Acoustic fingerprints at ingest, a delete that can't lose history, and a reproducible candidate draw (#132 )

docs(readme): the music mount is writable — Minstrel deletes when asked
The quickstart mounted the library :ro and promised "Minstrel never writes to your library". That stopped being true long before #3918: quarantine's Delete file removes files, and under :ro it failed. The operator has accepted delete ownership (Scribe note #3926). The quickstart now mounts it writable and says exactly what Minstrel writes: it deletes a file when an admin asks, and never moves, renames or retags. It notes that uid 1000 needs write access, and that :ro still works, with deletes refusing and explaining why. Reorganising and tag writes stay out, pending whether Minstrel absorbs Lidarr's role. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SQ31KQpYbStyK5y58UmPLH
2026-09-11 14:43:00 -04:00 · 2026-09-11 14:34:28 -04:00 · 2026-09-11 14:34:28 -04:00 · 2026-09-11 14:23:01 -04:00 · 2026-09-11 13:21:15 -04:00 · 2026-09-11 08:44:33 -04:00
140 changed files with 6864 additions and 623 deletions
@@ -6,9 +6,20 @@
 **/build
 web/build

-# Flutter mobile client — built separately on developer machines / Flutter CI.
-# Including it in the Go build context wastes ~70 files and invalidates the
-# `COPY . .` layer cache on every Flutter-only change.
+# The Android client — built by its own job, never from this context. The APK
+# reaches the image through client/, downloaded as a CI artifact, so nothing
+# here reads android/ sources.
+#
+# This block named `flutter_client/` until 2026-09-10 and lost its PATTERN when
+# that tree was deleted, leaving a comment describing an exclusion that was no
+# longer happening. android/ never took its place, so 4.1 MB of Gradle project
+# has been entering the context and busting the `COPY . .` layer on every
+# Android-only change.
+android/
+
+# Local `make build` output — an 18 MB binary the image never uses, since the
+# builder stage compiles its own.
+bin/

 # Docs and IDE noise
 docs/
@@ -26,5 +37,8 @@ docs/
 !.env.example

 # CI workflow files don't need to ship in the image.
-.forgejo/
-.github/
+#
+# This said `.forgejo/` and `.github/` — neither of which this repo has. Gitea
+# Actions reads `.gitea/`, so the one directory that actually exists was the
+# one not excluded, and every workflow edit invalidated the context.
+.gitea/
@@ -80,15 +80,12 @@ jobs:

      - name: Upload debug APK
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        # Mirrored action, never actions/upload-artifact. @v4+ throws
-        # GHESNotSupportedError client-side on the hostname (no server setting
-        # reaches that check), and @v3 is worse — it reports success while Gitea
-        # serves artifacts back only through the v4 API, so the upload is stored
-        # and invisible to every retrieval path. @v3 is what left 72 unreachable
-        # artifacts on this repo. Pinned by SHA because the mirror auto-syncs;
-        # full URL because DEFAULT_ACTIONS_URL sends bare owner/repo to github.com.
-        # See Scribe issues 2255 / 2270.
-        uses: https://git.fabledsword.com/bvandeusen/upload-artifact@cb8afe72b42edc798abfb8fcb556cf660d894245
+        # Stock action: it works on this forge since the runner moved to
+        # gitea/runner 3.x, which edits upload-artifact's client-side GHES refusal
+        # out of the action bundle (Scribe snippet #2271). Never @v3 — it reports
+        # success while Gitea serves artifacts back only through the v4 API, and
+        # it is what left 72 unreachable artifacts on this repo (Scribe 2270).
+        uses: actions/upload-artifact@v7
        with:
          name: minstrel-android-debug-${{ github.sha }}
          path: android/app/build/outputs/apk/debug/app-debug.apk
@@ -2,15 +2,71 @@ name: release

 # Builds and pushes the minstrel container image to the Gitea registry.
 #
-#   push to main             → :main and :latest (latest-release APK bundled)
-#   push tag vYYYY.MM.DD     → :vYYYY.MM.DD and :latest (freshly-built APK bundled)
-#   workflow_dispatch        → manual trigger (same rules based on the ref)
+#   push to dev                  → :dev            (freshly-built dev APK bundled)
+#   push to main                 → :latest + :<sha> (latest-release APK bundled)
+#   push tag vYYYY.MM.DD.HHMM    → :latest          (fresh APK bundled)
+#   workflow_dispatch            → manual trigger (same rules based on the ref)
 #
-# Release model: per-day CalVer tags (no trailing patch digit). The day's
-# tag is intentionally mutable — if a second release happens the same day,
-# move the tag with `git push -f origin vYYYY.MM.DD` and the image tag of
-# the same name gets overwritten. :latest is updated by every main push
-# AND every tag push, so it always reflects the newest blessed image.
+# That is the whole tag map, and it is family rule 145 + 147 as written.
+#
+# :<sha> on main is the ROLLBACK UNIT — every production commit addressable
+# without a release ceremony. It is minted only on main, where rollback is
+# actually worth having: merges are gated (rule 2) so they number in the dozens
+# per year, while on dev they would be one per push, forever, for a channel
+# whose entire contract is that it moves.
+#
+# There are NO :<version> image tags. This repo published :vYYYY.MM.DD.HHMM
+# until 2026-09-10 and it was the inverse of the rule on both counts — minting
+# a version tag nobody pinned while the rollback unit the rule names did not
+# exist here at all. Git and the build's own self-reported version answer
+# "which build is this"; a third name for the same thing is upkeep for a model
+# we do not run. Operator, 2026-09-10: "only things like the APK need that kind
+# of versioning for their update process."
+#
+# There is no :main either. :latest tracks main's tip with no gate between them
+# (rule 147), so a second name for the same image sends readers looking for a
+# distinction that does not exist.
+#
+# The dev channel exists so testing a build does not require shipping one.
+# Before it, the only way to get an APK onto a phone was to cut a release,
+# which made `main` the staging area by default. `:dev` carries its own
+# freshly-built APK, signed with the SAME key as release builds — a different
+# key cannot install over the stable app, so anyone crossing channels would
+# have to uninstall and lose their data.
+#
+# :dev is published ALONE, with no per-commit tag. A rolling channel is
+# rolling by definition; a commit-addressable image for it would be a
+# rollback target nobody ever pulls, kept forever. Recovery on dev is to fix
+# forward.
+#
+# Note what this repo does NOT need: a cross-repo dispatch to refresh the
+# channel when its bundled APK is rebuilt. That mechanism exists elsewhere in
+# the family because the app and the server live in separate repos. Minstrel
+# is a monorepo — one push builds the APK and the image in the same run from
+# the same commit, so the channel cannot go stale against its own artifact.
+# The requirement is satisfied structurally; copying the mechanism would add
+# a moving part to fix a problem that does not exist here.
+#
+# Release model: the tag IS the artifact's version name with a `v` in front.
+# `v2026.09.10.1432` and `2026.09.10.1432` are the same string, derived from
+# the tagged commit's UTC timestamp — so there is no mismatch to reconcile
+# between what the tag says and what the APK reports, and nothing to look up
+# when minting one.
+#
+# TAGS ARE IMMUTABLE. Never move, retarget or delete a published tag. A
+# same-day second release is not a collision — HHMM makes every tag unique
+# by construction, so the answer is simply another tag.
+#
+# This block used to say the opposite: that the per-day tag was
+# "intentionally mutable" and that a same-day re-cut should
+# `git push -f origin vYYYY.MM.DD`. That instruction is what the family
+# rulebook now forbids outright, and it has incidents behind it — moving a
+# same-day tag forward once took a published release down with it. Anyone
+# installing from a tag is holding something the tag no longer points at,
+# which is a worse failure than an extra row in the tag list.
+#
+# :latest is updated by every main push AND every tag push, so it always
+# reflects the newest blessed image.
 #
 # APK pipeline: on tag pushes the android-release job builds + signs the
 # Android APK and uploads it as a workflow artifact. The image-release
@@ -24,33 +80,37 @@ name: release
 # :latest (not just tags), a main build with no APK would silently strip
 # the in-app update channel off :latest until the next release. So on
 # non-tag builds image-release pulls the MOST RECENT release's signed APK
-# and reconstructs its exact versionName (tag + commit-count, the same
-# formula android-release bakes in) for the version sidecar — no rebuild,
-# just rebundle. Tag builds keep bundling their own freshly-built APK.
+# AND the version sidecar published beside it — the recorded values, not
+# recomputed ones — so no rebuild is needed, just a rebundle. Tag builds
+# keep bundling their own freshly-built APK.
 #
 # Android testing (lint + detekt + unit tests, debug APK upload on main)
 # lives in android.yml and runs independently on every push.

 on:
  push:
-    branches: [main]
+    branches: [main, dev]
    tags: ['v*']
    paths-ignore:
      - 'docs/**'
      - '**/*.md'
  workflow_dispatch:

-# Force-moving the per-day tag (or rapidly re-pushing to main) should
-# supersede the in-flight build — the operator explicitly wants the
-# later commit to win.
+# A rapid re-push to main should supersede the in-flight build — the
+# operator explicitly wants the later commit to win. Tags no longer enter
+# into this: they are immutable and unique, so no tag build can ever be
+# superseded by another run on the same ref.
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

 jobs:
  android-release:
-    name: Build signed APK (tag releases only)
-    if: startsWith(github.ref, 'refs/tags/v')
+    name: Build signed APK (releases and dev)
+    # Also builds on `dev`, which is what makes a test channel possible at
+    # all. Without it the only way to get a build onto a phone was to cut a
+    # release, which quietly turns `main` into the staging area.
+    if: startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/dev'
    runs-on: flutter-ci
    container:
      image: git.fabledsword.com/bvandeusen/ci-android:36
@@ -75,14 +135,18 @@ jobs:
    outputs:
      version_name: ${{ steps.ver.outputs.name }}
      version_code: ${{ steps.ver.outputs.code }}
+      channel: ${{ steps.ver.outputs.channel }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
-          # fetch-depth: 0 retrieves full history; default shallow clone
-          # would return 1 for `git rev-list --count HEAD`, breaking the
-          # iteration suffix.
+          # Full history. The version name now reads only the tip commit's
+          # timestamp, so a shallow clone would technically serve — but this
+          # job derives a value that ships to devices, and a shallow checkout
+          # changes what git-derived values resolve to WITHOUT failing. The
+          # whole failure class here is a green build carrying a wrong
+          # version, so the cheap guarantee is worth keeping.
          fetch-depth: 0

      - name: Compute release version
@@ -91,12 +155,23 @@ jobs:
        working-directory: ${{ github.workspace }}
        run: |
          set -euo pipefail
-          TAG="${GITHUB_REF#refs/tags/v}"
-          COMMIT_COUNT=$(git rev-list --count HEAD)
-          VERSION_NAME="${TAG}.${COMMIT_COUNT}"
-          echo "name=${VERSION_NAME}" >> "$GITHUB_OUTPUT"
-          echo "code=${COMMIT_COUNT}" >> "$GITHUB_OUTPUT"
-          echo "::notice::APK version: ${VERSION_NAME} (code=${COMMIT_COUNT})"
+          # The derivation lives in ci/version.sh, not here, so it can be
+          # executed by a test on every push. Anything inline in this file is
+          # unverifiable until a release is already running.
+          out="$(ci/version.sh HEAD)"
+          printf '%s\n' "${out}" >> "$GITHUB_OUTPUT"
+
+          # The channel is a property of the LANE, not of the commit, which is
+          # why it is derived here rather than in version.sh. Same commit built
+          # on dev and on main reports the same NAME and differs only here —
+          # that is the whole point of separating the two values.
+          if [ "${GITHUB_REF}" = "refs/heads/dev" ]; then
+            channel=dev
+          else
+            channel=stable
+          fi
+          echo "channel=${channel}" >> "$GITHUB_OUTPUT"
+          echo "::notice::APK $(printf '%s' "${out}" | tr '\n' ' ') channel=${channel}"

      # Checked BEFORE the expensive work, not after it. "Attach APK to gitea
      # Release" below resolves the release by tag and fails if it is absent —
@@ -108,6 +183,7 @@ jobs:
      # the release together, so this passes). A bare `git push origin vX` is the
      # case this catches.
      - name: Release must exist for this tag
+        if: startsWith(github.ref, 'refs/tags/v')
        shell: bash
        working-directory: ${{ github.workspace }}
        env:
@@ -156,13 +232,12 @@ jobs:
            -PMINSTREL_VERSION_CODE=${{ steps.ver.outputs.code }}

      - name: Upload APK as workflow artifact
-        # Mirrored action, never actions/upload-artifact — @v4+ refuses on the
-        # hostname, @v3 uploads something Gitea will never serve back. This is
-        # the producing half of a pair: image-release downloads `minstrel-apk`
-        # below with the matching download-artifact mirror. Both must stay on
-        # the v4 protocol — mixing a v3 upload with a v4 download (or the
-        # reverse) yields an empty listing, not an error. See Scribe 2255 / 2270.
-        uses: https://git.fabledsword.com/bvandeusen/upload-artifact@cb8afe72b42edc798abfb8fcb556cf660d894245
+        # Stock action (snippet #2271) — never @v3, which uploads something Gitea
+        # will never serve back. This is the producing half of a pair:
+        # image-release downloads `minstrel-apk` below. Any upload v4+ pairs with
+        # any download v4+ on this forge (every combination tested 2026-09-10,
+        # Scribe spike #3843), so the two pins need not move together.
+        uses: actions/upload-artifact@v7
        with:
          name: minstrel-apk
          path: android/app/build/outputs/apk/release/app-release.apk
@@ -171,9 +246,15 @@ jobs:
          if-no-files-found: error

      - name: Attach APK to gitea Release
+        # Tag releases only. A dev build has no Release to hang assets on and
+        # does not need one — the :dev image bundles the APK, and the server
+        # serves it from /api/client/apk like any other.
+        if: startsWith(github.ref, 'refs/tags/v')
        shell: bash
        env:
          CI_TOKEN: ${{ secrets.CI_TOKEN }}
+          VERSION_NAME: ${{ steps.ver.outputs.name }}
+          VERSION_CODE: ${{ steps.ver.outputs.code }}
        run: |
          set -euxo pipefail
          TAG="${GITHUB_REF#refs/tags/}"
@@ -181,6 +262,20 @@ jobs:
          APK_PATH="app/build/outputs/apk/release/app-release.apk"
          ls -lh "${APK_PATH}"

+          # Publish the version sidecar as a release asset next to the APK.
+          #
+          # This is what lets a later :latest build stop RECONSTRUCTING the
+          # bundled APK's version and simply read what was recorded. The
+          # ordering key in particular cannot be re-derived after the fact —
+          # it is build-time minutes, so once this job ends the value exists
+          # nowhere else. Reconstruction could only ever recover the name,
+          # and only by duplicating a formula that then has to be kept in
+          # step across two files.
+          SIDECAR_PATH="/tmp/minstrel.apk.version"
+          printf '{"name":"%s","code":%s,"channel":"stable"}\n' \
+            "${VERSION_NAME}" "${VERSION_CODE}" > "${SIDECAR_PATH}"
+          cat "${SIDECAR_PATH}"
+
          RELEASE_JSON="$(curl -fsSL \
            -H "Authorization: token ${CI_TOKEN}" \
            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/tags/${TAG}")"
@@ -202,6 +297,20 @@ jobs:
            exit 1
          fi

+          # Same treatment for the sidecar. Named `.apk.version` so the
+          # downloader's `\.apk$` match cannot pick it up by mistake.
+          SIDECAR_HTTP=$(curl -sS -L -o /tmp/upload-sidecar.out -w '%{http_code}' \
+            -H "Authorization: token ${CI_TOKEN}" \
+            -F "attachment=@${SIDECAR_PATH}" \
+            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=minstrel-${TAG}.apk.version")
+          echo "sidecar_upload_http=${SIDECAR_HTTP}"
+          cat /tmp/upload-sidecar.out || true
+          echo
+          if [ "${SIDECAR_HTTP}" -lt 200 ] || [ "${SIDECAR_HTTP}" -ge 300 ]; then
+            echo "::error::version sidecar upload returned HTTP ${SIDECAR_HTTP}"
+            exit 1
+          fi
+
  image-release:
    name: Build + push container image
    # `needs:` waits for android-release. For tag pushes android-release
@@ -222,11 +331,16 @@ jobs:
      - name: Checkout
        uses: actions/checkout@v4
        with:
-          # Full history + tags so non-tag :latest builds can resolve the
-          # latest release tag's commit count and reconstruct the bundled
-          # APK's exact versionName (see "Bundle latest release APK" below).
+          # Full history, and rule 149 names this specifically: any job that
+          # DERIVES the version name needs it, because a shallow clone changes
+          # what git-derived values resolve to WITHOUT failing — a too-low
+          # value, silently, with every lane green.
+          #
+          # This job was depth-1 while it took the version from GITHUB_REF. It
+          # now runs ci/version.sh itself, because with :<version> image tags
+          # gone the server's self-reported version is the only thing that says
+          # which build an image is.
          fetch-depth: 0
-          fetch-tags: true

      - name: Detect buildable project
        id: guard
@@ -244,21 +358,68 @@ jobs:
        if: steps.guard.outputs.ready == 'true'
        shell: bash
        run: |
-          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
-            VERSION="${GITHUB_REF#refs/tags/}"
-            echo "args=-t ${IMAGE}:${VERSION} -t ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
-            echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-            echo "::notice::Release build: ${VERSION} + latest"
-          else
-            # Main is the protected, post-PR-merge branch. Treat it as the
-            # rolling stable channel — every main push moves :latest.
-            # Pinned consumers can target :vYYYY.MM.DD; everyone else
-            # gets the newest main.
-            echo "args=-t ${IMAGE}:main -t ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
-            echo "version=main" >> "$GITHUB_OUTPUT"
-            echo "::notice::Main-branch build: :main + :latest"
+          set -euo pipefail
+
+          # THE VERSION, and it is derived the same way on every ref — the
+          # branch decides the CHANNEL, never the version (family rule 149).
+          #
+          # This used to be three different things: the literal string "main"
+          # on main, "dev" on dev, and the tag name on a tag. None of them
+          # ordered, and the first two were the same string forever — two dev
+          # images eight weeks apart were indistinguishable in the UI. That
+          # mattered little while :vYYYY.MM.DD.HHMM existed to identify a
+          # build; with version image tags gone, this IS how an operator tells
+          # which build a container is running.
+          #
+          # `sed -n s///p` rather than `grep`: it exits 0 when nothing matches,
+          # so the empty check below is actually reachable. A grep here would
+          # kill the step at the assignment under the runner's pipefail — the
+          # exact bug that took down the first main build after the version
+          # rework.
+          VERSION="$(ci/version.sh HEAD | sed -n 's/^name=//p')"
+          if [ -z "${VERSION}" ]; then
+            echo "::error::could not derive a build version from ci/version.sh"
+            exit 1
          fi

+          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
+            # A release refreshes the CHANNEL and mints nothing else.
+            #
+            # The tag build exists to produce the signed APK and attach it to
+            # the release; the image it rebuilds is the SAME SOURCE as the main
+            # build minutes earlier, differing only in which APK is baked in.
+            # Rule 145 is explicit about that case: when the same source is
+            # rebuilt with different contents, publish the moving channel tag
+            # and never a commit-addressable one.
+            #
+            # :latest must move here rather than waiting for the next main
+            # push, or the channel would carry the PREVIOUS release's APK
+            # indefinitely — a channel that cannot refresh itself (rule 146).
+            CHANNEL=stable
+            echo "args=-t ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
+            echo "::notice::Release build ${VERSION}: refreshing :latest around the new APK"
+          elif [[ "${GITHUB_REF}" == "refs/heads/dev" ]]; then
+            # The rolling test channel, and :dev ALONE — deliberately no
+            # per-commit tag. A rolling channel is rolling by definition, so a
+            # commit-addressable image here would be a rollback target nobody
+            # has ever pulled, accumulating in the registry forever. Recovery
+            # on dev is to fix forward.
+            CHANNEL=dev
+            echo "args=-t ${IMAGE}:dev" >> "$GITHUB_OUTPUT"
+            echo "::notice::Dev-branch build ${VERSION}: :dev"
+          else
+            # The production line: :latest tracks main's tip (rule 147) and
+            # :<sha> is the rollback unit (rule 145). Full 40-char SHA, matching
+            # the family's other repos, so a rollback target is addressable
+            # straight from the commit anyone is reading.
+            CHANNEL=stable
+            echo "args=-t ${IMAGE}:latest -t ${IMAGE}:${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+            echo "::notice::Main-branch build ${VERSION}: :latest + :${GITHUB_SHA}"
+          fi
+
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "channel=${CHANNEL}" >> "$GITHUB_OUTPUT"
+
      - name: Registry login
        if: steps.guard.outputs.ready == 'true'
        shell: bash
@@ -267,54 +428,57 @@ jobs:
            | docker login git.fabledsword.com -u "${{ github.actor }}" --password-stdin

      - name: Download signed APK artifact
-        # Tag pushes only — android-release just produced this. Non-tag
-        # builds take the "Bundle latest release APK" path below instead.
-        if: steps.guard.outputs.ready == 'true' && startsWith(github.ref, 'refs/tags/v')
-        # Consuming half of the pair — never actions/download-artifact. Same fork,
-        # same reason: upstream's client-side GHES check rejects this hostname
-        # before it connects. bvandeusen/download-artifact mirrors
-        # code.forgejo.org/forgejo/download-artifact.
-        #
-        # SHA below is that fork's `v6` tag. Match on @actions/artifact, NOT on
-        # the action's own version number — the two actions release on unrelated
-        # cadences, and download v5 would pair a ^2.3.2 client with this file's
-        # ^4.0.0 uploader. v6 is the tag whose bundled library major (^4.0.0) is
-        # the same one proven against this instance by the upload side.
-        # Deliberately NOT v7: it moves to node24 and upstream requires runner
-        # >= 2.327.1 for it, which act_runner does not claim to satisfy.
-        # Pinned, not tagged — the mirror auto-syncs every 8h.
-        uses: https://git.fabledsword.com/bvandeusen/download-artifact@8d4e9521a5f7e5f8b6351f341f719f9f45a92a3a
+        # Tag and dev pushes — android-release just produced this. Only `main`
+        # takes the "Bundle latest release APK" path below, because it is the
+        # one ref that moves a channel without building an APK of its own.
+        if: >-
+          steps.guard.outputs.ready == 'true' &&
+          (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/dev')
+        # Consuming half of the pair: stock download-artifact, which works here for
+        # the same reason as the upload (gitea/runner 3.x edits the GHES refusal
+        # out of the bundle; snippet #2271). v8 runs on node24, which every
+        # CI-runner image carries — the runner uses the image's own node.
+        uses: actions/download-artifact@v8
        with:
          name: minstrel-apk
          path: client/

      - name: Stage bundled APK + version sidecar
-        if: steps.guard.outputs.ready == 'true' && startsWith(github.ref, 'refs/tags/v')
+        if: >-
+          steps.guard.outputs.ready == 'true' &&
+          (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/dev')
        shell: bash
        env:
-          # Pulled from android-release.outputs.version_name so the
-          # sidecar string the server hands clients matches the
-          # versionName baked into the APK they're comparing against.
+          # All three pulled from android-release's outputs so the sidecar the
+          # server hands clients matches exactly what is baked into the APK
+          # they are comparing against.
          APK_VERSION_NAME: ${{ needs.android-release.outputs.version_name }}
+          APK_VERSION_CODE: ${{ needs.android-release.outputs.version_code }}
+          APK_CHANNEL: ${{ needs.android-release.outputs.channel }}
        run: |
          set -euxo pipefail
          # The artifact lands as `app-release.apk` (the original Gradle
          # output name). The Dockerfile COPYs client/* into /app/client/
          # and the server reads minstrel.apk + minstrel.apk.version.
          mv client/app-release.apk client/minstrel.apk
-          echo "${APK_VERSION_NAME}" > client/minstrel.apk.version
+          printf '{"name":"%s","code":%s,"channel":"%s"}\n' \
+            "${APK_VERSION_NAME}" "${APK_VERSION_CODE}" "${APK_CHANNEL}" \
+            > client/minstrel.apk.version
+          cat client/minstrel.apk.version
          ls -lh client/

      - name: Bundle latest release APK (non-tag :latest builds)
        # Main pushes don't build an APK, but they DO move :latest — so
        # without this the in-app update channel would vanish from :latest
        # until the next tag. Pull the most-recent release's signed APK and
-        # reconstruct its exact versionName (${TAG#v}.$(git rev-list --count
-        # TAG) — identical to android-release's formula) so the version
-        # sidecar the server hands clients matches the installed build.
+        # the sidecar published beside it, so what the server reports is what
+        # that build actually recorded rather than something re-derived here.
        # Degrades to an empty client/ (404 update channel) — never a wrong
-        # version — if no release / APK asset / tag-count can be resolved.
-        if: steps.guard.outputs.ready == 'true' && !startsWith(github.ref, 'refs/tags/v')
+        # version — if no release or APK asset can be resolved. That
+        # degradation only actually works because the greps below carry
+        # `|| true`; under the runner's default pipefail a non-matching grep
+        # kills the step instead of falling through to the empty-case branch.
+        if: steps.guard.outputs.ready == 'true' && github.ref == 'refs/heads/main'
        shell: bash
        env:
          CI_TOKEN: ${{ secrets.CI_TOKEN }}
@@ -326,19 +490,40 @@ jobs:
          if [ -z "${REL_JSON}" ]; then
            echo "::notice::no published release — image ships without bundled APK"; exit 0
          fi
-          TAG="$(printf '%s' "${REL_JSON}" | grep -oP '"tag_name":\s*"\K[^"]+' | head -1)"
-          APK_URL="$(printf '%s' "${REL_JSON}" | grep -oP '"browser_download_url":\s*"\K[^"]+' | grep -E '\.apk$' | head -1)"
+          # `|| true` on every one of these, and it is load-bearing rather
+          # than defensive habit. The runner already invokes this shell as
+          # `bash -e -o pipefail`, so a pipeline whose grep matches NOTHING
+          # exits non-zero even though `head` succeeded — and the step dies at
+          # the assignment, before ever reaching the `if` written to handle the
+          # empty case. Every "degrades gracefully" branch below is unreachable
+          # without this.
+          TAG="$(printf '%s' "${REL_JSON}" | grep -oP '"tag_name":\s*"\K[^"]+' | head -1)" || true
+          APK_URL="$(printf '%s' "${REL_JSON}" | grep -oP '"browser_download_url":\s*"\K[^"]+' | grep -E '\.apk$' | head -1)" || true
          if [ -z "${TAG}" ] || [ -z "${APK_URL}" ]; then
            echo "::notice::latest release '${TAG:-?}' has no APK asset — image ships without bundled APK"; exit 0
          fi
-          COUNT="$(git rev-list --count "${TAG}" 2>/dev/null || true)"
-          if [ -z "${COUNT}" ]; then
-            echo "::notice::could not resolve commit count for ${TAG} (tag not fetched?) — skipping APK bundle"; exit 0
-          fi
-          VERSION_NAME="${TAG#v}.${COUNT}"
          curl -fsSL -H "Authorization: token ${CI_TOKEN}" -o client/minstrel.apk "${APK_URL}"
-          echo "${VERSION_NAME}" > client/minstrel.apk.version
-          echo "::notice::bundled release APK ${TAG} as version ${VERSION_NAME}"
+
+          # Take the version the release RECORDED rather than recomputing it.
+          # This used to re-derive the name from the tagged commit, which meant
+          # the formula lived in two files that had to be kept in step, and it
+          # could only ever recover the name — the ordering key is build-time
+          # minutes and does not exist anywhere after that build ends.
+          SIDECAR_URL="$(printf '%s' "${REL_JSON}" | grep -oP '"browser_download_url":\s*"\K[^"]+' | grep -E '\.apk\.version$' | head -1)" || true
+          if [ -n "${SIDECAR_URL}" ]; then
+            curl -fsSL -H "Authorization: token ${CI_TOKEN}" -o client/minstrel.apk.version "${SIDECAR_URL}"
+            cat client/minstrel.apk.version
+          else
+            # Releases published before sidecars were attached. Their name is
+            # still recoverable from the tag, but their ordering key genuinely
+            # is not — so it is reported ABSENT rather than guessed. A wrong
+            # key is an install the platform refuses; an absent one just tells
+            # the client to fall back to comparing names, which is exactly
+            # what those builds already do.
+            echo "::notice::release ${TAG} predates the version sidecar — bundling with name only, no ordering key"
+            printf '{"name":"%s","code":null,"channel":"stable"}\n' "${TAG#v}" > client/minstrel.apk.version
+          fi
+          echo "::notice::bundled release APK from ${TAG}"
          ls -lh client/

      - name: Build and push
@@ -346,6 +531,7 @@ jobs:
        run: |
          docker buildx build \
            --build-arg MINSTREL_VERSION="${{ steps.tags.outputs.version }}" \
+            --build-arg MINSTREL_CHANNEL="${{ steps.tags.outputs.channel }}" \
            --push ${{ steps.tags.outputs.args }} .

  # Verifies a tag release actually ended up complete, and names the specific
@@ -356,8 +542,8 @@ jobs:
  # `failure` with none executed and image-release showed `skipped`. The run was
  # red, but the *release page rendered fine*, and `main`'s own push build had
  # already moved `:latest`, so the code was deployable and nothing looked
-  # obviously wrong. The release was simply missing its APK and its immutable
-  # `:vYYYY.MM.DD` image, which is easy to skim past.
+  # obviously wrong. The release was simply missing its APK and its image,
+  # which is easy to skim past.
  #
  # This job cannot prevent that (the cause was a runner failing to launch, not
  # anything in this file). What it does is turn an incomplete release into an
@@ -408,18 +594,30 @@ jobs:
      # missing when v2026.08.07 had to be re-cut. `always()` on this job means
      # it runs even when image-release failed, so without this the guard would
      # cheerfully verify an incomplete release.
-      - name: Immutable image tag must exist
+      #
+      # This asserted `:${TAG}` — the :vYYYY.MM.DD.HHMM image — until
+      # 2026-09-10. Version image tags are no longer published (rule 145), so
+      # that assertion would now fail every release for a tag nothing mints.
+      # The rollback target it was really protecting is the :<sha> image, which
+      # main's own build published for this same commit before the tag was cut.
+      #
+      # Checking it here earns its keep twice over: it still catches an image
+      # push that silently did not happen, and it additionally proves the
+      # ORDERING — a tag cut on a commit whose main build never completed has
+      # no rollback target, and that is worth failing on rather than
+      # discovering during an incident.
+      - name: Rollback image must exist for the tagged commit
        shell: bash
        run: |
          set -euo pipefail
-          TAG="${GITHUB_REF#refs/tags/}"
          IMAGE="git.fabledsword.com/bvandeusen/minstrel"

          echo "${{ secrets.CI_TOKEN }}" \
            | docker login git.fabledsword.com -u "${{ github.actor }}" --password-stdin

-          if ! docker manifest inspect "${IMAGE}:${TAG}" > /dev/null 2>&1; then
-            echo "::error::image ${IMAGE}:${TAG} was never pushed — the release tag has no immutable image, so there is nothing to pin or roll back to. Re-run this workflow run."
+          if ! docker manifest inspect "${IMAGE}:${GITHUB_SHA}" > /dev/null 2>&1; then
+            echo "::error::image ${IMAGE}:${GITHUB_SHA} does not exist — this commit has no rollback target."
+            echo "::error::That image is published by the MAIN build of this commit, not by the tag build. If main's build never ran or failed, fix that first; a release whose commit cannot be rolled back to is the thing this check exists to refuse."
            exit 1
          fi
-          echo "::notice::image verified: ${IMAGE}:${TAG}"
+          echo "::notice::rollback target verified: ${IMAGE}:${GITHUB_SHA}"
@@ -32,6 +32,12 @@ on:
      - 'cmd/**'
      - '.golangci.yml'
      - '.gitea/workflows/test-go.yml'
+      # The release lane's own trigger is `main` + tags, so nothing it
+      # contains is exercised until a release is already running. These two
+      # entries are what let internal/server/release_version_test.go guard
+      # the version derivation on ordinary dev pushes instead.
+      - 'ci/**'
+      - '.gitea/workflows/release.yml'

 # pull_request trigger intentionally omitted — see test-web.yml for
 # the rationale (single-author repo, push covers PR-merge equivalent).
@@ -12,6 +12,11 @@
 # Test binary, built with `go test -c`
 *.test

+# `make build` output. bin/minstrel was tracked until 2026-09-10 — an 18 MB
+# binary committed by accident, last refreshed by a commit about web test
+# mocks, and re-dirtied by every local build since.
+bin/
+
 # Bundled Android APK + version sidecar (#397). Populated by CI for
 # tag releases; never committed. README in client/ explains the flow.
 client/minstrel.apk
@@ -15,17 +15,32 @@ COPY . .
 # Overwrite the committed placeholder with the freshly-built SPA assets.
 COPY --from=web /web/build ./web/build
 ENV CGO_ENABLED=0
-# Version stamping: release.yml passes the git tag via MINSTREL_VERSION
-# build-arg; local `docker build` falls back to "dev". Surfaced at
-# /healthz for operator-side image-version verification.
+# Version stamping. release.yml passes the DERIVED version name
+# (YYYY.MM.DD.HHMM) and the lane's channel; a local `docker build` falls back
+# to "dev"/"local". Both are surfaced at /healthz.
+#
+# These are two values on purpose (family rule 149): the same commit built on
+# dev and on main reports the same NAME and differs only in CHANNEL. Folding
+# the channel into the version string is what the rule forbids — the version
+# used to BE the channel word here ("main"/"dev"), which meant two dev images
+# eight weeks apart were indistinguishable.
 ARG MINSTREL_VERSION=dev
+ARG MINSTREL_CHANNEL=local
 RUN go build -trimpath \
-    -ldflags="-s -w -X 'git.fabledsword.com/bvandeusen/minstrel/internal/server.ServerVersion=${MINSTREL_VERSION}'" \
+    -ldflags="-s -w \
+      -X 'git.fabledsword.com/bvandeusen/minstrel/internal/server.ServerVersion=${MINSTREL_VERSION}' \
+      -X 'git.fabledsword.com/bvandeusen/minstrel/internal/server.ServerChannel=${MINSTREL_CHANNEL}'" \
    -o /out/minstrel ./cmd/minstrel

 FROM debian:bookworm-slim
+# ffmpeg: duration probes and the exact-tier audio hash (a SHA-256 of the
+# encoded audio packets, so no decode). libchromaprint-tools: fpcalc, the
+# acoustic fingerprint that tells the same recording at two bitrates apart
+# from two different recordings (M400). Both are baked in at build time so a
+# deployed instance never fetches either (rule 164); fpcalc is shelled out
+# rather than bound because CGO_ENABLED=0 above rules out cgo.
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates ffmpeg \
+    && apt-get install -y --no-install-recommends ca-certificates ffmpeg libchromaprint-tools \
    && rm -rf /var/lib/apt/lists/*

 RUN groupadd --system --gid 1000 minstrel \
@@ -37,8 +37,12 @@ services:
    ports: ['4533:4533']
    volumes:
      # Your music library. Point ./music at wherever your audio files
-      # live. Mounted read-only — Minstrel never writes to your library.
-      - ./music:/music:ro
+      # live. Writable, because Minstrel deletes a file when an admin asks
+      # it to (for example, quarantine's "Delete file"). It never moves,
+      # renames or retags anything. The container runs as uid 1000, so that
+      # user needs write access to the folders. Mount it :ro to forbid even
+      # deletes: those actions then refuse, say why, and delete nothing.
+      - ./music:/music
      # Generated data: playlist cover collages, artist art, caches.
      # The path must match MINSTREL_STORAGE_DATA_DIR, which the image
      # sets to /app/data — keep this mount on /app/data or your cache
@@ -47,7 +51,7 @@ services:
    environment:
      MINSTREL_DATABASE_URL: postgres://minstrel:minstrel@db:5432/minstrel?sslmode=disable
      # Colon-separated library roots to scan; must match the container
-      # path of the read-only music mount above (/music here).
+      # path of the music mount above (/music here).
      MINSTREL_LIBRARY_SCAN_PATHS: /music
    depends_on: [db]

@@ -112,11 +116,21 @@ Most operational keys have a `MINSTREL_<SECTION>_<FIELD>` env override. Recommen

 Image tags (`git.fabledsword.com/bvandeusen/minstrel:<tag>`):

- `:latest` — the newest blessed image. Moves on every `main` push **and** every release. Recommended for most operators.
- `:vYYYY.MM.DD` — immutable per-day release tags. Pin one of these for a deployment you don't want moving under you. (Per-day CalVer — no trailing patch digit; a same-day re-cut moves the tag forward.)
- `:main` — the rolling post-merge tip. Same image as `:latest` at push time; choose it if you want to track `main` explicitly rather than the release line.
+- `:latest` — production. Tracks `main`'s tip and moves on every `main` push and every release. What most operators should run.
+- `:<commit-sha>` — the rollback unit. Every `main` push publishes one, so any production commit is addressable without a release ceremony. Immutable: a given SHA tag is never re-pushed. Pin one if you need a deployment that cannot change under you, and use it to roll back.
+- `:dev` — the rolling test channel, rebuilt on every push to `dev` and carrying its own freshly-built Android APK. Run this to try something before it ships. It moves constantly, has no per-commit tag, and its only recovery path is forward — if a `:dev` image is broken, the fix is the next push, not a rollback.

-Every `:latest` and every `:vYYYY.MM.DD` bundles the current signed Android APK, so the in-app update channel is always live. Database migrations run automatically at startup; rollbacks require restoring a Postgres dump.
+That is the whole tag map. **There are no version-numbered image tags**, and no `:main`. Git and the build's own self-reported version answer "which build is this" — the Settings page shows it, and so does `/healthz`. Release *tags* in git are still `vYYYY.MM.DD.HHMM`; they name a changelog entry and the APK attached to it, not an image.
+
+Rolling back to `:<commit-sha>` pins the **server code** at that commit — not the server-and-app pair. The Android APK is baked in at image build time, so a SHA image carries whichever app was current when that commit was built, which may be older than what `:latest` bundles now. If both halves matter, check what the image bundles rather than trusting the tag's name.
+
+Every `:latest`, `:<commit-sha>` and `:dev` bundles a signed Android APK, so the in-app update channel is always live. All are signed with the same key, so a phone can move between the stable and dev channels without uninstalling — point it at a `:dev` server and the in-app updater offers that channel's build.
+
+The app reports which channel it is on alongside its version, and decides whether an update is available using the build's ordering key rather than its displayed name — the same value Android installs by, so an offer it makes is one the platform will accept.
+
+Database migrations run automatically at startup; rollbacks require restoring a Postgres dump.
+
+Releases up to 2026-09-10 also published a `:vYYYY.MM.DD[.HHMM]` image tag. Those images still exist and still work — they are simply not extended.

 ## Specs

@@ -150,7 +164,7 @@ Two concurrent dev processes:

 - Day-to-day work happens on `dev` (or feature branches merged into `dev`).
 - `main` is **protected** — changes land via PR from `dev`.
- Releases are cut by tagging `v*` off `main`; the release workflow builds and pushes the container image to the Gitea registry.
+- Releases are cut by tagging `v*` off `main`; the release workflow builds the signed APK, attaches it to the release, and refreshes `:latest` around it.

 Task and milestone tracking: Fable (`Minstrel` project, id 12).

