job above whose path filter matched the PR, and fails if any of them failed or did not finish in time.
+
+Hot-path coverage gates are **required** on pull requests: the `coverage` jobs in [`frontend-tests.yml`](.github/workflows/frontend-tests.yml) and [`rust-tests.yml`](.github/workflows/rust-tests.yml) fail when any listed file drops below the floor. See the headers in [`frontend-hot-path-files.txt`](.github/frontend-hot-path-files.txt) and [`hot-path-files.txt`](.github/hot-path-files.txt) for curation rules and thresholds.
 
 ---
 
@@ -129,7 +151,10 @@ Assume the repository root is `psysonic/` (for example after `git clone https://
 
 ```bash
 npm ci
+npm run lint
+npm run dep:check
 npm test
+npm run prebuild:release-notes
 npx tsc --noEmit
 npm run test:coverage
 bash scripts/check-frontend-hot-path-coverage.sh

ORBIT.md

@@ -40,8 +40,9 @@ Click **Psy Orbit** in the top bar → **Create a session**. The start modal ope
 
 - **Session name** — a random playful name is generated; edit it or reroll with the dice button.
 - **Max guests** — cap on concurrent participants (1–32). You don't count.
+- **Session server** — when your library scope includes several servers, choose the Navidrome instance that will host the session. Psysonic temporarily narrows the library scope and mixed queue to that server, then restores the previous scope when the session ends.
 - **Invite link** — ready to copy and share the moment the modal opens. Pre-generated from a fresh session id + the slugified name.
-- **Clear my queue first** — optional. Start with an empty queue (guest suggestions land fresh) vs. keep your current queue and share it with the guests.
+- **Clear my queue first** — optional. Start with an empty queue (guest suggestions land fresh) vs. keep the chosen server's queued tracks and share them with the guests.
 
 Click **Start Orbit**. The session bar appears at the top of the window (session name, participant count, shuffle countdown, settings / share / help / exit buttons). The link is now live — share it.
 
@@ -267,11 +268,10 @@ The state blob is size-bounded to 4 KB (serialised JSON). `serialiseOrbitState`
 
 ### Cleanup
 
-Three layers of defense against orphaned playlists:
+Two layers of defense against orphaned playlists:
 
 1. **Explicit exit.** `endOrbitSession` (host) or `leaveOrbitSession` (guest) deletes the participant's own playlists synchronously. The happy path.
-2. **Server-switch teardown.** Switching Navidrome servers tears the current session down first (up to 1.5 s), then switches. Prevents "in session against wrong server" states.
-3. **App-start orphan sweep.** Every app launch runs `cleanupOrphanedOrbitPlaylists`: lists every `__psyorbit_*` playlist the current user owns, parses the heartbeat from the comment, deletes anything with a heartbeat older than 5 minutes (or `ended: true`, or an unparseable comment). The current local session is always protected.
+2. **App-start orphan sweep.** Every app launch runs `cleanupOrphanedOrbitPlaylists`: lists every `__psyorbit_*` playlist the current user owns, parses the heartbeat from the comment, deletes anything with a heartbeat older than 5 minutes (or `ended: true`, or an unparseable comment). The current local session is always protected.
 
 The 5-minute TTL is a conservative compromise: long enough to survive a brief app restart (and a session running on another device of yours), short enough that a dead session doesn't clutter the server indefinitely.
 
@@ -295,7 +295,7 @@ The 5-minute TTL is a conservative compromise: long enough to survive a brief ap
 - **Bulk "Play All" in-session.** Dialog: "Add 14 tracks to the Orbit queue?" On confirm, appended. On cancel, no-op.
 - **Single-click on song row in-session.** Swallowed; shows "Double-click to add" toast.
 - **Multiple accounts on target server.** Paste flow opens an account picker modal. Keyboard-navigable.
-- **Server switch while in session.** Teardown runs before switch. Any server-resident session playlists get cleaned up by their host's next app-start sweep.
+- **Server switch while in session.** The session remains bound to its original server; changing the visible active server cannot redirect playlist reads, writes, suggestions or cleanup.
 - **Initial sync race.** The guest's first tick retries on 500 ms cadence until the player state actually matches the host's last-known track (up to 2 s per attempt, then falls through with a best-effort mirror).
 - **`positionAt` stale on join.** Seek fraction is clamped to [0, 0.99] — prevents `audio:ended` from firing at the very start of a join.
 - **Outbox deletion mid-session** (cleanup race): host sees the guest drop out on the next sweep; guest's next heartbeat recreates the outbox if they're still connected.
@@ -312,7 +312,7 @@ The 5-minute TTL is a conservative compromise: long enough to survive a brief ap
 ### Lifecycle
 - `src/utils/orbit.ts` — `startOrbitSession`, `joinOrbitSession`, `endOrbitSession`, `leaveOrbitSession`, `suggestOrbitTrack`, `approveOrbitSuggestion`, `declineOrbitSuggestion`, `hostEnqueueToOrbit`, `cleanupOrphanedOrbitPlaylists`, `effectiveShuffleIntervalMs`.
 - `src/utils/orbitBulkGuard.ts` — standalone confirm-dialog helper invoked from `playerStore` when `>1` tracks land in the queue while a session is active.
-- `src/utils/switchActiveServer.ts` — wires Orbit teardown into server-switch.
+- `src/utils/server/switchActiveServer.ts` — switches the active account without tearing down the source-bound Orbit session.
 
 ### Hooks
 - `src/hooks/useOrbitHost.ts` — host state tick + outbox sweep + merge pipeline + heartbeat.

PRIVACY.md

@@ -9,13 +9,19 @@ All third-party integrations listed below are **opt-in**. Nothing is sent until
 ### Your Subsonic / Navidrome server
 Your server URL, username, and password are stored locally in the app's data directory. All playback and library requests go directly to your own server. Psysonic has no access to this data.
 
-### Last.fm
-If you connect a Last.fm account in Settings, Psysonic sends:
-- **Scrobbles** — track title, artist, album, and timestamp when a song reaches 50% playback
-- **Now Playing** — the currently playing track (title, artist, album)
-- **Love / Unlove** — when you mark a track as loved or unloved
+### Music Network (scrobble & enrichment services)
+Psysonic can connect to one or more scrobble services in Settings → Integrations. Each service you connect is opt-in and independent; nothing is sent to a service you have not connected. Supported service classes:
 
-All requests go to the [Last.fm API](https://www.last.fm/api). Your Last.fm credentials are stored locally and never leave your device. You can disconnect your account at any time in Settings.
+- **Audioscrobbler / GNU FM services** — Last.fm, Libre.fm, Rocksky (AT Protocol), and any self-hosted GNU FM-compatible instance
+- **ListenBrainz** — the public ListenBrainz.org service, or a self-hosted instance (e.g. Koito) via its ListenBrainz-compatible API
+- **Maloja** — your own self-hosted Maloja server (native API or its ListenBrainz-compatible API)
+
+To each connected service, Psysonic may send:
+- **Scrobbles** — track title, artist, album, and timestamp when a song reaches 50% playback
+- **Now Playing** — the currently playing track (title, artist, album), where the service supports it
+- **Love / Unlove** — when you mark a track as loved, on services that support it
+
+Additionally, the one service you choose as your **primary** is queried to enrich the UI (your loved tracks, similar artists, and listening stats). All requests go directly from your device to the service's own host — the public service's host (e.g. the [Last.fm API](https://www.last.fm/api), [ListenBrainz](https://listenbrainz.org)) or, for self-hosted services, the server URL you entered. Credentials (session keys / API tokens) are stored locally and never leave your device. You can disconnect any service at any time in Settings.
 
 ### LRCLIB (Lyrics)
 When lyrics are fetched from LRCLIB, Psysonic sends the track title, artist, album, and duration to [lrclib.net](https://lrclib.net) as a search query. No account is required. This feature can be disabled in Settings → Lyrics.
@@ -37,7 +43,7 @@ If Discord is running and Rich Presence is not disabled, Psysonic connects to th
 The following data is stored exclusively on your device in the app's local storage directory and is never transmitted:
 
 - Server profiles (URL, username, password)
-- Last.fm session key
+- Scrobble service credentials (session keys / API tokens)
 - Playback preferences, themes, keybindings, and all other settings
 - Synced device manifests
 

README.md

@@ -14,11 +14,11 @@ Psysonic is built primarily for **Navidrome** and also works with **Gonic**, **A
 
 <a href="https://discord.gg/AMnDRErm4u"><img src="https://img.shields.io/badge/Discord-Community-5865F2?style=for-the-badge&logo=discord&logoColor=white" alt="Discord Community"></a> <a href="https://t.me/+GLBx1_xeH28xYTJi"><img src="https://img.shields.io/badge/Telegram-Community-26A5E4?style=for-the-badge&logo=telegram&logoColor=white" alt="Telegram Community"></a> <a href="https://ko-fi.com/psychotoxic"><img src="https://img.shields.io/badge/Ko--fi-Support%20Psysonic-FF5E5B?style=for-the-badge&logo=ko-fi&logoColor=white" alt="Support Psysonic on Ko-fi"></a>
 
-<a href="https://aur.archlinux.org/packages/psysonic"><img src="https://img.shields.io/badge/AUR-psysonic-1793d1?style=for-the-badge&logo=arch-linux&logoColor=white" alt="AUR psysonic"></a> <a href="https://aur.archlinux.org/packages/psysonic-bin"><img src="https://img.shields.io/badge/AUR-psysonic--bin-1793d1?style=for-the-badge&logo=arch-linux&logoColor=white" alt="AUR psysonic-bin"></a> <a href="https://psysonic.cachix.org"><img src="https://img.shields.io/badge/Cachix-psysonic.cachix.org-5277C3?style=for-the-badge&logo=nixos&logoColor=white" alt="Cachix"></a>
+<a href="https://aur.archlinux.org/packages/psysonic"><img src="https://img.shields.io/badge/AUR-psysonic-1793d1?style=for-the-badge&logo=arch-linux&logoColor=white" alt="AUR psysonic"></a> <a href="https://aur.archlinux.org/packages/psysonic-bin"><img src="https://img.shields.io/badge/AUR-psysonic--bin-1793d1?style=for-the-badge&logo=arch-linux&logoColor=white" alt="AUR psysonic-bin"></a> <a href="https://psysonic.cachix.org"><img src="https://img.shields.io/badge/Cachix-psysonic.cachix.org-5277C3?style=for-the-badge&logo=nixos&logoColor=white" alt="Cachix"></a> <a href="https://github.com/microsoft/winget-pkgs/tree/master/manifests/p/Psychotoxical/Psysonic"><img src="https://img.shields.io/badge/WinGet-psysonic-blue?style=for-the-badge&logo=windows" alt="WinGet psysonic"></a>
 
 <br><br>
 
-**Available languages:** English, German, Spanish, French, Norwegian Bokmål, Dutch, Romanian, Russian and Chinese.
+**Available languages:** English, German, Spanish, French, Norwegian Bokmål, Dutch, Romanian, Russian, Chinese, Japanese, Hungarian and Polish.
 
 More translations are added over time.
 
@@ -32,104 +32,148 @@ More translations are added over time.
 
 ---
 
-> [!WARNING]
-> Psysonic is under active development. Bugs and rough edges can happen, and features may change as the project evolves.
-
 ## What is Psysonic?
 
 Psysonic is a desktop music client for self-hosted music libraries. It is designed for people who want the freedom of their own server without giving up the comfort, polish and speed of a modern music app.
 
 It is built with **Rust**, **Tauri v2** and **React**, with a strong focus on responsiveness, customization, practical music-library workflows and a user interface that does not require a manual before you can press play.
 
-Psysonic is **optimized first and foremost for Navidrome**. Other Subsonic-compatible servers can work well too, but advanced features may depend on server-side support.
+Psysonic is **optimized first and foremost for Navidrome**, and it leans into that on purpose: instead of being one more generic Subsonic client, it is **the Navidrome-first desktop client that does things no other client does.** Other Subsonic-compatible servers can work well too, but advanced features may depend on server-side support.
 
 ---
 
-# Highlights
+# ⭐ Key Features
 
-## Playback & Queue
+These are the things that set Psysonic apart. To our knowledge, no comparable self-hosted desktop client ships them.
+
+## 🪐 Orbit — Shared Listening
+
+**Listen together, in sync, over your own server.**
+
+Orbit brings real-time synchronized group listening into Psysonic. Start a session, invite people with a link, and everyone hears the same thing at the same time — with host-controlled playback, a shared queue and guest song suggestions.
+
+The clever part: Orbit rides entirely on **your own Navidrome**. There is no external relay, no third-party service and no extra accounts. The session lives on your server, where it belongs. It is built for real-world music sharing without turning your self-hosted setup into a social-media circus.
+
+<div align="left">
+  <img src="public/orbit.png" alt="Orbit shared listening" width="520"/>
+</div>
+
+## ⚡ Local Library — Instant, and Almost Offline
+
+**A local index of your whole collection, so the app stays fast no matter what your connection does.**
+
+Psysonic keeps a local library of your collection's metadata right on your machine. Because the app already knows your tracks inside out, browsing, searching and starting playback are instant — even a 500 MB FLAC starts the moment you hit play, because nothing has to be fetched or parsed first.
+
+It also means the connection to your server stops being a bottleneck. Even on a slow, flaky or distant link, Psysonic stays responsive and **behaves almost like an offline player**, whatever the network is doing.
+
+And it's the foundation everything else is built on: the local library is what makes on-device analysis, smart audio and snappy navigation possible in the first place.
+
+## 🧠 On-Device Audio Analysis
+
+**One of the most powerful things Psysonic does — entirely on your own machine.**
+
+Built on top of the local library, Psysonic analyzes your tracks locally — **loudness, waveform and tempo** — with no cloud service and no required server-side plugin. That analysis is what powers content-aware AutoDJ transitions, LUFS-based loudness normalization and playback-speed control.
+
+This is a deep, genuinely useful layer that most clients simply don't have, and because it runs locally, it works exactly the same whether you're fully online or barely connected.
+
+## 🎧 AutoDJ — Content-Aware Crossfade
+
+**A DJ that listens to the music, not a stopwatch.**
+
+Most players do fixed-time crossfade: blend the last N seconds into the next N seconds, dead air and all. AutoDJ uses Psysonic's own audio analysis to **trim the silence at the edges of a track and blend out of the actual music** — for transitions that sound deliberate instead of mechanical. It is a standalone playback mode with smooth skip/interrupt handling and a configurable overlap.
+
+## 🔗 Navidrome-Native, Deeply
+
+**Not a generic Subsonic client wearing a Navidrome hat.**
+
+Psysonic binds Navidrome's native capabilities directly: server-side smart-playlist create/edit, playback reporting and OpenSubsonic capability probing. Most clients in this space stay Subsonic-generic. Psysonic goes deeper, so Navidrome users get the features their server can actually deliver.
+
+## 🎨 Community Theme Store
+
+**A real marketplace for themes — installable and schedulable.**
+
+Beyond a big set of built-in themes, Psysonic has a first-party theme registry: browse community themes, install them in-app, and let the **Theme Scheduler** switch looks automatically between day and night.
+
+---
+
+> ### Built to be trusted
+>
+> We take an enterprise-grade approach to development — continuously improving our automated testing and maintaining strict contracts between the backend and the frontend. Releases are cut from green CI, not vibes.
+
+---
+
+# ✨ More Highlights
+
+Features that go well beyond the basics. Not all of these are unique to Psysonic, but few clients bring this many together.
+
+## Audio & Loudness
 
-* Gapless playback
-* Crossfade
-* ReplayGain support
 * LUFS-based Smart Loudness Normalization
-* [AudioMuse-AI](https://github.com/NeptuneHub/AudioMuse-AI) support
-* Infinite Queue
-* Smart Radio sessions
-* Fast and responsive playback handling
-* Low memory usage compared to heavy web-first clients
-
-## Audio Tools
-
-* 10-band Equalizer
-* Equalizer presets
+* ReplayGain support and loudness-aware playback
+* 10-band Equalizer with presets
 * AutoEQ headphone correction
-* Per-device optimization
-* Loudness-aware playback options
+* Per-device EQ and output optimization
+* Adjustable playback speed
 
-## Library Management
+## Lyrics & Listening
+
+* Synced lyrics with seek support, from multiple providers ([YouLy+](https://github.com/ibratabian17/YouLyPlus), LRCLIB, NetEase)
+* Auto-scrolling sidebar lyrics and a fullscreen lyric mode
+* Last.fm scrobbling, similar artists, loved tracks and listening stats
+* Smart Radio sessions and an Infinite Queue
+* [AudioMuse-AI](https://github.com/NeptuneHub/AudioMuse-AI) support for sonic-similarity discovery (requires an AudioMuse-AI server)
+
+## Artwork & Visuals
+
+* Optional external artist imagery via **fanart.tv** — opt-in, shown on the artist page, fullscreen player and home hero (Navidrome stays the canonical cover-art source)
+* Cover art surfaced across the app, OS media controls and Discord Rich Presence
+
+## Library & Playlists
 
-* Fast search across large libraries
-* Albums, artists, tracks and genres
-* Ratings support
-* Multi-select bulk actions
-* Drag & drop playlist management
 * Smart Playlists
-* Built for large self-hosted collections
+* Drag & drop playlist management
+* Multi-select bulk actions
 
-## Lyrics & Discovery
+## Sharing
 
-* Synced lyrics with seek support
-* Lyrics provider support: [YouLy+](https://github.com/ibratabian17/YouLyPlus), LRCLIB and NetEase
-* Auto-scrolling sidebar lyrics
-* Fullscreen lyric mode
-* Last.fm scrobbling
-* Similar artists
-* Loved tracks and listening stats
+* Magic Strings sharing for albums, artists and queues
+* Navidrome user-management helpers for fast account sharing
 
-## Sharing & Social Listening
+## Offline, Sync & Deployment
 
-* Magic Strings sharing:
-
-  * share albums, artists and queues
-  * Navidrome user management helpers
-  * fast account sharing
-* Orbit shared listening sessions:
-
-  * host-controlled synchronized playback
-  * session invites via link
-  * guest song suggestions
-  * real-time queue interaction
+* Offline playback and downloads
+* USB / portable sync
+* LAN / remote auto-switching
+* Custom HTTP headers for reverse-proxy-gated servers (e.g. Cloudflare Access, Pangolin)
+* Backup and restore settings
+* In-app auto updater
 
 ## Personalization & Accessibility
 
-* Large theme collection
-* Catppuccin and Nord inspired styles
-* Glassmorphism effects
-* Font customization
-* Zoom controls
+* Font customization and zoom controls
 * Keybind remapping
-* Theme Scheduler for automatic day/night switching
 * Colorblind-friendly theme options
 * Keyboard-friendly navigation
 
-## Power User Extras
+## Power-User Extras
 
 * CLI controls
-* USB / portable sync
-* Backup and restore settings
-* In-app auto updater
-* LAN / remote auto switching
 
 ---
 
-<div align="left">
-  <img src="public/orbit.png" alt="Shared listening feature banner" width="520"/>
-</div>
+# ✅ The Basics, Done Right
 
-Orbit brings synchronized shared listening sessions directly into Psysonic.
+The things you simply expect from a serious music player — and Psysonic does them well.
 
-Start a session, invite others with a link and listen together with host-controlled playback, shared queue interaction and guest song suggestions. It is built for real-world music sharing without turning your self-hosted setup into a social-media circus.
+* Gapless playback and crossfade
+* Fast search across large libraries
+* Browse albums, artists, tracks and genres
+* Ratings
+* Queue management
+* Keyboard navigation
+* Media key support
+* Low memory usage and native performance compared to heavy web-first clients
+* Built for large self-hosted collections
 
 ---
 
@@ -137,7 +181,7 @@ Start a session, invite others with a link and listen together with host-control
 
 | OS      | Support                                                         |
 | ------- | --------------------------------------------------------------- |
-| Windows | Native installer                                                |
+| Windows | Native installer / WinGet                                       |
 | macOS   | Signed DMG                                                      |
 | Linux   | AppImage / DEB / RPM / AUR (`psysonic`, `psysonic-bin`) / NixOS |
 
@@ -153,9 +197,18 @@ curl -fsSL https://raw.githubusercontent.com/Psychotoxical/psysonic/main/scripts
 
 Linux builds are also available through GitHub Releases, AUR and Cachix/Nix.
 
+> **AppImage runs under X11/XWayland** — it pins `GDK_BACKEND=x11` for a stable WebKitGTK stack. For a native-Wayland launch, use the `.deb`, `.rpm`, AUR, or Nix packages, which follow your session's display server.
+
 ## Windows
 
-Download the latest installer from the [GitHub Releases](https://github.com/Psychotoxical/psysonic/releases/latest).
+Download the latest installer from the [GitHub Releases](https://github.com/Psychotoxical/psysonic/releases/latest).  
+or,  
+install via Windows Package Manager (WinGet):  
+```powershell
+winget install Psysonic
+```
+
+You can also browse and install it on [winstall.app](https://winstall.app/apps/Psychotoxical.Psysonic).
 
 ## macOS
 
@@ -191,6 +244,14 @@ Psysonic is built for self-hosted music collections. Your library is yours.
 * No analytics harvesting
 * No hidden tracking
 
+See [TELEMETRY.md](TELEMETRY.md) for the telemetry stance and [PRIVACY.md](PRIVACY.md) for how each opt-in integration handles data.
+
+---
+
+# Reviews
+
+* [An independent review at falu.github.io](https://falu.github.io/2026/06/19/psysonic.html)
+
 ---
 
 # Community & Support

RELEASE_PROCESS.md

@@ -21,12 +21,14 @@ Direct push to these branches is not part of normal human workflow. Use PRs and
 
 ## 2) Versioning rules (mandatory)
 
-Version is authoritative in `package.json` and `package-lock.json`.
+Version is authoritative in `package.json` and `package-lock.json`. Promotion workflows run `scripts/sync-tauri-version-from-package.js`, which also aligns `[workspace.package]` in `src-tauri/Cargo.toml`, `tauri.conf.json`, and the `psysonic*` workspace crate version fields in `src-tauri/Cargo.lock` (local `cargo build` alone does not commit that lock metadata).
 
 - `main` version format: `X.Y.Z-dev`
 - `next` version format: `X.Y.Z-rc.N`
 - `release` version format: `X.Y.Z`
 
+WiX/MSI bundle version: alphabetic pre-releases (`-dev`, `-rc.N`) map to monotonic `major.minor.patch.build` in `bundle.windows.wix.version` via `scripts/sync-wix-bundle-version.mjs` — dev `.1`, rc `.10000+N`, stable `.65534` (in-place MSI upgrade across promotion). About/updater still show the real package version. NSIS accepts full semver without this mapping.
+
 Rules:
 
 1. Never edit versions manually in random commits.
@@ -49,6 +51,7 @@ Rules:
 
 ### Step B: Promote to RC (`next`)
 
+0. Confirm `WHATS_NEW.md` has a `## [X.Y.Z]` section for the release line about to ship (user-facing copy for the in-app What's New screen; CI uploads it as `whats-new.md` on the release tag).
 1. Run workflow: **Promote main to next**.
 2. Workflow behavior:
    - validates required `main` checks before promotion (default: `ci-ok`, or UI-style `ci-main / ci-ok`; either satisfies the gate)

SECURITY.md

@@ -0,0 +1,28 @@
+# Security policy
+
+## Reporting a vulnerability
+
+**Please do not open a public GitHub issue for security problems.**
+
+Report them privately so we can investigate and coordinate a fix before details are public:
+
+- [Discord](https://discord.gg/AMnDRErm4u) — reach a maintainer directly
+- [Telegram](https://t.me/+GLBx1_xeH28xYTJi) — same
+
+Include what you can: affected version, platform (Windows / macOS / Linux), steps to reproduce, and impact if known.
+
+## What to expect
+
+- We will acknowledge your report as soon as we can.
+- We will work with you on verification and timing of any public disclosure.
+- We do not offer a paid bug-bounty program; credit in the changelog or release notes is given when reporters want it and when it fits the fix.
+
+## Scope notes
+
+- **This repository** — Psysonic desktop application source.
+- **AUR packages** ([`psysonic`](https://aur.archlinux.org/packages/psysonic), [`psysonic-bin`](https://aur.archlinux.org/packages/psysonic-bin)) are maintained separately; packaging issues there should go through the AUR unless they reflect a vulnerability in the upstream app itself.
+- **Your music server** (Navidrome, Gonic, etc.) is outside this project's scope; report server-side issues to those projects.
+
+## Secure development
+
+Pull requests are reviewed on `main`. **Dependency security updates** are tracked via Dependabot (PRs only for reported vulnerabilities and their fix paths—not routine version bumps). For general contribution expectations, see [CONTRIBUTING.md](CONTRIBUTING.md).

TELEMETRY.md

@@ -0,0 +1,66 @@
+# Privacy & Telemetry
+
+Privacy is not an afterthought in Psysonic. It has been part of the project’s foundation from the very beginning.
+
+Psysonic was built with the clear intention of giving users control over their own music experience without silently observing what they do. We believe that people should be able to use software on their own systems without being monitored by the developers behind it.
+
+## No Telemetry
+
+Psysonic does **not** collect telemetry.
+
+That means:
+
+- no usage statistics
+- no background tracking
+- no hidden analytics
+- no hardware or system profiling
+- no automatic crash or behavior reporting
+- no data harvesting of any kind
+
+Psysonic itself does not collect, store, sell, analyze, or transmit personal usage data.
+
+## A Conscious Decision
+
+We are aware that telemetry can make software development easier.
+
+Anonymous usage statistics, crash reports, platform information, and diagnostic data can help developers find bugs faster, understand which systems are used most often, and prioritize fixes more efficiently.
+
+However, we made a conscious decision not to build Psysonic around that model.
+
+For us, respecting user privacy is more important than collecting additional data for convenience. Modern software already tracks more than enough, often by default and often without users fully understanding what is being collected. Psysonic intentionally takes a different approach.
+
+## External Services Are Opt-In
+
+Some Psysonic features can communicate with external services, such as:
+
+- Last.fm
+- Bandsintown
+- Discord Rich Presence
+- Fanart.tv
+
+These integrations are optional and clearly presented as opt-in features. They are never required for using Psysonic.
+
+If you enable one of these integrations, data may be transmitted to the respective external service provider as part of how that service works. Psysonic itself does not collect or process that data for its own analytics.
+
+You decide which integrations you want to use.
+
+## Community Feedback Instead of Silent Tracking
+
+Instead of telemetry, Psysonic relies on direct community feedback.
+
+Bug reports, feature requests, platform issues, and general discussions happen openly through community channels such as Discord and Telegram. Additional contact options, including WhatsApp and Facebook groups, are planned for the future.
+
+We prefer talking to users directly over silently collecting information in the background.
+
+This approach may sometimes require more communication, but it also keeps the relationship between the project and its users transparent and respectful.
+
+## Our Position
+
+Psysonic is built for people who want to enjoy their own music collection on their own terms.
+
+No hidden tracking.  
+No telemetry by default.  
+No analytics quietly running in the background.
+
+This is intentional, and it is not planned to change.
+

WHATS_NEW.md

@@ -0,0 +1,361 @@
+# What's New
+
+User-facing release highlights for the in-app **What's New** screen. Maintainers refresh the
+current line before promoting to `next` / `release`. Technical details and PR credits stay in
+`CHANGELOG.md`.
+
+Within each section, order by **user impact** (most noticeable first) — not PR merge order.
+`CHANGELOG.md` keeps strict PR order inside Added / Changed / Fixed.
+
+
+## [1.50.0]
+
+## Highlights
+
+### Multi-library filter — browse across your libraries
+
+- The sidebar library picker now supports **multi-select with priority ordering** — browse, search, genres, and album/artist detail views aggregate across the libraries you pick and de-duplicate shared items by priority.
+- Cross-library matching normalises names per locale (German ß, Norwegian æ, French œ, Romanian ș/ț, Cyrillic ё/й); CJK titles are matched as-is.
+- The Genres page and album browse genre filter list the full catalog on large libraries when **All libraries** is selected.
+
+### Navidrome public share links — listen without logging in
+
+- Paste or search a Navidrome **public share** URL (`/share/{id}`) to preview the shared track list, then play the full queue with no server account.
+- Share playback stays isolated from your logged-in Navidrome queue — idle server play-queue pull cannot replace a share session while you are connected elsewhere.
+- While a share queue is active, **Save Playlist** is hidden in the queue toolbar; **Share** copies the original Navidrome `/share/{id}` page URL.
+
+### Fullscreen player — Minimal, Immersive, and Prism
+
+- **Settings → Appearance → Fullscreen player style** now offers three looks: **Minimal** (the current sharp view), **Immersive** (artist photo/backdrop with rail or Apple-style scrolling lyrics), and **Prism** (full-bleed artist backdrop, glass lyrics panel, and a single glass control bar).
+- In Immersive, **Show artist photo** and **Photo dimming** are configurable; Prism drives progress and the active lyric line from the cover-derived accent colour.
+
+### Lyrics that follow the singer, word by word
+
+- The **Server** lyrics source now highlights lyrics word by word as a track plays, so karaoke sync no longer needs the third-party YouLyPlus backend. It requires Navidrome 0.63 or newer and lyrics that carry word timing (TTML or Enhanced LRC files) — everything else keeps highlighting line by line. The requirements are spelled out under **Settings → Lyrics → Lyrics Sources**.
+- Embedded Enhanced LRC no longer prints raw word timing codes in the lyric text; FLAC, Ogg Vorbis, Opus, and Speex files with synced lyrics in the `SYNCEDLYRICS` tag show embedded lyrics again.
+
+### Player bar — build your own, plus shuffle
+
+- **Settings → Personalisation → Player bar** now also hides the **stop button** and shows the **album name** under the artist (off by default; clicking it opens the album). Star rating, favourite, love, playback speed, equalizer, and mini player can be **dragged into any order** you like — the section is no longer behind **Advanced**.
+- A **shuffle toggle** in the player bar shuffles the queue from the current track onwards while keeping the playing track in place; turning shuffle off restores the original order. It survives restarts and keeps Orbit guests in sync with the host. Hide the button from **Settings → Personalisation → Player bar** if you prefer.
+
+### Track lists — optional album cover thumbnails
+
+- Browse and queue track rows can show each track's **album** cover (per-disc art when the album has distinct disc covers).
+- **Settings → Appearance** adds separate toggles for queue vs browse tracklists; playlist, Favorites, and album-detail grids gain a flex-resize handle on the title column when covers are shown.
+- Album detail pages skip per-row cover thumbs when the album art is already shown above the list.
+
+### Discord — Server cover art without exposing your login
+
+- **Settings → Integrations → Discord → Cover art source** includes a **Server** option alongside **None** and **Apple Music**. It resolves artwork through the server's public album image link — never an authenticated URL that could expose your login credentials. Requires a publicly reachable server.
+
+### Artists browse — album artists or track credits
+
+- Toggle **Album artists** vs **Track artists** on the Artists page — album mode lists indexed album artists; track mode includes featured and guest performers from the local artist index. The choice persists across restarts like **Show artist images**.
+- Artist name search no longer depends on query letter case for Cyrillic and other non-ASCII names when the local library index is enabled.
+
+### Theme Store — what's new on each theme
+
+- Each theme card has an expandable **What's new** with per-version release notes from the author — including non-visual fixes.
+- Installed themes with an available update now appear at the top of the store list so you do not have to hunt for them.
+- **Settings → System → Contributors** lists community theme authors in a **Themes** section alongside app contributors; author names refresh quietly from the store in the background.
+
+### Italian and Bulgarian — now in your language
+
+- Psysonic is now available in **Italian (Italiano)** and **Bulgarian (Български)** — pick either from the language menu on the **Settings** and **Login** screens.
+
+### Start minimized to tray
+
+- New **Start Minimized to Tray** toggle under **Settings → System → Behavior** — the next cold start keeps the main window hidden and Psysonic runs from the system tray until you show it from the tray icon. Requires **Show Tray Icon**; applies on the next launch only.
+- Opening the main window from the tray after a cold start renders the sidebar and main content immediately — including on Linux tiling window managers — instead of leaving them invisible or blank until a restart.
+
+### Square corners — a sharper, boxier look
+
+- New **Square Corners** toggle under **Settings → Appearance → Visual Options → Display** strips the rounded corners off cards and cover art across the app — handy when a theme's rounding does not suit your album covers. Off by default; buttons, inputs, and dialogs keep the theme's corners.
+
+## Improved
+
+- With **Remember EQ per device** on and **System Default** selected, the equalizer now keys profiles to the active OS default output and switches when that default changes outside the app (Windows sound settings, Stream Deck, PipeWire / `wpctl`, and similar). **Linux:** when PipeWire has already moved the stream to the new default, the device watcher skips a redundant reopen to avoid a post-switch stutter. **Windows:** release builds no longer freeze on the loading splash; audio output devices use stable backend IDs with clearer labels, and device-change detection works again after upgrade.
+
+## Fixed
+
+### Playback and audio
+
+- Playing a song from a playlist no longer shows the track's own cover in Now Playing when the album page would show album art — Now Playing consistently uses the album cover.
+- ReplayGain applies when stream or queue metadata resolves late; gapless auto-advance no longer leaves the playbar on the previous track.
+- Pausing a large queue behind a reverse proxy (e.g. Nginx) no longer snaps playback back to an earlier track — Navidrome saves via POST when supported, and a failed save no longer lets idle auto-pull overwrite your queue.
+- Internet Radio equalizer presets and slider changes now apply to live stations — not just library tracks.
+
+### Offline, Now Playing, and Navidrome
+
+- Desktop builds no longer get stuck showing "offline" when WebKitGTK leaves `navigator.onLine` at `false` while the server is reachable — the app confirms with a real server probe instead.
+- When browsing offline, Artists, Albums, Tracks, and Genres list only content with on-disk bytes — pins, favorites-auto saves, and hot-cache playback — instead of the full server or local index catalog.
+
+### Themes and integrations
+
+- Connecting a scrobble service in **Settings → Integrations → Music Network** now shows the underlying error alongside the generic network message, so a bad URL or rejected token is easier to tell apart from a reachability problem on your machine.
+- Horizontal album rails in themes with drop shadows no longer clip card shadows at the edges — scroll arrows keep working without theme authors overriding rail overflow.
+
+### Browse and library
+
+- Adding tracks to a playlist no longer fails past ~341 songs — writes go to the server in batches, and large-playlist edits are faster.
+- Queue rows far from the playing track no longer stay stuck on a "…" placeholder — the queue loads details for whatever you scroll to, in the desktop panel, mobile drawer, and fullscreen **Up next** overlay.
+- The year filter on **All Albums** no longer clamps on every keystroke while you type a four-digit year — it commits on blur, Enter, or outside click.
+- Starring an album on the detail page fills the heart immediately and keeps it filled after reload; album-level stars and ratings reconcile consistently across browse and Favorites.
+- Renamed artists no longer linger as ghost entries that open to "Artist not found"; album artist links and cover tiles in **Random Albums** stay consistent after resync.
+- Custom playlist and internet radio covers uploaded in Navidrome show again on cards and detail headers.
+- Sorting albums by artist now follows the name shown on each row — featured-guest releases no longer land under the wrong artist in **Artist / Year** order.
+
+### Other
+
+- Servers behind a custom HTTP header gate (Cloudflare Access, Pangolin, and similar) now work for the full app — add-server errors stay on the form with a clear reason, browse and detail views load natively behind the gate, streaming and covers carry the header reliably, and returning to a LAN address upgrades the connection automatically when both LAN and public endpoints are configured.
+- Modal dialogs now announce their title to screen readers when they open.
+- **Windows:** **Who is listening?** no longer shows `psysonic/undefined` as the client id.
+
+
+## [1.49.0]
+
+## Highlights
+
+### Play queue sync — pick up where you left off on another device
+
+- Click the header connection indicator to **pull** the active server's play queue when it differs from yours; a yellow LED shows when browse and playback servers do not match.
+- While paused or stopped, **idle auto-pull** checks every 10 seconds and applies server changes when you have been still for 30+ seconds.
+- Queue **push** sends only tracks owned by the playback server, so mixed-server queues stay sane when you switch servers.
+- Local queue edits while paused are no longer overwritten by auto-pull; pressing **Play** pushes your changes immediately, and the sync LED no longer flashes on every track during normal playback.
+- After the last track ends with repeat off, idle pull no longer rewinds to an earlier server position — the queue stays where playback finished.
+
+### AutoDJ — minimum pauses, maximum music
+
+- New **AutoDJ** mode — a smart crossfade that blends tracks intelligently: it trims dead air, rides natural fades, and keeps handovers musical instead of abrupt. Its own button in the queue toolbar and its own entry under **Settings → Audio**, alongside Crossfade and Gapless — only one at a time. Off by default; classic **Crossfade** is unchanged.
+- **Smooth skip** (on by default with AutoDJ) crossfades manual Next/Previous and track picks from where you are listening instead of hard-cutting; the play/pause button pulses while a blend is active.
+- Cap how long overlaps may last: **Auto** (content-driven, up to 12 s) or **Limit** (slider 2–30 s) under **Settings → Audio → Track transitions**.
+- The last track in the queue plays through to the end instead of being trimmed when nothing follows.
+
+### Playlist folders — your playlists, organised
+
+- Folders on the **Playlists** page and in the sidebar keep long lists tidy — group by mood, occasion, or anything you like. Drag playlists in, rename and collapse folders, or choose **Move to folder** from the right-click menu. Switch back to a flat list whenever you prefer.
+
+### Settings — tidier and easier to scan
+
+- Settings are grouped into clear, labelled panels so related options sit together — less hunting around. The **Native Hi-Res Playback** option now explains in plain language what it actually does.
+- **Normalization** and **Track transitions** are now their own sections under **Settings → Audio**, and the queue options (display mode, toolbar, and Play-Next order) are gathered into one **Queue Settings** group under **Personalisation**.
+
+### Japanese, Hungarian, and Polish — now in your language
+
+- Psysonic is now available in **Japanese (日本語)**, **Hungarian (Magyar)**, and **Polish (Polski)** — pick any of them from the language menu on the **Settings** and **Login** screens.
+
+### Theme store — spot updates, pick your style
+
+- Version numbers on store themes and ones you have installed make it obvious when an update is ready.
+- Filter for **animated** or **static** themes only — less scrolling when you already know the look you want.
+
+### Hi-Res playback — smoother transitions between sample rates
+
+- Under **Settings → Audio → Native Hi-Res**, choose a **blend rate** (44.1 / 88.2 / 96 kHz) for crossfade, AutoDJ, and gapless when adjacent tracks differ in sample rate — mixed 88.2 ↔ 44.1 kHz handovers no longer tear mid-transition.
+
+### Artist artwork — richer home, artist, and fullscreen views
+
+- Switch on **External Artwork Scraper** under **Settings → Integrations** to pull artist imagery from fanart.tv: a wide backdrop on the fullscreen player, a banner across the top of the artist page, and now the artist's backdrop behind the home screen's **mainstage** too. Off by default, your Navidrome covers stay in charge, and turning it back off removes the fetched images again.
+- Choose which images each place uses as its background, and in what order — drag to reorder or switch a source off — right under the same setting. The mainstage also loads the next backdrops ahead of time so they appear without a blank gap.
+
+### Equalizer — a profile per output device
+
+- Turn on **Remember EQ per device** under **Settings → Audio** and Psysonic keeps a separate equalizer setup for each output — speakers, headphones, a USB DAC — and switches to the right one automatically when you change devices, including when **System Default** is selected and the OS default output changes outside the app. Off by default.
+
+### Orbit — everyone hears transitions the host chose
+
+- In a shared **Orbit** session, the host's crossfade, gapless, or AutoDJ settings — including length and smooth skip — apply to all guests until you leave. Transition controls in **Settings → Audio** and the queue toolbar show as host-controlled while you are a guest.
+
+### Themes — follow your system's light and dark mode
+
+- The theme scheduler can now match your **system's light/dark setting** instead of a fixed clock: pick a light theme and a dark one, and Psysonic switches along with your OS. Choose **Time of Day** or **System Theme** under **Settings → Themes** — the existing time-based schedule is still there.
+
+### Servers behind a reverse proxy — custom HTTP headers
+
+- Per-server **custom HTTP headers** in **Settings → Servers** for Cloudflare Access, Pangolin, and similar gates — applied to library sync, playback, covers, offline download, and the rest without putting secrets in invite links.
+
+### Album details — every genre, not just the first
+
+- Album details now show **all** the genres a release spans: the main genre appears inline with a **+N** chip that opens the full, clickable list, each genre linking to its own page. Genres combine album and track tags and read from the local library index, so they work offline too.
+
+### Compact buttons — switch to icon-only controls
+
+- New **Compact buttons** option under **Settings → Appearance** switches the action and toolbar buttons between large labelled buttons and small icon-only ones — across album, artist and playlist headers, the shared browse toolbars, and the Most Played controls. Defaults to large; on phones the album header keeps its large touch targets.
+
+### Playlists — sort by date added
+
+- Sort a playlist by **Date added** (newest or oldest first), or by title, artist, album and the other columns, from a new sort dropdown in the playlist toolbar. The Subsonic API has no per-track "added on" date, so this follows the playlist's own order — servers add new tracks at the end, so newest-first puts your latest additions on top.
+
+## Improved
+
+- **macOS:** the window's title bar now follows the active theme instead of the grey system bar; the native window buttons stay in place, floating over the themed bar.
+- Pressing **Play**, **Shuffle**, or **Add to queue** on a playlist starts playback without reloading the whole page with a spinner — editing the playlist still refreshes the list as before.
+- Dragging sidebar items in **Settings → Personalisation → Sidebar** (or long-pressing in the sidebar itself) keeps each item exactly where you release it — no snap-back or off-by-one landing.
+
+## Fixed
+
+### Playback and audio
+
+- **Timeline** mode keeps your session play-history strip when you **Play** an album or playlist; the current track stays pinned at the top, and replaying a history row inserts after the playing track instead of replacing the queue.
+- **Opus/Ogg** tracks no longer fight the seekbar while they are still loading — scrub to where you want to be and keep listening.
+- The equalizer preset picker shows the active **AutoEQ** profile name again instead of going blank.
+
+### Offline, Now Playing, and Navidrome
+
+- The **Live** listener count in the header stays up to date even when the "Who is listening?" popover is closed.
+
+### Browse and library
+
+- Album and artist covers — and the full-size view when you click a cover — open at full resolution again instead of looking soft or small.
+- Albums sorted by artist now list each artist's work A–Z by title — no more random order within a name.
+- **Artist → Year** keeps artists grouped but walks through their albums chronologically, oldest first.
+- Genres with no remaining tracks disappear after you retag and resync the library, without restarting the app.
+- The **Artists** A–Z index matches Navidrome ignored articles — **The Beatles** lands under **B**, not **T**.
+- **All Albums → Only compilations** and **Favorites** return the albums you expect instead of an empty or partial list.
+
+### Player and playlists
+
+- **Add to playlist** from the player bar adds the song you are hearing, not the whole album.
+- On **Favorites**, bulk **Add to playlist** and **Play selected** / **Add selected to queue** act on every checked row.
+- **Play Now** on a playlist in the right-click menu starts playback instead of only opening the list.
+- Playlists page header buttons wrap on narrow windows instead of clipping off-screen when the queue panel is open.
+
+### Other
+
+- **Orbit** sessions stay reliable on long listens — guests keep receiving updates, radio no longer pollutes the shared queue, and opening Psysonic on a second device does not delete a live session elsewhere.
+- On the artist page, the header uses the fanart.tv background when no banner is available — the same image the fullscreen player already showed.
+- **Windows:** Previous, Play/Pause, and Next are back when you hover the taskbar icon — and Play/Pause shows whether music is playing or paused.
+- **macOS:** the dock icon matches native app sizing instead of looking oversized.
+- **Linux:** **Niri** is recognised as a tiling compositor and gets the same custom title bar behaviour as Hyprland and Sway; the "new version available" popup reads clearly on setups where the background blur used to bleed through.
+
+## Under the hood
+
+- If a screen hits an unexpected error, the app now shows a small recoverable card (**Try again** / **Reload app**) and keeps playing, instead of the whole window going blank.
+
+
+## [1.48.1]
+
+## Fixed
+
+### Playback and audio
+
+- Changing tracks — skipping, or the automatic advance at the end of a song — no longer freezes the interface for a few seconds: the progress bar and lyrics keep updating, and on **Windows** a change of output device now takes effect right away.
+- Seeking an **Opus/Ogg** track — and then pressing **Stop** — no longer crashes the app.
+- **macOS:** pausing or stopping playback and then unplugging headphones (or switching the output device) no longer makes playback restart — it stays paused or stopped.
+
+### Offline, Now Playing, and Navidrome
+
+- On large **Navidrome** libraries, background library sync no longer locks up database writes for minutes at a time, so play history, ratings, and other saves go through without long delays.
+
+### Themes and integrations
+
+- **Discord** Rich Presence shows the album cover again when a server profile has both a local and a public address.
+
+### Other
+
+- **Windows:** the system media controls (Quick Settings media tile, lock screen, and third-party flyouts) now show the album cover and display **Psysonic** with its icon instead of "Unknown application".
+- **macOS:** closing the window with the red close button now respects **Minimize to Tray** — with it on, the window hides to the tray instead of quitting.
+
+
+
+## [1.48.0]
+
+## Highlights
+
+### Offline listening
+
+- When the server is unreachable, browse and detail pages show what you already have locally instead of empty errors — albums, artists, playlists, and cross-server favorites.
+- Starred tracks, pinned albums, and playlists live under one **media** folder; browse them in **Offline Library** and see disk usage at a glance.
+- **Favorites auto-sync** keeps loved songs on disk; pinned albums and playlists refresh when the library index updates.
+
+### Music Network — scrobble beyond Last.fm
+
+- **Settings → Integrations** now hosts a **Music Network**: connect **Last.fm**, **Libre.fm**, **ListenBrainz**, **Maloja**, **Rocksky**, **Koito**, or your own **GNU FM** instance — and scrobble to several at once.
+- Pick a **primary** service for loved tracks, similar artists, and stats; other connections still receive scrobbles. Your existing Last.fm setup migrates automatically.
+- A master switch turns the whole network on or off.
+
+### Theme Store
+
+- Browse and install community themes from **Settings → Themes** — search, dark/light filter, full-size previews, and sort by popularity or date.
+- Six palettes ship with the app; everything else installs on demand and works offline after the first download.
+- **Now Playing** follows every theme cleanly, including light palettes.
+- Import a theme from a local `.zip` when you have a package from a friend or your own design.
+- The sidebar nudges you when an installed theme has an update; one-click update from the theme card.
+
+### Fullscreen player
+
+- Rebuilt for much lower CPU and memory use: a calm, sharp fullscreen view with album art, waveform seekbar, up-next queue, synced lyrics, ratings, and a clock that follows your **Clock format** setting.
+- The song title no longer shows a leading track number, and descenders (g, j, p, q, y) are no longer clipped.
+
+### Live — richer now playing on Navidrome 0.62+
+
+- On servers with OpenSubsonic **playbackReport** (Navidrome ≥ 0.62), **Live** shows who is playing or paused, how far into the track they are, and playback speed when another client sends it — with smooth position updates between refreshes.
+- In **Who is listening?**, each listener shows a small status dot (playing, paused, or idle) instead of a vague “minutes ago” line.
+
+### Queue — Timeline mode
+
+- A third queue layout keeps the current track in the middle with history above and up next below — great for long listening sessions. Cycle the header control or pick it in **Settings → Personalisation → Queue display**.
+
+### Settings → Servers
+
+- Each card shows the server software and version (e.g. **Navidrome 0.62.0**) under the name, with a cleaner two-line layout and compact actions.
+- Navidrome **0.62+** shows a green **AudioMuse-AI** badge when the plugin is detected — no manual toggle on current Navidrome.
+
+### Sidebar — pin Now Playing to the top
+
+- New **Settings → Sidebar** toggle moves **Now Playing** to the top of the sidebar instead of the bottom (off by default).
+
+### Startup
+
+- A themed loading splash appears while the app starts — colours follow your active theme, including community palettes.
+
+## Improved
+
+- Audio decoding runs on **Symphonia 0.6**; streams start sooner and recover from stalls without restarting the player.
+- The **Preload Next Track** toggle under **Settings → Storage → Buffering** is gone — playback no longer waits on that extra RAM prefetch. Gapless, crossfade, and Hot Cache behave as before.
+- New **Semitones** playback-speed strategy (±12 st, 0.1 step) with two-decimal speed readout; optional fine steps in **Settings → Audio → Advanced**.
+
+## Fixed
+
+### Playback and audio
+
+- **Windows:** the app no longer keeps the audio device open while idle, so the system can sleep when music is not playing.
+- **macOS:** steady playback stutter from background device polling is gone on the default output path.
+- After a long pause, the seekbar shows the saved position immediately and the next **Play** resumes without an audible blip at track start.
+- **Stop** keeps the real waveform on the seekbar instead of falling back to flat bars.
+
+### Offline, Now Playing, and Navidrome
+
+- Now Playing cards (**from this album**, discography, most played) stay populated during cached and offline playback instead of blanking out on track change.
+- Navidrome **Show in Now Playing** and play-count scrobbles work when audio plays from hot cache, offline pins, or auto-synced favorites.
+- Mixed-server queues still report to the correct Navidrome server.
+
+### Themes and integrations
+
+- Self-hosted Music Network targets (Koito, Maloja, custom GNU FM with a pasted token) scrobble again — reconnect once if you connected before this fix.
+- Favoriting from the player bar, fullscreen player, or shortcuts updates the star in track lists and playlists immediately.
+- Discord Rich Presence shows album art again when covers come from the server.
+- Focus rings and dropdown borders follow the active theme consistently.
+
+### Browse and library
+
+- Tracks tagged with several genres in one field (e.g. `Metal/Ambient/Experimental`) match **each genre** again in browse, filters, and search.
+- **All Albums → Only compilations** returns results for common tagging patterns.
+- Album grids show the album artist on compilations instead of a random track artist.
+- Song rails (**Random Picks**, **Discover Songs**, etc.) link each name in multi-artist credits separately.
+- **Artist → Top Tracks** play works even when the artist page has no albums loaded yet.
+- **Home → Most Played** no longer jumps the page when you load more albums.
+- **Mainstage** hero backdrop stays in sync when you skip albums quickly.
+
+### Other
+
+- **Linux:** the `curl | bash` auto-installer works again.
+- **Linux:** internet radio no longer appears twice in the desktop now-playing overlay.
+- On Navidrome **0.62+**, add/edit/delete radio stations is shown only to admin accounts; everyone can still play and favourite stations.
+- **Linux custom title bar:** pick window button styles (dots, flat, pill, and more) and optionally hide minimize in **Settings → Appearance**.
+- The active server card under **Settings → Servers** draws a complete border on all sides.
+
+## Under the hood
+
+- Navidrome **0.62+** auto-detects **AudioMuse-AI** and routes Instant Mix / Lucky Mix through the smarter API when the plugin is present — older Navidrome keeps the manual toggle you already know.

completions/_psysonic

@@ -149,7 +149,7 @@ case ${sub[1]} in
     (( n == 1 )) && _message -e descriptions 'integer delta (seconds, e.g. -5)'
     ;;
   volume)
-    (( n == 1 )) && _message -e descriptions 'percent 0–100'
+    (( n == 1 )) && _message -e descriptions 'percent 0–100, or ±N for relative change'
     ;;
   play)
     (( n == 1 )) && _message -e descriptions 'Subsonic id (song, album, or artist)'

completions/psysonic.bash

@@ -165,12 +165,17 @@ _psysonic_complete() {
     rating)
       (( n == 1 )) && _psysonic_compreply_from_compgen '0 1 2 3 4 5' "$cur"
       ;;
-    seek|volume)
+    seek)
       if (( n == 1 )); then
         _psysonic_compopt -o default
         COMPREPLY=()
       fi
       ;;
+    volume)
+      if (( n == 1 )); then
+        _psysonic_compreply_from_compgen '+5 +10 -5 -10 50' "$cur"
+      fi
+      ;;
     play)
       if (( n == 1 )); then
         _psysonic_compopt -o default

eslint.config.gradual.mjs

@@ -0,0 +1,45 @@
+import eslint from '@eslint/js';
+import globals from 'globals';
+import reactHooks from 'eslint-plugin-react-hooks';
+import reactRefresh from 'eslint-plugin-react-refresh';
+import tseslint from 'typescript-eslint';
+
+export default tseslint.config(
+  // `scripts/` (Node CI helpers) is intentionally ignored — this config targets the browser `src/` tree.
+  { ignores: ['dist', 'coverage', 'src-tauri', 'research', 'scripts'] },
+  // This gradual baseline deliberately omits the React Compiler rules (set-state-in-effect, refs,
+  // immutability, …) that the strict config enables. The per-line `eslint-disable-next-line` directives
+  // those rules require therefore read as "unused" here, so unused-directive reporting is turned off for
+  // this config only — the strict config keeps the default reporting and stays 0/0.
+  { linterOptions: { reportUnusedDisableDirectives: 'off' } },
+  eslint.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    files: ['**/*.{ts,tsx}'],
+    languageOptions: {
+      ecmaVersion: 2020,
+      globals: globals.browser,
+    },
+    plugins: {
+      'react-hooks': reactHooks,
+      'react-refresh': reactRefresh,
+    },
+    rules: {
+      'react-hooks/rules-of-hooks': 'error',
+      'react-hooks/exhaustive-deps': 'warn',
+      'react-refresh/only-export-components': [
+        'warn',
+        { allowConstantExport: true },
+      ],
+      '@typescript-eslint/no-unused-vars': [
+        'warn',
+        {
+          argsIgnorePattern: '^_',
+          varsIgnorePattern: '^_',
+          caughtErrorsIgnorePattern: '^_',
+        },
+      ],
+      '@typescript-eslint/no-explicit-any': 'warn',
+    },
+  },
+);

eslint.config.mjs

@@ -0,0 +1,45 @@
+import eslint from '@eslint/js';
+import globals from 'globals';
+import reactHooks from 'eslint-plugin-react-hooks';
+import reactRefresh from 'eslint-plugin-react-refresh';
+import tseslint from 'typescript-eslint';
+
+export default tseslint.config(
+  // `scripts/` (Node CI helpers) is intentionally ignored — this config targets the
+  // browser `src/` tree. See `npm run lint:scripts` if scripts ever need a Node-globals lint pass.
+  // `src/generated` holds machine-generated output (release-notes bundle,
+  // tauri-specta `bindings.ts`) — not linted. `bindings.ts` is still type-checked
+  // by tsc (the FE↔BE contract); its generated runtime helper uses `any`.
+  { ignores: ['dist', 'coverage', 'src-tauri', 'research', 'scripts', 'src/generated'] },
+  eslint.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    files: ['**/*.{ts,tsx}'],
+    languageOptions: {
+      ecmaVersion: 2020,
+      globals: globals.browser,
+    },
+    plugins: {
+      'react-hooks': reactHooks,
+      'react-refresh': reactRefresh,
+    },
+    rules: {
+      ...reactHooks.configs.recommended.rules,
+      'react-refresh/only-export-components': [
+        'warn',
+        { allowConstantExport: true },
+      ],
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        {
+          argsIgnorePattern: '^_',
+          varsIgnorePattern: '^_',
+          caughtErrorsIgnorePattern: '^_',
+        },
+      ],
+      '@typescript-eslint/no-explicit-any': 'error',
+      // Promote deps to error at strict stage (wave 6+)
+      'react-hooks/exhaustive-deps': 'error',
+    },
+  },
+);

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1776877367,
-        "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
+        "lastModified": 1783776592,
+        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57",
+        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
         "type": "github"
       },
       "original": {

flake.nix

@@ -3,17 +3,19 @@
     Psysonic for NixOS / nixpkgs: installable app + dev shell.
 
     Packages:
-      nix build .#psysonic          # or .#default — desktop app (.desktop + icon); GDK_BACKEND=x11 (default, fewer WebKit surprises)
-      nix build .#psysonic-gdk-session   # same app, no forced GDK x11 — optional; can misbehave on some stacks (see nixos-install.md)
+      nix build .#psysonic          # or .#default — desktop app; GDK follows session (no wrapper pin)
+      nix build .#psysonic-gdk-session   # same derivation (back-compat alias); see nixos-install.md
+      nix build .#psysonic-x11-legacy    # legacy: GDK_BACKEND=x11 wrapper (old default)
       nix profile install .#psysonic
 
     Run (after build, or from any clone with flake):
       nix run .#psysonic
-      nix run .#psysonic-gdk-session
+      nix run .#psysonic-gdk-session   # identical to psysonic
+      nix run .#psysonic-x11-legacy    # GDK x11 pinned (former default wrap)
       nix run github:Psychotoxical/psysonic
 
     Development:
-      nix develop                   # mkShell (Rust/Node/WebKit deps + hooks)
+      nix develop                   # mkShell (Rust/Node/WebKit deps); same GDK idea as installable (no GDK pin)
       nix shell .#devShells.default # same environment without entering subshell semantics
       Local cargo output: .build-local/ (gitignored; not copied into flake source tarball)
 
@@ -87,9 +89,6 @@
             export GIO_EXTRA_MODULES="${pkgs.glib-networking}/lib/gio/modules''${GIO_EXTRA_MODULES:+:$GIO_EXTRA_MODULES}"
             export LLVM_COV="${pkgs.llvmPackages.llvm}/bin/llvm-cov"
             export LLVM_PROFDATA="${pkgs.llvmPackages.llvm}/bin/llvm-profdata"
-            export GDK_BACKEND=x11
-            export WEBKIT_DISABLE_COMPOSITING_MODE=1
-            export WEBKIT_DISABLE_DMABUF_RENDERER=1
             unset CI
           '';
 
@@ -106,28 +105,38 @@
           inherit upstreamMeta;
         };
 
-      psysonicGdkSessionFor =
+      # Same app with GDK_BACKEND pinned to X11 — previous default wrapper behaviour (see nixos-install.md).
+      psysonicX11LegacyFor =
         system:
         nixpkgs.legacyPackages.${system}.callPackage ./nix/psysonic.nix {
           src = self;
           inherit upstreamMeta;
-          forceGdkX11 = false;
+          forceGdkX11 = true;
         };
+
     in
     {
       devShells = forSystem (system: { default = mkShellFor system; });
 
-      packages = forSystem (system: {
-        psysonic = psysonicFor system;
-        psysonic-gdk-session = psysonicGdkSessionFor system;
-        default = psysonicFor system;
-      });
+      packages = forSystem (
+        system:
+        let
+          p = psysonicFor system;
+          pX11 = psysonicX11LegacyFor system;
+        in
+        {
+          psysonic = p;
+          psysonic-gdk-session = p;
+          psysonic-x11-legacy = pX11;
+          default = p;
+        }
+      );
 
       apps = forSystem (
         system:
         let
           p = psysonicFor system;
-          pGdk = psysonicGdkSessionFor system;
+          pX11 = psysonicX11LegacyFor system;
         in
         {
           default = {
@@ -140,9 +149,17 @@
           };
           psysonic-gdk-session = {
             type = "app";
-            program = lib.getExe pGdk;
+            program = lib.getExe p;
             meta = {
-              inherit (pGdk.meta) description homepage license;
+              inherit (p.meta) description homepage license;
+              mainProgram = "psysonic";
+            };
+          };
+          psysonic-x11-legacy = {
+            type = "app";
+            program = lib.getExe pX11;
+            meta = {
+              inherit (pX11.meta) description homepage license;
               mainProgram = "psysonic";
             };
           };

index.html

@@ -6,9 +6,88 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="description" content="Psysonic – Dein Navidrome Desktop Player" />
     <title>Psysonic</title>
+    <script src="/startup-splash-preflight.js"></script>
+    <style>
+      html, body {
+        margin: 0;
+        min-height: 100%;
+        background: var(--startup-splash-bg, #1e1e2e);
+      }
+      #root.app-root--startup-pending {
+        visibility: hidden;
+      }
+      #app-startup-splash {
+        --splash-bg: var(--startup-splash-bg, #1e1e2e);
+        --splash-text: var(--startup-splash-text, #cdd6f4);
+        --splash-muted: var(--startup-splash-muted, #a6adc8);
+        --splash-accent: var(--startup-splash-accent, #cba6f7);
+        --splash-track: var(--startup-splash-track, #313244);
+        --splash-logo-start: var(--startup-splash-logo-start, var(--splash-accent));
+        --splash-logo-end: var(--startup-splash-logo-end, var(--splash-accent));
+        position: fixed;
+        inset: 0;
+        z-index: 2147483646;
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        justify-content: center;
+        gap: 1.75rem;
+        background: var(--splash-bg);
+        color: var(--splash-text);
+        font-family: system-ui, -apple-system, sans-serif;
+      }
+      #app-startup-splash .app-startup-splash__logo {
+        height: 72px;
+        width: auto;
+        opacity: 0.95;
+      }
+      #app-startup-splash .app-startup-splash__label {
+        font-size: 0.8rem;
+        font-weight: 600;
+        letter-spacing: 0.06em;
+        text-transform: uppercase;
+        color: var(--splash-muted);
+      }
+      #app-startup-splash .app-startup-splash__bar {
+        width: min(240px, 72vw);
+        height: 4px;
+        border-radius: 999px;
+        background: var(--splash-track);
+        overflow: hidden;
+      }
+      #app-startup-splash .app-startup-splash__bar-fill {
+        width: 42%;
+        height: 100%;
+        border-radius: inherit;
+        background: var(--splash-accent);
+        animation: app-startup-splash-indeterminate 1.15s ease-in-out infinite;
+      }
+      @keyframes app-startup-splash-indeterminate {
+        0% { transform: translateX(-120%); }
+        100% { transform: translateX(320%); }
+      }
+    </style>
   </head>
   <body>
-    <div id="root"></div>
+    <div id="app-startup-splash" role="status" aria-live="polite" aria-label="Loading Psysonic">
+      <svg class="app-startup-splash__logo" viewBox="0 0 115.549 130.30972" xmlns="http://www.w3.org/2000/svg" aria-hidden="true">
+        <defs>
+          <linearGradient id="startupSplashLogoGrad" x1="0%" y1="0%" x2="100%" y2="100%">
+            <stop offset="0%" stop-color="var(--splash-logo-start)" />
+            <stop offset="100%" stop-color="var(--splash-logo-end)" />
+          </linearGradient>
+        </defs>
+        <g transform="translate(220.53237,27.789086)">
+          <path fill="url(#startupSplashLogoGrad)" d="m -191.83501,87.581279 v -14.93937 l 1.01946,-0.029 c 1.8496,-0.0526 5.09881,-2.007 6.98453,-4.20123 2.13731,-2.48697 3.28384,-4.43657 4.52545,-7.69521 0.51751,-1.35819 1.078,-2.78694 1.24554,-3.175 0.16755,-0.38805 0.88173,-2.7693 1.58707,-5.29166 0.70533,-2.52236 1.41605,-4.90361 1.57937,-5.29167 0.16441,-0.39067 0.30759,11.85061 0.32081,27.42847 l 0.0239,28.134031 h -8.64306 -8.64305 z m -3.42317,-19.65031 c -0.81559,-0.16111 -1.84746,-0.48272 -2.29306,-0.71468 -1.09242,-0.5687 -2.72853,-2.16884 -2.74064,-2.68038 -0.005,-0.22765 -0.38465,-0.86265 -0.84281,-1.41111 -0.8626,-1.03264 -2.38323,-4.66133 -4.63113,-11.05137 -1.72997,-4.91772 -1.63358,-4.68451 -3.35352,-8.11389 -0.82714,-1.64924 -1.91998,-3.45186 -2.42853,-4.00582 -1.28805,-1.40307 -4.41406,-2.7715 -6.89485,-3.01827 l -2.08965,-0.20785 1.43221,-0.99035 c 1.5468,-1.06957 5.31147,-2.35399 6.9124,-2.35835 1.72563,-0.005 4.25283,0.7809 5.71247,1.77575 1.63175,1.11217 3.92377,3.83335 3.77488,4.48172 -0.0559,0.24344 0.11427,0.44261 0.37817,0.44261 0.53171,0 3.78445,6.24176 3.78445,7.26208 0,0.15195 0.30609,0.92171 0.6802,1.71057 0.37412,0.78887 1.08633,2.44854 1.5827,3.68817 1.00279,2.50434 2.57055,5.33152 2.95544,5.32962 0.85183,-0.004 3.83204,-7.97894 5.40479,-14.46266 1.9193,-7.91232 5.01161,-18.44694 6.10967,-20.81389 2.30114,-4.96024 4.60601,-7.03734 8.12223,-7.31959 1.95377,-0.15683 2.44243,-0.0601 4.01261,0.79453 2.49546,1.35819 3.31044,2.35029 5.40102,6.57479 0.93741,1.89425 3.29625,9.1126 4.36446,13.35583 0.51289,2.03729 1.21262,4.57729 1.55498,5.64444 0.34236,1.06716 0.83543,2.65466 1.09573,3.52778 0.96371,3.23267 3.75139,8.2344 5.51689,9.89856 2.09506,1.9748 4.10606,3.2977 5.85136,3.84922 0.72761,0.22993 1.32292,0.49404 1.32292,0.58692 0,0.0929 -0.71641,0.48577 -1.59202,0.87309 -2.29705,1.01609 -6.48839,1.02714 -8.75823,0.0231 -3.42674,-1.51581 -6.17101,-4.45149 -8.36088,-8.94406 -0.59782,-1.22642 -1.23412,-2.50231 -1.41401,-2.8353 -0.17988,-0.333 -0.47718,-1.20612 -0.66066,-1.94028 -0.74987,-3.00045 -6.42415,-19.25706 -6.99617,-20.04376 -0.79895,-1.09881 -0.87818,-1.08476 -1.55823,0.27628 -1.1693,2.3402 -2.07427,5.18987 -3.61302,11.37709 -3.03871,12.21839 -6.36478,22.38234 -8.0081,24.47148 -0.36655,0.466 -0.66646,0.99153 -0.66646,1.16785 0,0.86017 -2.61454,3.05174 -4.28395,3.59089 -1.94625,0.62857 -2.53141,0.65417 -4.78366,0.20926 z m 49.82815,-13.29265 c -2.77991,-0.70614 -6.29714,-6.05076 -8.15323,-12.38927 -0.30389,-1.03778 -0.47868,-1.96073 -0.38841,-2.051 0.0903,-0.0903 1.5695,-0.22877 3.28719,-0.30779 8.47079,-0.38969 9.78292,-0.63406 14.05919,-2.61837 3.78653,-1.75706 9.09259,-6.79386 10.56941,-10.03304 3.78708,-8.30644 4.33485,-14.20262 2.08448,-22.4376404 -1.15336,-4.22063002 -3.6401,-8.21361 -6.73205,-10.80969 -1.12271,-0.94265 -2.12066,-1.8146 -2.21767,-1.93765 -0.3794,-0.48123 -4.30858,-2.4333296 -6.41876,-3.1889796 -2.16778,-0.77628 -2.64336,-0.79956 -18.71666,-0.91597 l -16.49236,-0.11945 V -0.68605142 10.798429 h -0.8256 c -1.53109,0 -5.09758,2.09614 -6.79456,3.99338 -1.65639,1.85186 -4.54446,7.43871 -5.41264,10.47051 -0.25002,0.87312 -0.58222,1.98437 -0.73823,2.46944 -0.39136,1.2169 -2.0765,7.30176 -3.12634,11.28889 -0.2052,0.7793 -0.33685,-11.27627 -0.35693,-32.6846104 l -0.0318,-33.9193396 1.55319,-0.12371 c 0.85426,-0.068 12.32395,-0.10028 25.4882,-0.0716 20.69377,0.045 24.2694,0.12953 26.40444,0.62402 3.9887,0.92382 7.58472,2.04932 7.58472,2.3739 0,0.16576 0.52886,0.30139 1.17524,0.30139 2.09331,0 10.76432,4.87704 10.22435,5.75072 -0.12186,0.19718 -0.0447,0.24734 0.17328,0.11263 0.60692,-0.3751 4.21691,3.0333 6.9953,6.60467 2.06429,2.6534496 4.63504,8.4775396 5.94174,13.4611396 1.7681,6.7433 1.74625,15.8657704 -0.0549,22.9305504 -2.11084,8.27937 -4.97852,13.41407 -10.75456,19.25647 -2.59968,2.62955 -8.78375,7.02548 -9.88326,7.02548 -0.27557,0 -0.68644,0.1854 -0.91304,0.412 -0.39593,0.39593 -0.78905,0.56749 -4.31522,1.88319 -3.68968,1.37672 -10.83412,2.28545 -13.21446,1.68081 z m 7.57002,-15.26489 c 0,-0.19403 -0.07,-0.35278 -0.15557,-0.35278 -0.0856,0 -0.25368,0.15875 -0.3736,0.35278 -0.11992,0.19403 -0.0499,0.35278 0.15557,0.35278 0.20548,0 0.3736,-0.15875 0.3736,-0.35278 z" />
+        </g>
+      </svg>
+      <div class="app-startup-splash__bar" aria-hidden="true">
+        <div class="app-startup-splash__bar-fill"></div>
+      </div>
+      <span class="app-startup-splash__label">Loading</span>
+    </div>
+    <div id="root" class="app-root--startup-pending"></div>
+    <script src="/startup-splash-reveal.js"></script>
     <script type="module" src="/src/main.tsx"></script>
   </body>
 </html>

nix/psysonic.nix

@@ -35,9 +35,9 @@
   gst_all_1,
   src,
   upstreamMeta,
-  # When true (default), wrapProgram sets GDK_BACKEND=x11 for WebKit stability on many setups.
-  # When false, GDK follows the session (e.g. native Wayland) — often better HiDPI sizing.
-  forceGdkX11 ? true,
+  # When true, wrapProgram sets GDK_BACKEND=x11 (legacy conservative stack).
+  # When false (default), only lib paths — GDK follows session; binary applies webkit2gtk-nvidia-quirk only.
