Fix the rebundle step: a non-matching grep must not kill it (#130)

The first `main` build after the version rework failed, and the bug was
mine. :latest was never moved — "Build and push" was skipped — so nothing
reached production, but every subsequent main push would have failed the
same way.

The runner invokes `shell: bash` as `bash -e -o pipefail`. Under pipefail a
command substitution reports the FIRST non-zero status in its pipeline, not
the last, so

  VAR="$(printf ... | grep -oP ... | grep -E '\.apk\.version$' | head -1)"

exits non-zero when that grep matches nothing, even though `head` succeeded.
With -e the step dies AT THE ASSIGNMENT — before reaching the `if` written
to handle exactly the empty case.

Which is what happened: v2026.09.09 predates sidecar assets, so its
`.apk.version` grep matched nothing and the step aborted instead of falling
through to the name-only branch I added in 9f3e0b8c for precisely that
release. The transition case was described correctly in that commit message
and then not handled in code.

The other two assignments carried the same latent hazard and had simply
never fired, because a release always has a tag_name and an .apk asset. So
the step's documented promise — "degrades to an empty client/ (404 update
channel) — never a wrong version — if no release or APK asset can be
resolved" — was never actually reachable under pipefail. All three now
carry `|| true`.

Reproduced under the runner's exact shell before fixing: without `|| true`
the script exits 1 with no output at all, proving it never reaches the
branch; with it, the fallback runs and emits the name-only sidecar.

Guarded, since the graceful degradation depends on this and the failure is
invisible until the one release that triggers it: the new test asserts every
command-substitution grep in that step ends with `|| true`, and was
falsified by removing it from the sidecar line.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SQ31KQpYbStyK5y58UmPLH

.dockerignore

@@ -9,7 +9,6 @@ web/build
 # Flutter mobile client — built separately on developer machines / Flutter CI.
 # Including it in the Go build context wastes ~70 files and invalidates the
 # `COPY . .` layer cache on every Flutter-only change.
-flutter_client/
 
 # Docs and IDE noise
 docs/

.gitea/workflows/release.yml

@@ -2,15 +2,51 @@ name: release
 
 # Builds and pushes the minstrel container image to the Gitea registry.
 #
+#   push to dev                  → :dev (freshly-built dev APK bundled)
 #   push to main                 → :main and :latest (latest-release APK bundled)
-#   push tag vYYYY.MM.DD     → :vYYYY.MM.DD and :latest (freshly-built APK bundled)
+#   push tag vYYYY.MM.DD.HHMM    → :vYYYY.MM.DD.HHMM and :latest (fresh APK bundled)
 #   workflow_dispatch            → manual trigger (same rules based on the ref)
 #
-# Release model: per-day CalVer tags (no trailing patch digit). The day's
+# The dev channel exists so testing a build does not require shipping one.
-# tag is intentionally mutable — if a second release happens the same day,
+# Before it, the only way to get an APK onto a phone was to cut a release,
-# move the tag with `git push -f origin vYYYY.MM.DD` and the image tag of
+# which made `main` the staging area by default. `:dev` carries its own
-# the same name gets overwritten. :latest is updated by every main push
+# freshly-built APK, signed with the SAME key as release builds — a different
-# AND every tag push, so it always reflects the newest blessed image.
+# key cannot install over the stable app, so anyone crossing channels would
+# have to uninstall and lose their data.
+#
+# :dev is published ALONE, with no per-commit tag. A rolling channel is
+# rolling by definition; a commit-addressable image for it would be a
+# rollback target nobody ever pulls, kept forever. Recovery on dev is to fix
+# forward.
+#
+# Note what this repo does NOT need: a cross-repo dispatch to refresh the
+# channel when its bundled APK is rebuilt. That mechanism exists elsewhere in
+# the family because the app and the server live in separate repos. Minstrel
+# is a monorepo — one push builds the APK and the image in the same run from
+# the same commit, so the channel cannot go stale against its own artifact.
+# The requirement is satisfied structurally; copying the mechanism would add
+# a moving part to fix a problem that does not exist here.
+#
+# Release model: the tag IS the artifact's version name with a `v` in front.
+# `v2026.09.10.1432` and `2026.09.10.1432` are the same string, derived from
+# the tagged commit's UTC timestamp — so there is no mismatch to reconcile
+# between what the tag says and what the APK reports, and nothing to look up
+# when minting one.
+#
+# TAGS ARE IMMUTABLE. Never move, retarget or delete a published tag. A
+# same-day second release is not a collision — HHMM makes every tag unique
+# by construction, so the answer is simply another tag.
+#
+# This block used to say the opposite: that the per-day tag was
+# "intentionally mutable" and that a same-day re-cut should
+# `git push -f origin vYYYY.MM.DD`. That instruction is what the family
+# rulebook now forbids outright, and it has incidents behind it — moving a
+# same-day tag forward once took a published release down with it. Anyone
+# installing from a tag is holding something the tag no longer points at,
+# which is a worse failure than an extra row in the tag list.
+#
+# :latest is updated by every main push AND every tag push, so it always
+# reflects the newest blessed image.
 #
 # APK pipeline: on tag pushes the android-release job builds + signs the
 # Android APK and uploads it as a workflow artifact. The image-release
@@ -24,33 +60,37 @@ name: release
 # :latest (not just tags), a main build with no APK would silently strip
 # the in-app update channel off :latest until the next release. So on
 # non-tag builds image-release pulls the MOST RECENT release's signed APK
-# and reconstructs its exact versionName (tag + commit-count, the same
+# AND the version sidecar published beside it — the recorded values, not
-# formula android-release bakes in) for the version sidecar — no rebuild,
+# recomputed ones — so no rebuild is needed, just a rebundle. Tag builds
-# just rebundle. Tag builds keep bundling their own freshly-built APK.
+# keep bundling their own freshly-built APK.
 #
 # Android testing (lint + detekt + unit tests, debug APK upload on main)
 # lives in android.yml and runs independently on every push.
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev]
     tags: ['v*']
     paths-ignore:
       - 'docs/**'
       - '**/*.md'
   workflow_dispatch:
 
-# Force-moving the per-day tag (or rapidly re-pushing to main) should
+# A rapid re-push to main should supersede the in-flight build — the
-# supersede the in-flight build — the operator explicitly wants the
+# operator explicitly wants the later commit to win. Tags no longer enter
-# later commit to win.
+# into this: they are immutable and unique, so no tag build can ever be
+# superseded by another run on the same ref.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   android-release:
-    name: Build signed APK (tag releases only)
+    name: Build signed APK (releases and dev)
-    if: startsWith(github.ref, 'refs/tags/v')
+    # Also builds on `dev`, which is what makes a test channel possible at
+    # all. Without it the only way to get a build onto a phone was to cut a
+    # release, which quietly turns `main` into the staging area.
+    if: startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/dev'
     runs-on: flutter-ci
     container:
       image: git.fabledsword.com/bvandeusen/ci-android:36
@@ -75,14 +115,18 @@ jobs:
     outputs:
       version_name: ${{ steps.ver.outputs.name }}
       version_code: ${{ steps.ver.outputs.code }}
+      channel: ${{ steps.ver.outputs.channel }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          # fetch-depth: 0 retrieves full history; default shallow clone
+          # Full history. The version name now reads only the tip commit's
-          # would return 1 for `git rev-list --count HEAD`, breaking the
+          # timestamp, so a shallow clone would technically serve — but this
-          # iteration suffix.
+          # job derives a value that ships to devices, and a shallow checkout
+          # changes what git-derived values resolve to WITHOUT failing. The
+          # whole failure class here is a green build carrying a wrong
+          # version, so the cheap guarantee is worth keeping.
           fetch-depth: 0
 
       - name: Compute release version
@@ -91,12 +135,49 @@ jobs:
         working-directory: ${{ github.workspace }}
         run: |
           set -euo pipefail
-          TAG="${GITHUB_REF#refs/tags/v}"
+          # The derivation lives in ci/version.sh, not here, so it can be
-          COMMIT_COUNT=$(git rev-list --count HEAD)
+          # executed by a test on every push. Anything inline in this file is
-          VERSION_NAME="${TAG}.${COMMIT_COUNT}"
+          # unverifiable until a release is already running.
-          echo "name=${VERSION_NAME}" >> "$GITHUB_OUTPUT"
+          out="$(ci/version.sh HEAD)"
-          echo "code=${COMMIT_COUNT}" >> "$GITHUB_OUTPUT"
+          printf '%s\n' "${out}" >> "$GITHUB_OUTPUT"
-          echo "::notice::APK version: ${VERSION_NAME} (code=${COMMIT_COUNT})"
+
+          # The channel is a property of the LANE, not of the commit, which is
+          # why it is derived here rather than in version.sh. Same commit built
+          # on dev and on main reports the same NAME and differs only here —
+          # that is the whole point of separating the two values.
+          if [ "${GITHUB_REF}" = "refs/heads/dev" ]; then
+            channel=dev
+          else
+            channel=stable
+          fi
+          echo "channel=${channel}" >> "$GITHUB_OUTPUT"
+          echo "::notice::APK $(printf '%s' "${out}" | tr '\n' ' ') channel=${channel}"
+
+      # Checked BEFORE the expensive work, not after it. "Attach APK to gitea
+      # Release" below resolves the release by tag and fails if it is absent —
+      # but that is the final step, so a tag pushed without a release built an
+      # APK for several minutes first and only then discovered it had nowhere to
+      # put it. Same check, seconds in instead of minutes.
+      #
+      # Releases are normally created through the API (which creates the tag and
+      # the release together, so this passes). A bare `git push origin vX` is the
+      # case this catches.
+      - name: Release must exist for this tag
+        if: startsWith(github.ref, 'refs/tags/v')
+        shell: bash
+        working-directory: ${{ github.workspace }}
+        env:
+          CI_TOKEN: ${{ secrets.CI_TOKEN }}
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF#refs/tags/}"
+          if ! curl -fsSL -o /dev/null \
+            -H "Authorization: token ${CI_TOKEN}" \
+            "https://git.fabledsword.com/api/v1/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}"; then
+            echo "::error::no release exists for ${TAG}. Create the release (which creates the tag) rather than pushing a bare tag — otherwise there is nothing to attach the APK to."
+            exit 1
+          fi
+          echo "::notice::release found for ${TAG}"
 
       - name: Cache Gradle dirs
         uses: actions/cache@v4
@@ -146,9 +227,15 @@ jobs:
           if-no-files-found: error
 
       - name: Attach APK to gitea Release
+        # Tag releases only. A dev build has no Release to hang assets on and
+        # does not need one — the :dev image bundles the APK, and the server
+        # serves it from /api/client/apk like any other.
+        if: startsWith(github.ref, 'refs/tags/v')
         shell: bash
         env:
           CI_TOKEN: ${{ secrets.CI_TOKEN }}
+          VERSION_NAME: ${{ steps.ver.outputs.name }}
+          VERSION_CODE: ${{ steps.ver.outputs.code }}
         run: |
           set -euxo pipefail
           TAG="${GITHUB_REF#refs/tags/}"
@@ -156,6 +243,20 @@ jobs:
           APK_PATH="app/build/outputs/apk/release/app-release.apk"
           ls -lh "${APK_PATH}"
 
+          # Publish the version sidecar as a release asset next to the APK.
+          #
+          # This is what lets a later :latest build stop RECONSTRUCTING the
+          # bundled APK's version and simply read what was recorded. The
+          # ordering key in particular cannot be re-derived after the fact —
+          # it is build-time minutes, so once this job ends the value exists
+          # nowhere else. Reconstruction could only ever recover the name,
+          # and only by duplicating a formula that then has to be kept in
+          # step across two files.
+          SIDECAR_PATH="/tmp/minstrel.apk.version"
+          printf '{"name":"%s","code":%s,"channel":"stable"}\n' \
+            "${VERSION_NAME}" "${VERSION_CODE}" > "${SIDECAR_PATH}"
+          cat "${SIDECAR_PATH}"
+
           RELEASE_JSON="$(curl -fsSL \
             -H "Authorization: token ${CI_TOKEN}" \
             "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/tags/${TAG}")"
@@ -177,6 +278,20 @@ jobs:
             exit 1
           fi
 
+          # Same treatment for the sidecar. Named `.apk.version` so the
+          # downloader's `\.apk$` match cannot pick it up by mistake.
+          SIDECAR_HTTP=$(curl -sS -L -o /tmp/upload-sidecar.out -w '%{http_code}' \
+            -H "Authorization: token ${CI_TOKEN}" \
+            -F "attachment=@${SIDECAR_PATH}" \
+            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=minstrel-${TAG}.apk.version")
+          echo "sidecar_upload_http=${SIDECAR_HTTP}"
+          cat /tmp/upload-sidecar.out || true
+          echo
+          if [ "${SIDECAR_HTTP}" -lt 200 ] || [ "${SIDECAR_HTTP}" -ge 300 ]; then
+            echo "::error::version sidecar upload returned HTTP ${SIDECAR_HTTP}"
+            exit 1
+          fi
+
   image-release:
     name: Build + push container image
     # `needs:` waits for android-release. For tag pushes android-release
@@ -197,11 +312,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          # Full history + tags so non-tag :latest builds can resolve the
+          # Shallow is fine here. This job used to need full history + tags to
-          # latest release tag's commit count and reconstruct the bundled
+          # re-derive the bundled APK's version from the tagged commit; it now
-          # APK's exact versionName (see "Bundle latest release APK" below).
+          # downloads the sidecar the release recorded, and touches git for
-          fetch-depth: 0
+          # nothing. MINSTREL_VERSION comes from GITHUB_REF, not from git.
-          fetch-tags: true
+          fetch-depth: 1
 
       - name: Detect buildable project
         id: guard
@@ -224,11 +339,20 @@ jobs:
             echo "args=-t ${IMAGE}:${VERSION} -t ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
             echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "::notice::Release build: ${VERSION} + latest"
+          elif [[ "${GITHUB_REF}" == "refs/heads/dev" ]]; then
+            # The rolling test channel, and :dev ALONE — deliberately no
+            # per-commit tag. A rolling channel is rolling by definition, so a
+            # commit-addressable image here would be a rollback target nobody
+            # has ever pulled, accumulating in the registry forever. Recovery
+            # on dev is to fix forward.
+            echo "args=-t ${IMAGE}:dev" >> "$GITHUB_OUTPUT"
+            echo "version=dev" >> "$GITHUB_OUTPUT"
+            echo "::notice::Dev-branch build: :dev"
           else
             # Main is the protected, post-PR-merge branch. Treat it as the
             # rolling stable channel — every main push moves :latest.
-            # Pinned consumers can target :vYYYY.MM.DD; everyone else
+            # Pinned consumers can target :vYYYY.MM.DD.HHMM, which never
-            # gets the newest main.
+            # moves; everyone else gets the newest main.
             echo "args=-t ${IMAGE}:main -t ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
             echo "version=main" >> "$GITHUB_OUTPUT"
             echo "::notice::Main-branch build: :main + :latest"
@@ -242,9 +366,12 @@ jobs:
             | docker login git.fabledsword.com -u "${{ github.actor }}" --password-stdin
 
       - name: Download signed APK artifact
-        # Tag pushes only — android-release just produced this. Non-tag
+        # Tag and dev pushes — android-release just produced this. Only `main`
-        # builds take the "Bundle latest release APK" path below instead.
+        # takes the "Bundle latest release APK" path below, because it is the
-        if: steps.guard.outputs.ready == 'true' && startsWith(github.ref, 'refs/tags/v')
+        # one ref that moves a channel without building an APK of its own.
+        if: >-
+          steps.guard.outputs.ready == 'true' &&
+          (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/dev')
         # Consuming half of the pair — never actions/download-artifact. Same fork,
         # same reason: upstream's client-side GHES check rejects this hostname
         # before it connects. bvandeusen/download-artifact mirrors
@@ -264,32 +391,41 @@ jobs:
           path: client/
 
       - name: Stage bundled APK + version sidecar
-        if: steps.guard.outputs.ready == 'true' && startsWith(github.ref, 'refs/tags/v')
+        if: >-
+          steps.guard.outputs.ready == 'true' &&
+          (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/dev')
         shell: bash
         env:
-          # Pulled from android-release.outputs.version_name so the
+          # All three pulled from android-release's outputs so the sidecar the
-          # sidecar string the server hands clients matches the
+          # server hands clients matches exactly what is baked into the APK
-          # versionName baked into the APK they're comparing against.
+          # they are comparing against.
           APK_VERSION_NAME: ${{ needs.android-release.outputs.version_name }}
+          APK_VERSION_CODE: ${{ needs.android-release.outputs.version_code }}
+          APK_CHANNEL: ${{ needs.android-release.outputs.channel }}
         run: |
           set -euxo pipefail
           # The artifact lands as `app-release.apk` (the original Gradle
           # output name). The Dockerfile COPYs client/* into /app/client/
           # and the server reads minstrel.apk + minstrel.apk.version.
           mv client/app-release.apk client/minstrel.apk
-          echo "${APK_VERSION_NAME}" > client/minstrel.apk.version
+          printf '{"name":"%s","code":%s,"channel":"%s"}\n' \
+            "${APK_VERSION_NAME}" "${APK_VERSION_CODE}" "${APK_CHANNEL}" \
+            > client/minstrel.apk.version
+          cat client/minstrel.apk.version
           ls -lh client/
 
       - name: Bundle latest release APK (non-tag :latest builds)
         # Main pushes don't build an APK, but they DO move :latest — so
         # without this the in-app update channel would vanish from :latest
         # until the next tag. Pull the most-recent release's signed APK and
-        # reconstruct its exact versionName (${TAG#v}.$(git rev-list --count
+        # the sidecar published beside it, so what the server reports is what
-        # TAG) — identical to android-release's formula) so the version
+        # that build actually recorded rather than something re-derived here.
-        # sidecar the server hands clients matches the installed build.
         # Degrades to an empty client/ (404 update channel) — never a wrong
-        # version — if no release / APK asset / tag-count can be resolved.
+        # version — if no release or APK asset can be resolved. That
-        if: steps.guard.outputs.ready == 'true' && !startsWith(github.ref, 'refs/tags/v')
+        # degradation only actually works because the greps below carry
+        # `|| true`; under the runner's default pipefail a non-matching grep
+        # kills the step instead of falling through to the empty-case branch.
+        if: steps.guard.outputs.ready == 'true' && github.ref == 'refs/heads/main'
         shell: bash
         env:
           CI_TOKEN: ${{ secrets.CI_TOKEN }}
@@ -301,19 +437,40 @@ jobs:
           if [ -z "${REL_JSON}" ]; then
             echo "::notice::no published release — image ships without bundled APK"; exit 0
           fi
-          TAG="$(printf '%s' "${REL_JSON}" | grep -oP '"tag_name":\s*"\K[^"]+' | head -1)"
+          # `|| true` on every one of these, and it is load-bearing rather
-          APK_URL="$(printf '%s' "${REL_JSON}" | grep -oP '"browser_download_url":\s*"\K[^"]+' | grep -E '\.apk$' | head -1)"
+          # than defensive habit. The runner already invokes this shell as
+          # `bash -e -o pipefail`, so a pipeline whose grep matches NOTHING
+          # exits non-zero even though `head` succeeded — and the step dies at
+          # the assignment, before ever reaching the `if` written to handle the
+          # empty case. Every "degrades gracefully" branch below is unreachable
+          # without this.
+          TAG="$(printf '%s' "${REL_JSON}" | grep -oP '"tag_name":\s*"\K[^"]+' | head -1)" || true
+          APK_URL="$(printf '%s' "${REL_JSON}" | grep -oP '"browser_download_url":\s*"\K[^"]+' | grep -E '\.apk$' | head -1)" || true
           if [ -z "${TAG}" ] || [ -z "${APK_URL}" ]; then
             echo "::notice::latest release '${TAG:-?}' has no APK asset — image ships without bundled APK"; exit 0
           fi
-          COUNT="$(git rev-list --count "${TAG}" 2>/dev/null || true)"
-          if [ -z "${COUNT}" ]; then
-            echo "::notice::could not resolve commit count for ${TAG} (tag not fetched?) — skipping APK bundle"; exit 0
-          fi
-          VERSION_NAME="${TAG#v}.${COUNT}"
           curl -fsSL -H "Authorization: token ${CI_TOKEN}" -o client/minstrel.apk "${APK_URL}"
-          echo "${VERSION_NAME}" > client/minstrel.apk.version
+
-          echo "::notice::bundled release APK ${TAG} as version ${VERSION_NAME}"
+          # Take the version the release RECORDED rather than recomputing it.
+          # This used to re-derive the name from the tagged commit, which meant
+          # the formula lived in two files that had to be kept in step, and it
+          # could only ever recover the name — the ordering key is build-time
+          # minutes and does not exist anywhere after that build ends.
+          SIDECAR_URL="$(printf '%s' "${REL_JSON}" | grep -oP '"browser_download_url":\s*"\K[^"]+' | grep -E '\.apk\.version$' | head -1)" || true
+          if [ -n "${SIDECAR_URL}" ]; then
+            curl -fsSL -H "Authorization: token ${CI_TOKEN}" -o client/minstrel.apk.version "${SIDECAR_URL}"
+            cat client/minstrel.apk.version
+          else
+            # Releases published before sidecars were attached. Their name is
+            # still recoverable from the tag, but their ordering key genuinely
+            # is not — so it is reported ABSENT rather than guessed. A wrong
+            # key is an install the platform refuses; an absent one just tells
+            # the client to fall back to comparing names, which is exactly
+            # what those builds already do.
+            echo "::notice::release ${TAG} predates the version sidecar — bundling with name only, no ordering key"
+            printf '{"name":"%s","code":null,"channel":"stable"}\n' "${TAG#v}" > client/minstrel.apk.version
+          fi
+          echo "::notice::bundled release APK from ${TAG}"
           ls -lh client/
 
       - name: Build and push
@@ -322,3 +479,79 @@ jobs:
           docker buildx build \
             --build-arg MINSTREL_VERSION="${{ steps.tags.outputs.version }}" \
             --push ${{ steps.tags.outputs.args }} .
+
+  # Verifies a tag release actually ended up complete, and names the specific
+  # thing that's missing if not.
+  #
+  # Added 2026-08-07 after v2026.08.07 was re-cut. The android-release job never
+  # started — no log was written at all — so all eight of its steps reported
+  # `failure` with none executed and image-release showed `skipped`. The run was
+  # red, but the *release page rendered fine*, and `main`'s own push build had
+  # already moved `:latest`, so the code was deployable and nothing looked
+  # obviously wrong. The release was simply missing its APK and its immutable
+  # `:vYYYY.MM.DD` image, which is easy to skim past.
+  #
+  # This job cannot prevent that (the cause was a runner failing to launch, not
+  # anything in this file). What it does is turn an incomplete release into an
+  # explicit, named error instead of eight mystery step failures — so the
+  # consequence is legible without having to infer it.
+  #
+  # `if: always()` is the whole point: it has to report precisely when the jobs
+  # above did NOT succeed.
+  verify-release:
+    name: Verify release artifacts (tag releases only)
+    needs: [android-release, image-release]
+    if: ${{ always() && startsWith(github.ref, 'refs/tags/v') }}
+    runs-on: go-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-go:1.26
+
+    steps:
+      - name: Release must have an APK attached
+        shell: bash
+        env:
+          CI_TOKEN: ${{ secrets.CI_TOKEN }}
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF#refs/tags/}"
+          REPO="${GITHUB_REPOSITORY}"
+
+          REL_JSON="$(curl -fsSL \
+            -H "Authorization: token ${CI_TOKEN}" \
+            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/tags/${TAG}" || true)"
+          if [ -z "${REL_JSON}" ]; then
+            echo "::error::no release found for ${TAG} — the tag exists but nothing was published"
+            exit 1
+          fi
+
+          APK="$(printf '%s' "${REL_JSON}" \
+            | grep -oP '"browser_download_url":\s*"\K[^"]+' \
+            | grep -E '\.apk$' | head -1 || true)"
+          if [ -z "${APK}" ]; then
+            echo "::error::release ${TAG} has NO APK attached — in-app update will offer nothing, and the bundled-APK path on future :latest builds has no source."
+            echo "::error::Fix by RE-RUNNING this workflow run. Do NOT delete and re-create the tag; if it fails again the runner never started the container, and the evidence is in act_runner on the host (Gitea will hold no job log)."
+            exit 1
+          fi
+
+          echo "::notice::APK attached: ${APK}"
+
+      # The other half. Checking only the APK would report success on a release
+      # whose image push failed — which is precisely the second thing that was
+      # missing when v2026.08.07 had to be re-cut. `always()` on this job means
+      # it runs even when image-release failed, so without this the guard would
+      # cheerfully verify an incomplete release.
+      - name: Immutable image tag must exist
+        shell: bash
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF#refs/tags/}"
+          IMAGE="git.fabledsword.com/bvandeusen/minstrel"
+
+          echo "${{ secrets.CI_TOKEN }}" \
+            | docker login git.fabledsword.com -u "${{ github.actor }}" --password-stdin
+
+          if ! docker manifest inspect "${IMAGE}:${TAG}" > /dev/null 2>&1; then
+            echo "::error::image ${IMAGE}:${TAG} was never pushed — the release tag has no immutable image, so there is nothing to pin or roll back to. Re-run this workflow run."
+            exit 1
+          fi
+          echo "::notice::image verified: ${IMAGE}:${TAG}"

.gitea/workflows/test-go.yml

@@ -32,6 +32,12 @@ on:
       - 'cmd/**'
       - '.golangci.yml'
       - '.gitea/workflows/test-go.yml'
+      # The release lane's own trigger is `main` + tags, so nothing it
+      # contains is exercised until a release is already running. These two
+      # entries are what let internal/server/release_version_test.go guard
+      # the version derivation on ordinary dev pushes instead.
+      - 'ci/**'
+      - '.gitea/workflows/release.yml'
 
 # pull_request trigger intentionally omitted — see test-web.yml for
 # the rationale (single-author repo, push covers PR-merge equivalent).