@@ -21,13 +21,24 @@ android {
        applicationId = "com.fabledsword.minstrel"
        minSdk = 26
        targetSdk = 36
-        // versionName / versionCode are released-build values injected by
-        // CI from the git tag + commit count. Local / debug builds fall
-        // back to "dev" so the About card reads honestly. Releases ship
-        // versionName="YYYY.MM.DD.<commits>" (e.g. "2026.06.02.142") and
-        // versionCode=<commits>, which is monotonic forever and lets the
-        // shared isVersionNewer comparator distinguish two same-day
-        // re-cuts (the iteration suffix differs).
+        // versionName / versionCode are released-build values injected by CI.
+        // Local / debug builds fall back to "dev" so the About card reads
+        // honestly.
+        //
+        // versionName is "YYYY.MM.DD.HHMM" from the COMMIT's timestamp, so
+        // every lane building this source reports the same string and the
+        // channel is the only thing that differs between them.
+        //
+        // versionCode is minutes since 2020-01-01 at BUILD time. It is the
+        // value the platform decides installs by, so it must be monotonic by
+        // construction.
+        //
+        // This comment used to say versionCode was a commit count and that it
+        // was "monotonic forever". It was neither — a commit count runs ahead
+        // on `dev`, so a dev build outranked the `main` release meant to
+        // replace it and Android refused the install as a downgrade. Worth
+        // knowing the claim was here, stated as a reassurance, while the bug
+        // it denied was live.
        val versionNameOverride =
            (project.findProperty("MINSTREL_VERSION_NAME") as String?)?.takeIf { it.isNotBlank() }
        val versionCodeOverride =
@@ -150,7 +161,6 @@ dependencies {
    implementation(libs.compose.ui)
    implementation(libs.compose.ui.graphics)
    implementation(libs.compose.material3)
-    implementation(libs.compose.ui.text.google.fonts)
    debugImplementation(libs.compose.ui.tooling)
    implementation(libs.compose.ui.tooling.preview)

@@ -15,10 +15,14 @@ import androidx.compose.material3.HorizontalDivider
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedButton
 import androidx.compose.material3.Scaffold
+import androidx.compose.material3.SnackbarHost
+import androidx.compose.material3.SnackbarHostState
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
+import androidx.compose.runtime.remember
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.text.style.TextOverflow
@@ -42,6 +46,12 @@ fun AdminQuarantineScreen(
    viewModel: AdminQuarantineViewModel = hiltViewModel(),
 ) {
    val state by viewModel.uiState.collectAsStateWithLifecycle()
+    val snackbarHostState = remember { SnackbarHostState() }
+    LaunchedEffect(Unit) {
+        viewModel.transientMessages.collect { msg ->
+            snackbarHostState.showSnackbar(msg)
+        }
+    }
    Scaffold(
        contentWindowInsets = ShellContentWindowInsets,
        modifier = Modifier.fillMaxSize(),
@@ -53,6 +63,7 @@ fun AdminQuarantineScreen(
                onBack = { navController.popBackStack() },
            )
        },
+        snackbarHost = { SnackbarHost(snackbarHostState) },
    ) { inner ->
        PullToRefreshScaffold(
            onRefresh = { viewModel.refresh().join() },
@@ -10,10 +10,13 @@ import com.fabledsword.minstrel.events.EventsStream
 import com.fabledsword.minstrel.models.AdminQuarantineItemRef
 import dagger.hilt.android.lifecycle.HiltViewModel
 import kotlinx.coroutines.Job
+import kotlinx.coroutines.channels.Channel
+import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.flow.filter
+import kotlinx.coroutines.flow.receiveAsFlow
 import kotlinx.coroutines.launch
 import javax.inject.Inject

@@ -34,6 +37,15 @@ class AdminQuarantineViewModel @Inject constructor(
    private val internal = MutableStateFlow<AdminQuarantineUiState>(AdminQuarantineUiState.Loading)
    val uiState: StateFlow<AdminQuarantineUiState> = internal.asStateFlow()

+    /**
+     * One-shot messages for the screen's snackbar. A failed action has to say
+     * why: the row quietly reappearing reads as a glitch, and for a Delete
+     * file refused by a read-only library it hides the one thing the
+     * operator can fix (#3918).
+     */
+    private val transientMessagesChannel = Channel<String>(Channel.BUFFERED)
+    val transientMessages: Flow<String> = transientMessagesChannel.receiveAsFlow()
+
    init {
        refresh()
        viewModelScope.launch {
@@ -86,8 +98,9 @@ class AdminQuarantineViewModel @Inject constructor(
            try {
                action(trackId)
            } catch (
-                @Suppress("TooGenericExceptionCaught", "SwallowedException") e: Throwable,
+                @Suppress("TooGenericExceptionCaught") e: Throwable,
            ) {
+                transientMessagesChannel.trySend(ErrorCopy.fromThrowable(e))
                refresh()
            }
        }
@@ -37,18 +37,35 @@ object ErrorCopy {
     * as connection failures.
     */
    fun fromThrowable(t: Throwable): String = when (t) {
-        is HttpException -> messageFor(codeFromHttp(t))
+        is HttpException -> fromHttp(t)
        is IOException -> messageFor("connection_refused")
        else -> TABLE.getValue("unknown")
    }

-    private fun codeFromHttp(e: HttpException): String {
+    /**
+     * Codes whose server message carries specifics the operator needs in
+     * order to act — which directory, which uid — that fixed copy cannot say.
+     * For these the message follows the copy (#3918). Kept to a named set on
+     * purpose: most server messages are internal detail. Mirrors web's
+     * errors.ts.
+     */
+    private val DETAIL_CODES = setOf("library_not_writable", "file_delete_failed")
+
+    private fun fromHttp(e: HttpException): String {
+        val body = bodyFromHttp(e)
+        val copy = messageFor(body.code.ifEmpty { "unknown" })
+        return if (body.code in DETAIL_CODES && body.message.isNotBlank()) {
+            "$copy ${body.message}"
+        } else {
+            copy
+        }
+    }
+
+    private fun bodyFromHttp(e: HttpException): Body {
        val raw = runCatching { e.response()?.errorBody()?.string() }.getOrNull()
-            ?: return "unknown"
-        val code = runCatching { json.decodeFromString<Envelope>(raw).error?.code }
-            .getOrNull()
-            .orEmpty()
-        return code.ifEmpty { "unknown" }
+            ?: return Body()
+        return runCatching { json.decodeFromString<Envelope>(raw).error }
+            .getOrNull() ?: Body()
    }

    private val TABLE: Map<String, String> = mapOf(
@@ -99,6 +116,8 @@ object ErrorCopy {
        "request_not_pending" to "This request is no longer pending.",
        "request_not_found" to "That request no longer exists.",
        "track_not_found" to "That track no longer exists.",
+        "library_not_writable" to "The music library isn't writable by the server.",
+        "file_delete_failed" to "The file couldn't be deleted.",
        "album_not_found" to "That album no longer exists.",
        "artist_not_found" to "That artist no longer exists.",
        "playlist_not_found" to "That playlist no longer exists.",
@@ -1,15 +1,26 @@
 package com.fabledsword.minstrel.models

 /**
- * Wire shape returned by `GET /api/client/version`. Mirrors
- * the Flutter client's `UpdateInfo`.
+ * The server-bundled APK, as reported by `GET /api/client/version`.
 *
- * `version` is the server-bundled APK version (may have a leading
- * "v" from the git tag); `apkUrl` is server-relative (e.g.
- * `/api/client/apk`); `sizeBytes` is the download size.
+ * Three values that are deliberately kept apart:
+ *
+ *  - [version] is a LABEL for people — "YYYY.MM.DD.HHMM", derived from the
+ *    build's commit, so two channels carrying the same code read the same.
+ *    Display this; never decide on it when [code] is present.
+ *  - [code] is the ORDERING KEY, and is the same value Android itself
+ *    installs by. It answers "may this be installed over that?", which the
+ *    name cannot. Null when the server predates the field.
+ *  - [channel] is a SIBLING FIELD, never a suffix inside the name. Reported
+ *    verbatim rather than validated, so an unexpected value is shown rather
+ *    than dropped.
+ *
+ * [apkUrl] is server-relative (e.g. `/api/client/apk`).
 */
 data class UpdateInfo(
    val version: String,
+    val code: Long?,
+    val channel: String?,
    val apkUrl: String,
    val sizeBytes: Long,
 )
@@ -4,12 +4,26 @@ import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable

 /**
- * Wire shape for `GET /api/client/version`. Defaults match Flutter:
- * apk_url falls back to `/api/client/apk` if the server omits it.
+ * Wire shape for `GET /api/client/version`.
+ *
+ * `apkUrl` falls back to `/api/client/apk` if the server omits it.
+ *
+ * [code] MUST stay nullable, and this is not a style preference. The app's
+ * Json is configured with `coerceInputValues = true`, which replaces a JSON
+ * null with the declared default for a NON-nullable property — so writing
+ * `val code: Long = 0` would turn "this server reports no ordering key" into
+ * "this build's ordering key is 0", silently, with no error anywhere. A
+ * nullable type is what keeps absent distinguishable from zero, and the
+ * distinction is the whole reason the field exists.
+ *
+ * A server predating the ordering key sends neither [code] nor [channel];
+ * both arrive null and the caller falls back to comparing names.
 */
@Serializable
 data class UpdateInfoWire(
    val version: String = "",
+    val code: Long? = null,
+    val channel: String? = null,
    @SerialName("apk_url") val apkUrl: String = "/api/client/apk",
    @SerialName("size_bytes") val sizeBytes: Long = 0,
 )
@@ -109,8 +109,11 @@ private fun MiniCover(coverUrl: String, contentDescription: String) {
 * NowPlayingScreen via [onExpandClick].
 *
 * Layout (Column):
- *   - Slim seek slider at the top (4dp track)
- *   - Row: cover | title/artist column | like | prev | play/pause | next
+ *   - Slim seek slider pinned at the top (4dp track)
+ *   - Row: cover | title/artist column | like | prev | play/pause | next.
+ *     Weighted so it fills the rest of the fixed-height bar and centres its
+ *     own content; otherwise the row keeps its intrinsic 48dp and the
+ *     leftover height collects at the bottom as dead surface.
 *
 * No kebab on the mini bar (operator 2026-06-01): the full kebab
 * surface lives on NowPlayingScreen, and dropping it from the mini
@@ -164,6 +167,12 @@ fun MiniPlayer(
                durationMs = state.durationMs,
            )
            MiniRow(
+                // Take whatever the progress fill leaves. Without this the
+                // Column stacks 4dp + the row's intrinsic 48dp from the top
+                // and the remaining 28dp of an 80dp bar sits empty
+                // underneath — the content looked top-aligned rather than
+                // centred, with a dead strip above the gesture bar.
+                modifier = Modifier.weight(1f),
                track = track,
                isPlaying = state.isPlaying,
                isUpnpLoading = state.isUpnpLoading,
@@ -205,6 +214,7 @@ private fun MiniProgressFill(positionMs: Long, durationMs: Long) {
@Composable
@Suppress("LongParameterList")
 private fun MiniRow(
+    modifier: Modifier,
    track: TrackRef,
    isPlaying: Boolean,
    isUpnpLoading: Boolean,
@@ -216,7 +226,7 @@ private fun MiniRow(
    onToggleLike: () -> Unit,
 ) {
    Row(
-        modifier = Modifier
+        modifier = modifier
            .fillMaxWidth()
            .padding(horizontal = 12.dp),
        verticalAlignment = Alignment.CenterVertically,
@@ -9,7 +9,7 @@ import com.fabledsword.minstrel.update.data.ApkInstaller
 import com.fabledsword.minstrel.update.data.InstallStage
 import com.fabledsword.minstrel.update.data.UpdateRepository
 import com.fabledsword.minstrel.update.data.isBusy
-import com.fabledsword.minstrel.update.data.isVersionNewer
+import com.fabledsword.minstrel.update.data.isUpdateAvailable
 import com.fabledsword.minstrel.update.data.message
 import com.fabledsword.minstrel.update.data.stage
 import dagger.hilt.android.lifecycle.HiltViewModel
@@ -37,6 +37,10 @@ sealed interface UpdateCheckResult {

 data class AboutUiState(
    val installedVersion: String = BuildConfig.VERSION_NAME,
+    // The value the platform installs by, and therefore the one the update
+    // check must decide on. Held in state rather than read inline so a test
+    // can drive the comparison without a BuildConfig.
+    val installedCode: Long = BuildConfig.VERSION_CODE.toLong(),
    val isChecking: Boolean = false,
    val installStage: InstallStage = InstallStage.IDLE,
    val installMessage: String? = null,
@@ -45,8 +49,9 @@ data class AboutUiState(

 /**
 * Backs the About card's update controls. "Check for updates" calls
- * [UpdateRepository.getLatest], compares versus the build's
- * VERSION_NAME via [isVersionNewer], and reports the terminal state.
+ * [UpdateRepository.getLatest], compares versus this build via
+ * [isUpdateAvailable] — on the ordering key where the server reports one,
+ * on the name otherwise — and reports the terminal state.
 * When an update is available, [install] downloads the APK via
 * [ApkInstaller] and installs it — routing the user to the "install
 * unknown apps" settings page first when that permission hasn't been
@@ -66,9 +71,17 @@ class AboutCardViewModel @Inject constructor(
        viewModelScope.launch {
            internal.update { it.copy(isChecking = true, installMessage = null) }
            val installed = internal.value.installedVersion
+            val installedCode = internal.value.installedCode
            val result = runCatching { repository.getLatest() }
                .map { latest ->
-                    if (isVersionNewer(latest.version, installed)) {
+                    if (
+                        isUpdateAvailable(
+                            serverCode = latest.code,
+                            serverName = latest.version,
+                            installedCode = installedCode,
+                            installedName = installed,
+                        )
+                    ) {
                        UpdateCheckResult.UpdateAvailable(latest)
                    } else {
                        UpdateCheckResult.Latest
@@ -2,72 +2,45 @@ package com.fabledsword.minstrel.theme

 import androidx.compose.material3.Typography
 import androidx.compose.ui.text.TextStyle
+import androidx.compose.ui.text.font.Font
 import androidx.compose.ui.text.font.FontFamily
 import androidx.compose.ui.text.font.FontStyle
 import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.text.googlefonts.Font
-import androidx.compose.ui.text.googlefonts.GoogleFont
 import androidx.compose.ui.unit.sp
 import com.fabledsword.minstrel.R

 /**
- * Google Fonts provider — fetches font files via Play Services Fonts at
- * runtime, caches them across launches. Matches the Flutter client's
- * `google_fonts` package behaviour (no bundled .ttf files in either tree).
+ * Bundled typefaces, vendored into res/font by tools/vendor-fonts.py.
+ *
+ * These were fetched at runtime through the Play Services font provider until
+ * 2026-09-09. That is a network dependency for rendering, and a deployed
+ * instance is not guaranteed one — the provider is also absent entirely on
+ * devices without Play Services, where the app silently fell back to the
+ * platform default and stopped looking like Minstrel. Bundling costs ~0.86 MB
+ * of APK and removes both failure modes.
 *
 * Per FabledSword design system:
 *   - Fraunces — display + headline (mythic serif)
 *   - Inter — body + label (clean sans for UI text)
 *   - JetBrains Mono — technical / monospace
 * Weights are restricted to 400 (regular) and 500 (medium) only.
+ *
+ * Each res/font entry is a single static instance, not a variable font: the
+ * weight declared beside it here must match the file's own OS/2
+ * usWeightClass, which the vendoring script asserts on download.
 */
-private val GoogleFontProvider = GoogleFont.Provider(
-    providerAuthority = "com.google.android.gms.fonts",
-    providerPackage = "com.google.android.gms",
-    certificates = R.array.com_google_android_gms_fonts_certs,
-)
-
-private val FrauncesFont = GoogleFont("Fraunces")
-private val InterFont = GoogleFont("Inter")
-private val JetBrainsMonoFont = GoogleFont("JetBrains Mono")
-
 private val Fraunces = FontFamily(
-    Font(
-        googleFont = FrauncesFont,
-        fontProvider = GoogleFontProvider,
-        weight = FontWeight.W400,
-        style = FontStyle.Normal,
-    ),
-    Font(
-        googleFont = FrauncesFont,
-        fontProvider = GoogleFontProvider,
-        weight = FontWeight.W500,
-        style = FontStyle.Normal,
-    ),
+    Font(R.font.fraunces_regular, FontWeight.W400, FontStyle.Normal),
+    Font(R.font.fraunces_medium, FontWeight.W500, FontStyle.Normal),
 )

 private val Inter = FontFamily(
-    Font(
-        googleFont = InterFont,
-        fontProvider = GoogleFontProvider,
-        weight = FontWeight.W400,
-        style = FontStyle.Normal,
-    ),
-    Font(
-        googleFont = InterFont,
-        fontProvider = GoogleFontProvider,
-        weight = FontWeight.W500,
-        style = FontStyle.Normal,
-    ),
+    Font(R.font.inter_regular, FontWeight.W400, FontStyle.Normal),
+    Font(R.font.inter_medium, FontWeight.W500, FontStyle.Normal),
 )

 private val JetBrainsMono = FontFamily(
-    Font(
-        googleFont = JetBrainsMonoFont,
-        fontProvider = GoogleFontProvider,
-        weight = FontWeight.W400,
-        style = FontStyle.Normal,
-    ),
+    Font(R.font.jetbrains_mono_regular, FontWeight.W400, FontStyle.Normal),
 )

 /**
@@ -19,7 +19,8 @@ private const val POLL_INTERVAL_MS = 24 * 60 * 60 * 1000L
 /**
 * Drives the shell's soft "update available" banner. Polls
 * `/api/client/version` at launch + every 24h and, when the bundled
- * APK is strictly newer than this build, exposes its [UpdateInfo] so
+ * APK outranks this build — by ordering key where the server reports one,
+ * by name otherwise — exposes its [UpdateInfo] so
 * [com.fabledsword.minstrel.update.ui.UpdateBanner] can nudge an
 * install. Mirrors Flutter's `ClientUpdateController`.
 *
@@ -58,6 +59,13 @@ class UpdateBannerController @Inject constructor(

    private suspend fun runOnce() {
        val info = runCatching { repository.getLatest() }.getOrNull() ?: return
-        latest.value = info.takeIf { isVersionNewer(it.version, BuildConfig.VERSION_NAME) }
+        latest.value = info.takeIf {
+            isUpdateAvailable(
+                serverCode = it.code,
+                serverName = it.version,
+                installedCode = BuildConfig.VERSION_CODE.toLong(),
+                installedName = BuildConfig.VERSION_NAME,
+            )
+        }
    }
 }
@@ -21,10 +21,39 @@ class UpdateRepository @Inject constructor(retrofit: Retrofit) {

 private fun UpdateInfoWire.toDomain(): UpdateInfo = UpdateInfo(
    version = version,
+    code = code,
+    channel = channel,
    apkUrl = apkUrl,
    sizeBytes = sizeBytes,
 )

+/**
+ * True when [server] should be offered over the installed build.
+ *
+ * **Decide on the ordering key whenever the server sends one.** That is the
+ * same value Android's package installer compares, so an offer made this way
+ * implies an install the platform will actually accept. The app used to
+ * compare NAMES while the platform installed by `versionCode`, with nothing
+ * keeping the two orderings consistent — so it could offer a build Android
+ * then refused as a downgrade, or stay quiet about one it would have taken.
+ *
+ * Name comparison survives only as the fallback for a server that predates
+ * the field. A null code means "this server cannot tell me" — never "zero" —
+ * because treating absent as zero would rank every such server as infinitely
+ * old and offer its build to everyone, forever.
+ */
+fun isUpdateAvailable(
+    serverCode: Long?,
+    serverName: String,
+    installedCode: Long,
+    installedName: String,
+): Boolean =
+    if (serverCode != null) {
+        serverCode > installedCode
+    } else {
+        isVersionNewer(serverName, installedName)
+    }
+
 /**
 * True when [server] is strictly newer than [installed]. Mirrors
 * Flutter's `isVersionNewer` — splits both strings on `.`, parses
@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Google Fonts provider certificate hashes for downloadable fonts via
-     androidx.compose.ui.text.googlefonts.GoogleFont.Provider. Standard
-     values published by Google; copied verbatim from the AndroidX docs. -->
-<resources>
-    <array name="com_google_android_gms_fonts_certs">
-        <item>@array/com_google_android_gms_fonts_certs_dev</item>
-        <item>@array/com_google_android_gms_fonts_certs_prod</item>
-    </array>
-    <string-array name="com_google_android_gms_fonts_certs_dev">
-        <item>MIIEqDCCA5CgAwIBAgIJANWFuGx90071MA0GCSqGSIb3DQEBBAUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4GA1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTAeFw0wODA0MTUyMzM2NTZaFw0zNTA5MDEyMzM2NTZaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4GA1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTCCASAwDQYJKoZIhvcNAQEBBQADggENADCCAQgCggEBANbOLggKv+IxTdGNs8/TGFy0PTP6DHThvbbR24kT9ixcOd9W+EaBPWW+wPPKQmsHxajtWjmQwWfna8mZuSeJS48LIgAZlKkpoyLcfobBPv6yyz8x1IxWWmF9c1IGN3vSL6BLNJEUyMEPzC2WZdwT4ZG2cuJTtzeETl6jWFKx68ETtZxNVHe9Iy9NMxEljDqVZ4y6+FlHaiYJqq3LcJpJVuKYz4kvOcyf3M0nDA8mUlVdfsOlw/H4uoNQ7VrAQUKB4kAyfxsKp/RZmnZSJ7+8Ag9aTC+oguTd1iFNuMqDUlpePo6CGuh73iKuq8mYvtdQQ0Yz+mF4j2YWB7Gj0R1k2cCAQOjgfwwgfkwHQYDVR0OBBYEFI0cxb6VTEM8YYY6FbBMvAPyT+CyMIHJBgNVHSMEgcEwgb6AFI0cxb6VTEM8YYY6FbBMvAPyT+CyoYGapIGXMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4GA1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbYIJANWFuGx90071MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADggEBABnTDPEF+3iSP0wNfdIjIz1AlnrPzgAIHVvXxunW7SBrDhEglQZBbKJEk5kT0mtKoOD1JMrSu1xuTKEBahWRbqHsXclaXjoBADb0kkjVEJu/Lh5hgYZnOjvlba8Ld7HCKePCVePoTJBdI4fvugnL8TsgK05aIskyY0hKI9L8KfqfGTl1lzOv2KoWD0KWwtAWPoGChZxmQ+nBli+gwYMzM1vAkP+aayLe0a1EQimlOalO762r0GXO0ks+UeXde2Z4e+8S/pf7pITEI/tP+MxJTALw9QUWEv9lKTk+jkbqxbsh8nfBUapfKqYn0eidpwq2AzVp3juYl7//fKnaPhJD9gs=</item>
-    </string-array>
-    <string-array name="com_google_android_gms_fonts_certs_prod">
-        <item>MIIEQzCCAyugAwIBAgIJAMLgh0ZkSjCNMA0GCSqGSIb3DQEBBAUAMHQxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDAeFw0wODA4MjEyMzEzMzRaFw0zNjAxMDcyMzEzMzRaMHQxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKtWLgDYO6IIrgqWbxJOKdoR8qtW0I9Y4sypEwPpt1TTcvZApxsdyxMJZ2JORland2qSGT2y5b+3JKkedxiLDmpHpDsz2WCbdxgxRczfey5YZnTJ4VZbH0xqWVW/8lGmPav5xVwnIiJS6HXk+BVKZF+JcWjAsb/GEuq/eFdpuzSqeYTcfi6idkyugwfYwXFU1+5fZKUaRKYCwkkFQVfcAs1fXA5V+++FGfvjJ/CxURaSxaBvGdGDhfXE28LWuT9ozCl5xw4Yq5OGazvV24mZVSoOO0yZ31j7kYvtwYK6NeADwbSxDdJEqO4k//0zOHKrUiGYXtqw/A0LFFtqoZKFjnkCAwEAAaOB1zCB1DAdBgNVHQ4EFgQUhzkS9E6G+x8U7eIYZVgWyN4j2u4wgaQGA1UdIwSBnDCBmYAUhzkS9E6G+x8U7eIYZVgWyN4j2u6heKR2MHQxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZIIJAMLgh0ZkSjCNMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADggEBABywqUAtNkXf2EVQuRGiI3pnNvIYx7N5xj4LMtloEdEqMpEcMa6Qe87qDx2hsArOR1nzQAFGsT/8YIIfX0fAJjQuP1lAcExSxVKbFICEvFBaWuhGgOOZ7CYzfHB6tEzJFLR2DQHQrXLT2HKDDhxhe9hKzqIRDSc5Hjr3jY5MMzfYM5lFvKK9pLqEsP6/Ad9SDhupcVoOWVrSCNKfRb6jpJbZuxJhCnq8tmlV4iy5tEW0a3VBYzpRoBdAaORWqHQTUlt+iL3aH7C5OxhgN/JuxvxXBL/3kkc0wK1ZNuk+sb4lNXmHnVqQYTcyowQHRPCRsPzCCl4ANULRpZjxAd0xUgg=</item>
-    </string-array>
-</resources>
@@ -0,0 +1,60 @@
+package com.fabledsword.minstrel.api
+
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.ResponseBody.Companion.toResponseBody
+import org.junit.jupiter.api.Assertions.assertEquals
+import org.junit.jupiter.api.Test
+import retrofit2.HttpException
+import retrofit2.Response
+import java.io.IOException
+
+class ErrorCopyTest {
+    private fun httpError(status: Int, body: String): HttpException =
+        HttpException(
+            Response.error<Unit>(status, body.toResponseBody("application/json".toMediaType())),
+        )
+
+    @Test
+    fun libraryNotWritableAppendsTheServerDetail() {
+        val detail = "Minstrel runs as uid 1000, gid 1000 and cannot delete from /music/A " +
+            "(read-only file system). The library mount must be writable by that user. " +
+            "Nothing was deleted."
+        val e = httpError(409, """{"error":{"code":"library_not_writable","message":"$detail"}}""")
+
+        assertEquals(
+            "${ErrorCopy.messageFor("library_not_writable")} $detail",
+            ErrorCopy.fromThrowable(e),
+        )
+    }
+
+    @Test
+    fun detailCodeWithoutAMessageShowsTheCopyAlone() {
+        val e = httpError(409, """{"error":{"code":"library_not_writable","message":""}}""")
+
+        assertEquals(ErrorCopy.messageFor("library_not_writable"), ErrorCopy.fromThrowable(e))
+    }
+
+    // Server messages are usually internal detail; appending them for every
+    // code would leak driver errors into snackbars. This pins the scope.
+    @Test
+    fun otherCodesNeverCarryTheServerMessage() {
+        val e = httpError(404, """{"error":{"code":"track_not_found","message":"pgx: no rows"}}""")
+
+        assertEquals(ErrorCopy.messageFor("track_not_found"), ErrorCopy.fromThrowable(e))
+    }
+
+    @Test
+    fun anUnparseableBodyFallsBackToUnknown() {
+        val e = httpError(500, "not json")
+
+        assertEquals(ErrorCopy.messageFor("unknown"), ErrorCopy.fromThrowable(e))
+    }
+
+    @Test
+    fun transportFailureMapsToConnectionRefused() {
+        assertEquals(
+            ErrorCopy.messageFor("connection_refused"),
+            ErrorCopy.fromThrowable(IOException("refused")),
+        )
+    }
+}
@@ -0,0 +1,125 @@
+package com.fabledsword.minstrel.theme
+
+import org.junit.jupiter.api.Test
+import java.io.File
+import kotlin.test.assertEquals
+import kotlin.test.assertTrue
+
+/**
+ * Guards that the typefaces ship inside the APK instead of being fetched at
+ * runtime.
+ *
+ * Until 2026-09-09 these were resolved through the Play Services font
+ * provider. That needs a network the deployed app is not guaranteed, and a
+ * provider that devices without Play Services do not have at all. Both
+ * failures are silent — text just renders in the platform default, which
+ * reads as a styling regression rather than a missing dependency.
+ *
+ * Expectations are read out of Typography.kt itself rather than hardcoded, so
+ * this cannot drift away from what the app actually declares: adding a face
+ * without vendoring its file fails here, and so does changing a declared
+ * weight without refetching the matching static instance.
+ */
+class BundledFontsTest {
+    @Test
+    fun `typography builds its families from bundled resources`() {
+        val source = typographySource()
+        assertTrue(
+            source.contains("R.font."),
+            "Typography.kt should build its families from res/font resources",
+        )
+        FORBIDDEN.forEach { symbol ->
+            assertTrue(
+                !source.contains(symbol),
+                "Typography.kt must not reference $symbol — fonts are bundled, not fetched",
+            )
+        }
+    }
+
+    @Test
+    fun `every declared face is vendored as TrueType at its declared weight`() {
+        val declared = FACE_PATTERN.findAll(typographySource()).toList()
+        assertTrue(
+            declared.isNotEmpty(),
+            "no Font(R.font.…, FontWeight.W…) declarations found — the guard would pass vacuously",
+        )
+
+        declared.forEach { match ->
+            val (name, weight) = match.destructured
+            val file = File(appDir(), "src/main/res/font/$name.ttf")
+            assertTrue(file.isFile, "res/font/$name.ttf is missing — run tools/vendor-fonts.py")
+
+            val bytes = file.readBytes()
+            assertTrue(
+                bytes.copyOfRange(0, TTF_MAGIC.size).contentEquals(TTF_MAGIC),
+                "$name.ttf is not TrueType — res/font cannot load a woff2 or an eot",
+            )
+            // The decisive check. Google's css2 endpoint silently collapses a
+            // multi-weight request to 400 for legacy clients, so Medium can
+            // come back as Regular: a valid TrueType file that renders at the
+            // wrong weight everywhere. usWeightClass is the only field that
+            // tells the two apart.
+            assertEquals(
+                weight.toInt(),
+                weightClass(bytes),
+                "$name.ttf carries a different OS/2 usWeightClass than the FontWeight declared beside it",
+            )
+        }
+    }
+
+    /** Typography.kt with comments removed, so prose naming the forbidden
+     *  symbols cannot satisfy — or trip — the absence check above. */
+    private fun typographySource(): String =
+        File(appDir(), TYPOGRAPHY)
+            .readText()
+            .replace(BLOCK_COMMENT, "")
+            .replace(LINE_COMMENT, "")
+
+    /** Gradle's working directory for tests is the module dir, but don't rely
+     *  on it: walk up until the module is found, and say so if it isn't. */
+    private fun appDir(): File {
+        var dir: File? = File("").absoluteFile
+        while (dir != null) {
+            if (File(dir, TYPOGRAPHY).isFile) return dir
+            if (File(dir, "app/$TYPOGRAPHY").isFile) return File(dir, "app")
+            dir = dir.parentFile
+        }
+        error("could not locate the app module from ${File("").absolutePath}")
+    }
+
+    private fun weightClass(bytes: ByteArray): Int {
+        val tables = readU16(bytes, NUM_TABLES)
+        for (i in 0 until tables) {
+            val record = TABLE_DIRECTORY + i * TABLE_RECORD
+            if (String(bytes, record, TAG_LENGTH, Charsets.US_ASCII) == "OS/2") {
+                return readU16(bytes, readU32(bytes, record + OFFSET_FIELD) + WEIGHT_FIELD)
+            }
+        }
+        error("no OS/2 table in the font")
+    }
+
+    private fun readU16(bytes: ByteArray, at: Int): Int =
+        ((bytes[at].toInt() and BYTE_MASK) shl Byte.SIZE_BITS) or (bytes[at + 1].toInt() and BYTE_MASK)
+
+    private fun readU32(bytes: ByteArray, at: Int): Int =
+        (readU16(bytes, at) shl Short.SIZE_BITS) or readU16(bytes, at + 2)
+
+    private companion object {
+        const val TYPOGRAPHY = "src/main/java/com/fabledsword/minstrel/theme/Typography.kt"
+
+        val FORBIDDEN = listOf("GoogleFont", "googlefonts")
+        val FACE_PATTERN = Regex("""R\.font\.(\w+)\s*,\s*FontWeight\.W(\d+)""")
+        val BLOCK_COMMENT = Regex("""/\*[\s\S]*?\*/""")
+        val LINE_COMMENT = Regex("""//.*""")
+        val TTF_MAGIC = byteArrayOf(0x00, 0x01, 0x00, 0x00)
+
+        // Offsets into the TrueType table directory, per the OpenType spec.
+        const val NUM_TABLES = 4
+        const val TABLE_DIRECTORY = 12
+        const val TABLE_RECORD = 16
+        const val TAG_LENGTH = 4
+        const val OFFSET_FIELD = 8
+        const val WEIGHT_FIELD = 4
+        const val BYTE_MASK = 0xFF
+    }
+}
@@ -0,0 +1,163 @@
+package com.fabledsword.minstrel.update.data
+
+import org.junit.jupiter.api.Test
+import kotlin.test.assertFalse
+import kotlin.test.assertTrue
+
+/**
+ * The update channel had no tests at all before this. That is worth saying
+ * out loud, because the thing it decides — whether anyone is ever offered an
+ * update — fails silently in both directions: an update nobody is offered
+ * looks exactly like being up to date, and nobody files a bug about a prompt
+ * they never saw.
+ */
+class UpdateVersioningTest {
+    @Test
+    fun `decides on the ordering key when the server reports one`() {
+        assertTrue(
+            isUpdateAvailable(
+                serverCode = 3523847, serverName = "2026.09.10.1432",
+                installedCode = 3519456, installedName = "2026.09.09.1828",
+            ),
+        )
+        assertFalse(
+            isUpdateAvailable(
+                serverCode = 3519456, serverName = "2026.09.09.1828",
+                installedCode = 3523847, installedName = "2026.09.10.1432",
+            ),
+        )
+    }
+
+    @Test
+    fun `an equal ordering key is not an update`() {
+        assertFalse(
+            isUpdateAvailable(
+                serverCode = 3523847, serverName = "2026.09.10.1432",
+                installedCode = 3523847, installedName = "2026.09.10.1432",
+            ),
+        )
+    }
+
+    /**
+     * The property the whole rework exists for: the offer must agree with what
+     * the platform will actually install. Where the two disagree, the ordering
+     * key wins, because that is the value Android compares.
+     */
+    @Test
+    fun `the ordering key wins even when the name disagrees`() {
+        // Name looks older, key is newer — e.g. an older commit rebuilt later.
+        assertTrue(
+            isUpdateAvailable(
+                serverCode = 9_000_000, serverName = "2020.01.01.0000",
+                installedCode = 1, installedName = "2099.12.31.2359",
+            ),
+        )
+        // Name looks newer, key is not. Offering this would be offering an
+        // install the platform then refuses as a downgrade.
+        assertFalse(
+            isUpdateAvailable(
+                serverCode = 1, serverName = "2099.12.31.2359",
+                installedCode = 9_000_000, installedName = "2020.01.01.0000",
+            ),
+        )
+    }
+
+    @Test
+    fun `falls back to the name when the server reports no ordering key`() {
+        assertTrue(
+            isUpdateAvailable(
+                serverCode = null, serverName = "2026.09.10.1432",
+                installedCode = 3519456, installedName = "2026.09.09.1828",
+            ),
+        )
+        assertFalse(
+            isUpdateAvailable(
+                serverCode = null, serverName = "2026.09.09.1828",
+                installedCode = 3519456, installedName = "2026.09.10.1432",
+            ),
+        )
+    }
+
+    /**
+     * A null code must never be read as zero. Zero would rank every
+     * older server as infinitely behind and offer its build to everyone,
+     * forever — so this asserts the fallback runs instead of a comparison
+     * against 0 succeeding by accident.
+     */
+    @Test
+    fun `a null ordering key is absent, not zero`() {
+        // installedCode is 0 here: if null coerced to 0, "0 > 0" would be
+        // false and this would wrongly report no update despite a newer name.
+        assertTrue(
+            isUpdateAvailable(
+                serverCode = null, serverName = "2026.09.10.1432",
+                installedCode = 0, installedName = "2026.09.09.1828",
+            ),
+        )
+    }
+
+    /**
+     * The recorded migration constraint, pinned so it cannot be forgotten:
+     * the old scheme's fourth segment was a commit count (~1895), the new
+     * one is HHMM. Across a day boundary the date decides and all is well.
+     */
+    @Test
+    fun `new-scheme name outranks an old-scheme name on a later day`() {
+        assertTrue(isVersionNewer("2026.09.10.1432", "2026.09.09.1895"))
+    }
+
+    /**
+     * ...but on the SAME day the comparison comes down to HHMM against a
+     * commit count, and any build before ~19:00 UTC reads as older. This is
+     * why the first new-scheme release had to be cut on a later calendar day.
+     * Asserting the trap so nobody "fixes" it by accident.
+     */
+    @Test
+    fun `same-day new-scheme name can read older than an old-scheme name`() {
+        assertFalse(isVersionNewer("2026.09.09.1828", "2026.09.09.1895"))
+    }
+
+    @Test
+    fun `name comparison degrades per segment rather than discarding`() {
+        // The string is still compared rather than rejected outright: an
+        // earlier segment decides and the unparseable tail never matters.
+        assertTrue(isVersionNewer("2026.09.10.1432-dev", "2026.09.09.1828"))
+
+        // A shorter name pads with zeros instead of being refused.
+        assertTrue(isVersionNewer("2026.09.10", "2026.09.09.9999"))
+        assertFalse(isVersionNewer("2026.09.10", "2026.09.10.0"))
+    }
+
+    /**
+     * What "costs that segment's precision" actually means, and it is worth
+     * pinning because it is a real edge rather than a nicety: when the
+     * unparseable segment is the DECIDING one, it reads as 0 and loses. So a
+     * `-dev` suffixed build compares as older than an unsuffixed one from the
+     * same minute.
+     *
+     * That is the correct behaviour for a degrading parser — it is bounded
+     * loss rather than a discarded string — but it is exactly why the channel
+     * belongs in its own field and never in the name.
+     */
+    @Test
+    fun `an unparseable deciding segment reads as zero and loses`() {
+        assertFalse(isVersionNewer("2026.09.10.1432-dev", "2026.09.10.1000"))
+    }
+
+    /**
+     * Both sides unparseable (branch-name builds) falls back to string
+     * inequality, so a dev build still surfaces rather than comparing equal
+     * and going silent.
+     */
+    @Test
+    fun `two unparseable names fall back to string inequality`() {
+        assertTrue(isVersionNewer("main", "dev"))
+        assertFalse(isVersionNewer("dev", "dev"))
+    }
+
+    @Test
+    fun `a leading v is ignored on either side`() {
+        assertTrue(isVersionNewer("v2026.09.10.1432", "2026.09.09.1828"))
+        assertFalse(isVersionNewer("v2026.09.10.1432", "v2026.09.10.1432"))
+    }
+}
@@ -53,7 +53,6 @@ compose-ui-graphics = { module = "androidx.compose.ui:ui-graphics" }
 compose-ui-tooling = { module = "androidx.compose.ui:ui-tooling" }
 compose-ui-tooling-preview = { module = "androidx.compose.ui:ui-tooling-preview" }
 compose-material3 = { module = "androidx.compose.material3:material3" }
-compose-ui-text-google-fonts = { module = "androidx.compose.ui:ui-text-google-fonts" }
 hilt-android = { module = "com.google.dagger:hilt-android", version.ref = "hilt" }
 hilt-compiler = { module = "com.google.dagger:hilt-compiler", version.ref = "hilt" }
 room-runtime = { module = "androidx.room:room-runtime", version.ref = "room" }
@@ -62,57 +62,30 @@ None.
 - **Go toolchain pin.** `go.mod` is on `go 1.25.0` because `golang.org/x/crypto v0.51.0` declares 1.25 as its minimum. `ci-go:1.26` satisfies this with headroom. Future `x/crypto` bumps that move the Go floor should be paired with an image-tag bump in this file + the workflows.
 - **In-app update channel — `needs:`, not polling.** `release.yml`'s `image-release` job declares `needs: [android-release]`, so on tag pushes the signed APK is guaranteed present before the image build starts — no polling window, no race. (The old cross-workflow polling against `flutter.yml` is gone with that workflow.) On non-tag `main` pushes `android-release` is skipped and `image-release` instead pulls the most recent release's APK and reconstructs its exact `versionName`, so `:latest` never ships without an update channel. It degrades to an empty `client/` — never a wrong version — if no release, asset, or tag commit-count can be resolved.
 - **Cache server reachability.** `test-web.yml` does NOT use `cache: 'npm'` on `actions/setup-node` — the Gitea Actions cache server isn't reachable from this runner's container network and `setup-node` was burning ~4m41s on ETIMEDOUT before failing open. With the migration to `ci-go:1.26`, `setup-node` is removed entirely (Node is in the image). The cache concern reappears if a future change re-introduces a network-dependent action.
- **Artifacts — use the mirrored actions, never `actions/{upload,download}-artifact`.**
+- **Artifacts — stock `actions/upload-artifact@v7` and `actions/download-artifact@v8`; never `@v3`.**
  ```yaml
-  uses: https://git.fabledsword.com/bvandeusen/upload-artifact@cb8afe72b42edc798abfb8fcb556cf660d894245
-  uses: https://git.fabledsword.com/bvandeusen/download-artifact@8d4e9521a5f7e5f8b6351f341f719f9f45a92a3a
+  uses: actions/upload-artifact@v7
+  uses: actions/download-artifact@v8
  ```
-  Upstream's `@v4+` cannot work against this instance and no server-side change
-  will help: `isGhes()` rejects any hostname that isn't `github.com` /
-  `*.ghe.com` / `*.localhost` and throws before it opens a connection, so the
-  server is never asked what it supports. `@v3` is worse — it reports success,
-  and Gitea then serves artifacts back only through the v4 API
-  (`content_encoding = application/zip`), so a v3 upload is stored but invisible
-  to every retrieval path. A green job producing nothing retrievable; that is how
-  72 unreachable artifacts accumulated on this repo. Scribe issues 2255 / 2270.
+  Stock works on this forge since the runner moved to gitea/runner 3.x, which
+  edits the actions' client-side `isGhes()` refusal out of their bundles. Proven
+  on 2026-09-10 for upload v4–v7 and download v4–v8 (Scribe spike #3843). Until
+  then this repo pinned SHA mirrors of the Forgejo project's forks, because
+  upstream threw on the hostname before it opened a connection (Scribe 2255).

-  Both are pull mirrors of the Forgejo project's forks
-  (`code.forgejo.org/forgejo/{upload,download}-artifact`, one commit on upstream
-  disabling that check), mirrored so CI depends on commits we hold and pinned by
-  SHA because the mirrors auto-sync every 8h — a moved upstream tag would
-  otherwise silently change what runs.
+  `@v3` is still broken: it reports success, and Gitea serves artifacts back only
+  through the v4 API (`content_encoding = application/zip`), so a v3 upload is
+  stored but invisible to every retrieval path. That is how 72 unreachable
+  artifacts accumulated on this repo (Scribe 2270).

-  **Match the pins on `@actions/artifact`, not on the actions' own version
-  numbers.** The two actions release on unrelated cadences, so equal version
-  numbers do NOT mean a compatible pair — upload `v5` bundles `@actions/artifact`
-  ^4.0.0 while download `v5` bundles ^2.3.2. The pins above are upload **v5** and
-  download **v6**, which is the pairing that puts ^4.0.0 on both sides. This
-  matters because `release.yml` is a producer/consumer pair — `android-release`
-  uploads `minstrel-apk`, `image-release` downloads it — and a protocol mismatch
-  across it yields an empty listing rather than an error, exactly the silent
-  failure this entry exists to prevent.
-
-  | tag | `@actions/artifact` | runtime |
-  |---|---|---|
-  | upload v4 | ^2.1.1 | node20 |
-  | **upload v5** ← pinned | **^4.0.0** | node20 |
-  | download v4 | ^2.1.1 | node20 |
-  | download v5 | ^2.3.2 | node20 |
-  | **download v6** ← pinned | **^4.0.0** | node20 |
-  | download v7 | ^5.0.0 | **node24** |
-
-  The only true protocol break in this history was **v3 → v4** (upstream:
-  "Downloading artifacts that were created from `actions/upload-artifact@v3` and
-  below are not supported"); v4-and-up are one family. Later majors are mostly
-  ergonomics and runtime — upload v4 forbids re-uploading a name and caps a job
-  at 500 artifacts; download v5 made by-ID extraction match by-name.
-
-  **Do not jump the download pin to v7.** That major is a runner requirement, not
-  a feature change: it moves to `runs.using: node24` and upstream states it
-  "requires a minimum Actions Runner version of 2.327.1 … if you are using
-  self-hosted runners, ensure they are updated before upgrading." act_runner is
-  not GitHub's runner and makes no such version claim, so node24 is unverified
-  here. Everything currently pinned is node20.
+  **Pairing no longer needs managing.** This entry used to pin upload v5 against
+  download v6 so both bundled `@actions/artifact` ^4.0.0, warning that a mismatch
+  across `release.yml`'s producer/consumer pair would list empty. Tested, and not
+  true on this instance: every download major v4–v8 read the artifacts of every
+  upload major v4–v7, by name and by pattern (CI-runner run 6312). The only real
+  protocol break is v3 → v4. node24 is no longer a concern either — every
+  CI-runner image carries Node 24 and the runner runs actions with the image's
+  `node`.