+  forceGdkX11 ? false,
 }:
 
 let
@@ -138,7 +138,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
     export HOME=$(mktemp -d)
-    (cd src-tauri && cargo tauri build --no-bundle -v)
+    (cd src-tauri && cargo tauri build --no-bundle)
     runHook postBuild
   '';
 
@@ -163,10 +163,7 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup =
     let
       gdkX11Wrap = lib.optionalString forceGdkX11 ''
-        --set GDK_BACKEND x11 \
-      '';
-      allowNativeGdkWrap = lib.optionalString (!forceGdkX11) ''
-        --set PSYSONIC_ALLOW_NATIVE_GDK 1 \
+        --set GDK_BACKEND x11
       '';
     in
     ''
@@ -174,8 +171,7 @@ stdenv.mkDerivation (finalAttrs: {
         --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libayatana-appindicator ]}" \
         --prefix GST_PLUGIN_PATH : "${gstPluginPath}" \
         --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
-        ${gdkX11Wrap}${allowNativeGdkWrap}--set WEBKIT_DISABLE_COMPOSITING_MODE 1 \
-        --set WEBKIT_DISABLE_DMABUF_RENDERER 1
+        ${gdkX11Wrap}
     '';
 
   meta = {

nix/upstream-sources.json

@@ -1,3 +1,3 @@
 {
-  "npmDepsHash": "sha256-zcd6mudbopF0hlcJnFxwUOKpPt6IamfLmabSZ5rN7HI="
+  "npmDepsHash": "sha256-r7Pe7YRJvRhigg4vmfLbnLdWr5EKGAeAC53vbs3V2uw="
 }

nixos-install.md

@@ -85,25 +85,27 @@ environment.systemPackages = with pkgs; [
 ];
 ```
 
-### Linux wrapper: default vs gdk-session
+### Linux wrapper (default vs legacy X11)
 
-The flake exposes **two** installable packages on Linux. They are the same build; only the **wrapped runtime environment** differs:
+The flake exposes **three** Linux attributes (two are the **same derivation**):
 
 | Flake attribute | Wrapper behaviour |
 |----------------|-------------------|
-| **`psysonic`** (and **`default`**) | Sets **`GDK_BACKEND=x11`** together with the usual WebKit / GStreamer / AppIndicator paths. This is the **recommended default**: it matches the dev shell assumptions and avoids many WebKitGTK + Wayland edge cases. |
-| **`psysonic-gdk-session`** | **Does not** set `GDK_BACKEND`; GTK follows the session (e.g. native Wayland when available). Can improve **HiDPI sizing** on some desktops, but may cause **black window, broken scrolling, or tray quirks** on other GPU/compositor stacks—the same class of issues described under Linux / WebKit in the in-app Help. **Not default** on purpose. |
+| **`psysonic`**, **`default`**, **`psysonic-gdk-session`** | Wrappers prefix **libraries only** (**GStreamer**, **AppIndicator**); **`GDK_BACKEND`** is **not** pinned. The binary invokes **`webkit2gtk-nvidia-quirk`** early on Linux (unless **`PSYSONIC_WEBKIT_GPU_ACCEL`** is set); no extra **`WEBKIT_DISABLE_*`** heuristics in **`main.rs`**. Override with **`GDK_BACKEND`**, **`WEBKIT_DISABLE_*`**, etc. whenever you want. |
+| **`psysonic-x11-legacy`** | Former default: **`GDK_BACKEND=x11`** pinned in the wrapper. Use if you relied on **XWayland-ish** stability on messy stacks. Same binary as **`psysonic`**. |
 
-Use the alternate package when you understand that trade-off:
+`psysonic-gdk-session` remains a **back-compat alias** for **`psysonic`** (identical store path).
+
+### Example: legacy X11 wrap
 
 ```nix
-inputs.psysonic.packages.${system}.psysonic-gdk-session
+inputs.psysonic.packages.${system}.psysonic-x11-legacy
 ```
 
 Or one-shot (quote the URL in **zsh** — `?` / `#` are special):
 
 ```bash
-nix run 'github:Psychotoxical/psysonic#psysonic-gdk-session' -- --help
+nix run 'github:Psychotoxical/psysonic#psysonic-x11-legacy' -- --help
 ```
 
 ### Pinning a revision, branch, or tag
@@ -142,7 +144,7 @@ From any machine with flakes:
 nix run 'github:Psychotoxical/psysonic'
 ```
 
-Same as `nix build` / `packages.<system>.default` (the **x11-wrapped** binary); uses the flake `apps` output. For the session-GDK variant, use `'github:Psychotoxical/psysonic#psysonic-gdk-session'` (see [Linux wrapper](#linux-wrapper-default-vs-gdk-session) above). With a branch pin, keep the **whole** `github:…?ref=…#…` string in **single quotes** under **zsh**.
+Same as `nix build` / `packages.<system>.default` (session-native **GDK**); uses the flake `apps` output. For an **X11-pinned** launcher (old default), use `'github:Psychotoxical/psysonic#psysonic-x11-legacy'` (see [Linux wrapper](#linux-wrapper-default-vs-legacy-x11) above). `psysonic-gdk-session` is an **alias**—same as **`psysonic`**. With a branch pin, keep the **whole** `github:…?ref=…#…` string in **single quotes** under **zsh**.
 
 ### Apply configuration
 
@@ -179,8 +181,6 @@ From a **flake-enabled** clone of the repo:
 
 The flake **`devShell`** uses the same **`nixpkgs`** input as **`packages.psysonic`** (see **`flake.nix`**).
 
-Optional **local-only** helpers (`dev.sh`, `shell.nix`, `prod.sh`) are **gitignored** — not part of the upstream tree; keep your own copies if you use them (e.g. a small `dev.sh` that runs `nix develop` and `npm run tauri:dev`).
-
 ## Desktop entry
 
 The flake package installs a **`.desktop`** file and icon via `copyDesktopItems`; after `nixos-rebuild switch` (or a Home Manager activation that includes the package), Psysonic should appear in your application launcher like any other desktop app.

package.json

@@ -1,18 +1,25 @@
 {
   "name": "psysonic",
-  "version": "1.46.0-dev",
+  "version": "1.51.0-dev",
   "private": true,
   "scripts": {
     "check:css-imports": "node scripts/check-css-import-graph.mjs",
-    "dev": "vite",
-    "build": "tsc && vite build",
+    "prebuild:release-notes": "node scripts/generate-release-notes-bundle.mjs",
+    "dev": "npm run prebuild:release-notes && vite",
+    "build": "npm run prebuild:release-notes && tsc && vite build",
     "preview": "vite preview",
     "tauri": "tauri",
-    "tauri:dev": "tauri dev",
-    "tauri:build": "tauri build",
-    "test": "vitest run && npm run check:css-imports",
+    "tauri:dev": "npm run prebuild:release-notes && tauri dev --config src-tauri/tauri.dev.conf.json",
+    "tauri:build": "npm run prebuild:release-notes && node scripts/sync-wix-bundle-version.mjs && tauri build",
+    "lint": "eslint -c eslint.config.mjs src",
+    "lint:gradual": "eslint -c eslint.config.gradual.mjs src",
+    "dep:check": "depcruise src --config .dependency-cruiser.cjs --ignore-known",
+    "dep:check:barrels": "node scripts/check-feature-barrel-ui.mjs",
+    "check:boot-chunks": "node scripts/check-boot-chunk-lucide.mjs",
+    "build:verify": "npm run build && npm run check:boot-chunks",
+    "test": "npm run prebuild:release-notes && vitest run && node --test scripts/extract-release-section.test.mjs scripts/wix-bundle-version.test.mjs scripts/sync-version-pipeline.test.mjs && npm run check:css-imports && npm run dep:check:barrels",
     "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage && npm run check:css-imports"
+    "test:coverage": "npm run prebuild:release-notes && vitest run --coverage && npm run check:css-imports"
   },
   "dependencies": {
     "@fontsource-variable/dm-sans": "^5.2.8",
@@ -30,7 +37,7 @@
     "@fontsource-variable/space-grotesk": "^5.2.10",
     "@fontsource-variable/unbounded": "^5.2.8",
     "@fontsource/opendyslexic": "^5.2.5",
-    "@tanstack/react-virtual": "^3.13.24",
+    "@tanstack/react-virtual": "^3.13.26",
     "@tauri-apps/api": "^2",
     "@tauri-apps/plugin-dialog": "^2.7.1",
     "@tauri-apps/plugin-fs": "^2.5.1",
@@ -40,33 +47,43 @@
     "@tauri-apps/plugin-store": "^2",
     "@tauri-apps/plugin-updater": "^2.10.1",
     "@tauri-apps/plugin-window-state": "^2.4.1",
-    "axios": "^1.16.0",
+    "axios": "^1.18.1",
     "i18next": "^26.0.8",
-    "lucide-react": "^1.14.0",
+    "lucide-react": "^1.17.0",
     "md5": "^2.3.0",
     "papaparse": "^5.5.3",
     "react": "^19.2.5",
-    "react-dom": "^19.2.5",
+    "react-dom": "^19.2.6",
     "react-i18next": "^17.0.6",
-    "react-router-dom": "^7.15.0",
-    "zustand": "^5.0.13"
+    "react-router-dom": "^7.16.0",
+    "zustand": "^5.0.14"
   },
   "devDependencies": {
-    "@tauri-apps/cli": "^2",
+    "@eslint/js": "^10.0.1",
+    "@tauri-apps/cli": "^2.11.2",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
     "@types/md5": "^2.3.6",
     "@types/node": "^25.6.0",
     "@types/papaparse": "^5.5.2",
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.1",
-    "@vitest/coverage-v8": "^4.1.5",
-    "esbuild": "^0.28.0",
-    "jsdom": "^26.1.0",
+    "@vitejs/plugin-react": "^6.0.2",
+    "@vitest/coverage-v8": "^4.1.8",
+    "dependency-cruiser": "^18.0.0",
+    "esbuild": "^0.28.1",
+    "eslint": "^10.5.0",
+    "eslint-plugin-react-hooks": "^7.1.1",
+    "eslint-plugin-react-refresh": "^0.5.3",
+    "globals": "^17.7.0",
+    "jsdom": "^29.1.1",
     "typescript": "^6.0.3",
-    "vite": "^8.0.10",
-    "vitest": "^4.1.5"
+    "typescript-eslint": "^8.62.0",
+    "vite": "^8.0.14",
+    "vitest": "^4.1.8"
+  },
+  "overrides": {
+    "undici": "^7.28.0"
   }
 }

packages/aur/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Psychotoxic <psychotoxic@gmx.de>
 pkgname=psysonic
-pkgver=1.45.0
+pkgver=1.50.0
 pkgrel=1
 pkgdesc="Desktop music player for Subsonic API-compatible servers (Navidrome, Gonic, etc.)"
 arch=('x86_64')
@@ -53,12 +53,9 @@ package() {
   # Binary (in /usr/lib to make room for the wrapper)
   install -Dm755 "src-tauri/target/release/psysonic" "$pkgdir/usr/lib/psysonic/psysonic"
 
-  # Wrapper script that sets necessary env vars for WebKitGTK on Wayland
+  # Wrapper: thin exec (path hygiene only); GDK/session + WebKit mitigations come from main.rs / quirk (no GDK pin).
   install -Dm755 /dev/stdin "$pkgdir/usr/bin/psysonic" <<EOF
 #!/bin/sh
-export GDK_BACKEND=x11
-export WEBKIT_DISABLE_COMPOSITING_MODE=1
-export WEBKIT_DISABLE_DMABUF_RENDERER=1
 exec /usr/lib/psysonic/psysonic "\$@"
 EOF
 

public/startup-splash-preflight.js

@@ -0,0 +1,179 @@
+/**
+ * Synchronous startup splash theme (before the Vite bundle loads).
+ * Keep palette ids/hex in sync with `src/config/startupSplashPalettes.ts`.
+ */
+(function startupSplashPreflight() {
+  var THEME_KEY = 'psysonic_theme';
+  var INSTALLED_KEY = 'psysonic_installed_themes';
+  var DEFAULT = {
+    bg: '#1e1e2e',
+    text: '#cdd6f4',
+    muted: '#a6adc8',
+    accent: '#cba6f7',
+    track: '#313244',
+    logoStart: '#cba6f7',
+    logoEnd: '#89b4fa',
+  };
+  var BUILTIN = {
+    mocha: DEFAULT,
+    latte: {
+      bg: '#eff1f5',
+      text: '#4c4f69',
+      muted: '#6c6f85',
+      accent: '#8839ef',
+      track: '#ccd0da',
+      logoStart: '#8839ef',
+      logoEnd: '#1e66f5',
+    },
+    'kanagawa-wave': {
+      bg: '#1F1F28',
+      text: '#DCD7BA',
+      muted: '#727169',
+      accent: '#7E9CD8',
+      track: '#2A2A37',
+      logoStart: '#7E9CD8',
+      logoEnd: '#957FB8',
+    },
+    'stark-hud': {
+      bg: '#0b0f15',
+      text: '#e0f7fa',
+      muted: '#7da5aa',
+      accent: '#00f2ff',
+      track: '#141b24',
+      logoStart: '#00f2ff',
+      logoEnd: '#7df9ff',
+    },
+    'vision-dark': {
+      bg: '#0d0b12',
+      text: '#f2eef8',
+      muted: '#a6a2b8',
+      accent: '#ffd700',
+      track: '#16131e',
+      logoStart: '#ffd700',
+      logoEnd: '#a07af8',
+    },
+    'vision-navy': {
+      bg: '#0a1628',
+      text: '#e8eef8',
+      muted: '#9caac2',
+      accent: '#ffd700',
+      track: '#12213a',
+      logoStart: '#ffd700',
+      logoEnd: '#a07af8',
+    },
+  };
+
+  function readCssVar(css, name) {
+    var match = css.match(new RegExp(name + '\\s*:\\s*([^;]+);'));
+    var value = match && match[1] ? match[1].trim() : '';
+    return value || null;
+  }
+
+  function resolveScheduledTheme(state) {
+    if (!state.enableThemeScheduler) return state.theme;
+    var now = new Date();
+    var nowMins = now.getHours() * 60 + now.getMinutes();
+    var dayParts = state.timeDayStart.split(':').map(Number);
+    var nightParts = state.timeNightStart.split(':').map(Number);
+    var dayMins = dayParts[0] * 60 + dayParts[1];
+    var nightMins = nightParts[0] * 60 + nightParts[1];
+    var isDay = dayMins < nightMins
+      ? nowMins >= dayMins && nowMins < nightMins
+      : nowMins >= dayMins || nowMins < nightMins;
+    return isDay ? state.themeDay : state.themeNight;
+  }
+
+  function readThemeState() {
+    try {
+      var raw = localStorage.getItem(THEME_KEY);
+      if (!raw) return null;
+      var parsed = JSON.parse(raw);
+      var s = parsed && parsed.state;
+      if (!s) return null;
+      return {
+        enableThemeScheduler: !!s.enableThemeScheduler,
+        theme: String(s.theme || 'mocha'),
+        themeDay: String(s.themeDay || 'latte'),
+        themeNight: String(s.themeNight || 'mocha'),
+        timeDayStart: String(s.timeDayStart || '07:00'),
+        timeNightStart: String(s.timeNightStart || '19:00'),
+      };
+    } catch (_err) {
+      return null;
+    }
+  }
+
+  function readInstalledThemes() {
+    try {
+      var raw = localStorage.getItem(INSTALLED_KEY);
+      if (!raw) return [];
+      var parsed = JSON.parse(raw);
+      var themes = parsed && parsed.state && parsed.state.themes;
+      return Array.isArray(themes) ? themes : [];
+    } catch (_err) {
+      return [];
+    }
+  }
+
+  function paletteForTheme(themeId, installedThemes) {
+    if (BUILTIN[themeId]) return BUILTIN[themeId];
+    for (var i = 0; i < installedThemes.length; i += 1) {
+      var theme = installedThemes[i];
+      if (!theme || theme.id !== themeId || !theme.css) continue;
+      var bg = readCssVar(theme.css, '--bg-app');
+      var accent = readCssVar(theme.css, '--accent');
+      if (!bg || !accent) break;
+      var logoStart = readCssVar(theme.css, '--logo-color-start') || accent;
+      var logoEnd = readCssVar(theme.css, '--logo-color-end')
+        || readCssVar(theme.css, '--accent-2')
+        || accent;
+      return {
+        bg: bg,
+        text: readCssVar(theme.css, '--text-primary') || readCssVar(theme.css, '--ctp-text') || DEFAULT.text,
+        muted: readCssVar(theme.css, '--text-muted') || readCssVar(theme.css, '--ctp-subtext0') || DEFAULT.muted,
+        accent: accent,
+        track: readCssVar(theme.css, '--bg-card') || readCssVar(theme.css, '--border-subtle') || DEFAULT.track,
+        logoStart: logoStart,
+        logoEnd: logoEnd,
+      };
+    }
+    return DEFAULT;
+  }
+
+  function applyPalette(themeId, palette) {
+    var root = document.documentElement;
+    root.setAttribute('data-theme', themeId);
+    root.style.setProperty('--startup-splash-bg', palette.bg);
+    root.style.setProperty('--startup-splash-text', palette.text);
+    root.style.setProperty('--startup-splash-muted', palette.muted);
+    root.style.setProperty('--startup-splash-accent', palette.accent);
+    root.style.setProperty('--startup-splash-track', palette.track);
+    root.style.setProperty('--startup-splash-logo-start', palette.logoStart);
+    root.style.setProperty('--startup-splash-logo-end', palette.logoEnd);
+    root.style.background = palette.bg;
+    if (document.body) document.body.style.background = palette.bg;
+  }
+
+  var persisted = readThemeState();
+  function readStartMinimizedToTray() {
+    try {
+      var raw = localStorage.getItem('psysonic-auth');
+      if (!raw) return false;
+      var parsed = JSON.parse(raw);
+      var state = parsed && parsed.state;
+      if (!state || !state.startMinimizedToTray) return false;
+      return state.showTrayIcon !== false;
+    } catch (_err) {
+      return false;
+    }
+  }
+
+  var themeId = persisted ? resolveScheduledTheme(persisted) : 'mocha';
+  var palette = paletteForTheme(themeId, readInstalledThemes());
+  applyPalette(themeId, palette);
+  var trayHandled = false;
+  try {
+    trayHandled = sessionStorage.getItem('psy-startup-tray-handled') === '1';
+  } catch (_err) {}
+  window.__psyStartMinimizedToTray = readStartMinimizedToTray() && !trayHandled;
+})();

public/startup-splash-reveal.js

@@ -0,0 +1,57 @@
+/**
+ * Show the native window after the inline startup splash has painted.
+ * When starting minimized to tray, hide the main window as early as possible
+ * (visible:false may still map briefly on some Linux WMs before this script).
+ * __TAURI_INTERNALS__ may not exist yet when this script first runs.
+ */
+(function startupSplashReveal() {
+  var MAX_ATTEMPTS = 60;
+
+  function tryShowMainWindow() {
+    var internals = window.__TAURI_INTERNALS__;
+    if (!internals || typeof internals.invoke !== 'function') return false;
+    internals.invoke('plugin:window|show', { label: 'main' }).catch(function () {});
+    return true;
+  }
+
+  function tryHideMainWindow() {
+    var internals = window.__TAURI_INTERNALS__;
+    if (!internals || typeof internals.invoke !== 'function') return false;
+    internals.invoke('plugin:window|hide', { label: 'main' }).catch(function () {});
+    return true;
+  }
+
+  function reveal(attempt) {
+    if (window.__psyStartMinimizedToTray) {
+      if (tryHideMainWindow()) return;
+      if (attempt >= MAX_ATTEMPTS) return;
+      window.setTimeout(function () {
+        reveal(attempt + 1);
+      }, 50);
+      return;
+    }
+    if (tryShowMainWindow()) return;
+    if (attempt >= MAX_ATTEMPTS) return;
+    window.setTimeout(function () {
+      reveal(attempt + 1);
+    }, 50);
+  }
+
+  if (window.__psyStartMinimizedToTray) {
+    // Mark this synchronously, before React mounts. This deliberately does
+    // not set the CSS animation-pause attribute: entrance animations may
+    // still mount while the native window is hidden.
+    window.__psyHidden = true;
+    try {
+      sessionStorage.setItem('psy-startup-tray-handled', '1');
+    } catch (_err) {}
+    reveal(0);
+    return;
+  }
+
+  requestAnimationFrame(function () {
+    requestAnimationFrame(function () {
+      reveal(0);
+    });
+  });
+})();

scripts/check-boot-chunk-lucide.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+/**
+ * Post-build guard: boot-adjacent Vite chunks must not bundle lucide-react.
+ *
+ * When a store/utils barrel accidentally re-exports UI, Rollup may pull
+ * createLucideIcon into authStore/offline chunks and hit TDZ init-order bugs
+ * in production (Windows WebView2: "X is not a function" on splash).
+ *
+ * Run after `npm run build` — no Tauri compile needed.
+ */
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const DIST = join(new URL('..', import.meta.url).pathname, 'dist/assets');
+
+/** Chunk filename prefixes that must stay lucide-free. */
+const BOOT_CHUNK_PREFIXES = ['authStore-', 'offline-'];
+
+/** Minified bundles still embed lucide module paths or icon factory calls. */
+const LUCIDE_SIGNALS = [
+  'lucide-react',
+  'createLucideIcon',
+  // Common preset/offline icons pulled through bad barrels (minified arg strings):
+  '("globe"',
+  '("settings"',
+  '("wifi-off"',
+  '("download"',
+];
+
+/** Subsonic client id must be a compile-time literal, not a cyclic package.json import. */
+const CLIENT_ID_SIGNALS = [
+  'psysonic/undefined',
+  'psysonic/${',
+];
+
+let files;
+try {
+  files = readdirSync(DIST).filter(f => f.endsWith('.js'));
+} catch {
+  console.error('check-boot-chunk-lucide: dist/assets not found — run `npm run build` first.');
+  process.exit(1);
+}
+
+const violations = [];
+
+for (const file of files) {
+  if (!BOOT_CHUNK_PREFIXES.some(p => file.startsWith(p))) continue;
+  const text = readFileSync(join(DIST, file), 'utf8');
+  for (const signal of LUCIDE_SIGNALS) {
+    if (text.includes(signal)) {
+      violations.push({ file, signal });
+    }
+  }
+  for (const signal of CLIENT_ID_SIGNALS) {
+    if (text.includes(signal)) {
+      violations.push({ file, signal: `client-id: ${signal}` });
+    }
+  }
+}
+
+if (violations.length > 0) {
+  console.error('Lucide leaked into boot-critical chunks:\n');
+  for (const { file, signal } of violations) {
+    console.error(`  • dist/assets/${file} — matched "${signal}"`);
+  }
+  console.error(
+    '\nFix: split UI from the feature root barrel; import UI from @/features/<x>/ui only in components.',
+  );
+  process.exit(1);
+}
+
+console.log('check-boot-chunk-lucide: ok');

scripts/check-feature-barrel-ui.mjs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+/**
+ * Guard: boot-critical feature barrels must not re-export UI modules.
+ *
+ * Re-exporting components/hooks that pull lucide-react through a barrel while
+ * the same barrel (or its stores) is imported from boot paths creates production
+ * init-order failures (`createLucideIcon is not a function` in minified chunks).
+ *
+ * Not every feature barrel is checked — album/artist/etc. export UI for lazy
+ * routes and are safe. Only barrels that stores/utils on the boot path import
+ * from are listed in BOOT_CRITICAL_BARRELS.
+ */
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+const ROOT = new URL('..', import.meta.url).pathname;
+
+/** Barrels whose non-UI surface is imported before or during first paint. */
+const BOOT_CRITICAL_BARRELS = [
+  { file: join(ROOT, 'src/features/offline/index.ts'), label: 'src/features/offline/index.ts' },
+  { file: join(ROOT, 'src/music-network/index.ts'), label: 'src/music-network/index.ts' },
+];
+
+const FORBIDDEN_EXPORT_PATTERNS = [
+  /from\s+['"]\.\/components\//,
+  /from\s+['"]\.\/ui\//,
+  /export\s+\*\s+from\s+['"]\.\/components\//,
+  /export\s+\*\s+from\s+['"]\.\/ui\//,
+  /export\s+\{[^}]*\}\s+from\s+['"]\.\/components\//,
+  /export\s+\{[^}]*\}\s+from\s+['"]\.\/ui\//,
+];
+
+/** @param {string} file @param {string} label */
+function checkBarrel(file, label) {
+  const text = readFileSync(file, 'utf8');
+  const hits = [];
+  for (const re of FORBIDDEN_EXPORT_PATTERNS) {
+    for (const line of text.split('\n')) {
+      const trimmed = line.trim();
+      if (trimmed.startsWith('//') || trimmed.startsWith('*')) continue;
+      if (re.test(line)) hits.push(trimmed);
+    }
+  }
+  if (hits.length === 0) return [];
+  return hits.map(h => `${label}: ${h}`);
+}
+
+const errors = [];
+
+for (const { file, label } of BOOT_CRITICAL_BARRELS) {
+  try {
+    statSync(file);
+    errors.push(...checkBarrel(file, label));
+  } catch {
+    errors.push(`${label}: missing barrel file`);
+  }
+}
+
+if (errors.length > 0) {
+  console.error('Boot-critical barrel UI re-export violations:\n');
+  for (const e of errors) console.error(`  • ${e}`);
+  console.error(
+    '\nFix: remove UI exports from the root barrel; import from @/features/<x>/ui or deep paths.',
+  );
+  process.exit(1);
+}
+
+console.log('check-feature-barrel-ui: ok');

scripts/check-frontend-hot-path-coverage.sh

@@ -1,13 +1,11 @@
 #!/usr/bin/env bash
 #
-# Hot-path file coverage gate — frontend, soft mode.
+# Hot-path file coverage gate — frontend.
 #
 # Mirrors `scripts/check-hot-path-coverage.sh` for the Rust workspace. For
 # each source file listed in `.github/frontend-hot-path-files.txt`, verifies
 # that line coverage is at least $THRESHOLD %. Emits GitHub Actions warning
-# annotations for files below the floor; exits 1 when any file is below, but
-# the wrapping CI job carries `continue-on-error: true` so it doesn't block
-# merges yet (drop that flag once we've watched a few PRs run cleanly).
+# annotations for files below the floor and exits 1 when any file is below.
 #
 # Why files instead of per-function: v8 coverage's per-function data is
 # fragile under React Compiler / Vite minification — file-level line

scripts/check-hot-path-coverage.sh

@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
 #
-# Hot-path file coverage gate — soft mode.
+# Hot-path file coverage gate.
 #
 # For each source file listed in `.github/hot-path-files.txt`, verifies
 # that line coverage is at least $THRESHOLD %. Emits GitHub Actions
-# warning annotations for files below the floor; never sets a non-zero
-# exit code (soft gate).
+# warning annotations for files below the floor and exits 1 when any
+# file is below.
 #
 # Why files instead of per-function: cargo-llvm-cov's per-function
 # region data is unreliable for async state-machines (most regions live
@@ -104,14 +104,6 @@ echo "Checked: $TOTAL hot-path file(s)"
 echo "Below threshold: $BELOW"
 echo "Not found: $NOT_FOUND"
 
-# Two-layer gate:
-#   - This script exits 1 when any hot-path file regresses below the
-#     threshold. That gives an unambiguous CI signal in the workflow log.
-#   - The `coverage` job in `.github/workflows/rust-tests.yml` carries
-#     `continue-on-error: true`, so the failing exit is visible in the
-#     PR's checks panel but does NOT block merges yet.
-#   - Flip to a hard PR-blocker by removing `continue-on-error` from the
-#     workflow once we've watched a few PRs run cleanly.
 if [[ "$BELOW" -gt 0 ]]; then
     exit 1
 fi

scripts/compare-environment.sh

@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+# Compare two environment dumps from dump-environment.sh
+# Usage: ./scripts/compare-environment.sh FILE_A FILE_B
+
+set -euo pipefail
+
+if [[ $# -ne 2 ]]; then
+  echo "Usage: $0 FILE_A FILE_B" >&2
+  exit 1
+fi
+
+FILE_A="$1"
+FILE_B="$2"
+
+for f in "$FILE_A" "$FILE_B"; do
+  if [[ ! -f "$f" ]]; then
+    echo "Missing file: $f" >&2
+    exit 1
+  fi
+done
+
+parse_dump() {
+  local file="$1"
+  awk -F= '
+    /^\[/ {
+      section = substr($0, 2, length($0) - 2)
+      next
+    }
+    /^[[:space:]]*$/ { next }
+    /^#/ { next }
+    {
+      key = $1
+      $1 = ""
+      sub(/^=/, "", $0)
+      full = (section == "" ? key : section "." key)
+      print full "\t" $0
+    }
+  ' "$file" | sort -u
+}
+
+TMP_A="$(mktemp)"
+TMP_B="$(mktemp)"
+TMP_JOIN="$(mktemp)"
+trap 'rm -f "$TMP_A" "$TMP_B" "$TMP_JOIN"' EXIT
+
+parse_dump "$FILE_A" >"$TMP_A"
+parse_dump "$FILE_B" >"$TMP_B"
+
+join -t $'\t' -a 1 -a 2 -e '—' -o '0,1.2,2.2' "$TMP_A" "$TMP_B" >"$TMP_JOIN"
+
+ONLY_A=0
+ONLY_B=0
+DIFF=0
+SAME=0
+
+echo "Comparing:"
+echo "  A: $FILE_A"
+echo "  B: $FILE_B"
+echo
+
+while IFS=$'\t' read -r key val_a val_b; do
+  [[ -z "$key" ]] && continue
+  if [[ "$val_a" == "—" ]]; then
+    ONLY_B=$((ONLY_B + 1))
+    printf '  +  %-40s  B=%s\n' "$key" "$val_b"
+  elif [[ "$val_b" == "—" ]]; then
+    ONLY_A=$((ONLY_A + 1))
+    printf '  -  %-40s  A=%s\n' "$key" "$val_a"
+  elif [[ "$val_a" != "$val_b" ]]; then
+    DIFF=$((DIFF + 1))
+    printf '  ≠  %-40s\n     A=%s\n     B=%s\n' "$key" "$val_a" "$val_b"
+  else
+    SAME=$((SAME + 1))
+  fi
+done <"$TMP_JOIN"
+
+echo
+echo "Summary: same=$SAME  different=$DIFF  only_in_A=$ONLY_A  only_in_B=$ONLY_B"
+
+# High-signal keys for the common "works on one NixOS box" case.
+echo
+echo "High-signal differences (if any):"
+HIGH_SIGNAL=0
+while IFS=$'\t' read -r key val_a val_b; do
+  [[ "$val_a" == "$val_b" ]] && continue
+  case "$key" in
+    meta.flake_lock_sha256|meta.nixpkgs_locked_rev|meta.npm_lock_sha256|meta.git_rev|\
+    installed_app.psysonic_realpath|installed_app.psysonic_closure_paths|installed_app.psysonic_drv|\
+    runtime_env.HTTP_PROXY|runtime_env.HTTPS_PROXY|runtime_env.http_proxy|runtime_env.https_proxy|\
+    runtime_env.NO_PROXY|runtime_env.no_proxy|runtime_env.SSL_CERT_FILE|runtime_env.NIX_SSL_CERT_FILE|\
+    toolchain_nix_develop.node_realpath|toolchain_nix_develop.rustc_realpath|\
+    host.nixos_version|host.uname|\
+    app_config_paths.data_dir|app_config_paths.localstorage_db_path|\
+    app_preferences.language|app_servers.active_server_id|app_servers.server_count|\
+    app_servers.server.*.url|app_servers.server.*.alternateUrl|\
+    app_servers.server.*.customHeaders_count|app_servers.server.*.customHeadersApplyTo|\
+    app_servers.server.*.password_sha256|app_servers.server.*.customHeaders.*.name|\
+    app_servers.server.*.customHeaders.*.value_sha256|\
+    app_network_probe.probe.*)
+      HIGH_SIGNAL=$((HIGH_SIGNAL + 1))
+      printf '  ! %s\n    A=%s\n    B=%s\n' "$key" "$val_a" "$val_b"
+      ;;
+  esac
+done <"$TMP_JOIN"
+
+if [[ "$HIGH_SIGNAL" -eq 0 && "$DIFF" -eq 0 && "$ONLY_A" -eq 0 && "$ONLY_B" -eq 0 ]]; then
+  echo "  (none — environments match on recorded keys)"
+elif [[ "$HIGH_SIGNAL" -eq 0 ]]; then
+  echo "  (no high-signal keys differ; see full list above — may be npm patch-level deps only)"
+fi
+
+echo
+echo "Server / network config differences:"
+SERVER_DIFF=0
+while IFS=$'\t' read -r key val_a val_b; do
+  [[ "$val_a" == "$val_b" ]] && continue
+  case "$key" in
+    app_servers.*|app_network_probe.*|app_config_paths.*|app_preferences.*)
+      SERVER_DIFF=$((SERVER_DIFF + 1))
+      printf '  • %s\n    A=%s\n    B=%s\n' "$key" "$val_a" "$val_b"
+      ;;
+  esac
+done <"$TMP_JOIN"
+if [[ "$SERVER_DIFF" -eq 0 ]]; then
+  echo "  (none — server URLs, headers, and curl probes match)"
+fi
+
+echo
+echo "Reminder: server offline is usually URL/network/headers, not Node patch versions."
+echo "Next: curl the Navidrome URL from both hosts; compare Settings → Servers side by side."
+
+if [[ "$DIFF" -gt 0 || "$ONLY_A" -gt 0 || "$ONLY_B" -gt 0 ]]; then
+  exit 1
+fi

scripts/dump-environment.sh

@@ -0,0 +1,254 @@
+#!/usr/bin/env bash
+# Dump Psysonic-related toolchain, Nix closure hints, app config, and env for cross-machine diff.
+# Re-enters `nix develop` automatically when flake.nix is present (no manual dev shell needed).
+# Usage: ./scripts/dump-environment.sh [-o FILE]
+# Compare: ./scripts/compare-environment.sh a.txt b.txt
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SCRIPT="$REPO_ROOT/scripts/dump-environment.sh"
+
+# Bootstrap: run the rest inside the flake dev shell so node/jq match the project.
+if [[ -z "${PSYSONIC_ENV_DUMP_IN_NIX:-}" ]] && [[ -f "$REPO_ROOT/flake.nix" ]]; then
+  if ! command -v nix >/dev/null 2>&1; then
+    echo "$0: flake.nix found but nix is not on PATH — install Nix or run from a NixOS profile with flakes." >&2
+    exit 1
+  fi
+  export PSYSONIC_ENV_DUMP_IN_NIX=1
+  exec env REPO_ROOT="$REPO_ROOT" nix develop --command bash "$SCRIPT" "$@"
+fi
+
+cd "$REPO_ROOT"
+
+if ! command -v node >/dev/null 2>&1; then
+  echo "$0: node not found after nix develop — check flake.nix devShell." >&2
+  exit 1
+fi
+
+OUTPUT_FILE=""
+while getopts 'o:h' opt; do
+  case "$opt" in
+    o) OUTPUT_FILE="$OPTARG" ;;
+    h)
+      echo "Usage: $0 [-o FILE]" >&2
+      exit 0
+      ;;
+    *)
+      echo "Usage: $0 [-o FILE]" >&2
+      exit 1
+      ;;
+  esac
+done
+
+emit() {
+  if [[ -n "$OUTPUT_FILE" ]]; then
+    printf '%s\n' "$*" >>"$OUTPUT_FILE"
+  else
+    printf '%s\n' "$*"
+  fi
+}
+
+kv() {
+  local key="$1"
+  local value="${2-}"
+  value="${value//$'\n'/\\n}"
+  emit "${key}=${value}"
+}
+
+section() {
+  emit ""
+  emit "[$1]"
+}
+
+run_optional() {
+  "$@" 2>/dev/null || true
+}
+
+if [[ -n "$OUTPUT_FILE" ]]; then
+  : >"$OUTPUT_FILE"
+fi
+
+section meta
+kv generated_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+kv in_nix_dev_shell "${PSYSONIC_ENV_DUMP_IN_NIX:-no}"
+kv hostname "$(hostname 2>/dev/null || echo unknown)"
+kv repo_root "$REPO_ROOT"
+if command -v git >/dev/null 2>&1 && git -C "$REPO_ROOT" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  kv git_rev "$(git -C "$REPO_ROOT" rev-parse HEAD 2>/dev/null || echo unknown)"
+  kv git_branch "$(git -C "$REPO_ROOT" rev-parse --abbrev-ref HEAD 2>/dev/null || echo unknown)"
+  kv git_dirty "$(git -C "$REPO_ROOT" status --porcelain 2>/dev/null | wc -l | tr -d ' ')"
+else
+  kv git_rev "n/a"
+  kv git_branch "n/a"
+  kv git_dirty "n/a"
+fi
+if [[ -f "$REPO_ROOT/package.json" ]]; then
+  kv package_json_version "$(node -p "require('./package.json').version" 2>/dev/null || sed -n 's/.*\"version\": \"\\([^\"]*\\)\".*/\\1/p' "$REPO_ROOT/package.json" | head -1)"
+fi
+if [[ -f "$REPO_ROOT/flake.lock" ]]; then
+  kv flake_lock_sha256 "$(sha256sum "$REPO_ROOT/flake.lock" | awk '{print $1}')"
+  if command -v jq >/dev/null 2>&1; then
+    kv nixpkgs_locked_rev "$(jq -r '.nodes.nixpkgs.locked.rev // "unknown"' "$REPO_ROOT/flake.lock" 2>/dev/null)"
+    kv nixpkgs_locked_narHash "$(jq -r '.nodes.nixpkgs.locked.narHash // "unknown"' "$REPO_ROOT/flake.lock" 2>/dev/null)"
+  fi
+fi
+if [[ -f "$REPO_ROOT/package-lock.json" ]]; then
+  kv npm_lockfile_version "$(jq -r '.lockfileVersion // "unknown"' "$REPO_ROOT/package-lock.json" 2>/dev/null || echo unknown)"
+  kv npm_lock_sha256 "$(sha256sum "$REPO_ROOT/package-lock.json" | awk '{print $1}')"
+fi
+
+section host
+kv uname "$(uname -a 2>/dev/null || echo unknown)"
+if [[ -r /etc/os-release ]]; then
+  # shellcheck disable=SC1091
+  source /etc/os-release
+  kv os_id "${ID:-unknown}"
+  kv os_version "${VERSION_ID:-unknown}"
+  kv os_pretty "${PRETTY_NAME:-unknown}"
+fi
+if command -v nixos-version >/dev/null 2>&1; then
+  kv nixos_version "$(nixos-version 2>/dev/null || echo unknown)"
+fi
+
+section nix
+if command -v nix >/dev/null 2>&1; then
+  kv nix_version "$(nix --version 2>/dev/null | head -1)"
+  kv nix_flake_present "$([[ -f "$REPO_ROOT/flake.nix" ]] && echo yes || echo no)"
+else
+  kv nix_version "not_installed"
+  kv nix_flake_present "$([[ -f "$REPO_ROOT/flake.nix" ]] && echo yes || echo no)"
+fi
+
+dump_toolchain_block() {
+  local label="$1"
+  shift
+  section "$label"
+  for tool in node npm rustc cargo clippy jq cmake pkg-config; do
+    if command -v "$tool" >/dev/null 2>&1; then
+      case "$tool" in
+        node) kv node_version "$("$tool" -v 2>/dev/null)" ;;
+        npm) kv npm_version "$("$tool" -v 2>/dev/null)" ;;
+        rustc) kv rustc_version "$("$tool" -V 2>/dev/null | head -1)" ;;
+        cargo) kv cargo_version "$("$tool" -V 2>/dev/null | head -1)" ;;
+        clippy) kv clippy_version "$("$tool" -V 2>/dev/null | head -1)" ;;
+        jq) kv jq_version "$("$tool" --version 2>/dev/null | head -1)" ;;
+        cmake) kv cmake_version "$("$tool" --version 2>/dev/null | head -1)" ;;
+        pkg-config) kv pkg_config_version "$("$tool" --version 2>/dev/null | head -1)" ;;
+      esac
+      kv "${tool}_path" "$(command -v "$tool")"
+      if [[ -L "$(command -v "$tool")" ]] || [[ -e "$(command -v "$tool")" ]]; then
+        kv "${tool}_realpath" "$(readlink -f "$(command -v "$tool")" 2>/dev/null || echo unknown)"
+      fi
+    else
+      kv "${tool}_version" "missing"
+    fi
+  done
+  kv CARGO_TARGET_DIR "${CARGO_TARGET_DIR:-unset}"
+  kv LD_LIBRARY_PATH "${LD_LIBRARY_PATH:-unset}"
+  kv GST_PLUGIN_PATH "${GST_PLUGIN_PATH:-unset}"
+  kv GIO_EXTRA_MODULES "${GIO_EXTRA_MODULES:-unset}"
+}
+
+if [[ -n "${PSYSONIC_ENV_DUMP_IN_NIX:-}" ]]; then
+  dump_toolchain_block toolchain_nix_develop
+elif command -v nix >/dev/null 2>&1 && [[ -f "$REPO_ROOT/flake.nix" ]]; then
+  # No bootstrap (should not happen when flake exists) — capture devShell separately.
+  NIX_DEV_DUMP="$(nix develop --command bash -lc '
+    set +e
+    cd "$REPO_ROOT" || exit 0
+    for tool in node npm rustc cargo clippy jq; do
+      if command -v "$tool" >/dev/null 2>&1; then
+        case "$tool" in
+          node) printf "node_version=%s\n" "$("$tool" -v)" ;;
+          npm) printf "npm_version=%s\n" "$("$tool" -v)" ;;
+          rustc) printf "rustc_version=%s\n" "$("$tool" -V | head -1)" ;;
+          cargo) printf "cargo_version=%s\n" "$("$tool" -V | head -1)" ;;
+          clippy) printf "clippy_version=%s\n" "$("$tool" -V | head -1)" ;;
+          jq) printf "jq_version=%s\n" "$("$tool" --version | head -1)" ;;
+        esac
+        printf "%s_path=%s\n" "$tool" "$(command -v "$tool")"
+        printf "%s_realpath=%s\n" "$tool" "$(readlink -f "$(command -v "$tool")" 2>/dev/null || echo unknown)"
+      else
+        printf "%s_version=missing\n" "$tool"
+      fi
+    done
+    printf "CARGO_TARGET_DIR=%s\n" "${CARGO_TARGET_DIR:-unset}"
+    printf "LD_LIBRARY_PATH=%s\n" "${LD_LIBRARY_PATH:-unset}"
+    printf "GST_PLUGIN_PATH=%s\n" "${GST_PLUGIN_PATH:-unset}"
+    printf "GIO_EXTRA_MODULES=%s\n" "${GIO_EXTRA_MODULES:-unset}"
+  ' REPO_ROOT="$REPO_ROOT" 2>/dev/null | tr -d '\r' || true)"
+  if [[ -n "$NIX_DEV_DUMP" ]]; then
+    section toolchain_nix_develop
+    while IFS= read -r line; do
+      [[ -n "$line" && "$line" == *=* ]] && emit "$line"
+    done <<<"$NIX_DEV_DUMP"
+  else
+    section toolchain_nix_develop
+    kv status "nix develop failed or unavailable"
+  fi
+else
+  dump_toolchain_block toolchain_ambient
+fi
+
+section runtime_env
+for var in HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY http_proxy https_proxy all_proxy no_proxy GDK_BACKEND PSYSONIC_SKIP_WAYLAND_FONT_TUNING PSYSONIC_ALLOW_NATIVE_GDK SSL_CERT_FILE SSL_CERT_DIR NIX_SSL_CERT_FILE; do
+  kv "$var" "${!var-unset}"
+done
+kv navigator_online "n/a (browser-only)"
+
+section installed_app
+if command -v psysonic >/dev/null 2>&1; then
+  PSY_PATH="$(command -v psysonic)"
+  kv psysonic_path "$PSY_PATH"
+  kv psysonic_realpath "$(readlink -f "$PSY_PATH" 2>/dev/null || echo unknown)"
+  run_optional kv psysonic_version "$(psysonic --version 2>/dev/null | head -1)"
+  if command -v nix-store >/dev/null 2>&1; then
+    kv psysonic_closure_paths "$(nix-store -qR "$PSY_PATH" 2>/dev/null | wc -l | tr -d ' ')"
+    kv psysonic_drv "$(nix-store -q --deriver "$PSY_PATH" 2>/dev/null | sed 's/\.drv$//' | xargs -r basename 2>/dev/null || echo unknown)"
+  fi
+else
+  kv psysonic_path "not_in_path"
+fi
+
+section npm_dependencies
+if [[ -f "$REPO_ROOT/package-lock.json" ]] && command -v node >/dev/null 2>&1; then
+  REPO_ROOT="$REPO_ROOT" node <<'NODE' 2>/dev/null | while IFS= read -r line; do emit "$line"; done || true
+const fs = require('fs');
+const path = require('path');
+const lockPath = path.join(process.env.REPO_ROOT || '.', 'package-lock.json');
+let lock;
+try { lock = JSON.parse(fs.readFileSync(lockPath, 'utf8')); } catch { process.exit(0); }
+const root = lock.packages?.['']?.dependencies || {};
+const deps = Object.keys(root).sort();
+for (const name of deps) {
+  const entry = lock.packages?.[`node_modules/${name}`] || lock.packages?.[name];
+  const version = entry?.version || 'unknown';
+  console.log(`dep.${name}=${version}`);
+}
+NODE
+else
+  kv status "node or package-lock.json unavailable"
+fi
+
+run_app_config_dump() {
+  local extractor="$REPO_ROOT/scripts/lib/extract-app-config.mjs"
+  [[ -f "$extractor" ]] || return 0
+  if node "$extractor" --repo-root "$REPO_ROOT" >>"${OUTPUT_FILE:-/dev/stdout}" 2>/dev/null; then
+    :
+  else
+    section app_config
+    kv status "extract-app-config failed (is Psysonic installed / has it been run once?)"
+  fi
+}
+
+run_app_config_dump
+
+section network_probe_hint
+kv note_1 "App server profiles and curl probes are in app_servers / app_network_probe sections above."
+kv note_2 "Passwords and custom header values are redacted; compare password_sha256 and value_sha256 only."
+kv note_3 "Compare two dumps with: scripts/compare-environment.sh a.txt b.txt"
+
+if [[ -n "$OUTPUT_FILE" ]]; then
+  echo "Wrote $OUTPUT_FILE" >&2
+fi

scripts/extract-release-section.mjs

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+/**
+ * Extract the body of a ## [version] section from a Keep-a-Changelog-style file.
+ * Resolution matches src/utils/releaseNotes/releaseNotesMatch.ts.
+ *
+ * Usage: node scripts/extract-release-section.mjs <file> <version> [--allow-empty]
+ * Stdout: section body (no ## header). Exit 1 if empty unless --allow-empty.
+ */
+
+import { readFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+
+const SEMVER_CORE = /^v?(\d+\.\d+\.\d+)/i;
+
+function versionCore(version) {
+  const m = version.trim().match(SEMVER_CORE);
+  return m ? m[1] : null;
+}
+
+function isPlainTriple(header) {
+  return /^\d+\.\d+\.\d+$/.test(header.trim());
+}
+
+function splitBlocks(raw) {
+  return raw.split(/\n(?=## \[)/).filter((b) => b.startsWith('## ['));
+}
+
+function headerVersion(block) {
+  const m = block.match(/^## \[([^\]]+)\]/);
+  return m ? m[1] : null;
+}
+
+function parseBlock(block) {
+  const lines = block.split('\n');
+  const m = lines[0].match(/## \[([^\]]+)\](?:\s*-\s*(.+))?/);
+  if (!m) return null;
+  return {
+    headerVersion: m[1],
+    date: (m[2] ?? '').trim(),
+    body: lines.slice(1).join('\n').trim(),
+  };
+}
+
+export function findReleaseSection(raw, appVersion) {
+  const blocks = splitBlocks(raw);
+
+  const exact = blocks.find((b) => b.startsWith(`## [${appVersion}]`));
+  if (exact) return parseBlock(exact);
+
+  const appCore = versionCore(appVersion);
+  if (!appCore) return null;
+
+  const candidates = blocks.filter((b) => {
+    const hv = headerVersion(b);
+    return hv !== null && versionCore(hv) === appCore;
+  });
+  if (candidates.length === 0) return null;
+
+  const plain = candidates.find((b) => {
+    const hv = headerVersion(b);
+    return hv !== null && isPlainTriple(hv);
+  });
+  return parseBlock(plain ?? candidates[0]);
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  const allowEmpty = args.includes('--allow-empty');
+  const positional = args.filter((a) => a !== '--allow-empty');
+  const [file, version] = positional;
+
+  if (!file || !version) {
+    console.error('Usage: node scripts/extract-release-section.mjs <file> <version> [--allow-empty]');
+    process.exit(2);
+  }
+
+  const raw = readFileSync(file, 'utf8');
+  const entry = findReleaseSection(raw, version);
+  const body = entry?.body?.trim() ?? '';
+
+  if (!body) {
+    if (allowEmpty) process.exit(0);
+    console.error(`No release section found in ${file} for version ${version}`);
+    process.exit(1);
+  }
+
+  process.stdout.write(`${body}\n`);
+}
+
+const isMain = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isMain) main();

scripts/extract-release-section.test.mjs

@@ -0,0 +1,26 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { findReleaseSection } from './extract-release-section.mjs';
+
+const FIXTURE = `
+## [1.48.0] - 2026-06-10
+
+## Highlights
+- One
+
+## [1.47.0]
+- Old
+`;
+
+describe('findReleaseSection', () => {
+  it('matches base line for -rc versions', () => {
+    const entry = findReleaseSection(FIXTURE, '1.48.0-rc.3');
+    assert.equal(entry.headerVersion, '1.48.0');
+    assert.match(entry.body, /Highlights/);
+  });
+
+  it('matches base line for -dev versions', () => {
+    const entry = findReleaseSection(FIXTURE, '1.48.0-dev');
+    assert.equal(entry.headerVersion, '1.48.0');
+  });
+});

scripts/generate-release-notes-bundle.mjs

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+/**
+ * Build src/generated/releaseNotesBundle.ts for production bundles.
+ * Embeds only the ## [X.Y.Z] slice for package.json version (dev, RC, and stable).
+ * tauri:dev reads live markdown from the repo via Vite ?raw imports instead.
+ */
+
+import { readFileSync, mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { findReleaseSection } from './extract-release-section.mjs';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+const version = pkg.version;
+
+const whatsNewPath = join(root, 'WHATS_NEW.md');
+const changelogPath = join(root, 'CHANGELOG.md');
+const whatsNewFull = readFileSync(whatsNewPath, 'utf8');
+const changelogFull = readFileSync(changelogPath, 'utf8');
+
+function sliceForVersion(full, fileLabel) {
+  const entry = findReleaseSection(full, version);
+  if (!entry?.body) {
+    console.warn(`warn: no section in ${fileLabel} for ${version} — embedding empty slice`);
+    return '';
+  }
+  const dateSuffix = entry.date ? ` - ${entry.date}` : '';
+  return `## [${entry.headerVersion}]${dateSuffix}\n\n${entry.body}`;
+}
+
+const whatsNewRaw = sliceForVersion(whatsNewFull, 'WHATS_NEW.md');
+const changelogRaw = sliceForVersion(changelogFull, 'CHANGELOG.md');
+
+const outDir = join(root, 'src/generated');
+mkdirSync(outDir, { recursive: true });
+
+const ts = `/** @generated — run: node scripts/generate-release-notes-bundle.mjs */
+export const WHATS_NEW_RAW: string = ${JSON.stringify(whatsNewRaw)};
+
+export const CHANGELOG_RAW: string = ${JSON.stringify(changelogRaw)};
+`;
+
+writeFileSync(join(outDir, 'releaseNotesBundle.ts'), ts, 'utf8');
+console.log(`wrote src/generated/releaseNotesBundle.ts (sliced for ${version})`);
+
+// Leaf module for boot-critical client id — must not import package.json at runtime
+// in the authStore chunk (circular init → psysonic/undefined on Windows WebView2).
+const appVersionTs = `/** @generated — run: node scripts/generate-release-notes-bundle.mjs */
+export const APP_VERSION = ${JSON.stringify(version)};
+
+/** Subsonic REST \`c\` param and OpenSubsonic client id (\`psysonic/<version>\`). */
+export const SUBSONIC_CLIENT_ID = ${JSON.stringify(`psysonic/${version}`)};
+`;
+
+writeFileSync(join(outDir, 'appVersion.ts'), appVersionTs, 'utf8');
+console.log(`wrote src/generated/appVersion.ts (${version})`);

scripts/install.sh

@@ -14,20 +14,22 @@ YELLOW='\033[1;33m'
 BLUE='\033[0;34m'
 NC='\033[0m' # No Color
 
+# Log helpers write to stderr so functions that return values via stdout
+# (e.g. get_download_url) stay clean when called in command substitution.
 info() {
-    echo -e "${BLUE}[INFO]${NC} $1"
+    echo -e "${BLUE}[INFO]${NC} $1" >&2
 }
 
 success() {
-    echo -e "${GREEN}[SUCCESS]${NC} $1"
+    echo -e "${GREEN}[SUCCESS]${NC} $1" >&2
 }
 
 warn() {
-    echo -e "${YELLOW}[WARN]${NC} $1"
+    echo -e "${YELLOW}[WARN]${NC} $1" >&2
 }
 
 error() {
-    echo -e "${RED}[ERROR]${NC} $1"
+    echo -e "${RED}[ERROR]${NC} $1" >&2
     exit 1
 }
 
@@ -105,7 +107,7 @@ install_package() {
     
     if [ "$OS_TYPE" = "debian" ]; then
         package_file="${package_file}.deb"
-        curl -L -o "$package_file" "$download_url"
+        curl --fail --globoff -L -o "$package_file" "$download_url"
         
         info "Installing package..."
         $PACKAGE_MANAGER install -y "$package_file" || {
@@ -114,7 +116,7 @@ install_package() {
         }
     elif [ "$OS_TYPE" = "rhel" ]; then
         package_file="${package_file}.rpm"
-        curl -L -o "$package_file" "$download_url"
+        curl --fail --globoff -L -o "$package_file" "$download_url"
         
         info "Installing package..."
         $PACKAGE_MANAGER install -y "$package_file"
@@ -128,8 +130,17 @@ install_package() {
 check_installed() {
     if command -v $APP_NAME &> /dev/null || command -v ${APP_NAME^} &> /dev/null; then
         warn "${APP_NAME} appears to be already installed."
-        read -p "Do you want to reinstall? (y/N): " -n 1 -r
-        echo
+        # Under `curl ... | bash`, stdin is the script stream itself, so
+        # read the answer from the controlling terminal instead. Probe by
+        # opening: `[ -r /dev/tty ]` passes on the 0666 device node even
+        # without a controlling terminal; only open() reports the failure.
+        if { : < /dev/tty; } 2>/dev/null; then
+            read -p "Do you want to reinstall? (y/N): " -n 1 -r < /dev/tty
+            echo
+        else
+            warn "No terminal available for prompt; skipping reinstall."
+            exit 0
+        fi
         if [[ ! $REPLY =~ ^[Yy]$ ]]; then
             info "Installation cancelled."
             exit 0

scripts/lib/extract-app-config.mjs

@@ -0,0 +1,249 @@
+#!/usr/bin/env node
+/**
+ * Read Psysonic app config from WebKit localStorage + XDG dirs.
+ * Emits key=value lines (passwords/secrets redacted; header values hashed).
+ *
+ * Usage: node scripts/lib/extract-app-config.mjs [--app-id ID] [--repo-root PATH]
+ */
+
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { DatabaseSync } from 'node:sqlite';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+function parseArgs(argv) {
+  const out = { appId: process.env.PSYSONIC_APP_ID || '', repoRoot: '' };
+  for (let i = 2; i < argv.length; i++) {
+    if (argv[i] === '--app-id' && argv[i + 1]) {
+      out.appId = argv[++i];
+    } else if (argv[i] === '--repo-root' && argv[i + 1]) {
+      out.repoRoot = argv[++i];
+    }
+  }
+  return out;
+}
+
+function sha256(text) {
+  return createHash('sha256').update(text, 'utf8').digest('hex').slice(0, 16);
+}
+
+function emitSection(name) {
+  process.stdout.write(`\n[${name}]\n`);
+}
+
+function emit(key, value) {
+  const v = String(value ?? '').replace(/\n/g, '\\n');
+  process.stdout.write(`${key}=${v}\n`);
+}
+
+function readAppIdFromRepo(repoRoot) {
+  const conf = path.join(repoRoot, 'src-tauri', 'tauri.conf.json');
+  if (!fs.existsSync(conf)) return '';
+  try {
+    const j = JSON.parse(fs.readFileSync(conf, 'utf8'));
+    return typeof j.identifier === 'string' ? j.identifier : '';
+  } catch {
+    return '';
+  }
+}
+
+function xdgDataHome() {
+  return process.env.XDG_DATA_HOME || path.join(os.homedir(), '.local', 'share');
+}
+
+function xdgConfigHome() {
+  return process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+}
+
+function decodeWebKitValue(raw) {
+  if (raw == null) return null;
+  const buf = Buffer.isBuffer(raw) ? raw : raw instanceof Uint8Array ? Buffer.from(raw) : null;
+  if (buf) {
+    if (buf.length >= 2 && buf[0] === 0xff && buf[1] === 0xfe) {
+      return new TextDecoder('utf-16le').decode(buf.subarray(2));
+    }
+    if (buf.length >= 2 && buf[0] === 0xfe && buf[1] === 0xff) {
+      return new TextDecoder('utf-16be').decode(buf.subarray(2));
+    }
+    // WebKit often stores UTF-16LE without BOM
+    if (buf.length >= 4 && buf[1] === 0 && buf[3] === 0) {
+      return new TextDecoder('utf-16le').decode(buf);
+    }
+    return buf.toString('utf8');
+  }
+  if (typeof raw === 'string') return raw;
+  return String(raw);
+}
+
+function readLocalStorageRaw(dbPath, storageKey) {
+  try {
+    const db = new DatabaseSync(dbPath, { readOnly: true });
+    const row = db.prepare('SELECT value FROM ItemTable WHERE key = ?').get(storageKey);
+    db.close();
+    if (!row?.value) return null;
+    return decodeWebKitValue(row.value);
+  } catch {
+    return null;
+  }
+}
+
+function readLocalStorageKey(dbPath, storageKey) {
+  const text = readLocalStorageRaw(dbPath, storageKey);
+  if (text == null) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
+function pickLocalStorageFile(dataDir) {
+  const dir = path.join(dataDir, 'localstorage');
+  if (!fs.existsSync(dir)) return null;
+  const files = fs
+    .readdirSync(dir)
+    .filter(f => f.endsWith('.localstorage') && !f.includes('-wal') && !f.includes('-shm'))
+    .map(f => path.join(dir, f));
+  if (files.length === 0) return null;
+
+  // Prefer packaged app origin over vite dev (1420) when both exist.
+  const ranked = files.sort((a, b) => {
+    const score = p => {
+      const base = path.basename(p);
+      if (base.includes('tauri_localhost')) return 0;
+      if (base.includes('1420')) return 2;
+      return 1;
+    };
+    return score(a) - score(b);
+  });
+
+  for (const file of ranked) {
+    const auth = readLocalStorageKey(file, 'psysonic-auth');
+    if (auth?.state?.servers?.length) return file;
+  }
+  return ranked[0];
+}
+
+function probeHttpReachability(rawUrl) {
+  if (!rawUrl) return 'empty';
+  const url = rawUrl.startsWith('http') ? rawUrl : `http://${rawUrl}`;
+  const r = spawnSync(
+    'curl',
+    ['-sS', '-o', '/dev/null', '-w', '%{http_code}', '--connect-timeout', '5', '--max-time', '10', url],
+    { encoding: 'utf8', timeout: 15000 },
+  );
+  if (r.error) return `error:${r.error.code ?? 'unknown'}`;
+  if (r.status !== 0) return `curl_exit_${r.status}`;
+  return `http_${r.stdout.trim() || '000'}`;
+}
+
+function dumpNetworkProbes(servers) {
+  emitSection('app_network_probe');
+  const seen = new Set();
+  servers.forEach((srv, i) => {
+    for (const [kind, raw] of [
+      ['url', srv.url],
+      ['alternateUrl', srv.alternateUrl],
+    ]) {
+      if (!raw || seen.has(raw)) continue;
+      seen.add(raw);
+      emit(`probe.${i}.${kind}`, probeHttpReachability(raw));
+      emit(`probe.${i}.${kind}_target`, raw);
+    }
+  });
+  if (seen.size === 0) emit('probe_status', 'no server URLs configured');
+}
+
+function dumpServerProfiles(state) {
+  const servers = state?.servers ?? [];
+  emit('active_server_id', state?.activeServerId ?? '');
+  emit('server_count', servers.length);
+  servers.forEach((srv, i) => {
+    const p = `server.${i}`;
+    emit(`${p}.id`, srv.id ?? '');
+    emit(`${p}.name`, srv.name ?? '');
+    emit(`${p}.url`, srv.url ?? '');
+    emit(`${p}.alternateUrl`, srv.alternateUrl ?? '');
+    emit(`${p}.shareUsesLocalUrl`, srv.shareUsesLocalUrl === true ? 'true' : 'false');
+    emit(`${p}.username`, srv.username ?? '');
+    emit(`${p}.password_set`, srv.password ? 'yes' : 'no');
+    emit(`${p}.password_sha256`, srv.password ? sha256(srv.password) : 'none');
+    emit(`${p}.customHeadersApplyTo`, srv.customHeadersApplyTo ?? 'public');
+    const headers = srv.customHeaders ?? [];
+    emit(`${p}.customHeaders_count`, headers.length);
+    headers.forEach((h, hi) => {
+      emit(`${p}.customHeaders.${hi}.name`, h.name ?? '');
+      emit(`${p}.customHeaders.${hi}.value_sha256`, h.value ? sha256(h.value) : 'empty');
+    });
+  });
+  dumpNetworkProbes(servers);
+}
+
+function fileMeta(label, filePath) {
+  if (!filePath || !fs.existsSync(filePath)) {
+    emit(`${label}_exists`, 'no');
+    return;
+  }
+  const st = fs.statSync(filePath);
+  emit(`${label}_exists`, 'yes');
+  emit(`${label}_path`, filePath);
+  emit(`${label}_size`, st.size);
+  emit(`${label}_mtime`, st.mtime.toISOString());
+}
+
+function listDir(label, dirPath, max = 12) {
+  if (!fs.existsSync(dirPath)) {
+    emit(`${label}_exists`, 'no');
+    return;
+  }
+  emit(`${label}_exists`, 'yes');
+  emit(`${label}_path`, dirPath);
+  const entries = fs.readdirSync(dirPath).sort();
+  emit(`${label}_entry_count`, entries.length);
+  entries.slice(0, max).forEach((name, i) => emit(`${label}.entry.${i}`, name));
+}
+
+const { appId: appIdArg, repoRoot } = parseArgs(process.argv);
+let appId = appIdArg || (repoRoot ? readAppIdFromRepo(repoRoot) : '');
+if (!appId) appId = readAppIdFromRepo(process.cwd()) || 'dev.psysonic.player';
+
+const dataDir = path.join(xdgDataHome(), appId);
+const configDir = path.join(xdgConfigHome(), appId);
+
+emitSection('app_config_paths');
+emit('app_id', appId);
+emit('data_dir', dataDir);
+emit('config_dir', configDir);
+emit('data_dir_exists', fs.existsSync(dataDir) ? 'yes' : 'no');
+emit('config_dir_exists', fs.existsSync(configDir) ? 'yes' : 'no');
+
+const lsFile = pickLocalStorageFile(dataDir);
+fileMeta('localstorage_db', lsFile);
+
+emitSection('app_preferences');
+if (lsFile) {
+  const lang = readLocalStorageRaw(lsFile, 'psysonic_language');
+  emit('language', lang ?? 'unknown');
+
+  const authWrap = readLocalStorageKey(lsFile, 'psysonic-auth');
+  if (authWrap?.state) {
+    emitSection('app_servers');
+    dumpServerProfiles(authWrap.state);
+  } else {
+    emit('app_servers_status', 'psysonic-auth not found or empty');
+  }
+} else {
+  emit('app_servers_status', 'no localstorage database found');
+}
+
+emitSection('app_config_files');
+for (const rel of ['linux_wayland_text_profile', 'mini_player_pos.json', '.window-state.json']) {
+  fileMeta(rel.replace(/\./g, '_'), path.join(configDir, rel));
+}
+
+emitSection('app_data_artifacts');
+fileMeta('hsts_storage', path.join(dataDir, 'hsts-storage.sqlite'));
+fileMeta('library_db', path.join(dataDir, 'databases', 'library', 'library.sqlite'));
+listDir('localstorage_dir', path.join(dataDir, 'localstorage'));

scripts/sync-tauri-version-from-package.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 /**
- * Align src-tauri/Cargo.toml and src-tauri/tauri.conf.json with package.json "version".
+ * Align src-tauri/Cargo.toml, src-tauri/tauri.conf.json, and workspace entries in
+ * src-tauri/Cargo.lock with package.json "version".
  * Used after npm version in promote workflows so bundle names match release semver.
  */
 const fs = require('fs');
@@ -28,3 +29,26 @@ const conf = JSON.parse(fs.readFileSync(confPath, 'utf8'));
 conf.version = version;
 fs.writeFileSync(confPath, JSON.stringify(conf, null, 2) + '\n');
 console.log(`tauri.conf.json -> ${version}`);
+
+/** @param {string} lockText */
+function syncCargoLockWorkspaceVersions(lockText, targetVersion) {
+  return lockText.replace(
+    /^(name = "psysonic[^"]*"\nversion = ")[^"]+"/gm,
+    `$1${targetVersion}"`,
+  );
+}
+
+const lockPath = path.join(root, 'src-tauri', 'Cargo.lock');
+let lock = fs.readFileSync(lockPath, 'utf8');
+const updatedLock = syncCargoLockWorkspaceVersions(lock, version);
+if (updatedLock !== lock) {
+  fs.writeFileSync(lockPath, updatedLock);
+  console.log(`Cargo.lock workspace crates -> ${version}`);
+} else {
+  console.log(`Cargo.lock workspace crates already at ${version}`);
+}
+
+require('child_process').execSync('node scripts/sync-wix-bundle-version.mjs', {
+  cwd: root,
+  stdio: 'inherit',
+});

scripts/sync-version-pipeline.test.mjs

@@ -0,0 +1,84 @@
+/**
+ * Integration tests for promotion/version sync: npm version → sync-tauri → sync-wix.
+ * Simulates tauri.conf.json state after the full pipeline (no file I/O).
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import {
+  wixMappedBuildNumber,
+  wixVersionOverrideForPackageVersion,
+} from './wix-bundle-version.mjs';
+
+/** Mirrors sync-tauri + sync-wix effects on tauri.conf.json. */
+function confAfterVersionSync(packageVersion, priorConf) {
+  const conf = structuredClone(priorConf);
+  conf.version = packageVersion;
+  conf.bundle ??= {};
+  conf.bundle.windows ??= {};
+  const override = wixVersionOverrideForPackageVersion(packageVersion);
+  conf.bundle.windows.wix = { ...(conf.bundle.windows.wix ?? {}), version: override };
+  return conf;
+}
+
+const baseConf = {
+  version: '1.49.0-dev',
+  bundle: {
+    windows: {
+      nsis: { installMode: 'currentUser' },
+      wix: { version: '1.49.0.1' },
+    },
+  },
+};
+
+describe('version promotion pipeline (sync-tauri + sync-wix)', () => {
+  it('main → next: dev to first RC increases WiX build', () => {
+    const conf = confAfterVersionSync('1.50.0-rc.1', baseConf);
+    assert.equal(conf.version, '1.50.0-rc.1');
+    assert.equal(conf.bundle.windows.wix.version, '1.50.0.10001');
+    assert.ok(
+      wixMappedBuildNumber('1.50.0-rc.1') > wixMappedBuildNumber('1.50.0-dev'),
+    );
+  });
+
+  it('next RC bump: rc.1 to rc.2', () => {
+    const from = confAfterVersionSync('1.50.0-rc.1', baseConf);
+    const conf = confAfterVersionSync('1.50.0-rc.2', from);
+    assert.equal(conf.version, '1.50.0-rc.2');
+    assert.equal(conf.bundle.windows.wix.version, '1.50.0.10002');
+  });
+
+  it('next → release: RC to stable increases WiX build', () => {
+    const from = confAfterVersionSync('1.50.0-rc.3', baseConf);
+    const conf = confAfterVersionSync('1.50.0', from);
+    assert.equal(conf.version, '1.50.0');
+    assert.equal(conf.bundle.windows.wix.version, '1.50.0.65534');
+    assert.ok(wixMappedBuildNumber('1.50.0') > wixMappedBuildNumber('1.50.0-rc.3'));
+  });
+
+  it('post-release: next minor dev resets build band on new line', () => {
+    const from = confAfterVersionSync('1.50.0', baseConf);
+    const conf = confAfterVersionSync('1.51.0-dev', from);
+    assert.equal(conf.version, '1.51.0-dev');
+    assert.equal(conf.bundle.windows.wix.version, '1.51.0.1');
+  });
+
+  it('stable release sets highest build in line', () => {
+    const conf = confAfterVersionSync('2.0.0', {
+      version: '2.0.0-rc.1',
+      bundle: { windows: { wix: { version: '2.0.0.10001' } } },
+    });
+    assert.equal(conf.version, '2.0.0');
+    assert.equal(conf.bundle.windows.wix.version, '2.0.0.65534');
+  });
+});
+
+describe('sync-tauri-version-from-package.js invokes sync-wix', () => {
+  it('calls sync-wix-bundle-version.mjs after updating conf.version', () => {
+    const source = readFileSync(new URL('./sync-tauri-version-from-package.js', import.meta.url), 'utf8');
+    assert.match(source, /sync-wix-bundle-version\.mjs/);
+    const wixCall = source.indexOf('sync-wix-bundle-version');
+    const versionWrite = source.indexOf('conf.version = version');
+    assert.ok(wixCall > versionWrite, 'sync-wix must run after conf.version is set');
+  });
+});

scripts/sync-wix-bundle-version.mjs

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+/**
+ * Write bundle.windows.wix.version in tauri.conf.json from package.json.