.gitignore

@@ -52,20 +52,6 @@ GEMINI.md
 .windsurfrules
 .aider.conf.yml
 
-# Flutter
-flutter_client/.dart_tool/
-flutter_client/.flutter-plugins
-flutter_client/.flutter-plugins-dependencies
-flutter_client/build/
-flutter_client/.idea/
-flutter_client/ios/Podfile.lock
-flutter_client/ios/Pods/
-flutter_client/android/.gradle/
-flutter_client/android/app/build/
-flutter_client/android/local.properties
-flutter_client/android/key.properties
-flutter_client/*.iml
-
 # Native Android (Kotlin/Compose) — M8 rewrite
 android/.gradle/
 android/.kotlin/

README.md

@@ -11,10 +11,22 @@ A self-hosted music server that thinks for you. Smart shuffle, contextual likes,
 - **OpenSubsonic-compatible.** Existing Subsonic clients (DSub, Symfonium, play:Sub, etc.) connect with no special configuration.
 - **Server-side smart shuffle.** Track-similarity vectors, dual-like model (general + contextual), and session memory keep mixes coherent across devices.
 - **ListenBrainz radio.** Session-aware "more like this" pulls from ListenBrainz similarity data, not a static genre tag.
-- **Lidarr integration.** Triggered scans, request-driven album imports, and a quarantine flow when something doesn't fit.
+- **Lidarr integration.** Triggered scans, request-driven album imports, and a quarantine flow when something doesn't fit — against a Lidarr instance *you* run and configure. Optional, and off until you supply a URL and API key.
 - **Built-in web SPA.** Full-feature library, search, queue, playlists, and admin — no separate frontend container to deploy.
 - **Native Android client, shipped with the server.** The signed APK is bundled into every image and attached to each [release](https://git.fabledsword.com/bvandeusen/minstrel/releases) — sideload it once, then the app self-updates straight from your own server (no app store, no separate download to track).
 