  Upload steps set `if-no-files-found: error` rather than the default `warn`, so
  an upload that matches nothing fails its own job instead of failing the
@@ -0,0 +1,159 @@
+#!/usr/bin/env bash
+#
+# Derives the three values a build is stamped with, and the tag that names it.
+#
+#   name=YYYY.MM.DD.HHMM   label for people, from the timestamp of the newest
+#                          commit that CHANGED SOMETHING SHIPPED (see SHIPPED)
+#   code=<int>             ordering key, minutes since 2020-01-01 at BUILD time
+#   tag=v<name>            what a release of this commit must be called
+#
+# Usage:  ci/version.sh [<commit-ish>]        (default HEAD)
+#
+# This exists as a script rather than inline workflow YAML for one reason:
+# release.yml only runs on `main` and on tags, so anything living inside it is
+# unverifiable until a release is already happening — which is the worst
+# possible moment to discover the version is wrong, because the failure mode
+# is silent (an update nobody is offered looks exactly like being current).
+# As a script it can be executed by a test on every push instead.
+#
+# The two clocks are deliberate and are NOT interchangeable:
+#
+#   The NAME answers "is this the same code?" — so it must read identically on
+#   every lane that builds this commit. Commit time does that; build time
+#   prints two different strings for one thing.
+#
+#   The CODE answers "may this be installed over that?" — so it must be
+#   monotonic BY CONSTRUCTION. Build time is; commit time is not (rebuild an
+#   older commit and it goes down, which on a phone is a refused install), and
+#   a commit COUNT is worse still, because it runs ahead on `dev` and inverts
+#   against `main`.
+set -euo pipefail
+
+readonly EPOCH_2020=1577836800 # 2020-01-01T00:00:00Z
+readonly REF="${1:-HEAD}"
+
+# Both clocks are overridable so a test can pin them. Nothing but tests should
+# set these — the defaults are the real derivation.
+# The paths that do NOT ship, in either artifact. Everything else counts.
+#
+# A DENYLIST, and the direction is the whole point. As an allowlist, the list
+# has to be updated by whoever adds a directory and nothing fails if they
+# don't — so the failure mode is a changed artifact keeping its old version,
+# silently, on a green run. That is a build lying about what it is. Inverted,
+# new content counts by default and the only way to wrongly EXCLUDE something
+# is to name it here deliberately.
+#
+# The two error directions are not symmetric, which is why this is not taste:
+#   wrongly excluded → changed artifact, unchanged version. A silent lie.
+#   wrongly included → version moves when nothing shipped. Cosmetic noise in
+#                      a string nobody sorts.
+#
+# THIS REPO SHIPS TWO ARTIFACTS FROM ONE DERIVATION, and that is why the list
+# is shorter than it looks like it should be. The server image ships cmd/,
+# internal/, shared/, web/, config.example.yaml and client/; the APK ships
+# android/. Neither ships the other's sources — but excluding android/ here
+# would stop an Android-only commit from moving the APK's OWN version, which
+# is the dangerous direction. So this is the union: exclude only what ships in
+# NEITHER, and accept that an Android commit also nudges the server's reported
+# version. Over-inclusion across the two, which is the harmless direction.
+#
+# The family's other repos (roundtable / roundtable-android) each keep a
+# tighter list because they are separate repos with one artifact apiece. Do
+# not copy theirs onto this one.
+readonly SHIPPED=(
+  .
+  ':!.gitea'          # CI workflows — including this script's own caller
+  ':!ci'              # CI scripts — including this script
+  ':!docs'
+  ':!tools'           # asset/font generators; their OUTPUT ships, they do not
+  ':!deploy'          # test-database bootstrap SQL
+  ':!bin'             # local `make build` output
+  ':!*.md'
+  ':!Makefile'
+  ':!docker-compose.yml'
+  ':!.env.example'
+  ':!.gitignore'
+  ':!.dockerignore'
+  ':!renovate.json'
+  ':!.golangci.yml'
+
+  # TESTS DO NOT SHIP, so they must not re-version an artifact.
+  #
+  # Named as globs rather than a directory because this repo has no tests/
+  # tree to exclude: Go tests sit inline beside the code they cover, and the
+  # web suite sits beside its modules. `go build` drops *_test.go outright and
+  # the Vite build never imports a .test.ts, so neither reaches an artifact.
+  #
+  # A commit touching a test AND its source still moves the version — the
+  # source path matches on its own. Only a test-ONLY commit is inert, which is
+  # the whole intent.
+  #
+  # Patterns match what exists today and nothing speculative: there are no
+  # .spec.* files, no __tests__/ directories and no androidTest/ tree. If any
+  # appear they will re-version until named here, which is the harmless
+  # direction and the reason this list is a denylist.
+  ':!*_test.go'                   # 158 files, inline beside the code
+  ':!*.test.ts'                   # 114 files
+  ':!*.test.js'
+  ':!android/app/src/test'        # JVM unit tests; no androidTest tree exists
+  ':!web/vitest.config.ts'        # test-harness config, not build config
+  ':!web/vitest.setup.ts'
+)
+
+commit_epoch="${MINSTREL_COMMIT_EPOCH:-}"
+if [ -z "${commit_epoch}" ]; then
+  commit_epoch="$(git log --format=%ct -1 "${REF}" -- "${SHIPPED[@]}")"
+  # Loudly, on purpose. A silent fallback here is the landmine this whole
+  # script exists to avoid: a plausible-looking version that is quietly wrong,
+  # on a green run. Realistically this means a shallow clone (no commit in
+  # range touches the shipped set) rather than a repo of pure CI config.
+  if [ -z "${commit_epoch}" ]; then
+    echo "version.sh: no commit under '${REF}' touches the shipped file set — shallow clone? (needs fetch-depth: 0)" >&2
+    exit 1
+  fi
+fi
+now_epoch="${MINSTREL_NOW_EPOCH:-$(date -u +%s)}"
+
+if ! name="$(date -u -d "@${commit_epoch}" +%Y.%m.%d.%H%M 2>/dev/null)"; then
+  echo "version.sh: could not read a commit timestamp from '${commit_epoch}'" >&2
+  exit 1
+fi
+
+if ! [ "${now_epoch}" -eq "${now_epoch}" ] 2>/dev/null; then
+  echo "version.sh: build timestamp '${now_epoch}' is not a number" >&2
+  exit 1
+fi
+code=$(( (now_epoch - EPOCH_2020) / 60 ))
+
+# Assert the shape here, at the source. A malformed name builds, signs and
+# publishes perfectly happily; it only surfaces later as an update channel
+# that has quietly stopped offering anything.
+if [[ ! "${name}" =~ ^[0-9]{4}\.[0-9]{2}\.[0-9]{2}\.[0-9]{4}$ ]]; then
+  echo "version.sh: name '${name}' is not YYYY.MM.DD.HHMM" >&2
+  exit 1
+fi
+
+# A non-positive key means the build clock is set before 2020, and every
+# comparison downstream would be nonsense.
+if [ "${code}" -le 0 ]; then
+  echo "version.sh: ordering key '${code}' is not positive — build clock wrong?" >&2
+  exit 1
+fi
+
+# Android's versionCode is a signed 32-bit int and the platform refuses an APK
+# whose code exceeds it. At ~525k minutes a year this is four thousand years
+# away in normal operation, so the realistic cause is a build machine with a
+# badly wrong clock — which produces a code that is not merely too large but
+# also unreachably high, permanently blocking every real build that follows
+# from ever outranking it. Cheaper to refuse the build than to discover that
+# from a phone that will not update.
+readonly VERSION_CODE_CEILING=2147483647
+if [ "${code}" -gt "${VERSION_CODE_CEILING}" ]; then
+  echo "version.sh: ordering key '${code}' exceeds versionCode's int32 ceiling — build clock wrong?" >&2
+  exit 1
+fi
+
+# KEY=VALUE, which is also exactly $GITHUB_OUTPUT's format.
+echo "name=${name}"
+echo "code=${code}"
+echo "tag=v${name}"
@@ -133,6 +133,13 @@ func (h *handlers) handleDeleteQuarantineFile(w http.ResponseWriter, r *http.Req
 	}
 	action, err := h.lidarrQuarantine.DeleteFile(r.Context(), id, admin.ID)
 	if err != nil {
+		// Written in the enveloped shape, not writeAdminJSONErr's bare code: the
+		// message is the part that tells the operator which directory and uid.
+		if apiErr, ok := fileRemoveAPIError(err); ok {
+			logFileRemoveFailure(h.logger, apiErr, "track_id", uuidToString(id))
+			writeErr(w, apiErr)
+			return
+		}
 		switch {
 		case errors.Is(err, lidarrquarantine.ErrTrackNotFound):
 			writeAdminJSONErr(w, http.StatusNotFound, "track_not_found")
@@ -69,7 +69,7 @@ func installQuarantineClientFn(t *testing.T, h *handlers) {
 		}
 		return lidarr.NewClient(c.BaseURL, c.APIKey)
 	}
-	h.lidarrQuarantine = lidarrquarantine.NewService(h.pool, cfg, clientFn)
+	h.lidarrQuarantine = lidarrquarantine.NewService(h.pool, cfg, clientFn, h.dataDir)
 }

 // flagDirect bypasses the HTTP handler to seed a quarantine row via the
@@ -97,14 +97,16 @@ type tuningSnapshot struct {
 func (h *handlers) tuningSnapshot() tuningSnapshot {
 	var out tuningSnapshot
 	out.Profiles = map[string]weightsResp{
-		recsettings.ScopeRadio:    weightsRespFrom(h.recSettings.Weights(recsettings.ScopeRadio)),
-		recsettings.ScopeDailyMix: weightsRespFrom(h.recSettings.Weights(recsettings.ScopeDailyMix)),
+		recsettings.ScopeRadio:     weightsRespFrom(h.recSettings.Weights(recsettings.ScopeRadio)),
+		recsettings.ScopeDailyMix:  weightsRespFrom(h.recSettings.Weights(recsettings.ScopeDailyMix)),
+		recsettings.ScopeSongsLike: weightsRespFrom(h.recSettings.Weights(recsettings.ScopeSongsLike)),
 	}
 	out.Taste = tasteRespFrom(h.recSettings.Taste())
 	out.Discover = discoverRespFrom(h.recSettings.Discover())
 	out.Shipped.Profiles = map[string]weightsResp{
-		recsettings.ScopeRadio:    weightsRespFrom(recsettings.ShippedRadioWeights()),
-		recsettings.ScopeDailyMix: weightsRespFrom(recsettings.ShippedDailyMixWeights()),
+		recsettings.ScopeRadio:     weightsRespFrom(recsettings.ShippedRadioWeights()),
+		recsettings.ScopeDailyMix:  weightsRespFrom(recsettings.ShippedDailyMixWeights()),
+		recsettings.ScopeSongsLike: weightsRespFrom(recsettings.ShippedSongsLikeWeights()),
 	}
 	out.Shipped.Taste = tasteRespFrom(recsettings.ShippedTasteTuning())
 	out.Shipped.Discover = discoverRespFrom(recsettings.ShippedDiscoverTuning())
@@ -23,15 +23,17 @@ type removeTrackResponse struct {

 // handleRemoveTrack implements DELETE /api/admin/tracks/{id}?unmonitor=true|false.
 //
-// Admin-only (gated by auth.RequireAdmin on the /admin route group). Always
-// deletes the file + DB row and runs the album/artist cascade tidy-up. When
+// Admin-only (gated by auth.RequireAdmin on the /admin route group). Deletes the
+// file, then the DB row, and runs the album/artist cascade tidy-up — and deletes
+// nothing at all when the file cannot be removed (#3918). When
 // unmonitor=true and the track has an mbid, also calls Lidarr.UnmonitorTrack
 // — failure there is non-fatal (the destructive part already completed) and
 // surfaces as `lidarr_unmonitor_failed: true` in the success envelope.
 //
 // Per spec §5, Lidarr-side errors during the unmonitor step do NOT map to
-// wire error codes; the only error codes this handler emits are not_found,
-// server_error, plus the auth codes the middleware emits upstream.
+// wire error codes. The codes this handler emits are not_found,
+// library_not_writable (409) and file_delete_failed when the file could not be
+// removed, server_error, plus the auth codes the middleware emits upstream.
 func (h *handlers) handleRemoveTrack(w http.ResponseWriter, r *http.Request) {
 	idStr := chi.URLParam(r, "id")
 	trackID, ok := parseUUID(idStr)
@@ -66,6 +68,11 @@ func (h *handlers) handleRemoveTrack(w http.ResponseWriter, r *http.Request) {
 			writeErr(w, &apierror.Error{Status: http.StatusNotFound, Code: "not_found", Message: "track not found"})
 			return
 		}
+		if apiErr, ok := fileRemoveAPIError(err); ok {
+			logFileRemoveFailure(h.logger, apiErr, "track_id", idStr)
+			writeErr(w, apiErr)
+			return
+		}
 		h.logger.Error("api: remove track failed", "err", err, "track_id", idStr)
 		writeErr(w, apierror.InternalMsg("remove failed", err))
 		return
@@ -24,6 +24,7 @@ import (
 	"git.fabledsword.com/bvandeusen/minstrel/internal/playevents"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/playlists"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/reacquisition"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/recommendation"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/recsettings"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/tags"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/tracks"
@@ -55,6 +56,7 @@ func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playev
 		streamSecret:      streamSecret,
 		netSettings:       netSettings,
 		reacqSettings:     reacqSettings,
+		librarySize:       recommendation.NewLibrarySize(nil),
 	}

 	r.Route("/api", func(api chi.Router) {
@@ -268,12 +270,16 @@ func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playev
 }

 type handlers struct {
-	pool              *pgxpool.Pool
-	logger            *slog.Logger
-	events            *playevents.Writer
-	recCfg            config.RecommendationConfig
-	recSettings       *recsettings.Service
-	rng               func() float64
+	pool        *pgxpool.Pool
+	logger      *slog.Logger
+	events      *playevents.Writer
+	recCfg      config.RecommendationConfig
+	recSettings *recsettings.Service
+	rng         func() float64
+	// librarySize memoises the track count that sizes the candidate pool
+	// (#3880). Held here rather than counted per request: the count is a
+	// full table scan, and library size only moves when a scan runs.
+	librarySize       *recommendation.LibrarySize
 	lidarrCfg         *lidarrconfig.Service
 	lidarrRequests    *lidarrrequests.Service
 	lidarrQuarantine  *lidarrquarantine.Service
@@ -65,7 +65,7 @@ func testHandlers(t *testing.T) (*handlers, *pgxpool.Pool) {
 	}
 	lidarrCfg := lidarrconfig.New(pool)
 	lidarrReqs := lidarrrequests.NewService(pool, lidarrCfg, nil, nil)
-	lidarrQuar := lidarrquarantine.NewService(pool, lidarrCfg, nil)
+	lidarrQuar := lidarrquarantine.NewService(pool, lidarrCfg, nil, "")
 	// tracks.Service has no Lidarr unmonitorer in tests by default; the
 	// admin-tracks tests below override h.tracks via installTracksLidarrStub
 	// when they need a stubbed Lidarr.
@@ -6,19 +6,21 @@ package api
 // /app/client/ at image build time.
 //
 // Both endpoints are authenticated — the bandwidth cost of the APK
-// (~30-60 MB) makes anonymous access an abuse vector. The Flutter
-// client's polling only fires after login (banner mounts in the post-
-// login shell), so this gate is invisible to the actual update flow.
+// (~30-60 MB) makes anonymous access an abuse vector. The client only
+// polls after login, so this gate is invisible to the actual update flow.
 //
 // /api/client/apk additionally rate-limits per user to a single
 // download every 60s. Real install flows fire one download per
 // update; anything tighter is scripted/abusive.
 //
 // Returns 404 gracefully when the APK isn't present (dev environments,
-// pre-CI-wiring); the Flutter client treats 404 as "no update channel
-// available."
+// pre-CI-wiring); the client treats 404 as "no update channel available."
+//
+// (These paragraphs said "the Flutter client" until 2026-09-10. That client
+// was deleted in v2026.08.18 — the Android app is the only one now.)

 import (
+	"encoding/json"
 	"errors"
 	"net/http"
 	"os"
@@ -84,8 +86,36 @@ func clientAPKAllowDownload(userID string, now time.Time) time.Duration {
 	return 0
 }

+// clientVersionSidecar is the JSON written beside the bundled APK by
+// release.yml. It carries three values that are deliberately separate:
+//
+//   - Name is a LABEL for people, "YYYY.MM.DD.HHMM" from the commit's
+//     timestamp. Two channels carrying the same code report the same name.
+//   - Code is the ORDERING KEY, minutes since 2020-01-01 at build time, and
+//     is the value Android itself installs by. It answers "may this be
+//     installed over that?" — the name never does.
+//   - Channel is a SIBLING FIELD, never a suffix inside the name.
+//
+// JSON rather than a positional line on purpose. The obvious growth path for
+// the old one-value file was "<name> <code>", which a first-space split
+// silently mangles the moment a third field appears: the code stops parsing,
+// and the reader falls back to name comparison WITHOUT erroring.
+type clientVersionSidecar struct {
+	Name string `json:"name"`
+	// Pointer, not int64: absent must stay distinguishable from zero. An
+	// artifact published before codes were recorded genuinely has no code —
+	// zero would claim it is infinitely old rather than unknown.
+	Code    *int64 `json:"code"`
+	Channel string `json:"channel"`
+}
+
 type clientVersionResponse struct {
-	Version   string `json:"version"`
+	Version string `json:"version"`
+	// omitempty on both: the client must be able to tell "this server does
+	// not report a code" from "this build's code is 0", because those call
+	// for different behaviour on the other end.
+	Code      *int64 `json:"code,omitempty"`
+	Channel   string `json:"channel,omitempty"`
 	APKURL    string `json:"apk_url"`
 	SizeBytes int64  `json:"size_bytes"`
 }
@@ -117,8 +147,25 @@ func (h *handlers) handleClientVersion(w http.ResponseWriter, _ *http.Request) {
 		return
 	}

+	var sidecar clientVersionSidecar
+	if err := json.Unmarshal(versionBytes, &sidecar); err != nil {
+		// Fail LOUDLY rather than serving a blank version. The failure mode
+		// this avoids is the one that never gets reported: if an unreadable
+		// sidecar produced an empty name, every client would compare against
+		// nothing, conclude it was current, and go quiet — "I cannot read
+		// this" and "there is nothing newer" would be the same answer.
+		writeErrWithLog(w, h.logger, "client_version: sidecar is not valid JSON", err)
+		return
+	}
+	if sidecar.Name == "" {
+		http.Error(w, `{"error":{"code":"bad_client_version","message":"version sidecar has no name"}}`, http.StatusInternalServerError)
+		return
+	}
+
 	writeJSON(w, http.StatusOK, clientVersionResponse{
-		Version:   strings.TrimSpace(string(versionBytes)),
+		Version:   strings.TrimSpace(sidecar.Name),
+		Code:      sidecar.Code,
+		Channel:   strings.TrimSpace(sidecar.Channel),
 		APKURL:    "/api/client/apk",
 		SizeBytes: stat.Size(),
 	})
@@ -77,18 +77,32 @@ func TestClientVersion_404WhenAPKButNoVersion(t *testing.T) {
 	}
 }

-func TestClientVersion_200WithBothFiles(t *testing.T) {
+// writeClientAssets stages an APK plus a raw sidecar body, and returns the
+// APK's size so callers can assert size_bytes without recomputing it.
+func writeClientAssets(t *testing.T, sidecar string) int64 {
+	t.Helper()
 	dir := withClientAPKDir(t)
 	body := []byte("fake apk content")
 	if err := os.WriteFile(filepath.Join(dir, clientAPKFilename), body, 0o644); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(dir, clientVersionFile), []byte("v2026.05.10\n"), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(dir, clientVersionFile), []byte(sidecar), 0o644); err != nil {
 		t.Fatal(err)
 	}
+	return int64(len(body))
+}
+
+func getClientVersion(t *testing.T) *httptest.ResponseRecorder {
+	t.Helper()
 	h := &handlers{logger: slog.New(slog.NewTextHandler(io.Discard, nil))}
 	rr := httptest.NewRecorder()
 	h.handleClientVersion(rr, httptest.NewRequest(http.MethodGet, "/api/client/version", nil))
+	return rr
+}
+
+func TestClientVersion_200WithBothFiles(t *testing.T) {
+	size := writeClientAssets(t, `{"name":"2026.09.10.1432","code":3523847,"channel":"stable"}`+"\n")
+	rr := getClientVersion(t)
 	if rr.Code != http.StatusOK {
 		t.Fatalf("want 200, got %d (body: %s)", rr.Code, rr.Body.String())
 	}
@@ -96,14 +110,69 @@ func TestClientVersion_200WithBothFiles(t *testing.T) {
 	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
 		t.Fatal(err)
 	}
-	if resp.Version != "v2026.05.10" {
-		t.Errorf("version: want trimmed v2026.05.10, got %q", resp.Version)
+	if resp.Version != "2026.09.10.1432" {
+		t.Errorf("version: want 2026.09.10.1432, got %q", resp.Version)
+	}
+	if resp.Code == nil {
+		t.Fatal("code: want 3523847, got absent — the client decides on this, so absent means it silently falls back to name comparison")
+	}
+	if *resp.Code != 3523847 {
+		t.Errorf("code: want 3523847, got %d", *resp.Code)
+	}
+	if resp.Channel != "stable" {
+		t.Errorf("channel: want stable, got %q", resp.Channel)
 	}
 	if resp.APKURL != "/api/client/apk" {
 		t.Errorf("apk_url: want /api/client/apk, got %q", resp.APKURL)
 	}
-	if resp.SizeBytes != int64(len(body)) {
-		t.Errorf("size_bytes: want %d, got %d", len(body), resp.SizeBytes)
+	if resp.SizeBytes != size {
+		t.Errorf("size_bytes: want %d, got %d", size, resp.SizeBytes)
+	}
+}
+
+// A release published before ordering keys were recorded has a name and
+// genuinely no code. That must arrive as ABSENT, not as 0 — zero would claim
+// the build is infinitely old and offer an update to everyone forever.
+func TestClientVersion_CodeAbsentIsOmittedNotZero(t *testing.T) {
+	writeClientAssets(t, `{"name":"2026.09.09","code":null,"channel":"stable"}`)
+	rr := getClientVersion(t)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("want 200, got %d (body: %s)", rr.Code, rr.Body.String())
+	}
+	var resp clientVersionResponse
+	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if resp.Code != nil {
+		t.Errorf("code: want absent, got %d", *resp.Code)
+	}
+	// The wire must omit the key entirely, so a client can distinguish
+	// "this server reports no code" from "this build's code is 0".
+	var raw map[string]any
+	if err := json.Unmarshal(rr.Body.Bytes(), &raw); err != nil {
+		t.Fatal(err)
+	}
+	if _, present := raw["code"]; present {
+		t.Errorf("code key should be omitted entirely, body was %s", rr.Body.String())
+	}
+}
+
+// The failure this guards is the one nobody reports: if an unreadable sidecar
+// produced an empty version, every client would compare against nothing,
+// decide it was current, and go quiet. "I cannot read this" and "there is
+// nothing newer" must not be the same answer.
+func TestClientVersion_MalformedSidecarErrorsRatherThanReportingNothing(t *testing.T) {
+	for _, sidecar := range []string{
+		"2026.09.10.1432",              // the OLD plain-text format
+		`{"name":"x",`,                 // truncated JSON
+		`{"code":123,"channel":"dev"}`, // valid JSON, no name
+		"",
+	} {
+		writeClientAssets(t, sidecar)
+		rr := getClientVersion(t)
+		if rr.Code == http.StatusOK {
+			t.Errorf("sidecar %q: want an error status, got 200 with body %s", sidecar, rr.Body.String())
+		}
 	}
 }

@@ -0,0 +1,58 @@
+package api
+
+import (
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/library"
+)
+
+// fileRemoveAPIError answers a delete that could not reach the track's file
+// (#3918). Both delete endpoints use it, so the operator gets the same
+// explanation from the admin remove-track action and from quarantine's Delete
+// file.
+//
+// The unwritable case is a 409 rather than a 500 because nothing is broken: the
+// request conflicts with how the library is mounted, and the fix is the
+// operator's. The message names the directory — removal writes to the parent,
+// not the file — and the uid/gid the process runs as, which is the half of a
+// permission problem invisible from the host. Every case says nothing was
+// deleted, because that is exactly what the operator will be worried about.
+func fileRemoveAPIError(err error) (*apierror.Error, bool) {
+	var fre *library.FileRemoveError
+	if !errors.As(err, &fre) {
+		return nil, false
+	}
+	if fre.NotWritable() {
+		return &apierror.Error{
+			Status: http.StatusConflict,
+			Code:   "library_not_writable",
+			Message: fmt.Sprintf(
+				"Minstrel runs as uid %d, gid %d and cannot delete from %s (%s). "+
+					"The library mount must be writable by that user. Nothing was deleted.",
+				fre.UID, fre.GID, fre.Dir(), fre.Reason()),
+			Cause: err,
+		}, true
+	}
+	return &apierror.Error{
+		Status:  http.StatusInternalServerError,
+		Code:    "file_delete_failed",
+		Message: fmt.Sprintf("Could not delete %s (%s). Nothing was deleted.", fre.Path, fre.Reason()),
+		Cause:   err,
+	}, true
+}
+
+// logFileRemoveFailure records a delete that could not reach its file. An
+// unwritable library is an environment fact the operator can fix, so it is a
+// Warn; anything else is a real fault.
+func logFileRemoveFailure(logger *slog.Logger, apiErr *apierror.Error, attrs ...any) {
+	attrs = append(attrs, "code", apiErr.Code, "err", apiErr.Cause)
+	if apiErr.Status == http.StatusConflict {
+		logger.Warn("api: track file could not be deleted", attrs...)
+		return
+	}
+	logger.Error("api: track file could not be deleted", attrs...)
+}
@@ -0,0 +1,96 @@
+package api
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"net/http"
+	"strings"
+	"syscall"
+	"testing"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/library"
+)
+
+const removeTestPath = "/music/Moe Shop/WWW (2020)/01 - WWW.mp3"
+
+// removeFailure builds the error a delete service returns when the file would
+// not go, wrapped the way lidarrquarantine.DeleteFile and tracks.RemoveTrack
+// wrap it — the mapping has to see through that.
+func removeFailure(errno syscall.Errno) error {
+	return fmt.Errorf("delete file: %w", &library.FileRemoveError{
+		Path: removeTestPath, UID: 1000, GID: 1000,
+		Err: &fs.PathError{Op: "remove", Path: removeTestPath, Err: errno},
+	})
+}
+
+func TestFileRemoveAPIError(t *testing.T) {
+	cases := []struct {
+		name       string
+		errno      syscall.Errno
+		wantStatus int
+		wantCode   string
+		wantIn     []string
+	}{
+		{
+			name: "read-only mount", errno: syscall.EROFS,
+			wantStatus: http.StatusConflict, wantCode: "library_not_writable",
+			wantIn: []string{"uid 1000, gid 1000", "/music/Moe Shop/WWW (2020)", "read-only file system", "Nothing was deleted"},
+		},
+		{
+			name: "permission denied", errno: syscall.EACCES,
+			wantStatus: http.StatusConflict, wantCode: "library_not_writable",
+			wantIn: []string{"permission denied", "Nothing was deleted"},
+		},
+		{
+			name: "operation not permitted", errno: syscall.EPERM,
+			wantStatus: http.StatusConflict, wantCode: "library_not_writable",
+			wantIn: []string{"operation not permitted"},
+		},
+		{
+			name: "i/o error", errno: syscall.EIO,
+			wantStatus: http.StatusInternalServerError, wantCode: "file_delete_failed",
+			wantIn: []string{removeTestPath, "input/output error", "Nothing was deleted"},
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			apiErr, ok := fileRemoveAPIError(removeFailure(tc.errno))
+			if !ok {
+				t.Fatal("a wrapped *library.FileRemoveError was not recognised")
+			}
+			if apiErr.Status != tc.wantStatus || apiErr.Code != tc.wantCode {
+				t.Fatalf("got %d %s, want %d %s", apiErr.Status, apiErr.Code, tc.wantStatus, tc.wantCode)
+			}
+			for _, want := range tc.wantIn {
+				if !strings.Contains(apiErr.Message, want) {
+					t.Errorf("message %q lacks %q", apiErr.Message, want)
+				}
+			}
+		})
+	}
+}
+
+// The unwritable answer must name the DIRECTORY. Removal needs write access to
+// the parent, so a message naming the file would send the operator to fix the
+// wrong permissions. The directory is a prefix of the file path, which is why a
+// plain "contains the directory" check could never catch that regression.
+func TestFileRemoveAPIError_NotWritableNamesTheDirectoryNotTheFile(t *testing.T) {
+	apiErr, _ := fileRemoveAPIError(removeFailure(syscall.EROFS))
+	if strings.Contains(apiErr.Message, "01 - WWW.mp3") {
+		t.Fatalf("message names the file rather than its directory: %q", apiErr.Message)
+	}
+}
+
+func TestFileRemoveAPIError_IgnoresOtherErrors(t *testing.T) {
+	for name, err := range map[string]error{
+		"nil":         nil,
+		"plain error": errors.New("delete track: connection reset"),
+		"path error":  &fs.PathError{Op: "remove", Path: removeTestPath, Err: syscall.EROFS},
+		"not found":   library.ErrTrackNotFound,
+	} {
+		if _, ok := fileRemoveAPIError(err); ok {
+			t.Errorf("%s: mapped as a file-remove failure", name)
+		}
+	}
+}
@@ -87,10 +87,24 @@ func (h *handlers) handleRadio(w http.ResponseWriter, r *http.Request) {
 	currentVec.DeviceClass = latestDeviceClass(r.Context(), q, user.ID, h.logger)

 	exclude := parseExcludeParam(r.URL.Query().Get("exclude"))
-	limits := recommendation.DefaultCandidateSourceLimits()
+	// Size the pool to the library (#3880). A fixed ~170 candidates samples a
+	// shrinking fraction of a growing collection, which is what made the
+	// recommendations feel less relevant as the library grew. Degrades to the
+	// base limits if the count is unavailable — never fails the request over a
+	// sizing hint.
+	librarySize := h.librarySize.Get(r.Context(), func(ctx context.Context) (int64, error) {
+		return recommendation.CountLibraryTracks(ctx, q)
+	})
+	limits := recommendation.ScaleForLibrary(
+		recommendation.DefaultCandidateSourceLimits(), librarySize,
+	)
 	candidates, err := recommendation.LoadCandidatesFromSimilarity(
 		r.Context(), q, user.ID, seedID,
 		h.recCfg.RecentlyPlayedHours, currentVec, exclude, limits,
+		// A fresh seed per request (#3889): radio is a new session each time
+		// and SHOULD draw differently. The system mixes are the surfaces that
+		// promise repeatability; this is not one of them.
+		strconv.FormatInt(time.Now().UnixNano(), 36),
 	)
 	if err != nil {
 		h.logger.Warn("api: radio: similarity-pool failed; falling back to whole-library", "err", err)
@@ -108,7 +122,15 @@ func (h *handlers) handleRadio(w http.ResponseWriter, r *http.Request) {
 	// Scoring weights come from the DB-backed tuning lab (#1250) —
 	// read per request so an admin change takes effect live.
 	weights := h.recSettings.Weights(recsettings.ScopeRadio)
-	picks := recommendation.Shuffle(candidates, weights, time.Now().UTC(), h.rng, limit-1)
+	// Diversity caps (#3882). Radio had none while every sibling surface did,
+	// which is how a whole session could come back from one artist. Scaled to
+	// the requested length so a 20-track radio and a 200-track one are capped
+	// alike; Shuffle relaxes them rather than returning a short radio.
+	//
+	// limit-1 because the seed track occupies the first slot and is prepended
+	// below — the caps govern the tracks that FOLLOW it.
+	caps := recommendation.RadioDiversityCaps(limit - 1)
+	picks := recommendation.Shuffle(candidates, weights, time.Now().UTC(), h.rng, limit-1, caps)

 	out := make([]TrackRef, 0, len(picks)+1)
 	out = append(out, trackRefFrom(track, album.Title, artist.Name))
@@ -0,0 +1,59 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: fingerprints.sql
+
+package dbq
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+const deleteTrackFingerprint = `-- name: DeleteTrackFingerprint :exec
+DELETE FROM track_fingerprints WHERE track_id = $1
+`
+
+// A file changed but could not be fingerprinted, for a reason unrelated to the
+// file. The stored row describes the OLD bytes, so it goes and the backfill
+// re-derives it — nothing may keep trusting a stale identity.
+func (q *Queries) DeleteTrackFingerprint(ctx context.Context, trackID pgtype.UUID) error {
+	_, err := q.db.Exec(ctx, deleteTrackFingerprint, trackID)
+	return err
+}
+
+const upsertTrackFingerprint = `-- name: UpsertTrackFingerprint :exec
+INSERT INTO track_fingerprints (
+    track_id, audio_stream_sha256, chromaprint, fingerprint_version
+) VALUES (
+    $1, $2, $3,
+    $4
+)
+ON CONFLICT (track_id) DO UPDATE SET
+    audio_stream_sha256 = EXCLUDED.audio_stream_sha256,
+    chromaprint         = EXCLUDED.chromaprint,
+    fingerprint_version = EXCLUDED.fingerprint_version,
+    computed_at         = now()
+`
+
+type UpsertTrackFingerprintParams struct {
+	TrackID            pgtype.UUID
+	AudioStreamSha256  []byte
+	Chromaprint        []int32
+	FingerprintVersion int16
+}
+
+// Written whenever a track's fingerprint is derived: by the scan when a file is
+// new or its bytes changed, and by the backfill (#3908) for rows derived by an
+// older method. Replaces the row wholesale — a fingerprint of the old bytes has
+// no standing once the file has changed.
+func (q *Queries) UpsertTrackFingerprint(ctx context.Context, arg UpsertTrackFingerprintParams) error {
+	_, err := q.db.Exec(ctx, upsertTrackFingerprint,
+		arg.TrackID,
+		arg.AudioStreamSha256,
+		arg.Chromaprint,
+		arg.FingerprintVersion,
+	)
+	return err
+}
@@ -667,6 +667,14 @@ type Track struct {
 	MissingSince      pgtype.Timestamptz
 }

+type TrackFingerprint struct {
+	TrackID            pgtype.UUID
+	AudioStreamSha256  []byte
+	Chromaprint        []int32
+	FingerprintVersion int16
+	ComputedAt         pgtype.Timestamptz
+}
+
 type TrackSimilarity struct {
 	TrackAID  pgtype.UUID
 	TrackBID  pgtype.UUID
@@ -829,7 +829,7 @@ similar_artists AS (
    JOIN seed_artist sa ON asim.artist_a_id = sa.artist_id
    WHERE asim.source = 'listenbrainz'
      AND t.id NOT IN (SELECT id FROM excluded_ids)
-    ORDER BY asim.score DESC, random()
+    ORDER BY asim.score DESC, md5(t.id::text || $12::text)
    LIMIT $6
 ),
 tag_overlap AS (
@@ -857,7 +857,7 @@ likes_overlap AS (
          WHERE t.id = gl.track_id
            AND trim(g_overlap.g) IN (SELECT tag FROM seed_tags)
      )
-    ORDER BY random()
+    ORDER BY md5(gl.track_id::text || $12::text)
    LIMIT $8
 ),
 taste_overlap AS (
@@ -884,7 +884,7 @@ coplay_artists AS (
    WHERE asim.source = 'user_cooccurrence'
      AND t.id NOT IN (SELECT id FROM excluded_ids)
      AND t.id <> $2
-    ORDER BY asim.score DESC, random()
+    ORDER BY asim.score DESC, md5(t.id::text || $12::text)
    LIMIT $11
 ),
 random_fill AS (
@@ -900,7 +900,7 @@ random_fill AS (
          UNION SELECT track_id FROM taste_overlap
          UNION SELECT track_id FROM coplay_artists
      )
-    ORDER BY random()
+    ORDER BY md5(t.id::text || $12::text)
    LIMIT $9
 )
 SELECT
@@ -938,17 +938,18 @@ GROUP BY t.id, t.title, t.album_id, t.artist_id, t.duration_ms, t.file_path,
 `

 type LoadRadioCandidatesV2Params struct {
-	UserID  pgtype.UUID
-	ID      pgtype.UUID
-	Column3 interface{}
-	Column4 []pgtype.UUID
-	Limit   int32
-	Limit_2 int32
-	Limit_3 int32
-	Limit_4 int32
-	Limit_5 int32
-	Limit_6 int32
-	Limit_7 int32
+	UserID   pgtype.UUID
+	ID       pgtype.UUID
+	Column3  interface{}
+	Column4  []pgtype.UUID
+	Limit    int32
+	Limit_2  int32
+	Limit_3  int32
+	Limit_4  int32
+	Limit_5  int32
+	Limit_6  int32
+	Limit_7  int32
+	Column12 string
 }

 type LoadRadioCandidatesV2Row struct {
@@ -971,8 +972,22 @@ type LoadRadioCandidatesV2Row struct {
 //	enter the pool even when the similarity/random arms miss them; scored
 //	in Go via TasteMatch, so sim_score here is 0 pool-inclusion),
 //	$11 coplay_artists K (#1533 — tracks by artists co-played across the
-//	instance with the seed's artist; source='user_cooccurrence').
+//	instance with the seed's artist; source='user_cooccurrence'),
+//	$12 order_seed (text) — see below.
 //
+// $12 REPLACES `ORDER BY random()` IN FOUR ARMS (#3889). Those arms returned
+// a stable set only while their LIMIT exceeded the rows eligible for them: at
+// that point they returned all of them and the order stopped mattering,
+// because the caller sorts by track id before scoring. Below that threshold
+// they returned a random SUBSET, and two builds on the same day drew
+// different ones — so "daily determinism" held by accident, and only for
+// libraries smaller than the limits.
+//
+// md5(id || seed) keeps the intent — an arbitrary spread that changes when
+// the seed does — while making it reproducible for a given seed. The CALLER
+// decides what that means: system mixes pass a per-(user, day) string and get
+// the determinism they promise; radio passes a fresh value per request and
+// keeps varying, which is what a radio should do.
 // Returns same shape as LoadRadioCandidates plus similarity_score column.
 func (q *Queries) LoadRadioCandidatesV2(ctx context.Context, arg LoadRadioCandidatesV2Params) ([]LoadRadioCandidatesV2Row, error) {
 	rows, err := q.db.Query(ctx, loadRadioCandidatesV2,
@@ -987,6 +1002,7 @@ func (q *Queries) LoadRadioCandidatesV2(ctx context.Context, arg LoadRadioCandid
 		arg.Limit_5,
 		arg.Limit_6,
 		arg.Limit_7,
+		arg.Column12,
 	)
 	if err != nil {
 		return nil, err
@@ -0,0 +1,16 @@
+-- Drop the rows the narrower constraints are about to forbid, or re-adding
+-- them fails against existing data (the 0051 down-migration pattern).
+DELETE FROM recommendation_weight_profiles WHERE profile = 'songs_like';
+DELETE FROM recommendation_tuning_audit WHERE scope = 'songs_like';
+
+ALTER TABLE recommendation_tuning_audit
+    DROP CONSTRAINT recommendation_tuning_audit_scope_check;
+ALTER TABLE recommendation_tuning_audit
+    ADD CONSTRAINT recommendation_tuning_audit_scope_check
+    CHECK (scope IN ('radio', 'daily_mix', 'taste', 'discover'));
+
+ALTER TABLE recommendation_weight_profiles
+    DROP CONSTRAINT recommendation_weight_profiles_profile_check;
+ALTER TABLE recommendation_weight_profiles
+    ADD CONSTRAINT recommendation_weight_profiles_profile_check
+    CHECK (profile IN ('radio', 'daily_mix'));
@@ -0,0 +1,37 @@
+-- 0057_songs_like_tuning.up.sql — a THIRD weight profile, for Songs-like
+-- (Scribe #3881, milestone #398).
+--
+-- Songs-like shared the `daily_mix` profile with For-You, and that is the bug.
+-- The two surfaces want opposite things: For-You is a broad "what will they
+-- enjoy today", Songs-like answers "what sounds like THIS", and under one set
+-- of weights the broad answer wins. Operator, 2026-09-10: "I'm expecting to
+-- get a consistent sound and style from the experience... I was getting a
+-- seeming wide variety of music from each one when I was hoping to stay in a
+-- certain neighborhood."
+--
+-- Under the shared daily_mix weights, an UNRELATED track the user had liked
+-- and not played recently scored 1.0 + 2.0 + 1.0 = 4.0 before taste, while a
+-- PERFECT similarity match they had not liked scored 1.0 + 1.5 = 2.5. Liking
+-- something outranked sounding like the seed. Splitting the profile is what
+-- lets similarity dominate here without making For-You narrow.
+--
+-- Rows are seeded by the recsettings boot reconcile, not here, so shipped
+-- defaults live in exactly one place (Go) — same as 0040.
+
+-- Rule #36: a new value for a CHECK-gated column needs the constraint
+-- rewritten in the SAME change, or the first row written under the new
+-- profile fails at runtime rather than at migrate time.
+ALTER TABLE recommendation_weight_profiles
+    DROP CONSTRAINT recommendation_weight_profiles_profile_check;
+ALTER TABLE recommendation_weight_profiles
+    ADD CONSTRAINT recommendation_weight_profiles_profile_check
+    CHECK (profile IN ('radio', 'daily_mix', 'songs_like'));
+
+-- The audit table gates the same name on a separate constraint. Missing this
+-- one would let the profile be seeded and then fail on the first knob turn —
+-- green at boot, 500 on first use.
+ALTER TABLE recommendation_tuning_audit
+    DROP CONSTRAINT recommendation_tuning_audit_scope_check;
+ALTER TABLE recommendation_tuning_audit
+    ADD CONSTRAINT recommendation_tuning_audit_scope_check
+    CHECK (scope IN ('radio', 'daily_mix', 'taste', 'discover', 'songs_like'));
@@ -0,0 +1 @@
+DROP TABLE track_fingerprints;
@@ -0,0 +1,38 @@
+-- 0058_track_fingerprints.up.sql — an acoustic identity per track (Scribe
+-- milestone #400: #3905, #3906).
+--
+-- A table of its own rather than columns on tracks, for the hot path's sake:
+-- tracks is read with SELECT * by eight queries, among them ListTracksByAlbum,
+-- SearchTracks and GetTracksByIDs — album pages, search, the Subsonic surface.
+-- A ~4 KB chromaprint column on tracks would be de-TOASTed on every one of
+-- those reads to carry a value only the duplicate sweep ever looks at.
+--
+-- What a row means, which the backfill depends on:
+--   no row                          never fingerprinted
+--   fingerprint_version < current   derived by an older method; re-derive it
+--   fingerprint_version = current   attempted; a NULL value means that tool
+--                                   failed on this file, and it is not retried
+--                                   until the file changes
+-- A failure that says nothing about the file — a timeout, a cancelled scan, a
+-- missing binary — writes no row at all, so the backfill tries again.
+CREATE TABLE track_fingerprints (
+    -- CASCADE is right here, unlike for the likes and play history M400's
+    -- merge has to carry across: a fingerprint describes one file's bytes and
+    -- means nothing once that file's row is gone.
+    track_id            uuid        PRIMARY KEY REFERENCES tracks (id) ON DELETE CASCADE,
+    -- SHA-256 of the ENCODED audio packets (ffmpeg -c:a copy -f hash), not of
+    -- decoded samples. internal/library/fingerprint.go says why.
+    audio_stream_sha256 bytea
+        CHECK (audio_stream_sha256 IS NULL OR octet_length(audio_stream_sha256) = 32),
+    -- fpcalc -raw -signed: the same 32 bits per item, stored signed because
+    -- integer is.
+    chromaprint         integer[],
+    fingerprint_version smallint    NOT NULL,
+    computed_at         timestamptz NOT NULL DEFAULT now()
+);
+
+-- The exact duplicate tier is an equality match on this column. Partial
+-- because a NULL is never looked up — it only means the hash was not taken.
+CREATE INDEX track_fingerprints_audio_stream_sha256
+    ON track_fingerprints (audio_stream_sha256)
+    WHERE audio_stream_sha256 IS NOT NULL;
@@ -0,0 +1,22 @@
+-- name: UpsertTrackFingerprint :exec
+-- Written whenever a track's fingerprint is derived: by the scan when a file is
+-- new or its bytes changed, and by the backfill (#3908) for rows derived by an
+-- older method. Replaces the row wholesale — a fingerprint of the old bytes has
+-- no standing once the file has changed.
+INSERT INTO track_fingerprints (
+    track_id, audio_stream_sha256, chromaprint, fingerprint_version
+) VALUES (
+    sqlc.arg(track_id), sqlc.narg(audio_stream_sha256), sqlc.narg(chromaprint),
+    sqlc.arg(fingerprint_version)
+)
+ON CONFLICT (track_id) DO UPDATE SET
+    audio_stream_sha256 = EXCLUDED.audio_stream_sha256,
+    chromaprint         = EXCLUDED.chromaprint,
+    fingerprint_version = EXCLUDED.fingerprint_version,
+    computed_at         = now();
+
+-- name: DeleteTrackFingerprint :exec
+-- A file changed but could not be fingerprinted, for a reason unrelated to the
+-- file. The stored row describes the OLD bytes, so it goes and the backfill
+-- re-derives it — nothing may keep trusting a stale identity.
+DELETE FROM track_fingerprints WHERE track_id = $1;
@@ -45,7 +45,22 @@ WHERE t.id <> $2
 --   enter the pool even when the similarity/random arms miss them; scored
 --   in Go via TasteMatch, so sim_score here is 0 pool-inclusion),
 --   $11 coplay_artists K (#1533 — tracks by artists co-played across the
--   instance with the seed's artist; source='user_cooccurrence').
+--   instance with the seed's artist; source='user_cooccurrence'),
+--   $12 order_seed (text) — see below.
+--
+-- $12 REPLACES `ORDER BY random()` IN FOUR ARMS (#3889). Those arms returned
+-- a stable set only while their LIMIT exceeded the rows eligible for them: at
+-- that point they returned all of them and the order stopped mattering,
+-- because the caller sorts by track id before scoring. Below that threshold
+-- they returned a random SUBSET, and two builds on the same day drew
+-- different ones — so "daily determinism" held by accident, and only for
+-- libraries smaller than the limits.
+--
+-- md5(id || seed) keeps the intent — an arbitrary spread that changes when
+-- the seed does — while making it reproducible for a given seed. The CALLER
+-- decides what that means: system mixes pass a per-(user, day) string and get
+-- the determinism they promise; radio passes a fresh value per request and
+-- keeps varying, which is what a radio should do.
 -- Returns same shape as LoadRadioCandidates plus similarity_score column.