+ * Keeps the top-level app version unchanged (About, updater metadata, filenames).
+ */
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { wixVersionOverrideForPackageVersion } from './wix-bundle-version.mjs';
+
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const version = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version;
+if (!version || typeof version !== 'string') {
+  console.error('package.json version missing');
+  process.exit(1);
+}
+
+const confPath = path.join(root, 'src-tauri', 'tauri.conf.json');
+const conf = JSON.parse(fs.readFileSync(confPath, 'utf8'));
+conf.bundle ??= {};
+conf.bundle.windows ??= {};
+conf.bundle.windows.wix ??= {};
+
+const wixVersion = wixVersionOverrideForPackageVersion(version);
+conf.bundle.windows.wix.version = wixVersion;
+console.log(`tauri.conf wix.version -> ${wixVersion} (package ${version})`);
+
+fs.writeFileSync(confPath, `${JSON.stringify(conf, null, 2)}\n`);

scripts/wix-bundle-version.mjs

@@ -0,0 +1,96 @@
+/**
+ * Map package.json semver to a monotonic WiX/MSI ProductVersion for Tauri.
+ *
+ * `bundle.windows.wix.version` must be `major.minor.patch.build` (four integers
+ * ≤ 65535). Alphabetic pre-releases cannot be used directly. NSIS accepts full
+ * semver without this mapping.
+ *
+ * Build bands (monotonic within X.Y.Z so in-place MSI upgrades work across
+ * dev → rc → stable):
+ *   dev     → .1
+ *   rc.N    → .10000 + N
+ *   stable  → .65534
+ *
+ * Display / About still use the real package.json version.
+ */
+
+/** @type {const} */
+export const WIX_BUILD = {
+  DEV: 1,
+  RC_BASE: 10_000,
+  STABLE: 65_534,
+};
+
+const MAX_WIX_FIELD = 65_535;
+
+/** @param {number} build */
+function assertBuildField(build, label) {
+  if (!Number.isInteger(build) || build < 0 || build > MAX_WIX_FIELD) {
+    throw new Error(`WiX build field out of range for ${label}: ${build}`);
+  }
+}
+
+/**
+ * WiX dot version for bundle.windows.wix.version (always four parts for channels
+ * we ship).
+ * @param {string} version
+ */
+export function wixVersionOverrideForPackageVersion(version) {
+  const trimmed = version.trim();
+  const match = trimmed.match(/^(\d+)\.(\d+)\.(\d+)(?:-([^+]+))?(?:\+(\d+))?$/);
+  if (!match) {
+    throw new Error(`Invalid semver for WiX mapping: ${trimmed}`);
+  }
+
+  const major = match[1];
+  const minor = match[2];
+  const patch = match[3];
+  const pre = match[4];
+  const buildPart = match[5];
+  const base = `${major}.${minor}.${patch}`;
+
+  if (buildPart !== undefined) {
+    throw new Error(
+      `Version "${trimmed}" has +build metadata — map manually or drop build for WiX`,
+    );
+  }
+
+  if (pre === undefined) {
+    return `${base}.${WIX_BUILD.STABLE}`;
+  }
+
+  if (pre === 'dev') {
+    return `${base}.${WIX_BUILD.DEV}`;
+  }
+
+  const rc = pre.match(/^rc\.(\d+)$/);
+  if (rc) {
+    const n = Number(rc[1]);
+    if (!Number.isInteger(n) || n < 1) {
+      throw new Error(`WiX rc index must be ≥ 1 (got rc.${rc[1]})`);
+    }
+    const build = WIX_BUILD.RC_BASE + n;
+    assertBuildField(build, `rc.${n}`);
+    return `${base}.${build}`;
+  }
+
+  if (/^\d+$/.test(pre)) {
+    const n = Number(pre);
+    const build = WIX_BUILD.RC_BASE + n;
+    assertBuildField(build, `pre ${pre}`);
+    return `${base}.${build}`;
+  }
+
+  throw new Error(
+    `Version "${trimmed}" has non-numeric pre-release "${pre}" — MSI/WiX cannot bundle it. ` +
+      'Use NSIS (`--bundles nsis`) or extend wix-bundle-version.mjs.',
+  );
+}
+
+/** Numeric build field from mapped WiX version (for monotonicity tests). */
+export function wixMappedBuildNumber(packageVersion) {
+  const wix = wixVersionOverrideForPackageVersion(packageVersion);
+  const build = Number(wix.split('.')[3]);
+  assertBuildField(build, packageVersion);
+  return build;
+}

scripts/wix-bundle-version.test.mjs

@@ -0,0 +1,38 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  WIX_BUILD,
+  wixMappedBuildNumber,
+  wixVersionOverrideForPackageVersion,
+} from './wix-bundle-version.mjs';
+
+describe('wixVersionOverrideForPackageVersion', () => {
+  it('maps -dev to lowest build band', () => {
+    assert.equal(wixVersionOverrideForPackageVersion('1.50.0-dev'), '1.50.0.1');
+  });
+
+  it('maps -rc.N to RC base + N', () => {
+    assert.equal(wixVersionOverrideForPackageVersion('1.50.0-rc.3'), '1.50.0.10003');
+  });
+
+  it('maps stable to highest build band', () => {
+    assert.equal(wixVersionOverrideForPackageVersion('1.50.0'), '1.50.0.65534');
+  });
+
+  it('maps numeric pre-release to RC band', () => {
+    assert.equal(wixVersionOverrideForPackageVersion('1.50.0-42'), '1.50.0.10042');
+  });
+});
+
+describe('monotonic promotion builds within X.Y.Z', () => {
+  it('dev < rc.1 < rc.2 < stable', () => {
+    const chain = ['1.50.0-dev', '1.50.0-rc.1', '1.50.0-rc.2', '1.50.0'];
+    let prev = -1;
+    for (const v of chain) {
+      const build = wixMappedBuildNumber(v);
+      assert.ok(build > prev, `${v} build ${build} must exceed ${prev}`);
+      prev = build;
+    }
+    assert.equal(prev, WIX_BUILD.STABLE);
+  });
+});

src-tauri/Cargo.toml

@@ -3,9 +3,10 @@ members = ["crates/*"]
 resolver = "2"
 
 [workspace.package]
-version = "1.46.0-dev"
+version = "1.51.0-dev"
 edition = "2021"
-rust-version = "1.89"
+rust-version = "1.95"
+license = "GPL-3.0-or-later"
 
 [workspace.dependencies]
 tempfile = "3"
@@ -18,7 +19,7 @@ name = "psysonic"
 version.workspace = true
 description = "Psysonic Desktop Music Player"
 authors = []
-license = ""
+license.workspace = true
 repository = ""
 default-run = "psysonic"
 edition.workspace = true
@@ -39,9 +40,13 @@ tauri-build = { version = "2", features = [] }
 psysonic-core = { path = "crates/psysonic-core" }
 psysonic-analysis = { path = "crates/psysonic-analysis" }
 psysonic-audio = { path = "crates/psysonic-audio" }
+psysonic-library = { path = "crates/psysonic-library" }
 psysonic-syncfs = { path = "crates/psysonic-syncfs" }
 psysonic-integration = { path = "crates/psysonic-integration" }
-tauri = { version = "2", features = ["tray-icon", "image-png"] }
+tauri = { version = "2", features = ["protocol-asset", "tray-icon", "image-png"] }
+specta = "=2.0.0-rc.25"
+specta-typescript = "=0.0.12"
+tauri-specta = { version = "=2.0.0-rc.25", features = ["derive", "typescript"] }
 tauri-plugin-single-instance = "2"
 tauri-plugin-shell = "2"
 tauri-plugin-global-shortcut = "2"
@@ -50,8 +55,8 @@ tauri-plugin-dialog = "2"
 tauri-plugin-fs = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-rodio = { version = "0.22", default-features = false, features = ["playback", "symphonia-all"] }
-symphonia = { version = "0.5", default-features = false, features = ["flac", "mp3", "pcm", "aac", "alac", "isomp4", "vorbis", "ogg", "wav", "adpcm"] }
+rodio = { version = "0.22", default-features = false, features = ["playback"] }
+symphonia = { version = "0.6", default-features = false, features = ["flac", "mp3", "pcm", "aac", "alac", "isomp4", "vorbis", "ogg", "wav", "adpcm", "all-meta"] }
 reqwest = { version = "0.13", default-features = false, features = ["stream", "json", "multipart", "query", "form", "rustls", "blocking", "gzip", "brotli"] }
 futures-util = "0.3"
 md5 = "0.8"
@@ -66,20 +71,27 @@ discord-rich-presence = "1.1"
 url = "2"
 thread-priority = "3"
 lofty = "0.24"
-sysinfo = { version = "0.38", default-features = false, features = ["disk"] }
-id3 = "1.16.4"
-symphonia-adapter-libopus = "0.2.9"
-rusqlite = { version = "0.39", features = ["bundled"] }
+sysinfo = { version = "0.39", default-features = false, features = ["disk", "system"] }
+id3 = "1.17"
+symphonia-adapter-libopus = "0.3"
+rusqlite = { version = "0.40", features = ["bundled"] }
 ebur128 = "0.1"
 dasp_sample = "0.11.0"
+zip = "8"
+image = { version = "0.25", default-features = false, features = ["jpeg", "png", "webp"] }
+webp = "0.3"
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"
 
+[target.'cfg(target_os = "macos")'.dependencies]
+mach2 = "0.5"
+
 [target.'cfg(target_os = "linux")'.dependencies]
-zbus = { version = "5.15", default-features = false, features = ["blocking-api"] }
+zbus = { version = "5.16", default-features = false, features = ["blocking-api", "async-io"] }
 # Match wry/tauri’s WebKitGTK stack — used only to turn off kinetic wheel scrolling.
 webkit2gtk = { version = "2.0", default-features = false, features = ["v2_40"] }
+webkit2gtk-nvidia-quirk = "1.3"
 
 [target.'cfg(windows)'.dependencies]
 windows = { version = "0.62", features = [
@@ -94,11 +106,10 @@ windows = { version = "0.62", features = [
     "Win32_UI_WindowsAndMessaging",
 ] }
 
-[patch.crates-io]
-# Local patch for Symphonia's isomp4 demuxer:
-# - Fixes descriptor.unwrap() panic on malformed esds atoms (older iTunes M4A)
-# - Tolerates SL predefined=0x01 (null) used by some older iTunes-purchased files
-# - Gracefully skips malformed trak atoms (e.g. MJPEG cover-art streams) instead
-#   of failing the entire probe
-symphonia-format-isomp4 = { path = "patches/symphonia-format-isomp4" }
+# NOTE: The local `symphonia-format-isomp4` path patch (0.5-based) was removed for
+# the Symphonia 0.6 migration. Symphonia 0.6 upstream already covers the esds
+# missing-descriptor and SL predefined=null fixes. The malformed-trak skip and
+# moov-at-end tail scan are validated against the fixture corpus on stock 0.6; if a
+# case regresses, re-create the patch from the 0.6 isomp4 source and re-add the
+# [patch.crates-io] entry here. See workdocs task 2026-05-symphonia-0.6-migration.
 

src-tauri/about.toml

@@ -21,6 +21,8 @@ accepted = [
     "OpenSSL",
     "BSL-1.0",
     "CDLA-Permissive-2.0",
+    "GPL-3.0-or-later",
+    "bzip2-1.0.6",
 ]
 
 # Skip the build host's own platform-pinning; we want a list across all targets
@@ -38,5 +40,4 @@ targets = [
 ignore-build-dependencies = false
 ignore-dev-dependencies = true
 ignore-transitive-dependencies = false
-filter-noassertion = false
 workarounds = ["ring"]

src-tauri/build.rs

@@ -1,3 +1,20 @@
 fn main() {
+    // Windows/MSVC test binaries only: bind to Common-Controls v6.
+    //
+    // The library test harness (`--lib` unittests) links the wry/tao windowing
+    // runtime and statically imports `TaskDialogIndirect` from comctl32, which
+    // exists only in Common-Controls v6 (WinSxS). The real app binary gets that
+    // manifest from `tauri_build`, but the separate test executable does not, so
+    // it aborts at startup with STATUS_ENTRYPOINT_NOT_FOUND (0xC0000139). Add the
+    // dependency to test targets only — never the app binary (which already has a
+    // manifest via tauri_build) nor non-Windows/CI builds.
+    let is_windows_msvc = std::env::var("CARGO_CFG_TARGET_OS").as_deref() == Ok("windows")
+        && std::env::var("CARGO_CFG_TARGET_ENV").as_deref() == Ok("msvc");
+    if is_windows_msvc {
+        println!(
+            "cargo::rustc-link-arg=/MANIFESTDEPENDENCY:type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'"
+        );
+    }
+
     tauri_build::build()
 }

src-tauri/capabilities/default.json

@@ -22,6 +22,7 @@
     "fs:allow-write-file",
     "fs:allow-read-file",
     "fs:allow-mkdir",
+    "fs:allow-app-write-recursive",
     "fs:scope-download-recursive",
     "fs:scope-home-recursive",
     "window-state:allow-save-window-state",
@@ -38,6 +39,7 @@
     "core:window:allow-create",
     "core:window:allow-set-size",
     "core:webview:allow-create-webview-window",
+    "core:webview:allow-set-webview-zoom",
     "process:allow-restart",
     "updater:default"
   ]

src-tauri/crates/psysonic-analysis/Cargo.toml

@@ -3,6 +3,7 @@ name = "psysonic-analysis"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+license.workspace = true
 publish = false
 
 [dependencies]
@@ -11,10 +12,16 @@ psysonic-core = { path = "../psysonic-core" }
 tauri = { version = "2" }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+specta = { version = "=2.0.0-rc.25", features = ["derive"] }
 tokio = { version = "1", features = ["rt", "time", "sync"] }
 reqwest = { version = "0.13", default-features = false, features = ["stream", "rustls", "gzip", "brotli"] }
 futures-util = "0.3"
 ebur128 = "0.1"
 md5 = "0.8"
-rusqlite = { version = "0.39", features = ["bundled"] }
-symphonia = { version = "0.5", default-features = false, features = ["flac", "mp3", "pcm", "aac", "alac", "isomp4", "vorbis", "ogg", "wav", "adpcm"] }
+rusqlite = { version = "0.40", features = ["bundled"] }
+symphonia = { version = "0.6", default-features = false, features = ["flac", "mp3", "pcm", "aac", "alac", "isomp4", "vorbis", "ogg", "wav", "adpcm", "all-meta"] }
+symphonia-adapter-libopus = "0.3"
+oximedia-mir = { version = "0.1.7", default-features = false, features = ["tempo", "mood"] }
+
+[dev-dependencies]
+tauri = { version = "2", features = ["test"] }

src-tauri/crates/psysonic-analysis/build.rs

@@ -0,0 +1,19 @@
+fn main() {
+    // Windows/MSVC test binaries only: bind to Common-Controls v6.
+    //
+    // The `tauri` dev-dependency pulls the wry/tao windowing runtime into this
+    // crate's *test* executables, which statically import `TaskDialogIndirect`
+    // from comctl32. That symbol lives only in Common-Controls v6 (WinSxS); the
+    // bare System32 comctl32.dll is v5.82 and does not export it, so an
+    // unmanifested test exe aborts at startup with STATUS_ENTRYPOINT_NOT_FOUND
+    // (0xC0000139) before any test runs. The app binary avoids this through its
+    // embedded manifest — mirror that here, scoped to test targets only (never
+    // the app, the rlib, or non-Windows/CI builds).
+    let is_windows_msvc = std::env::var("CARGO_CFG_TARGET_OS").as_deref() == Ok("windows")
+        && std::env::var("CARGO_CFG_TARGET_ENV").as_deref() == Ok("msvc");
+    if is_windows_msvc {
+        println!(
+            "cargo::rustc-link-arg=/MANIFESTDEPENDENCY:type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'"
+        );
+    }
+}

src-tauri/crates/psysonic-analysis/migrations/001_baseline.sql

@@ -0,0 +1,44 @@
+-- Baseline: the pre-versioning analysis cache schema.
+--
+-- This is the exact shape every existing user DB already carries (created by
+-- the old `CREATE TABLE IF NOT EXISTS` bootstrap). `IF NOT EXISTS` keeps it a
+-- no-op on those DBs and creates the tables on a fresh one, so "migration 1
+-- applied" means "the schema that shipped before versioned migrations".
+--
+-- Server-scoping (server_id) is added additively in 002.
+
+CREATE TABLE IF NOT EXISTS analysis_track (
+    track_id TEXT NOT NULL,
+    md5_16kb TEXT NOT NULL,
+    status TEXT NOT NULL,
+    waveform_algo_version INTEGER NOT NULL,
+    loudness_algo_version INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    PRIMARY KEY (track_id, md5_16kb)
+);
+
+CREATE TABLE IF NOT EXISTS waveform_cache (
+    track_id TEXT NOT NULL,
+    md5_16kb TEXT NOT NULL,
+    bins BLOB NOT NULL,
+    bin_count INTEGER NOT NULL,
+    is_partial INTEGER NOT NULL,
+    known_until_sec REAL NOT NULL,
+    duration_sec REAL NOT NULL,
+    updated_at INTEGER NOT NULL,
+    PRIMARY KEY (track_id, md5_16kb)
+);
+
+CREATE TABLE IF NOT EXISTS loudness_cache (
+    track_id TEXT NOT NULL,
+    md5_16kb TEXT NOT NULL,
+    integrated_lufs REAL NOT NULL,
+    true_peak REAL NOT NULL,
+    recommended_gain_db REAL NOT NULL,
+    target_lufs REAL NOT NULL,
+    updated_at INTEGER NOT NULL,
+    PRIMARY KEY (track_id, md5_16kb, target_lufs)
+);
+
+CREATE INDEX IF NOT EXISTS idx_analysis_track_status
+    ON analysis_track(status);

src-tauri/crates/psysonic-analysis/migrations/002_server_id.sql

@@ -0,0 +1,73 @@
+-- Add `server_id` to the analysis cache so waveform/loudness rows are scoped
+-- per server (E1 / R7-16). SQLite cannot change a PRIMARY KEY in place, so each
+-- table is rebuilt: create the v2 shape, copy every row with server_id = '',
+-- drop the old table, rename. Existing rows become legacy ('') rows that the
+-- read path still finds (server -> legacy -> lazy re-tag, added in 6c-2).
+--
+-- Atomicity: the migration runner wraps this whole file plus the
+-- schema_migrations marker in one transaction, so any failure or crash rolls
+-- everything back to the original tables — DROP never runs unless the copy
+-- before it succeeded. No BEGIN/COMMIT here (that would nest).
+--
+-- These three tables have no foreign keys between them or from any other table,
+-- so the drop/rename needs no `PRAGMA foreign_keys` toggle (which is a no-op
+-- inside a transaction anyway).
+
+-- analysis_track
+CREATE TABLE analysis_track_v2 (
+    server_id TEXT NOT NULL DEFAULT '',
+    track_id TEXT NOT NULL,
+    md5_16kb TEXT NOT NULL,
+    status TEXT NOT NULL,
+    waveform_algo_version INTEGER NOT NULL,
+    loudness_algo_version INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    PRIMARY KEY (server_id, track_id, md5_16kb)
+);
+INSERT INTO analysis_track_v2
+    (server_id, track_id, md5_16kb, status, waveform_algo_version, loudness_algo_version, updated_at)
+    SELECT '', track_id, md5_16kb, status, waveform_algo_version, loudness_algo_version, updated_at
+    FROM analysis_track;
+DROP TABLE analysis_track;
+ALTER TABLE analysis_track_v2 RENAME TO analysis_track;
+CREATE INDEX IF NOT EXISTS idx_analysis_track_status
+    ON analysis_track(status);
+
+-- waveform_cache
+CREATE TABLE waveform_cache_v2 (
+    server_id TEXT NOT NULL DEFAULT '',
+    track_id TEXT NOT NULL,
+    md5_16kb TEXT NOT NULL,
+    bins BLOB NOT NULL,
+    bin_count INTEGER NOT NULL,
+    is_partial INTEGER NOT NULL,
+    known_until_sec REAL NOT NULL,
+    duration_sec REAL NOT NULL,
+    updated_at INTEGER NOT NULL,
+    PRIMARY KEY (server_id, track_id, md5_16kb)
+);
+INSERT INTO waveform_cache_v2
+    (server_id, track_id, md5_16kb, bins, bin_count, is_partial, known_until_sec, duration_sec, updated_at)
+    SELECT '', track_id, md5_16kb, bins, bin_count, is_partial, known_until_sec, duration_sec, updated_at
+    FROM waveform_cache;
+DROP TABLE waveform_cache;
+ALTER TABLE waveform_cache_v2 RENAME TO waveform_cache;
+
+-- loudness_cache
+CREATE TABLE loudness_cache_v2 (
+    server_id TEXT NOT NULL DEFAULT '',
+    track_id TEXT NOT NULL,
+    md5_16kb TEXT NOT NULL,
+    integrated_lufs REAL NOT NULL,
+    true_peak REAL NOT NULL,
+    recommended_gain_db REAL NOT NULL,
+    target_lufs REAL NOT NULL,
+    updated_at INTEGER NOT NULL,
+    PRIMARY KEY (server_id, track_id, md5_16kb, target_lufs)
+);
+INSERT INTO loudness_cache_v2
+    (server_id, track_id, md5_16kb, integrated_lufs, true_peak, recommended_gain_db, target_lufs, updated_at)
+    SELECT '', track_id, md5_16kb, integrated_lufs, true_peak, recommended_gain_db, target_lufs, updated_at
+    FROM loudness_cache;
+DROP TABLE loudness_cache;
+ALTER TABLE loudness_cache_v2 RENAME TO loudness_cache;

src-tauri/crates/psysonic-analysis/src/analysis_cache/compute.rs

@@ -2,14 +2,18 @@ use std::io::Cursor;
 use std::time::Instant;
 
 use ebur128::{EbuR128, Mode as Ebur128Mode};
-use symphonia::core::audio::SampleBuffer;
-use symphonia::core::codecs::{Decoder, DecoderOptions, CODEC_TYPE_NULL};
+use symphonia::core::codecs::audio::{AudioDecoder, AudioDecoderOptions};
 use symphonia::core::errors::Error as SymphoniaError;
-use symphonia::core::formats::{FormatOptions, FormatReader};
+use symphonia::core::formats::probe::Hint;
+use symphonia::core::formats::{FormatOptions, FormatReader, SeekMode, SeekTo, TrackType};
 use symphonia::core::io::MediaSourceStream;
 use symphonia::core::meta::MetadataOptions;
-use symphonia::core::probe::Hint;
-use tauri::Manager;
+use symphonia::core::units::Time;
+use tauri::{Manager, Runtime};
+use psysonic_core::track_enrichment::TrackEnrichmentOutcome;
+
+use crate::analysis_perf::AnalysisSeedTimings;
+use crate::codec::make_decoder;
 
 use super::store::{now_unix_ts, AnalysisCache, LoudnessEntry, TrackKey, WaveformEntry};
 
@@ -38,54 +42,120 @@ pub enum SeedFromBytesOutcome {
 
 /// Full Symphonia + (optional) EBU decode for waveform + loudness. Call only from the
 /// single CPU-seed worker in `lib.rs` (`spawn_blocking`) so at most one heavy decode runs.
-pub fn seed_from_bytes_execute(
-    app: &tauri::AppHandle,
+pub fn seed_from_bytes_execute<R: Runtime>(
+    app: &tauri::AppHandle<R>,
+    server_id: &str,
     track_id: &str,
     bytes: &[u8],
-) -> Result<SeedFromBytesOutcome, String> {
+    format_hint: Option<&str>,
+    notify_ui: bool,
+) -> Result<(SeedFromBytesOutcome, AnalysisSeedTimings), String> {
+    let seed_started = Instant::now();
     let Some(cache) = app.try_state::<AnalysisCache>() else {
         crate::app_deprintln!(
             "[analysis][waveform] build skip track_id={} reason=no_analysis_cache bytes={}",
             track_id,
             bytes.len()
         );
-        return Ok(SeedFromBytesOutcome::SkippedNoAnalysisCache);
+        return Ok((
+            SeedFromBytesOutcome::SkippedNoAnalysisCache,
+            AnalysisSeedTimings::default(),
+        ));
     };
-    seed_from_bytes_into_cache(&cache, track_id, bytes)
+    let (outcome, md5_16kb) =
+        seed_from_bytes_into_cache(&cache, server_id, track_id, bytes, format_hint)?;
+    let seed_ms = seed_started.elapsed().as_millis() as u64;
+    // E2 bridge (analysis → library content_hash): once the playback-derived
+    // md5_16kb is known — whether freshly written or already cached — record it
+    // as `track.content_hash` via the registered sink. Decoupled from
+    // psysonic-library through the psysonic-core port; a no-op when the library
+    // has no row for this (server_id, track_id). Skipped when no server is known.
+    if !server_id.is_empty()
+        && matches!(
+            outcome,
+            SeedFromBytesOutcome::Upserted | SeedFromBytesOutcome::SkippedWaveformCacheHit
+        )
+    {
+        if let Some(sink) = app.try_state::<psysonic_core::ports::ContentHashSink>() {
+            sink.record_content_hash(server_id, track_id, &md5_16kb);
+        }
+    }
+    let bpm_ms = if !server_id.is_empty() {
+        let bpm_started = Instant::now();
+        let enrichment_outcome = crate::track_enrichment::run_track_enrichment_if_needed(
+            app,
+            server_id,
+            track_id,
+            bytes,
+            notify_ui,
+        );
+        if matches!(enrichment_outcome, TrackEnrichmentOutcome::Failed) {
+            let key = TrackKey {
+                server_id: server_id.to_string(),
+                track_id: track_id.to_string(),
+                md5_16kb: md5_16kb.clone(),
+            };
+            let _ = cache.touch_track_status(&key, "failed");
+        }
+        if matches!(outcome, SeedFromBytesOutcome::Upserted) {
+            if let Ok(coverage) = cache.content_cache_coverage(server_id, track_id, &md5_16kb) {
+                if !coverage.has_loudness {
+                    let key = TrackKey {
+                        server_id: server_id.to_string(),
+                        track_id: track_id.to_string(),
+                        md5_16kb: md5_16kb.clone(),
+                    };
+                    let _ = cache.touch_track_status(&key, "failed");
+                }
+            }
+        }
+        bpm_started.elapsed().as_millis() as u64
+    } else {
+        0
+    };
+    Ok((
+        outcome,
+        AnalysisSeedTimings { seed_ms, bpm_ms },
+    ))
 }
 
 /// AppHandle-free entry point for [`seed_from_bytes_execute`]: takes the cache
 /// directly, runs the same Symphonia → waveform → EBU R128 pipeline, and
 /// upserts the rows. Called from `seed_from_bytes_execute` in production and
 /// from tests against an in-memory cache.
+/// Returns the outcome plus the computed `md5_16kb` (the content fingerprint),
+/// so the AppHandle-aware caller can bridge it to the library `content_hash`
+/// (E2) without re-reading the bytes.
 pub fn seed_from_bytes_into_cache(
     cache: &AnalysisCache,
+    server_id: &str,
     track_id: &str,
     bytes: &[u8],
-) -> Result<SeedFromBytesOutcome, String> {
+    format_hint: Option<&str>,
+) -> Result<(SeedFromBytesOutcome, String), String> {
     let started = Instant::now();
+    // Write under the playback server's scope.
     let key = TrackKey {
+        server_id: server_id.to_string(),
         track_id: track_id.to_string(),
         md5_16kb: md5_first_16kb(bytes),
     };
-    if let Some(existing) = cache.get_waveform(&key)? {
-        if !existing.bins.is_empty() {
-            if cache.loudness_row_exists_for_key(&key)? {
-                crate::app_deprintln!(
-                    "[analysis][waveform] build skip track_id={} reason=waveform_cache_hit md5_16kb={} bins_len={} elapsed_ms={}",
-                    track_id,
-                    key.md5_16kb,
-                    existing.bins.len(),
-                    started.elapsed().as_millis()
-                );
-                return Ok(SeedFromBytesOutcome::SkippedWaveformCacheHit);
-            }
-            crate::app_deprintln!(
-                "[analysis][waveform] waveform cache hit but loudness missing — full re-analysis track_id={} md5_16kb={}",
-                track_id,
-                key.md5_16kb
-            );
-        }
+    let coverage = cache.content_cache_coverage(server_id, track_id, &key.md5_16kb)?;
+    if coverage.complete() {
+        crate::app_deprintln!(
+            "[analysis][waveform] build skip track_id={} reason=waveform_cache_hit md5_16kb={} elapsed_ms={}",
+            track_id,
+            key.md5_16kb,
+            started.elapsed().as_millis()
+        );
+        return Ok((SeedFromBytesOutcome::SkippedWaveformCacheHit, key.md5_16kb.clone()));
+    }
+    if coverage.has_waveform && !coverage.has_loudness {
+        crate::app_deprintln!(
+            "[analysis][waveform] waveform cache hit but loudness missing — full re-analysis track_id={} md5_16kb={}",
+            track_id,
+            key.md5_16kb
+        );
     }
     let mib = bytes.len() as f64 / (1024.0 * 1024.0);
     crate::app_deprintln!(
@@ -101,7 +171,8 @@ pub fn seed_from_bytes_into_cache(
     let build = (|| -> Result<(bool, usize), String> {
         cache.touch_track_status(&key, "queued")?;
 
-        let (wf_bins, loudness_opt, used_pcm_decode) = match analyze_loudness_and_waveform(bytes, -16.0, 500) {
+        let (wf_bins, loudness_opt, used_pcm_decode) =
+            match analyze_loudness_and_waveform(bytes, -16.0, 500, format_hint) {
             Some((integrated_lufs, true_peak, recommended_gain_db, target_lufs, bins)) => {
                 (
                     bins,
@@ -134,6 +205,7 @@ pub fn seed_from_bytes_into_cache(
         }
 
         cache.touch_track_status(&key, "ready")?;
+        let _ = cache.checkpoint_wal("analysis.seed");
         Ok((used_pcm_decode, bins_len))
     })();
 
@@ -154,6 +226,7 @@ pub fn seed_from_bytes_into_cache(
             );
         }
         Err(e) => {
+            let _ = cache.touch_track_status(&key, "failed");
             crate::app_deprintln!(
                 "[analysis] full-track analysis failed track_id={} elapsed_ms={} err={}",
                 track_id,
@@ -164,12 +237,12 @@ pub fn seed_from_bytes_into_cache(
     }
 
     match build {
-        Ok(_) => Ok(SeedFromBytesOutcome::Upserted),
+        Ok(_) => Ok((SeedFromBytesOutcome::Upserted, key.md5_16kb.clone())),
         Err(e) => Err(e),
     }
 }
 
-fn md5_first_16kb(bytes: &[u8]) -> String {
+pub fn md5_first_16kb(bytes: &[u8]) -> String {
     let n = bytes.len().min(16 * 1024);
     format!("{:x}", md5::compute(&bytes[..n]))
 }
@@ -206,15 +279,16 @@ fn analyze_loudness_and_waveform(
     bytes: &[u8],
     target_lufs: f64,
     bin_count: usize,
+    format_hint: Option<&str>,
 ) -> Option<(f64, f64, f64, f64, Vec<u8>)> {
     if bytes.is_empty() || bin_count == 0 {
         return None;
     }
-    let (decoded_frames, timeline_hint) = count_mono_frames_from_audio_bytes(bytes)?;
+    let (decoded_frames, timeline_hint) = count_mono_frames_from_audio_bytes(bytes, format_hint)?;
     if decoded_frames == 0 {
         return None;
     }
-    let scanned = decode_scan_pcm(bytes, bin_count, decoded_frames, timeline_hint, Some(target_lufs))?;
+    let scanned = decode_scan_pcm(bytes, bin_count, decoded_frames, timeline_hint, Some(target_lufs), format_hint)?;
     let (i, t, r, tgt) = scanned.loudness?;
     Some((i, t, r, tgt, scanned.bins))
 }
@@ -224,34 +298,60 @@ fn analyze_loudness_and_waveform(
 /// when the container reports total track length.
 struct DecodeSession {
     format: Box<dyn FormatReader>,
-    decoder: Box<dyn Decoder>,
+    decoder: Box<dyn AudioDecoder>,
     track_id: u32,
     timeline_hint: Option<u64>,
 }
 
-fn open_decode_session(bytes: &[u8]) -> Option<DecodeSession> {
+fn format_hint_from_bytes(bytes: &[u8]) -> Option<String> {
+    if bytes.len() < 4 {
+        return None;
+    }
+    if bytes[0..4] == *b"OggS" {
+        return Some("ogg".into());
+    }
+    if bytes.len() >= 4 && bytes[0..4] == *b"fLaC" {
+        return Some("flac".into());
+    }
+    if bytes.len() >= 12 && bytes[0..4] == *b"RIFF" && bytes[8..12] == *b"WAVE" {
+        return Some("wav".into());
+    }
+    let scan = bytes.len().min(4096).saturating_sub(4);
+    for i in 0..=scan {
+        if bytes[i..i + 4] == *b"ftyp" {
+            return Some("m4a".into());
+        }
+    }
+    None
+}
+
+fn open_decode_session(bytes: &[u8], format_hint: Option<&str>) -> Option<DecodeSession> {
     let source = Box::new(Cursor::new(bytes.to_vec()));
     let mss = MediaSourceStream::new(source, Default::default());
-    let hint = Hint::new();
-    let probed = symphonia::default::get_probe()
-        .format(&hint, mss, &FormatOptions::default(), &MetadataOptions::default())
+    let sniffed = format_hint_from_bytes(bytes);
+    let mut hint = Hint::new();
+    if let Some(ext) = format_hint.or(sniffed.as_deref()) {
+        hint.with_extension(ext);
+    }
+    let format = symphonia::default::get_probe()
+        .probe(&hint, mss, FormatOptions::default(), MetadataOptions::default())
         .ok()?;
-    let format = probed.format;
+    // Prefer an audio track that reports both sample rate and channels; fall back to
+    // the first audio track with a known codec (skips e.g. MJPEG cover-art tracks).
     let track = format
-        .default_track()
-        .filter(|t| t.codec_params.codec != CODEC_TYPE_NULL)
-        .or_else(|| {
-            format.tracks().iter().find(|t| {
-                t.codec_params.codec != CODEC_TYPE_NULL
-                    && t.codec_params.sample_rate.is_some()
-                    && t.codec_params.channels.is_some()
-            })
+        .tracks()
+        .iter()
+        .find(|t| {
+            t.codec_params
+                .as_ref()
+                .and_then(|c| c.audio())
+                .is_some_and(|a| a.sample_rate.is_some() && a.channels.is_some())
         })
-        .or_else(|| format.tracks().iter().find(|t| t.codec_params.codec != CODEC_TYPE_NULL))?;
+        .or_else(|| format.first_track_known_codec(TrackType::Audio))?;
     let track_id = track.id;
-    let timeline_hint = track.codec_params.n_frames.filter(|&n| n > 0);
-    let codec_params = track.codec_params.clone();
-    let decoder = match symphonia::default::get_codecs().make(&codec_params, &DecoderOptions::default()) {
+    let timeline_hint = track.num_frames.filter(|&n| n > 0);
+    let audio_params = track.codec_params.as_ref()?.audio()?.clone();
+    let decoder = match make_decoder(&audio_params, &AudioDecoderOptions::default().gapless(false)) {
         Ok(v) => v,
         Err(e) => {
             crate::app_deprintln!("[analysis] decoder make failed: {}", e);
@@ -265,14 +365,15 @@ fn open_decode_session(bytes: &[u8]) -> Option<DecodeSession> {
 /// `codec_params.n_frames` when the container reports total track length — used
 /// as a **fixed** waveform time axis so partial decodes do not remap every bin
 /// when the buffer grows.
-fn count_mono_frames_from_audio_bytes(bytes: &[u8]) -> Option<(u64, Option<u64>)> {
+fn count_mono_frames_from_audio_bytes(bytes: &[u8], format_hint: Option<&str>) -> Option<(u64, Option<u64>)> {
     let DecodeSession { mut format, mut decoder, track_id, timeline_hint } =
-        open_decode_session(bytes)?;
+        open_decode_session(bytes, format_hint)?;
 
     let mut total: u64 = 0;
     let mut loop_i: u32 = 0;
-    while let Ok(packet) = format.next_packet() {
-        if packet.track_id() != track_id {
+    let mut samples_buf: Vec<f32> = Vec::new();
+    while let Ok(Some(packet)) = format.next_packet() {
+        if packet.track_id != track_id {
             continue;
         }
         let decoded = match decoder.decode(&packet) {
@@ -281,14 +382,12 @@ fn count_mono_frames_from_audio_bytes(bytes: &[u8]) -> Option<(u64, Option<u64>)
             Err(SymphoniaError::ResetRequired) => break,
             Err(_) => break,
         };
-        let spec = *decoded.spec();
-        let n_ch = spec.channels.count();
+        let n_ch = decoded.spec().channels().count();
         if n_ch == 0 {
             continue;
         }
-        let mut samples = SampleBuffer::<f32>::new(decoded.capacity() as u64, spec);
-        samples.copy_interleaved_ref(decoded);
-        let n = samples.samples().len();
+        decoded.copy_to_vec_interleaved(&mut samples_buf);
+        let n = samples_buf.len();
         if n < n_ch || !n.is_multiple_of(n_ch) {
             continue;
         }
@@ -330,8 +429,9 @@ fn decode_scan_pcm(
     decoded_frames: u64,
     timeline_hint: Option<u64>,
     loudness_target_lufs: Option<f64>,
+    format_hint: Option<&str>,
 ) -> Option<PcmScanResult> {
-    let DecodeSession { mut format, mut decoder, track_id, .. } = open_decode_session(bytes)?;
+    let DecodeSession { mut format, mut decoder, track_id, .. } = open_decode_session(bytes, format_hint)?;
 
     let mut bin_max = vec![0.0f32; bin_count];
     let mut bin_sum = vec![0.0f32; bin_count];
@@ -358,8 +458,9 @@ fn decode_scan_pcm(
     }
     let bin_grid_frames = decoded_frames.max(1);
 
-    while let Ok(packet) = format.next_packet() {
-        if packet.track_id() != track_id {
+    let mut samples_buf: Vec<f32> = Vec::new();
+    while let Ok(Some(packet)) = format.next_packet() {
+        if packet.track_id != track_id {
             continue;
         }
         let decoded = match decoder.decode(&packet) {
@@ -369,15 +470,14 @@ fn decode_scan_pcm(
             Err(_) => break,
         };
 
-        let spec = *decoded.spec();
-        let n_ch = spec.channels.count();
+        let n_ch = decoded.spec().channels().count();
         if n_ch == 0 {
             continue;
         }
 
         if loudness_target_lufs.is_some() && ebu.is_none() {
-            let ch = spec.channels.count() as u32;
-            let sr = spec.rate;
+            let ch = decoded.spec().channels().count() as u32;
+            let sr = decoded.spec().rate();
             match EbuR128::new(ch, sr, Ebur128Mode::I | Ebur128Mode::TRUE_PEAK) {
                 Ok(v) => {
                     ebu = Some(v);
@@ -395,9 +495,8 @@ fn decode_scan_pcm(
             }
         }
 
-        let mut samples = SampleBuffer::<f32>::new(decoded.capacity() as u64, spec);
-        samples.copy_interleaved_ref(decoded);
-        let slice = samples.samples();
+        decoded.copy_to_vec_interleaved(&mut samples_buf);
+        let slice = samples_buf.as_slice();
         if slice.len() < n_ch || !slice.len().is_multiple_of(n_ch) {
             continue;
         }
@@ -429,7 +528,7 @@ fn decode_scan_pcm(
 
         if loudness_target_lufs.is_some() {
             if let Some(e) = ebu.as_mut() {
-                match e.add_frames_f32(samples.samples()) {
+                match e.add_frames_f32(&samples_buf) {
                     Ok(_) => fed_any_frames = true,
                     Err(err) => {
                         crate::app_deprintln!("[analysis] loudness add_frames failed: {}", err);
@@ -503,6 +602,171 @@ fn decode_scan_pcm(
     Some(PcmScanResult { bins, loudness })
 }
 
+/// PCM window for short MIR-style analysis (typically 60 s from track center).
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct PcmAnalysisWindow {
+    pub start_sec: f64,
+    pub duration_sec: f64,
+}
+
+/// Pick a centered analysis window, or the full track when shorter than `window_sec`.
+pub fn analysis_pcm_window(total_duration_sec: f64, window_sec: f64) -> PcmAnalysisWindow {
+    let total = total_duration_sec.max(0.0);
+    let window = window_sec.max(0.1);
+    if total <= window || !total.is_finite() {
+        return PcmAnalysisWindow {
+            start_sec: 0.0,
+            duration_sec: if total > 0.0 { total } else { window },
+        };
+    }
+    let start = ((total - window) / 2.0).max(0.0);
+    PcmAnalysisWindow {
+        start_sec: start,
+        duration_sec: window,
+    }
+}
+
+/// Best-effort container duration from codec metadata (seconds).
+pub fn audio_duration_from_bytes(bytes: &[u8]) -> Option<f64> {
+    let session = open_decode_session(bytes, None)?;
+    let sample_rate = session
+        .format
+        .default_track(TrackType::Audio)
+        .or_else(|| session.format.tracks().first())
+        .and_then(|t| t.codec_params.as_ref())
+        .and_then(|c| c.audio())
+        .and_then(|a| a.sample_rate)
+        .filter(|&sr| sr > 0)?;
+    let frames = session.timeline_hint?;
+    Some(frames as f64 / sample_rate as f64)
+}
+
+/// Decode mono PCM for a time window. Seeks when `start_sec > 0`.
+pub fn decode_mono_pcm_window(
+    bytes: &[u8],
+    start_sec: f64,
+    window_sec: f64,
+) -> Result<(Vec<f32>, f32), String> {
+    if bytes.is_empty() {
+        return Err("empty audio buffer".to_string());
+    }
+    let DecodeSession {
+        mut format,
+        mut decoder,
+        track_id,
+        ..
+    } = open_decode_session(bytes, None).ok_or_else(|| "failed to open audio decode session".to_string())?;
+
+    if start_sec.is_finite() && start_sec > 0.0 {
+        let time = Time::try_from_secs_f64(start_sec.max(0.0))
+            .ok_or_else(|| "pcm window: invalid seek time".to_string())?;
+        format
+            .seek(
+                SeekMode::Accurate,
+                SeekTo::Time {
+                    time,
+                    track_id: Some(track_id),
+                },
+            )
+            .map_err(|e| format!("pcm window seek failed: {e}"))?;
+    }
+
+    decode_mono_pcm_from_session(&mut format, &mut decoder, track_id, Some(window_sec))
+}
+
+/// Decode audio bytes to mono f32 PCM, optionally capped at `max_seconds`.
+pub fn decode_mono_pcm_limited(
+    bytes: &[u8],
+    max_seconds: Option<f64>,
+) -> Result<(Vec<f32>, f32), String> {
+    if bytes.is_empty() {
+        return Err("empty audio buffer".to_string());
+    }
+    let DecodeSession {
+        mut format,
+        mut decoder,
+        track_id,
+        ..
+    } = open_decode_session(bytes, None).ok_or_else(|| "failed to open audio decode session".to_string())?;
+    decode_mono_pcm_from_session(&mut format, &mut decoder, track_id, max_seconds)
+}
+
+fn decode_mono_pcm_from_session(
+    format: &mut Box<dyn FormatReader>,
+    decoder: &mut Box<dyn AudioDecoder>,
+    track_id: u32,
+    max_seconds: Option<f64>,
+) -> Result<(Vec<f32>, f32), String> {
+    let mut mono = Vec::new();
+    let mut sample_rate = 0_f32;
+    let mut max_frames: Option<u64> = None;
+    let mut loop_i: u32 = 0;
+    let mut samples_buf: Vec<f32> = Vec::new();
+
+    while let Ok(Some(packet)) = format.next_packet() {
+        if packet.track_id != track_id {
+            continue;
+        }
+        let decoded = match decoder.decode(&packet) {
+            Ok(buf) => buf,
+            Err(SymphoniaError::DecodeError(_)) => continue,
+            Err(SymphoniaError::ResetRequired) => break,
+            Err(_) => break,
+        };
+
+        let n_ch = decoded.spec().channels().count();
+        if n_ch == 0 {
+            continue;
+        }
+        if sample_rate <= 0.0 {
+            sample_rate = decoded.spec().rate() as f32;
+            if sample_rate <= 0.0 {
+                return Err("invalid sample rate".to_string());
+            }
+            max_frames = max_seconds.and_then(|sec| {
+                if sec.is_finite() && sec > 0.0 {
+                    Some((sec * sample_rate as f64).max(1.0) as u64)
+                } else {
+                    None
+                }
+            });
+        }
+
+        decoded.copy_to_vec_interleaved(&mut samples_buf);
+        let slice = samples_buf.as_slice();
+        if slice.len() < n_ch || !slice.len().is_multiple_of(n_ch) {
+            continue;
+        }
+        let frames = slice.len() / n_ch;
+        for f in 0..frames {
+            if let Some(limit) = max_frames {
+                if mono.len() as u64 >= limit {
+                    break;
+                }
+            }
+            let base = f * n_ch;
+            let mut acc = 0.0_f32;
+            for c in 0..n_ch {
+                acc += slice[base + c];
+            }
+            mono.push(acc / (n_ch as f32));
+        }
+        if max_frames.is_some_and(|limit| mono.len() as u64 >= limit) {
+            break;
+        }
+
+        loop_i = loop_i.wrapping_add(1);
+        if loop_i.is_multiple_of(128) {
+            std::thread::yield_now();
+        }
+    }
+
+    if mono.is_empty() {
+        return Err("no PCM frames decoded".to_string());
+    }
+    Ok((mono, sample_rate))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -535,6 +799,20 @@ mod tests {
         assert_eq!(huge_down, -24.0);
     }
 
+    #[test]
+    fn analysis_pcm_window_uses_center_for_long_tracks() {
+        let w = analysis_pcm_window(180.0, 60.0);
+        assert!((w.start_sec - 60.0).abs() < 1e-9);
+        assert!((w.duration_sec - 60.0).abs() < 1e-9);
+    }
+
+    #[test]
+    fn analysis_pcm_window_uses_full_track_when_short() {
+        let w = analysis_pcm_window(45.0, 60.0);
+        assert_eq!(w.start_sec, 0.0);
+        assert!((w.duration_sec - 45.0).abs() < 1e-9);
+    }
+
     // ── md5_first_16kb ────────────────────────────────────────────────────────
 
     #[test]
@@ -681,7 +959,7 @@ mod tests {
     #[test]
     fn count_mono_frames_returns_decoded_length_for_synthetic_wav() {
         let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 1.0), 44_100);
-        let (frames, _hint) = count_mono_frames_from_audio_bytes(&wav)
+        let (frames, _hint) = count_mono_frames_from_audio_bytes(&wav, None)
             .expect("WAV decode must succeed");
         // 1 second × 44.1 kHz mono = 44 100 frames; allow ±1 packet tolerance.
         assert!(
@@ -692,18 +970,18 @@ mod tests {
 
     #[test]
     fn count_mono_frames_returns_none_for_garbage_bytes() {
-        assert!(count_mono_frames_from_audio_bytes(b"not an audio file").is_none());
+        assert!(count_mono_frames_from_audio_bytes(b"not an audio file", None).is_none());
     }
 
     #[test]
     fn count_mono_frames_returns_none_for_empty_bytes() {
-        assert!(count_mono_frames_from_audio_bytes(&[]).is_none());
+        assert!(count_mono_frames_from_audio_bytes(&[], None).is_none());
     }
 
     #[test]
     fn analyze_loudness_and_waveform_returns_loudness_for_synthetic_sine() {
         let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 1.5), 44_100);
-        let result = analyze_loudness_and_waveform(&wav, -14.0, 100)
+        let result = analyze_loudness_and_waveform(&wav, -14.0, 100, None)
             .expect("WAV decode must succeed");
         let (integrated_lufs, true_peak, recommended_gain_db, target_lufs, bins) = result;
         assert_eq!(bins.len(), 200, "bins layout is peak_u8 + mean_u8 = 2 * bin_count");
@@ -728,24 +1006,26 @@ mod tests {
     #[test]
     fn analyze_loudness_returns_none_for_zero_bin_count() {
         let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 0.5), 44_100);
-        assert!(analyze_loudness_and_waveform(&wav, -14.0, 0).is_none());
+        assert!(analyze_loudness_and_waveform(&wav, -14.0, 0, None).is_none());
     }
 
     #[test]
     fn analyze_loudness_returns_none_for_empty_bytes() {
-        assert!(analyze_loudness_and_waveform(&[], -14.0, 100).is_none());
+        assert!(analyze_loudness_and_waveform(&[], -14.0, 100, None).is_none());
     }
 
     #[test]
     fn seed_from_bytes_into_cache_upserts_waveform_and_loudness_for_wav() {
         let cache = AnalysisCache::open_in_memory();
         let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 1.5), 44_100);
-        let outcome = seed_from_bytes_into_cache(&cache, "wav-track", &wav).unwrap();
+        let (outcome, md5) = seed_from_bytes_into_cache(&cache, "server-a", "wav-track", &wav, None).unwrap();
         assert_eq!(outcome, SeedFromBytesOutcome::Upserted);
+        assert_eq!(md5, md5_first_16kb(&wav), "outcome carries the content fingerprint");
 
         // Both a waveform AND a loudness row must exist after a successful
         // PCM decode + EBU R128 analysis.
         let key = TrackKey {
+            server_id: "server-a".to_string(),
             track_id: "wav-track".to_string(),
             md5_16kb: md5_first_16kb(&wav),
         };
@@ -755,13 +1035,34 @@ mod tests {
         assert!(cache.loudness_row_exists_for_key(&key).unwrap());
     }
 
+    #[test]
+    fn seed_from_bytes_into_cache_writes_under_the_given_server_scope() {
+        let cache = AnalysisCache::open_in_memory();
+        let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 1.5), 44_100);
+        seed_from_bytes_into_cache(&cache, "server-x", "scoped-track", &wav, None).unwrap();
+
+        let md5 = md5_first_16kb(&wav);
+        let scoped = TrackKey {
+            server_id: "server-x".to_string(),
+            track_id: "scoped-track".to_string(),
+            md5_16kb: md5.clone(),
+        };
+        assert!(cache.get_waveform(&scoped).unwrap().is_some(), "row lands under server scope");
+        let other = TrackKey {
+            server_id: "server-y".to_string(),
+            track_id: "scoped-track".to_string(),
+            md5_16kb: md5,
+        };
+        assert!(cache.get_waveform(&other).unwrap().is_none(), "row stays under the exact server");
+    }
+
     #[test]
     fn seed_from_bytes_into_cache_returns_skipped_on_second_call() {
         let cache = AnalysisCache::open_in_memory();
         let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 1.0), 44_100);
-        let first = seed_from_bytes_into_cache(&cache, "wav-track-2", &wav).unwrap();
+        let (first, _) = seed_from_bytes_into_cache(&cache, "server-a", "wav-track-2", &wav, None).unwrap();
         assert_eq!(first, SeedFromBytesOutcome::Upserted);
-        let second = seed_from_bytes_into_cache(&cache, "wav-track-2", &wav).unwrap();
+        let (second, _) = seed_from_bytes_into_cache(&cache, "server-a", "wav-track-2", &wav, None).unwrap();
         assert_eq!(
             second,
             SeedFromBytesOutcome::SkippedWaveformCacheHit,
@@ -775,10 +1076,11 @@ mod tests {
         // Garbage bytes — Symphonia probe fails, the pipeline falls back to
         // `derive_waveform_bins` (no loudness row gets cached).
         let bytes = vec![0xAAu8; 8 * 1024];
-        let outcome = seed_from_bytes_into_cache(&cache, "garbage", &bytes).unwrap();
+        let (outcome, _) = seed_from_bytes_into_cache(&cache, "server-a", "garbage", &bytes, None).unwrap();
         assert_eq!(outcome, SeedFromBytesOutcome::Upserted);
 
         let key = TrackKey {
+            server_id: "server-a".to_string(),
             track_id: "garbage".to_string(),
             md5_16kb: md5_first_16kb(&bytes),
         };
@@ -789,4 +1091,204 @@ mod tests {
             "byte-envelope fallback must not cache loudness"
         );
     }
+
+    #[test]
+    fn audio_duration_from_bytes_reports_duration_for_wav() {
+        let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 2.0), 44_100);
+        let duration = audio_duration_from_bytes(&wav).expect("duration must be available");
+        assert!(
+            (1.8..=2.2).contains(&duration),
+            "expected ~2s duration, got {duration}"
+        );
+    }
+
+    #[test]
+    fn audio_duration_from_bytes_returns_none_for_garbage() {
+        assert!(audio_duration_from_bytes(b"not audio").is_none());
+    }
+
+    #[test]
+    fn decode_mono_pcm_limited_decodes_and_respects_limit() {
+        let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(48_000, 2.0), 48_000);
+        let (full_pcm, sr_full) = decode_mono_pcm_limited(&wav, None).expect("full decode");
+        assert_eq!(sr_full, 48_000.0);
+        assert!(
+            full_pcm.len() >= 95_000,
+            "2 seconds at 48kHz should decode close to 96k samples"
+        );
+
+        let (limited_pcm, sr_limited) =
+            decode_mono_pcm_limited(&wav, Some(0.25)).expect("limited decode");
+        assert_eq!(sr_limited, 48_000.0);
+        assert!(
+            (11_500..=12_500).contains(&limited_pcm.len()),
+            "0.25 seconds at 48kHz should decode ~12k samples, got {}",
+            limited_pcm.len()
+        );
+        assert!(limited_pcm.len() < full_pcm.len());
+    }
+
+    #[test]
+    fn decode_mono_pcm_limited_rejects_empty_buffer() {
+        let err = decode_mono_pcm_limited(&[], Some(1.0)).unwrap_err();
+        assert!(err.contains("empty audio buffer"));
+    }
+
+    #[test]
+    fn decode_mono_pcm_window_decodes_center_slice() {
+        let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 2.0), 44_100);
+        let (window_pcm, sr) = decode_mono_pcm_window(&wav, 0.75, 0.5).expect("window decode");
+        assert_eq!(sr, 44_100.0);
+        assert!(
+            (20_000..=24_000).contains(&window_pcm.len()),
+            "0.5 seconds at 44.1kHz should decode ~22k samples, got {}",
+            window_pcm.len()
+        );
+    }
+
+    #[test]
+    fn decode_mono_pcm_window_rejects_invalid_bytes() {
+        let err = decode_mono_pcm_window(b"not-audio", 0.0, 1.0).unwrap_err();
+        assert!(
+            err.contains("failed to open audio decode session"),
+            "unexpected error: {err}"
+        );
+    }
+
+    #[test]
+    fn decode_scan_pcm_supports_waveform_only_mode_without_loudness() {
+        let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 1.0), 44_100);
+        let (frames, hint) = count_mono_frames_from_audio_bytes(&wav, None).expect("frame counting");
+        let scanned = decode_scan_pcm(&wav, 64, frames, hint, None, None).expect("scan must succeed");
+        assert_eq!(scanned.bins.len(), 128);
+        assert!(scanned.loudness.is_none());
+    }
+
+    #[test]
+    fn decode_scan_pcm_with_loudness_target_returns_loudness_tuple() {
+        let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 1.0), 44_100);
+        let (frames, hint) = count_mono_frames_from_audio_bytes(&wav, None).expect("frame counting");
+        let scanned = decode_scan_pcm(&wav, 64, frames, hint, Some(-14.0), None).expect("scan must succeed");
+        assert_eq!(scanned.bins.len(), 128);
+        let (integrated_lufs, true_peak, recommended_gain_db, target_lufs) =
+            scanned.loudness.expect("loudness tuple must be present");
+        assert!(integrated_lufs.is_finite());
+        assert!(true_peak.is_finite());
+        assert!((-24.0..=24.0).contains(&recommended_gain_db));
+        assert_eq!(target_lufs, -14.0);
+    }
+
+    #[test]
+    fn decode_scan_pcm_returns_none_for_non_audio_input() {
+        assert!(decode_scan_pcm(b"nope", 32, 10, None, Some(-14.0), None).is_none());
+    }
+
+    #[test]
+    fn seed_from_bytes_reanalyzes_when_waveform_exists_without_loudness() {
+        let cache = AnalysisCache::open_in_memory();
+        let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 1.0), 44_100);
+        let md5 = md5_first_16kb(&wav);
+        let key = TrackKey {
+            server_id: "server-a".to_string(),
+            track_id: "track-reseed".to_string(),
+            md5_16kb: md5,
+        };
+        cache.touch_track_status(&key, "ready").unwrap();
+        cache
+            .upsert_waveform(
+                &key,
+                &WaveformEntry {
+                    bins: vec![8u8; 1000],
+                    bin_count: 500,
+                    is_partial: false,
+                    known_until_sec: 0.0,
+                    duration_sec: 0.0,
+                    updated_at: now_unix_ts(),
+                },
+            )
+            .unwrap();
+        assert!(!cache.loudness_row_exists_for_key(&key).unwrap());
+
+        let (outcome, _) =
+            seed_from_bytes_into_cache(&cache, "server-a", "track-reseed", &wav, None).unwrap();
+        assert_eq!(outcome, SeedFromBytesOutcome::Upserted);
+        assert!(cache.loudness_row_exists_for_key(&key).unwrap());
+    }
+
+    #[test]
+    fn analysis_pcm_window_handles_negative_and_non_finite_durations() {
+        let neg = analysis_pcm_window(-42.0, 60.0);
+        assert_eq!(neg.start_sec, 0.0);
+        assert_eq!(neg.duration_sec, 60.0);
+
+        let inf = analysis_pcm_window(f64::INFINITY, 60.0);
+        assert_eq!(inf.start_sec, 0.0);
+        assert!(!inf.duration_sec.is_finite());
+    }
+
+    #[test]
+    fn decode_mono_pcm_window_rejects_empty_buffer() {
+        let err = decode_mono_pcm_window(&[], 0.0, 1.0).unwrap_err();
+        assert!(err.contains("empty audio buffer"));
+    }
+
+    #[test]
+    fn decode_mono_pcm_limited_rejects_invalid_bytes() {
+        let err = decode_mono_pcm_limited(b"not-audio", Some(0.5)).unwrap_err();
+        assert!(err.contains("failed to open audio decode session"));
+    }
+
+    #[test]
+    fn decode_mono_pcm_limited_ignores_non_positive_or_non_finite_cap() {
+        let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 1.0), 44_100);
+        let (full_a, _) = decode_mono_pcm_limited(&wav, None).unwrap();
+        let (full_b, _) = decode_mono_pcm_limited(&wav, Some(0.0)).unwrap();
+        let (full_c, _) = decode_mono_pcm_limited(&wav, Some(f64::NAN)).unwrap();
+        assert_eq!(full_a.len(), full_b.len());
+        assert_eq!(full_a.len(), full_c.len());
+    }
+
+    #[test]
+    fn decode_scan_pcm_returns_none_when_no_frames_decoded() {
+        let wav = build_mono_pcm16_wav(&[], 44_100);
+        assert!(analyze_loudness_and_waveform(&wav, -14.0, 64, None).is_none());
+    }
+
+    #[test]
+    fn decode_scan_pcm_ignores_oversized_timeline_hint() {
+        let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 1.0), 44_100);
+        let (frames, _hint) = count_mono_frames_from_audio_bytes(&wav, None).expect("frame counting");
+        let scanned = decode_scan_pcm(&wav, 64, frames, Some(frames * 10), None, None).unwrap();
+        assert_eq!(scanned.bins.len(), 128);
+    }
+
+    #[test]
+    fn seed_from_bytes_execute_returns_no_cache_without_registered_state() {
+        let app = tauri::test::mock_app();
+        let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 0.25), 44_100);
+        let handle = app.handle().clone();
+        let (outcome, timings) = seed_from_bytes_execute(&handle, "s", "t", &wav, None, true)
+            .expect("seed execute should return a graceful skip");
+        assert_eq!(outcome, SeedFromBytesOutcome::SkippedNoAnalysisCache);
+        assert_eq!(timings.seed_ms, 0);
+        assert_eq!(timings.bpm_ms, 0);
+    }
+
+    #[test]
+    fn seed_from_bytes_execute_runs_with_registered_cache() {
+        let app = tauri::test::mock_app();
+        app.manage(AnalysisCache::open_in_memory());
+        let wav = build_mono_pcm16_wav(&sine_440_at_minus_6db(44_100, 0.5), 44_100);
+        let handle = app.handle().clone();
+
+        let (first, timings_first) =
+            seed_from_bytes_execute(&handle, "server-a", "track-exec", &wav, None, true).unwrap();
+        assert_eq!(first, SeedFromBytesOutcome::Upserted);
+        assert!(timings_first.seed_ms <= 30_000);
+
+        let (second, timings_second) =
+            seed_from_bytes_execute(&handle, "server-a", "track-exec", &wav, None, true).unwrap();
+        assert_eq!(second, SeedFromBytesOutcome::SkippedWaveformCacheHit);
+        assert!(timings_second.seed_ms <= 30_000);
+    }
 }

src-tauri/crates/psysonic-analysis/src/analysis_cache/mod.rs

@@ -2,7 +2,11 @@ mod compute;
 mod store;
 
 pub use compute::{
-    recommended_gain_for_target, seed_from_bytes_execute, seed_from_bytes_into_cache,
-    SeedFromBytesOutcome,
+    analysis_pcm_window, audio_duration_from_bytes, decode_mono_pcm_limited,
+    decode_mono_pcm_window, md5_first_16kb, recommended_gain_for_target, seed_from_bytes_execute,
+    seed_from_bytes_into_cache, PcmAnalysisWindow, SeedFromBytesOutcome,
+};
+pub use store::{
+    AnalysisCache, AnalysisDeleteServerReport, FailedTrackEntry, LoudnessEntry, TrackKey,
+    WaveformEntry, ANALYSIS_DB_SCHEMA_VERSION,
 };
-pub use store::{AnalysisCache, LoudnessEntry, TrackKey, WaveformEntry};

src-tauri/crates/psysonic-analysis/src/analysis_perf.rs

@@ -0,0 +1,42 @@
+//! Per-track analysis timing events for the Performance Probe overlay.
+
+use tauri::{AppHandle, Emitter};
+
+#[derive(Debug, Clone, Copy, Default)]
+pub struct AnalysisSeedTimings {
+    pub seed_ms: u64,
+    pub bpm_ms: u64,
+}
+
+#[derive(Clone, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AnalysisTrackPerfPayload {
+    pub track_id: String,
+    pub fetch_ms: u64,
+    pub seed_ms: u64,
+    pub bpm_ms: u64,
+    pub total_ms: u64,
+}
+
+pub fn emit_analysis_track_perf(
+    app: &AppHandle,
+    track_id: &str,
+    fetch_ms: u64,
+    seed_ms: u64,
+    bpm_ms: u64,
+) {
+    let total_ms = fetch_ms.saturating_add(seed_ms).saturating_add(bpm_ms);
+    if total_ms == 0 {
+        return;
+    }
+    let _ = app.emit(
+        "analysis:track-perf",
+        AnalysisTrackPerfPayload {
+            track_id: track_id.to_string(),
+            fetch_ms,
+            seed_ms,
+            bpm_ms,
+            total_ms,
+        },
+    );
+}

src-tauri/crates/psysonic-analysis/src/codec.rs

@@ -0,0 +1,22 @@
+//! Symphonia codec registry — mirrors `psysonic-audio::codec` (Opus via libopus).
+use std::sync::OnceLock;
+
+use symphonia::core::codecs::audio::{AudioCodecParameters, AudioDecoder, AudioDecoderOptions};
+use symphonia::core::codecs::registry::CodecRegistry;
+
+pub(crate) fn psysonic_codec_registry() -> &'static CodecRegistry {
+    static REGISTRY: OnceLock<CodecRegistry> = OnceLock::new();
+    REGISTRY.get_or_init(|| {
+        let mut registry = CodecRegistry::new();
+        symphonia::default::register_enabled_codecs(&mut registry);
+        registry.register_audio_decoder::<symphonia_adapter_libopus::OpusDecoder>();
+        registry
+    })
+}
+
+pub(crate) fn make_decoder(
+    params: &AudioCodecParameters,
+    opts: &AudioDecoderOptions,
+) -> Result<Box<dyn AudioDecoder>, symphonia::core::errors::Error> {
+    psysonic_codec_registry().make_audio_decoder(params, opts)
+}

src-tauri/crates/psysonic-analysis/src/commands.rs

@@ -5,17 +5,13 @@
 
 use std::collections::HashSet;
 
-use tauri::Manager;
-
-use psysonic_core::ports::PlaybackQueryHandle;
-
 use crate::analysis_cache;
 use crate::analysis_runtime::{
-    analysis_backfill_is_current_track, analysis_backfill_shared, prune_analysis_queues,
-    AnalysisBackfillEnqueueKind,
+    analysis_backfill_queue_stats, analysis_pipeline_queue_stats, enqueue_seed_from_url,
+    prune_analysis_queues, AnalysisBackfillPriority, PlaybackPriorityHints,
 };
 
-#[derive(serde::Serialize)]
+#[derive(serde::Serialize, specta::Type)]
 #[serde(rename_all = "camelCase")]
 pub struct WaveformCachePayload {
     pub bins: Vec<u8>,
@@ -39,7 +35,7 @@ impl From<analysis_cache::WaveformEntry> for WaveformCachePayload {
     }
 }
 
-#[derive(serde::Serialize)]
+#[derive(serde::Serialize, specta::Type)]
 #[serde(rename_all = "camelCase")]
 pub struct LoudnessCachePayload {
     pub integrated_lufs: f64,
@@ -49,43 +45,92 @@ pub struct LoudnessCachePayload {
     pub updated_at: i64,
 }
 
-/// AppHandle-free helper: looks up a waveform by exact `(track_id, md5_16kb)`
-/// key and converts the `WaveformEntry` into the JSON-serialisable
-/// `WaveformCachePayload`. Pulled out of [`analysis_get_waveform`] so it can
-/// be tested with `AnalysisCache::open_in_memory()` and direct upserts.
+#[derive(serde::Serialize, specta::Type)]
+#[serde(rename_all = "camelCase")]
+pub struct AnalysisDeleteServerReportDto {
+    pub analysis_tracks: u64,
+    pub waveforms: u64,
+    pub loudness: u64,
+}
+
+#[derive(Debug, Clone, serde::Serialize, specta::Type)]
+#[serde(rename_all = "camelCase")]
+pub struct AnalysisFailedTrackDto {
+    pub track_id: String,
+    pub md5_16kb: String,
+    pub updated_at: i64,
+}
+
+impl From<analysis_cache::AnalysisDeleteServerReport> for AnalysisDeleteServerReportDto {
+    fn from(value: analysis_cache::AnalysisDeleteServerReport) -> Self {
+        Self {
+            analysis_tracks: value.analysis_tracks,
+            waveforms: value.waveforms,
+            loudness: value.loudness,
+        }
+    }
+}
+
+impl From<analysis_cache::FailedTrackEntry> for AnalysisFailedTrackDto {
+    fn from(value: analysis_cache::FailedTrackEntry) -> Self {
+        Self {
+            track_id: value.track_id,
+            md5_16kb: value.md5_16kb,
+            updated_at: value.updated_at,
+        }
+    }
+}
+
+#[derive(serde::Deserialize, specta::Type)]
+#[serde(rename_all = "camelCase")]
+pub struct AnalysisServerKeyMigrationDto {
+    pub legacy_id: String,
+    pub index_key: String,
+}
+
+/// AppHandle-free helper: looks up a waveform by exact `(server_id, track_id,
+/// md5_16kb)` key. Converts the `WaveformEntry` into the JSON-serialisable
+/// `WaveformCachePayload`. Pulled out of [`analysis_get_waveform`] so it can be
+/// tested with `AnalysisCache::open_in_memory()` and direct upserts.
 pub fn get_waveform_payload(
     cache: &analysis_cache::AnalysisCache,
+    server_id: &str,
     track_id: &str,
     md5_16kb: &str,
 ) -> Result<Option<WaveformCachePayload>, String> {
-    let key = analysis_cache::TrackKey {
+    let exact = analysis_cache::TrackKey {
+        server_id: server_id.to_string(),
         track_id: track_id.to_string(),
         md5_16kb: md5_16kb.to_string(),
     };
-    Ok(cache.get_waveform(&key)?.map(WaveformCachePayload::from))
-}
-
-/// AppHandle-free helper: looks up the latest waveform for `track_id`
-/// across all id variants (bare ↔ `stream:` prefix). See [`get_waveform_payload`].
-pub fn get_waveform_payload_for_track(
-    cache: &analysis_cache::AnalysisCache,
-    track_id: &str,
-) -> Result<Option<WaveformCachePayload>, String> {
     Ok(cache
-        .get_latest_waveform_for_track(track_id)?
+        .get_waveform(&exact)?
         .map(WaveformCachePayload::from))
 }
 
-/// AppHandle-free helper: looks up the latest loudness row for `track_id`
-/// and recomputes `recommended_gain_db` against the optional requested target
-/// (clamped to [-30, -8]). When `target_lufs` is `None`, the cached row's own
-/// target is used.
+/// AppHandle-free helper: looks up the latest waveform for `(server_id, track_id)`
+/// across all id variants (bare ↔ `stream:` prefix). See [`get_waveform_payload`].
+pub fn get_waveform_payload_for_track(
+    cache: &analysis_cache::AnalysisCache,
+    server_id: &str,
+    track_id: &str,
+) -> Result<Option<WaveformCachePayload>, String> {
+    Ok(cache
+        .get_latest_waveform_for_track(server_id, track_id)?