+## Scope and responsible use
+
+**Minstrel serves music you already have.** It is a library server: it indexes files on disk you point it at, and streams them to your own clients. It does not source, search for, or acquire content, and it has no opinion about where your files came from.
+
+Concretely, Minstrel ships **no** indexers, **no** trackers, **no** torrent / Usenet / NZB client, and **no** DRM circumvention of any kind. There is nothing to point at a content source because Minstrel has no such subsystem.
+
+The **Lidarr integration is optional and inert until you configure it.** You supply the URL and API key of a Lidarr instance you are already running; Minstrel then calls that instance's API to trigger scans, submit album requests, and reconcile imports. Minstrel neither bundles nor installs Lidarr, and configures no indexers on your behalf — Lidarr ships with none either, and any it uses are ones you added yourself.
+
+**What you put in your library, and what sources you configure in your own Lidarr, are your responsibility.** Copyright law applies to your collection the same way it applies to any other software that plays a file. Please respect it, and respect the terms of any service you connect.
+
+Minstrel is not affiliated with or endorsed by Lidarr, ListenBrainz, MusicBrainz, or Subsonic.
+
 ## Quickstart
 
 ```yaml
@@ -101,10 +113,17 @@ Most operational keys have a `MINSTREL_<SECTION>_<FIELD>` env override. Recommen
 Image tags (`git.fabledsword.com/bvandeusen/minstrel:<tag>`):
 
 - `:latest` — the newest blessed image. Moves on every `main` push **and** every release. Recommended for most operators.
-- `:vYYYY.MM.DD` — immutable per-day release tags. Pin one of these for a deployment you don't want moving under you. (Per-day CalVer — no trailing patch digit; a same-day re-cut moves the tag forward.)
+- `:vYYYY.MM.DD.HHMM` — immutable release tags, never moved or deleted. Pin one for a deployment you don't want changing under you. The tag is the build's own version name with a `v` in front, derived from the tagged commit's UTC timestamp, so two releases can never collide and a re-cut is simply a new tag.
 - `:main` — the rolling post-merge tip. Same image as `:latest` at push time; choose it if you want to track `main` explicitly rather than the release line.
+- `:dev` — the rolling test channel, rebuilt on every push to `dev` and carrying its own freshly-built Android APK. Run this when you want to try something before it ships. It moves constantly, has no per-commit tag to pin, and its only recovery path is forward — if a `:dev` image is broken, the fix is the next push, not a rollback.
 
-Every `:latest` and every `:vYYYY.MM.DD` bundles the current signed Android APK, so the in-app update channel is always live. Database migrations run automatically at startup; rollbacks require restoring a Postgres dump.
+Every `:latest`, `:vYYYY.MM.DD.HHMM` and `:dev` bundles a signed Android APK, so the in-app update channel is always live. All of them are signed with the same key, so a phone can move between the stable and dev channels without uninstalling — point it at a `:dev` server and the in-app updater offers that channel's build.
+
+The app reports which channel it is on alongside its version, and decides whether an update is available using the build's ordering key rather than its displayed name — the same value Android installs by, so an offer it makes is one the platform will accept.
+
+Database migrations run automatically at startup; rollbacks require restoring a Postgres dump.
+
+Releases before 2026-09-10 use the older per-day `:vYYYY.MM.DD` shape. Those tags still exist and still work — they are simply not extended.
 
 ## Specs
 

android/app/build.gradle.kts

@@ -21,13 +21,24 @@ android {
         applicationId = "com.fabledsword.minstrel"
         minSdk = 26
         targetSdk = 36
-        // versionName / versionCode are released-build values injected by
+        // versionName / versionCode are released-build values injected by CI.
-        // CI from the git tag + commit count. Local / debug builds fall
+        // Local / debug builds fall back to "dev" so the About card reads
-        // back to "dev" so the About card reads honestly. Releases ship
+        // honestly.
-        // versionName="YYYY.MM.DD.<commits>" (e.g. "2026.06.02.142") and
+        //
-        // versionCode=<commits>, which is monotonic forever and lets the
+        // versionName is "YYYY.MM.DD.HHMM" from the COMMIT's timestamp, so
-        // shared isVersionNewer comparator distinguish two same-day
+        // every lane building this source reports the same string and the
-        // re-cuts (the iteration suffix differs).
+        // channel is the only thing that differs between them.
+        //
+        // versionCode is minutes since 2020-01-01 at BUILD time. It is the
+        // value the platform decides installs by, so it must be monotonic by
+        // construction.
+        //
+        // This comment used to say versionCode was a commit count and that it
+        // was "monotonic forever". It was neither — a commit count runs ahead
+        // on `dev`, so a dev build outranked the `main` release meant to
+        // replace it and Android refused the install as a downgrade. Worth
+        // knowing the claim was here, stated as a reassurance, while the bug
+        // it denied was live.
         val versionNameOverride =
             (project.findProperty("MINSTREL_VERSION_NAME") as String?)?.takeIf { it.isNotBlank() }
         val versionCodeOverride =
@@ -150,7 +161,6 @@ dependencies {
     implementation(libs.compose.ui)
     implementation(libs.compose.ui.graphics)
     implementation(libs.compose.material3)
-    implementation(libs.compose.ui.text.google.fonts)
     debugImplementation(libs.compose.ui.tooling)
     implementation(libs.compose.ui.tooling.preview)
 

android/app/src/main/AndroidManifest.xml

@@ -8,7 +8,16 @@
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK" />
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <!-- In-app self-update. REQUEST_INSTALL_PACKAGES lets us hand an APK to the
+         platform installer at all; UPDATE_PACKAGES_WITHOUT_USER_ACTION (API 31+)
+         is what lets that install happen with NO confirm dialog. The platform
+         grants the silent path only when the installer opts in via
+         SessionParams.setRequireUserAction(USER_ACTION_NOT_REQUIRED), the
+         installed app targets API 29+, the installer holds this permission, and
+         the target is the installer itself — all true here, since Minstrel is
+         updating Minstrel. See update/data/SelfUpdateSession.kt. -->
     <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
+    <uses-permission android:name="android.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTION" />
     <uses-permission android:name="android.permission.BLUETOOTH_CONNECT" />
     <uses-permission android:name="android.permission.CHANGE_WIFI_MULTICAST_STATE" />
 
@@ -19,9 +28,9 @@
         android:fullBackupContent="@xml/backup_rules"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:supportsRtl="true"
         android:theme="@style/Theme.Minstrel"
-        android:usesCleartextTraffic="true"
         tools:targetApi="34">
 
         <!-- Portrait-locked until a tablet/landscape layout exists.
@@ -48,15 +57,11 @@
             </intent-filter>
         </service>
 
-        <provider
+        <!-- The FileProvider that used to live here existed solely to expose the
-            android:name="androidx.core.content.FileProvider"
+             downloaded update APK as a content:// URI for the old ACTION_VIEW
-            android:authorities="${applicationId}.fileprovider"
+             install intent. A PackageInstaller session takes a stream instead,
-            android:exported="false"
+             so both the provider and res/xml/file_paths.xml are gone — nothing
-            android:grantUriPermissions="true">
+             else in the app ever used that authority. -->
-            <meta-data
-                android:name="android.support.FILE_PROVIDER_PATHS"
-                android:resource="@xml/file_paths" />
-        </provider>
 
         <!-- On-demand WorkManager initialization: MinstrelApplication
              implements Configuration.Provider and supplies the

android/app/src/main/java/com/fabledsword/minstrel/admin/data/AdminRequestsRepository.kt

@@ -11,8 +11,6 @@ import javax.inject.Singleton
 
 /**
  * Read-through accessor for the admin cross-user requests queue.
- * Mirrors `flutter_client/lib/admin/admin_providers.dart`'s
- * AdminRequestsController.
  *
  * No Room caching — admin actions are infrequent and don't benefit
  * from offline scrollback. `approve` and `reject` fire direct REST

android/app/src/main/java/com/fabledsword/minstrel/admin/ui/AdminLandingScreen.kt

@@ -41,6 +41,7 @@ import com.fabledsword.minstrel.nav.AdminQuarantine
 import com.fabledsword.minstrel.nav.AdminRequests
 import com.fabledsword.minstrel.nav.AdminTagSources
 import com.fabledsword.minstrel.nav.AdminUsers
+import com.fabledsword.minstrel.shared.widgets.ShellContentWindowInsets
 import com.fabledsword.minstrel.shared.widgets.EmptyState
 import com.fabledsword.minstrel.shared.widgets.LoadingCentered
 import com.fabledsword.minstrel.shared.widgets.MinstrelTopAppBar
@@ -112,6 +113,7 @@ fun AdminLandingScreen(
 ) {
     val state by viewModel.uiState.collectAsStateWithLifecycle()
     Scaffold(
+        contentWindowInsets = ShellContentWindowInsets,
         modifier = Modifier.fillMaxSize(),
         topBar = {
             MinstrelTopAppBar(

android/app/src/main/java/com/fabledsword/minstrel/admin/ui/AdminQuarantineScreen.kt

@@ -28,6 +28,7 @@ import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import androidx.navigation.NavHostController
 import com.fabledsword.minstrel.models.AdminQuarantineItemRef
 import com.fabledsword.minstrel.nav.AdminQuarantine
+import com.fabledsword.minstrel.shared.widgets.ShellContentWindowInsets
 import com.fabledsword.minstrel.shared.widgets.EmptyState
 import com.fabledsword.minstrel.shared.widgets.ErrorRetry
 import com.fabledsword.minstrel.shared.widgets.LoadingCentered
@@ -42,6 +43,7 @@ fun AdminQuarantineScreen(
 ) {
     val state by viewModel.uiState.collectAsStateWithLifecycle()
     Scaffold(
+        contentWindowInsets = ShellContentWindowInsets,
         modifier = Modifier.fillMaxSize(),
         topBar = {
             MinstrelTopAppBar(

android/app/src/main/java/com/fabledsword/minstrel/admin/ui/AdminRequestsScreen.kt

@@ -27,6 +27,7 @@ import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import androidx.navigation.NavHostController
 import com.fabledsword.minstrel.models.RequestRef
 import com.fabledsword.minstrel.nav.AdminRequests
+import com.fabledsword.minstrel.shared.widgets.ShellContentWindowInsets
 import com.fabledsword.minstrel.shared.widgets.EmptyState
 import com.fabledsword.minstrel.shared.widgets.ErrorRetry
 import com.fabledsword.minstrel.shared.widgets.LoadingCentered
@@ -41,6 +42,7 @@ fun AdminRequestsScreen(
 ) {
     val state by viewModel.uiState.collectAsStateWithLifecycle()
     Scaffold(
+        contentWindowInsets = ShellContentWindowInsets,
         modifier = Modifier.fillMaxSize(),
         topBar = {
             MinstrelTopAppBar(

android/app/src/main/java/com/fabledsword/minstrel/admin/ui/AdminTagSourcesScreen.kt

@@ -35,6 +35,7 @@ import androidx.navigation.NavHostController
 import com.fabledsword.minstrel.models.AdminTagSourceRef
 import com.fabledsword.minstrel.models.TagSourceTestResult
 import com.fabledsword.minstrel.nav.AdminTagSources
+import com.fabledsword.minstrel.shared.widgets.ShellContentWindowInsets
 import com.fabledsword.minstrel.shared.widgets.EmptyState
 import com.fabledsword.minstrel.shared.widgets.ErrorRetry
 import com.fabledsword.minstrel.shared.widgets.LoadingCentered
@@ -49,6 +50,7 @@ fun AdminTagSourcesScreen(
 ) {
     val state by viewModel.uiState.collectAsStateWithLifecycle()
     Scaffold(
+        contentWindowInsets = ShellContentWindowInsets,
         modifier = Modifier.fillMaxSize(),
         topBar = {
             MinstrelTopAppBar(

android/app/src/main/java/com/fabledsword/minstrel/admin/ui/AdminUsersScreen.kt

@@ -49,6 +49,7 @@ import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import androidx.navigation.NavHostController
 import com.fabledsword.minstrel.models.AdminUserRef
 import com.fabledsword.minstrel.nav.AdminUsers
+import com.fabledsword.minstrel.shared.widgets.ShellContentWindowInsets
 import com.fabledsword.minstrel.shared.widgets.MinstrelTopAppBar
 import com.fabledsword.minstrel.shared.widgets.PullToRefreshScaffold
 import kotlinx.coroutines.launch
@@ -127,6 +128,7 @@ private fun AdminUsersScaffold(
     onRevokeInvite: (String) -> Unit,
 ) {
     Scaffold(
+        contentWindowInsets = ShellContentWindowInsets,
         modifier = Modifier.fillMaxSize(),
         topBar = {
             MinstrelTopAppBar(

android/app/src/main/java/com/fabledsword/minstrel/api/ErrorCopy.kt

@@ -8,8 +8,7 @@ import java.io.IOException
 
 /**
  * Maps server error codes (and common transport failures) to
- * friendly, sentence-case copy. Mirrors
+ * friendly, sentence-case copy.
- * `flutter_client/assets/error-copy.json` + `error_copy.dart`.
  *
  * Server errors are `{"error":{"code":"...","message":"..."}}`.
  * [fromThrowable] pulls the code out of a Retrofit [HttpException]'s

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/AdminInvitesApi.kt

@@ -10,8 +10,7 @@ import retrofit2.http.POST
 import retrofit2.http.Path
 
 /**
- * Retrofit interface for `/api/admin/invites`. Mirrors
+ * Retrofit interface for `/api/admin/invites`.
- * `flutter_client/lib/api/endpoints/admin_invites.dart`.
  *
  * Server TTL is hardcoded at 24h; the only configurable field is the
  * optional `note` on create.

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/AdminQuarantineApi.kt

@@ -6,8 +6,7 @@ import retrofit2.http.POST
 import retrofit2.http.Path
 
 /**
- * Retrofit interface for `/api/admin/quarantine`. Mirrors
+ * Retrofit interface for `/api/admin/quarantine`.
- * `flutter_client/lib/api/endpoints/admin_quarantine.dart`.
  *
  * Three resolution endpoints:
  *   - `resolve`        → admin reviewed, no action taken (clears flags).

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/AdminRequestsApi.kt

@@ -6,8 +6,7 @@ import retrofit2.http.POST
 import retrofit2.http.Path
 
 /**
- * Retrofit interface for `/api/admin/requests`. Mirrors
+ * Retrofit interface for `/api/admin/requests`.
- * `flutter_client/lib/api/endpoints/admin_requests.dart`.
  *
  * Server returns the same `requestView` shape as the user-side
  * `/api/requests`, so RequestWire is reused. Different listing scope —

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/AdminUsersApi.kt

@@ -10,8 +10,7 @@ import retrofit2.http.PUT
 import retrofit2.http.Path
 
 /**
- * Retrofit interface for `/api/admin/users`. Mirrors
+ * Retrofit interface for `/api/admin/users`.
- * `flutter_client/lib/api/endpoints/admin_users.dart`.
  *
  * Note: the PUT-auto-approve body field is `auto_approve`, NOT
  * `auto_approve_requests` — the request shape differs from the

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/AuthApi.kt

@@ -6,8 +6,7 @@ import retrofit2.http.Body
 import retrofit2.http.POST
 
 /**
- * Retrofit interface for `/api/auth`. Mirrors
+ * Retrofit interface for `/api/auth`.
- * `flutter_client/lib/api/endpoints/auth.dart`.
  *
  * The actual session-cookie capture happens in
  * [com.fabledsword.minstrel.api.AuthCookieInterceptor]; we don't

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/DiscoverApi.kt

@@ -14,7 +14,6 @@ import retrofit2.http.Query
 
 /**
  * Retrofit interface for Discover / Lidarr search / request creation.
- * Mirrors `flutter_client/lib/api/endpoints/discover.dart`.
  *
  * `/api/lidarr/search` has a 60s LRU on the server so quick re-types
  * of the same query are cheap.

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/EventsApi.kt

@@ -9,8 +9,7 @@ import retrofit2.http.Body
 import retrofit2.http.POST
 
 /**
- * Retrofit interface for `POST /api/events`. Mirrors the relevant
+ * Retrofit interface for `POST /api/events`. All four
- * slice of `flutter_client/lib/api/endpoints/events.dart`. All four
  * variants share the same URL — the discriminator is in the request
  * body's `type` field. Server contract is best-effort per spec;
  * callers (the live path in PlayEventsReporter) swallow errors and

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/HistoryApi.kt

@@ -5,10 +5,9 @@ import retrofit2.http.GET
 import retrofit2.http.Query
 
 /**
- * Retrofit interface for `/api/me/history`. Mirrors the relevant
+ * Retrofit interface for `/api/me/history` — history only. The profile,
- * subset of `flutter_client/lib/api/endpoints/me.dart` (only
+ * timezone and quarantine endpoints on `/api/me` live with their own
- * `history()`; profile / timezone / quarantine endpoints land with
+ * features rather than here.
- * their respective phases).
  */
 interface HistoryApi {
     @GET("api/me/history")

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/HomeApi.kt

@@ -4,10 +4,9 @@ import com.fabledsword.minstrel.models.wire.HomeIndexWire
 import retrofit2.http.GET
 
 /**
- * Retrofit interface for the Home discovery endpoint. Mirrors
+ * Retrofit interface for the Home discovery endpoint. Only the ID-only
- * `flutter_client/lib/api/endpoints/home.dart` — just the ID-only
+ * `/api/home/index` variant is used. The server also serves a heavier
- * `/api/home/index` variant. The Flutter port has a heavier
+ * `/api/home` (full embedded payload); we don't use it because
- * `/api/home` (full embedded payload) too; we don't use it because
  * the per-item hydration path (sync controller → Room → Flow) is
  * the only one the native client needs.
  */

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/LibraryApi.kt

@@ -3,14 +3,16 @@ package com.fabledsword.minstrel.api.endpoints
 import com.fabledsword.minstrel.models.wire.AlbumDetailWire
 import com.fabledsword.minstrel.models.wire.ArtistDetailWire
 import com.fabledsword.minstrel.models.wire.ArtistWire
+import com.fabledsword.minstrel.models.wire.GenreCountWire
+import com.fabledsword.minstrel.models.wire.PagedAlbumsWire
 import com.fabledsword.minstrel.models.wire.TrackWire
+import com.fabledsword.minstrel.models.wire.YearCountWire
 import retrofit2.http.GET
 import retrofit2.http.Path
 import retrofit2.http.Query
 
 /**
  * Retrofit interface for the server's native `/api/...` library surface.
- * Mirrors `flutter_client/lib/api/endpoints/library.dart` 1:1.
  *
  * Notes on shapes:
  *   - `GET /api/artists/{id}` returns ArtistDetailWire (ArtistRef fields
@@ -54,6 +56,49 @@ interface LibraryApi {
     @GET("api/library/shuffle")
     suspend fun shuffleLibrary(@Query("limit") limit: Int = 100): List<TrackWire>
 
+    // Browse axes (#367). Both indexes are unpaged by design: the client needs
+    // the whole set to render a browsable picker, and even a messy library
+    // yields hundreds of rows, not thousands.
+    //
+    // These read the server rather than the local cache on purpose. The cache
+    // is a full mirror of the library, but /api/library/sync ships tracks whose
+    // files are missing and carries no flag for it (#2704), while the browse
+    // index filters them out -- so a locally-computed index would disagree with
+    // the server's and with the web client. One source of truth wins over
+    // offline capability here until #2704 is resolved.
+    @GET("api/library/genres")
+    suspend fun getGenres(): List<GenreCountWire>
+
+    @GET("api/library/years")
+    suspend fun getAlbumYears(): List<YearCountWire>
+
+    /**
+     * Albums carrying [genre] on any of their tracks.
+     *
+     * @Query, never @Path: "Rock/Pop" is a real ID3 tag and a slash cannot
+     * survive a path segment. Retrofit percent-encodes query values correctly;
+     * a @Path would either 404 or silently address a different genre.
+     */
+    @GET("api/library/albums")
+    suspend fun getAlbumsByGenre(
+        @Query("genre") genre: String,
+        @Query("limit") limit: Int,
+        @Query("offset") offset: Int,
+    ): PagedAlbumsWire
+
+    /**
+     * Albums released in an inclusive year range. Pass the same year twice for
+     * a single year. Sending a genre alongside these is a deliberate 400 on the
+     * server (`unsupported_filter_combination`) -- they are separate axes.
+     */
+    @GET("api/library/albums")
+    suspend fun getAlbumsByYear(
+        @Query("year_from") yearFrom: Int,
+        @Query("year_to") yearTo: Int,
+        @Query("limit") limit: Int,
+        @Query("offset") offset: Int,
+    ): PagedAlbumsWire
+
     private companion object {
         const val SIMILAR_ARTISTS_LIMIT = 12
         const val TOP_TRACKS_LIMIT = 5

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/LikesApi.kt

@@ -7,8 +7,7 @@ import retrofit2.http.POST
 import retrofit2.http.Path
 
 /**
- * Retrofit interface for `/api/likes`. Mirrors
+ * Retrofit interface for `/api/likes`.
- * `flutter_client/lib/api/endpoints/likes.dart`.
  *
  * Path segment `kind` is one of "artists" | "albums" | "tracks"
  * (plural, matching the server route). The Repository hides that

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/MeApi.kt

@@ -11,7 +11,6 @@ import retrofit2.http.PUT
 
 /**
  * Retrofit interface for the `/api/me` endpoints — caller-scoped account endpoints.
- * Mirrors the relevant slice of `flutter_client/lib/api/endpoints/settings.dart`.
  *
  * History + timezone + system-playlists-status live under /api/me too
  * but are handled by their respective feature repositories; this

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/PlaylistsApi.kt

@@ -11,8 +11,7 @@ import retrofit2.http.Path
 import retrofit2.http.Query
 
 /**
- * Retrofit interface for `/api/playlists`. Mirrors
+ * Retrofit interface for `/api/playlists`.
- * `flutter_client/lib/api/endpoints/playlists.dart`.
  */
 interface PlaylistsApi {
     /**
@@ -54,7 +53,7 @@ interface PlaylistsApi {
      * the system playlist's tracks in rotation-aware order without
      * rebuilding — used by the Home play-button overlay so taps on For
      * You / Discover / Today's mix advance rotation rather than picking
-     * the stored order. Mirrors `playlists.dart.systemShuffle`.
+     * the stored order.
      */
     @GET("api/playlists/system/{kind}/shuffle")
     suspend fun systemShuffle(@Path("kind") variant: String): PlaylistDetailWire

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/QuarantineApi.kt

@@ -8,9 +8,8 @@ import retrofit2.http.POST
 import retrofit2.http.Path
 
 /**
- * Retrofit interface for `/api/quarantine`. Mirrors the relevant
+ * Retrofit interface for `/api/quarantine`: flag and unflag, plus the
- * parts of `flutter_client/lib/api/endpoints/quarantine.dart` (flag
+ * `/api/quarantine/mine` listing.
- * and unflag) plus the `/api/quarantine/mine` endpoint from `me.dart`.
  *
  * Both flag and unflag are user-scoped — callers act on their own
  * quarantine entries. The cross-user admin surface is a separate

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/RadioApi.kt

@@ -5,9 +5,7 @@ import retrofit2.http.GET
 import retrofit2.http.Query
 
 /**
- * Retrofit interface for `/api/radio`. Mirrors the relevant slice of
+ * Retrofit interface for `/api/radio`. The server picks a fresh shuffle each
- * `flutter_client/lib/api/endpoints/radio.dart` (a single GET that
- * returns the seeded queue). The server picks a fresh shuffle each
  * invocation — clients call this once per radio start.
  */
 interface RadioApi {

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/RequestsApi.kt

@@ -6,8 +6,7 @@ import retrofit2.http.GET
 import retrofit2.http.Path
 
 /**
- * Retrofit interface for the user-side `/api/requests`. Mirrors
+ * Retrofit interface for the user-side `/api/requests`.
- * `flutter_client/lib/api/endpoints/requests.dart`.
  *
  * Server scopes results to the caller — admins see only their own
  * requests through this endpoint. The cross-user admin view lives on

android/app/src/main/java/com/fabledsword/minstrel/api/endpoints/SearchApi.kt

@@ -5,8 +5,7 @@ import retrofit2.http.GET
 import retrofit2.http.Query
 
 /**
- * Retrofit interface for `GET /api/search`. Mirrors
+ * Retrofit interface for `GET /api/search`. Server returns 400
- * `flutter_client/lib/api/endpoints/search.dart`. Server returns 400
  * on empty/whitespace-only `q` — the caller is responsible for
  * guarding.
  */

android/app/src/main/java/com/fabledsword/minstrel/auth/AuthController.kt

@@ -17,8 +17,7 @@ import javax.inject.Inject
 import javax.inject.Singleton
 
 /**
- * Singleton facade over the auth state machine. Mirrors Flutter's
+ * Singleton facade over the auth state machine.
- * `AuthController` from `auth_provider.dart`.
  *
  * Cookie persistence is handled by [AuthCookieInterceptor] capturing
  * Set-Cookie on the login response; the user identity itself

android/app/src/main/java/com/fabledsword/minstrel/cache/ShuffleSource.kt

@@ -12,8 +12,7 @@ import javax.inject.Singleton
 private const val POOL_LIMIT = 100
 
 /**
- * Offline play sources over the local audio-cache index. Mirrors
+ * Offline play sources over the local audio-cache index.
- * `flutter_client/lib/cache/shuffle_source.dart`.
  *
  * Both pools are UNIONs over the cache regardless of storage bucket
  * (liked AND recently-played both included). The two-bucket split is
@@ -58,6 +57,14 @@ class ShuffleSource @Inject constructor(
     private suspend fun materialize(orderedIds: List<String>): List<TrackRef> {
         if (orderedIds.isEmpty()) return emptyList()
         val byId = trackDao.getByIds(orderedIds).associateBy { it.id }
-        return orderedIds.mapNotNull { byId[it]?.toDomain() }
+        return orderedIds.mapNotNull { id ->
+            // Clear the server's missing mark (#2704). Every id reaching here
+            // came through residentIdsByRecency, which already proved the
+            // AUDIO is in the local cache — so these play regardless of what
+            // the server has lost, and the queue filter in PlayerController
+            // would otherwise throw away tracks that work perfectly. Missing
+            // means "cannot stream", not "cannot play".
+            byId[id]?.toDomain()?.copy(unavailable = false)