 WITH
@@ -87,7 +102,7 @@ similar_artists AS (
    JOIN seed_artist sa ON asim.artist_a_id = sa.artist_id
    WHERE asim.source = 'listenbrainz'
      AND t.id NOT IN (SELECT id FROM excluded_ids)
-    ORDER BY asim.score DESC, random()
+    ORDER BY asim.score DESC, md5(t.id::text || $12::text)
    LIMIT $6
 ),
 tag_overlap AS (
@@ -115,7 +130,7 @@ likes_overlap AS (
          WHERE t.id = gl.track_id
            AND trim(g_overlap.g) IN (SELECT tag FROM seed_tags)
      )
-    ORDER BY random()
+    ORDER BY md5(gl.track_id::text || $12::text)
    LIMIT $8
 ),
 taste_overlap AS (
@@ -142,7 +157,7 @@ coplay_artists AS (
    WHERE asim.source = 'user_cooccurrence'
      AND t.id NOT IN (SELECT id FROM excluded_ids)
      AND t.id <> $2
-    ORDER BY asim.score DESC, random()
+    ORDER BY asim.score DESC, md5(t.id::text || $12::text)
    LIMIT $11
 ),
 random_fill AS (
@@ -158,7 +173,7 @@ random_fill AS (
          UNION SELECT track_id FROM taste_overlap
          UNION SELECT track_id FROM coplay_artists
      )
-    ORDER BY random()
+    ORDER BY md5(t.id::text || $12::text)
    LIMIT $9
 )
 SELECT
@@ -87,6 +87,7 @@ var dataTables = []string{
 	// pristine Discover knobs rather than whatever a previous test tuned.
 	"discover_tuning",
 	"recommendation_tuning_audit",
+	"track_fingerprints", // M400
 	"tracks",
 	"albums",
 	"artists",
@@ -5,12 +5,16 @@ import (
 	"errors"
 	"fmt"
 	"io/fs"
+	"log/slog"
 	"os"
+	"path/filepath"
+	"syscall"

 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/jackc/pgx/v5/pgxpool"

+	"git.fabledsword.com/bvandeusen/minstrel/internal/coverart"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
 	syncpkg "git.fabledsword.com/bvandeusen/minstrel/internal/sync"
 )
@@ -19,54 +23,159 @@ import (
 // that has no row in tracks.
 var ErrTrackNotFound = errors.New("library: track not found")

-// DeleteTrackFile removes a track file from disk and its row from the
-// tracks table. Album and artist rows are left untouched.
+// removeFile is os.Remove behind a variable so a test can make removal fail the
+// way a read-only mount or a wrongly-owned directory does. A chmod-based test
+// cannot stand in for that: root ignores permission bits, so in a CI container
+// running as root it would pass without ever exercising the failure.
+var removeFile = os.Remove
+
+// FileRemoveError reports that a track's file exists but could not be removed.
+// When DeleteTrackFile returns one, NOTHING was deleted: the row, its likes, its
+// play history and its playlist memberships are all intact.
+type FileRemoveError struct {
+	Path string
+	// UID and GID are the identity the server process runs as — the half of a
+	// permission problem the operator cannot see from the host side.
+	UID, GID int
+	Err      error
+}
+
+func (e *FileRemoveError) Error() string { return fmt.Sprintf("remove track file: %v", e.Err) }
+
+func (e *FileRemoveError) Unwrap() error { return e.Err }
+
+// Dir is the directory removal needs write access to. Unlinking a file writes to
+// its PARENT, so a world-writable file inside a read-only directory still cannot
+// be removed — naming the file's own permissions would send the operator to the
+// wrong place.
+func (e *FileRemoveError) Dir() string { return filepath.Dir(e.Path) }
+
+// NotWritable reports whether the library is unwritable for this process — a
+// read-only mount or a permission denial — rather than an I/O fault. It is the
+// case the operator can fix, so callers answer it differently.
+func (e *FileRemoveError) NotWritable() bool {
+	return errors.Is(e.Err, fs.ErrPermission) || errors.Is(e.Err, syscall.EROFS)
+}
+
+// Reason is the underlying cause without the path os.Remove already wrapped
+// around it, for messages that name the directory themselves.
+func (e *FileRemoveError) Reason() string {
+	var pathErr *fs.PathError
+	if errors.As(e.Err, &pathErr) {
+		return pathErr.Err.Error()
+	}
+	return e.Err.Error()
+}
+
+// DeletedTrack reports what a delete tidied away beyond the track itself.
+type DeletedTrack struct {
+	// AlbumID is set when the track was its album's last, so the album went too.
+	AlbumID *pgtype.UUID
+	// ArtistID is set when that album was its artist's last, so the artist went too.
+	ArtistID *pgtype.UUID
+}
+
+// DeleteTrackFile removes a track's file from disk and then its row, tidying
+// away an album or artist the delete leaves empty. It is the ONLY path that
+// deletes a track file: the admin remove-track endpoint and quarantine's Delete
+// file both come through here (#3918).
 //
-// Steps:
-//  1. Look up the track to get its file_path.
-//  2. Remove the file from disk. fs.ErrNotExist is OK — already gone.
-//  3. Delete the tracks row.
+// Order is the whole contract. The file goes first, and if it cannot go — a
+// read-only mount, a permission denial, an I/O error — nothing else happens and
+// a *FileRemoveError comes back. Proceeding past that failure is how #3918 lost
+// history: tracks CASCADEs to play_events, general_likes, contextual_likes,
+// playlist_tracks, track_tags and playback_errors, so the row and everything
+// hanging off it were destroyed while the file survived, and the next scan
+// re-imported it as a brand-new track with none of it.
 //
-// Order matters: file first, then DB. If the file delete fails (permission,
-// I/O error), we leave the DB row alone so the admin can retry.
+// A file that is already gone (fs.ErrNotExist) is not a failure; the row is
+// removed as asked.
 //
-// The reverse failure mode — file gone, DB row still present — IS reconciled
-// now, and not by this function: the scan's reconcile pass stamps
-// tracks.missing_since (#2523), every selection path filters on it, and a file
-// that returns is un-marked or adopted at its new path (#2528). That is the
-// normal life of a vanished file and it is deliberately non-destructive: the
-// row, its play history and its likes survive, because a missing file is a
-// track Minstrel still knows about (#2527).
+// This is NOT the missing-file path. That lifecycle is deliberately
+// non-destructive: reconcile stamps missing_since (#2523), selection paths
+// filter on it, and a returning file is un-marked or adopted (#2528). This is the
+// explicit, irreversible "remove this recording", never the way to tidy up a row
+// whose file merely went away.
 //
-// So this function is NOT the missing-file path. It is the explicit admin
-// action "remove this recording from disk and from the library", and it is
-// irreversible: tracks CASCADEs to play_events, general_likes_tracks,
-// contextual_likes, track_tags and playback_errors. Reach for it when the
-// operator means to destroy the record, never to tidy up a row whose file
-// merely went away.
-func DeleteTrackFile(ctx context.Context, pool *pgxpool.Pool, trackID pgtype.UUID) error {
+// dataDir, when set, also clears the cached art of an artist the delete removed.
+// logger may be nil.
+func DeleteTrackFile(
+	ctx context.Context, pool *pgxpool.Pool, logger *slog.Logger, dataDir string, trackID pgtype.UUID,
+) (DeletedTrack, error) {
+	if logger == nil {
+		logger = slog.Default()
+	}
 	q := dbq.New(pool)
 	track, err := q.GetTrackByID(ctx, trackID)
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
-			return ErrTrackNotFound
+			return DeletedTrack{}, ErrTrackNotFound
 		}
-		return fmt.Errorf("get track: %w", err)
+		return DeletedTrack{}, fmt.Errorf("get track: %w", err)
 	}

-	if err := os.Remove(track.FilePath); err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return fmt.Errorf("remove file: %w", err)
+	if err := removeFile(track.FilePath); err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return DeletedTrack{}, &FileRemoveError{
+			Path: track.FilePath, UID: os.Getuid(), GID: os.Getgid(), Err: err,
+		}
 	}

-	if _, err := pool.Exec(ctx, "DELETE FROM tracks WHERE id = $1", trackID); err != nil {
-		return fmt.Errorf("delete row: %w", err)
+	// The row and any album or artist it empties go together, so a failure
+	// partway cannot leave a deleted track with a ghost album behind it.
+	tx, err := pool.Begin(ctx)
+	if err != nil {
+		return DeletedTrack{}, fmt.Errorf("begin tx: %w", err)
 	}
-	// Log the change after the delete succeeds. Best-effort: a Warn-level
-	// failure here would leave the cache index orphaned on offline clients
-	// until the next scan touches the surrounding album.
+	defer func() { _ = tx.Rollback(ctx) }()
+	tq := dbq.New(tx)
+
+	deleted, err := tq.DeleteTrack(ctx, trackID)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			// Removed by someone else between the lookup and here.
+			return DeletedTrack{}, ErrTrackNotFound
+		}
+		return DeletedTrack{}, fmt.Errorf("delete track: %w", err)
+	}
+
+	var out DeletedTrack
+	album, err := tq.DeleteAlbumIfEmpty(ctx, deleted.AlbumID)
+	switch {
+	case err == nil:
+		albumID := album.ID
+		out.AlbumID = &albumID
+		artistID, aerr := tq.DeleteArtistIfEmpty(ctx, album.ArtistID)
+		switch {
+		case aerr == nil:
+			out.ArtistID = &artistID
+		case errors.Is(aerr, pgx.ErrNoRows):
+			// The artist still has other albums or stray tracks.
+		default:
+			return DeletedTrack{}, fmt.Errorf("delete artist if empty: %w", aerr)
+		}
+	case errors.Is(err, pgx.ErrNoRows):
+		// The album still has other tracks.
+	default:
+		return DeletedTrack{}, fmt.Errorf("delete album if empty: %w", err)
+	}
+
+	if err := tx.Commit(ctx); err != nil {
+		return DeletedTrack{}, fmt.Errorf("commit: %w", err)
+	}
+
+	// Both of these run after the delete has committed, so neither may fail
+	// it: the recording is gone either way. An unlogged change leaves the track
+	// in offline clients' caches until the next scan touches its album; a
+	// leftover art directory is only disk.
 	if err := syncpkg.LogChange(ctx, pool, syncpkg.EntityTrack,
 		syncpkg.FormatUUID(trackID), syncpkg.OpDelete); err != nil {
-		return fmt.Errorf("log change: %w", err)
+		logger.Warn("track delete: LogChange failed", "track_id", syncpkg.FormatUUID(trackID), "err", err)
 	}
-	return nil
+	if out.ArtistID != nil && dataDir != "" {
+		if err := coverart.CleanupArtistArt(dataDir, *out.ArtistID); err != nil {
+			logger.Warn("track delete: artist-art cleanup failed",
+				"artist_id", syncpkg.FormatUUID(*out.ArtistID), "err", err)
+		}
+	}
+	return out, nil
 }
@@ -4,9 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
+	"io/fs"
 	"log/slog"
 	"os"
 	"path/filepath"
+	"syscall"
 	"testing"

 	"github.com/jackc/pgx/v5/pgtype"
@@ -64,6 +66,15 @@ func seedTrack(t *testing.T, pool *pgxpool.Pool, filePath string) (dbq.Track, db
 	return track, album, artist
 }

+// stubRemoveFile makes file removal fail (or succeed) on demand for one test.
+// See removeFile for why this is a seam rather than a chmod.
+func stubRemoveFile(t *testing.T, fn func(string) error) {
+	t.Helper()
+	orig := removeFile
+	removeFile = fn
+	t.Cleanup(func() { removeFile = orig })
+}
+
 func TestDeleteTrackFile_HappyPath(t *testing.T) {
 	pool := newPool(t)
 	q := dbq.New(pool)
@@ -73,9 +84,18 @@ func TestDeleteTrackFile_HappyPath(t *testing.T) {
 	if err := os.WriteFile(path, []byte("payload"), 0o644); err != nil {
 		t.Fatalf("write file: %v", err)
 	}
-	track, album, _ := seedTrack(t, pool, path)
+	track, album, artist := seedTrack(t, pool, path)
+	// A sibling keeps the album non-empty, so this case pins that the tidy-up
+	// only removes an album the delete actually emptied.
+	if _, err := q.UpsertTrack(context.Background(), dbq.UpsertTrackParams{
+		Title: "Sibling", AlbumID: album.ID, ArtistID: artist.ID,
+		DurationMs: 1000, FilePath: filepath.Join(dir, "sibling.mp3"), FileSize: 100, FileFormat: "mp3",
+	}); err != nil {
+		t.Fatalf("sibling: %v", err)
+	}

-	if err := DeleteTrackFile(context.Background(), pool, track.ID); err != nil {
+	got, err := DeleteTrackFile(context.Background(), pool, nil, "", track.ID)
+	if err != nil {
 		t.Fatalf("DeleteTrackFile: %v", err)
 	}

@@ -85,9 +105,99 @@ func TestDeleteTrackFile_HappyPath(t *testing.T) {
 	if _, err := q.GetTrackByID(context.Background(), track.ID); err == nil {
 		t.Errorf("track row still exists")
 	}
-	// Album row preserved (other tracks may reference it).
 	if _, err := q.GetAlbumByID(context.Background(), album.ID); err != nil {
-		t.Errorf("album row vanished: %v", err)
+		t.Errorf("album with a remaining track vanished: %v", err)
+	}
+	if got.AlbumID != nil || got.ArtistID != nil {
+		t.Errorf("reported tidy-up %+v for an album that still has a track", got)
+	}
+}
+
+func TestDeleteTrackFile_EmptiedAlbumAndArtistGoToo(t *testing.T) {
+	pool := newPool(t)
+	q := dbq.New(pool)
+
+	path := filepath.Join(t.TempDir(), "lone.mp3")
+	if err := os.WriteFile(path, []byte("payload"), 0o644); err != nil {
+		t.Fatalf("write file: %v", err)
+	}
+	track, album, artist := seedTrack(t, pool, path)
+
+	got, err := DeleteTrackFile(context.Background(), pool, nil, "", track.ID)
+	if err != nil {
+		t.Fatalf("DeleteTrackFile: %v", err)
+	}
+	if got.AlbumID == nil || *got.AlbumID != album.ID {
+		t.Errorf("AlbumID = %v, want %v", got.AlbumID, album.ID)
+	}
+	if got.ArtistID == nil || *got.ArtistID != artist.ID {
+		t.Errorf("ArtistID = %v, want %v", got.ArtistID, artist.ID)
+	}
+	if _, err := q.GetAlbumByID(context.Background(), album.ID); err == nil {
+		t.Errorf("emptied album row still exists")
+	}
+	if _, err := q.GetArtistByID(context.Background(), artist.ID); err == nil {
+		t.Errorf("emptied artist row still exists")
+	}
+}
+
+// The #3918 proof. A file that cannot be removed must leave EVERYTHING in place:
+// the row is what carries likes, plays and playlist memberships, and the file
+// surviving means the next scan would re-import it as a stranger.
+func TestDeleteTrackFile_UnremovableFileDeletesNothing(t *testing.T) {
+	cases := []struct {
+		name        string
+		errno       syscall.Errno
+		notWritable bool
+	}{
+		{"read-only mount", syscall.EROFS, true},
+		{"permission denied", syscall.EACCES, true},
+		{"operation not permitted", syscall.EPERM, true},
+		{"i/o error", syscall.EIO, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			pool := newPool(t)
+			q := dbq.New(pool)
+
+			dir := t.TempDir()
+			path := filepath.Join(dir, "track.mp3")
+			if err := os.WriteFile(path, []byte("payload"), 0o644); err != nil {
+				t.Fatalf("write file: %v", err)
+			}
+			track, album, _ := seedTrack(t, pool, path)
+			stubRemoveFile(t, func(name string) error {
+				return &fs.PathError{Op: "remove", Path: name, Err: tc.errno}
+			})
+
+			_, err := DeleteTrackFile(context.Background(), pool, nil, "", track.ID)
+
+			var fre *FileRemoveError
+			if !errors.As(err, &fre) {
+				t.Fatalf("err = %v, want a *FileRemoveError", err)
+			}
+			if fre.NotWritable() != tc.notWritable {
+				t.Errorf("NotWritable = %v, want %v", fre.NotWritable(), tc.notWritable)
+			}
+			if fre.Dir() != dir {
+				t.Errorf("Dir = %q, want the parent directory %q", fre.Dir(), dir)
+			}
+			if fre.Reason() != tc.errno.Error() {
+				t.Errorf("Reason = %q, want %q", fre.Reason(), tc.errno.Error())
+			}
+			if fre.UID != os.Getuid() || fre.GID != os.Getgid() {
+				t.Errorf("identity = %d:%d, want this process's %d:%d", fre.UID, fre.GID, os.Getuid(), os.Getgid())
+			}
+			if _, err := q.GetTrackByID(context.Background(), track.ID); err != nil {
+				t.Errorf("track row was deleted although its file was not: %v", err)
+			}
+			if _, err := q.GetAlbumByID(context.Background(), album.ID); err != nil {
+				t.Errorf("album row was deleted although the track's file was not: %v", err)
+			}
+			if _, err := os.Stat(path); err != nil {
+				t.Errorf("file gone although removal was refused: %v", err)
+			}
+		})
 	}
 }

@@ -97,7 +207,7 @@ func TestDeleteTrackFile_FileAlreadyGoneSucceeds(t *testing.T) {

 	track, _, _ := seedTrack(t, pool, "/no/such/file/anywhere.mp3")

-	if err := DeleteTrackFile(context.Background(), pool, track.ID); err != nil {
+	if _, err := DeleteTrackFile(context.Background(), pool, nil, "", track.ID); err != nil {
 		t.Fatalf("DeleteTrackFile with missing file: %v", err)
 	}
 	if _, err := q.GetTrackByID(context.Background(), track.ID); err == nil {
@@ -112,7 +222,7 @@ func TestDeleteTrackFile_NotFoundReturnsErr(t *testing.T) {
 	bogus.Bytes = [16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
 	bogus.Valid = true

-	err := DeleteTrackFile(context.Background(), pool, bogus)
+	_, err := DeleteTrackFile(context.Background(), pool, nil, "", bogus)
 	if !errors.Is(err, ErrTrackNotFound) {
 		t.Errorf("err = %v, want ErrTrackNotFound", err)
 	}
@@ -0,0 +1,296 @@
+package library
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"os/exec"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgtype"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
+)
+
+// Acoustic identity (M400).
+//
+// Two values per track, because they answer different questions:
+//
+//	audio_stream_sha256  a SHA-256 of the ENCODED audio packets. Equal means the
+//	                     same audio bytes, whatever the tags or container around
+//	                     them say. No threshold and no false positives — this is
+//	                     what catches two copies of one MP3 that differ only in
+//	                     their ID3 (#3885).
+//
+//	chromaprint          fpcalc's raw fingerprint. Close means the same
+//	                     recording, even at another bitrate or in another codec
+//	                     — the case an exact hash cannot see.
+//
+// Both shell out, in the shape probeDurationMs already set: a deadline on every
+// call, and a failure that leaves the value unset rather than failing the file.
+// A track with no fingerprint is never a duplicate candidate; it is still a
+// track.
+
+// fingerprintTimeout bounds one ffmpeg hash or fpcalc call. Longer than
+// probeTimeout because both read the audio rather than a header: the hash reads
+// every packet and fpcalc decodes up to its -length. 60s leaves room for a large
+// lossless file on a slow network mount; a call needing more is a stall, not a
+// big file.
+const fingerprintTimeout = 60 * time.Second
+
+// fingerprintWaitDelay bounds how long Output may keep waiting on the tool's
+// pipes after the deadline has killed it. Without it, a child that left a
+// descendant holding stdout open would block the scan past its own timeout.
+const fingerprintWaitDelay = 5 * time.Second
+
+// fingerprintVersion stamps how a track_fingerprints row was derived. Bump it
+// whenever the derivation changes — the hash arguments, fpcalc's flags or its
+// length — and the backfill re-derives every row below it. Fingerprints taken
+// by two methods are not comparable, and nothing else would reveal that the
+// library held a mix.
+const fingerprintVersion int16 = 1
+
+// errFingerprintTimeout marks a tool that ran out of time. Distinct from a
+// failed exit because a stall is a fact about the mount, not about the file.
+var errFingerprintTimeout = errors.New("fingerprint tool timed out")
+
+// defaultChromaprintLengthSec is how many seconds of audio fpcalc fingerprints.
+// 120 is fpcalc's own default. Fingerprints taken at different lengths are not
+// comparable, so changing this has to re-derive every stored one.
+const defaultChromaprintLengthSec = 120
+
+// fpcalcStderrTail caps how much of a failing tool's stderr reaches the log.
+const fpcalcStderrTail = 512
+
+// streamHashArgs hashes the encoded audio packets, never decoded samples.
+//
+// -c:a copy is the point, not an optimisation. A decoded hash of a lossy file
+// depends on the decoder's float maths and sample conversion, which can move
+// between ffmpeg releases — so an image upgrade could silently change every
+// stored hash, and yesterday's duplicate would stop matching today's copy.
+// Packet bytes do not move. It is also far cheaper: demux only, no decode.
+//
+// -map 0:a keeps embedded cover art (an attached-picture video stream) out of
+// the hash, so two copies of one recording carrying different art still match.
+func streamHashArgs(path string) []string {
+	return []string{
+		"-v", "error",
+		"-i", path,
+		"-map", "0:a",
+		"-c:a", "copy",
+		"-f", "hash", "-hash", "sha256",
+		"-",
+	}
+}
+
+// fpcalcArgs asks for the raw fingerprint as SIGNED integers.
+//
+// -raw because the matcher compares items bit by bit, which the compressed form
+// cannot do without being unpacked first. -signed because the column is Postgres
+// integer[], which is signed: fpcalc's default prints uint32, and half of those
+// values do not fit. Signed output is the same 32 bits with no reinterpretation
+// step left to get wrong.
+func fpcalcArgs(path string, lengthSec int) []string {
+	return []string{
+		"-raw", "-signed",
+		"-length", strconv.Itoa(lengthSec),
+		path,
+	}
+}
+
+// fingerprintResult is one attempt at both halves of a track's identity. They
+// fail independently: a file ffmpeg can demux may still defeat fpcalc.
+type fingerprintResult struct {
+	streamSHA256 []byte
+	chromaprint  []int32
+	hashErr      error
+	printErr     error
+}
+
+// computeFingerprint derives both halves for the file at path.
+func computeFingerprint(ctx context.Context, path string) fingerprintResult {
+	var r fingerprintResult
+	r.streamSHA256, r.hashErr = computeAudioStreamSHA256(ctx, path)
+	r.chromaprint, r.printErr = computeChromaprint(ctx, path, defaultChromaprintLengthSec)
+	return r
+}
+
+// inconclusive reports whether either half failed for a reason that says
+// nothing about the file. Such a result must never be stored: stamped at the
+// current version it would read as "tried, and this file cannot be
+// fingerprinted", and the backfill would never try it again.
+func (r fingerprintResult) inconclusive() bool {
+	return isInconclusive(r.hashErr) || isInconclusive(r.printErr)
+}
+
+// isInconclusive names the failures that are not a verdict on the file: a
+// stall, a cancelled scan, and a tool that is not installed. The last matters
+// outside the image — a dev binary run without fpcalc on PATH must not stamp
+// every track in the library as unfingerprintable.
+func isInconclusive(err error) bool {
+	return errors.Is(err, errFingerprintTimeout) ||
+		errors.Is(err, context.Canceled) ||
+		errors.Is(err, context.DeadlineExceeded) ||
+		errors.Is(err, exec.ErrNotFound)
+}
+
+// fingerprintFile runs the scanner's fingerprinter. A Scanner built without New
+// gets the real tools rather than a nil-func panic halfway through a scan.
+func (s *Scanner) fingerprintFile(ctx context.Context, path string) fingerprintResult {
+	if s.fingerprint == nil {
+		return computeFingerprint(ctx, path)
+	}
+	return s.fingerprint(ctx, path)
+}
+
+// storeFingerprint records one attempt for a track whose bytes are new or have
+// changed. It never fails the scan: a missing fingerprint only keeps a track
+// out of duplicate detection, which is not worth dropping the track over.
+func (s *Scanner) storeFingerprint(
+	ctx context.Context, q *dbq.Queries, trackID pgtype.UUID, path string, fp fingerprintResult,
+) {
+	if fp.hashErr != nil {
+		s.logger.Warn("library scan: audio stream hash failed", "path", path, "err", fp.hashErr)
+	}
+	if fp.printErr != nil {
+		s.logger.Warn("library scan: chromaprint failed", "path", path, "err", fp.printErr)
+	}
+	if fp.inconclusive() {
+		// Any row this track holds describes its PREVIOUS bytes. Drop it and
+		// leave the track to the backfill, rather than stamping a failure that
+		// says nothing about this file.
+		if err := q.DeleteTrackFingerprint(ctx, trackID); err != nil {
+			s.logger.Warn("library scan: clearing stale fingerprint failed", "path", path, "err", err)
+		}
+		return
+	}
+	// A NULL half here is a verdict — the tool ran and rejected this file — and
+	// is stamped at the current version so the backfill does not retry it on
+	// every boot. It is retried when the file changes.
+	if err := q.UpsertTrackFingerprint(ctx, dbq.UpsertTrackFingerprintParams{
+		TrackID:            trackID,
+		AudioStreamSha256:  fp.streamSHA256,
+		Chromaprint:        fp.chromaprint,
+		FingerprintVersion: fingerprintVersion,
+	}); err != nil {
+		s.logger.Warn("library scan: storing fingerprint failed", "path", path, "err", err)
+	}
+}
+
+// computeAudioStreamSHA256 returns the SHA-256 of the file's encoded audio.
+func computeAudioStreamSHA256(ctx context.Context, path string) ([]byte, error) {
+	out, err := runFingerprintTool(ctx, "ffmpeg", streamHashArgs(path))
+	if err != nil {
+		return nil, err
+	}
+	return parseStreamHash(out)
+}
+
+// computeChromaprint returns the raw acoustic fingerprint of the first
+// lengthSec seconds of the file.
+func computeChromaprint(ctx context.Context, path string, lengthSec int) ([]int32, error) {
+	out, err := runFingerprintTool(ctx, "fpcalc", fpcalcArgs(path, lengthSec))
+	if err != nil {
+		return nil, err
+	}
+	return parseFpcalcRaw(out)
+}
+
+// runFingerprintTool runs one tool under fingerprintTimeout.
+//
+// Any non-zero exit is an error, and that deliberately includes fpcalc's exit 3:
+// "reading failed, but here is a fingerprint of what I got". A partial
+// fingerprint of a damaged file is not that file's identity. Stored, it would
+// score against a healthy copy over whatever prefix survived, and could group
+// or fail to group either way. Absent is better than wrong.
+func runFingerprintTool(ctx context.Context, name string, args []string) ([]byte, error) {
+	runCtx, cancel := context.WithTimeout(ctx, fingerprintTimeout)
+	defer cancel()
+
+	cmd := exec.CommandContext(runCtx, name, args...)
+	cmd.WaitDelay = fingerprintWaitDelay
+	out, err := cmd.Output()
+	if err == nil {
+		return out, nil
+	}
+	// The caller gave up (a cancelled scan). Report that rather than the
+	// signal-killed exit it caused, so it is never mistaken for a verdict on
+	// the file.
+	if ctx.Err() != nil {
+		return nil, fmt.Errorf("%s: %w", name, ctx.Err())
+	}
+	// Named separately so a stall reads as a stall, not as a crash.
+	if errors.Is(runCtx.Err(), context.DeadlineExceeded) {
+		return nil, fmt.Errorf("%s: no result within %s: %w", name, fingerprintTimeout, errFingerprintTimeout)
+	}
+	var exitErr *exec.ExitError
+	if errors.As(err, &exitErr) {
+		return nil, fmt.Errorf("%s exited %d: %s", name, exitErr.ExitCode(), stderrTail(exitErr.Stderr))
+	}
+	return nil, fmt.Errorf("%s: %w", name, err)
+}
+
+// stderrTail keeps the END of a failing tool's stderr. ffmpeg and fpcalc print
+// the actual reason last, after any banner or per-frame warnings, so a cap that
+// kept the head would log the noise and drop the cause.
+func stderrTail(stderr []byte) []byte {
+	stderr = bytes.TrimSpace(stderr)
+	if len(stderr) > fpcalcStderrTail {
+		stderr = stderr[len(stderr)-fpcalcStderrTail:]
+	}
+	return stderr
+}
+
+// parseStreamHash reads the ffmpeg hash muxer's "SHA256=<hex>" line.
+func parseStreamHash(out []byte) ([]byte, error) {
+	for _, line := range strings.Split(string(out), "\n") {
+		hexed, ok := strings.CutPrefix(strings.TrimSpace(line), "SHA256=")
+		if !ok {
+			continue
+		}
+		sum, err := hex.DecodeString(hexed)
+		if err != nil {
+			return nil, fmt.Errorf("stream hash %q: %w", hexed, err)
+		}
+		if len(sum) != sha256.Size {
+			return nil, fmt.Errorf("stream hash is %d bytes, want %d", len(sum), sha256.Size)
+		}
+		return sum, nil
+	}
+	return nil, errors.New("ffmpeg printed no SHA256= line")
+}
+
+// parseFpcalcRaw reads fpcalc's text output:
+//
+//	DURATION=<seconds>
+//	FINGERPRINT=<int32>,<int32>,...
+func parseFpcalcRaw(out []byte) ([]int32, error) {
+	for _, line := range strings.Split(string(out), "\n") {
+		list, ok := strings.CutPrefix(strings.TrimSpace(line), "FINGERPRINT=")
+		if !ok {
+			continue
+		}
+		if list == "" {
+			return nil, errors.New("fpcalc returned an empty fingerprint")
+		}
+		items := strings.Split(list, ",")
+		fp := make([]int32, len(items))
+		for i, item := range items {
+			// ParseInt at 32 bits, not ParseUint: a value past int32 means the
+			// output was unsigned — -signed went missing from the invocation —
+			// and nothing downstream would reinterpret it. Refuse it here.
+			v, err := strconv.ParseInt(item, 10, 32)
+			if err != nil {
+				return nil, fmt.Errorf("fingerprint item %d %q: %w", i, item, err)
+			}
+			fp[i] = int32(v)
+		}
+		return fp, nil
+	}
+	return nil, errors.New("fpcalc printed no FINGERPRINT= line")
+}
@@ -0,0 +1,174 @@
+package library
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/db"
+)
+
+// TestScanner_FingerprintsOnlyNewOrChangedBytes_Integration pins WHEN the scan
+// fingerprints. The cost of getting it wrong is asymmetric and invisible: a
+// scan that re-fingerprints unchanged files still produces correct rows, just
+// by decoding the entire library on every tag-repair pass.
+//
+// The fingerprinter is stubbed. CI has no real audio, and the tools' output is
+// covered by the parser tests; this covers the scan's decisions.
+func TestScanner_FingerprintsOnlyNewOrChangedBytes_Integration(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping scanner integration in -short mode")
+	}
+	dsn := os.Getenv("MINSTREL_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("MINSTREL_TEST_DATABASE_URL not set")
+	}
+	ctx := context.Background()
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+
+	if err := db.Migrate(dsn, logger); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("pool: %v", err)
+	}
+	t.Cleanup(pool.Close)
+	if _, err := pool.Exec(ctx, "TRUNCATE tracks, albums, artists RESTART IDENTITY CASCADE"); err != nil {
+		t.Fatalf("truncate: %v", err)
+	}
+
+	root := t.TempDir()
+	a := filepath.Join(root, "artist/album/01.mp3")
+	b := filepath.Join(root, "artist/album/02.mp3")
+	writeTestMP3(t, a, map[string]string{"TIT2": "One", "TPE1": "Artist", "TALB": "Album", "TRCK": "1"})
+	writeTestMP3(t, b, map[string]string{"TIT2": "Two", "TPE1": "Artist", "TALB": "Album", "TRCK": "2"})
+
+	sum := bytes.Repeat([]byte{0xAB}, 32)
+	chroma := []int32{7, -7, 2147483647}
+	result := fingerprintResult{streamSHA256: sum, chromaprint: chroma}
+	calls := map[string]int{}
+
+	scanner := New(pool, logger, []string{root})
+	scanner.fingerprint = func(_ context.Context, path string) fingerprintResult {
+		calls[path]++
+		return result
+	}
+
+	scan := func(step string) Stats {
+		t.Helper()
+		st, err := scanner.Scan(ctx, nil)
+		if err != nil {
+			t.Fatalf("%s: scan: %v", step, err)
+		}
+		return st
+	}
+	type row struct {
+		sha     []byte
+		chroma  []int32
+		version int16
+	}
+	stored := func(path string) (row, bool) {
+		t.Helper()
+		var r row
+		err := pool.QueryRow(ctx, `
+			SELECT f.audio_stream_sha256, f.chromaprint, f.fingerprint_version
+			  FROM track_fingerprints f JOIN tracks t ON t.id = f.track_id
+			 WHERE t.file_path = $1`, path).Scan(&r.sha, &r.chroma, &r.version)
+		if errors.Is(err, pgx.ErrNoRows) {
+			return row{}, false
+		}
+		if err != nil {
+			t.Fatalf("read fingerprint for %s: %v", path, err)
+		}
+		return r, true
+	}
+	// A later step moves mtime forward past the row's updated_at, which is
+	// what the scan reads as "these bytes changed".
+	touch := func(path string, ahead time.Duration) {
+		t.Helper()
+		when := time.Now().Add(ahead)
+		if err := os.Chtimes(path, when, when); err != nil {
+			t.Fatalf("chtimes %s: %v", path, err)
+		}
+	}
+
+	// 1. New files are fingerprinted, and stored at the current version.
+	scan("first scan")
+	if calls[a] != 1 || calls[b] != 1 {
+		t.Fatalf("first scan fingerprint calls = %v, want one per file", calls)
+	}
+	got, ok := stored(a)
+	if !ok {
+		t.Fatal("first scan stored no fingerprint")
+	}
+	if !bytes.Equal(got.sha, sum) || !slices.Equal(got.chroma, chroma) || got.version != fingerprintVersion {
+		t.Fatalf("stored %+v, want sha %x chromaprint %v version %d", got, sum, chroma, fingerprintVersion)
+	}
+
+	// 2. A tag-repair pass re-reads every unchanged file and must not
+	// fingerprint any of them again.
+	//
+	// The Updated count is what makes this able to fail. Without it, a scan
+	// that simply SKIPPED both files would also leave the call counts at one,
+	// and the assertion would pass without the re-read path ever running.
+	if _, err := pool.Exec(ctx, "UPDATE tracks SET duration_ms = 1000, tag_read_version = 0"); err != nil {
+		t.Fatalf("force tag re-read: %v", err)
+	}
+	if st := scan("tag-repair scan"); st.Updated != 2 || st.Skipped != 0 {
+		t.Fatalf("tag-repair scan stats = %+v, want both files re-read (Updated=2 Skipped=0)", st)
+	}
+	if calls[a] != 1 || calls[b] != 1 {
+		t.Fatalf("tag-repair scan re-fingerprinted unchanged files: calls = %v", calls)
+	}
+	if _, ok := stored(a); !ok {
+		t.Fatal("tag-repair scan dropped a stored fingerprint")
+	}
+
+	// 3. Bytes that changed are fingerprinted again, and only those.
+	touch(a, time.Hour)
+	scan("changed-file scan")
+	if calls[a] != 2 || calls[b] != 1 {
+		t.Fatalf("changed-file scan calls = %v, want a=2 b=1", calls)
+	}
+
+	// 4. A changed file whose attempt is inconclusive loses its old row: that
+	// row describes the previous bytes, and a stall says nothing about the new
+	// ones.
+	result = fingerprintResult{streamSHA256: sum, printErr: fmt.Errorf("fpcalc: %w", errFingerprintTimeout)}
+	touch(a, 2*time.Hour)
+	scan("inconclusive scan")
+	if _, ok := stored(a); ok {
+		t.Fatal("inconclusive attempt left the previous bytes' fingerprint in place")
+	}
+	if _, ok := stored(b); !ok {
+		t.Fatal("inconclusive attempt on one file removed another file's fingerprint")
+	}
+
+	// 5. A file the tools reject gets a row at the current version with both
+	// halves NULL — a verdict, so the backfill does not retry it every boot.
+	result = fingerprintResult{
+		hashErr:  errors.New("ffmpeg exited 1"),
+		printErr: errors.New("fpcalc exited 2"),
+	}
+	touch(a, 3*time.Hour)
+	scan("rejected scan")
+	got, ok = stored(a)
+	if !ok {
+		t.Fatal("a file the tools rejected got no row, so the backfill would retry it forever")
+	}
+	if got.sha != nil || got.chroma != nil || got.version != fingerprintVersion {
+		t.Fatalf("rejected file stored %+v, want both halves NULL at version %d", got, fingerprintVersion)
+	}
+}
@@ -0,0 +1,194 @@
+package library
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os/exec"
+	"slices"
+	"strings"
+	"testing"
+)
+
+func TestParseFpcalcRaw(t *testing.T) {
+	cases := []struct {
+		name    string
+		out     string
+		want    []int32
+		wantErr string
+	}{
+		{
+			name: "signed output with negatives",
+			out:  "DURATION=213\nFINGERPRINT=-1453821711,17,0,2147483647,-2147483648\n",
+			want: []int32{-1453821711, 17, 0, 2147483647, -2147483648},
+		},
+		{
+			name: "fingerprint line need not come second",
+			out:  "FINGERPRINT=5,6\nDURATION=1\n",
+			want: []int32{5, 6},
+		},
+		{
+			// fpcalc's default is uint32. This value only appears when -signed
+			// is missing, and storing it would need a reinterpretation nothing
+			// performs.
+			name:    "unsigned output is refused",
+			out:     "DURATION=213\nFINGERPRINT=2841145585,17\n",
+			wantErr: "item 0",
+		},
+		{name: "empty fingerprint", out: "DURATION=0\nFINGERPRINT=\n", wantErr: "empty fingerprint"},
+		{name: "no fingerprint line", out: "DURATION=213\n", wantErr: "no FINGERPRINT= line"},
+		{name: "non-numeric item", out: "FINGERPRINT=1,x,3\n", wantErr: "item 1"},
+		{name: "trailing comma", out: "FINGERPRINT=1,2,\n", wantErr: "item 2"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := parseFpcalcRaw([]byte(tc.out))
+			if tc.wantErr != "" {
+				if err == nil || !strings.Contains(err.Error(), tc.wantErr) {
+					t.Fatalf("err = %v, want one containing %q", err, tc.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected err: %v", err)
+			}
+			if !slices.Equal(got, tc.want) {
+				t.Fatalf("got %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestParseStreamHash(t *testing.T) {
+	// The real value ffmpeg printed for both files of the #3885 pair.
+	const www = "24e2daa3b4a534ff1a8d1a76f67810205869daf89f728d83a16625da4d28a18e"
+
+	got, err := parseStreamHash([]byte("SHA256=" + www + "\n"))
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if len(got) != 32 || got[0] != 0x24 || got[31] != 0x8e {
+		t.Fatalf("decoded %x, want %s", got, www)
+	}
+
+	for name, out := range map[string]string{
+		"no hash line":  "",
+		"other hash":    "MD5=" + www[:32] + "\n",
+		"not hex":       "SHA256=" + strings.Repeat("zz", 32) + "\n",
+		"short digest":  "SHA256=" + www[:62] + "\n",
+		"odd hex chars": "SHA256=" + www[:63] + "\n",
+	} {
+		if _, err := parseStreamHash([]byte(out)); err == nil {
+			t.Errorf("%s: parsed %q without error", name, out)
+		}
+	}
+}
+
+// followedBy reports whether flag appears in args immediately followed by value.
+func followedBy(args []string, flag, value string) bool {
+	for i := 0; i+1 < len(args); i++ {
+		if args[i] == flag && args[i+1] == value {
+			return true
+		}
+	}
+	return false
+}
+
+// The exact tier's stored hashes must stay comparable across ffmpeg upgrades,
+// which only holds while the packets are copied rather than decoded. A decoded
+// hash still matches within one ffmpeg build, so nothing else would notice the
+// change until an image upgrade silently broke every stored value.
+func TestStreamHashArgs_HashPacketsNotSamples(t *testing.T) {
+	args := streamHashArgs("/music/a.mp3")
+	for _, pair := range [][2]string{
+		{"-c:a", "copy"}, // no decode
+		{"-map", "0:a"},  // audio only: cover art stays out of the hash
+		{"-f", "hash"},   // the hash muxer, not a file
+		{"-hash", "sha256"},
+		{"-i", "/music/a.mp3"},
+	} {
+		if !followedBy(args, pair[0], pair[1]) {
+			t.Errorf("streamHashArgs lacks %s %s: %v", pair[0], pair[1], args)
+		}
+	}
+}
+
+func TestFpcalcArgs_RequestSignedRawOutput(t *testing.T) {
+	args := fpcalcArgs("/music/a.flac", 90)
+	for _, flag := range []string{"-raw", "-signed"} {
+		if !slices.Contains(args, flag) {
+			t.Errorf("fpcalcArgs lacks %s: %v", flag, args)
+		}
+	}
+	if !followedBy(args, "-length", "90") {
+		t.Errorf("fpcalcArgs does not pass the requested length: %v", args)
+	}
+	// fpcalc takes the file as its trailing positional argument.
+	if args[len(args)-1] != "/music/a.flac" {
+		t.Errorf("path is not last: %v", args)
+	}
+}
+
+func TestStderrTail_KeepsTheCauseNotTheBanner(t *testing.T) {
+	banner := bytes.Repeat([]byte("warning: skipping frame\n"), fpcalcStderrTail)
+	got := stderrTail(append(banner, []byte("ERROR: could not decode\n")...))
+	if len(got) != fpcalcStderrTail {
+		t.Fatalf("tail is %d bytes, want the %d-byte cap", len(got), fpcalcStderrTail)
+	}
+	if !bytes.HasSuffix(got, []byte("ERROR: could not decode")) {
+		t.Fatalf("tail dropped the final line: ...%q", got[len(got)-40:])
+	}
+
+	if got := stderrTail([]byte("  short  \n")); string(got) != "short" {
+		t.Fatalf("short stderr = %q, want it trimmed and whole", got)
+	}
+}
+
+// A stored failure is permanent until the file changes, so the classification
+// decides whether a track is ever retried. Every inconclusive case here would,
+// if misfiled as a verdict, silently exclude that track from duplicate
+// detection for good.
+func TestIsInconclusive(t *testing.T) {
+	notInstalled := fmt.Errorf("fpcalc: %w", &exec.Error{Name: "fpcalc", Err: exec.ErrNotFound})
+	cases := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{"timeout", fmt.Errorf("fpcalc: no result: %w", errFingerprintTimeout), true},
+		{"scan cancelled", fmt.Errorf("ffmpeg: %w", context.Canceled), true},
+		{"caller deadline", fmt.Errorf("ffmpeg: %w", context.DeadlineExceeded), true},
+		{"tool not installed", notInstalled, true},
+		{"tool rejected the file", errors.New("fpcalc exited 2: could not decode"), false},
+		{"unparseable output", errors.New("fpcalc printed no FINGERPRINT= line"), false},
+		{"success", nil, false},
+	}
+	for _, tc := range cases {
+		if got := isInconclusive(tc.err); got != tc.want {
+			t.Errorf("%s: isInconclusive = %v, want %v", tc.name, got, tc.want)
+		}
+	}
+}
+
+// Either half being inconclusive taints the whole result: storing the half that
+// succeeded would stamp the row at the current version with the other half
+// NULL, and that NULL would then read as a verdict.
+func TestFingerprintResult_InconclusiveIfEitherHalfIs(t *testing.T) {
+	stall := fmt.Errorf("fpcalc: %w", errFingerprintTimeout)
+	rejected := errors.New("fpcalc exited 2")
+	for name, tc := range map[string]struct {
+		r    fingerprintResult
+		want bool
+	}{
+		"both succeeded":            {fingerprintResult{streamSHA256: []byte{1}, chromaprint: []int32{1}}, false},
+		"hash ok, print stalled":    {fingerprintResult{streamSHA256: []byte{1}, printErr: stall}, true},
+		"hash stalled, print ok":    {fingerprintResult{hashErr: stall, chromaprint: []int32{1}}, true},
+		"hash ok, print rejected":   {fingerprintResult{streamSHA256: []byte{1}, printErr: rejected}, false},
+		"both rejected by the file": {fingerprintResult{hashErr: rejected, printErr: rejected}, false},
+	} {
+		if got := tc.r.inconclusive(); got != tc.want {
+			t.Errorf("%s: inconclusive = %v, want %v", name, got, tc.want)
+		}
+	}
+}
@@ -75,10 +75,15 @@ type Scanner struct {
 	pool   *pgxpool.Pool
 	logger *slog.Logger
 	paths  []string
+	// fingerprint derives a file's acoustic identity (M400). A field so an
+	// integration test can substitute a deterministic one: CI has no real audio
+	// to fingerprint, and what the test pins is WHEN the scan fingerprints, not
+	// what the tools print. Call it through fingerprintFile.
+	fingerprint func(ctx context.Context, path string) fingerprintResult
 }

 func New(pool *pgxpool.Pool, logger *slog.Logger, paths []string) *Scanner {
-	return &Scanner{pool: pool, logger: logger, paths: paths}
+	return &Scanner{pool: pool, logger: logger, paths: paths, fingerprint: computeFingerprint}
 }

 // Scan walks every configured root and upserts any audio file whose mtime is
@@ -295,6 +300,25 @@ func (s *Scanner) scanFile(
 		durationMs = probed
 	}

+	// Fingerprint only bytes this row has not seen: a new path, or a file whose
+	// mtime moved past the row's. An unchanged file re-read for a tag repair
+	// keeps its stored fingerprint, for the same reason it keeps its duration
+	// above — a tagReadVersion bump must stay bound by tag reads, not become a
+	// decode of the whole library.
+	//
+	// An unchanged file with NO fingerprint yet is the backfill's job (#3908),
+	// deliberately not the scan's. Folding it into the skip check would make
+	// the first scan after an upgrade re-decode every track and push a sync
+	// change to every client for each one.
+	//
+	// Computed before move adoption so adoption can match on the audio hash
+	// (#3914); stored after the upsert, once the row id is known.
+	var fp fingerprintResult
+	fingerprinted := !unchanged
+	if fingerprinted {
+		fp = s.fingerprintFile(ctx, path)
+	}
+
 	// A path we've never seen might not be a new track — it might be one that
 	// moved or was renamed (#2528). Adopting re-points the existing row at this
 	// path and clears its missing mark, so the UpsertTrack below conflicts on
@@ -359,6 +383,9 @@ func (s *Scanner) scanFile(
 		// touches this track will re-emit the change.
 		s.logger.Warn("library scan: LogChange track upsert failed", "track_id", track.ID, "err", err)
 	}
+	if fingerprinted {
+		s.storeFingerprint(ctx, q, track.ID, path, fp)
+	}

 	if knownTrack {
 		stats.Updated++
@@ -35,6 +35,9 @@ var (
 // config changes in lidarrconfig take effect immediately. clientFn returns
 // nil when Lidarr is disabled.
 type Service struct {
+	// dataDir lets a Delete file that empties an artist clear that artist's
+	// cached art, the same as the admin remove-track path.
+	dataDir   string
 	pool      *pgxpool.Pool
 	lidarrCfg *lidarrconfig.Service
 	clientFn  func() *lidarr.Client
@@ -42,11 +45,11 @@ type Service struct {

