Merge PR #127: Sonos queue verification, cast double-download fix, stutter instrumentation

.dockerignore

@@ -6,20 +6,9 @@
 **/build
 web/build
 
-# The Android client — built by its own job, never from this context. The APK
-# reaches the image through client/, downloaded as a CI artifact, so nothing
-# here reads android/ sources.
-#
-# This block named `flutter_client/` until 2026-09-10 and lost its PATTERN when
-# that tree was deleted, leaving a comment describing an exclusion that was no
-# longer happening. android/ never took its place, so 4.1 MB of Gradle project
-# has been entering the context and busting the `COPY . .` layer on every
-# Android-only change.
-android/
-
-# Local `make build` output — an 18 MB binary the image never uses, since the
-# builder stage compiles its own.
-bin/
+# Flutter mobile client — built separately on developer machines / Flutter CI.
+# Including it in the Go build context wastes ~70 files and invalidates the
+# `COPY . .` layer cache on every Flutter-only change.
 
 # Docs and IDE noise
 docs/
@@ -37,8 +26,5 @@ docs/
 !.env.example
 
 # CI workflow files don't need to ship in the image.
-#
-# This said `.forgejo/` and `.github/` — neither of which this repo has. Gitea
-# Actions reads `.gitea/`, so the one directory that actually exists was the
-# one not excluded, and every workflow edit invalidated the context.
-.gitea/
+.forgejo/
+.github/

.gitea/workflows/android.yml

@@ -0,0 +1,95 @@
+name: android
+
+# Native Android (Kotlin/Compose/Media3) — M8 rewrite, now the only client.
+# This workflow is testing only — lint + detekt + unit tests on every push
+# to dev/main, plus a debug APK artifact for main. The signed-release
+# build + asset attach + image-bundling lives in release.yml under a
+# `needs:` chain so the docker image cannot ship without the APK.
+
+on:
+  push:
+    branches: [main, dev]
+    paths:
+      - 'android/**'
+      - '.gitea/workflows/android.yml'
+
+# pull_request trigger intentionally omitted — see test-web.yml for
+# the rationale (single-author repo, push covers PR-merge equivalent).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # Silences the JDK 22+ "restricted method in java.lang.System has been
+  # called" warning that Gradle 9.1's bundled native-platform jar trips
+  # at launch (System.load for native primitives). Affects the LAUNCHER
+  # JVM, not the daemon — that's why org.gradle.jvmargs in
+  # gradle.properties isn't enough. Future-compat: required opt-in once
+  # JDK 25 promotes the warning to an error.
+  JAVA_TOOL_OPTIONS: "--enable-native-access=ALL-UNNAMED"
+
+jobs:
+  build:
+    name: Build + lint + test
+    # Using flutter-ci runner label because it's the only proven-working
+    # label with docker that can pull our container.image. Switch to
+    # android-ci once the operator registers that runner label.
+    runs-on: flutter-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-android:36
+
+    defaults:
+      run:
+        working-directory: android
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Cache Gradle dirs
+        # Resolved deps + Gradle distribution + Kotlin daemon caches.
+        # Saves ~3 min per CI run after the first warm-up.
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+            ~/.kotlin
+          key: gradle-${{ runner.os }}-${{ hashFiles('android/gradle/wrapper/gradle-wrapper.properties', 'android/gradle/libs.versions.toml', 'android/**/*.gradle.kts') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-
+
+      - name: Make gradlew executable
+        run: chmod +x ./gradlew
+
+      - name: Gradle wrapper validation
+        run: ./gradlew --version
+
+      - name: ktlint
+        run: ./gradlew ktlintCheck
+
+      - name: detekt
+        run: ./gradlew detekt
+
+      - name: Unit tests
+        run: ./gradlew testDebugUnitTest
+
+      - name: Assemble debug
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: ./gradlew assembleDebug
+
+      - name: Upload debug APK
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        # Mirrored action, never actions/upload-artifact. @v4+ throws
+        # GHESNotSupportedError client-side on the hostname (no server setting
+        # reaches that check), and @v3 is worse — it reports success while Gitea
+        # serves artifacts back only through the v4 API, so the upload is stored
+        # and invisible to every retrieval path. @v3 is what left 72 unreachable
+        # artifacts on this repo. Pinned by SHA because the mirror auto-syncs;
+        # full URL because DEFAULT_ACTIONS_URL sends bare owner/repo to github.com.
+        # See Scribe issues 2255 / 2270.
+        uses: https://git.fabledsword.com/bvandeusen/upload-artifact@cb8afe72b42edc798abfb8fcb556cf660d894245
+        with:
+          name: minstrel-android-debug-${{ github.sha }}
+          path: android/app/build/outputs/apk/debug/app-debug.apk
+          if-no-files-found: error

.gitea/workflows/release.yml

@@ -2,407 +2,55 @@ name: release
 
 # Builds and pushes the minstrel container image to the Gitea registry.
 #
-#   push to dev                  → :dev            (freshly-built dev APK bundled)
-#   push to main                 → :latest + :<sha> (latest-release APK bundled)
-#   push tag vYYYY.MM.DD.HHMM    → :latest          (fresh APK bundled)
-#   workflow_dispatch            → manual trigger (same rules based on the ref)
+#   push to main             → :main and :latest (latest-release APK bundled)
+#   push tag vYYYY.MM.DD     → :vYYYY.MM.DD and :latest (freshly-built APK bundled)
+#   workflow_dispatch        → manual trigger (same rules based on the ref)
 #
-# That is the whole tag map, and it is family rule 145 + 147 as written.
-#
-# :<sha> on main is the ROLLBACK UNIT — every production commit addressable
-# without a release ceremony. It is minted only on main, where rollback is
-# actually worth having: merges are gated (rule 2) so they number in the dozens
-# per year, while on dev they would be one per push, forever, for a channel
-# whose entire contract is that it moves.
-#
-# There are NO :<version> image tags. This repo published :vYYYY.MM.DD.HHMM
-# until 2026-09-10 and it was the inverse of the rule on both counts — minting
-# a version tag nobody pinned while the rollback unit the rule names did not
-# exist here at all. Git and the build's own self-reported version answer
-# "which build is this"; a third name for the same thing is upkeep for a model
-# we do not run. Operator, 2026-09-10: "only things like the APK need that kind
-# of versioning for their update process."
-#
-# There is no :main either. :latest tracks main's tip with no gate between them
-# (rule 147), so a second name for the same image sends readers looking for a
-# distinction that does not exist.
-#
-# The dev channel exists so testing a build does not require shipping one.
-# Before it, the only way to get an APK onto a phone was to cut a release,
-# which made `main` the staging area by default. `:dev` carries its own
-# freshly-built APK, signed with the SAME key as release builds — a different
-# key cannot install over the stable app, so anyone crossing channels would
-# have to uninstall and lose their data.
-#
-# :dev is published ALONE, with no per-commit tag. A rolling channel is
-# rolling by definition; a commit-addressable image for it would be a
-# rollback target nobody ever pulls, kept forever. Recovery on dev is to fix
-# forward.
-#
-# Note what this repo does NOT need: a cross-repo dispatch to refresh the
-# channel when its bundled APK is rebuilt. That mechanism exists elsewhere in
-# the family because the app and the server live in separate repos. Minstrel
-# is a monorepo — one push builds the APK and the image in the same run from
-# the same commit, so the channel cannot go stale against its own artifact.
-# The requirement is satisfied structurally; copying the mechanism would add
-# a moving part to fix a problem that does not exist here.
-#
-# Release model: the tag IS the artifact's version name with a `v` in front.
-# `v2026.09.10.1432` and `2026.09.10.1432` are the same string, derived from
-# the tagged commit's UTC timestamp — so there is no mismatch to reconcile
-# between what the tag says and what the APK reports, and nothing to look up
-# when minting one.
-#
-# TAGS ARE IMMUTABLE. Never move, retarget or delete a published tag. A
-# same-day second release is not a collision — HHMM makes every tag unique
-# by construction, so the answer is simply another tag.
-#
-# This block used to say the opposite: that the per-day tag was
-# "intentionally mutable" and that a same-day re-cut should
-# `git push -f origin vYYYY.MM.DD`. That instruction is what the family
-# rulebook now forbids outright, and it has incidents behind it — moving a
-# same-day tag forward once took a published release down with it. Anyone
-# installing from a tag is holding something the tag no longer points at,
-# which is a worse failure than an extra row in the tag list.
-#
-# :latest is updated by every main push AND every tag push, so it always
-# reflects the newest blessed image.
+# Release model: per-day CalVer tags (no trailing patch digit). The day's
+# tag is intentionally mutable — if a second release happens the same day,
+# move the tag with `git push -f origin vYYYY.MM.DD` and the image tag of
+# the same name gets overwritten. :latest is updated by every main push
+# AND every tag push, so it always reflects the newest blessed image.
 #
 # APK pipeline: on tag pushes the android-release job builds + signs the
 # Android APK and uploads it as a workflow artifact. The image-release
 # job declares `needs: android-release`, so the docker image cannot
 # start building until the APK is guaranteed-ready — no polling, no
-# race, no silent-failure mode. Attaching the APK to the gitea Release is
-# its own job (release-assets), behind the test gate below.
+# race, no silent-failure mode. Asset attachment to the gitea Release
+# happens in the same android-release job, so the Release-page download
+# link and the in-image bundled APK are both populated atomically.
 #
 # :latest always carries an APK. Because every main push also moves
 # :latest (not just tags), a main build with no APK would silently strip
 # the in-app update channel off :latest until the next release. So on
 # non-tag builds image-release pulls the MOST RECENT release's signed APK
-# AND the version sidecar published beside it — the recorded values, not
-# recomputed ones — so no rebuild is needed, just a rebundle. Tag builds
-# keep bundling their own freshly-built APK.
+# and reconstructs its exact versionName (tag + commit-count, the same
+# formula android-release bakes in) for the version sidecar — no rebuild,
+# just rebundle. Tag builds keep bundling their own freshly-built APK.
 #
-# THE GATE (rule 177, M462 #4984). Every verifying lane lives in this file —
-# Go (vet, lint, short tests), the Postgres integration suite, the web app
-# (npm audit, svelte-check, vitest), Android (ktlint, detekt, unit tests) and
-# govulncheck — and every job that publishes something names each of them in
-# `needs:` and requires `success` from each, by name. Nothing publishes on red.
-#
-# They used to be three separate workflows (test-go, test-web, android) on the
-# same push trigger as this one. Separate workflows cannot see each other's
-# verdict, so :dev meant "it built", never "it passed": a red test run and a
-# fresh :dev could carry the same timestamp. One graph is the only place the
-# edge can be written.
-#
-# A skipped lane is NOT a pass. The publishing conditions check
-# `result == 'success'` per lane rather than `!failure()`, so a lane that
-# never started blocks the publish exactly as a red one does. Lanes carry no
-# path filters for the same reason: a web-only push still runs the Go suite,
-# because "not run" must never read as "passed".
-#
-# What publishes, and is therefore gated: the image tags (image-release) and
-# the APK + version sidecar attached to a tag's Release (release-assets).
-# android-release only BUILDS the signed APK into a workflow artifact, which
-# nobody outside this run can pull, so it runs in parallel with the lanes
-# instead of after them; attaching it to the Release is the publishing half,
-# and that half waits for the gate.
-#
-# To watch the gate refuse: dispatch this workflow with force_red=true. The go
-# lane fails on purpose, and both publishing jobs must report skipped.
+# Android testing (lint + detekt + unit tests, debug APK upload on main)
+# lives in android.yml and runs independently on every push.
 
 on:
   push:
-    branches: [main, dev]
+    branches: [main]
     tags: ['v*']
     paths-ignore:
       - 'docs/**'
       - '**/*.md'
   workflow_dispatch:
-    inputs:
-      force_red:
-        description: Fail the go lane on purpose, to check that nothing publishes on red
-        type: boolean
-        default: false
 
-# A rapid re-push to main should supersede the in-flight build — the
-# operator explicitly wants the later commit to win. Tags no longer enter
-# into this: they are immutable and unique, so no tag build can ever be
-# superseded by another run on the same ref.
+# Force-moving the per-day tag (or rapidly re-pushing to main) should
+# supersede the in-flight build — the operator explicitly wants the
+# later commit to win.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  # ---------------------------------------------------------------- lanes --
-  # Verifying jobs. Each one is named in the `needs:` of every publishing job
-  # below; add a lane here and it must be added there in the same commit.
-
-  go:
-    runs-on: go-ci
-    container:
-      image: git.fabledsword.com/bvandeusen/ci-go:1.26
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Forced failure (gate check)
-        if: github.event.inputs.force_red == 'true'
-        run: |
-          echo "::error::force_red dispatch: failing on purpose so the publishing jobs must skip"
-          exit 1
-
-      - name: Toolchain versions
-        run: |
-          go version
-          golangci-lint --version
-
-      - name: Generated code matches queries (sqlc)
-        run: make verify-generate
-
-      - name: go vet
-        run: go vet ./...
-
-      - name: golangci-lint
-        run: golangci-lint run ./...
-
-      - name: go test (short, race)
-        run: go test -short -race ./...
-
-  # Full `go test -race` against an ephemeral Postgres.
-  #
-  # DB wiring follows the act_runner shared-daemon pattern: the runner's Docker
-  # daemon also runs the operator's dev compose stack, so service containers
-  # get NO published ports (collision) and no service-name DNS. We discover the
-  # service container through the mounted docker socket and reach it by bridge
-  # IP. The exactly-one assertion is a hard guard — pointing tests at the dev
-  # Postgres would truncate it (the disaster Fable #339 exists to prevent).
-  #
-  # The key stays `integration` with no `name:` (rule 80): act_runner derives
-  # the service container's name from the job's display name.
-  #
-  # `web/build/` has a committed placeholder index.html so go:embed succeeds
-  # without the SPA being built first.
-  integration:
-    runs-on: go-ci
-    container:
-      image: git.fabledsword.com/bvandeusen/ci-go:1.26
-    services:
-      postgres:
-        image: postgres:16-alpine
-        env:
-          POSTGRES_USER: minstrel
-          POSTGRES_PASSWORD: minstrel
-          POSTGRES_DB: minstrel_test
-        # No `ports:` — the runner shares the operator's dev compose
-        # Docker daemon; publishing a fixed host port collides.
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Integration suite (discover service by bridge IP, migrate, test)
-        run: |
-          set -eux
-          # Discover THIS job's Postgres service container via the
-          # mounted docker socket. act_runner attaches the job
-          # container and its service container(s) to a shared per-job
-          # network, so scope discovery to a postgres that sits on a
-          # network THIS job container is also on. The old
-          # `--filter name=integration` matched EVERY concurrent
-          # integration run's postgres (a dev push + the main-merge run
-          # overlap → 2 candidates → false "expected exactly 1" abort).
-          # The operator's dev compose `minstrel-postgres-*` is never on
-          # this job's network; skip it explicitly as belt-and-suspenders
-          # (a wrong target would truncate real data).
-          SELF=$(cat /etc/hostname)
-          SELF_NETS=$(docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} {{end}}' "$SELF")
-          test -n "$SELF_NETS"
-          echo "self ($SELF) networks: $SELF_NETS"
-          PG_ID=""
-          PG_NAME=""
-          for cid in $(docker ps --filter "ancestor=postgres:16-alpine" -q); do
-            nm=$(docker inspect -f '{{.Name}}' "$cid" | sed 's#^/##')
-            case "$nm" in *minstrel-postgres*|*_postgres_*) continue ;; esac
-            for net in $(docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} {{end}}' "$cid"); do
-              case " $SELF_NETS " in *" $net "*) PG_ID="$cid"; PG_NAME="$nm"; break 2 ;; esac
-            done
-          done
-          test -n "$PG_ID" || { echo "FATAL: no postgres service container on this job's network (self nets: $SELF_NETS)"; exit 1; }
-          echo "selected postgres: $PG_ID $PG_NAME"
-          PG_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$PG_ID")
-          test -n "$PG_IP"
-          export MINSTREL_TEST_DATABASE_URL="postgres://minstrel:minstrel@${PG_IP}:5432/minstrel_test?sslmode=disable"
-
-          # Wait for Postgres to accept connections. Asked of the service
-          # container itself: the run: shell is dash (rule 81), where the
-          # old `/dev/tcp` probe never connects and the loop silently
-          # burned its full two minutes on every run.
-          ready=""
-          for i in $(seq 1 60); do
-            if docker exec "$PG_ID" pg_isready -U minstrel -d minstrel_test -q; then ready=1; break; fi
-            sleep 2
-          done
-          test -n "$ready" || { echo "FATAL: postgres never became ready"; exit 1; }
-
-          # Relax durability on the throwaway CI Postgres. Our test pattern
-          # is dbtest.ResetDB → TRUNCATE … RESTART IDENTITY CASCADE before
-          # every test, and the per-TRUNCATE commit fsync is the dominant
-          # cost of the integration suite. The CI DB is rebuilt every run so
-          # fsync / full_page_writes / synchronous_commit buy nothing. Apply
-          # via docker exec because:
-          #  - The act_runner `services:` block can't override the container
-          #    command, so `postgres -c fsync=off` at boot isn't an option.
-          #  - ALTER SYSTEM cannot run inside a transaction; psql -c
-          #    auto-commits each statement, which is what we need.
-          #  - fsync / full_page_writes are sighup GUCs and
-          #    synchronous_commit is user-context, so pg_reload_conf() picks
-          #    all three up with no restart.
-          # Non-fatal: a perms surprise degrades to "slower", never red CI.
-          docker exec "$PG_ID" psql -U minstrel -d minstrel_test \
-            -c "ALTER SYSTEM SET fsync = off" \
-            -c "ALTER SYSTEM SET synchronous_commit = off" \
-            -c "ALTER SYSTEM SET full_page_writes = off" \
-            -c "SELECT pg_reload_conf()" \
-            || echo "WARN: durability relax failed; continuing"
-
-          # Apply embedded migrations to the fresh test DB, then run the
-          # full suite (no -short → integration tests execute). -p 1:
-          # every integration package TRUNCATEs the one shared test DB;
-          # concurrent package binaries → TRUNCATE deadlocks. Serialize
-          # package execution (the documented local invocation too).
-          # -timeout 20m: internal/api alone takes ~6.5 min under -race on
-          # an idle runner, and a dev and a main run sharing the runner
-          # pushed it past go test's default 10m (run 8368, 600.016s, the
-          # running test 2s old — nothing hung).
-          MINSTREL_DATABASE_URL="$MINSTREL_TEST_DATABASE_URL" go run ./cmd/minstrel migrate
-          go test -p 1 -race -timeout 20m ./...
-
-  web:
-    runs-on: go-ci
-    container:
-      image: git.fabledsword.com/bvandeusen/ci-go:1.26
-
-    defaults:
-      run:
-        working-directory: web
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install deps
-        run: npm ci
-
-      # What ships to browsers: `dependencies` and the runtime they pull in
-      # (svelte, devalue). Build and test tooling (vite, vitest, tailwind,
-      # kit's dev server) is left out because none of it reaches a user, and
-      # its open advisories need major-version upgrades tracked separately.
-      - name: npm audit (shipped dependencies)
-        run: npm audit --omit=dev --audit-level=moderate
-
-      - name: Type-check + svelte-check
-        run: npm run check
-
-      - name: Vitest
-        run: npm test
-
-  android:
-    # Using flutter-ci runner label because it's the only proven-working
-    # label with docker that can pull our container.image.
-    runs-on: flutter-ci
-    container:
-      image: git.fabledsword.com/bvandeusen/ci-android:36
-
-    defaults:
-      run:
-        working-directory: android
-
-    env:
-      # Silences the JDK 22+ "restricted method in java.lang.System has been
-      # called" warning that Gradle's bundled native-platform jar trips at
-      # launch. Affects the LAUNCHER JVM, not the daemon — that's why
-      # org.gradle.jvmargs in gradle.properties isn't enough.
-      JAVA_TOOL_OPTIONS: "--enable-native-access=ALL-UNNAMED"
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Cache Gradle dirs
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-            ~/.kotlin
-          key: gradle-${{ runner.os }}-${{ hashFiles('android/gradle/wrapper/gradle-wrapper.properties', 'android/gradle/libs.versions.toml', 'android/**/*.gradle.kts') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-
-
-      - name: Make gradlew executable
-        run: chmod +x ./gradlew
-
-      - name: Gradle wrapper validation
-        run: ./gradlew --version
-
-      - name: ktlint
-        run: ./gradlew ktlintCheck
-
-      - name: detekt
-        run: ./gradlew detekt
-
-      - name: Unit tests
-        run: ./gradlew testDebugUnitTest
-
-      # No debug APK is built or uploaded here. Main used to upload a
-      # debug-signed app-debug.apk: a build signed by a key regenerated in
-      # every container, which no install can update (family idea #5103,
-      # practice 2). Phones get builds from android-release, signed with
-      # the one release key, on dev and on tags.
-
-  # Known vulnerabilities in the Go code and the standard library it is built
-  # with. Runs in the SAME image the Dockerfile's builder stage uses, so the
-  # standard library it checks is the one that ends up in the shipped binary;
-  # the ci-go image carries its own Go and would be checking a different
-  # toolchain. Keep this image and the Dockerfile's builder in step.
-  #
-  # govulncheck is fetched at CI time, unpinned (rule 154): the vulnerability
-  # database and the tool that reads it should both be current.
-  govulncheck:
-    runs-on: go-ci
-    container:
-      image: golang:1.26-bookworm
-
-    steps:
-      # Plain git, not actions/checkout: that action runs on node, which the
-      # golang image does not carry. This step is dash (rule 81).
-      - name: Checkout
-        env:
-          TOKEN: ${{ github.token }}
-        run: |
-          set -eu
-          auth=$(printf 'x-access-token:%s' "$TOKEN" | base64 -w0)
-          git init -q .
-          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
-          git -c http.extraHeader="Authorization: Basic ${auth}" fetch -q --depth 1 origin "${{ github.sha }}"
-          git checkout -q FETCH_HEAD
-          git log -1 --format='%H %s'
-
-      - name: govulncheck
-        run: |
-          go version
-          go run golang.org/x/vuln/cmd/govulncheck@latest ./...
-
-  # ------------------------------------------------------------ artifacts --
-
   android-release:
-    name: Build signed APK (releases and dev)
-    # Also builds on `dev`, which is what makes a test channel possible at
-    # all. Without it the only way to get a build onto a phone was to cut a
-    # release, which quietly turns `main` into the staging area.
-    if: startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/dev'
+    name: Build signed APK (tag releases only)
+    if: startsWith(github.ref, 'refs/tags/v')
     runs-on: flutter-ci
     container:
       image: git.fabledsword.com/bvandeusen/ci-android:36
@@ -427,18 +75,14 @@ jobs:
     outputs:
       version_name: ${{ steps.ver.outputs.name }}
       version_code: ${{ steps.ver.outputs.code }}
-      channel: ${{ steps.ver.outputs.channel }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          # Full history. The version name now reads only the tip commit's
-          # timestamp, so a shallow clone would technically serve — but this
-          # job derives a value that ships to devices, and a shallow checkout
-          # changes what git-derived values resolve to WITHOUT failing. The
-          # whole failure class here is a green build carrying a wrong
-          # version, so the cheap guarantee is worth keeping.
+          # fetch-depth: 0 retrieves full history; default shallow clone
+          # would return 1 for `git rev-list --count HEAD`, breaking the
+          # iteration suffix.
           fetch-depth: 0
 
       - name: Compute release version
@@ -447,23 +91,12 @@ jobs:
         working-directory: ${{ github.workspace }}
         run: |
           set -euo pipefail
-          # The derivation lives in ci/version.sh, not here, so it can be
-          # executed by a test on every push. Anything inline in this file is
-          # unverifiable until a release is already running.
-          out="$(ci/version.sh HEAD)"
-          printf '%s\n' "${out}" >> "$GITHUB_OUTPUT"
-
-          # The channel is a property of the LANE, not of the commit, which is
-          # why it is derived here rather than in version.sh. Same commit built
-          # on dev and on main reports the same NAME and differs only here —
-          # that is the whole point of separating the two values.
-          if [ "${GITHUB_REF}" = "refs/heads/dev" ]; then
-            channel=dev
-          else
-            channel=stable
-          fi
-          echo "channel=${channel}" >> "$GITHUB_OUTPUT"
-          echo "::notice::APK $(printf '%s' "${out}" | tr '\n' ' ') channel=${channel}"
+          TAG="${GITHUB_REF#refs/tags/v}"
+          COMMIT_COUNT=$(git rev-list --count HEAD)
+          VERSION_NAME="${TAG}.${COMMIT_COUNT}"
+          echo "name=${VERSION_NAME}" >> "$GITHUB_OUTPUT"
+          echo "code=${COMMIT_COUNT}" >> "$GITHUB_OUTPUT"
+          echo "::notice::APK version: ${VERSION_NAME} (code=${COMMIT_COUNT})"
 
       # Checked BEFORE the expensive work, not after it. "Attach APK to gitea
       # Release" below resolves the release by tag and fails if it is absent —
@@ -475,7 +108,6 @@ jobs:
       # the release together, so this passes). A bare `git push origin vX` is the
       # case this catches.
       - name: Release must exist for this tag
-        if: startsWith(github.ref, 'refs/tags/v')
         shell: bash
         working-directory: ${{ github.workspace }}
         env:
@@ -523,49 +155,14 @@ jobs:
             -PMINSTREL_VERSION_NAME=${{ steps.ver.outputs.name }} \
             -PMINSTREL_VERSION_CODE=${{ steps.ver.outputs.code }}
 
-      # The APK every phone updates from must carry THE release key: Android
-      # updates an app in place only when the signer matches, so an APK
-      # signed by any other key (debug, a regenerated keystore, a swapped
-      # secret) reaches no installed phone. The certificate's digest is
-      # pinned below; it is public, not a secret. Gradle signs with the
-      # release key or leaves the APK unsigned, and an unsigned build fails
-      # here too, as there is no app-release.apk to verify (family idea
-      # #5103, practice 3). apksigner, not keytool: keytool prints nothing
-      # for a v2-only APK.
-      #
-      # Rotating the key on purpose means every install must be removed and
-      # reinstalled; change the digest here in the same commit.
-      - name: The APK carries the release key
-        shell: bash
-        env:
-          # CN=Minstrel, O=FabledSword. Read from run 8446 (#5116).
-          RELEASE_CERT_SHA256: 43d183307bc46b821789d90444a960b137f78f2166ff431efb2406d0fceaf612
-        run: |
-          set -euo pipefail
-          sdk="${ANDROID_HOME:-${ANDROID_SDK_ROOT:-}}"
-          signer="$(ls "$sdk"/build-tools/*/apksigner 2>/dev/null | sort -V | tail -1 || true)"
-          test -n "$signer" || { echo "::error::no apksigner under '$sdk/build-tools'"; exit 1; }
-          certs="$("$signer" verify --print-certs app/build/outputs/apk/release/app-release.apk)"
-          printf '%s\n' "$certs" | grep -E '^Signer #[0-9]+ certificate (DN|SHA-256 digest)'
-          # One signer, and it is ours. A second signer would be a lineage or
-          # a mistake; either way not something to ship unexamined.
-          digests="$(printf '%s\n' "$certs" | sed -n 's/^Signer #[0-9]* certificate SHA-256 digest: //p')"
-          if [ "$digests" != "$RELEASE_CERT_SHA256" ]; then
-            if printf '%s' "$certs" | grep -q 'CN=Android Debug'; then
-              echo "::error::the release APK is signed with a debug key"
-            else
-              echo "::error::the release APK is not signed by the release key: got '${digests//$'\n'/ }', want ${RELEASE_CERT_SHA256}"
-            fi
-            exit 1
-          fi
-
       - name: Upload APK as workflow artifact
-        # Stock action (snippet #2271) — never @v3, which uploads something Gitea
-        # will never serve back. This is the producing half of a pair:
-        # image-release downloads `minstrel-apk` below. Any upload v4+ pairs with
-        # any download v4+ on this forge (every combination tested 2026-09-10,
-        # Scribe spike #3843), so the two pins need not move together.
-        uses: actions/upload-artifact@v7
+        # Mirrored action, never actions/upload-artifact — @v4+ refuses on the
+        # hostname, @v3 uploads something Gitea will never serve back. This is
+        # the producing half of a pair: image-release downloads `minstrel-apk`
+        # below with the matching download-artifact mirror. Both must stay on
+        # the v4 protocol — mixing a v3 upload with a v4 download (or the
+        # reverse) yields an empty listing, not an error. See Scribe 2255 / 2270.
+        uses: https://git.fabledsword.com/bvandeusen/upload-artifact@cb8afe72b42edc798abfb8fcb556cf660d894245
         with:
           name: minstrel-apk
           path: android/app/build/outputs/apk/release/app-release.apk
@@ -573,63 +170,17 @@ jobs:
           # artifact existing, so an empty upload must fail here, not there.
           if-no-files-found: error
 
-  # Publishes the signed APK and its version sidecar on the tag's Release.
-  # Split out of android-release so the APK can be BUILT in parallel with the
-  # lanes while being PUBLISHED only once they have all passed.
-  release-assets:
-    name: Attach APK to the Release (tag releases only)
-    needs: [go, integration, web, android, govulncheck, android-release]
-    if: >-
-      ${{
-      !cancelled()
-      && needs.go.result == 'success'
-      && needs.integration.result == 'success'
-      && needs.web.result == 'success'
-      && needs.android.result == 'success'
-      && needs.govulncheck.result == 'success'
-      && needs.android-release.result == 'success'
-      && startsWith(github.ref, 'refs/tags/v') }}
-    runs-on: go-ci
-    container:
-      image: git.fabledsword.com/bvandeusen/ci-go:1.26
-
-    steps:
-      - name: Download signed APK artifact
-        uses: actions/download-artifact@v8
-        with:
-          name: minstrel-apk
-          path: release-apk/
-
       - name: Attach APK to gitea Release
-        # Tag releases only. A dev build has no Release to hang assets on and
-        # does not need one — the :dev image bundles the APK, and the server
-        # serves it from /api/client/apk like any other.
         shell: bash
         env:
           CI_TOKEN: ${{ secrets.CI_TOKEN }}
-          VERSION_NAME: ${{ needs.android-release.outputs.version_name }}
-          VERSION_CODE: ${{ needs.android-release.outputs.version_code }}
         run: |
           set -euxo pipefail
           TAG="${GITHUB_REF#refs/tags/}"
           REPO="${GITHUB_REPOSITORY}"
-          APK_PATH="release-apk/app-release.apk"
+          APK_PATH="app/build/outputs/apk/release/app-release.apk"
           ls -lh "${APK_PATH}"
 
-          # Publish the version sidecar as a release asset next to the APK.
-          #
-          # This is what lets a later :latest build stop RECONSTRUCTING the
-          # bundled APK's version and simply read what was recorded. The
-          # ordering key in particular cannot be re-derived after the fact —
-          # it is build-time minutes, so once this job ends the value exists
-          # nowhere else. Reconstruction could only ever recover the name,
-          # and only by duplicating a formula that then has to be kept in
-          # step across two files.
-          SIDECAR_PATH="/tmp/minstrel.apk.version"
-          printf '{"name":"%s","code":%s,"channel":"stable"}\n' \
-            "${VERSION_NAME}" "${VERSION_CODE}" > "${SIDECAR_PATH}"
-          cat "${SIDECAR_PATH}"
-
           RELEASE_JSON="$(curl -fsSL \
             -H "Authorization: token ${CI_TOKEN}" \
             "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/tags/${TAG}")"
@@ -651,37 +202,15 @@ jobs:
             exit 1
           fi
 
-          # Same treatment for the sidecar. Named `.apk.version` so the
-          # downloader's `\.apk$` match cannot pick it up by mistake.
-          SIDECAR_HTTP=$(curl -sS -L -o /tmp/upload-sidecar.out -w '%{http_code}' \
-            -H "Authorization: token ${CI_TOKEN}" \
-            -F "attachment=@${SIDECAR_PATH}" \
-            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=minstrel-${TAG}.apk.version")
-          echo "sidecar_upload_http=${SIDECAR_HTTP}"
-          cat /tmp/upload-sidecar.out || true
-          echo
-          if [ "${SIDECAR_HTTP}" -lt 200 ] || [ "${SIDECAR_HTTP}" -ge 300 ]; then
-            echo "::error::version sidecar upload returned HTTP ${SIDECAR_HTTP}"
-            exit 1
-          fi
-
   image-release:
     name: Build + push container image
-    # Every lane must have SUCCEEDED, each named here (rule 177). Then the
-    # APK: tag and dev pushes build one and it must have succeeded; main
-    # pushes skip android-release and bundle the latest release's APK
-    # instead, so for main alone a skipped android-release is expected.
-    needs: [go, integration, web, android, govulncheck, android-release]
-    if: >-
-      ${{
-      !cancelled()
-      && needs.go.result == 'success'
-      && needs.integration.result == 'success'
-      && needs.web.result == 'success'
-      && needs.android.result == 'success'
-      && needs.govulncheck.result == 'success'
-      && (needs.android-release.result == 'success'
-      || (needs.android-release.result == 'skipped' && github.ref == 'refs/heads/main')) }}
+    # `needs:` waits for android-release. For tag pushes android-release
+    # runs and must succeed before this job starts — guaranteeing the
+    # APK artifact is present. For main pushes android-release is
+    # skipped; the `if: ...` below lets this job run anyway and the
+    # download/copy steps gate themselves on the tag context.
+    needs: [android-release]
+    if: ${{ !failure() && !cancelled() }}
     runs-on: go-ci
     container:
       image: git.fabledsword.com/bvandeusen/ci-go:1.26
@@ -693,16 +222,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          # Full history, and rule 149 names this specifically: any job that
-          # DERIVES the version name needs it, because a shallow clone changes
-          # what git-derived values resolve to WITHOUT failing — a too-low
-          # value, silently, with every lane green.
-          #
-          # This job was depth-1 while it took the version from GITHUB_REF. It
-          # now runs ci/version.sh itself, because with :<version> image tags
-          # gone the server's self-reported version is the only thing that says
-          # which build an image is.
+          # Full history + tags so non-tag :latest builds can resolve the
+          # latest release tag's commit count and reconstruct the bundled
+          # APK's exact versionName (see "Bundle latest release APK" below).
           fetch-depth: 0
+          fetch-tags: true
 