+        }
     }
 }

android/app/src/main/java/com/fabledsword/minstrel/cache/audiocache/CacheConfig.kt

@@ -1,7 +1,7 @@
 package com.fabledsword.minstrel.cache.audiocache
 
 /**
- * Defaults for the 2-bucket audio cache. Matches the Flutter client.
+ * Defaults for the 2-bucket audio cache.
  *
  *  - `likedCapBytes`: cap for the protected bucket — cached files for
  *    tracks the user has liked. Evicted only after the rolling bucket

android/app/src/main/java/com/fabledsword/minstrel/cache/audiocache/CacheSettings.kt

@@ -6,8 +6,7 @@ private const val FIVE_GIB_BYTES = 5L * 1024 * 1024 * 1024
 private const val DEFAULT_PREFETCH_WINDOW = 5
 
 /**
- * User-tunable audio cache settings. Mirrors Flutter's `CacheSettings`
+ * User-tunable audio cache settings. Persisted as a JSON
- * (cache_settings_provider.dart) field-for-field. Persisted as a JSON
  * blob on the auth_session single-row table via [AuthStore].
  *
  * - [likedCapBytes]: budget for cached files of liked tracks. 0 means

android/app/src/main/java/com/fabledsword/minstrel/cache/db/AppDatabase.kt

@@ -65,9 +65,13 @@ import com.fabledsword.minstrel.cache.db.entities.SyncMetadataEntity
         AuthSessionEntity::class,
         DiagnosticEventEntity::class,
     ],
+    // v8: + cached_tracks.missing, the server's missing-file mark (#2704),
+    // so cache-first surfaces stop offering files that cannot stream.
     // v7: + diagnostic_events table (M9) and the diagnosticsOptOut column
-    // on auth_session. Pre-v1 destructive fallback rebuilds on mismatch.
+    // on auth_session. Pre-v1 destructive fallback rebuilds on mismatch —
-    version = 7,
+    // which is exactly right here: the next sync refills every row with the
+    // new column populated, so there is nothing to migrate by hand.
+    version = 8,
     exportSchema = true,
 )
 @TypeConverters(MinstrelTypeConverters::class)

android/app/src/main/java/com/fabledsword/minstrel/cache/db/dao/CachedPlaylistDao.kt

@@ -59,7 +59,6 @@ interface CachedPlaylistDao {
 
     /**
      * Atomically reconciles the cache against the fresh list response.
-     * Mirrors `flutter_client/lib/playlists/playlists_provider.dart:54` —
      * `BuildSystemPlaylists` rotates system-playlist UUIDs every
      * rebuild, so upsert alone leaves stale rows whose detail fetch
      * 404s. Delete any of the user's rows not in [freshOwnedIds] (this

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/AudioCacheIndexEntity.kt

@@ -8,7 +8,7 @@ import kotlinx.datetime.Instant
 
 /**
  * One row per fully-downloaded audio file. Mirrors
- * `flutter_client/lib/cache/db.dart`'s `AudioCacheIndex` Drift table.
+ * the Flutter client's `AudioCacheIndex` Drift table.
  *
  * Drives the 2-bucket LRU eviction (Phase 12 AudioCacheEvictionWorker):
  *   - `incidental` files (streamed-and-cached side effect) evict first

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/CachedAlbumEntity.kt

@@ -6,7 +6,7 @@ import kotlinx.datetime.Clock
 import kotlinx.datetime.Instant
 
 /**
- * Cache row for one album. Mirrors `flutter_client/lib/cache/db.dart`'s
+ * Cache row for one album. Mirrors the Flutter client's
  * `CachedAlbums` Drift table.
  */
 @Entity(tableName = "cached_albums")

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/CachedArtistEntity.kt

@@ -6,7 +6,7 @@ import kotlinx.datetime.Clock
 import kotlinx.datetime.Instant
 
 /**
- * Cache row for one artist. Mirrors `flutter_client/lib/cache/db.dart`'s
+ * Cache row for one artist. Mirrors the Flutter client's
  * `CachedArtists` Drift table.
  *
  * Column names follow Kotlin idiom (camelCase) rather than Drift's

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/CachedHomeIndexEntity.kt

@@ -6,7 +6,7 @@ import kotlinx.datetime.Instant
 
 /**
  * Per-item row driving the Home screen sections. Mirrors
- * `flutter_client/lib/cache/db.dart`'s `CachedHomeIndex` Drift table.
+ * the Flutter client's `CachedHomeIndex` Drift table.
  *
  * `section` is one of (matching /api/home keys):
  *   - "recently_added_albums"

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/CachedLikeEntity.kt

@@ -5,7 +5,7 @@ import kotlinx.datetime.Clock
 import kotlinx.datetime.Instant
 
 /**
- * Like membership row. Mirrors `flutter_client/lib/cache/db.dart`'s
+ * Like membership row. Mirrors the Flutter client's
  * `CachedLikes` Drift table. Composite primary key — one user may
  * independently like a track AND its album AND its artist; rows are
  * disambiguated by the (userId, entityType, entityId) triple.

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/CachedMutationEntity.kt

@@ -7,7 +7,7 @@ import kotlinx.datetime.Instant
 
 /**
  * One row per pending offline-write. Mirrors
- * `flutter_client/lib/cache/db.dart`'s `CachedMutations` Drift table.
+ * the Flutter client's `CachedMutations` Drift table.
  *
  * MutationQueue.enqueue() inserts a row when a server-write fails with
  * an IOException; MutationReplayer.drain() pops and re-attempts each

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/CachedPlaylistEntity.kt

@@ -7,7 +7,7 @@ import kotlinx.datetime.Instant
 
 /**
  * Cache row for one playlist (user or system). Mirrors
- * `flutter_client/lib/cache/db.dart`'s `CachedPlaylists` Drift table.
+ * the Flutter client's `CachedPlaylists` Drift table.
  *
  * `systemVariant` is null for user playlists and one of
  * "for_you" / "songs_like_artist" / "discover" / "todays_mix" / etc.

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/CachedPlaylistTrackEntity.kt

@@ -4,7 +4,7 @@ import androidx.room.Entity
 
 /**
  * Ordered membership of tracks within a playlist. Mirrors
- * `flutter_client/lib/cache/db.dart`'s `CachedPlaylistTracks` Drift table.
+ * the Flutter client's `CachedPlaylistTracks` Drift table.
  * Composite PK so the same track can only appear once per playlist;
  * `position` carries the ordering.
  */

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/CachedQuarantineEntity.kt

@@ -7,7 +7,7 @@ import kotlinx.datetime.Instant
 
 /**
  * The current user's quarantine flag for one track. Mirrors
- * `flutter_client/lib/cache/db.dart`'s `CachedQuarantineMine` Drift
+ * the Flutter client's `CachedQuarantineMine` Drift
  * table.
  *
  * The flat denormalized track/album/artist columns let the Quarantine

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/CachedResumeStateEntity.kt

@@ -8,7 +8,7 @@ import kotlinx.datetime.Instant
 /**
  * Single-row snapshot of the last playback session — queue (as JSON),
  * current index, position, and source tag. Mirrors
- * `flutter_client/lib/cache/db.dart`'s `CachedResumeState` Drift table.
+ * the Flutter client's `CachedResumeState` Drift table.
  *
  * Lets a torn-down session (the player's idle/dismissed teardown)
  * resume on next launch; without it the headset / lock-screen play

android/app/src/main/java/com/fabledsword/minstrel/cache/db/entities/CachedTrackEntity.kt

@@ -6,8 +6,12 @@ import kotlinx.datetime.Clock
 import kotlinx.datetime.Instant
 
 /**
- * Cache row for one track. Mirrors `flutter_client/lib/cache/db.dart`'s
+ * Cache row for one track. Mirrors the Flutter client's
  * `CachedTracks` Drift table.
+ *
+ * [missing] carries the server's missing-file mark (#2704). Every read that
+ * can put a track in front of the user — or in a queue — must exclude it, and
+ * the DAO queries do that rather than each call site remembering to.
  */
 @Entity(tableName = "cached_tracks")
 data class CachedTrackEntity(
@@ -21,5 +25,6 @@ data class CachedTrackEntity(
     val filePath: String? = null,
     val fileFormat: String? = null,
     val genre: String? = null,
+    val missing: Boolean = false,
     val fetchedAt: Instant = Clock.System.now(),
 )

android/app/src/main/java/com/fabledsword/minstrel/cache/sync/SyncController.kt

@@ -219,4 +219,5 @@ private fun SyncTrackWire.toEntity(): CachedTrackEntity = CachedTrackEntity(
     filePath = filePath,
     fileFormat = fileFormat,
     genre = genre,
+    missing = missing,
 )

android/app/src/main/java/com/fabledsword/minstrel/connectivity/NetworkStatusController.kt

@@ -1,6 +1,9 @@
 package com.fabledsword.minstrel.connectivity
 
 import androidx.compose.runtime.staticCompositionLocalOf
+import androidx.lifecycle.DefaultLifecycleObserver
+import androidx.lifecycle.LifecycleOwner
+import androidx.lifecycle.ProcessLifecycleOwner
 import com.fabledsword.minstrel.BuildConfig
 import com.fabledsword.minstrel.auth.AuthStore
 import com.fabledsword.minstrel.di.ApplicationScope
@@ -41,6 +44,12 @@ private const val ARBITRATE_MIN_GAP_MS = 2_000L
  *  - reportSuccess / reportFailure from the API interceptor, the audio data
  *    source, and the playback-error reporter.
  *  - recheck() from pull-to-refresh and the banner.
+ *  - a forced probe when the app returns to the foreground (#1209). Without
+ *    it a stale ServerDown outlived the condition that caused it: the poll
+ *    loop's delay() is throttled while screen-off/doze, so recovery waited on
+ *    whenever the OS next let the loop run. Meanwhile ServerDown makes
+ *    OfflineGatedDataSource refuse every uncached track, so the app declined
+ *    to play music that would have played fine.
  *
  * Version compatibility is a byproduct of the same /healthz response.
  *
@@ -53,7 +62,7 @@ class NetworkStatusController @Inject constructor(
     connectivity: ConnectivityObserver,
     private val authStore: AuthStore,
     retrofit: Retrofit,
-) {
+) : DefaultLifecycleObserver {
     private val api: HealthzApi = retrofit.create(HealthzApi::class.java)
     private val machine = ReachabilityMachine()
     private val lastProbeAtMs = AtomicLong(0)
@@ -74,6 +83,7 @@ class NetworkStatusController @Inject constructor(
     private val intents = Channel<Intent>(Channel.UNLIMITED)
 
     init {
+        ProcessLifecycleOwner.get().lifecycle.addObserver(this)
         scope.launch { reduceLoop() }
         scope.launch {
             connectivity.online.collect { up ->
@@ -100,6 +110,20 @@ class NetworkStatusController @Inject constructor(
         scope.launch { probeOnce(force = true) }
     }
 
+    /**
+     * App returned to the foreground — probe now rather than waiting for the
+     * poll loop (#1209).
+     *
+     * The link-return probe in `init` does NOT cover this: it fires on a
+     * connectivity *change*, and an app backgrounded on stable Wi-Fi sees none.
+     * force = true so this also bypasses the ARBITRATE_MIN_GAP_MS throttle —
+     * a user bringing the app up is exactly when a stale banner and a refused
+     * track are most visible, and it's a once-per-foreground cost.
+     */
+    override fun onStart(owner: LifecycleOwner) {
+        recheck()
+    }
+
     private suspend fun reduceLoop() {
         for (intent in intents) {
             val now = System.currentTimeMillis()

android/app/src/main/java/com/fabledsword/minstrel/connectivity/ReachabilityMachine.kt

@@ -4,6 +4,24 @@ internal const val ESCALATE_AFTER_MS = 120_000L
 internal const val CORROBORATION_WINDOW_MS = 30_000L
 internal const val CORROBORATION_OP_THRESHOLD = 2
 
+/**
+ * Minimum gap between op failures for them to count as SEPARATE evidence
+ * (#1209).
+ *
+ * A link handoff fails every in-flight request at once, so a burst is one
+ * event producing N failures — not N independent observations that the server
+ * is gone. Without this, two simultaneous failures corroborated each other
+ * straight to Unreachable, and ServerDown makes OfflineGatedDataSource refuse
+ * every uncached track. The app declined to play music that would have played
+ * fine, for a blip that had already resolved.
+ *
+ * 3s is comfortably above the sub-second window an OS handoff occupies while
+ * still letting a genuine outage corroborate within seconds once a client
+ * retries. The sustained-time backstop covers the case where nothing retries
+ * at all — and if nothing is asking, a late ServerDown costs nothing.
+ */
+internal const val CORROBORATION_MIN_SPACING_MS = 3_000L
+
 /**
  * Pure reachability state machine. No Android, no coroutines, no real clock —
  * every entry point takes `nowMs`, so it is fully deterministic and unit-
@@ -46,9 +64,17 @@ class ReachabilityMachine {
         recentOpFailures.clear()
     }
 
-    /** A real network op failed. Ambiguous on its own — records corroboration. */
+    /**
+     * A real network op failed. Ambiguous on its own — records corroboration.
+     *
+     * Failures arriving within [CORROBORATION_MIN_SPACING_MS] of the last
+     * recorded one are dropped rather than stacked: see that constant for why
+     * a burst must not corroborate itself.
+     */
     fun onOpFailure(nowMs: Long) {
         pruneOpFailures(nowMs)
+        val last = recentOpFailures.lastOrNull()
+        if (last != null && nowMs - last < CORROBORATION_MIN_SPACING_MS) return
         recentOpFailures.addLast(nowMs)
     }
 

android/app/src/main/java/com/fabledsword/minstrel/diagnostics/DiagnosticsReporter.kt

@@ -18,6 +18,7 @@ import com.fabledsword.minstrel.connectivity.NetworkStatusController
 import com.fabledsword.minstrel.di.ApplicationScope
 import com.fabledsword.minstrel.player.PlayerController
 import com.fabledsword.minstrel.player.RemotePlayerState
+import com.fabledsword.minstrel.player.TransportObservation
 import com.fabledsword.minstrel.player.output.OutputPickerController
 import com.fabledsword.minstrel.player.output.OutputRoute
 import dagger.hilt.android.qualifiers.ApplicationContext
@@ -103,6 +104,7 @@ class DiagnosticsReporter @Inject constructor(
             launch { collectUpnpDrops() }
             launch { collectPlayerState() }
             launch { collectTrackChanges() }
+            launch { collectTransportFlap() }
             launch { collectRoutes() }
             launch { heartbeatLoop() }
         }
@@ -191,6 +193,67 @@ class DiagnosticsReporter @Inject constructor(
             }
     }
 
+    /**
+     * Catch the renderer rapidly leaving and re-entering PLAYING.
+     *
+     * The operator reports the Sonos "play pause play pause, like someone
+     * pressing it every half second", usually as a track starts, cleared by a
+     * manual pause or skip. Nothing here could see that: `player_state`
+     * carries source/loading/error but not playing, `track_change` needs the
+     * index to move, and the heartbeat samples once per 45s. The symptom fell
+     * through every existing collector, which is why it has only ever been
+     * described and never measured.
+     *
+     * Records every raw transport change (cheap — steady playback produces
+     * a couple per track) and, when they come in a burst, one summary event
+     * carrying the whole sequence. The summary is the useful artefact: it
+     * pairs the renderer's states with local-vs-Sonos track and position, so
+     * an episode says whether the app and the renderer disagreed about which
+     * track was playing, or agreed while the renderer rebuffered.
+     *
+     * See [TransportObservation] on the 1 Hz sampling limit.
+     */
+    private suspend fun collectTransportFlap() {
+        val detector = TransportFlapDetector()
+        playerController.transportEvents.collect { obs ->
+            record("upnp_sync", buildJsonObject {
+                put("event", "transport")
+                put("state", obs.state)
+                put("status_ok", obs.statusOk)
+                put("sonos_track", obs.trackNumber)
+                put("sonos_pos_ms", obs.positionMs)
+                put("play_intent", obs.playIntent)
+            })
+            detector.onChange(obs)?.let { recordFlapSummary(it) }
+        }
+    }
+
+    private suspend fun recordFlapSummary(recent: List<TransportObservation>) {
+        val ui = playerController.uiState.value
+        val casting = outputPicker.routesState.value.current.protocol !=
+            OutputRoute.Protocol.SYSTEM
+        val spanMs = recent.last().atElapsedMs - recent.first().atElapsedMs
+        record("upnp_sync", buildJsonObject {
+            put("event", "transport_flap")
+            put("changes", recent.size)
+            put("window_ms", spanMs)
+            // The sequence itself, e.g. "PLAYING>TRANSITIONING>STOPPED>PLAYING".
+            // Whether STOPPED appears at all is the first question to ask of a
+            // captured episode.
+            put("sequence", recent.joinToString(">") { it.state })
+            put("sonos_positions_ms", recent.joinToString(",") { it.positionMs.toString() })
+            put("sonos_tracks", recent.joinToString(",") { it.trackNumber.toString() })
+            put("local_index", ui.queueIndex)
+            put("local_track_id", ui.currentTrack?.id ?: "")
+            put("local_pos_ms", ui.positionMs)
+            putSonos(this, casting)
+            put("upnp_loading", ui.isUpnpLoading)
+            put("server_health", networkStatus.state.value.name)
+            put("route", outputPicker.routesState.value.current.name)
+            addPowerFields(this)
+        })
+    }
+
     private suspend fun collectRoutes() {
         // 'playback' — route changes happen for all outputs. This only ever
         // logs the ACTIVE route (routesState.current), so no "connected" flag.

android/app/src/main/java/com/fabledsword/minstrel/diagnostics/TransportFlapDetector.kt

@@ -0,0 +1,75 @@
+package com.fabledsword.minstrel.diagnostics
+
+import com.fabledsword.minstrel.player.TransportObservation
+
+/**
+ * Decides when a run of renderer transport changes is a *flap* — the renderer
+ * repeatedly failing to settle — rather than an ordinary track transition.
+ *
+ * The operator reports the Sonos "play pause play pause, like someone pressing
+ * it every half second", usually as a track starts. No diagnostic event could
+ * see it, so it has been described several times and measured never. This is
+ * the rule that decides when an episode is worth writing down.
+ *
+ * Pure decision state, like [com.fabledsword.minstrel.player.RemoteStallWatchdog]:
+ * the caller owns the flow and the recording, this only answers "is this an
+ * episode, and which readings make it up". Keeps the windowing and the
+ * one-episode-one-summary rule testable without a renderer or a clock.
+ */
+class TransportFlapDetector(
+    private val windowMs: Long = FLAP_WINDOW_MS,
+    private val minChanges: Int = FLAP_MIN_CHANGES,
+    private val summaryCooldownMs: Long = FLAP_SUMMARY_COOLDOWN_MS,
+) {
+    private val recent = ArrayDeque<TransportObservation>()
+    private var lastSummaryAtMs: Long? = null
+
+    /**
+     * Feed one transport change. Returns the readings making up an episode
+     * worth recording, or null when there is nothing to say.
+     *
+     * The returned list is a copy: the caller may hold it while more readings
+     * arrive.
+     */
+    fun onChange(observation: TransportObservation): List<TransportObservation>? {
+        recent.addLast(observation)
+        dropReadingsOlderThan(observation.atElapsedMs)
+        if (!isEpisode(observation.atElapsedMs)) return null
+        lastSummaryAtMs = observation.atElapsedMs
+        return recent.toList()
+    }
+
+    private fun dropReadingsOlderThan(nowMs: Long) {
+        while (recent.isNotEmpty() && nowMs - recent.first().atElapsedMs > windowMs) {
+            recent.removeFirst()
+        }
+    }
+
+    /**
+     * Enough changes packed together, and far enough from the last thing we
+     * wrote down. The cooldown is what keeps one episode to one summary: a
+     * sustained fault produces a change every poll, and a summary per reading
+     * would bury the per-change events underneath them.
+     */
+    private fun isEpisode(nowMs: Long): Boolean {
+        val since = lastSummaryAtMs
+        val cooled = since == null || nowMs - since >= summaryCooldownMs
+        return recent.size >= minChanges && cooled
+    }
+
+    /** Forget everything — call when the route changes or casting ends. */
+    fun reset() {
+        recent.clear()
+        lastSummaryAtMs = null
+    }
+
+    companion object {
+        // Readings arrive at the 1 Hz poll cadence, and a normal track
+        // transition is 2-3 changes (PLAYING -> TRANSITIONING -> PLAYING).
+        // Four inside six seconds is not a track change, and it is not a
+        // person at the Sonos app either; it is the renderer not settling.
+        const val FLAP_WINDOW_MS = 6_000L
+        const val FLAP_MIN_CHANGES = 4
+        const val FLAP_SUMMARY_COOLDOWN_MS = 60_000L
+    }
+}

android/app/src/main/java/com/fabledsword/minstrel/discover/ui/DiscoverScreen.kt

@@ -42,6 +42,7 @@ import com.fabledsword.minstrel.models.LidarrRequestKind
 import com.fabledsword.minstrel.models.LidarrSearchResultRef
 import com.fabledsword.minstrel.models.SuggestionSnoozeRef
 import com.fabledsword.minstrel.nav.Discover
+import com.fabledsword.minstrel.shared.widgets.ShellContentWindowInsets
 import com.fabledsword.minstrel.shared.widgets.ErrorRetry
 import com.fabledsword.minstrel.shared.widgets.LoadingCentered
 import com.fabledsword.minstrel.shared.widgets.MinstrelTopAppBar
@@ -61,6 +62,7 @@ fun DiscoverScreen(
     val scope = rememberCoroutineScope()
 
     Scaffold(
+        contentWindowInsets = ShellContentWindowInsets,
         modifier = Modifier.fillMaxSize(),
         topBar = {
             MinstrelTopAppBar(

android/app/src/main/java/com/fabledsword/minstrel/events/EventsStream.kt

@@ -38,8 +38,7 @@ private const val BACKOFF_FACTOR = 2
  * ViewModels + the central [LiveEventsDispatcher]) collect filtered
  * subsets of the stream.
  *
- * Connection lifecycle mirrors
+ * Connection lifecycle:
- * `flutter_client/lib/shared/live_events_provider.dart`:
  * - Gated on having a session cookie. Subscription opens when the
  *   cookie transitions to non-null and closes when it transitions
  *   back to null (sign-out).

android/app/src/main/java/com/fabledsword/minstrel/events/LiveEvent.kt

@@ -5,7 +5,7 @@ import kotlinx.serialization.json.JsonObject
 
 /**
  * Parsed event from the server's SSE stream. Mirrors
- * `flutter_client/lib/shared/live_events_provider.dart`'s `LiveEvent`.
+ * the Flutter client's `LiveEvent`.
  *
  * - [kind] is the SSE `event:` field (e.g. "track.liked", "playlist.deleted").
  * - [userId] is the actor whose user-scoped state changed (empty for

android/app/src/main/java/com/fabledsword/minstrel/events/LiveEventsDispatcher.kt

@@ -11,8 +11,7 @@ import javax.inject.Inject
 import javax.inject.Singleton
 
 /**
- * Maps incoming [LiveEvent]s to cross-screen state refreshes. Mirrors
+ * Maps incoming [LiveEvent]s to cross-screen state refreshes. Activated
- * `flutter_client/lib/shared/live_events_dispatcher.dart`. Activated
  * by force-@Inject in MinstrelApplication.
  *
  * Scope is deliberately narrow: this dispatcher only touches state

android/app/src/main/java/com/fabledsword/minstrel/history/ui/HistoryTab.kt

@@ -204,8 +204,7 @@ private const val HOURS_PER_DAY = 24L
 private const val DAYS_PER_WEEK = 7L
 
 /**
- * Lightweight relative-time formatter mirroring Flutter's
+ * Lightweight relative-time formatter:
- * `library_screen.dart`'s `_relativeTime`:
  *
  *   < 1h   → "Nm ago"
  *   < 24h  → "Nh ago"

android/app/src/main/java/com/fabledsword/minstrel/home/ui/HomeScreen.kt

@@ -91,6 +91,7 @@ import com.fabledsword.minstrel.shared.VeilOutcome
 import com.fabledsword.minstrel.shared.VeilSessionResult
 import com.fabledsword.minstrel.shared.VeilSettleState
 import com.fabledsword.minstrel.shared.asCacheFirstStateFlow
+import com.fabledsword.minstrel.shared.widgets.ShellContentWindowInsets
 import com.fabledsword.minstrel.shared.widgets.ArtSettleTracker
 import com.fabledsword.minstrel.shared.widgets.EmptyState
 import com.fabledsword.minstrel.shared.widgets.ErrorRetry
@@ -564,6 +565,7 @@ fun HomeScreen(
         viewModel.transientMessages.collect { snackbarHostState.showSnackbar(it) }
     }
     Scaffold(
+        contentWindowInsets = ShellContentWindowInsets,
         modifier = Modifier.fillMaxSize(),
         topBar = {
             MinstrelTopAppBar(
@@ -1170,7 +1172,7 @@ enum class OfflinePoolKind(val label: String) {
  * first / greyed after, and the "building/pending" placeholders are dropped
  * (they need the server to generate, so they're meaningless offline).
  *
- * Diverges from Flutter (`flutter_client/lib/library/home_screen.dart`
+ * Diverges from Flutter (the Flutter client
  * `_buildPlaylistsRow`) which only shows the 5 fixed slots and never
  * surfaces the secondary kinds on Home. Operator authorized the
  * divergence on 2026-06-01; web UI catch-up tracked as task #53.
@@ -1372,7 +1374,7 @@ private const val MOST_PLAYED_COVER_DP = 48
 
 // 3 rows of MOST_PLAYED_TILE_HEIGHT_DP + 2 * 8dp inter-row spacing,
 // rounded up. Mirrors Flutter (`CompactTrackCard` in
-// flutter_client/lib/library/widgets/compact_track_card.dart) which
+// the Flutter client) which
 // uses a horizontal-row card pattern - much denser than the square
 // per-track tiles that web uses (operator request 2026-06-01: "in the
 // flutter iteration the tiles were different and smaller so more of

android/app/src/main/java/com/fabledsword/minstrel/library/data/LibraryMappers.kt

@@ -97,6 +97,7 @@ fun CachedTrackEntity.toDomain(
         trackNumber = trackNumber,
         discNumber = discNumber,
         durationSec = durationMs.millisToSeconds(),
+        unavailable = missing,
         // Deterministic from track id; matches the server's stream_url
         // (internal/api/convert.go:75 streamURL builder). Cached rows
         // didn't carry streamUrl before, which left MetadataProvider-
@@ -121,6 +122,7 @@ fun TrackWire.toDomain(): TrackRef =
         discNumber = discNumber,
         durationSec = durationSec,
         streamUrl = streamUrl,
+        unavailable = unavailable,
     )
 
 fun ArtistWire.toDomain(): ArtistRef =

android/app/src/main/java/com/fabledsword/minstrel/library/data/LibraryRepository.kt

@@ -161,7 +161,52 @@ class LibraryRepository @Inject constructor(
     suspend fun shuffleLibrary(limit: Int = SHUFFLE_DEFAULT_LIMIT): List<TrackRef> =
         api.shuffleLibrary(limit = limit).map { it.toDomain() }
 
+    // ---- Browse axes (#367 / #2467) ----
+    //
+    // Server-backed rather than cache-first, unlike everything above. The
+    // cache mirrors the whole library but includes tracks whose files are
+    // missing, with no flag to spot them (#2704), while the server's index