+        .map(WaveformCachePayload::from))
+}
+
+/// AppHandle-free helper: looks up the latest loudness row for `(server_id,
+/// track_id)` and recomputes `recommended_gain_db`
+/// against the optional requested target (clamped to [-30, -8]). When
+/// `target_lufs` is `None`, the cached row's own target is used.
 pub fn get_loudness_payload_for_track(
     cache: &analysis_cache::AnalysisCache,
+    server_id: &str,
     track_id: &str,
     target_lufs: Option<f64>,
 ) -> Result<Option<LoudnessCachePayload>, String> {
-    Ok(cache.get_latest_loudness_for_track(track_id)?.map(|v| {
+    Ok(cache.get_latest_loudness_for_track(server_id, track_id)?.map(|v| {
         let requested_target = target_lufs.unwrap_or(v.target_lufs).clamp(-30.0, -8.0);
         let recommended_gain_db = analysis_cache::recommended_gain_for_target(
             v.integrated_lufs,
@@ -103,12 +148,15 @@ pub fn get_loudness_payload_for_track(
 }
 
 #[tauri::command]
+#[specta::specta]
 pub fn analysis_get_waveform(
     track_id: String,
     md5_16kb: String,
+    server_id: Option<String>,
     cache: tauri::State<'_, analysis_cache::AnalysisCache>,
 ) -> Result<Option<WaveformCachePayload>, String> {
-    let result = get_waveform_payload(cache.inner(), &track_id, &md5_16kb);
+    let server_id = server_id.unwrap_or_default();
+    let result = get_waveform_payload(cache.inner(), &server_id, &track_id, &md5_16kb);
     if let Ok(ref payload) = result {
         match payload {
             Some(v) => crate::app_deprintln!(
@@ -125,11 +173,14 @@ pub fn analysis_get_waveform(
 }
 
 #[tauri::command]
+#[specta::specta]
 pub fn analysis_get_waveform_for_track(
     track_id: String,
+    server_id: Option<String>,
     cache: tauri::State<'_, analysis_cache::AnalysisCache>,
 ) -> Result<Option<WaveformCachePayload>, String> {
-    let result = get_waveform_payload_for_track(cache.inner(), &track_id);
+    let server_id = server_id.unwrap_or_default();
+    let result = get_waveform_payload_for_track(cache.inner(), &server_id, &track_id);
     if let Ok(ref payload) = result {
         match payload {
             Some(v) => crate::app_deprintln!(
@@ -143,31 +194,39 @@ pub fn analysis_get_waveform_for_track(
 }
 
 #[tauri::command]
+#[specta::specta]
 pub fn analysis_get_loudness_for_track(
     track_id: String,
     target_lufs: Option<f64>,
+    server_id: Option<String>,
     cache: tauri::State<'_, analysis_cache::AnalysisCache>,
 ) -> Result<Option<LoudnessCachePayload>, String> {
-    get_loudness_payload_for_track(cache.inner(), &track_id, target_lufs)
+    let server_id = server_id.unwrap_or_default();
+    get_loudness_payload_for_track(cache.inner(), &server_id, &track_id, target_lufs)
 }
 
 #[tauri::command]
+#[specta::specta]
 pub fn analysis_delete_loudness_for_track(
     track_id: String,
+    server_id: Option<String>,
     cache: tauri::State<'_, analysis_cache::AnalysisCache>,
 ) -> Result<u64, String> {
-    cache.delete_loudness_for_track_id(&track_id)
+    cache.delete_loudness_for_track_id(&server_id.unwrap_or_default(), &track_id)
 }
 
 #[tauri::command]
+#[specta::specta]
 pub fn analysis_delete_waveform_for_track(
     track_id: String,
+    server_id: Option<String>,
     cache: tauri::State<'_, analysis_cache::AnalysisCache>,
 ) -> Result<u64, String> {
-    cache.delete_waveform_for_track_id(&track_id)
+    cache.delete_waveform_for_track_id(&server_id.unwrap_or_default(), &track_id)
 }
 
 #[tauri::command]
+#[specta::specta]
 pub fn analysis_delete_all_waveforms(
     cache: tauri::State<'_, analysis_cache::AnalysisCache>,
 ) -> Result<u64, String> {
@@ -175,70 +234,156 @@ pub fn analysis_delete_all_waveforms(
 }
 
 #[tauri::command]
-pub fn analysis_enqueue_seed_from_url(
-    track_id: String,
-    url: String,
-    force: Option<bool>,
-    app: tauri::AppHandle,
+#[specta::specta]
+pub fn analysis_delete_all_for_server(
+    server_id: String,
+    cache: tauri::State<'_, analysis_cache::AnalysisCache>,
+) -> Result<AnalysisDeleteServerReportDto, String> {
+    if server_id.trim().is_empty() {
+        return Err("server_id required".to_string());
+    }
+    let report = cache.delete_all_for_server(&server_id)?;
+    Ok(report.into())
+}
+
+#[tauri::command]
+#[specta::specta]
+pub fn analysis_get_failed_track_count(
+    server_id: String,
+    cache: tauri::State<'_, analysis_cache::AnalysisCache>,
+) -> Result<i64, String> {
+    let server_id = server_id.trim().to_string();
+    if server_id.is_empty() {
+        return Ok(0);
+    }
+    cache.count_failed_tracks(&server_id)
+}
+
+#[tauri::command]
+#[specta::specta]
+pub fn analysis_list_failed_tracks(
+    server_id: String,
+    limit: Option<u32>,
+    cache: tauri::State<'_, analysis_cache::AnalysisCache>,
+) -> Result<Vec<AnalysisFailedTrackDto>, String> {
+    let server_id = server_id.trim().to_string();
+    if server_id.is_empty() {
+        return Ok(Vec::new());
+    }
+    let limit = limit
+        .map(|v| usize::try_from(v).unwrap_or(usize::MAX))
+        .map(|v| v.clamp(1, 5_000));
+    let rows = cache.list_failed_tracks(&server_id, limit)?;
+    Ok(rows.into_iter().map(AnalysisFailedTrackDto::from).collect())
+}
+
+#[tauri::command]
+#[specta::specta]
+pub fn analysis_clear_failed_tracks(
+    server_id: String,
+    track_ids: Option<Vec<String>>,
+    cache: tauri::State<'_, analysis_cache::AnalysisCache>,
+) -> Result<u64, String> {
+    let server_id = server_id.trim().to_string();
+    if server_id.is_empty() {
+        return Err("server_id required".to_string());
+    }
+    let track_ids = track_ids
+        .unwrap_or_default()
+        .into_iter()
+        .map(|id| id.trim().to_string())
+        .filter(|id| !id.is_empty())
+        .collect::<Vec<_>>();
+    cache.clear_failed_tracks(&server_id, &track_ids)
+}
+
+#[tauri::command]
+#[specta::specta]
+pub fn analysis_migrate_server_index_keys(
+    mappings: Vec<AnalysisServerKeyMigrationDto>,
+    _cache: tauri::State<'_, analysis_cache::AnalysisCache>,
 ) -> Result<(), String> {
-    if track_id.trim().is_empty() || url.trim().is_empty() {
-        return Ok(());
-    }
-    let force = force.unwrap_or(false);
-    if !force {
-        if let Some(playback) = app.try_state::<PlaybackQueryHandle>() {
-            if playback.ranged_loudness_backfill_should_defer(&track_id) {
-                crate::app_deprintln!(
-                    "[analysis] backfill skip track_id={} reason=ranged_playback_will_seed",
-                    track_id
-                );
-                return Ok(());
-            }
-        }
-    }
-    if !force {
-        if let Some(cache) = app.try_state::<analysis_cache::AnalysisCache>() {
-            if cache.get_latest_loudness_for_track(&track_id)?.is_some() {
-                crate::app_deprintln!(
-                    "[analysis] backfill skip (already cached): {}",
-                    track_id
-                );
-                return Ok(());
-            }
-        }
-    }
-    let tid_log = track_id.clone();
-    let high_priority = analysis_backfill_is_current_track(&app, &track_id);
-    let shared = analysis_backfill_shared(&app);
-    let kind = {
-        let mut st = shared
-            .state
-            .lock()
-            .map_err(|_| "analysis backfill lock poisoned".to_string())?;
-        st.enqueue(track_id, url, high_priority)
-    };
-    match kind {
-        AnalysisBackfillEnqueueKind::NewBack | AnalysisBackfillEnqueueKind::NewFront => {
-            shared.ping_worker();
-            crate::app_deprintln!(
-                "[analysis] backfill enqueued: track_id={} position={}",
-                tid_log,
-                if high_priority { "front" } else { "back" }
-            );
-        }
-        AnalysisBackfillEnqueueKind::ReorderedFront => {
-            shared.ping_worker();
-            crate::app_deprintln!(
-                "[analysis] backfill bumped to front (current track) track_id={}",
-                tid_log
-            );
-        }
-        AnalysisBackfillEnqueueKind::DuplicateSkipped | AnalysisBackfillEnqueueKind::RunningSkipped => {}
+    for mapping in mappings {
+        let _ = (mapping.legacy_id, mapping.index_key);
     }
     Ok(())
 }
 
-#[derive(Debug, Clone, serde::Serialize)]
+#[tauri::command]
+#[specta::specta]
+pub fn analysis_enqueue_seed_from_url(
+    track_id: String,
+    url: String,
+    force: Option<bool>,
+    server_id: Option<String>,
+    priority: Option<String>,
+    app: tauri::AppHandle,
+) -> Result<(), String> {
+    let explicit = AnalysisBackfillPriority::from_optional_str(priority.as_deref());
+    enqueue_seed_from_url(
+        &app,
+        &track_id,
+        &url,
+        server_id.as_deref(),
+        explicit,
+        force.unwrap_or(false),
+    )
+}
+
+#[derive(Debug, Clone, serde::Deserialize, specta::Type)]
+#[serde(rename_all = "camelCase")]
+pub struct AnalysisPriorityHintDto {
+    pub server_id: String,
+    pub track_id: String,
+}
+
+#[tauri::command]
+#[specta::specta]
+pub fn analysis_set_playback_priority_hints(
+    middle_track_refs: Vec<AnalysisPriorityHintDto>,
+    hints: tauri::State<'_, PlaybackPriorityHints>,
+) -> Result<(), String> {
+    let pairs = middle_track_refs
+        .into_iter()
+        .map(|r| (r.server_id, r.track_id));
+    hints.set_middle_track_ids(pairs);
+    Ok(())
+}
+
+#[derive(Debug, Clone, serde::Serialize, specta::Type)]
+#[serde(rename_all = "camelCase")]
+pub struct AnalysisBackfillQueueStatsDto {
+    pub queued: usize,
+    pub in_progress_count: usize,
+    pub in_progress_track_id: Option<String>,
+}
+
+#[tauri::command]
+#[specta::specta]
+pub fn analysis_set_pipeline_parallelism(workers: u32) -> Result<(), String> {
+    crate::analysis_runtime::analysis_set_pipeline_parallelism(workers as usize);
+    Ok(())
+}
+
+#[tauri::command]
+#[specta::specta]
+pub fn analysis_get_pipeline_queue_stats() -> Result<crate::analysis_runtime::AnalysisPipelineQueueStatsDto, String> {
+    Ok(analysis_pipeline_queue_stats())
+}
+
+#[tauri::command]
+#[specta::specta]
+pub fn analysis_get_backfill_queue_stats() -> Result<AnalysisBackfillQueueStatsDto, String> {
+    let (queued, in_progress_count, in_progress_track_id) =
+        analysis_backfill_queue_stats();
+    Ok(AnalysisBackfillQueueStatsDto {
+        queued,
+        in_progress_count,
+        in_progress_track_id,
+    })
+}
+
+#[derive(Debug, Clone, serde::Serialize, specta::Type)]
 #[serde(rename_all = "camelCase")]
 pub struct AnalysisPrunePendingResult {
     pub keep_count: usize,
@@ -251,8 +396,10 @@ pub struct AnalysisPrunePendingResult {
 ///
 /// Keeps currently-running jobs untouched; only queued (not-yet-started) jobs are removed.
 #[tauri::command]
+#[specta::specta]
 pub fn analysis_prune_pending_to_track_ids(
     track_ids: Vec<String>,
+    server_id: String,
 ) -> Result<AnalysisPrunePendingResult, String> {
     let mut normalized: Vec<String> = Vec::with_capacity(track_ids.len());
     let mut seen = HashSet::new();
@@ -267,8 +414,10 @@ pub fn analysis_prune_pending_to_track_ids(
     }
     let keep_track_ids: HashSet<&str> = normalized.iter().map(|s| s.as_str()).collect();
 
+    let server_id = server_id.trim().to_string();
+    let server_filter = if server_id.is_empty() { None } else { Some(server_id.as_str()) };
     let (http_removed, cpu_removed_jobs, cpu_removed_waiters) =
-        prune_analysis_queues(&keep_track_ids)?;
+        prune_analysis_queues(&keep_track_ids, server_filter)?;
 
     if http_removed > 0 || cpu_removed_jobs > 0 {
         crate::app_deprintln!(
@@ -297,6 +446,7 @@ mod tests {
 
     fn key(track_id: &str, md5: &str) -> TrackKey {
         TrackKey {
+            server_id: "server-a".to_string(),
             track_id: track_id.to_string(),
             md5_16kb: md5.to_string(),
         }
@@ -342,7 +492,7 @@ mod tests {
     #[test]
     fn get_waveform_payload_returns_none_for_unknown_key() {
         let cache = AnalysisCache::open_in_memory();
-        let payload = get_waveform_payload(&cache, "missing", "deadbeef").unwrap();
+        let payload = get_waveform_payload(&cache, "server-a", "missing", "deadbeef").unwrap();
         assert!(payload.is_none());
     }
 
@@ -351,7 +501,7 @@ mod tests {
         let cache = AnalysisCache::open_in_memory();
         let bins: Vec<u8> = (0..8u8).collect();
         upsert_waveform(&cache, "abc", "deadbeef", bins.clone());
-        let payload = get_waveform_payload(&cache, "abc", "deadbeef")
+        let payload = get_waveform_payload(&cache, "server-a", "abc", "deadbeef")
             .unwrap()
             .expect("payload exists");
         assert_eq!(payload.bins, bins);
@@ -367,8 +517,8 @@ mod tests {
         let cache = AnalysisCache::open_in_memory();
         upsert_waveform(&cache, "abc", "aaaa", vec![0u8; 8]);
         upsert_waveform(&cache, "abc", "bbbb", vec![0xFFu8; 8]);
-        let p1 = get_waveform_payload(&cache, "abc", "aaaa").unwrap().unwrap();
-        let p2 = get_waveform_payload(&cache, "abc", "bbbb").unwrap().unwrap();
+        let p1 = get_waveform_payload(&cache, "server-a", "abc", "aaaa").unwrap().unwrap();
+        let p2 = get_waveform_payload(&cache, "server-a", "abc", "bbbb").unwrap().unwrap();
         assert_ne!(p1.bins, p2.bins);
     }
 
@@ -380,7 +530,7 @@ mod tests {
         // matching is the whole point of get_latest_waveform_for_track.
         let cache = AnalysisCache::open_in_memory();
         upsert_waveform(&cache, "stream:abc", "deadbeef", vec![1u8; 8]);
-        let payload = get_waveform_payload_for_track(&cache, "abc")
+        let payload = get_waveform_payload_for_track(&cache, "server-a", "abc")
             .unwrap()
             .expect("bare-id lookup must hit the stream-prefixed row");
         assert_eq!(payload.bin_count, 4);
@@ -389,7 +539,7 @@ mod tests {
     #[test]
     fn get_waveform_for_track_returns_none_for_unknown_track() {
         let cache = AnalysisCache::open_in_memory();
-        assert!(get_waveform_payload_for_track(&cache, "phantom").unwrap().is_none());
+        assert!(get_waveform_payload_for_track(&cache, "server-a", "phantom").unwrap().is_none());
     }
 
     // ── get_loudness_payload_for_track ────────────────────────────────────────
@@ -400,7 +550,7 @@ mod tests {
         upsert_loudness(&cache, "abc", "deadbeef", -14.0);
         // Cached row: integrated -14, target -14 → gain 0. Request target -10 →
         // recommended gain = -10 - (-14) = +4 dB (capped by true-peak guard).
-        let payload = get_loudness_payload_for_track(&cache, "abc", Some(-10.0))
+        let payload = get_loudness_payload_for_track(&cache, "server-a", "abc", Some(-10.0))
             .unwrap()
             .expect("loudness row exists");
         assert_eq!(payload.target_lufs, -10.0);
@@ -415,7 +565,7 @@ mod tests {
     fn get_loudness_for_track_uses_cached_target_when_request_is_none() {
         let cache = AnalysisCache::open_in_memory();
         upsert_loudness(&cache, "abc", "deadbeef", -16.0);
-        let payload = get_loudness_payload_for_track(&cache, "abc", None)
+        let payload = get_loudness_payload_for_track(&cache, "server-a", "abc", None)
             .unwrap()
             .unwrap();
         assert_eq!(payload.target_lufs, -16.0);
@@ -426,11 +576,11 @@ mod tests {
         let cache = AnalysisCache::open_in_memory();
         upsert_loudness(&cache, "abc", "deadbeef", -14.0);
         // Out-of-range target gets clamped to [-30, -8].
-        let too_high = get_loudness_payload_for_track(&cache, "abc", Some(0.0))
+        let too_high = get_loudness_payload_for_track(&cache, "server-a", "abc", Some(0.0))
             .unwrap()
             .unwrap();
         assert_eq!(too_high.target_lufs, -8.0);
-        let too_low = get_loudness_payload_for_track(&cache, "abc", Some(-100.0))
+        let too_low = get_loudness_payload_for_track(&cache, "server-a", "abc", Some(-100.0))
             .unwrap()
             .unwrap();
         assert_eq!(too_low.target_lufs, -30.0);
@@ -439,7 +589,7 @@ mod tests {
     #[test]
     fn get_loudness_for_track_returns_none_for_unknown_track() {
         let cache = AnalysisCache::open_in_memory();
-        assert!(get_loudness_payload_for_track(&cache, "phantom", None)
+        assert!(get_loudness_payload_for_track(&cache, "server-a", "phantom", None)
             .unwrap()
             .is_none());
     }

src-tauri/crates/psysonic-analysis/src/lib.rs

@@ -6,8 +6,12 @@
 //! - `analysis_runtime` — backfill queue, CPU-seed queue, queue snapshot loop
 
 pub mod analysis_cache;
+pub mod analysis_perf;
 pub mod analysis_runtime;
+mod codec;
 pub mod commands;
+pub mod track_analysis_plan;
+pub mod track_enrichment;
 
 // Re-export logging facade so submodules can write `crate::app_eprintln!()`
 // the same way they did when they lived in the top crate.

src-tauri/crates/psysonic-analysis/src/track_analysis_plan.rs

@@ -0,0 +1,285 @@
+//! Plan what a track still needs: waveform, LUFS, enrichment (BPM/mood), …
+//!
+//! All byte-backed enqueue paths should call [`crate::analysis_runtime::enqueue_track_analysis`],
+//! which uses this module to decide full CPU seed vs enrichment-only vs no-op.
+
+use psysonic_core::track_analysis::TrackAnalysisPlan;
+use psysonic_core::track_enrichment::TrackEnrichmentPort;
+use tauri::{AppHandle, Manager};
+
+use crate::analysis_cache::{AnalysisCache, TrackKey};
+
+pub fn plan_track_analysis(
+    app: &AppHandle,
+    server_id: &str,
+    track_id: &str,
+    content_hash: &str,
+) -> TrackAnalysisPlan {
+    plan_track_analysis_offline_library(app, &[server_id], server_id, track_id, content_hash)
+}
+
+/// Offline/library download: waveform cache and enrichment facts may live under the
+/// playback index key while library rows use the UUID — try every scope before seeding.
+pub fn plan_track_analysis_offline_library(
+    app: &AppHandle,
+    cache_server_ids: &[&str],
+    _enrichment_server_id: &str,
+    track_id: &str,
+    content_hash: &str,
+) -> TrackAnalysisPlan {
+    let (need_waveform, need_loudness) =
+        cache_gaps_multi(app, cache_server_ids, track_id, content_hash);
+    let enrichment = enrichment_plan_multi(app, cache_server_ids, track_id, content_hash);
+    TrackAnalysisPlan {
+        need_waveform,
+        need_loudness,
+        enrichment,
+    }
+}
+
+/// Plan from the latest cached fingerprint when bytes are not available yet (HTTP backfill gate).
+pub fn plan_track_analysis_from_cache(
+    app: &AppHandle,
+    server_id: &str,
+    track_id: &str,
+) -> Result<TrackAnalysisPlan, String> {
+    let Some(cache) = app.try_state::<AnalysisCache>() else {
+        return Ok(TrackAnalysisPlan {
+            need_waveform: true,
+            need_loudness: true,
+            enrichment: Default::default(),
+        });
+    };
+    let Some(md5) = cache.get_latest_md5_16kb_for_track(server_id, track_id)? else {
+        return Ok(TrackAnalysisPlan {
+            need_waveform: true,
+            need_loudness: true,
+            enrichment: Default::default(),
+        });
+    };
+    Ok(plan_track_analysis(app, server_id, track_id, &md5))
+}
+
+pub fn track_analysis_needs_work(
+    app: &AppHandle,
+    server_id: &str,
+    track_id: &str,
+) -> Result<bool, String> {
+    if let Some(cache) = app.try_state::<AnalysisCache>() {
+        let latest_status = cache.get_latest_status_for_track(server_id, track_id)?;
+        if latest_status
+            .as_ref()
+            .is_some_and(|(status, _)| status == "failed")
+        {
+            return Ok(false);
+        }
+        let plan = plan_track_analysis_from_cache(app, server_id, track_id)?;
+        if !plan.any() {
+            return Ok(false);
+        }
+        // Legacy reconciliation: some old rows are persisted as `ready` with
+        // waveform present but no loudness (typically unsupported decode path).
+        // Those tracks spin forever in pending without converging. Promote to
+        // terminal `failed` so scheduler/progress can converge.
+        if latest_status
+            .as_ref()
+            .is_some_and(|(status, _)| status == "ready")
+            && plan.need_loudness
+            && !plan.need_waveform
+        {
+            if let Some(md5) = cache.get_latest_md5_16kb_for_track(server_id, track_id)? {
+                let key = TrackKey {
+                    server_id: server_id.to_string(),
+                    track_id: track_id.to_string(),
+                    md5_16kb: md5,
+                };
+                let _ = cache.touch_track_status(&key, "failed");
+            }
+            return Ok(false);
+        }
+        return Ok(plan.any());
+    }
+    Ok(plan_track_analysis_from_cache(app, server_id, track_id)?.any())
+}
+
+fn cache_gaps(
+    app: &AppHandle,
+    server_id: &str,
+    track_id: &str,
+    content_hash: &str,
+) -> (bool, bool) {
+    cache_gaps_for_content(
+        app.try_state::<AnalysisCache>().as_deref(),
+        server_id,
+        track_id,
+        content_hash,
+    )
+}
+
+fn cache_gaps_multi(
+    app: &AppHandle,
+    server_ids: &[&str],
+    track_id: &str,
+    content_hash: &str,
+) -> (bool, bool) {
+    let mut need_waveform = true;
+    let mut need_loudness = true;
+    for &server_id in server_ids {
+        if server_id.is_empty() {
+            continue;
+        }
+        let (nw, nl) = cache_gaps(app, server_id, track_id, content_hash);
+        if !nw {
+            need_waveform = false;
+        }
+        if !nl {
+            need_loudness = false;
+        }
+        if !need_waveform && !need_loudness {
+            break;
+        }
+    }
+    (need_waveform, need_loudness)
+}
+
+fn enrichment_plan(
+    app: &AppHandle,
+    server_id: &str,
+    track_id: &str,
+    content_hash: &str,
+) -> psysonic_core::track_enrichment::TrackEnrichmentPlan {
+    if server_id.is_empty() {
+        return Default::default();
+    }
+    app.try_state::<TrackEnrichmentPort>()
+        .map(|port| port.plan(server_id, track_id, content_hash))
+        .unwrap_or_default()
+}
+
+fn enrichment_plan_multi(
+    app: &AppHandle,
+    server_ids: &[&str],
+    track_id: &str,
+    content_hash: &str,
+) -> psysonic_core::track_enrichment::TrackEnrichmentPlan {
+    let mut need_bpm = true;
+    let mut need_valence = true;
+    let mut need_arousal = true;
+    let mut need_moods = true;
+    for &server_id in server_ids {
+        if server_id.is_empty() {
+            continue;
+        }
+        let plan = enrichment_plan(app, server_id, track_id, content_hash);
+        if !plan.need_bpm {
+            need_bpm = false;
+        }
+        if !plan.need_valence {
+            need_valence = false;
+        }
+        if !plan.need_arousal {
+            need_arousal = false;
+        }
+        if !plan.need_moods {
+            need_moods = false;
+        }
+        if !need_bpm && !need_valence && !need_arousal && !need_moods {
+            break;
+        }
+    }
+    psysonic_core::track_enrichment::TrackEnrichmentPlan {
+        need_bpm,
+        need_valence,
+        need_arousal,
+        need_moods,
+    }
+}
+
+fn cache_gaps_for_content(
+    cache: Option<&AnalysisCache>,
+    server_id: &str,
+    track_id: &str,
+    content_hash: &str,
+) -> (bool, bool) {
+    let Some(cache) = cache else {
+        return (true, true);
+    };
+    match cache.content_cache_coverage(server_id, track_id, content_hash) {
+        Ok(coverage) => (!coverage.has_waveform, !coverage.has_loudness),
+        Err(_) => (true, true),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::analysis_cache::{LoudnessEntry, TrackKey, WaveformEntry};
+
+    fn seed_waveform_loudness(cache: &AnalysisCache, server_id: &str, track_id: &str, md5: &str) {
+        let key = TrackKey {
+            server_id: server_id.to_string(),
+            track_id: track_id.to_string(),
+            md5_16kb: md5.to_string(),
+        };
+        cache.touch_track_status(&key, "ready").unwrap();
+        cache
+            .upsert_waveform(
+                &key,
+                &WaveformEntry {
+                    bins: vec![0u8; 1000],
+                    bin_count: 500,
+                    is_partial: false,
+                    known_until_sec: 0.0,
+                    duration_sec: 0.0,
+                    updated_at: 1,
+                },
+            )
+            .unwrap();
+        cache
+            .upsert_loudness(
+                &key,
+                &LoudnessEntry {
+                    integrated_lufs: -14.0,
+                    true_peak: 1.0,
+                    recommended_gain_db: 0.0,
+                    target_lufs: -14.0,
+                    updated_at: 1,
+                },
+            )
+            .unwrap();
+    }
+
+    #[test]
+    fn cache_gaps_true_when_empty() {
+        let cache = AnalysisCache::open_in_memory();
+        let (wf, ld) = cache_gaps_for_content(Some(&cache), "s1", "t1", "abc");
+        assert!(wf && ld);
+    }
+
+    #[test]
+    fn cache_gaps_false_when_fingerprint_present() {
+        let cache = AnalysisCache::open_in_memory();
+        seed_waveform_loudness(&cache, "s1", "t1", "abc");
+        let (wf, ld) = cache_gaps_for_content(Some(&cache), "s1", "t1", "abc");
+        assert!(!wf && !ld);
+    }
+
+    #[test]
+    fn cache_gaps_finds_stream_prefix_row_for_bare_track_id() {
+        let cache = AnalysisCache::open_in_memory();
+        seed_waveform_loudness(&cache, "s1", "stream:t1", "abc");
+        let (wf, ld) = cache_gaps_for_content(Some(&cache), "s1", "t1", "abc");
+        assert!(!wf && !ld, "bare id should resolve stream: cached fingerprint");
+    }
+
+    #[test]
+    fn playback_index_cache_row_not_visible_under_library_uuid_only() {
+        let cache = AnalysisCache::open_in_memory();
+        seed_waveform_loudness(&cache, "navidrome.test:4533", "t1", "abc");
+        let (wf, ld) = cache_gaps_for_content(Some(&cache), "library-uuid", "t1", "abc");
+        assert!(wf && ld, "library uuid alone should miss playback-scoped cache");
+        let (wf2, ld2) = cache_gaps_for_content(Some(&cache), "navidrome.test:4533", "t1", "abc");
+        assert!(!wf2 && !ld2, "playback index key should hit the cached row");
+    }
+
+}

src-tauri/crates/psysonic-analysis/src/track_enrichment.rs

@@ -0,0 +1,130 @@
+//! Client-side track enrichment — oximedia BPM + mood into library facts.
+
+use oximedia_mir::{mood, tempo, MirConfig};
+use psysonic_core::track_enrichment::{
+    TrackEnrichmentFacts, TrackEnrichmentIntFact, TrackEnrichmentOutcome, TrackEnrichmentPort,
+    TrackEnrichmentPlan, TrackEnrichmentRealFact,
+};
+use tauri::{AppHandle, Emitter, Manager, Runtime};
+
+use crate::analysis_cache::{
+    analysis_pcm_window, audio_duration_from_bytes, decode_mono_pcm_window, md5_first_16kb,
+};
+
+pub const ENRICHMENT_WINDOW_SEC: f64 = 60.0;
+
+#[derive(Clone, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EnrichmentUpdatedPayload {
+    pub track_id: String,
+    pub server_id: String,
+}
+
+fn emit_enrichment_updated<R: Runtime>(app: &AppHandle<R>, server_id: &str, track_id: &str) {
+    let _ = app.emit(
+        "analysis:enrichment-updated",
+        EnrichmentUpdatedPayload {
+            track_id: track_id.to_string(),
+            server_id: server_id.to_string(),
+        },
+    );
+}
+
+pub fn run_track_enrichment_if_needed<R: Runtime>(
+    app: &AppHandle<R>,
+    server_id: &str,
+    track_id: &str,
+    bytes: &[u8],
+    notify_ui: bool,
+) -> TrackEnrichmentOutcome {
+    if server_id.is_empty() {
+        return TrackEnrichmentOutcome::SkippedNoServer;
+    }
+    let Some(port) = app.try_state::<TrackEnrichmentPort>() else {
+        return TrackEnrichmentOutcome::SkippedNoPort;
+    };
+    let content_hash = md5_first_16kb(bytes);
+    let plan = port.plan(server_id, track_id, &content_hash);
+    if !plan.any() {
+        return TrackEnrichmentOutcome::SkippedComplete;
+    }
+
+    match analyze_and_store(&port, server_id, track_id, &content_hash, bytes, plan) {
+        Ok(()) => {
+            crate::app_deprintln!(
+                "[analysis][enrichment] applied track_id={} server_id={} hash={}",
+                track_id,
+                server_id,
+                content_hash
+            );
+            if notify_ui {
+                emit_enrichment_updated(app, server_id, track_id);
+            }
+            TrackEnrichmentOutcome::Applied
+        }
+        Err(e) => {
+            crate::app_eprintln!(
+                "[analysis][enrichment] failed track_id={} server_id={}: {}",
+                track_id,
+                server_id,
+                e
+            );
+            TrackEnrichmentOutcome::Failed
+        }
+    }
+}
+
+fn analyze_and_store(
+    port: &TrackEnrichmentPort,
+    server_id: &str,
+    track_id: &str,
+    content_hash: &str,
+    bytes: &[u8],
+    plan: TrackEnrichmentPlan,
+) -> Result<(), String> {
+    let total_duration = audio_duration_from_bytes(bytes).unwrap_or(0.0);
+    let window = analysis_pcm_window(total_duration, ENRICHMENT_WINDOW_SEC);
+    let (mono, sample_rate) =
+        decode_mono_pcm_window(bytes, window.start_sec, window.duration_sec)?;
+    if mono.is_empty() || sample_rate <= 0.0 {
+        return Err("empty PCM window".to_string());
+    }
+
+    let config = MirConfig::default();
+    let mut facts = TrackEnrichmentFacts::default();
+
+    if plan.need_bpm {
+        let detector = tempo::TempoDetector::new(sample_rate, config.min_tempo, config.max_tempo);
+        let tempo = detector.detect(&mono).map_err(|e| format!("tempo: {e}"))?;
+        let bpm = tempo.bpm.round().clamp(20.0, 999.0) as i64;
+        facts.bpm = Some(TrackEnrichmentIntFact {
+            value: bpm,
+            confidence: tempo.confidence,
+        });
+    }
+
+    if plan.need_valence || plan.need_arousal || plan.need_moods {
+        let detector = mood::MoodDetector::new(sample_rate);
+        let mood = detector.detect(&mono).map_err(|e| format!("mood: {e}"))?;
+        let confidence = mood.intensity.clamp(0.0, 1.0);
+        if plan.need_valence {
+            facts.valence = Some(TrackEnrichmentRealFact {
+                value: mood.valence as f64,
+                confidence,
+            });
+        }
+        if plan.need_arousal {
+            facts.arousal = Some(TrackEnrichmentRealFact {
+                value: mood.arousal as f64,
+                confidence,
+            });
+        }
+        if plan.need_moods && !mood.moods.is_empty() {
+            facts.moods = Some(
+                serde_json::to_string(&mood.moods).map_err(|e| format!("moods json: {e}"))?,
+            );
+        }
+    }
+
+    port.store(server_id, track_id, content_hash, &facts)
+}

src-tauri/crates/psysonic-audio/Cargo.toml

@@ -3,6 +3,7 @@ name = "psysonic-audio"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+license.workspace = true
 publish = false
 
 [dependencies]
@@ -10,14 +11,15 @@ psysonic-core = { path = "../psysonic-core" }
 psysonic-analysis = { path = "../psysonic-analysis" }
 
 tauri = { version = "2" }
+specta = { version = "=2.0.0-rc.25", features = ["derive"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tokio = { version = "1", features = ["rt", "time", "sync"] }
 reqwest = { version = "0.13", default-features = false, features = ["stream", "json", "rustls", "blocking", "gzip", "brotli"] }
 futures-util = "0.3"
-rodio = { version = "0.22", default-features = false, features = ["playback", "symphonia-all"] }
-symphonia = { version = "0.5", default-features = false, features = ["flac", "mp3", "pcm", "aac", "alac", "isomp4", "vorbis", "ogg", "wav", "adpcm"] }
-symphonia-adapter-libopus = "0.2.9"
+rodio = { version = "0.22", default-features = false, features = ["playback"] }
+symphonia = { version = "0.6", default-features = false, features = ["flac", "mp3", "pcm", "aac", "alac", "isomp4", "vorbis", "ogg", "wav", "adpcm", "all-meta"] }
+symphonia-adapter-libopus = "0.3"
 ringbuf = "0.5"
 biquad = "0.6"
 dasp_sample = "0.11.0"
@@ -25,19 +27,22 @@ md5 = "0.8"
 url = "2"
 thread-priority = "3"
 lofty = "0.24"
-id3 = "1.16.4"
+id3 = "1.17"
+pitch_shift = "2.1"
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"
 
 [target.'cfg(target_os = "linux")'.dependencies]
-zbus = { version = "5.15", default-features = false, features = ["blocking-api"] }
+zbus = { version = "5.16", default-features = false, features = ["blocking-api", "async-io"] }
 
 [target.'cfg(windows)'.dependencies]
 windows = { version = "0.62", features = [
     "Win32_Foundation",
     "Win32_System_Com",
     "Win32_System_Threading",
+    "Win32_System_Power",
+    "Win32_UI_WindowsAndMessaging",
 ] }
 
 [dev-dependencies]

src-tauri/crates/psysonic-audio/build.rs

@@ -0,0 +1,19 @@
+fn main() {
+    // Windows/MSVC test binaries only: bind to Common-Controls v6.
+    //
+    // The `tauri` dev-dependency pulls the wry/tao windowing runtime into this
+    // crate's *test* executables, which statically import `TaskDialogIndirect`
+    // from comctl32. That symbol lives only in Common-Controls v6 (WinSxS); the
+    // bare System32 comctl32.dll is v5.82 and does not export it, so an
+    // unmanifested test exe aborts at startup with STATUS_ENTRYPOINT_NOT_FOUND
+    // (0xC0000139) before any test runs. The app binary avoids this through its
+    // embedded manifest — mirror that here, scoped to test targets only (never
+    // the app, the rlib, or non-Windows/CI builds).
+    let is_windows_msvc = std::env::var("CARGO_CFG_TARGET_OS").as_deref() == Ok("windows")
+        && std::env::var("CARGO_CFG_TARGET_ENV").as_deref() == Ok("msvc");
+    if is_windows_msvc {
+        println!(
+            "cargo::rustc-link-arg=/MANIFESTDEPENDENCY:type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'"
+        );
+    }
+}

src-tauri/crates/psysonic-audio/src/analysis_dispatch.rs

@@ -0,0 +1,288 @@
+//! Unified playback → track analysis dispatch.
+//!
+//! Stream completion, hot/offline files, gapless chain, preload, and in-memory
+//! replay all funnel through here before [`psysonic_analysis::analysis_runtime::enqueue_track_analysis`].
+
+use std::path::PathBuf;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::Arc;
+
+use tauri::{AppHandle, Manager};
+
+use psysonic_analysis::analysis_runtime::AnalysisBackfillPriority;
+
+use crate::engine::{analysis_track_id_is_current_playback, AudioEngine};
+use crate::helpers::{analysis_cache_track_id, current_playback_server_id_str};
+use url::Url;
+use crate::state::ChainedInfo;
+use crate::stream::{LOCAL_FILE_PLAYBACK_SEED_MAX_BYTES, TRACK_STREAM_PROMOTE_MAX_BYTES};
+
+/// Where playback obtained the bytes — used for logging and size caps only.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum TrackAnalysisOrigin {
+    InMemoryReplay,
+    StreamDownloadComplete,
+    LocalFilePlayback,
+    StreamSpillFile,
+    PrefetchOrCacheFile,
+    GaplessChainReady,
+    GaplessTransition,
+}
+
+fn max_bytes_for_origin(origin: TrackAnalysisOrigin) -> usize {
+    match origin {
+        TrackAnalysisOrigin::LocalFilePlayback => LOCAL_FILE_PLAYBACK_SEED_MAX_BYTES,
+        _ => TRACK_STREAM_PROMOTE_MAX_BYTES,
+    }
+}
+
+/// Playback server scope: explicit IPC value, else pinned engine scope.
+pub(crate) fn resolve_analysis_server_id(
+    explicit: Option<&str>,
+    engine: Option<&AudioEngine>,
+) -> String {
+    if let Some(engine) = engine {
+        if let Some(url) = engine
+            .current_playback_url
+            .lock()
+            .ok()
+            .and_then(|g| (*g).clone())
+        {
+            if let Some(derived) = server_id_from_playback_url(&url) {
+                return derived;
+            }
+        }
+    }
+    explicit
+        .map(str::trim)
+        .filter(|s| !s.is_empty())
+        .map(str::to_string)
+        .unwrap_or_else(|| engine.map(current_playback_server_id_str).unwrap_or_default())
+}
+
+fn server_id_from_playback_url(url_raw: &str) -> Option<String> {
+    if url_raw.starts_with("psysonic-local://") {
+        return None;
+    }
+    let parsed = Url::parse(url_raw).ok()?;
+    let host = parsed.host_str()?;
+    let mut base_path = parsed.path().to_string();
+    if let Some(idx) = base_path.find("/rest") {
+        base_path.truncate(idx);
+    }
+    while base_path.ends_with('/') {
+        base_path.pop();
+    }
+    let mut base = host.to_string();
+    if let Some(port) = parsed.port() {
+        base.push_str(&format!(":{port}"));
+    }
+    if !base_path.is_empty() {
+        base.push_str(&base_path);
+    }
+    Some(base)
+}
+
+fn resolve_analysis_priority(
+    app: &AppHandle,
+    engine: Option<&AudioEngine>,
+    server_id: &str,
+    track_id: &str,
+    explicit: Option<AnalysisBackfillPriority>,
+) -> AnalysisBackfillPriority {
+    if let Some(priority) = explicit {
+        return priority;
+    }
+    if psysonic_analysis::analysis_runtime::analysis_backfill_is_current_track(app, track_id)
+        || engine.is_some_and(|e| analysis_track_id_is_current_playback(e, track_id))
+    {
+        return AnalysisBackfillPriority::High;
+    }
+    psysonic_analysis::analysis_runtime::analysis_backfill_resolve_priority(
+        app,
+        server_id,
+        track_id,
+        None,
+    )
+}
+
+/// Resolve `(server_id, priority)` when the caller has live engine state.
+pub(crate) fn prepare_playback_analysis(
+    app: &AppHandle,
+    engine: &AudioEngine,
+    explicit_server_id: Option<&str>,
+    track_id: &str,
+    priority: Option<AnalysisBackfillPriority>,
+) -> (String, AnalysisBackfillPriority) {
+    let sid = resolve_analysis_server_id(explicit_server_id, Some(engine));
+    let resolved = resolve_analysis_priority(app, Some(engine), &sid, track_id, priority);
+    (sid, resolved)
+}
+
+pub(crate) fn resolve_server_id_for_app(
+    app: &AppHandle,
+    explicit: Option<&str>,
+) -> String {
+    let engine = app.try_state::<AudioEngine>();
+    resolve_analysis_server_id(explicit, engine.as_deref())
+}
+
+pub(crate) fn analysis_priority_for_app(
+    app: &AppHandle,
+    server_id: &str,
+    track_id: &str,
+    explicit: Option<AnalysisBackfillPriority>,
+) -> AnalysisBackfillPriority {
+    let engine = app.try_state::<AudioEngine>();
+    resolve_analysis_priority(app, engine.as_deref(), server_id, track_id, explicit)
+}
+
+/// Gapless boundary: chained track became audible — run unified analysis if needed.
+pub(crate) fn spawn_gapless_transition_analysis(app: &AppHandle, info: &ChainedInfo) {
+    let track_id = analysis_cache_track_id(
+        info.analysis_track_id.as_deref(),
+        &info.url,
+    );
+    let Some(track_id) = track_id else {
+        return;
+    };
+    let engine = app.state::<AudioEngine>();
+    let (sid, priority) = prepare_playback_analysis(
+        app,
+        &engine,
+        info.server_id.as_deref(),
+        &track_id,
+        Some(AnalysisBackfillPriority::High),
+    );
+    let bytes = (*info.raw_bytes).clone();
+    spawn_track_analysis_bytes(
+        app.clone(),
+        TrackAnalysisOrigin::GaplessTransition,
+        sid,
+        track_id,
+        bytes,
+        priority,
+        None,
+    );
+}
+
+/// Byte-backed analysis — the single audio-side entry before the analysis crate planner.
+pub(crate) async fn dispatch_track_analysis_bytes(
+    app: &AppHandle,
+    origin: TrackAnalysisOrigin,
+    server_id: &str,
+    track_id: &str,
+    bytes: Vec<u8>,
+    priority: AnalysisBackfillPriority,
+) -> Result<(), String> {
+    let track_id = track_id.trim();
+    if track_id.is_empty() {
+        return Ok(());
+    }
+    if bytes.is_empty() {
+        return Ok(());
+    }
+    let max = max_bytes_for_origin(origin);
+    if bytes.len() > max {
+        crate::app_deprintln!(
+            "[analysis][dispatch] skip origin={origin:?} track_id={track_id} bytes={} max={max}",
+            bytes.len(),
+        );
+        return Ok(());
+    }
+    crate::app_deprintln!(
+        "[analysis][dispatch] origin={origin:?} track_id={track_id} server_id={} size_mib={:.2} priority={priority:?}",
+        if server_id.is_empty() { "''" } else { server_id },
+        bytes.len() as f64 / (1024.0 * 1024.0),
+    );
+    psysonic_analysis::analysis_runtime::enqueue_track_analysis(
+        app,
+        server_id,
+        track_id,
+        &bytes,
+        None,
+        priority,
+    )
+    .await
+    .map(|_| ())
+}
+
+/// Non-blocking wrapper with optional play-generation supersede guard.
+pub(crate) fn spawn_track_analysis_bytes(
+    app: AppHandle,
+    origin: TrackAnalysisOrigin,
+    server_id: String,
+    track_id: String,
+    bytes: Vec<u8>,
+    priority: AnalysisBackfillPriority,
+    generation_guard: Option<(u64, Arc<AtomicU64>)>,
+) {
+    if track_id.trim().is_empty() || bytes.is_empty() {
+        return;
+    }
+    tokio::spawn(async move {
+        if let Some((gen, gen_arc)) = generation_guard {
+            if gen_arc.load(Ordering::SeqCst) != gen {
+                return;
+            }
+        }
+        if let Err(e) = dispatch_track_analysis_bytes(
+            &app,
+            origin,
+            &server_id,
+            &track_id,
+            bytes,
+            priority,
+        )
+        .await
+        {
+            crate::app_eprintln!(
+                "[analysis][dispatch] failed origin={origin:?} track_id={track_id}: {e}"
+            );
+        }
+    });
+}
+
+pub(crate) fn spawn_track_analysis_file(
+    app: AppHandle,
+    origin: TrackAnalysisOrigin,
+    server_id: String,
+    track_id: String,
+    file_path: PathBuf,
+    priority: AnalysisBackfillPriority,
+    generation_guard: Option<(u64, Arc<AtomicU64>)>,
+) {
+    if track_id.trim().is_empty() {
+        return;
+    }
+    tokio::spawn(async move {
+        if let Some((gen, gen_arc)) = &generation_guard {
+            if gen_arc.load(Ordering::SeqCst) != *gen {
+                return;
+            }
+        }
+        let bytes = match tokio::fs::read(&file_path).await {
+            Ok(b) if !b.is_empty() => b,
+            _ => return,
+        };
+        if let Some((gen, gen_arc)) = generation_guard {
+            if gen_arc.load(Ordering::SeqCst) != gen {
+                return;
+            }
+        }
+        if let Err(e) = dispatch_track_analysis_bytes(
+            &app,
+            origin,
+            &server_id,
+            &track_id,
+            bytes,
+            priority,
+        )
+        .await
+        {
+            crate::app_eprintln!(
+                "[analysis][dispatch] file failed origin={origin:?} track_id={track_id}: {e}"
+            );
+        }
+    });
+}

src-tauri/crates/psysonic-audio/src/autoeq_commands.rs

@@ -40,6 +40,7 @@ pub(crate) fn autoeq_profile_url_candidates(
 
 /// Proxy: fetches https://autoeq.app/entries via Rust to bypass WebView CORS restrictions.
 #[tauri::command]
+#[specta::specta]
 pub async fn autoeq_entries(state: State<'_, AudioEngine>) -> Result<String, String> {
     audio_http_client(&state)
         .get("https://autoeq.app/entries")
@@ -49,6 +50,7 @@ pub async fn autoeq_entries(state: State<'_, AudioEngine>) -> Result<String, Str
 
 /// Fetches the AutoEQ FixedBandEQ profile for a specific headphone from GitHub raw content.
 #[tauri::command]
+#[specta::specta]
 pub async fn autoeq_fetch_profile(
     name: String,
     source: String,

src-tauri/crates/psysonic-audio/src/codec.rs

@@ -1,21 +1,22 @@
 //! Symphonia codec registry (incl. Opus) and radio decoder factory.
 use std::sync::OnceLock;
 
-use symphonia::core::codecs::{CodecRegistry, DecoderOptions};
+use symphonia::core::codecs::audio::{AudioCodecParameters, AudioDecoder, AudioDecoderOptions};
+use symphonia::core::codecs::registry::CodecRegistry;
 
 pub(crate) fn psysonic_codec_registry() -> &'static CodecRegistry {
     static REGISTRY: OnceLock<CodecRegistry> = OnceLock::new();
     REGISTRY.get_or_init(|| {
         let mut registry = CodecRegistry::new();
         symphonia::default::register_enabled_codecs(&mut registry);
-        registry.register_all::<symphonia_adapter_libopus::OpusDecoder>();
+        registry.register_audio_decoder::<symphonia_adapter_libopus::OpusDecoder>();
         registry
     })
 }
 
 pub(crate) fn try_make_radio_decoder(
-    params: &symphonia::core::codecs::CodecParameters,
-    opts: &DecoderOptions,
-) -> Result<Box<dyn symphonia::core::codecs::Decoder>, symphonia::core::errors::Error> {
-    psysonic_codec_registry().make(params, opts)
+    params: &AudioCodecParameters,
+    opts: &AudioDecoderOptions,
+) -> Result<Box<dyn AudioDecoder>, symphonia::core::errors::Error> {
+    psysonic_codec_registry().make_audio_decoder(params, opts)
 }

src-tauri/crates/psysonic-audio/src/commands.rs

@@ -11,13 +11,17 @@ use rodio::Source;
 use tauri::{AppHandle, Emitter, State};
 
 use super::decode::build_source;
-use super::engine::{audio_http_client, AudioEngine};
+use super::engine::AudioEngine;
 use super::helpers::*;
+use super::hi_res_blend::{self, OutgoingBlendSnapshot};
 use super::ipc::{maybe_emit_normalization_state, NormalizationStatePayload};
-use super::play_input::{
-    build_source_from_play_input, select_play_input, swap_in_new_sink, url_format_hint,
-    PlayInputContext, SinkSwapInputs,
+use super::play_input::{select_play_input, url_format_hint, PlayInputContext};
+use super::source_build::{build_playback_source_with_probe_fallback, BuildSourceArgs};
+use super::sink_swap::{
+    spawn_legacy_stream_start_when_armed, swap_in_new_sink, LegacyStreamStartWhenArmed,
+    SinkSwapInputs,
 };
+use super::playback_rate::{preserve_pitch_will_run, raw_counter_samples_for_content_position};
 use super::preview::preview_clear_for_new_main_playback;
 use super::progress_task::spawn_progress_task;
 use super::state::{ChainedInfo, PreloadedTrack};
@@ -28,9 +32,18 @@ use super::state::{ChainedInfo, PreloadedTrack};
 /// cache to the track when playing `psysonic-local://` (hot/offline). Optional
 /// for HTTP streams (`playback_identity` is used as fallback).
 ///
+/// `server_id`: app id of the server that owns this track (`playbackServerId ??
+/// activeServerId` on the frontend). Scopes the analysis-cache write key so a
+/// later server switch can't surface another server's waveform for the same bare
+/// `track_id`. Empty/absent falls back to the legacy `''` scope.
+///
 /// `stream_format_suffix`: Subsonic `song.suffix` (e.g. m4a); `stream.view` URLs have no
 /// file extension, so this helps pick a Symphonia `format_hint` for ranged HTTP.
 #[tauri::command]
+// NOTE: excluded from tauri-specta collect_commands! — specta's SpectaFn is only
+// implemented up to 10 args and this has 24. Typing it needs the args bundled into
+// a struct (a behaviour/contract change), tracked for the D4 flip; stays on
+// generate_handler! for now.
 #[allow(clippy::too_many_arguments)]
 pub async fn audio_play(
     url: String,
@@ -43,11 +56,36 @@ pub async fn audio_play(
     fallback_db: f32,
     manual: bool, // true = user-initiated skip → bypass crossfade, start immediately
     hi_res_enabled: bool, // false = safe 44.1 kHz mode; true = native rate (alpha)
+  hi_res_crossfade_resample_hz: Option<u32>, // 44100 / 88200 / 96000 when hi-res + crossfade
     analysis_track_id: Option<String>,
+    server_id: Option<String>,
     stream_format_suffix: Option<String>,
+    // Silent load: no `audio:playing`, sink stays paused. Optional + defaults to
+    // `false` so older/external `audio_play` callers that omit it still work.
+    start_paused: Option<bool>,
+    // Silence-aware crossfade (B-head): begin playback past the next track's
+    // leading silence. Optional + defaults to `0` so existing callers are
+    // unaffected; only applied when the freshly built source is seekable.
+    start_secs: Option<f64>,
+    // Dynamic crossfade (phase 2): per-transition overlap length, computed by the
+    // frontend from both tracks' waveform envelopes. Caps the fade for *this*
+    // transition instead of the global `crossfade_secs`. `None` → use the global
+    // setting (today's behaviour); always still clamped to the measured remaining.
+    crossfade_secs_override: Option<f32>,
+    // Scenario A (dynamic crossfade): engine fade-out length for the *outgoing*
+    // track A, decoupled from B's fade-in. `Some(0)` → don't fade A at all (it
+    // already fades out in the recording, so let it ride at full engine gain
+    // while B rises underneath); `Some(x)` → fade A over x s; `None` → mirror
+    // B's fade (today's behaviour). Always clamped to A's measured remaining.
+    outgoing_fade_secs_override: Option<f32>,
+    // AutoDJ smooth skip: short outgoing fade when the user hits next/previous
+    // while a track is playing. Optional; only honoured when `manual` is true.
+    manual_autodj_blend: Option<bool>,
     app: AppHandle,
     state: State<'_, AudioEngine>,
 ) -> Result<(), String> {
+    let start_paused = start_paused.unwrap_or(false);
+    let start_secs = start_secs.unwrap_or(0.0).max(0.0);
     let gapless = state.gapless_enabled.load(Ordering::Relaxed);
 
     // ── Ghost-command guard ───────────────────────────────────────────────────
@@ -97,6 +135,8 @@ pub async fn audio_play(
     // Bump generation first so the old progress task stops before we peel
     // chained_info (avoids a race where it sees current_done + empty chain).
     let gen = state.generation.fetch_add(1, Ordering::SeqCst) + 1;
+    // Ranged/legacy HTTP paths reset this to false in `select_play_input`.
+    state.stream_playback_armed.store(true, Ordering::SeqCst);
 
     // Manual skip onto the gapless-pre-chained track: reuse raw bytes (no HTTP;
     // preload cache was already consumed when the chain was built). Otherwise
@@ -131,6 +171,11 @@ pub async fn audio_play(
         .filter(|s| !s.is_empty());
     *state.current_analysis_track_id.lock().unwrap() = logical_trim.clone();
     let cache_id_for_tasks = analysis_cache_track_id(logical_trim.as_deref(), &url);
+    // Playback server scope for the analysis-cache write key (empty → legacy '').
+    let analysis_server_id = server_id.as_deref().map(str::trim).filter(|s| !s.is_empty());
+    // Pin it so the gain-resolution + replay-gain-update + device-resume reads
+    // scope to this server too (mirrors `current_analysis_track_id`).
+    *state.current_playback_server_id.lock().unwrap() = analysis_server_id.map(str::to_string);
 
     let format_hint = url_format_hint(&url);
 
@@ -142,6 +187,7 @@ pub async fn audio_play(
             stream_format_suffix: stream_format_suffix.as_deref(),
             format_hint: format_hint.as_deref(),
             cache_id_for_tasks: cache_id_for_tasks.as_deref(),
+            server_id: analysis_server_id,
             reuse_chained_bytes,
         },
         &state,
@@ -199,9 +245,18 @@ pub async fn audio_play(
         },
     );
 
-    // Manual skips (user-initiated) bypass crossfade — the track should start immediately.
-    let crossfade_enabled = state.crossfade_enabled.load(Ordering::Relaxed) && !manual;
-    let crossfade_secs_val = f32::from_bits(state.crossfade_secs.load(Ordering::Relaxed)).clamp(0.5, 12.0);
+    // Manual skips bypass crossfade unless AutoDJ smooth skip requests a full blend.
+    let manual_blend = manual && manual_autodj_blend.unwrap_or(false);
+    let crossfade_enabled =
+        state.crossfade_enabled.load(Ordering::Relaxed) && (!manual || manual_blend);
+    // Per-transition override (dynamic crossfade) caps the fade for this swap;
+    // otherwise fall back to the global crossfade length. Both clamped the same.
+    let crossfade_secs_val = if let Some(override_secs) = crossfade_secs_override {
+        override_secs.clamp(0.5, 30.0)
+    } else {
+        f32::from_bits(state.crossfade_secs.load(Ordering::Relaxed))
+            .clamp(0.5, 12.0)
+    };
 
     // Measure how much audio Track A actually has left right now.
     // By the time audio_play is called, near_end_ticks (2×500ms) + IPC latency
@@ -226,18 +281,47 @@ pub async fn audio_play(
         Duration::from_millis(5)
     };
 
+    // Outgoing (Track A) fade-out, decoupled from B's fade-in. Defaults to
+    // `actual_fade_secs` (symmetric crossfade, today's behaviour); a `Some(0)`
+    // override means A already fades out in the recording, so we leave it at
+    // full engine gain (scenario A). Never longer than A's remaining audio.
+    let outgoing_fade_secs: f32 = if crossfade_enabled {
+        match outgoing_fade_secs_override {
+            Some(v) => v.max(0.0).min(actual_fade_secs),
+            None => actual_fade_secs,
+        }
+    } else {
+        0.0
+    };
+
+    let blend_rate = hi_res_blend::blend_rate_hz(
+        hi_res_enabled,
+        crossfade_enabled || (gapless && !manual),
+        hi_res_crossfade_resample_hz,
+    );
+    let resample_target_hz = blend_rate.unwrap_or(0);
+
     // Build source: decode → trim → resample → EQ → fade-in → fade-out → notify → count.
     let done_flag = Arc::new(AtomicBool::new(false));
     // Reset sample counter for the new track.
     state.samples_played.store(0, Ordering::Relaxed);
-    let playback_source = build_source_from_play_input(
+    let playback_source = build_playback_source_with_probe_fallback(
         play_input,
+        BuildSourceArgs {
+            url: &url,
+            gen,
+            cache_id_for_tasks: cache_id_for_tasks.as_deref(),
+            server_id: analysis_server_id,
+            url_format_hint: format_hint.as_deref(),
+            stream_format_suffix: stream_format_suffix.as_deref(),
+            done_flag: done_flag.clone(),
+            fade_in_dur,
+            hi_res_enabled,
+            resample_target_hz,
+            duration_hint,
+        },
         &state,
-        format_hint.as_deref(),
-        done_flag.clone(),
-        fade_in_dur,
-        hi_res_enabled,
-        duration_hint,
+        &app,
     )
     .await
     .map_err(|e| {
@@ -257,8 +341,9 @@ pub async fn audio_play(
         e
     })?;
     state.current_is_seekable.store(playback_source.is_seekable, Ordering::SeqCst);
+    let source_seekable = playback_source.is_seekable;
     let built = playback_source.built;
-    let source = built.source;
+    let mut source = built.source;
     let duration_secs = built.duration_secs;
     let output_rate = built.output_rate;
     let output_channels = built.output_channels;
@@ -271,6 +356,26 @@ pub async fn audio_play(
         return Ok(());
     }
 
+    let current_stream_rate = state.stream_sample_rate.load(Ordering::Relaxed);
+    let outgoing_blend: Option<OutgoingBlendSnapshot> =
+        if let Some(blend) = blend_rate {
+            if crossfade_enabled && current_stream_rate > 0 && current_stream_rate != blend {
+                hi_res_blend::capture_outgoing_blend_snapshot(
+                    &state,
+                    outgoing_fade_secs,
+                    actual_fade_secs,
+                )
+            } else {
+                None
+            }
+        } else {
+            None
+        };
+
+    if outgoing_blend.is_some() {
+        hi_res_blend::detach_current_sink_for_blend_reopen(&state);
+    }
+
     // ── Stream rate management ────────────────────────────────────────────────
     // Hi-Res ON:  open device at file's native rate (bit-perfect, no resampler).
     // Hi-Res OFF: if the stream was previously opened at a hi-res rate (e.g. the
@@ -279,31 +384,34 @@ pub async fn audio_play(
     //             If already at the device default — skip entirely (no IPC, no
     //             PipeWire reconfigure, no scheduler cost).
     {
-        let current_stream_rate = state.stream_sample_rate.load(Ordering::Relaxed);
-        let target_rate = if hi_res_enabled {
-            output_rate   // native file rate
+        let target_rate = if let Some(blend) = blend_rate {
+            blend
+        } else if hi_res_enabled {
+            output_rate // native file rate
         } else {
-            state.device_default_rate  // restore device default
+            state.device_default_rate // restore device default
         };
         let needs_switch = target_rate > 0 && target_rate != current_stream_rate;
         if needs_switch {
-            let (reply_tx, reply_rx) = std::sync::mpsc::sync_channel::<Arc<rodio::MixerDeviceSink>>(0);
             let dev = state.selected_device.lock().unwrap().clone();
-            if state.stream_reopen_tx.send((target_rate, hi_res_enabled, dev, reply_tx)).is_ok() {
-                match reply_rx.recv_timeout(std::time::Duration::from_secs(5)) {
-                    Ok(new_handle) => {
-                        *state.stream_handle.lock().unwrap() = new_handle;
-                        state.stream_sample_rate.store(target_rate, Ordering::Relaxed);
-                        // Give PipeWire time to reconfigure at the new rate before
-                        // we open a Sink — only needed for large hi-res quanta.
-                        if hi_res_enabled && target_rate > 48_000 {
-                            tokio::time::sleep(Duration::from_millis(150)).await;
-                        }
-                    }
-                    Err(_) => {
-                        crate::app_eprintln!("[psysonic] stream rate switch timed out, keeping {current_stream_rate} Hz");
+            match super::engine::open_output_stream_blocking(
+                &state,
+                target_rate,
+                hi_res_enabled,
+                dev,
+            ) {
+                Ok(_) => {
+                    // Give PipeWire time to reconfigure at the new rate before
+                    // we open a Sink — only needed for large hi-res quanta.
+                    if hi_res_enabled && target_rate > 48_000 {
+                        tokio::time::sleep(Duration::from_millis(150)).await;
                     }
                 }
+                Err(_) => {
+                    crate::app_eprintln!(
+                        "[psysonic] stream rate switch timed out, keeping {current_stream_rate} Hz"
+                    );
+                }
             }
         }
 
@@ -313,7 +421,25 @@ pub async fn audio_play(
         }
     }
 
-    let sink = Arc::new(Player::connect_new(state.stream_handle.lock().unwrap().mixer()));
+    if let (Some(snap), Some(blend)) = (&outgoing_blend, blend_rate) {
+        if let Err(e) = hi_res_blend::spawn_outgoing_blend_resample(
+            &app,
+            &state,
+            snap,
+            blend,
+            gen,
+        )
+        .await
+        {
+            crate::app_eprintln!("{e}");
+        }
+        if state.generation.load(Ordering::SeqCst) != gen {
+            return Ok(());
+        }
+    }
+
+    let stream = super::engine::ensure_output_stream_open(&state)?;
+    let sink = Arc::new(Player::connect_new(stream.mixer()));
     sink.set_volume(effective_volume);
 
     // ── Sink pre-fill for hi-res tracks ──────────────────────────────────────
@@ -324,8 +450,13 @@ pub async fn audio_play(
     // we resume — the buffer is already full and the hardware gets its frames
     // without an underrun on the very first period.
     // Standard mode: no pre-fill needed — default 44.1/48 kHz quantum is small.
-    let needs_prefill = hi_res_enabled && output_rate > 48_000;
-    if needs_prefill {
+    // Preserve-pitch phase vocoder runs on a worker thread; pre-fill gives the
+    // ring buffer time to build headroom before the cpal callback drains it.
+    let needs_preserve_prefill = preserve_pitch_will_run(&state.playback_rate);
+    let needs_prefill =
+        (hi_res_enabled && blend_rate.unwrap_or(output_rate) > 48_000) || needs_preserve_prefill;
+    let defer_playback_start = !state.stream_playback_armed.load(Ordering::Relaxed);
+    if needs_prefill || defer_playback_start {
         sink.pause();
     }
 
@@ -360,19 +491,32 @@ pub async fn audio_play(
         }
     }
 
+    // Silence-aware crossfade (B-head): skip the next track's leading silence by
+    // seeking the freshly built source before it is appended. The outermost
+    // `CountingSource` stores the sample counter on a successful seek; we still
+    // re-seed `samples_played` + `seek_offset` explicitly after the swap (below)
+    // so the seekbar and the crossfade-remaining math are content-relative.
+    let did_start_seek = if start_secs > 0.05 && source_seekable {
+        source.try_seek(Duration::from_secs_f64(start_secs)).is_ok()
+    } else {
+        false
+    };
+
     sink.append(source);
 
     if needs_prefill {
-        // 500 ms lets rodio decode several seconds of hi-res audio into its
-        // internal buffer while the sink is paused. The hardware sees no gap
-        // because the output is held — it only starts draining after sink.play().
-        // 500 ms gives ~5 quanta of headroom at 8192-frame/88200 Hz quantum size,
-        // absorbing scheduler jitter and PipeWire graph wake-up latency.
-        tokio::time::sleep(Duration::from_millis(500)).await;
+        let prefill_ms = if needs_preserve_prefill {
+            800
+        } else {
+            500
+        };
+        tokio::time::sleep(Duration::from_millis(prefill_ms)).await;
         if state.generation.load(Ordering::SeqCst) != gen {
             return Ok(()); // skipped during pre-fill — abort silently
         }
-        sink.play();
+        if !defer_playback_start && !start_paused {
+            sink.play();
+        }
     }
 
     swap_in_new_sink(&state, SinkSwapInputs {
@@ -384,11 +528,51 @@ pub async fn audio_play(
         fadeout_samples: built.fadeout_samples,
         crossfade_enabled,
         actual_fade_secs,
+        outgoing_fade_secs,
+        start_paused,
     });
 
-    app.emit("audio:playing", duration_secs).ok();
+    // B-head: `swap_in_new_sink` resets `seek_offset` to 0 and starts the play
+    // clock — re-anchor both the wall-clock baseline (`seek_offset`) and the
+    // sample counter to the content offset so position reporting is correct.
+    if did_start_seek {
+        {
+            let mut cur = state.current.lock().unwrap();
+            cur.seek_offset = start_secs;
+        }
+        state.samples_played.store(
+            raw_counter_samples_for_content_position(
+                start_secs,
+                output_rate,
+                output_channels as u32,
+                &state.playback_rate,
+            ),
+            Ordering::Relaxed,
+        );
+    }
+
+    if defer_playback_start {
+        if !start_paused {
+            let mut cur = state.current.lock().unwrap();
+            cur.play_started = None;
+            cur.paused_at = Some(0.0);
+        }
+        spawn_legacy_stream_start_when_armed(LegacyStreamStartWhenArmed {
+            gen,
+            gen_arc: state.generation.clone(),
+            playback_armed: state.stream_playback_armed.clone(),
+            samples_played: state.samples_played.clone(),
+            current: state.current.clone(),
+            app: app.clone(),
+            duration_secs,
+            hold_paused: start_paused,
+        });
+    } else if !start_paused {
+        app.emit("audio:playing", duration_secs).ok();
+    }
 
     // ── Progress + ended detection ────────────────────────────────────────────
+    let analysis_app = app.clone();
     spawn_progress_task(
         gen,
         state.generation.clone(),
@@ -396,13 +580,17 @@ pub async fn audio_play(
         state.chained_info.clone(),
         state.crossfade_enabled.clone(),
         state.crossfade_secs.clone(),
+        state.autodj_suppress_autocrossfade.clone(),
         done_flag,
         app,
+        Some(analysis_app),
         state.samples_played.clone(),
         state.current_sample_rate.clone(),
         state.current_channels.clone(),
         state.gapless_switch_at.clone(),
         state.current_playback_url.clone(),
+        state.stream_playback_armed.clone(),
+        state.playback_rate.clone(),
     );
 
     Ok(())
@@ -418,6 +606,9 @@ pub async fn audio_play(
 /// audio_play() checks chained_info.url on arrival: if it matches, it returns
 /// immediately without touching the Sink (pure no-op on the audio path).
 #[tauri::command]
+// NOTE: excluded from tauri-specta collect_commands! — 13 args exceed specta's
+// 10-arg SpectaFn limit; needs arg-bundling for the D4 flip. Stays on
+// generate_handler! for now.
 #[allow(clippy::too_many_arguments)]
 pub async fn audio_chain_preload(
     url: String,
@@ -429,7 +620,9 @@ pub async fn audio_chain_preload(
     pre_gain_db: f32,
     fallback_db: f32,
     hi_res_enabled: bool,
+    hi_res_crossfade_resample_hz: Option<u32>,
     analysis_track_id: Option<String>,
+    server_id: Option<String>,
     app: AppHandle,
     state: State<'_, AudioEngine>,
 ) -> Result<(), String> {
@@ -463,7 +656,14 @@ pub async fn audio_chain_preload(
         } else if let Some(path) = url.strip_prefix("psysonic-local://") {
             tokio::fs::read(path).await.map_err(|e| e.to_string())?
         } else {
-            let resp = audio_http_client(&state).get(&url).send().await
+            let resp = crate::engine::playback_scoped_get(
+                &state,
+                &app,
+                &url,
+                server_id.as_deref(),
+            )
+            .send()
+            .await
                 .map_err(|e| e.to_string())?;
             if !resp.status().is_success() {
                 return Ok(()); // silently fail — audio_play will retry
@@ -492,6 +692,27 @@ pub async fn audio_chain_preload(
         .as_ref()
         .map(|s| s.trim().to_string())
         .filter(|s| !s.is_empty());
+    let analysis_server_id = server_id.as_deref().map(str::trim).filter(|s| !s.is_empty());
+
+    if let Some(track_id) = analysis_cache_track_id(logical_trim.as_deref(), &url) {
+        let (sid, priority) = crate::analysis_dispatch::prepare_playback_analysis(
+            &app,
+            &state,
+            analysis_server_id,
+            &track_id,
+            Some(psysonic_analysis::analysis_runtime::AnalysisBackfillPriority::Middle),
+        );
+        let bytes = (*raw_bytes).clone();
+        crate::analysis_dispatch::spawn_track_analysis_bytes(
+            app.clone(),
+            crate::analysis_dispatch::TrackAnalysisOrigin::GaplessChainReady,
+            sid,
+            track_id,
+            bytes,
+            priority,
+            None,
+        );
+    }
 
     // Only `gain_linear` is needed — `effective_volume` is intentionally NOT
     // applied to the Sink here. `audio_chain_preload` runs ~30 s before the
@@ -513,8 +734,9 @@ pub async fn audio_chain_preload(
     // Use a dedicated counter for the chained source — it will be swapped into
     // samples_played when the chained track becomes active.
     let chain_counter = Arc::new(AtomicU64::new(0));
-    // Always 0 — no application-level resampling (same as audio_play).
-    let target_rate: u32 = 0;
+    // Always 0 unless hi-res gapless blend resampling is active.