       - name: Detect buildable project
         id: guard
@@ -720,68 +244,21 @@ jobs:
         if: steps.guard.outputs.ready == 'true'
         shell: bash
         run: |
-          set -euo pipefail
-
-          # THE VERSION, and it is derived the same way on every ref — the
-          # branch decides the CHANNEL, never the version (family rule 149).
-          #
-          # This used to be three different things: the literal string "main"
-          # on main, "dev" on dev, and the tag name on a tag. None of them
-          # ordered, and the first two were the same string forever — two dev
-          # images eight weeks apart were indistinguishable in the UI. That
-          # mattered little while :vYYYY.MM.DD.HHMM existed to identify a
-          # build; with version image tags gone, this IS how an operator tells
-          # which build a container is running.
-          #
-          # `sed -n s///p` rather than `grep`: it exits 0 when nothing matches,
-          # so the empty check below is actually reachable. A grep here would
-          # kill the step at the assignment under the runner's pipefail — the
-          # exact bug that took down the first main build after the version
-          # rework.
-          VERSION="$(ci/version.sh HEAD | sed -n 's/^name=//p')"
-          if [ -z "${VERSION}" ]; then
-            echo "::error::could not derive a build version from ci/version.sh"
-            exit 1
-          fi
-
           if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
-            # A release refreshes the CHANNEL and mints nothing else.
-            #
-            # The tag build exists to produce the signed APK and attach it to
-            # the release; the image it rebuilds is the SAME SOURCE as the main
-            # build minutes earlier, differing only in which APK is baked in.
-            # Rule 145 is explicit about that case: when the same source is
-            # rebuilt with different contents, publish the moving channel tag
-            # and never a commit-addressable one.
-            #
-            # :latest must move here rather than waiting for the next main
-            # push, or the channel would carry the PREVIOUS release's APK
-            # indefinitely — a channel that cannot refresh itself (rule 146).
-            CHANNEL=stable
-            echo "args=-t ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
-            echo "::notice::Release build ${VERSION}: refreshing :latest around the new APK"
-          elif [[ "${GITHUB_REF}" == "refs/heads/dev" ]]; then
-            # The rolling test channel, and :dev ALONE — deliberately no
-            # per-commit tag. A rolling channel is rolling by definition, so a
-            # commit-addressable image here would be a rollback target nobody
-            # has ever pulled, accumulating in the registry forever. Recovery
-            # on dev is to fix forward.
-            CHANNEL=dev
-            echo "args=-t ${IMAGE}:dev" >> "$GITHUB_OUTPUT"
-            echo "::notice::Dev-branch build ${VERSION}: :dev"
+            VERSION="${GITHUB_REF#refs/tags/}"
+            echo "args=-t ${IMAGE}:${VERSION} -t ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
+            echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+            echo "::notice::Release build: ${VERSION} + latest"
           else
-            # The production line: :latest tracks main's tip (rule 147) and
-            # :<sha> is the rollback unit (rule 145). Full 40-char SHA, matching
-            # the family's other repos, so a rollback target is addressable
-            # straight from the commit anyone is reading.
-            CHANNEL=stable
-            echo "args=-t ${IMAGE}:latest -t ${IMAGE}:${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
-            echo "::notice::Main-branch build ${VERSION}: :latest + :${GITHUB_SHA}"
+            # Main is the protected, post-PR-merge branch. Treat it as the
+            # rolling stable channel — every main push moves :latest.
+            # Pinned consumers can target :vYYYY.MM.DD; everyone else
+            # gets the newest main.
+            echo "args=-t ${IMAGE}:main -t ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
+            echo "version=main" >> "$GITHUB_OUTPUT"
+            echo "::notice::Main-branch build: :main + :latest"
           fi
 
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "channel=${CHANNEL}" >> "$GITHUB_OUTPUT"
-
       - name: Registry login
         if: steps.guard.outputs.ready == 'true'
         shell: bash
@@ -790,57 +267,54 @@ jobs:
             | docker login git.fabledsword.com -u "${{ github.actor }}" --password-stdin
 
       - name: Download signed APK artifact
-        # Tag and dev pushes — android-release just produced this. Only `main`
-        # takes the "Bundle latest release APK" path below, because it is the
-        # one ref that moves a channel without building an APK of its own.
-        if: >-
-          steps.guard.outputs.ready == 'true' &&
-          (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/dev')
-        # Consuming half of the pair: stock download-artifact, which works here for
-        # the same reason as the upload (gitea/runner 3.x edits the GHES refusal
-        # out of the bundle; snippet #2271). v8 runs on node24, which every
-        # CI-runner image carries — the runner uses the image's own node.
-        uses: actions/download-artifact@v8
+        # Tag pushes only — android-release just produced this. Non-tag
+        # builds take the "Bundle latest release APK" path below instead.
+        if: steps.guard.outputs.ready == 'true' && startsWith(github.ref, 'refs/tags/v')
+        # Consuming half of the pair — never actions/download-artifact. Same fork,
+        # same reason: upstream's client-side GHES check rejects this hostname
+        # before it connects. bvandeusen/download-artifact mirrors
+        # code.forgejo.org/forgejo/download-artifact.
+        #
+        # SHA below is that fork's `v6` tag. Match on @actions/artifact, NOT on
+        # the action's own version number — the two actions release on unrelated
+        # cadences, and download v5 would pair a ^2.3.2 client with this file's
+        # ^4.0.0 uploader. v6 is the tag whose bundled library major (^4.0.0) is
+        # the same one proven against this instance by the upload side.
+        # Deliberately NOT v7: it moves to node24 and upstream requires runner
+        # >= 2.327.1 for it, which act_runner does not claim to satisfy.
+        # Pinned, not tagged — the mirror auto-syncs every 8h.
+        uses: https://git.fabledsword.com/bvandeusen/download-artifact@8d4e9521a5f7e5f8b6351f341f719f9f45a92a3a
         with:
           name: minstrel-apk
           path: client/
 
       - name: Stage bundled APK + version sidecar
-        if: >-
-          steps.guard.outputs.ready == 'true' &&
-          (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/dev')
+        if: steps.guard.outputs.ready == 'true' && startsWith(github.ref, 'refs/tags/v')
         shell: bash
         env:
-          # All three pulled from android-release's outputs so the sidecar the
-          # server hands clients matches exactly what is baked into the APK
-          # they are comparing against.
+          # Pulled from android-release.outputs.version_name so the
+          # sidecar string the server hands clients matches the
+          # versionName baked into the APK they're comparing against.
           APK_VERSION_NAME: ${{ needs.android-release.outputs.version_name }}
-          APK_VERSION_CODE: ${{ needs.android-release.outputs.version_code }}
-          APK_CHANNEL: ${{ needs.android-release.outputs.channel }}
         run: |
           set -euxo pipefail
           # The artifact lands as `app-release.apk` (the original Gradle
           # output name). The Dockerfile COPYs client/* into /app/client/
           # and the server reads minstrel.apk + minstrel.apk.version.
           mv client/app-release.apk client/minstrel.apk
-          printf '{"name":"%s","code":%s,"channel":"%s"}\n' \
-            "${APK_VERSION_NAME}" "${APK_VERSION_CODE}" "${APK_CHANNEL}" \
-            > client/minstrel.apk.version
-          cat client/minstrel.apk.version
+          echo "${APK_VERSION_NAME}" > client/minstrel.apk.version
           ls -lh client/
 
       - name: Bundle latest release APK (non-tag :latest builds)
         # Main pushes don't build an APK, but they DO move :latest — so
         # without this the in-app update channel would vanish from :latest
         # until the next tag. Pull the most-recent release's signed APK and
-        # the sidecar published beside it, so what the server reports is what
-        # that build actually recorded rather than something re-derived here.
+        # reconstruct its exact versionName (${TAG#v}.$(git rev-list --count
+        # TAG) — identical to android-release's formula) so the version
+        # sidecar the server hands clients matches the installed build.
         # Degrades to an empty client/ (404 update channel) — never a wrong
-        # version — if no release or APK asset can be resolved. That
-        # degradation only actually works because the greps below carry
-        # `|| true`; under the runner's default pipefail a non-matching grep
-        # kills the step instead of falling through to the empty-case branch.
-        if: steps.guard.outputs.ready == 'true' && github.ref == 'refs/heads/main'
+        # version — if no release / APK asset / tag-count can be resolved.
+        if: steps.guard.outputs.ready == 'true' && !startsWith(github.ref, 'refs/tags/v')
         shell: bash
         env:
           CI_TOKEN: ${{ secrets.CI_TOKEN }}
@@ -852,53 +326,26 @@ jobs:
           if [ -z "${REL_JSON}" ]; then
             echo "::notice::no published release — image ships without bundled APK"; exit 0
           fi
-          # `|| true` on every one of these, and it is load-bearing rather
-          # than defensive habit. The runner already invokes this shell as
-          # `bash -e -o pipefail`, so a pipeline whose grep matches NOTHING
-          # exits non-zero even though `head` succeeded — and the step dies at
-          # the assignment, before ever reaching the `if` written to handle the
-          # empty case. Every "degrades gracefully" branch below is unreachable
-          # without this.
-          TAG="$(printf '%s' "${REL_JSON}" | grep -oP '"tag_name":\s*"\K[^"]+' | head -1)" || true
-          APK_URL="$(printf '%s' "${REL_JSON}" | grep -oP '"browser_download_url":\s*"\K[^"]+' | grep -E '\.apk$' | head -1)" || true
+          TAG="$(printf '%s' "${REL_JSON}" | grep -oP '"tag_name":\s*"\K[^"]+' | head -1)"
+          APK_URL="$(printf '%s' "${REL_JSON}" | grep -oP '"browser_download_url":\s*"\K[^"]+' | grep -E '\.apk$' | head -1)"
           if [ -z "${TAG}" ] || [ -z "${APK_URL}" ]; then
             echo "::notice::latest release '${TAG:-?}' has no APK asset — image ships without bundled APK"; exit 0
           fi
-          curl -fsSL -H "Authorization: token ${CI_TOKEN}" -o client/minstrel.apk "${APK_URL}"
-
-          # Take the version the release RECORDED rather than recomputing it.
-          # This used to re-derive the name from the tagged commit, which meant
-          # the formula lived in two files that had to be kept in step, and it
-          # could only ever recover the name — the ordering key is build-time
-          # minutes and does not exist anywhere after that build ends.
-          SIDECAR_URL="$(printf '%s' "${REL_JSON}" | grep -oP '"browser_download_url":\s*"\K[^"]+' | grep -E '\.apk\.version$' | head -1)" || true
-          if [ -n "${SIDECAR_URL}" ]; then
-            curl -fsSL -H "Authorization: token ${CI_TOKEN}" -o client/minstrel.apk.version "${SIDECAR_URL}"
-            cat client/minstrel.apk.version
-          else
-            # Releases published before sidecars were attached. Their name is
-            # still recoverable from the tag, but their ordering key genuinely
-            # is not — so it is reported ABSENT rather than guessed. A wrong
-            # key is an install the platform refuses; an absent one just tells
-            # the client to fall back to comparing names, which is exactly
-            # what those builds already do.
-            echo "::notice::release ${TAG} predates the version sidecar — bundling with name only, no ordering key"
-            printf '{"name":"%s","code":null,"channel":"stable"}\n' "${TAG#v}" > client/minstrel.apk.version
+          COUNT="$(git rev-list --count "${TAG}" 2>/dev/null || true)"
+          if [ -z "${COUNT}" ]; then
+            echo "::notice::could not resolve commit count for ${TAG} (tag not fetched?) — skipping APK bundle"; exit 0
           fi
-          echo "::notice::bundled release APK from ${TAG}"
+          VERSION_NAME="${TAG#v}.${COUNT}"
+          curl -fsSL -H "Authorization: token ${CI_TOKEN}" -o client/minstrel.apk "${APK_URL}"
+          echo "${VERSION_NAME}" > client/minstrel.apk.version
+          echo "::notice::bundled release APK ${TAG} as version ${VERSION_NAME}"
           ls -lh client/
 
       - name: Build and push
         if: steps.guard.outputs.ready == 'true'
-        # --pull: the Dockerfile's base images are floating tags (golang:1.26,
-        # debian:bookworm-slim). Without it the runner's daemon reuses
-        # whatever it cached, and the shipped binary can sit on a Go patch
-        # release govulncheck already flagged while the lane, which pulls
-        # fresh, reports clean.
         run: |
-          docker buildx build --pull \
+          docker buildx build \
             --build-arg MINSTREL_VERSION="${{ steps.tags.outputs.version }}" \
-            --build-arg MINSTREL_CHANNEL="${{ steps.tags.outputs.channel }}" \
             --push ${{ steps.tags.outputs.args }} .
 
   # Verifies a tag release actually ended up complete, and names the specific
@@ -909,8 +356,8 @@ jobs:
   # `failure` with none executed and image-release showed `skipped`. The run was
   # red, but the *release page rendered fine*, and `main`'s own push build had
   # already moved `:latest`, so the code was deployable and nothing looked
-  # obviously wrong. The release was simply missing its APK and its image,
-  # which is easy to skim past.
+  # obviously wrong. The release was simply missing its APK and its immutable
+  # `:vYYYY.MM.DD` image, which is easy to skim past.
   #
   # This job cannot prevent that (the cause was a runner failing to launch, not
   # anything in this file). What it does is turn an incomplete release into an
@@ -921,7 +368,7 @@ jobs:
   # above did NOT succeed.
   verify-release:
     name: Verify release artifacts (tag releases only)
-    needs: [android-release, release-assets, image-release]
+    needs: [android-release, image-release]
     if: ${{ always() && startsWith(github.ref, 'refs/tags/v') }}
     runs-on: go-ci
     container:
@@ -961,30 +408,18 @@ jobs:
       # missing when v2026.08.07 had to be re-cut. `always()` on this job means
       # it runs even when image-release failed, so without this the guard would
       # cheerfully verify an incomplete release.
-      #
-      # This asserted `:${TAG}` — the :vYYYY.MM.DD.HHMM image — until
-      # 2026-09-10. Version image tags are no longer published (rule 145), so
-      # that assertion would now fail every release for a tag nothing mints.
-      # The rollback target it was really protecting is the :<sha> image, which
-      # main's own build published for this same commit before the tag was cut.
-      #
-      # Checking it here earns its keep twice over: it still catches an image
-      # push that silently did not happen, and it additionally proves the
-      # ORDERING — a tag cut on a commit whose main build never completed has
-      # no rollback target, and that is worth failing on rather than
-      # discovering during an incident.
-      - name: Rollback image must exist for the tagged commit
+      - name: Immutable image tag must exist
         shell: bash
         run: |
           set -euo pipefail
+          TAG="${GITHUB_REF#refs/tags/}"
           IMAGE="git.fabledsword.com/bvandeusen/minstrel"
 
           echo "${{ secrets.CI_TOKEN }}" \
             | docker login git.fabledsword.com -u "${{ github.actor }}" --password-stdin
 
-          if ! docker manifest inspect "${IMAGE}:${GITHUB_SHA}" > /dev/null 2>&1; then
-            echo "::error::image ${IMAGE}:${GITHUB_SHA} does not exist — this commit has no rollback target."
-            echo "::error::That image is published by the MAIN build of this commit, not by the tag build. If main's build never ran or failed, fix that first; a release whose commit cannot be rolled back to is the thing this check exists to refuse."
+          if ! docker manifest inspect "${IMAGE}:${TAG}" > /dev/null 2>&1; then
+            echo "::error::image ${IMAGE}:${TAG} was never pushed — the release tag has no immutable image, so there is nothing to pin or roll back to. Re-run this workflow run."
             exit 1
           fi
-          echo "::notice::rollback target verified: ${IMAGE}:${GITHUB_SHA}"
+          echo "::notice::image verified: ${IMAGE}:${TAG}"

.gitea/workflows/test-go.yml

@@ -0,0 +1,150 @@
+name: test-go
+
+# Go server: vet + golangci-lint + short race tests. Runs on push to
+# dev/main and PRs to main, scoped to Go-side files only — web-only or
+# Flutter-only diffs don't trigger this workflow.
+#
+# Two jobs: `test` (fast — vet + lint + `go test -short -race`, no DB) and
+# `integration` (full `go test -race` against an ephemeral Postgres).
+#
+# Integration-job DB wiring follows the act_runner shared-daemon pattern:
+# the runner's Docker daemon also runs the operator's dev compose stack,
+# so service containers get NO published ports (collision) and no
+# service-name DNS. We discover the service container by the job-scoped
+# name filter via the mounted docker socket and reach it by bridge IP.
+# The exactly-one assertion is a hard guard — pointing tests at the dev
+# Postgres would truncate it (the disaster Fable #339 exists to prevent).
+#
+# `web/build/` has a committed placeholder index.html so go:embed succeeds
+# without needing the SPA to be freshly built. Real builds happen in
+# release.yml (container) and locally during dev.
+
+on:
+  push:
+    branches: [dev, main]
+    paths:
+      - '**/*.go'
+      - 'go.mod'
+      - 'go.sum'
+      - 'sqlc.yaml'
+      - 'Makefile'
+      - 'internal/**'
+      - 'cmd/**'
+      - '.golangci.yml'
+      - '.gitea/workflows/test-go.yml'
+
+# pull_request trigger intentionally omitted — see test-web.yml for
+# the rationale (single-author repo, push covers PR-merge equivalent).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: go-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-go:1.26
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Toolchain versions
+        run: |
+          go version
+          golangci-lint --version
+
+      - name: Generated code matches queries (sqlc)
+        run: make verify-generate
+
+      - name: go vet
+        run: go vet ./...
+
+      - name: golangci-lint
+        run: golangci-lint run ./...
+
+      - name: go test (short, race)
+        run: go test -short -race ./...
+
+  integration:
+    runs-on: go-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-go:1.26
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: minstrel
+          POSTGRES_PASSWORD: minstrel
+          POSTGRES_DB: minstrel_test
+        # No `ports:` — the runner shares the operator's dev compose
+        # Docker daemon; publishing a fixed host port collides.
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Integration suite (discover service by bridge IP, migrate, test)
+        run: |
+          set -eux
+          # Discover THIS job's Postgres service container via the
+          # mounted docker socket. act_runner attaches the job
+          # container and its service container(s) to a shared per-job
+          # network, so scope discovery to a postgres that sits on a
+          # network THIS job container is also on. The old
+          # `--filter name=integration` matched EVERY concurrent
+          # integration run's postgres (a dev push + the main-merge run
+          # overlap → 2 candidates → false "expected exactly 1" abort).
+          # The operator's dev compose `minstrel-postgres-*` is never on
+          # this job's network; skip it explicitly as belt-and-suspenders
+          # (a wrong target would truncate real data).
+          SELF=$(cat /etc/hostname)
+          SELF_NETS=$(docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} {{end}}' "$SELF")
+          test -n "$SELF_NETS"
+          echo "self ($SELF) networks: $SELF_NETS"
+          PG_ID=""
+          PG_NAME=""
+          for cid in $(docker ps --filter "ancestor=postgres:16-alpine" -q); do
+            nm=$(docker inspect -f '{{.Name}}' "$cid" | sed 's#^/##')
+            case "$nm" in *minstrel-postgres*|*_postgres_*) continue ;; esac
+            for net in $(docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} {{end}}' "$cid"); do
+              case " $SELF_NETS " in *" $net "*) PG_ID="$cid"; PG_NAME="$nm"; break 2 ;; esac
+            done
+          done
+          test -n "$PG_ID" || { echo "FATAL: no postgres service container on this job's network (self nets: $SELF_NETS)"; exit 1; }
+          echo "selected postgres: $PG_ID $PG_NAME"
+          PG_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$PG_ID")
+          test -n "$PG_IP"
+          export MINSTREL_TEST_DATABASE_URL="postgres://minstrel:minstrel@${PG_IP}:5432/minstrel_test?sslmode=disable"
+
+          # Wait for Postgres to accept TCP (no health-check dependency).
+          for i in $(seq 1 60); do (echo > "/dev/tcp/${PG_IP}/5432") 2>/dev/null && break; sleep 2; done
+
+          # Relax durability on the throwaway CI Postgres. Our test pattern
+          # is dbtest.ResetDB → TRUNCATE … RESTART IDENTITY CASCADE before
+          # every test, and the per-TRUNCATE commit fsync is the dominant
+          # cost of the integration suite. The CI DB is rebuilt every run so
+          # fsync / full_page_writes / synchronous_commit buy nothing. Apply
+          # via docker exec because:
+          #  - The act_runner `services:` block can't override the container
+          #    command, so `postgres -c fsync=off` at boot isn't an option.
+          #  - ALTER SYSTEM cannot run inside a transaction; psql -c
+          #    auto-commits each statement, which is what we need.
+          #  - fsync / full_page_writes are sighup GUCs and
+          #    synchronous_commit is user-context, so pg_reload_conf() picks
+          #    all three up with no restart.
+          # Non-fatal: a perms surprise degrades to "slower", never red CI.
+          docker exec "$PG_ID" psql -U minstrel -d minstrel_test \
+            -c "ALTER SYSTEM SET fsync = off" \
+            -c "ALTER SYSTEM SET synchronous_commit = off" \
+            -c "ALTER SYSTEM SET full_page_writes = off" \
+            -c "SELECT pg_reload_conf()" \
+            || echo "WARN: durability relax failed; continuing"
+
+          # Apply embedded migrations to the fresh test DB, then run the
+          # full suite (no -short → integration tests execute). -p 1:
+          # every integration package TRUNCATEs the one shared test DB;
+          # concurrent package binaries → TRUNCATE deadlocks. Serialize
+          # package execution (the documented local invocation too).
+          MINSTREL_DATABASE_URL="$MINSTREL_TEST_DATABASE_URL" go run ./cmd/minstrel migrate
+          go test -p 1 -race ./...

.gitea/workflows/test-web.yml

@@ -0,0 +1,44 @@
+name: test-web
+
+# Web SPA: vitest + svelte-check. Runs on push to dev/main only —
+# the `pull_request` trigger is intentionally omitted because every
+# branch on this repo is local-only (no fork PRs), so the dev push
+# fully covers what a PR run would re-execute. Keeping both events
+# doubled CI cost on every commit.
+
+on:
+  push:
+    branches: [dev, main]
+    paths:
+      - 'web/**'
+      - '.gitea/workflows/test-web.yml'
+
+# Cancel an earlier in-flight run for the same ref when a newer
+# commit arrives. With cancel-in-progress, rapid re-pushes don't
+# pile up zombie runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: go-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-go:1.26
+
+    defaults:
+      run:
+        working-directory: web
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Type-check + svelte-check
+        run: npm run check
+
+      - name: Vitest
+        run: npm test

.gitignore

@@ -12,11 +12,6 @@
 # Test binary, built with `go test -c`
 *.test
 
-# `make build` output. bin/minstrel was tracked until 2026-09-10 — an 18 MB
-# binary committed by accident, last refreshed by a commit about web test
-# mocks, and re-dirtied by every local build since.
-bin/
-
 # Bundled Android APK + version sidecar (#397). Populated by CI for
 # tag releases; never committed. README in client/ explains the flow.
 client/minstrel.apk

Dockerfile

@@ -7,7 +7,7 @@ RUN npm ci
 COPY web/ ./
 RUN npm run build
 
-FROM golang:1.26-bookworm AS builder
+FROM golang:1.25-bookworm AS builder
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -15,32 +15,17 @@ COPY . .
 # Overwrite the committed placeholder with the freshly-built SPA assets.
 COPY --from=web /web/build ./web/build
 ENV CGO_ENABLED=0
-# Version stamping. release.yml passes the DERIVED version name
-# (YYYY.MM.DD.HHMM) and the lane's channel; a local `docker build` falls back
-# to "dev"/"local". Both are surfaced at /healthz.
-#
-# These are two values on purpose (family rule 149): the same commit built on
-# dev and on main reports the same NAME and differs only in CHANNEL. Folding
-# the channel into the version string is what the rule forbids — the version
-# used to BE the channel word here ("main"/"dev"), which meant two dev images
-# eight weeks apart were indistinguishable.
+# Version stamping: release.yml passes the git tag via MINSTREL_VERSION
+# build-arg; local `docker build` falls back to "dev". Surfaced at
+# /healthz for operator-side image-version verification.
 ARG MINSTREL_VERSION=dev
-ARG MINSTREL_CHANNEL=local
 RUN go build -trimpath \
-    -ldflags="-s -w \
-      -X 'git.fabledsword.com/bvandeusen/minstrel/internal/server.ServerVersion=${MINSTREL_VERSION}' \
-      -X 'git.fabledsword.com/bvandeusen/minstrel/internal/server.ServerChannel=${MINSTREL_CHANNEL}'" \
+    -ldflags="-s -w -X 'git.fabledsword.com/bvandeusen/minstrel/internal/server.ServerVersion=${MINSTREL_VERSION}'" \
     -o /out/minstrel ./cmd/minstrel
 
 FROM debian:bookworm-slim
-# ffmpeg: duration probes and the exact-tier audio hash (a SHA-256 of the
-# encoded audio packets, so no decode). libchromaprint-tools: fpcalc, the
-# acoustic fingerprint that tells the same recording at two bitrates apart
-# from two different recordings (M400). Both are baked in at build time so a
-# deployed instance never fetches either (rule 164); fpcalc is shelled out
-# rather than bound because CGO_ENABLED=0 above rules out cgo.
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates ffmpeg libchromaprint-tools \
+    && apt-get install -y --no-install-recommends ca-certificates ffmpeg \
     && rm -rf /var/lib/apt/lists/*
 
 RUN groupadd --system --gid 1000 minstrel \

README.md

@@ -34,18 +34,11 @@ Minstrel is not affiliated with or endorsed by Lidarr, ListenBrainz, MusicBrainz
 services:
   minstrel:
     image: git.fabledsword.com/bvandeusen/minstrel:latest
-    # Reachable from your LAN at http://<host>:4533. If this host faces the
-    # internet, bind it to 127.0.0.1 and put an HTTPS proxy in front instead:
-    # see docs/hosting.md.
     ports: ['4533:4533']
     volumes:
       # Your music library. Point ./music at wherever your audio files
-      # live. Writable, because Minstrel deletes a file when an admin asks
-      # it to (for example, quarantine's "Delete file"). It never moves,
-      # renames or retags anything. The container runs as uid 1000, so that
-      # user needs write access to the folders. Mount it :ro to forbid even
-      # deletes: those actions then refuse, say why, and delete nothing.
-      - ./music:/music
+      # live. Mounted read-only — Minstrel never writes to your library.
+      - ./music:/music:ro
       # Generated data: playlist cover collages, artist art, caches.
       # The path must match MINSTREL_STORAGE_DATA_DIR, which the image
       # sets to /app/data — keep this mount on /app/data or your cache
@@ -54,7 +47,7 @@ services:
     environment:
       MINSTREL_DATABASE_URL: postgres://minstrel:minstrel@db:5432/minstrel?sslmode=disable
       # Colon-separated library roots to scan; must match the container
-      # path of the music mount above (/music here).
+      # path of the read-only music mount above (/music here).
       MINSTREL_LIBRARY_SCAN_PATHS: /music
     depends_on: [db]
 
@@ -79,9 +72,9 @@ docker compose up -d
 
 ## First run
 
-With the stack up, a handful of in-app steps get you to a working library. Use your own host in place of `localhost` if you're reaching the server over a LAN/VPN address. Plain `http://` is fine on a network you trust; a server reachable from the internet belongs behind HTTPS, which [docs/hosting.md](docs/hosting.md) walks through.
+With the stack up, a handful of in-app steps get you to a working library. Use your own host in place of `localhost` if you're reaching the server over a LAN/VPN address (plain `http://` is fine — no TLS required).
 
-**1. Create your admin account.** Visit `http://localhost:4533/register`. The first account on a fresh instance becomes the administrator, and creating it asks for the **setup token** the server prints in its log (`docker compose logs minstrel | grep setup_token`), so nobody else can claim a newly exposed server first. Later users join through the same form or an invite token (step 5).
+**1. Create your admin account.** Visit `http://localhost:4533/register`. The first account on a fresh instance is automatically the administrator; later users join through the same form or an invite token (step 5).
 
 <a href="docs/screenshots/register.png"><img src="docs/screenshots/register.png" width="320" alt="Creating the first (admin) account on a fresh instance"></a>
 
@@ -103,8 +96,6 @@ With the stack up, a handful of in-app steps get you to a working library. Use y
 
 For the full configuration surface, see [`config.example.yaml`](./config.example.yaml).
 
-Hosting Minstrel on the internet: see [docs/hosting.md](docs/hosting.md). What Minstrel does to protect accounts, and why: [docs/security.md](docs/security.md).
-
 ## Configuration
 
 Most operators only need the env vars in the quickstart above. A few extras worth knowing:
@@ -121,21 +112,11 @@ Most operational keys have a `MINSTREL_<SECTION>_<FIELD>` env override. Recommen
 
 Image tags (`git.fabledsword.com/bvandeusen/minstrel:<tag>`):
 
-- `:latest` — production. Tracks `main`'s tip and moves on every `main` push and every release. What most operators should run.
-- `:<commit-sha>` — the rollback unit. Every `main` push publishes one, so any production commit is addressable without a release ceremony. Immutable: a given SHA tag is never re-pushed. Pin one if you need a deployment that cannot change under you, and use it to roll back.
-- `:dev` — the rolling test channel, rebuilt on every push to `dev` and carrying its own freshly-built Android APK. Run this to try something before it ships. It moves constantly, has no per-commit tag, and its only recovery path is forward — if a `:dev` image is broken, the fix is the next push, not a rollback.
+- `:latest` — the newest blessed image. Moves on every `main` push **and** every release. Recommended for most operators.
+- `:vYYYY.MM.DD` — immutable per-day release tags. Pin one of these for a deployment you don't want moving under you. (Per-day CalVer — no trailing patch digit; a same-day re-cut moves the tag forward.)
+- `:main` — the rolling post-merge tip. Same image as `:latest` at push time; choose it if you want to track `main` explicitly rather than the release line.
 
-That is the whole tag map. **There are no version-numbered image tags**, and no `:main`. Git and the build's own self-reported version answer "which build is this" — the Settings page shows it, and so does `/healthz`. Release *tags* in git are still `vYYYY.MM.DD.HHMM`; they name a changelog entry and the APK attached to it, not an image.
-
-Rolling back to `:<commit-sha>` pins the **server code** at that commit — not the server-and-app pair. The Android APK is baked in at image build time, so a SHA image carries whichever app was current when that commit was built, which may be older than what `:latest` bundles now. If both halves matter, check what the image bundles rather than trusting the tag's name.
-
-Every `:latest`, `:<commit-sha>` and `:dev` bundles a signed Android APK, so the in-app update channel is always live. All are signed with the same key, so a phone can move between the stable and dev channels without uninstalling — point it at a `:dev` server and the in-app updater offers that channel's build.
-
-The app reports which channel it is on alongside its version, and decides whether an update is available using the build's ordering key rather than its displayed name — the same value Android installs by, so an offer it makes is one the platform will accept.
-
-Database migrations run automatically at startup; rollbacks require restoring a Postgres dump.
-
-Releases up to 2026-09-10 also published a `:vYYYY.MM.DD[.HHMM]` image tag. Those images still exist and still work — they are simply not extended.
+Every `:latest` and every `:vYYYY.MM.DD` bundles the current signed Android APK, so the in-app update channel is always live. Database migrations run automatically at startup; rollbacks require restoring a Postgres dump.
 
 ## Specs
 
@@ -159,8 +140,7 @@ Two concurrent dev processes:
   truncates your dev `minstrel` data (admin user, library, likes). It
   brings up the compose Postgres and creates the test DB if missing.
 - CI runs both: a fast `go test -short -race` gate plus an integration
-  job with its own ephemeral Postgres (the `integration` lane in
-  `.gitea/workflows/release.yml`, which also gates every image publish).
+  job with its own ephemeral Postgres (`.gitea/workflows/test-go.yml`).
 
 ### Production build
 
@@ -170,7 +150,7 @@ Two concurrent dev processes:
 
 - Day-to-day work happens on `dev` (or feature branches merged into `dev`).
 - `main` is **protected** — changes land via PR from `dev`.
-- Releases are cut by tagging `v*` off `main`; the release workflow builds the signed APK, attaches it to the release, and refreshes `:latest` around it.
+- Releases are cut by tagging `v*` off `main`; the release workflow builds and pushes the container image to the Gitea registry.
 