+    // excludes them -- so a locally-derived index would quietly disagree with
+    // the web client's. Revisit when #2704 lands.
+
+    /** Genre index, ordered by track count then name (server order). */
+    suspend fun genres(): List<GenreCount> =
+        api.getGenres().map { GenreCount(genre = it.genre, trackCount = it.trackCount) }
+
+    /** Year index, newest first. Albums with no release date are absent. */
+    suspend fun albumYears(): List<YearCount> =
+        api.getAlbumYears().map { YearCount(year = it.year, albumCount = it.albumCount) }
+
+    /** One page of albums carrying [genre] on any track. */
+    suspend fun albumsByGenre(genre: String, limit: Int, offset: Int): AlbumPage {
+        val page = api.getAlbumsByGenre(genre = genre, limit = limit, offset = offset)
+        return AlbumPage(items = page.items.map { it.toDomain() }, total = page.total)
+    }
+
+    /** One page of albums released in [year]. */
+    suspend fun albumsByYear(year: Int, limit: Int, offset: Int): AlbumPage {
+        val page = api.getAlbumsByYear(
+            yearFrom = year,
+            yearTo = year,
+            limit = limit,
+            offset = offset,
+        )
+        return AlbumPage(items = page.items.map { it.toDomain() }, total = page.total)
+    }
+
     private companion object {
         const val SHUFFLE_DEFAULT_LIMIT = 100
     }
 }
+
+/** One row of the genre index. */
+data class GenreCount(val genre: String, val trackCount: Int)
+
+/** One row of the year index. */
+data class YearCount(val year: Int, val albumCount: Int)
+
+/**
+ * A page of albums plus the server's total for the whole filter, which is
+ * what lets the UI say how many are left rather than just offering "more".
+ */
+data class AlbumPage(val items: List<AlbumRef>, val total: Int)

android/app/src/main/java/com/fabledsword/minstrel/library/ui/AlbumDetailScreen.kt

@@ -6,7 +6,6 @@ import androidx.compose.foundation.background
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.PaddingValues
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxSize
@@ -52,6 +51,7 @@ import com.fabledsword.minstrel.models.TrackRef
 import com.fabledsword.minstrel.nav.AlbumDetail
 import com.fabledsword.minstrel.nav.ArtistDetail
 import com.fabledsword.minstrel.shared.formatDuration
+import com.fabledsword.minstrel.shared.widgets.ShellContentWindowInsets
 import com.fabledsword.minstrel.shared.widgets.TrackRow
 import com.fabledsword.minstrel.shared.widgets.ErrorRetry
 import com.fabledsword.minstrel.shared.widgets.LikeButton
@@ -70,6 +70,7 @@ fun AlbumDetailScreen(
 ) {
     val state by viewModel.uiState.collectAsStateWithLifecycle()
     Scaffold(
+        contentWindowInsets = ShellContentWindowInsets,
         modifier = Modifier.fillMaxSize(),
         topBar = {
             TopAppBar(
@@ -165,7 +166,6 @@ private fun AlbumBody(
 ) {
     LazyColumn(
         modifier = Modifier.fillMaxSize(),
-        contentPadding = PaddingValues(bottom = 140.dp),
     ) {
         item {
             AlbumHeader(

android/app/src/main/java/com/fabledsword/minstrel/library/ui/ArtistDetailScreen.kt

@@ -56,6 +56,7 @@ import com.fabledsword.minstrel.models.albumCoverPath
 import com.fabledsword.minstrel.nav.AlbumDetail
 import com.fabledsword.minstrel.nav.ArtistDetail
 import com.fabledsword.minstrel.shared.formatDuration
+import com.fabledsword.minstrel.shared.widgets.ShellContentWindowInsets
 import com.fabledsword.minstrel.shared.widgets.ErrorRetry
 import com.fabledsword.minstrel.shared.widgets.HorizontalScrollRow
 import com.fabledsword.minstrel.shared.widgets.LikeButton
@@ -79,6 +80,7 @@ fun ArtistDetailScreen(
         }
     }
     Scaffold(
+        contentWindowInsets = ShellContentWindowInsets,
         modifier = Modifier.fillMaxSize(),
         topBar = {
             TopAppBar(

android/app/src/main/java/com/fabledsword/minstrel/library/ui/BrowseViewModel.kt

@@ -0,0 +1,271 @@
+package com.fabledsword.minstrel.library.ui
+
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import com.fabledsword.minstrel.api.ErrorCopy
+import com.fabledsword.minstrel.library.data.AlbumPage
+import com.fabledsword.minstrel.library.data.GenreCount
+import com.fabledsword.minstrel.library.data.LibraryRepository
+import com.fabledsword.minstrel.library.data.YearCount
+import com.fabledsword.minstrel.models.AlbumRef
+import com.fabledsword.minstrel.shared.UiState
+import dagger.hilt.android.lifecycle.HiltViewModel
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.launch
+import javax.inject.Inject
+
+/** How the genre index is ordered. */
+enum class GenreSort {
+    /** Server order: track count descending, name breaking ties. */
+    COUNT,
+
+    /** Alphabetical, case-insensitive. */
+    NAME,
+}
+
+/**
+ * Albums for whichever genre or year is currently drilled into.
+ *
+ * [total] is the server's count for the whole filter, not the loaded slice,
+ * so the UI can say how many are left instead of only offering "more".
+ */
+data class AlbumBrowseState(
+    val albums: List<AlbumRef> = emptyList(),
+    val total: Int = 0,
+    val loading: Boolean = false,
+    val failed: Boolean = false,
+) {
+    val hasMore: Boolean get() = albums.size < total
+    val remaining: Int get() = (total - albums.size).coerceAtLeast(0)
+}
+
+/**
+ * Backs the Genres and Years tabs (#2467), mirroring the web surfaces #367
+ * shipped.
+ *
+ * Both indexes come from the server, which is a deliberate departure from the
+ * cache-first Artists/Albums tabs beside them: the local cache includes tracks
+ * whose files are missing and cannot tell you which (#2704), while the server's
+ * index excludes them, so a locally-derived index would disagree with the web
+ * client's. These two tabs therefore need a connection; the empty states say so
+ * rather than looking broken.
+ */
+// Two browse axes, each with an index, a filter/sort or grouping, a
+// drill-down and a pager. The function count is two axes' worth of a
+// cohesive surface; splitting into GenresViewModel + YearsViewModel would
+// duplicate the shared paging body for no gain.
+@Suppress("TooManyFunctions")
+@HiltViewModel
+class BrowseViewModel @Inject constructor(
+    private val repository: LibraryRepository,
+) : ViewModel() {
+
+    private val genresInternal = MutableStateFlow<UiState<List<GenreCount>>>(UiState.Loading)
+    val genres: StateFlow<UiState<List<GenreCount>>> = genresInternal.asStateFlow()
+
+    private val yearsInternal = MutableStateFlow<UiState<List<YearCount>>>(UiState.Loading)
+    val years: StateFlow<UiState<List<YearCount>>> = yearsInternal.asStateFlow()
+
+    private val genreFilterInternal = MutableStateFlow("")
+    val genreFilter: StateFlow<String> = genreFilterInternal.asStateFlow()
+
+    private val genreSortInternal = MutableStateFlow(GenreSort.COUNT)
+    val genreSort: StateFlow<GenreSort> = genreSortInternal.asStateFlow()
+
+    private val selectedGenreInternal = MutableStateFlow<String?>(null)
+    val selectedGenre: StateFlow<String?> = selectedGenreInternal.asStateFlow()
+
+    private val selectedYearInternal = MutableStateFlow<Int?>(null)
+    val selectedYear: StateFlow<Int?> = selectedYearInternal.asStateFlow()
+
+    private val genreAlbumsInternal = MutableStateFlow(AlbumBrowseState())
+    val genreAlbums: StateFlow<AlbumBrowseState> = genreAlbumsInternal.asStateFlow()
+
+    private val yearAlbumsInternal = MutableStateFlow(AlbumBrowseState())
+    val yearAlbums: StateFlow<AlbumBrowseState> = yearAlbumsInternal.asStateFlow()
+
+    // Guards against a slow response for a previously-selected genre/year
+    // landing after the user has moved on and painting over the new list.
+    // One counter per axis, since the two drill-downs are independent.
+    private var genreRequestToken = 0
+    private var yearRequestToken = 0
+
+    init {
+        loadGenres()
+        loadYears()
+    }
+
+    fun loadGenres() {
+        viewModelScope.launch {
+            genresInternal.value = UiState.Loading
+            genresInternal.value = runCatching { repository.genres() }.fold(
+                onSuccess = { if (it.isEmpty()) UiState.Empty else UiState.Success(it) },
+                onFailure = { UiState.Error(ErrorCopy.fromThrowable(it)) },
+            )
+        }
+    }
+
+    fun loadYears() {
+        viewModelScope.launch {
+            yearsInternal.value = UiState.Loading
+            yearsInternal.value = runCatching { repository.albumYears() }.fold(
+                onSuccess = { if (it.isEmpty()) UiState.Empty else UiState.Success(it) },
+                onFailure = { UiState.Error(ErrorCopy.fromThrowable(it)) },
+            )
+        }
+    }
+
+    fun setGenreFilter(value: String) { genreFilterInternal.value = value }
+
+    fun setGenreSort(sort: GenreSort) { genreSortInternal.value = sort }
+
+    /** Drill into [genre], or pass null to go back to the index. */
+    fun selectGenre(genre: String?) {
+        selectedGenreInternal.value = genre
+        genreRequestToken += 1
+        genreAlbumsInternal.value = AlbumBrowseState()
+        if (genre == null) return
+        fetchGenrePage(genre, offset = 0, token = genreRequestToken)
+    }
+
+    fun loadMoreGenreAlbums() {
+        val genre = selectedGenreInternal.value ?: return
+        val state = genreAlbumsInternal.value
+        if (state.loading || !state.hasMore) return
+        fetchGenrePage(genre, offset = state.albums.size, token = genreRequestToken)
+    }
+
+    fun retryGenreAlbums() {
+        selectedGenreInternal.value?.let { selectGenre(it) }
+    }
+
+    /** Drill into [year], or pass null to go back to the index. */
+    fun selectYear(year: Int?) {
+        selectedYearInternal.value = year
+        yearRequestToken += 1
+        yearAlbumsInternal.value = AlbumBrowseState()
+        if (year == null) return
+        fetchYearPage(year, offset = 0, token = yearRequestToken)
+    }
+
+    fun loadMoreYearAlbums() {
+        val year = selectedYearInternal.value ?: return
+        val state = yearAlbumsInternal.value
+        if (state.loading || !state.hasMore) return
+        fetchYearPage(year, offset = state.albums.size, token = yearRequestToken)
+    }
+
+    fun retryYearAlbums() {
+        selectedYearInternal.value?.let { selectYear(it) }
+    }
+
+    private fun fetchGenrePage(genre: String, offset: Int, token: Int) {
+        fetchPage(
+            state = genreAlbumsInternal,
+            offset = offset,
+            isCurrent = { token == genreRequestToken },
+            fetch = { repository.albumsByGenre(genre, PAGE_SIZE, offset) },
+        )
+    }
+
+    private fun fetchYearPage(year: Int, offset: Int, token: Int) {
+        fetchPage(
+            state = yearAlbumsInternal,
+            offset = offset,
+            isCurrent = { token == yearRequestToken },
+            fetch = { repository.albumsByYear(year, PAGE_SIZE, offset) },
+        )
+    }
+
+    /**
+     * The paging body both axes share: append on success, and drop the result
+     * entirely if the selection moved while the request was in flight.
+     */
+    private fun fetchPage(
+        state: MutableStateFlow<AlbumBrowseState>,
+        offset: Int,
+        isCurrent: () -> Boolean,
+        fetch: suspend () -> AlbumPage,
+    ) {
+        viewModelScope.launch {
+            state.value = state.value.copy(loading = true, failed = false)
+            runCatching { fetch() }.fold(
+                onSuccess = { page ->
+                    if (!isCurrent()) return@launch
+                    val merged =
+                        if (offset == 0) page.items else state.value.albums + page.items
+                    state.value = AlbumBrowseState(
+                        albums = merged,
+                        total = page.total,
+                        loading = false,
+                        failed = false,
+                    )
+                },
+                onFailure = {
+                    if (!isCurrent()) return@launch
+                    state.value = state.value.copy(loading = false, failed = true)
+                },
+            )
+        }
+    }
+
+    private companion object {
+        // Matches the web client's BROWSE_PAGE_SIZE so "Load more (N left)"
+        // steps at the same rate on both clients.
+        const val PAGE_SIZE = 50
+    }
+}
+
+/**
+ * Apply the current filter and sort to a genre index.
+ *
+ * Pure so the ordering rules are testable without a ViewModel. Sorting copies
+ * first: the input is the list held in the loaded state, and sorting in place
+ * would reorder what every other reader sees.
+ */
+fun visibleGenres(
+    genres: List<GenreCount>,
+    filter: String,
+    sort: GenreSort,
+): List<GenreCount> {
+    val q = filter.trim()
+    val matched =
+        if (q.isEmpty()) genres else genres.filter { it.genre.contains(q, ignoreCase = true) }
+    return when (sort) {
+        // Server order is already count DESC then name; don't re-sort it.
+        GenreSort.COUNT -> matched
+        GenreSort.NAME -> matched.sortedWith(compareBy(String.CASE_INSENSITIVE_ORDER) { it.genre })
+    }
+}
+
+// Integer division by this floors a year to its decade: 2007 -> 2000. Named
+// because detekt counts it as magic, and because the arithmetic reads as
+// arbitrary otherwise.
+private const val YEARS_PER_DECADE = 10
+
+/** A decade's worth of the year index, newest year first. */
+data class DecadeGroup(
+    val decade: Int,
+    val years: List<YearCount>,
+    val albumCount: Int,
+)
+
+/**
+ * Group the year index by decade, newest first.
+ *
+ * A flat list of every year in a decades-deep library is a wall of numbers, and
+ * the decade is usually how someone actually thinks about it. Pure, for the
+ * same reason as [visibleGenres].
+ */
+fun groupByDecade(years: List<YearCount>): List<DecadeGroup> =
+    years.groupBy { (it.year / YEARS_PER_DECADE) * YEARS_PER_DECADE }
+        .map { (decade, entries) ->
+            DecadeGroup(
+                decade = decade,
+                years = entries.sortedByDescending { it.year },
+                albumCount = entries.sumOf { it.albumCount },
+            )
+        }
+        .sortedByDescending { it.decade }

android/app/src/main/java/com/fabledsword/minstrel/library/ui/GenresTab.kt

@@ -0,0 +1,341 @@
+package com.fabledsword.minstrel.library.ui
+
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.lazy.grid.GridCells
+import androidx.compose.foundation.lazy.grid.GridItemSpan
+import androidx.compose.foundation.lazy.grid.LazyVerticalGrid
+import androidx.compose.foundation.lazy.grid.items
+import androidx.compose.material3.FilterChip
+import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import androidx.hilt.navigation.compose.hiltViewModel
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.composables.icons.lucide.ArrowLeft
+import com.composables.icons.lucide.Lucide
+import com.composables.icons.lucide.LibraryBig
+import com.fabledsword.minstrel.library.widgets.AlbumCard
+import com.fabledsword.minstrel.models.AlbumRef
+import com.fabledsword.minstrel.shared.UiState
+import com.fabledsword.minstrel.shared.widgets.EmptyState
+import com.fabledsword.minstrel.shared.widgets.ErrorRetry
+
+/**
+ * Genres tab (#2467) — the Android half of the browse axis #367 shipped on web.
+ *
+ * Two states in one tab rather than a navigation destination: the index, and
+ * the albums for a chosen genre. Back returns to the index. A route would have
+ * meant carrying the genre in the path, and "Rock/Pop" is a real ID3 tag whose
+ * slash a path segment cannot carry — the same reason the server takes it as a
+ * query parameter.
+ */
+@Composable
+fun GenresTab(
+    onAlbumClick: (String) -> Unit,
+    viewModel: BrowseViewModel = hiltViewModel(),
+) {
+    val selected by viewModel.selectedGenre.collectAsStateWithLifecycle()
+    val genre = selected
+    if (genre == null) {
+        GenreIndex(viewModel = viewModel)
+    } else {
+        GenreAlbums(
+            genre = genre,
+            viewModel = viewModel,
+            onAlbumClick = onAlbumClick,
+        )
+    }
+}
+
+@Composable
+private fun GenreIndex(viewModel: BrowseViewModel) {
+    val state by viewModel.genres.collectAsStateWithLifecycle()
+    val filter by viewModel.genreFilter.collectAsStateWithLifecycle()
+    val sort by viewModel.genreSort.collectAsStateWithLifecycle()
+
+    when (val s = state) {
+        UiState.Loading -> EmptyState(
+            title = "Reading your genres…",
+            body = "",
+            icon = Lucide.LibraryBig,
+        )
+        UiState.Empty -> EmptyState(
+            title = "No genres found",
+            body = "Genres come from the genre tag on your audio files. If your " +
+                "library is tagged but this is empty, try a rescan from the admin " +
+                "screen.",
+            icon = Lucide.LibraryBig,
+        )
+        is UiState.Error -> ErrorRetry(
+            message = s.message,
+            onRetry = viewModel::loadGenres,
+        )
+        is UiState.Success -> {
+            val visible = visibleGenres(s.data, filter, sort)
+            Column(modifier = Modifier.fillMaxSize()) {
+                GenreIndexControls(
+                    total = s.data.size,
+                    shown = visible.size,
+                    filter = filter,
+                    sort = sort,
+                    onFilterChange = viewModel::setGenreFilter,
+                    onSortChange = viewModel::setGenreSort,
+                )
+                if (visible.isEmpty()) {
+                    EmptyState(
+                        title = "No genres match \"${filter.trim()}\"",
+                        body = "Try a shorter search.",
+                        icon = Lucide.LibraryBig,
+                    )
+                } else {
+                    LazyColumn(modifier = Modifier.fillMaxSize()) {
+                        items(items = visible, key = { it.genre }) { row ->
+                            GenreRow(
+                                genre = row.genre,
+                                trackCount = row.trackCount,
+                                onClick = { viewModel.selectGenre(row.genre) },
+                            )
+                            HorizontalDivider()
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun GenreIndexControls(
+    total: Int,
+    shown: Int,
+    filter: String,
+    sort: GenreSort,
+    onFilterChange: (String) -> Unit,
+    onSortChange: (GenreSort) -> Unit,
+) {
+    Column(modifier = Modifier.padding(horizontal = 12.dp, vertical = 8.dp)) {
+        OutlinedTextField(
+            value = filter,
+            onValueChange = onFilterChange,
+            label = { Text("Filter genres") },
+            singleLine = true,
+            modifier = Modifier.fillMaxWidth(),
+        )
+        Row(
+            modifier = Modifier.fillMaxWidth().padding(top = 8.dp),
+            horizontalArrangement = Arrangement.spacedBy(8.dp),
+            verticalAlignment = Alignment.CenterVertically,
+        ) {
+            // Count-first is the default because the head of that list is
+            // genuinely where you are going; raw tags carry a long tail of
+            // one-offs that A-Z would bury the real genres under. A-Z is here
+            // for when you already know roughly what it is called.
+            FilterChip(
+                selected = sort == GenreSort.COUNT,
+                onClick = { onSortChange(GenreSort.COUNT) },
+                label = { Text("Most tracks") },
+            )
+            FilterChip(
+                selected = sort == GenreSort.NAME,
+                onClick = { onSortChange(GenreSort.NAME) },
+                label = { Text("A–Z") },
+            )
+            Text(
+                text = if (filter.isBlank()) {
+                    "$total genres"
+                } else {
+                    "$shown of $total"
+                },
+                style = MaterialTheme.typography.bodySmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+        }
+    }
+}
+
+@Composable
+private fun GenreRow(genre: String, trackCount: Int, onClick: () -> Unit) {
+    Row(
+        modifier = Modifier
+            .fillMaxWidth()
+            .clickable(onClick = onClick)
+            .padding(horizontal = 16.dp, vertical = 14.dp),
+        verticalAlignment = Alignment.CenterVertically,
+    ) {
+        Text(
+            text = genre,
+            style = MaterialTheme.typography.bodyLarge,
+            color = MaterialTheme.colorScheme.onSurface,
+            maxLines = 1,
+            overflow = TextOverflow.Ellipsis,
+            modifier = Modifier.weight(1f),
+        )
+        Text(
+            text = "$trackCount",
+            style = MaterialTheme.typography.bodySmall,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+    }
+}
+
+@Composable
+private fun GenreAlbums(
+    genre: String,
+    viewModel: BrowseViewModel,
+    onAlbumClick: (String) -> Unit,
+) {
+    val albums by viewModel.genreAlbums.collectAsStateWithLifecycle()
+    BrowseAlbumResults(
+        heading = genre,
+        subtitle = albumCountLabel(albums.total, albums.loading, albums.albums.size),
+        state = albums,
+        emptyTitle = "No albums for this genre",
+        emptyBody = "The library may have been rescanned since this list was built.",
+        onBack = { viewModel.selectGenre(null) },
+        onRetry = viewModel::retryGenreAlbums,
+        onLoadMore = viewModel::loadMoreGenreAlbums,
+        onAlbumClick = onAlbumClick,
+    )
+}
+
+/**
+ * Shared results pane for both browse axes: a back affordance, a heading, the
+ * album grid, and the load-more footer. Genres and Years differ only in their
+ * heading and copy, so the layout lives once.
+ */
+@Composable
+@Suppress("LongParameterList") // one presentational surface; all of it varies by axis
+fun BrowseAlbumResults(
+    heading: String,
+    subtitle: String,
+    state: AlbumBrowseState,
+    emptyTitle: String,
+    emptyBody: String,
+    onBack: () -> Unit,
+    onRetry: () -> Unit,
+    onLoadMore: () -> Unit,
+    onAlbumClick: (String) -> Unit,
+) {
+    Column(modifier = Modifier.fillMaxSize()) {
+        Row(
+            modifier = Modifier.fillMaxWidth().padding(start = 4.dp, end = 12.dp),
+            verticalAlignment = Alignment.CenterVertically,
+        ) {
+            IconButton(onClick = onBack) {
+                Icon(Lucide.ArrowLeft, contentDescription = "Back to the index")
+            }
+            Column(modifier = Modifier.weight(1f)) {
+                Text(
+                    text = heading,
+                    style = MaterialTheme.typography.titleMedium,
+                    color = MaterialTheme.colorScheme.onSurface,
+                    maxLines = 1,
+                    overflow = TextOverflow.Ellipsis,
+                )
+                if (subtitle.isNotEmpty()) {
+                    Text(
+                        text = subtitle,
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+            }
+        }
+
+        when {
+            state.failed && state.albums.isEmpty() -> ErrorRetry(
+                message = "Couldn't load albums.",
+                onRetry = onRetry,
+            )
+            state.loading && state.albums.isEmpty() -> EmptyState(
+                title = "Loading…",
+                body = "",
+            )
+            state.albums.isEmpty() -> EmptyState(title = emptyTitle, body = emptyBody)
+            else -> BrowseAlbumGrid(
+                state = state,
+                onLoadMore = onLoadMore,
+                onAlbumClick = onAlbumClick,
+            )
+        }
+    }
+}
+
+@Composable
+private fun BrowseAlbumGrid(
+    state: AlbumBrowseState,
+    onLoadMore: () -> Unit,
+    onAlbumClick: (String) -> Unit,
+) {
+    LazyVerticalGrid(
+        // Same 176dp cell as the Albums tab, so a genre's grid and the full
+        // album grid line up rather than each inventing a column count.
+        columns = GridCells.Adaptive(minSize = 176.dp),
+        contentPadding = PaddingValues(8.dp),
+        verticalArrangement = Arrangement.spacedBy(8.dp),
+        horizontalArrangement = Arrangement.spacedBy(8.dp),
+        modifier = Modifier.fillMaxSize(),
+    ) {
+        items(items = state.albums, key = { it.id }) { album: AlbumRef ->
+            AlbumCard(album = album, onClick = { onAlbumClick(album.id) })
+        }
+        item(span = { GridItemSpan(maxLineSpan) }) {
+            Box(
+                modifier = Modifier.fillMaxWidth().padding(vertical = 8.dp),
+                contentAlignment = Alignment.Center,
+            ) {
+                if (state.hasMore) {
+                    // Explicit rather than infinite scroll, matching web: the
+                    // remaining count is useful, and a browse axis is a place
+                    // people skim rather than fall through.
+                    TextButton(onClick = onLoadMore, enabled = !state.loading) {
+                        Text(
+                            if (state.loading) {
+                                "Loading…"
+                            } else {
+                                "Load more (${state.remaining} left)"
+                            },
+                        )
+                    }
+                } else {
+                    Text(
+                        text = "That's everything",
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+            }
+        }
+    }
+}
+
+/**
+ * "12 albums" once the total is known, and nothing at all while the first page
+ * is still in flight — a count that appears as 0 and then corrects itself reads
+ * as a bug.
+ */
+internal fun albumCountLabel(total: Int, loading: Boolean, loaded: Int): String = when {
+    loading && loaded == 0 -> ""
+    total == 1 -> "1 album"
+    else -> "$total albums"
+}

android/app/src/main/java/com/fabledsword/minstrel/library/ui/LibraryScreen.kt

@@ -43,6 +43,7 @@ import com.fabledsword.minstrel.nav.Library
 import com.composables.icons.lucide.Lucide
 import com.composables.icons.lucide.Shuffle
 import com.fabledsword.minstrel.shared.UiState
+import com.fabledsword.minstrel.shared.widgets.ShellContentWindowInsets
 import com.fabledsword.minstrel.shared.widgets.EmptyState
 import com.fabledsword.minstrel.shared.widgets.ErrorRetry
 import com.fabledsword.minstrel.shared.widgets.MinstrelTopAppBar
@@ -51,8 +52,10 @@ import com.fabledsword.minstrel.shared.widgets.SkeletonAlbumTile