+    let blend_rate = hi_res_blend::blend_rate_hz(hi_res_enabled, hi_res_enabled, hi_res_crossfade_resample_hz);
+    let target_rate: u32 = blend_rate.unwrap_or(0);
     let format_hint = url.rsplit('.').next()
         .and_then(|ext| ext.split('?').next())
         .map(|s| s.to_lowercase());
@@ -524,6 +746,7 @@ pub async fn audio_chain_preload(
         state.eq_gains.clone(),
         state.eq_enabled.clone(),
         state.eq_pre_gain.clone(),
+        state.playback_rate.clone(),
         done_next.clone(),
         Duration::ZERO, // gapless: no fade-in — sample-accurate boundary, no click
         chain_counter.clone(),
@@ -539,23 +762,70 @@ pub async fn audio_chain_preload(
         return Ok(());
     }
 
-    // In hi-res mode: if the next track's native rate differs from the current
-    // output stream, we cannot chain gaplessly — audio_play will do a hard cut
-    // with a stream re-open. Store raw bytes to avoid re-downloading.
-    // In safe mode (44.1 kHz locked): the stream rate is always 44100, so the
-    // chain proceeds and rodio resamples internally — no bail needed.
-    let next_rate = if hi_res_enabled { built.output_rate } else { 44_100 };
+    // Hi-res gapless: resample the chained track to the blend rate and realign
+    // the output stream when its Hz differs from the current track.
     let stream_rate = state.stream_sample_rate.load(Ordering::Relaxed);
-    if hi_res_enabled && stream_rate > 0 && next_rate != stream_rate {
-        crate::app_eprintln!(
-            "[psysonic] gapless chain skipped: next track rate {} Hz ≠ stream {} Hz",
-            next_rate, stream_rate
-        );
-        *state.preloaded.lock().unwrap() = Some(PreloadedTrack {
-            url,
-            data: Arc::try_unwrap(raw_bytes).unwrap_or_else(|a| (*a).clone()),
-        });
-        return Ok(());
+    if let Some(br) = blend_rate {
+        if stream_rate > 0 && stream_rate != br {
+            if let Some(snap) = hi_res_blend::capture_outgoing_blend_snapshot(&state, 0.0, 0.0) {
+                hi_res_blend::detach_current_sink_for_blend_reopen(&state);
+                let dev = state.selected_device.lock().unwrap().clone();
+                if super::engine::open_output_stream_blocking(&state, br, true, dev).is_ok() {
+                    if hi_res_enabled && br > 48_000 {
+                        tokio::time::sleep(Duration::from_millis(150)).await;
+                    }
+                    if state.generation.load(Ordering::SeqCst) == snapshot_gen {
+                        if let Err(e) = hi_res_blend::rebuild_current_track_at_blend_rate(
+                            &app,
+                            &state,
+                            &snap,
+                            br,
+                            snapshot_gen,
+                        )
+                        .await
+                        {
+                            crate::app_eprintln!("{e}");
+                            *state.preloaded.lock().unwrap() = Some(PreloadedTrack {
+                                url: url.clone(),
+                                data: Arc::try_unwrap(raw_bytes).unwrap_or_else(|a| (*a).clone()),
+                            });
+                            return Ok(());
+                        }
+                    }
+                } else {
+                    crate::app_eprintln!(
+                        "[psysonic] gapless blend stream reopen failed (wanted {br} Hz, had {stream_rate} Hz)"
+                    );
+                    *state.preloaded.lock().unwrap() = Some(PreloadedTrack {
+                        url,
+                        data: Arc::try_unwrap(raw_bytes).unwrap_or_else(|a| (*a).clone()),
+                    });
+                    return Ok(());
+                }
+            } else {
+                crate::app_eprintln!(
+                    "[psysonic] gapless blend skipped: current track not cached for realign"
+                );
+                *state.preloaded.lock().unwrap() = Some(PreloadedTrack {
+                    url,
+                    data: Arc::try_unwrap(raw_bytes).unwrap_or_else(|a| (*a).clone()),
+                });
+                return Ok(());
+            }
+        }
+    } else {
+        let next_rate = if hi_res_enabled { built.output_rate } else { 44_100 };
+        if hi_res_enabled && stream_rate > 0 && next_rate != stream_rate {
+            crate::app_eprintln!(
+                "[psysonic] gapless chain skipped: next track rate {} Hz ≠ stream {} Hz",
+                next_rate, stream_rate
+            );
+            *state.preloaded.lock().unwrap() = Some(PreloadedTrack {
+                url,
+                data: Arc::try_unwrap(raw_bytes).unwrap_or_else(|a| (*a).clone()),
+            });
+            return Ok(());
+        }
     }
 
     // Append to the existing Sink. The audio hardware stream never stalls.
@@ -572,6 +842,8 @@ pub async fn audio_chain_preload(
 
     *state.chained_info.lock().unwrap() = Some(ChainedInfo {
         url,
+        analysis_track_id: logical_trim,
+        server_id: analysis_server_id.map(str::to_string),
         raw_bytes,
         duration_secs,
         replay_gain_linear: gain_linear,

src-tauri/crates/psysonic-audio/src/decode.rs

@@ -1,22 +1,24 @@
 //! Symphonia `SizedDecoder`, gapless trim, and `build_source` / `build_streaming_source`.
 use std::io::{Cursor, Read, Seek};
-use std::sync::atomic::{AtomicBool, AtomicU32, AtomicU64};
+use std::sync::atomic::{AtomicBool, AtomicU32, AtomicU64, Ordering};
 use std::sync::Arc;
 use std::time::Duration;
 
 use rodio::source::UniformSourceIterator;
 use rodio::Source;
 use symphonia::core::{
-    audio::{AudioBufferRef, SampleBuffer, SignalSpec},
-    codecs::{DecoderOptions, CODEC_TYPE_NULL},
+    audio::{AudioSpec, GenericAudioBufferRef},
+    codecs::audio::{AudioCodecParameters, AudioDecoder, AudioDecoderOptions},
+    formats::probe::Hint,
     formats::{FormatOptions, FormatReader, SeekMode, SeekTo},
+    common::Limit,
     io::{MediaSource, MediaSourceStream, MediaSourceStreamOptions},
     meta::MetadataOptions,
-    probe::Hint,
-    units::{self, Time},
+    units::{Time, Timestamp},
 };
 
 use super::codec::{psysonic_codec_registry, try_make_radio_decoder};
+use super::playback_rate::{PlaybackRateAtomics, PlaybackRateSource};
 use super::sources::*;
 
 // ─── SizedCursorSource — correct byte_len for seekable in-memory sources ──────
@@ -51,6 +53,46 @@ impl MediaSource for SizedCursorSource {
     fn byte_len(&self) -> Option<u64> { Some(self.len) }
 }
 
+// ─── ProbeSeekGate — temporarily hide seekability during probing ──────────────
+//
+// Symphonia 0.6's `Probe::probe` scans for *trailing* metadata (ID3v1/APEv2/…)
+// whenever the source reports `is_seekable() == true` and a known `byte_len()`.
+// That scan seeks to the end of the stream. For a progressive ranged-HTTP source
+// this forces a download all the way to EOF before the first sample can play
+// (FLAC/MP3/OGG regressed to "won't start until fully downloaded").
+//
+// These formats are demuxed sequentially from the start, and their seek paths
+// re-check `is_seekable()` dynamically, so we can advertise the source as
+// non-seekable for the duration of the probe (skipping the trailing scan) and
+// flip it back to seekable afterwards to preserve scrubbing. MP4/ISO-BMFF is
+// excluded because its demuxer captures seekability at construction and relies
+// on seeking to locate `moov` (its tail is prefetched separately instead).
+struct ProbeSeekGate {
+    inner: Box<dyn MediaSource>,
+    seekable: Arc<AtomicBool>,
+}
+
+impl Read for ProbeSeekGate {
+    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+        self.inner.read(buf)
+    }
+}
+
+impl Seek for ProbeSeekGate {
+    fn seek(&mut self, pos: std::io::SeekFrom) -> std::io::Result<u64> {
+        self.inner.seek(pos)
+    }
+}
+
+impl MediaSource for ProbeSeekGate {
+    fn is_seekable(&self) -> bool {
+        self.seekable.load(Ordering::Relaxed) && self.inner.is_seekable()
+    }
+    fn byte_len(&self) -> Option<u64> {
+        self.inner.byte_len()
+    }
+}
+
 // ─── SizedDecoder — symphonia decoder with correct byte_len ───────────────────
 //
 // Replaces rodio::Decoder::new() which wraps the source in ReadSeekSource
@@ -64,19 +106,19 @@ impl MediaSource for SizedCursorSource {
 /// playback is genuinely lossless.
 pub(crate) fn log_codec_resolution(
     tag: &str,
-    params: &symphonia::core::codecs::CodecParameters,
+    params: &AudioCodecParameters,
     container_hint: Option<&str>,
 ) {
     let codec_name = symphonia::default::get_codecs()
-        .get_codec(params.codec)
-        .map(|d| d.short_name)
+        .get_audio_decoder(params.codec)
+        .map(|d| d.codec.info.short_name)
         .unwrap_or("?");
     let rate = params.sample_rate.map(|r| format!("{} Hz", r)).unwrap_or_else(|| "? Hz".into());
     let bits = params.bits_per_sample
         .or(params.bits_per_coded_sample)
         .map(|b| format!("{}-bit", b))
         .unwrap_or_else(|| "?-bit".into());
-    let ch = params.channels
+    let ch = params.channels.as_ref()
         .map(|c| format!("{}ch", c.count()))
         .unwrap_or_else(|| "?ch".into());
     let lossless = codec_name.starts_with("pcm")
@@ -98,14 +140,20 @@ const DECODE_MAX_RETRIES: usize = 3;
 /// this limit so a handful of corrupt MP3 frames never aborts an otherwise
 /// playable track (VLC-style frame dropping).
 const MAX_CONSECUTIVE_DECODE_ERRORS: usize = 100;
+/// Wall-clock cap for the streaming `probe()` call. A ranged-HTTP source whose
+/// download stalls (e.g. right after a server switch) can otherwise block the
+/// probe — and therefore playback start — indefinitely. On timeout we abort with
+/// an error so the player can recover/retry instead of hanging until a restart.
+const STREAM_PROBE_TIMEOUT: Duration = Duration::from_secs(20);
 
 pub(crate) struct SizedDecoder {
-    decoder: Box<dyn symphonia::core::codecs::Decoder>,
+    decoder: Box<dyn AudioDecoder>,
     current_frame_offset: usize,
     format: Box<dyn FormatReader>,
     total_duration: Option<Time>,
-    buffer: SampleBuffer<f32>,
-    spec: SignalSpec,
+    /// Interleaved f32 samples of the currently decoded packet.
+    buffer: Vec<f32>,
+    spec: AudioSpec,
     /// Counts consecutive DecodeErrors in the hot-path. Reset to 0 on every
     /// successfully decoded frame. Used to detect fully undecodable streams.
     consecutive_decode_errors: usize,
@@ -118,36 +166,44 @@ impl SizedDecoder {
             inner: Cursor::new(data),
             len: data_len,
         };
+        // Symphonia 0.6 scans trailing metadata on seekable sources — hide
+        // seekability during probe (same as `new_streaming`) so preview does not
+        // read the entire in-memory file before the first sample.
+        //
+        // Exception: Ogg (Vorbis/Opus/…) must stay seekable through the probe,
+        // otherwise its demuxer never records `phys_byte_range_end` and the first
+        // seek panics (see `container_hint_is_ogg`). This source is fully
+        // in-memory, so the trailing-metadata scan it re-enables is free.
+        let gate_needed = !crate::stream::container_hint_is_mp4(format_hint)
+            && !crate::stream::container_hint_is_ogg(format_hint);
+        let probe_seek_gate = gate_needed.then(|| Arc::new(AtomicBool::new(false)));
+        let media: Box<dyn MediaSource> = match &probe_seek_gate {
+            Some(gate) => Box::new(ProbeSeekGate {
+                inner: Box::new(source),
+                seekable: gate.clone(),
+            }),
+            None => Box::new(source),
+        };
         // Hi-Res: 4 MB read-ahead so Symphonia demuxes fewer Read calls for
         // high-bitrate files (88.2 kHz/24-bit FLAC ≈ 1800 kbps).
         // Standard: 512 KB is plenty for MP3/AAC — larger buffers waste allocation
         // and compete with the playback thread at track start.
         let buf_len = if hi_res { 4 * 1024 * 1024 } else { 512 * 1024 };
-        let mss = MediaSourceStream::new(
-            Box::new(source) as Box<dyn MediaSource>,
-            MediaSourceStreamOptions { buffer_len: buf_len },
-        );
+        let mss = MediaSourceStream::new(media, MediaSourceStreamOptions { buffer_len: buf_len });
 
         let mut hint = Hint::new();
         if let Some(ext) = format_hint {
             hint.with_extension(ext);
         }
-        let format_opts = FormatOptions {
-            // Disable gapless parsing — Symphonia 0.5.5 crashes on `edts` atoms
-            // present in older iTunes-purchased M4A files.
-            enable_gapless: false,
-            ..Default::default()
-        };
+        let format_opts = FormatOptions::default();
 
-        let meta_opts = symphonia::core::meta::MetadataOptions {
-            // Cap embedded cover art at 8 MiB so oversized MJPEG images in
-            // iTunes M4A files don't choke the parser.
-            limit_visual_bytes: symphonia::core::meta::Limit::Maximum(8 * 1024 * 1024),
-            ..Default::default()
-        };
+        // Cap embedded cover art at 8 MiB so oversized MJPEG images in
+        // iTunes M4A files don't choke the parser.
+        let meta_opts =
+            MetadataOptions::default().limit_visual_bytes(Limit::Maximum(8 * 1024 * 1024));
 
-        let probed = symphonia::default::get_probe()
-            .format(&hint, mss, &format_opts, &meta_opts)
+        let mut format = symphonia::default::get_probe()
+            .probe(&hint, mss, format_opts, meta_opts)
             .map_err(|e| {
                 let hint_str = format_hint.unwrap_or("unknown");
                 // Always print the raw Symphonia error to the terminal for diagnosis.
@@ -159,30 +215,49 @@ impl SizedDecoder {
                 }
             })?;
 
-        let track = probed.format
+        if let Some(gate) = &probe_seek_gate {
+            gate.store(true, Ordering::Relaxed);
+        }
+
+        let track = format
             .tracks()
             .iter()
-            // Explicitly select only audio tracks: must have a valid codec and a
+            // Explicitly select only audio tracks: must have an audio codec and a
             // sample_rate. This skips MJPEG cover-art streams that iTunes M4A
             // files embed as a secondary video track.
             .find(|t| {
-                t.codec_params.codec != CODEC_TYPE_NULL
-                    && t.codec_params.sample_rate.is_some()
+                t.codec_params
+                    .as_ref()
+                    .and_then(|c| c.audio())
+                    .is_some_and(|a| a.sample_rate.is_some())
             })
             .ok_or_else(|| {
-                crate::app_eprintln!("[psysonic] no audio track found among {} tracks", probed.format.tracks().len());
+                crate::app_eprintln!("[psysonic] no audio track found among {} tracks", format.tracks().len());
                 "no playable audio track found in file".to_string()
             })?;
 
         let track_id = track.id;
-        let total_duration = track.codec_params.time_base
-            .zip(track.codec_params.n_frames)
-            .map(|(base, frames)| base.calc_time(frames));
+        // Encoder-delay-aware total duration (timebase units → Time).
+        let total_duration = track
+            .time_base
+            .zip(track.num_frames)
+            .and_then(|(base, frames)| {
+                Timestamp::try_from(frames).ok().and_then(|ts| base.calc_time(ts))
+            });
 
-        log_codec_resolution("bytes", &track.codec_params, format_hint);
+        let audio_params = track
+            .codec_params
+            .as_ref()
+            .and_then(|c| c.audio())
+            .ok_or_else(|| "selected track has no audio codec parameters".to_string())?
+            .clone();
 
+        log_codec_resolution("bytes", &audio_params, format_hint);
+
+        // Gapless trimming is performed by `build_source` (iTunSMPB), so disable
+        // the decoder's built-in trimming to avoid double-trimming.
         let mut decoder = psysonic_codec_registry()
-            .make(&track.codec_params, &DecoderOptions::default())
+            .make_audio_decoder(&audio_params, &AudioDecoderOptions::default().gapless(false))
             .map_err(|e| {
                 crate::app_eprintln!("[psysonic] codec init failed: {e}");
                 if e.to_string().to_lowercase().contains("unsupported") {
@@ -192,15 +267,15 @@ impl SizedDecoder {
                 }
             })?;
 
-        let mut format = probed.format;
-
         // Decode the first packet to initialise spec + buffer.
         // DecodeErrors (e.g. "invalid main_data offset") are non-fatal: drop the
         // frame and try the next packet up to MAX_CONSECUTIVE_DECODE_ERRORS times.
         let mut decode_errors: usize = 0;
         let decoded = loop {
             let packet = match format.next_packet() {
-                Ok(p) => p,
+                Ok(Some(p)) => p,
+                // Clean EOF before any decodable packet.
+                Ok(None) => break decoder.last_decoded(),
                 Err(symphonia::core::errors::Error::IoError(_)) => {
                     break decoder.last_decoded();
                 }
@@ -209,8 +284,8 @@ impl SizedDecoder {
                     return Err(format!("could not read audio data: {e}"));
                 }
             };
-            if packet.track_id() != track_id {
-                crate::app_eprintln!("[psysonic] skipping packet for track {} (want {})", packet.track_id(), track_id);
+            if packet.track_id != track_id {
+                crate::app_eprintln!("[psysonic] skipping packet for track {} (want {})", packet.track_id, track_id);
                 continue;
             }
             match decoder.decode(&packet) {
@@ -229,8 +304,8 @@ impl SizedDecoder {
             }
         };
 
-        let spec = decoded.spec().to_owned();
-        let buffer = Self::make_buffer(decoded, &spec);
+        let spec = decoded.spec().clone();
+        let buffer = Self::make_buffer(&decoded);
 
         Ok(SizedDecoder {
             decoder,
@@ -246,39 +321,126 @@ impl SizedDecoder {
     /// Build a decoder from any `MediaSource` (e.g. track-stream or radio).
     /// Uses `enable_gapless: false` — live streams are not seekable; gapless
     /// trimming requires seeking to read the LAME/iTunSMPB end-padding info.
+    /// `source_random_access`: the underlying source can cheaply seek to EOF
+    /// (e.g. a local file), so the probe-time trailing-metadata / stream-end scan
+    /// is not a full download. Progressive sources (ranged HTTP) pass `false`.
     pub(crate) fn new_streaming(
         media: Box<dyn MediaSource>,
         format_hint: Option<&str>,
         source_tag: &str,
+        source_random_access: bool,
     ) -> Result<Self, String> {
+        // For non-MP4 progressive streams, hide seekability during the probe so
+        // Symphonia 0.6 skips its trailing-metadata scan (which would seek to EOF
+        // and block until the whole file is downloaded). Re-enabled right after.
+        // MP4 keeps seekability (its demuxer needs it to find `moov`; tail is
+        // prefetched separately).
+        //
+        // Ogg also keeps seekability through the probe, but only on random-access
+        // sources: its demuxer records `phys_byte_range_end` during the probe and
+        // panics on the first seek otherwise (see `container_hint_is_ogg`). On a
+        // local file the stream-end scan is cheap; on a progressive ranged stream
+        // it would force a full download, so there we keep the gate and accept
+        // that seeking is a no-op (the panic itself is contained in `try_seek`).
+        let stream_len = media.byte_len();
+        let ogg_needs_seekable_probe =
+            source_random_access && crate::stream::container_hint_is_ogg(format_hint);
+        let gate_needed = !crate::stream::container_hint_is_mp4(format_hint)
+            && !ogg_needs_seekable_probe;
+        let probe_seek_gate = gate_needed.then(|| Arc::new(AtomicBool::new(false)));
+        let media: Box<dyn MediaSource> = match &probe_seek_gate {
+            Some(gate) => Box::new(ProbeSeekGate { inner: media, seekable: gate.clone() }),
+            None => media,
+        };
+
         // Larger read-ahead buffer for the live streaming SPSC consumer — reduces
         // read() call frequency into the ring buffer, easing I/O spikes.
         let mss = MediaSourceStream::new(media, MediaSourceStreamOptions { buffer_len: 512 * 1024 });
-        let mut hint = Hint::new();
-        if let Some(ext) = format_hint { hint.with_extension(ext); }
-        let format_opts = FormatOptions { enable_gapless: false, ..Default::default() };
-        let probed = symphonia::default::get_probe()
-            .format(&hint, mss, &format_opts, &MetadataOptions::default())
-            .map_err(|e| format!("{source_tag}: format probe failed: {e}"))?;
+        let format_opts = FormatOptions::default();
+        let meta_opts = MetadataOptions::default();
 
-        let track = probed.format.tracks().iter()
-            .find(|t| t.codec_params.codec != CODEC_TYPE_NULL)
+        crate::app_deprintln!(
+            "[stream] {source_tag}: probe start (hint={}, stream_len={})",
+            format_hint.unwrap_or("?"),
+            stream_len.map(|n| n.to_string()).unwrap_or_else(|| "?".into()),
+        );
+        let probe_start = std::time::Instant::now();
+
+        // Run the probe on a dedicated thread guarded by a timeout. If a ranged
+        // source stalls (download never reaches the bytes Symphonia needs), the
+        // probe blocks forever; without this guard playback start would hang until
+        // the user restarts the player. On timeout we abandon the worker thread
+        // (it unblocks once the underlying read errors/returns) and surface an
+        // error so the caller can retry.
+        let hint_ext = format_hint.map(|s| s.to_string());
+        let tag_owned = source_tag.to_string();
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::Builder::new()
+            .name("symphonia-probe".into())
+            .spawn(move || {
+                let mut hint = Hint::new();
+                if let Some(ext) = &hint_ext {
+                    hint.with_extension(ext);
+                }
+                let result = symphonia::default::get_probe()
+                    .probe(&hint, mss, format_opts, meta_opts)
+                    .map_err(|e| format!("{tag_owned}: format probe failed: {e}"));
+                // Receiver is gone if we already timed out — ignore the send error.
+                let _ = tx.send(result);
+            })
+            .map_err(|e| format!("{source_tag}: failed to spawn probe thread: {e}"))?;
+
+        let mut format = match rx.recv_timeout(STREAM_PROBE_TIMEOUT) {
+            Ok(Ok(format)) => format,
+            Ok(Err(e)) => return Err(e),
+            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {
+                crate::app_eprintln!(
+                    "[stream] {source_tag}: probe timed out after {STREAM_PROBE_TIMEOUT:?} \
+                     (stream stalled?) — aborting so the player can retry"
+                );
+                return Err(format!(
+                    "{source_tag}: format probe timed out after {STREAM_PROBE_TIMEOUT:?}"
+                ));
+            }
+            Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => {
+                return Err(format!("{source_tag}: probe thread ended unexpectedly"));
+            }
+        };
+
+        crate::app_deprintln!(
+            "[stream] {source_tag}: probe done in {} ms",
+            probe_start.elapsed().as_millis()
+        );
+
+        // Trailing-metadata scan is done; restore real seekability for scrubbing.
+        if let Some(gate) = &probe_seek_gate {
+            gate.store(true, Ordering::Relaxed);
+        }
+
+        let track = format.tracks().iter()
+            .find(|t| t.codec_params.as_ref().and_then(|c| c.audio()).is_some())
             .ok_or_else(|| format!("{source_tag}: no audio track found"))?;
         let track_id = track.id;
-        log_codec_resolution(source_tag, &track.codec_params, format_hint);
+        let audio_params = track
+            .codec_params
+            .as_ref()
+            .and_then(|c| c.audio())
+            .ok_or_else(|| format!("{source_tag}: track has no audio codec parameters"))?
+            .clone();
+        log_codec_resolution(source_tag, &audio_params, format_hint);
         // Live streams have no known total frame count → total_duration = None.
         let total_duration = None;
-        let mut decoder = try_make_radio_decoder(&track.codec_params, &DecoderOptions::default())
+        let mut decoder = try_make_radio_decoder(&audio_params, &AudioDecoderOptions::default().gapless(false))
             .map_err(|e| format!("{source_tag}: codec init failed: {e}"))?;
-        let mut format = probed.format;
 
         let mut errors = 0usize;
         let decoded = loop {
             let packet = match format.next_packet() {
-                Ok(p) => p,
+                Ok(Some(p)) => p,
+                Ok(None) => break decoder.last_decoded(),
                 Err(_) => break decoder.last_decoded(),
             };
-            if packet.track_id() != track_id { continue; }
+            if packet.track_id != track_id { continue; }
             match decoder.decode(&packet) {
                 Ok(d) => break d,
                 Err(symphonia::core::errors::Error::DecodeError(ref msg)) => {
@@ -291,16 +453,15 @@ impl SizedDecoder {
                 Err(e) => return Err(format!("{source_tag}: decode error: {e}")),
             }
         };
-        let spec = decoded.spec().to_owned();
-        let buffer = Self::make_buffer(decoded, &spec);
+        let spec = decoded.spec().clone();
+        let buffer = Self::make_buffer(&decoded);
         Ok(SizedDecoder { decoder, current_frame_offset: 0, format, total_duration, buffer, spec, consecutive_decode_errors: 0 })
     }
 
     #[inline]
-    fn make_buffer(decoded: AudioBufferRef, spec: &SignalSpec) -> SampleBuffer<f32> {
-        let duration = units::Duration::from(decoded.capacity() as u64);
-        let mut buffer = SampleBuffer::<f32>::new(duration, *spec);
-        buffer.copy_interleaved_ref(decoded);
+    fn make_buffer(decoded: &GenericAudioBufferRef<'_>) -> Vec<f32> {
+        let mut buffer = Vec::new();
+        decoded.copy_to_vec_interleaved(&mut buffer);
         buffer
     }
 
@@ -310,29 +471,43 @@ impl SizedDecoder {
         &mut self,
         seek_res: symphonia::core::formats::SeekedTo,
     ) -> Result<(), String> {
-        let mut samples_to_pass = seek_res.required_ts - seek_res.actual_ts;
+        // Number of frames between where the demuxer landed and the requested ts.
+        let mut samples_to_pass: u64 = seek_res
+            .required_ts
+            .get()
+            .saturating_sub(seek_res.actual_ts.get())
+            .max(0) as u64;
         let packet = loop {
-            let candidate = self.format.next_packet()
-                .map_err(|e| format!("refine seek: {e}"))?;
-            if candidate.dur() > samples_to_pass {
+            let candidate = match self.format.next_packet()
+                .map_err(|e| format!("refine seek: {e}"))?
+            {
+                Some(p) => p,
+                // EOF while refining — nothing more to skip.
+                None => return Ok(()),
+            };
+            if candidate.dur.get() > samples_to_pass {
                 break candidate;
             }
-            samples_to_pass -= candidate.dur();
+            samples_to_pass -= candidate.dur.get();
         };
 
         let mut decoded = self.decoder.decode(&packet);
         for _ in 0..DECODE_MAX_RETRIES {
             if decoded.is_err() {
-                let p = self.format.next_packet()
-                    .map_err(|e| format!("refine retry: {e}"))?;
+                let p = match self.format.next_packet()
+                    .map_err(|e| format!("refine retry: {e}"))?
+                {
+                    Some(p) => p,
+                    None => break,
+                };
                 decoded = self.decoder.decode(&p);
             }
         }
 
         let decoded = decoded.map_err(|e| format!("refine decode: {e}"))?;
-        decoded.spec().clone_into(&mut self.spec);
-        self.buffer = Self::make_buffer(decoded, &self.spec);
-        self.current_frame_offset = samples_to_pass as usize * self.spec.channels.count();
+        self.spec = decoded.spec().clone();
+        self.buffer = Self::make_buffer(&decoded);
+        self.current_frame_offset = samples_to_pass as usize * self.spec.channels().count();
         Ok(())
     }
 }
@@ -348,12 +523,12 @@ impl Iterator for SizedDecoder {
             // drop the frame and advance to the next packet. IO errors and a
             // clean end-of-stream both terminate the iterator normally.
             loop {
-                let packet = self.format.next_packet().ok()?;
+                let packet = self.format.next_packet().ok()??;
                 match self.decoder.decode(&packet) {
                     Ok(decoded) => {
                         self.consecutive_decode_errors = 0;
-                        decoded.spec().clone_into(&mut self.spec);
-                        self.buffer = Self::make_buffer(decoded, &self.spec);
+                        self.spec = decoded.spec().clone();
+                        self.buffer = Self::make_buffer(&decoded);
                         self.current_frame_offset = 0;
                         break;
                     }
@@ -384,7 +559,7 @@ impl Iterator for SizedDecoder {
             }
         }
 
-        let sample = *self.buffer.samples().get(self.current_frame_offset)?;
+        let sample = *self.buffer.get(self.current_frame_offset)?;
         self.current_frame_offset += 1;
         Some(sample)
     }
@@ -393,25 +568,24 @@ impl Iterator for SizedDecoder {
 impl Source for SizedDecoder {
     #[inline]
     fn current_span_len(&self) -> Option<usize> {
-        Some(self.buffer.samples().len())
+        Some(self.buffer.len())
     }
 
     #[inline]
     fn channels(&self) -> rodio::ChannelCount {
-        std::num::NonZeroU16::new(self.spec.channels.count() as u16)
+        std::num::NonZeroU16::new(self.spec.channels().count() as u16)
             .unwrap_or(std::num::NonZeroU16::MIN)
     }
 
     #[inline]
     fn sample_rate(&self) -> rodio::SampleRate {
-        std::num::NonZeroU32::new(self.spec.rate).unwrap_or(std::num::NonZeroU32::MIN)
+        std::num::NonZeroU32::new(self.spec.rate()).unwrap_or(std::num::NonZeroU32::MIN)
     }
 
     #[inline]
     fn total_duration(&self) -> Option<Duration> {
-        self.total_duration.map(|Time { seconds, frac }| {
-            Duration::new(seconds, (frac * 1_000_000_000.0) as u32)
-        })
+        self.total_duration
+            .map(|t| Duration::from_secs_f64(t.as_secs_f64().max(0.0)))
     }
 
     fn try_seek(&mut self, pos: Duration) -> Result<(), rodio::source::SeekError> {
@@ -419,36 +593,51 @@ impl Source for SizedDecoder {
             .total_duration()
             .is_some_and(|dur| dur.saturating_sub(pos).as_millis() < 1);
 
-        let time: Time = if seek_beyond_end {
-            let t = self.total_duration.unwrap_or(pos.as_secs_f64().into());
+        let target_secs = if seek_beyond_end {
             // Step back a tiny bit — some demuxers can't seek to the exact end.
-            let mut secs = t.seconds;
-            let mut frac = t.frac - 0.0001;
-            if frac < 0.0 {
-                secs = secs.saturating_sub(1);
-                frac = 1.0 - frac;
-            }
-            Time { seconds: secs, frac }
+            let total = self
+                .total_duration
+                .map(|t| t.as_secs_f64())
+                .unwrap_or_else(|| pos.as_secs_f64());
+            (total - 0.0001).max(0.0)
         } else {
-            pos.as_secs_f64().into()
+            pos.as_secs_f64()
         };
 
+        let time = Time::try_from_secs_f64(target_secs).unwrap_or(Time::ZERO);
+
         let to_skip = self.current_frame_offset % self.channels().get() as usize;
 
-        let seek_res = self
-            .format
-            .seek(SeekMode::Accurate, SeekTo::Time { time, track_id: None })
-            .map_err(|e| rodio::source::SeekError::Other(
-                std::sync::Arc::new(std::io::Error::other(e.to_string()))
-            ))?;
+        // symphonia 0.6's OGG demuxer can `panic!` (e.g. `Option::unwrap()` on
+        // `None` in `OggReader::do_seek`) on some streams instead of returning
+        // an `Err`. `try_seek` runs on rodio's cpal output thread, so an escaping
+        // panic poisons the engine mutexes and then aborts the whole process at
+        // the non-unwinding cpal FFI boundary (the "crash on Stop" is a downstream
+        // symptom of that poison). Contain the unwind here — including the packet
+        // reads in `refine_position`, which can hit the same broken demuxer state —
+        // and surface it as a recoverable `SeekError` so the engine stays alive
+        // (the seek becomes a no-op rather than killing playback).
+        let seek_outcome = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            let seek_res = self
+                .format
+                .seek(SeekMode::Accurate, SeekTo::Time { time, track_id: None })
+                .map_err(|e| e.to_string())?;
+            self.refine_position(seek_res)?;
+            Ok::<(), String>(())
+        }));
 
-        self.refine_position(seek_res)
-            .map_err(|e| rodio::source::SeekError::Other(
-                std::sync::Arc::new(std::io::Error::other(e))
-            ))?;
-
-        self.current_frame_offset += to_skip;
-        Ok(())
+        match seek_outcome {
+            Ok(Ok(())) => {
+                self.current_frame_offset += to_skip;
+                Ok(())
+            }
+            Ok(Err(e)) => Err(rodio::source::SeekError::Other(std::sync::Arc::new(
+                std::io::Error::other(e),
+            ))),
+            Err(_panic) => Err(rodio::source::SeekError::Other(std::sync::Arc::new(
+                std::io::Error::other("seek panicked inside the demuxer (contained)"),
+            ))),
+        }
     }
 }
 
@@ -546,6 +735,7 @@ pub(crate) fn build_source(
     eq_gains: Arc<[AtomicU32; 10]>,
     eq_enabled: Arc<AtomicBool>,
     eq_pre_gain: Arc<AtomicU32>,
+    playback_rate: PlaybackRateAtomics,
     done_flag: Arc<AtomicBool>,
     fade_in_dur: Duration,
     sample_counter: Arc<AtomicU64>,
@@ -616,7 +806,9 @@ pub(crate) fn build_source(
     let fadeout_trigger = Arc::new(AtomicBool::new(false));
     let fadeout_samples = Arc::new(AtomicU64::new(0));
 
-    let eq_src = EqSource::new(dyn_src, eq_gains, eq_enabled, eq_pre_gain);
+    let rate_src = PlaybackRateSource::new(dyn_src, playback_rate.clone());
+    let rate_dyn = DynSource::new(rate_src);
+    let eq_src = EqSource::new(rate_dyn, eq_gains, eq_enabled, eq_pre_gain);
     let fade_in = EqualPowerFadeIn::new(eq_src, fade_in_dur);
     let fade_out = TriggeredFadeOut::new(fade_in, fadeout_trigger.clone(), fadeout_samples.clone());
     let notifying = NotifyingSource::new(fade_out, done_flag);
@@ -625,7 +817,7 @@ pub(crate) fn build_source(
 
     Ok(BuiltSource {
         source: boosted,
-        duration_secs: effective_dur,
+        duration_secs: crate::playback_rate::effective_duration_secs(effective_dur, &playback_rate),
         output_rate,
         output_channels: channels.get(),
         fadeout_trigger,
@@ -643,10 +835,12 @@ pub(crate) fn build_streaming_source(
     eq_gains: Arc<[AtomicU32; 10]>,
     eq_enabled: Arc<AtomicBool>,
     eq_pre_gain: Arc<AtomicU32>,
+    playback_rate: PlaybackRateAtomics,
     done_flag: Arc<AtomicBool>,
     fade_in_dur: Duration,
     sample_counter: Arc<AtomicU64>,
     target_rate: u32,
+    count_gate: Option<Arc<AtomicBool>>,
 ) -> Result<BuiltSource, String> {
     let sample_rate = decoder.sample_rate();
     let channels = decoder.channels();
@@ -681,16 +875,21 @@ pub(crate) fn build_streaming_source(
     let fadeout_trigger = Arc::new(AtomicBool::new(false));
     let fadeout_samples = Arc::new(AtomicU64::new(0));
 
-    let eq_src = EqSource::new(dyn_src, eq_gains, eq_enabled, eq_pre_gain);
+    let rate_src = PlaybackRateSource::new(dyn_src, playback_rate.clone());
+    let rate_dyn = DynSource::new(rate_src);
+    let eq_src = EqSource::new(rate_dyn, eq_gains, eq_enabled, eq_pre_gain);
     let fade_in = EqualPowerFadeIn::new(eq_src, fade_in_dur);
     let fade_out = TriggeredFadeOut::new(fade_in, fadeout_trigger.clone(), fadeout_samples.clone());
     let notifying = NotifyingSource::new(fade_out, done_flag);
-    let counting = CountingSource::new(notifying, sample_counter);
+    let counting = match count_gate {
+        Some(gate) => CountingSource::new_gated(notifying, sample_counter, gate),
+        None => CountingSource::new(notifying, sample_counter),
+    };
     let boosted = PriorityBoostSource::new(counting);
 
     Ok(BuiltSource {
         source: boosted,
-        duration_secs: effective_dur,
+        duration_secs: crate::playback_rate::effective_duration_secs(effective_dur, &playback_rate),
         output_rate,
         output_channels: channels.get(),
         fadeout_trigger,
@@ -830,8 +1029,8 @@ mod tests {
     fn sized_decoder_constructs_from_synthetic_wav() {
         let wav = synthetic_wav_bytes(0.5);
         let decoder = SizedDecoder::new(wav, Some("wav"), false).expect("WAV decode setup");
-        assert_eq!(decoder.spec.rate, 44_100);
-        assert_eq!(decoder.spec.channels.count(), 1);
+        assert_eq!(decoder.spec.rate(), 44_100);
+        assert_eq!(decoder.spec.channels().count(), 1);
     }
 
     #[test]
@@ -846,21 +1045,86 @@ mod tests {
         let _decoder = SizedDecoder::new(wav, Some("wav"), true).expect("WAV decode with hi-res");
     }
 
+    // ── new_streaming + ProbeSeekGate ────────────────────────────────────────
+
+    fn seekable_source(bytes: Vec<u8>) -> Box<dyn MediaSource> {
+        let len = bytes.len() as u64;
+        Box::new(SizedCursorSource { inner: Cursor::new(bytes), len })
+    }
+
+    #[test]
+    fn new_streaming_constructs_from_synthetic_wav() {
+        let wav = synthetic_wav_bytes(0.5);
+        let decoder =
+            SizedDecoder::new_streaming(seekable_source(wav), Some("wav"), "test-stream", true)
+                .expect("streaming WAV decode setup");
+        assert_eq!(decoder.spec.rate(), 44_100);
+        assert_eq!(decoder.spec.channels().count(), 1);
+        // Live streams report no total duration.
+        assert!(decoder.total_duration.is_none());
+    }
+
+    #[test]
+    fn new_streaming_returns_err_for_garbage_input() {
+        let result = SizedDecoder::new_streaming(
+            seekable_source(vec![0x00u8; 64]),
+            None,
+            "test-stream",
+            true,
+        );
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn probe_seek_gate_toggles_seekability() {
+        let wav = synthetic_wav_bytes(0.1);
+        let len = wav.len() as u64;
+        let flag = Arc::new(AtomicBool::new(false));
+        let gate = ProbeSeekGate {
+            inner: seekable_source(wav),
+            seekable: flag.clone(),
+        };
+        // Hidden during probe …
+        assert!(!gate.is_seekable());
+        // … restored afterwards.
+        flag.store(true, Ordering::Relaxed);
+        assert!(gate.is_seekable());
+        // byte_len always passes through to the inner source.
+        assert_eq!(gate.byte_len(), Some(len));
+    }
+
+    #[test]
+    fn probe_seek_gate_read_and_seek_pass_through() {
+        let bytes = vec![1u8, 2, 3, 4, 5, 6, 7, 8];
+        let mut gate = ProbeSeekGate {
+            inner: seekable_source(bytes),
+            seekable: Arc::new(AtomicBool::new(true)),
+        };
+        let mut buf = [0u8; 4];
+        let n = gate.read(&mut buf).expect("read");
+        assert_eq!(n, 4);
+        assert_eq!(&buf, &[1, 2, 3, 4]);
+        let pos = gate.seek(std::io::SeekFrom::Start(6)).expect("seek");
+        assert_eq!(pos, 6);
+        let n = gate.read(&mut buf).expect("read after seek");
+        assert_eq!(&buf[..n], &[7, 8]);
+    }
+
     // ── log_codec_resolution ─────────────────────────────────────────────────
 
     #[test]
     fn log_codec_resolution_does_not_panic_for_valid_params() {
-        let mut params = symphonia::core::codecs::CodecParameters::new();
-        params.codec = symphonia::core::codecs::CODEC_TYPE_PCM_S16LE;
+        let mut params = AudioCodecParameters::new();
+        params.codec = symphonia::core::codecs::audio::well_known::CODEC_ID_PCM_S16LE;
         params.sample_rate = Some(44_100);
         params.bits_per_sample = Some(16);
-        params.channels = Some(symphonia::core::audio::Channels::FRONT_LEFT);
+        params.channels = Some(symphonia::core::audio::Channels::Discrete(1));
         log_codec_resolution("test-tag", &params, Some("wav"));
     }
 
     #[test]
     fn log_codec_resolution_handles_unknown_codec_gracefully() {
-        let params = symphonia::core::codecs::CodecParameters::new();
+        let params = AudioCodecParameters::new();
         log_codec_resolution("unknown", &params, None);
     }
 }
@@ -911,21 +1175,29 @@ mod build_source_tests {
     }
 
     type EqGains = Arc<[AtomicU32; 10]>;
-    type SourceArgs = (EqGains, Arc<AtomicBool>, Arc<AtomicU32>, Arc<AtomicBool>, Arc<AtomicU64>);
+    type SourceArgs = (
+        EqGains,
+        Arc<AtomicBool>,
+        Arc<AtomicU32>,
+        PlaybackRateAtomics,
+        Arc<AtomicBool>,
+        Arc<AtomicU64>,
+    );
 
     fn default_source_args() -> SourceArgs {
         let eq_gains: Arc<[AtomicU32; 10]> =
             Arc::new(std::array::from_fn(|_| AtomicU32::new(0f32.to_bits())));
         let eq_enabled = Arc::new(AtomicBool::new(false));
         let eq_pre_gain = Arc::new(AtomicU32::new(0f32.to_bits()));
+        let playback_rate = PlaybackRateAtomics::new();
         let done_flag = Arc::new(AtomicBool::new(false));
         let sample_counter = Arc::new(AtomicU64::new(0));
-        (eq_gains, eq_enabled, eq_pre_gain, done_flag, sample_counter)
+        (eq_gains, eq_enabled, eq_pre_gain, playback_rate, done_flag, sample_counter)
     }
 
     #[test]
     fn build_source_succeeds_for_synthetic_wav() {
-        let (eq_gains, eq_enabled, eq_pre_gain, done_flag, sample_counter) = default_source_args();
+        let (eq_gains, eq_enabled, eq_pre_gain, playback_rate, done_flag, sample_counter) = default_source_args();
         let wav = synthetic_wav_bytes_local(0.4);
         let built = build_source(
             wav,
@@ -933,6 +1205,7 @@ mod build_source_tests {
             eq_gains,
             eq_enabled,
             eq_pre_gain,
+            playback_rate,
             done_flag,
             Duration::ZERO,
             sample_counter,
@@ -948,13 +1221,14 @@ mod build_source_tests {
 
     #[test]
     fn build_source_returns_err_for_garbage_bytes() {
-        let (eq_gains, eq_enabled, eq_pre_gain, done_flag, sample_counter) = default_source_args();
+        let (eq_gains, eq_enabled, eq_pre_gain, playback_rate, done_flag, sample_counter) = default_source_args();
         let result = build_source(
             vec![0u8; 32],
             0.0,
             eq_gains,
             eq_enabled,
             eq_pre_gain,
+            playback_rate,
             done_flag,
             Duration::ZERO,
             sample_counter,
@@ -967,7 +1241,7 @@ mod build_source_tests {
 
     #[test]
     fn build_streaming_source_succeeds_for_synthetic_wav() {
-        let (eq_gains, eq_enabled, eq_pre_gain, done_flag, sample_counter) = default_source_args();
+        let (eq_gains, eq_enabled, eq_pre_gain, playback_rate, done_flag, sample_counter) = default_source_args();
         let wav = synthetic_wav_bytes_local(0.4);
         let decoder = SizedDecoder::new(wav, Some("wav"), false).unwrap();
         let built = build_streaming_source(
@@ -976,10 +1250,12 @@ mod build_source_tests {
             eq_gains,
             eq_enabled,
             eq_pre_gain,
+            playback_rate,
             done_flag,
             Duration::ZERO,
             sample_counter,
             0,
+            None,
         )
         .expect("build_streaming_source must succeed for a valid WAV decoder");
         assert_eq!(built.output_channels, 1);
@@ -988,7 +1264,7 @@ mod build_source_tests {
 
     #[test]
     fn build_source_with_target_rate_resamples() {
-        let (eq_gains, eq_enabled, eq_pre_gain, done_flag, sample_counter) = default_source_args();
+        let (eq_gains, eq_enabled, eq_pre_gain, playback_rate, done_flag, sample_counter) = default_source_args();
         let wav = synthetic_wav_bytes_local(0.3);
         let built = build_source(
             wav,
@@ -996,6 +1272,7 @@ mod build_source_tests {
             eq_gains,
             eq_enabled,
             eq_pre_gain,
+            playback_rate,
             done_flag,
             Duration::from_millis(5),
             sample_counter,

src-tauri/crates/psysonic-audio/src/dev_io.rs

@@ -27,18 +27,540 @@ pub(crate) fn with_suppressed_alsa_stderr<R>(f: impl FnOnce() -> R) -> R {
 }
 
 pub(crate) fn enumerate_output_device_names() -> Vec<String> {
-    use rodio::cpal::traits::{DeviceTrait, HostTrait};
-    with_suppressed_alsa_stderr(|| {
+    enumerate_output_device_entries()
+        .into_iter()
+        .map(|e| e.key)
+        .collect()
+}
+
+/// Stable key + human label for the settings dropdown.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct OutputDeviceEntry {
+    pub key: String,
+    pub label: String,
+}
+
+pub(crate) fn enumerate_output_device_entries() -> Vec<OutputDeviceEntry> {
+    use rodio::cpal::traits::HostTrait;
+    let mut out = with_suppressed_alsa_stderr(|| {
         let host = rodio::cpal::default_host();
         host.output_devices()
             .map(|iter| {
-                iter.filter_map(|d| d.description().ok().map(|desc| desc.name().to_string()))
-                    .collect()
+                iter.filter_map(|d| {
+                    let key = output_device_stable_key(&d);
+                    if key.is_empty() {
+                        return None;
+                    }
+                    Some(OutputDeviceEntry {
+                        label: output_device_display_label(&d),
+                        key,
+                    })
+                })
+                .collect::<Vec<_>>()
             })
             .unwrap_or_default()
+    });
+    dedupe_output_device_entries(&mut out);
+    out
+}
+
+fn dedupe_output_device_entries(entries: &mut Vec<OutputDeviceEntry>) {
+    let mut seen = std::collections::HashSet::new();
+    entries.retain(|e| seen.insert(e.key.clone()));
+}
+
+/// Stable per-device key for Settings / EQ maps. Linux keeps ALSA-style description
+/// names; Windows/macOS use cpal [`DeviceId`] so same-named endpoints stay distinct
+/// and default-device changes are observable by the watcher.
+pub(crate) fn output_device_stable_key(device: &impl rodio::cpal::traits::DeviceTrait) -> String {
+    #[cfg(not(target_os = "linux"))]
+    {
+        if let Ok(id) = device.id() {
+            return id.to_string();
+        }
+    }
+    device
+        .description()
+        .ok()
+        .map(|d| d.name().to_string())
+        .unwrap_or_else(|| device.id().map(|i| i.to_string()).unwrap_or_default())
+}
+
+/// Human-readable label for the settings dropdown (not the stored key).
+pub(crate) fn output_device_display_label(
+    device: &impl rodio::cpal::traits::DeviceTrait,
+) -> String {
+    match device.description() {
+        Ok(desc) => format_output_device_label(&desc),
+        Err(_) => output_device_stable_key(device),
+    }
+}
+
+pub(crate) fn format_output_device_label(desc: &rodio::cpal::DeviceDescription) -> String {
+    use rodio::cpal::{DeviceType, InterfaceType};
+    let name = desc.name();
+    let mut parts: Vec<String> = vec![name.to_string()];
+    if let Some(mfr) = desc.manufacturer() {
+        if mfr != name && !name.contains(mfr) {
+            parts.push(mfr.to_string());
+        }
+    }
+    if let Some(driver) = desc.driver() {
+        if driver != name && !parts.iter().any(|p| p.contains(driver)) {
+            parts.push(driver.to_string());
+        }
+    }
+    if parts.len() == 1 {
+        let iface = desc.interface_type();
+        if iface != InterfaceType::Unknown && iface != InterfaceType::BuiltIn {
+            parts.push(iface.to_string());
+        } else {
+            let dtype = desc.device_type();
+            if dtype != DeviceType::Unknown && dtype != DeviceType::Speaker {
+                parts.push(dtype.to_string());
+            }
+        }
+    }
+    parts.join(" · ")
+}
+
+/// Best-effort label when a legacy plain-name pin is kept off the current list.
+pub(crate) fn legacy_output_device_display_label(key: &str) -> String {
+    #[cfg(not(target_os = "linux"))]
+    {
+        use rodio::cpal::traits::HostTrait;
+        if let Ok(id) = key.parse::<rodio::cpal::DeviceId>() {
+            if let Some(device) = rodio::cpal::default_host().device_by_id(&id) {
+                return output_device_display_label(&device);
+            }
+        }
+    }
+    key.to_string()
+}
+
+/// Upgrade a pre–DeviceId persisted pin to the current stable key when unambiguous.
+pub(crate) fn resolve_legacy_pinned_key(
+    pinned: &str,
+    entries: &[OutputDeviceEntry],
+) -> Option<String> {
+    if entries.iter().any(|e| e.key == pinned) {
+        return Some(pinned.to_string());
+    }
+    let logic_matches: Vec<_> = entries
+        .iter()
+        .filter(|e| output_devices_logically_same(&e.key, pinned))
+        .collect();
+    if logic_matches.len() == 1 {
+        return Some(logic_matches[0].key.clone());
+    }
+    #[cfg(not(target_os = "linux"))]
+    {
+        let label_matches: Vec<_> = entries
+            .iter()
+            .filter(|e| e.label == pinned || e.label.starts_with(&format!("{pinned} · ")))
+            .collect();
+        if label_matches.len() == 1 {
+            return Some(label_matches[0].key.clone());
+        }
+    }
+    None
+}
+
+/// Resolve a stored device key to a cpal device (DeviceId on Windows/macOS, name on Linux).
+pub(crate) fn resolve_output_device(
+    device_key: &str,
+) -> Option<rodio::cpal::Device> {
+    use rodio::cpal::traits::{DeviceTrait, HostTrait};
+    use std::str::FromStr;
+    let host = rodio::cpal::default_host();
+    if let Ok(id) = rodio::cpal::DeviceId::from_str(device_key) {
+        if let Some(device) = host.device_by_id(&id) {
+            return Some(device);
+        }
+    }
+    host.output_devices().ok()?.find(|d| {
+        output_device_stable_key(d) == device_key
+            || d.description()
+                .ok()
+                .map(|desc| desc.name().to_string())
+                .as_deref()
+                == Some(device_key)
     })
 }
 
+/// cpal/rodio aliases for "follow the OS default" — not a stable per-device key.
+#[cfg(target_os = "linux")]
+pub(crate) fn is_generic_default_output_alias(name: &str) -> bool {
+    matches!(
+        name,
+        "default"
+            | "Default Audio Device"
+            | "PipeWire Sound Server"
+            | "Default ALSA Output (currently PipeWire Media Server)"
+    )
+}
+
+fn raw_cpal_default_output_device_key() -> Option<String> {
+    use rodio::cpal::traits::HostTrait;
+    with_suppressed_alsa_stderr(|| {
+        rodio::cpal::default_host()
+            .default_output_device()
+            .map(|d| output_device_stable_key(&d))
+    })
+}
+
+#[cfg(target_os = "linux")]
+fn pick_listed_device_name(candidate: &str, list: &[String]) -> Option<String> {
+    list.iter()
+        .find(|d| d.as_str() == candidate || output_devices_logically_same(d, candidate))
+        .cloned()
+}
+
+#[cfg(target_os = "linux")]
+fn equivalent_list_entries(name: &str, list: &[String]) -> Vec<String> {
+    let mut out: Vec<String> = list
+        .iter()
+        .filter(|d| d.as_str() == name || output_devices_logically_same(d, name))
+        .cloned()
+        .collect();
+    if let Some(picked) = pick_listed_device_name(name, list) {
+        if !out.iter().any(|d| d == &picked) {
+            out.push(picked);
+        }
+    }
+    if out.is_empty() && !name.is_empty() {
+        out.push(name.to_string());
+    }
+    out
+}
+
+/// True when two device keys refer to the same sink (exact, ALSA logical, or via list canon).
+#[cfg(target_os = "linux")]
+pub(crate) fn output_device_keys_equivalent(a: &str, b: &str, list: &[String]) -> bool {
+    if a == b || output_devices_logically_same(a, b) {
+        return true;
+    }
+    if comma_and_alsa_device_equivalent(a, b) {
+        return true;
+    }
+    let ea = equivalent_list_entries(a, list);
+    let eb = equivalent_list_entries(b, list);
+    ea.iter()
+        .any(|x| eb.iter().any(|y| x == y || output_devices_logically_same(x, y)))
+}
+
+/// Match wpctl/cpal `"CARD, PCM"` labels to ALSA `iface:CARD=…` picker ids.
+#[cfg(target_os = "linux")]
+fn comma_and_alsa_device_equivalent(a: &str, b: &str) -> bool {
+    let (comma, alsa) = if linux_alsa_sink_fingerprint(a).is_some() {
+        (b, a)
+    } else if linux_alsa_sink_fingerprint(b).is_some() {
+        (a, b)
+    } else {
+        return false;
+    };
+    if comma.contains(':') {
+        return false;
+    }
+    let mut parts = comma.splitn(2, ',');
+    let Some(comma_card) = parts.next() else {
+        return false;
+    };
+    let comma_card = comma_card.trim();
+    let comma_pcm = parts.next().map(|s| s.trim()).unwrap_or("");
+    if comma_pcm.is_empty() {
+        return false;
+    }
+    let Some((_, alsa_card, _)) = linux_alsa_sink_fingerprint(alsa) else {
+        return false;
+    };
+    let pcm = comma_pcm.to_ascii_lowercase();
+    let alsa_lower = alsa.to_ascii_lowercase();
+    let cc = comma_card.to_ascii_lowercase();
+    let ac = alsa_card.to_ascii_lowercase();
+    let card_ok = cc.contains(&ac) || ac.contains(&cc);
+    if !card_ok {
+        return false;
+    }
+    if alsa_lower.starts_with("hdmi:") {
+        return !pcm.contains("analog");
+    }
+    if pcm.contains("analog") {
+        return alsa_lower.starts_with("hw:") || alsa_lower.starts_with("plughw:");
+    }
+    alsa_lower.contains(&pcm) || pcm.contains(&alsa_lower)
+}
+
+/// Build the cpal-style `"CARD, PCM name"` label PipeWire exposes for ALSA sinks.
+#[cfg(target_os = "linux")]
+pub(crate) fn cpal_name_from_pipewire_alsa(card: &str, alsa_name: &str) -> String {
+    format!("{card}, {alsa_name}")
+}
+
+/// Read `node.driver-id` from `wpctl inspect` output (PipeWire stream → sink link).
+#[cfg(target_os = "linux")]
+pub(crate) fn parse_wpctl_inspect_driver_id(inspect: &str) -> Option<u32> {
+    for line in inspect.lines() {
+        let line = line.trim().trim_start_matches('*').trim();
+        if let Some(v) = line.strip_prefix("node.driver-id = ") {
+            return v.trim_matches('"').parse().ok();
+        }
+    }
+    None
+}
+
+/// Collect PipeWire ALSA `[psysonic]` stream node ids that have at least one
+/// active playback link in `wpctl status` (ignores stale / idle nodes).
+#[cfg(target_os = "linux")]
+pub(crate) fn parse_wpctl_status_psysonic_stream_ids(status: &str) -> Vec<u32> {
+    let mut in_audio_streams = false;
+    let mut ids = Vec::new();
+    let mut current_id: Option<u32> = None;
+    for line in status.lines() {
+        if line.contains("Streams:") && line.contains('─') {
+            in_audio_streams = true;
+            continue;
+        }
+        if !in_audio_streams {
+            continue;
+        }
+        let trimmed = line.trim();
+        if trimmed.starts_with("Video") || trimmed.starts_with("Settings") {
+            break;
+        }
+        if trimmed.contains("PipeWire ALSA [psysonic]") && !trimmed.contains("(deleted)") {
+            current_id = trimmed
+                .split('.')
+                .next()
+                .and_then(|s| s.trim().parse().ok());
+            continue;
+        }
+        if trimmed.contains('>')
+            && (trimmed.contains("[active]") || trimmed.contains("[init]"))
+        {
+            if let Some(id) = current_id {
+                if !ids.contains(&id) {
+                    ids.push(id);
+                }
+            }
+        } else if trimmed.contains('.') {
+            let prefix = trimmed.split('.').next().unwrap_or("").trim();
+            if prefix.chars().all(|c| c.is_ascii_digit()) && !trimmed.contains('>') {
+                current_id = None;
+            }
+        }
+    }
+    ids
+}
+
+#[cfg(target_os = "linux")]
+fn linux_wpctl_inspect_driver_id(node_id: u32) -> Option<u32> {
+    use std::process::Command;
+    let inspect = Command::new("wpctl")
+        .args(["inspect", &node_id.to_string()])
+        .output()
+        .ok()
+        .filter(|o| o.status.success())
+        .map(|o| String::from_utf8_lossy(&o.stdout).into_owned())?;
+    parse_wpctl_inspect_driver_id(&inspect)
+}
+
+/// True when a live psysonic PipeWire stream is already routed to the default sink.
+/// Hyprpanel / WirePlumber often migrate streams on `set-default` before our poll
+/// sees the change — reopening CPAL in that case only causes an audible glitch.
+#[cfg(target_os = "linux")]
+pub(crate) fn linux_psysonic_stream_routes_to_default_sink() -> bool {
+    use std::process::Command;
+    let Some(default_id) = linux_wpctl_default_sink_id() else {
+        return false;
+    };
+    let Some(status) = Command::new("wpctl")
+        .args(["status"])
+        .output()
+        .ok()
+        .filter(|o| o.status.success())
+        .map(|o| String::from_utf8_lossy(&o.stdout).into_owned())
+    else {
+        return false;
+    };
+    let stream_ids = parse_wpctl_status_psysonic_stream_ids(&status);
+    stream_ids.iter().any(|&id| linux_wpctl_inspect_driver_id(id) == Some(default_id))
+}
+
+/// Parse `wpctl list audio sinks` and return the id of the default sink (trailing `*`).
+#[cfg(target_os = "linux")]
+pub(crate) fn parse_wpctl_list_default_sink_id(listing: &str) -> Option<u32> {
+    for line in listing.lines() {
+        let line = line.trim_end();
+        if !line.ends_with('*') {
+            continue;
+        }
+        let id_str = line.split('\t').next()?.trim();
+        return id_str.parse().ok();
+    }
+    None
+}
+
+/// Parse `wpctl status` and return the id of the default sink (line marked with `*`).
+#[cfg(target_os = "linux")]
+pub(crate) fn parse_wpctl_default_sink_id(status: &str) -> Option<u32> {
+    let mut in_sinks = false;
+    for line in status.lines() {
+        if line.contains("Sinks:") {
+            in_sinks = true;
+            continue;
+        }
+        if !in_sinks {
+            continue;
+        }
+        if line.contains("Sources:") {
+            break;
+        }
+        if !line.contains('*') {
+            continue;
+        }
+        let after_star = line.split('*').nth(1)?.trim();
+        let id_str = after_star.split('.').next()?.trim();
+        return id_str.parse().ok();
+    }
+    None
+}
+
+/// Read `api.alsa.card.name` + `alsa.name` from `wpctl inspect` output.
+#[cfg(target_os = "linux")]
+pub(crate) fn parse_wpctl_inspect_alsa_names(inspect: &str) -> Option<(String, String)> {
+    let mut card: Option<String> = None;
+    let mut pcm: Option<String> = None;
+    for line in inspect.lines() {
+        let line = line.trim();
+        if let Some(v) = line.strip_prefix("api.alsa.card.name = ") {
+            card = Some(v.trim_matches('"').to_string());
+        } else if card.is_none() {
+            if let Some(v) = line.strip_prefix("alsa.card_name = ") {
+                card = Some(v.trim_matches('"').to_string());
+            }
+        }
+        if let Some(v) = line.strip_prefix("alsa.name = ") {
+            pcm = Some(v.trim_matches('"').to_string());
+        }
+    }
+    match (card, pcm) {
+        (Some(c), Some(n)) if !c.is_empty() && !n.is_empty() => Some((c, n)),
+        _ => None,
+    }
+}
+
+#[cfg(target_os = "linux")]
+fn linux_wpctl_default_sink_id() -> Option<u32> {
+    use std::process::Command;
+    let listing = Command::new("wpctl")
+        .args(["list", "audio", "sinks"])
+        .output()
+        .ok()
+        .filter(|o| o.status.success())
+        .map(|o| String::from_utf8_lossy(&o.stdout).into_owned());
+    if let Some(ref text) = listing {
+        if let Some(id) = parse_wpctl_list_default_sink_id(text) {
+            return Some(id);
+        }
+    }
+    let status = Command::new("wpctl")
+        .args(["status"])
+        .output()
+        .ok()
+        .filter(|o| o.status.success())
+        .map(|o| String::from_utf8_lossy(&o.stdout).into_owned())?;
+    parse_wpctl_default_sink_id(&status)
+}
+
+/// Read `node.description` from `wpctl inspect` (Bluetooth and other non-ALSA sinks).
+#[cfg(target_os = "linux")]
+pub(crate) fn parse_wpctl_inspect_node_description(inspect: &str) -> Option<String> {
+    for line in inspect.lines() {
+        let line = line.trim().trim_start_matches('*').trim();
+        if let Some(v) = line.strip_prefix("node.description = ") {
+            let desc = v.trim_matches('"').to_string();
+            if !desc.is_empty() {
+                return Some(desc);
+            }
+        }
+    }
+    None
+}
+
+#[cfg(target_os = "linux")]
+fn linux_resolve_default_via_pipewire(list: &[String]) -> Option<String> {
+    use std::process::Command;
+    let sink_id = linux_wpctl_default_sink_id()?;
+    let inspect = Command::new("wpctl")
+        .args(["inspect", &sink_id.to_string()])
+        .output()
+        .ok()
+        .filter(|o| o.status.success())
+        .map(|o| String::from_utf8_lossy(&o.stdout).into_owned())?;
+    let candidate = if let Some((card, pcm)) = parse_wpctl_inspect_alsa_names(&inspect) {
+        cpal_name_from_pipewire_alsa(&card, &pcm)
+    } else {
+        parse_wpctl_inspect_node_description(&inspect)?
+    };
+    pick_listed_device_name(&candidate, list).or(Some(candidate))
+}
+
+/// Resolve the active default output to a device key that matches `audio_list_devices`
+/// when possible. On Linux/PipeWire, cpal's default is often a generic alias or a
+/// stale card name that does not track WirePlumber default changes (Hyprpanel,
+/// pavucontrol, `wpctl set-default`, etc.) — prefer `wpctl` when available.
+pub fn effective_default_output_device_name() -> Option<String> {
+    resolve_effective_default_output_device_name(true)
+}
+
+/// Same as [`effective_default_output_device_name`] but skips the full
+/// `output_devices()` scan — for the device-watcher poll path (#996).
+pub(crate) fn effective_default_output_device_name_for_poll() -> Option<String> {
+    resolve_effective_default_output_device_name(false)
+}
+
+fn resolve_effective_default_output_device_name(enumerate_devices: bool) -> Option<String> {
+    // Windows/macOS: single cpal default query (pre-#1274). Full `output_devices()`
+    // enumeration contends with WASAPI/CoreAudio and is only needed for Linux/PipeWire
+    // default resolution + ALSA logical key matching.
+    #[cfg(not(target_os = "linux"))]
+    {
+        let _ = enumerate_devices;
+        return raw_cpal_default_output_device_key();
+    }
+
+    #[cfg(target_os = "linux")]
+    {
+        let list = if enumerate_devices {
+            enumerate_output_device_names()
+        } else {
+            Vec::new()
+        };
+        if let Some(resolved) = linux_resolve_default_via_pipewire(&list) {
+            return Some(resolved);
+        }
+        if !enumerate_devices {
+            // wpctl unavailable — last-resort cpal (skip generic/stale placeholder names).
+            if linux_wpctl_default_sink_id().is_none() {
+                if let Some(raw) = raw_cpal_default_output_device_key() {
+                    if !is_generic_default_output_alias(&raw) {
+                        return Some(raw);
+                    }
+                }
+            }
+            return None;
+        }
+        let raw = raw_cpal_default_output_device_key();
+        if let Some(ref name) = raw {
+            if !is_generic_default_output_alias(name) {
+                return pick_listed_device_name(name, &list).or_else(|| Some(name.clone()));
+            }
+        }
+        raw
+    }
+}
+
 /// Linux ALSA-style cpal names: same physical sink can appear with different suffixes;
 /// busy devices are sometimes omitted from `output_devices()` while playback works.
 #[cfg(target_os = "linux")]
@@ -72,6 +594,20 @@ pub(crate) fn output_devices_logically_same(a: &str, b: &str) -> bool {
     if a == b {
         return true;
     }
+    #[cfg(not(target_os = "linux"))]
+    {
+        if let (Ok(ida), Ok(idb)) = (
+            a.parse::<rodio::cpal::DeviceId>(),
+            b.parse::<rodio::cpal::DeviceId>(),
+        ) {
+            return ida.1 == idb.1;
+        }
+        if legacy_description_key_matches_device_id(a, b)
+            || legacy_description_key_matches_device_id(b, a)
+        {
+            return true;
+        }
+    }
     match (
         linux_alsa_sink_fingerprint(a),
         linux_alsa_sink_fingerprint(b),
@@ -81,7 +617,32 @@ pub(crate) fn output_devices_logically_same(a: &str, b: &str) -> bool {
     }
 }
 
+/// Pre–DeviceId persisted pins (description names) vs cpal `DeviceId` enumeration keys.
+#[cfg(not(target_os = "linux"))]
+fn legacy_description_key_matches_device_id(legacy: &str, device_id_key: &str) -> bool {
+    use rodio::cpal::traits::{DeviceTrait, HostTrait};
+    use std::str::FromStr;
+    if legacy.parse::<rodio::cpal::DeviceId>().is_ok() {
+        return false;
+    }
+    let Ok(id) = rodio::cpal::DeviceId::from_str(device_id_key) else {
+        return legacy == device_id_key;
+    };
+    let Some(device) = rodio::cpal::default_host().device_by_id(&id) else {
+        return false;
+    };
+    let Ok(desc) = device.description() else {
+        return false;
+    };
+    if desc.name() == legacy {
+        return true;
+    }
+    let label = output_device_display_label(&device);
+    label == legacy || label.starts_with(&format!("{legacy} · "))
+}
+
 /// True if `pinned` is the same sink as some entry (exact or Linux ALSA logical match).