 Task and milestone tracking: Fable (`Minstrel` project, id 12).
 

android/app/build.gradle.kts

@@ -21,24 +21,13 @@ android {
         applicationId = "com.fabledsword.minstrel"
         minSdk = 26
         targetSdk = 36
-        // versionName / versionCode are released-build values injected by CI.
-        // Local / debug builds fall back to "dev" so the About card reads
-        // honestly.
-        //
-        // versionName is "YYYY.MM.DD.HHMM" from the COMMIT's timestamp, so
-        // every lane building this source reports the same string and the
-        // channel is the only thing that differs between them.
-        //
-        // versionCode is minutes since 2020-01-01 at BUILD time. It is the
-        // value the platform decides installs by, so it must be monotonic by
-        // construction.
-        //
-        // This comment used to say versionCode was a commit count and that it
-        // was "monotonic forever". It was neither — a commit count runs ahead
-        // on `dev`, so a dev build outranked the `main` release meant to
-        // replace it and Android refused the install as a downgrade. Worth
-        // knowing the claim was here, stated as a reassurance, while the bug
-        // it denied was live.
+        // versionName / versionCode are released-build values injected by
+        // CI from the git tag + commit count. Local / debug builds fall
+        // back to "dev" so the About card reads honestly. Releases ship
+        // versionName="YYYY.MM.DD.<commits>" (e.g. "2026.06.02.142") and
+        // versionCode=<commits>, which is monotonic forever and lets the
+        // shared isVersionNewer comparator distinguish two same-day
+        // re-cuts (the iteration suffix differs).
         val versionNameOverride =
             (project.findProperty("MINSTREL_VERSION_NAME") as String?)?.takeIf { it.isNotBlank() }
         val versionCodeOverride =
@@ -72,13 +61,9 @@ android {
                 getDefaultProguardFile("proguard-android-optimize.txt"),
                 "proguard-rules.pro",
             )
-            // Signed with the release key or not at all. Falling back to the
-            // debug key made a missing secret into a published APK that no
-            // install could ever update (family idea #5103, practice 2). An
-            // unsigned build installs nowhere, so the gap shows at once.
             signingConfig =
                 if (System.getenv("ANDROID_KEYSTORE_PATH").isNullOrEmpty()) {
-                    null
+                    signingConfigs.getByName("debug")
                 } else {
                     signingConfigs.getByName("release")
                 }
@@ -165,6 +150,7 @@ dependencies {
     implementation(libs.compose.ui)
     implementation(libs.compose.ui.graphics)
     implementation(libs.compose.material3)
+    implementation(libs.compose.ui.text.google.fonts)
     debugImplementation(libs.compose.ui.tooling)
     implementation(libs.compose.ui.tooling.preview)
 

android/app/src/main/java/com/fabledsword/minstrel/admin/ui/AdminQuarantineScreen.kt

@@ -15,14 +15,10 @@ import androidx.compose.material3.HorizontalDivider
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedButton
 import androidx.compose.material3.Scaffold
-import androidx.compose.material3.SnackbarHost
-import androidx.compose.material3.SnackbarHostState
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
-import androidx.compose.runtime.remember
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.text.style.TextOverflow
@@ -46,12 +42,6 @@ fun AdminQuarantineScreen(
     viewModel: AdminQuarantineViewModel = hiltViewModel(),
 ) {
     val state by viewModel.uiState.collectAsStateWithLifecycle()
-    val snackbarHostState = remember { SnackbarHostState() }
-    LaunchedEffect(Unit) {
-        viewModel.transientMessages.collect { msg ->
-            snackbarHostState.showSnackbar(msg)
-        }
-    }
     Scaffold(
         contentWindowInsets = ShellContentWindowInsets,
         modifier = Modifier.fillMaxSize(),
@@ -63,7 +53,6 @@ fun AdminQuarantineScreen(
                 onBack = { navController.popBackStack() },
             )
         },
-        snackbarHost = { SnackbarHost(snackbarHostState) },
     ) { inner ->
         PullToRefreshScaffold(
             onRefresh = { viewModel.refresh().join() },

android/app/src/main/java/com/fabledsword/minstrel/admin/ui/AdminQuarantineViewModel.kt

@@ -10,13 +10,10 @@ import com.fabledsword.minstrel.events.EventsStream
 import com.fabledsword.minstrel.models.AdminQuarantineItemRef
 import dagger.hilt.android.lifecycle.HiltViewModel
 import kotlinx.coroutines.Job
-import kotlinx.coroutines.channels.Channel
-import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.flow.filter
-import kotlinx.coroutines.flow.receiveAsFlow
 import kotlinx.coroutines.launch
 import javax.inject.Inject
 
@@ -37,15 +34,6 @@ class AdminQuarantineViewModel @Inject constructor(
     private val internal = MutableStateFlow<AdminQuarantineUiState>(AdminQuarantineUiState.Loading)
     val uiState: StateFlow<AdminQuarantineUiState> = internal.asStateFlow()
 
-    /**
-     * One-shot messages for the screen's snackbar. A failed action has to say
-     * why: the row quietly reappearing reads as a glitch, and for a Delete
-     * file refused by a read-only library it hides the one thing the
-     * operator can fix (#3918).
-     */
-    private val transientMessagesChannel = Channel<String>(Channel.BUFFERED)
-    val transientMessages: Flow<String> = transientMessagesChannel.receiveAsFlow()
-
     init {
         refresh()
         viewModelScope.launch {
@@ -98,9 +86,8 @@ class AdminQuarantineViewModel @Inject constructor(
             try {
                 action(trackId)
             } catch (
-                @Suppress("TooGenericExceptionCaught") e: Throwable,
+                @Suppress("TooGenericExceptionCaught", "SwallowedException") e: Throwable,
             ) {
-                transientMessagesChannel.trySend(ErrorCopy.fromThrowable(e))
                 refresh()
             }
         }

android/app/src/main/java/com/fabledsword/minstrel/api/BaseUrlInterceptor.kt

@@ -50,14 +50,7 @@ class BaseUrlInterceptor @Inject constructor(
                 .port(baseUrl.port)
                 .build()
         } ?: original.url
-        return chain.proceed(
-            original.newBuilder()
-                .url(rewritten)
-                // Lets CleartextGuardInterceptor tell server requests from
-                // external fetches once the placeholder host is gone.
-                .tag(MinstrelServerRequest::class.java, MinstrelServerRequest)
-                .build(),
-        )
+        return chain.proceed(original.newBuilder().url(rewritten).build())
     }
 
     companion object {

android/app/src/main/java/com/fabledsword/minstrel/api/CleartextGuard.kt

@@ -1,84 +0,0 @@
-package com.fabledsword.minstrel.api
-
-import okhttp3.Interceptor
-import okhttp3.Response
-import java.io.IOException
-import java.net.Inet4Address
-import java.net.Inet6Address
-import java.net.InetAddress
-
-/**
- * Marks a request as bound for the Minstrel server, set by
- * [BaseUrlInterceptor] when it retargets the placeholder host. Those are the
- * requests that carry the session cookie and the password.
- */
-object MinstrelServerRequest
-
-/**
- * Plain `http://` to the Minstrel server is allowed only when the connection
- * actually lands on a private address (family security baseline #5105,
- * practice 13).
- *
- * Cleartext stays permitted app-wide for LAN servers and UPnP
- * (network_security_config.xml, #2439), but a password or session cookie sent
- * over plain HTTP to a public address can be read by anyone on the path.
- *
- * Checked per connection, on the address the socket really reached, not on
- * the URL when it was typed: a name that resolved to the home network when it
- * was entered resolves to a public address once the phone leaves home, and
- * that is exactly when the password would go out in the clear. A network
- * interceptor runs after the connection is made and before any request byte
- * is written, so nothing is sent.
- */
-class CleartextGuardInterceptor(
-    // The policy is a parameter so a test can refuse loopback, the only
-    // address a test server can listen on.
-    private val allows: (InetAddress) -> Boolean = CleartextPolicy::allows,
-) : Interceptor {
-    override fun intercept(chain: Interceptor.Chain): Response {
-        val request = chain.request()
-        if (request.isHttps || request.tag(MinstrelServerRequest::class.java) == null) {
-            return chain.proceed(request)
-        }
-        val address = chain.connection()?.route()?.socketAddress?.address
-        if (address != null && !allows(address)) {
-            throw CleartextToPublicHostException(request.url.host)
-        }
-        return chain.proceed(request)
-    }
-}
-
-/** The server was reached over plain HTTP at a public address, and refused. */
-class CleartextToPublicHostException(host: String) :
-    IOException("refusing plain http:// to $host: it is a public address")
-
-/** Which addresses plain HTTP may reach: the home network, never the internet. */
-object CleartextPolicy {
-    private const val CGNAT_FIRST_OCTET = 100
-    private const val CGNAT_SECOND_MASK = 0xC0
-    private const val CGNAT_SECOND_PREFIX = 64
-    private const val ULA_MASK = 0xFE
-    private const val ULA_PREFIX = 0xFC
-    private const val BYTE = 0xFF
-
-    fun allows(address: InetAddress): Boolean =
-        address.isLoopbackAddress ||
-            address.isSiteLocalAddress || // 10/8, 172.16/12, 192.168/16
-            address.isLinkLocalAddress || // 169.254/16, fe80::/10
-            address.isAnyLocalAddress ||
-            isCarrierGradeNat(address) ||
-            isUniqueLocal(address)
-
-    // 100.64/10. Tailscale and other overlay VPNs hand these out; the overlay
-    // encrypts the traffic itself.
-    private fun isCarrierGradeNat(address: InetAddress): Boolean {
-        if (address !is Inet4Address) return false
-        val b = address.address
-        return (b[0].toInt() and BYTE) == CGNAT_FIRST_OCTET &&
-            (b[1].toInt() and CGNAT_SECOND_MASK) == CGNAT_SECOND_PREFIX
-    }
-
-    // fc00::/7, IPv6's private range.
-    private fun isUniqueLocal(address: InetAddress): Boolean =
-        address is Inet6Address && (address.address[0].toInt() and ULA_MASK) == ULA_PREFIX
-}

android/app/src/main/java/com/fabledsword/minstrel/api/ErrorCopy.kt

@@ -37,36 +37,18 @@ object ErrorCopy {
      * as connection failures.
      */
     fun fromThrowable(t: Throwable): String = when (t) {
-        is HttpException -> fromHttp(t)
-        is CleartextToPublicHostException -> messageFor("cleartext_public")
+        is HttpException -> messageFor(codeFromHttp(t))
         is IOException -> messageFor("connection_refused")
         else -> TABLE.getValue("unknown")
     }
 
-    /**
-     * Codes whose server message carries specifics the operator needs in
-     * order to act — which directory, which uid — that fixed copy cannot say.
-     * For these the message follows the copy (#3918). Kept to a named set on
-     * purpose: most server messages are internal detail. Mirrors web's
-     * errors.ts.
-     */
-    private val DETAIL_CODES = setOf("library_not_writable", "file_delete_failed")
-
-    private fun fromHttp(e: HttpException): String {
-        val body = bodyFromHttp(e)
-        val copy = messageFor(body.code.ifEmpty { "unknown" })
-        return if (body.code in DETAIL_CODES && body.message.isNotBlank()) {
-            "$copy ${body.message}"
-        } else {
-            copy
-        }
-    }
-
-    private fun bodyFromHttp(e: HttpException): Body {
+    private fun codeFromHttp(e: HttpException): String {
         val raw = runCatching { e.response()?.errorBody()?.string() }.getOrNull()
-            ?: return Body()
-        return runCatching { json.decodeFromString<Envelope>(raw).error }
-            .getOrNull() ?: Body()
+            ?: return "unknown"
+        val code = runCatching { json.decodeFromString<Envelope>(raw).error?.code }
+            .getOrNull()
+            .orEmpty()
+        return code.ifEmpty { "unknown" }
     }
 
     private val TABLE: Map<String, String> = mapOf(
@@ -76,7 +58,6 @@ object ErrorCopy {
         "forbidden" to "You don't have permission to do that.",
         "not_authorized" to "You don't have permission to do that.",
         "invalid_credentials" to "Wrong username or password.",
-        "rate_limited" to "Too many attempts. Wait a few minutes and try again.",
         "wrong_password" to "Current password is incorrect.",
         "password_too_short" to "Password must be at least 8 characters.",
         "username_invalid" to "That username isn't valid.",
@@ -102,9 +83,6 @@ object ErrorCopy {
         "mbid_required" to "An MBID is required for this lookup.",
         "system_playlist_readonly" to "System playlists can't be edited directly.",
         "connection_refused" to "Couldn't reach the server. Check the URL and try again.",
-        "cleartext_public" to
-            "This server is on the internet, so its URL must start with https://. " +
-            "Plain http:// only works on your home network.",
         "lidarr_unreachable" to
             "Lidarr is unreachable right now. Try again, or check Admin → Integrations.",
         "lidarr_disabled" to "Lidarr integration is not enabled.",
@@ -121,8 +99,6 @@ object ErrorCopy {
         "request_not_pending" to "This request is no longer pending.",
         "request_not_found" to "That request no longer exists.",
         "track_not_found" to "That track no longer exists.",
-        "library_not_writable" to "The music library isn't writable by the server.",
-        "file_delete_failed" to "The file couldn't be deleted.",
         "album_not_found" to "That album no longer exists.",
         "artist_not_found" to "That artist no longer exists.",
         "playlist_not_found" to "That playlist no longer exists.",

android/app/src/main/java/com/fabledsword/minstrel/api/NetworkModule.kt

@@ -70,9 +70,6 @@ object NetworkModule {
             .addInterceptor(auth)
             .addInterceptor(baseUrl)
             .addInterceptor(logging)
-            // A network interceptor, so it sees the address the connection
-            // really reached and runs before any request byte is written.
-            .addNetworkInterceptor(CleartextGuardInterceptor())
             .connectTimeout(CONNECT_TIMEOUT_SECONDS, TimeUnit.SECONDS)
             .readTimeout(READ_TIMEOUT_SECONDS, TimeUnit.SECONDS)
             .build()

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/CastApi.kt

@@ -29,20 +29,11 @@ interface CastApi {
  * Request body. [expSeconds] is clamped server-side to [60, 86400];
  * the 21_600 default (6h) is long enough to play through any typical
  * track without re-minting mid-playback.
- *
- * [level] asks for the leveled stream (M464 #5001): the track rendered at
- * the user's loudness gain, which the server works out from their setting.
- * [asAlbum] says the track plays among its album in order, which picks
- * album gain in auto mode. [prerender] says the speaker will fetch it
- * soon, so the server renders it ahead.
  */
 @Serializable
 data class StreamTokenRequest(
     val trackId: String,
     val expSeconds: Int = 21_600,
-    val level: Boolean = false,
-    val asAlbum: Boolean = false,
-    val prerender: Boolean = false,
 )
 
 /**
@@ -62,6 +53,4 @@ data class StreamTokenResponse(
     val url: String,
     val mime: String = "audio/mpeg",
     val title: String = "",
-    /** [url] is the leveled stream; false when leveling is off or changes nothing. */
-    val leveled: Boolean = false,
 )

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/MeApi.kt

@@ -3,7 +3,6 @@ package com.fabledsword.minstrel.api.endpoints
 import com.fabledsword.minstrel.models.wire.ListenBrainzStatusWire
 import com.fabledsword.minstrel.models.wire.MyProfileWire
 import com.fabledsword.minstrel.models.wire.SystemPlaylistsStatusWire
-import com.fabledsword.minstrel.settings.data.NormalizationPrefs
 import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
 import retrofit2.http.Body
@@ -60,14 +59,6 @@ interface MeApi {
      */
     @PUT("api/me/listenbrainz")
     suspend fun setListenBrainz(@Body body: ListenBrainzPutBody): ListenBrainzStatusWire
-
-    /** The caller's loudness-normalization preference, or the defaults if never set. */
-    @GET("api/me/normalization")
-    suspend fun getNormalization(): NormalizationPrefs
-
-    /** Replaces the whole preference; returns what the server stored. */
-    @PUT("api/me/normalization")
-    suspend fun putNormalization(@Body body: NormalizationPrefs): NormalizationPrefs
 }
 
 /**

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/ReplayGainApi.kt

@@ -1,15 +0,0 @@
-package com.fabledsword.minstrel.api.endpoints
-
-import com.fabledsword.minstrel.models.wire.ReplayGainResponseWire
-import retrofit2.http.GET
-import retrofit2.http.Query
-
-/** The player's loudness lookup (#4997), kept apart from the browse surface in [LibraryApi]. */
-interface ReplayGainApi {
-    /**
-     * ReplayGain values for up to 200 comma-separated track ids. An id
-     * missing from `items` has not been measured yet.
-     */
-    @GET("api/tracks/replay-gain")
-    suspend fun getReplayGain(@Query("ids") ids: String): ReplayGainResponseWire
-}

android/app/src/main/java/com/fabledsword/minstrel/auth/AuthStore.kt

@@ -4,19 +4,12 @@ import com.fabledsword.minstrel.cache.audiocache.CacheSettings
 import com.fabledsword.minstrel.cache.db.dao.AuthSessionDao
 import com.fabledsword.minstrel.cache.db.entities.AuthSessionEntity
 import com.fabledsword.minstrel.di.ApplicationScope
-import com.fabledsword.minstrel.settings.data.NormalizationPrefs
 import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Deferred
-import kotlinx.coroutines.async
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.launch
-import kotlinx.coroutines.sync.Mutex
-import kotlinx.coroutines.sync.withLock
-import kotlinx.coroutines.withTimeoutOrNull
 import kotlinx.serialization.json.Json
-import timber.log.Timber
 import javax.inject.Inject
 import javax.inject.Singleton
 
@@ -34,14 +27,6 @@ import javax.inject.Singleton
  * in-memory state changes synchronously so the next interceptor read
  * sees the new value immediately; the DAO write coroutine catches up
  * shortly after.
- *
- * **The session cookie is the exception** (M462 #4985): it is persisted
- * through [SessionVault] (Keystore-encrypted), not the Room row. On the
- * first launch after the upgrade, a cookie still in the row is moved into
- * the vault and the column cleared, so nobody is signed out by the change.
- * If the Keystore cannot be used on a device, the cookie stays in the row
- * as before rather than being lost. [awaitSessionHydrated] lets a caller
- * that needs a definitive answer (the auth gate) wait for this.
  */
 // AuthStore is the single-row facade over auth_session (de-facto
 // app_preferences — see entity comment). It legitimately owns one
@@ -54,7 +39,6 @@ import javax.inject.Singleton
 @Singleton
 class AuthStore @Inject constructor(
     private val dao: AuthSessionDao,
-    private val vault: SessionVault,
     @ApplicationScope private val scope: CoroutineScope,
 ) {
     private val sessionCookieState = MutableStateFlow<String?>(null)
@@ -78,32 +62,18 @@ class AuthStore @Inject constructor(
     private val diagnosticsOptOutState = MutableStateFlow(false)
     val diagnosticsOptOut: StateFlow<Boolean> = diagnosticsOptOutState.asStateFlow()
 
-    private val normalizationState = MutableStateFlow(NormalizationPrefs.DEFAULT)
-    val normalization: StateFlow<NormalizationPrefs> = normalizationState.asStateFlow()
-
     private val json = Json { ignoreUnknownKeys = true }
 
-    // Serialises every cookie persist with the one-time hydration, so a
-    // sign-in or a 401 that lands while hydration runs is never overwritten
-    // by the stale value hydration read.
-    private val cookieLock = Mutex()
-
-    // Set by setSessionCookie. Once something has written the cookie this
-    // process, that value wins over whatever hydration finds on disk.
-    @Volatile private var cookieTouched = false
-
-    private val cookieHydration: Deferred<Unit> = scope.async { hydrateSessionCookie() }
-
     init {
         scope.launch {
             dao.observe().collect { row ->
+                sessionCookieState.value = row?.sessionCookie
                 baseUrlState.value = row?.baseUrl ?: DEFAULT_BASE_URL
                 userJsonState.value = row?.userJson
                 themeModeState.value = row?.themeMode
                 clientIdState.value = row?.clientId
                 cacheSettingsState.value = decodeCacheSettings(row?.cacheSettingsJson)
                 diagnosticsOptOutState.value = row?.diagnosticsOptOut ?: false
-                normalizationState.value = decodeNormalization(row?.normalizationJson)
             }
         }
     }
@@ -115,57 +85,9 @@ class AuthStore @Inject constructor(
         }.getOrDefault(CacheSettings.DEFAULT)
     }
 
-    private fun decodeNormalization(raw: String?): NormalizationPrefs {
-        if (raw.isNullOrEmpty()) return NormalizationPrefs.DEFAULT
-        return runCatching {
-            json.decodeFromString(NormalizationPrefs.serializer(), raw)
-        }.getOrDefault(NormalizationPrefs.DEFAULT)
-    }
-
-    /**
-     * Suspends until the stored session cookie has been loaded into
-     * [sessionCookie], or [HYDRATION_DEADLINE_MS] passes (rule 156: a wedged
-     * Keystore must not leave the start screen spinning). Returns false on
-     * the deadline; the caller then decides from whatever has loaded, and a
-     * late hydration still lands in [sessionCookie].
-     */
-    suspend fun awaitSessionHydrated(): Boolean {
-        val done = withTimeoutOrNull(HYDRATION_DEADLINE_MS) { cookieHydration.await() } != null
-        if (!done) Timber.w("auth store: session hydration passed its deadline; deciding without it")
-        return done
-    }
-
     fun setSessionCookie(value: String?) {
-        cookieTouched = true
         sessionCookieState.value = value
-        scope.launch { cookieLock.withLock { storeCookie(value) } }
-    }
-
-    private suspend fun hydrateSessionCookie() = cookieLock.withLock {
-        val legacy = runCatching { dao.get()?.sessionCookie }.getOrNull()
-        if (cookieTouched) return@withLock
-        // A cookie in the row is the newer one when both exist: the row is
-        // only written when the vault failed, and an install upgrading from
-        // before the vault has nothing in the vault yet.
-        val cookie = legacy ?: vault.read()
-        // Best-effort: if moving it fails, the session still loads this time
-        // and the move is retried on the next launch. Hydration must never
-        // throw, or awaitSessionHydrated would leave the auth gate stuck.
-        if (legacy != null) {
-            runCatching { storeCookie(legacy) }
-                .onFailure { Timber.w(it, "auth store: could not move the session cookie into the vault") }
-        }
-        sessionCookieState.value = cookie
-    }
-
-    // Vault first; the Room row only when the Keystore is unusable, so a
-    // broken Keystore degrades to the old storage rather than a sign-out.
-    private suspend fun storeCookie(value: String?) {
-        if (vault.write(value)) {
-            if (dao.get()?.sessionCookie != null) dao.setSessionCookie(null)
-        } else {
-            persistLegacyCookie(value)
-        }
+        scope.launch { persistCookie(value) }
     }
 
     fun setBaseUrl(value: String) {
@@ -199,13 +121,7 @@ class AuthStore @Inject constructor(
         scope.launch { persistDiagnosticsOptOut(value) }
     }
 
-    fun setNormalization(value: NormalizationPrefs) {
-        normalizationState.value = value
-        val encoded = json.encodeToString(NormalizationPrefs.serializer(), value)
-        scope.launch { persistNormalization(encoded) }
-    }
-
-    private suspend fun persistLegacyCookie(value: String?) {
+    private suspend fun persistCookie(value: String?) {
         if (dao.get() == null) {
             dao.upsert(currentEntity().copy(sessionCookie = value))
         } else {
@@ -261,19 +177,9 @@ class AuthStore @Inject constructor(
         }
     }
 
-    private suspend fun persistNormalization(json: String) {
-        if (dao.get() == null) {
-            dao.upsert(currentEntity().copy(normalizationJson = json))
-        } else {
-            dao.setNormalizationJson(json)
-        }
-    }
-
     private fun currentEntity(): AuthSessionEntity = AuthSessionEntity(
         id = ROW_ID,
-        // Never copied into the row: the cookie lives in the vault, and
-        // persistLegacyCookie sets it explicitly on the fallback path.
-        sessionCookie = null,
+        sessionCookie = sessionCookieState.value,
         baseUrl = baseUrlState.value,
         userJson = userJsonState.value,
         themeMode = themeModeState.value,
@@ -283,18 +189,10 @@ class AuthStore @Inject constructor(
             cacheSettingsState.value,
         ),
         diagnosticsOptOut = diagnosticsOptOutState.value,
-        normalizationJson = json.encodeToString(
-            NormalizationPrefs.serializer(),
-            normalizationState.value,
-        ),
     )
 
     companion object {
         const val DEFAULT_BASE_URL: String = "http://localhost:8080"
-
-        // Generous on purpose: hydration is one local row read and one
-        // Keystore decrypt, normally milliseconds. This only bounds "never".
-        const val HYDRATION_DEADLINE_MS: Long = 10_000
         private const val ROW_ID = 0
     }
 }

android/app/src/main/java/com/fabledsword/minstrel/auth/SessionVault.kt

@@ -1,147 +0,0 @@
-package com.fabledsword.minstrel.auth
-
-import android.content.Context
-import android.security.keystore.KeyGenParameterSpec
-import android.security.keystore.KeyProperties
-import dagger.Binds
-import dagger.Module
-import dagger.hilt.InstallIn
-import dagger.hilt.android.qualifiers.ApplicationContext
-import dagger.hilt.components.SingletonComponent
-import timber.log.Timber
-import java.security.KeyStore
-import java.util.Base64
-import javax.crypto.Cipher
-import javax.crypto.KeyGenerator
-import javax.crypto.SecretKey
-import javax.crypto.spec.GCMParameterSpec
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/**
- * Where the session cookie lives at rest (M462 #4985).
- *
- * The cookie is a bearer credential: anyone holding it is signed in as the
- * user until the server expires or revokes it. It used to sit in plain text
- * in the Room `auth_session` row, readable from any copy of the app's data
- * directory (a rooted device, an adb backup of a debuggable build, a
- * forensic image). Now only ciphertext is stored, under an AES key that
- * lives in the Android Keystore and never leaves it, so a copy of the
- * files alone yields nothing usable.
- */
-interface SessionVault {
-    /** The stored cookie, or null when none is stored or it can't be decrypted. */
-    fun read(): String?
-
-    /**
-     * Stores [value], or clears the stored cookie when null. Returns false
-     * when the Keystore could not be used, so the caller can fall back
-     * rather than lose the session.
-     */
-    fun write(value: String?): Boolean
-}
-
-/**
- * AES-GCM sealing of a short string, framed as base64(iv || ciphertext+tag).
- * Kept apart from the Keystore so the framing can be unit-tested on the JVM
- * with an ordinary key; the Android Keystore has no JVM implementation.
- */
-internal object SealedBox {
-    private const val TRANSFORMATION = "AES/GCM/NoPadding"
-    private const val TAG_BITS = 128
-    private const val IV_BYTES = 12
-
-    // Binds a sealed value to its purpose: a blob sealed for something else
-    // under the same key will not open as a session cookie.
-    private val AAD = "minstrel-session-cookie-v1".toByteArray(Charsets.UTF_8)
-
-    fun seal(key: SecretKey, plaintext: String): String {
-        val cipher = Cipher.getInstance(TRANSFORMATION)
-        // No IV passed: the provider generates a fresh random one. Keystore
-        // keys refuse a caller-chosen IV for encryption by default.
-        cipher.init(Cipher.ENCRYPT_MODE, key)
-        cipher.updateAAD(AAD)
-        val sealed = cipher.iv + cipher.doFinal(plaintext.toByteArray(Charsets.UTF_8))
-        return Base64.getEncoder().encodeToString(sealed)
-    }
-
-    fun open(key: SecretKey, sealed: String): String {
-        val bytes = Base64.getDecoder().decode(sealed)
-        require(bytes.size > IV_BYTES) { "sealed value too short" }
-        val cipher = Cipher.getInstance(TRANSFORMATION)
-        cipher.init(Cipher.DECRYPT_MODE, key, GCMParameterSpec(TAG_BITS, bytes, 0, IV_BYTES))
-        cipher.updateAAD(AAD)
-        return String(cipher.doFinal(bytes, IV_BYTES, bytes.size - IV_BYTES), Charsets.UTF_8)
-    }
-}
-
-/**
- * [SessionVault] backed by a Keystore AES key and a private prefs file that
- * holds only the sealed value.
- *
- * A value that will not open (the key was wiped by a factory-reset of the
- * Keystore, or the file was restored onto another device; app backup is off,
- * but a vendor transfer tool may still copy files) is discarded and reported
- * as absent. The user signs in again, which is the right outcome for a
- * credential that no longer verifies.
- */
-@Singleton
-class KeystoreSessionVault @Inject constructor(
-    @ApplicationContext context: Context,
-) : SessionVault {
-    private val prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
-
-    override fun read(): String? {
-        val sealed = prefs.getString(KEY_COOKIE, null) ?: return null
-        return runCatching { SealedBox.open(key(), sealed) }
-            .onFailure {
-                Timber.w(it, "session vault: stored cookie would not decrypt; discarding it")
-                prefs.edit().remove(KEY_COOKIE).commit()
-            }
-            .getOrNull()
-    }
-
-    override fun write(value: String?): Boolean = runCatching {
-        val editor = prefs.edit()
-        if (value == null) {
-            editor.remove(KEY_COOKIE)
-        } else {
-            editor.putString(KEY_COOKIE, SealedBox.seal(key(), value))
-        }
-        editor.commit()
-    }.onFailure {
-        Timber.w(it, "session vault: Keystore unavailable; cookie not stored in the vault")
-    }.getOrDefault(false)
-
-    private fun key(): SecretKey {
-        val keyStore = KeyStore.getInstance(ANDROID_KEYSTORE).apply { load(null) }
-        (keyStore.getKey(KEY_ALIAS, null) as? SecretKey)?.let { return it }
-        val generator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, ANDROID_KEYSTORE)
-        generator.init(
-            KeyGenParameterSpec.Builder(
-                KEY_ALIAS,
-                KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT,
-            )
-                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
-                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
-                .setKeySize(KEY_BITS)
-                .build(),
-        )
-        return generator.generateKey()
-    }
-
-    private companion object {
-        const val ANDROID_KEYSTORE = "AndroidKeyStore"
-        const val KEY_ALIAS = "minstrel_session_cookie"
-        const val KEY_BITS = 256
-        const val PREFS_NAME = "session_vault"
-        const val KEY_COOKIE = "sealed_cookie"
-    }
-}
-
-@Module
-@InstallIn(SingletonComponent::class)
-abstract class SessionVaultModule {
-    @Binds
-    abstract fun bindSessionVault(impl: KeystoreSessionVault): SessionVault
-}

android/app/src/main/java/com/fabledsword/minstrel/auth/ui/AuthGateViewModel.kt

@@ -16,11 +16,10 @@ import javax.inject.Inject
 
 /**
  * Computes the initial startDestination for the root NavHost based on
- * persisted auth state. Reads the row from AuthSessionDao directly, and
- * the session cookie only after [AuthStore.awaitSessionHydrated]: both
- * StateFlows default to null until their async load lands, and we need a
- * definitive answer before drawing any nav graph. The cookie is no longer
- * in the row (it lives in the Keystore-backed SessionVault, #4985).
+ * persisted auth state. Sits on top of AuthSessionDao directly rather
+ * than AuthStore's StateFlow because the StateFlow defaults to null
+ * until Room's first async emission — we need a definitive answer
+ * before drawing any nav graph.
  *
  *   - no row at all          → ServerUrl   (first launch)
  *   - row with baseUrl, no cookie → Login   (URL configured, not yet signed in)
@@ -32,7 +31,6 @@ import javax.inject.Inject
 @HiltViewModel
 class AuthGateViewModel @Inject constructor(
     private val dao: AuthSessionDao,
-    private val authStore: AuthStore,
 ) : ViewModel() {
 
     private val internal = MutableStateFlow<Any?>(null)
@@ -40,13 +38,12 @@ class AuthGateViewModel @Inject constructor(
 
     init {
         viewModelScope.launch {
-            authStore.awaitSessionHydrated()
-            val signedIn = !authStore.sessionCookie.value.isNullOrEmpty()
             val row = dao.get()
             internal.value = when {
                 row == null -> ServerUrl
-                row.baseUrl == AuthStore.DEFAULT_BASE_URL && !signedIn -> ServerUrl
-                !signedIn -> Login
+                row.baseUrl == AuthStore.DEFAULT_BASE_URL && row.sessionCookie.isNullOrEmpty() ->
+                    ServerUrl
+                row.sessionCookie.isNullOrEmpty() -> Login
                 else -> Home
             }
         }

android/app/src/main/java/com/fabledsword/minstrel/cache/db/AppDatabase.kt

@@ -3,8 +3,6 @@ package com.fabledsword.minstrel.cache.db
 import androidx.room.Database
 import androidx.room.RoomDatabase
 import androidx.room.TypeConverters
-import androidx.room.migration.Migration
-import androidx.sqlite.db.SupportSQLiteDatabase
 import com.fabledsword.minstrel.cache.db.dao.AudioCacheIndexDao
 import com.fabledsword.minstrel.cache.db.dao.AuthSessionDao
 import com.fabledsword.minstrel.cache.db.dao.CachedAlbumDao
@@ -67,22 +65,13 @@ import com.fabledsword.minstrel.cache.db.entities.SyncMetadataEntity
         AuthSessionEntity::class,
         DiagnosticEventEntity::class,
     ],
-    // v10: + cached_tracks.trackGain/trackPeak and cached_albums.albumGain/
-    // albumPeak, the ReplayGain values the player levels by (M464 #5000).
-    // MIGRATION_9_10 also rewinds the sync cursor, so the next sync re-sends
-    // every row and an existing cache gains its values.
-    // v9: + auth_session.normalizationJson, the loudness-normalization
-    // preference (M464 #4998). The first schema step with an explicit
-    // Migration (MIGRATION_8_9): a destructive rebuild would also wipe this
-    // row — the server address and theme — and the queued offline writes,
-    // which is too much to lose for one added column.
     // v8: + cached_tracks.missing, the server's missing-file mark (#2704),
     // so cache-first surfaces stop offering files that cannot stream.
     // v7: + diagnostic_events table (M9) and the diagnosticsOptOut column
     // on auth_session. Pre-v1 destructive fallback rebuilds on mismatch —
     // which is exactly right here: the next sync refills every row with the
     // new column populated, so there is nothing to migrate by hand.
-    version = 10,
+    version = 8,
     exportSchema = true,
 )
 @TypeConverters(MinstrelTypeConverters::class)
@@ -103,25 +92,3 @@ abstract class AppDatabase : RoomDatabase() {
     abstract fun authSessionDao(): AuthSessionDao
     abstract fun diagnosticEventDao(): DiagnosticEventDao
 }
-
-/** v8 → v9: add the nullable normalization preference column (#4998). */
-val MIGRATION_8_9: Migration = object : Migration(8, 9) {
-    override fun migrate(db: SupportSQLiteDatabase) {
-        db.execSQL("ALTER TABLE auth_session ADD COLUMN normalizationJson TEXT")
-    }
-}
-
-/**
- * v9 → v10: the gain columns (#5000). Rows synced before this carry no gains,
- * and the sync is incremental, so it would never re-send them: the cursor goes
- * back to 0 and the next sync is a full one, upserting every row in place.
- */
-val MIGRATION_9_10: Migration = object : Migration(9, 10) {
-    override fun migrate(db: SupportSQLiteDatabase) {
-        db.execSQL("ALTER TABLE cached_tracks ADD COLUMN trackGain REAL")
-        db.execSQL("ALTER TABLE cached_tracks ADD COLUMN trackPeak REAL")
-        db.execSQL("ALTER TABLE cached_albums ADD COLUMN albumGain REAL")
-        db.execSQL("ALTER TABLE cached_albums ADD COLUMN albumPeak REAL")
-        db.execSQL("UPDATE sync_metadata SET cursor = 0")
-    }
-}

android/app/src/main/java/com/fabledsword/minstrel/cache/db/DatabaseModule.kt

@@ -37,7 +37,6 @@ object DatabaseModule {
             // launch, so users lose only the unsynced mutation queue
             // (acceptable while we're iterating). Replace with explicit
             // Migration entries before the first tagged release.
-            .addMigrations(MIGRATION_8_9, MIGRATION_9_10)
             .fallbackToDestructiveMigration(dropAllTables = true)
             .build()
 

android/app/src/main/java/com/fabledsword/minstrel/cache/db/dao/AuthSessionDao.kt