 import com.fabledsword.minstrel.shared.widgets.SkeletonArtistTile
 
 /**
- * Library tab. Five-tab TabBar (Artists / Albums / History / Liked /
+ * Library tab. Seven-tab TabBar (Artists / Albums / Genres / Years /
- * Hidden) matching `flutter_client/lib/library/library_screen.dart`.
+ * History / Liked / Hidden), matching the web client's library tab bar.
+ * Genres and Years arrived with #2467; the rest predate it and mirrored
+ * the Flutter client.
  *
  * Artists + Albums are wired against the existing LibraryViewModel
  * (cache-first reads of cached_artists / cached_albums). The other
@@ -77,6 +80,7 @@ fun LibraryScreen(
     val scope = rememberCoroutineScope()
 
     Scaffold(
+        contentWindowInsets = ShellContentWindowInsets,
         modifier = Modifier.fillMaxSize(),
         topBar = {
             Column {
@@ -113,9 +117,31 @@ fun LibraryScreen(
             state = pagerState,
             modifier = Modifier.fillMaxSize().padding(inner),
         ) { page ->
+            LibraryTabPage(page = page, viewModel = viewModel, navController = navController)
+        }
+    }
+}
+
+/**
+ * The pager's page bodies, split out of [LibraryScreen] so the screen stays
+ * the scaffold + tab bar and this stays the routing table. Adding a tab is
+ * then one line here and one label in [LIBRARY_TABS].
+ */
+@Composable
+private fun LibraryTabPage(
+    page: Int,
+    viewModel: LibraryViewModel,
+    navController: NavHostController,
+) {
     when (page) {
         TAB_ARTISTS -> ArtistsTab(viewModel = viewModel, navController = navController)
         TAB_ALBUMS -> AlbumsTab(viewModel = viewModel, navController = navController)
+        TAB_GENRES -> GenresTab(
+            onAlbumClick = { id -> navController.navigate(AlbumDetail(id)) },
+        )
+        TAB_YEARS -> YearsTab(
+            onAlbumClick = { id -> navController.navigate(AlbumDetail(id)) },
+        )
         TAB_HISTORY -> HistoryTab(
             onNavigateToAlbum = { id -> navController.navigate(AlbumDetail(id)) },
             onNavigateToArtist = { id -> navController.navigate(ArtistDetail(id)) },
@@ -124,16 +150,20 @@ fun LibraryScreen(
         TAB_HIDDEN -> HiddenTab()
     }
 }
-    }
-}
 
 private const val TAB_ARTISTS = 0
 private const val TAB_ALBUMS = 1
-private const val TAB_HISTORY = 2
+private const val TAB_GENRES = 2
-private const val TAB_LIKED = 3
+private const val TAB_YEARS = 3
-private const val TAB_HIDDEN = 4
+private const val TAB_HISTORY = 4
+private const val TAB_LIKED = 5
+private const val TAB_HIDDEN = 6
 
-private val LIBRARY_TABS = listOf("Artists", "Albums", "History", "Liked", "Hidden")
+// Genres and Years sit straight after Albums, matching the web tab bar's
+// order (#2467) -- they are browse axes over the same albums, so they belong
+// beside them rather than after the personal tabs.
+private val LIBRARY_TABS =
+    listOf("Artists", "Albums", "Genres", "Years", "History", "Liked", "Hidden")
 
 @Composable
 private fun ArtistsTab(

android/app/src/main/java/com/fabledsword/minstrel/library/ui/YearsTab.kt

@@ -0,0 +1,161 @@
+package com.fabledsword.minstrel.library.ui
+
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.unit.dp
+import androidx.hilt.navigation.compose.hiltViewModel
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.composables.icons.lucide.Clock
+import com.composables.icons.lucide.Lucide
+import com.fabledsword.minstrel.shared.UiState
+import com.fabledsword.minstrel.shared.widgets.EmptyState
+import com.fabledsword.minstrel.shared.widgets.ErrorRetry
+
+/**
+ * Years tab (#2467). Same two-state shape as [GenresTab]: the decade-grouped
+ * index, then the albums for a chosen year.
+ *
+ * Albums with no release date are absent from this axis entirely — the server
+ * leaves them out rather than inventing a year-0 bucket, and the empty state
+ * says so, because "my albums aren't here" otherwise looks like a bug.
+ */
+@Composable
+fun YearsTab(
+    onAlbumClick: (String) -> Unit,
+    viewModel: BrowseViewModel = hiltViewModel(),
+) {
+    val selected by viewModel.selectedYear.collectAsStateWithLifecycle()
+    val year = selected
+    if (year == null) {
+        YearIndex(viewModel = viewModel)
+    } else {
+        YearAlbums(year = year, viewModel = viewModel, onAlbumClick = onAlbumClick)
+    }
+}
+
+@Composable
+private fun YearIndex(viewModel: BrowseViewModel) {
+    val state by viewModel.years.collectAsStateWithLifecycle()
+
+    when (val s = state) {
+        UiState.Loading -> EmptyState(
+            title = "Reading release years…",
+            body = "",
+            icon = Lucide.Clock,
+        )
+        UiState.Empty -> EmptyState(
+            title = "No release years found",
+            body = "Years come from the release date on your albums. Albums " +
+                "without one don't appear on this axis at all.",
+            icon = Lucide.Clock,
+        )
+        is UiState.Error -> ErrorRetry(
+            message = s.message,
+            onRetry = viewModel::loadYears,
+        )
+        is UiState.Success -> {
+            val decades = groupByDecade(s.data)
+            LazyColumn(
+                modifier = Modifier.fillMaxSize(),
+                contentPadding = PaddingValues(vertical = 8.dp),
+            ) {
+                decades.forEach { group ->
+                    item(key = "decade-${group.decade}") {
+                        DecadeHeader(decade = group.decade, albumCount = group.albumCount)
+                    }
+                    items(
+                        count = group.years.size,
+                        key = { i -> "year-${group.years[i].year}" },
+                    ) { i ->
+                        val row = group.years[i]
+                        YearRow(
+                            year = row.year,
+                            albumCount = row.albumCount,
+                            onClick = { viewModel.selectYear(row.year) },
+                        )
+                        HorizontalDivider()
+                    }
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun DecadeHeader(decade: Int, albumCount: Int) {
+    Row(
+        modifier = Modifier
+            .fillMaxWidth()
+            .padding(horizontal = 16.dp, vertical = 10.dp),
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.SpaceBetween,
+    ) {
+        Text(
+            text = "${decade}s",
+            style = MaterialTheme.typography.titleSmall,
+            color = MaterialTheme.colorScheme.primary,
+        )
+        Text(
+            text = albumCountLabel(albumCount, loading = false, loaded = albumCount),
+            style = MaterialTheme.typography.bodySmall,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+    }
+}
+
+@Composable
+private fun YearRow(year: Int, albumCount: Int, onClick: () -> Unit) {
+    Row(
+        modifier = Modifier
+            .fillMaxWidth()
+            .clickable(onClick = onClick)
+            .padding(horizontal = 16.dp, vertical = 14.dp),
+        verticalAlignment = Alignment.CenterVertically,
+    ) {
+        Text(
+            text = "$year",
+            style = MaterialTheme.typography.bodyLarge,
+            color = MaterialTheme.colorScheme.onSurface,
+            modifier = Modifier.weight(1f),
+        )
+        Text(
+            text = "$albumCount",
+            style = MaterialTheme.typography.bodySmall,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+    }
+}
+
+@Composable
+private fun YearAlbums(
+    year: Int,
+    viewModel: BrowseViewModel,
+    onAlbumClick: (String) -> Unit,
+) {
+    val albums by viewModel.yearAlbums.collectAsStateWithLifecycle()
+    BrowseAlbumResults(
+        heading = "$year",
+        subtitle = albumCountLabel(albums.total, albums.loading, albums.albums.size),
+        state = albums,
+        emptyTitle = "No albums for $year",
+        emptyBody = "The library may have been rescanned since this list was built.",
+        onBack = { viewModel.selectYear(null) },
+        onRetry = viewModel::retryYearAlbums,
+        onLoadMore = viewModel::loadMoreYearAlbums,
+        onAlbumClick = onAlbumClick,
+    )
+}

android/app/src/main/java/com/fabledsword/minstrel/models/AlbumRef.kt

@@ -2,7 +2,7 @@ package com.fabledsword.minstrel.models
 
 /**
  * Lightweight reference to one album. Mirrors
- * `flutter_client/lib/models/album.dart`'s `AlbumRef`.
+ * the Flutter client's `AlbumRef`.
  *
  * `coverUrl` and `durationSec` match the server contract (not
  * `cover_art_url` / `duration_ms`). `year` is omitempty server-side so

android/app/src/main/java/com/fabledsword/minstrel/models/ArtistRef.kt

@@ -2,7 +2,7 @@ package com.fabledsword.minstrel.models
 
 /**
  * Lightweight reference to one artist. Mirrors
- * `flutter_client/lib/models/artist.dart`'s `ArtistRef`.
+ * the Flutter client's `ArtistRef`.
  *
  * `coverUrl` is the server's field name (NOT cover_art_url). Server emits
  * empty string when the artist has no representative album cover; UI code

android/app/src/main/java/com/fabledsword/minstrel/models/Discover.kt

@@ -14,7 +14,7 @@ enum class LidarrRequestKind {
 }
 
 /**
- * Lidarr search hit. Mirrors `flutter_client/lib/models/lidarr.dart`'s
+ * Lidarr search hit. Mirrors the Flutter client's
  * `LidarrSearchResult` — `mbid` is the result's own MBID; `artistMbid`
  * and `albumMbid` are filled when the row is an album/track and the
  * UI needs the parent IDs to build the request.

android/app/src/main/java/com/fabledsword/minstrel/models/Invite.kt

@@ -2,7 +2,7 @@ package com.fabledsword.minstrel.models
 
 /**
  * Domain shape for one admin-issued registration invite. Mirrors
- * `flutter_client/lib/models/invite.dart Invite` and the server's
+ * the Flutter client's `Invite` and the server's
  * `inviteResp` from `internal/api/admin_invites.go`.
  *
  * `invitedBy` and `redeemedBy` are UUIDs of users (not usernames);

android/app/src/main/java/com/fabledsword/minstrel/models/ListenBrainzStatus.kt

@@ -2,7 +2,7 @@ package com.fabledsword.minstrel.models
 
 /**
  * Caller's ListenBrainz integration state. Mirrors
- * `flutter_client/lib/models/my_profile.dart ListenBrainzStatus`
+ * the Flutter client's `ListenBrainzStatus`
  * and the server's `listenBrainzResp`.
  *
  * The token itself is never read back from the server — `tokenSet`

android/app/src/main/java/com/fabledsword/minstrel/models/Playlist.kt

@@ -2,7 +2,7 @@ package com.fabledsword.minstrel.models
 
 /**
  * Lightweight reference to one playlist (user or system-generated).
- * Mirrors `flutter_client/lib/models/playlist.dart`'s `Playlist`.
+ * Mirrors the Flutter client's `Playlist`.
  *
  * `systemVariant` discriminates user vs. system playlists — null for
  * user-owned, one of "for_you" / "discover" / "songs_like_artist" / etc.
@@ -47,7 +47,10 @@ data class PlaylistRef(
  * `trackId` and `streamUrl` are nullable because the upstream track can
  * be removed from the library while the row stays in the playlist —
  * those tiles render grey + unplayable per Flutter's `isAvailable`
- * convention.
+ * convention. [unavailable] is the second, softer case: the track is
+ * still there but its file is missing. Both render grey and refuse to
+ * play; only the second is worth explaining to the user, because it
+ * can fix itself.
  */
 data class PlaylistTrackRef(
     val position: Int,
@@ -59,8 +62,21 @@ data class PlaylistTrackRef(
     val artistName: String = "",
     val durationSec: Int = 0,
     val streamUrl: String? = null,
+    /**
+     * The track is still in the library but its file is missing from
+     * disk (#2527). Unlike a null [trackId] this is expected to be
+     * temporary — the scanner clears it when the file returns, and
+     * adopts the row if it returns under a new name (#2528) — so the
+     * row keeps its identity, its likes and its play history.
+     */
+    val unavailable: Boolean = false,
 ) {
-    val isAvailable: Boolean get() = trackId != null
+    /**
+     * Playable-ness, covering both ways a row can outlive its audio.
+     * Everything that greys a row or refuses to queue it reads this, so
+     * neither concern has to be re-derived at a call site.
+     */
+    val isAvailable: Boolean get() = trackId != null && !unavailable
 
     /**
      * Cover URL derived from the parent album's `/api/albums/{id}/cover`

android/app/src/main/java/com/fabledsword/minstrel/models/Request.kt

@@ -24,7 +24,7 @@ enum class RequestStatus {
 
 /**
  * One Lidarr request the user has submitted. Mirrors
- * `flutter_client/lib/models/admin_request.dart AdminRequest` —
+ * the Flutter client's `AdminRequest` —
  * shared between the user-side `/api/requests` view and the admin
  * cross-user view since the wire shape is identical.
  *

android/app/src/main/java/com/fabledsword/minstrel/models/SystemPlaylistsStatus.kt

@@ -3,8 +3,7 @@ package com.fabledsword.minstrel.models
 /**
  * Caller's most recent system_playlist_runs state, driving the Home
  * placeholder cards for not-yet-generated system playlists. Mirrors
- * `flutter_client/lib/models/system_playlists_status.dart` and the
+ * the server's `systemPlaylistsStatusResp`.
- * server's `systemPlaylistsStatusResp`.
  *
  * Zero values (inFlight=false, both timestamps null) mean the user
  * has never had a build attempted — the placeholders read as

android/app/src/main/java/com/fabledsword/minstrel/models/TrackRef.kt

@@ -4,7 +4,7 @@ import kotlinx.serialization.Serializable
 
 /**
  * Lightweight reference to one track. Mirrors
- * `flutter_client/lib/models/track.dart`'s `TrackRef`.
+ * the Flutter client's `TrackRef`.
  *
  * The `Ref` suffix matches the Flutter convention — these types carry
  * only the IDs + display fields needed for list rendering + the player
@@ -31,6 +31,16 @@ data class TrackRef(
     val discNumber: Int? = null,
     val durationSec: Int = 0,
     val streamUrl: String = "",
+    /**
+     * The server has no file for this track right now (#2704). It still
+     * belongs to the library, keeps its history, and may come back — but
+     * streaming it will fail, so nothing should queue it.
+     *
+     * NOT the same as unplayable on this device: audio already resident in
+     * the local cache plays regardless of what the server has, which is why
+     * the offline pools in ShuffleSource deliberately ignore this.
+     */
+    val unavailable: Boolean = false,
 ) {
     /**
      * Cover URL derived from the parent album's `/api/albums/{id}/cover`

android/app/src/main/java/com/fabledsword/minstrel/models/UpdateInfo.kt

@@ -1,15 +1,26 @@
 package com.fabledsword.minstrel.models
 
 /**
- * Wire shape returned by `GET /api/client/version`. Mirrors
+ * The server-bundled APK, as reported by `GET /api/client/version`.
- * `flutter_client/lib/update/update_info.dart UpdateInfo`.
  *
- * `version` is the server-bundled APK version (may have a leading
+ * Three values that are deliberately kept apart:
- * "v" from the git tag); `apkUrl` is server-relative (e.g.
+ *
- * `/api/client/apk`); `sizeBytes` is the download size.
+ *  - [version] is a LABEL for people — "YYYY.MM.DD.HHMM", derived from the
+ *    build's commit, so two channels carrying the same code read the same.
+ *    Display this; never decide on it when [code] is present.
+ *  - [code] is the ORDERING KEY, and is the same value Android itself
+ *    installs by. It answers "may this be installed over that?", which the
+ *    name cannot. Null when the server predates the field.
+ *  - [channel] is a SIBLING FIELD, never a suffix inside the name. Reported
+ *    verbatim rather than validated, so an unexpected value is shown rather
+ *    than dropped.
+ *
+ * [apkUrl] is server-relative (e.g. `/api/client/apk`).
  */
 data class UpdateInfo(
     val version: String,
+    val code: Long?,
+    val channel: String?,
     val apkUrl: String,
     val sizeBytes: Long,
 )

android/app/src/main/java/com/fabledsword/minstrel/models/wire/AlbumWire.kt

@@ -4,7 +4,7 @@ import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
 
 /**
- * Wire shape for `AlbumRef`. Mirrors `flutter_client/lib/models/album.dart`.
+ * Wire shape for `AlbumRef`.
  */
 @Serializable
 data class AlbumWire(

android/app/src/main/java/com/fabledsword/minstrel/models/wire/ArtistWire.kt

@@ -4,7 +4,7 @@ import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
 
 /**
- * Wire shape for `ArtistRef`. Mirrors `flutter_client/lib/models/artist.dart`.
+ * Wire shape for `ArtistRef`.
  */
 @Serializable
 data class ArtistWire(

android/app/src/main/java/com/fabledsword/minstrel/models/wire/BrowseWire.kt

@@ -0,0 +1,33 @@
+package com.fabledsword.minstrel.models.wire
+
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+
+/**
+ * One row of `GET /api/library/genres` (#367).
+ *
+ * The label is the file tag's own string, split on `[;,]` and trimmed but
+ * otherwise untouched by the server — no case folding, no synonym mapping.
+ * So "Rock" and "rock" can both appear, as can "Rock/Pop" beside "Rock" and
+ * "Pop". Don't normalise it on the client either: the index and the album
+ * filter have to agree on the exact string, and the filter matches what the
+ * server stored.
+ */
+@Serializable
+data class GenreCountWire(
+    val genre: String = "",
+    @SerialName("track_count") val trackCount: Int = 0,
+)
+
+/**
+ * One row of `GET /api/library/years`.
+ *
+ * Albums with no release date are absent from this axis entirely rather than
+ * bucketed under year 0 — "unknown" is not a year, and the UI should say so
+ * instead of showing a fake row.
+ */
+@Serializable
+data class YearCountWire(
+    val year: Int = 0,
+    @SerialName("album_count") val albumCount: Int = 0,
+)

android/app/src/main/java/com/fabledsword/minstrel/models/wire/DiscoverWire.kt

@@ -6,7 +6,7 @@ import kotlinx.serialization.Serializable
 /**
  * One row of `GET /api/lidarr/search`. Mirrors
  * `web/src/lib/api/types.ts LidarrSearchResult` /
- * `flutter_client/lib/models/lidarr.dart LidarrSearchResult`.
+ * the Flutter client's `LidarrSearchResult`.
  *
  * `inLibrary` and `requested` let the UI greyout rows the user can't
  * act on (already imported / already awaiting review). All defaults

android/app/src/main/java/com/fabledsword/minstrel/models/wire/EventsWire.kt

@@ -9,8 +9,7 @@ import kotlinx.serialization.Serializable
 
 /**
  * Wire shapes for `POST /api/events`. The endpoint multiplexes four
- * variants on the `type` discriminator field, mirroring
+ * variants on the `type` discriminator field.
- * `flutter_client/lib/api/endpoints/events.dart`.
  *
  * play_started returns the server-assigned play_event_id (nullable —
  * server may suppress under certain conditions); the other three

android/app/src/main/java/com/fabledsword/minstrel/models/wire/HomeIndexWire.kt

@@ -5,9 +5,8 @@ import kotlinx.serialization.Serializable
 
 /**
  * Wire shape of `GET /api/home/index` — five flat slices of entity-ID
- * strings, one per Home section. Mirrors
+ * strings, one per Home section. Mirrors the server's
- * `flutter_client/lib/models/home_index.dart` (and the server's
+ * `HomeIndexPayload` in `internal/api/types.go`.
- * `internal/api/types.go HomeIndexPayload`).
  *
  * Section name implies entity type; no per-entry type tag is needed:
  *   - recentlyAddedAlbums  → album

android/app/src/main/java/com/fabledsword/minstrel/models/wire/MyProfileWire.kt

@@ -5,8 +5,7 @@ import kotlinx.serialization.Serializable
 
 /**
  * Wire shape for `GET /api/me` and the return value of
- * `PUT /api/me/profile`. Mirrors
+ * `PUT /api/me/profile`. Two things the shape assumes:
- * `flutter_client/lib/models/my_profile.dart`:
  *   - `display_name` and `email` are nullable; server returns null
  *     when the user hasn't set them yet (registration only requires
  *     a username).

android/app/src/main/java/com/fabledsword/minstrel/models/wire/PlaylistWire.kt

@@ -41,6 +41,14 @@ data class PlaylistsListWire(
  * / `artistId` / `streamUrl` are nullable because the upstream track
  * may have been removed from the library while the row stays in the
  * playlist with its display fields preserved.
+ *
+ * [unavailable] is the other way a row outlives its audio (#2527): the
+ * track is still in the library, with its history and likes, but its
+ * file is missing from disk. The server withholds `stream_url` in that
+ * case too, so a client that only checked the URL would already skip
+ * it — the flag is what lets the UI say WHY instead of rendering a
+ * mysteriously dead row. Defaults false so a server that predates the
+ * field deserialises cleanly.
  */
 @Serializable
 data class PlaylistTrackWire(
@@ -53,6 +61,7 @@ data class PlaylistTrackWire(
     @SerialName("artist_name") val artistName: String = "",
     @SerialName("duration_sec") val durationSec: Int = 0,
     @SerialName("stream_url") val streamUrl: String? = null,
+    val unavailable: Boolean = false,
 )
 
 /**

android/app/src/main/java/com/fabledsword/minstrel/models/wire/QuarantineMineWire.kt

@@ -5,7 +5,7 @@ import kotlinx.serialization.Serializable
 
 /**
  * One row of `GET /api/quarantine/mine`. Mirrors
- * `flutter_client/lib/models/quarantine_mine.dart QuarantineMineRow`
+ * the Flutter client's `QuarantineMineRow`
  * (web `LidarrQuarantineMineRow`).
  *
  * Reason values: `bad_rip` / `wrong_file` / `wrong_tags` / `duplicate`

android/app/src/main/java/com/fabledsword/minstrel/models/wire/RequestWire.kt

@@ -7,7 +7,7 @@ import kotlinx.serialization.Serializable
  * Wire shape of `requestView` from `internal/api/requests.go` — the
  * row returned by both `GET /api/requests` (caller's own requests) and
  * `GET /api/admin/requests` (cross-user admin view). Mirrors
- * `flutter_client/lib/models/admin_request.dart AdminRequest`.
+ * the Flutter client's `AdminRequest`.
  *
  * Status values: `pending` / `approved` / `rejected` / `completed` /
  * `failed`. Kind values: `artist` / `album` / `track`.

android/app/src/main/java/com/fabledsword/minstrel/models/wire/SyncResponseWire.kt

@@ -42,6 +42,15 @@ data class SyncTrackWire(
     @SerialName("file_path") val filePath: String? = null,
     @SerialName("file_format") val fileFormat: String? = null,
     val genre: String? = null,
+    // The file is currently absent from disk server-side (#2704). Shipped as
+    // state rather than the row being withheld, because a missing file is
+    // expected to return — dropping it would churn the cache on every
+    // transient unmount and discard the identity #2528 preserves.
+    //
+    // Defaults false so a server predating the field deserialises cleanly and
+    // its tracks stay playable, which is the correct reading of "this server
+    // has nothing to say about missing files".
+    val missing: Boolean = false,
 )
 
 /**

android/app/src/main/java/com/fabledsword/minstrel/models/wire/TrackWire.kt

@@ -5,7 +5,7 @@ import kotlinx.serialization.Serializable
 
 /**
  * Wire shape for `TrackRef` as the server emits it. Mirrors
- * `flutter_client/lib/models/track.dart`'s `TrackRef.fromJson`
+ * the Flutter client's `TrackRef.fromJson`
  * field-for-field; the keys are snake_case because the server is Go
  * (json:"album_id" etc.).
  *
@@ -26,4 +26,9 @@ data class TrackWire(
     @SerialName("disc_number") val discNumber: Int? = null,
     @SerialName("duration_sec") val durationSec: Int = 0,
     @SerialName("stream_url") val streamUrl: String = "",
+    // Omitted by the server when false, so the default carries most rows
+    // (#2704). True only from the direct-lookup surfaces — album detail and
+    // search — which return a track the user asked for by name or container
+    // rather than one Minstrel chose.
+    val unavailable: Boolean = false,
 )

android/app/src/main/java/com/fabledsword/minstrel/models/wire/UpdateInfoWire.kt

@@ -4,12 +4,26 @@ import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
 
 /**
- * Wire shape for `GET /api/client/version`. Defaults match Flutter:
+ * Wire shape for `GET /api/client/version`.
- * apk_url falls back to `/api/client/apk` if the server omits it.
+ *
+ * `apkUrl` falls back to `/api/client/apk` if the server omits it.
+ *
+ * [code] MUST stay nullable, and this is not a style preference. The app's
+ * Json is configured with `coerceInputValues = true`, which replaces a JSON
+ * null with the declared default for a NON-nullable property — so writing
+ * `val code: Long = 0` would turn "this server reports no ordering key" into
+ * "this build's ordering key is 0", silently, with no error anywhere. A
+ * nullable type is what keeps absent distinguishable from zero, and the
+ * distinction is the whole reason the field exists.
+ *
+ * A server predating the ordering key sends neither [code] nor [channel];
+ * both arrive null and the caller falls back to comparing names.
  */
 @Serializable
 data class UpdateInfoWire(
     val version: String = "",
+    val code: Long? = null,
+    val channel: String? = null,
     @SerialName("apk_url") val apkUrl: String = "/api/client/apk",
     @SerialName("size_bytes") val sizeBytes: Long = 0,
 )

android/app/src/main/java/com/fabledsword/minstrel/player/AudioPrefetcher.kt

@@ -25,7 +25,7 @@ import javax.inject.Singleton
  * Pre-downloads the next-N tracks in the queue into the shared Media3
  * [androidx.media3.datasource.cache.SimpleCache] so a skip-forward or
  * natural advance plays from disk instead of waiting on a fresh HTTP
- * connection. Mirrors the Flutter `Prefetcher` (cache/prefetcher.dart):
+ * connection. Behaviour:
  * watches the player's current track, walks forward by
  * [com.fabledsword.minstrel.cache.audiocache.CacheSettings.prefetchWindow]
  * tracks, and pins each one. Idempotent — `CacheWriter` is a no-op when

android/app/src/main/java/com/fabledsword/minstrel/player/MinstrelForwardingPlayer.kt

@@ -14,7 +14,9 @@ import com.fabledsword.minstrel.connectivity.NetworkStatusController
 import com.fabledsword.minstrel.connectivity.ServerHealth
 import com.fabledsword.minstrel.player.output.ActiveUpnp
 import com.fabledsword.minstrel.player.output.ActiveUpnpHolder
+import com.fabledsword.minstrel.player.output.upnp.PositionInfo
 import com.fabledsword.minstrel.player.output.upnp.SoapFaultException
+import com.fabledsword.minstrel.player.output.upnp.TransportInfo
 import com.fabledsword.minstrel.player.output.upnp.TransportState
 import java.io.IOException
 import kotlin.math.abs
@@ -47,12 +49,12 @@ import timber.log.Timber
  *
  * Drop heuristic: the 1 Hz poll loop is the *sole* arbiter of route