 // NewService constructs a Service. Pass nil for clientFn to disable the
 // Lidarr-using methods (DeleteViaLidarr will return ErrLidarrDisabled).
-func NewService(pool *pgxpool.Pool, cfg *lidarrconfig.Service, clientFn func() *lidarr.Client) *Service {
+func NewService(pool *pgxpool.Pool, cfg *lidarrconfig.Service, clientFn func() *lidarr.Client, dataDir string) *Service {
 	if clientFn == nil {
 		clientFn = func() *lidarr.Client { return nil }
 	}
-	return &Service{pool: pool, lidarrCfg: cfg, clientFn: clientFn}
+	return &Service{pool: pool, lidarrCfg: cfg, clientFn: clientFn, dataDir: dataDir}
 }

 // Flag inserts or updates a quarantine row for the caller. Re-flagging
@@ -245,10 +248,13 @@ func (s *Service) snapshot(ctx context.Context, q *dbq.Queries, track dbq.Track)
 	}, nil
 }

-// DeleteFile removes the track file from disk and the tracks row, then
-// (via FK ON DELETE CASCADE) clears all per-user quarantine rows for that
-// track and writes an audit row. If the file deletion fails, the per-user
-// rows stay so admin can retry. No partial state.
+// DeleteFile removes the track file from disk and the tracks row (tidying away
+// an album or artist that leaves empty), then — via FK ON DELETE CASCADE —
+// clears every per-user quarantine row for that track and writes an audit row.
+//
+// If the file cannot be removed, nothing is deleted and the per-user rows stay
+// so the admin can retry: the error wraps a *library.FileRemoveError, which the
+// handler turns into an answer naming the cause (#3918). No partial state.
 func (s *Service) DeleteFile(ctx context.Context, trackID, adminID pgtype.UUID) (dbq.LidarrQuarantineAction, error) {
 	q := dbq.New(s.pool)
 	track, err := q.GetTrackByID(ctx, trackID)
@@ -267,7 +273,7 @@ func (s *Service) DeleteFile(ctx context.Context, trackID, adminID pgtype.UUID)
 	if err != nil {
 		return dbq.LidarrQuarantineAction{}, fmt.Errorf("count: %w", err)
 	}
-	if err := library.DeleteTrackFile(ctx, s.pool, trackID); err != nil {
+	if _, err := library.DeleteTrackFile(ctx, s.pool, nil, s.dataDir, trackID); err != nil {
 		return dbq.LidarrQuarantineAction{}, fmt.Errorf("delete file: %w", err)
 	}
 	// tracks row is gone; ON DELETE CASCADE on lidarr_quarantine.track_id
@@ -87,7 +87,7 @@ func TestFlag_HappyPath(t *testing.T) {
 	user := seedUser(t, pool, "alice")
 	track, _, _ := seedTrack(t, pool, "Bad Track", "abc")

-	svc := NewService(pool, lidarrconfig.New(pool), nil)
+	svc := NewService(pool, lidarrconfig.New(pool), nil, "")
 	row, err := svc.Flag(context.Background(), user.ID, track.ID, "bad_rip", "crackly")
 	if err != nil {
 		t.Fatalf("Flag: %v", err)
@@ -105,7 +105,7 @@ func TestFlag_UpsertOnSecondFlag(t *testing.T) {
 	user := seedUser(t, pool, "alice")
 	track, _, _ := seedTrack(t, pool, "T", "x")

-	svc := NewService(pool, lidarrconfig.New(pool), nil)
+	svc := NewService(pool, lidarrconfig.New(pool), nil, "")
 	if _, err := svc.Flag(context.Background(), user.ID, track.ID, "bad_rip", "first"); err != nil {
 		t.Fatalf("first flag: %v", err)
 	}
@@ -129,7 +129,7 @@ func TestFlag_NonexistentTrackReturnsErrTrackNotFound(t *testing.T) {
 	bogus.Bytes = [16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
 	bogus.Valid = true

-	svc := NewService(pool, lidarrconfig.New(pool), nil)
+	svc := NewService(pool, lidarrconfig.New(pool), nil, "")
 	_, err := svc.Flag(context.Background(), user.ID, bogus, "bad_rip", "")
 	if !errors.Is(err, ErrTrackNotFound) {
 		t.Errorf("err = %v, want ErrTrackNotFound", err)
@@ -141,7 +141,7 @@ func TestFlag_BadReasonRejected(t *testing.T) {
 	user := seedUser(t, pool, "alice")
 	track, _, _ := seedTrack(t, pool, "T", "x")

-	svc := NewService(pool, lidarrconfig.New(pool), nil)
+	svc := NewService(pool, lidarrconfig.New(pool), nil, "")
 	_, err := svc.Flag(context.Background(), user.ID, track.ID, "garbage", "")
 	if !errors.Is(err, ErrBadReason) {
 		t.Errorf("err = %v, want ErrBadReason", err)
@@ -153,7 +153,7 @@ func TestUnflag_DeletesRow(t *testing.T) {
 	user := seedUser(t, pool, "alice")
 	track, _, _ := seedTrack(t, pool, "T", "x")

-	svc := NewService(pool, lidarrconfig.New(pool), nil)
+	svc := NewService(pool, lidarrconfig.New(pool), nil, "")
 	if _, err := svc.Flag(context.Background(), user.ID, track.ID, "bad_rip", ""); err != nil {
 		t.Fatalf("Flag: %v", err)
 	}
@@ -171,7 +171,7 @@ func TestListMine_OrderedNewestFirst(t *testing.T) {
 	t1, _, _ := seedTrack(t, pool, "T1", "x")
 	t2, _, _ := seedTrack(t, pool, "T2", "y")

-	svc := NewService(pool, lidarrconfig.New(pool), nil)
+	svc := NewService(pool, lidarrconfig.New(pool), nil, "")
 	if _, err := svc.Flag(context.Background(), user.ID, t1.ID, "bad_rip", ""); err != nil {
 		t.Fatalf("Flag t1: %v", err)
 	}
@@ -199,7 +199,7 @@ func TestListAdminQueue_AggregatesByTrackWithReasonCounts(t *testing.T) {
 	carol := seedUser(t, pool, "carol")
 	track, _, _ := seedTrack(t, pool, "Hot Mess", "abc")

-	svc := NewService(pool, lidarrconfig.New(pool), nil)
+	svc := NewService(pool, lidarrconfig.New(pool), nil, "")
 	if _, err := svc.Flag(context.Background(), alice.ID, track.ID, "bad_rip", ""); err != nil {
 		t.Fatalf("alice flag: %v", err)
 	}
@@ -235,7 +235,7 @@ func TestResolve_ClearsRowsAndWritesAudit(t *testing.T) {
 	bob := seedUser(t, pool, "bob")
 	track, _, _ := seedTrack(t, pool, "T", "x")

-	svc := NewService(pool, lidarrconfig.New(pool), nil)
+	svc := NewService(pool, lidarrconfig.New(pool), nil, "")
 	if _, err := svc.Flag(context.Background(), alice.ID, track.ID, "bad_rip", ""); err != nil {
 		t.Fatalf("alice flag: %v", err)
 	}
@@ -267,7 +267,7 @@ func TestResolve_NoExistingRowsStillWritesAudit(t *testing.T) {
 	user := seedUser(t, pool, "alice")
 	track, _, _ := seedTrack(t, pool, "T", "x")

-	svc := NewService(pool, lidarrconfig.New(pool), nil)
+	svc := NewService(pool, lidarrconfig.New(pool), nil, "")
 	// No flags applied — resolve a track with zero quarantine rows.
 	audit, err := svc.Resolve(context.Background(), track.ID, user.ID)
 	if err != nil {
@@ -291,7 +291,7 @@ func TestResolve_TrackNotFound(t *testing.T) {
 	bogus.Bytes = [16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
 	bogus.Valid = true

-	svc := NewService(pool, lidarrconfig.New(pool), nil)
+	svc := NewService(pool, lidarrconfig.New(pool), nil, "")
 	_, err := svc.Resolve(context.Background(), bogus, user.ID)
 	if !errors.Is(err, ErrTrackNotFound) {
 		t.Errorf("err = %v, want ErrTrackNotFound", err)
@@ -315,7 +315,7 @@ func TestDeleteFile_RemovesFileAndAuditsAffected(t *testing.T) {
 		DurationMs: 1000, FilePath: path, FileSize: 1, FileFormat: "mp3",
 	})

-	svc := NewService(pool, lidarrconfig.New(pool), nil)
+	svc := NewService(pool, lidarrconfig.New(pool), nil, "")
 	if _, err := svc.Flag(context.Background(), user.ID, track.ID, "bad_rip", ""); err != nil {
 		t.Fatalf("Flag: %v", err)
 	}
@@ -366,7 +366,7 @@ func TestDeleteViaLidarr_FullCascade(t *testing.T) {
 		t.Fatalf("save config: %v", err)
 	}
 	clientFn := func() *lidarr.Client { return lidarr.NewClient(stub.URL, "k") }
-	svc := NewService(pool, cfg, clientFn)
+	svc := NewService(pool, cfg, clientFn, "")

 	q := dbq.New(pool)
 	artist, _ := q.UpsertArtist(context.Background(), dbq.UpsertArtistParams{Name: "A", SortName: "A"})
@@ -424,7 +424,7 @@ func TestDeleteViaLidarr_LidarrDisabled(t *testing.T) {
 	user := seedUser(t, pool, "alice")
 	track, _, _ := seedTrack(t, pool, "T", "x")

-	svc := NewService(pool, lidarrconfig.New(pool), nil)
+	svc := NewService(pool, lidarrconfig.New(pool), nil, "")
 	_, _, err := svc.DeleteViaLidarr(context.Background(), track.ID, user.ID)
 	if !errors.Is(err, ErrLidarrDisabled) {
 		t.Errorf("err = %v, want ErrLidarrDisabled", err)
@@ -456,7 +456,7 @@ func TestDeleteViaLidarr_AlbumMBIDMissing(t *testing.T) {
 	cfg := lidarrconfig.New(pool)
 	_ = cfg.Save(context.Background(), lidarrconfig.Config{Enabled: true, BaseURL: stub.URL, APIKey: "k"})
 	clientFn := func() *lidarr.Client { return lidarr.NewClient(stub.URL, "k") }
-	svc := NewService(pool, cfg, clientFn)
+	svc := NewService(pool, cfg, clientFn, "")
 	_, _ = svc.Flag(context.Background(), user.ID, track.ID, "bad_rip", "")

 	_, _, err := svc.DeleteViaLidarr(context.Background(), track.ID, user.ID)
@@ -481,7 +481,7 @@ func TestDeleteViaLidarr_LidarrAlbumNotFound(t *testing.T) {
 	cfg := lidarrconfig.New(pool)
 	_ = cfg.Save(context.Background(), lidarrconfig.Config{Enabled: true, BaseURL: stub.URL, APIKey: "k"})
 	clientFn := func() *lidarr.Client { return lidarr.NewClient(stub.URL, "k") }
-	svc := NewService(pool, cfg, clientFn)
+	svc := NewService(pool, cfg, clientFn, "")

 	track, _, _ := seedTrack(t, pool, "T", "x")
 	_, _ = svc.Flag(context.Background(), user.ID, track.ID, "bad_rip", "")
@@ -499,7 +499,7 @@ func TestDeleteFile_TrackNotFound(t *testing.T) {
 	bogus.Bytes = [16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
 	bogus.Valid = true

-	svc := NewService(pool, lidarrconfig.New(pool), nil)
+	svc := NewService(pool, lidarrconfig.New(pool), nil, "")
 	_, err := svc.DeleteFile(context.Background(), bogus, user.ID)
 	if !errors.Is(err, ErrTrackNotFound) {
 		t.Errorf("err = %v, want ErrTrackNotFound", err)
@@ -521,7 +521,7 @@ func TestDeleteViaLidarr_TrackNotFound(t *testing.T) {
 		t.Fatalf("save config: %v", err)
 	}
 	clientFn := func() *lidarr.Client { return lidarr.NewClient(stub.URL, "k") }
-	svc := NewService(pool, cfg, clientFn)
+	svc := NewService(pool, cfg, clientFn, "")

 	var bogus pgtype.UUID
 	bogus.Bytes = [16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
@@ -219,7 +219,30 @@ var (
 		// uniform with radio pending trend data.
 		ContextTimeWeight: 1.0,
 	}
+	// Songs-like's own profile (#3881). Pre-push literal only; shipped
+	// defaults live in recsettings.ShippedSongsLikeWeights and must stay in
+	// sync with it, exactly as systemMixWeights does above.
+	//
+	// SimilarityWeight dominates here and every seed-INDEPENDENT term is
+	// demoted, which is the whole difference between this surface and For-You.
+	// See ShippedSongsLikeWeights for the property the numbers encode.
+	songsLikeWeights = recommendation.ScoringWeights{
+		BaseWeight:        1.0,
+		LikeBoost:         0.5,
+		RecencyWeight:     0.25,
+		SkipPenalty:       2.0,
+		JitterMagnitude:   0.05,
+		ContextWeight:     0.5,
+		SimilarityWeight:  4.0,
+		TasteWeight:       0.25,
+		ContextTimeWeight: 0.5,
+	}
 	systemTasteConfig = taste.DefaultConfig()
+
+	// Sizes the candidate pool to the library (#3880). Cached because the
+	// count is a full table scan and the daily build runs it once per user;
+	// within the TTL every user in a build shares one count.
+	systemLibrarySize = recommendation.NewLibrarySize(nil)
 )

 // SetSystemMixWeights installs the current daily_mix scoring weights.
@@ -230,6 +253,20 @@ func SetSystemMixWeights(w recommendation.ScoringWeights) {
 	systemMixWeights = w
 }

+// SetSongsLikeWeights installs the songs_like scoring profile (#3881).
+// Same push model as SetSystemMixWeights — recsettings calls it on boot and
+// after every knob turn, so a tuning change takes effect on the next daily
+// build with no restart.
+//
+// Separate from systemMixWeights because Songs-like and For-You want opposite
+// things: For-You roams, Songs-like must not. Sharing one profile is what made
+// "Songs like X" wander.
+func SetSongsLikeWeights(w recommendation.ScoringWeights) {
+	systemTuningMu.Lock()
+	defer systemTuningMu.Unlock()
+	songsLikeWeights = w
+}
+
 // SetTasteConfig installs the taste-profile build configuration
 // (half-life + engagement curve, #1250). Same push model as
 // SetSystemMixWeights.
@@ -239,6 +276,23 @@ func SetTasteConfig(c taste.Config) {
 	systemTasteConfig = c
 }

+// dailyOrderSeed is the value the randomised candidate arms order by (#3889).
+//
+// Per (user, day) so a same-day rebuild draws the SAME set — which is what
+// TestBuildSystemPlaylists_DailyNonceDeterminism asserts and what those arms
+// only ever achieved by accident before, when their limits happened to exceed
+// the eligible rows. It changes on the day boundary, so the mixes still move
+// daily.
+func dailyOrderSeed(userID pgtype.UUID, dateStr string) string {
+	return uuidStringPL(userID) + ":" + dateStr
+}
+
+func currentSongsLikeWeights() recommendation.ScoringWeights {
+	systemTuningMu.RLock()
+	defer systemTuningMu.RUnlock()
+	return songsLikeWeights
+}
+
 func currentSystemMixWeights() recommendation.ScoringWeights {
 	systemTuningMu.RLock()
 	defer systemTuningMu.RUnlock()
@@ -392,7 +446,13 @@ func pickWeightedTail(tailPool []recommendation.Candidate, dateStr string, tailN
 // tieBreakHash). The scoring RNG is seeded by userIDHash so jitter is
 // deterministic per (user, day) but rotates across days. Pure — no
 // truncation, no cap.
-func scoreAndSortCandidates(cands []recommendation.Candidate, userID pgtype.UUID, dateStr string, now time.Time) []recommendation.Candidate {
+// weights is a parameter rather than a read of currentSystemMixWeights()
+// because this sort IS the selection: the caller caps and truncates in the
+// order this returns, so whatever profile ranks here decides which tracks
+// reach the playlist. Scoring with daily_mix here and re-scoring with
+// songs_like afterwards would have let the new profile relabel tracks it had
+// no part in choosing — inert where it matters (#3881).
+func scoreAndSortCandidates(cands []recommendation.Candidate, userID pgtype.UUID, dateStr string, now time.Time, weights recommendation.ScoringWeights) []recommendation.Candidate {
 	rng := rand.New(rand.NewSource(int64(userIDHash(userID, dateStr))))
 	type scored struct {
 		c     recommendation.Candidate
@@ -411,7 +471,6 @@ func scoreAndSortCandidates(cands []recommendation.Candidate, userID pgtype.UUID
 	sort.SliceStable(ordered, func(i, j int) bool {
 		return uuidLessPL(ordered[i].Track.ID, ordered[j].Track.ID)
 	})
-	weights := currentSystemMixWeights()
 	pairs := make([]scored, len(ordered))
 	for i, c := range ordered {
 		pairs[i] = scored{c: c, score: recommendation.Score(c.Inputs, weights, now, rng.Float64)}
@@ -581,6 +640,7 @@ func produceForYou(
 			zeroVec,
 			seeds,
 			systemForYouSourceLimits(),
+			dailyOrderSeed(userID, dateStr),
 		)
 		if cerr != nil {
 			logger.Warn("system playlist: for-you candidates load failed for seed; continuing",
@@ -632,6 +692,13 @@ func produceSeedMixes(
 	seedPool := pickSeedArtistsFromRows(seedRowsLocal)
 	seeds := pickSeedArtistsForDay(seedPool, userID, dateStr)

+	// Once per build rather than once per seed artist — six mixes would
+	// otherwise mean six full-table counts for a number that cannot have
+	// changed between them.
+	librarySize := systemLibrarySize.Get(ctx, func(c context.Context) (int64, error) {
+		return recommendation.CountLibraryTracks(c, q)
+	})
+
 	out := make([]builtPlaylist, 0, len(seeds))
 	for _, artistID := range seeds {
 		artistRow, aerr := q.GetArtistByID(ctx, artistID)
@@ -647,23 +714,47 @@ func produceSeedMixes(
 			continue
 		}
 		zeroVec := recommendation.SessionVector{Seed: true}
+		// Songs-like's own pool shape, not the default (#3881). Same total
+		// size; the composition shifts toward arms that actually measure
+		// distance from the seed. The default gave ~29% of candidates a
+		// sim_score of literally 0.
+		//
+		// Then scaled to the library (#3880): a bigger collection should put
+		// more genuinely-similar candidates in reach, not the same ~170
+		// regardless. The weights still rank sim_score-0 arms last, so the
+		// growth reaches coherence rather than working against it.
 		cands, cerr := recommendation.LoadCandidatesFromSimilarity(
 			ctx, q, userID, seedTrack, 1, zeroVec, []pgtype.UUID{seedTrack},
-			recommendation.DefaultCandidateSourceLimits(),
+			recommendation.ScaleForLibrary(
+				recommendation.SongsLikeCandidateSourceLimits(), librarySize,
+			),
+			dailyOrderSeed(userID, dateStr),
 		)
 		if cerr != nil {
 			logger.Warn("system playlist: seed candidates load failed; skipping",
 				"artist_id", uuidStringPL(artistID), "err", cerr)
 			continue
 		}
-		// "Songs like X" excludes X's own songs.
-		filtered := make([]recommendation.Candidate, 0, len(cands))
-		for _, c := range cands {
-			if !pgtypeUUIDEqual(c.Track.ArtistID, artistID) {
-				filtered = append(filtered, c)
-			}
-		}
-		tracks := pickTopN(filtered, userID, dateStr, now, systemMixLength)
+		// The seed artist's own songs are ELIGIBLE here, deliberately.
+		//
+		// This used to filter them out — "Songs like X excludes X's own
+		// songs" — which reads as obviously right and is not. The seed is a
+		// TRACK, and the tracks most likely to sound like it are usually the
+		// rest of that artist's catalogue; excluding them threw away the
+		// nearest neighbours of the very thing the mix is built around, and
+		// then reached further out to replace them. On a surface whose whole
+		// job is staying in one neighbourhood, that is backwards.
+		//
+		// Operator, 2026-09-10: "it should also be able to include music from
+		// the same artist."
+		//
+		// Domination is bounded by the cap rather than by exclusion, which is
+		// the distinction that makes this safe: capCandidatesByAlbumAndArtist
+		// inside pickTopN allows at most discoverMaxTracksPerArtist (3) of a
+		// 25-track mix — 12%, a presence rather than a takeover. The seed
+		// track itself still cannot appear; it is passed as an exclusion to
+		// LoadCandidatesFromSimilarity above.
+		tracks := pickTopN(cands, userID, dateStr, now, systemMixLength)
 		if len(tracks) == 0 {
 			continue
 		}
@@ -838,13 +929,20 @@ func BuildSystemPlaylists(ctx context.Context, pool *pgxpool.Pool, logger *slog.
 // truncates to n. Used by Songs-like-X (and as the fallback inside
 // pickHeadAndTail for small pools).
 func pickTopN(cands []recommendation.Candidate, userID pgtype.UUID, dateStr string, now time.Time, n int) []rankedCandidate {
-	sorted := scoreAndSortCandidates(cands, userID, dateStr, now)
+	// songs_like, not daily_mix (#3881). produceSeedMixes is this function's
+	// only caller, so the switch moves exactly one surface — For-You ranks
+	// through pickHeadAndTail and keeps the broader daily_mix profile.
+	//
+	// The SAME profile does the selection sort and the final score. Passing
+	// one and using the other is the subtle version of this bug: the playlist
+	// would still be chosen by daily_mix and merely wear songs_like numbers.
+	weights := currentSongsLikeWeights()
+	sorted := scoreAndSortCandidates(cands, userID, dateStr, now, weights)
 	capped := capCandidatesByAlbumAndArtist(sorted)
 	if len(capped) > n {
 		capped = capped[:n]
 	}
 	rng := rand.New(rand.NewSource(int64(userIDHash(userID, dateStr))))
-	weights := currentSystemMixWeights()
 	out := make([]rankedCandidate, len(capped))
 	for i, c := range capped {
 		out[i] = rankedCandidate{
@@ -873,10 +971,11 @@ func pickHeadAndTail(
 	cands []recommendation.Candidate, seedOf map[pgtype.UUID]int, numSeeds int,
 	userID pgtype.UUID, dateStr string, now time.Time, headN, tailN int,
 ) []rankedCandidate {
-	sorted := scoreAndSortCandidates(cands, userID, dateStr, now)
+	// daily_mix — For-You is the broad surface and keeps the roaming profile.
+	weights := currentSystemMixWeights()
+	sorted := scoreAndSortCandidates(cands, userID, dateStr, now, weights)
 	capped := capCandidatesByAlbumAndArtist(sorted)
 	rng := rand.New(rand.NewSource(int64(userIDHash(userID, dateStr))))
-	weights := currentSystemMixWeights()

 	total := headN + tailN
 	if len(capped) <= total {
@@ -2,8 +2,10 @@ package playlists_test

 import (
 	"context"
+	"fmt"
 	"io"
 	"log/slog"
+	"path/filepath"
 	"sync"
 	"testing"
 	"time"
@@ -287,6 +289,141 @@ func TestBuildSystemPlaylists_Concurrency(t *testing.T) {
 	}
 }

+// seedSharedArtistLibrary seeds artists that genuinely OWN several tracks.
+//
+// seedActiveLibrary cannot be used for this: its helper documents that
+// "artist and album are not deduplicated across calls (mbid-less upsert)",
+// so every track gets its own artist row and a seed artist always has
+// exactly one track — the seed itself, which is excluded. A same-artist
+// assertion against that fixture can never pass no matter what the code
+// does, which is how the first version of this test failed.
+//
+// Albums are not deduplicated either, for the same mbid-less reason, so each
+// track ends up under its own album row however the titles are written. That
+// is convenient here rather than a problem: it means the per-ALBUM cap (2)
+// never binds, and the per-ARTIST cap (3) is unambiguously the thing under
+// test. Do not "fix" the album titles into something shared without checking
+// which cap you are then measuring.
+func seedSharedArtistLibrary(
+	t *testing.T, pool *pgxpool.Pool, name string, numArtists, tracksPerArtist int,
+) (dbq.User, []pgtype.UUID) {
+	t.Helper()
+	q := dbq.New(pool)
+	ctx := context.Background()
+	u := seedUser(t, pool, name)
+	now := time.Now().UTC()
+	dir := t.TempDir()
+
+	artistIDs := make([]pgtype.UUID, 0, numArtists)
+	for a := 0; a < numArtists; a++ {
+		artistName := name + "-shared-" + string(rune('A'+a))
+		ar, err := q.UpsertArtist(ctx, dbq.UpsertArtistParams{Name: artistName, SortName: artistName})
+		if err != nil {
+			t.Fatalf("seed artist: %v", err)
+		}
+		artistIDs = append(artistIDs, ar.ID)
+
+		for k := 0; k < tracksPerArtist; k++ {
+			albumTitle := fmt.Sprintf("%s - Album %d", artistName, k/2)
+			al, err := q.UpsertAlbum(ctx, dbq.UpsertAlbumParams{
+				Title: albumTitle, SortTitle: albumTitle, ArtistID: ar.ID,
+			})
+			if err != nil {
+				t.Fatalf("seed album: %v", err)
+			}
+			tk, err := q.UpsertTrack(ctx, dbq.UpsertTrackParams{
+				Title: fmt.Sprintf("%s-t%d", artistName, k), AlbumID: al.ID, ArtistID: ar.ID,
+				DurationMs: 1000,
+				FilePath:   filepath.Join(dir, fmt.Sprintf("%s-%d-%d.mp3", name, a, k)),
+				FileSize:   100, FileFormat: "mp3",
+			})
+			if err != nil {
+				t.Fatalf("seed track: %v", err)
+			}
+			// Well clear of the recently-played exclusion window, which uses
+			// the DATABASE clock rather than the build's `now`.
+			for pl := 0; pl < 3; pl++ {
+				seedPlayEvent(t, pool, u.ID, tk.ID,
+					now.Add(-time.Duration(24+a*10+k+pl)*time.Hour), false)
+			}
+		}
+	}
+	return u, artistIDs
+}
+
+// The seed artist's own tracks are ELIGIBLE for its "Songs like" mix, and are
+// bounded by the diversity cap rather than excluded outright (#3881).
+//
+// produceSeedMixes used to filter them out — "Songs like X excludes X's own
+// songs" — which threw away the nearest neighbours of the seed TRACK and then
+// reached further out to replace them. Operator, 2026-09-10: "it should also
+// be able to include music from the same artist."
+//
+// Asserted end-to-end rather than by reading the source, because the guard has
+// to survive the filter coming back in a different shape — and because an
+// absence check would now match the comment explaining why the filter is gone.
+func TestBuildSystemPlaylists_SongsLikeIncludesItsSeedArtist(t *testing.T) {
+	pool := newPool(t)
+	logger := discardLogger()
+	u, _ := seedSharedArtistLibrary(t, pool, "seedartist", 4, 6)
+	ctx := context.Background()
+	now := time.Date(2026, 5, 4, 12, 0, 0, 0, time.UTC)
+
+	if err := playlists.BuildSystemPlaylists(ctx, pool, logger, u.ID, now, t.TempDir()); err != nil {
+		t.Fatalf("build: %v", err)
+	}
+
+	rows, err := pool.Query(ctx, `
+		SELECT count(*) FILTER (WHERE t.artist_id = p.seed_artist_id) AS own,
+		       count(*)                                              AS total
+		  FROM playlists p
+		  JOIN playlist_tracks pt ON pt.playlist_id = p.id
+		  JOIN tracks t          ON t.id = pt.track_id
+		 WHERE p.user_id = $1 AND p.system_variant = 'songs_like_artist'
+		 GROUP BY p.id
+	`, u.ID)
+	if err != nil {
+		t.Fatalf("query: %v", err)
+	}
+	defer rows.Close()
+
+	// discoverMaxTracksPerArtist, which this package_test cannot reference.
+	// Duplicated deliberately: if the cap moves, this failing is the point.
+	const maxPerArtist = 3
+
+	mixes, withOwn := 0, 0
+	for rows.Next() {
+		var own, total int
+		if err := rows.Scan(&own, &total); err != nil {
+			t.Fatalf("scan: %v", err)
+		}
+		mixes++
+		if own > 0 {
+			withOwn++
+		}
+		// The bound is what makes inclusion safe. Without it, "include the
+		// seed artist" becomes "the mix is mostly the seed artist", which is
+		// the radio failure (#3882) arriving on a different surface.
+		if own > maxPerArtist {
+			t.Errorf("a songs_like mix carries %d tracks by its own seed artist "+
+				"out of %d; the per-artist cap (%d) is not being applied",
+				own, total, maxPerArtist)
+		}
+	}
+	if err := rows.Err(); err != nil {
+		t.Fatalf("rows: %v", err)
+	}
+
+	if mixes == 0 {
+		t.Fatal("no songs_like_artist mixes were built, so this test asserts nothing")
+	}
+	if withOwn == 0 {
+		t.Errorf("none of the %d songs_like mixes contains a single track by its own "+
+			"seed artist — the tracks most likely to sound like the seed are being "+
+			"excluded from the surface whose job is sounding like the seed", mixes)
+	}
+}
+
 func TestBuildSystemPlaylists_DailyNonceDeterminism(t *testing.T) {
 	pool := newPool(t)
 	logger := discardLogger()
@@ -102,6 +102,7 @@ func buildYouMightLike(
 	cands, err := recommendation.LoadCandidatesFromSimilarity(
 		ctx, q, userID, seed, 1, zeroVec,
 		[]pgtype.UUID{seed}, ymlLimits,
+		dailyOrderSeed(userID, dateStr),
 	)
 	if err != nil {
 		logger.Warn("you-might-like: candidate load failed; skipping",
@@ -105,11 +105,87 @@ func DefaultCandidateSourceLimits() CandidateSourceLimits {
 	}
 }

+// SongsLikeCandidateSourceLimits is the pool shape for "Songs like {X}"
+// (#3881). Same total size as the default (~170) — the composition is what
+// changes, shifted hard toward arms that actually measure distance from the
+// seed.
+//
+// The surface answers "what sounds like THIS", and it shared the default
+// pool with For-You, which answers the much broader "what will they enjoy
+// today". Under the default, 50 of ~170 candidates carried sim_score = 0 by
+// construction — `taste_overlap` (tracks by the user's top taste artists) and
+// `random_fill` (literally any track not already in the pool), both of which
+// are seed-INDEPENDENT. Nearly a third of the pool had no relationship to the
+// seed at all, and the operator saw it: "I was getting a seeming wide variety
+// of music from each one when I was hoping to stay in a certain neighborhood."
+//
+// TIERED, per rule 131 — a system mix degrades, it never vanishes:
+//
+//	tier 1  lb_similar      real track-level similarity. The exact promise.
+//	tier 2  similar_artist, tag_overlap, coplay, likes_overlap
+//	                        seed-RELATED but weaker signal.
+//	tier 3  taste_overlap, random_fill
+//	                        seed-independent. The floor, and nothing more.
+//
+// The tiering is enforced by SCORE rather than by a fallback ladder: tier-3
+// arms carry sim_score 0, so under SongsLike weights (SimilarityWeight 4.0,
+// everything seed-independent demoted) they rank below any real match and
+// surface only when tiers 1–2 cannot fill the mix. That is the rule's
+// "fill from tier 1 first, reach down only when a tier cannot fill".
+//
+// Which is exactly why tier 3 is REDUCED rather than removed. Zeroing those
+// two arms was the first instinct and it is the vanish-or-nothing shape rule
+// 131 exists to forbid: a seed whose artist has thin ListenBrainz coverage
+// would produce a short mix or none at all, and "no playlist" is a worse
+// answer than "a few tracks further from the seed than we would like".
+//
+// The seed-independent arms are trimmed hardest, because on this surface they
+// are noise: `taste_overlap` (tracks by the user's top taste artists) and
+// `random_fill` (any track not already in the pool) both carry
+// `0.0::float8 AS sim_score`, so nearly a third of the default pool had no
+// relationship to the seed at all.
+//
+// THESE TRIMS WERE BLOCKED UNTIL #3889. `likes_overlap` and `random_fill`
+// used to end in a bare `ORDER BY random()`, which made their output a stable
+// SET only while the limit exceeded the eligible rows — so SHRINKING them
+// changed pool membership between same-day rebuilds and broke daily
+// determinism. Those arms now order by md5(id || seed), so a smaller limit
+// takes a smaller but REPRODUCIBLE slice, and the trim is safe.
+//
+// Reduced, never removed. Rule 131: the two seed-independent arms are the
+// tier-3 floor, and zeroing them would leave a seed with thin ListenBrainz
+// coverage producing a short mix or none at all. The weights (SimilarityWeight
+// 4.0, everything seed-independent demoted) keep them ranked last, so they
+// surface only when the closer tiers cannot fill the mix.
+//
+// likes_overlap is cut hardest of the tier-2 arms for a specific reason: its
+// SQL assigns a FLAT 0.6 sim_score (recommendation.sql) rather than measuring
+// anything. It is a collaborative signal wearing similarity's clothes, and a
+// raised SimilarityWeight amplifies it — if real ListenBrainz scores commonly
+// land below 0.6 it would outrank genuine matches. Halved pending the
+// fill-rate measurement in #3879; the honest fix is to stop it claiming a
+// similarity score it never computed.
+func SongsLikeCandidateSourceLimits() CandidateSourceLimits {
+	return CandidateSourceLimits{
+		LBSimilar:     60, // tier 1 — doubled; the only arm that measures the seed
+		SimilarArtist: 40, // tier 2 — raised; growing is always safe
+		TagOverlap:    20, // tier 2
+		UserCoplay:    20, // tier 2
+		LikesOverlap:  10, // tier 2, halved — flat 0.6 sim_score, see above
+		TasteOverlap:  10, // tier 3 floor — halved, not removed
+		RandomFill:    10, // tier 3 floor — cut hard, never to zero
+	}
+}
+
 // LoadCandidatesFromSimilarity is M4c's primary candidate-pool loader.
 // 5-way SQL UNION (LB-similar / similar-artist tracks / MB-tag overlap /
 // likes-overlap / random fill) + dedup-by-max sim_score. Returns
 // []Candidate (same shape as LoadCandidates) so Shuffle is unchanged.
 //
+// orderSeed decides whether the randomised arms repeat their draw — see
+// Column12 below and #3889. Pass a stable per-(user, day) value where the
+// selection must be reproducible, and a varying one where it should not be.
+//
 // Caller (radio handler) falls back to LoadCandidates on error.
 func LoadCandidatesFromSimilarity(
 	ctx context.Context,
@@ -119,6 +195,7 @@ func LoadCandidatesFromSimilarity(
 	currentVector SessionVector,
 	exclude []pgtype.UUID,
 	limits CandidateSourceLimits,
+	orderSeed string,
 ) ([]Candidate, error) {
 	if exclude == nil {
 		exclude = []pgtype.UUID{}
@@ -135,6 +212,12 @@ func LoadCandidatesFromSimilarity(
 		Limit_5: int32(limits.RandomFill),
 		Limit_6: int32(limits.TasteOverlap),
 		Limit_7: int32(limits.UserCoplay),
+		// #3889. Four arms used to end in a bare ORDER BY random(), which made
+		// their output a stable SET only while the limit exceeded the eligible
+		// rows. They now order by md5(id || this), so the caller decides
+		// whether the draw repeats: a per-(user, day) seed for the system
+		// mixes that promise daily determinism, a fresh one per radio request.
+		Column12: orderSeed,
 	})
 	if err != nil {
 		return nil, err
@@ -2,6 +2,10 @@ package recommendation

 import (
 	"context"
+	"fmt"
+	"reflect"
+	"sort"
+	"strings"
 	"testing"