@@ -46,8 +46,4 @@ interface AuthSessionDao {
     /** Partial update: change only the per-device diagnostics opt-out. */
     @Query("UPDATE auth_session SET diagnosticsOptOut = :optOut WHERE id = 0")
     suspend fun setDiagnosticsOptOut(optOut: Boolean)
-
-    /** Partial update: change only the serialized normalization preference. */
-    @Query("UPDATE auth_session SET normalizationJson = :json WHERE id = 0")
-    suspend fun setNormalizationJson(json: String?)
 }

android/app/src/main/java/com/fabledsword/minstrel/cache/db/dao/CachedMutationDao.kt

@@ -31,8 +31,4 @@ interface CachedMutationDao {
 
     @Query("DELETE FROM cached_mutations")
     suspend fun clear()
-
-    /** Whether a write of [kind] is still waiting to be replayed. */
-    @Query("SELECT EXISTS(SELECT 1 FROM cached_mutations WHERE kind = :kind)")
-    suspend fun hasPending(kind: String): Boolean
 }

android/app/src/main/java/com/fabledsword/minstrel/cache/db/dao/CachedTrackDao.kt

@@ -38,27 +38,6 @@ interface CachedTrackDao {
     @Insert(onConflict = OnConflictStrategy.REPLACE)
     suspend fun upsertAll(rows: List<CachedTrackEntity>)
 
-    /**
-     * ReplayGain values for [ids] (M464 #5000): the track's own from its row,
-     * the album's from its album row. A track not in the cache has no row.
-     */
-    @Query(
-        "SELECT t.id AS id, t.trackGain AS trackGain, t.trackPeak AS trackPeak, " +
-            "a.albumGain AS albumGain, a.albumPeak AS albumPeak " +
-            "FROM cached_tracks t LEFT JOIN cached_albums a ON a.id = t.albumId " +
-            "WHERE t.id IN (:ids)",
-    )
-    suspend fun replayGains(ids: List<String>): List<CachedReplayGain>
-
     @Query("DELETE FROM cached_tracks WHERE id IN (:ids)")
     suspend fun deleteByIds(ids: List<String>)
 }
-
-/** One row of [CachedTrackDao.replayGains]. */
-data class CachedReplayGain(
-    val id: String,
-    val trackGain: Float?,
-    val trackPeak: Float?,
-    val albumGain: Float?,
-    val albumPeak: Float?,
-)

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/AuthSessionEntity.kt

@@ -43,10 +43,4 @@ data class AuthSessionEntity(
      * choice lives here. Default false = honor the account flag.
      */
     val diagnosticsOptOut: Boolean = false,
-    /**
-     * JSON-encoded NormalizationPrefs (settings/data), the last value seen
-     * from the server or set here (M464 #4998). Null = never fetched; the
-     * defaults apply. Kept so offline playback still levels.
-     */
-    val normalizationJson: String? = null,
 )

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/CachedAlbumEntity.kt

@@ -18,8 +18,5 @@ data class CachedAlbumEntity(
     val releaseDate: String? = null,
     val coverPath: String? = null,
     val mbid: String? = null,
-    // ReplayGain 2.0 album values (M464); null until every track is measured.
-    val albumGain: Float? = null,
-    val albumPeak: Float? = null,
     val fetchedAt: Instant = Clock.System.now(),
 )

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/CachedTrackEntity.kt

@@ -26,9 +26,5 @@ data class CachedTrackEntity(
     val fileFormat: String? = null,
     val genre: String? = null,
     val missing: Boolean = false,
-    // ReplayGain 2.0 track values (M464), kept so cached audio levels
-    // offline. Null until the server has measured the track.
-    val trackGain: Float? = null,
-    val trackPeak: Float? = null,
     val fetchedAt: Instant = Clock.System.now(),
 )

android/app/src/main/java/com/fabledsword/minstrel/cache/mutations/MutationQueue.kt

@@ -2,7 +2,6 @@ package com.fabledsword.minstrel.cache.mutations
 
 import com.fabledsword.minstrel.cache.db.dao.CachedMutationDao
 import com.fabledsword.minstrel.cache.db.entities.CachedMutationEntity
-import com.fabledsword.minstrel.settings.data.NormalizationPrefs
 import kotlinx.coroutines.channels.BufferOverflow
 import kotlinx.coroutines.flow.MutableSharedFlow
 import kotlinx.coroutines.flow.SharedFlow
@@ -42,11 +41,6 @@ object MutationKind {
     // an undo collapses to the latest intent instead of replaying as two
     // opposed calls whose order decides the outcome.
     const val SUGGESTION_SNOOZE_TOGGLE: String = "suggestion_snooze_toggle"
-
-    // M464 #4998 loudness-normalization preference. The payload is the whole
-    // preference, a target state like the toggles above, so queued changes
-    // collapse to the last one and an older one can never be replayed last.
-    const val NORMALIZATION_SET: String = "normalization_set"
 }
 
 /**
@@ -91,7 +85,6 @@ data class RequestCreatePayload(
  * This matches `feedback_offline_first_for_server_writes` — writes
  * never go fire-and-forget.
  */
-@Suppress("TooManyFunctions") // one enqueue per mutation kind, like the replayer's dispatchers
 @Singleton
 class MutationQueue @Inject constructor(
     private val dao: CachedMutationDao,
@@ -184,12 +177,6 @@ class MutationQueue @Inject constructor(
         ),
     )
 
-    /** Queues the user's whole normalization preference for replay. */
-    suspend fun enqueueNormalizationSet(prefs: NormalizationPrefs): Long = insertUserDriven(
-        MutationKind.NORMALIZATION_SET,
-        json.encodeToString(NormalizationPrefs.serializer(), prefs),
-    )
-
     suspend fun enqueueRequestCancel(requestId: String): Long = insertUserDriven(
         MutationKind.REQUEST_CANCEL,
         json.encodeToString(

android/app/src/main/java/com/fabledsword/minstrel/cache/mutations/MutationReplayer.kt

@@ -7,7 +7,6 @@ import com.fabledsword.minstrel.api.endpoints.DiscoverApi
 import com.fabledsword.minstrel.api.endpoints.EventsApi
 import com.fabledsword.minstrel.api.endpoints.FlagRequest
 import com.fabledsword.minstrel.api.endpoints.LikesApi
-import com.fabledsword.minstrel.api.endpoints.MeApi
 import com.fabledsword.minstrel.api.endpoints.PlaybackErrorReportRequest
 import com.fabledsword.minstrel.api.endpoints.PlaybackErrorsApi
 import com.fabledsword.minstrel.api.endpoints.PlaylistsApi
@@ -23,7 +22,6 @@ import com.fabledsword.minstrel.cache.db.dao.CachedMutationDao
 import com.fabledsword.minstrel.cache.db.entities.CachedMutationEntity
 import com.fabledsword.minstrel.di.ApplicationScope
 import com.fabledsword.minstrel.likes.data.LikesRepository
-import com.fabledsword.minstrel.settings.data.NormalizationPrefs
 import com.fabledsword.minstrel.models.wire.CreateRequestBody
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.flow.distinctUntilChanged
@@ -81,7 +79,6 @@ class MutationReplayer @Inject constructor(
     private val eventsApi: EventsApi = retrofit.create()
     private val requestsApi: RequestsApi = retrofit.create()
     private val playbackErrorsApi: PlaybackErrorsApi = retrofit.create()
-    private val meApi: MeApi = retrofit.create()
 
     private val mutex = Mutex()
 
@@ -169,7 +166,6 @@ class MutationReplayer @Inject constructor(
         MutationKind.REQUEST_CANCEL -> dispatchRequestCancel(row.payload)
         MutationKind.PLAYBACK_ERROR_REPORT -> dispatchPlaybackErrorReport(row.payload)
         MutationKind.SUGGESTION_SNOOZE_TOGGLE -> dispatchSuggestionSnoozeToggle(row.payload)
-        MutationKind.NORMALIZATION_SET -> dispatchNormalizationSet(row.payload)
         // Unknown kind — drop so a stale schema entry can't wedge the queue.
         else -> Outcome.DROP
     }
@@ -283,16 +279,6 @@ class MutationReplayer @Inject constructor(
         return Outcome.SENT
     }
 
-    /**
-     * Sends the queued normalization preference. The device already shows
-     * it, so the server's echo is not written back: a change made since the
-     * row was queued would be a newer row, and the collapse keeps only that.
-     */
-    private suspend fun dispatchNormalizationSet(payload: String): Outcome {
-        meApi.putNormalization(json.decodeFromString(NormalizationPrefs.serializer(), payload))
-        return Outcome.SENT
-    }
-
     private suspend fun dispatchPlaybackErrorReport(payload: String): Outcome {
         val decoded = json.decodeFromString(PlaybackErrorReportPayload.serializer(), payload)
         playbackErrorsApi.report(
@@ -317,8 +303,7 @@ class MutationReplayer @Inject constructor(
 /**
  * Row ids of desired-state toggles superseded by a later toggle for the same
  * entity. Applies to every kind whose payload encodes a TARGET state rather
- * than an action — like-toggles, suggestion snoozes (#2374) and the
- * normalization preference (#4998) — because
+ * than an action — like-toggles and suggestion snoozes (#2374) — because
  * replaying a stale one last would invert the final state.
  *
  * Top-level and pure so it can be unit-tested without standing up a Retrofit
@@ -355,10 +340,5 @@ private fun toggleKeyOf(row: CachedMutationEntity, json: Json): String? = when (
         json.decodeFromString(SuggestionSnoozeTogglePayload.serializer(), row.payload)
     }.getOrNull()?.let { "${row.kind}:${it.mbid}" }
 
-    // One preference per user, so every normalization row shares one key.
-    MutationKind.NORMALIZATION_SET -> runCatching {
-        json.decodeFromString(NormalizationPrefs.serializer(), row.payload)
-    }.getOrNull()?.let { row.kind }
-
     else -> null
 }

android/app/src/main/java/com/fabledsword/minstrel/cache/sync/SyncController.kt

@@ -206,8 +206,6 @@ private fun SyncAlbumWire.toEntity(): CachedAlbumEntity = CachedAlbumEntity(
     releaseDate = releaseDate,
     coverPath = coverArtPath,
     mbid = mbid,
-    albumGain = albumGain,
-    albumPeak = albumPeak,
 )
 
 private fun SyncTrackWire.toEntity(): CachedTrackEntity = CachedTrackEntity(
@@ -222,6 +220,4 @@ private fun SyncTrackWire.toEntity(): CachedTrackEntity = CachedTrackEntity(
     fileFormat = fileFormat,
     genre = genre,
     missing = missing,
-    trackGain = trackGain,
-    trackPeak = trackPeak,
 )

android/app/src/main/java/com/fabledsword/minstrel/models/UpdateInfo.kt

@@ -1,26 +1,15 @@
 package com.fabledsword.minstrel.models
 
 /**
- * The server-bundled APK, as reported by `GET /api/client/version`.
+ * Wire shape returned by `GET /api/client/version`. Mirrors
+ * the Flutter client's `UpdateInfo`.
  *
- * Three values that are deliberately kept apart:
- *
- *  - [version] is a LABEL for people — "YYYY.MM.DD.HHMM", derived from the
- *    build's commit, so two channels carrying the same code read the same.
- *    Display this; never decide on it when [code] is present.
- *  - [code] is the ORDERING KEY, and is the same value Android itself
- *    installs by. It answers "may this be installed over that?", which the
- *    name cannot. Null when the server predates the field.
- *  - [channel] is a SIBLING FIELD, never a suffix inside the name. Reported
- *    verbatim rather than validated, so an unexpected value is shown rather
- *    than dropped.
- *
- * [apkUrl] is server-relative (e.g. `/api/client/apk`).
+ * `version` is the server-bundled APK version (may have a leading
+ * "v" from the git tag); `apkUrl` is server-relative (e.g.
+ * `/api/client/apk`); `sizeBytes` is the download size.
  */
 data class UpdateInfo(
     val version: String,
-    val code: Long?,
-    val channel: String?,
     val apkUrl: String,
     val sizeBytes: Long,
 )

android/app/src/main/java/com/fabledsword/minstrel/models/wire/ReplayGainWire.kt

@@ -1,18 +0,0 @@
-package com.fabledsword.minstrel.models.wire
-
-import kotlinx.serialization.SerialName
-import kotlinx.serialization.Serializable
-
-/** One track's entry in `GET /api/tracks/replay-gain` (#4997). Decode-only. */
-@Serializable
-data class ReplayGainWire(
-    @SerialName("track_gain") val trackGain: Float? = null,
-    @SerialName("track_peak") val trackPeak: Float? = null,
-    @SerialName("album_gain") val albumGain: Float? = null,
-    @SerialName("album_peak") val albumPeak: Float? = null,
-)
-
-@Serializable
-data class ReplayGainResponseWire(
-    val items: Map<String, ReplayGainWire> = emptyMap(),
-)

android/app/src/main/java/com/fabledsword/minstrel/models/wire/SyncResponseWire.kt

@@ -28,10 +28,6 @@ data class SyncAlbumWire(
     @SerialName("release_date") val releaseDate: String? = null,
     @SerialName("cover_art_path") val coverArtPath: String? = null,
     val mbid: String? = null,
-    // The album's ReplayGain 2.0 values (#4997): dB to -18 LUFS and a linear
-    // peak. Null until every track on the album is measured.
-    @SerialName("album_gain") val albumGain: Float? = null,
-    @SerialName("album_peak") val albumPeak: Float? = null,
 )
 
 @Serializable
@@ -55,9 +51,6 @@ data class SyncTrackWire(
     // its tracks stay playable, which is the correct reading of "this server
     // has nothing to say about missing files".
     val missing: Boolean = false,
-    // The track's ReplayGain 2.0 values (#4997); null until it is measured.
-    @SerialName("track_gain") val trackGain: Float? = null,
-    @SerialName("track_peak") val trackPeak: Float? = null,
 )
 
 /**

android/app/src/main/java/com/fabledsword/minstrel/models/wire/UpdateInfoWire.kt

@@ -4,26 +4,12 @@ import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
 
 /**
- * Wire shape for `GET /api/client/version`.
- *
- * `apkUrl` falls back to `/api/client/apk` if the server omits it.
- *
- * [code] MUST stay nullable, and this is not a style preference. The app's
- * Json is configured with `coerceInputValues = true`, which replaces a JSON
- * null with the declared default for a NON-nullable property — so writing
- * `val code: Long = 0` would turn "this server reports no ordering key" into
- * "this build's ordering key is 0", silently, with no error anywhere. A
- * nullable type is what keeps absent distinguishable from zero, and the
- * distinction is the whole reason the field exists.
- *
- * A server predating the ordering key sends neither [code] nor [channel];
- * both arrive null and the caller falls back to comparing names.
+ * Wire shape for `GET /api/client/version`. Defaults match Flutter:
+ * apk_url falls back to `/api/client/apk` if the server omits it.
  */
 @Serializable
 data class UpdateInfoWire(
     val version: String = "",
-    val code: Long? = null,
-    val channel: String? = null,
     @SerialName("apk_url") val apkUrl: String = "/api/client/apk",
     @SerialName("size_bytes") val sizeBytes: Long = 0,
 )

android/app/src/main/java/com/fabledsword/minstrel/player/MinstrelForwardingPlayer.kt

@@ -93,8 +93,6 @@ class MinstrelForwardingPlayer(
          * one. Diagnostics-only; see [TransportObservation].
          */
         val onTransport: (TransportObservation) -> Unit = {},
-        /** The renderer's 1-based queue position, every poll. */
-        val onRendererTrack: (trackNumber: Int) -> Unit = {},
     )
 
     private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
@@ -624,7 +622,6 @@ class MinstrelForwardingPlayer(
             trackNumber = info.track,
         )
         syncLocalCursorToRemote(sonosTrack = info.track, trackUri = info.trackUri)
-        events.onRendererTrack(info.track)
         val transport = active.avTransport.getTransportInfo()
         when (transport.state) {
             TransportState.PLAYING -> {

android/app/src/main/java/com/fabledsword/minstrel/player/MinstrelPlayerService.kt

@@ -12,10 +12,8 @@ import androidx.media3.session.SessionCommand
 import com.fabledsword.minstrel.MainActivity
 import com.fabledsword.minstrel.likes.data.LikesRepository
 import com.fabledsword.minstrel.likes.data.LikesRepository.Companion.ENTITY_TRACK
-import com.fabledsword.minstrel.settings.data.NormalizationRepository
 import com.google.common.collect.ImmutableList
 import dagger.hilt.android.AndroidEntryPoint
-import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.ExperimentalCoroutinesApi
@@ -27,7 +25,6 @@ import kotlinx.coroutines.flow.flatMapLatest
 import kotlinx.coroutines.flow.flowOf
 import kotlinx.coroutines.flow.onStart
 import kotlinx.coroutines.launch
-import timber.log.Timber
 import javax.inject.Inject
 
 /**
@@ -69,8 +66,6 @@ class MinstrelPlayerService : MediaSessionService() {
 
     @Inject lateinit var likesRepository: LikesRepository
 
-    @Inject lateinit var normalizationRepository: NormalizationRepository
-
     private val serviceScope = CoroutineScope(SupervisorJob() + Dispatchers.Main.immediate)
 
     private var mediaSession: MediaSession? = null
@@ -87,21 +82,6 @@ class MinstrelPlayerService : MediaSessionService() {
             .build()
         mediaSession = session
         serviceScope.launch { observeLikeState(session, player) }
-        serviceScope.launch { refreshNormalization() }
-    }
-
-    // Takes up a leveling preference changed on another device (M464 #5000).
-    // Offline, the device's copy stands, which is the one playback reads.
-    private suspend fun refreshNormalization() {
-        try {
-            normalizationRepository.refresh()
-        } catch (e: CancellationException) {
-            throw e
-        } catch (
-            @Suppress("TooGenericExceptionCaught") e: Throwable,
-        ) {
-            Timber.d(e, "normalization refresh skipped")
-        }
     }
 
     /**

android/app/src/main/java/com/fabledsword/minstrel/player/PlayerController.kt

@@ -14,8 +14,6 @@ import androidx.media3.session.MediaController
 import androidx.media3.session.SessionToken
 import com.fabledsword.minstrel.di.ApplicationScope
 import com.fabledsword.minstrel.models.TrackRef
-import com.fabledsword.minstrel.player.gain.GainAudioProcessor
-import com.fabledsword.minstrel.player.gain.ReplayGainStore
 import com.fabledsword.minstrel.playlists.data.PlaylistsRepository
 import com.fabledsword.minstrel.playlists.data.toPlayableTrackRefs
 import com.fabledsword.minstrel.shared.resolveServerUrl
@@ -71,7 +69,6 @@ class PlayerController @Inject constructor(
     private val playerFactory: PlayerFactory,
     private val activeUpnpHolder: com.fabledsword.minstrel.player.output.ActiveUpnpHolder,
     private val remoteState: RemotePlayerState,
-    private val replayGains: ReplayGainStore,
 ) {
 
     /**
@@ -280,11 +277,6 @@ class PlayerController @Inject constructor(
         queueRefs = playable.tracks
         val items = playable.tracks.map { it.toMediaItem(source) }
         val startIndex = playable.initialIndex
-        // Gains for the first tracks, so the first one levels from its first
-        // sample rather than ramping in once the lookup lands.
-        replayGains.request(
-            playable.tracks.drop(startIndex).take(GAIN_PREFETCH).map { it.id },
-        )
         // Drift #562 cold-boot resume calls this from a non-Main suspend
         // context after awaitReady() unblocks (ResumeController launches
         // on Dispatchers.Default by the time it reaches us). MediaController
@@ -800,13 +792,7 @@ class PlayerController @Inject constructor(
                 // scrubber a real total even when the wrapped ExoPlayer is
                 // paused under UPnP (it never probes a duration in that state).
                 if (durationSec > 0) setDurationMs(durationSec.toLong() * MS_PER_SECOND)
-                // Album and track position let the gain processor tell an
-                // album played in order from a mix (M464 #5000).
-                trackNumber?.let { setTrackNumber(it) }
-                discNumber?.let { setDiscNumber(it) }
-                val extras = GainAudioProcessor.albumExtras(albumId)
-                if (source != null) extras.putAll(sourceExtras(source))
-                setExtras(extras)
+                if (source != null) setExtras(sourceExtras(source))
                 // Point the notification / lock-screen art at the SAME album
                 // cover the in-app surfaces use (TrackRef.coverUrl ->
                 // /api/albums/{id}/cover). Without this, Media3 falls back to
@@ -874,7 +860,6 @@ class PlayerController @Inject constructor(
         const val MINSTREL_SOURCE_KEY: String = "minstrel_source"
         private const val MS_PER_SECOND = 1_000L
         private const val MAX_INTERPOLATION_DRIFT_MS = 5_000L
-        private const val GAIN_PREFETCH = 20
     }
 }
 

android/app/src/main/java/com/fabledsword/minstrel/player/PlayerFactory.kt

@@ -4,7 +4,6 @@ import android.content.Context
 import androidx.media3.common.AudioAttributes
 import androidx.media3.common.C
 import androidx.media3.common.Player
-import androidx.media3.common.audio.AudioProcessor
 import androidx.media3.common.util.BitmapLoader
 import androidx.media3.database.StandaloneDatabaseProvider
 import androidx.media3.datasource.DataSourceBitmapLoader
@@ -13,18 +12,11 @@ import androidx.media3.datasource.cache.CacheDataSource
 import androidx.media3.datasource.cache.LeastRecentlyUsedCacheEvictor
 import androidx.media3.datasource.cache.SimpleCache
 import androidx.media3.datasource.okhttp.OkHttpDataSource
-import androidx.media3.exoplayer.DefaultRenderersFactory
 import androidx.media3.exoplayer.ExoPlayer
-import androidx.media3.exoplayer.audio.AudioSink
-import androidx.media3.exoplayer.audio.DefaultAudioSink
 import androidx.media3.exoplayer.source.DefaultMediaSourceFactory
 import androidx.media3.session.CacheBitmapLoader
-import com.fabledsword.minstrel.auth.AuthStore
 import com.fabledsword.minstrel.cache.audiocache.CacheConfig
-import com.fabledsword.minstrel.player.gain.GainAudioProcessor
-import com.fabledsword.minstrel.player.gain.ReplayGainStore
 import com.fabledsword.minstrel.player.output.ActiveUpnpHolder
-import com.fabledsword.minstrel.player.output.SonosQueueLoader
 import dagger.hilt.android.qualifiers.ApplicationContext
 import kotlinx.coroutines.channels.BufferOverflow
 import kotlinx.coroutines.flow.MutableSharedFlow
@@ -64,9 +56,6 @@ class PlayerFactory @Inject constructor(
     private val activeUpnpHolder: ActiveUpnpHolder,
     private val remoteState: RemotePlayerState,
     private val serverHealth: com.fabledsword.minstrel.connectivity.NetworkStatusController,
-    private val authStore: AuthStore,
-    private val replayGains: ReplayGainStore,
-    private val sonosQueue: SonosQueueLoader,
 ) {
     private val cacheDir: File = File(context.cacheDir, "audio_cache").apply { mkdirs() }
 
@@ -131,7 +120,6 @@ class PlayerFactory @Inject constructor(
                 onStalled = { trackId -> stallEventsInternal.tryEmit(trackId) },
                 onQueueTruncated = { queueRepairInternal.tryEmit(Unit) },
                 onTransport = { transportInternal.tryEmit(it) },
-                onRendererTrack = { sonosQueue.onRendererTrack(it) },
             ),
         )
     }
@@ -154,28 +142,7 @@ class PlayerFactory @Inject constructor(
         val mediaSourceFactory = DefaultMediaSourceFactory(context)
             .setDataSourceFactory(cacheDataSource)
 
-        // Loudness normalization (M464 #5000) runs inside the audio sink so
-        // each track's gain starts on its first sample. Audio offload would
-        // bypass the sink's processors; ExoPlayer leaves it off unless asked
-        // (TrackSelectionParameters.audioOffloadPreferences), and nothing here
-        // asks, so leveling always applies.
-        val gainProcessor = GainAudioProcessor(
-            prefs = { authStore.normalization.value },
-            store = replayGains,
-        )
-        val renderersFactory = object : DefaultRenderersFactory(context) {
-            override fun buildAudioSink(
-                context: Context,
-                enableFloatOutput: Boolean,
-                enableAudioOutputPlaybackParams: Boolean,
-            ): AudioSink = DefaultAudioSink.Builder(context)
-                .setEnableFloatOutput(enableFloatOutput)
-                .setEnableAudioOutputPlaybackParameters(enableAudioOutputPlaybackParams)
-                .setAudioProcessors(arrayOf<AudioProcessor>(gainProcessor))
-                .build()
-        }
-
-        val exo = ExoPlayer.Builder(context, renderersFactory)
+        return ExoPlayer.Builder(context)
             .setMediaSourceFactory(mediaSourceFactory)
             .setAudioAttributes(
                 AudioAttributes.Builder()
@@ -186,17 +153,6 @@ class PlayerFactory @Inject constructor(
             )
             .setHandleAudioBecomingNoisy(true)
             .build()
-        // The processor finds a track's neighbours in play order, which
-        // depends on shuffle mode.
-        gainProcessor.shuffleEnabled = exo.shuffleModeEnabled
-        exo.addListener(
-            object : Player.Listener {
-                override fun onShuffleModeEnabledChanged(shuffleModeEnabled: Boolean) {
-                    gainProcessor.shuffleEnabled = shuffleModeEnabled
-                }
-            },
-        )
-        return exo
     }
 
     /**

android/app/src/main/java/com/fabledsword/minstrel/player/StreamTokenProvider.kt

@@ -19,13 +19,6 @@ import javax.inject.Singleton
 class StreamTokenProvider @Inject constructor(retrofit: Retrofit) {
     private val api: CastApi = retrofit.create()
 
-    /**
-     * Mints a URL for a speaker, leveled when the user's setting calls for
-     * it (M464 #5002). The server answers with the plain stream when it does
-     * not, so every speaker URL asks.
-     */
-    suspend fun mint(trackId: String, asAlbum: Boolean = false, prerender: Boolean = false): StreamTokenResponse =
-        api.streamToken(
-            StreamTokenRequest(trackId = trackId, level = true, asAlbum = asAlbum, prerender = prerender),
-        )
+    suspend fun mint(trackId: String): StreamTokenResponse =
+        api.streamToken(StreamTokenRequest(trackId = trackId))
 }

android/app/src/main/java/com/fabledsword/minstrel/player/gain/GainAudioProcessor.kt

@@ -1,139 +0,0 @@
-package com.fabledsword.minstrel.player.gain
-
-import android.os.Bundle
-import androidx.media3.common.C
-import androidx.media3.common.MediaItem
-import androidx.media3.common.Player
-import androidx.media3.common.Timeline
-import androidx.media3.common.audio.AudioProcessor
-import androidx.media3.common.audio.BaseAudioProcessor
-import com.fabledsword.minstrel.settings.data.NormalizationBoost
-import com.fabledsword.minstrel.settings.data.NormalizationMode
-import com.fabledsword.minstrel.settings.data.NormalizationPrefs
-import java.nio.ByteBuffer
-
-/**
- * Applies each track's loudness gain inside ExoPlayer's audio sink (M464
- * #5000), so the level changes on the exact sample a track starts, gapless
- * transitions included. `Player.setVolume` could do neither: it stops at 1,
- * and set from a transition callback it lands about two seconds late
- * because the next track is already buffered (androidx/media#418).
- *
- * Media3 1.11 flushes the sink's processors at every item boundary with the
- * playlist [Timeline] and the new item's period, which is how this knows
- * which track it is processing and who its neighbours are.
- *
- * Boosts above unity are held under -1 dBFS by a peak limiter when the user
- * chose one. In headroom mode the gain already stops short of the track's
- * true peak, and the final clamp only guards against a bad measurement.
- *
- * Runs on the playback thread. [prefs] and [store] are read per buffer, so a
- * changed preference or a gain that arrives mid-track applies at once,
- * through a short ramp rather than a step.
- */
-class GainAudioProcessor(
-    private val prefs: () -> NormalizationPrefs,
-    private val store: ReplayGainStore,
-) : BaseAudioProcessor() {
-
-    /** Mirrors the player's shuffle mode, so neighbours are found in play order. */
-    @Volatile var shuffleEnabled: Boolean = false
-
-    private var currentId: String? = null
-    private var asAlbum = false
-    private val stage = GainStage()
-
-    override fun onConfigure(inputAudioFormat: AudioProcessor.AudioFormat): AudioProcessor.AudioFormat =
-        when (inputAudioFormat.encoding) {
-            C.ENCODING_PCM_16BIT, C.ENCODING_PCM_FLOAT -> inputAudioFormat
-            else -> AudioProcessor.AudioFormat.NOT_SET
-        }
-
-    override fun onFlush(streamMetadata: AudioProcessor.StreamMetadata) {
-        identify(streamMetadata)
-        // A new stream starts at its own level: ramping in from the previous
-        // track's gain would swell or dip its first moments.
-        stage.reset(inputAudioFormat.sampleRate, inputAudioFormat.channelCount, targetGain())
-    }
-
-    override fun onReset() {
-        currentId = null
-        asAlbum = false
-    }
-
-    override fun queueInput(inputBuffer: ByteBuffer) {
-        val size = inputBuffer.remaining()
-        if (size == 0) return
-        val out = replaceOutputBuffer(size)
-        val p = prefs()
-        val target = targetGain(p)
-        val limiting = p.mode != NormalizationMode.OFF && p.boost == NormalizationBoost.LIMITER
-        if (stage.isUnity(target, limiting)) {
-            out.put(inputBuffer)
-        } else {
-            stage.process(
-                input = inputBuffer,
-                out = out,
-                channels = inputAudioFormat.channelCount,
-                isFloat = inputAudioFormat.encoding == C.ENCODING_PCM_FLOAT,
-                target = target,
-                limiting = limiting,
-            )
-        }
-        out.flip()
-    }
-
-    private fun targetGain(p: NormalizationPrefs = prefs()): Float {
-        val id = currentId ?: return 1f
-        return GainMath.dbToLinear(GainMath.gainDb(p, store.get(id), asAlbum))
-    }
-
-    // Which track this stream is, and whether it is playing as part of its
-    // album. Also asks the store for the gains of the tracks coming up, so
-    // each is known before it starts.
-    private fun identify(meta: AudioProcessor.StreamMetadata) {
-        currentId = null
-        asAlbum = false
-        val uid = meta.periodUid
-        if (uid == null || meta.timeline.isEmpty) return
-        val timeline = meta.timeline
-        val index = timeline.getPeriodByUid(uid, Timeline.Period()).windowIndex
-        val window = Timeline.Window()
-        fun itemAt(i: Int): MediaItem? =
-            if (i == C.INDEX_UNSET) null else timeline.getWindow(i, window).mediaItem
-        fun nextOf(i: Int) = timeline.getNextWindowIndex(i, Player.REPEAT_MODE_OFF, shuffleEnabled)
-
-        val cur = itemAt(index)
-        val prev = itemAt(timeline.getPreviousWindowIndex(index, Player.REPEAT_MODE_OFF, shuffleEnabled))
-        val next = itemAt(nextOf(index))
-        if (cur != null) {
-            currentId = cur.mediaId
-            asAlbum = GainMath.playingAsAlbum(prev?.albumPosition(), cur.albumPosition(), next?.albumPosition())
-        }
-
-        val upcoming = mutableListOf<String>()
-        var i = index
-        while (i != C.INDEX_UNSET && upcoming.size < LOOKAHEAD) {
-            itemAt(i)?.let { upcoming += it.mediaId }
-            i = nextOf(i)
-        }
-        store.request(upcoming)
-    }
-
-    companion object {
-        /** MediaMetadata extras key holding the track's album id. */
-        const val EXTRA_ALBUM_ID = "minstrel.album_id"
-
-        private const val LOOKAHEAD = 20
-
-        /** Puts what [albumPosition] reads into a MediaItem's metadata extras. */
-        fun albumExtras(albumId: String, into: Bundle = Bundle()): Bundle =
-            into.apply { putString(EXTRA_ALBUM_ID, albumId) }
-    }
-}
-
-private fun MediaItem.albumPosition(): AlbumPosition = AlbumPosition(
-    albumId = mediaMetadata.extras?.getString(GainAudioProcessor.EXTRA_ALBUM_ID),
-    discNumber = mediaMetadata.discNumber,
-    trackNumber = mediaMetadata.trackNumber,
-)