  * liveness -- [RemotePlayerState.recordPollFailure]'s rolling threshold
- * (DROP_THRESHOLD consecutive failures) fires [onDrop]. A failed transport
+ * (DROP_THRESHOLD consecutive failures) fires [RemoteEvents.onDrop]. A failed transport
  * command (play/pause/seek/next) does NOT drop on its own: a locked phone's
  * WiFi power-save can stall a single command's socket I/O for a second or
  * two while the renderer is perfectly reachable, so commands retry on
  * transient IO failure and otherwise defer to the poll loop. The factory
- * wraps the [onDrop] callback into a SharedFlow consumed by the NowPlaying
+ * wraps that callback into a SharedFlow consumed by the NowPlaying
  * surface as a snackbar.
  *
  * Queue mode: OutputPickerController loads the full queue into Sonos's
@@ -70,13 +72,38 @@ class MinstrelForwardingPlayer(
     private val remoteState: RemotePlayerState,
     private val castNetworkLock: CastNetworkLock,
     private val networkStatus: NetworkStatusController,
-    private val onDrop: (routeName: String) -> Unit,
+    private val events: RemoteEvents = RemoteEvents(),
 ) : ForwardingPlayer(delegate) {
 
+    /**
+     * The ways remote playback reports trouble outward. Grouped rather than
+     * passed as three more constructor lambdas: they share a lifetime, they
+     * all end up as flows on [PlayerFactory], and the list grows every time
+     * the renderer finds a new way to disappoint us.
+     */
+    data class RemoteEvents(
+        /** A route stopped answering and playback fell back to the phone. */
+        val onDrop: (routeName: String) -> Unit = {},
+        /** A track could not be got playing again; surfaces to the user. */
+        val onStalled: (trackId: String) -> Unit = {},
+        /** The renderer's queue is short of ours and needs rebuilding. */
+        val onQueueTruncated: () -> Unit = {},
+        /**
+         * A raw poll reading, emitted only when it differs from the previous
+         * one. Diagnostics-only; see [TransportObservation].
+         */
+        val onTransport: (TransportObservation) -> Unit = {},
+    )
+
     private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
     private val handler = Handler(delegate.applicationLooper)
     private var pollJob: Job? = null
 
+    // Watches for the renderer stopping without being asked to. A UPnP
+    // renderer streams on its own, so a stream that dies looks like silence
+    // and nothing else in the app would notice -- see [RemoteStallWatchdog].
+    private val stallWatchdog = RemoteStallWatchdog()
+
     // Tracks consecutive non-PLAYING poll observations so a single transient
     // PAUSED_PLAYBACK / STOPPED tick during a Sonos track transition does not
     // flip the play/pause button. Manual pause still feels instant because it
@@ -90,6 +117,16 @@ class MinstrelForwardingPlayer(
     // visibly jumps backwards immediately after a drag, then forwards again.
     @Volatile private var lastSeekIssuedAtMs: Long = 0L
 
+    // Last-read renderer queue length + when we read it. See [queueStateFor]:
+    // a stopped renderer is polled once a second and its queue does not change
+    // by itself, so re-asking every tick is pure round-trips.
+    @Volatile private var cachedNrTracks: Int = 0
+    @Volatile private var lastMediaInfoAtMs: Long = 0L
+
+    // Previous raw transport reading, so [TransportObservation]s are emitted
+    // on change rather than once a second forever. Null until the first poll.
+    @Volatile private var lastObservedTransport: Pair<TransportState, Boolean>? = null
+
     // Wake channel for the poll loop. requestImmediatePoll() trySend's a Unit;
     // pollLoop's select{} races the delay against this channel so the next
     // pollOnce can fire immediately instead of waiting up to POLL_INTERVAL_MS.
@@ -481,17 +518,38 @@ class MinstrelForwardingPlayer(
             // without this the radio power-saves on a locked screen and the
             // poll below starves -- see [CastNetworkLock].
             castNetworkLock.acquire()
-            // Pause the wrapped ExoPlayer so we are not playing local audio
+            // STOP the wrapped ExoPlayer -- not pause. pause() is only
-            // simultaneously with the remote renderer. handler.post targets the
+            // playWhenReady=false: ExoPlayer's LoadControl keeps loading, so a
-            // application looper, so this runs on the same thread that processes
+            // paused-but-prepared player goes on downloading the current track
-            // our override calls -- no race with the pause() override branching
+            // (~50s of buffer). During a cast that means the phone pulls the
-            // to SOAP (holder.active is already non-null by the time this post
+            // same file the renderer is streaming, over the same WiFi, and
-            // fires, but delegate.pause() bypasses the override entirely).
+            // re-arms on every track change via syncLocalCursorToRemote's
-            handler.post { delegate.pause() }
+            // seekTo. At FLAC bitrates that is a second full-rate download
+            // competing with the speaker for air, starting exactly when a new
+            // track does. stop() ends the loading; Media3 keeps the media
+            // items, the current index and the position, so cursor sync and
+            // the handoff back are unaffected, and getPlaybackState() already
+            // reports STATE_READY while remote so no external reader sees IDLE.
+            //
+            // handler.post targets the application looper, so this runs on the
+            // same thread that processes our override calls -- no race with the
+            // pause() override branching to SOAP (holder.active is already
+            // non-null by the time this post fires, but delegate.stop()
+            // bypasses the override entirely).
+            handler.post { delegate.stop() }
             pollJob = scope.launch { pollLoop(active) }
         } else {
             castNetworkLock.release()
             remoteState.reset()
+            lastObservedTransport = null
+            // The delegate was stopped for the cast, so it is IDLE and would
+            // ignore a play(). Re-prepare it for local playback. Safe when the
+            // queue is empty, and it does not start playback on its own --
+            // playWhenReady is still false until something calls play().
+            handler.post { delegate.prepare() }
+            // The next cast starts with a clean attempt budget; a stall on the
+            // route we just left says nothing about the next one.
+            stallWatchdog.reset()
         }
     }
 
@@ -506,7 +564,7 @@ class MinstrelForwardingPlayer(
             } else if (remoteState.recordPollFailure()) {
                 if (networkStatus.state.value == ServerHealth.Healthy) {
                     Timber.w("UPnP drop threshold tripped for %s", active.routeName)
-                    handler.post { onDrop(active.routeName) }
+                    handler.post { events.onDrop(active.routeName) }
                     return
                 }
                 networkDropSuppressed = suppressDropForNetwork(active, networkDropSuppressed)
@@ -584,9 +642,146 @@ class MinstrelForwardingPlayer(
             }
             TransportState.TRANSITIONING, TransportState.UNKNOWN -> Unit
         }
+        observeTransport(transport, info)
+        checkForStall(active, info.trackUri, transport)
         notifyRemoteStateChanged()
     }
 
+    /**
+     * Ask the watchdog what to make of this poll, and act on its answer.
+     *
+     * Recovery re-issues Play and then seeks back to the last position the
+     * renderer was observed playing, so a stream that died 90 seconds into a
+     * track resumes near there rather than restarting it. The seek is
+     * best-effort and deliberately after the play: a renderer that refuses
+     * the seek is still better off playing from zero than silent.
+     */
+    private suspend fun checkForStall(
+        active: ActiveUpnp,
+        trackUri: String,
+        transport: TransportInfo,
+    ) {
+        val decision = stallWatchdog.onPoll(
+            RemoteStallWatchdog.Poll(
+                trackUri = trackUri,
+                state = transport.state,
+                statusOk = transport.statusOk,
+                playIntent = remoteState.lastPlayIntent,
+                positionMs = remoteState.positionMs,
+                nowMs = SystemClock.elapsedRealtime(),
+                queue = queueStateFor(active, transport),
+            ),
+        )
+        when (decision) {
+            is RemoteStallWatchdog.Decision.Resume -> {
+                Timber.w(
+                    "UPnP stall on %s: renderer stopped unasked (status_ok=%b), " +
+                        "resume attempt %d at %dms",
+                    active.routeName, transport.statusOk, decision.attempt, decision.resumeAtMs,
+                )
+                runCatching {
+                    retryTransport { active.avTransport.play() }
+                    if (decision.resumeAtMs > 0L) {
+                        retryTransport { active.avTransport.seek(decision.resumeAtMs) }
+                    }
+                }.onFailure {
+                    // Leave the streak alone: a failed recovery is more
+                    // evidence of a stall, and the next poll re-decides.
+                    Timber.w(it, "UPnP stall: resume attempt failed on %s", active.routeName)
+                }
+            }
+            is RemoteStallWatchdog.Decision.RepairQueue -> {
+                Timber.w(
+                    "UPnP queue truncated on %s: renderer ended at its last track " +
+                        "while %d local tracks remain; repair attempt %d",
+                    active.routeName, delegate.mediaItemCount, decision.attempt,
+                )
+                // The renderer isn't broken -- it played everything it was
+                // given. Rebuilding the queue is the fix; the controller owns
+                // queue loading, so ask it rather than duplicating that here.
+                handler.post { events.onQueueTruncated() }
+            }
+            RemoteStallWatchdog.Decision.GiveUp -> {
+                Timber.w(
+                    "UPnP stall on %s: giving up after repeated resume attempts",
+                    active.routeName,
+                )
+                // Tell the user and the admin inbox. Silence here would be the
+                // original bug: playback simply ends and nobody finds out.
+                trackIdFromStreamUri(trackUri)?.let { handler.post { events.onStalled(it) } }
+            }
+            RemoteStallWatchdog.Decision.None -> Unit
+        }
+    }
+
+    /**
+     * Publish this poll's raw transport reading if it differs from the last.
+     *
+     * Change-gated on purpose: steady playback is one reading repeated once a
+     * second, which is worth nothing and would fill the ring buffer. What is
+     * worth capturing is the renderer LEAVING a state — which during normal
+     * playback happens a couple of times per track, and during the fault the
+     * operator describes should happen repeatedly within a few seconds.
+     */
+    private fun observeTransport(transport: TransportInfo, info: PositionInfo) {
+        val key = transport.state to transport.statusOk
+        if (key == lastObservedTransport) return
+        lastObservedTransport = key
+        events.onTransport(
+            TransportObservation(
+                state = transport.state.name,
+                statusOk = transport.statusOk,
+                trackNumber = info.track,
+                positionMs = info.relTimeMs,
+                playIntent = remoteState.lastPlayIntent,
+                atElapsedMs = SystemClock.elapsedRealtime(),
+            ),
+        )
+    }
+
+    /**
+     * How the renderer's queue compares to ours, for [RemoteStallWatchdog].
+     *
+     * Only asked when the transport is actually stopped or reporting an error:
+     * while it plays, the answer changes nothing and GetMediaInfo would be a
+     * third SOAP round-trip every second. Even then the result is cached for
+     * [MEDIA_INFO_TTL_MS], because a stopped renderer gets polled once a
+     * second and its queue length does not change on its own.
+     *
+     * A renderer that reports NrTracks=0 is telling us nothing usable (some
+     * don't implement it) -- that reads as UNKNOWN, never as "empty queue",
+     * so an unhelpful renderer keeps the old resume-and-seek behaviour rather
+     * than being told its queue is broken.
+     */
+    @Suppress("ReturnCount") // one early return per verdict reads better than nesting
+    private suspend fun queueStateFor(
+        active: ActiveUpnp,
+        transport: TransportInfo,
+    ): RemoteStallWatchdog.QueueState {
+        val stalled = transport.state == TransportState.STOPPED || !transport.statusOk
+        if (!stalled) return RemoteStallWatchdog.QueueState.UNKNOWN
+
+        val now = SystemClock.elapsedRealtime()
+        if (now - lastMediaInfoAtMs > MEDIA_INFO_TTL_MS) {
+            lastMediaInfoAtMs = now
+            cachedNrTracks = runCatching { active.avTransport.getMediaInfo().nrTracks }
+                .onFailure { Timber.w(it, "UPnP GetMediaInfo failed on %s", active.routeName) }
+                .getOrDefault(0)
+        }
+        val nrTracks = cachedNrTracks
+        val rendererTrack = remoteState.trackNumber
+        if (nrTracks <= 0 || rendererTrack <= 0) return RemoteStallWatchdog.QueueState.UNKNOWN
+        if (rendererTrack < nrTracks) return RemoteStallWatchdog.QueueState.HAS_MORE
+
+        // On its last track. Whether that is a problem depends entirely on
+        // whether we have tracks it never received.
+        return if (delegate.mediaItemCount > nrTracks) {
+            RemoteStallWatchdog.QueueState.TRUNCATED
+        } else {
+            RemoteStallWatchdog.QueueState.COMPLETE
+        }
+    }
+
     /**
      * Align the paused local delegate cursor to the track the renderer is
      * actually playing, so the un-overridden current-item getters
@@ -679,6 +874,10 @@ class MinstrelForwardingPlayer(
         const val POLL_INTERVAL_MS = 1_000L
         const val NON_PLAYING_CONFIRM = 2
         const val SEEK_ACK_WINDOW_MS = 2_000L
+        // How long a GetMediaInfo queue-length reading stays good for. The
+        // watchdog needs three agreeing polls (~3s) before it acts, so one
+        // read comfortably covers a decision without asking every tick.
+        const val MEDIA_INFO_TTL_MS = 5_000L
         // Safety upper bound on how long the polling tick will wait for
         // Sonos to ack a user transport. The common case clears event-driven
         // when Sonos's reported Track matches the wrapped player; this only

android/app/src/main/java/com/fabledsword/minstrel/player/PlaybackErrorReporter.kt

@@ -23,7 +23,7 @@ private const val DEBOUNCE_MS = 2_000L
  * operator never finds out the track is bad and the next user hits
  * the same wall.
  *
- * The snackbar text mirrors Flutter's `playback_error_reporter.dart`:
+ * The snackbar text:
  * collect [PlayerController.playbackErrorEvents], debounce in a 2s
  * window, emit "Couldn't play 'X' — skipping" for a single error or
  * "Skipped N unplayable tracks" when a burst lands inside the window.

android/app/src/main/java/com/fabledsword/minstrel/player/PlayerController.kt

@@ -77,6 +77,13 @@ class PlayerController @Inject constructor(
      * during UPnP playback shows "Disconnected from <name>" to the user.
      */
     val dropEvents: SharedFlow<String> = playerFactory.dropEvents
+
+    /**
+     * Raw UPnP transport readings from [PlayerFactory.transportEvents], for
+     * the diagnostics reporter. Read-only tap — nothing in the playback path
+     * consumes it.
+     */
+    val transportEvents: SharedFlow<TransportObservation> = playerFactory.transportEvents
     private val sessionToken =
         SessionToken(context, ComponentName(context, MinstrelPlayerService::class.java))
 
@@ -128,6 +135,28 @@ class PlayerController @Inject constructor(
      */
     private var queueRefs: List<TrackRef> = emptyList()
 
+    init {
+        // A remote stall that survived the watchdog's retries is a playback
+        // failure like any other: the user gets the snackbar and the operator
+        // gets an admin-inbox row, via the same reporter that handles dead
+        // files. Without this the session just ends in silence -- the exact
+        // failure the watchdog exists to surface.
+        scope.launch {
+            playerFactory.stallEvents.collect { trackId ->
+                val title = queueRefs.firstOrNull { it.id == trackId }?.title
+                    ?.takeIf { it.isNotEmpty() } ?: "Track"
+                playbackErrorEventsChannel.trySend(
+                    PlaybackErrorEvent(
+                        trackId = trackId,
+                        kind = "stalled",
+                        title = title,
+                        detail = "remote renderer stopped and would not resume",
+                    ),
+                )
+            }
+        }
+    }
+
     /**
      * Completes when [mediaController] is non-null and the listener has
      * been attached. Used by [awaitReady] so cold-boot callers like
@@ -238,8 +267,16 @@ class PlayerController @Inject constructor(
         autoplay: Boolean = true,
     ) {
         val controller = mediaController ?: return
-        queueRefs = tracks
+        // One choke point for #2704: a track whose file the server has lost
-        val items = tracks.map { it.toMediaItem(source) }
+        // must not take a queue slot, whichever surface built the list.
+        // Playlists already drop them earlier (toPlayableTrackRefs), but
+        // album play-all, search, radio and cold-boot resume all arrive here
+        // too, and catching it once beats remembering at five call sites.
+        val playable = dropUnavailable(tracks, initialIndex)
+        if (playable.tracks.isEmpty()) return
+        queueRefs = playable.tracks
+        val items = playable.tracks.map { it.toMediaItem(source) }
+        val startIndex = playable.initialIndex
         // Drift #562 cold-boot resume calls this from a non-Main suspend
         // context after awaitReady() unblocks (ResumeController launches
         // on Dispatchers.Default by the time it reaches us). MediaController
@@ -248,7 +285,7 @@ class PlayerController @Inject constructor(
         // if we're already there, run directly to avoid the re-dispatch
         // latency UI callers depend on.
         runOnControllerThread(controller) {
-            controller.setMediaItems(items, initialIndex, /* startPositionMs = */ 0L)
+            controller.setMediaItems(items, startIndex, /* startPositionMs = */ 0L)
             controller.prepare()
             if (autoplay) controller.play()
         }
@@ -852,3 +889,37 @@ data class PlaybackErrorEvent(
     val title: String,
     val detail: String? = null,
 )
+
+/**
+ * A queue with the server-missing tracks removed, and the caller's starting
+ * index moved to match (#2704).
+ */
+data class PlayableQueue(val tracks: List<TrackRef>, val initialIndex: Int)
+
+/**
+ * Drop tracks the server has no file for, keeping [initialIndex] pointing at
+ * the same music.
+ *
+ * The index is the fiddly half and the reason this is a function rather than
+ * a `filter` at the call site: removing entries before the requested position
+ * would otherwise start playback on the wrong track. The new index is the
+ * count of surviving tracks ahead of it, which also gives the right behaviour
+ * when the requested track is ITSELF missing — playback starts at the next
+ * one that can play, i.e. it gets skipped.
+ *
+ * Returns an empty queue when nothing survives, which the caller treats as
+ * "don't touch the player": replacing a playing queue with silence because a
+ * stale list turned out to be entirely missing would be worse than ignoring
+ * the request.
+ */
+fun dropUnavailable(tracks: List<TrackRef>, initialIndex: Int): PlayableQueue {
+    if (tracks.none { it.unavailable }) return PlayableQueue(tracks, initialIndex)
+    val kept = ArrayList<TrackRef>(tracks.size)
+    var newIndex = 0
+    tracks.forEachIndexed { i, track ->
+        if (track.unavailable) return@forEachIndexed
+        if (i < initialIndex) newIndex++
+        kept.add(track)
+    }
+    return PlayableQueue(kept, newIndex.coerceAtMost((kept.size - 1).coerceAtLeast(0)))
+}

android/app/src/main/java/com/fabledsword/minstrel/player/PlayerFactory.kt

@@ -75,6 +75,38 @@ class PlayerFactory @Inject constructor(
     )
     val dropEvents: SharedFlow<String> = dropEventsInternal.asSharedFlow()
 
+    // Track ids whose remote playback stalled and could not be resumed. Same
+    // buffering rationale as dropEvents: a burst is one problem, not N.
+    private val stallEventsInternal = MutableSharedFlow<String>(
+        replay = 0,
+        extraBufferCapacity = 1,
+        onBufferOverflow = BufferOverflow.DROP_OLDEST,
+    )
+    val stallEvents: SharedFlow<String> = stallEventsInternal.asSharedFlow()
+
+    // Fires when the renderer is found to have reached the end of a queue
+    // shorter than ours -- i.e. part of the queue load never landed. The
+    // controller owns queue loading, so it collects this and rebuilds.
+    // Same one-is-enough buffering: repeated notices are the same problem.
+    private val queueRepairInternal = MutableSharedFlow<Unit>(
+        replay = 0,
+        extraBufferCapacity = 1,
+        onBufferOverflow = BufferOverflow.DROP_OLDEST,
+    )
+    val queueRepairEvents: SharedFlow<Unit> = queueRepairInternal.asSharedFlow()
+
+    // Raw renderer transport readings, change-gated. Unlike the flows above
+    // this one carries a SEQUENCE — the diagnostics flap detector needs
+    // several readings in a row to tell oscillation from a normal track
+    // transition — so it buffers more than one and drops oldest under
+    // pressure rather than collapsing to the latest.
+    private val transportInternal = MutableSharedFlow<TransportObservation>(
+        replay = 0,
+        extraBufferCapacity = TRANSPORT_EVENT_BUFFER,
+        onBufferOverflow = BufferOverflow.DROP_OLDEST,
+    )
+    val transportEvents: SharedFlow<TransportObservation> = transportInternal.asSharedFlow()
+
     fun build(): Player {
         val exo = buildExoPlayer()
         return MinstrelForwardingPlayer(
@@ -83,7 +115,12 @@ class PlayerFactory @Inject constructor(
             remoteState = remoteState,
             castNetworkLock = CastNetworkLock(context),
             networkStatus = serverHealth,
+            events = MinstrelForwardingPlayer.RemoteEvents(
                 onDrop = { name -> emitDrop(name) },
+                onStalled = { trackId -> stallEventsInternal.tryEmit(trackId) },
+                onQueueTruncated = { queueRepairInternal.tryEmit(Unit) },
+                onTransport = { transportInternal.tryEmit(it) },
+            ),
         )
     }
 
@@ -136,6 +173,12 @@ class PlayerFactory @Inject constructor(
                 .build(),
         )
 
+    private companion object {
+        // Enough readings to hold a whole flap episode plus the normal
+        // transitions around it; the detector's window is only a few seconds.
+        const val TRANSPORT_EVENT_BUFFER = 32
+    }
+
     private fun emitDrop(routeName: String) {
         dropEventsInternal.tryEmit(routeName)
     }

android/app/src/main/java/com/fabledsword/minstrel/player/PlayerUiState.kt

@@ -3,8 +3,7 @@ package com.fabledsword.minstrel.player
 import com.fabledsword.minstrel.models.TrackRef
 
 /**
- * Cycle on the repeat button: off → all → one → off. Mirrors
+ * Cycle on the repeat button: off → all → one → off. Maps directly to
- * `AudioServiceRepeatMode` in flutter_client and maps directly to
  * the three Media3 `Player.REPEAT_MODE_*` int constants.
  */
 enum class RepeatMode { OFF, ALL, ONE }

android/app/src/main/java/com/fabledsword/minstrel/player/RemoteStallWatchdog.kt

@@ -0,0 +1,222 @@
+package com.fabledsword.minstrel.player
+
+import com.fabledsword.minstrel.player.output.upnp.TransportState
+
+/**
+ * Notices when a UPnP renderer has stopped playing without being asked, and
+ * decides whether to try getting it going again.
+ *
+ * The gap this closes (diagnostics 2026-08-16): a Sonos playing from the
+ * server stopped by itself mid-track while the phone was in Doze. The poll
+ * loop was frozen, so nothing saw it; when the screen came back on the app
+ * faithfully reported "queue track 10, position 113s, not playing" and then
+ * sat there. Playback was over and no part of the app considered that a
+ * problem. A renderer streams autonomously, which is exactly why a failed
+ * stream is invisible without something watching for it.
+ *
+ * Deliberately conservative about what counts as a stall:
+ *
+ *  - Only STOPPED (or a transport reporting an error) triggers recovery.
+ *    PAUSED is left alone: the likely cause is a person pausing from the
+ *    Sonos app or a wall controller, and fighting them for the transport is
+ *    obnoxious. A stream that dies stops, it does not pause.
+ *  - Only when the operator's last intent was to play. A stop we asked for
+ *    is not a stall.
+ *  - Only after [STALL_CONFIRM_POLLS] consecutive polls agree, so a single
+ *    reading during a track change (Sonos passes through STOPPED and
+ *    TRANSITIONING between queue items) never trips it.
+ *  - At most [MAX_RESUME_ATTEMPTS] per track, spaced by
+ *    [RETRY_SPACING_MS]. A genuinely unplayable file must not become an
+ *    infinite retry loop against the renderer.
+ *
+ * A stop is not always a fault, and not always the same fault. Three
+ * different things arrive here looking identical — the transport says
+ * STOPPED and we wanted to be playing:
+ *
+ *  1. The stream died mid-track. Re-play and seek back. ([Decision.Resume])
+ *  2. The renderer reached the end of a queue *shorter than ours*, because
+ *     part of the load never landed. Nothing is broken; it is playing
+ *     exactly what it was given. Repairing the queue is the fix, and
+ *     re-playing the finished track is not. ([Decision.RepairQueue])
+ *  3. The renderer reached the end of the queue and so did we. Playback is
+ *     simply over. ([Decision.None])