 	"github.com/jackc/pgx/v5/pgtype"
@@ -50,7 +54,7 @@ func TestLoadCandidatesFromSimilarity_LBSimilarSourceContributes(t *testing.T) {
 	target := f.tracks[1]
 	helperLBSimilarity(t, f, seed.ID, target.ID, 0.85)
 	got, err := LoadCandidatesFromSimilarity(
-		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(),
+		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(), "test-seed",
 	)
 	if err != nil {
 		t.Fatalf("load: %v", err)
@@ -82,7 +86,7 @@ func TestLoadCandidatesFromSimilarity_SimilarArtistTracksContribute(t *testing.T
 	})
 	helperArtistSimilarity(t, f, seed.ArtistID, otherArtist.ID, 0.8)
 	got, err := LoadCandidatesFromSimilarity(
-		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(),
+		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(), "test-seed",
 	)
 	if err != nil {
 		t.Fatalf("load: %v", err)
@@ -106,7 +110,7 @@ func TestLoadCandidatesFromSimilarity_TagOverlapContributes(t *testing.T) {
 	helperSetTrackGenre(t, f, seed.ID, "Rock; Pop")
 	helperSetTrackGenre(t, f, target.ID, "Rock")
 	got, err := LoadCandidatesFromSimilarity(
-		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(),
+		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(), "test-seed",
 	)
 	if err != nil {
 		t.Fatalf("load: %v", err)
@@ -133,7 +137,7 @@ func TestLoadCandidatesFromSimilarity_LikesOverlapContributes(t *testing.T) {
 		t.Fatalf("like: %v", err)
 	}
 	got, err := LoadCandidatesFromSimilarity(
-		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(),
+		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(), "test-seed",
 	)
 	if err != nil {
 		t.Fatalf("load: %v", err)
@@ -155,7 +159,7 @@ func TestLoadCandidatesFromSimilarity_RandomFillReturnsTracks(t *testing.T) {
 	f := newFixture(t, 10) // 10 tracks; no similarity data
 	seed := f.tracks[0]
 	got, err := LoadCandidatesFromSimilarity(
-		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(),
+		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(), "test-seed",
 	)
 	if err != nil {
 		t.Fatalf("load: %v", err)
@@ -176,7 +180,7 @@ func TestLoadCandidatesFromSimilarity_ExcludeListRespected(t *testing.T) {
 	excluded := f.tracks[1].ID
 	got, err := LoadCandidatesFromSimilarity(
 		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true},
-		[]pgtype.UUID{excluded}, defaultLimits(),
+		[]pgtype.UUID{excluded}, defaultLimits(), "test-seed",
 	)
 	if err != nil {
 		t.Fatalf("load: %v", err)
@@ -192,7 +196,7 @@ func TestLoadCandidatesFromSimilarity_SeedAlwaysExcluded(t *testing.T) {
 	f := newFixture(t, 5)
 	seed := f.tracks[0]
 	got, err := LoadCandidatesFromSimilarity(
-		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(),
+		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(), "test-seed",
 	)
 	if err != nil {
 		t.Fatalf("load: %v", err)
@@ -222,7 +226,7 @@ func TestLoadCandidatesFromSimilarity_RecentlyPlayedExcluded(t *testing.T) {
 		t.Fatalf("play_event: %v", err)
 	}
 	got, err := LoadCandidatesFromSimilarity(
-		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(),
+		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(), "test-seed",
 	)
 	if err != nil {
 		t.Fatalf("load: %v", err)
@@ -242,7 +246,7 @@ func TestLoadCandidatesFromSimilarity_DedupTakesMaxScore(t *testing.T) {
 	helperSetTrackGenre(t, f, target.ID, "Rock")      // jaccard 1/1 = 1.0 from tag-overlap
 	helperLBSimilarity(t, f, seed.ID, target.ID, 0.5) // weaker LB signal
 	got, err := LoadCandidatesFromSimilarity(
-		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(),
+		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(), "test-seed",
 	)
 	if err != nil {
 		t.Fatalf("load: %v", err)
@@ -295,7 +299,7 @@ func TestLoadCandidatesFromSimilarity_TasteOverlapArm(t *testing.T) {
 	// Only the taste_overlap arm is enabled.
 	limits := CandidateSourceLimits{TasteOverlap: 10}
 	got, err := LoadCandidatesFromSimilarity(
-		ctx, f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, limits,
+		ctx, f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, limits, "test-seed",
 	)
 	if err != nil {
 		t.Fatalf("load: %v", err)
@@ -321,7 +325,7 @@ func TestLoadCandidatesFromSimilarity_EmptyLibrary_NoError(t *testing.T) {
 	f := newFixture(t, 1) // just the seed
 	seed := f.tracks[0]
 	got, err := LoadCandidatesFromSimilarity(
-		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(),
+		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, defaultLimits(), "test-seed",
 	)
 	if err != nil {
 		t.Fatalf("load: %v", err)
@@ -331,3 +335,97 @@ func TestLoadCandidatesFromSimilarity_EmptyLibrary_NoError(t *testing.T) {
 		t.Errorf("got %d candidates from seed-only library, want 0", len(got))
 	}
 }
+
+// The randomised arms must draw REPRODUCIBLY for a given seed (#3889).
+//
+// Four arms used to end in a bare `ORDER BY random()`. That returned a stable
+// set only while the arm's LIMIT exceeded the rows eligible for it — at that
+// point it returned all of them and the order stopped mattering, because the
+// caller sorts by track id before scoring. Below that threshold it returned a
+// random SUBSET, so two calls drew different candidates.
+//
+// It therefore held by ACCIDENT, and only for libraries smaller than the
+// limits. Any real library is larger, so same-day rebuilds had been drawing
+// different mixes since the arm was written — invisible, because a mix that
+// changes after a refresh looks like a feature.
+//
+// Limits deliberately smaller than the fixture, because that is the only
+// regime where the bug existed at all: with limits above the eligible count
+// the old code passes this too.
+func TestLoadCandidatesFromSimilarity_SameSeedDrawsTheSameSet(t *testing.T) {
+	f := newFixture(t, 12)
+	seed := f.tracks[0]
+
+	tight := CandidateSourceLimits{
+		LBSimilar: 2, SimilarArtist: 2, TagOverlap: 2,
+		LikesOverlap: 2, RandomFill: 3, TasteOverlap: 2, UserCoplay: 2,
+	}
+	ids := func(cs []Candidate) []string {
+		out := make([]string, 0, len(cs))
+		for _, c := range cs {
+			out = append(out, fmt.Sprintf("%x", c.Track.ID.Bytes))
+		}
+		sort.Strings(out) // membership, not order — order is settled downstream
+		return out
+	}
+
+	first, err := LoadCandidatesFromSimilarity(
+		context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, tight, "day-one",
+	)
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if len(first) == 0 {
+		t.Fatal("no candidates, so this test asserts nothing")
+	}
+
+	for i := 0; i < 3; i++ {
+		again, err := LoadCandidatesFromSimilarity(
+			context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, tight, "day-one",
+		)
+		if err != nil {
+			t.Fatalf("load %d: %v", i, err)
+		}
+		if !reflect.DeepEqual(ids(first), ids(again)) {
+			t.Fatalf("same seed drew a different set on call %d:\n  first %v\n  again %v",
+				i, ids(first), ids(again))
+		}
+	}
+}
+
+// ...and a different seed is free to draw differently, or the ordering would
+// be fixed rather than seeded and every day would serve the same mix.
+//
+// Asserted as "not pinned to one answer" rather than "always differs": with a
+// small fixture two seeds can legitimately collide, so requiring a difference
+// on any single pair would be flaky. Several seeds producing exactly one
+// distinct set is the real regression — that is what a constant ORDER BY
+// looks like.
+func TestLoadCandidatesFromSimilarity_DifferentSeedsCanDrawDifferently(t *testing.T) {
+	f := newFixture(t, 12)
+	seed := f.tracks[0]
+	tight := CandidateSourceLimits{
+		LBSimilar: 2, SimilarArtist: 2, TagOverlap: 2,
+		LikesOverlap: 2, RandomFill: 3, TasteOverlap: 2, UserCoplay: 2,
+	}
+
+	seen := map[string]bool{}
+	for _, orderSeed := range []string{"a", "b", "c", "d", "e", "f"} {
+		cs, err := LoadCandidatesFromSimilarity(
+			context.Background(), f.q, f.user, seed.ID, 1, SessionVector{Seed: true}, nil, tight, orderSeed,
+		)
+		if err != nil {
+			t.Fatalf("load %q: %v", orderSeed, err)
+		}
+		ids := make([]string, 0, len(cs))
+		for _, c := range cs {
+			ids = append(ids, fmt.Sprintf("%x", c.Track.ID.Bytes))
+		}
+		sort.Strings(ids)
+		seen[strings.Join(ids, ",")] = true
+	}
+	if len(seen) < 2 {
+		t.Errorf("six different seeds produced %d distinct set(s); the ordering is not "+
+			"varying with the seed at all", len(seen))
+	}
+}
@@ -0,0 +1,188 @@
+package recommendation
+
+import (
+	"context"
+	"math"
+	"sync"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgtype"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
+)
+
+// Scaling the candidate pool to the library (#3880).
+//
+// DefaultCandidateSourceLimits returns what its own comment calls "the v1
+// hardcoded constants per spec" — ~170 candidates, identical for a 500-track
+// library and a 100,000-track one. Operator, 2026-09-10: "is the pool that we
+// draw from somehow scaled to the amount of music in the library... my earlier
+// understanding of the tuning and work may have been skewed by what was in my
+// library."
+//
+// It was not, and the consequence compounds. The pool samples a shrinking
+// FRACTION of the library as it grows — 17% of 1,000 tracks, 1.7% of 10,000,
+// 0.17% of 100,000 — so the ceiling on how much of a collection can ever
+// surface stays flat while the collection does not. RandomFill, whose entire
+// job is exploration, becomes a thinner and noisier slice of a more diverse
+// corpus at exactly the moment diversity rises.
+
+const (
+	// libraryScaleReference is the library size at which the base limits
+	// apply unchanged. Below it nothing scales, so small libraries keep
+	// today's behaviour exactly.
+	//
+	// ASSUMED, NOT MEASURED. The size the v1 constants were actually tuned
+	// against is unrecorded; 5,000 is a plausible mid-size library and a
+	// deliberately conservative place to start growing. #3879 should replace
+	// this with the real number, and until it does, this constant is the
+	// single thing to change.
+	libraryScaleReference = 5000
+
+	// maxLibraryScale bounds growth so a very large library does not turn
+	// every recommendation query into a huge scan. At 4x the pool tops out
+	// around 500 candidates, which is still cheap to score in memory.
+	maxLibraryScale = 4.0
+)
+
+// libraryScale is sqrt rather than linear on purpose. Linear growth would put
+// a 100,000-track library at a 3,400-candidate pool — a slow query, slow
+// scoring, and far past the point where more candidates improve the answer.
+// Square-root growth keeps the pool meaningfully proportional while staying
+// bounded: 1x at the reference, 2x at four times it, 4x at sixteen times.
+//
+// Never returns below 1: the base limits are a floor, not a midpoint. That
+// also keeps this safe against #3889 — growing an arm ordered by unseeded
+// random() is fine, shrinking one is what breaks same-day determinism.
+func libraryScale(libraryTracks int64) float64 {
+	if libraryTracks <= libraryScaleReference {
+		return 1.0
+	}
+	f := math.Sqrt(float64(libraryTracks) / float64(libraryScaleReference))
+	return math.Min(f, maxLibraryScale)
+}
+
+// ScaleForLibrary grows the library-bounded arms of a limit set for a library
+// of the given size, and leaves the rest alone.
+//
+// THE SCALING IS NOT UNIFORM, and that is the substance of it rather than a
+// refinement. An arm's limit only matters if there are rows for it to cut off,
+// so what an arm is BOUNDED BY decides whether library size can help it:
+//
+//	scaled     LBSimilar, SimilarArtist, TagOverlap — bounded by similarity
+//	           and tag data, which grows as the library does. A bigger library
+//	           means more of ListenBrainz's returned MBIDs survive the
+//	           local-library filter in similarity/worker.go.
+//	scaled     RandomFill — the exploration arm, and the one the complaint is
+//	           really about. This is where "fraction of the library" lives.
+//	unscaled   LikesOverlap — bounded by the USER's likes.
+//	unscaled   UserCoplay — bounded by the INSTANCE's co-play graph.
+//	unscaled   TasteOverlap — bounded by the taste profile's artists.
+//
+// Raising the last three would not sample more of the library; it would
+// sample more of a set that did not grow, which is churn rather than reach.
+// Leaving TasteOverlap alone has a second benefit: it and RandomFill are the
+// two arms carrying sim_score 0, so this does not inflate the
+// seed-independent share as fast as a uniform scale would.
+func ScaleForLibrary(base CandidateSourceLimits, libraryTracks int64) CandidateSourceLimits {
+	f := libraryScale(libraryTracks)
+	grow := func(n int) int { return int(float64(n) * f) } // f >= 1, so never shrinks
+	return CandidateSourceLimits{
+		LBSimilar:     grow(base.LBSimilar),
+		SimilarArtist: grow(base.SimilarArtist),
+		TagOverlap:    grow(base.TagOverlap),
+		RandomFill:    grow(base.RandomFill),
+		LikesOverlap:  base.LikesOverlap,
+		UserCoplay:    base.UserCoplay,
+		TasteOverlap:  base.TasteOverlap,
+	}
+}
+
+// CountLibraryTracks returns the whole library's track count.
+//
+// Reuses CountTracksMatching with an empty pattern — `title ILIKE '%%'`
+// matches every row — rather than adding a query, because a new one would
+// need sqlc regeneration (rule 28, and see #3889 for where that blocks).
+// The user id is left invalid so the quarantine anti-join is skipped: this
+// number sizes a pool, and a per-user view of it would be false precision.
+func CountLibraryTracks(ctx context.Context, q *dbq.Queries) (int64, error) {
+	return q.CountTracksMatching(ctx, dbq.CountTracksMatchingParams{
+		Column1: "",
+		UserID:  pgtype.UUID{}, // invalid → NULL → no quarantine filter
+	})
+}
+
+// librarySizeTTL is how long a counted size is reused. Library size changes
+// only when a scan runs, so minutes are plenty — and the count is a full
+// table scan (the ILIKE defeats every index), which is why it is not done
+// per request.
+const librarySizeTTL = 5 * time.Minute
+
+// librarySizeTimeout bounds the count itself — see loadWithDeadline.
+const librarySizeTimeout = 3 * time.Second
+
+// LibrarySize memoises the library track count.
+//
+// Degrades rather than fails: a count that errors or times out leaves the
+// previous value in place, and a zero (never yet counted) scales to the base
+// limits — which is exactly today's behaviour. Nothing about sizing a
+// candidate pool justifies failing the request it is sizing.
+type LibrarySize struct {
+	mu   sync.Mutex
+	now  func() time.Time // injectable for tests
+	at   time.Time
+	size int64
+}
+
+// NewLibrarySize returns an empty cache. The zero value works too; this
+// exists so tests can pin the clock.
+func NewLibrarySize(now func() time.Time) *LibrarySize {
+	return &LibrarySize{now: now}
+}
+
+// Get returns the cached size, refreshing through load when stale.
+//
+// A NIL RECEIVER IS VALID and means "no cache": the count still runs, it is
+// just not memoised. That is deliberate rather than defensive habit. The api
+// handlers struct is built directly by a dozen tests that cannot know about
+// every field, and a nil here previously panicked inside a radio request —
+// turning a missing pool-sizing HINT into a 500. Uncached-but-correct is the
+// right failure for something whose whole contract is that it degrades.
+func (l *LibrarySize) Get(ctx context.Context, load func(context.Context) (int64, error)) int64 {
+	if l == nil {
+		n, err := loadWithDeadline(ctx, load)
+		if err != nil {
+			return 0 // scales to the base limits
+		}
+		return n
+	}
+
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	now := time.Now
+	if l.now != nil {
+		now = l.now
+	}
+	if !l.at.IsZero() && now().Sub(l.at) < librarySizeTTL {
+		return l.size
+	}
+
+	n, err := loadWithDeadline(ctx, load)
+	if err != nil {
+		// Keep the last known value and re-try at the next call rather than
+		// stamping `at`, so a transient failure does not pin a stale number
+		// for the whole TTL.
+		return l.size
+	}
+	l.size, l.at = n, now()
+	return l.size
+}
+
+// loadWithDeadline bounds the count. Rule 156: the caller is a user waiting
+// on a radio, and a pool-sizing hint is never worth hanging for.
+func loadWithDeadline(ctx context.Context, load func(context.Context) (int64, error)) (int64, error) {
+	cctx, cancel := context.WithTimeout(ctx, librarySizeTimeout)
+	defer cancel()
+	return load(cctx)
+}
@@ -0,0 +1,216 @@
+package recommendation
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+)
+
+// Small libraries must behave exactly as before. Scaling is meant to help a
+// growing collection, not to change what every existing install already does.
+func TestScaleForLibrary_SmallLibrariesAreUntouched(t *testing.T) {
+	base := DefaultCandidateSourceLimits()
+	for _, size := range []int64{0, 1, 500, libraryScaleReference} {
+		if got := ScaleForLibrary(base, size); got != base {
+			t.Errorf("library of %d changed the limits: %+v, want %+v", size, got, base)
+		}
+	}
+}
+
+// The complaint, restated as a property: a bigger library must reach further
+// into itself. Operator, 2026-09-10 — "is the pool that we draw from somehow
+// scaled to the amount of music in the library".
+func TestScaleForLibrary_BigLibrariesGetABiggerPool(t *testing.T) {
+	base := DefaultCandidateSourceLimits()
+	small := ScaleForLibrary(base, libraryScaleReference)
+	big := ScaleForLibrary(base, libraryScaleReference*16)
+
+	if big.RandomFill <= small.RandomFill {
+		t.Errorf("RandomFill %d did not grow for a 16x library (was %d); that arm "+
+			"IS the fraction-of-library problem", big.RandomFill, small.RandomFill)
+	}
+	if big.LBSimilar <= small.LBSimilar {
+		t.Errorf("LBSimilar %d did not grow for a 16x library (was %d)",
+			big.LBSimilar, small.LBSimilar)
+	}
+}
+
+// THE SUBSTANCE: scaling is per-arm, decided by what each arm is BOUNDED BY.
+// Raising a limit only helps if there are rows for it to cut off, so arms
+// bounded by the user's likes, the instance's co-play graph or the taste
+// profile gain nothing from a bigger library — raising them would sample more
+// of a set that did not grow.
+//
+// A uniform scale would look right and be wrong, which is why this is pinned
+// separately from "the pool got bigger".
+func TestScaleForLibrary_OnlyLibraryBoundedArmsGrow(t *testing.T) {
+	base := DefaultCandidateSourceLimits()
+	big := ScaleForLibrary(base, libraryScaleReference*16)
+
+	for _, tc := range []struct {
+		arm       string
+		got, want int
+		why       string
+	}{
+		{"LikesOverlap", big.LikesOverlap, base.LikesOverlap, "bounded by the user's likes"},
+		{"UserCoplay", big.UserCoplay, base.UserCoplay, "bounded by the instance's co-play graph"},
+		{"TasteOverlap", big.TasteOverlap, base.TasteOverlap, "bounded by the taste profile's artists"},
+	} {
+		if tc.got != tc.want {
+			t.Errorf("%s scaled to %d (base %d) but is %s — a bigger library gives it "+
+				"nothing more to return", tc.arm, tc.got, tc.want, tc.why)
+		}
+	}
+}
+
+// Growth is bounded, or a huge library turns every recommendation query into
+// a huge scan. sqrt keeps it proportional; the ceiling keeps it affordable.
+func TestScaleForLibrary_GrowthIsBounded(t *testing.T) {
+	base := DefaultCandidateSourceLimits()
+	huge := ScaleForLibrary(base, 100_000_000)
+
+	if huge.RandomFill > int(float64(base.RandomFill)*maxLibraryScale) {
+		t.Errorf("RandomFill %d exceeds the %.0fx ceiling on base %d",
+			huge.RandomFill, maxLibraryScale, base.RandomFill)
+	}
+	// sqrt, not linear — and the test point matters. At SIXTEEN times the
+	// reference both curves land on 4x, because linear has already been
+	// clamped by the ceiling; asserting there proves nothing. Four times the
+	// reference is below the ceiling for both, so the curves separate: sqrt
+	// gives 2x, linear would give 4x.
+	four := ScaleForLibrary(base, libraryScaleReference*4)
+	if four.RandomFill != base.RandomFill*2 {
+		t.Errorf("4x library gave RandomFill %d, want %d — sqrt growth (linear "+
+			"would give %d)", four.RandomFill, base.RandomFill*2, base.RandomFill*4)
+	}
+}
+
+// Never below the base. The base limits are a floor, not a midpoint — and
+// #3889 makes this load-bearing rather than tidy: shrinking an arm ordered by
+// unseeded random() changes pool membership between same-day rebuilds.
+func TestScaleForLibrary_NeverShrinksAnArm(t *testing.T) {
+	base := DefaultCandidateSourceLimits()
+	for _, size := range []int64{0, 1, 100, 4999, 5001, 1_000_000} {
+		got := ScaleForLibrary(base, size)
+		for _, tc := range []struct {
+			arm       string
+			got, want int
+		}{
+			{"LBSimilar", got.LBSimilar, base.LBSimilar},
+			{"SimilarArtist", got.SimilarArtist, base.SimilarArtist},
+			{"TagOverlap", got.TagOverlap, base.TagOverlap},
+			{"RandomFill", got.RandomFill, base.RandomFill},
+			{"LikesOverlap", got.LikesOverlap, base.LikesOverlap},
+			{"UserCoplay", got.UserCoplay, base.UserCoplay},
+			{"TasteOverlap", got.TasteOverlap, base.TasteOverlap},
+		} {
+			if tc.got < tc.want {
+				t.Errorf("library %d shrank %s to %d (base %d)", size, tc.arm, tc.got, tc.want)
+			}
+		}
+	}
+}
+
+// A pool-sizing hint must never fail the request it is sizing. A count that
+// errors leaves the previous value in place, and a never-counted cache
+// returns 0 — which scales to the base limits, i.e. exactly today's
+// behaviour.
+func TestLibrarySize_DegradesOnFailure(t *testing.T) {
+	clock := time.Now()
+	c := NewLibrarySize(func() time.Time { return clock })
+
+	boom := func(context.Context) (int64, error) { return 0, errors.New("db is down") }
+	if got := c.Get(context.Background(), boom); got != 0 {
+		t.Errorf("first failure returned %d, want 0 (which scales to the base limits)", got)
+	}
+	if got := ScaleForLibrary(DefaultCandidateSourceLimits(), 0); got != DefaultCandidateSourceLimits() {
+		t.Error("a zero library size did not scale to the base limits")
+	}
+
+	// A good count, then a failure: the last known value survives.
+	if got := c.Get(context.Background(), func(context.Context) (int64, error) { return 40_000, nil }); got != 40_000 {
+		t.Fatalf("got %d, want 40000", got)
+	}
+	clock = clock.Add(librarySizeTTL + time.Second)
+	if got := c.Get(context.Background(), boom); got != 40_000 {
+		t.Errorf("a failed refresh returned %d, discarding the last known 40000", got)
+	}
+}
+
+// The count is a full table scan, so it must not run per request.
+func TestLibrarySize_CachesWithinTheTTL(t *testing.T) {
+	clock := time.Now()
+	c := NewLibrarySize(func() time.Time { return clock })
+	calls := 0
+	load := func(context.Context) (int64, error) { calls++; return 1234, nil }
+
+	for i := 0; i < 5; i++ {
+		c.Get(context.Background(), load)
+	}
+	if calls != 1 {
+		t.Errorf("counted %d times within the TTL, want 1 — this is a full table scan", calls)
+	}
+
+	clock = clock.Add(librarySizeTTL + time.Second)
+	c.Get(context.Background(), load)
+	if calls != 2 {
+		t.Errorf("counted %d times after the TTL expired, want 2 — the size never refreshes", calls)
+	}
+}
+
+// A transient failure must not pin a stale value for the whole TTL: the
+// failed refresh does not stamp the clock, so the next call retries.
+func TestLibrarySize_RetriesAfterAFailedRefresh(t *testing.T) {
+	clock := time.Now()
+	c := NewLibrarySize(func() time.Time { return clock })
+
+	c.Get(context.Background(), func(context.Context) (int64, error) { return 100, nil })
+	clock = clock.Add(librarySizeTTL + time.Second)
+	c.Get(context.Background(), func(context.Context) (int64, error) { return 0, errors.New("blip") })
+
+	// Immediately after, with no clock movement — a stamped failure would
+	// serve the stale 100 until the TTL expired again.
+	if got := c.Get(context.Background(), func(context.Context) (int64, error) { return 900, nil }); got != 900 {
+		t.Errorf("got %d after a failed refresh, want 900 — the failure pinned a stale value", got)
+	}
+}
+
+// A nil cache must not panic, and must still be CORRECT — uncached, not
+// broken.
+//
+// This is not a hypothetical hardening. internal/api builds its handlers
+// struct directly in a dozen tests, none of which know about every field, so
+// librarySize arrives nil there. The first version of this panicked inside
+// handleRadio and took down TestHandleRadio_ColdStart_OnlySeedReturned with a
+// SIGSEGV — turning a missing pool-sizing HINT into a request-killing crash,
+// which is the opposite of what a value that "degrades rather than fails" is
+// supposed to do.
+func TestLibrarySize_NilReceiverStillCounts(t *testing.T) {
+	var c *LibrarySize // deliberately not constructed
+
+	calls := 0
+	got := c.Get(context.Background(), func(context.Context) (int64, error) {
+		calls++
+		return 40_000, nil
+	})
+	if got != 40_000 {
+		t.Errorf("nil cache returned %d, want 40000 — it should still count, just not memoise", got)
+	}
+	if calls != 1 {
+		t.Errorf("nil cache called the loader %d times, want 1", calls)
+	}
+
+	// Uncached: a second call counts again rather than reusing anything.
+	c.Get(context.Background(), func(context.Context) (int64, error) { calls++; return 40_000, nil })
+	if calls != 2 {
+		t.Errorf("nil cache memoised across calls (%d loads); it has nowhere to store a value", calls)
+	}
+
+	// And it still degrades on error rather than panicking.
+	if got := c.Get(context.Background(), func(context.Context) (int64, error) {
+		return 0, errors.New("db is down")
+	}); got != 0 {
+		t.Errorf("nil cache returned %d on a failed count, want 0 (base limits)", got)
+	}
+}
@@ -4,6 +4,8 @@ import (
 	"sort"
 	"time"

+	"github.com/jackc/pgx/v5/pgtype"
+
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
 )

@@ -13,15 +15,72 @@ type Candidate struct {
 	Inputs ScoringInputs
 }

-// Shuffle scores each candidate, sorts descending by score, and returns
-// the top `limit` candidates. limit <= 0 returns nil; nil input returns
-// nil. Pure — no IO, no global state beyond the rng callback.
+// DiversityCaps bounds how much of one selection a single artist or album
+// may occupy. A zero value means "no cap", which is what Shuffle did
+// unconditionally before #3882.
+type DiversityCaps struct {
+	MaxPerArtist int
+	MaxPerAlbum  int
+}
+
+// radioCapArtistPer25 / radioCapAlbumPer25 hold the caps at the same
+// PROPORTION the system mixes already use — 3 artist / 2 album tracks in a
+// 25-track mix — so a 20-track radio and a 200-track one feel alike rather
+// than one of them being effectively uncapped.
+//
+// A fixed count cannot do that. Three-per-artist is a reasonable 12% of a
+// 25-track mix and an absurd 1.5% of a 200-track radio, where it would put
+// the selection permanently in the relaxation path below and quietly undo
+// the cap it was meant to enforce.
+const (
+	radioCapArtistPer25 = 3
+	radioCapAlbumPer25  = 2
+)
+
+// RadioDiversityCaps scales the diversity caps to the requested radio
+// length. Floors of 2 and 1 keep a very short radio from being capped into
+// a single track per artist, which would be its own kind of wrong.
+func RadioDiversityCaps(limit int) DiversityCaps {
+	artist := limit * radioCapArtistPer25 / 25
+	if artist < 2 {
+		artist = 2
+	}
+	album := limit * radioCapAlbumPer25 / 25
+	if album < 1 {
+		album = 1
+	}
+	return DiversityCaps{MaxPerArtist: artist, MaxPerAlbum: album}
+}
+
+// Shuffle scores each candidate, sorts descending by score, and returns the
+// top `limit` candidates, preferring artist/album diversity. limit <= 0
+// returns nil; nil input returns nil. Pure — no IO, no global state beyond
+// the rng callback.
+//
+// THE COUNT IS NEVER REDUCED BY THE CAPS. Selection runs in two passes: the
+// first takes candidates that fit under the caps, and the second fills any
+// remaining slots from those the first pass skipped, still in score order.
+// So the result holds min(limit, len(candidates)) either way — the caps
+// change WHICH tracks are chosen, never HOW MANY.
+//
+// That two-pass shape is the whole design, and a hard cap would have been
+// the easy mistake. Radio asks for 50 tracks by default and 200 at most; a
+// pool concentrated on a few artists would return six tracks and call it a
+// radio. Rule 131's principle — degrade, never vanish — applies past the
+// system mixes it was written for.
+//
+// Before #3882 there was no cap here at all, while discover.go,
+// you_might_like.go and home.go all had one. That asymmetry is what let a
+// radio session come back entirely from a single artist: nothing between
+// the pool and the output bounded any artist's share, so a pool dominated
+// by one artist produced an output dominated by it too.
 func Shuffle(
 	candidates []Candidate,
 	weights ScoringWeights,
 	now time.Time,
 	rng func() float64,
 	limit int,
+	caps DiversityCaps,
 ) []Candidate {
 	if len(candidates) == 0 || limit <= 0 {
 		return nil
@@ -40,9 +99,36 @@ func Shuffle(
 	if limit > len(scored) {
 		limit = len(scored)
 	}
-	out := make([]Candidate, limit)
-	for i := 0; i < limit; i++ {
-		out[i] = scored[i].c
+
+	out := make([]Candidate, 0, limit)
+	deferred := make([]Candidate, 0, len(scored)-limit)
+	artistCount := map[pgtype.UUID]int{}
+	albumCount := map[pgtype.UUID]int{}
+
+	for _, s := range scored {
+		if len(out) == limit {
+			break
+		}
+		overArtist := caps.MaxPerArtist > 0 && artistCount[s.c.Track.ArtistID] >= caps.MaxPerArtist
+		overAlbum := caps.MaxPerAlbum > 0 && albumCount[s.c.Track.AlbumID] >= caps.MaxPerAlbum
+		if overArtist || overAlbum {
+			// Held back, not discarded — pass two may still need it.
+			deferred = append(deferred, s.c)
+			continue
+		}
+		artistCount[s.c.Track.ArtistID]++
+		albumCount[s.c.Track.AlbumID]++
+		out = append(out, s.c)
+	}
+
+	// Pass two: the caps could not fill the request, so relax them rather
+	// than hand back a short radio. Still score order, so the best of the
+	// held-back candidates go first.
+	for _, c := range deferred {
+		if len(out) == limit {
+			break
+		}
+		out = append(out, c)
 	}
 	return out
 }
@@ -0,0 +1,197 @@
+package recommendation
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgtype"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
+)
+
+// candBy builds a candidate with a real artist and album identity, which
+// `cand` deliberately leaves zero.
+func candBy(t *testing.T, id, artist, album string, in ScoringInputs) Candidate {
+	t.Helper()
+	tr := dbq.Track{Title: id}
+	if err := tr.ID.Scan("00000000-0000-0000-0000-" + id); err != nil {
+		t.Fatalf("track id %q: %v", id, err)
+	}
+	if err := tr.ArtistID.Scan("00000000-0000-0000-0001-" + artist); err != nil {
+		t.Fatalf("artist id %q: %v", artist, err)
+	}
+	if err := tr.AlbumID.Scan("00000000-0000-0000-0002-" + album); err != nil {
+		t.Fatalf("album id %q: %v", album, err)
+	}
+	return Candidate{Track: tr, Inputs: in}
+}
+
+// artistKey is the map key artistsOf produces for a given fixture artist,
+// derived the same way the fixture builds the UUID. Hand-writing the hex is
+// how the first version of this test went wrong: the artist id is not all
+// zeros — it carries 0001 in its fourth group — so the literal did not match
+// and the assertion measured nothing.
+func artistKey(t *testing.T, artist string) string {
+	t.Helper()
+	var id pgtype.UUID
+	if err := id.Scan("00000000-0000-0000-0001-" + artist); err != nil {
+		t.Fatalf("artist id %q: %v", artist, err)
+	}
+	return fmt.Sprintf("%x", id.Bytes)
+}
+
+// artistsOf counts how many picks each artist contributed.
+func artistsOf(picks []Candidate) map[string]int {
+	out := map[string]int{}
+	for _, p := range picks {
+		out[fmt.Sprintf("%x", p.Track.ArtistID.Bytes)]++
+	}
+	return out
+}
+
+// THE BUG. Operator, 2026-09-10: started radio from a song and "literally
+// all of the songs in the playlist after that were from a single artist".
+//
+// One artist's tracks all outscore everything else, and there are more of
+// them than the radio has room for. Without a cap the output is entirely
+// that artist — nothing between the pool and the result bounded its share.
+func TestShuffle_CapStopsOneArtistTakingTheWholeRadio(t *testing.T) {
+	var cs []Candidate
+	// 20 tracks by artist A, all liked so they sort to the top.
+	for i := 0; i < 20; i++ {
+		cs = append(cs, candBy(t, fmt.Sprintf("%012d", i), "00000000000a",
+			fmt.Sprintf("%012d", i), ScoringInputs{IsGeneralLiked: true}))
+	}
+	// 10 tracks by 10 other artists, none liked, so they all rank below.
+	for i := 0; i < 10; i++ {
+		cs = append(cs, candBy(t, fmt.Sprintf("%012d", 100+i),
+			fmt.Sprintf("%012d", 200+i), fmt.Sprintf("%012d", 100+i),
+			ScoringInputs{IsGeneralLiked: false}))
+	}
+
+	const limit = 10
+	caps := DiversityCaps{MaxPerArtist: 3}
+	picks := Shuffle(cs, defaultWeights(), time.Now(), fixedRNG(0.5), limit, caps)
+
+	if len(picks) != limit {
+		t.Fatalf("len = %d, want %d", len(picks), limit)
+	}
+	byArtist := artistsOf(picks)
+	artistA := artistKey(t, "00000000000a")
+	if got := byArtist[artistA]; got != 3 {
+		t.Errorf("artist A contributed %d of %d picks, cap is 3", got, limit)
+	}
+	if len(byArtist) < 8 {
+		t.Errorf("only %d distinct artists in a %d-track radio; the cap is not "+
+			"spreading the selection", len(byArtist), limit)
+	}
+
+	// The same pool with NO cap is the regression this exists to catch. If
+	// this stops holding, the test above is no longer proving anything.
+	uncapped := Shuffle(cs, defaultWeights(), time.Now(), fixedRNG(0.5), limit, DiversityCaps{})
+	if artistsOf(uncapped)[artistA] != limit {
+		t.Errorf("uncapped selection was not single-artist, so this fixture no " +
+			"longer reproduces the bug being fixed")
+	}
+}
+
+// A CAP IS A BOUND, NOT AN EXCLUSION. The operator asked for the opposite of
+// removal: "again it should be able to add songs from the same artist."
+func TestShuffle_CappedArtistIsStillRepresented(t *testing.T) {
+	var cs []Candidate
+	for i := 0; i < 20; i++ {
+		cs = append(cs, candBy(t, fmt.Sprintf("%012d", i), "00000000000a",
+			fmt.Sprintf("%012d", i), ScoringInputs{IsGeneralLiked: true}))
+	}
+	for i := 0; i < 10; i++ {
+		cs = append(cs, candBy(t, fmt.Sprintf("%012d", 100+i),
+			fmt.Sprintf("%012d", 200+i), fmt.Sprintf("%012d", 100+i),
+			ScoringInputs{IsGeneralLiked: false}))
+	}
+	picks := Shuffle(cs, defaultWeights(), time.Now(), fixedRNG(0.5), 10,
+		DiversityCaps{MaxPerArtist: 3})
+	if artistsOf(picks)[artistKey(t, "00000000000a")] == 0 {
+		t.Error("the dominant artist was excluded entirely; the cap should bound " +
+			"its share, not remove it")
+	}
+}
+
+// RULE 131, applied past the system mixes it was written for: degrade, never
+// vanish. A hard cap over a pool with few artists would hand back a six-track
+// "radio" for a fifty-track request. The caps must change WHICH tracks are
+// picked, never HOW MANY.
+func TestShuffle_CapsNeverShortenTheResult(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		artists int
+		perArt  int
+		limit   int
+	}{
+		{"one artist owns the entire pool", 1, 30, 10},
+		{"two artists, tight cap", 2, 15, 20},
+		{"pool smaller than the request", 3, 2, 50},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var cs []Candidate
+			n := 0
+			for a := 0; a < tc.artists; a++ {
+				for k := 0; k < tc.perArt; k++ {
+					cs = append(cs, candBy(t, fmt.Sprintf("%012d", n),
+						fmt.Sprintf("%012d", 300+a), fmt.Sprintf("%012d", n),
+						ScoringInputs{}))
+					n++
+				}
+			}
+			want := tc.limit
+			if len(cs) < want {
+				want = len(cs)
+			}
+			picks := Shuffle(cs, defaultWeights(), time.Now(), fixedRNG(0.5), tc.limit,
+				DiversityCaps{MaxPerArtist: 3, MaxPerAlbum: 2})
+			if len(picks) != want {
+				t.Errorf("len = %d, want %d — the caps shortened the result instead "+
+					"of relaxing to fill it", len(picks), want)
+			}
+			// No duplicates: a candidate deferred in pass one must not also be
+			// taken in pass two.
+			seen := map[[16]byte]bool{}
+			for _, p := range picks {
+				if seen[p.Track.ID.Bytes] {
+					t.Fatalf("track %x appears twice; pass two re-added a pick", p.Track.ID.Bytes)
+				}
+				seen[p.Track.ID.Bytes] = true
+			}
+		})
+	}
+}
+
+// A fixed count cannot serve both a 20-track radio and a 200-track one: three
+// per artist is 12% of the first and 1.5% of the second, which would leave the
+// long radio permanently in the relaxation path and effectively uncapped.
+func TestRadioDiversityCaps_ScaleWithTheRequestedLength(t *testing.T) {
+	short := RadioDiversityCaps(25)
+	long := RadioDiversityCaps(200)
+
+	if short.MaxPerArtist != 3 {
+		t.Errorf("a 25-track radio caps artists at %d, want 3 — the same "+
+			"proportion the system mixes use", short.MaxPerArtist)
+	}
+	if long.MaxPerArtist <= short.MaxPerArtist {
+		t.Errorf("a 200-track radio caps artists at %d, no higher than a 25-track "+
+			"one at %d; the cap is not scaling", long.MaxPerArtist, short.MaxPerArtist)
+	}
+	// Proportion held, not just "bigger".
+	if long.MaxPerArtist != 24 {
+		t.Errorf("200-track artist cap = %d, want 24 (3 per 25)", long.MaxPerArtist)
+	}
+
+	// Floors: a tiny radio must not be capped down to one track per artist.
+	tiny := RadioDiversityCaps(1)
+	if tiny.MaxPerArtist < 2 {
+		t.Errorf("tiny radio artist cap = %d, want at least 2", tiny.MaxPerArtist)
+	}
+	if tiny.MaxPerAlbum < 1 {
+		t.Errorf("tiny radio album cap = %d, want at least 1", tiny.MaxPerAlbum)
+	}
+}
@@ -21,7 +21,7 @@ func TestShuffle_LikedRanksAboveUnliked(t *testing.T) {
 		cand("000000000001", ScoringInputs{IsGeneralLiked: false}),
 		cand("000000000002", ScoringInputs{IsGeneralLiked: true}),
 	}
-	out := Shuffle(cs, defaultWeights(), time.Now(), fixedRNG(0.5), 10)
+	out := Shuffle(cs, defaultWeights(), time.Now(), fixedRNG(0.5), 10, DiversityCaps{})
 	if out[0].Track.Title != "000000000002" {
 		t.Errorf("liked track did not rank first: %+v", out)
 	}
@@ -33,7 +33,7 @@ func TestShuffle_HighSkipRanksLast(t *testing.T) {
 		cand("000000000002", ScoringInputs{PlayCount: 10, SkipCount: 0}),  // ratio 0
 		cand("000000000003", ScoringInputs{PlayCount: 10, SkipCount: 5}),  // ratio 0.5
 	}
-	out := Shuffle(cs, defaultWeights(), time.Now(), fixedRNG(0.5), 10)
+	out := Shuffle(cs, defaultWeights(), time.Now(), fixedRNG(0.5), 10, DiversityCaps{})
 	if out[0].Track.Title != "000000000002" || out[2].Track.Title != "000000000001" {
 		t.Errorf("skip-ratio ordering broken: %v", titles(out))
 	}
@@ -44,7 +44,7 @@ func TestShuffle_LimitTruncates(t *testing.T) {
 	for i := range cs {
 		cs[i] = cand("00000000000"+string(rune('a'+i%26)), ScoringInputs{})
 	}
-	out := Shuffle(cs, defaultWeights(), time.Now(), fixedRNG(0.5), 10)
+	out := Shuffle(cs, defaultWeights(), time.Now(), fixedRNG(0.5), 10, DiversityCaps{})
 	if len(out) != 10 {
 		t.Errorf("len = %d, want 10", len(out))
 	}
@@ -58,7 +58,7 @@ func TestShuffle_JitterDoesNotFlipStructuralWinner(t *testing.T) {
 			cand("000000000001", ScoringInputs{IsGeneralLiked: false}),
 			cand("000000000002", ScoringInputs{IsGeneralLiked: true}),
 		}
-		out := Shuffle(cs, defaultWeights(), time.Now(), r.Float64, 10)
+		out := Shuffle(cs, defaultWeights(), time.Now(), r.Float64, 10, DiversityCaps{})
 		if out[0].Track.Title != "000000000002" {
 			t.Fatalf("iter %d: liked did not rank first; out=%v", i, titles(out))
 		}
@@ -66,7 +66,7 @@ func TestShuffle_JitterDoesNotFlipStructuralWinner(t *testing.T) {
 }

 func TestShuffle_Empty_ReturnsEmpty(t *testing.T) {
-	out := Shuffle(nil, defaultWeights(), time.Now(), fixedRNG(0.5), 10)
+	out := Shuffle(nil, defaultWeights(), time.Now(), fixedRNG(0.5), 10, DiversityCaps{})
 	if len(out) != 0 {
 		t.Errorf("len = %d, want 0", len(out))
 	}
@@ -0,0 +1,61 @@
+package recommendation
+
+import "testing"
+
+// Songs-like's pool must lean on arms that MEASURE distance from the seed.
+// The default gave ~29% of candidates a sim_score of literally 0
+// (taste_overlap and random_fill are both `0.0::float8` in
+// recommendation.sql), which is what let "Songs like X" wander.
+func TestSongsLikeLimits_FavourTheArmsThatMeasureTheSeed(t *testing.T) {
+	d := DefaultCandidateSourceLimits()
+	s := SongsLikeCandidateSourceLimits()
+
+	if s.LBSimilar <= d.LBSimilar {
+		t.Errorf("LBSimilar %d is not above the default %d — the only arm that "+
+			"measures track-level distance from the seed should be favoured here",
+			s.LBSimilar, d.LBSimilar)
+	}
+	// The two seed-INDEPENDENT arms, which is the whole complaint.
+	zeroSimDefault := d.TasteOverlap + d.RandomFill
+	zeroSimSongsLike := s.TasteOverlap + s.RandomFill
+	if zeroSimSongsLike >= zeroSimDefault {
+		t.Errorf("seed-independent arms total %d, not reduced from the default %d; "+
+			"these carry sim_score 0 by construction", zeroSimSongsLike, zeroSimDefault)
+	}
+}
+
+// RULE 131: a system playlist degrades, it never vanishes.
+//
+// Zeroing the seed-independent arms was the first instinct and is exactly the
+// vanish-or-nothing shape that rule forbids: a seed whose artist has thin
+// ListenBrainz coverage would yield a short mix or none at all. They are the
+// tier-3 FLOOR — reduced hard, never removed — and the songs_like weights are
+// what keep them at the bottom of the ranking rather than out of the pool.
+//
+// "A few tracks further from the seed than we would like" beats "no playlist".
+func TestSongsLikeLimits_KeepATierThreeFloor(t *testing.T) {
+	s := SongsLikeCandidateSourceLimits()
+	if s.RandomFill <= 0 {
+		t.Error("RandomFill is zero: a seed with thin similarity coverage now produces " +
+			"a short or empty mix instead of degrading (rule 131)")
+	}
+	if s.TasteOverlap <= 0 {
+		t.Error("TasteOverlap is zero: the graded floor is gone, leaving only random " +
+			"fill between a sparse seed and an empty playlist (rule 131)")
+	}
+}
+
+// The pool should stay roughly the size it was — this change is about
+// COMPOSITION, not about starving the surface. A much smaller pool would also
+// shrink what the per-artist cap has to work with.
+func TestSongsLikeLimits_KeepThePoolRoughlyTheSameSize(t *testing.T) {
+	total := func(l CandidateSourceLimits) int {
+		return l.LBSimilar + l.SimilarArtist + l.TagOverlap + l.LikesOverlap +
+			l.RandomFill + l.TasteOverlap + l.UserCoplay
+	}
+	d, s := total(DefaultCandidateSourceLimits()), total(SongsLikeCandidateSourceLimits())
+	if s < d/2 {
+		t.Errorf("songs_like pool is %d against the default %d — less than half; "+
+			"this was meant to re-weight the pool, not starve it", s, d)
+	}
+}
@@ -40,6 +40,13 @@ const (
 	// never be read as taste signal (#2374) — filing it under taste would put
 	// it one careless join from the leak that design forbids.
 	ScopeDiscover = "discover"
+	// ScopeSongsLike is the "Songs like {X}" surface (#3881). It shared
+	// daily_mix with For-You until 2026-09-10, and that sharing WAS the bug:
+	// the two surfaces want opposite things. For-You answers "what will they
+	// enjoy today" and is supposed to roam; Songs-like answers "what sounds
+	// like THIS" and is the tightest surface in the product. One set of
+	// weights cannot serve both, and the broad answer was winning.
+	ScopeSongsLike = "songs_like"
 )

 // TasteTuning is the tunable subset of taste.Config: the engagement
@@ -92,6 +99,76 @@ func ShippedDailyMixWeights() recommendation.ScoringWeights {
 	}
 }

+// ShippedSongsLikeWeights are the shipped songs_like-profile defaults
+// (#3881). The whole point is that SIMILARITY DOMINATES; every other
+// profile balances it against taste and engagement, and this one must not.
+//
+// The failure being corrected, arithmetic from the daily_mix profile that
+// this surface used to share:
+//
+//	unrelated track, liked, not played recently → 1.0 + 2.0 + 1.0 = 4.0
+//	PERFECT similarity match, not liked         → 1.0 + 1.5       = 2.5
+//
+// Liking something outranked sounding like the seed, because LikeBoost (2.0)
+// exceeded SimilarityWeight's entire range (1.5) and TasteWeight (1.5, and
+// seed-independent) matched it outright.
+//
+// THE PROPERTY THESE NUMBERS ENCODE, which is what to preserve if they are
+// retuned: the similarity term's range must exceed the combined range of
+// every seed-INDEPENDENT differentiator, so that a closer match cannot be
+// beaten on the strength of likes, freshness and taste alone.
+//
+//	seed-independent spread = LikeBoost 0.5 + Recency 0.25
+//	                        + Taste 0.25 + ContextTime 0.5
+//	                        + jitter 0.05                  = 1.55
+//	similarity spread       = 0 → 4.0
+//
+// So a similarity advantage of ~0.39 (1.55/4.0) wins outright regardless of
+// everything else, while tracks within that band still get ordered by what
+// the user likes and has not heard lately. Tight, not deaf.
+//
+// BaseWeight stays 1.0: it is identical for every candidate and so
+// differentiates nothing — it sets the floor, not the shape. SkipPenalty
+// stays 2.0 because a track the user skips is still unwanted no matter how
+// similar it is.
+//
+// These are DEFAULTS, not settings (rule 25) — the operator turns them in the
+// admin tuning card and good values get baked back here. They are a
+// defensible starting point rather than a measured optimum: the per-arm fill
+// rates and the real sim_score distribution are still unknown (#3879), and
+// `likes_overlap` contributes a flat 0.6 that a high SimilarityWeight
+// amplifies. Expect to move these once that lands.
+func ShippedSongsLikeWeights() recommendation.ScoringWeights {
+	return recommendation.ScoringWeights{
+		BaseWeight:        1.0,  // same for all candidates; differentiates nothing
+		LikeBoost:         0.5,  // was 2.0 — a tie-break among similar tracks, not an override
+		RecencyWeight:     0.25, // was 1.0 — freshness must not outrank sounding right
+		SkipPenalty:       2.0,  // unchanged — a skipped track stays unwanted
+		JitterMagnitude:   0.05, // was 0.1 — less shuffle on a coherence surface
+		ContextWeight:     0.5,
+		SimilarityWeight:  4.0,  // was 1.5 — dominant, by design
+		TasteWeight:       0.25, // was 1.5 — seed-INDEPENDENT, so demoted hard
+		ContextTimeWeight: 0.5,  // was 1.0
+	}
+}
+
+// shippedWeightsFor returns the shipped defaults for a weight-profile scope,
+// or ok=false if the scope is not a weight profile. Single source for the
+// three call sites (seed, update-validation, reset) so adding a fourth
+// profile cannot be half-wired — which is how a scope ends up seedable but
+// not resettable.
+func shippedWeightsFor(scope string) (recommendation.ScoringWeights, bool) {
+	switch scope {
+	case ScopeRadio:
+		return ShippedRadioWeights(), true
+	case ScopeDailyMix:
+		return ShippedDailyMixWeights(), true
+	case ScopeSongsLike:
+		return ShippedSongsLikeWeights(), true
+	}
+	return recommendation.ScoringWeights{}, false
+}
+
 // DiscoverTuning is the tunable set for the Discover request surface (#2377).
 type DiscoverTuning struct {
 	// TagOverlapWeight scales the taste-tag term: score × (1 + w × overlap).
@@ -165,8 +242,9 @@ func New(ctx context.Context, pool *pgxpool.Pool, logger *slog.Logger) (*Service
 func (s *Service) reconcile(ctx context.Context) error {
 	q := dbq.New(s.pool)
 	for profile, w := range map[string]recommendation.ScoringWeights{
-		ScopeRadio:    ShippedRadioWeights(),
-		ScopeDailyMix: ShippedDailyMixWeights(),
+		ScopeRadio:     ShippedRadioWeights(),
+		ScopeDailyMix:  ShippedDailyMixWeights(),
+		ScopeSongsLike: ShippedSongsLikeWeights(),
 	} {
 		if err := q.UpsertWeightProfileDefaults(ctx, upsertParams(profile, w)); err != nil {
 			return fmt.Errorf("seed profile %q: %w", profile, err)
@@ -234,6 +312,7 @@ func (s *Service) reconcile(ctx context.Context) error {
 // reads Weights(ScopeRadio) per request.
 func (s *Service) push() {
 	playlists.SetSystemMixWeights(s.Weights(ScopeDailyMix))
+	playlists.SetSongsLikeWeights(s.Weights(ScopeSongsLike))
 	playlists.SetTasteConfig(s.TasteConfig())
 }