android/app/src/main/java/com/fabledsword/minstrel/player/gain/GainMath.kt

@@ -1,96 +0,0 @@
-package com.fabledsword.minstrel.player.gain
-
-import com.fabledsword.minstrel.settings.data.NormalizationBoost
-import com.fabledsword.minstrel.settings.data.NormalizationMode
-import com.fabledsword.minstrel.settings.data.NormalizationPrefs
-import kotlin.math.log10
-import kotlin.math.min
-import kotlin.math.pow
-
-/**
- * One track's ReplayGain 2.0 values from the server (#4997): dB to the
- * -18 LUFS reference, and linear true peaks. A null field has not been
- * measured yet.
- */
-data class ReplayGain(
-    val trackGain: Float?,
-    val trackPeak: Float?,
-    val albumGain: Float?,
-    val albumPeak: Float?,
-) {
-    companion object {
-        val NONE = ReplayGain(null, null, null, null)
-    }
-}
-
-/** Where a queue item sits in its album, for the auto-mode album rule. */
-data class AlbumPosition(val albumId: String?, val discNumber: Int?, val trackNumber: Int?)
-
-/**
- * Loudness-normalization math (M464 #5000). The same rules as the web
- * player's `web/src/lib/player/gain.ts`, so a track levels the same on
- * every device.
- */
-object GainMath {
-    private const val REFERENCE_LUFS = -18
-
-    /** Headroom mode raises a quiet track only until its true peak reaches this. */
-    const val PEAK_CEILING_DBTP = -1f
-
-    /**
-     * No track is raised more than this, whatever its measurement says: a
-     * near-silent track would otherwise come out as amplified noise.
-     */
-    const val MAX_BOOST_DB = 12f
-
-    private const val DISC_STRIDE = 1000
-
-    // Amplitude decibels: 20 dB per factor of ten.
-    private const val DB_PER_DECADE = 20f
-
-    /**
-     * The gain to apply, in dB. 0 when leveling is off or the track has not
-     * been measured: an unmeasured track plays as mastered.
-     */
-    fun gainDb(prefs: NormalizationPrefs, g: ReplayGain?, asAlbum: Boolean): Float {
-        if (prefs.mode == NormalizationMode.OFF || g == null) return 0f
-        val wantAlbum = prefs.mode == NormalizationMode.ALBUM ||
-            (prefs.mode == NormalizationMode.AUTO && asAlbum)
-        // Album gain falls back to track gain while the album is still being
-        // measured; track gain never falls back to album gain.
-        val useAlbum = wantAlbum && g.albumGain != null
-        val gain = if (useAlbum) g.albumGain else g.trackGain
-        val peak = if (useAlbum) g.albumPeak else g.trackPeak
-        return gain?.let { leveled(prefs, it, peak) } ?: 0f
-    }
-
-    private fun leveled(prefs: NormalizationPrefs, gain: Float, peak: Float?): Float {
-        var db = gain + (prefs.targetLufs - REFERENCE_LUFS)
-        if (prefs.boost == NormalizationBoost.HEADROOM && peak != null && peak > 0f) {
-            db = min(db, PEAK_CEILING_DBTP - DB_PER_DECADE * log10(peak))
-        }
-        return min(db, MAX_BOOST_DB)
-    }
-
-    /**
-     * Whether the current item is being played as part of its album, in
-     * order: a neighbour in play order is from the same album and sits on
-     * the right side of it. That is when album gain keeps the album's own
-     * dynamics (a quiet intro stays quiet); anywhere else track gain levels
-     * the mix.
-     */
-    fun playingAsAlbum(prev: AlbumPosition?, cur: AlbumPosition, next: AlbumPosition?): Boolean {
-        val curOrder = order(cur)
-        if (cur.albumId == null || curOrder == null) return false
-        val prevOrder = prev?.takeIf { it.albumId == cur.albumId }?.let { order(it) }
-        val nextOrder = next?.takeIf { it.albumId == cur.albumId }?.let { order(it) }
-        return (prevOrder != null && prevOrder < curOrder) || (nextOrder != null && nextOrder > curOrder)
-    }
-
-    // Disc-major track order. A track with no number has no place in the
-    // order and is never evidence of album play.
-    private fun order(p: AlbumPosition): Int? =
-        p.trackNumber?.let { (p.discNumber ?: 1) * DISC_STRIDE + it }
-
-    fun dbToLinear(db: Float): Float = 10f.pow(db / DB_PER_DECADE)
-}

android/app/src/main/java/com/fabledsword/minstrel/player/gain/GainStage.kt

@@ -1,82 +0,0 @@
-package com.fabledsword.minstrel.player.gain
-
-import java.nio.ByteBuffer
-import kotlin.math.abs
-import kotlin.math.exp
-import kotlin.math.max
-import kotlin.math.roundToInt
-
-/**
- * The sample arithmetic of [GainAudioProcessor], apart from Media3 so it can
- * be tested on the JVM: a gain that ramps toward its target, then an
- * optional peak limiter, then a clamp to full scale. Interleaved 16-bit or
- * float PCM in, the same format out.
- */
-internal class GainStage {
-    private var gain = 1f
-    private var envelope = 0f
-    private var rampCoeff = 1f
-    private var releaseCoeff = 0f
-    private var frame = FloatArray(2)
-
-    /** Sets the sample rate and channel count, and starts the gain at [startGain]. */
-    fun reset(sampleRate: Int, channels: Int, startGain: Float) {
-        val rate = sampleRate.coerceAtLeast(1).toFloat()
-        rampCoeff = 1f - exp(-1f / (RAMP_SECONDS * rate))
-        releaseCoeff = exp(-1f / (RELEASE_SECONDS * rate))
-        if (frame.size < channels) frame = FloatArray(channels)
-        gain = startGain
-        envelope = 0f
-    }
-
-    /** True when processing would copy the input unchanged. */
-    fun isUnity(target: Float, limiting: Boolean): Boolean = gain == 1f && target == 1f && !limiting
-
-    /**
-     * Processes every whole frame of [input] into [out]. A trailing partial
-     * frame is dropped, as Media3's own processors do.
-     */
-    @Suppress("LongParameterList") // the PCM layout is four facts; a holder type would only rename them
-    fun process(
-        input: ByteBuffer,
-        out: ByteBuffer,
-        channels: Int,
-        isFloat: Boolean,
-        target: Float,
-        limiting: Boolean,
-    ) {
-        val bytesPerFrame = channels * if (isFloat) FLOAT_BYTES else PCM16_BYTES
-        val frames = input.remaining() / bytesPerFrame
-        repeat(frames) {
-            gain += (target - gain) * rampCoeff
-            var peak = 0f
-            for (c in 0 until channels) {
-                val s = (if (isFloat) input.float else input.short / PCM16_SCALE) * gain
-                frame[c] = s
-                peak = max(peak, abs(s))
-            }
-            var reduce = 1f
-            if (limiting) {
-                envelope = max(peak, envelope * releaseCoeff)
-                if (envelope > LIMIT_CEILING) reduce = LIMIT_CEILING / envelope
-            }
-            for (c in 0 until channels) {
-                val v = (frame[c] * reduce).coerceIn(-1f, 1f)
-                if (isFloat) out.putFloat(v) else out.putShort((v * PCM16_MAX).roundToInt().toShort())
-            }
-        }
-        input.position(input.limit())
-    }
-
-    companion object {
-        /** -1 dBFS, the ceiling the web player's limiter holds too. */
-        const val LIMIT_CEILING = 0.8913f
-
-        private const val RAMP_SECONDS = 0.05f
-        private const val RELEASE_SECONDS = 0.25f
-        private const val PCM16_SCALE = 32768f
-        private const val PCM16_MAX = 32767f
-        private const val PCM16_BYTES = 2
-        private const val FLOAT_BYTES = 4
-    }
-}

android/app/src/main/java/com/fabledsword/minstrel/player/gain/ReplayGainStore.kt

@@ -1,140 +0,0 @@
-package com.fabledsword.minstrel.player.gain
-
-import com.fabledsword.minstrel.api.endpoints.ReplayGainApi
-import com.fabledsword.minstrel.cache.db.dao.CachedTrackDao
-import com.fabledsword.minstrel.connectivity.NetworkStatusController
-import com.fabledsword.minstrel.connectivity.ServerHealth
-import com.fabledsword.minstrel.di.ApplicationScope
-import kotlinx.coroutines.CancellationException
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withTimeoutOrNull
-import retrofit2.Retrofit
-import retrofit2.create
-import timber.log.Timber
-import java.util.concurrent.ConcurrentHashMap
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/**
- * The gains the player levels by (M464 #5000), looked up per track and
- * held for the life of the process. The audio thread reads them with [get];
- * [request] fills them in the background.
- *
- * Sources, most to least preferred:
- *  1. the library cache, synced with the gains, so cached audio levels
- *     offline;
- *  2. the server's replay-gain lookup, for a track not cached yet or
- *     measured since the last sync;
- *  3. none: the track plays as mastered, and the player picks the gain up
- *     the moment it lands.
- */
-@Singleton
-class ReplayGainStore internal constructor(
-    private val scope: CoroutineScope,
-    private val trackDao: CachedTrackDao,
-    private val api: ReplayGainApi,
-    private val serverHealth: () -> ServerHealth,
-    private val clock: () -> Long,
-) {
-    @Inject constructor(
-        @ApplicationScope scope: CoroutineScope,
-        trackDao: CachedTrackDao,
-        retrofit: Retrofit,
-        network: NetworkStatusController,
-    ) : this(
-        scope = scope,
-        trackDao = trackDao,
-        api = retrofit.create(),
-        serverHealth = { network.state.value },
-        clock = System::currentTimeMillis,
-    )
-
-    private val gains = ConcurrentHashMap<String, ReplayGain>()
-    private val inflight: MutableSet<String> = ConcurrentHashMap.newKeySet()
-
-    // When the server last said it had nothing for a track. Not cached for
-    // good: the backfill may measure it minutes later.
-    private val missedAt = ConcurrentHashMap<String, Long>()
-
-    /** The track's gains, or null while they are unknown. Safe from any thread. */
-    fun get(trackId: String): ReplayGain? = gains[trackId]
-
-    /** Starts loading gains for any of [trackIds] not already known or loading. */
-    fun request(trackIds: Collection<String>) {
-        val now = clock()
-        val wanted = trackIds.filter { id ->
-            !gains.containsKey(id) &&
-                (missedAt[id]?.let { now - it > MISS_RETRY_MS } ?: true) &&
-                inflight.add(id)
-        }
-        if (wanted.isEmpty()) return
-        scope.launch {
-            try {
-                load(wanted)
-            } finally {
-                inflight.removeAll(wanted.toSet())
-            }
-        }
-    }
-
-    internal suspend fun load(ids: List<String>) {
-        fromCache(ids)
-        val rest = ids.filter { !gains.containsKey(it) }
-        val health = serverHealth()
-        if (rest.isEmpty() || health == ServerHealth.Offline || health == ServerHealth.ServerDown) return
-        for (batch in rest.chunked(MAX_IDS_PER_REQUEST)) {
-            // A failed lookup leaves the batch unknown; the next request asks again.
-            if (!fromServer(batch)) return
-        }
-    }
-
-    private suspend fun fromCache(ids: List<String>) {
-        val rows = try {
-            trackDao.replayGains(ids)
-        } catch (e: CancellationException) {
-            throw e
-        } catch (
-            @Suppress("TooGenericExceptionCaught") e: Throwable,
-        ) {
-            Timber.w(e, "replay gain: cache read failed")
-            emptyList()
-        }
-        for (row in rows) {
-            // A cached row without a track gain is not an answer: the server
-            // may have measured the track since this device last synced.
-            if (row.trackGain == null) continue
-            gains[row.id] = ReplayGain(row.trackGain, row.trackPeak, row.albumGain, row.albumPeak)
-        }
-    }
-
-    /** Asks the server about [batch]; false when it could not be asked. */
-    private suspend fun fromServer(batch: List<String>): Boolean {
-        val res = try {
-            withTimeoutOrNull(REQUEST_TIMEOUT_MS) { api.getReplayGain(batch.joinToString(",")) }
-        } catch (e: CancellationException) {
-            throw e
-        } catch (
-            @Suppress("TooGenericExceptionCaught") e: Throwable,
-        ) {
-            Timber.w(e, "replay gain: lookup failed")
-            null
-        } ?: return false
-        val now = clock()
-        for (id in batch) {
-            val w = res.items[id]
-            if (w == null) {
-                missedAt[id] = now
-            } else {
-                gains[id] = ReplayGain(w.trackGain, w.trackPeak, w.albumGain, w.albumPeak)
-            }
-        }
-        return true
-    }
-
-    private companion object {
-        const val MAX_IDS_PER_REQUEST = 200 // the endpoint's limit
-        const val REQUEST_TIMEOUT_MS = 10_000L
-        const val MISS_RETRY_MS = 5 * 60_000L
-    }
-}

android/app/src/main/java/com/fabledsword/minstrel/player/output/SonosQueueLoader.kt

@@ -4,8 +4,6 @@ import com.fabledsword.minstrel.di.ApplicationScope
 import com.fabledsword.minstrel.models.TrackRef
 import com.fabledsword.minstrel.player.RemotePlayerState
 import com.fabledsword.minstrel.player.StreamTokenProvider
-import com.fabledsword.minstrel.player.gain.AlbumPosition
-import com.fabledsword.minstrel.player.gain.GainMath
 import com.fabledsword.minstrel.player.output.upnp.AVTransportClient
 import com.fabledsword.minstrel.player.output.upnp.SoapFaultException
 import com.fabledsword.minstrel.player.output.upnp.bareUdn
@@ -26,11 +24,6 @@ import javax.inject.Singleton
  * with its own failure modes, and it had grown large enough to hide one:
  * every write here is a SOAP call that can fail individually, and until
  * [verifyQueueLength] nothing ever read the result back.
- *
- * Every URL sent is a leveled one (M464 #5002): the server renders the track
- * at the user's loudness gain, or hands back the plain stream when leveling
- * is off. Renders are slow enough to matter, so the track playing and the
- * one after it are rendered ahead; the rest render when the speaker asks.
  */
 @Singleton
 class SonosQueueLoader @Inject constructor(
@@ -39,13 +32,6 @@ class SonosQueueLoader @Inject constructor(
     private val activeUpnpHolder: ActiveUpnpHolder,
     private val remoteState: RemotePlayerState,
 ) {
-    // The queue as last sent to the renderer, for looking up the track after
-    // the one it is playing.
-    @Volatile private var sent: List<TrackRef> = emptyList()
-
-    // The renderer track the next one was last prerendered for.
-    @Volatile private var prerenderedAfter = 0
-
     suspend fun load(
         transport: AVTransportClient,
         route: OutputRoute,
@@ -60,10 +46,8 @@ class SonosQueueLoader @Inject constructor(
             "UPnP select: add %d initial tracks (currentIndex=%d, totalQueue=%d)",
             initialBatch.size, currentIndex, queue.size,
         )
-        sent = queue
-        prerenderedAfter = currentIndex + 1
-        initialBatch.indices.forEach { idx ->
-            val token = mint(queue, idx, prerender = idx == currentIndex)
+        initialBatch.forEachIndexed { idx, ref ->
+            val token = streamTokens.mint(ref.id)
             transport.addURIToQueue(
                 uri = token.url,
                 mime = token.mime,
@@ -80,12 +64,12 @@ class SonosQueueLoader @Inject constructor(
         Timber.w("UPnP select: Play")
         transport.play()
         Timber.w("UPnP select: initial done; backgrounding remainder")
+        val remaining = queue.drop(initialEnd)
         // Verify even when there is no tail to append: the initial batch is
         // sent the same way and can be dropped the same way.
         scope.launch {
-            prerender(queue, currentIndex + 1)
-            if (initialEnd < queue.size) {
-                extendQueueOnSonos(transport, route, queue, initialEnd)
+            if (remaining.isNotEmpty()) {
+                extendQueueOnSonos(transport, route, remaining, initialEnd)
             }
             verifyQueueLength(transport, route, queue)
         }
@@ -100,16 +84,15 @@ class SonosQueueLoader @Inject constructor(
     private suspend fun extendQueueOnSonos(
         transport: AVTransportClient,
         route: OutputRoute,
-        queue: List<TrackRef>,
+        tracks: List<TrackRef>,
         startPosition: Int,
     ) {
-        val count = queue.size - startPosition
         Timber.w(
             "UPnP extend: appending %d tracks starting at position %d",
-            count, startPosition + 1,
+            tracks.size, startPosition + 1,
         )
-        val succeeded = appendTracksToQueue(transport, route, queue, startPosition)
-        Timber.w("UPnP extend: done (%d / %d appended)", succeeded, count)
+        val succeeded = appendTracksToQueue(transport, route, tracks, startPosition)
+        Timber.w("UPnP extend: done (%d / %d appended)", succeeded, tracks.size)
     }
 
     /**
@@ -153,17 +136,18 @@ class SonosQueueLoader @Inject constructor(
                 Timber.w("UPnP verify: renderer holds %d tracks, queue intact", nrTracks)
                 return
             }
+            val missing = fullQueue.drop(nrTracks)
             Timber.w(
                 "UPnP verify: %s holds %d of %d tracks; appending %d missing (round %d)",
-                route.name, nrTracks, fullQueue.size, fullQueue.size - nrTracks, round + 1,
+                route.name, nrTracks, fullQueue.size, missing.size, round + 1,
             )
-            appendTracksToQueue(transport, route, fullQueue, nrTracks)
+            appendTracksToQueue(transport, route, missing, nrTracks)
         }
         Timber.w("UPnP verify: gave up repairing queue length on %s", route.name)
     }
 
     /**
-     * Append [queue] from [startPosition] (0-based) on, returning how many landed.
+     * Append [tracks] at [startPosition] (0-based), returning how many landed.
      * Tolerates individual AddURIToQueue failures — log and continue so some
      * tracks loaded is better than zero tracks loaded — and stops early after
      * [EXTEND_ABORT_AFTER_FAILURES] consecutive ones.
@@ -171,20 +155,20 @@ class SonosQueueLoader @Inject constructor(
     private suspend fun appendTracksToQueue(
         transport: AVTransportClient,
         route: OutputRoute,
-        queue: List<TrackRef>,
+        tracks: List<TrackRef>,
         startPosition: Int,
     ): Int {
         var consecutiveFailures = 0
         var succeeded = 0
         var aborted = false
-        for (i in 0 until queue.size - startPosition) {
+        for ((i, ref) in tracks.withIndex()) {
             if (aborted) break
             if (activeUpnpHolder.active.value?.routeId != route.id) {
                 Timber.w("UPnP extend: cancelled at offset %d (route changed)", i)
                 aborted = true
             } else {
                 val outcome = runCatching {
-                    val token = mint(queue, startPosition + i)
+                    val token = streamTokens.mint(ref.id)
                     transport.addURIToQueue(
                         uri = token.url,
                         mime = token.mime,
@@ -236,7 +220,6 @@ class SonosQueueLoader @Inject constructor(
         newQueue: List<TrackRef>,
     ): Boolean {
         val newIds = newQueue.map { it.id }
-        sent = newQueue
         if (oldIds == newIds) return true
         val prefixLen = commonPrefixLength(oldIds, newIds)
         val suffixLen = commonSuffixLength(
@@ -288,7 +271,8 @@ class SonosQueueLoader @Inject constructor(
             prefixLen + 1,
         )
         for (i in 0 until addedCount) {
-            val token = mint(newQueue, prefixLen + i)
+            val ref = newQueue[prefixLen + i]
+            val token = streamTokens.mint(ref.id)
             transport.addURIToQueue(
                 uri = token.url,
                 mime = token.mime,
@@ -299,27 +283,6 @@ class SonosQueueLoader @Inject constructor(
         }
     }
 
-    /**
-     * Called on every poll with the renderer's 1-based track number. When it
-     * moves, the track after it is rendered ahead, so the speaker's fetch of
-     * it finds the render ready.
-     */
-    fun onRendererTrack(trackNumber: Int) {
-        if (trackNumber <= 0 || trackNumber == prerenderedAfter) return
-        prerenderedAfter = trackNumber
-        val queue = sent
-        scope.launch { prerender(queue, trackNumber) }
-    }
-
-    private suspend fun prerender(queue: List<TrackRef>, index: Int) {
-        if (index !in queue.indices) return
-        runCatching { mint(queue, index, prerender = true) }
-            .onFailure { Timber.w(it, "UPnP prerender failed for %s", queue[index].id) }
-    }
-
-    private suspend fun mint(queue: List<TrackRef>, index: Int, prerender: Boolean = false) =
-        streamTokens.mint(queue[index].id, asAlbum = playingAsAlbum(queue, index), prerender = prerender)
-
     private fun commonPrefixLength(a: List<String>, b: List<String>): Int {
         val limit = minOf(a.size, b.size)
         for (i in 0 until limit) {
@@ -336,33 +299,18 @@ class SonosQueueLoader @Inject constructor(
         return limit
     }
 
-    companion object {
-        /**
-         * Whether [queue]'s track at [index] plays among its album in order,
-         * judged by its neighbours in the renderer's queue, which plays
-         * straight through.
-         */
-        internal fun playingAsAlbum(queue: List<TrackRef>, index: Int): Boolean =
-            GainMath.playingAsAlbum(
-                prev = queue.getOrNull(index - 1)?.let(::position),
-                cur = position(queue[index]),
-                next = queue.getOrNull(index + 1)?.let(::position),
-            )
-
-        private fun position(t: TrackRef) =
-            AlbumPosition(t.albumId.ifEmpty { null }, t.discNumber, t.trackNumber)
-
+    private companion object {
         // Abort the append loop after this many consecutive AddURIToQueue
         // failures; Sonos rate-limits burst adds and a wall of failures means
         // it has stopped accepting, not that the next one might land.
-        private const val EXTEND_ABORT_AFTER_FAILURES = 3
-        private const val EXTEND_THROTTLE_MS = 50L
+        const val EXTEND_ABORT_AFTER_FAILURES = 3
+        const val EXTEND_THROTTLE_MS = 50L
 
         // Verify/repair passes after a queue load. Two: one to catch the
         // common case (a rate-limit burst dropped a chunk), one to catch a
         // repair that itself got rate-limited. Beyond that the renderer is
         // refusing for a reason retrying won't fix, and the stall watchdog
         // becomes the backstop.
-        private const val VERIFY_ROUNDS = 2
+        const val VERIFY_ROUNDS = 2
     }
 }

android/app/src/main/java/com/fabledsword/minstrel/player/ui/MiniPlayer.kt

@@ -109,11 +109,8 @@ private fun MiniCover(coverUrl: String, contentDescription: String) {
  * NowPlayingScreen via [onExpandClick].
  *
  * Layout (Column):
- *   - Slim seek slider pinned at the top (4dp track)
- *   - Row: cover | title/artist column | like | prev | play/pause | next.
- *     Weighted so it fills the rest of the fixed-height bar and centres its
- *     own content; otherwise the row keeps its intrinsic 48dp and the
- *     leftover height collects at the bottom as dead surface.
+ *   - Slim seek slider at the top (4dp track)
+ *   - Row: cover | title/artist column | like | prev | play/pause | next
  *
  * No kebab on the mini bar (operator 2026-06-01): the full kebab
  * surface lives on NowPlayingScreen, and dropping it from the mini
@@ -167,12 +164,6 @@ fun MiniPlayer(
                 durationMs = state.durationMs,
             )
             MiniRow(
-                // Take whatever the progress fill leaves. Without this the
-                // Column stacks 4dp + the row's intrinsic 48dp from the top
-                // and the remaining 28dp of an 80dp bar sits empty
-                // underneath — the content looked top-aligned rather than
-                // centred, with a dead strip above the gesture bar.
-                modifier = Modifier.weight(1f),
                 track = track,
                 isPlaying = state.isPlaying,
                 isUpnpLoading = state.isUpnpLoading,
@@ -214,7 +205,6 @@ private fun MiniProgressFill(positionMs: Long, durationMs: Long) {
 @Composable
 @Suppress("LongParameterList")
 private fun MiniRow(
-    modifier: Modifier,
     track: TrackRef,
     isPlaying: Boolean,
     isUpnpLoading: Boolean,
@@ -226,7 +216,7 @@ private fun MiniRow(
     onToggleLike: () -> Unit,
 ) {
     Row(
-        modifier = modifier
+        modifier = Modifier
             .fillMaxWidth()
             .padding(horizontal = 12.dp),
         verticalAlignment = Alignment.CenterVertically,

android/app/src/main/java/com/fabledsword/minstrel/settings/data/NormalizationPrefs.kt

@@ -1,55 +0,0 @@
-package com.fabledsword.minstrel.settings.data
-
-import kotlinx.serialization.SerialName
-import kotlinx.serialization.Serializable
-
-/**
- * The user's loudness-normalization preference (M464 #4998). The server
- * holds it, so this device, the web player and casts all level the same
- * way; a copy is kept on the device so offline playback still applies it.
- * Field names and values match `GET/PUT /api/me/normalization`.
- *
- * No constructor defaults, on purpose: the app's Json leaves out any field
- * equal to its default (encodeDefaults is off), and the server refuses a PUT
- * missing a field. Without defaults every field is always sent.
- */
-@Serializable
-data class NormalizationPrefs(
-    val mode: NormalizationMode,
-    @SerialName("target_lufs") val targetLufs: Int,
-    val boost: NormalizationBoost,
-) {
-    companion object {
-        /** The targets the server accepts, quietest first. */
-        val TARGETS: List<Int> = listOf(-18, -16, -14)
-
-        /** Must match library.DefaultNormalizationPrefs on the server. */
-        val DEFAULT: NormalizationPrefs = NormalizationPrefs(
-            mode = NormalizationMode.AUTO,
-            targetLufs = -18,
-            boost = NormalizationBoost.HEADROOM,
-        )
-    }
-}
-
-@Serializable
-enum class NormalizationMode {
-    /** Tracks play at their mastered volume. */
-    @SerialName("off") OFF,
-
-    /** Album gain while an album plays in order, track gain otherwise. */
-    @SerialName("auto") AUTO,
-
-    @SerialName("track") TRACK,
-
-    @SerialName("album") ALBUM,
-}
-
-@Serializable
-enum class NormalizationBoost {
-    /** Quiet tracks are raised only as far as their true peak allows. */
-    @SerialName("headroom") HEADROOM,
-
-    /** Quiet tracks are raised all the way and a limiter holds the peaks. */
-    @SerialName("limiter") LIMITER,
-}

android/app/src/main/java/com/fabledsword/minstrel/settings/data/NormalizationRepository.kt

@@ -1,67 +0,0 @@
-package com.fabledsword.minstrel.settings.data
-
-import com.fabledsword.minstrel.api.endpoints.MeApi
-import com.fabledsword.minstrel.auth.AuthStore
-import com.fabledsword.minstrel.cache.db.dao.CachedMutationDao
-import com.fabledsword.minstrel.cache.mutations.MutationKind
-import com.fabledsword.minstrel.cache.mutations.MutationQueue
-import kotlinx.coroutines.CancellationException
-import kotlinx.coroutines.flow.StateFlow
-import retrofit2.Retrofit
-import retrofit2.create
-import timber.log.Timber
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/**
- * The user's loudness-normalization preference (M464 #4998). The device's
- * copy lives in [AuthStore] so playback reads it offline; the server's copy
- * is what other devices and casts use.
- *
- * Writes follow rule 100: the device shows the change at once, the PUT is
- * best effort, and a failed PUT is queued for the MutationReplayer.
- */
-@Singleton
-class NormalizationRepository @Inject constructor(
-    retrofit: Retrofit,
-    private val authStore: AuthStore,
-    private val mutationQueue: MutationQueue,
-    private val mutationDao: CachedMutationDao,
-) {
-    private val api: MeApi = retrofit.create()
-
-    val prefs: StateFlow<NormalizationPrefs> = authStore.normalization
-
-    /**
-     * Takes the server's value, unless a change made here is still queued:
-     * the server has not seen it yet, and taking its older value would undo
-     * the change on screen until the replay landed. Throws on a network
-     * failure; the device's copy then stands.
-     */
-    suspend fun refresh() {
-        val server = api.getNormalization()
-        if (mutationDao.hasPending(MutationKind.NORMALIZATION_SET)) return
-        authStore.setNormalization(server)
-    }
-
-    suspend fun set(next: NormalizationPrefs) {
-        authStore.setNormalization(next)
-        // An earlier change still queued would be replayed after this PUT
-        // and undo it. Queue behind it instead: the replayer sends only the
-        // newest queued preference.
-        if (mutationDao.hasPending(MutationKind.NORMALIZATION_SET)) {
-            mutationQueue.enqueueNormalizationSet(next)
-            return
-        }
-        try {
-            api.putNormalization(next)
-        } catch (e: CancellationException) {
-            throw e
-        } catch (
-            @Suppress("TooGenericExceptionCaught") e: Throwable,
-        ) {
-            Timber.i(e, "normalization: PUT failed; queued for replay")
-            mutationQueue.enqueueNormalizationSet(next)
-        }
-    }
-}

android/app/src/main/java/com/fabledsword/minstrel/settings/ui/AboutCardViewModel.kt

@@ -9,7 +9,7 @@ import com.fabledsword.minstrel.update.data.ApkInstaller
 import com.fabledsword.minstrel.update.data.InstallStage
 import com.fabledsword.minstrel.update.data.UpdateRepository
 import com.fabledsword.minstrel.update.data.isBusy
-import com.fabledsword.minstrel.update.data.isUpdateAvailable
+import com.fabledsword.minstrel.update.data.isVersionNewer
 import com.fabledsword.minstrel.update.data.message
 import com.fabledsword.minstrel.update.data.stage
 import dagger.hilt.android.lifecycle.HiltViewModel
@@ -37,14 +37,6 @@ sealed interface UpdateCheckResult {
 
 data class AboutUiState(
     val installedVersion: String = BuildConfig.VERSION_NAME,
-    // The value the platform installs by, and therefore the one the update
-    // check must decide on. Held in state rather than read inline so a test
-    // can drive the comparison without a BuildConfig.
-    val installedCode: Long = BuildConfig.VERSION_CODE.toLong(),
-    // A debug build is signed with this machine's debug key, so the server's
-    // release-signed APK can never install over it (family idea #5103,
-    // practice 9). It updates from Android Studio instead.
-    val selfUpdates: Boolean = !BuildConfig.DEBUG,
     val isChecking: Boolean = false,
     val installStage: InstallStage = InstallStage.IDLE,
     val installMessage: String? = null,
@@ -53,9 +45,8 @@ data class AboutUiState(
 
 /**
  * Backs the About card's update controls. "Check for updates" calls
- * [UpdateRepository.getLatest], compares versus this build via
- * [isUpdateAvailable] — on the ordering key where the server reports one,
- * on the name otherwise — and reports the terminal state.
+ * [UpdateRepository.getLatest], compares versus the build's
+ * VERSION_NAME via [isVersionNewer], and reports the terminal state.
  * When an update is available, [install] downloads the APK via
  * [ApkInstaller] and installs it — routing the user to the "install
  * unknown apps" settings page first when that permission hasn't been
@@ -71,21 +62,13 @@ class AboutCardViewModel @Inject constructor(
     val state: StateFlow<AboutUiState> = internal.asStateFlow()
 
     fun checkForUpdates() {
-        if (internal.value.isChecking || !internal.value.selfUpdates) return
+        if (internal.value.isChecking) return
         viewModelScope.launch {
             internal.update { it.copy(isChecking = true, installMessage = null) }
             val installed = internal.value.installedVersion
-            val installedCode = internal.value.installedCode
             val result = runCatching { repository.getLatest() }
                 .map { latest ->
-                    if (
-                        isUpdateAvailable(
-                            serverCode = latest.code,
-                            serverName = latest.version,
-                            installedCode = installedCode,
-                            installedName = installed,
-                        )
-                    ) {
+                    if (isVersionNewer(latest.version, installed)) {
                         UpdateCheckResult.UpdateAvailable(latest)
                     } else {
                         UpdateCheckResult.Latest

android/app/src/main/java/com/fabledsword/minstrel/settings/ui/NormalizationCard.kt