+#[cfg(not(target_os = "linux"))]
 pub(crate) fn output_enumeration_includes_pinned(available: &[String], pinned: &str) -> bool {
     available
         .iter()
@@ -110,18 +671,21 @@ mod tests {
     // ── output_enumeration_includes_pinned ────────────────────────────────────
 
     #[test]
+    #[cfg(not(target_os = "linux"))]
     fn includes_pinned_finds_exact_match() {
         let avail = vec!["A".to_string(), "B".to_string(), "C".to_string()];
         assert!(output_enumeration_includes_pinned(&avail, "B"));
     }
 
     #[test]
+    #[cfg(not(target_os = "linux"))]
     fn includes_pinned_returns_false_when_absent() {
         let avail = vec!["A".to_string(), "B".to_string()];
         assert!(!output_enumeration_includes_pinned(&avail, "Z"));
     }
 
     #[test]
+    #[cfg(not(target_os = "linux"))]
     fn includes_pinned_returns_false_for_empty_list() {
         let avail: Vec<String> = vec![];
         assert!(!output_enumeration_includes_pinned(&avail, "anything"));
@@ -188,4 +752,165 @@ mod tests {
         assert!(linux_alsa_sink_fingerprint("hdmi:CARD=X,DEV=0").is_none());
         assert!(linux_alsa_sink_fingerprint("anything").is_none());
     }
+
+    // ── generic default alias / PipeWire wpctl parsing ────────────────────────
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn generic_default_alias_detects_cpal_pipewire_placeholders() {
+        assert!(is_generic_default_output_alias("Default Audio Device"));
+        assert!(is_generic_default_output_alias("PipeWire Sound Server"));
+        assert!(!is_generic_default_output_alias("HDA NVidia, Gigabyte M32U"));
+    }
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn parse_wpctl_status_psysonic_stream_ids_accepts_init_links_when_paused() {
+        let status = r#"
+Audio
+ └─ Streams:
+        84. PipeWire ALSA [psysonic]
+             90. output_FL       > ALC897 Analog:playback_FL	[init]
+"#;
+        assert_eq!(parse_wpctl_status_psysonic_stream_ids(status), vec![84]);
+    }
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn parse_wpctl_status_psysonic_stream_ids_ignores_streams_without_links() {
+        let status = r#"
+Audio
+ └─ Streams:
+        84. PipeWire ALSA [psysonic]
+        87. PipeWire ALSA [psysonic]
+            106. output_FL       > HDMI:playback_FL	[active]
+"#;
+        assert_eq!(parse_wpctl_status_psysonic_stream_ids(status), vec![87]);
+    }
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn parse_wpctl_status_psysonic_stream_ids_finds_active_streams() {
+        let status = r#"
+Audio
+ └─ Streams:
+        84. PipeWire ALSA [psysonic]
+             90. output_FL       > ALC897 Analog:playback_FL	[active]
+       119. PipeWire ALSA [psysonic (deleted)]
+Video
+"#;
+        assert_eq!(
+            parse_wpctl_status_psysonic_stream_ids(status),
+            vec![84]
+        );
+    }
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn parse_wpctl_inspect_driver_id_reads_node_driver() {
+        let inspect = r#"
+  * node.driver-id = "58"
+    node.name = "alsa_playback.psysonic"
+"#;
+        assert_eq!(parse_wpctl_inspect_driver_id(inspect), Some(58));
+    }
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn parse_wpctl_list_default_sink_id_finds_starred_sink() {
+        let listing = "56\talsa_output.pci-hdmi\taudio/sink\t\n58\talsa_output.pci-analog\taudio/sink\t*";
+        assert_eq!(parse_wpctl_list_default_sink_id(listing), Some(58));
+    }
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn parse_wpctl_default_sink_id_finds_starred_sink() {
+        let status = r#"
+Audio
+ ├─ Devices:
+ ├─ Sinks:
+ │      56. HDMI out
+ │  *   58. Analog out
+ ├─ Sources:
+"#;
+        assert_eq!(parse_wpctl_default_sink_id(status), Some(58));
+    }
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn parse_wpctl_inspect_alsa_names_reads_card_and_pcm() {
+        let inspect = r#"
+    api.alsa.card.name = "HD-Audio Generic"
+    alsa.name = "ALC897 Analog"
+"#;
+        assert_eq!(
+            parse_wpctl_inspect_alsa_names(inspect),
+            Some(("HD-Audio Generic".into(), "ALC897 Analog".into()))
+        );
+        assert_eq!(
+            cpal_name_from_pipewire_alsa("HD-Audio Generic", "ALC897 Analog"),
+            "HD-Audio Generic, ALC897 Analog"
+        );
+    }
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn parse_wpctl_inspect_node_description_reads_bluetooth_sink() {
+        let inspect = r#"
+  * node.description = "BlueZ Audio Device"
+    node.name = "bluez_output.xxx"
+"#;
+        assert_eq!(
+            parse_wpctl_inspect_node_description(inspect),
+            Some("BlueZ Audio Device".into())
+        );
+    }
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn output_device_keys_equivalent_links_hdmi_comma_and_alsa_id() {
+        assert!(output_device_keys_equivalent(
+            "HDA NVidia, Gigabyte M32U",
+            "hdmi:CARD=NVidia,DEV=3",
+            &[],
+        ));
+    }
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn output_device_keys_equivalent_distinguishes_analog_and_hdmi() {
+        assert!(!output_device_keys_equivalent(
+            "HD-Audio Generic, ALC897 Analog",
+            "hdmi:CARD=HD-Audio Generic,DEV=3",
+            &[],
+        ));
+    }
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn pick_listed_device_name_prefers_enumerated_entry() {
+        let list = vec![
+            "Default Audio Device".to_string(),
+            "HDA NVidia, Gigabyte M32U".to_string(),
+        ];
+        assert_eq!(
+            pick_listed_device_name("HDA NVidia, Gigabyte M32U", &list),
+            Some("HDA NVidia, Gigabyte M32U".to_string())
+        );
+    }
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn pick_listed_device_name_matches_linux_alsa_logical_alias() {
+        let list = vec!["hdmi:CARD=NVidia,DEV=3".to_string()];
+        assert_eq!(
+            pick_listed_device_name("hw:CARD=NVidia,DEV=3", &list),
+            None,
+            "different ALSA ifaces are not logically the same"
+        );
+        assert_eq!(
+            pick_listed_device_name("hdmi:CARD=NVidia,DEV=3", &list),
+            Some("hdmi:CARD=NVidia,DEV=3".to_string())
+        );
+    }
 }

src-tauri/crates/psysonic-audio/src/device_commands.rs

@@ -2,74 +2,140 @@
 //! `commands.rs` so playback / radio / EQ aren't entangled with the device
 //! enumeration + reopen path.
 
-use std::sync::Arc;
 use std::sync::atomic::Ordering;
-use std::time::Duration;
 
 use tauri::{Emitter, State};
 
 use super::dev_io::{
-    enumerate_output_device_names, output_devices_logically_same,
-    output_enumeration_includes_pinned, with_suppressed_alsa_stderr,
+    enumerate_output_device_entries, legacy_output_device_display_label,
+    output_devices_logically_same, resolve_legacy_pinned_key, OutputDeviceEntry,
 };
+#[cfg(target_os = "linux")]
+use super::dev_io::output_device_keys_equivalent;
 use super::engine::AudioEngine;
 
+/// One row in the audio output device picker (`key` is persisted; `label` is display-only).
+#[derive(Debug, Clone, serde::Serialize, specta::Type)]
+pub struct AudioOutputDeviceEntry {
+    pub key: String,
+    pub label: String,
+}
+
+impl From<OutputDeviceEntry> for AudioOutputDeviceEntry {
+    fn from(e: OutputDeviceEntry) -> Self {
+        Self {
+            key: e.key,
+            label: e.label,
+        }
+    }
+}
+
+fn list_output_device_entries(engine: &AudioEngine) -> Vec<AudioOutputDeviceEntry> {
+    let mut list: Vec<AudioOutputDeviceEntry> = enumerate_output_device_entries()
+        .into_iter()
+        .map(Into::into)
+        .collect();
+    if let Some(ref name) = *engine.selected_device.lock().unwrap() {
+        if !name.is_empty()
+            && !list
+                .iter()
+                .any(|e| output_devices_logically_same(&e.key, name))
+        {
+            list.push(AudioOutputDeviceEntry {
+                key: name.clone(),
+                label: legacy_output_device_display_label(name),
+            });
+        }
+    }
+    list
+}
+
 /// When the saved `selected_device` no longer literally matches any listed
 /// physical sink (e.g. suffix drift), rewrite `selected_device` to the listed form.
 #[tauri::command]
+#[specta::specta]
 pub fn audio_canonicalize_selected_device(state: State<'_, AudioEngine>) -> Option<String> {
     let pinned = state.selected_device.lock().unwrap().clone()?;
     if pinned.is_empty() {
         return None;
     }
-    let list = enumerate_output_device_names();
-    if list.iter().any(|d| d == &pinned) {
+    let entries = list_output_device_entries(&state);
+    if entries.iter().any(|e| e.key == pinned) {
         return None;
     }
-    let canon = list
+    if let Some(upgraded) = resolve_legacy_pinned_key(&pinned, &enumerate_output_device_entries()) {
+        if upgraded != pinned {
+            *state.selected_device.lock().unwrap() = Some(upgraded.clone());
+            return Some(upgraded);
+        }
+    }
+    let canon = entries
         .iter()
-        .find(|d| output_devices_logically_same(d, &pinned))?
+        .find(|e| output_devices_logically_same(&e.key, &pinned))?
+        .key
         .clone();
     *state.selected_device.lock().unwrap() = Some(canon.clone());
     Some(canon)
 }
 
 /// Same device list as [`audio_list_devices`] without the Tauri `State` wrapper (CLI / single-instance).
-pub fn audio_list_devices_for_engine(engine: &AudioEngine) -> Vec<String> {
-    let mut list = enumerate_output_device_names();
-    if let Some(ref name) = *engine.selected_device.lock().unwrap() {
-        if !name.is_empty() && !output_enumeration_includes_pinned(&list, name) {
-            list.push(name.clone());
-        }
-    }
-    list
+pub fn audio_list_devices_for_engine(engine: &AudioEngine) -> Vec<AudioOutputDeviceEntry> {
+    list_output_device_entries(engine)
 }
 
-/// Returns the names of all available audio output devices on the current host.
+/// Returns the keys of all available audio output devices on the current host.
 /// On Linux, ALSA probes unavailable backends (JACK, OSS, dmix) and prints errors to
 /// stderr. We suppress fd 2 for the duration of enumeration to keep the terminal clean.
 ///
-/// The user-pinned device name is appended when cpal omits it (e.g. HDMI busy while
+/// The user-pinned device is appended when cpal omits it (e.g. HDMI busy while
 /// streaming) so the Settings dropdown still matches `audioOutputDevice`.
 #[tauri::command]
-pub fn audio_list_devices(state: State<'_, AudioEngine>) -> Vec<String> {
+#[specta::specta]
+pub fn audio_list_devices(state: State<'_, AudioEngine>) -> Vec<AudioOutputDeviceEntry> {
     audio_list_devices_for_engine(&state)
 }
 
 /// Device id string for the host default output (matches an entry from `audio_list_devices` when present).
 #[tauri::command]
+#[specta::specta]
 pub fn audio_default_output_device_name() -> Option<String> {
-    use rodio::cpal::traits::{DeviceTrait, HostTrait};
-    with_suppressed_alsa_stderr(|| {
-        let host = rodio::cpal::default_host();
-        host.default_output_device()
-            .and_then(|d| d.description().ok().map(|desc| desc.name().to_string()))
-    })
+    super::dev_io::effective_default_output_device_name()
+}
+
+/// Lightweight default query for EQ poll — skips full `output_devices()` scan (#996).
+#[tauri::command]
+#[specta::specta]
+pub fn audio_default_output_device_name_for_poll() -> Option<String> {
+    super::dev_io::effective_default_output_device_name_for_poll()
+}
+
+/// Find a stored per-device EQ key that denotes the same sink as `candidate`
+/// (exact or Linux ALSA logical match).
+#[tauri::command]
+#[specta::specta]
+pub fn audio_match_stored_output_device_key(
+    candidate: String,
+    stored_keys: Vec<String>,
+) -> Option<String> {
+    #[cfg(not(target_os = "linux"))]
+    {
+        return stored_keys
+            .into_iter()
+            .find(|k| output_devices_logically_same(k, &candidate));
+    }
+    #[cfg(target_os = "linux")]
+    {
+        let list = super::dev_io::enumerate_output_device_names();
+        stored_keys
+            .into_iter()
+            .find(|k| output_device_keys_equivalent(k, &candidate, &list))
+    }
 }
 
 /// Switch the audio output device. `device_name = null` → follow system default.
 /// Reopens the stream immediately; frontend must restart playback via audio:device-changed.
 #[tauri::command]
+#[specta::specta]
 pub async fn audio_set_device(
     device_name: Option<String>,
     state: State<'_, AudioEngine>,
@@ -78,21 +144,27 @@ pub async fn audio_set_device(
     *state.selected_device.lock().unwrap() = device_name.clone();
 
     let rate = state.stream_sample_rate.load(Ordering::Relaxed);
-    let (reply_tx, reply_rx) = std::sync::mpsc::sync_channel::<Arc<rodio::MixerDeviceSink>>(0);
-    state.stream_reopen_tx
-        .send((rate, false, device_name, reply_tx))
-        .map_err(|e| e.to_string())?;
+    let open_rate = if rate > 0 {
+        rate
+    } else {
+        state.device_default_rate
+    };
+    super::engine::open_output_stream_blocking(&state, open_rate, false, device_name.clone())
+        .map_err(|_| "device open timed out".to_string())?;
 
-    let new_handle = tauri::async_runtime::spawn_blocking(move || {
-        reply_rx.recv_timeout(Duration::from_secs(5)).ok()
-    }).await.unwrap_or(None).ok_or("device open timed out")?;
-
-    *state.stream_handle.lock().unwrap() = new_handle;
-
-    // Drop active sinks — they were bound to the old stream.
-    if let Some(s) = state.current.lock().unwrap().sink.take() { s.stop(); }
+    // Capture position and drop the active sink atomically so the position
+    // reading is still valid (play_started / paused_at intact before take).
+    let current_time = {
+        let mut cur = state.current.lock().unwrap();
+        let pos = cur.position();
+        if let Some(s) = cur.sink.take() { s.stop(); }
+        pos
+    };
     if let Some(s) = state.fading_out_sink.lock().unwrap().take() { s.stop(); }
 
-    app.emit("audio:device-changed", ()).map_err(|e| e.to_string())?;
+    // Emit the saved position so the frontend can use seekFallbackVisualTarget
+    // and resume from where the track was, rather than restarting from the beginning.
+    // null is reserved for "Rust already resumed internally" (see reopen_output_stream).
+    app.emit("audio:device-changed", current_time).map_err(|e| e.to_string())?;
     Ok(())
 }

src-tauri/crates/psysonic-audio/src/device_resume.rs

@@ -0,0 +1,285 @@
+//! Rust-side seamless replay after an output-device switch.
+//!
+//! `try_resume_after_device_change` is called from `reopen_output_stream`
+//! (device_watcher.rs) after the new CPAL stream is ready and the old sink
+//! has been stopped. It attempts to restart the current track on the new
+//! device without any frontend round-trip.
+//!
+//! Supported source paths (in order of preference):
+//!   - `psysonic-local://` — opened directly from disk via `LocalFileSource`.
+//!   - HTTP, fully cached in RAM — replayed from `stream_completed_cache`.
+//!   - HTTP, spilled to disk — bytes read from `stream_completed_spill`.
+//!
+//! Falls back to the frontend (returns `false`) for:
+//!   - paused playback
+//!   - radio / live stream
+//!   - HTTP track whose download was only partial
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+use std::time::Instant;
+
+use rodio::Player;
+use tauri::Emitter;
+use tauri::Manager;
+
+use super::engine::AudioEngine;
+use super::play_input::{url_format_hint, PlayInput};
+use super::source_build::{
+    build_playback_source_with_probe_fallback, BuildSourceArgs, PlaybackSource,
+};
+use super::sink_swap::{swap_in_new_sink, SinkSwapInputs};
+use super::progress_task::spawn_progress_task;
+use super::stream::LocalFileSource;
+
+/// Snapshot of playback state captured before the blocking stream reopen.
+pub(crate) struct ResumeSnapshot {
+    pub(crate) url: Option<String>,
+    pub(crate) current_time_secs: f64,
+    pub(crate) duration_secs: f64,
+    pub(crate) base_volume: f32,
+    pub(crate) gain_linear: f32,
+    pub(crate) analysis_track_id: Option<String>,
+    pub(crate) is_playing: bool,
+}
+
+/// Try to replay the current track on the new device without involving the
+/// frontend. Returns `true` if playback was successfully restarted.
+///
+/// Conditions that cause an immediate `false` (frontend fallback):
+/// - Paused playback — user can press play on the new device via the cold path.
+/// - Radio stream — live, non-seekable; frontend handles reconnect.
+/// - No current URL — nothing was playing.
+/// - HTTP track whose download was only partial (cache/spill absent) — frontend
+///   re-fetches from the server via the seekFallbackVisualTarget path.
+pub(crate) async fn try_resume_after_device_change(
+    app: &tauri::AppHandle,
+    snap: &ResumeSnapshot,
+) -> bool {
+    // Only resume actively-playing (not paused) tracks.
+    if !snap.is_playing {
+        return false;
+    }
+    let url = match snap.url.as_deref() {
+        Some(u) if !u.is_empty() => u,
+        _ => return false,
+    };
+
+    let Some(engine) = app.try_state::<AudioEngine>() else {
+        return false;
+    };
+
+    // Skip radio — live streams don't have a resume position.
+    if engine.radio_state.lock().unwrap().is_some() {
+        return false;
+    }
+
+    // Build a PlayInput without re-downloading:
+    //   - psysonic-local://  → seekable file
+    //   - HTTP, fully cached → in-memory bytes (stream_completed_cache)
+    //   - HTTP, spilled      → bytes read from spill file
+    //   - HTTP, partial      → return false (frontend will re-fetch)
+    let play_input: PlayInput = if url.starts_with("psysonic-local://") {
+        let path = url.strip_prefix("psysonic-local://").unwrap_or(url);
+        match std::fs::File::open(path) {
+            Ok(file) => {
+                let len = file.metadata().map(|m| m.len()).unwrap_or(0);
+                PlayInput::SeekableMedia {
+                    reader: Box::new(LocalFileSource { file, len }),
+                    format_hint: url_format_hint(url),
+                    tag: "LocalFile[device-resume]",
+                    random_access: true,
+                    mp4_probe_gate: None,
+                }
+            }
+            Err(e) => {
+                crate::app_eprintln!("[device-resume] cannot open local file: {e}");
+                return false;
+            }
+        }
+    } else {
+        // HTTP track — use completed in-memory cache or spill file.
+        // If the download was only partial, fall back to the frontend path
+        // which will re-fetch from the server.
+        let ram_bytes = {
+            let guard = engine.stream_completed_cache.lock().unwrap();
+            guard.as_ref().filter(|t| t.url == url).map(|t| t.data.clone())
+        };
+        let bytes = if let Some(b) = ram_bytes {
+            b
+        } else {
+            let spill_path = {
+                let guard = engine.stream_completed_spill.lock().unwrap();
+                guard.as_ref().filter(|s| s.url == url).map(|s| s.path.clone())
+            };
+            match spill_path {
+                Some(p) => match std::fs::read(&p) {
+                    Ok(b) => b,
+                    Err(e) => {
+                        crate::app_eprintln!("[device-resume] spill read failed: {e}");
+                        return false;
+                    }
+                },
+                None => return false, // not fully cached yet — frontend will re-fetch
+            }
+        };
+        PlayInput::Bytes(bytes)
+    };
+
+    // Bump generation so the old progress task exits cleanly.
+    let gen = engine.generation.fetch_add(1, Ordering::SeqCst) + 1;
+    engine.stream_playback_armed.store(true, Ordering::SeqCst);
+    *engine.chained_info.lock().unwrap() = None;
+    *engine.current_playback_url.lock().unwrap() = Some(url.to_owned());
+
+    if engine.generation.load(Ordering::SeqCst) != gen {
+        return false; // raced with another audio_play
+    }
+
+    let format_hint = url_format_hint(url);
+    let stream_format_suffix: Option<String> = url
+        .rsplit('.')
+        .next()
+        .and_then(|e| e.split('?').next())
+        .map(|s| s.to_lowercase());
+    let done_flag = Arc::new(AtomicBool::new(false));
+    engine.samples_played.store(0, Ordering::Relaxed);
+
+    let hi_res_enabled = engine.current_sample_rate.load(Ordering::Relaxed) > 48_000;
+    // Resume re-plays the current track → scope its analysis writes to the
+    // pinned playback server (empty → legacy '').
+    let resume_server = crate::helpers::current_playback_server_id_str(&engine);
+
+    let ps: PlaybackSource = match build_playback_source_with_probe_fallback(
+        play_input,
+        BuildSourceArgs {
+            url,
+            gen,
+            cache_id_for_tasks: snap.analysis_track_id.as_deref(),
+            server_id: Some(resume_server.as_str()),
+            url_format_hint: format_hint.as_deref(),
+            stream_format_suffix: stream_format_suffix.as_deref(),
+            done_flag: done_flag.clone(),
+            fade_in_dur: std::time::Duration::from_millis(5),
+            hi_res_enabled,
+            resample_target_hz: 0,
+            duration_hint: snap.duration_secs,
+        },
+        &engine,
+        app,
+    )
+    .await
+    {
+        Ok(ps) => ps,
+        Err(e) => {
+            crate::app_eprintln!("[device-resume] source build failed: {e}");
+            return false;
+        }
+    };
+
+    if engine.generation.load(Ordering::SeqCst) != gen {
+        return false;
+    }
+
+    engine
+        .current_is_seekable
+        .store(ps.is_seekable, Ordering::SeqCst);
+    engine
+        .current_sample_rate
+        .store(ps.built.output_rate, Ordering::Relaxed);
+    engine
+        .current_channels
+        .store(ps.built.output_channels as u32, Ordering::Relaxed);
+
+    let stream = match super::engine::ensure_output_stream_open(&engine) {
+        Ok(s) => s,
+        Err(e) => {
+            crate::app_eprintln!("[device-resume] output stream open failed: {e}");
+            return false;
+        }
+    };
+    let sink = Arc::new(Player::connect_new(stream.mixer()));
+    let effective_volume = (snap.base_volume * snap.gain_linear).clamp(0.0, 1.0);
+    sink.set_volume(effective_volume);
+    sink.append(ps.built.source);
+
+    swap_in_new_sink(
+        &engine,
+        SinkSwapInputs {
+            sink,
+            duration_secs: ps.built.duration_secs,
+            volume: snap.base_volume,
+            gain_linear: snap.gain_linear,
+            fadeout_trigger: ps.built.fadeout_trigger,
+            fadeout_samples: ps.built.fadeout_samples,
+            crossfade_enabled: false,
+            actual_fade_secs: 0.0,
+            outgoing_fade_secs: 0.0,
+            start_paused: false,
+        },
+    );
+
+    // Seek to the saved position for seekable sources (local files, ranged HTTP).
+    if ps.is_seekable && snap.current_time_secs > 0.5 {
+        let seek_sink = engine.current.lock().unwrap().sink.as_ref().map(Arc::clone);
+        if let Some(sk) = seek_sink {
+            let target = std::time::Duration::from_secs_f64(snap.current_time_secs.max(0.0));
+            let (tx, rx) = std::sync::mpsc::channel::<Result<(), String>>();
+            std::thread::spawn(move || {
+                let _ = tx.send(sk.try_seek(target).map_err(|e| e.to_string()));
+            });
+            match rx.recv_timeout(std::time::Duration::from_millis(700)) {
+                Ok(Ok(())) => {
+                    let mut cur = engine.current.lock().unwrap();
+                    cur.seek_offset = snap.current_time_secs;
+                    cur.play_started = Some(Instant::now());
+                    engine.samples_played.store(
+                        crate::playback_rate::raw_counter_samples_for_content_position(
+                            snap.current_time_secs,
+                            engine.current_sample_rate.load(Ordering::Relaxed),
+                            engine.current_channels.load(Ordering::Relaxed),
+                            &engine.playback_rate,
+                        ),
+                        Ordering::Relaxed,
+                    );
+                }
+                Ok(Err(e)) => {
+                    crate::app_eprintln!("[device-resume] seek failed: {e}");
+                }
+                Err(_) => {
+                    crate::app_eprintln!("[device-resume] seek timed out");
+                }
+            }
+        }
+    }
+
+    // Inform the frontend of the new duration (keeps seekbar range correct).
+    app.emit("audio:playing", ps.built.duration_secs).ok();
+
+    let analysis_app = app.clone();
+    spawn_progress_task(
+        gen,
+        engine.generation.clone(),
+        engine.current.clone(),
+        engine.chained_info.clone(),
+        engine.crossfade_enabled.clone(),
+        engine.crossfade_secs.clone(),
+        engine.autodj_suppress_autocrossfade.clone(),
+        done_flag,
+        app.clone(),
+        Some(analysis_app),
+        engine.samples_played.clone(),
+        engine.current_sample_rate.clone(),
+        engine.current_channels.clone(),
+        engine.gapless_switch_at.clone(),
+        engine.current_playback_url.clone(),
+        engine.stream_playback_armed.clone(),
+        engine.playback_rate.clone(),
+    );
+
+    crate::app_deprintln!(
+        "[device-resume] internal replay ok — url={url:?} resume_at={:.2}s seekable={}",
+        snap.current_time_secs,
+        ps.is_seekable
+    );
+    true
+}

src-tauri/crates/psysonic-audio/src/device_watcher.rs

@@ -1,11 +1,11 @@
 //! Poll default output device and pinned-device presence; reopen stream when needed.
 use std::sync::atomic::Ordering;
-use std::sync::Arc;
 use std::time::{Duration, Instant};
 
 use tauri::Emitter;
 use tauri::Manager;
 
+use super::device_resume::{try_resume_after_device_change, ResumeSnapshot};
 use super::engine::AudioEngine;
 #[cfg(not(target_os = "linux"))]
 use super::dev_io::output_enumeration_includes_pinned;
@@ -21,6 +21,15 @@ pub(crate) enum ReopenNotify {
 
 /// Opens a new CPAL/rodio output stream with the given rate and device name (same path as
 /// manual device switch). Used by the device watcher and Windows suspend/resume notifications.
+///
+/// If the interrupted track is a seekable local file or a fully-cached HTTP download
+/// (in-memory or spill file), the function replays it internally from the saved position —
+/// no frontend round-trip, no audible restart. On success it emits
+/// `audio:device-changed` / `audio:device-reset` with a `null` payload so the frontend
+/// knows Rust already handled playback.
+/// For radio, partially-buffered HTTP tracks, or paused playback, it falls back to the
+/// previous behaviour: emit with the captured `current_time_secs` so the frontend calls
+/// `playTrack`.
 pub(crate) async fn reopen_output_stream(
     app: &tauri::AppHandle,
     device_name: Option<String>,
@@ -31,48 +40,91 @@ pub(crate) async fn reopen_output_stream(
     };
 
     let rate = engine.stream_sample_rate.load(Ordering::Relaxed);
-    let reopen_tx = engine.stream_reopen_tx.clone();
-    let stream_handle = engine.stream_handle.clone();
+    let open_rate = if rate > 0 {
+        rate
+    } else {
+        engine.device_default_rate
+    };
     let current = engine.current.clone();
     let fading_out = engine.fading_out_sink.clone();
 
-    let new_handle = tauri::async_runtime::spawn_blocking(move || {
-        let (reply_tx, reply_rx) =
-            std::sync::mpsc::sync_channel::<Arc<rodio::MixerDeviceSink>>(0);
-        if reopen_tx
-            .send((rate, false, device_name, reply_tx))
-            .is_err()
-        {
-            return None;
+    // Snapshot state we need BEFORE the blocking stream reopen (while the old sink
+    // is still live and position() is still valid).
+    let snapshot = {
+        let cur = current.lock().unwrap();
+        let is_playing = cur.play_started.is_some() && cur.paused_at.is_none();
+        ResumeSnapshot {
+            url: engine.current_playback_url.lock().unwrap().clone(),
+            current_time_secs: cur.position(),
+            duration_secs: cur.duration_secs,
+            base_volume: cur.base_volume,
+            gain_linear: cur.replay_gain_linear,
+            analysis_track_id: engine.current_analysis_track_id.lock().unwrap().clone(),
+            is_playing,
         }
-        reply_rx.recv_timeout(Duration::from_secs(5)).ok()
-    })
-    .await
-    .unwrap_or(None);
-
-    let Some(handle) = new_handle else {
-        return false;
     };
 
-    *stream_handle.lock().unwrap() = handle;
+    let app_for_open = app.clone();
+    let device_name_for_open = device_name.clone();
+    let opened = tauri::async_runtime::spawn_blocking(move || {
+        let engine = app_for_open.state::<AudioEngine>();
+        super::engine::open_output_stream_blocking(
+            &engine,
+            open_rate,
+            false,
+            device_name_for_open,
+        )
+        .is_ok()
+    })
+    .await
+    .unwrap_or(false);
+
+    if !opened {
+        return false;
+    }
+    // When we're not actively playing (paused/stopped), bump the generation
+    // before stopping the old sink so the still-running progress task sees the
+    // mismatch and bails out instead of emitting a spurious `audio:ended` —
+    // which would otherwise trigger a frontend restart of paused playback
+    // (#1094). The active-playback path bumps inside
+    // `try_resume_after_device_change`, so only guard the non-playing case here.
+    if !snapshot.is_playing {
+        engine.generation.fetch_add(1, Ordering::SeqCst);
+    }
     if let Some(s) = current.lock().unwrap().sink.take() {
         s.stop();
     }
     if let Some(s) = fading_out.lock().unwrap().take() {
         s.stop();
     }
+
+    // Attempt a Rust-side internal replay (no frontend involvement).
+    // Falls back gracefully to the frontend path if conditions aren't met.
+    let resumed = try_resume_after_device_change(app, &snapshot).await;
+
     match notify {
         ReopenNotify::DeviceChanged => {
-            app.emit("audio:device-changed", ()).ok();
+            // null  → Rust already resumed; frontend skips playTrack
+            // f64   → fallback; frontend calls playTrack + seek
+            if resumed {
+                app.emit("audio:device-changed", Option::<f64>::None).ok();
+            } else {
+                app.emit("audio:device-changed", snapshot.current_time_secs).ok();
+            }
         }
         #[cfg(not(target_os = "linux"))]
         ReopenNotify::DeviceReset => {
-            app.emit("audio:device-reset", ()).ok();
+            if resumed {
+                app.emit("audio:device-reset", Option::<f64>::None).ok();
+            } else {
+                app.emit("audio:device-reset", snapshot.current_time_secs).ok();
+            }
         }
     }
     true
 }
 
+
 pub fn start_device_watcher(engine: &AudioEngine, app: tauri::AppHandle) {
     let selected_device = engine.selected_device.clone();
     let samples_played = engine.samples_played.clone();
@@ -80,10 +132,7 @@ pub fn start_device_watcher(engine: &AudioEngine, app: tauri::AppHandle) {
 
     tauri::async_runtime::spawn(async move {
         let mut last_default: Option<String> = tauri::async_runtime::spawn_blocking(|| {
-            use rodio::cpal::traits::{DeviceTrait, HostTrait};
-            rodio::cpal::default_host()
-                .default_output_device()
-                .and_then(|d| d.description().ok().map(|desc| desc.name().to_string()))
+            super::dev_io::effective_default_output_device_name_for_poll()
         }).await.unwrap_or(None);
 
         // macOS/Windows: consecutive polls where a pinned device is absent from cpal's list.
@@ -182,10 +231,18 @@ pub fn start_device_watcher(engine: &AudioEngine, app: tauri::AppHandle) {
                 }
             }
 
-            // Enumerate all available output devices and the current default.
+            // The full `output_devices()` + per-device `description()` scan is the
+            // CoreAudio HAL call that contends with the audio render thread and
+            // produces a brief dropout once per poll interval (issue #996: stutter
+            // every ~3s, cadence tracking the poll exactly). It is only needed to
+            // detect a *pinned* output device disappearing. With no pin — system
+            // default, the common case — only the current default is needed, a
+            // single cheap query, so the full enumeration is skipped entirely.
+            let pinned = selected_device.lock().unwrap().clone();
+            let need_full_enum = pinned.is_some();
+
             // Suppress stderr on Unix to avoid ALSA probing noise (JACK, OSS, dmix).
-            let (current_default, available) = tauri::async_runtime::spawn_blocking(|| {
-                use rodio::cpal::traits::{DeviceTrait, HostTrait};
+            let (current_default, available) = tauri::async_runtime::spawn_blocking(move || {
                 #[cfg(unix)]
                 let _guard = unsafe {
                     struct StderrGuard(i32);
@@ -198,30 +255,24 @@ pub fn start_device_watcher(engine: &AudioEngine, app: tauri::AppHandle) {
                     libc::close(devnull);
                     StderrGuard(saved)
                 };
-                let host = rodio::cpal::default_host();
-                let default = host
-                    .default_output_device()
-                    .and_then(|d| d.description().ok().map(|desc| desc.name().to_string()));
-                let available: Vec<String> = host
-                    .output_devices()
-                    .map(|iter| {
-                        iter.filter_map(|d| d.description().ok().map(|desc| desc.name().to_string()))
-                            .collect()
-                    })
-                    .unwrap_or_default();
+                let default = super::dev_io::effective_default_output_device_name_for_poll();
+                let available: Vec<String> = if need_full_enum {
+                    super::dev_io::enumerate_output_device_names()
+                } else {
+                    Vec::new()
+                };
                 (default, available)
             }).await.unwrap_or((None, vec![]));
 
-            // Empty list almost always means a transient enumeration failure, not
-            // that every output device vanished. Treating it as "pinned missing"
-            // caused false audio:device-reset (UI jumped back to system default)
-            // when switching to external USB / class-compliant interfaces.
-            if available.is_empty() {
+            // Empty list (only when we actually enumerated for a pinned device)
+            // almost always means a transient enumeration failure, not that every
+            // output device vanished. Treating it as "pinned missing" caused false
+            // audio:device-reset (UI jumped back to system default) when switching
+            // to external USB / class-compliant interfaces.
+            if need_full_enum && available.is_empty() {
                 continue;
             }
 
-            let pinned = selected_device.lock().unwrap().clone();
-
             #[cfg(target_os = "linux")]
             if pinned.is_some() {
                 // Do not infer "unplugged" from `output_devices()` when a device is pinned.
@@ -263,13 +314,57 @@ pub fn start_device_watcher(engine: &AudioEngine, app: tauri::AppHandle) {
                 continue;
             }
 
-            last_default = current_default.clone();
+            let Some(new_name) = current_default else {
+                // Transient wpctl/cpal miss — keep last known default.
+                continue;
+            };
 
-            let Some(_new_name) = current_default else { continue };
+            if last_default.is_none() {
+                last_default = Some(new_name.clone());
+                continue;
+            }
+
+            // Linux/PipeWire: cpal default labels can drift while the physical sink
+            // is unchanged — compare via ALSA logical keys before reopening.
+            #[cfg(target_os = "linux")]
+            if let Some(ref prev) = last_default {
+                let prev_name = prev.clone();
+                let new_name_for_eq = new_name.clone();
+                let same_sink = tauri::async_runtime::spawn_blocking(move || {
+                    let list = super::dev_io::enumerate_output_device_names();
+                    super::dev_io::output_device_keys_equivalent(
+                        &prev_name,
+                        &new_name_for_eq,
+                        &list,
+                    )
+                })
+                .await
+                .unwrap_or(false);
+                if same_sink {
+                    last_default = Some(new_name);
+                    continue;
+                }
+            }
+
+            last_default = Some(new_name.clone());
 
             // Debounce: give the OS time to finish configuring the new device.
             tokio::time::sleep(Duration::from_millis(500)).await;
 
+            #[cfg(target_os = "linux")]
+            {
+                let stream_on_default = tauri::async_runtime::spawn_blocking(|| {
+                    super::dev_io::linux_psysonic_stream_routes_to_default_sink()
+                })
+                .await
+                .unwrap_or(false);
+                if stream_on_default {
+                    // PipeWire already moved playback — notify frontend (EQ sync) only.
+                    app.emit("audio:device-changed", Option::<f64>::None).ok();
+                    continue;
+                }
+            }
+
             if !reopen_output_stream(&app, None, ReopenNotify::DeviceChanged).await {
                 crate::app_eprintln!("[psysonic] device-watcher: stream reopen timed out");
             }

src-tauri/crates/psysonic-audio/src/engine.rs

@@ -4,25 +4,36 @@ use std::sync::{Arc, Mutex, RwLock};
 use std::time::{Duration, Instant};
 
 use rodio::Player;
-use tauri::{AppHandle, Manager};
+use tauri::Manager;
 
-use super::state::{ChainedInfo, PreloadedTrack};
+use super::state::{ChainedInfo, PreloadedTrack, StreamCompletedSpill};
 
-/// Reply channel handed back to the audio-stream thread once a re-open finishes.
-pub type StreamReopenReply = std::sync::mpsc::SyncSender<Arc<rodio::MixerDeviceSink>>;
-/// Stream-thread re-open request: `(desired_rate, is_hi_res, device_name, reply_tx)`.
-pub type StreamReopenRequest = (u32, bool, Option<String>, StreamReopenReply);
+/// Reply channel handed back to the audio-stream thread once an open finishes.
+pub type StreamOpenReply =
+    std::sync::mpsc::SyncSender<(Arc<rodio::MixerDeviceSink>, u32)>;
+
+/// Requests handled on the dedicated audio-stream thread (open / idle release).
+pub enum StreamThreadMsg {
+    Open {
+        desired_rate: u32,
+        is_hi_res: bool,
+        device_name: Option<String>,
+        reply: StreamOpenReply,
+    },
+    Release {
+        reply: std::sync::mpsc::SyncSender<()>,
+    },
+}
 
 pub struct AudioEngine {
-    pub stream_handle: Arc<std::sync::Mutex<Arc<rodio::MixerDeviceSink>>>,
+    pub stream_handle: Arc<std::sync::Mutex<Option<Arc<rodio::MixerDeviceSink>>>>,
     /// Sample rate the output stream was last opened at (updated on every re-open).
     pub stream_sample_rate: Arc<AtomicU32>,
     /// The rate the device was opened at on cold start — used to restore the
     /// stream when Hi-Res is toggled off while a hi-res rate is active.
     pub device_default_rate: u32,
-    /// Sends `(desired_rate, is_hi_res, device_name, reply_tx)` to the audio-stream
-    /// thread to re-open the output device. `device_name = None` → system default.
-    pub stream_reopen_tx: std::sync::mpsc::SyncSender<StreamReopenRequest>,
+    /// Open or release the CPAL output stream on the audio-stream thread.
+    pub stream_thread_tx: std::sync::mpsc::SyncSender<StreamThreadMsg>,
     /// User-selected output device name (None = follow system default).
     pub selected_device: Arc<Mutex<Option<String>>>,
     pub current: Arc<Mutex<AudioCurrent>>,
@@ -32,17 +43,33 @@ pub struct AudioEngine {
     pub eq_gains: Arc<[AtomicU32; 10]>,
     pub eq_enabled: Arc<AtomicBool>,
     pub eq_pre_gain: Arc<AtomicU32>,
+    pub playback_rate: crate::playback_rate::PlaybackRateAtomics,
     pub(crate) preloaded: Arc<Mutex<Option<PreloadedTrack>>>,
     /// Last fully downloaded manual-stream track bytes (same playback identity),
     /// used to recover seek/replay without waiting for network again.
     pub(crate) stream_completed_cache: Arc<Mutex<Option<PreloadedTrack>>>,
+    /// On-disk spill for completed ranged streams above `TRACK_STREAM_PROMOTE_MAX_BYTES`.
+    pub(crate) stream_completed_spill: Arc<Mutex<Option<StreamCompletedSpill>>>,
     /// True when the currently playing source supports seeking (in-memory bytes
     /// or `RangedHttpSource`); false for the legacy non-seekable streaming
     /// fallback (`AudioStreamReader`). `audio_seek` rejects with a "not
     /// seekable" error when false so the frontend restart-fallback can engage.
     pub(crate) current_is_seekable: Arc<AtomicBool>,
+    /// HTTP stream paths (`RangedHttpSource`, legacy `AudioStreamReader`): false
+    /// until `TRACK_STREAM_PLAY_START_BYTES` are buffered (or download ends).
+    /// Bytes / local file / radio keep true.
+    pub(crate) stream_playback_armed: Arc<AtomicBool>,
     pub crossfade_enabled: Arc<AtomicBool>,
     pub crossfade_secs: Arc<AtomicU32>,
+    /// AutoDJ: when true, the progress task does NOT fire its autonomous
+    /// `crossfade_secs`-before-end `audio:ended` timer — the JS A-tail logic
+    /// drives every advance (gated on the next track being playable). Prevents
+    /// the engine from starting a still-buffering next track and fading over it
+    /// (an audible "jump"); cold next-track degrades to a clean sequential start.
+    pub(crate) autodj_suppress_autocrossfade: Arc<AtomicBool>,
+    /// AutoDJ interrupt prep: `audio_begin_outgoing_fade` volume-ducked the
+    /// outgoing sink; block normalization/volume ramps until the handoff swap.
+    pub(crate) interrupt_outgoing_duck_active: Arc<AtomicBool>,
     pub fading_out_sink: Arc<Mutex<Option<Arc<Player>>>>,
     /// When true, audio_play chains sources to the existing Sink instead of
     /// creating a new one, achieving sample-accurate gapless transitions.
@@ -76,6 +103,11 @@ pub struct AudioEngine {
     /// Subsonic song id last passed from JS with `audio_play` (trimmed). Used
     /// for loudness/waveform cache when the URL is `psysonic-local://…`.
     pub(crate) current_analysis_track_id: Arc<Mutex<Option<String>>>,
+    /// App server id (`playbackServerId ?? activeServerId`) of the current
+    /// playback, pinned by `audio_play`. Scopes analysis-cache reads (loudness
+    /// gain, replay-gain updates, device resume) to the right server so a switch
+    /// can't surface another server's blob for the same bare `track_id`.
+    pub(crate) current_playback_server_id: Arc<Mutex<Option<String>>>,
     /// While a `RangedHttpSource` download task is filling the buffer for this
     /// `(track_id, play_generation)`, skip `analysis_enqueue_seed_from_url` for the
     /// same id — otherwise a parallel full GET + Symphonia competes with playback
@@ -136,6 +168,15 @@ impl AudioCurrent {
 ///   3. Device default.
 ///   4. System default (last resort).
 ///
+/// Rodio prints a stderr line on every intentional stream drop. Keep that only
+/// when runtime logging is in **debug** mode; normal/off silence the noise.
+fn finalize_mixer_device_sink(mut handle: rodio::MixerDeviceSink) -> Arc<rodio::MixerDeviceSink> {
+    if !crate::logging::should_log_debug() {
+        handle.log_on_drop(false);
+    }
+    Arc::new(handle)
+}
+
 /// Returns `(stream_handle, actual_sample_rate)`.
 fn open_stream_for_device_and_rate(device_name: Option<&str>, desired_rate: u32) -> (Arc<rodio::MixerDeviceSink>, u32) {
     use rodio::cpal::traits::{DeviceTrait, HostTrait};
@@ -165,21 +206,23 @@ fn open_stream_for_device_and_rate(device_name: Option<&str>, desired_rate: u32)
     // On systems where neither alias exists (pure ALSA, macOS, Windows),
     // `find_by_name` returns None and we drop through to `default_output_device`
     // unchanged — no regression.
-    let find_by_name = |name: &str| -> Option<_> {
-        host.output_devices().ok()?.find(|d| {
-            d.description()
-                .ok()
-                .map(|desc| desc.name().to_string())
-                .as_deref()
-                == Some(name)
+    let find_by_key = |key: &str| -> Option<_> {
+        super::dev_io::resolve_output_device(key).or_else(|| {
+            host.output_devices().ok()?.find(|d| {
+                d.description()
+                    .ok()
+                    .map(|desc| desc.name().to_string())
+                    .as_deref()
+                    == Some(key)
+            })
         })
     };
 
     let device = device_name
-        .and_then(find_by_name)
+        .and_then(find_by_key)
         .or_else(|| {
             #[cfg(target_os = "linux")]
-            { find_by_name("pipewire").or_else(|| find_by_name("pulse")) }
+            { find_by_key("pipewire").or_else(|| find_by_key("pulse")) }
             #[cfg(not(target_os = "linux"))]
             { None }
         })
@@ -203,7 +246,7 @@ fn open_stream_for_device_and_rate(device_name: Option<&str>, desired_rate: u32)
                         .and_then(|b| b.with_sample_rate(std::num::NonZeroU32::new(desired_rate).unwrap_or(std::num::NonZeroU32::MIN)).open_stream())
                     {
                         crate::app_eprintln!("[psysonic] audio stream opened at {} Hz (exact)", desired_rate);
-                        return (Arc::new(handle), desired_rate);
+                        return (finalize_mixer_device_sink(handle), desired_rate);
                     }
                 }
 
@@ -220,7 +263,7 @@ fn open_stream_for_device_and_rate(device_name: Option<&str>, desired_rate: u32)
                             "[psysonic] audio stream opened at {} Hz (highest, wanted {})",
                             rate, desired_rate
                         );
-                        return (Arc::new(handle), rate);
+                        return (finalize_mixer_device_sink(handle), rate);
                     }
                 }
             }
@@ -233,7 +276,7 @@ fn open_stream_for_device_and_rate(device_name: Option<&str>, desired_rate: u32)
                 .map(|c| c.sample_rate())
                 .unwrap_or(44100);
             crate::app_eprintln!("[psysonic] audio stream opened at {} Hz (device default)", rate);
-            return (Arc::new(handle), rate);
+            return (finalize_mixer_device_sink(handle), rate);
         }
     }
 
@@ -246,7 +289,78 @@ fn open_stream_for_device_and_rate(device_name: Option<&str>, desired_rate: u32)
         .and_then(|d| d.default_output_config().ok())
         .map(|c| c.sample_rate())
         .unwrap_or(44100);
-    (Arc::new(handle), rate)
+    (finalize_mixer_device_sink(handle), rate)
+}
+
+fn probe_device_default_rate() -> u32 {
+    use rodio::cpal::traits::{DeviceTrait, HostTrait};
+
+    rodio::cpal::default_host()
+        .default_output_device()
+        .and_then(|d| d.default_output_config().ok())
+        .map(|c| c.sample_rate())
+        .unwrap_or(44_100)
+}
+
+/// Open the output stream (blocking). Updates `stream_handle` and `stream_sample_rate`.
+pub(crate) fn open_output_stream_blocking(
+    engine: &AudioEngine,
+    desired_rate: u32,
+    is_hi_res: bool,
+    device_name: Option<String>,
+) -> Result<Arc<rodio::MixerDeviceSink>, String> {
+    let rate = if desired_rate > 0 {
+        desired_rate
+    } else {
+        engine.device_default_rate
+    };
+    let (reply_tx, reply_rx) = std::sync::mpsc::sync_channel(0);
+    engine
+        .stream_thread_tx
+        .send(StreamThreadMsg::Open {
+            desired_rate: rate,
+            is_hi_res,
+            device_name,
+            reply: reply_tx,
+        })
+        .map_err(|e| e.to_string())?;
+    let (handle, actual_rate) = reply_rx
+        .recv_timeout(Duration::from_secs(5))
+        .map_err(|_| "audio stream open timed out".to_string())?;
+    engine
+        .stream_sample_rate
+        .store(actual_rate, std::sync::atomic::Ordering::Relaxed);
+    *engine.stream_handle.lock().unwrap() = Some(handle.clone());
+    Ok(handle)
+}
+
+/// Ensure a live output stream exists; lazy-opens on first playback.
+pub(crate) fn ensure_output_stream_open(
+    engine: &AudioEngine,
+) -> Result<Arc<rodio::MixerDeviceSink>, String> {
+    if let Some(handle) = engine.stream_handle.lock().unwrap().clone() {
+        return Ok(handle);
+    }
+    let rate = engine.stream_sample_rate.load(std::sync::atomic::Ordering::Relaxed);
+    let open_rate = if rate > 0 {
+        rate
+    } else {
+        engine.device_default_rate
+    };
+    let device = engine.selected_device.lock().unwrap().clone();
+    open_output_stream_blocking(engine, open_rate, false, device)
+}
+
+pub(crate) fn request_stream_release(engine: &AudioEngine) -> Result<(), String> {
+    let (reply_tx, reply_rx) = std::sync::mpsc::sync_channel(0);
+    engine
+        .stream_thread_tx
+        .send(StreamThreadMsg::Release { reply: reply_tx })
+        .map_err(|e| e.to_string())?;
+    reply_rx
+        .recv_timeout(Duration::from_secs(5))
+        .map_err(|_| "audio stream release timed out".to_string())?;
+    Ok(())
 }
 
 pub fn create_engine() -> (AudioEngine, std::thread::JoinHandle<()>) {
@@ -258,13 +372,12 @@ pub fn create_engine() -> (AudioEngine, std::thread::JoinHandle<()>) {
         }
     }
 
-    // Channels: main thread ←→ audio-stream thread.
-    //   init_tx/rx : (Arc<rodio::MixerDeviceSink>, actual_rate) sent once at startup.
-    //   reopen_tx/rx: (desired_rate, reply_tx) — triggers a stream re-open.
-    let (init_tx, init_rx) =
-        std::sync::mpsc::sync_channel::<(Arc<rodio::MixerDeviceSink>, u32)>(0);
-    let (reopen_tx, reopen_rx) =
-        std::sync::mpsc::sync_channel::<(u32, bool, Option<String>, std::sync::mpsc::SyncSender<Arc<rodio::MixerDeviceSink>>)>(4);
+    // Channel: main thread ←→ audio-stream thread (lazy open + idle release).
+    let (ready_tx, ready_rx) = std::sync::mpsc::sync_channel::<()>(0);
+    let (stream_thread_tx, stream_thread_rx) =
+        std::sync::mpsc::sync_channel::<StreamThreadMsg>(4);
+
+    let device_default_rate = probe_device_default_rate();
 
     let thread = std::thread::Builder::new()
         .name("psysonic-audio-stream".into())
@@ -285,52 +398,63 @@ pub fn create_engine() -> (AudioEngine, std::thread::JoinHandle<()>) {
             // Thread priority is kept at default during standard-mode playback.
             // It is escalated to Max only when a Hi-Res stream reopen is requested,
             // to prevent PipeWire underruns at high quantum sizes (8192 frames).
-            let (mut _stream, rate) = open_stream_for_device_and_rate(None, 0);
-            let handle = _stream.clone();
-            init_tx.send((handle, rate)).ok();
+            let mut _stream: Option<Arc<rodio::MixerDeviceSink>> = None;
+            ready_tx.send(()).ok();
 
-            // Keep the stream alive and handle sample-rate / device-switch requests.
-            while let Ok((desired_rate, is_hi_res, device_name, reply_tx)) = reopen_rx.recv() {
-                // Escalate to Max for Hi-Res reopens (large PipeWire quanta need
-                // real-time scheduling to avoid underruns). No escalation for
-                // standard mode — the thread blocks on recv() between reopens so
-                // elevated priority would only waste scheduler budget.
-                if is_hi_res {
-                    thread_priority::set_current_thread_priority(
-                        thread_priority::ThreadPriority::Max
-                    ).ok();
+            while let Ok(msg) = stream_thread_rx.recv() {
+                match msg {
+                    StreamThreadMsg::Release { reply } => {
+                        _stream = None;
+                        let _ = reply.send(());
+                    }
+                    StreamThreadMsg::Open {
+                        desired_rate,
+                        is_hi_res,
+                        device_name,
+                        reply,
+                    } => {
+                        // Escalate to Max for Hi-Res reopens (large PipeWire quanta need
+                        // real-time scheduling to avoid underruns). No escalation for
+                        // standard mode — the thread blocks on recv() between reopens so
+                        // elevated priority would only waste scheduler budget.
+                        if is_hi_res {
+                            thread_priority::set_current_thread_priority(
+                                thread_priority::ThreadPriority::Max,
+                            )
+                            .ok();
+                        }
+
+                        _stream = None;
+
+                        // Scale the PipeWire quantum with the sample rate so wall-clock
+                        // latency stays roughly constant (≈93 ms) at all rates.
+                        #[cfg(target_os = "linux")]
+                        if desired_rate > 0 {
+                            let frames: u32 = if desired_rate > 48_000 { 8192 } else { 4096 };
+                            std::env::set_var("PIPEWIRE_LATENCY", format!("{frames}/{desired_rate}"));
+                            let latency_ms =
+                                (frames as f64 / desired_rate as f64 * 1000.0).round() as u64;
+                            std::env::set_var("PULSE_LATENCY_MSEC", latency_ms.to_string());
+                        }
+
+                        let (new_stream, actual_rate) =
+                            open_stream_for_device_and_rate(device_name.as_deref(), desired_rate);
+                        let new_handle = new_stream.clone();
+                        _stream = Some(new_stream);
+                        let _ = reply.send((new_handle, actual_rate));
+                    }
                 }
-
-                drop(_stream); // close old stream before opening new one
-
-                // Scale the PipeWire quantum with the sample rate so wall-clock
-                // latency stays roughly constant (≈93 ms) at all rates.
-                // 8192 frames at 88200 Hz ≈ 92.9 ms (same as 4096 at 48000 Hz).
-                #[cfg(target_os = "linux")]
-                {
-                    let frames: u32 = if desired_rate > 48_000 { 8192 } else { 4096 };
-                    std::env::set_var("PIPEWIRE_LATENCY", format!("{frames}/{desired_rate}"));
-                    // Keep PULSE_LATENCY_MSEC in sync so PulseAudio-based setups
-                    // get the same wall-clock quantum as PipeWire.
-                    let latency_ms = (frames as f64 / desired_rate as f64 * 1000.0).round() as u64;
-                    std::env::set_var("PULSE_LATENCY_MSEC", latency_ms.to_string());
-                }
-
-                let (new_stream, _actual) = open_stream_for_device_and_rate(device_name.as_deref(), desired_rate);
-                let new_handle = new_stream.clone();
-                _stream = new_stream;
-                reply_tx.send(new_handle).ok();
             }
         })
         .expect("spawn audio stream thread");
 
-    let (initial_handle, initial_rate) = init_rx.recv().expect("audio stream handle");
+    ready_rx.recv().expect("audio stream thread ready");
 
     let engine = AudioEngine {
-        stream_handle: Arc::new(std::sync::Mutex::new(initial_handle)),
-        stream_sample_rate: Arc::new(AtomicU32::new(initial_rate)),
-        device_default_rate: initial_rate,
-        stream_reopen_tx: reopen_tx,
+        stream_handle: Arc::new(std::sync::Mutex::new(None)),
+        stream_sample_rate: Arc::new(AtomicU32::new(0)),
+        device_default_rate,
+        stream_thread_tx,
         selected_device: Arc::new(Mutex::new(None)),
         current: Arc::new(Mutex::new(AudioCurrent {
             sink: None,
@@ -355,11 +479,16 @@ pub fn create_engine() -> (AudioEngine, std::thread::JoinHandle<()>) {
         eq_gains: Arc::new(std::array::from_fn(|_| AtomicU32::new(0f32.to_bits()))),
         eq_enabled: Arc::new(AtomicBool::new(false)),
         eq_pre_gain: Arc::new(AtomicU32::new(0f32.to_bits())),
+        playback_rate: crate::playback_rate::PlaybackRateAtomics::new(),
         preloaded: Arc::new(Mutex::new(None)),
         stream_completed_cache: Arc::new(Mutex::new(None)),
+        stream_completed_spill: Arc::new(Mutex::new(None)),
         current_is_seekable: Arc::new(AtomicBool::new(true)),
+        stream_playback_armed: Arc::new(AtomicBool::new(true)),
         crossfade_enabled: Arc::new(AtomicBool::new(false)),
         crossfade_secs: Arc::new(AtomicU32::new(3.0f32.to_bits())),
+        autodj_suppress_autocrossfade: Arc::new(AtomicBool::new(false)),
+        interrupt_outgoing_duck_active: Arc::new(AtomicBool::new(false)),
         fading_out_sink: Arc::new(Mutex::new(None)),
         gapless_enabled: Arc::new(AtomicBool::new(false)),
         normalization_engine: Arc::new(AtomicU32::new(0)),
@@ -373,6 +502,7 @@ pub fn create_engine() -> (AudioEngine, std::thread::JoinHandle<()>) {
         radio_state: Mutex::new(None),
         current_playback_url: Arc::new(Mutex::new(None)),
         current_analysis_track_id: Arc::new(Mutex::new(None)),
+        current_playback_server_id: Arc::new(Mutex::new(None)),
         ranged_loudness_seed_hold: Arc::new(Mutex::new(None)),
         preview_sink: Arc::new(Mutex::new(None)),
         preview_gen: Arc::new(AtomicU64::new(0)),
@@ -443,7 +573,75 @@ pub fn refresh_http_user_agent(state: &AudioEngine, ua: &str) {
         *slot = client;
     }
 }
-pub(crate) fn analysis_seed_high_priority_for_track(app: &AppHandle, track_id: &str) -> bool {
-    app.try_state::<AudioEngine>()
-        .is_some_and(|e| analysis_track_id_is_current_playback(&e, track_id))
+
+pub(crate) fn apply_playback_request_headers(
+    registry: Option<&psysonic_core::server_http::ServerHttpRegistry>,
+    server_id: Option<&str>,
+    url: &str,
+    req: reqwest::RequestBuilder,
+) -> reqwest::RequestBuilder {
+    psysonic_core::server_http::apply_optional_registry_headers(registry, server_id, url, req)
+}
+
+/// Custom HTTP headers for reverse-proxy gates — cloned into background download tasks.
+#[derive(Clone, Default)]
+pub(crate) struct PlaybackHttpHeaders {
+    registry: Option<Arc<psysonic_core::server_http::ServerHttpRegistry>>,
+    server_id: Option<String>,
+}
+
+impl PlaybackHttpHeaders {
+    pub fn from_app(app: &tauri::AppHandle, server_id: Option<&str>) -> Self {
+        Self {
+            registry: app
+                .try_state::<Arc<psysonic_core::server_http::ServerHttpRegistry>>()
+                .map(|s| Arc::clone(&*s)),
+            server_id: server_id.filter(|s| !s.is_empty()).map(str::to_string),
+        }
+    }
+
+    pub fn apply(&self, url: &str, req: reqwest::RequestBuilder) -> reqwest::RequestBuilder {
+        apply_playback_request_headers(
+            self.registry.as_deref(),
+            self.server_id.as_deref(),
+            url,
+            req,
+        )
+    }
+}
+
+pub(crate) fn scoped_http_get(
+    state: &AudioEngine,
+    registry: Option<&psysonic_core::server_http::ServerHttpRegistry>,
+    server_id: Option<&str>,
+    url: &str,
+) -> reqwest::RequestBuilder {
+    apply_playback_request_headers(
+        registry,
+        server_id,
+        url,
+        audio_http_client(state).get(url),
+    )
+}
+
+/// Resolve registry + server id for playback/preload HTTP GETs.
+pub(crate) fn playback_scoped_get(
+    state: &AudioEngine,
+    app: &tauri::AppHandle,
+    url: &str,
+    server_id: Option<&str>,
+) -> reqwest::RequestBuilder {
+    let registry = app
+        .try_state::<Arc<psysonic_core::server_http::ServerHttpRegistry>>()
+        .map(|s| Arc::clone(&*s));
+    let sid = server_id
+        .filter(|s| !s.is_empty())
+        .map(str::to_string)
+        .or_else(|| state.current_playback_server_id.lock().unwrap().clone());
+    scoped_http_get(
+        state,
+        registry.as_deref(),
+        sid.as_deref(),
+        url,
+    )
 }

src-tauri/crates/psysonic-audio/src/helpers.rs

@@ -16,6 +16,7 @@ use crate::ipc::{
 pub(crate) fn emit_partial_loudness_from_bytes(
     app: &AppHandle,
     url: &str,
+    server_id: Option<&str>,
     bytes: &[u8],
     target_lufs: f32,
     pre_analysis_attenuation_db: f32,
@@ -63,6 +64,10 @@ pub(crate) fn emit_partial_loudness_from_bytes(
         "analysis:loudness-partial",
         PartialLoudnessPayload {
             track_id: playback_identity(url),
+            server_index_key: {
+                let sid = crate::analysis_dispatch::resolve_server_id_for_app(app, server_id);
+                (!sid.is_empty()).then_some(sid)
+            },
             gain_db,
             target_lufs,
             is_partial: true,
@@ -153,6 +158,21 @@ pub(crate) fn format_hint_from_content_disposition(cd: &str) -> Option<String> {
     None
 }
 
+/// Best Symphonia container hint for playback: ranged/stream media hint, URL tail,
+/// Subsonic `song.suffix`, then magic-byte sniff on buffered bytes.
+pub(crate) fn resolve_playback_format_hint(
+    url_hint: Option<&str>,
+    stream_suffix: Option<&str>,
+    media_hint: Option<&str>,
+    data: Option<&[u8]>,
+) -> Option<String> {
+    media_hint
+        .map(str::to_string)
+        .or_else(|| url_hint.map(str::to_string))
+        .or_else(|| normalize_stream_suffix_for_hint(stream_suffix))
+        .or_else(|| data.and_then(sniff_stream_format_extension))
+}
+
 /// Subsonic [`song.suffix`](https://www.subsonic.org/pages/api.jsp#getSong) — stream.view URLs
 /// usually have no file extension; this supplies `format_hint` for ranged open.
 pub(crate) fn normalize_stream_suffix_for_hint(suffix: Option<&str>) -> Option<String> {
@@ -242,6 +262,9 @@ pub(crate) fn sniff_stream_format_extension(data: &[u8]) -> Option<String> {
 pub struct ProgressPayload {
     pub current_time: f64,
     pub duration: f64,
+    /// HTTP stream still filling its play buffer — UI must not extrapolate
+    /// progress until this clears.
+    pub buffering: bool,
 }
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -308,12 +331,14 @@ pub(crate) fn resolve_loudness_gain_from_cache(
     url: &str,
     target_lufs: f32,
     logical_track_id: Option<&str>,
+    server_id: &str,
 ) -> Option<f32> {
     resolve_loudness_gain_from_cache_impl(
         app,
         url,
         target_lufs,
         logical_track_id,
+        server_id,
         ResolveLoudnessCacheOpts::default(),
     )
 }
@@ -323,6 +348,7 @@ pub(crate) fn resolve_loudness_gain_from_cache_impl(
     url: &str,
     target_lufs: f32,
     logical_track_id: Option<&str>,
+    server_id: &str,
     opts: ResolveLoudnessCacheOpts,
 ) -> Option<f32> {
     // Only a SQLite loudness row counts here. Ephemeral JS hints (`analysis:loudness-partial`)
@@ -345,7 +371,7 @@ pub(crate) fn resolve_loudness_gain_from_cache_impl(
         }
         return None;
     };
-    resolve_loudness_gain_with_cache(cache.inner(), &track_id, target_lufs, opts)
+    resolve_loudness_gain_with_cache(cache.inner(), server_id, &track_id, target_lufs, opts)
 }
 
 /// AppHandle-free core of [`resolve_loudness_gain_from_cache_impl`]. Looks up
@@ -358,15 +384,16 @@ pub(crate) fn resolve_loudness_gain_from_cache_impl(
 /// connection's row cache is warm for the next IPC tick.
 pub(crate) fn resolve_loudness_gain_with_cache(
     cache: &psysonic_analysis::analysis_cache::AnalysisCache,
+    server_id: &str,
     track_id: &str,
     target_lufs: f32,
     opts: ResolveLoudnessCacheOpts,
 ) -> Option<f32> {
     if opts.touch_waveform {
         // Bind / preload: verify waveform context exists alongside loudness lookup.
-        let _ = cache.get_latest_waveform_for_track(track_id);
+        let _ = cache.get_latest_waveform_for_track(server_id, track_id);
     }
-    match cache.get_latest_loudness_for_track(track_id) {
+    match cache.get_latest_loudness_for_track(server_id, track_id) {
         Ok(Some(row)) if row.integrated_lufs.is_finite() => {
             let recommended = psysonic_analysis::analysis_cache::recommended_gain_for_target(
                 row.integrated_lufs,
@@ -475,6 +502,17 @@ pub(crate) struct TrackGainInputs {
 /// Read engine state + resolve the loudness cache for a track that's about to
 /// start playing. JS-supplied `loudness_gain_db` is **not** consulted at bind
 /// time (only post-cache via `audio_update_replay_gain`).
+/// Current playback server scope (`current_playback_server_id`, empty when
+/// unset) for scoping analysis-cache reads on the gain-resolution path.
+pub(crate) fn current_playback_server_id_str(state: &AudioEngine) -> String {
+    state
+        .current_playback_server_id
+        .lock()
+        .ok()
+        .and_then(|g| (*g).clone())
+        .unwrap_or_default()
+}
+
 pub(crate) fn resolve_track_gain_inputs(
     state: &AudioEngine,
     app: &AppHandle,
@@ -485,7 +523,9 @@ pub(crate) fn resolve_track_gain_inputs(
     let target_lufs = f32::from_bits(state.normalization_target_lufs.load(Ordering::Relaxed));
     let norm_mode = state.normalization_engine.load(Ordering::Relaxed);
     let pre_analysis_db = loudness_pre_analysis_db_for_engine(state);
-    let cache_loudness_db = resolve_loudness_gain_from_cache(app, url, target_lufs, logical_track_id);
+    let server_id = current_playback_server_id_str(state);
+    let cache_loudness_db =
+        resolve_loudness_gain_from_cache(app, url, target_lufs, logical_track_id, &server_id);
     let effective_loudness_db = if norm_mode == 2 {
         loudness_gain_db_after_resolve(
             cache_loudness_db,
@@ -528,6 +568,90 @@ pub fn take_stream_completed_for_url(state: &AudioEngine, url: &str) -> Option<V
     None
 }
 
+/// Take (consume) on-disk spill for a completed large ranged stream.
+pub fn take_stream_completed_spill_for_url(
+    state: &AudioEngine,
+    url: &str,
+) -> Option<std::path::PathBuf> {
+    take_stream_completed_spill_from_slot(&state.stream_completed_spill, url)
+}
+
+pub(crate) fn take_stream_completed_spill_from_slot(
+    slot: &std::sync::Arc<std::sync::Mutex<Option<crate::state::StreamCompletedSpill>>>,
+    url: &str,
+) -> Option<std::path::PathBuf> {
+    let mut guard = slot.lock().unwrap();
+    if guard
+        .as_ref()
+        .is_some_and(|p| same_playback_target(&p.url, url))
+    {
+        return guard.take().map(|p| p.path);
+    }
+    None
+}
+
+/// Atomically write completed stream bytes under `dir` (`{track_id}.complete.part` → rename).
+pub(crate) fn write_stream_spill_bytes_in_dir(
+    dir: &std::path::Path,
+    track_id: &str,
+    bytes: &[u8],
+) -> Result<std::path::PathBuf, String> {
+    std::fs::create_dir_all(dir).map_err(|e| e.to_string())?;
+    let path = dir.join(format!("{track_id}.complete"));
+    let part = dir.join(format!("{track_id}.complete.part"));
+    std::fs::write(&part, bytes).map_err(|e| e.to_string())?;
+    std::fs::rename(&part, &path).map_err(|e| e.to_string())?;
+    Ok(path)
+}
+
+/// Atomically write completed stream bytes to app-data `stream-spill/` (sync; no await while holding `buf`).
+pub(crate) fn write_stream_spill_file(
+    app: &AppHandle,
+    track_id: &str,
+    bytes: &[u8],
+) -> Result<std::path::PathBuf, String> {
+    let dir = app
+        .path()
+        .app_data_dir()
+        .map_err(|e| e.to_string())?
+        .join("stream-spill");
+    write_stream_spill_bytes_in_dir(&dir, track_id, bytes)
+}
+
+/// Remove leftover `stream-spill/*.complete*` from prior sessions (best-effort).
+pub fn cleanup_orphan_stream_spill_dir(app: &AppHandle) {
+    let Ok(dir) = app.path().app_data_dir().map(|d| d.join("stream-spill")) else {
+        return;
+    };
+    if !dir.is_dir() {
+        return;
+    }
+    let Ok(entries) = std::fs::read_dir(&dir) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let name = entry.file_name();
+        let lossy = name.to_string_lossy();
+        if lossy.ends_with(".complete") || lossy.ends_with(".complete.part") {
+            let _ = std::fs::remove_file(entry.path());
+        }
+    }
+}
+
+pub(crate) fn install_stream_completed_spill(
+    slot: &std::sync::Arc<std::sync::Mutex<Option<crate::state::StreamCompletedSpill>>>,
+    url: String,
+    path: std::path::PathBuf,
+) {
+    let mut guard = slot.lock().unwrap();
+    if let Some(old) = guard.take() {
+        if old.path != path {
+            let _ = std::fs::remove_file(&old.path);
+        }
+    }
+    *guard = Some(crate::state::StreamCompletedSpill { url, path });
+}
+
 /// Fetch track bytes from the preload cache or via HTTP.
 pub(crate) async fn fetch_data(
     url: &str,
@@ -548,6 +672,27 @@ pub(crate) async fn fetch_data(
         return Ok(Some(data));
     }
 
+    // Spill path is cloned (not taken) so replay of the same URL can still read from disk
+    // until hot-cache promote consumes the file via `take_stream_completed_spill_for_url`.
+    let spill_path = {
+        let guard = state.stream_completed_spill.lock().unwrap();
+        guard
+            .as_ref()
+            .filter(|p| same_playback_target(&p.url, url))
+            .map(|p| p.path.clone())
+    };
+    if let Some(path) = spill_path {
+        let data = tokio::fs::read(&path).await.map_err(|e| e.to_string())?;
+        if !data.is_empty() {
+            crate::app_deprintln!(
+                "[stream] fetch_data from spill path={} bytes={}",
+                path.display(),
+                data.len()
+            );
+            return Ok(Some(data));
+        }
+    }
+
     // Check preload cache next.
     let cached = {
         let mut preloaded = state.preloaded.lock().unwrap();
@@ -568,7 +713,10 @@ pub(crate) async fn fetch_data(
         return Ok(Some(data));
     }
 
-    let response = crate::engine::audio_http_client(state).get(url).send().await.map_err(|e| e.to_string())?;
+    let response = crate::engine::playback_scoped_get(state, app, url, None)
+        .send()
+        .await
+        .map_err(|e| e.to_string())?;
     let status = response.status();
     let ct = response.headers()
         .get(reqwest::header::CONTENT_TYPE)
@@ -607,47 +755,6 @@ pub(crate) async fn fetch_data(
     Ok(Some(data))
 }
 
-/// When playback uses full track bytes already in RAM (gapless `reuse_chained_bytes`,
-/// `preloaded`, or `stream_completed_cache` via `fetch_data`), the `psysonic-local`
-/// disk-read seed path never runs. Submit the same full-buffer analysis via the cpu-seed queue so waveform /
-/// loudness SQLite can fill **offline** without `analysis_enqueue_seed_from_url` HTTP.
-pub(crate) fn spawn_analysis_seed_from_in_memory_bytes(
-    app: &AppHandle,
-    cache_track_id: Option<&str>,
-    gen: u64,
-    gen_arc: &Arc<AtomicU64>,
-    bytes: &[u8],
-) {
-    let Some(track_id) = cache_track_id.map(str::trim).filter(|s| !s.is_empty()) else {
-        return;
-    };
-    if bytes.is_empty() || bytes.len() > crate::stream::TRACK_STREAM_PROMOTE_MAX_BYTES {
-        return;
-    }
-    let track_id = track_id.to_string();
-    let bytes = bytes.to_vec();
-    let app = app.clone();
-    let gen_arc = gen_arc.clone();
-    crate::app_deprintln!(
-        "[stream] in-memory play path: scheduling full-track analysis track_id={} size_mib={:.2}",
-        track_id,
-        bytes.len() as f64 / (1024.0 * 1024.0)
-    );
-    let high = crate::engine::analysis_seed_high_priority_for_track(&app, &track_id);
-    tokio::spawn(async move {
-        if gen_arc.load(Ordering::SeqCst) != gen {
-            return;
-        }
-        if let Err(e) = psysonic_analysis::analysis_runtime::submit_analysis_cpu_seed(app.clone(), track_id.clone(), bytes, high).await {
-            crate::app_eprintln!(
-                "[analysis] in-memory play path seed failed for {}: {}",
-                track_id,
-                e
-            );
-        }
-    });
-}
-
 /// -1 dB headroom applied at full scale to prevent inter-sample clipping.
 /// Modern masters are often at 0 dBFS; the EQ biquad chain and resampler
 /// can produce inter-sample peaks slightly above ±1.0 → audible distortion.
@@ -706,6 +813,19 @@ pub(crate) fn loudness_ui_current_gain_db(gain_linear: f32) -> Option<f32> {
     gain_linear_to_db(gain_linear)
 }
 
+static SINK_VOLUME_RAMP_GEN: AtomicU64 = AtomicU64::new(0);
+
+/// Cancel any in-flight sink-volume ramp (new ramp wins).