@@ -297,7 +376,7 @@ type fieldChange struct {
 // Unknown fields and out-of-range values reject the whole patch. A
 // no-op patch (all values equal to current) writes no audit row.
 func (s *Service) UpdateProfile(ctx context.Context, profile string, patch map[string]float64) error {
-	if profile != ScopeRadio && profile != ScopeDailyMix {
+	if _, ok := shippedWeightsFor(profile); !ok {
 		return fmt.Errorf("%w: %q", ErrUnknownScope, profile)
 	}
 	current := s.Weights(profile)
@@ -340,17 +419,18 @@ func (s *Service) UpdateDiscover(ctx context.Context, patch map[string]float64)
 // Reset restores a scope to its shipped defaults, with one audit row
 // carrying the full diff. A scope already at defaults is a no-op.
 func (s *Service) Reset(ctx context.Context, scope string) error {
-	switch scope {
-	case ScopeRadio, ScopeDailyMix:
-		shipped := ShippedRadioWeights()
-		if scope == ScopeDailyMix {
-			shipped = ShippedDailyMixWeights()
-		}
+	if shipped, ok := shippedWeightsFor(scope); ok {
+		// Every weight profile resets the same way; the per-scope defaults
+		// come from one place so a new profile cannot be seedable but not
+		// resettable. This was an if/else over two hard-coded scopes until
+		// songs_like made it three.
 		changes := diffWeights(s.Weights(scope), shipped)
 		if len(changes) == 0 {
 			return nil
 		}
 		return s.persistProfile(ctx, scope, shipped, "reset", changes)
+	}
+	switch scope {
 	case ScopeTaste:
 		shipped := ShippedTasteTuning()
 		changes := diffTaste(s.Taste(), shipped)
@@ -0,0 +1,130 @@
+package recsettings
+
+import (
+	"testing"
+	"time"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/recommendation"
+)
+
+// The bug, reproduced as a ranking: a track that sounds nothing like the seed
+// but which the user liked and has not played lately used to OUTRANK a perfect
+// similarity match. Operator, 2026-09-10: "I was getting a seeming wide variety
+// of music from each one when I was hoping to stay in a certain neighborhood."
+//
+// This is the whole point of the songs_like profile, so it is asserted as
+// BEHAVIOUR — two candidates, which one wins — rather than by checking the
+// weight numbers. Numbers get retuned; this property must survive that.
+//
+// It also pins the contrast: daily_mix is EXPECTED to fail this. If both
+// profiles started ranking the same way, the split would have quietly become
+// pointless and nothing else would notice.
+func TestSongsLikeWeights_SimilarityBeatsAnUnrelatedLikedTrack(t *testing.T) {
+	now := time.Now().UTC()
+	stale := now.Add(-365 * 24 * time.Hour)
+
+	// A perfect similarity match the user has never liked and played recently.
+	// Everything except similarity is working against it.
+	perfectMatch := recommendation.ScoringInputs{
+		SimilarityScore: 1.0,
+		IsGeneralLiked:  false,
+		LastPlayedAt:    &now,
+	}
+	// Nothing to do with the seed, but liked and long unplayed — every
+	// seed-independent term in its favour.
+	unrelatedFavourite := recommendation.ScoringInputs{
+		SimilarityScore: 0.0,
+		IsGeneralLiked:  true,
+		LastPlayedAt:    &stale,
+		TasteMatchScore: 1.0,
+	}
+
+	// Jitter fixed at its midpoint so the comparison is about the weights.
+	noJitter := func() float64 { return 0.5 }
+
+	songsLike := ShippedSongsLikeWeights()
+	matchScore := recommendation.Score(perfectMatch, songsLike, now, noJitter)
+	favScore := recommendation.Score(unrelatedFavourite, songsLike, now, noJitter)
+	if matchScore <= favScore {
+		t.Errorf("songs_like ranks an unrelated liked track (%.3f) at or above a "+
+			"perfect similarity match (%.3f) — the mix will wander", favScore, matchScore)
+	}
+
+	// The contrast that makes the split worth having. If this ever passes,
+	// daily_mix has been tightened into songs_like and one of them is redundant.
+	daily := ShippedDailyMixWeights()
+	dMatch := recommendation.Score(perfectMatch, daily, now, noJitter)
+	dFav := recommendation.Score(unrelatedFavourite, daily, now, noJitter)
+	if dMatch > dFav {
+		t.Errorf("daily_mix now also puts similarity first (%.3f vs %.3f); the two "+
+			"profiles no longer differ, so songs_like is buying nothing", dMatch, dFav)
+	}
+}
+
+// The property the songs_like numbers encode, stated independently of them:
+// the similarity term's range must exceed the combined range of every
+// seed-INDEPENDENT differentiator, so a closer match cannot be beaten on
+// likes, freshness and taste alone.
+//
+// BaseWeight is excluded deliberately — it is identical for every candidate
+// and so differentiates nothing. SkipPenalty is excluded because it only ever
+// pushes a candidate DOWN, and a skipped track should lose however similar.
+func TestSongsLikeWeights_SimilarityOutrangesEverySeedIndependentTerm(t *testing.T) {
+	w := ShippedSongsLikeWeights()
+
+	// TasteMatchScore and ContextAffinityScore are in [-1,+1]; recencyDecay is
+	// in [0,1]; LikeBoost is all-or-nothing.
+	seedIndependent := w.LikeBoost + w.RecencyWeight + w.TasteWeight +
+		w.ContextTimeWeight + w.JitterMagnitude
+
+	if w.SimilarityWeight <= seedIndependent {
+		t.Errorf("SimilarityWeight %.2f does not outrange the seed-independent "+
+			"terms (%.2f) — likes/recency/taste can outvote sounding like the seed",
+			w.SimilarityWeight, seedIndependent)
+	}
+}
+
+// A scope that is seedable but not resettable is the half-wired shape this
+// guards: the profile appears in the admin card, the operator turns a knob,
+// and Reset then 404s on a scope the rest of the service knows about.
+func TestShippedWeightsFor_CoversEveryWeightProfile(t *testing.T) {
+	for _, scope := range []string{ScopeRadio, ScopeDailyMix, ScopeSongsLike} {
+		if _, ok := shippedWeightsFor(scope); !ok {
+			t.Errorf("scope %q has no shipped defaults; it cannot be seeded or reset", scope)
+		}
+	}
+	// Non-weight scopes must NOT resolve here, or Reset would treat the taste
+	// singleton as a weight profile and write nonsense.
+	for _, scope := range []string{ScopeTaste, ScopeDiscover, "nonsense"} {
+		if _, ok := shippedWeightsFor(scope); ok {
+			t.Errorf("scope %q resolved as a weight profile and is not one", scope)
+		}
+	}
+}
+
+// Guards the sync the comment in playlists/system.go asks for: the pre-push
+// literal there must match the shipped defaults here, or a build that has not
+// yet been reconciled ranks differently from one that has.
+func TestShippedSongsLikeWeights_AreDominatedBySimilarity(t *testing.T) {
+	w := ShippedSongsLikeWeights()
+	daily := ShippedDailyMixWeights()
+
+	if w.SimilarityWeight <= daily.SimilarityWeight {
+		t.Errorf("songs_like SimilarityWeight %.2f is not above daily_mix's %.2f",
+			w.SimilarityWeight, daily.SimilarityWeight)
+	}
+	for _, tc := range []struct {
+		name       string
+		songs, day float64
+	}{
+		{"LikeBoost", w.LikeBoost, daily.LikeBoost},
+		{"TasteWeight", w.TasteWeight, daily.TasteWeight},
+		{"RecencyWeight", w.RecencyWeight, daily.RecencyWeight},
+	} {
+		if tc.songs >= tc.day {
+			t.Errorf("songs_like %s (%.2f) is not demoted below daily_mix (%.2f); "+
+				"these are the seed-independent terms that made the mix wander",
+				tc.name, tc.songs, tc.day)
+		}
+	}
+}
@@ -0,0 +1,718 @@
+package server
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+// Guards the version derivation that stamps every build.
+//
+// These assertions used to be impossible to run. The derivation lived inline
+// in release.yml, which triggers only on `main` and on tags — so a mistake in
+// it could not surface until a release was already under way, and its failure
+// mode is silence: a version nobody can compare looks exactly like being up to
+// date, and nobody reports an update they were never offered.
+//
+// Moving it to ci/version.sh made it executable, so this runs on every push
+// that touches the release machinery. That is the whole point of the file; the
+// specific assertions below matter less than the fact that they run at all.
+//
+// The tests EXECUTE the script rather than asserting on its text, so they
+// break when the behaviour changes rather than when the wording does.
+
+// highestOldSchemeCode is the largest versionCode ever shipped under the
+// retired commit-count scheme (v2026.09.09 shipped 1895). Every code the new
+// scheme emits must clear it, or Android would refuse the upgrade as a
+// downgrade and the update channel would be a one-way door.
+const highestOldSchemeCode = 1895
+
+func repoRoot(t *testing.T) string {
+	t.Helper()
+	dir, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for {
+		if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil {
+			return dir
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			t.Fatalf("no go.mod above %s", dir)
+		}
+		dir = parent
+	}
+}
+
+// runVersion executes ci/version.sh with both clocks pinned, so the result is
+// deterministic. Returns the parsed KEY=VALUE output.
+func runVersion(t *testing.T, commitEpoch, nowEpoch string) map[string]string {
+	t.Helper()
+	out, err := versionScript(t, commitEpoch, nowEpoch)
+	if err != nil {
+		t.Fatalf("ci/version.sh failed: %v\n%s", err, out)
+	}
+	parsed := map[string]string{}
+	for _, line := range strings.Split(strings.TrimSpace(out), "\n") {
+		if k, v, ok := strings.Cut(line, "="); ok {
+			parsed[k] = v
+		}
+	}
+	return parsed
+}
+
+func versionScript(t *testing.T, commitEpoch, nowEpoch string) (string, error) {
+	t.Helper()
+	root := repoRoot(t)
+	cmd := exec.Command(filepath.Join(root, "ci", "version.sh"))
+	cmd.Dir = root
+	cmd.Env = append(os.Environ(),
+		"MINSTREL_COMMIT_EPOCH="+commitEpoch,
+		"MINSTREL_NOW_EPOCH="+nowEpoch,
+	)
+	out, err := cmd.CombinedOutput()
+	return string(out), err
+}
+
+func TestVersionName_IsCommitTimeToTheMinute(t *testing.T) {
+	// 2025-09-09T18:48:56Z
+	got := runVersion(t, "1757443736", "1789000920")
+	if want := "2025.09.09.1848"; got["name"] != want {
+		t.Errorf("name = %q, want %q", got["name"], want)
+	}
+}
+
+// HHMM is the segment most likely to be silently mangled, and it only bites
+// for about a tenth of the day — a build just after midnight must emit "0042",
+// never "42". A stripped leading zero shifts the segment by two orders of
+// magnitude and reverses comparisons against every other build that day.
+func TestVersionName_PadsTheMinuteSegment(t *testing.T) {
+	// 2026-09-10T00:42:00Z
+	got := runVersion(t, "1789000920", "1789000920")
+	if want := "2026.09.10.0042"; got["name"] != want {
+		t.Errorf("name = %q, want %q — leading zero lost?", got["name"], want)
+	}
+}
+
+func TestVersionName_DerivesFromCommitNotBuildClock(t *testing.T) {
+	// Same commit, two different build clocks: the NAME must not move, or a
+	// dev build and a main build of one commit would report different strings
+	// and the channel field would stop being the only thing separating them.
+	a := runVersion(t, "1757443736", "1789000920")
+	b := runVersion(t, "1757443736", "1789500000")
+	if a["name"] != b["name"] {
+		t.Errorf("name moved with the build clock: %q vs %q", a["name"], b["name"])
+	}
+	if a["code"] == b["code"] {
+		t.Errorf("code did NOT move with the build clock (%q) — it is not build-derived", a["code"])
+	}
+}
+
+func TestVersionCode_IsMinutesSince2020AndClearsTheOldScheme(t *testing.T) {
+	got := runVersion(t, "1789000920", "1789000920")
+	code, err := strconv.Atoi(got["code"])
+	if err != nil {
+		t.Fatalf("code %q is not an integer: %v", got["code"], err)
+	}
+	if want := (1789000920 - 1577836800) / 60; code != want {
+		t.Errorf("code = %d, want %d", code, want)
+	}
+	if code <= highestOldSchemeCode {
+		t.Errorf("code %d does not clear the retired commit-count scheme (%d) — "+
+			"Android would refuse the upgrade as a downgrade", code, highestOldSchemeCode)
+	}
+	if int64(code) > 2147483647 {
+		t.Errorf("code %d overflows versionCode's int32 ceiling", code)
+	}
+}
+
+// The tag is not chosen, it is the name with a `v`. Anything else reintroduces
+// the mismatch between what a tag claims and what the artifact reports.
+func TestTag_IsTheNameWithAPrefix(t *testing.T) {
+	got := runVersion(t, "1757443736", "1789000920")
+	if want := "v" + got["name"]; got["tag"] != want {
+		t.Errorf("tag = %q, want %q", got["tag"], want)
+	}
+}
+
+// A guard that cannot fail is worse than no guard. These prove the script
+// rejects the shapes it claims to reject, rather than emitting something
+// plausible and letting it ship.
+func TestVersionScript_RejectsUnusableClocks(t *testing.T) {
+	for _, tc := range []struct{ name, commit, now string }{
+		{"unreadable commit timestamp", "notanumber", "1789000920"},
+		{"non-numeric build clock", "1789000920", "abc"},
+		{"build clock before 2020", "1789000920", "1000000000"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			out, err := versionScript(t, tc.commit, tc.now)
+			if err == nil {
+				t.Errorf("script succeeded on %s, output: %s", tc.name, out)
+			}
+		})
+	}
+}
+
+// Pins the wiring, not the formula: if release.yml stops calling the script,
+// every assertion above keeps passing while the thing that actually ships goes
+// unguarded again. That silent decoupling is the specific regression here.
+func TestReleaseWorkflow_UsesTheSharedDerivation(t *testing.T) {
+	body, err := os.ReadFile(filepath.Join(repoRoot(t), ".gitea", "workflows", "release.yml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	yaml := string(body)
+
+	if !strings.Contains(yaml, "ci/version.sh") {
+		t.Error("release.yml no longer calls ci/version.sh — the derivation has drifted out of test coverage")
+	}
+	// The retired scheme, which must not come back. A presence check is safe
+	// against prose; the historical note in that file names the old formula
+	// only in comments, so match the executable form.
+	if strings.Contains(yaml, "$(git rev-list --count") {
+		t.Error("release.yml derives a commit count again — that is not monotonic across branches")
+	}
+}
+
+// jobBoundary matches a blank line followed by job-level (two-space)
+// indentation — the end of the last step in a job.
+var jobBoundary = regexp.MustCompile(`\n\n  [^ \n]`)
+
+// stepBody returns one workflow step's text, from its `- name:` line to the
+// start of the next step or the next job.
+//
+// The naive cut — "up to the next `- name:`" — silently returns an EMPTY body
+// for the last step in a job, and every assertion over it then passes
+// vacuously. That is the failure rule 167 names: a check that reads as
+// coverage while asserting on nothing. Cutting at a blank line followed by
+// job-level indentation handles the last-step case, which is exactly where
+// `Build and push` sits.
+func stepBody(t *testing.T, yaml, name string) string {
+	t.Helper()
+	i := strings.Index(yaml, "- name: "+name)
+	if i < 0 {
+		t.Fatalf("no %q step in release.yml", name)
+	}
+	body := yaml[i:]
+	end := len(body)
+	if j := strings.Index(body, "\n      - name:"); j >= 0 {
+		end = j
+	}
+	// A blank line followed by EXACTLY two spaces and then content starts a
+	// new job or job-level comment. The "exactly" matters: a blank line inside
+	// a `run:` block is followed by ten-space indentation and would otherwise
+	// match, truncating the step mid-body — which is how this helper first
+	// sliced the verify step down to its first two lines.
+	if loc := jobBoundary.FindStringIndex(body); loc != nil && loc[0] < end {
+		end = loc[0]
+	}
+	body = body[:end]
+	if strings.TrimSpace(strings.TrimPrefix(body, "- name: "+name)) == "" {
+		t.Fatalf("step %q sliced to an empty body — the assertions below would pass vacuously", name)
+	}
+	return body
+}
+
+// releaseYAML reads the workflow once per test.
+func releaseYAML(t *testing.T) string {
+	t.Helper()
+	body, err := os.ReadFile(filepath.Join(repoRoot(t), ".gitea", "workflows", "release.yml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(body)
+}
+
+// imageTagArms splits "Compute image tags" into its three ref branches. The
+// whole tag policy lives in that if/elif/else, so the arms are the unit worth
+// asserting on — a tag published from the wrong arm reaches the wrong
+// audience, and every such mistake still builds and still pushes a valid
+// image.
+func imageTagArms(t *testing.T, yaml string) (tagArm, devArm, mainArm string) {
+	t.Helper()
+	const (
+		tagMarker  = `if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then`
+		devMarker  = `elif [[ "${GITHUB_REF}" == "refs/heads/dev" ]]; then`
+		mainMarker = "\n          else"
+		endMarker  = "\n          fi"
+	)
+	iTag := strings.Index(yaml, tagMarker)
+	iDev := strings.Index(yaml, devMarker)
+	iMain := -1
+	if iDev >= 0 {
+		if k := strings.Index(yaml[iDev:], mainMarker); k >= 0 {
+			iMain = iDev + k
+		}
+	}
+	if iTag < 0 || iDev < 0 || iMain < 0 {
+		t.Fatal("Compute image tags no longer has a tag/dev/main arm — the tag policy has been restructured, so these guards are pinning nothing")
+	}
+	iEnd := iMain
+	if k := strings.Index(yaml[iMain:], endMarker); k >= 0 {
+		iEnd = iMain + k
+	} else {
+		t.Fatal("no closing fi after the main arm")
+	}
+	return yaml[iTag:iDev], yaml[iDev:iMain], yaml[iMain:iEnd]
+}
+
+// The worst regression this wiring can produce: a dev push that also moves
+// :latest would ship untested code to every stable operator, silently, on the
+// next pull. Nothing else in the suite would notice — the build stays green
+// and the image is valid, it is simply the wrong audience.
+func TestDevChannel_PublishesDevAloneAndNeverLatest(t *testing.T) {
+	_, arm, _ := imageTagArms(t, releaseYAML(t))
+
+	if !strings.Contains(arm, "${IMAGE}:dev") {
+		t.Errorf("dev arm does not publish :dev\n%s", arm)
+	}
+	if strings.Contains(arm, ":latest") {
+		t.Errorf("dev arm moves :latest — that ships dev code to every stable operator\n%s", arm)
+	}
+	// Rule 145: a rolling channel gets no commit-addressable tag.
+	if strings.Contains(arm, "GITHUB_SHA") {
+		t.Errorf("dev arm publishes a per-commit tag; a rolling channel should not\n%s", arm)
+	}
+}
+
+// The two bundling paths must stay mutually exclusive. If the rebundle step's
+// condition were relaxed back to "not a tag", a dev push would run BOTH: stage
+// its freshly-built APK, then overwrite it with the previous release's. The
+// image would still build and the sidecar would still parse — it would just
+// quietly serve stale art to the channel whose whole job is being current.
+func TestDevChannel_RebundlePathIsMainOnly(t *testing.T) {
+	body, err := os.ReadFile(filepath.Join(repoRoot(t), ".gitea", "workflows", "release.yml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	yaml := string(body)
+
+	i := strings.Index(yaml, "- name: Bundle latest release APK")
+	if i < 0 {
+		t.Fatal("no 'Bundle latest release APK' step")
+	}
+	step := yaml[i:]
+	if j := strings.Index(step, "\n      - name:"); j >= 0 {
+		step = step[:j]
+	}
+	if !strings.Contains(step, "github.ref == 'refs/heads/main'") {
+		t.Errorf("the rebundle step is not gated to main; a dev push would overwrite its own APK\n%s", step)
+	}
+}
+
+// The runner invokes `shell: bash` as `bash -e -o pipefail`. That makes any
+// command substitution whose grep matches NOTHING fatal at the assignment —
+// pipefail reports the grep's non-zero status even though `head` succeeded —
+// so the step dies before reaching the `if` written to handle the empty case.
+//
+// This is not hypothetical. It took down the first `main` build after the
+// version rework: the newest release predated sidecar assets, its
+// `.apk.version` grep matched nothing, and the step aborted instead of
+// falling through to the name-only branch that exists precisely for it. The
+// same latent hazard sat on the other two assignments and had simply never
+// fired, because their greps always matched.
+//
+// Pins the property that makes every "degrades gracefully" branch in that
+// step reachable at all.
+func TestBundleStep_GrepsCannotKillTheStep(t *testing.T) {
+	body, err := os.ReadFile(filepath.Join(repoRoot(t), ".gitea", "workflows", "release.yml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	yaml := string(body)
+
+	i := strings.Index(yaml, "- name: Bundle latest release APK")
+	if i < 0 {
+		t.Fatal("no 'Bundle latest release APK' step")
+	}
+	step := yaml[i:]
+	if j := strings.Index(step, "\n      - name:"); j >= 0 {
+		step = step[:j]
+	}
+
+	for _, line := range strings.Split(step, "\n") {
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(trimmed, "#") || !strings.Contains(trimmed, "grep") {
+			continue
+		}
+		// Only assignments from a command substitution can abort the step.
+		if !strings.Contains(trimmed, `="$(`) {
+			continue
+		}
+		if !strings.HasSuffix(trimmed, "|| true") {
+			t.Errorf("this assignment dies under pipefail when its grep matches nothing, "+
+				"skipping the empty-case branch below it:\n  %s", trimmed)
+		}
+	}
+}
+
+// The rollback unit, and the reason it is worth a guard: it is invisible until
+// the moment it is needed. Nothing pulls :<sha> during normal operation, so if
+// this arm stopped minting one, every build would stay green and every image
+// would be valid — and the absence would surface only during an incident, as
+// "there is nothing to roll back to."
+//
+// Rules 145 and 147: main push → :latest + :<sha>.
+func TestMainChannel_PublishesLatestAndTheRollbackUnit(t *testing.T) {
+	_, _, arm := imageTagArms(t, releaseYAML(t))
+
+	if !strings.Contains(arm, "${IMAGE}:latest") {
+		t.Errorf("main arm does not move :latest — production would stop tracking main's tip\n%s", arm)
+	}
+	if !strings.Contains(arm, "${IMAGE}:${GITHUB_SHA}") {
+		t.Errorf("main arm publishes no commit-addressable image; there is no rollback target for production commits\n%s", arm)
+	}
+	// Rule 147: :latest tracks main's tip, and a second name for the same
+	// image sends readers looking for a distinction that does not exist.
+	if strings.Contains(arm, "${IMAGE}:main") {
+		t.Errorf("main arm publishes :main — rule 147 says that tag should not exist\n%s", arm)
+	}
+}
+
+// A release refreshes the CHANNEL and mints nothing else (rules 145 + 146).
+//
+// The specific regression: re-adding :<sha> here. The tag build rebuilds the
+// SAME SOURCE as main's build minutes earlier, differing only in which APK is
+// baked in — so a :<sha> minted here would overwrite main's immutable rollback
+// target with different contents, under the same name. That is the exact thing
+// rule 145's immutability clause exists to prevent, and it is the half with
+// the incidents behind it.
+func TestReleaseBuild_RefreshesTheChannelAndMintsNothingElse(t *testing.T) {
+	arm, _, _ := imageTagArms(t, releaseYAML(t))
+
+	if !strings.Contains(arm, "${IMAGE}:latest") {
+		t.Errorf("tag arm does not refresh :latest — the channel would keep serving the PREVIOUS release's APK until someone pushed to main\n%s", arm)
+	}
+	if strings.Contains(arm, "GITHUB_SHA") {
+		t.Errorf("tag arm mints a :<sha> image; that would re-push main's immutable rollback target with different bundled contents\n%s", arm)
+	}
+}
+
+// No version-numbered image tags anywhere, on any arm (rule 145, and the
+// operator's 2026-09-10 decision to drop them across every project).
+//
+// Asserted across the whole step rather than per-arm because the mistake this
+// catches is re-adding one ANYWHERE, and the tag arm is only the likeliest
+// spot. `${VERSION}` still legitimately appears in the step as the build's
+// self-reported version, so the assertion has to name the image-tag form
+// specifically rather than the variable — otherwise it would fire on correct
+// code and get "fixed" by deleting the guard.
+func TestNoVersionNumberedImageTags(t *testing.T) {
+	yaml := releaseYAML(t)
+	tagArm, devArm, mainArm := imageTagArms(t, yaml)
+
+	for _, tc := range []struct{ name, arm string }{
+		{"tag", tagArm}, {"dev", devArm}, {"main", mainArm},
+	} {
+		for _, forbidden := range []string{
+			"${IMAGE}:${VERSION}",
+			"${IMAGE}:v",
+			"${IMAGE}:${GITHUB_REF#refs/tags/}",
+		} {
+			if strings.Contains(tc.arm, forbidden) {
+				t.Errorf("%s arm publishes a version-numbered image tag (%q); git and the build's self-reported version answer \"which build is this\"\n%s",
+					tc.name, forbidden, tc.arm)
+			}
+		}
+	}
+}
+
+// The verify job asserted the :<version> image existed. With version tags
+// gone that assertion would fail every release for a tag nothing mints — so
+// this pins that it was re-pointed rather than deleted, since deleting it is
+// the tempting way to make a failing guard go green.
+func TestVerifyJob_ChecksTheRollbackImageNotAVersionTag(t *testing.T) {
+	yaml := releaseYAML(t)
+
+	if !strings.Contains(yaml, "- name: Rollback image must exist for the tagged commit") {
+		t.Fatal("the release-verification step that checks an image exists is gone; an image push that silently did not happen would now pass verification")
+	}
+	step := stepBody(t, yaml, "Rollback image must exist for the tagged commit")
+	if !strings.Contains(step, "${IMAGE}:${GITHUB_SHA}") {
+		t.Errorf("the verify step does not inspect the commit's rollback image\n%s", step)
+	}
+	if strings.Contains(step, "${IMAGE}:${TAG}") {
+		t.Errorf("the verify step still inspects a version-numbered image, which is no longer published — this would fail every release\n%s", step)
+	}
+}
+
+// The server's self-reported version is now the ONLY thing that identifies a
+// build, so a lane that stamps a channel word instead of a version silently
+// removes that ability. It used to stamp the literal "main"/"dev".
+func TestImageBuild_StampsADerivedVersionAndAChannel(t *testing.T) {
+	yaml := releaseYAML(t)
+
+	step := stepBody(t, yaml, "Build and push")
+	for _, want := range []string{
+		"MINSTREL_VERSION=",
+		"MINSTREL_CHANNEL=",
+	} {
+		if !strings.Contains(step, want) {
+			t.Errorf("Build and push does not pass %s — the image cannot report which build it is\n%s", want, step)
+		}
+	}
+
+	// The version must come from the shared derivation, not from the ref.
+	// Reading it off GITHUB_REF is what produced "main" and "dev" as version
+	// strings, which is the regression this pins.
+	_, _, mainArm := imageTagArms(t, yaml)
+	if strings.Contains(mainArm, `version=main`) {
+		t.Errorf("the main arm stamps the literal string \"main\" as a version; two images months apart would be indistinguishable\n%s", mainArm)
+	}
+	if !strings.Contains(yaml, "ci/version.sh HEAD | sed") {
+		t.Error("the image job no longer derives its version from ci/version.sh — the version and the APK's version can now drift apart")
+	}
+}
+
+// gitRepo builds a throwaway repo and returns its path. Commit timestamps are
+// pinned so the derivation is deterministic.
+func gitRepo(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	run := func(args ...string) {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		cmd.Env = append(os.Environ(), "GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_SYSTEM=/dev/null")
+		if out, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("git %v: %v\n%s", args, err, out)
+		}
+	}
+	run("-c", "init.defaultBranch=main", "init", "-q")
+	run("config", "user.email", "t@example.invalid")
+	run("config", "user.name", "t")
+	return dir
+}
+
+// commitFile writes path and commits it with a pinned committer timestamp.
+func commitFile(t *testing.T, dir, path, epoch string) {
+	t.Helper()
+	full := filepath.Join(dir, path)
+	if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	// Content must DIFFER from any earlier write to the same path, or git
+	// records nothing and the commit silently covers fewer files than the
+	// test believes. That is not hypothetical: it made the
+	// source-alongside-test case pass vacuously.
+	if err := os.WriteFile(full, []byte("content @"+epoch+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	for _, args := range [][]string{{"add", "-A"}, {"commit", "-q", "-m", path}} {
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		cmd.Env = append(os.Environ(),
+			"GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_SYSTEM=/dev/null",
+			"GIT_AUTHOR_DATE=@"+epoch+" +0000",
+			"GIT_COMMITTER_DATE=@"+epoch+" +0000",
+		)
+		if out, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("git %v: %v\n%s", args, err, out)
+		}
+	}
+}
+
+// versionIn runs ci/version.sh inside dir, reading real git rather than the
+// pinned-clock override, so the PATHSPEC is what is under test.
+func versionIn(t *testing.T, dir string) (string, error) {
+	t.Helper()
+	cmd := exec.Command(filepath.Join(repoRoot(t), "ci", "version.sh"), "HEAD")
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(),
+		"GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_SYSTEM=/dev/null",
+		"MINSTREL_NOW_EPOCH=1789000920",
+	)
+	out, err := cmd.CombinedOutput()
+	return string(out), err
+}
+
+// The version names what SHIPPED, so a commit that changes nothing shippable
+// must not move it.
+//
+// The failure this prevents is not the cosmetic one. The derivation is a
+// denylist precisely so that new content counts by default: the direction that
+// matters is a changed artifact keeping its OLD version, silently, on a green
+// run. This test pins the cheap half of that (CI-only commits are inert) and,
+// in the same breath, that a source commit still moves it — because a pathspec
+// typo that excluded everything would satisfy the first assertion alone.
+func TestVersionName_IgnoresCommitsThatShipNothing(t *testing.T) {
+	const (
+		shipped = "1757443736" // 2025-09-09T18:48:56Z
+		ciOnly  = "1789000920" // 2026-09-10T00:42:00Z, later
+	)
+	dir := gitRepo(t)
+	commitFile(t, dir, "internal/server/thing.go", shipped)
+	commitFile(t, dir, ".gitea/workflows/release.yml", ciOnly)
+
+	out, err := versionIn(t, dir)
+	if err != nil {
+		t.Fatalf("version.sh failed: %v\n%s", err, out)
+	}
+	if !strings.Contains(out, "name=2025.09.09.1848") {
+		t.Errorf("a CI-only commit moved the version — the pathspec is not excluding it\n%s", out)
+	}
+
+	// ...and the pathspec must not be so broad it excludes everything.
+	commitFile(t, dir, "internal/server/other.go", ciOnly)
+	out, err = versionIn(t, dir)
+	if err != nil {
+		t.Fatalf("version.sh failed: %v\n%s", err, out)
+	}
+	if !strings.Contains(out, "name=2026.09.10.0042") {
+		t.Errorf("a source commit did NOT move the version — the pathspec excludes too much, which is the silent-lie direction\n%s", out)
+	}
+}
+
+// android/ is deliberately NOT excluded, and that is the subtle half of the
+// list. It ships in no server image — but it is the APK's entire source, and
+// ONE script derives the version for both artifacts. Excluding it would stop
+// an Android-only commit from moving the APK's own version, which is exactly
+// the silent downgrade the versioning rework exists to prevent.
+func TestVersionName_AndroidSourcesCount(t *testing.T) {
+	dir := gitRepo(t)
+	commitFile(t, dir, "internal/server/thing.go", "1757443736")
+	commitFile(t, dir, "android/app/src/main/Thing.kt", "1789000920")
+
+	out, err := versionIn(t, dir)
+	if err != nil {
+		t.Fatalf("version.sh failed: %v\n%s", err, out)
+	}
+	if !strings.Contains(out, "name=2026.09.10.0042") {
+		t.Errorf("an Android commit did not move the version; the APK would ship new code under its old version name\n%s", out)
+	}
+}
+
+// No shipped commit in range means a shallow clone, and the script must refuse
+// rather than emit something plausible. A wrong version builds, signs and
+// publishes perfectly happily; it surfaces later as an update channel that has
+// quietly stopped offering anything.
+func TestVersionScript_RefusesWhenNothingShippedIsInRange(t *testing.T) {
+	dir := gitRepo(t)
+	commitFile(t, dir, "ci/version.sh", "1789000920")
+
+	out, err := versionIn(t, dir)
+	if err == nil {
+		t.Fatalf("script succeeded with no shipped commit in range; it should refuse\n%s", out)
+	}
+	if strings.Contains(out, "name=") {
+		t.Errorf("script emitted a version name while refusing — that value could still be consumed\n%s", out)
+	}
+}
+
+// commitFiles is commitFile for more than one path in a single commit.
+func commitFiles(t *testing.T, dir, epoch string, paths ...string) {
+	t.Helper()
+	for _, rel := range paths {
+		full := filepath.Join(dir, rel)
+		if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(full, []byte("content @"+epoch+"\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, args := range [][]string{{"add", "-A"}, {"commit", "-q", "-m", strings.Join(paths, " ")}} {
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		cmd.Env = append(os.Environ(),
+			"GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_SYSTEM=/dev/null",
+			"GIT_AUTHOR_DATE=@"+epoch+" +0000",
+			"GIT_COMMITTER_DATE=@"+epoch+" +0000",
+		)
+		if out, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("git %v: %v\n%s", args, err, out)
+		}
+	}
+}
+
+// gitOutput runs a git command in dir and returns its combined output.
+func gitOutput(t *testing.T, dir string, args ...string) string {
+	t.Helper()
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(), "GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_SYSTEM=/dev/null")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %v: %v\n%s", args, err, out)
+	}
+	return string(out)
+}
+
+// Tests do not ship, so a test-only commit must not re-version an artifact.
+//
+// `go build` drops *_test.go outright and the Vite build never imports a
+// .test.ts, so neither reaches an image or an APK. This repo has no tests/
+// tree — Go tests sit inline beside the code — so the exclusions are globs,
+// and a glob is easy to get subtly wrong in a way that still looks right.
+func TestVersionName_TestsDoNotReVersionTheArtifact(t *testing.T) {
+	const (
+		shipped = "1757443736" // 2025.09.09.1848
+		later   = "1789000920" // 2026.09.10.0042
+	)
+	for _, tc := range []struct{ name, path string }{
+		{"go test beside its source", "internal/server/thing_test.go"},
+		{"web unit test", "web/src/lib/api/admin.test.ts"},
+		{"web script test", "web/scripts/tokens-to-css.test.js"},
+		{"android JVM unit test", "android/app/src/test/java/A.kt"},
+		{"vitest harness config", "web/vitest.config.ts"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := gitRepo(t)
+			commitFile(t, dir, "internal/server/thing.go", shipped)
+			commitFile(t, dir, tc.path, later)
+
+			out, err := versionIn(t, dir)
+			if err != nil {
+				t.Fatalf("version.sh failed: %v\n%s", err, out)
+			}
+			if !strings.Contains(out, "name=2025.09.09.1848") {
+				t.Errorf("a commit touching only %s moved the version; tests do not ship\n%s", tc.path, out)
+			}
+		})
+	}
+}
+
+// The direction that actually costs something, and the reason the exclusions
+// above are globs over FILES rather than over their directories.
+//
+// `':!internal'` would satisfy every assertion in the test above while
+// silently excluding the entire server. This pins the opposite: a commit that
+// changes a test AND the source under it must still move the version, because
+// the source path matches on its own. Without this, a too-broad exclusion
+// reads as a passing test suite and ships an artifact under a stale version.
+func TestVersionName_ATestAlongsideItsSourceStillCounts(t *testing.T) {
+	const (
+		shipped = "1757443736"
+		later   = "1789000920"
+	)
+	dir := gitRepo(t)
+	commitFile(t, dir, "internal/server/thing.go", shipped)
+	commitFiles(t, dir, later,
+		"internal/server/thing.go",
+		"internal/server/thing_test.go",
+	)
+
+	// The commit must actually contain BOTH paths. Rewriting a file with
+	// identical bytes records nothing, and this assertion would then be
+	// checking a test-only commit while appearing to check a mixed one.
+	touched := gitOutput(t, dir, "show", "--name-only", "--format=", "HEAD")
+	for _, want := range []string{"internal/server/thing.go", "internal/server/thing_test.go"} {
+		if !strings.Contains(touched, want) {
+			t.Fatalf("fixture is wrong: HEAD does not contain %s\n%s", want, touched)
+		}
+	}
+
+	out, err := versionIn(t, dir)
+	if err != nil {
+		t.Fatalf("version.sh failed: %v\n%s", err, out)
+	}
+	if !strings.Contains(out, "name=2026.09.10.0042") {
+		t.Errorf("a source change accompanied by a test change did NOT move the version — "+
+			"the exclusions are matching directories rather than test files\n%s", out)
+	}
+}
@@ -160,7 +160,7 @@ func (s *Server) Router() http.Handler {
 		if raErr != nil {
 			s.Logger.Warn("reacquisition settings unavailable; serving defaults", "err", raErr)
 		}
-		lidarrQuar := lidarrquarantine.NewService(s.Pool, lidarrCfg, lidarrClientFn)
+		lidarrQuar := lidarrquarantine.NewService(s.Pool, lidarrCfg, lidarrClientFn, s.DataDir)
 		tracksSvc := tracks.NewService(s.Pool, s.Logger, lidarrUnmonitorAdapter{fn: lidarrClientFn}, s.DataDir)
 		playlistsSvc := playlists.NewService(s.Pool, s.Logger, s.DataDir)
 		smtpSender := mailer.NewSMTPSender(s.Pool, s.Logger.With("component", "mailer"))
@@ -218,6 +218,7 @@ func (s *Server) handleHealthz(w http.ResponseWriter, _ *http.Request) {
 	_ = json.NewEncoder(w).Encode(map[string]string{
 		"status":             "ok",
 		"version":            ServerVersion,
+		"channel":            ServerChannel,
 		"min_client_version": MinClientVersion,
 	})
 }
@@ -5,12 +5,27 @@ package server
 // older clients see version_too_old at /healthz and refuse to operate.
 const MinClientVersion = "0.1.0"

-// ServerVersion is the deployed server image's version tag. Defaults to
-// "dev" for local builds; overridden at link time via:
+// ServerVersion is the build's own version name — YYYY.MM.DD.HHMM, derived
+// from the commit it was built from by ci/version.sh. Defaults to "dev" for
+// local builds; overridden at link time via:
 //
-//	-ldflags="-X 'git.fabledsword.com/bvandeusen/minstrel/internal/server.ServerVersion=v2026.05.10.2'"
+//	-ldflags="-X 'git.fabledsword.com/bvandeusen/minstrel/internal/server.ServerVersion=2026.09.10.1449'"
 //
-// release.yml passes the git tag through MINSTREL_VERSION build-arg →
-// Dockerfile ldflag. Surfaced at /healthz so operators can verify which
-// image their container is running without exec'ing into it.
+// release.yml passes it through the MINSTREL_VERSION build-arg → Dockerfile
+// ldflag. Surfaced at /healthz so operators can verify which image their
+// container is running without exec'ing into it.
+//
+// This carried the literal strings "main" and "dev" until 2026-09-10, which
+// made every image on a channel report the same thing forever. It stopped
+// being cosmetic when :vYYYY.MM.DD.HHMM image tags were retired (family rule
+// 145): this is now the ONLY thing that says which build is running.
 var ServerVersion = "dev"
+
+// ServerChannel is which line this build came off — "stable" or "dev", or
+// "local" for a plain `docker build`.
+//
+// A SIBLING FIELD, never a suffix inside ServerVersion (family rule 149). The
+// same commit built on both lanes reports the same version and differs only
+// here; folding the two together is what makes a version string stop being
+// comparable.
+var ServerChannel = "local"
@@ -1,9 +1,9 @@
-// Package tracks owns the track-level admin actions exposed by the
-// M7 #372 track-actions menu. Today that's RemoveTrack: the destructive
-// part is always handled directly by Minstrel (os.Remove + DB delete +
-// cascade); when the operator opts in via `unmonitor=true` the service
-// also tells Lidarr to flip the track's monitored flag off so Lidarr
-// doesn't search for a replacement.
+// Package tracks owns the track-level admin actions behind DELETE
+// /api/admin/tracks/{id}. Today that's RemoveTrack: the destructive part goes
+// through library.DeleteTrackFile — the one path that deletes a track file —
+// and when the operator opts in via `unmonitor=true` the service also tells
+// Lidarr to flip the track's monitored flag off so Lidarr doesn't search for a
+// replacement.
 //
 // History: an earlier shape (commit 50a231f, since rewritten) routed
 // Lidarr-managed tracks through lidarrquarantine.DeleteViaLidarr — but
@@ -12,6 +12,9 @@
 // drop sibling tracks the operator didn't ask to remove. The current
 // shape per spec revision 723eee9 is "always direct delete; opt-in
 // Lidarr unmonitor for replacement-suppression."
+//
+// The web track-kebab entry that called this was removed in f7278f24; the
+// endpoint was kept deliberately for a safer admin surface to rebind.
 package tracks

 import (
@@ -19,15 +22,14 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
-	"os"

 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/jackc/pgx/v5/pgxpool"

 	"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
-	"git.fabledsword.com/bvandeusen/minstrel/internal/coverart"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/library"
 )

 // ErrNotFound is returned when the track id doesn't resolve. Aliased
@@ -69,10 +71,10 @@ func NewService(pool *pgxpool.Pool, logger *slog.Logger, lidarr LidarrUnmonitore
 	return &Service{pool: pool, logger: logger, lidarr: lidarr, dataDir: dataDir}
 }

-// RemoveTrack deletes the file from disk and the DB rows, runs the
-// album-empty / artist-empty cascade tidy-up, and (when unmonitor is
-// true and the track is Lidarr-managed) tells Lidarr to flip the track's
-// monitored flag off so it won't search for a replacement.
+// RemoveTrack deletes the track's file and then its row, tidies away an album
+// or artist the delete empties, and (when unmonitor is true and the track is
+// Lidarr-managed) tells Lidarr to flip the track's monitored flag off so it
+// won't search for a replacement.
 //
 // Returns:
 //   - deletedAlbumID: non-nil when removing the track left the album
@@ -81,9 +83,10 @@ func NewService(pool *pgxpool.Pool, logger *slog.Logger, lidarr LidarrUnmonitore
 //     empty (only set if deletedAlbumID is also set).
 //   - lidarrUnmonitorFailed: true when the operator requested unmonitor
 //     and the Lidarr call failed; the file + DB delete still succeeded.
-//   - err: only for failures *before* the destructive part completes.
-//     A failed os.Remove is logged and tolerated. A failed Lidarr
-//     unmonitor is reflected in the bool flag, not the error.
+//   - err: ErrNotFound, or a failure before anything was deleted. When the
+//     file cannot be removed it is a *library.FileRemoveError and NOTHING was
+//     deleted — see library.DeleteTrackFile for why that order is the contract
+//     (#3918). A failed Lidarr unmonitor is reflected in the bool, not here.
 //
 // adminID is currently unused — the cascade audit-log line that would
 // reference it isn't wired in this slice. It's threaded through the
@@ -104,10 +107,9 @@ func (s *Service) RemoveTrack(
 		return nil, nil, false, fmt.Errorf("get track: %w", err)
 	}

-	// Capture the album's mbid *before* the cascade-delete transaction.
-	// If removing this track empties the album, DeleteAlbumIfEmpty
-	// removes the row and a post-commit GetAlbumByID would return
-	// pgx.ErrNoRows — leaving the unmonitor walk with no album mbid.
+	// Capture the album's mbid *before* the delete. If removing this track
+	// empties the album, its row is gone afterwards and the unmonitor walk
+	// would have no album mbid to name.
 	var albumMbid string
 	if track.Mbid != nil && *track.Mbid != "" && unmonitor && s.lidarr != nil {
 		alb, alerr := q.GetAlbumByID(ctx, track.AlbumID)
@@ -118,64 +120,14 @@ func (s *Service) RemoveTrack(
 		// "no albumMbid → can't unmonitor → flag failure."
 	}

-	// Always: remove the file. Tolerate already-missing.
-	if track.FilePath != "" {
-		if rerr := os.Remove(track.FilePath); rerr != nil && !errors.Is(rerr, os.ErrNotExist) {
-			s.logger.Warn("track delete: file remove failed",
-				"path", track.FilePath, "track_id", trackID, "err", rerr)
-			// Proceed: DB consistency is the priority.
+	deleted, err := library.DeleteTrackFile(ctx, s.pool, s.logger, s.dataDir, trackID)
+	if err != nil {
+		if errors.Is(err, library.ErrTrackNotFound) {
+			return nil, nil, false, ErrNotFound
 		}
-	}
-
-	// DB cleanup in a transaction so a midway failure leaves things consistent.
-	tx, err := s.pool.Begin(ctx)
-	if err != nil {
-		return nil, nil, false, fmt.Errorf("begin tx: %w", err)
-	}
-	defer func() { _ = tx.Rollback(ctx) }()
-
-	tq := dbq.New(tx)
-
-	deleted, err := tq.DeleteTrack(ctx, trackID)
-	if err != nil {
 		return nil, nil, false, fmt.Errorf("delete track: %w", err)
 	}

-	albumRow, aerr := tq.DeleteAlbumIfEmpty(ctx, deleted.AlbumID)
-	switch {
-	case aerr == nil:
-		albumID := albumRow.ID
-		deletedAlbumID = &albumID
-		artistID, arerr := tq.DeleteArtistIfEmpty(ctx, albumRow.ArtistID)
-		switch {
-		case arerr == nil:
-			id := artistID
-			deletedArtistID = &id
-		case errors.Is(arerr, pgx.ErrNoRows):
-			// Artist still has other albums or stray tracks. OK.
-		default:
-			return nil, nil, false, fmt.Errorf("delete artist if empty: %w", arerr)
-		}
-	case errors.Is(aerr, pgx.ErrNoRows):
-		// Album still has other tracks. OK.
-	default:
-		return nil, nil, false, fmt.Errorf("delete album if empty: %w", aerr)
-	}
-
-	if err := tx.Commit(ctx); err != nil {
-		return nil, nil, false, fmt.Errorf("commit: %w", err)
-	}
-
-	// Cleanup artist-art filesystem cache if the delete cascade orphaned
-	// an artist. Non-fatal — the destructive part is done; we just want
-	// to keep the dataDir tidy.
-	if deletedArtistID != nil && s.dataDir != "" {
-		if err := coverart.CleanupArtistArt(s.dataDir, *deletedArtistID); err != nil {
-			s.logger.Warn("track delete: artist-art cleanup failed",
-				"artist_id", *deletedArtistID, "err", err)
-		}
-	}
-
 	// Lidarr unmonitor — non-fatal. The destructive part is done; any
 	// failure here is informational so the operator can retry manually.
 	if unmonitor && track.Mbid != nil && *track.Mbid != "" && s.lidarr != nil {
@@ -193,5 +145,5 @@ func (s *Service) RemoveTrack(
 		}
 	}