@@ -1,143 +0,0 @@
-package com.fabledsword.minstrel.settings.ui
-
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
-import androidx.compose.material3.ElevatedCard
-import androidx.compose.material3.ExperimentalMaterial3Api
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.SegmentedButton
-import androidx.compose.material3.SegmentedButtonDefaults
-import androidx.compose.material3.SingleChoiceSegmentedButtonRow
-import androidx.compose.material3.Switch
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.unit.dp
-import androidx.hilt.navigation.compose.hiltViewModel
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.fabledsword.minstrel.settings.data.NormalizationBoost
-import com.fabledsword.minstrel.settings.data.NormalizationMode
-import com.fabledsword.minstrel.settings.data.NormalizationPrefs
-
-/**
- * Volume leveling (M464 #4998). The choice is stored on the server, so the
- * web player and casts follow it too.
- */
-@Composable
-fun NormalizationCard(viewModel: NormalizationViewModel = hiltViewModel()) {
-    val prefs by viewModel.prefs.collectAsStateWithLifecycle()
-    NormalizationCardContent(prefs = prefs, onChange = viewModel::update)
-}
-
-@OptIn(ExperimentalMaterial3Api::class)
-@Composable
-internal fun NormalizationCardContent(
-    prefs: NormalizationPrefs,
-    onChange: (NormalizationPrefs) -> Unit,
-) {
-    ElevatedCard(modifier = Modifier.fillMaxWidth()) {
-        Column(
-            modifier = Modifier.padding(16.dp),
-            verticalArrangement = Arrangement.spacedBy(8.dp),
-        ) {
-            Text(
-                text = "Volume leveling",
-                style = MaterialTheme.typography.titleMedium,
-                color = MaterialTheme.colorScheme.onSurface,
-            )
-            Hint(modeHint(prefs.mode))
-            val modes = NormalizationMode.entries
-            SingleChoiceSegmentedButtonRow(modifier = Modifier.fillMaxWidth()) {
-                modes.forEachIndexed { index, mode ->
-                    SegmentedButton(
-                        selected = mode == prefs.mode,
-                        onClick = { onChange(prefs.copy(mode = mode)) },
-                        shape = SegmentedButtonDefaults.itemShape(
-                            index = index,
-                            count = modes.size,
-                        ),
-                    ) { Text(modeLabel(mode)) }
-                }
-            }
-            if (prefs.mode != NormalizationMode.OFF) {
-                TargetRow(prefs = prefs, onChange = onChange)
-                BoostRow(prefs = prefs, onChange = onChange)
-            }
-        }
-    }
-}
-
-@OptIn(ExperimentalMaterial3Api::class)
-@Composable
-private fun TargetRow(prefs: NormalizationPrefs, onChange: (NormalizationPrefs) -> Unit) {
-    Text(
-        text = "Target loudness",
-        style = MaterialTheme.typography.bodyLarge,
-        color = MaterialTheme.colorScheme.onSurface,
-    )
-    val targets = NormalizationPrefs.TARGETS
-    SingleChoiceSegmentedButtonRow(modifier = Modifier.fillMaxWidth()) {
-        targets.forEachIndexed { index, lufs ->
-            SegmentedButton(
-                selected = lufs == prefs.targetLufs,
-                onClick = { onChange(prefs.copy(targetLufs = lufs)) },
-                shape = SegmentedButtonDefaults.itemShape(
-                    index = index,
-                    count = targets.size,
-                ),
-            ) { Text("$lufs LUFS") }
-        }
-    }
-}
-
-@Composable
-private fun BoostRow(prefs: NormalizationPrefs, onChange: (NormalizationPrefs) -> Unit) {
-    Row(verticalAlignment = Alignment.CenterVertically) {
-        Column(modifier = Modifier.weight(1f)) {
-            Text(
-                text = "Boost quiet tracks fully",
-                style = MaterialTheme.typography.bodyLarge,
-                color = MaterialTheme.colorScheme.onSurface,
-            )
-            Hint("A limiter catches the peaks.")
-        }
-        Spacer(Modifier.size(12.dp))
-        Switch(
-            checked = prefs.boost == NormalizationBoost.LIMITER,
-            onCheckedChange = { on ->
-                val boost = if (on) NormalizationBoost.LIMITER else NormalizationBoost.HEADROOM
-                onChange(prefs.copy(boost = boost))
-            },
-        )
-    }
-}
-
-@Composable
-private fun Hint(text: String) {
-    Text(
-        text = text,
-        style = MaterialTheme.typography.bodySmall,
-        color = MaterialTheme.colorScheme.onSurfaceVariant,
-    )
-}
-
-private fun modeLabel(mode: NormalizationMode): String = when (mode) {
-    NormalizationMode.OFF -> "Off"
-    NormalizationMode.AUTO -> "Auto"
-    NormalizationMode.TRACK -> "Track"
-    NormalizationMode.ALBUM -> "Album"
-}
-
-private fun modeHint(mode: NormalizationMode): String = when (mode) {
-    NormalizationMode.OFF -> "Tracks play at their mastered volume."
-    NormalizationMode.AUTO -> "Album gain for whole albums, track gain otherwise."
-    NormalizationMode.TRACK -> "Every track at the same loudness."
-    NormalizationMode.ALBUM -> "Albums keep their own quiet and loud tracks."
-}

android/app/src/main/java/com/fabledsword/minstrel/settings/ui/NormalizationViewModel.kt

@@ -1,44 +0,0 @@
-package com.fabledsword.minstrel.settings.ui
-
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.viewModelScope
-import com.fabledsword.minstrel.settings.data.NormalizationPrefs
-import com.fabledsword.minstrel.settings.data.NormalizationRepository
-import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.CancellationException
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.launch
-import timber.log.Timber
-import javax.inject.Inject
-
-/**
- * Backs the Volume leveling card. Shows the device's copy straight away and
- * refreshes it from the server on open, so a change made on the web shows
- * here too.
- */
-@HiltViewModel
-class NormalizationViewModel @Inject constructor(
-    private val repository: NormalizationRepository,
-) : ViewModel() {
-
-    val prefs: StateFlow<NormalizationPrefs> = repository.prefs
-
-    init {
-        viewModelScope.launch {
-            try {
-                repository.refresh()
-            } catch (e: CancellationException) {
-                throw e
-            } catch (
-                @Suppress("TooGenericExceptionCaught") e: Throwable,
-            ) {
-                // Offline: the device's copy stands.
-                Timber.i(e, "normalization: refresh failed")
-            }
-        }
-    }
-
-    fun update(next: NormalizationPrefs) {
-        viewModelScope.launch { repository.set(next) }
-    }
-}

android/app/src/main/java/com/fabledsword/minstrel/settings/ui/PasswordViewModel.kt

@@ -57,7 +57,7 @@ class PasswordViewModel @Inject constructor(
             try {
                 repository.changePassword(current = s.current, next = s.next)
                 internal.update {
-                    PasswordUiState(message = "Password changed. Your other devices have been signed out.")
+                    PasswordUiState(message = "Password changed.")
                 }
             } catch (
                 @Suppress("TooGenericExceptionCaught") e: Throwable,

android/app/src/main/java/com/fabledsword/minstrel/settings/ui/SettingsScreen.kt

@@ -161,7 +161,6 @@ private fun SettingsList(
                 onToggle = onToggleDiagnostics,
             )
         }
-        NormalizationCard()
         AppearanceCard(themeMode = themeMode, onPick = onPickTheme)
         StorageCard()
         AboutCard()
@@ -383,14 +382,6 @@ private fun AboutCard(viewModel: AboutCardViewModel = hiltViewModel()) {
 
 @Composable
 private fun UpdateControls(state: AboutUiState, viewModel: AboutCardViewModel) {
-    if (!state.selfUpdates) {
-        Text(
-            text = "Debug build: updates install from Android Studio.",
-            style = MaterialTheme.typography.bodySmall,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
-        )
-        return
-    }
     UpdateCheckLine(result = state.result)
     Button(
         onClick = viewModel::checkForUpdates,

android/app/src/main/java/com/fabledsword/minstrel/theme/Typography.kt

@@ -2,45 +2,72 @@ package com.fabledsword.minstrel.theme
 
 import androidx.compose.material3.Typography
 import androidx.compose.ui.text.TextStyle
-import androidx.compose.ui.text.font.Font
 import androidx.compose.ui.text.font.FontFamily
 import androidx.compose.ui.text.font.FontStyle
 import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.googlefonts.Font
+import androidx.compose.ui.text.googlefonts.GoogleFont
 import androidx.compose.ui.unit.sp
 import com.fabledsword.minstrel.R
 
 /**
- * Bundled typefaces, vendored into res/font by tools/vendor-fonts.py.
- *
- * These were fetched at runtime through the Play Services font provider until
- * 2026-09-09. That is a network dependency for rendering, and a deployed
- * instance is not guaranteed one — the provider is also absent entirely on
- * devices without Play Services, where the app silently fell back to the
- * platform default and stopped looking like Minstrel. Bundling costs ~0.86 MB
- * of APK and removes both failure modes.
+ * Google Fonts provider — fetches font files via Play Services Fonts at
+ * runtime, caches them across launches. Matches the Flutter client's
+ * `google_fonts` package behaviour (no bundled .ttf files in either tree).
  *
  * Per FabledSword design system:
  *   - Fraunces — display + headline (mythic serif)
  *   - Inter — body + label (clean sans for UI text)
  *   - JetBrains Mono — technical / monospace
  * Weights are restricted to 400 (regular) and 500 (medium) only.
- *
- * Each res/font entry is a single static instance, not a variable font: the
- * weight declared beside it here must match the file's own OS/2
- * usWeightClass, which the vendoring script asserts on download.
  */
+private val GoogleFontProvider = GoogleFont.Provider(
+    providerAuthority = "com.google.android.gms.fonts",
+    providerPackage = "com.google.android.gms",
+    certificates = R.array.com_google_android_gms_fonts_certs,
+)
+
+private val FrauncesFont = GoogleFont("Fraunces")
+private val InterFont = GoogleFont("Inter")
+private val JetBrainsMonoFont = GoogleFont("JetBrains Mono")
+
 private val Fraunces = FontFamily(
-    Font(R.font.fraunces_regular, FontWeight.W400, FontStyle.Normal),
-    Font(R.font.fraunces_medium, FontWeight.W500, FontStyle.Normal),
+    Font(
+        googleFont = FrauncesFont,
+        fontProvider = GoogleFontProvider,
+        weight = FontWeight.W400,
+        style = FontStyle.Normal,
+    ),
+    Font(
+        googleFont = FrauncesFont,
+        fontProvider = GoogleFontProvider,
+        weight = FontWeight.W500,
+        style = FontStyle.Normal,
+    ),
 )
 
 private val Inter = FontFamily(
-    Font(R.font.inter_regular, FontWeight.W400, FontStyle.Normal),
-    Font(R.font.inter_medium, FontWeight.W500, FontStyle.Normal),
+    Font(
+        googleFont = InterFont,
+        fontProvider = GoogleFontProvider,
+        weight = FontWeight.W400,
+        style = FontStyle.Normal,
+    ),
+    Font(
+        googleFont = InterFont,
+        fontProvider = GoogleFontProvider,
+        weight = FontWeight.W500,
+        style = FontStyle.Normal,
+    ),
 )
 
 private val JetBrainsMono = FontFamily(
-    Font(R.font.jetbrains_mono_regular, FontWeight.W400, FontStyle.Normal),
+    Font(
+        googleFont = JetBrainsMonoFont,
+        fontProvider = GoogleFontProvider,
+        weight = FontWeight.W400,
+        style = FontStyle.Normal,
+    ),
 )
 
 /**

android/app/src/main/java/com/fabledsword/minstrel/update/data/UpdateBannerController.kt

@@ -19,8 +19,7 @@ private const val POLL_INTERVAL_MS = 24 * 60 * 60 * 1000L
 /**
  * Drives the shell's soft "update available" banner. Polls
  * `/api/client/version` at launch + every 24h and, when the bundled
- * APK outranks this build — by ordering key where the server reports one,
- * by name otherwise — exposes its [UpdateInfo] so
+ * APK is strictly newer than this build, exposes its [UpdateInfo] so
  * [com.fabledsword.minstrel.update.ui.UpdateBanner] can nudge an
  * install. Mirrors Flutter's `ClientUpdateController`.
  *
@@ -29,9 +28,6 @@ private const val POLL_INTERVAL_MS = 24 * 60 * 60 * 1000L
  * restart re-shows it, which is acceptable nudging for v1 (matches
  * Flutter). Server 404 / network errors stay silent. Constructed at
  * launch via the construct-the-singleton trick in `MinstrelApplication`.
- *
- * A debug build never polls: it is signed with a local debug key, so the
- * server's release-signed APK could never install over it (#5103).
  */
 @Singleton
 class UpdateBannerController @Inject constructor(
@@ -48,10 +44,6 @@ class UpdateBannerController @Inject constructor(
         }.stateIn(scope, SharingStarted.Eagerly, null)
 
     init {
-        if (!BuildConfig.DEBUG) startPolling()
-    }
-
-    private fun startPolling() {
         scope.launch {
             while (true) {
                 runOnce()
@@ -66,13 +58,6 @@ class UpdateBannerController @Inject constructor(
 
     private suspend fun runOnce() {
         val info = runCatching { repository.getLatest() }.getOrNull() ?: return
-        latest.value = info.takeIf {
-            isUpdateAvailable(
-                serverCode = it.code,
-                serverName = it.version,
-                installedCode = BuildConfig.VERSION_CODE.toLong(),
-                installedName = BuildConfig.VERSION_NAME,
-            )
-        }
+        latest.value = info.takeIf { isVersionNewer(it.version, BuildConfig.VERSION_NAME) }
     }
 }

android/app/src/main/java/com/fabledsword/minstrel/update/data/UpdateRepository.kt

@@ -21,39 +21,10 @@ class UpdateRepository @Inject constructor(retrofit: Retrofit) {
 
 private fun UpdateInfoWire.toDomain(): UpdateInfo = UpdateInfo(
     version = version,
-    code = code,
-    channel = channel,
     apkUrl = apkUrl,
     sizeBytes = sizeBytes,
 )
 
-/**
- * True when [server] should be offered over the installed build.
- *
- * **Decide on the ordering key whenever the server sends one.** That is the
- * same value Android's package installer compares, so an offer made this way
- * implies an install the platform will actually accept. The app used to
- * compare NAMES while the platform installed by `versionCode`, with nothing
- * keeping the two orderings consistent — so it could offer a build Android
- * then refused as a downgrade, or stay quiet about one it would have taken.
- *
- * Name comparison survives only as the fallback for a server that predates
- * the field. A null code means "this server cannot tell me" — never "zero" —
- * because treating absent as zero would rank every such server as infinitely
- * old and offer its build to everyone, forever.
- */
-fun isUpdateAvailable(
-    serverCode: Long?,
-    serverName: String,
-    installedCode: Long,
-    installedName: String,
-): Boolean =
-    if (serverCode != null) {
-        serverCode > installedCode
-    } else {
-        isVersionNewer(serverName, installedName)
-    }
-
 /**
  * True when [server] is strictly newer than [installed]. Mirrors
  * Flutter's `isVersionNewer` — splits both strings on `.`, parses

android/app/src/main/res/values/font_certs.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Google Fonts provider certificate hashes for downloadable fonts via
+     androidx.compose.ui.text.googlefonts.GoogleFont.Provider. Standard
+     values published by Google; copied verbatim from the AndroidX docs. -->
+<resources>
+    <array name="com_google_android_gms_fonts_certs">
+        <item>@array/com_google_android_gms_fonts_certs_dev</item>
+        <item>@array/com_google_android_gms_fonts_certs_prod</item>
+    </array>
+    <string-array name="com_google_android_gms_fonts_certs_dev">
+        <item>MIIEqDCCA5CgAwIBAgIJANWFuGx90071MA0GCSqGSIb3DQEBBAUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4GA1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTAeFw0wODA0MTUyMzM2NTZaFw0zNTA5MDEyMzM2NTZaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4GA1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTCCASAwDQYJKoZIhvcNAQEBBQADggENADCCAQgCggEBANbOLggKv+IxTdGNs8/TGFy0PTP6DHThvbbR24kT9ixcOd9W+EaBPWW+wPPKQmsHxajtWjmQwWfna8mZuSeJS48LIgAZlKkpoyLcfobBPv6yyz8x1IxWWmF9c1IGN3vSL6BLNJEUyMEPzC2WZdwT4ZG2cuJTtzeETl6jWFKx68ETtZxNVHe9Iy9NMxEljDqVZ4y6+FlHaiYJqq3LcJpJVuKYz4kvOcyf3M0nDA8mUlVdfsOlw/H4uoNQ7VrAQUKB4kAyfxsKp/RZmnZSJ7+8Ag9aTC+oguTd1iFNuMqDUlpePo6CGuh73iKuq8mYvtdQQ0Yz+mF4j2YWB7Gj0R1k2cCAQOjgfwwgfkwHQYDVR0OBBYEFI0cxb6VTEM8YYY6FbBMvAPyT+CyMIHJBgNVHSMEgcEwgb6AFI0cxb6VTEM8YYY6FbBMvAPyT+CyoYGapIGXMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4GA1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbYIJANWFuGx90071MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADggEBABnTDPEF+3iSP0wNfdIjIz1AlnrPzgAIHVvXxunW7SBrDhEglQZBbKJEk5kT0mtKoOD1JMrSu1xuTKEBahWRbqHsXclaXjoBADb0kkjVEJu/Lh5hgYZnOjvlba8Ld7HCKePCVePoTJBdI4fvugnL8TsgK05aIskyY0hKI9L8KfqfGTl1lzOv2KoWD0KWwtAWPoGChZxmQ+nBli+gwYMzM1vAkP+aayLe0a1EQimlOalO762r0GXO0ks+UeXde2Z4e+8S/pf7pITEI/tP+MxJTALw9QUWEv9lKTk+jkbqxbsh8nfBUapfKqYn0eidpwq2AzVp3juYl7//fKnaPhJD9gs=</item>
+    </string-array>
+    <string-array name="com_google_android_gms_fonts_certs_prod">
+        <item>MIIEQzCCAyugAwIBAgIJAMLgh0ZkSjCNMA0GCSqGSIb3DQEBBAUAMHQxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDAeFw0wODA4MjEyMzEzMzRaFw0zNjAxMDcyMzEzMzRaMHQxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKtWLgDYO6IIrgqWbxJOKdoR8qtW0I9Y4sypEwPpt1TTcvZApxsdyxMJZ2JORland2qSGT2y5b+3JKkedxiLDmpHpDsz2WCbdxgxRczfey5YZnTJ4VZbH0xqWVW/8lGmPav5xVwnIiJS6HXk+BVKZF+JcWjAsb/GEuq/eFdpuzSqeYTcfi6idkyugwfYwXFU1+5fZKUaRKYCwkkFQVfcAs1fXA5V+++FGfvjJ/CxURaSxaBvGdGDhfXE28LWuT9ozCl5xw4Yq5OGazvV24mZVSoOO0yZ31j7kYvtwYK6NeADwbSxDdJEqO4k//0zOHKrUiGYXtqw/A0LFFtqoZKFjnkCAwEAAaOB1zCB1DAdBgNVHQ4EFgQUhzkS9E6G+x8U7eIYZVgWyN4j2u4wgaQGA1UdIwSBnDCBmYAUhzkS9E6G+x8U7eIYZVgWyN4j2u6heKR2MHQxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZIIJAMLgh0ZkSjCNMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADggEBABywqUAtNkXf2EVQuRGiI3pnNvIYx7N5xj4LMtloEdEqMpEcMa6Qe87qDx2hsArOR1nzQAFGsT/8YIIfX0fAJjQuP1lAcExSxVKbFICEvFBaWuhGgOOZ7CYzfHB6tEzJFLR2DQHQrXLT2HKDDhxhe9hKzqIRDSc5Hjr3jY5MMzfYM5lFvKK9pLqEsP6/Ad9SDhupcVoOWVrSCNKfRb6jpJbZuxJhCnq8tmlV4iy5tEW0a3VBYzpRoBdAaORWqHQTUlt+iL3aH7C5OxhgN/JuxvxXBL/3kkc0wK1ZNuk+sb4lNXmHnVqQYTcyowQHRPCRsPzCCl4ANULRpZjxAd0xUgg=</item>
+    </string-array>
+</resources>

android/app/src/main/res/xml/network_security_config.xml

@@ -17,12 +17,8 @@
   hostnames rather than CIDR ranges, and both sets of hosts above are unknowable
   until runtime. So a permissive base-config is an honest description of our
   situation — the gain over the manifest attribute is that the reasoning now
-  lives somewhere.
-
-  The LAN/WAN line this file cannot draw is drawn in code instead:
-  api/CleartextGuard.kt refuses plain http:// to the Minstrel server whenever
-  the connection lands on a public address (family baseline #5105, practice
-  13). LAN servers and UPnP speakers are unaffected.
+  lives somewhere, and there is one place to tighten if a future settings screen
+  can distinguish a LAN server from a WAN one.
 
   Worth stating because it looks worse than it is: this is NOT a tamper risk for
   the in-app updater. An APK altered in transit and re-signed is rejected by the

android/app/src/test/java/com/fabledsword/minstrel/api/AuthCookieInterceptorTest.kt

@@ -1,7 +1,6 @@
 package com.fabledsword.minstrel.api
 
 import com.fabledsword.minstrel.auth.AuthStore
-import com.fabledsword.minstrel.auth.FakeSessionVault
 import com.fabledsword.minstrel.cache.db.dao.AuthSessionDao
 import io.mockk.coEvery
 import io.mockk.every
@@ -44,7 +43,7 @@ class AuthCookieInterceptorTest {
                 coEvery { setSessionCookie(any()) } returns Unit
                 coEvery { setBaseUrl(any()) } returns Unit
             }
-        authStore = AuthStore(dao, FakeSessionVault(), TestScope(UnconfinedTestDispatcher()))
+        authStore = AuthStore(dao, TestScope(UnconfinedTestDispatcher()))
 
         // BaseUrlInterceptor rewrites placeholder.invalid → mock server.
         // AuthCookieInterceptor scopes its attach + clear behavior to

android/app/src/test/java/com/fabledsword/minstrel/api/BaseUrlInterceptorTest.kt

@@ -1,7 +1,6 @@
 package com.fabledsword.minstrel.api
 
 import com.fabledsword.minstrel.auth.AuthStore
-import com.fabledsword.minstrel.auth.FakeSessionVault
 import com.fabledsword.minstrel.cache.db.dao.AuthSessionDao
 import io.mockk.coEvery
 import io.mockk.every
@@ -39,7 +38,7 @@ class BaseUrlInterceptorTest {
                 coEvery { setSessionCookie(any()) } returns Unit
                 coEvery { setBaseUrl(any()) } returns Unit
             }
-        authStore = AuthStore(dao, FakeSessionVault(), TestScope(UnconfinedTestDispatcher()))
+        authStore = AuthStore(dao, TestScope(UnconfinedTestDispatcher()))
     }
 
     @AfterEach

android/app/src/test/java/com/fabledsword/minstrel/api/CleartextGuardTest.kt

@@ -1,89 +0,0 @@
-package com.fabledsword.minstrel.api
-
-import okhttp3.OkHttpClient
-import okhttp3.Request
-import okhttp3.mockwebserver.MockResponse
-import okhttp3.mockwebserver.MockWebServer
-import org.junit.jupiter.api.AfterEach
-import org.junit.jupiter.api.BeforeEach
-import org.junit.jupiter.api.Test
-import org.junit.jupiter.api.assertThrows
-import java.net.InetAddress
-import kotlin.test.assertEquals
-import kotlin.test.assertFalse
-import kotlin.test.assertTrue
-
-/** Plain http:// to the Minstrel server only on a private address (#5105, practice 13). */
-class CleartextGuardTest {
-    private lateinit var server: MockWebServer
-
-    @BeforeEach
-    fun setup() {
-        server = MockWebServer().apply { start() }
-    }
-
-    @AfterEach
-    fun teardown() {
-        server.shutdown()
-    }
-
-    private fun ip(s: String) = InetAddress.getByName(s)
-
-    @Test
-    fun `home network and overlay addresses may use plain http`() {
-        for (a in listOf(
-            "127.0.0.1", "10.1.2.3", "172.16.0.9", "172.31.255.1", "192.168.1.20",
-            "169.254.3.4", "100.64.0.1", "100.127.255.254", "::1", "fd12:3456::1", "fe80::1",
-        )) {
-            assertTrue(CleartextPolicy.allows(ip(a)), "$a should be allowed")
-        }
-    }
-
-    @Test
-    fun `public addresses may not`() {
-        for (a in listOf(
-            "8.8.8.8", "172.32.0.1", "100.128.0.1", "100.63.255.255", "203.0.113.5",
-            "2001:db8::1", "2606:4700::1111",
-        )) {
-            assertFalse(CleartextPolicy.allows(ip(a)), "$a should be refused")
-        }
-    }
-
-    private fun client(allows: Boolean) = OkHttpClient.Builder()
-        .addNetworkInterceptor(CleartextGuardInterceptor { allows })
-        .build()
-
-    private fun serverRequest() = Request.Builder()
-        .url(server.url("/api/auth/login"))
-        .tag(MinstrelServerRequest::class.java, MinstrelServerRequest)
-        .build()
-
-    @Test
-    fun `a refused server request sends nothing`() {
-        server.enqueue(MockResponse().setResponseCode(200))
-        assertThrows<CleartextToPublicHostException> {
-            client(allows = false).newCall(serverRequest()).execute()
-        }
-        assertEquals(0, server.requestCount, "the request reached the server")
-    }
-
-    @Test
-    fun `an allowed server request goes through`() {
-        server.enqueue(MockResponse().setResponseCode(200))
-        client(allows = true).newCall(serverRequest()).execute().use { assertEquals(200, it.code) }
-        assertEquals(1, server.requestCount)
-    }
-
-    @Test
-    fun `requests not bound for the Minstrel server are left alone`() {
-        server.enqueue(MockResponse().setResponseCode(200))
-        client(allows = false).newCall(Request.Builder().url(server.url("/art.jpg")).build())
-            .execute().use { assertEquals(200, it.code) }
-    }
-
-    @Test
-    fun `the refusal has its own message`() {
-        val msg = ErrorCopy.fromThrowable(CleartextToPublicHostException("music.example.com"))
-        assertTrue(msg.contains("https://"), msg)
-    }
-}

android/app/src/test/java/com/fabledsword/minstrel/api/ErrorCopyTest.kt

@@ -1,60 +0,0 @@
-package com.fabledsword.minstrel.api
-
-import okhttp3.MediaType.Companion.toMediaType
-import okhttp3.ResponseBody.Companion.toResponseBody
-import org.junit.jupiter.api.Assertions.assertEquals
-import org.junit.jupiter.api.Test
-import retrofit2.HttpException
-import retrofit2.Response
-import java.io.IOException
-
-class ErrorCopyTest {
-    private fun httpError(status: Int, body: String): HttpException =
-        HttpException(
-            Response.error<Unit>(status, body.toResponseBody("application/json".toMediaType())),
-        )
-
-    @Test
-    fun libraryNotWritableAppendsTheServerDetail() {
-        val detail = "Minstrel runs as uid 1000, gid 1000 and cannot delete from /music/A " +
-            "(read-only file system). The library mount must be writable by that user. " +
-            "Nothing was deleted."
-        val e = httpError(409, """{"error":{"code":"library_not_writable","message":"$detail"}}""")
-
-        assertEquals(
-            "${ErrorCopy.messageFor("library_not_writable")} $detail",
-            ErrorCopy.fromThrowable(e),
-        )
-    }
-
-    @Test
-    fun detailCodeWithoutAMessageShowsTheCopyAlone() {
-        val e = httpError(409, """{"error":{"code":"library_not_writable","message":""}}""")
-
-        assertEquals(ErrorCopy.messageFor("library_not_writable"), ErrorCopy.fromThrowable(e))
-    }
-
-    // Server messages are usually internal detail; appending them for every
-    // code would leak driver errors into snackbars. This pins the scope.
-    @Test
-    fun otherCodesNeverCarryTheServerMessage() {
-        val e = httpError(404, """{"error":{"code":"track_not_found","message":"pgx: no rows"}}""")
-
-        assertEquals(ErrorCopy.messageFor("track_not_found"), ErrorCopy.fromThrowable(e))
-    }
-
-    @Test
-    fun anUnparseableBodyFallsBackToUnknown() {
-        val e = httpError(500, "not json")
-
-        assertEquals(ErrorCopy.messageFor("unknown"), ErrorCopy.fromThrowable(e))
-    }
-
-    @Test
-    fun transportFailureMapsToConnectionRefused() {
-        assertEquals(
-            ErrorCopy.messageFor("connection_refused"),
-            ErrorCopy.fromThrowable(IOException("refused")),
-        )
-    }
-}

android/app/src/test/java/com/fabledsword/minstrel/auth/AuthStoreSessionVaultTest.kt

@@ -1,111 +0,0 @@
-package com.fabledsword.minstrel.auth
-
-import com.fabledsword.minstrel.cache.db.dao.AuthSessionDao
-import com.fabledsword.minstrel.cache.db.entities.AuthSessionEntity
-import io.mockk.coEvery
-import io.mockk.coVerify
-import io.mockk.every
-import io.mockk.mockk
-import kotlinx.coroutines.ExperimentalCoroutinesApi
-import kotlinx.coroutines.flow.flowOf
-import kotlinx.coroutines.test.StandardTestDispatcher
-import kotlinx.coroutines.test.TestScope
-import kotlinx.coroutines.test.UnconfinedTestDispatcher
-import kotlinx.coroutines.test.advanceUntilIdle
-import kotlinx.coroutines.test.runTest
-import org.junit.jupiter.api.Test
-import kotlin.test.assertEquals
-import kotlin.test.assertNull
-
-/**
- * The session cookie moved out of the Room row into a Keystore-backed vault
- * (M462 #4985). What matters is that nobody is signed out by it: an install
- * upgrading with a cookie in the row keeps it, a device whose Keystore will
- * not work keeps the old storage, and a sign-in or 401 that lands while the
- * one-time move runs is never overwritten by the value it read.
- */
-@OptIn(ExperimentalCoroutinesApi::class)
-class AuthStoreSessionVaultTest {
-    /** A DAO whose single row holds [legacyCookie] in its sessionCookie column. */
-    private class RowDao(var legacyCookie: String?) {
-        val dao: AuthSessionDao = mockk {
-            every { observe() } returns flowOf(null)
-            coEvery { get() } answers {
-                AuthSessionEntity(baseUrl = "http://music.local", sessionCookie = legacyCookie)
-            }
-            coEvery { upsert(any()) } answers { legacyCookie = firstArg<AuthSessionEntity>().sessionCookie }
-            coEvery { setSessionCookie(any()) } answers { legacyCookie = firstArg() }
-        }
-    }
-
-    @Test
-    fun `an upgrading install keeps its session, moved out of the row into the vault`() = runTest {
-        val row = RowDao(legacyCookie = "session=abc")
-        val vault = FakeSessionVault()
-
-        val store = AuthStore(row.dao, vault, TestScope(UnconfinedTestDispatcher(testScheduler)))
-        store.awaitSessionHydrated()
-
-        assertEquals("session=abc", store.sessionCookie.value)
-        assertEquals("session=abc", vault.stored)
-        assertNull(row.legacyCookie, "the plain-text copy must be cleared from the row")
-    }
-
-    @Test
-    fun `a cookie already in the vault is loaded without touching the row`() = runTest {
-        val row = RowDao(legacyCookie = null)
-        val vault = FakeSessionVault(stored = "session=xyz")
-
-        val store = AuthStore(row.dao, vault, TestScope(UnconfinedTestDispatcher(testScheduler)))
-        store.awaitSessionHydrated()
-
-        assertEquals("session=xyz", store.sessionCookie.value)
-        assertEquals(0, vault.writes)
-        coVerify(exactly = 0) { row.dao.setSessionCookie(any()) }
-    }
-
-    @Test
-    fun `when the Keystore will not work the cookie stays in the row instead of being lost`() = runTest {
-        val row = RowDao(legacyCookie = "session=abc")
-        val vault = FakeSessionVault(available = false)
-
-        val store = AuthStore(row.dao, vault, TestScope(UnconfinedTestDispatcher(testScheduler)))
-        store.awaitSessionHydrated()
-        assertEquals("session=abc", store.sessionCookie.value)
-        assertEquals("session=abc", row.legacyCookie)
-
-        store.setSessionCookie("session=new")
-        assertEquals("session=new", row.legacyCookie, "fallback writes go to the row")
-    }
-
-    @Test
-    fun `sign-in and sign-out write the vault, and never the row`() = runTest {
-        val row = RowDao(legacyCookie = null)
-        val vault = FakeSessionVault()
-        val store = AuthStore(row.dao, vault, TestScope(UnconfinedTestDispatcher(testScheduler)))
-        store.awaitSessionHydrated()
-
-        store.setSessionCookie("session=new")
-        assertEquals("session=new", vault.stored)
-        assertNull(row.legacyCookie)
-
-        store.setSessionCookie(null)
-        assertNull(vault.stored)
-        assertNull(store.sessionCookie.value)
-    }
-
-    @Test
-    fun `a sign-out that lands before hydration finishes is not undone by it`() = runTest {
-        val row = RowDao(legacyCookie = "session=stale")
-        val vault = FakeSessionVault()
-        val scope = TestScope(StandardTestDispatcher(testScheduler))
-
-        // Hydration is queued but has not run; a 401 clears the session first.
-        val store = AuthStore(row.dao, vault, scope)
-        store.setSessionCookie(null)
-        scope.advanceUntilIdle()
-
-        assertNull(store.sessionCookie.value, "hydration must not resurrect the stale cookie")
-        assertNull(vault.stored)
-    }
-}

android/app/src/test/java/com/fabledsword/minstrel/auth/FakeSessionVault.kt

@@ -1,23 +0,0 @@
-package com.fabledsword.minstrel.auth
-
-/**
- * In-memory [SessionVault] for JVM tests: the Android Keystore has no JVM
- * implementation. [available] = false stands in for a device whose Keystore
- * refuses to work, so callers' fallback paths can be exercised.
- */
-class FakeSessionVault(
-    var stored: String? = null,
-    var available: Boolean = true,
-) : SessionVault {
-    var writes = 0
-        private set
-
-    override fun read(): String? = if (available) stored else null
-
-    override fun write(value: String?): Boolean {
-        if (!available) return false
-        writes++
-        stored = value
-        return true
-    }
-}

android/app/src/test/java/com/fabledsword/minstrel/auth/SealedBoxTest.kt

@@ -1,48 +0,0 @@
-package com.fabledsword.minstrel.auth
-
-import org.junit.jupiter.api.Test
-import org.junit.jupiter.api.assertThrows
-import java.util.Base64
-import javax.crypto.KeyGenerator
-import javax.crypto.SecretKey
-import kotlin.test.assertEquals
-import kotlin.test.assertFalse
-import kotlin.test.assertNotEquals
-
-/**
- * The sealing half of the session vault, with an ordinary JVM AES key in
- * place of the Keystore one (the Keystore has no JVM implementation).
- */
-class SealedBoxTest {
-    private fun newKey(): SecretKey = KeyGenerator.getInstance("AES").apply { init(256) }.generateKey()
-
-    @Test
-    fun `round-trips a cookie`() {
-        val key = newKey()
-        assertEquals("session=abc", SealedBox.open(key, SealedBox.seal(key, "session=abc")))
-    }
-
-    @Test
-    fun `the stored form does not contain the cookie, and differs every time`() {
-        val key = newKey()
-        val first = SealedBox.seal(key, "session=abc")
-        val second = SealedBox.seal(key, "session=abc")
-        assertNotEquals(first, second, "a fresh IV per seal")
-        val decoded = String(Base64.getDecoder().decode(first), Charsets.ISO_8859_1)
-        assertFalse(decoded.contains("session=abc"), "plaintext visible in the sealed value")
-    }
-
-    @Test
-    fun `a tampered value does not open`() {
-        val key = newKey()
-        val bytes = Base64.getDecoder().decode(SealedBox.seal(key, "session=abc"))
-        bytes[bytes.size - 1] = (bytes[bytes.size - 1].toInt() xor 1).toByte()
-        assertThrows<Exception> { SealedBox.open(key, Base64.getEncoder().encodeToString(bytes)) }
-    }
-
-    @Test
-    fun `a value sealed under another key does not open`() {
-        val sealed = SealedBox.seal(newKey(), "session=abc")
-        assertThrows<Exception> { SealedBox.open(newKey(), sealed) }
-    }
-}

android/app/src/test/java/com/fabledsword/minstrel/cache/mutations/SupersededToggleIdsTest.kt