+ *
+ * Case 3 matters as much as the others: without [QueueState] every cast
+ * session would end with the watchdog retrying the last track three times
+ * and then reporting a `stalled` error for a listening session that
+ * finished perfectly normally.
+ *
+ * Pure decision state, no coroutines and no SOAP: the caller owns the poll
+ * loop and performs the transport calls, this only says what should happen.
+ * That keeps the awkward part — counting, keying and giving up — testable
+ * without a renderer.
+ */
+class RemoteStallWatchdog {
+
+    /**
+     * What the renderer's queue looks like relative to ours, as of this poll.
+     * The caller derives it from GetMediaInfo's NrTracks against the local
+     * queue; it only needs to be accurate when the transport is not playing.
+     */
+    enum class QueueState {
+        /**
+         * The renderer didn't report a usable count, or it is playing and the
+         * question is moot. Treated as "assume a real stall" — the old
+         * behaviour, which is right when we know nothing.
+         */
+        UNKNOWN,
+
+        /** The renderer still has tracks after the current one. */
+        HAS_MORE,
+
+        /**
+         * The renderer is on its last track but our queue has tracks it never
+         * received — the load was truncated.
+         */
+        TRUNCATED,
+
+        /** Renderer is on its last track and so are we: playback is over. */
+        COMPLETE,
+    }
+
+    /**
+     * One poll's worth of observation. Grouped into a type rather than passed
+     * as a long parameter list so adding a fact doesn't reshuffle call sites.
+     */
+    data class Poll(
+        val trackUri: String,
+        val state: TransportState,
+        val statusOk: Boolean,
+        val playIntent: Boolean,
+        val positionMs: Long,
+        val nowMs: Long,
+        val queue: QueueState = QueueState.UNKNOWN,
+    )
+
+    sealed interface Decision {
+        /** Nothing to do. */
+        data object None : Decision
+
+        /**
+         * Ask the renderer to play again. [resumeAtMs] is the last position
+         * observed while it was actually playing, so the caller can seek back
+         * to roughly where the listener was rather than restarting the track.
+         */
+        data class Resume(val attempt: Int, val resumeAtMs: Long) : Decision
+
+        /**
+         * The renderer ran off the end of a queue we failed to fully load.
+         * The caller should append the tail it never got and resume at the
+         * next track — re-playing the current one would just replay a track
+         * the listener already heard.
+         */
+        data class RepairQueue(val attempt: Int) : Decision
+
+        /** Attempts are exhausted. Report it and stop trying for this track. */
+        data object GiveUp : Decision
+    }
+
+    private var trackKey: String = ""
+    private var lastPlayingPositionMs: Long = 0L
+    private var stoppedStreak: Int = 0
+    private var attempts: Int = 0
+    private var lastAttemptAtMs: Long = 0L
+    private var gaveUp: Boolean = false
+
+    /**
+     * Feed one poll result in, get the action out. See [Poll] for the inputs;
+     * `nowMs` is a monotonic clock (SystemClock.elapsedRealtime), passed in so
+     * tests can drive time.
+     */
+    @Suppress("ReturnCount") // early returns per state are clearer than nesting
+    fun onPoll(poll: Poll): Decision {
+        if (poll.trackUri != trackKey) {
+            // New track: a fresh attempt budget, and no inherited stall state.
+            trackKey = poll.trackUri
+            resetStall()
+            attempts = 0
+            gaveUp = false
+            lastPlayingPositionMs = 0L
+        }
+
+        if (!poll.playIntent) {
+            // Stopped because we asked. Not a stall, and the next genuine one
+            // should start from a clean budget.
+            resetStall()
+            attempts = 0
+            gaveUp = false
+            return Decision.None
+        }
+
+        if (poll.state == TransportState.PLAYING && poll.statusOk) {
+            lastPlayingPositionMs = poll.positionMs
+            resetStall()
+            // A track that recovered and is playing again has earned back its
+            // budget; a later, unrelated stall on the same track should get
+            // the full set of attempts rather than the remainder.
+            attempts = 0
+            return Decision.None
+        }
+
+        val stalled = poll.state == TransportState.STOPPED || !poll.statusOk
+        if (!stalled) {
+            // PAUSED (someone else's doing) or TRANSITIONING/UNKNOWN (in
+            // flight). Neither is a stall; drop the streak so a mid-track
+            // transition doesn't accumulate toward one.
+            resetStall()
+            return Decision.None
+        }
+
+        // The queue simply ended. Not a fault, so it must not consume the
+        // attempt budget or raise an error — the listener heard everything
+        // they queued.
+        if (poll.queue == QueueState.COMPLETE) {
+            resetStall()
+            return Decision.None
+        }
+
+        stoppedStreak += 1
+        if (stoppedStreak < STALL_CONFIRM_POLLS) return Decision.None
+        if (gaveUp) return Decision.None
+
+        if (attempts >= MAX_RESUME_ATTEMPTS) {
+            gaveUp = true
+            return Decision.GiveUp
+        }
+        if (attempts > 0 && poll.nowMs - lastAttemptAtMs < RETRY_SPACING_MS) return Decision.None
+
+        attempts += 1
+        lastAttemptAtMs = poll.nowMs
+        return if (poll.queue == QueueState.TRUNCATED) {
+            Decision.RepairQueue(attempt = attempts)
+        } else {
+            Decision.Resume(attempt = attempts, resumeAtMs = lastPlayingPositionMs)
+        }
+    }
+
+    /** Forget everything — call when the route changes or playback is torn down. */
+    fun reset() {
+        trackKey = ""
+        lastPlayingPositionMs = 0L
+        resetStall()
+        attempts = 0
+        lastAttemptAtMs = 0L
+        gaveUp = false
+    }
+
+    private fun resetStall() {
+        stoppedStreak = 0
+    }
+
+    private companion object {
+        // At the 1s poll cadence this is ~3s of agreement. Sonos passes
+        // through STOPPED between queue items, so one or two readings mean
+        // nothing on their own.
+        const val STALL_CONFIRM_POLLS = 3
+
+        // Three tries at ~5s spacing covers a server blip or a dropped
+        // connection without hammering a renderer whose file is simply bad.
+        const val MAX_RESUME_ATTEMPTS = 3
+        const val RETRY_SPACING_MS = 5_000L
+    }
+}

android/app/src/main/java/com/fabledsword/minstrel/player/ResumeController.kt

@@ -15,8 +15,7 @@ import javax.inject.Singleton
 
 /**
  * Persists the player's last queue + position to Room so a torn-down
- * session can resume on next app launch. Mirrors
+ * session can resume on next app launch.
- * `flutter_client/lib/cache/resume_controller.dart`.
  *
  * Subscribes to [PlayerController.uiState] in init; persists when the
  * (track-id, queueIndex) changes — captures real session transitions

android/app/src/main/java/com/fabledsword/minstrel/player/TransportObservation.kt

@@ -0,0 +1,38 @@
+package com.fabledsword.minstrel.player
+
+/**
+ * One reading of what a UPnP renderer says it is doing, taken by the poll
+ * loop and emitted only when it differs from the previous reading.
+ *
+ * Exists for diagnostics. The operator reports the Sonos rapidly
+ * play-pause-play-pausing at the start of a track, and nothing in the
+ * diagnostics could see it: `player_state` records source / loading / error
+ * but not whether we are playing, `track_change` needs the queue index to
+ * move, and the heartbeat samples once every 45 seconds. A symptom that
+ * lasts a few seconds and changes no index fell straight through all three.
+ *
+ * This is the closest observation point we have to the renderer's own truth
+ * — the raw GetTransportInfo reading, before the two-poll confirmation and
+ * the UI's smoothing have had a chance to hide the wobble.
+ *
+ * **It samples at the poll cadence (1 Hz).** If the real oscillation is
+ * faster than that, what lands here is an aliased jagged sequence rather
+ * than the true waveform. That still answers the question that matters —
+ * whether the renderer is steadily PLAYING or repeatedly leaving that state
+ * — but it cannot measure the true period. If a captured episode comes back
+ * looking clean, the next instrument is burst sampling, not this one.
+ */
+data class TransportObservation(
+    /** [com.fabledsword.minstrel.player.output.upnp.TransportState] name. */
+    val state: String,
+    /** CurrentTransportStatus: false means the renderer reports an error. */
+    val statusOk: Boolean,
+    /** The renderer's 1-based queue position at this reading. */
+    val trackNumber: Int,
+    /** The renderer's reported position within the track. */
+    val positionMs: Long,
+    /** Whether the operator's last intent was to be playing. */
+    val playIntent: Boolean,
+    /** Monotonic stamp, so a consumer can measure gaps between readings. */
+    val atElapsedMs: Long,
+)

android/app/src/main/java/com/fabledsword/minstrel/player/output/OutputPickerController.kt

@@ -10,11 +10,9 @@ import com.fabledsword.minstrel.models.TrackRef
 import com.fabledsword.minstrel.player.PlayerController
 import com.fabledsword.minstrel.player.PlayerFactory
 import com.fabledsword.minstrel.player.RemotePlayerState
-import com.fabledsword.minstrel.player.StreamTokenProvider
 import com.fabledsword.minstrel.player.output.upnp.AVTransportClient
 import com.fabledsword.minstrel.player.output.upnp.RenderingControlClient
 import com.fabledsword.minstrel.player.output.upnp.SoapClient
-import com.fabledsword.minstrel.player.output.upnp.SoapFaultException
 import com.fabledsword.minstrel.player.output.upnp.TransportState
 import com.fabledsword.minstrel.player.output.upnp.UpnpDiscoveryController
 import com.fabledsword.minstrel.player.output.upnp.bareUdn
@@ -61,7 +59,7 @@ data class RouteSnapshot(
  *  - [OutputRoute.Protocol.SYSTEM] — MediaRouter.selectRoute (built-in,
  *    wired, Bluetooth)
  *  - [OutputRoute.Protocol.UPNP] — mint a signed stream token via
- *    [StreamTokenProvider.mint], drive the discovered renderer with
+ *    [SonosQueueLoader], drive the discovered renderer with
  *    AVTransport.SetAVTransportURI + Play, pause local playback so
  *    audio yields to the network speaker
  *  - [OutputRoute.Protocol.CAST] / [OutputRoute.Protocol.SONOS] —
@@ -79,7 +77,7 @@ class OutputPickerController @Inject constructor(
     private val upnpDiscovery: UpnpDiscoveryController,
     private val playerController: PlayerController,
     private val playerFactory: PlayerFactory,
-    private val streamTokens: StreamTokenProvider,
+    private val sonosQueue: SonosQueueLoader,
     private val activeUpnpHolder: ActiveUpnpHolder,
     private val remoteState: RemotePlayerState,
     private val okHttp: OkHttpClient,
@@ -173,6 +171,7 @@ class OutputPickerController @Inject constructor(
             playerFactory.dropEvents.collect { handleRemoteDrop() }
         }
         scope.launch { observeQueueChangesForSonosResync() }
+        scope.launch { observeQueueRepairRequests() }
         scope.launch { observeIdleRevertWhileUpnp() }
         scope.launch { observeSelectedRouteDisappearance() }
     }
@@ -255,7 +254,7 @@ class OutputPickerController @Inject constructor(
      * setMediaItems override clears holder.active + sets target so the
      * imminent play() call drops (drops via isLoadingUpnp() = true). Then
      * this collector observes the uiState.queue change and re-runs
-     * loadQueueOnSonos to push the new tracks to Sonos.
+     * SonosQueueLoader.load to push the new tracks to Sonos.
      *
      * Discrimination: selectUpnp's initial-load path doesn't change
      * uiState.queue (the queue was already populated before route
@@ -286,6 +285,71 @@ class OutputPickerController @Inject constructor(
         }
     }
 
+    /**
+     * Rebuild the renderer's queue when playback stopped because the renderer
+     * ran off the end of a queue shorter than ours.
+     *
+     * [SonosQueueLoader] tolerates individual AddURIToQueue failures and
+     * gives up appending after a few consecutive ones
+     * -- Sonos rate-limits burst adds. Until this existed that left a short
+     * queue on the renderer and nothing to notice it: the renderer played what
+     * it had and stopped, and the app went on believing there were forty
+     * tracks left. [MinstrelForwardingPlayer] now compares GetMediaInfo's
+     * NrTracks against the local queue and asks for this.
+     *
+     * A full reload, not an incremental diff: the renderer's copy is known to
+     * be wrong, and the diff path reasons from what we *think* it holds, which
+     * is exactly the assumption that failed. The load re-seeks to the
+     * current track and plays, so recovery lands where the listener was.
+     */
+    private suspend fun observeQueueRepairRequests() {
+        playerFactory.queueRepairEvents.collect {
+            val routeId = selectedUpnpRouteIdInternal.value
+                ?: activeUpnpHolder.active.value?.routeId
+            if (routeId == null) {
+                Timber.w("Sonos queue repair skipped: no UPnP route selected")
+                return@collect
+            }
+            val state = playerController.uiState.value
+            if (state.queue.isEmpty()) {
+                Timber.w("Sonos queue repair skipped: local queue is empty")
+                return@collect
+            }
+            // Resume on the track AFTER the current one. The renderer stopped
+            // because it finished the last track it had; the local cursor is
+            // synced to that track, so reloading at it would replay something
+            // the listener just heard. The next one is what they never got.
+            val resumeAt = (state.queueIndex + 1).coerceAtMost(state.queue.size - 1)
+            repairSonosQueue(routeId, state.queue, resumeAt)
+        }
+    }
+
+    private suspend fun repairSonosQueue(
+        routeId: String,
+        queue: List<TrackRef>,
+        currentIndex: Int,
+    ) = selectUpnpMutex.withLock {
+        val upnpRoute = upnpDiscovery.routes.value.firstOrNull { it.id == routeId }
+        val transport = upnpDiscovery.transportFor(routeId)
+        if (upnpRoute == null || transport == null) {
+            Timber.w("Sonos queue repair: route or transport gone for %s", routeId)
+            return@withLock
+        }
+        val outputRoute = OutputRoute.fromUpnpRoute(upnpRoute)
+        Timber.w(
+            "Sonos queue repair: reloading %d tracks on %s (resuming at index %d)",
+            queue.size, outputRoute.name, currentIndex,
+        )
+        runCatching {
+            sonosQueue.load(transport, outputRoute, queue, currentIndex)
+        }.onFailure { e ->
+            // Leave the route active: the renderer is reachable enough to have
+            // told us its queue length, so dropping to local would be a harsher
+            // remedy than letting the next stall re-decide.
+            Timber.w(e, "Sonos queue repair failed on %s", outputRoute.name)
+        }
+    }
+
     /**
      * Bring Sonos's native queue back in sync with the local queue after a
      * mutation. Tries an incremental SOAP diff first (RemoveTrackRangeFromQueue
@@ -313,7 +377,7 @@ class OutputPickerController @Inject constructor(
             return@withLock
         }
         val handledIncrementally = runCatching {
-            tryIncrementalResync(transport, oldIds, newQueue)
+            sonosQueue.tryIncrementalResync(transport, oldIds, newQueue)
         }.getOrElse { e ->
             Timber.w(e, "Sonos incremental resync errored; falling back to full reload")
             false
@@ -337,7 +401,7 @@ class OutputPickerController @Inject constructor(
         val rendering = renderingClientFor(routeId)
         Timber.w("Sonos resync: full reload of %d tracks on %s", newQueue.size, outputRoute.name)
         runCatching {
-            loadQueueOnSonos(transport, outputRoute, newQueue, newCurrentIndex)
+            sonosQueue.load(transport, outputRoute, newQueue, newCurrentIndex)
             activeUpnpHolder.set(
                 ActiveUpnp(
                     routeId = routeId,
@@ -354,98 +418,6 @@ class OutputPickerController @Inject constructor(
         }
     }
 
-    /**
-     * Diff-based incremental Sonos queue sync. Returns true when the new
-     * queue can be produced from the old one with a remove-then-insert at
-     * the same middle slice -- the common-prefix and common-suffix portions
-     * stay untouched, and the current Sonos track must lie in the preserved
-     * prefix (otherwise the diff would orphan playback). Returns false to
-     * signal the caller to fall back to a full reload.
-     */
-    private suspend fun tryIncrementalResync(
-        transport: AVTransportClient,
-        oldIds: List<String>,
-        newQueue: List<TrackRef>,
-    ): Boolean {
-        val newIds = newQueue.map { it.id }
-        if (oldIds == newIds) return true
-        val prefixLen = commonPrefixLength(oldIds, newIds)
-        val suffixLen = commonSuffixLength(
-            oldIds.subList(prefixLen, oldIds.size),
-            newIds.subList(prefixLen, newIds.size),
-        )
-        val removedCount = oldIds.size - prefixLen - suffixLen
-        val addedCount = newIds.size - prefixLen - suffixLen
-        // Sonos's current track number is 1-based; compare against the
-        // preserved-prefix range as 0-based. If the current track is in
-        // the removed slice, incremental can't preserve playback -- caller
-        // falls back to full rebuild.
-        val currentSonosIdx0 = remoteState.trackNumber - 1
-        val canApply = currentSonosIdx0 in 0 until prefixLen
-        if (canApply) {
-            applyQueueDiff(transport, newQueue, prefixLen, removedCount, addedCount)
-        } else {
-            Timber.w(
-                "Sonos incremental: current track %d not in preserved prefix [0,%d); full rebuild",
-                currentSonosIdx0,
-                prefixLen,
-            )
-        }
-        return canApply
-    }
-
-    private suspend fun applyQueueDiff(
-        transport: AVTransportClient,
-        newQueue: List<TrackRef>,
-        prefixLen: Int,
-        removedCount: Int,
-        addedCount: Int,
-    ) {
-        if (removedCount > 0) {
-            Timber.w(
-                "Sonos incremental: RemoveTrackRangeFromQueue start=%d count=%d",
-                prefixLen + 1,
-                removedCount,
-            )
-            transport.removeTrackRangeFromQueue(
-                startingIndex = prefixLen + 1,
-                numberOfTracks = removedCount,
-            )
-        }
-        if (addedCount == 0) return
-        Timber.w(
-            "Sonos incremental: AddURIToQueue x%d starting at position %d",
-            addedCount,
-            prefixLen + 1,
-        )
-        for (i in 0 until addedCount) {
-            val ref = newQueue[prefixLen + i]
-            val token = streamTokens.mint(ref.id)
-            transport.addURIToQueue(
-                uri = token.url,
-                mime = token.mime,
-                title = token.title,
-                enqueuedURIPosition = prefixLen + i + 1,
-            )
-            if (i > 0) delay(EXTEND_THROTTLE_MS)
-        }
-    }
-
-    private fun commonPrefixLength(a: List<String>, b: List<String>): Int {
-        val limit = minOf(a.size, b.size)
-        for (i in 0 until limit) {
-            if (a[i] != b[i]) return i
-        }
-        return limit
-    }
-
-    private fun commonSuffixLength(a: List<String>, b: List<String>): Int {
-        val limit = minOf(a.size, b.size)
-        for (i in 0 until limit) {
-            if (a[a.size - 1 - i] != b[b.size - 1 - i]) return i
-        }
-        return limit
-    }
 
     /**
      * Called when the active UPnP route drops unexpectedly (the poll loop's
@@ -539,7 +511,7 @@ class OutputPickerController @Inject constructor(
      *  1. Pause local so the user doesn't keep hearing local audio.
      *  2. Set target early so ForwardingPlayer drops transport taps
      *     while the 17-second queue load is in progress.
-     *  3. Wire active LAST (after loadQueueOnSonos) so SOAP commands
+     *  3. Wire active LAST (after the queue load) so SOAP commands
      *     are never routed to a half-loaded Sonos queue.
      */
     private suspend fun selectUpnp(route: OutputRoute) = selectUpnpMutex.withLock {
@@ -580,7 +552,7 @@ class OutputPickerController @Inject constructor(
         // taps don't hit Sonos's stale state from a prior session.
         activeUpnpHolder.setTarget(effectiveRoute.id)
         runCatching {
-            loadQueueOnSonos(transport, effectiveRoute, uiState.queue, uiState.queueIndex)
+            sonosQueue.load(transport, effectiveRoute, uiState.queue, uiState.queueIndex)
             // Wire active LAST -- SOAP path is now safe to use.
             activeUpnpHolder.set(
                 ActiveUpnp(
@@ -697,108 +669,6 @@ class OutputPickerController @Inject constructor(
         return if (i >= 0) segments.getOrNull(i + 1) else null
     }
 
-    private suspend fun loadQueueOnSonos(
-        transport: AVTransportClient,
-        route: OutputRoute,
-        queue: List<TrackRef>,
-        currentIndex: Int,
-    ) {
-        Timber.w("UPnP select: clear queue on %s", route.name)
-        transport.removeAllTracksFromQueue()
-        val initialEnd = (currentIndex + 1).coerceAtMost(queue.size)
-        val initialBatch = queue.subList(0, initialEnd)
-        Timber.w(
-            "UPnP select: add %d initial tracks (currentIndex=%d, totalQueue=%d)",
-            initialBatch.size, currentIndex, queue.size,
-        )
-        initialBatch.forEachIndexed { idx, ref ->
-            val token = streamTokens.mint(ref.id)
-            transport.addURIToQueue(
-                uri = token.url,
-                mime = token.mime,
-                title = token.title,
-                enqueuedURIPosition = idx + 1,
-            )
-        }
-        val coordinatorUdn = route.id.bareUdn()
-        val queueUri = "x-rincon-queue:$coordinatorUdn#0"
-        Timber.w("UPnP select: SetAVTransportURI %s", queueUri)
-        transport.setAVTransportURI(queueUri, "")
-        Timber.w("UPnP select: Seek to track %d", currentIndex + 1)
-        transport.seekToTrack(currentIndex + 1)
-        Timber.w("UPnP select: Play")
-        transport.play()
-        Timber.w("UPnP select: initial done; backgrounding remainder")
-        val remaining = queue.drop(initialEnd)
-        if (remaining.isNotEmpty()) {
-            scope.launch { extendQueueOnSonos(transport, route, remaining, initialEnd) }
-        }
-    }
-
-    /**
-     * Background-append tracks after activation. Runs concurrently with
-     * Sonos playback. Cancels if the user disconnects from this route
-     * (active.routeId changes or becomes null). Tolerates individual
-     * AddURIToQueue failures — log and continue so some tracks loaded
-     * is better than zero tracks loaded.
-     */
-    private suspend fun extendQueueOnSonos(
-        transport: AVTransportClient,
-        route: OutputRoute,
-        tracks: List<TrackRef>,
-        startPosition: Int,
-    ) {
-        Timber.w(
-            "UPnP extend: appending %d tracks starting at position %d",
-            tracks.size, startPosition + 1,
-        )
-        var consecutiveFailures = 0
-        var succeeded = 0
-        var aborted = false
-        for ((i, ref) in tracks.withIndex()) {
-            if (aborted) break
-            if (activeUpnpHolder.active.value?.routeId != route.id) {
-                Timber.w("UPnP extend: cancelled at offset %d (route changed)", i)
-                aborted = true
-            } else {
-                val outcome = runCatching {
-                    val token = streamTokens.mint(ref.id)
-                    transport.addURIToQueue(
-                        uri = token.url,
-                        mime = token.mime,
-                        title = token.title,
-                        enqueuedURIPosition = startPosition + i + 1,
-                    )
-                }
-                if (outcome.isSuccess) {
-                    consecutiveFailures = 0
-                    succeeded += 1
-                    // Throttle the burst so we don't tickle Sonos's burst-add
-                    // rejection -- logcat 2026-06-04 showed 33 consecutive
-                    // failures clustered at ~10ms intervals once offset 39 was
-                    // reached, which looks like a rate-limit kicking in. The
-                    // delay is small enough that extending 100 tracks adds
-                    // only ~5s to background work that's already async.
-                    delay(EXTEND_THROTTLE_MS)
-                } else {
-                    consecutiveFailures += 1
-                    val e = outcome.exceptionOrNull()
-                    val detail = (e as? SoapFaultException)?.let {
-                        "code=${it.code} desc=${it.description}"
-                    } ?: e?.message
-                    Timber.w(e, "UPnP extend: append failed at offset %d -- %s", i, detail)
-                    if (consecutiveFailures >= EXTEND_ABORT_AFTER_FAILURES) {
-                        Timber.w(
-                            "UPnP extend: aborting after %d consecutive failures",
-                            consecutiveFailures,
-                        )
-                        aborted = true
-                    }
-                }
-            }
-        }
-        Timber.w("UPnP extend: done (%d / %d appended)", succeeded, tracks.size)
-    }
 
     private fun renderingClientFor(routeId: String): RenderingControlClient? {
         val rcUrl = upnpDiscovery.routes.value
@@ -830,9 +700,6 @@ class OutputPickerController @Inject constructor(
     }
 
     private companion object {
-        const val EXTEND_ABORT_AFTER_FAILURES = 3
-        const val EXTEND_THROTTLE_MS = 50L
-
         // 5 minutes of continuous non-playing on a UPnP route before we
         // revert to the phone speaker, so a stale Sonos selection can't make
         // a later "tap play" do nothing.