+pub(crate) fn cancel_sink_volume_ramp() {
+    SINK_VOLUME_RAMP_GEN.fetch_add(1, Ordering::SeqCst);
+}
+
+/// Audible sink multiplier — may differ from `base_volume * replay_gain` after
+/// interrupt prep or a mid-ramp correction.
+pub(crate) fn sink_volume_now(sink: &Player) -> f32 {
+    sink.volume().clamp(0.0, 1.0)
+}
+
 pub(crate) fn ramp_sink_volume(sink: Arc<Player>, from: f32, to: f32) {
     let from = from.clamp(0.0, 1.0);
     let to = to.clamp(0.0, 1.0);
@@ -713,8 +833,7 @@ pub(crate) fn ramp_sink_volume(sink: Arc<Player>, from: f32, to: f32) {
         sink.set_volume(to);
         return;
     }
-    static RAMP_GEN: AtomicU64 = AtomicU64::new(0);
-    let my_gen = RAMP_GEN.fetch_add(1, Ordering::SeqCst) + 1;
+    let my_gen = SINK_VOLUME_RAMP_GEN.fetch_add(1, Ordering::SeqCst) + 1;
     std::thread::spawn(move || {
         let delta = (to - from).abs();
         // Stretch large corrections to avoid audible "step down" moments.
@@ -727,18 +846,46 @@ pub(crate) fn ramp_sink_volume(sink: Arc<Player>, from: f32, to: f32) {
         } else {
             (8, 16)
         };
-        for i in 1..=steps {
-            if RAMP_GEN.load(Ordering::SeqCst) != my_gen {
-                return;
-            }
-            let t = i as f32 / steps as f32;
-            let v = from + (to - from) * t;
-            sink.set_volume(v.clamp(0.0, 1.0));
-            std::thread::sleep(Duration::from_millis(step_ms));
-        }
+        ramp_sink_volume_steps(sink, from, to, steps, step_ms, my_gen);
     });
 }
 
+/// Linear sink-volume ramp over an explicit wall-clock duration (interrupt prep).
+pub(crate) fn ramp_sink_volume_over_secs(sink: Arc<Player>, from: f32, to: f32, secs: f32) {
+    let from = from.clamp(0.0, 1.0);
+    let to = to.clamp(0.0, 1.0);
+    if (to - from).abs() < 0.002 {
+        sink.set_volume(to);
+        return;
+    }
+    let my_gen = SINK_VOLUME_RAMP_GEN.fetch_add(1, Ordering::SeqCst) + 1;
+    let secs = secs.clamp(0.1, 12.0);
+    let step_ms: u64 = 20;
+    let steps = ((secs * 1000.0) / step_ms as f32).round().max(1.0) as usize;
+    std::thread::spawn(move || {
+        ramp_sink_volume_steps(sink, from, to, steps, step_ms, my_gen);
+    });
+}
+
+fn ramp_sink_volume_steps(
+    sink: Arc<Player>,
+    from: f32,
+    to: f32,
+    steps: usize,
+    step_ms: u64,
+    my_gen: u64,
+) {
+    for i in 1..=steps {
+        if SINK_VOLUME_RAMP_GEN.load(Ordering::SeqCst) != my_gen {
+            return;
+        }
+        let t = i as f32 / steps as f32;
+        let v = from + (to - from) * t;
+        sink.set_volume(v.clamp(0.0, 1.0));
+        std::thread::sleep(Duration::from_millis(step_ms));
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -852,6 +999,31 @@ mod tests {
         assert_eq!(format_hint_from_content_disposition("inline"), None);
     }
 
+    // ── resolve_playback_format_hint ───────────────────────────────────────────
+
+    #[test]
+    fn resolve_playback_hint_prefers_media_then_suffix() {
+        assert_eq!(
+            resolve_playback_format_hint(None, Some("m4a"), Some("flac"), None),
+            Some("flac".into()),
+        );
+        assert_eq!(
+            resolve_playback_format_hint(None, Some("m4a"), None, None),
+            Some("m4a".into()),
+        );
+    }
+
+    #[test]
+    fn resolve_playback_hint_sniffs_bytes_when_no_suffix() {
+        let mut buf = vec![0u8; 4];
+        buf.extend_from_slice(b"ftyp");
+        buf.extend_from_slice(b"M4A \x00\x00\x02\x00");
+        assert_eq!(
+            resolve_playback_format_hint(None, None, None, Some(&buf)),
+            Some("m4a".into()),
+        );
+    }
+
     // ── normalize_stream_suffix_for_hint ──────────────────────────────────────
 
     #[test]
@@ -1193,6 +1365,7 @@ mod tests {
 
     fn upsert_loudness_row(cache: &AnalysisCache, track_id: &str, integrated: f64, target: f64) {
         let k = TrackKey {
+            server_id: String::new(),
             track_id: track_id.to_string(),
             md5_16kb: "deadbeef".to_string(),
         };
@@ -1216,6 +1389,7 @@ mod tests {
         let cache = AnalysisCache::open_in_memory();
         let g = resolve_loudness_gain_with_cache(
             &cache,
+            "",
             "no-such-track",
             -14.0,
             ResolveLoudnessCacheOpts::default(),
@@ -1230,6 +1404,7 @@ mod tests {
         upsert_loudness_row(&cache, "abc", -23.0, -14.0);
         let g = resolve_loudness_gain_with_cache(
             &cache,
+            "",
             "abc",
             -14.0,
             ResolveLoudnessCacheOpts::default(),
@@ -1254,6 +1429,7 @@ mod tests {
         upsert_loudness_row(&cache, "stream:abc", -16.0, -14.0);
         let g = resolve_loudness_gain_with_cache(
             &cache,
+            "",
             "abc",
             -14.0,
             ResolveLoudnessCacheOpts::default(),
@@ -1267,6 +1443,7 @@ mod tests {
         upsert_loudness_row(&cache, "abc", -20.0, -14.0);
         let g_quiet = resolve_loudness_gain_with_cache(
             &cache,
+            "",
             "abc",
             -20.0,
             ResolveLoudnessCacheOpts::default(),
@@ -1274,6 +1451,7 @@ mod tests {
         .unwrap();
         let g_loud = resolve_loudness_gain_with_cache(
             &cache,
+            "",
             "abc",
             -10.0,
             ResolveLoudnessCacheOpts::default(),
@@ -1294,7 +1472,73 @@ mod tests {
             touch_waveform: false,
             log_soft_misses: false,
         };
-        let g = resolve_loudness_gain_with_cache(&cache, "abc", -14.0, opts);
+        let g = resolve_loudness_gain_with_cache(&cache, "", "abc", -14.0, opts);
         assert!(g.is_some());
     }
 }
+
+#[cfg(test)]
+mod stream_spill_tests {
+    use super::*;
+    use std::sync::{Arc, Mutex};
+
+    fn scratch_dir(label: &str) -> std::path::PathBuf {
+        let dir = std::env::temp_dir().join(format!(
+            "psysonic-audio-spill-{label}-{}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).expect("scratch dir");
+        dir
+    }
+
+    #[test]
+    fn write_stream_spill_bytes_in_dir_creates_complete_file() {
+        let dir = scratch_dir("write");
+        let path =
+            write_stream_spill_bytes_in_dir(&dir, "track-1", b"hello").expect("write spill");
+        assert!(path.exists());
+        assert_eq!(std::fs::read(&path).unwrap(), b"hello");
+        assert!(!dir.join("track-1.complete.part").exists());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn install_stream_completed_spill_replaces_prior_file() {
+        let dir = scratch_dir("install");
+        let old_path = dir.join("old.complete");
+        let new_path = dir.join("new.complete");
+        std::fs::write(&old_path, b"old").unwrap();
+        std::fs::write(&new_path, b"new").unwrap();
+        let slot: Arc<Mutex<Option<crate::state::StreamCompletedSpill>>> =
+            Arc::new(Mutex::new(None));
+        install_stream_completed_spill(
+            &slot,
+            "http://example/a".into(),
+            old_path.clone(),
+        );
+        install_stream_completed_spill(
+            &slot,
+            "http://example/b".into(),
+            new_path.clone(),
+        );
+        assert!(!old_path.exists(), "previous spill file must be removed");
+        assert!(new_path.exists());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn take_stream_completed_spill_for_url_consumes_slot() {
+        let dir = scratch_dir("take");
+        let path = dir.join("t.complete");
+        std::fs::write(&path, b"x").unwrap();
+        let slot: Arc<Mutex<Option<crate::state::StreamCompletedSpill>>> =
+            Arc::new(Mutex::new(None));
+        let url = "https://server/stream?id=1";
+        install_stream_completed_spill(&slot, url.into(), path.clone());
+        let taken = take_stream_completed_spill_from_slot(&slot, url);
+        assert_eq!(taken.as_deref(), Some(path.as_path()));
+        assert!(take_stream_completed_spill_from_slot(&slot, url).is_none());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

src-tauri/crates/psysonic-audio/src/hi_res_blend.rs

@@ -0,0 +1,349 @@
+//! Hi-Res transition blend: resample to a user-chosen rate when crossfade,
+//! AutoDJ, or gapless must cross a sample-rate boundary.
+
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use rodio::Player;
+use tauri::{AppHandle, State};
+
+use super::engine::AudioEngine;
+use super::playback_rate::raw_counter_samples_for_content_position;
+use super::play_input::{url_format_hint, PlayInput};
+use super::source_build::{build_playback_source_with_probe_fallback, BuildSourceArgs, PlaybackSource};
+use super::stream::LocalFileSource;
+
+const BLEND_44100: u32 = 44_100;
+const BLEND_88200: u32 = 88_200;
+const BLEND_96000: u32 = 96_000;
+
+/// User-selected blend rate for hi-res transitions; `None` when inactive.
+pub(crate) fn blend_rate_hz(
+    hi_res_enabled: bool,
+    transition_blend_active: bool,
+    hz: Option<u32>,
+) -> Option<u32> {
+    if !hi_res_enabled || !transition_blend_active {
+        return None;
+    }
+    let raw = hz.unwrap_or(BLEND_44100);
+    match raw {
+        BLEND_44100 | BLEND_88200 | BLEND_96000 => Some(raw),
+        _ => Some(BLEND_44100),
+    }
+}
+
+pub(crate) struct OutgoingBlendSnapshot {
+    pub(crate) url: String,
+    pub(crate) position_secs: f64,
+    pub(crate) duration_secs: f64,
+    pub(crate) base_volume: f32,
+    pub(crate) gain_linear: f32,
+    pub(crate) outgoing_fade_secs: f32,
+    pub(crate) actual_fade_secs: f32,
+    pub(crate) analysis_track_id: Option<String>,
+}
+
+/// Capture the currently playing track before a hi-res blend stream reopen.
+pub(crate) fn capture_outgoing_blend_snapshot(
+    state: &AudioEngine,
+    outgoing_fade_secs: f32,
+    actual_fade_secs: f32,
+) -> Option<OutgoingBlendSnapshot> {
+    let url = state.current_playback_url.lock().unwrap().clone()?;
+    if url.is_empty() {
+        return None;
+    }
+    let (position_secs, duration_secs, base_volume, gain_linear, playing) = {
+        let cur = state.current.lock().unwrap();
+        let playing = cur.sink.is_some() && cur.paused_at.is_none();
+        (
+            cur.position(),
+            cur.duration_secs,
+            cur.base_volume,
+            cur.replay_gain_linear,
+            playing,
+        )
+    };
+    if !playing {
+        return None;
+    }
+    let analysis_track_id = state.current_analysis_track_id.lock().unwrap().clone();
+    Some(OutgoingBlendSnapshot {
+        url,
+        position_secs,
+        duration_secs,
+        base_volume,
+        gain_linear,
+        outgoing_fade_secs,
+        actual_fade_secs,
+        analysis_track_id,
+    })
+}
+
+/// Drop the live main sink so a stream reopen does not leave dangling players.
+pub(crate) fn detach_current_sink_for_blend_reopen(state: &AudioEngine) {
+    let mut cur = state.current.lock().unwrap();
+    if let Some(old) = cur.sink.take() {
+        old.stop();
+    }
+    cur.fadeout_trigger = None;
+    cur.fadeout_samples = None;
+}
+
+fn resolve_cached_play_input(engine: &AudioEngine, url: &str) -> Option<PlayInput> {
+    if url.starts_with("psysonic-local://") {
+        let path = url.strip_prefix("psysonic-local://").unwrap_or(url);
+        let file = std::fs::File::open(path).ok()?;
+        let len = file.metadata().map(|m| m.len()).unwrap_or(0);
+        return Some(PlayInput::SeekableMedia {
+            reader: Box::new(LocalFileSource { file, len }),
+            format_hint: url_format_hint(url),
+            tag: "LocalFile[hi-res-blend]",
+            random_access: true,
+            mp4_probe_gate: None,
+        });
+    }
+
+    let ram_bytes = {
+        let guard = engine.stream_completed_cache.lock().unwrap();
+        guard
+            .as_ref()
+            .filter(|t| t.url == url)
+            .map(|t| t.data.clone())
+    };
+    let bytes = if let Some(b) = ram_bytes {
+        b
+    } else {
+        let spill_path = {
+            let guard = engine.stream_completed_spill.lock().unwrap();
+            guard
+                .as_ref()
+                .filter(|s| s.url == url)
+                .map(|s| s.path.clone())
+        };
+        let path = spill_path?;
+        std::fs::read(&path).ok()?
+    };
+    Some(PlayInput::Bytes(bytes))
+}
+
+/// Rebuild the outgoing track on `fading_out_sink` at `blend_rate` after reopen.
+pub(crate) async fn spawn_outgoing_blend_resample(
+    app: &AppHandle,
+    state: &State<'_, AudioEngine>,
+    snap: &OutgoingBlendSnapshot,
+    blend_rate: u32,
+    gen: u64,
+) -> Result<(), String> {
+    if state.generation.load(Ordering::SeqCst) != gen {
+        return Ok(());
+    }
+
+    let play_input = resolve_cached_play_input(state, &snap.url).ok_or_else(|| {
+        format!(
+            "[hi-res-blend] outgoing track not cached for blend reopen: {}",
+            snap.url
+        )
+    })?;
+
+    let done_flag = Arc::new(AtomicBool::new(false));
+    let format_hint = url_format_hint(&snap.url);
+    let stream_format_suffix: Option<String> = snap
+        .url
+        .rsplit('.')
+        .next()
+        .and_then(|e| e.split('?').next())
+        .map(|s| s.to_lowercase());
+    let resume_server = super::helpers::current_playback_server_id_str(state);
+
+    let ps: PlaybackSource = build_playback_source_with_probe_fallback(
+        play_input,
+        BuildSourceArgs {
+            url: &snap.url,
+            gen,
+            cache_id_for_tasks: snap.analysis_track_id.as_deref(),
+            server_id: Some(resume_server.as_str()),
+            url_format_hint: format_hint.as_deref(),
+            stream_format_suffix: stream_format_suffix.as_deref(),
+            done_flag: done_flag.clone(),
+            fade_in_dur: Duration::from_millis(5),
+            hi_res_enabled: true,
+            resample_target_hz: blend_rate,
+            duration_hint: snap.duration_secs,
+        },
+        state,
+        app,
+    )
+    .await?;
+
+    if state.generation.load(Ordering::SeqCst) != gen {
+        return Ok(());
+    }
+
+    let stream = super::engine::ensure_output_stream_open(state)?;
+    let sink = Arc::new(Player::connect_new(stream.mixer()));
+    let effective_volume = (snap.base_volume * snap.gain_linear).clamp(0.0, 1.0);
+    sink.set_volume(effective_volume);
+    sink.append(ps.built.source);
+
+    if ps.is_seekable && snap.position_secs > 0.05 {
+        let target = Duration::from_secs_f64(snap.position_secs.max(0.0));
+        sink.try_seek(target)
+            .map_err(|e| format!("[hi-res-blend] outgoing seek failed: {e}"))?;
+    }
+
+    let fade_secs = snap.outgoing_fade_secs;
+    if fade_secs > 0.0 {
+        let rate = blend_rate;
+        let ch = state.current_channels.load(Ordering::Relaxed).max(2);
+        let fade_total = (fade_secs as f64 * rate as f64 * ch as f64) as u64;
+        ps.built
+            .fadeout_samples
+            .store(fade_total.max(1), Ordering::SeqCst);
+        ps.built.fadeout_trigger.store(true, Ordering::SeqCst);
+    }
+
+    sink.play();
+    *state.fading_out_sink.lock().unwrap() = Some(sink);
+
+    let fo_arc = state.fading_out_sink.clone();
+    let cleanup_secs = snap.actual_fade_secs.max(snap.outgoing_fade_secs) + 0.5;
+    tokio::spawn(async move {
+        tokio::time::sleep(Duration::from_secs_f32(cleanup_secs)).await;
+        if let Some(s) = fo_arc.lock().unwrap().take() {
+            s.stop();
+        }
+    });
+
+    crate::app_deprintln!(
+        "[hi-res-blend] outgoing rebuilt at {blend_rate} Hz from {:.2}s (fade {:.2}s)",
+        snap.position_secs,
+        fade_secs
+    );
+    Ok(())
+}
+
+/// Rebuild the **current** track on a freshly opened blend-rate stream (gapless
+/// chain realign) so the next source can append to the same sink.
+pub(crate) async fn rebuild_current_track_at_blend_rate(
+    app: &AppHandle,
+    state: &State<'_, AudioEngine>,
+    snap: &OutgoingBlendSnapshot,
+    blend_rate: u32,
+    gen: u64,
+) -> Result<(), String> {
+    if state.generation.load(Ordering::SeqCst) != gen {
+        return Ok(());
+    }
+
+    let play_input = resolve_cached_play_input(state, &snap.url).ok_or_else(|| {
+        format!(
+            "[hi-res-blend] current track not cached for gapless realign: {}",
+            snap.url
+        )
+    })?;
+
+    let done_flag = Arc::new(AtomicBool::new(false));
+    let format_hint = url_format_hint(&snap.url);
+    let stream_format_suffix: Option<String> = snap
+        .url
+        .rsplit('.')
+        .next()
+        .and_then(|e| e.split('?').next())
+        .map(|s| s.to_lowercase());
+    let resume_server = super::helpers::current_playback_server_id_str(state);
+
+    let ps: PlaybackSource = build_playback_source_with_probe_fallback(
+        play_input,
+        BuildSourceArgs {
+            url: &snap.url,
+            gen,
+            cache_id_for_tasks: snap.analysis_track_id.as_deref(),
+            server_id: Some(resume_server.as_str()),
+            url_format_hint: format_hint.as_deref(),
+            stream_format_suffix: stream_format_suffix.as_deref(),
+            done_flag: done_flag.clone(),
+            fade_in_dur: Duration::from_millis(5),
+            hi_res_enabled: true,
+            resample_target_hz: blend_rate,
+            duration_hint: snap.duration_secs,
+        },
+        state,
+        app,
+    )
+    .await?;
+
+    if state.generation.load(Ordering::SeqCst) != gen {
+        return Ok(());
+    }
+
+    state
+        .current_sample_rate
+        .store(ps.built.output_rate, Ordering::Relaxed);
+    state
+        .current_channels
+        .store(ps.built.output_channels as u32, Ordering::Relaxed);
+
+    let stream = super::engine::ensure_output_stream_open(state)?;
+    let sink = Arc::new(Player::connect_new(stream.mixer()));
+    let effective_volume = (snap.base_volume * snap.gain_linear).clamp(0.0, 1.0);
+    sink.set_volume(effective_volume);
+    sink.append(ps.built.source);
+
+    if ps.is_seekable && snap.position_secs > 0.05 {
+        let target = Duration::from_secs_f64(snap.position_secs.max(0.0));
+        sink.try_seek(target)
+            .map_err(|e| format!("[hi-res-blend] gapless realign seek failed: {e}"))?;
+    }
+
+    sink.play();
+
+    {
+        let mut cur = state.current.lock().unwrap();
+        cur.sink = Some(sink);
+        cur.duration_secs = ps.built.duration_secs;
+        cur.seek_offset = snap.position_secs;
+        cur.play_started = Some(Instant::now());
+        cur.paused_at = None;
+        cur.replay_gain_linear = snap.gain_linear;
+        cur.base_volume = snap.base_volume;
+        cur.fadeout_trigger = Some(ps.built.fadeout_trigger);
+        cur.fadeout_samples = Some(ps.built.fadeout_samples);
+    }
+
+    state.samples_played.store(
+        raw_counter_samples_for_content_position(
+            snap.position_secs,
+            ps.built.output_rate,
+            ps.built.output_channels as u32,
+            &state.playback_rate,
+        ),
+        Ordering::Relaxed,
+    );
+
+    crate::app_deprintln!(
+        "[hi-res-blend] gapless realigned current track at {blend_rate} Hz from {:.2}s",
+        snap.position_secs
+    );
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn blend_rate_inactive_without_hi_res_or_transition() {
+        assert_eq!(blend_rate_hz(false, true, Some(96_000)), None);
+        assert_eq!(blend_rate_hz(true, false, Some(96_000)), None);
+    }
+
+    #[test]
+    fn blend_rate_sanitizes_hz() {
+        assert_eq!(blend_rate_hz(true, true, None), Some(44_100));
+        assert_eq!(blend_rate_hz(true, true, Some(88_200)), Some(88_200));
+        assert_eq!(blend_rate_hz(true, true, Some(48_000)), Some(44_100));
+    }
+}

src-tauri/crates/psysonic-audio/src/ipc.rs

@@ -7,6 +7,7 @@ use tauri::{AppHandle, Emitter};
 #[serde(rename_all = "camelCase")]
 pub(crate) struct PartialLoudnessPayload {
     pub(crate) track_id: Option<String>,
+    pub(crate) server_index_key: Option<String>,
     pub(crate) gain_db: f32,
     pub(crate) target_lufs: f32,
     pub(crate) is_partial: bool,

src-tauri/crates/psysonic-audio/src/lib.rs

@@ -7,6 +7,7 @@
 pub use psysonic_core::{app_deprintln, app_eprintln, logging};
 
 pub mod autoeq_commands;
+mod analysis_dispatch;
 mod codec;
 pub mod commands;
 mod decode;
@@ -14,12 +15,18 @@ mod dev_io;
 pub mod device_commands;
 pub mod mix_commands;
 mod play_input;
+pub mod playback_rate;
+mod sink_swap;
+mod source_build;
+mod preserve_worker;
 pub mod preload_commands;
 pub(crate) mod progress_task;
 pub mod radio_commands;
 pub mod transport_commands;
+mod device_resume;
 mod device_watcher;
 mod engine;
+mod stream_idle;
 #[cfg(any(target_os = "windows", target_os = "linux"))]
 mod power_resume;
 #[cfg(target_os = "windows")]
@@ -27,6 +34,7 @@ mod power_notify_win;
 #[cfg(target_os = "linux")]
 mod power_notify_linux;
 mod helpers;
+mod hi_res_blend;
 mod ipc;
 pub mod preview;
 mod sources;
@@ -35,8 +43,12 @@ mod stream;
 
 pub use device_commands::{audio_default_output_device_name, audio_list_devices_for_engine};
 pub use device_watcher::start_device_watcher;
+pub use stream_idle::start_stream_idle_watcher;
 pub use engine::{create_engine, refresh_http_user_agent, AudioEngine};
-pub use helpers::take_stream_completed_for_url;
+pub use helpers::{
+    cleanup_orphan_stream_spill_dir, take_stream_completed_for_url,
+    take_stream_completed_spill_for_url,
+};
 
 /// Register platform-specific listeners so the output stream is reopened after sleep/resume
 /// when the device name may be unchanged (Windows WASAPI, Linux PipeWire, …).

src-tauri/crates/psysonic-audio/src/mix_commands.rs

@@ -11,17 +11,19 @@ use super::helpers::*;
 use super::ipc::{maybe_emit_normalization_state, NormalizationStatePayload};
 
 #[tauri::command]
+#[specta::specta]
 pub fn audio_set_volume(volume: f32, state: State<'_, AudioEngine>) {
     let mut cur = state.current.lock().unwrap();
-    let prev_effective = (cur.base_volume * cur.replay_gain_linear * MASTER_HEADROOM).clamp(0.0, 1.0);
     cur.base_volume = volume.clamp(0.0, 1.0);
     if let Some(sink) = &cur.sink {
+        let prev_effective = sink_volume_now(sink);
         let next_effective = (cur.base_volume * cur.replay_gain_linear * MASTER_HEADROOM).clamp(0.0, 1.0);
         ramp_sink_volume(Arc::clone(sink), prev_effective, next_effective);
     }
 }
 
 #[tauri::command]
+#[specta::specta]
 #[allow(clippy::too_many_arguments)]
 pub fn audio_update_replay_gain(
     volume: f32,
@@ -50,12 +52,14 @@ pub fn audio_update_replay_gain(
         .filter(|s| !s.is_empty());
     // If `current_playback_url` is not pinned yet, still honour JS `loudness_gain_db`
     // for the uncached path (`effective_loudness_db` / UI gain follow from `compute_gain`).
+    let server_for_loudness = crate::helpers::current_playback_server_id_str(&state);
     let cache_loudness = url_for_loudness.as_deref().and_then(|u| {
         resolve_loudness_gain_from_cache_impl(
             &app,
             u,
             target_lufs,
             logical_for_loudness.as_deref(),
+            &server_for_loudness,
             ResolveLoudnessCacheOpts {
                 touch_waveform: false,
                 log_soft_misses: false,
@@ -103,11 +107,19 @@ pub fn audio_update_replay_gain(
         volume,
         effective
     );
+    if state
+        .interrupt_outgoing_duck_active
+        .load(Ordering::Relaxed)
+    {
+        // Interrupt prep ducked the outgoing sink; syncing B's loudness here would
+        // ramp A back to full gain before the handoff swap.
+        return;
+    }
     let mut cur = state.current.lock().unwrap();
-    let prev_effective = (cur.base_volume * cur.replay_gain_linear * MASTER_HEADROOM).clamp(0.0, 1.0);
     cur.replay_gain_linear = gain_linear;
     cur.base_volume = volume.clamp(0.0, 1.0);
     if let Some(sink) = &cur.sink {
+        let prev_effective = sink_volume_now(sink);
         ramp_sink_volume(Arc::clone(sink), prev_effective, effective);
     }
     drop(cur);
@@ -122,6 +134,7 @@ pub fn audio_update_replay_gain(
 }
 
 #[tauri::command]
+#[specta::specta]
 pub fn audio_set_eq(gains: [f32; 10], enabled: bool, pre_gain: f32, state: State<'_, AudioEngine>) {
     state.eq_enabled.store(enabled, Ordering::Relaxed);
     state.eq_pre_gain.store(pre_gain.clamp(-30.0, 6.0).to_bits(), Ordering::Relaxed);
@@ -131,17 +144,134 @@ pub fn audio_set_eq(gains: [f32; 10], enabled: bool, pre_gain: f32, state: State
 }
 
 #[tauri::command]
+#[specta::specta]
 pub fn audio_set_crossfade(enabled: bool, secs: f32, state: State<'_, AudioEngine>) {
     state.crossfade_enabled.store(enabled, Ordering::Relaxed);
     state.crossfade_secs.store(secs.clamp(0.1, 12.0).to_bits(), Ordering::Relaxed);
 }
 
 #[tauri::command]
+#[specta::specta]
 pub fn audio_set_gapless(enabled: bool, state: State<'_, AudioEngine>) {
     state.gapless_enabled.store(enabled, Ordering::Relaxed);
 }
 
+/// Duck the current sink over `fade_secs` without exhausting its source (which
+/// would spuriously emit `audio:ended` before the interrupt handoff).
 #[tauri::command]
+#[specta::specta]
+pub fn audio_begin_outgoing_fade(fade_secs: f32, state: State<'_, AudioEngine>) {
+    let fade_secs = fade_secs.clamp(0.1, 12.0);
+    let cur = state.current.lock().unwrap();
+    let Some(sink) = cur.sink.as_ref() else {
+        return;
+    };
+    state
+        .interrupt_outgoing_duck_active
+        .store(true, Ordering::Relaxed);
+    cancel_sink_volume_ramp();
+    let from = sink_volume_now(sink);
+    ramp_sink_volume_over_secs(Arc::clone(sink), from, 0.0, fade_secs);
+}
+
+/// AutoDJ: when `true`, the progress task stops firing its autonomous
+/// crossfade `audio:ended` timer so the JS A-tail logic drives every advance
+/// (only when the next track is actually playable). When `false`, the engine's
+/// normal early crossfade trigger is restored (plain crossfade / loud→loud).
+#[tauri::command]
+#[specta::specta]
+pub fn audio_set_autodj_suppress(enabled: bool, state: State<'_, AudioEngine>) {
+    state
+        .autodj_suppress_autocrossfade
+        .store(enabled, Ordering::Relaxed);
+}
+
+#[tauri::command]
+#[specta::specta]
+pub fn audio_set_playback_rate(
+    enabled: bool,
+    strategy: String,
+    speed: f32,
+    pitch_semitones: f32,
+    state: State<'_, AudioEngine>,
+) {
+    use crate::playback_rate::{
+        content_position_from_samples, is_effect_active, raw_counter_samples_for_content_position,
+        uses_preserve_dsp, STRATEGY_PRESERVE_PITCH, STRATEGY_SPEED_CORRECTED,
+        STRATEGY_VARISPEED,
+    };
+
+    let clamped_speed = speed.clamp(0.5, 2.0);
+    let clamped_pitch = pitch_semitones.clamp(-12.0, 12.0);
+    let old_enabled = state.playback_rate.enabled.load(Ordering::Relaxed);
+    let old_strat = state.playback_rate.load_strategy();
+    let old_speed = state.playback_rate.load_speed();
+    let was_active = is_effect_active(&state.playback_rate);
+    let new_strat = match strategy.as_str() {
+        "preserve_pitch" => STRATEGY_PRESERVE_PITCH,
+        "speed_corrected" => STRATEGY_SPEED_CORRECTED,
+        _ => STRATEGY_VARISPEED,
+    };
+    let speed_changed = (clamped_speed - old_speed).abs() > 0.001;
+
+    let restamp_content = if was_active
+        && enabled == old_enabled
+        && uses_preserve_dsp(old_strat)
+        && new_strat == old_strat
+        && speed_changed
+    {
+        let sample_rate = state.current_sample_rate.load(Ordering::Relaxed);
+        let channels = state.current_channels.load(Ordering::Relaxed);
+        if sample_rate > 0 && channels > 0 {
+            Some(content_position_from_samples(
+                state.samples_played.load(Ordering::Relaxed),
+                sample_rate,
+                channels,
+                &state.playback_rate,
+            ))
+        } else {
+            None
+        }
+    } else {
+        None
+    };
+
+    state
+        .playback_rate
+        .enabled
+        .store(enabled, Ordering::Relaxed);
+    state
+        .playback_rate
+        .strategy
+        .store(new_strat, Ordering::Relaxed);
+    state
+        .playback_rate
+        .speed
+        .store(clamped_speed.to_bits(), Ordering::Relaxed);
+    state
+        .playback_rate
+        .pitch_semitones
+        .store(clamped_pitch.to_bits(), Ordering::Relaxed);
+
+    if let Some(content_secs) = restamp_content {
+        if is_effect_active(&state.playback_rate) {
+            let sample_rate = state.current_sample_rate.load(Ordering::Relaxed);
+            let channels = state.current_channels.load(Ordering::Relaxed);
+            state.samples_played.store(
+                raw_counter_samples_for_content_position(
+                    content_secs,
+                    sample_rate,
+                    channels,
+                    &state.playback_rate,
+                ),
+                Ordering::Relaxed,
+            );
+        }
+    }
+}
+
+#[tauri::command]
+#[specta::specta]
 pub fn audio_set_normalization(
     engine: String,
     target_lufs: f32,

src-tauri/crates/psysonic-audio/src/play_input.rs

@@ -2,31 +2,34 @@
 //! Subsonic hints, decide whether to play from in-memory bytes, a seekable
 //! local file, a seekable RangedHttpSource, or a non-seekable streaming reader.
 
-use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering};
 use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
 use ringbuf::traits::Split;
 use ringbuf::{HeapCons, HeapRb};
 use symphonia::core::io::MediaSource;
-use tauri::{AppHandle, Emitter, Manager, State};
+use tauri::{AppHandle, Emitter, State};
 
-use super::decode::{build_source, build_streaming_source, BuiltSource, SizedDecoder};
-use super::engine::{audio_http_client, AudioEngine};
+use super::analysis_dispatch::{
+    prepare_playback_analysis, spawn_track_analysis_bytes, spawn_track_analysis_file,
+    TrackAnalysisOrigin,
+};
+use super::engine::{audio_http_client, AudioEngine, PlaybackHttpHeaders};
 use super::helpers::{
     content_type_to_hint, fetch_data, format_hint_from_content_disposition,
     normalize_stream_suffix_for_hint, sniff_stream_format_extension,
-    spawn_analysis_seed_from_in_memory_bytes, same_playback_target,
+    same_playback_target,
     STREAM_FORMAT_SNIFF_PROBE_BYTES,
 };
 use super::stream::{
     ranged_download_task, track_download_task, AudioStreamReader,
-    LocalFileSource, RangedHttpSource, LOCAL_FILE_PLAYBACK_SEED_MAX_BYTES,
-    RADIO_READ_TIMEOUT_SECS, TRACK_STREAM_MAX_BUF_CAPACITY, TRACK_STREAM_MIN_BUF_CAPACITY,
+    LocalFileSource, RangedHttpSource,
+    TRACK_READ_TIMEOUT_SECS, TRACK_STREAM_MAX_BUF_CAPACITY, TRACK_STREAM_MIN_BUF_CAPACITY,
 };
 
 /// What `audio_play` will hand to `build_source` / `build_streaming_source`.
-pub(super) enum PlayInput {
+pub(crate) enum PlayInput {
     Bytes(Vec<u8>),
     /// Seekable on-demand source — `RangedHttpSource` for HTTP streams,
     /// `LocalFileSource` for `psysonic-local://` files. Goes through
@@ -37,6 +40,11 @@ pub(super) enum PlayInput {
         reader: Box<dyn MediaSource>,
         format_hint: Option<String>,
         tag: &'static str,
+        /// Source can cheaply seek to EOF (local file). Drives whether Ogg keeps
+        /// seekability through the probe so its seek path does not panic.
+        random_access: bool,
+        /// When set, Symphonia probe waits for moov (tail or fast-start prefix).
+        mp4_probe_gate: Option<super::stream::RangedMp4ProbeGate>,
     },
     Streaming {
         reader: AudioStreamReader,
@@ -52,11 +60,41 @@ pub(super) struct PlayInputContext<'a> {
     pub stream_format_suffix: Option<&'a str>,
     pub format_hint: Option<&'a str>,
     pub cache_id_for_tasks: Option<&'a str>,
+    /// Playback server scope for the analysis-cache write key (empty/`None` →
+    /// legacy `''`). Rides alongside `cache_id_for_tasks` into every seed path.
+    pub server_id: Option<&'a str>,
     /// `Some(bytes)` when manual-skip onto a pre-chained track reuses bytes
     /// from the chained-info block.
     pub reuse_chained_bytes: Option<Vec<u8>>,
 }
 
+fn spawn_playback_analysis_bytes(
+    app: &AppHandle,
+    state: &State<'_, AudioEngine>,
+    ctx: &PlayInputContext<'_>,
+    origin: TrackAnalysisOrigin,
+    bytes: Vec<u8>,
+) {
+    let Some(track_id) = ctx
+        .cache_id_for_tasks
+        .map(str::trim)
+        .filter(|s| !s.is_empty())
+    else {
+        return;
+    };
+    let (sid, high) =
+        prepare_playback_analysis(app, state, ctx.server_id, track_id, None);
+    spawn_track_analysis_bytes(
+        app.clone(),
+        origin,
+        sid,
+        track_id.to_string(),
+        bytes,
+        high,
+        Some((ctx.gen, state.generation.clone())),
+    );
+}
+
 /// Resolves the play input for `audio_play` honouring (in priority order):
 /// 1. Reused chained bytes — manual skip onto pre-chained track.
 /// 2. `psysonic-local://` files — open as seekable LocalFileSource.
@@ -72,13 +110,23 @@ pub(super) async fn select_play_input(
     app: &AppHandle,
 ) -> Result<Option<PlayInput>, String> {
     if let Some(d) = ctx.reuse_chained_bytes {
-        spawn_analysis_seed_from_in_memory_bytes(
-            app,
-            ctx.cache_id_for_tasks,
-            ctx.gen,
-            &state.generation,
-            &d,
-        );
+        if let Some(track_id) = ctx
+            .cache_id_for_tasks
+            .map(str::trim)
+            .filter(|s| !s.is_empty())
+        {
+            let (sid, high) =
+                prepare_playback_analysis(app, state, ctx.server_id, track_id, None);
+            spawn_track_analysis_bytes(
+                app.clone(),
+                TrackAnalysisOrigin::InMemoryReplay,
+                sid,
+                track_id.to_string(),
+                d.clone(),
+                high,
+                Some((ctx.gen, state.generation.clone())),
+            );
+        }
         return Ok(Some(PlayInput::Bytes(d)));
     }
 
@@ -108,12 +156,12 @@ pub(super) async fn select_play_input(
         Some(d) => d,
         None => return Ok(None), // superseded while downloading
     };
-    spawn_analysis_seed_from_in_memory_bytes(
+    spawn_playback_analysis_bytes(
         app,
-        ctx.cache_id_for_tasks,
-        ctx.gen,
-        &state.generation,
-        &data,
+        state,
+        &ctx,
+        TrackAnalysisOrigin::InMemoryReplay,
+        data.clone(),
     );
     Ok(Some(PlayInput::Bytes(data)))
 }
@@ -139,59 +187,25 @@ fn open_local_file_input(
         local_hint
     );
     if let Some(seed_id) = ctx.cache_id_for_tasks {
-        let skip_cpu_seed = app
-            .try_state::<psysonic_analysis::analysis_cache::AnalysisCache>()
-            .map(|c| c.cpu_seed_redundant_for_track(seed_id).unwrap_or(false))
-            .unwrap_or(false);
-        if !skip_cpu_seed {
-            let path_owned = std::path::PathBuf::from(path);
-            let app_seed = app.clone();
-            let gen_seed = ctx.gen;
-            let gen_arc_seed = state.generation.clone();
-            let seed_id = seed_id.to_string();
-            tokio::spawn(async move {
-                if gen_arc_seed.load(Ordering::SeqCst) != gen_seed {
-                    return;
-                }
-                let data = match tokio::fs::read(&path_owned).await {
-                    Ok(d) => d,
-                    Err(_) => return,
-                };
-                if gen_arc_seed.load(Ordering::SeqCst) != gen_seed {
-                    return;
-                }
-                if data.is_empty() || data.len() > LOCAL_FILE_PLAYBACK_SEED_MAX_BYTES {
-                    crate::app_deprintln!(
-                        "[stream] psysonic-local: skip analysis seed track_id={} bytes={} (over {} MiB cap)",
-                        seed_id,
-                        data.len(),
-                        LOCAL_FILE_PLAYBACK_SEED_MAX_BYTES / (1024 * 1024)
-                    );
-                    return;
-                }
-                crate::app_deprintln!(
-                    "[stream] psysonic-local: file read complete track_id={} size_mib={:.2} — full-track analysis (cpu-seed queue)",
-                    seed_id,
-                    data.len() as f64 / (1024.0 * 1024.0)
-                );
-                let high = crate::engine::analysis_seed_high_priority_for_track(&app_seed, &seed_id);
-                if let Err(e) =
-                    psysonic_analysis::analysis_runtime::submit_analysis_cpu_seed(app_seed.clone(), seed_id.clone(), data, high).await
-                {
-                    crate::app_eprintln!(
-                        "[analysis] local-file seed failed for {}: {}",
-                        seed_id,
-                        e
-                    );
-                }
-            });
-        }
+        let (sid, high) =
+            prepare_playback_analysis(app, state, ctx.server_id, seed_id, None);
+        spawn_track_analysis_file(
+            app.clone(),
+            TrackAnalysisOrigin::LocalFilePlayback,
+            sid,
+            seed_id.to_string(),
+            std::path::PathBuf::from(path),
+            high,
+            Some((ctx.gen, state.generation.clone())),
+        );
     }
     let reader = LocalFileSource { file, len };
     Ok(PlayInput::SeekableMedia {
         reader: Box::new(reader),
         format_hint: local_hint,
         tag: "local-file",
+        random_access: true,
+        mp4_probe_gate: None,
     })
 }
 
@@ -203,7 +217,12 @@ async fn open_ranged_or_streaming_input(
     state: &State<'_, AudioEngine>,
     app: &AppHandle,
 ) -> Result<Option<PlayInput>, String> {
-    let response = audio_http_client(state).get(ctx.url).send().await.map_err(|e| e.to_string())?;
+    let http_headers = PlaybackHttpHeaders::from_app(app, ctx.server_id);
+    let response = http_headers
+        .apply(ctx.url, audio_http_client(state).get(ctx.url))
+        .send()
+        .await
+        .map_err(|e| e.to_string())?;
     if !response.status().is_success() {
         if state.generation.load(Ordering::SeqCst) != ctx.gen {
             return Ok(None); // superseded
@@ -242,8 +261,8 @@ async fn open_ranged_or_streaming_input(
             let last = total_u64
                 .saturating_sub(1)
                 .min((STREAM_FORMAT_SNIFF_PROBE_BYTES - 1) as u64);
-            if let Ok(pr) = audio_http_client(state)
-                .get(ctx.url)
+            if let Ok(pr) = http_headers
+                .apply(ctx.url, audio_http_client(state).get(ctx.url))
                 .header(reqwest::header::RANGE, format!("bytes=0-{last}"))
                 .send()
                 .await
@@ -270,10 +289,6 @@ async fn open_ranged_or_streaming_input(
         }
     }
 
-    // Guardrail: when format/container hint is unknown, some demuxers may
-    // seek near EOF during probe. With a progressively downloaded ranged
-    // source that can delay first audible samples until most/all bytes are
-    // fetched. Prefer sequential streaming in that case for faster start.
     if let (true, Some(total), true) = (supports_range, total_size, stream_hint.is_some()) {
         let total_usize = total as usize;
         crate::app_deprintln!(
@@ -284,6 +299,20 @@ async fn open_ranged_or_streaming_input(
         let buf = Arc::new(Mutex::new(vec![0u8; total_usize]));
         let downloaded_to = Arc::new(AtomicUsize::new(0));
         let done = Arc::new(AtomicBool::new(false));
+        state.stream_playback_armed.store(false, Ordering::SeqCst);
+        let playback_armed = state.stream_playback_armed.clone();
+        let tail_ready = Arc::new(AtomicBool::new(false));
+        let tail_filled_from = Arc::new(AtomicU64::new(0));
+        let tail_prefetch =
+            super::stream::mp4_needs_tail_prefetch(&[], stream_hint.as_deref());
+        let mp4_probe_gate = tail_prefetch.then(|| super::stream::RangedMp4ProbeGate {
+            tail_ready: tail_ready.clone(),
+            buf: buf.clone(),
+            downloaded_to: downloaded_to.clone(),
+            gen_arc: state.generation.clone(),
+            gen: ctx.gen,
+            format_hint: stream_hint.clone(),
+        });
         let loudness_hold_for_defer = (total_usize <= super::stream::TRACK_STREAM_PROMOTE_MAX_BYTES)
             .then_some(state.ranged_loudness_seed_hold.clone());
         tokio::spawn(ranged_download_task(
@@ -298,25 +327,55 @@ async fn open_ranged_or_streaming_input(
             downloaded_to.clone(),
             done.clone(),
             state.stream_completed_cache.clone(),
+            state.stream_completed_spill.clone(),
             state.normalization_engine.clone(),
             state.normalization_target_lufs.clone(),
             state.loudness_pre_analysis_attenuation_db.clone(),
             ctx.cache_id_for_tasks.map(|s| s.to_string()),
+            ctx.server_id.map(|s| s.to_string()),
+            http_headers.clone(),
             loudness_hold_for_defer,
+            playback_armed,
+            stream_hint.clone(),
+            tail_ready.clone(),
+            tail_filled_from.clone(),
         ));
+        // On-demand random-access fetcher: lets seeks (Ogg bisection, end-of-
+        // stream probe, forward scrubs) pull arbitrary byte ranges over HTTP
+        // Range instead of blocking until the linear filler reaches the target.
+        // This is what makes seeking work on a still-downloading Opus/Ogg stream
+        // (previously a contained no-op) without forcing a full pre-download.
+        let on_demand = Some(Arc::new(super::stream::OnDemand::new(
+            audio_http_client(state),
+            tokio::runtime::Handle::current(),
+            ctx.url.to_string(),
+            buf.clone(),
+            total,
+            state.generation.clone(),
+            ctx.gen,
+            http_headers.clone(),
+        )));
         let reader = RangedHttpSource {
             buf,
             downloaded_to,
+            tail_ready,
+            tail_filled_from,
             total_size: total,
             pos: 0,
             done,
             gen_arc: state.generation.clone(),
             gen: ctx.gen,
+            on_demand,
         };
         return Ok(Some(PlayInput::SeekableMedia {
             reader: Box::new(reader),
             format_hint: stream_hint,
             tag: "ranged-stream",
+            // The on-demand fetcher makes a seek-to-EOF during the probe cheap,
+            // so Ogg can stay seekable through the probe (records its byte range
+            // → real seeking) without forcing a full download.
+            random_access: true,
+            mp4_probe_gate,
         }));
     }
 
@@ -332,6 +391,8 @@ async fn open_ranged_or_streaming_input(
     let rb = HeapRb::<u8>::new(buffer_cap);
     let (prod, cons) = rb.split();
     let done = Arc::new(AtomicBool::new(false));
+    state.stream_playback_armed.store(false, Ordering::SeqCst);
+    let playback_armed = state.stream_playback_armed.clone();
     tokio::spawn(track_download_task(
         ctx.gen,
         state.generation.clone(),
@@ -346,14 +407,18 @@ async fn open_ranged_or_streaming_input(
         state.normalization_target_lufs.clone(),
         state.loudness_pre_analysis_attenuation_db.clone(),
         ctx.cache_id_for_tasks.map(|s| s.to_string()),
+        ctx.server_id.map(|s| s.to_string()),
+        http_headers,
+        playback_armed,
     ));
 
     let (_new_cons_tx, new_cons_rx) = std::sync::mpsc::channel::<HeapCons<u8>>();
     let reader = AudioStreamReader {
+        read_timeout_secs: TRACK_READ_TIMEOUT_SECS,
         cons: Mutex::new(cons),
         new_cons_rx: Mutex::new(new_cons_rx),
         deadline: std::time::Instant::now()
-            + Duration::from_secs(RADIO_READ_TIMEOUT_SECS),
+            + Duration::from_secs(TRACK_READ_TIMEOUT_SECS),
         gen_arc: state.generation.clone(),
         gen: ctx.gen,
         source_tag: "track-stream",
@@ -370,7 +435,7 @@ async fn open_ranged_or_streaming_input(
 /// query string first so Subsonic-style URLs (`stream.view?...&v=1.16.1&...`)
 /// don't latch onto random query-param substrings; only accept short
 /// alphanumeric tails that look like an actual audio extension.
-pub(super) fn url_format_hint(url: &str) -> Option<String> {
+pub(crate) fn url_format_hint(url: &str) -> Option<String> {
     url.split('?').next()
         .and_then(|path| path.rsplit('.').next())
         .filter(|ext| {
@@ -384,160 +449,3 @@ pub(super) fn url_format_hint(url: &str) -> Option<String> {
         })
         .map(|s| s.to_lowercase())
 }
-
-/// Output of `build_source_from_play_input`: the wrapped rodio source plus
-/// whether the chosen source path is seekable (only the Streaming variant
-/// is not).
-pub(super) struct PlaybackSource {
-    pub(super) built: BuiltSource,
-    pub(super) is_seekable: bool,
-}
-
-/// State + decisions audio_play computed before the sink swap.
-pub(super) struct SinkSwapInputs {
-    pub(super) sink: Arc<rodio::Player>,
-    pub(super) duration_secs: f64,
-    pub(super) volume: f32,
-    pub(super) gain_linear: f32,
-    pub(super) fadeout_trigger: Arc<AtomicBool>,
-    pub(super) fadeout_samples: Arc<std::sync::atomic::AtomicU64>,
-    pub(super) crossfade_enabled: bool,
-    pub(super) actual_fade_secs: f32,
-}
-
-/// Atomically swap the new sink into `state.current`, then handle the old
-/// sink: trigger sample-level fade-out (crossfade enabled) or stop it
-/// immediately (hard cut). The fade-out is handed off to a small spawned
-/// task that drops the old sink ~`actual_fade_secs + 0.5 s` later.
-pub(super) fn swap_in_new_sink(state: &State<'_, AudioEngine>, inputs: SinkSwapInputs) {
-    use std::time::Instant;
-
-    let SinkSwapInputs {
-        sink,
-        duration_secs,
-        volume,
-        gain_linear,
-        fadeout_trigger: new_fadeout_trigger,
-        fadeout_samples: new_fadeout_samples,
-        crossfade_enabled,
-        actual_fade_secs,
-    } = inputs;
-
-    let (old_sink, old_fadeout_trigger, old_fadeout_samples) = {
-        let mut cur = state.current.lock().unwrap();
-        let old = cur.sink.take();
-        let old_fo_trigger = cur.fadeout_trigger.take();
-        let old_fo_samples = cur.fadeout_samples.take();
-        cur.sink = Some(sink);
-        cur.duration_secs = duration_secs;
-        cur.seek_offset = 0.0;
-        cur.play_started = Some(Instant::now());
-        cur.paused_at = None;
-        cur.replay_gain_linear = gain_linear;
-        cur.base_volume = volume.clamp(0.0, 1.0);
-        cur.fadeout_trigger = Some(new_fadeout_trigger);
-        cur.fadeout_samples = Some(new_fadeout_samples);
-        (old, old_fo_trigger, old_fo_samples)
-    };
-
-    if crossfade_enabled {
-        if let Some(old) = old_sink {
-            // Trigger sample-level fade-out on Track A via TriggeredFadeOut.
-            // Calculate total fade samples from the measured actual_fade_secs.
-            let rate = state.current_sample_rate.load(Ordering::Relaxed);
-            let ch = state.current_channels.load(Ordering::Relaxed);
-            let fade_total = (actual_fade_secs as f64 * rate as f64 * ch as f64) as u64;
-
-            if let (Some(trigger), Some(samples)) = (old_fadeout_trigger, old_fadeout_samples) {
-                samples.store(fade_total.max(1), Ordering::SeqCst);
-                trigger.store(true, Ordering::SeqCst);
-            }
-
-            // Keep old sink alive until the fade completes + small margin,
-            // then drop it. No volume stepping needed — the fade-out runs
-            // at sample level inside the audio thread.
-            *state.fading_out_sink.lock().unwrap() = Some(old);
-            let fo_arc = state.fading_out_sink.clone();
-            let cleanup_dur = Duration::from_secs_f32(actual_fade_secs + 0.5);
-            tokio::spawn(async move {
-                tokio::time::sleep(cleanup_dur).await;
-                if let Some(s) = fo_arc.lock().unwrap().take() {
-                    s.stop();
-                }
-            });
-        }
-    } else if let Some(old) = old_sink {
-        old.stop();
-    }
-}
-
-/// Dispatch [`PlayInput`] → fully wrapped rodio source. For Bytes the full
-/// in-memory pipeline (incl. iTunSMPB scan); for SeekableMedia / Streaming
-/// the streaming variant runs the decoder build on a blocking thread.
-pub(super) async fn build_source_from_play_input(
-    play_input: PlayInput,
-    state: &State<'_, AudioEngine>,
-    format_hint: Option<&str>,
-    done_flag: Arc<AtomicBool>,
-    fade_in_dur: Duration,
-    hi_res_enabled: bool,
-    duration_hint: f64,
-) -> Result<PlaybackSource, String> {
-    // Always 0 — no application-level resampling. Rodio handles conversion to
-    // the output device rate internally; we let every track play at its native rate.
-    let target_rate: u32 = 0;
-    let mut is_seekable = true;
-    let built = match play_input {
-        PlayInput::Bytes(data) => build_source(
-            data,
-            duration_hint,
-            state.eq_gains.clone(),
-            state.eq_enabled.clone(),
-            state.eq_pre_gain.clone(),
-            done_flag,
-            fade_in_dur,
-            state.samples_played.clone(),
-            target_rate,
-            format_hint,
-            hi_res_enabled,
-        ),
-        PlayInput::SeekableMedia { reader, format_hint: media_hint, tag } => {
-            let decoder = tokio::task::spawn_blocking(move || {
-                SizedDecoder::new_streaming(reader, media_hint.as_deref(), tag)
-            })
-            .await
-            .map_err(|e| e.to_string())??;
-            build_streaming_source(
-                decoder,
-                duration_hint,
-                state.eq_gains.clone(),
-                state.eq_enabled.clone(),
-                state.eq_pre_gain.clone(),
-                done_flag,
-                fade_in_dur,
-                state.samples_played.clone(),
-                target_rate,
-            )
-        }
-        PlayInput::Streaming { reader, format_hint: stream_hint } => {
-            is_seekable = false;
-            let decoder = tokio::task::spawn_blocking(move || {
-                SizedDecoder::new_streaming(Box::new(reader), stream_hint.as_deref(), "track-stream")
-            })
-            .await
-            .map_err(|e| e.to_string())??;
-            build_streaming_source(
-                decoder,
-                duration_hint,
-                state.eq_gains.clone(),
-                state.eq_enabled.clone(),
-                state.eq_pre_gain.clone(),
-                done_flag,
-                fade_in_dur,
-                state.samples_played.clone(),
-                target_rate,
-            )
-        }
-    }?;
-    Ok(PlaybackSource { built, is_seekable })
-}

src-tauri/crates/psysonic-audio/src/playback_rate.rs

@@ -0,0 +1,662 @@
+//! Global playback speed / pitch strategies (varispeed, speed-corrected, preserve pitch).
+
+use std::sync::atomic::{AtomicBool, AtomicU32, Ordering};
+use std::sync::mpsc;
+use std::sync::Arc;
+use std::time::Duration;
+
+use rodio::source::SeekError;
+use rodio::{ChannelCount, SampleRate, Source};
+
+use crate::preserve_worker::PreserveOffload;
+
+pub const STRATEGY_VARISPEED: u32 = 0;
+pub const STRATEGY_PRESERVE_PITCH: u32 = 1;
+pub const STRATEGY_SPEED_CORRECTED: u32 = 2;
+
+pub(crate) const PRESERVE_MAKEUP_GAIN: f32 = 1.35;
+
+#[derive(Clone)]
+pub struct PlaybackRateAtomics {
+    pub enabled: Arc<AtomicBool>,
+    pub strategy: Arc<AtomicU32>,
+    pub speed: Arc<AtomicU32>,
+    pub pitch_semitones: Arc<AtomicU32>,
+}
+
+impl Default for PlaybackRateAtomics {
+    fn default() -> Self {
+        Self {
+            enabled: Arc::new(AtomicBool::new(false)),
+            strategy: Arc::new(AtomicU32::new(STRATEGY_SPEED_CORRECTED)),
+            speed: Arc::new(AtomicU32::new(1.0f32.to_bits())),
+            pitch_semitones: Arc::new(AtomicU32::new(0.0f32.to_bits())),
+        }
+    }
+}
+
+impl PlaybackRateAtomics {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn load_speed(&self) -> f32 {
+        f32::from_bits(self.speed.load(Ordering::Relaxed)).clamp(0.5, 2.0)
+    }
+
+    pub fn load_pitch(&self) -> f32 {
+        f32::from_bits(self.pitch_semitones.load(Ordering::Relaxed)).clamp(-12.0, 12.0)
+    }
+
+    pub fn load_strategy(&self) -> u32 {
+        match self.strategy.load(Ordering::Relaxed) {
+            STRATEGY_PRESERVE_PITCH => STRATEGY_PRESERVE_PITCH,
+            STRATEGY_SPEED_CORRECTED => STRATEGY_SPEED_CORRECTED,
+            _ => STRATEGY_VARISPEED,
+        }
+    }
+}
+
+pub fn uses_preserve_dsp(strategy: u32) -> bool {
+    strategy == STRATEGY_PRESERVE_PITCH || strategy == STRATEGY_SPEED_CORRECTED
+}
+
+pub fn effective_pitch(atomics: &PlaybackRateAtomics) -> f32 {
+    if atomics.load_strategy() == STRATEGY_PRESERVE_PITCH {
+        atomics.load_pitch()
+    } else {
+        0.0
+    }
+}
+
+pub fn is_effect_active(atomics: &PlaybackRateAtomics) -> bool {
+    if !atomics.enabled.load(Ordering::Relaxed) {
+        return false;
+    }
+    let speed = atomics.load_speed();
+    match atomics.load_strategy() {
+        STRATEGY_PRESERVE_PITCH => {
+            (speed - 1.0).abs() > 0.001 || atomics.load_pitch().abs() > 0.001
+        }
+        _ => (speed - 1.0).abs() > 0.001,
+    }
+}
+
+/// True when preserve-pitch DSP (background worker) should run for this track.
+pub(crate) fn preserve_pitch_will_run(atomics: &PlaybackRateAtomics) -> bool {
+    atomics.enabled.load(Ordering::Relaxed)
+        && uses_preserve_dsp(atomics.load_strategy())
+        && is_effect_active(atomics)
+}
+
+/// Content timeline length for seek bar / duration labels (always the full track).
+pub fn effective_duration_secs(base_secs: f64, _atomics: &PlaybackRateAtomics) -> f64 {
+    base_secs
+}
+
+/// Map counter-derived seconds to timeline position for UI / near-end checks.
+pub fn effective_position_secs(raw_secs: f64, atomics: &PlaybackRateAtomics) -> f64 {
+    if !is_effect_active(atomics) {
+        return raw_secs;
+    }
+    if atomics.load_strategy() == STRATEGY_VARISPEED {
+        return raw_secs;
+    }
+    // Preserve DSP outputs at the base sample rate; scale to content timeline.
+    raw_secs * atomics.load_speed() as f64
+}
+
+/// Sample-counter position mapped to the content timeline (seek bar / labels).
+pub(crate) fn content_position_from_samples(
+    samples: u64,
+    sample_rate_hz: u32,
+    channels: u32,
+    atomics: &PlaybackRateAtomics,
+) -> f64 {
+    let divisor = (sample_rate_hz as f64 * channels as f64).max(1.0);
+    effective_position_secs(samples as f64 / divisor, atomics)
+}
+
+/// Counter value that matches `content_position_from_samples` after a content-timeline seek.
+pub(crate) fn raw_counter_samples_for_content_position(
+    content_secs: f64,
+    sample_rate_hz: u32,
+    channels: u32,
+    atomics: &PlaybackRateAtomics,
+) -> u64 {
+    let divisor = (sample_rate_hz as f64 * channels as f64).max(1.0);
+    let raw_secs = if is_effect_active(atomics)
+        && atomics.load_strategy() != STRATEGY_VARISPEED
+    {
+        content_secs / atomics.load_speed().max(0.001) as f64
+    } else {
+        content_secs
+    };
+    (raw_secs * divisor).round() as u64
+}
+
+pub(crate) fn preserve_out_samples(speed: f32) -> usize {
+    (128.0f32 / speed.clamp(0.5, 2.0)).round() as usize
+}
+
+pub struct PlaybackRateSource<S: Source<Item = f32> + Send + 'static> {
+    inner: Option<S>,
+    base_sample_rate: SampleRate,
+    base_channels: ChannelCount,
+    atomics: PlaybackRateAtomics,
+    offload: Option<PreserveOffload>,
+    handback_rx: Option<mpsc::Receiver<S>>,
+    handback_requested: bool,
+}
+
+impl<S: Source<Item = f32> + Send + 'static> PlaybackRateSource<S> {
+    pub fn new(inner: S, atomics: PlaybackRateAtomics) -> Self {
+        let base_sample_rate = inner.sample_rate();
+        let base_channels = inner.channels();
+        Self {
+            inner: Some(inner),
+            base_sample_rate,
+            base_channels,
+            atomics,
+            offload: None,
+            handback_rx: None,
+            handback_requested: false,
+        }
+    }
+
+    fn poll_handback(&mut self) {
+        let Some(rx) = &self.handback_rx else {
+            return;
+        };
+        if let Ok(inner) = rx.try_recv() {
+            self.inner = Some(inner);
+            self.handback_rx = None;
+            self.handback_requested = false;
+            if let Some(offload) = self.offload.take() {
+                offload.join();
+            }
+        }
+    }
+
+    fn request_handback_if_needed(&mut self) {
+        if self.inner.is_some() || self.handback_requested {
+            return;
+        }
+        if let Some(offload) = &self.offload {
+            offload.request_handback();
+            self.handback_requested = true;
+        }
+    }
+
+    fn ensure_offload(&mut self) {
+        if self.offload.is_some() {
+            return;
+        }
+        if let Some(inner) = self.inner.take() {
+            let (handback_tx, handback_rx) = mpsc::sync_channel(1);
+            self.handback_rx = Some(handback_rx);
+            self.offload = Some(PreserveOffload::spawn(
+                inner,
+                self.atomics.clone(),
+                self.base_sample_rate.get(),
+                self.base_channels.get(),
+                handback_tx,
+            ));
+        }
+    }
+
+    fn base_sample_rate(&self) -> SampleRate {
+        self.inner
+            .as_ref()
+            .map(Source::sample_rate)
+            .unwrap_or(self.base_sample_rate)
+    }
+
+    fn try_recover_inner_from_offload(&mut self) {
+        if self.inner.is_some() || self.offload.is_none() {
+            return;
+        }
+        self.request_handback_if_needed();
+        self.poll_handback();
+    }
+
+    fn next_from_inner_or_pad(&mut self) -> Option<f32> {
+        self.try_recover_inner_from_offload();
+        if let Some(inner) = self.inner.as_mut() {
+            return inner.next();
+        }
+        if self
+            .offload
+            .as_ref()
+            .is_some_and(|offload| !offload.is_done())
+        {
+            return Some(0.0);
+        }
+        None
+    }
+}
+
+impl<S: Source<Item = f32> + Send + 'static> Iterator for PlaybackRateSource<S> {
+    type Item = f32;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        if !is_effect_active(&self.atomics) {
+            if let Some(offload) = self.offload.as_mut() {
+                if let Some(s) = offload.pop() {
+                    return Some(s);
+                }
+            }
+            return self.next_from_inner_or_pad();
+        }
+
+        if uses_preserve_dsp(self.atomics.load_strategy()) {
+            self.ensure_offload();
+            if let Some(s) = self.offload.as_mut().and_then(|o| o.pop()) {
+                return Some(s);
+            }
+            if self
+                .offload
+                .as_ref()
+                .is_some_and(|offload| !offload.is_done())
+            {
+                return Some(0.0);
+            }
+            return None;
+        }
+
+        // Varispeed: decoder must stay in `inner` (never in the preserve worker).
+        if self.offload.is_some() {
+            self.try_recover_inner_from_offload();
+        }
+        self.next_from_inner_or_pad()
+    }
+}
+
+impl<S: Source<Item = f32> + Send + 'static> Source for PlaybackRateSource<S> {
+    fn current_span_len(&self) -> Option<usize> {
+        self.inner.as_ref()?.current_span_len()
+    }
+
+    fn channels(&self) -> ChannelCount {
+        self.base_channels
+    }
+
+    fn sample_rate(&self) -> SampleRate {
+        if is_effect_active(&self.atomics) && self.atomics.load_strategy() == STRATEGY_VARISPEED {
+            let factor = self.atomics.load_speed().max(0.001);
+            SampleRate::new((self.base_sample_rate().get() as f32 * factor).max(1.0) as u32)
+                .unwrap_or(self.base_sample_rate)
+        } else {
+            self.base_sample_rate()
+        }
+    }
+
+    fn total_duration(&self) -> Option<Duration> {
+        self.inner.as_ref()?.total_duration()
+    }
+
+    fn try_seek(&mut self, pos: Duration) -> Result<(), SeekError> {
+        // UI / transport always pass content-timeline seconds (0..full track).