@@ -1,8 +1,6 @@
 package com.fabledsword.minstrel.cache.mutations
 
 import com.fabledsword.minstrel.cache.db.entities.CachedMutationEntity
-import com.fabledsword.minstrel.settings.data.NormalizationMode
-import com.fabledsword.minstrel.settings.data.NormalizationPrefs
 import kotlinx.serialization.json.Json
 import org.junit.jupiter.api.Test
 import kotlin.test.assertEquals
@@ -131,26 +129,4 @@ class SupersededToggleIdsTest {
     fun `an empty queue collapses nothing`() {
         assertTrue(supersededToggleIds(emptyList(), json).isEmpty())
     }
-
-    private fun normalizationRow(id: Long, mode: NormalizationMode) = CachedMutationEntity(
-        id = id,
-        kind = MutationKind.NORMALIZATION_SET,
-        payload = json.encodeToString(
-            NormalizationPrefs.serializer(),
-            NormalizationPrefs.DEFAULT.copy(mode = mode),
-        ),
-    )
-
-    // There is one preference per user, so any two queued changes to it
-    // collapse, and only the newest is sent (#4998).
-    @Test
-    fun `only the newest queued normalization change survives`() {
-        val rows = listOf(
-            normalizationRow(1, NormalizationMode.TRACK),
-            snoozeRow(2, "mb-a", desiredSnoozed = true),
-            normalizationRow(3, NormalizationMode.OFF),
-            normalizationRow(4, NormalizationMode.ALBUM),
-        )
-        assertEquals(setOf(1L, 3L), supersededToggleIds(rows, json))
-    }
 }

android/app/src/test/java/com/fabledsword/minstrel/player/gain/GainMathTest.kt

@@ -1,111 +0,0 @@
-package com.fabledsword.minstrel.player.gain
-
-import com.fabledsword.minstrel.settings.data.NormalizationBoost
-import com.fabledsword.minstrel.settings.data.NormalizationMode
-import com.fabledsword.minstrel.settings.data.NormalizationPrefs
-import org.junit.jupiter.api.Test
-import kotlin.math.log10
-import kotlin.test.assertEquals
-import kotlin.test.assertFalse
-import kotlin.test.assertTrue
-
-/** Mirrors web/src/lib/player/gain.test.ts: both players must level alike. */
-class GainMathTest {
-
-    private fun prefs(
-        mode: NormalizationMode = NormalizationMode.AUTO,
-        target: Int = -18,
-        boost: NormalizationBoost = NormalizationBoost.HEADROOM,
-    ) = NormalizationPrefs(mode = mode, targetLufs = target, boost = boost)
-
-    private val g = ReplayGain(trackGain = -6f, trackPeak = 1f, albumGain = -4f, albumPeak = 1f)
-
-    @Test
-    fun `off and unmeasured tracks play as mastered`() {
-        assertEquals(0f, GainMath.gainDb(prefs(mode = NormalizationMode.OFF), g, false))
-        assertEquals(0f, GainMath.gainDb(prefs(), null, false))
-        assertEquals(0f, GainMath.gainDb(prefs(), ReplayGain.NONE, false))
-    }
-
-    @Test
-    fun `mode picks the gain and auto follows album play`() {
-        assertEquals(-6f, GainMath.gainDb(prefs(mode = NormalizationMode.TRACK), g, true))
-        assertEquals(-4f, GainMath.gainDb(prefs(mode = NormalizationMode.ALBUM), g, false))
-        assertEquals(-4f, GainMath.gainDb(prefs(), g, true))
-        assertEquals(-6f, GainMath.gainDb(prefs(), g, false))
-    }
-
-    @Test
-    fun `album gain falls back to track gain until the album is measured`() {
-        val partial = ReplayGain(trackGain = -6f, trackPeak = 1f, albumGain = null, albumPeak = null)
-        assertEquals(-6f, GainMath.gainDb(prefs(mode = NormalizationMode.ALBUM), partial, true))
-    }
-
-    @Test
-    fun `a louder target raises every gain by the difference`() {
-        assertEquals(-2f, GainMath.gainDb(prefs(mode = NormalizationMode.TRACK, target = -14), g, false))
-    }
-
-    @Test
-    fun `headroom stops a boost 1 dB under the true peak and the limiter lets it through`() {
-        val quiet = ReplayGain(trackGain = 8f, trackPeak = 0.5f, albumGain = null, albumPeak = null)
-        val headroom = GainMath.gainDb(prefs(mode = NormalizationMode.TRACK), quiet, false)
-        assertEquals(-1f - 20f * log10(0.5f), headroom, 1e-4f)
-        val limited = GainMath.gainDb(
-            prefs(mode = NormalizationMode.TRACK, boost = NormalizationBoost.LIMITER),
-            quiet,
-            false,
-        )
-        assertEquals(8f, limited)
-    }
-
-    @Test
-    fun `no boost passes the cap`() {
-        val silent = ReplayGain(trackGain = 30f, trackPeak = 0.001f, albumGain = null, albumPeak = null)
-        val db = GainMath.gainDb(
-            prefs(mode = NormalizationMode.TRACK, boost = NormalizationBoost.LIMITER),
-            silent,
-            false,
-        )
-        assertEquals(GainMath.MAX_BOOST_DB, db)
-    }
-
-    @Test
-    fun `cuts are never limited by the peak`() {
-        val hot = ReplayGain(trackGain = -9f, trackPeak = 1.4f, albumGain = null, albumPeak = null)
-        assertEquals(-9f, GainMath.gainDb(prefs(mode = NormalizationMode.TRACK), hot, false))
-    }
-
-    private fun pos(album: String, track: Int?, disc: Int? = 1) = AlbumPosition(album, disc, track)
-
-    @Test
-    fun `in-order neighbours from the same album are album play`() {
-        assertTrue(GainMath.playingAsAlbum(null, pos("x", 1), pos("x", 2)))
-        assertTrue(GainMath.playingAsAlbum(pos("x", 1), pos("x", 2), pos("x", 3)))
-        assertTrue(GainMath.playingAsAlbum(pos("x", 2), pos("x", 3), null))
-    }
-
-    @Test
-    fun `a shuffled album, a mix and a lone track are not album play`() {
-        assertFalse(GainMath.playingAsAlbum(null, pos("x", 3), pos("x", 1)))
-        assertFalse(GainMath.playingAsAlbum(null, pos("x", 1), pos("y", 2)))
-        assertFalse(GainMath.playingAsAlbum(null, pos("x", 1), null))
-    }
-
-    @Test
-    fun `disc order counts`() {
-        assertTrue(GainMath.playingAsAlbum(pos("x", 12, disc = 1), pos("x", 1, disc = 2), null))
-    }
-
-    @Test
-    fun `a neighbour without a track number is not evidence of order`() {
-        assertFalse(GainMath.playingAsAlbum(pos("x", null), pos("x", 3), null))
-        assertFalse(GainMath.playingAsAlbum(null, pos("x", null), pos("x", null)))
-    }
-
-    @Test
-    fun `dbToLinear`() {
-        assertEquals(1f, GainMath.dbToLinear(0f))
-        assertEquals(0.1f, GainMath.dbToLinear(-20f), 1e-6f)
-    }
-}

android/app/src/test/java/com/fabledsword/minstrel/player/gain/GainStageTest.kt

@@ -1,73 +0,0 @@
-package com.fabledsword.minstrel.player.gain
-
-import org.junit.jupiter.api.Test
-import java.nio.ByteBuffer
-import java.nio.ByteOrder
-import kotlin.math.abs
-import kotlin.test.assertEquals
-import kotlin.test.assertTrue
-
-class GainStageTest {
-
-    private fun floats(vararg v: Float): ByteBuffer =
-        ByteBuffer.allocateDirect(v.size * 4).order(ByteOrder.nativeOrder()).apply {
-            v.forEach { putFloat(it) }
-            flip()
-        }
-
-    private fun shorts(vararg v: Short): ByteBuffer =
-        ByteBuffer.allocateDirect(v.size * 2).order(ByteOrder.nativeOrder()).apply {
-            v.forEach { putShort(it) }
-            flip()
-        }
-
-    private fun runFloat(stage: GainStage, input: ByteBuffer, target: Float, limiting: Boolean): FloatArray {
-        val out = ByteBuffer.allocateDirect(input.remaining()).order(ByteOrder.nativeOrder())
-        stage.process(input, out, channels = 2, isFloat = true, target = target, limiting = limiting)
-        out.flip()
-        return FloatArray(out.remaining() / 4) { out.float }
-    }
-
-    @Test
-    fun `a stream that starts at its gain is scaled from the first sample`() {
-        val stage = GainStage().apply { reset(sampleRate = 44_100, channels = 2, startGain = 0.5f) }
-        val out = runFloat(stage, floats(0.8f, -0.4f), target = 0.5f, limiting = false)
-        assertEquals(0.4f, out[0], 1e-6f)
-        assertEquals(-0.2f, out[1], 1e-6f)
-    }
-
-    @Test
-    fun `a changed target ramps rather than steps`() {
-        val stage = GainStage().apply { reset(sampleRate = 44_100, channels = 2, startGain = 1f) }
-        val n = 44_100 // one second of stereo frames
-        val input = floats(*FloatArray(n * 2) { 0.5f })
-        val out = runFloat(stage, input, target = 0.5f, limiting = false)
-        assertTrue(out[0] > 0.49f, "first frame barely moved: ${out[0]}")
-        assertEquals(0.25f, out.last(), 1e-3f)
-    }
-
-    @Test
-    fun `the limiter holds a boosted peak at -1 dBFS`() {
-        val stage = GainStage().apply { reset(sampleRate = 44_100, channels = 2, startGain = 4f) }
-        val out = runFloat(stage, floats(0.9f, -0.9f, 0.1f, 0.1f), target = 4f, limiting = true)
-        out.forEach { assertTrue(abs(it) <= GainStage.LIMIT_CEILING + 1e-6f, "sample $it over the ceiling") }
-    }
-
-    @Test
-    fun `without the limiter a boost is clamped to full scale, 16-bit included`() {
-        val stage = GainStage().apply { reset(sampleRate = 44_100, channels = 2, startGain = 4f) }
-        val input = shorts(20_000, -20_000)
-        val out = ByteBuffer.allocateDirect(4).order(ByteOrder.nativeOrder())
-        stage.process(input, out, channels = 2, isFloat = false, target = 4f, limiting = false)
-        out.flip()
-        assertEquals(Short.MAX_VALUE, out.short)
-        assertEquals((-Short.MAX_VALUE).toShort(), out.short)
-    }
-
-    @Test
-    fun `unity is a pass-through`() {
-        val stage = GainStage().apply { reset(sampleRate = 44_100, channels = 2, startGain = 1f) }
-        assertTrue(stage.isUnity(target = 1f, limiting = false))
-        assertTrue(!stage.isUnity(target = 1f, limiting = true))
-    }
-}

android/app/src/test/java/com/fabledsword/minstrel/player/gain/ReplayGainStoreTest.kt

@@ -1,74 +0,0 @@
-package com.fabledsword.minstrel.player.gain
-
-import com.fabledsword.minstrel.api.endpoints.ReplayGainApi
-import com.fabledsword.minstrel.cache.db.dao.CachedReplayGain
-import com.fabledsword.minstrel.cache.db.dao.CachedTrackDao
-import com.fabledsword.minstrel.connectivity.ServerHealth
-import com.fabledsword.minstrel.models.wire.ReplayGainResponseWire
-import com.fabledsword.minstrel.models.wire.ReplayGainWire
-import io.mockk.coEvery
-import io.mockk.coVerify
-import io.mockk.mockk
-import kotlinx.coroutines.test.TestScope
-import kotlinx.coroutines.test.runTest
-import org.junit.jupiter.api.Test
-import java.io.IOException
-import kotlin.test.assertEquals
-import kotlin.test.assertNull
-
-/** The fallback ladder: the library cache, then the server, then nothing. */
-class ReplayGainStoreTest {
-    private val dao: CachedTrackDao = mockk()
-    private val api: ReplayGainApi = mockk()
-    private var health = ServerHealth.Healthy
-
-    private fun store() = ReplayGainStore(
-        scope = TestScope(),
-        trackDao = dao,
-        api = api,
-        serverHealth = { health },
-        clock = { 0L },
-    )
-
-    @Test
-    fun `cached gains are used and only the rest are asked of the server`() = runTest {
-        coEvery { dao.replayGains(listOf("a", "b", "c")) } returns listOf(
-            CachedReplayGain("a", trackGain = -6f, trackPeak = 1f, albumGain = -4f, albumPeak = 1f),
-            // Cached but unmeasured at the last sync: the server may know more.
-            CachedReplayGain("b", trackGain = null, trackPeak = null, albumGain = null, albumPeak = null),
-        )
-        coEvery { api.getReplayGain("b,c") } returns ReplayGainResponseWire(
-            items = mapOf("b" to ReplayGainWire(trackGain = -3f, trackPeak = 0.9f)),
-        )
-        val s = store()
-
-        s.load(listOf("a", "b", "c"))
-
-        assertEquals(-4f, s.get("a")?.albumGain)
-        assertEquals(-3f, s.get("b")?.trackGain)
-        assertNull(s.get("c"), "a track the server has not measured stays unknown")
-    }
-
-    @Test
-    fun `offline, the cache is all there is`() = runTest {
-        health = ServerHealth.Offline
-        coEvery { dao.replayGains(any()) } returns emptyList()
-        val s = store()
-
-        s.load(listOf("a"))
-
-        assertNull(s.get("a"))
-        coVerify(exactly = 0) { api.getReplayGain(any()) }
-    }
-
-    @Test
-    fun `a failed lookup leaves the track unknown, to be asked again`() = runTest {
-        coEvery { dao.replayGains(any()) } returns emptyList()
-        coEvery { api.getReplayGain(any()) } throws IOException("reset")
-        val s = store()
-
-        s.load(listOf("a"))
-
-        assertNull(s.get("a"))
-    }
-}

android/app/src/test/java/com/fabledsword/minstrel/player/output/SonosAlbumPlayTest.kt

@@ -1,43 +0,0 @@
-package com.fabledsword.minstrel.player.output
-
-import com.fabledsword.minstrel.models.TrackRef
-import org.junit.jupiter.api.Test
-import kotlin.test.assertEquals
-
-/**
- * The Sonos queue plays straight through, so a track's album play is judged
- * from its neighbours in the list sent (M464 #5002).
- */
-class SonosAlbumPlayTest {
-
-    private fun t(album: String, n: Int?, disc: Int? = null) =
-        TrackRef(id = "$album-$disc-$n", title = "", albumId = album, artistId = "", trackNumber = n, discNumber = disc)
-
-    private fun asAlbum(queue: List<TrackRef>) = queue.indices.map { SonosQueueLoader.playingAsAlbum(queue, it) }
-
-    @Test
-    fun `an album in order plays as an album throughout`() {
-        assertEquals(listOf(true, true, true), asAlbum(listOf(t("a", 1), t("a", 2), t("a", 3))))
-    }
-
-    @Test
-    fun `a mix of albums plays as singles`() {
-        assertEquals(listOf(false, false, false), asAlbum(listOf(t("a", 1), t("b", 1), t("c", 4))))
-    }
-
-    @Test
-    fun `album order runs across discs`() {
-        assertEquals(listOf(true, true), asAlbum(listOf(t("a", 12, disc = 1), t("a", 1, disc = 2))))
-    }
-
-    @Test
-    fun `shuffled tracks of one album are not album play`() {
-        assertEquals(listOf(false, false), asAlbum(listOf(t("a", 3), t("a", 1))))
-    }
-
-    @Test
-    fun `unnumbered tracks and missing albums are never album play`() {
-        assertEquals(listOf(false, false), asAlbum(listOf(t("a", null), t("a", null))))
-        assertEquals(listOf(false, false), asAlbum(listOf(t("", 1), t("", 2))))
-    }
-}

android/app/src/test/java/com/fabledsword/minstrel/settings/data/NormalizationRepositoryTest.kt

@@ -1,90 +0,0 @@
-package com.fabledsword.minstrel.settings.data
-
-import com.fabledsword.minstrel.api.endpoints.MeApi
-import com.fabledsword.minstrel.auth.AuthStore
-import com.fabledsword.minstrel.cache.db.dao.CachedMutationDao
-import com.fabledsword.minstrel.cache.mutations.MutationKind
-import com.fabledsword.minstrel.cache.mutations.MutationQueue
-import io.mockk.coEvery
-import io.mockk.coVerify
-import io.mockk.every
-import io.mockk.mockk
-import io.mockk.verify
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.test.runTest
-import org.junit.jupiter.api.Test
-import retrofit2.Retrofit
-import java.io.IOException
-
-/**
- * The normalization preference is written offline-first (rule 100): the
- * device shows the change at once, and a change the server has not seen
- * yet is never overwritten or reordered.
- */
-class NormalizationRepositoryTest {
-    private val api: MeApi = mockk()
-    private val authStore: AuthStore = mockk(relaxed = true) {
-        every { normalization } returns MutableStateFlow(NormalizationPrefs.DEFAULT)
-    }
-    private val queue: MutationQueue = mockk(relaxed = true)
-    private val dao: CachedMutationDao = mockk()
-    private val retrofit: Retrofit = mockk {
-        every { create(MeApi::class.java) } returns api
-    }
-    private val repo = NormalizationRepository(retrofit, authStore, queue, dao)
-
-    private val album = NormalizationPrefs.DEFAULT.copy(mode = NormalizationMode.ALBUM)
-
-    @Test
-    fun `a change is shown at once and sent`() = runTest {
-        coEvery { dao.hasPending(MutationKind.NORMALIZATION_SET) } returns false
-        coEvery { api.putNormalization(album) } returns album
-
-        repo.set(album)
-
-        verify { authStore.setNormalization(album) }
-        coVerify { api.putNormalization(album) }
-        coVerify(exactly = 0) { queue.enqueueNormalizationSet(any()) }
-    }
-
-    @Test
-    fun `a change that cannot reach the server is queued`() = runTest {
-        coEvery { dao.hasPending(MutationKind.NORMALIZATION_SET) } returns false
-        coEvery { api.putNormalization(album) } throws IOException("offline")
-
-        repo.set(album)
-
-        verify { authStore.setNormalization(album) }
-        coVerify { queue.enqueueNormalizationSet(album) }
-    }
-
-    @Test
-    fun `a change behind a queued one queues too, so the older one cannot land last`() = runTest {
-        coEvery { dao.hasPending(MutationKind.NORMALIZATION_SET) } returns true
-
-        repo.set(album)
-
-        coVerify(exactly = 0) { api.putNormalization(any()) }
-        coVerify { queue.enqueueNormalizationSet(album) }
-    }
-
-    @Test
-    fun `refresh takes the server value`() = runTest {
-        coEvery { api.getNormalization() } returns album
-        coEvery { dao.hasPending(MutationKind.NORMALIZATION_SET) } returns false
-
-        repo.refresh()
-
-        verify { authStore.setNormalization(album) }
-    }
-
-    @Test
-    fun `refresh leaves a queued change on screen`() = runTest {
-        coEvery { api.getNormalization() } returns NormalizationPrefs.DEFAULT
-        coEvery { dao.hasPending(MutationKind.NORMALIZATION_SET) } returns true
-
-        repo.refresh()
-
-        verify(exactly = 0) { authStore.setNormalization(any()) }
-    }
-}

android/app/src/test/java/com/fabledsword/minstrel/theme/BundledFontsTest.kt

@@ -1,125 +0,0 @@
-package com.fabledsword.minstrel.theme
-
-import org.junit.jupiter.api.Test
-import java.io.File
-import kotlin.test.assertEquals
-import kotlin.test.assertTrue
-
-/**
- * Guards that the typefaces ship inside the APK instead of being fetched at
- * runtime.
- *
- * Until 2026-09-09 these were resolved through the Play Services font
- * provider. That needs a network the deployed app is not guaranteed, and a
- * provider that devices without Play Services do not have at all. Both
- * failures are silent — text just renders in the platform default, which
- * reads as a styling regression rather than a missing dependency.
- *
- * Expectations are read out of Typography.kt itself rather than hardcoded, so
- * this cannot drift away from what the app actually declares: adding a face
- * without vendoring its file fails here, and so does changing a declared
- * weight without refetching the matching static instance.
- */
-class BundledFontsTest {
-    @Test
-    fun `typography builds its families from bundled resources`() {
-        val source = typographySource()
-        assertTrue(
-            source.contains("R.font."),
-            "Typography.kt should build its families from res/font resources",
-        )
-        FORBIDDEN.forEach { symbol ->
-            assertTrue(
-                !source.contains(symbol),
-                "Typography.kt must not reference $symbol — fonts are bundled, not fetched",
-            )
-        }
-    }
-
-    @Test
-    fun `every declared face is vendored as TrueType at its declared weight`() {
-        val declared = FACE_PATTERN.findAll(typographySource()).toList()
-        assertTrue(
-            declared.isNotEmpty(),
-            "no Font(R.font.…, FontWeight.W…) declarations found — the guard would pass vacuously",
-        )
-
-        declared.forEach { match ->
-            val (name, weight) = match.destructured
-            val file = File(appDir(), "src/main/res/font/$name.ttf")
-            assertTrue(file.isFile, "res/font/$name.ttf is missing — run tools/vendor-fonts.py")
-
-            val bytes = file.readBytes()
-            assertTrue(
-                bytes.copyOfRange(0, TTF_MAGIC.size).contentEquals(TTF_MAGIC),
-                "$name.ttf is not TrueType — res/font cannot load a woff2 or an eot",
-            )
-            // The decisive check. Google's css2 endpoint silently collapses a
-            // multi-weight request to 400 for legacy clients, so Medium can
-            // come back as Regular: a valid TrueType file that renders at the
-            // wrong weight everywhere. usWeightClass is the only field that
-            // tells the two apart.
-            assertEquals(
-                weight.toInt(),
-                weightClass(bytes),
-                "$name.ttf carries a different OS/2 usWeightClass than the FontWeight declared beside it",
-            )
-        }
-    }
-
-    /** Typography.kt with comments removed, so prose naming the forbidden
-     *  symbols cannot satisfy — or trip — the absence check above. */
-    private fun typographySource(): String =
-        File(appDir(), TYPOGRAPHY)
-            .readText()
-            .replace(BLOCK_COMMENT, "")
-            .replace(LINE_COMMENT, "")
-
-    /** Gradle's working directory for tests is the module dir, but don't rely
-     *  on it: walk up until the module is found, and say so if it isn't. */
-    private fun appDir(): File {
-        var dir: File? = File("").absoluteFile
-        while (dir != null) {
-            if (File(dir, TYPOGRAPHY).isFile) return dir
-            if (File(dir, "app/$TYPOGRAPHY").isFile) return File(dir, "app")
-            dir = dir.parentFile
-        }
-        error("could not locate the app module from ${File("").absolutePath}")
-    }
-
-    private fun weightClass(bytes: ByteArray): Int {
-        val tables = readU16(bytes, NUM_TABLES)
-        for (i in 0 until tables) {
-            val record = TABLE_DIRECTORY + i * TABLE_RECORD
-            if (String(bytes, record, TAG_LENGTH, Charsets.US_ASCII) == "OS/2") {
-                return readU16(bytes, readU32(bytes, record + OFFSET_FIELD) + WEIGHT_FIELD)
-            }
-        }
-        error("no OS/2 table in the font")
-    }
-
-    private fun readU16(bytes: ByteArray, at: Int): Int =
-        ((bytes[at].toInt() and BYTE_MASK) shl Byte.SIZE_BITS) or (bytes[at + 1].toInt() and BYTE_MASK)
-
-    private fun readU32(bytes: ByteArray, at: Int): Int =
-        (readU16(bytes, at) shl Short.SIZE_BITS) or readU16(bytes, at + 2)
-
-    private companion object {
-        const val TYPOGRAPHY = "src/main/java/com/fabledsword/minstrel/theme/Typography.kt"
-
-        val FORBIDDEN = listOf("GoogleFont", "googlefonts")
-        val FACE_PATTERN = Regex("""R\.font\.(\w+)\s*,\s*FontWeight\.W(\d+)""")
-        val BLOCK_COMMENT = Regex("""/\*[\s\S]*?\*/""")
-        val LINE_COMMENT = Regex("""//.*""")
-        val TTF_MAGIC = byteArrayOf(0x00, 0x01, 0x00, 0x00)
-
-        // Offsets into the TrueType table directory, per the OpenType spec.
-        const val NUM_TABLES = 4
-        const val TABLE_DIRECTORY = 12
-        const val TABLE_RECORD = 16
-        const val TAG_LENGTH = 4
-        const val OFFSET_FIELD = 8
-        const val WEIGHT_FIELD = 4
-        const val BYTE_MASK = 0xFF
-    }
-}

android/app/src/test/java/com/fabledsword/minstrel/update/data/UpdateVersioningTest.kt

@@ -1,163 +0,0 @@
-package com.fabledsword.minstrel.update.data
-
-import org.junit.jupiter.api.Test
-import kotlin.test.assertFalse
-import kotlin.test.assertTrue
-
-/**
- * The update channel had no tests at all before this. That is worth saying
- * out loud, because the thing it decides — whether anyone is ever offered an
- * update — fails silently in both directions: an update nobody is offered
- * looks exactly like being up to date, and nobody files a bug about a prompt
- * they never saw.
- */
-class UpdateVersioningTest {
-    @Test
-    fun `decides on the ordering key when the server reports one`() {
-        assertTrue(
-            isUpdateAvailable(
-                serverCode = 3523847, serverName = "2026.09.10.1432",
-                installedCode = 3519456, installedName = "2026.09.09.1828",
-            ),
-        )
-        assertFalse(
-            isUpdateAvailable(
-                serverCode = 3519456, serverName = "2026.09.09.1828",
-                installedCode = 3523847, installedName = "2026.09.10.1432",
-            ),
-        )
-    }
-
-    @Test
-    fun `an equal ordering key is not an update`() {
-        assertFalse(
-            isUpdateAvailable(
-                serverCode = 3523847, serverName = "2026.09.10.1432",
-                installedCode = 3523847, installedName = "2026.09.10.1432",
-            ),
-        )
-    }
-
-    /**
-     * The property the whole rework exists for: the offer must agree with what
-     * the platform will actually install. Where the two disagree, the ordering
-     * key wins, because that is the value Android compares.
-     */
-    @Test
-    fun `the ordering key wins even when the name disagrees`() {
-        // Name looks older, key is newer — e.g. an older commit rebuilt later.
-        assertTrue(
-            isUpdateAvailable(
-                serverCode = 9_000_000, serverName = "2020.01.01.0000",
-                installedCode = 1, installedName = "2099.12.31.2359",
-            ),
-        )
-        // Name looks newer, key is not. Offering this would be offering an
-        // install the platform then refuses as a downgrade.
-        assertFalse(
-            isUpdateAvailable(
-                serverCode = 1, serverName = "2099.12.31.2359",
-                installedCode = 9_000_000, installedName = "2020.01.01.0000",
-            ),
-        )
-    }
-
-    @Test
-    fun `falls back to the name when the server reports no ordering key`() {
-        assertTrue(
-            isUpdateAvailable(
-                serverCode = null, serverName = "2026.09.10.1432",
-                installedCode = 3519456, installedName = "2026.09.09.1828",
-            ),
-        )
-        assertFalse(
-            isUpdateAvailable(
-                serverCode = null, serverName = "2026.09.09.1828",
-                installedCode = 3519456, installedName = "2026.09.10.1432",
-            ),
-        )
-    }
-
-    /**
-     * A null code must never be read as zero. Zero would rank every
-     * older server as infinitely behind and offer its build to everyone,
-     * forever — so this asserts the fallback runs instead of a comparison
-     * against 0 succeeding by accident.
-     */
-    @Test
-    fun `a null ordering key is absent, not zero`() {
-        // installedCode is 0 here: if null coerced to 0, "0 > 0" would be
-        // false and this would wrongly report no update despite a newer name.
-        assertTrue(
-            isUpdateAvailable(
-                serverCode = null, serverName = "2026.09.10.1432",
-                installedCode = 0, installedName = "2026.09.09.1828",
-            ),
-        )
-    }
-
-    /**
-     * The recorded migration constraint, pinned so it cannot be forgotten:
-     * the old scheme's fourth segment was a commit count (~1895), the new
-     * one is HHMM. Across a day boundary the date decides and all is well.
-     */
-    @Test
-    fun `new-scheme name outranks an old-scheme name on a later day`() {
-        assertTrue(isVersionNewer("2026.09.10.1432", "2026.09.09.1895"))
-    }
-
-    /**
-     * ...but on the SAME day the comparison comes down to HHMM against a
-     * commit count, and any build before ~19:00 UTC reads as older. This is
-     * why the first new-scheme release had to be cut on a later calendar day.
-     * Asserting the trap so nobody "fixes" it by accident.
-     */
-    @Test
-    fun `same-day new-scheme name can read older than an old-scheme name`() {
-        assertFalse(isVersionNewer("2026.09.09.1828", "2026.09.09.1895"))
-    }
-
-    @Test
-    fun `name comparison degrades per segment rather than discarding`() {
-        // The string is still compared rather than rejected outright: an
-        // earlier segment decides and the unparseable tail never matters.
-        assertTrue(isVersionNewer("2026.09.10.1432-dev", "2026.09.09.1828"))
-
-        // A shorter name pads with zeros instead of being refused.
-        assertTrue(isVersionNewer("2026.09.10", "2026.09.09.9999"))
-        assertFalse(isVersionNewer("2026.09.10", "2026.09.10.0"))
-    }
-
-    /**
-     * What "costs that segment's precision" actually means, and it is worth
-     * pinning because it is a real edge rather than a nicety: when the
-     * unparseable segment is the DECIDING one, it reads as 0 and loses. So a
-     * `-dev` suffixed build compares as older than an unsuffixed one from the
-     * same minute.
-     *
-     * That is the correct behaviour for a degrading parser — it is bounded
-     * loss rather than a discarded string — but it is exactly why the channel
-     * belongs in its own field and never in the name.
-     */
-    @Test
-    fun `an unparseable deciding segment reads as zero and loses`() {
-        assertFalse(isVersionNewer("2026.09.10.1432-dev", "2026.09.10.1000"))
-    }
-
-    /**
-     * Both sides unparseable (branch-name builds) falls back to string
-     * inequality, so a dev build still surfaces rather than comparing equal
-     * and going silent.
-     */
-    @Test
-    fun `two unparseable names fall back to string inequality`() {
-        assertTrue(isVersionNewer("main", "dev"))
-        assertFalse(isVersionNewer("dev", "dev"))
-    }
-
-    @Test
-    fun `a leading v is ignored on either side`() {
-        assertTrue(isVersionNewer("v2026.09.10.1432", "2026.09.09.1828"))
-        assertFalse(isVersionNewer("v2026.09.10.1432", "v2026.09.10.1432"))
-    }
-}

android/gradle/libs.versions.toml

@@ -21,7 +21,7 @@ kotlinx-serialization = "1.7.3"
 kotlinx-coroutines = "1.9.0"
 kotlinx-datetime = "0.6.1"
 kotlinx-serialization-converter = "1.0.0"
-media3 = "1.11.0"
+media3 = "1.10.1"
 mediarouter = "1.7.0"
 coil = "3.0.0-rc02"
 palette = "1.0.0"
@@ -53,6 +53,7 @@ compose-ui-graphics = { module = "androidx.compose.ui:ui-graphics" }
 compose-ui-tooling = { module = "androidx.compose.ui:ui-tooling" }
 compose-ui-tooling-preview = { module = "androidx.compose.ui:ui-tooling-preview" }
 compose-material3 = { module = "androidx.compose.material3:material3" }
+compose-ui-text-google-fonts = { module = "androidx.compose.ui:ui-text-google-fonts" }
 hilt-android = { module = "com.google.dagger:hilt-android", version.ref = "hilt" }
 hilt-compiler = { module = "com.google.dagger:hilt-compiler", version.ref = "hilt" }
 room-runtime = { module = "androidx.room:room-runtime", version.ref = "room" }