+        if let Some(inner) = self.inner.as_mut() {
+            inner.try_seek(pos)?;
+        }
+        if let Some(offload) = self.offload.as_mut() {
+            offload.request_seek(pos);
+            offload.drain();
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pitch_shift::{Shifter, TOTAL_F32};
+
+    #[test]
+    fn passthrough_when_disabled() {
+        let a = PlaybackRateAtomics::new();
+        assert!(!is_effect_active(&a));
+    }
+
+    #[test]
+    fn passthrough_at_unity() {
+        let a = PlaybackRateAtomics::new();
+        a.enabled.store(true, Ordering::Relaxed);
+        assert!(!is_effect_active(&a));
+    }
+
+    #[test]
+    fn active_when_speed_not_one() {
+        let a = PlaybackRateAtomics::new();
+        a.enabled.store(true, Ordering::Relaxed);
+        a.speed.store(1.5f32.to_bits(), Ordering::Relaxed);
+        assert!(is_effect_active(&a));
+    }
+
+    #[test]
+    fn effective_duration_is_content_timeline() {
+        let a = PlaybackRateAtomics::new();
+        a.enabled.store(true, Ordering::Relaxed);
+        a.speed.store(2.0f32.to_bits(), Ordering::Relaxed);
+        for strat in [
+            STRATEGY_VARISPEED,
+            STRATEGY_SPEED_CORRECTED,
+            STRATEGY_PRESERVE_PITCH,
+        ] {
+            a.strategy.store(strat, Ordering::Relaxed);
+            assert!(
+                (effective_duration_secs(200.0, &a) - 200.0).abs() < 0.001,
+                "strategy {strat}"
+            );
+        }
+    }
+
+    #[test]
+    fn effective_position_varispeed_uses_counter() {
+        let a = PlaybackRateAtomics::new();
+        a.enabled.store(true, Ordering::Relaxed);
+        a
+            .strategy
+            .store(STRATEGY_VARISPEED, Ordering::Relaxed);
+        a.speed.store(2.0f32.to_bits(), Ordering::Relaxed);
+        assert!((effective_position_secs(20.0, &a) - 20.0).abs() < 0.001);
+    }
+
+    #[test]
+    fn effective_position_preserve_scales_with_speed() {
+        let a = PlaybackRateAtomics::new();
+        a.enabled.store(true, Ordering::Relaxed);
+        a
+            .strategy
+            .store(STRATEGY_SPEED_CORRECTED, Ordering::Relaxed);
+        a.speed.store(2.0f32.to_bits(), Ordering::Relaxed);
+        assert!((effective_position_secs(10.0, &a) - 20.0).abs() < 0.001);
+    }
+
+    #[test]
+    fn effective_position_inactive_is_raw() {
+        let a = PlaybackRateAtomics::new();
+        assert!((effective_position_secs(15.0, &a) - 15.0).abs() < 0.001);
+    }
+
+    #[test]
+    fn raw_counter_samples_roundtrip_content_timeline() {
+        let a = PlaybackRateAtomics::new();
+        a.enabled.store(true, Ordering::Relaxed);
+        a
+            .strategy
+            .store(STRATEGY_SPEED_CORRECTED, Ordering::Relaxed);
+        a.speed.store(2.0f32.to_bits(), Ordering::Relaxed);
+        let samples = raw_counter_samples_for_content_position(120.0, 44_100, 2, &a);
+        let back = content_position_from_samples(samples, 44_100, 2, &a);
+        assert!((back - 120.0).abs() < 0.05, "roundtrip at 2x preserve");
+    }
+
+    #[test]
+    fn raw_counter_samples_roundtrip_varispeed() {
+        let a = PlaybackRateAtomics::new();
+        a.enabled.store(true, Ordering::Relaxed);
+        a
+            .strategy
+            .store(STRATEGY_VARISPEED, Ordering::Relaxed);
+        a.speed.store(2.0f32.to_bits(), Ordering::Relaxed);
+        let samples = raw_counter_samples_for_content_position(90.0, 44_100, 2, &a);
+        let back = content_position_from_samples(samples, 44_100, 2, &a);
+        assert!((back - 90.0).abs() < 0.05, "roundtrip at 2x varispeed");
+    }
+
+    #[test]
+    fn varispeed_seek_uses_content_timeline() {
+        use std::sync::atomic::{AtomicU64, Ordering as AtomicOrdering};
+        use std::sync::Arc;
+
+        struct SeekSpy {
+            rate: SampleRate,
+            last_seek_secs: Arc<AtomicU64>,
+            remaining: usize,
+        }
+
+        impl Iterator for SeekSpy {
+            type Item = f32;
+            fn next(&mut self) -> Option<f32> {
+                if self.remaining == 0 {
+                    return None;
+                }
+                self.remaining -= 1;
+                Some(0.0)
+            }
+        }
+
+        impl Source for SeekSpy {
+            fn current_span_len(&self) -> Option<usize> {
+                Some(self.remaining)
+            }
+            fn channels(&self) -> ChannelCount {
+                ChannelCount::new(1).unwrap()
+            }
+            fn sample_rate(&self) -> SampleRate {
+                self.rate
+            }
+            fn total_duration(&self) -> Option<Duration> {
+                Some(Duration::from_secs(200))
+            }
+            fn try_seek(&mut self, pos: Duration) -> Result<(), SeekError> {
+                self.last_seek_secs
+                    .store(pos.as_secs_f64().to_bits(), AtomicOrdering::Relaxed);
+                Ok(())
+            }
+        }
+
+        let last = Arc::new(AtomicU64::new(f64::NAN.to_bits()));
+        let spy = SeekSpy {
+            rate: SampleRate::new(44_100).unwrap(),
+            last_seek_secs: last.clone(),
+            remaining: 44_100,
+        };
+
+        let a = PlaybackRateAtomics::new();
+        a.enabled.store(true, Ordering::Relaxed);
+        a
+            .strategy
+            .store(STRATEGY_VARISPEED, Ordering::Relaxed);
+        a.speed.store(2.0f32.to_bits(), Ordering::Relaxed);
+
+        let mut src = PlaybackRateSource::new(spy, a);
+        src.try_seek(Duration::from_secs(120)).unwrap();
+        let got = f64::from_bits(last.load(AtomicOrdering::Relaxed));
+        assert!(
+            (got - 120.0).abs() < 0.001,
+            "varispeed seek must not scale content position, got {got}"
+        );
+    }
+
+    #[test]
+    fn preserve_out_samples_clamped() {
+        assert_eq!(preserve_out_samples(2.0), 64);
+        assert_eq!(preserve_out_samples(0.5), 256);
+    }
+
+    struct FixedRateSource {
+        rate: u32,
+        remaining: usize,
+    }
+
+    impl Iterator for FixedRateSource {
+        type Item = f32;
+        fn next(&mut self) -> Option<f32> {
+            if self.remaining == 0 {
+                return None;
+            }
+            self.remaining -= 1;
+            Some(0.0)
+        }
+    }
+
+    impl Source for FixedRateSource {
+        fn current_span_len(&self) -> Option<usize> {
+            Some(self.remaining)
+        }
+        fn channels(&self) -> ChannelCount {
+            std::num::NonZero::new(1).unwrap()
+        }
+        fn sample_rate(&self) -> SampleRate {
+            SampleRate::new(self.rate).unwrap()
+        }
+        fn total_duration(&self) -> Option<Duration> {
+            Some(Duration::from_secs(1))
+        }
+    }
+
+    #[test]
+    fn speed_corrected_uses_preserve_dsp_path() {
+        let atomics = PlaybackRateAtomics::new();
+        atomics.enabled.store(true, Ordering::Relaxed);
+        atomics
+            .strategy
+            .store(STRATEGY_SPEED_CORRECTED, Ordering::Relaxed);
+        atomics.speed.store(1.5f32.to_bits(), Ordering::Relaxed);
+        assert!(uses_preserve_dsp(atomics.load_strategy()));
+        assert!(is_effect_active(&atomics));
+        assert_eq!(effective_pitch(&atomics), 0.0);
+    }
+
+    #[test]
+    fn preserve_pitch_respects_manual_pitch() {
+        let atomics = PlaybackRateAtomics::new();
+        atomics.enabled.store(true, Ordering::Relaxed);
+        atomics
+            .strategy
+            .store(STRATEGY_PRESERVE_PITCH, Ordering::Relaxed);
+        atomics.pitch_semitones.store(3.0f32.to_bits(), Ordering::Relaxed);
+        assert!(is_effect_active(&atomics));
+        assert_eq!(effective_pitch(&atomics), 3.0);
+    }
+
+    #[test]
+    fn strategy_switch_preserve_to_varispeed_does_not_end_early() {
+        let atomics = PlaybackRateAtomics::new();
+        atomics.enabled.store(true, Ordering::Relaxed);
+        atomics
+            .strategy
+            .store(STRATEGY_SPEED_CORRECTED, Ordering::Relaxed);
+        atomics.speed.store(1.5f32.to_bits(), Ordering::Relaxed);
+
+        let mut src = PlaybackRateSource::new(
+            FixedRateSource {
+                rate: 44_100,
+                remaining: 50_000,
+            },
+            atomics.clone(),
+        );
+        for _ in 0..5_000 {
+            assert!(src.next().is_some());
+        }
+
+        atomics
+            .strategy
+            .store(STRATEGY_VARISPEED, Ordering::Relaxed);
+
+        let mut got = 0usize;
+        for _ in 0..2_000 {
+            if src.next().is_some() {
+                got += 1;
+            } else {
+                break;
+            }
+        }
+        assert!(
+            got > 100,
+            "varispeed should continue after preserve strategy switch, got {got} samples"
+        );
+    }
+
+    #[test]
+    fn varispeed_scales_reported_sample_rate() {
+        let atomics = PlaybackRateAtomics::new();
+        atomics.enabled.store(true, Ordering::Relaxed);
+        atomics
+            .strategy
+            .store(STRATEGY_VARISPEED, Ordering::Relaxed);
+        atomics.speed.store(1.5f32.to_bits(), Ordering::Relaxed);
+        let src = PlaybackRateSource::new(
+            FixedRateSource {
+                rate: 44_100,
+                remaining: 1,
+            },
+            atomics,
+        );
+        assert_eq!(src.sample_rate().get(), 66_150);
+    }
+
+    #[test]
+    fn varispeed_propagates_through_dyn_source() {
+        use crate::sources::DynSource;
+
+        let atomics = PlaybackRateAtomics::new();
+        atomics.enabled.store(true, Ordering::Relaxed);
+        atomics
+            .strategy
+            .store(STRATEGY_VARISPEED, Ordering::Relaxed);
+        atomics.speed.store(2.0f32.to_bits(), Ordering::Relaxed);
+        let rate_src = PlaybackRateSource::new(
+            FixedRateSource {
+                rate: 48_000,
+                remaining: 1,
+            },
+            atomics,
+        );
+        let dyn_src = DynSource::new(rate_src);
+        assert_eq!(dyn_src.sample_rate().get(), 96_000);
+    }
+
+    fn rms_f32(samples: &[f32]) -> f32 {
+        if samples.is_empty() {
+            return 0.0;
+        }
+        (samples.iter().map(|s| s * s).sum::<f32>() / samples.len() as f32).sqrt()
+    }
+
+    #[test]
+    fn preserve_pitch_makeup_keeps_level_reasonable() {
+        let sr = 44_100f32;
+        let mut input = [0.0f32; 128];
+        for (i, s) in input.iter_mut().enumerate() {
+            *s = (i as f32 * 0.12).sin() * 0.75;
+        }
+        let in_rms = rms_f32(&input);
+        let mut shifter: Shifter<Box<[f32; TOTAL_F32]>> =
+            Shifter::new(Box::new([0.0; TOTAL_F32]));
+        for _ in 0..24 {
+            shifter.shift(&input, 4.0, 128, sr);
+        }
+        let dry = shifter.shift(&input, 4.0, 128, sr);
+        let boosted: Vec<f32> = dry
+            .iter()
+            .map(|&s| (s * PRESERVE_MAKEUP_GAIN).clamp(-1.0, 1.0))
+            .collect();
+        let out_rms = rms_f32(&boosted);
+        assert!(out_rms > in_rms * 0.8, "out_rms={out_rms} in_rms={in_rms}");
+        assert!(out_rms < in_rms * 1.25, "out_rms={out_rms} in_rms={in_rms}");
+    }
+
+    #[test]
+    fn live_speed_change_represerves_content_position() {
+        let atomics = PlaybackRateAtomics::new();
+        atomics.enabled.store(true, Ordering::Relaxed);
+        atomics
+            .strategy
+            .store(STRATEGY_SPEED_CORRECTED, Ordering::Relaxed);
+        atomics.speed.store(1.5f32.to_bits(), Ordering::Relaxed);
+
+        let samples = raw_counter_samples_for_content_position(30.0, 44_100, 2, &atomics);
+        let content = content_position_from_samples(samples, 44_100, 2, &atomics);
+        assert!((content - 30.0).abs() < 0.05);
+
+        atomics.speed.store(1.8f32.to_bits(), Ordering::Relaxed);
+        let restamped =
+            raw_counter_samples_for_content_position(content, 44_100, 2, &atomics);
+        let after = content_position_from_samples(restamped, 44_100, 2, &atomics);
+        assert!((after - 30.0).abs() < 0.05);
+    }
+}

src-tauri/crates/psysonic-audio/src/power_resume.rs

@@ -4,11 +4,11 @@
 use std::sync::Mutex;
 use std::time::{Duration, Instant};
 
-use tauri::AppHandle;
-use tauri::Manager;
+use tauri::{AppHandle, Emitter, Manager};
 
 use super::device_watcher::{reopen_output_stream, ReopenNotify};
-use super::engine::AudioEngine;
+use super::engine::{request_stream_release, AudioEngine};
+use super::stream_idle::{output_stream_is_needed, teardown_playback_sinks_for_idle_release};
 
 static RESUME_REOPEN_DEBOUNCE: Mutex<Option<Instant>> = Mutex::new(None);
 const DEBOUNCE: Duration = Duration::from_millis(900);
@@ -30,10 +30,22 @@ pub(crate) fn debounce_allow_resume_reopen() -> bool {
 pub(crate) async fn reopen_audio_after_system_resume(app: &AppHandle) {
     tokio::time::sleep(Duration::from_millis(400)).await;
 
-    let device_name = match app.try_state::<AudioEngine>() {
-        Some(e) => e.selected_device.lock().unwrap().clone(),
-        None => return,
+    let Some(state) = app.try_state::<AudioEngine>() else {
+        return;
     };
+    let engine = state.inner();
+
+    if !output_stream_is_needed(engine) {
+        if engine.stream_handle.lock().unwrap().is_some() {
+            teardown_playback_sinks_for_idle_release(engine);
+            let _ = request_stream_release(engine);
+            *engine.stream_handle.lock().unwrap() = None;
+            let _ = app.emit("audio:output-released", ());
+        }
+        return;
+    }
+
+    let device_name = engine.selected_device.lock().unwrap().clone();
 
     if reopen_output_stream(app, device_name, ReopenNotify::DeviceChanged).await {
         crate::app_eprintln!("[psysonic] audio output reopened after system resume");

src-tauri/crates/psysonic-audio/src/preload_commands.rs

@@ -3,65 +3,230 @@
 //! (which constructs the gapless source chain) and `audio_play` (which
 //! starts playback). All three live in this audio submodule.
 
+use std::path::PathBuf;
 use std::sync::atomic::Ordering;
 use std::time::Duration;
 
+use serde::Serialize;
 use tauri::{AppHandle, Emitter, State};
 
-use super::engine::{audio_http_client, AudioEngine};
+use psysonic_analysis::analysis_runtime::AnalysisBackfillPriority;
+
+use super::analysis_dispatch::{
+    dispatch_track_analysis_bytes, prepare_playback_analysis, spawn_track_analysis_file,
+    TrackAnalysisOrigin,
+};
+use super::engine::AudioEngine;
 use super::helpers::{analysis_cache_track_id, same_playback_target};
 use super::state::PreloadedTrack;
 
+#[derive(Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct PreloadEventPayload {
+    url: String,
+    track_id: Option<String>,
+}
+
+async fn seed_preload_analysis_bytes(
+    app: &AppHandle,
+    state: &State<'_, AudioEngine>,
+    url: &str,
+    data: &[u8],
+    analysis_track_id: Option<&str>,
+    server_id: Option<&str>,
+) {
+    let Some(track_id) = analysis_cache_track_id(analysis_track_id, url) else {
+        return;
+    };
+    let (sid, priority) = prepare_playback_analysis(
+        app,
+        state,
+        server_id,
+        &track_id,
+        Some(AnalysisBackfillPriority::Middle),
+    );
+    if let Err(e) = dispatch_track_analysis_bytes(
+        app,
+        TrackAnalysisOrigin::PrefetchOrCacheFile,
+        &sid,
+        &track_id,
+        data.to_vec(),
+        priority,
+    )
+    .await
+    {
+        crate::app_eprintln!("[analysis] preload seed failed for {track_id}: {e}");
+    }
+}
+
+fn seed_preload_analysis_file(
+    app: &AppHandle,
+    state: &State<'_, AudioEngine>,
+    url: &str,
+    file_path: PathBuf,
+    analysis_track_id: Option<&str>,
+    server_id: Option<&str>,
+) {
+    let Some(track_id) = analysis_cache_track_id(analysis_track_id, url) else {
+        return;
+    };
+    let (sid, priority) = prepare_playback_analysis(
+        app,
+        state,
+        server_id,
+        &track_id,
+        Some(AnalysisBackfillPriority::Middle),
+    );
+    crate::app_deprintln!(
+        "[stream] audio_preload: local file analysis track_id={} path={}",
+        track_id,
+        file_path.display()
+    );
+    spawn_track_analysis_file(
+        app.clone(),
+        TrackAnalysisOrigin::LocalFilePlayback,
+        sid,
+        track_id,
+        file_path,
+        priority,
+        None,
+    );
+}
+
+fn emit_preload_ready(app: &AppHandle, url: String, track_id: Option<String>) {
+    let _ = app.emit(
+        "audio:preload-ready",
+        PreloadEventPayload {
+            url,
+            track_id,
+        },
+    );
+}
+
+fn emit_preload_cancelled(app: &AppHandle, url: String, track_id: Option<String>) {
+    let _ = app.emit(
+        "audio:preload-cancelled",
+        PreloadEventPayload {
+            url,
+            track_id,
+        },
+    );
+}
+
 #[tauri::command]
+#[specta::specta]
 pub async fn audio_preload(
     url: String,
     duration_hint: f64,
     analysis_track_id: Option<String>,
+    server_id: Option<String>,
+    eager: Option<bool>,
     app: AppHandle,
     state: State<'_, AudioEngine>,
 ) -> Result<(), String> {
-    {
-        let preloaded = state.preloaded.lock().unwrap();
-        if preloaded.as_ref().is_some_and(|p| same_playback_target(&p.url, &url)) {
-            let _ = app.emit("audio:preload-ready", url.clone());
-            return Ok(());
-        }
-    }
-    // Throttle: wait 8 s before starting the background download so it does not
-    // compete with the decode + sink-feed work of the just-started current track.
-    // If the user skips during the wait the generation counter changes and we abort.
-    let gen_snapshot = state.generation.load(Ordering::Relaxed);
-    tokio::time::sleep(Duration::from_secs(8)).await;
-    if state.generation.load(Ordering::Relaxed) != gen_snapshot {
-        return Ok(());
-    }
-    let data: Vec<u8> = if let Some(path) = url.strip_prefix("psysonic-local://") {
-        tokio::fs::read(path).await.map_err(|e| e.to_string())?
-    } else {
-        let response = audio_http_client(&state).get(&url).send().await.map_err(|e| e.to_string())?;
-        if !response.status().is_success() {
-            return Ok(());
-        }
-        response.bytes().await.map_err(|e| e.to_string())?.into()
-    };
-    let _ = duration_hint; // kept in API for compatibility
     let logical_trim = analysis_track_id
         .as_ref()
         .map(|s| s.trim().to_string())
         .filter(|s| !s.is_empty());
-    if let Some(track_id) = analysis_cache_track_id(logical_trim.as_deref(), &url) {
-        crate::app_deprintln!(
-            "[stream] audio_preload: bytes ready track_id={} size_mib={:.2} — invoking full-track analysis",
-            track_id,
-            data.len() as f64 / (1024.0 * 1024.0)
+    let track_id_for_events = logical_trim.clone();
+
+    let is_local = url.starts_with("psysonic-local://");
+
+    // Hot/offline cache: playback reads from disk — seed analysis from the file
+    // (512 MiB cap) without copying into the RAM preload slot.
+    if is_local {
+        let path = PathBuf::from(url.strip_prefix("psysonic-local://").unwrap());
+        if !path.is_file() {
+            crate::app_deprintln!(
+                "[stream] audio_preload: local file missing path={}",
+                path.display()
+            );
+            emit_preload_cancelled(&app, url, track_id_for_events);
+            return Ok(());
+        }
+        seed_preload_analysis_file(
+            &app,
+            &state,
+            &url,
+            path,
+            logical_trim.as_deref(),
+            server_id.as_deref(),
         );
-        let high = crate::engine::analysis_track_id_is_current_playback(&state, &track_id);
-        if let Err(e) = psysonic_analysis::analysis_runtime::submit_analysis_cpu_seed(app.clone(), track_id.clone(), data.clone(), high).await {
-            crate::app_eprintln!("[analysis] preload seed failed for {}: {}", track_id, e);
+        emit_preload_ready(&app, url, track_id_for_events);
+        return Ok(());
+    }
+
+    // Remote URL — reuse in-memory bytes when a prior HTTP preload finished.
+    {
+        let cached = {
+            let preloaded = state.preloaded.lock().unwrap();
+            preloaded
+                .as_ref()
+                .filter(|p| same_playback_target(&p.url, &url))
+                .map(|p| p.data.clone())
+        };
+        if let Some(data) = cached {
+            if !data.is_empty() {
+                seed_preload_analysis_bytes(
+                    &app,
+                    &state,
+                    &url,
+                    &data,
+                    logical_trim.as_deref(),
+                    server_id.as_deref(),
+                )
+                .await;
+            }
+            return Ok(());
         }
     }
+
+    let _ = duration_hint; // kept in API for compatibility
+
+    // Throttle: wait 8 s before starting the background download so it does not
+    // compete with the decode + sink-feed work of the just-started current track.
+    // Eager callers (crossfade/AutoDJ pre-buffer, fired ~30 s before the fade
+    // when the current track is long-settled) skip the wait so the RAM slot
+    // fills in time for the fade to fire. If the user skips during the wait the
+    // generation counter changes and we abort.
+    let gen_snapshot = state.generation.load(Ordering::Relaxed);
+    if !eager.unwrap_or(false) {
+        tokio::time::sleep(Duration::from_secs(8)).await;
+        if state.generation.load(Ordering::Relaxed) != gen_snapshot {
+            emit_preload_cancelled(&app, url, track_id_for_events);
+            return Ok(());
+        }
+    }
+
+    let response = crate::engine::playback_scoped_get(
+        &state,
+        &app,
+        &url,
+        server_id.as_deref(),
+    )
+    .send()
+    .await
+    .map_err(|e| e.to_string())?;
+    if !response.status().is_success() {
+        emit_preload_cancelled(&app, url, track_id_for_events);
+        return Ok(());
+    }
+    let data: Vec<u8> = response.bytes().await.map_err(|e| e.to_string())?.into();
+
+    if !data.is_empty() {
+        seed_preload_analysis_bytes(
+            &app,
+            &state,
+            &url,
+            &data,
+            logical_trim.as_deref(),
+            server_id.as_deref(),
+        )
+        .await;
+    }
+
     let url_for_emit = url.clone();
     *state.preloaded.lock().unwrap() = Some(PreloadedTrack { url, data });
-    let _ = app.emit("audio:preload-ready", url_for_emit);
+    emit_preload_ready(&app, url_for_emit, track_id_for_events);
     Ok(())
 }

src-tauri/crates/psysonic-audio/src/preserve_worker.rs

@@ -0,0 +1,467 @@
+//! Background worker for preserve-pitch DSP (phase vocoder is too heavy for cpal callback).
+
+use std::collections::VecDeque;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::mpsc::{self, RecvTimeoutError, SyncSender};
+use std::sync::Arc;
+use std::thread::{self, JoinHandle};
+use std::time::Duration;
+
+use pitch_shift::{Shifter, TOTAL_F32};
+use ringbuf::traits::{Consumer, Observer, Producer, Split};
+use ringbuf::{HeapCons, HeapProd, HeapRb};
+use rodio::Source;
+
+use crate::playback_rate::{
+    effective_pitch, is_effect_active, preserve_out_samples, PlaybackRateAtomics, PRESERVE_MAKEUP_GAIN,
+    uses_preserve_dsp,
+};
+
+const FRAME_BLOCK: usize = 128;
+const PRESERVE_OUT_MAX: usize = 1023;
+const PRESERVE_PARAM_EPS_PITCH: f32 = 0.05;
+const PRESERVE_PARAM_EPS_SPEED: f32 = 0.001;
+const RB_MIN_CAPACITY: usize = 44_100 * 2 * 2; // ~2 s stereo @ 44.1 kHz
+const RB_TARGET_FILL: f32 = 0.6;
+const RB_FILL_HIGH: f32 = 0.88;
+const FORWARD_BATCH: usize = 4096;
+const WORKER_IDLE_SLEEP: Duration = Duration::from_millis(1);
+
+enum WorkerCmd {
+    Seek(Duration),
+    Handback,
+    Shutdown,
+}
+
+struct PreserveWorkerEnv {
+    atomics: PlaybackRateAtomics,
+    sample_rate: u32,
+    channels: u16,
+    capacity: usize,
+    stop: Arc<AtomicBool>,
+    done: Arc<AtomicBool>,
+    cmd_rx: mpsc::Receiver<WorkerCmd>,
+}
+
+pub(crate) struct PreserveOffload {
+    cons: HeapCons<f32>,
+    stop: Arc<AtomicBool>,
+    done: Arc<AtomicBool>,
+    cmd_tx: SyncSender<WorkerCmd>,
+    thread: Option<JoinHandle<()>>,
+}
+
+impl PreserveOffload {
+    pub(crate) fn spawn<S: Source<Item = f32> + Send + 'static>(
+        inner: S,
+        atomics: PlaybackRateAtomics,
+        sample_rate: u32,
+        channels: u16,
+        handback_tx: SyncSender<S>,
+    ) -> Self {
+        let cap = ((sample_rate as f32 * channels as f32 * 2.5) as usize).max(RB_MIN_CAPACITY);
+        let rb = HeapRb::<f32>::new(cap);
+        let (prod, cons) = rb.split();
+        let stop = Arc::new(AtomicBool::new(false));
+        let done = Arc::new(AtomicBool::new(false));
+        let (cmd_tx, cmd_rx) = mpsc::sync_channel::<WorkerCmd>(8);
+        let stop_worker = stop.clone();
+        let done_worker = done.clone();
+        let thread = thread::Builder::new()
+            .name("psysonic-preserve-pitch".into())
+            .spawn(move || {
+                worker_main(
+                    inner,
+                    prod,
+                    PreserveWorkerEnv {
+                        atomics,
+                        sample_rate,
+                        channels,
+                        capacity: cap,
+                        stop: stop_worker,
+                        done: done_worker,
+                        cmd_rx,
+                    },
+                    handback_tx,
+                );
+            })
+            .expect("spawn preserve-pitch worker");
+
+        Self {
+            cons,
+            stop,
+            done,
+            cmd_tx,
+            thread: Some(thread),
+        }
+    }
+
+    pub(crate) fn pop(&mut self) -> Option<f32> {
+        self.cons.try_pop()
+    }
+
+    pub(crate) fn is_done(&self) -> bool {
+        self.done.load(Ordering::Acquire)
+    }
+
+    pub(crate) fn request_seek(&self, pos: Duration) {
+        let _ = self.cmd_tx.send(WorkerCmd::Seek(pos));
+    }
+
+    pub(crate) fn request_handback(&self) {
+        let _ = self.cmd_tx.send(WorkerCmd::Handback);
+    }
+
+    pub(crate) fn drain(&mut self) {
+        while self.cons.try_pop().is_some() {}
+    }
+
+    pub(crate) fn join(mut self) {
+        self.stop.store(true, Ordering::Release);
+        let _ = self.cmd_tx.send(WorkerCmd::Shutdown);
+        if let Some(t) = self.thread.take() {
+            let _ = t.join();
+        }
+    }
+}
+
+impl Drop for PreserveOffload {
+    fn drop(&mut self) {
+        self.stop.store(true, Ordering::Release);
+        let _ = self.cmd_tx.send(WorkerCmd::Shutdown);
+        if let Some(t) = self.thread.take() {
+            let _ = t.join();
+        }
+    }
+}
+
+struct PreserveChannelState {
+    shifter: Shifter<Box<[f32; TOTAL_F32]>>,
+    frame: Vec<f32>,
+}
+
+impl PreserveChannelState {
+    fn new() -> Self {
+        Self {
+            shifter: Shifter::new(Box::new([0.0; TOTAL_F32])),
+            frame: Vec::with_capacity(FRAME_BLOCK),
+        }
+    }
+
+    fn reset(&mut self) {
+        self.shifter = Shifter::new(Box::new([0.0; TOTAL_F32]));
+        self.frame.clear();
+    }
+
+    fn reset_shifter(&mut self) {
+        self.shifter = Shifter::new(Box::new([0.0; TOTAL_F32]));
+    }
+}
+
+struct PreserveState {
+    channels: Vec<PreserveChannelState>,
+    pending: VecDeque<f32>,
+    channel_idx: usize,
+    last_pitch: f32,
+    last_speed: f32,
+}
+
+impl PreserveState {
+    fn for_channels(count: u16) -> Self {
+        let n = count.max(1) as usize;
+        Self {
+            channels: (0..n).map(|_| PreserveChannelState::new()).collect(),
+            pending: VecDeque::new(),
+            channel_idx: 0,
+            last_pitch: f32::NAN,
+            last_speed: f32::NAN,
+        }
+    }
+
+    fn reset(&mut self, channels: u16) {
+        let n = channels.max(1) as usize;
+        if self.channels.len() != n {
+            self.channels = (0..n).map(|_| PreserveChannelState::new()).collect();
+        } else {
+            for ch in &mut self.channels {
+                ch.reset();
+            }
+        }
+        self.pending.clear();
+        self.channel_idx = 0;
+        self.last_pitch = f32::NAN;
+        self.last_speed = f32::NAN;
+    }
+
+    fn reset_if_params_changed(&mut self, pitch: f32, speed: f32) {
+        if self.last_pitch.is_nan() {
+            self.last_pitch = pitch;
+            self.last_speed = speed;
+            return;
+        }
+        if (pitch - self.last_pitch).abs() > PRESERVE_PARAM_EPS_PITCH
+            || (speed - self.last_speed).abs() > PRESERVE_PARAM_EPS_SPEED
+        {
+            for ch in &mut self.channels {
+                ch.reset_shifter();
+            }
+            self.pending.clear();
+            self.last_pitch = pitch;
+            self.last_speed = speed;
+        }
+    }
+
+    fn process_block(&mut self, speed: f32, pitch: f32, sample_rate: f32) {
+        self.reset_if_params_changed(pitch, speed);
+        let out_n = preserve_out_samples(speed).clamp(1, PRESERVE_OUT_MAX);
+        let ch_count = self.channels.len();
+        let mut outs: Vec<&[f32]> = Vec::with_capacity(ch_count);
+        for ch in &mut self.channels {
+            if ch.frame.len() == FRAME_BLOCK {
+                let out = ch.shifter.shift(&ch.frame, pitch, out_n, sample_rate);
+                outs.push(out);
+                ch.frame.clear();
+            }
+        }
+        if outs.len() != ch_count {
+            return;
+        }
+        for i in 0..out_n {
+            for out_slice in &outs {
+                if let Some(&sample) = out_slice.get(i) {
+                    self.pending
+                        .push_back((sample * PRESERVE_MAKEUP_GAIN).clamp(-1.0, 1.0));
+                }
+            }
+        }
+    }
+}
+
+fn ring_fill(prod: &HeapProd<f32>, capacity: usize) -> f32 {
+    1.0 - prod.vacant_len() as f32 / capacity as f32
+}
+
+fn push_pending(prod: &mut HeapProd<f32>, pending: &mut VecDeque<f32>, stop: &AtomicBool) {
+    while let Some(&s) = pending.front() {
+        if stop.load(Ordering::Acquire) {
+            return;
+        }
+        if prod.try_push(s).is_ok() {
+            pending.pop_front();
+        } else {
+            return;
+        }
+    }
+}
+
+fn forward_passthrough<S: Source<Item = f32>>(
+    inner: &mut S,
+    prod: &mut HeapProd<f32>,
+    capacity: usize,
+    stop: &AtomicBool,
+) -> bool {
+    let target = (capacity as f32 * RB_TARGET_FILL) as usize;
+    let mut pushed = 0usize;
+    while prod.occupied_len() < target && pushed < FORWARD_BATCH {
+        if stop.load(Ordering::Acquire) {
+            return false;
+        }
+        let Some(s) = inner.next() else {
+            return false;
+        };
+        if prod.try_push(s).is_err() {
+            break;
+        }
+        pushed += 1;
+    }
+    true
+}
+
+fn worker_main<S: Source<Item = f32> + Send>(
+    mut inner: S,
+    mut prod: HeapProd<f32>,
+    env: PreserveWorkerEnv,
+    handback_tx: SyncSender<S>,
+) {
+    let PreserveWorkerEnv {
+        atomics,
+        sample_rate,
+        channels,
+        capacity,
+        stop,
+        done,
+        cmd_rx,
+    } = env;
+    let ch_count = channels.max(1) as usize;
+    let mut preserve = PreserveState::for_channels(channels);
+    let sr = sample_rate as f32;
+
+    'run: while !stop.load(Ordering::Acquire) {
+        if let Ok(cmd) = cmd_rx.try_recv() {
+            match cmd {
+                WorkerCmd::Shutdown => break,
+                WorkerCmd::Handback => {
+                    push_pending(&mut prod, &mut preserve.pending, &stop);
+                    let _ = handback_tx.send(inner);
+                    done.store(true, Ordering::Release);
+                    return;
+                }
+                WorkerCmd::Seek(pos) => {
+                    let _ = inner.try_seek(pos);
+                    preserve.reset(channels);
+                }
+            }
+        }
+
+        let use_preserve = atomics.enabled.load(Ordering::Relaxed)
+            && uses_preserve_dsp(atomics.load_strategy())
+            && is_effect_active(&atomics);
+
+        if !use_preserve {
+            preserve.reset(channels);
+            push_pending(&mut prod, &mut preserve.pending, &stop);
+            let fill = ring_fill(&prod, capacity);
+            if fill >= RB_FILL_HIGH {
+                match cmd_rx.recv_timeout(WORKER_IDLE_SLEEP) {
+                    Ok(WorkerCmd::Shutdown) => break 'run,
+                    Ok(WorkerCmd::Handback) => {
+                        push_pending(&mut prod, &mut preserve.pending, &stop);
+                        let _ = handback_tx.send(inner);
+                        done.store(true, Ordering::Release);
+                        return;
+                    }
+                    Ok(WorkerCmd::Seek(pos)) => {
+                        let _ = inner.try_seek(pos);
+                        preserve.reset(channels);
+                    }
+                    Err(RecvTimeoutError::Timeout) => continue,
+                    Err(RecvTimeoutError::Disconnected) => break 'run,
+                }
+            }
+            if !forward_passthrough(&mut inner, &mut prod, capacity, &stop) {
+                break;
+            }
+            continue;
+        }
+
+        let fill = ring_fill(&prod, capacity);
+        if fill >= RB_FILL_HIGH {
+            match cmd_rx.recv_timeout(WORKER_IDLE_SLEEP) {
+                Ok(WorkerCmd::Shutdown) => break 'run,
+                Ok(WorkerCmd::Handback) => {
+                    push_pending(&mut prod, &mut preserve.pending, &stop);
+                    let _ = handback_tx.send(inner);
+                    done.store(true, Ordering::Release);
+                    return;
+                }
+                Ok(WorkerCmd::Seek(pos)) => {
+                    let _ = inner.try_seek(pos);
+                    preserve.reset(channels);
+                }
+                Err(RecvTimeoutError::Timeout) => continue,
+                Err(RecvTimeoutError::Disconnected) => break 'run,
+            }
+        }
+
+        push_pending(&mut prod, &mut preserve.pending, &stop);
+
+        if !preserve.pending.is_empty() {
+            continue;
+        }
+
+        match inner.next() {
+            Some(s) => {
+                let ch = preserve.channel_idx;
+                preserve.channels[ch].frame.push(s);
+                preserve.channel_idx = (ch + 1) % ch_count;
+                if preserve
+                    .channels
+                    .iter()
+                    .all(|c| c.frame.len() >= FRAME_BLOCK)
+                {
+                    preserve.process_block(
+                        atomics.load_speed(),
+                        effective_pitch(&atomics),
+                        sr,
+                    );
+                }
+            }
+            None => break,
+        }
+    }
+
+    push_pending(&mut prod, &mut preserve.pending, &stop);
+    done.store(true, Ordering::Release);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::playback_rate::STRATEGY_PRESERVE_PITCH;
+    use rodio::{ChannelCount, SampleRate};
+    use std::time::Duration as StdDuration;
+
+    struct SineSource {
+        remaining: usize,
+        rate: u32,
+    }
+
+    impl Iterator for SineSource {
+        type Item = f32;
+        fn next(&mut self) -> Option<f32> {
+            if self.remaining == 0 {
+                return None;
+            }
+            self.remaining -= 1;
+            Some(0.25)
+        }
+    }
+
+    impl Source for SineSource {
+        fn current_span_len(&self) -> Option<usize> {
+            Some(self.remaining)
+        }
+        fn channels(&self) -> ChannelCount {
+            std::num::NonZero::new(2).unwrap()
+        }
+        fn sample_rate(&self) -> SampleRate {
+            SampleRate::new(self.rate).unwrap()
+        }
+        fn total_duration(&self) -> Option<StdDuration> {
+            Some(StdDuration::from_secs(1))
+        }
+    }
+
+    #[test]
+    fn worker_prefills_ring_before_done() {
+        let atomics = PlaybackRateAtomics::new();
+        atomics.enabled.store(true, Ordering::Relaxed);
+        atomics
+            .strategy
+            .store(STRATEGY_PRESERVE_PITCH, Ordering::Relaxed);
+        atomics.speed.store(1.25f32.to_bits(), Ordering::Relaxed);
+
+        let src = SineSource {
+            remaining: 44_100 * 2,
+            rate: 44_100,
+        };
+        let (tx, _rx) = mpsc::sync_channel(1);
+        let mut offload = PreserveOffload::spawn(src, atomics, 44_100, 2, tx);
+        std::thread::sleep(Duration::from_millis(150));
+        let mut got = 0usize;
+        for _ in 0..10_000 {
+            if let Some(s) = offload.pop() {
+                got += 1;
+                if got > 500 {
+                    break;
+                }
+                let _ = s;
+            } else if offload.is_done() {
+                break;
+            } else {
+                std::thread::sleep(Duration::from_millis(1));
+            }
+        }
+        assert!(got > 500, "expected prefetched samples, got {got}");
+    }
+}

src-tauri/crates/psysonic-audio/src/preview.rs

@@ -1,6 +1,6 @@
 //! Short preview playback on a secondary sink (same output stream).
-use std::sync::atomic::Ordering;
-use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};
 
 use rodio::Player;
@@ -8,9 +8,18 @@ use rodio::Source;
 use tauri::{AppHandle, Emitter, State};
 
 use super::decode::SizedDecoder;
-use super::engine::{audio_http_client, AudioEngine};
-use super::helpers::MASTER_HEADROOM;
+use super::engine::{audio_http_client, AudioEngine, PlaybackHttpHeaders};
+use super::helpers::{
+    content_type_to_hint, format_hint_from_content_disposition, normalize_stream_suffix_for_hint,
+    resolve_playback_format_hint, sniff_stream_format_extension, STREAM_FORMAT_SNIFF_PROBE_BYTES,
+    MASTER_HEADROOM,
+};
+use super::play_input::url_format_hint;
 use super::sources::PriorityBoostSource;
+use super::stream::{
+    mp4_needs_tail_prefetch, ranged_download_task, wait_for_ranged_mp4_probe_ready,
+    RangedHttpSource, RangedMp4ProbeGate,
+};
 
 // ────────────────────────────────────────────────────────────────────────────
 // Preview engine — secondary Sink on the same OutputStream, fed by Symphonia.
@@ -90,26 +99,252 @@ pub(crate) fn preview_resume_main(state: &AudioEngine) {
     }
 }
 
-/// Format hint inferred from a Subsonic stream URL. The frontend always passes
-/// a `format=flac` query param for `.opus` files (server transcodes); for
-/// everything else we guess from the URL's `format=` value or fall back to None.
+/// `format=` query param on Subsonic stream URLs (transcode targets).
 pub(crate) fn preview_format_hint_from_url(url: &str) -> Option<String> {
     url.split('?')
         .nth(1)?
         .split('&')
         .find_map(|kv| {
             let (k, v) = kv.split_once('=')?;
-            if k.eq_ignore_ascii_case("format") { Some(v.to_string()) } else { None }
+            if k.eq_ignore_ascii_case("format") {
+                Some(v.to_string())
+            } else {
+                None
+            }
         })
 }
 
+/// Symphonia container hint for preview downloads — mirrors main playback:
+/// Content-Type / Content-Disposition, URL tail, Subsonic suffix, magic-byte sniff.
+pub(crate) fn resolve_preview_format_hint(
+    url: &str,
+    content_type: Option<&str>,
+    content_disposition: Option<&str>,
+    stream_suffix: Option<&str>,
+    bytes: &[u8],
+) -> Option<String> {
+    let media_hint = content_type
+        .and_then(content_type_to_hint)
+        .or_else(|| {
+            content_disposition.and_then(format_hint_from_content_disposition)
+        });
+    let url_hint = preview_format_hint_from_url(url).or_else(|| url_format_hint(url));
+    resolve_playback_format_hint(
+        url_hint.as_deref(),
+        stream_suffix,
+        media_hint.as_deref(),
+        Some(bytes),
+    )
+}
+
+fn preview_http_client(state: &AudioEngine) -> reqwest::Client {
+    reqwest::Client::builder()
+        .timeout(Duration::from_secs(300))
+        .use_rustls_tls()
+        .user_agent(psysonic_core::user_agent::subsonic_wire_user_agent())
+        .build()
+        .unwrap_or_else(|_| audio_http_client(state))
+}
+
+/// Open a preview decoder — ranged HTTP when the server supports it (starts
+/// after ~384 KiB buffered), otherwise falls back to a full in-memory download.
+async fn open_preview_decoder(
+    url: &str,
+    format_suffix: Option<&str>,
+    gen: u64,
+    state: &AudioEngine,
+    app: &AppHandle,
+) -> Result<Option<SizedDecoder>, String> {
+    let http_headers = PlaybackHttpHeaders::from_app(app, None);
+    let preview_http = preview_http_client(state);
+    let response = http_headers
+        .apply(url, preview_http.get(url))
+        .send()
+        .await
+        .map_err(|e| format!("preview: connection failed: {e}"))?
+        .error_for_status()
+        .map_err(|e| format!("preview: HTTP {e}"))?;
+
+    let mut stream_hint = content_type_to_hint(
+        response
+            .headers()
+            .get(reqwest::header::CONTENT_TYPE)
+            .and_then(|v| v.to_str().ok())
+            .unwrap_or(""),
+    )
+    .or_else(|| {
+        response
+            .headers()
+            .get(reqwest::header::CONTENT_DISPOSITION)
+            .and_then(|v| v.to_str().ok())
+            .and_then(format_hint_from_content_disposition)
+    })
+    .or_else(|| normalize_stream_suffix_for_hint(format_suffix))
+    .or_else(|| preview_format_hint_from_url(url))
+    .or_else(|| url_format_hint(url));
+
+    let supports_range = response
+        .headers()
+        .get(reqwest::header::ACCEPT_RANGES)
+        .and_then(|v| v.to_str().ok())
+        .is_some_and(|v| v.to_ascii_lowercase().contains("bytes"));
+    let total_size = response.content_length();
+
+    if stream_hint.is_none() && supports_range {
+        if let Some(total_u64) = total_size.filter(|&t| t > 0) {
+            let last = total_u64
+                .saturating_sub(1)
+                .min((STREAM_FORMAT_SNIFF_PROBE_BYTES - 1) as u64);
+            if let Ok(pr) = http_headers
+                .apply(url, preview_http.get(url))
+                .header(reqwest::header::RANGE, format!("bytes=0-{last}"))
+                .send()
+                .await
+            {
+                let stat = pr.status();
+                let ok = stat == reqwest::StatusCode::PARTIAL_CONTENT
+                    || stat == reqwest::StatusCode::OK;
+                if ok {
+                    if let Ok(bytes) = pr.bytes().await {
+                        if !bytes.is_empty() {
+                            stream_hint = sniff_stream_format_extension(&bytes).or(stream_hint);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    if let (true, Some(total), true) = (supports_range, total_size, stream_hint.is_some()) {
+        if state.preview_gen.load(Ordering::SeqCst) != gen {
+            return Ok(None);
+        }
+        let total_usize = total as usize;
+        crate::app_deprintln!(
+            "[preview] ranged open — total={} KB, hint={:?}",
+            total_usize / 1024,
+            stream_hint
+        );
+        let buf = Arc::new(Mutex::new(vec![0u8; total_usize]));
+        let downloaded_to = Arc::new(AtomicUsize::new(0));
+        let done = Arc::new(AtomicBool::new(false));
+        let playback_armed = Arc::new(AtomicBool::new(false));
+        let tail_ready = Arc::new(AtomicBool::new(false));
+        let tail_filled_from = Arc::new(AtomicU64::new(0));
+        let tail_prefetch = mp4_needs_tail_prefetch(&[], stream_hint.as_deref());
+        let mp4_probe_gate = tail_prefetch.then(|| RangedMp4ProbeGate {
+            tail_ready: tail_ready.clone(),
+            buf: buf.clone(),
+            downloaded_to: downloaded_to.clone(),
+            gen_arc: state.preview_gen.clone(),
+            gen,
+            format_hint: stream_hint.clone(),
+        });
+        tokio::spawn(ranged_download_task(
+            gen,
+            state.preview_gen.clone(),
+            preview_http,
+            app.clone(),
+            0.0,
+            url.to_string(),
+            response,
+            buf.clone(),
+            downloaded_to.clone(),
+            done.clone(),
+            state.stream_completed_cache.clone(),
+            state.stream_completed_spill.clone(),
+            state.normalization_engine.clone(),
+            state.normalization_target_lufs.clone(),
+            state.loudness_pre_analysis_attenuation_db.clone(),
+            None,
+            None,
+            http_headers.clone(),
+            None,
+            playback_armed,
+            stream_hint.clone(),
+            tail_ready.clone(),
+            tail_filled_from.clone(),
+        ));
+        if let Some(ref gate) = mp4_probe_gate {
+            wait_for_ranged_mp4_probe_ready(gate).await?;
+            if state.preview_gen.load(Ordering::SeqCst) != gen {
+                return Ok(None);
+            }
+        }
+        let reader = RangedHttpSource {
+            buf,
+            downloaded_to,
+            tail_ready,
+            tail_filled_from,
+            total_size: total,
+            pos: 0,
+            done,
+            gen_arc: state.preview_gen.clone(),
+            gen,
+            // Preview plays a fixed short segment; no user seeking → no need for
+            // the on-demand random-access fetcher.
+            on_demand: None,
+        };
+        let hint = stream_hint.clone();
+        let decoder = tokio::task::spawn_blocking(move || {
+            SizedDecoder::new_streaming(Box::new(reader), hint.as_deref(), "preview-stream", false)
+        })
+        .await
+        .map_err(|e| format!("preview: decoder thread: {e}"))??;
+        return Ok(Some(decoder));
+    }
+
+    crate::app_deprintln!(
+        "[preview] buffered download — accept-ranges={}, content-length={:?}, hint={:?}",
+        supports_range,
+        total_size,
+        stream_hint
+    );
+    let content_type = response
+        .headers()
+        .get(reqwest::header::CONTENT_TYPE)
+        .and_then(|v| v.to_str().ok())
+        .map(str::to_string);
+    let content_disposition = response
+        .headers()
+        .get(reqwest::header::CONTENT_DISPOSITION)
+        .and_then(|v| v.to_str().ok())
+        .map(str::to_string);
+    let bytes = response
+        .bytes()
+        .await
+        .map_err(|e| format!("preview: read body: {e}"))?
+        .to_vec();
+    if state.preview_gen.load(Ordering::SeqCst) != gen {
+        return Ok(None);
+    }
+    let hint = resolve_preview_format_hint(
+        url,
+        content_type.as_deref(),
+        content_disposition.as_deref(),
+        format_suffix,
+        &bytes,
+    );
+    let bytes_for_blocking = bytes;
+    let hint_for_blocking = hint.clone();
+    let decoder = tokio::task::spawn_blocking(move || {
+        SizedDecoder::new(bytes_for_blocking, hint_for_blocking.as_deref(), false)
+    })
+    .await
+    .map_err(|e| format!("preview: decoder thread: {e}"))??;
+    Ok(Some(decoder))
+}
+
 #[tauri::command]
+#[specta::specta]
+#[allow(clippy::too_many_arguments)] // Tauri IPC — args map 1:1 to the JS invoke payload.
 pub async fn audio_preview_play(
     id: String,
     url: String,
     start_sec: f64,
     duration_sec: f64,
     volume: f32,
+    format_suffix: Option<String>,
     app: AppHandle,
     state: State<'_, AudioEngine>,
 ) -> Result<(), String> {
@@ -134,48 +369,24 @@ pub async fn audio_preview_play(
         preview_pause_main(&state);
     }
 
-    // ── Download ─────────────────────────────────────────────────────────────
-    // Dedicated client with a generous timeout. The shared `audio_http_client`
-    // caps at 30 s, which aborts mid-download on multi-hundred-megabyte
-    // uncompressed files (e.g. 18-min Hi-Res WAV ~600 MB) — those need
-    // ~60–120 s on a typical home LAN. The watchdog (30 s wall-clock) still
-    // bounds how long the preview plays once the bytes are in memory, so a
-    // long download just means a longer "loading" spinner before audio starts.
-    let preview_http = reqwest::Client::builder()
-        .timeout(Duration::from_secs(300))
-        .use_rustls_tls()
-        .user_agent(psysonic_core::user_agent::subsonic_wire_user_agent())
-        .build()
-        .unwrap_or_else(|_| audio_http_client(&state));
-    let bytes = preview_http
-        .get(&url)
-        .send()
-        .await
-        .map_err(|e| format!("preview: connection failed: {e}"))?
-        .error_for_status()
-        .map_err(|e| format!("preview: HTTP {e}"))?
-        .bytes()
-        .await
-        .map_err(|e| format!("preview: read body: {e}"))?
-        .to_vec();
+    // ── Open decoder (ranged stream when possible) ───────────────────────────
+    let decoder = match open_preview_decoder(
+        &url,
+        format_suffix.as_deref(),
+        gen,
+        &state,
+        &app,
+    )
+    .await?
+    {
+        Some(d) => d,
+        None => return Ok(()),
+    };
 
     if state.preview_gen.load(Ordering::SeqCst) != gen {
-        // A newer preview started while we were downloading — bail.
         return Ok(());
     }
 
-    // ── Decode ───────────────────────────────────────────────────────────────
-    let hint = preview_format_hint_from_url(&url);
-    let bytes_for_blocking = bytes;
-    let hint_for_blocking = hint.clone();
-    let decoder = tokio::task::spawn_blocking(move || {
-        SizedDecoder::new(bytes_for_blocking, hint_for_blocking.as_deref(), false)
-    })
-    .await
-    .map_err(|e| format!("preview: decoder thread: {e}"))??;
-
-    if state.preview_gen.load(Ordering::SeqCst) != gen { return Ok(()); }
-
     // ── Build source pipeline ────────────────────────────────────────────────
     // Seek FIRST on the bare decoder, THEN cap with take_duration. Capping
     // before the seek made take_duration's wall-clock counter tick from
@@ -194,7 +405,8 @@ pub async fn audio_preview_play(
     let source = PriorityBoostSource::new(source);
 
     // ── Build secondary sink on the existing OutputStream ────────────────────
-    let sink = Arc::new(Player::connect_new(state.stream_handle.lock().unwrap().mixer()));
+    let stream = super::engine::ensure_output_stream_open(&state)?;
+    let sink = Arc::new(Player::connect_new(stream.mixer()));
     sink.set_volume((volume.clamp(0.0, 1.0) * MASTER_HEADROOM).clamp(0.0, 1.0));
     sink.append(source);
 
@@ -271,7 +483,57 @@ pub async fn audio_preview_play(
     Ok(())
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn resolve_preview_format_hint_sniffs_flac_from_bytes() {
+        let hint = resolve_preview_format_hint(
+            "https://host/rest/stream.view?id=1",
+            None,
+            None,
+            None,
+            b"fLaC\x00\x00\x00\x22",
+        );
+        assert_eq!(hint.as_deref(), Some("flac"));
+    }
+
+    #[test]
+    fn resolve_preview_format_hint_prefers_content_type_over_sniff() {
+        let hint = resolve_preview_format_hint(
+            "https://host/rest/stream.view?id=1",
+            Some("audio/mpeg"),
+            None,
+            None,
+            b"fLaC\x00\x00\x00\x22",
+        );
+        assert_eq!(hint.as_deref(), Some("mp3"));
+    }
+
+    #[test]
+    fn resolve_preview_format_hint_uses_subsonic_suffix() {
+        let hint = resolve_preview_format_hint(
+            "https://host/rest/stream.view?id=1",
+            None,
+            None,
+            Some("flac"),
+            &[0x00, 0x01, 0x02, 0x03],
+        );
+        assert_eq!(hint.as_deref(), Some("flac"));
+    }
+
+    #[test]
+    fn preview_format_hint_from_url_reads_format_query_param() {
+        assert_eq!(
+            preview_format_hint_from_url("https://h/stream.view?format=opus&id=x"),
+            Some("opus".into())
+        );
+    }
+}
+
 #[tauri::command]
+#[specta::specta]
 pub fn audio_preview_stop(app: AppHandle, state: State<'_, AudioEngine>) {
     preview_stop_inner(&app, &state, true);
 }
@@ -282,6 +544,7 @@ pub fn audio_preview_stop(app: AppHandle, state: State<'_, AudioEngine>) {
 /// auto-resume main playback the moment the preview ends and the user perceives
 /// the click as having no effect.
 #[tauri::command]
+#[specta::specta]
 pub fn audio_preview_stop_silent(app: AppHandle, state: State<'_, AudioEngine>) {
     preview_stop_inner(&app, &state, false);
 }
@@ -292,6 +555,7 @@ pub fn audio_preview_stop_silent(app: AppHandle, state: State<'_, AudioEngine>)
 /// start, so the engine just clamps and applies the master headroom. No-op
 /// when no preview is active.
 #[tauri::command]
+#[specta::specta]
 pub fn audio_preview_set_volume(volume: f32, state: State<'_, AudioEngine>) {
     if let Some(sink) = state.preview_sink.lock().unwrap().as_ref() {
         sink.set_volume((volume.clamp(0.0, 1.0) * MASTER_HEADROOM).clamp(0.0, 1.0));

src-tauri/crates/psysonic-audio/src/progress_task.rs

@@ -12,6 +12,7 @@ use tauri::{AppHandle, Emitter, Runtime};
 
 use super::engine::AudioCurrent;
 use super::helpers::{ramp_sink_volume, ProgressPayload, MASTER_HEADROOM};
+use super::playback_rate::{effective_duration_secs, effective_position_secs, PlaybackRateAtomics};
 use super::state::ChainedInfo;
 
 /// Sink for the three progress events the task emits. Production wraps an
@@ -53,20 +54,24 @@ impl<R: Runtime> ProgressEmitter for AppHandle<R> {
 ///   • Immediate `audio:track_switched` event at decoder boundary
 ///   • `audio:ended` only fires when no chained successor exists
 #[allow(clippy::too_many_arguments)]
-pub(super) fn spawn_progress_task<E: ProgressEmitter>(
+pub(crate) fn spawn_progress_task<E: ProgressEmitter>(
     gen: u64,
     gen_counter: Arc<AtomicU64>,
     current_arc: Arc<Mutex<AudioCurrent>>,
     chained_arc: Arc<Mutex<Option<ChainedInfo>>>,
     crossfade_enabled_arc: Arc<AtomicBool>,
     crossfade_secs_arc: Arc<AtomicU32>,
+    autodj_suppress_arc: Arc<AtomicBool>,
     initial_done: Arc<AtomicBool>,
     emitter: E,
+    analysis_app: Option<AppHandle>,
     samples_played: Arc<AtomicU64>,
     sample_rate_arc: Arc<AtomicU32>,
     channels_arc: Arc<AtomicU32>,
     gapless_switch_at: Arc<AtomicU64>,
     current_playback_url: Arc<Mutex<Option<String>>>,
+    stream_playback_armed: Arc<AtomicBool>,
+    playback_rate: PlaybackRateAtomics,
 ) {
     // Keep progress aligned with audible output (ALSA/PipeWire/Pulse queue) on
     // Linux; mirrors the quantum policy used for stream open/reopen plus a small
@@ -87,6 +92,15 @@ pub(super) fn spawn_progress_task<E: ProgressEmitter>(
     const PROGRESS_EMIT_MIN_MS: u64 = 1500;
     const PROGRESS_EMIT_MIN_DELTA_SECS: f64 = 0.9;
 
+    // Watchdog ceiling for the duration-hint near-end timer. Without crossfade,
+    // audio:ended fires from the sample-accurate `current_done` signal (see the
+    // exhaustion branch below), so this timer only matters as a fallback for a
+    // source that never signals exhaustion (stalled or malformed decoder). ~8 s
+    // past the point where near-end counting starts — far longer than any
+    // healthy track runs past its (floored) duration hint, so it never clips a
+    // real tail.
+    const END_WATCHDOG_TICKS: u32 = 80;
+
     tokio::spawn(async move {
         let mut near_end_ticks: u32 = 0;
         // Local done-flag reference; swapped on gapless transition.
@@ -122,6 +136,10 @@ pub(super) fn spawn_progress_task<E: ProgressEmitter>(
 
                 let chained = chained_arc.lock().unwrap().take();
                 if let Some(info) = chained {
+                    if let Some(app) = analysis_app.clone() {
+                        crate::analysis_dispatch::spawn_gapless_transition_analysis(&app, &info);
+                    }
+
                     // Swap to the chained source's done flag.
                     current_done = info.source_done;
 
@@ -166,9 +184,16 @@ pub(super) fn spawn_progress_task<E: ProgressEmitter>(
                     near_end_ticks = 0;
                     continue;
                 }
-                // Current source exhausted but no chain queued — the Sink is
-                // likely draining; audio:ended will fire on the next tick via
-                // the near-end logic below.
+                // Current source exhausted and no chain queued — this is the
+                // real, sample-accurate end of the track. Emit audio:ended now.
+                // The duration_hint-based near-end timer below would otherwise
+                // clip up to ~1 s off the tail: the Subsonic hint is floored to
+                // whole seconds while the decoded audio runs slightly longer.
+                // The timer stays only as the crossfade trigger and as a
+                // watchdog for sources that never signal exhaustion.
+                gen_counter.fetch_add(1, Ordering::SeqCst);
+                emitter.emit_ended();
+                break;
             }
 
             // ── Position from atomic sample counter ──────────────────────────
@@ -179,16 +204,20 @@ pub(super) fn spawn_progress_task<E: ProgressEmitter>(
 
             // Read playback snapshot under a single lock to minimize contention
             // with seek/play/pause commands that also touch `current`.
-            let (dur, paused_at) = {
+            let (base_dur, paused_at) = {
                 let cur = current_arc.lock().unwrap();
                 (cur.duration_secs, cur.paused_at)
             };
+            let dur = effective_duration_secs(base_dur, &playback_rate);
             let is_paused = paused_at.is_some();
 
-            let pos_raw = if let Some(p) = paused_at {
+            let pos_raw = if !stream_playback_armed.load(Ordering::Relaxed) {
+                0.0
+            } else if let Some(p) = paused_at {
                 p
             } else {
-                (samples / divisor).min(dur.max(0.001))
+                effective_position_secs(samples / divisor, &playback_rate)
+                    .min(dur.max(0.001))
             };
             let progress_latency = if is_paused {
                 0.0
@@ -202,7 +231,12 @@ pub(super) fn spawn_progress_task<E: ProgressEmitter>(
                 || now.duration_since(last_progress_emit_at) >= Duration::from_millis(PROGRESS_EMIT_MIN_MS)
                 || (pos - last_progress_emit_pos).abs() >= PROGRESS_EMIT_MIN_DELTA_SECS;
             if should_emit_progress {
-                emitter.emit_progress(ProgressPayload { current_time: pos, duration: dur });
+                let buffering = !stream_playback_armed.load(Ordering::Relaxed);
+                emitter.emit_progress(ProgressPayload {
+                    current_time: pos,
+                    duration: dur,
+                    buffering,
+                });
                 last_progress_emit_at = now;
                 last_progress_emit_pos = pos;
                 last_progress_emit_paused = is_paused;
@@ -212,7 +246,12 @@ pub(super) fn spawn_progress_task<E: ProgressEmitter>(
                 continue;
             }
 
-            let cf_enabled = crossfade_enabled_arc.load(Ordering::Relaxed);
+            // AutoDJ may suppress the autonomous crossfade trigger so JS drives
+            // every advance (gated on the next track being playable). Treat it
+            // like crossfade-off here: only emit `audio:ended` on real source
+            // exhaustion (above) or the watchdog — never the early timer.
+            let cf_enabled = crossfade_enabled_arc.load(Ordering::Relaxed)
+                && !autodj_suppress_arc.load(Ordering::Relaxed);
             let cf_secs = f32::from_bits(crossfade_secs_arc.load(Ordering::Relaxed)).clamp(0.5, 12.0) as f64;
             let end_threshold = if cf_enabled { cf_secs.max(1.0) } else { 1.0 };
 
@@ -229,9 +268,20 @@ pub(super) fn spawn_progress_task<E: ProgressEmitter>(
                     if has_chain {
                         continue;
                     }
-                    gen_counter.fetch_add(1, Ordering::SeqCst);
-                    emitter.emit_ended();
-                    break;
+                    // With crossfade, audio:ended must fire *early* (cf_secs
+                    // before the real end, source not yet exhausted) so the
+                    // frontend can start the next track and fade between them
+                    // — the timer is the intended trigger here. Without
+                    // crossfade, the real end is detected sample-accurately
+                    // via `current_done` (handled in the exhaustion branch
+                    // above), so the timer only acts as a watchdog for a
+                    // source that never signals exhaustion — emitting on the
+                    // hint alone would clip up to ~1 s off the tail.
+                    if cf_enabled || near_end_ticks >= END_WATCHDOG_TICKS {
+                        gen_counter.fetch_add(1, Ordering::SeqCst);
+                        emitter.emit_ended();
+                        break;
+                    }
                 }
             } else {
                 near_end_ticks = 0;
@@ -262,6 +312,13 @@ mod tests {
         fn track_switched_count(&self) -> usize {
             self.track_switched.lock().unwrap().len()
         }
+        fn last_progress_time(&self) -> Option<f64> {
+            self.progress
+                .lock()
+                .unwrap()
+                .last()
+                .map(|p| p.current_time)
+        }
     }
 
     impl ProgressEmitter for Arc<MockEmitter> {
@@ -284,12 +341,15 @@ mod tests {
         chained: Arc<Mutex<Option<ChainedInfo>>>,
         crossfade_enabled: Arc<AtomicBool>,
         crossfade_secs: Arc<AtomicU32>,
+        autodj_suppress: Arc<AtomicBool>,
         done: Arc<AtomicBool>,
         samples_played: Arc<AtomicU64>,
         sample_rate: Arc<AtomicU32>,
         channels: Arc<AtomicU32>,
         gapless_switch_at: Arc<AtomicU64>,
         playback_url: Arc<Mutex<Option<String>>>,
+        stream_playback_armed: Arc<AtomicBool>,
+        playback_rate: PlaybackRateAtomics,
     }
 
     impl TaskHarness {
@@ -312,12 +372,15 @@ mod tests {
                 chained: Arc::new(Mutex::new(None)),
                 crossfade_enabled: Arc::new(AtomicBool::new(false)),
                 crossfade_secs: Arc::new(AtomicU32::new(0f32.to_bits())),
+                autodj_suppress: Arc::new(AtomicBool::new(false)),
                 done: Arc::new(AtomicBool::new(false)),
                 samples_played: Arc::new(AtomicU64::new(0)),
                 sample_rate: Arc::new(AtomicU32::new(44_100)),
                 channels: Arc::new(AtomicU32::new(2)),
                 gapless_switch_at: Arc::new(AtomicU64::new(0)),
                 playback_url: Arc::new(Mutex::new(None)),
+                stream_playback_armed: Arc::new(AtomicBool::new(true)),
+                playback_rate: PlaybackRateAtomics::new(),
             }
         }
 
@@ -329,19 +392,70 @@ mod tests {
                 self.chained.clone(),
                 self.crossfade_enabled.clone(),
                 self.crossfade_secs.clone(),
+                self.autodj_suppress.clone(),
                 self.done.clone(),
                 emitter,
+                None,
                 self.samples_played.clone(),
                 self.sample_rate.clone(),
                 self.channels.clone(),
                 self.gapless_switch_at.clone(),
                 self.playback_url.clone(),
+                self.stream_playback_armed.clone(),
+                self.playback_rate.clone(),
             );
         }
     }
 
     // ── tests ─────────────────────────────────────────────────────────────────
 
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    async fn progress_emits_buffering_while_stream_not_armed() {
+        let h = TaskHarness::new(240.0);
+        h.stream_playback_armed.store(false, Ordering::SeqCst);
+        h.samples_played.store(441_000, Ordering::SeqCst);
+
+        let emitter = Arc::new(MockEmitter::default());
+        h.spawn_with(emitter.clone());
+
+        tokio::time::sleep(Duration::from_millis(250)).await;
+        assert!(
+            emitter.progress.lock().unwrap().iter().any(|p| p.buffering),
+            "progress payload must flag HTTP stream buffering before armed"
+        );
+
+        h.gen_counter.store(99, Ordering::SeqCst);
+        tokio::time::sleep(Duration::from_millis(200)).await;
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    async fn legacy_stream_holds_progress_at_zero_until_armed() {
+        let h = TaskHarness::new(240.0);
+        h.stream_playback_armed.store(false, Ordering::SeqCst);
+        h.samples_played.store(441_000, Ordering::SeqCst);
+
+        let emitter = Arc::new(MockEmitter::default());
+        h.spawn_with(emitter.clone());
+
+        tokio::time::sleep(Duration::from_millis(250)).await;
+        assert!(
+            emitter.last_progress_time().unwrap_or(0.0) < 0.01,
+            "progress must stay at 0 while legacy stream is buffering"
+        );
+        assert!(
+            emitter.progress.lock().unwrap().iter().any(|p| p.buffering),
+            "progress payload must flag legacy stream buffering"
+        );
+
+        h.stream_playback_armed.store(true, Ordering::SeqCst);
+        tokio::time::sleep(Duration::from_millis(250)).await;
+        assert!(
+            emitter.last_progress_time().unwrap_or(0.0) > 4.0,
+            "progress should follow samples once armed (got {:?})",
+            emitter.last_progress_time()
+        );
+    }
+
     #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
     async fn task_breaks_immediately_when_generation_already_changed() {
         let h = TaskHarness::new(120.0);
@@ -419,6 +533,8 @@ mod tests {
         let chained_samples = Arc::new(AtomicU64::new(0));
         *h.chained.lock().unwrap() = Some(ChainedInfo {
             url: chain_url.clone(),
+            analysis_track_id: None,
+            server_id: None,
             raw_bytes: Arc::new(Vec::new()),
             duration_secs: 200.0,
             replay_gain_linear: 1.0,
@@ -459,4 +575,107 @@ mod tests {
         h.gen_counter.store(99, Ordering::SeqCst);
         tokio::time::sleep(Duration::from_millis(200)).await;
     }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    async fn done_without_chain_emits_ended_immediately() {
+        // Real track (duration_secs > 0), source exhausted, no chained
+        // successor: audio:ended must fire on the sample-accurate done flag —
+        // not be deferred to (or clipped by) the duration-hint near-end timer.
+        let h = TaskHarness::new(120.0);
+        h.done.store(true, Ordering::SeqCst);
+
+        let emitter = Arc::new(MockEmitter::default());
+        h.spawn_with(emitter.clone());
+
+        tokio::time::sleep(Duration::from_millis(200)).await;
+        assert_eq!(emitter.ended_count(), 1, "audio:ended must fire on source exhaustion");
+        assert_eq!(emitter.track_switched_count(), 0, "no chain → no track switch");
+        assert!(
+            h.gen_counter.load(Ordering::SeqCst) > h.gen,
+            "generation counter must bump so following commands see the new gen"
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    async fn near_end_without_crossfade_waits_for_source_done() {
+        // Position playback past the (floored) duration hint with the source
+        // NOT yet exhausted and crossfade off. The duration-hint timer must
+        // NOT emit audio:ended — doing so would clip the real tail, since the
+        // decoded audio routinely runs slightly longer than the integer hint.
+        let h = TaskHarness::new(120.0);
+        // samples → pos_raw clamps to dur (120 s), well inside `dur - 1`.
+        let played = (120.0 * 44_100.0 * 2.0) as u64;
+        h.samples_played.store(played, Ordering::SeqCst);
+
+        let emitter = Arc::new(MockEmitter::default());
+        h.spawn_with(emitter.clone());
+
+        // > 10 ticks: the timer's near-end counter is well past its 1 s mark.
+        tokio::time::sleep(Duration::from_millis(1500)).await;
+        assert_eq!(
+            emitter.ended_count(),
+            0,
+            "audio:ended must NOT fire from the duration-hint timer before the source is done"
+        );
+
+        // Source actually exhausts → audio:ended fires now.
+        h.done.store(true, Ordering::SeqCst);
+        tokio::time::sleep(Duration::from_millis(300)).await;
+        assert_eq!(emitter.ended_count(), 1, "audio:ended fires once the source is exhausted");
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    async fn near_end_with_crossfade_emits_ended_on_timer() {
+        // With crossfade enabled, audio:ended must still fire from the timer
+        // ~cf_secs before the real end (the source is NOT exhausted yet) so the
+        // frontend can start the next track and fade between them.
+        let h = TaskHarness::new(120.0);
+        h.crossfade_enabled.store(true, Ordering::SeqCst);
+        h.crossfade_secs.store(5.0f32.to_bits(), Ordering::SeqCst);
+        // Position inside the crossfade window (>= dur - 5 s), source not done.
+        let played = (117.0 * 44_100.0 * 2.0) as u64;
+        h.samples_played.store(played, Ordering::SeqCst);
+
+        let emitter = Arc::new(MockEmitter::default());
+        h.spawn_with(emitter.clone());
+
+        // 10 ticks ≈ 1 s to cross the near-end debounce.
+        tokio::time::sleep(Duration::from_millis(1300)).await;
+        assert_eq!(
+            emitter.ended_count(),
+            1,
+            "crossfade still relies on the timer to fire audio:ended early"
+        );
+        assert!(h.gen_counter.load(Ordering::SeqCst) > h.gen);
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    async fn autodj_suppress_does_not_fire_crossfade_timer() {
+        // AutoDJ suppression on: even with crossfade enabled and the position
+        // inside the crossfade window, the autonomous timer must NOT emit
+        // audio:ended (JS drives the advance, gated on the next track being
+        // ready). The real end is still reached via source exhaustion.
+        let h = TaskHarness::new(120.0);
+        h.crossfade_enabled.store(true, Ordering::SeqCst);
+        h.crossfade_secs.store(5.0f32.to_bits(), Ordering::SeqCst);
+        h.autodj_suppress.store(true, Ordering::SeqCst);
+        // Position inside the crossfade window (>= dur - 5 s), source not done.
+        let played = (117.0 * 44_100.0 * 2.0) as u64;
+        h.samples_played.store(played, Ordering::SeqCst);
+
+        let emitter = Arc::new(MockEmitter::default());
+        h.spawn_with(emitter.clone());
+
+        tokio::time::sleep(Duration::from_millis(1300)).await;
+        assert_eq!(
+            emitter.ended_count(),
+            0,
+            "suppressed AutoDJ must not fire the autonomous crossfade timer"
+        );
+
+        // Source exhausts → audio:ended fires (clean sequential end).
+        h.done.store(true, Ordering::SeqCst);
+        tokio::time::sleep(Duration::from_millis(300)).await;
+        assert_eq!(emitter.ended_count(), 1, "audio:ended fires on exhaustion");
+    }
 }

src-tauri/crates/psysonic-audio/src/radio_commands.rs

@@ -11,6 +11,7 @@ use rodio::{Player, Source};
 use tauri::{AppHandle, Emitter, State};
 
 use super::decode::SizedDecoder;
+use super::playback_rate::PlaybackRateAtomics;
 use super::engine::{audio_http_client, AudioEngine};
 use super::helpers::{content_type_to_hint, MASTER_HEADROOM};
 use super::progress_task::spawn_progress_task;
@@ -30,6 +31,7 @@ use super::stream::{
 /// Emits `audio:playing` with `duration = 0.0` (sentinel for live stream)
 /// and `radio:metadata` whenever the StreamTitle changes.
 #[tauri::command]
+#[specta::specta]
 pub async fn audio_play_radio(
     url: String,
     volume: f32,
@@ -108,6 +110,7 @@ pub async fn audio_play_radio(
 
     // ── Build Symphonia decoder in a blocking thread ──────────────────────────
     let reader = AudioStreamReader {
+        read_timeout_secs: RADIO_READ_TIMEOUT_SECS,
         cons: Mutex::new(cons),
         new_cons_rx: Mutex::new(new_cons_rx),
         deadline: std::time::Instant::now() + Duration::from_secs(RADIO_READ_TIMEOUT_SECS),
@@ -122,7 +125,7 @@ pub async fn audio_play_radio(
 
     let hint_clone = fmt_hint.clone();
     let decoder = tokio::task::spawn_blocking(move || {
-        SizedDecoder::new_streaming(Box::new(reader), hint_clone.as_deref(), "radio")
+        SizedDecoder::new_streaming(Box::new(reader), hint_clone.as_deref(), "radio", false)
     })
     .await
     .map_err(|e| e.to_string())??;
@@ -148,7 +151,8 @@ pub async fn audio_play_radio(
 
     if state.generation.load(Ordering::SeqCst) != gen { return Ok(()); }
 
-    let sink = Arc::new(Player::connect_new(state.stream_handle.lock().unwrap().mixer()));
+    let stream = super::engine::ensure_output_stream_open(&state)?;
+    let sink = Arc::new(Player::connect_new(stream.mixer()));
     sink.set_volume((volume.clamp(0.0, 1.0) * MASTER_HEADROOM).clamp(0.0, 1.0));
     sink.append(boosted);
 
@@ -173,6 +177,7 @@ pub async fn audio_play_radio(
 
     app.emit("audio:playing", 0.0f64).ok();
 
+    state.stream_playback_armed.store(true, Ordering::SeqCst);
     spawn_progress_task(
         gen,
         state.generation.clone(),
@@ -180,13 +185,17 @@ pub async fn audio_play_radio(
         state.chained_info.clone(),
         state.crossfade_enabled.clone(),
         state.crossfade_secs.clone(),
+        state.autodj_suppress_autocrossfade.clone(),
         done_flag,
         app,
+        None,
         state.samples_played.clone(),
         state.current_sample_rate.clone(),
         state.current_channels.clone(),
         state.gapless_switch_at.clone(),
         state.current_playback_url.clone(),
+        state.stream_playback_armed.clone(),
+        PlaybackRateAtomics::default(),
     );
 
     Ok(())