ci-requirements.md

@@ -12,9 +12,8 @@ git.fabledsword.com/bvandeusen/ci-go:1.26
 git.fabledsword.com/bvandeusen/ci-android:36
 ```
 
-- `ci-go:1.26` — the `go`, `integration` and `web` lanes, `release-assets`, and the container build (`image-release`). All CI lives in one workflow, `.gitea/workflows/release.yml`, so every publishing job can depend on every lane (rule 177).
-- `golang:1.26-bookworm` (Docker Hub) — the `govulncheck` lane. Deliberately the same image as the Dockerfile's builder stage rather than `ci-go`, so the standard library it checks is the one in the shipped binary. Keep the two in step.
-- `ci-android:36` — native Kotlin/Compose client: ktlint + detekt + unit tests + debug APK (the `android` lane), and the signed release APK (`android-release`).
+- `ci-go:1.26` — Go server tests (`.gitea/workflows/test-go.yml`), web SPA tests (`.gitea/workflows/test-web.yml`), and the release container build (`release.yml`'s `image-release` job).
+- `ci-android:36` — native Kotlin/Compose client: ktlint + detekt + unit tests + debug APK (`.gitea/workflows/android.yml`), and the signed release APK (`release.yml`'s `android-release` job).
 
 **`ci-flutter` is no longer consumed, and `ci-flutter` can now be retired.**
 The M8 rewrite replaced the Flutter client with the native Android app and
@@ -31,9 +30,9 @@ split below. The label is a scheduling handle, not a toolchain assertion.
 
 ### From `ci-go:1.26`
 - **Go** (1.26 toolchain) — `go vet`, `go test -race`, `go build`, `go mod`.
-- **Node + npm** — `npm ci`, `npm audit`, `npm test` and `npm run check` in the `web` lane.
-- **golangci-lint** — lint pass in the `go` lane.
-- **docker CLI** — bridge-IP discovery of the per-job Postgres service container in the `integration` lane (via the runner's shared `/var/run/docker.sock`).
+- **Node + npm** — `npm ci` and `npm test` / `npm run check` in `test-web.yml`.
+- **golangci-lint** — lint pass in `test-go.yml`.
+- **docker CLI** — bridge-IP discovery of the per-job Postgres service container in `test-go.yml` integration job (via the runner's shared `/var/run/docker.sock`).
 - **docker buildx** — release container build + push in `release.yml`.
 - **curl** — release-asset polling / upload in `release.yml`.
 
@@ -46,7 +45,7 @@ split below. The label is a scheduling handle, not a toolchain assertion.
   No NDK: the native client has no C/C++ sources (this is why it isn't on
   `ci-flutter`).
 - **ktlint + detekt** — `./gradlew ktlintCheck` and `./gradlew detekt` in
-  the `android` lane. Image pins track `android/gradle/libs.versions.toml` so local
+  `android.yml`. Image pins track `android/gradle/libs.versions.toml` so local
   and CI checks agree.
 - **git** — `actions/checkout@v4` baseline (and any shell git operations).
 - **base64 + curl** — keystore decode + release-asset upload in `release.yml`'s
@@ -59,34 +58,61 @@ None.
 ## Notes
 
 - **Label/image split.** Workflows keep `runs-on: go-ci` / `runs-on: flutter-ci` as the scheduling label per the [`ci-runners.md`](https://…/FabledRulebook/ci-runners.md) "label = scheduling handle, image = `container.image`" pattern. The labels are intentional handles, not toolchain assertions — which is why the Android jobs still schedule on `flutter-ci` while pulling `ci-android:36`. Switch them to `android-ci` if that runner label is ever registered; nothing breaks either way.
-- **Integration-job docker-socket dependency.** The `integration` lane uses the runner's shared docker socket (`/var/run/docker.sock`) to bridge-IP-discover the per-job Postgres service container by name + network intersection — the dev compose's `minstrel-postgres-*` containers are explicitly skipped as belt-and-suspenders. Depends on `act_runner.valid_volumes` whitelisting the socket; if that ever stops auto-mounting, integration tests fail at the `docker inspect` step.
+- **Integration-job docker-socket dependency.** `test-go.yml`'s integration job uses the runner's shared docker socket (`/var/run/docker.sock`) to bridge-IP-discover the per-job Postgres service container by name + network intersection — the dev compose's `minstrel-postgres-*` containers are explicitly skipped as belt-and-suspenders. Depends on `act_runner.valid_volumes` whitelisting the socket; if that ever stops auto-mounting, integration tests fail at the `docker inspect` step.
 - **Go toolchain pin.** `go.mod` is on `go 1.25.0` because `golang.org/x/crypto v0.51.0` declares 1.25 as its minimum. `ci-go:1.26` satisfies this with headroom. Future `x/crypto` bumps that move the Go floor should be paired with an image-tag bump in this file + the workflows.
 - **In-app update channel — `needs:`, not polling.** `release.yml`'s `image-release` job declares `needs: [android-release]`, so on tag pushes the signed APK is guaranteed present before the image build starts — no polling window, no race. (The old cross-workflow polling against `flutter.yml` is gone with that workflow.) On non-tag `main` pushes `android-release` is skipped and `image-release` instead pulls the most recent release's APK and reconstructs its exact `versionName`, so `:latest` never ships without an update channel. It degrades to an empty `client/` — never a wrong version — if no release, asset, or tag commit-count can be resolved.
-- **Cache server reachability.** The `web` lane does NOT use `cache: 'npm'` on `actions/setup-node` — the Gitea Actions cache server isn't reachable from this runner's container network and `setup-node` was burning ~4m41s on ETIMEDOUT before failing open. With the migration to `ci-go:1.26`, `setup-node` is removed entirely (Node is in the image). The cache concern reappears if a future change re-introduces a network-dependent action.
-- **Artifacts — stock `actions/upload-artifact@v7` and `actions/download-artifact@v8`; never `@v3`.**
+- **Cache server reachability.** `test-web.yml` does NOT use `cache: 'npm'` on `actions/setup-node` — the Gitea Actions cache server isn't reachable from this runner's container network and `setup-node` was burning ~4m41s on ETIMEDOUT before failing open. With the migration to `ci-go:1.26`, `setup-node` is removed entirely (Node is in the image). The cache concern reappears if a future change re-introduces a network-dependent action.
+- **Artifacts — use the mirrored actions, never `actions/{upload,download}-artifact`.**
   ```yaml
-  uses: actions/upload-artifact@v7
-  uses: actions/download-artifact@v8
+  uses: https://git.fabledsword.com/bvandeusen/upload-artifact@cb8afe72b42edc798abfb8fcb556cf660d894245
+  uses: https://git.fabledsword.com/bvandeusen/download-artifact@8d4e9521a5f7e5f8b6351f341f719f9f45a92a3a
   ```
-  Stock works on this forge since the runner moved to gitea/runner 3.x, which
-  edits the actions' client-side `isGhes()` refusal out of their bundles. Proven
-  on 2026-09-10 for upload v4–v7 and download v4–v8 (Scribe spike #3843). Until
-  then this repo pinned SHA mirrors of the Forgejo project's forks, because
-  upstream threw on the hostname before it opened a connection (Scribe 2255).
+  Upstream's `@v4+` cannot work against this instance and no server-side change
+  will help: `isGhes()` rejects any hostname that isn't `github.com` /
+  `*.ghe.com` / `*.localhost` and throws before it opens a connection, so the
+  server is never asked what it supports. `@v3` is worse — it reports success,
+  and Gitea then serves artifacts back only through the v4 API
+  (`content_encoding = application/zip`), so a v3 upload is stored but invisible
+  to every retrieval path. A green job producing nothing retrievable; that is how
+  72 unreachable artifacts accumulated on this repo. Scribe issues 2255 / 2270.
 
-  `@v3` is still broken: it reports success, and Gitea serves artifacts back only
-  through the v4 API (`content_encoding = application/zip`), so a v3 upload is
-  stored but invisible to every retrieval path. That is how 72 unreachable
-  artifacts accumulated on this repo (Scribe 2270).
+  Both are pull mirrors of the Forgejo project's forks
+  (`code.forgejo.org/forgejo/{upload,download}-artifact`, one commit on upstream
+  disabling that check), mirrored so CI depends on commits we hold and pinned by
+  SHA because the mirrors auto-sync every 8h — a moved upstream tag would
+  otherwise silently change what runs.
 
-  **Pairing no longer needs managing.** This entry used to pin upload v5 against
-  download v6 so both bundled `@actions/artifact` ^4.0.0, warning that a mismatch
-  across `release.yml`'s producer/consumer pair would list empty. Tested, and not
-  true on this instance: every download major v4–v8 read the artifacts of every
-  upload major v4–v7, by name and by pattern (CI-runner run 6312). The only real
-  protocol break is v3 → v4. node24 is no longer a concern either — every
-  CI-runner image carries Node 24 and the runner runs actions with the image's
-  `node`.
+  **Match the pins on `@actions/artifact`, not on the actions' own version
+  numbers.** The two actions release on unrelated cadences, so equal version
+  numbers do NOT mean a compatible pair — upload `v5` bundles `@actions/artifact`
+  ^4.0.0 while download `v5` bundles ^2.3.2. The pins above are upload **v5** and
+  download **v6**, which is the pairing that puts ^4.0.0 on both sides. This
+  matters because `release.yml` is a producer/consumer pair — `android-release`
+  uploads `minstrel-apk`, `image-release` downloads it — and a protocol mismatch
+  across it yields an empty listing rather than an error, exactly the silent
+  failure this entry exists to prevent.
+
+  | tag | `@actions/artifact` | runtime |
+  |---|---|---|
+  | upload v4 | ^2.1.1 | node20 |
+  | **upload v5** ← pinned | **^4.0.0** | node20 |
+  | download v4 | ^2.1.1 | node20 |
+  | download v5 | ^2.3.2 | node20 |
+  | **download v6** ← pinned | **^4.0.0** | node20 |
+  | download v7 | ^5.0.0 | **node24** |
+
+  The only true protocol break in this history was **v3 → v4** (upstream:
+  "Downloading artifacts that were created from `actions/upload-artifact@v3` and
+  below are not supported"); v4-and-up are one family. Later majors are mostly
+  ergonomics and runtime — upload v4 forbids re-uploading a name and caps a job
+  at 500 artifacts; download v5 made by-ID extraction match by-name.
+
+  **Do not jump the download pin to v7.** That major is a runner requirement, not
+  a feature change: it moves to `runs.using: node24` and upstream states it
+  "requires a minimum Actions Runner version of 2.327.1 … if you are using
+  self-hosted runners, ensure they are updated before upgrading." act_runner is
+  not GitHub's runner and makes no such version claim, so node24 is unverified
+  here. Everything currently pinned is node20.
 
   Upload steps set `if-no-files-found: error` rather than the default `warn`, so
   an upload that matches nothing fails its own job instead of failing the

ci/version.sh

@@ -1,159 +0,0 @@
-#!/usr/bin/env bash
-#
-# Derives the three values a build is stamped with, and the tag that names it.
-#
-#   name=YYYY.MM.DD.HHMM   label for people, from the timestamp of the newest
-#                          commit that CHANGED SOMETHING SHIPPED (see SHIPPED)
-#   code=<int>             ordering key, minutes since 2020-01-01 at BUILD time
-#   tag=v<name>            what a release of this commit must be called
-#
-# Usage:  ci/version.sh [<commit-ish>]        (default HEAD)
-#
-# This exists as a script rather than inline workflow YAML for one reason:
-# release.yml only runs on `main` and on tags, so anything living inside it is
-# unverifiable until a release is already happening — which is the worst
-# possible moment to discover the version is wrong, because the failure mode
-# is silent (an update nobody is offered looks exactly like being current).
-# As a script it can be executed by a test on every push instead.
-#
-# The two clocks are deliberate and are NOT interchangeable:
-#
-#   The NAME answers "is this the same code?" — so it must read identically on
-#   every lane that builds this commit. Commit time does that; build time
-#   prints two different strings for one thing.
-#
-#   The CODE answers "may this be installed over that?" — so it must be
-#   monotonic BY CONSTRUCTION. Build time is; commit time is not (rebuild an
-#   older commit and it goes down, which on a phone is a refused install), and
-#   a commit COUNT is worse still, because it runs ahead on `dev` and inverts
-#   against `main`.
-set -euo pipefail
-
-readonly EPOCH_2020=1577836800 # 2020-01-01T00:00:00Z
-readonly REF="${1:-HEAD}"
-
-# Both clocks are overridable so a test can pin them. Nothing but tests should
-# set these — the defaults are the real derivation.
-# The paths that do NOT ship, in either artifact. Everything else counts.
-#
-# A DENYLIST, and the direction is the whole point. As an allowlist, the list
-# has to be updated by whoever adds a directory and nothing fails if they
-# don't — so the failure mode is a changed artifact keeping its old version,
-# silently, on a green run. That is a build lying about what it is. Inverted,
-# new content counts by default and the only way to wrongly EXCLUDE something
-# is to name it here deliberately.
-#
-# The two error directions are not symmetric, which is why this is not taste:
-#   wrongly excluded → changed artifact, unchanged version. A silent lie.
-#   wrongly included → version moves when nothing shipped. Cosmetic noise in
-#                      a string nobody sorts.
-#
-# THIS REPO SHIPS TWO ARTIFACTS FROM ONE DERIVATION, and that is why the list
-# is shorter than it looks like it should be. The server image ships cmd/,
-# internal/, shared/, web/, config.example.yaml and client/; the APK ships
-# android/. Neither ships the other's sources — but excluding android/ here
-# would stop an Android-only commit from moving the APK's OWN version, which
-# is the dangerous direction. So this is the union: exclude only what ships in
-# NEITHER, and accept that an Android commit also nudges the server's reported
-# version. Over-inclusion across the two, which is the harmless direction.
-#
-# The family's other repos (roundtable / roundtable-android) each keep a
-# tighter list because they are separate repos with one artifact apiece. Do
-# not copy theirs onto this one.
-readonly SHIPPED=(
-  .
-  ':!.gitea'          # CI workflows — including this script's own caller
-  ':!ci'              # CI scripts — including this script
-  ':!docs'
-  ':!tools'           # asset/font generators; their OUTPUT ships, they do not
-  ':!deploy'          # test-database bootstrap SQL
-  ':!bin'             # local `make build` output
-  ':!*.md'
-  ':!Makefile'
-  ':!docker-compose.yml'
-  ':!.env.example'
-  ':!.gitignore'
-  ':!.dockerignore'
-  ':!renovate.json'
-  ':!.golangci.yml'
-
-  # TESTS DO NOT SHIP, so they must not re-version an artifact.
-  #
-  # Named as globs rather than a directory because this repo has no tests/
-  # tree to exclude: Go tests sit inline beside the code they cover, and the
-  # web suite sits beside its modules. `go build` drops *_test.go outright and
-  # the Vite build never imports a .test.ts, so neither reaches an artifact.
-  #
-  # A commit touching a test AND its source still moves the version — the
-  # source path matches on its own. Only a test-ONLY commit is inert, which is
-  # the whole intent.
-  #
-  # Patterns match what exists today and nothing speculative: there are no
-  # .spec.* files, no __tests__/ directories and no androidTest/ tree. If any
-  # appear they will re-version until named here, which is the harmless
-  # direction and the reason this list is a denylist.
-  ':!*_test.go'                   # 158 files, inline beside the code
-  ':!*.test.ts'                   # 114 files
-  ':!*.test.js'
-  ':!android/app/src/test'        # JVM unit tests; no androidTest tree exists
-  ':!web/vitest.config.ts'        # test-harness config, not build config
-  ':!web/vitest.setup.ts'
-)
-
-commit_epoch="${MINSTREL_COMMIT_EPOCH:-}"
-if [ -z "${commit_epoch}" ]; then
-  commit_epoch="$(git log --format=%ct -1 "${REF}" -- "${SHIPPED[@]}")"
-  # Loudly, on purpose. A silent fallback here is the landmine this whole
-  # script exists to avoid: a plausible-looking version that is quietly wrong,
-  # on a green run. Realistically this means a shallow clone (no commit in
-  # range touches the shipped set) rather than a repo of pure CI config.
-  if [ -z "${commit_epoch}" ]; then
-    echo "version.sh: no commit under '${REF}' touches the shipped file set — shallow clone? (needs fetch-depth: 0)" >&2
-    exit 1
-  fi
-fi
-now_epoch="${MINSTREL_NOW_EPOCH:-$(date -u +%s)}"
-
-if ! name="$(date -u -d "@${commit_epoch}" +%Y.%m.%d.%H%M 2>/dev/null)"; then
-  echo "version.sh: could not read a commit timestamp from '${commit_epoch}'" >&2
-  exit 1
-fi
-
-if ! [ "${now_epoch}" -eq "${now_epoch}" ] 2>/dev/null; then
-  echo "version.sh: build timestamp '${now_epoch}' is not a number" >&2
-  exit 1
-fi
-code=$(( (now_epoch - EPOCH_2020) / 60 ))
-
-# Assert the shape here, at the source. A malformed name builds, signs and
-# publishes perfectly happily; it only surfaces later as an update channel
-# that has quietly stopped offering anything.
-if [[ ! "${name}" =~ ^[0-9]{4}\.[0-9]{2}\.[0-9]{2}\.[0-9]{4}$ ]]; then
-  echo "version.sh: name '${name}' is not YYYY.MM.DD.HHMM" >&2
-  exit 1
-fi
-
-# A non-positive key means the build clock is set before 2020, and every
-# comparison downstream would be nonsense.
-if [ "${code}" -le 0 ]; then
-  echo "version.sh: ordering key '${code}' is not positive — build clock wrong?" >&2
-  exit 1
-fi
-
-# Android's versionCode is a signed 32-bit int and the platform refuses an APK
-# whose code exceeds it. At ~525k minutes a year this is four thousand years
-# away in normal operation, so the realistic cause is a build machine with a
-# badly wrong clock — which produces a code that is not merely too large but
-# also unreachably high, permanently blocking every real build that follows
-# from ever outranking it. Cheaper to refuse the build than to discover that
-# from a phone that will not update.
-readonly VERSION_CODE_CEILING=2147483647
-if [ "${code}" -gt "${VERSION_CODE_CEILING}" ]; then
-  echo "version.sh: ordering key '${code}' exceeds versionCode's int32 ceiling — build clock wrong?" >&2
-  exit 1
-fi
-
-# KEY=VALUE, which is also exactly $GITHUB_OUTPUT's format.
-echo "name=${name}"
-echo "code=${code}"
-echo "tag=v${name}"

cmd/minstrel/admin.go

@@ -55,14 +55,12 @@ func runAdmin(args []string) error {
 	}
 }
 
-// adminResetPassword resets a user's login password (password_hash). It
-// recovers a locked-out operator when the bootstrap password was missed or
-// the DB volume was recreated (Fable #321) without DB surgery.
-//
-// It deliberately leaves subsonic_password alone. That column is stored in
-// plain text, and it used to receive the new login password here, so any
-// account recovered this way had its login password readable in the database
-// (#5026). The Subsonic password is generated separately in Settings.
+// adminResetPassword resets a user's credentials. It updates BOTH
+// password_hash (bcrypt, for /api/auth/login) and subsonic_password
+// (plaintext, required for Subsonic t+s token verification) so neither
+// auth path is left stale. Recovers a locked-out operator when the
+// bootstrap password was missed or the DB volume was recreated (Fable
+// #321) without DB surgery.
 func adminResetPassword(args []string) error {
 	fs := flag.NewFlagSet("admin reset-password", flag.ContinueOnError)
 	configPath := fs.String("config", os.Getenv("MINSTREL_CONFIG"), "path to YAML config file")
@@ -114,6 +112,13 @@ func adminResetPassword(args []string) error {
 	}); err != nil {
 		return fmt.Errorf("update password_hash: %w", err)
 	}
+	sp := pw
+	if err := q.SetSubsonicPassword(ctx, dbq.SetSubsonicPasswordParams{
+		ID:               user.ID,
+		SubsonicPassword: &sp,
+	}); err != nil {
+		return fmt.Errorf("update subsonic_password: %w", err)
+	}
 
 	if generated {
 		fmt.Printf("minstrel: password for %q reset.\nNew password: %s\n", *username, pw)

cmd/minstrel/main.go

@@ -14,7 +14,6 @@ import (
 
 	"github.com/jackc/pgx/v5/pgxpool"
 
-	"git.fabledsword.com/bvandeusen/minstrel/internal/acoustid"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/config"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/coplay"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/coverart"
@@ -123,31 +122,7 @@ func run() error {
 	}
 	defer pool.Close()
 
-	// Fingerprinting settings (M400 #3913): one instance, shared by the scanner,
-	// the fingerprint backfill, the duplicate sweep and the admin API, so a save
-	// reaches all of them without a restart. A load failure is logged, not fatal:
-	// the service falls back to the shipped defaults.
-	fpSettings, fpErr := library.NewFingerprintSettingsService(ctx, pool)
-	if fpErr != nil {
-		logger.Warn("fingerprint settings: using defaults", "err", fpErr)
-	}
-	scanner := library.New(pool, logger, cfg.Library.ScanPaths, fpSettings)
-
-	// Loudness analysis settings (M464 #4995): shared by the loudness backfill
-	// and the admin API, and falls back to the defaults like the above.
-	loudSettings, loudErr := library.NewLoudnessSettingsService(ctx, pool)
-	if loudErr != nil {
-		logger.Warn("loudness settings: using defaults", "err", loudErr)
-	}
-
-	// AcoustID lookup settings (M401): shared by the lookup worker and the
-	// admin API. A load failure leaves the lookup off.
-	acoustIDSettings, acoustIDErr := library.NewAcoustIDSettingsService(ctx, pool)
-	if acoustIDErr != nil {
-		logger.Warn("acoustid settings: using defaults (lookup off)", "err", acoustIDErr)
-	}
-	acoustIDLookup := library.NewAcoustIDLookupWorker(pool, logger.With("component", "acoustid_lookup"),
-		acoustIDSettings, acoustid.New(acoustid.DefaultBaseURL))
+	scanner := library.New(pool, logger, cfg.Library.ScanPaths)
 
 	contact := cfg.Library.ContactEmail
 	if contact == "" {
@@ -239,27 +214,6 @@ func run() error {
 	// SQL, no external calls; empty on single-user servers.
 	go coplay.NewWorker(pool, logger.With("component", "coplay")).Run(ctx)
 
-	// Fingerprint backfill (M400 #3908): fingerprints the tracks the scan never
-	// will — everything imported before fingerprinting existed, and rows derived
-	// by an older method. A worker of its own rather than a scan stage; see
-	// internal/library/fingerprint_backfill.go for why.
-	go library.NewFingerprintBackfillWorker(pool, logger.With("component", "fingerprint_backfill"), fpSettings).Run(ctx)
-
-	// Loudness backfill (M464 #4995): measures every track's loudness for
-	// normalization, new tracks included; the scan only drops a changed file's
-	// measurement. See internal/library/loudness_backfill.go.
-	go library.NewLoudnessBackfillWorker(pool, logger.With("component", "loudness_backfill"), loudSettings).Run(ctx)
-
-	// AcoustID lookup (M401): fills the recording MBIDs untagged tracks lack,
-	// so the similarity arms can see them. Idle until the operator adds a key
-	// and switches it on. See internal/library/acoustid_lookup.go.
-	go acoustIDLookup.Run(ctx)
-
-	// Duplicate sweep (M400 #3910): proposes groups of tracks holding one
-	// recording, from the fingerprints above. Sweeps only when fingerprints have
-	// changed since the last sweep.
-	go library.NewDuplicateSweepWorker(pool, logger.With("component", "duplicate_sweep"), fpSettings).Run(ctx)
-
 	// Start the tag-enrichment worker (#1490). Reconciles the compiled-in
 	// tag providers with tag_provider_settings, bumps the sources version if
 	// the provider set changed (re-opening settled rows), then drains tracks
@@ -403,22 +357,11 @@ func run() error {
 	srv.PlaylistScheduler = playlistScheduler
 	srv.RecSettings = recSettings
 	srv.TagSettings = tagSettings
-	srv.FingerprintSettings = fpSettings
-	srv.LoudnessSettings = loudSettings
-	srv.AcoustIDLookup = acoustIDLookup
-	// The sweeper above holds this same instance, so a save from the admin
-	// card changes what it does on its next tick (#3936).
-	srv.ReacqSettings = reacqSettings
 	srv.StreamSecret = cfg.StreamSecret
 	httpServer := &http.Server{
 		Addr:              cfg.Server.Address,
 		Handler:           srv.Router(),
 		ReadHeaderTimeout: 10 * time.Second,
-		// Closes keep-alive connections nobody is using. Deliberately no
-		// ReadTimeout or WriteTimeout: either would cut off audio streams and
-		// the SSE event stream. Request bodies get their own deadline in the
-		// server's limitRequestBody middleware instead.
-		IdleTimeout: 120 * time.Second,
 	}
 
 	errCh := make(chan error, 1)

docker-compose.yml

@@ -8,7 +8,7 @@ version: "3.9"
 # tests at it:
 #   make test-integration
 # (CI runs the same suite against its own ephemeral Postgres service —
-# see the `integration` job in .gitea/workflows/release.yml.)
+# see .gitea/workflows/test-go.yml.)
 #
 # Full stack (server + db):
 #   docker compose up --build

docs/hosting.md

@@ -1,92 +0,0 @@
-# Hosting Minstrel
-
-Minstrel serves plain HTTP on port 4533 and never terminates TLS itself. On a
-home network or a VPN you trust, that is all you need. Once the server is
-reachable from the internet, put it behind a reverse proxy that speaks HTTPS,
-and tell Minstrel about that proxy. This page covers both.
-
-## On a LAN or VPN
-
-Publish the port to the network and use `http://<host>:4533`:
-
-```yaml
-    ports: ['4533:4533']
-```
-
-If nothing sits in front of Minstrel, set **Admin → Integrations → Client IP
-detection** to 0. It defaults to 1, which assumes one proxy (see below for
-why that matters).
-
-## On the internet
-
-Three things, all required:
-
-1. **Don't publish 4533 to the world.** Bind it to the loopback interface so
-   only the proxy on the same host can reach it:
-
-   ```yaml
-       ports: ['127.0.0.1:4533:4533']
-   ```
-
-   If the proxy runs in another container on the same Docker network, drop
-   `ports:` entirely and point the proxy at `minstrel:4533`.
-
-2. **Terminate HTTPS at a reverse proxy.** Any proxy works. With Caddy, which
-   gets and renews certificates by itself:
-
-   ```
-   music.example.com {
-       reverse_proxy 127.0.0.1:4533
-   }
-   ```
-
-   Two settings matter for every proxy:
-   - **Don't buffer responses.** Live updates use Server-Sent Events and audio
-     is streamed; a buffering proxy holds both back. Caddy streams by default.
-     For nginx, set `proxy_buffering off;`.
-   - **Allow long-lived responses.** An event stream stays open for as long as
-     the app is. Raise the proxy's read timeout well past a minute (nginx:
-     `proxy_read_timeout 1h;`).
-
-3. **Tell Minstrel where it lives**, in **Admin → Integrations**:
-   - **Client IP detection:** the number of proxies in front of Minstrel. One
-     proxy (Caddy, Traefik, nginx) is 1; Cloudflare in front of Traefik is 2.
-     Minstrel uses this to find the real client address, for login rate
-     limits and the sessions list, and to tell whether a request arrived over
-     HTTPS.
-   - **Public address:** the URL people use, e.g. `https://music.example.com`.
-     Password-reset emails link here. **Until it is set, no reset email is
-     sent**, so a forged `Host` header can never put a reset token on a link
-     to someone else's server.
-
-### Why the proxy count matters
-
-Minstrel only believes `X-Forwarded-For` and `X-Forwarded-Proto` from the
-number of proxies you configure, counted from the right. Set it too high, or
-leave it at the default of 1 with no proxy in front, and a client can write
-those headers itself: it could claim any address to slip past the per-address
-login limit, or claim HTTPS. With no proxy, set it to 0.
-
-When the proxy reports HTTPS, Minstrel marks the session cookie `Secure` and
-sends `Strict-Transport-Security`. Over plain HTTP it does neither, and it
-never redirects to HTTPS, so LAN use keeps working unchanged.
-
-## First account
-
-A fresh server with no accounts prints a **setup token** in its log:
-
-```
-docker compose logs minstrel | grep setup_token
-```
-
-Creating the first account (which becomes the admin) requires that token, so
-whoever reaches a newly exposed server first can't claim it. The token
-changes on every restart until an account exists.
-
-## Android app
-
-The app connects over whatever URL you give it, HTTP or HTTPS. Once the
-server has a public HTTPS address, give the app that address so the session
-cookie never crosses the internet unencrypted. See
-[security notes](./security.md#android-allows-plain-http) for why plain HTTP
-is still allowed.

docs/security.md

@@ -1,105 +0,0 @@
-# Security notes
-
-What Minstrel does to protect accounts, and the reasoning behind the
-decisions that look odd at first. For deployment steps, see
-[hosting](./hosting.md).
-
-## Accounts and sessions
-
-- **Passwords** are stored as bcrypt hashes.
-- **Login, registration and password reset are rate-limited:** 10 failed
-  sign-ins per account and 50 per address per 15 minutes, with similar limits
-  on register, forgot-password and reset. The Subsonic `/rest` API shares the
-  login limits. An unknown username takes as long to reject as a wrong
-  password, so timing doesn't reveal which accounts exist.
-- **Sessions** are random 256-bit tokens; the server stores only their
-  SHA-256. A session ends after 30 days unused or 365 days in total. Changing
-  your password signs out your other devices; a password reset, or an admin
-  resetting it, signs out all of them.
-- **API keys** (the OpenSubsonic `apiKey`) are stored as SHA-256 too, so a
-  key is shown once, when you generate it in Settings, and can only be
-  replaced after that.
-- **The first account** on an empty server needs the setup token from the
-  server log (see [hosting](./hosting.md#first-account)).
-- **Password-reset links** are built only from the configured public address,
-  never from the request's `Host` header.
-
-## Requests
-
-- Request bodies are capped at 4 MiB and must arrive within 30 seconds.
-  Streams and the live-event connection are unaffected.
-- Every response carries `X-Content-Type-Options: nosniff`,
-  `Referrer-Policy: strict-origin-when-cross-origin`, a restrictive
-  `Permissions-Policy` and `X-Frame-Options: DENY`. The web app also gets a
-  `Content-Security-Policy` that allows only its own scripts, by hash.
-- Media responses are `Cache-Control: private`, so a shared cache never keeps
-  one user's audio or artwork for another.
-
-## CSRF: SameSite cookies plus JSON-only writes
-
-There are no CSRF tokens. The session cookie is `SameSite=Strict`, so
-browsers don't send it with requests that start on another site. That leaves
-one gap: SameSite treats every subdomain of the same registrable domain as the
-same site, so a different app on `other.example.com` could still send a
-request carrying the cookie. To close it, any state-changing `/api` request
-authenticated by the cookie must have a JSON body (`Content-Type:
-application/json`) or no body at all. An HTML form or a script on another
-origin can't send JSON without a CORS preflight, and Minstrel answers no
-cross-origin preflight. Requests authenticated with a bearer token or the
-Subsonic query parameters carry nothing a browser attaches on its own, so
-they aren't checked.
-
-## Subsonic sign-in, and the one password stored in plain text
-
-Classic Subsonic clients sign in with `t` and `s`: the MD5 of the password
-followed by a random salt. To check that, the server has to know the password
-itself, so supporting this sign-in method means storing a password Minstrel
-can read. That is the Subsonic password, and it is the only credential
-Minstrel keeps unhashed.
-
-- **The recommended way in is the API key.** Clients that support the
-  OpenSubsonic `apiKey` should use it. The key is stored hashed and can be
-  replaced at any time in Settings.
-- **The Subsonic password is never your login password.** Minstrel generates
-  it (**Settings → Subsonic password**), shows it once, and lets you replace
-  or turn it off. Because it is random, a copy of the database exposes access
-  to this server's Subsonic API and nothing else: it can't be a password you
-  also use somewhere else.
-- **`t`/`s` and `p=` sign-in are off for an account until it has a Subsonic
-  password.** Plain `p=` sign-in is additionally off server-wide unless
-  `subsonic.allow_plaintext_password` is enabled.
-- `minstrel admin reset-password` changes only the login password. Older
-  versions also copied it into the Subsonic password; upgrading clears every
-  Subsonic password once, so those copies are gone. An account that used
-  `t`/`s` sign-in needs a new Subsonic password generated in Settings.
-
-## Android allows plain HTTP
-
-The Android app permits cleartext connections, for two reasons that can't be
-narrowed to a list of hosts. The server address is whatever the user types,
-and many self-hosted servers run plain HTTP on a LAN. And UPnP, DLNA and
-Sonos speakers are controlled over plain HTTP at addresses that are only
-known once they're discovered. The reasoning lives in
-`android/app/src/main/res/xml/network_security_config.xml`.
-
-This doesn't weaken app updates: an APK altered in transit fails the
-platform's signature check. It does mean a server reached over plain HTTP
-across the internet exposes the session cookie in transit, which is why the
-[hosting guide](./hosting.md) puts public servers behind HTTPS.
-
-On the phone, the session cookie is encrypted with a key held in the Android
-Keystore, so a copy of the app's files doesn't yield a usable session.
-
-## Build pipeline
-
-Nothing is published unless every check passes: the Go, integration, web and
-Android test suites, `govulncheck` against the toolchain that builds the
-image, and `npm audit` on the packages that ship to the browser. See
-`.gitea/workflows/release.yml`.
-
-## Reporting a problem
-
-Open an issue on the
-[repository](https://git.fabledsword.com/bvandeusen/minstrel/issues), or
-contact the maintainer privately first if it's something that shouldn't be
-public until fixed.

go.mod

@@ -13,7 +13,6 @@ require (
 	github.com/jackc/pgx/v5 v5.9.2
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/crypto v0.51.0
-	golang.org/x/sync v0.22.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -26,7 +25,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.44.0 // indirect
-	// x/text >= v0.41.0 for GO-2026-6629 (panic in x/text/secure/precis, reached via pgxpool).
-	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 )