-	return deletedAlbumID, deletedArtistID, lidarrUnmonitorFailed, nil
+	return deleted.AlbumID, deleted.ArtistID, lidarrUnmonitorFailed, nil
 }
@@ -0,0 +1,377 @@
+#!/usr/bin/env python3
+"""Trace the Minstrel logo and emit every brand asset that derives from it.
+
+Run by hand after the source artwork changes, never in CI — it needs potrace
+and Pillow, which the build images don't carry, and its outputs are committed
+(the app must render itself with no outbound network).
+
+    python3 tools/gen-brand-assets.py
+
+Why a generator at all: the mark ships in four places that cannot share one
+file, because each needs a different colour mechanism — currentColor in the
+component, literal fills in mark.svg, a prefers-color-scheme swap in
+favicon.svg, and flattened pixels in the rasters. Hand-copying ~20KB of path
+data four ways is how a silhouette change lands in three of them and not the
+fourth. The paths have one source here instead.
+
+The trace pipeline, and why each step is what it is:
+
+  * Components are separated first (connected-component labelling) so the hat
+    and the note arc can take different fills. Grouping is by component id
+    against the source raster, which is stable as long as SOURCE doesn't move.
+  * Tracing runs on the ORIGINAL antialiased greyscale, upsampled and blurred
+    — not on the binary mask. Tracing the mask supersampled hits 100% IoU by
+    reproducing the pixel staircase exactly: a perfect score for jagged art
+    and a 120KB path. Smoothing first finds a sub-pixel boundary instead,
+    which is 99.74% IoU at 20KB.
+  * potrace reads PBM, where bit 1 is BLACK, so the ink mask is inverted on
+    the way in. Getting this backwards traces the background and still
+    produces a plausible-looking SVG.
+"""
+import re, shutil, subprocess, sys
+from pathlib import Path
+
+import numpy as np
+from PIL import Image, ImageDraw, ImageFilter
+
+ROOT = Path(__file__).resolve().parent.parent
+SOURCE = ROOT / "docs/brand/minstrel-logo-source.png"
+
+PARCHMENT = "#E8E4D8"
+ACCENT = "#4A6B5C"   # --fs-accent; the one row Minstrel overrides
+OBSIDIAN = "#14171A" # plate for rasters — see the contrast note in README
+
+# Component ids from the source raster: the hat body, brim, feather, band and
+# jewel take the text colour; the noteheads and the arc swashes take the accent.
+HAT = [396, 58, 251, 497, 442]
+NOTES = [31, 207, 30, 247, 317, 135, 78, 161, 186, 107, 215]
+FRAME = [1]  # the source's rounded-rect border — deliberately NOT traced: an
+             # adaptive icon gets masked to the launcher's own shape, so a
+             # baked border would be clipped raggedly, and at header size it
+             # is noise around a mark that is already busy.
+
+SUPERSAMPLE, BLUR = 4, 1.5
+POTRACE = ["-s", "--flat", "-a", "1.334", "-O", "0.2", "-u", "4", "-t", "20"]
+
+
+def components(gray):
+    """Label 8-connected runs of ink. Two-pass union-find; no scipy here."""
+    ink = gray > 128
+    H, W = ink.shape
+    parent, labels, nxt = {}, np.zeros((H, W), np.int32), 1
+
+    def find(x):
+        r = x
+        while parent[r] != r:
+            r = parent[r]
+        while parent[x] != r:
+            parent[x], x = r, parent[x]
+        return r
+
+    for y in range(H):
+        if not ink[y].any():
+            continue
+        prev = labels[y - 1] if y else None
+        for x in np.nonzero(ink[y])[0]:
+            nb = [labels[y, x - 1]] if x and labels[y, x - 1] else []
+            if y:
+                nb += [prev[xx] for xx in (x - 1, x, x + 1) if 0 <= xx < W and prev[xx]]
+            if nb:
+                m = min(nb)
+                labels[y, x] = m
+                for n in nb:
+                    rm, rn = find(m), find(n)
+                    if rm != rn:
+                        parent[max(rm, rn)] = min(rm, rn)
+            else:
+                parent[nxt] = nxt
+                labels[y, x] = nxt
+                nxt += 1
+    flat = np.array([0] + [find(i) for i in range(1, nxt)], np.int32)
+    return flat[labels]
+
+
+def trace(labels, gray, ids, tmp):
+    keep = np.isin(labels, ids)
+    # Dilate the group mask so the component's own antialiased fringe survives;
+    # thresholding a hard-cut mask would shave a half-pixel off every edge.
+    grown = Image.fromarray((keep * 255).astype(np.uint8)).filter(ImageFilter.MaxFilter(5))
+    img = Image.fromarray(np.where(np.asarray(grown), gray, 0.0).astype(np.uint8))
+    H, W = labels.shape
+    img = img.resize((W * SUPERSAMPLE, H * SUPERSAMPLE), Image.BICUBIC)
+    img = img.filter(ImageFilter.GaussianBlur(BLUR))
+    img.point(lambda p: 0 if p > 128 else 255).convert("1", dither=Image.NONE).save(tmp / "g.pbm")
+    subprocess.run(["potrace", *POTRACE, str(tmp / "g.pbm"), "-o", str(tmp / "g.svg")], check=True)
+    s = (tmp / "g.svg").read_text()
+    return (" ".join(re.findall(r'<path d="([^"]+)"', s)),
+            re.search(r'<g transform="([^"]+)"', s).group(1))
+
+
+def wrap(d, width=78, indent=" " * 6):
+    """Re-wrap path data so diffs stay reviewable instead of one endless line."""
+    out, line = [], ""
+    for tok in d.split():
+        if len(line) + len(tok) + 1 > width:
+            out.append(line)
+            line = tok
+        else:
+            line = f"{line} {tok}".strip()
+    out.append(line)
+    return ("\n" + indent).join(out)
+
+
+# ---------------------------------------------------------------------------
+# The reduced mark, for small sizes.
+#
+# NOT a simplification of the traced art — that was tried and does not work.
+# The source composition is dominated by a long diagonal plume, so every
+# mechanical reduction of it (hole-filling, morphological smoothing, dropping
+# components) collapses at 16px into a diagonal smear that reads as no object
+# at all. What reads at that size is a strong horizontal brim under a leaning
+# crown, which has to be DRAWN rather than derived.
+#
+# So this is hand-authored geometry, tuned against the real thing: the crown
+# peaks left of centre with a long right flank, the brim rides up at the right
+# tip, and a band slit keeps crown and brim from fusing into one lump. It is a
+# family member of the full mark, not a copy of it.
+# ---------------------------------------------------------------------------
+
+RN = 640  # design-space square for the reduced mark
+
+
+def _bez(pts, n=60):
+    """Sample a chain of cubic beziers given as [P0, C1,C2,P1, C1,C2,P2, ...]."""
+    out = [pts[0]]
+    for i in range(1, len(pts), 3):
+        p0, (c1, c2, p1) = out[-1], pts[i:i + 3]
+        for t in np.linspace(0, 1, n)[1:]:
+            u = 1 - t
+            out.append((u**3 * p0[0] + 3*u*u*t * c1[0] + 3*u*t*t * c2[0] + t**3 * p1[0],
+                        u**3 * p0[1] + 3*u*u*t * c1[1] + 3*u*t*t * c2[1] + t**3 * p1[1]))
+    return out
+
+
+def _reduced(plume):
+    """The reduced hat. plume=False gives crown+brim only; the plume is taken
+    as the difference between the two so it can be filled separately."""
+    im = Image.new("L", (RN, RN), 0)
+    d = ImageDraw.Draw(im)
+    by = 336
+    # Brim: the single strongest horizontal in the mark, and the shape that
+    # says "hat" at 16px, so it stays thick and unbroken end to end.
+    rt = by - 74
+    d.polygon(_bez([(38, by + 10),
+                    (150, by - 58), (430, by - 72), (590, rt),
+                    (614, rt + 10), (610, rt + 40), (586, rt + 54),
+                    (450, by + 56), (150, by + 58), (38, by + 30),
+                    (22, by + 26), (22, by + 16), (38, by + 10)]), fill=255)
+    # Crown: peak pushed left of centre with a long right flank — the lean is
+    # what keeps this recognisably the same hat as the traced one.
+    px, top = 260, by - 256
+    d.polygon(_bez([(190, by + 16),
+                    (182, by - 96), (px - 92, top + 66), (px - 40, top + 10),
+                    (px - 6, top - 14), (px + 44, top + 10), (px + 62, top + 56),
+                    (px + 108, top + 150), (422, by - 120), (440, by - 34),
+                    (448, by - 4), (424, by + 18), (190, by + 16)]), fill=255)
+    if plume:
+        # A pointed leaf, deliberately short: a long thin plume is exactly what
+        # turns the whole mark into a diagonal bar at small sizes.
+        d.polygon(_bez([(404, by - 158),
+                        (466, by - 240), (546, by - 296), (586, by - 310),
+                        (580, by - 270), (532, by - 196), (458, by - 132)]), fill=255)
+    a = np.asarray(im) > 128
+    # Band slit: across the crown base only. Never across the brim — breaking
+    # the brim costs more legibility than the band gap buys.
+    g = Image.new("L", (RN, RN), 0)
+    ImageDraw.Draw(g).polygon(_bez([(192, by - 30),
+                                    (256, by - 50), (376, by - 54), (438, by - 58),
+                                    (446, by - 32), (300, by - 26), (192, by - 6)]), fill=255)
+    return a & ~(np.asarray(g) > 128)
+
+
+def trace_reduced(tmp):
+    """Trace the reduced hat and plume as two fills, on one shared viewBox."""
+    full, hat_only = _reduced(True), _reduced(False)
+    plume_only = full & ~hat_only
+    ys, xs = np.nonzero(full)
+    pad = 8
+    box = (xs.min() - pad, ys.min() - pad, xs.max() + pad, ys.max() + pad)
+
+    def one(mask, name):
+        # Ink BRIGHT here, matching what trace() feeds potrace: the point()
+        # below is what inverts to PBM's ink-is-black. Passing an already-dark
+        # mask double-inverts and silently traces the background instead.
+        img = Image.fromarray((mask * 255).astype(np.uint8))
+        img = img.resize((RN * SUPERSAMPLE, RN * SUPERSAMPLE), Image.BICUBIC)
+        img = img.filter(ImageFilter.GaussianBlur(BLUR))
+        img.point(lambda p: 0 if p > 128 else 255).convert("1", dither=Image.NONE).save(tmp / f"{name}.pbm")
+        subprocess.run(["potrace", *POTRACE, str(tmp / f"{name}.pbm"), "-o", str(tmp / f"{name}.svg")], check=True)
+        s = (tmp / f"{name}.svg").read_text()
+        return (" ".join(re.findall(r'<path d="([^"]+)"', s)),
+                re.search(r'<g transform="([^"]+)"', s).group(1))
+
+    hat_d, tr = one(hat_only, "rhat")
+    plume_d, _ = one(plume_only, "rplume")
+    S = SUPERSAMPLE
+    vb = f"{box[0]*S} {box[1]*S} {(box[2]-box[0])*S} {(box[3]-box[1])*S}"
+    return hat_d, plume_d, tr, vb
+
+
+def svg_doc(vb, tr, hat_fill, notes_fill, hat_d, notes_d, style="", head=""):
+    return (f'<svg xmlns="http://www.w3.org/2000/svg" viewBox="{vb}">\n'
+            f'{head}{style}'
+            f'  <g transform="{tr}" fill-rule="evenodd">\n'
+            f'    <path fill="{hat_fill}" d="{wrap(hat_d)}"/>\n'
+            f'    <path fill="{notes_fill}" d="{wrap(notes_d)}"/>\n'
+            f'  </g>\n</svg>\n')
+
+
+def rasterize(svg_path, out, px, plate=None, radius_frac=0.0, art_frac=1.0):
+    """Render the mark to a PNG, optionally on a rounded plate.
+
+    Rasters carry their own background because a PNG cannot answer to a colour
+    scheme and iOS composites the touch icon onto white regardless. Obsidian
+    rather than the raised iron: the accent clears the 3:1 graphics floor
+    against obsidian (3.04:1) and fails against iron (2.70:1). Lightening the
+    plate makes this worse, not better, because the accent is a dark colour.
+    """
+    art = round(px * art_frac)
+    subprocess.run(["rsvg-convert", "-w", str(art), "-o", str(out), str(svg_path)], check=True)
+    mark = Image.open(out).convert("RGBA")
+    canvas = Image.new("RGBA", (px, px), (0, 0, 0, 0))
+    if plate:
+        r = round(px * radius_frac)
+        layer = Image.new("RGBA", (px, px), (0, 0, 0, 0))
+        ImageDraw.Draw(layer).rounded_rectangle([0, 0, px - 1, px - 1], radius=r, fill=plate)
+        canvas.alpha_composite(layer)
+    canvas.alpha_composite(mark, ((px - mark.width) // 2, (px - mark.height) // 2))
+    canvas.save(out)
+
+
+def main():
+    tmp = ROOT / ".brand-tmp"
+    tmp.mkdir(exist_ok=True)
+    if not SOURCE.exists():
+        sys.exit(f"source artwork missing: {SOURCE}")
+
+    a = np.asarray(Image.open(SOURCE).convert("RGB")).astype(np.float32)
+    gray = 0.299 * a[:, :, 0] + 0.587 * a[:, :, 1] + 0.114 * a[:, :, 2]
+    labels = components(gray)
+
+    hat_d, tr = trace(labels, gray, HAT, tmp)
+    notes_d, _ = trace(labels, gray, NOTES, tmp)
+
+    # Tight viewBox around the traced art (frame excluded), in potrace's user
+    # space, which is source pixels x SUPERSAMPLE.
+    ys, xs = np.nonzero(np.isin(labels, HAT + NOTES))
+    pad = 6
+    x0, x1 = xs.min() - pad, xs.max() + pad
+    y0, y1 = ys.min() - pad, ys.max() + pad
+    S = SUPERSAMPLE
+    vb = f"{x0*S} {y0*S} {(x1-x0)*S} {(y1-y0)*S}"
+    w, h = (x1 - x0) * S, (y1 - y0) * S
+
+    (ROOT / "web/static/brand/mark.svg").write_text(svg_doc(
+        vb, tr, PARCHMENT, ACCENT, hat_d, notes_d,
+        head="  <!-- Generated by tools/gen-brand-assets.py — do not edit by hand.\n"
+             "       Literal colours, for any consumer that cannot inline the SVG and\n"
+             "       therefore cannot supply a currentColor. -->\n"))
+
+    # The reduced mark, for anywhere the full art cannot resolve.
+    rhat_d, rplume_d, rtr, rvb = trace_reduced(tmp)
+
+    (ROOT / "web/static/brand/mark-small.svg").write_text(svg_doc(
+        rvb, rtr, PARCHMENT, ACCENT, rhat_d, rplume_d,
+        head="  <!-- Generated by tools/gen-brand-assets.py — do not edit by hand.\n"
+             "       The reduced mark, literal colours. For use at or below ~24px,\n"
+             "       where the full art collapses into a diagonal smear. -->\n"))
+
+    # Favicon uses the REDUCED mark: a browser tab renders it at 16px, and the
+    # full art is unreadable there. This is the one consumer whose size is not
+    # ours to choose, so it takes the form drawn for that size.
+    (ROOT / "web/static/brand/favicon.svg").write_text(svg_doc(
+        rvb, rtr, "currentColor", ACCENT, rhat_d, rplume_d,
+        head="  <!-- Generated by tools/gen-brand-assets.py — do not edit by hand.\n"
+             "       The REDUCED mark, because a tab renders this at 16px.\n"
+             "       The hat flips with the viewer's scheme because a favicon sits on\n"
+             "       browser chrome we don't control: parchment would vanish on a light\n"
+             "       tab strip, obsidian on a dark one. The plume holds the accent in\n"
+             "       both — teal reads against either (3.04:1 on obsidian, 5.43:1 on\n"
+             "       the light ground). -->\n",
+        style="  <style>\n"
+              f"    svg {{ color: {PARCHMENT}; }}\n"
+              f"    @media (prefers-color-scheme: light) {{ svg {{ color: {OBSIDIAN}; }} }}\n"
+              "  </style>\n"))
+
+    plated = ROOT / ".brand-tmp/plated.svg"
+    plated.write_text(svg_doc(vb, tr, PARCHMENT, ACCENT, hat_d, notes_d))
+
+    # Web rasters: plate radius and art scale measured off the icons these
+    # replace, so the new mark sits where the old one did.
+    for out, px in [("web/static/brand/icon-512.png", 512),
+                    ("web/static/apple-touch-icon.png", 180)]:
+        rasterize(plated, ROOT / out, px, plate=OBSIDIAN, radius_frac=0.20, art_frac=0.88)
+
+    # 32px fallback favicon: reduced art, same reasoning as favicon.svg.
+    plated_small = ROOT / ".brand-tmp/plated-small.svg"
+    plated_small.write_text(svg_doc(rvb, rtr, PARCHMENT, ACCENT, rhat_d, rplume_d))
+    rasterize(plated_small, ROOT / "web/static/favicon.png", 32,
+              plate=OBSIDIAN, radius_frac=0.20, art_frac=0.90)
+
+    # Adaptive icon foreground: transparent, art inside the 66/108dp safe zone
+    # so no launcher mask can clip it. The plate comes from the XML instead.
+    res = ROOT / "android/app/src/main/res"
+    for d, fg, legacy in [("mdpi", 108, 48), ("hdpi", 162, 72), ("xhdpi", 216, 96),
+                          ("xxhdpi", 324, 144), ("xxxhdpi", 432, 192)]:
+        rasterize(plated, res / f"mipmap-{d}/ic_launcher_foreground.png", fg, art_frac=0.58)
+        rasterize(plated, res / f"mipmap-{d}/ic_launcher.png", legacy,
+                  plate=OBSIDIAN, radius_frac=0.20, art_frac=0.88)
+
+    (ROOT / "web/src/lib/components/MinstrelMark.svelte").write_text(
+        COMPONENT.format(vb=vb, tr=tr, w=w, h=h,
+                         hat=wrap(hat_d, indent=" " * 6), notes=wrap(notes_d, indent=" " * 6),
+                         accent=ACCENT))
+
+    print(f"viewBox {vb}  aspect {w/h:.4f}  hat {len(hat_d)/1024:.1f}KB  notes {len(notes_d)/1024:.1f}KB")
+    shutil.rmtree(tmp)
+
+
+COMPONENT = '''<script lang="ts">
+  // The Minstrel mark: a feathered bard's hat with an arc of notes overhead.
+  //
+  // Generated by tools/gen-brand-assets.py — do not edit the paths by hand.
+  // The same silhouette ships in web/static/brand/{{mark,favicon}}.svg and the
+  // Android launcher icons; regenerate all of them together.
+  //
+  // Inlined rather than <img src="mark.svg"> on purpose — an <img> cannot
+  // inherit currentColor, and inheriting it is the whole point: the hat takes
+  // the surrounding text colour, so it reads on both the dark and light
+  // palettes without a second asset. Parchment-on-parchment is invisible,
+  // which is exactly the bug a fixed fill would reintroduce.
+  //
+  // The notes keep the accent in both modes — one of the places the design
+  // system sanctions the accent (the wordmark).
+  //
+  // aria-hidden: every current use sits directly beside the words "Minstrel",
+  // so labelling it would make a screen reader announce the name twice. A
+  // STANDALONE use would need its own label.
+  let {{ size = 28, class: klass = '' }}: {{ size?: number; class?: string }} = $props();
+</script>
+
+<svg
+  viewBox="{vb}"
+  width={{size * {w} / {h}}}
+  height={{size}}
+  class={{klass}}
+  aria-hidden="true"
+  focusable="false"
+>
+  <g transform="{tr}" fill-rule="evenodd">
+    <path fill="currentColor" d="{hat}"/>
+    <path fill="{accent}" d="{notes}"/>
+  </g>
+</svg>
+'''
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,172 @@
+#!/usr/bin/env python3
+"""Download the fonts from Google Fonts and vendor them into the repo.
+
+Covers BOTH clients — the web bundle (woff2, subsetted) and the Android app
+(static ttf, whole-font) — because they draw from the same three families and
+letting them drift is how one of them quietly stops matching the other.
+
+Run by hand when the font set changes, never at build or run time:
+
+    python3 tools/vendor-fonts.py
+
+The app must render itself with no outbound network, so nothing here may
+happen while it is running. This script fetches once, writes the woff2 files
+and a stylesheet that points at them by RELATIVE url, and everything is
+committed. `web/static/` is copied verbatim into the SvelteKit build, which
+Go then embeds — so the fonts travel inside the binary.
+
+Relative urls in the stylesheet (`./Inter-latin.woff2`, not `/fonts/...`)
+are deliberate: a CSS url() resolves against the stylesheet's own address, so
+the whole directory keeps working when the app is served under a base path.
+
+Subsets are kept as Google slices them, with their `unicode-range` intact.
+That is not a size compromise — the browser downloads only the ranges a page
+actually uses, so vendoring every subset costs repository bytes rather than
+request bytes, and a library full of non-English artist names renders instead
+of falling back mid-list.
+"""
+import re
+import struct
+import sys
+import urllib.request
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+OUT = ROOT / "web/static/fonts"
+ANDROID_OUT = ROOT / "android/app/src/main/res/font"
+
+# Matches the faces the design system actually permits: two weights only, 400
+# and 500 (never 600/700), and Fraunces' optical-size axis across its range.
+FAMILIES = (
+    "family=Fraunces:opsz,wght@9..144,400;9..144,500"
+    "&family=Inter:wght@400;500"
+    "&family=JetBrains+Mono:wght@400;500"
+)
+CSS_URL = f"https://fonts.googleapis.com/css2?{FAMILIES}&display=swap"
+
+# The UA is load-bearing, not cosmetic: Google Fonts serves a different FORMAT
+# per client, and there is no parameter to ask for one directly.
+#   modern Chrome -> woff2   (what the browser wants)
+#   old Android   -> ttf     (what Android's res/font requires)
+#   MSIE 6        -> eot     (an IE-only format; the obvious "old UA" choice
+#                             and completely useless here — it downloads and
+#                             looks plausible until you check the magic bytes)
+UA = ("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 "
+      "(KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36")
+UA_TTF = ("Mozilla/5.0 (Linux; U; Android 4.4.2; en-us) AppleWebKit/534.30 "
+          "(KHTML, like Gecko) Version/4.0 Mobile Safari/534.30")
+
+# Android res/font resource names: lowercase, digits and underscore only.
+# Each entry is one static weight — Compose selects by the FontWeight declared
+# alongside it in Typography.kt, so the file must genuinely be that instance.
+# css2 collapses a multi-weight request to 400 for legacy clients, so each
+# weight is fetched on its own URL.
+ANDROID_FACES = [
+    ("fraunces_regular",       "Fraunces:opsz,wght@9..144,400", 400),
+    ("fraunces_medium",        "Fraunces:opsz,wght@9..144,500", 500),
+    ("inter_regular",          "Inter:wght@400",                400),
+    ("inter_medium",           "Inter:wght@500",                500),
+    ("jetbrains_mono_regular", "JetBrains+Mono:wght@400",       400),
+]
+
+TTF_MAGIC = (b"\x00\x01\x00\x00", b"true", b"OTTO")
+
+
+def weight_class(data):
+    """Read OS/2 usWeightClass out of a TrueType file.
+
+    Worth the twenty lines: css2 silently collapses a multi-weight request to
+    400 for legacy clients, so asking for Medium and getting Regular is a real
+    and quiet failure. The file downloads, has valid TrueType magic, and
+    renders — just at the wrong weight, everywhere, forever. This is the only
+    field that actually distinguishes them.
+    """
+    count = struct.unpack(">H", data[4:6])[0]
+    for i in range(count):
+        off = 12 + i * 16
+        if data[off:off + 4] == b"OS/2":
+            table = struct.unpack(">I", data[off + 8:off + 12])[0]
+            return struct.unpack(">H", data[table + 4:table + 6])[0]
+    return None
+
+
+def fetch(url, timeout=30, ttf=False):
+    req = urllib.request.Request(url, headers={"User-Agent": UA_TTF if ttf else UA})
+    with urllib.request.urlopen(req, timeout=timeout) as r:
+        return r.read()
+
+
+def vendor_android():
+    """Fetch static TTFs for the Android client's res/font."""
+    ANDROID_OUT.mkdir(parents=True, exist_ok=True)
+    for old in ANDROID_OUT.glob("*.ttf"):
+        old.unlink()
+    total = 0
+    for name, spec, want_weight in ANDROID_FACES:
+        css = fetch(f"https://fonts.googleapis.com/css2?family={spec}", ttf=True).decode()
+        url = re.search(r"url\((https://[^)]+)\)", css)
+        if not url:
+            sys.exit(f"no font url for {spec}")
+        data = fetch(url.group(1), ttf=True)
+        # Assert the FORMAT, because every wrong one still downloads happily
+        # and only fails later, on a device, as a silently missing typeface.
+        if not data.startswith(TTF_MAGIC):
+            sys.exit(f"{name}: expected TrueType, got magic {data[:4].hex()} "
+                     f"(eot/woff means the UA negotiation broke)")
+        got = weight_class(data)
+        if got != want_weight:
+            sys.exit(f"{name}: wanted weight {want_weight}, file reports {got} "
+                     f"(css2 collapsed the request to a single weight)")
+        (ANDROID_OUT / f"{name}.ttf").write_bytes(data)
+        total += len(data)
+        print(f"  {name + '.ttf':<30} {len(data)/1024:7.1f} KB  weight {got}")
+    print(f"{len(ANDROID_FACES)} ttf, {total/1024/1024:.2f} MB total -> "
+          f"{ANDROID_OUT.relative_to(ROOT)}")
+
+
+def main():
+    css = fetch(CSS_URL).decode()
+
+    # Google emits a comment naming each subset before its @font-face block.
+    blocks = re.split(r"(?=/\*\s*[a-z0-9-]+\s*\*/)", css)
+    OUT.mkdir(parents=True, exist_ok=True)
+    for old in OUT.glob("*.woff2"):
+        old.unlink()
+
+    out_css, seen, total = [], {}, 0
+    for block in blocks:
+        subset = re.search(r"/\*\s*([a-z0-9-]+)\s*\*/", block)
+        family = re.search(r"font-family:\s*'([^']+)'", block)
+        weight = re.search(r"font-weight:\s*([^;]+);", block)
+        url = re.search(r"url\((https://[^)]+\.woff2)\)", block)
+        if not (subset and family and url):
+            continue
+        w = weight.group(1).strip().replace(" ", "-") if weight else "400"
+        name = f"{family.group(1).replace(' ', '')}-{w}-{subset.group(1)}.woff2"
+        if name not in seen:
+            data = fetch(url.group(1))
+            (OUT / name).write_bytes(data)
+            seen[name] = len(data)
+            total += len(data)
+        out_css.append(block.replace(url.group(1), f"./{name}"))
+
+    header = (
+        "/* Generated by tools/vendor-fonts.py — do not edit by hand.\n"
+        " *\n"
+        " * Vendored from Google Fonts and served from our own origin: the app\n"
+        " * has to render with no outbound network, so a font provider link is\n"
+        " * not an option. Urls are relative so this keeps working under a base\n"
+        " * path. unicode-range is preserved, so the browser still fetches only\n"
+        " * the subsets a page needs.\n"
+        " */\n"
+    )
+    (OUT / "fonts.css").write_text(header + "".join(out_css))
+    for n, size in sorted(seen.items()):
+        print(f"  {n:<44} {size/1024:7.1f} KB")
+    print(f"{len(seen)} files, {total/1024/1024:.2f} MB total -> {OUT.relative_to(ROOT)}")
+    print()
+    vendor_android()
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -3,7 +3,7 @@
  <head>
    <meta charset="utf-8" />
    <!--
-      SVG first: it flips the M with the viewer's colour scheme, which the PNG
+      SVG first: it flips the hat with the viewer's colour scheme, which the PNG
      can't. The PNG is the fallback for browsers without SVG-favicon support
      and is plated for the same reason apple-touch-icon is — see brand/.
      Ordering matters: browsers take the last icon they understand, so the
@@ -30,12 +30,12 @@
        }
      })();
    </script>
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link
-      rel="stylesheet"
-      href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400;9..144,500&family=Inter:wght@400;500&family=JetBrains+Mono:wght@400;500&display=swap"
-    />
+    <!-- Fonts are vendored into web/static/fonts by tools/vendor-fonts.py and
+         served from our own origin. A deployed instance has no outbound
+         network, so a provider stylesheet would simply never arrive and the
+         UI would render in fallback faces — hence no font-provider link and
+         no preconnect to a host we don't run. -->
+    <link rel="stylesheet" href="%sveltekit.assets%/fonts/fonts.css" />
    %sveltekit.head%
    <!-- MINSTREL_TOKENS -->
  </head>
@@ -49,3 +49,37 @@ describe('errMessage', () => {
    expect(result.length).toBeGreaterThan(0);
  });
 });
+
+describe('errMessage detail codes (#3918)', () => {
+  const detail =
+    'Minstrel runs as uid 1000, gid 1000 and cannot delete from /music/A (read-only file system). ' +
+    'The library mount must be writable by that user. Nothing was deleted.';
+
+  test('library_not_writable appends the server message to the copy', () => {
+    expect(errMessage({ code: 'library_not_writable', message: detail })).toBe(
+      `${ERROR_COPY.library_not_writable} ${detail}`
+    );
+  });
+
+  test('file_delete_failed appends the server message to the copy', () => {
+    const msg = 'Could not delete /music/A/01.mp3 (input/output error). Nothing was deleted.';
+    expect(errMessage({ code: 'file_delete_failed', message: msg })).toBe(
+      `${ERROR_COPY.file_delete_failed} ${msg}`
+    );
+  });
+
+  test('a detail code with no message shows the copy alone', () => {
+    expect(errMessage({ code: 'library_not_writable' })).toBe(ERROR_COPY.library_not_writable);
+    expect(errMessage({ code: 'library_not_writable', message: '  ' })).toBe(
+      ERROR_COPY.library_not_writable
+    );
+  });
+
+  // Server messages are usually internal detail. Appending them for every code
+  // would leak things like driver errors into toasts; this pins the scope.
+  test('other codes never carry the server message', () => {
+    expect(errMessage({ code: 'track_not_found', message: 'pgx: no rows in result set' })).toBe(
+      ERROR_COPY.track_not_found
+    );
+  });
+});
@@ -8,11 +8,25 @@ export function errCode(err: unknown): string {
  return (err as { code?: string })?.code ?? 'unknown';
 }

+/**
+ * Codes whose server message carries specifics the operator needs in order to
+ * act — which directory, which uid — that fixed copy cannot say. For these the
+ * message follows the copy (#3918). Kept to a named list on purpose: most
+ * server messages are internal detail and must never reach a toast. Mirrored
+ * in Android's ErrorCopy.
+ */
+const DETAIL_CODES: ReadonlySet<string> = new Set(['library_not_writable', 'file_delete_failed']);
+
 /**
 * Returns user-facing copy for an unknown error value. Looks up the
 * error's code in the error-copy map; falls back to the supplied
 * fallback (default: "Something went wrong.") when the code is unknown.
+ * For a DETAIL_CODES code, the server's message is appended.
 */
 export function errMessage(err: unknown, fallback = 'Something went wrong.'): string {
-  return copyForCode(errCode(err)) ?? fallback;
+  const code = errCode(err);
+  const copy = copyForCode(code) ?? fallback;
+  if (!DETAIL_CODES.has(code)) return copy;
+  const detail = (err as { message?: unknown })?.message;
+  return typeof detail === 'string' && detail.trim() !== '' ? `${copy} ${detail}` : copy;
 }
@@ -34,14 +34,17 @@ export type DiscoverTuning = {
  snooze_days: number;
 };

-export type TuningScope = 'radio' | 'daily_mix' | 'taste' | 'discover';
+export type TuningScope = 'radio' | 'daily_mix' | 'songs_like' | 'taste' | 'discover';
+
+/** The weight-profile scopes, as distinct from the singleton-settings scopes. */
+export type WeightProfileScope = 'radio' | 'daily_mix' | 'songs_like';

 export type TuningSnapshot = {
-  profiles: Record<'radio' | 'daily_mix', WeightProfile>;
+  profiles: Record<WeightProfileScope, WeightProfile>;
  taste: TasteTuning;
  discover: DiscoverTuning;
  shipped: {
-    profiles: Record<'radio' | 'daily_mix', WeightProfile>;
+    profiles: Record<WeightProfileScope, WeightProfile>;
    taste: TasteTuning;
    discover: DiscoverTuning;
  };
@@ -1,57 +1,300 @@
 <script lang="ts">
-  // The Minstrel mark: a Didone M whose right leg is an eighth note.
+  // The Minstrel mark: a feathered bard's hat with an arc of notes overhead.
+  //
+  // Generated by tools/gen-brand-assets.py — do not edit the paths by hand.
+  // The same silhouette ships in web/static/brand/{mark,favicon}.svg and the
+  // Android launcher icons; regenerate all of them together.
  //
  // Inlined rather than <img src="mark.svg"> on purpose — an <img> cannot
-  // inherit currentColor, and inheriting it is the whole point: the letter
-  // takes the surrounding text colour, so it reads on both the dark and light
+  // inherit currentColor, and inheriting it is the whole point: the hat takes
+  // the surrounding text colour, so it reads on both the dark and light
  // palettes without a second asset. Parchment-on-parchment is invisible,
  // which is exactly the bug a fixed fill would reintroduce.
  //
-  // The note keeps the accent in both modes — one of the places the design
+  // The notes keep the accent in both modes — one of the places the design
  // system sanctions the accent (the wordmark).
  //
-  // ⚠ These paths are duplicated in web/static/brand/favicon.svg and
-  // web/static/brand/mark.svg, which need literal colours instead of
-  // currentColor (a favicon has no cascade to inherit from). Change the
-  // silhouette here, change it there.
-  //
  // aria-hidden: every current use sits directly beside the words "Minstrel",
  // so labelling it would make a screen reader announce the name twice. A
  // STANDALONE use would need its own label.
-  let { size = 20, class: klass = '' }: { size?: number; class?: string } = $props();
+  let { size = 28, class: klass = '' }: { size?: number; class?: string } = $props();
 </script>

 <svg
-  viewBox="202 251 902 723"
-  width={size * 902 / 723}
+  viewBox="608 592 3928 3568"
+  width={size * 3928 / 3568}
  height={size}
  class={klass}
  aria-hidden="true"
  focusable="false"
 >
-  <g transform="translate(0,1254) scale(0.1,-0.1)" fill-rule="evenodd">
-    <path fill="currentColor" d="M2252 9878 l3 -152 109 -22 c342 -72 492 -184 538 -405 16 -74 24
-4823 9 -5024 -20 -266 -73 -375 -236 -484 -116 -77 -332 -150 -543 -181 -114
-18 -107 -6 -110 -165 -1 -76 2 -143 7 -148 9 -9 2607 -11 2623 -1 14 9 10
-280 -4 291 -7 5 -49 15 -93 22 -380 60 -638 193 -720 374 -63 136 -59 -12 -61
-2247 -3 1999 -2 2054 15 2015 116 -253 646 -1520 1183 -2825 71 -173 216 -524
-322 -780 206 -494 266 -640 370 -895 97 -237 68 -210 226 -210 l135 0 23 50
-c13 27 95 212 182 410 134 307 747 1685 1015 2285 92 205 726 1599 910 2000
-65 140 126 274 137 297 22 50 52 71 74 52 12 -10 14 -266 14 -1864 l0 -1852
-82 -7 c-347 -29 -716 -203 -973 -460 -710 -712 -343 -1645 650 -1649 453 -2
-892 184 1206 510 193 202 295 397 351 676 l23 112 0 2357 c0 1297 0 2358 1
-2358 12 0 142 -49 179 -67 342 -173 607 -545 715 -1004 85 -361 66 -801 -51
-1215 -43 -151 -40 -173 18 -174 53 0 284 377 396 650 243 590 303 1238 163
-1754 -178 652 -643 1100 -1294 1248 -93 21 -122 22 -716 25 -707 4 -649 12
-696 -90 -15 -34 -78 -172 -140 -307 -593 -1297 -1123 -2469 -1717 -3800 -210
-472 -193 -437 -204 -418 -11 19 -173 423 -630 1568 -214 536 -394 986 -400
-1000 -6 14 -76 187 -156 385 -80 198 -182 452 -228 565 -46 113 -140 346 -209
-518 -205 507 -225 554 -244 568 -14 11 -209 13 -1055 14 l-1038 0 3 -152z"/>
-    <path fill="#4A6B5C" d="M8830 7450 l0 -2582 -32 6 c-517 106 -1064 -47 -1442 -405 -598 -566
-501 -1354 196 -1598 489 -170 1134 -19 1548 363 234 217 350 418 423 736 l22
-95 3 2373 c2 1961 5 2372 16 2372 27 0 132 -41 205 -81 315 -169 569 -524 675
-944 50 -198 60 -285 60 -525 0 -288 -27 -487 -105 -756 -34 -120 -35 -130
-11 -143 33 -18 64 11 154 144 227 334 402 795 469 1235 37 238 34 646 -4 843
-149 761 -637 1271 -1353 1418 -98 20 -147 23 -466 27 l-358 4 0 -2582z"/>
+  <g transform="translate(0.000000,5016.000000) scale(0.250000,-0.250000)" fill-rule="evenodd">
+    <path fill="currentColor" d="M17412 17089 c-134 -7 -375 -42 -530 -77 -90 -20 -238 -58 -296 -76 -13 -4 -60
+      -19 -104 -32 -44 -14 -90 -28 -102 -32 -60 -21 -156 -55 -206 -75 -31 -12 -72
+      -28 -92 -35 -20 -7 -56 -22 -80 -32 -24 -10 -50 -21 -58 -24 -17 -6 -79 -34 -133
+      -59 -21 -10 -59 -27 -84 -38 -42 -19 -167 -81 -221 -111 -13 -7 -40 -21 -59 -32
+      -35 -18 -44 -23 -169 -97 -371 -217 -625 -419 -799 -637 -69 -87 -107 -141 -152
+      -216 -70 -117 -115 -204 -163 -314 -11 -26 -23 -54 -26 -61 -12 -26 -42 -108 -64
+      -173 -48 -144 -92 -356 -106 -516 -3 -27 -6 -63 -8 -78 -2 -15 -4 -64 -4 -108 0
+      -77 -2 -94 -11 -89 -5 3 -16 39 -29 91 -54 222 -65 467 -32 690 12 78 31 167 48
+      220 40 125 60 175 113 286 25 53 28 61 18 63 -9 2 -145 -92 -227 -157 -25 -20
+      -56 -44 -68 -54 -39 -30 -124 -107 -197 -180 -112 -109 -216 -229 -317 -364 -107
+      -142 -234 -379 -307 -568 -69 -177 -120 -389 -135 -558 -2 -26 -6 -68 -8 -92 -7
+      -80 -4 -224 8 -360 8 -89 28 -204 68 -392 8 -35 32 -125 40 -146 2 -5 8 -27 14
+      -48 6 -21 20 -65 31 -97 10 -33 19 -62 19 -64 0 -8 -17 11 -34 37 -33 51 -118
+      211 -158 298 -46 100 -102 256 -134 373 -56 211 -78 413 -67 635 4 78 17 180 30
+      241 12 51 -5 41 -49 -31 -16 -25 -33 -52 -38 -60 -65 -100 -169 -296 -217 -408
+      -42 -98 -90 -228 -118 -324 -37 -125 -87 -343 -103 -452 -22 -157 -30 -269 -30
+      -446 0 -178 6 -273 26 -406 2 -14 8 -54 12 -88 8 -58 49 -272 63 -326 21 -87 73
+      -265 94 -324 11 -31 29 -85 41 -120 12 -35 29 -83 38 -106 9 -23 24 -62 34 -86
+      22 -56 49 -122 69 -168 9 -19 15 -37 14 -40 -3 -5 -26 22 -62 74 -17 25 -41 60
+      -52 76 -21 30 -118 181 -134 208 -4 8 -21 35 -36 61 -37 60 -133 247 -170 329
+      -54 123 -107 261 -131 345 -7 23 -10 29 -16 29 -9 0 -10 -3 -16 -68 -16 -187 -15
+      -298 4 -473 14 -124 47 -294 94 -485 25 -97 27 -106 83 -274 57 -173 84 -249 124
+      -348 16 -41 41 -103 55 -138 14 -35 45 -105 68 -156 24 -51 49 -106 57 -124 39
+      -87 106 -217 205 -398 25 -45 53 -98 63 -117 11 -19 21 -36 23 -37 7 -4 221 -3
+      225 1 2 3 6 20 7 40 2 19 6 44 8 55 2 11 5 31 6 44 1 13 6 49 10 80 4 31 12 83
+      16 116 18 132 52 331 112 658 4 23 13 73 20 110 19 101 46 237 66 330 10 45 22
+      99 26 120 20 91 35 161 48 214 15 62 33 136 40 162 4 14 21 79 37 144 17 65 35
+      134 40 154 6 20 18 63 27 96 36 134 103 348 152 486 14 39 32 90 40 114 9 24 23
+      65 32 90 9 25 24 66 32 90 8 24 24 65 34 90 10 25 28 72 40 104 26 70 43 112 119
+      292 9 21 20 48 25 60 5 12 20 46 33 76 157 352 355 737 536 1042 76 127 135 224
+      149 246 8 12 22 36 32 52 123 215 410 628 606 872 180 225 306 368 466 528 173
+      173 333 313 513 449 72 55 91 67 91 58 0 -6 -8 -14 -123 -135 -81 -86 -168 -183
+      -283 -316 -135 -156 -335 -426 -496 -668 -81 -123 -202 -319 -270 -441 -21 -36
+      -52 -91 -70 -123 -52 -91 -166 -313 -209 -408 -22 -47 -48 -101 -57 -120 -9 -19
+      -25 -54 -36 -78 -17 -39 -35 -79 -99 -224 -9 -20 -23 -54 -32 -76 -23 -55 -65
+      -155 -87 -208 -19 -46 -48 -118 -80 -202 -10 -27 -27 -70 -36 -94 -10 -24 -29
+      -76 -44 -116 -15 -40 -30 -81 -34 -92 -4 -11 -15 -42 -24 -68 -9 -26 -19 -54 -22
+      -62 -6 -15 -26 -74 -50 -144 -8 -25 -23 -69 -33 -98 -30 -86 -124 -379 -151 -472
+      -9 -31 -26 -87 -38 -124 -12 -37 -27 -89 -34 -114 -7 -25 -19 -66 -26 -90 -7 -24
+      -17 -59 -22 -78 -9 -34 -28 -101 -47 -164 -5 -19 -15 -54 -21 -78 -13 -51 -28
+      -105 -48 -180 -5 -18 -16 -59 -24 -92 -8 -33 -21 -81 -28 -106 -24 -87 -61 -229
+      -92 -358 -11 -44 -25 -98 -30 -120 -21 -80 -86 -345 -94 -380 -12 -52 -17 -75
+      -38 -158 -21 -87 -35 -147 -44 -186 -15 -67 -47 -211 -54 -244 -5 -20 -12 -50
+      -16 -68 -24 -105 -33 -145 -42 -188 -6 -26 -13 -60 -16 -74 -9 -41 -19 -101 -20
+      -116 0 -14 0 -14 58 -43 32 -16 61 -29 65 -29 4 0 23 24 52 67 55 80 95 133 200
+      257 108 129 221 243 347 350 20 18 47 41 60 51 12 11 45 37 74 59 29 22 65 50 80
+      61 34 26 135 97 182 128 19 12 58 38 88 57 30 19 63 41 74 48 11 7 39 25 62 39
+      77 49 110 70 192 127 45 31 89 61 96 66 22 15 121 95 164 132 57 50 156 149 208
+      209 57 64 151 193 193 263 31 51 38 68 34 73 -2 1 -43 -18 -92 -42 -49 -24 -100
+      -48 -113 -54 -79 -34 -112 -48 -148 -60 -86 -31 -283 -95 -338 -111 -32 -8 -91
+      -25 -132 -37 -78 -21 -317 -101 -398 -133 -26 -10 -64 -24 -84 -32 -20 -7 -48
+      -19 -64 -25 -26 -12 -46 -17 -46 -10 0 4 12 13 74 60 87 65 101 74 216 143 99 59
+      294 161 394 205 71 32 147 67 236 111 17 8 51 24 76 35 122 54 319 160 433 235
+      150 97 274 196 384 307 124 125 209 240 286 385 20 38 53 108 63 136 3 8 13 37
+      24 66 31 84 61 193 72 263 6 38 6 47 -2 47 -1 0 -17 -12 -34 -26 -39 -32 -127
+      -96 -175 -127 -110 -72 -280 -155 -429 -211 -42 -15 -181 -58 -260 -79 -162 -43
+      -418 -79 -644 -91 -105 -5 -130 -5 -130 2 0 7 16 12 67 24 176 40 443 130 669
+      225 93 39 268 127 356 178 62 36 198 123 240 155 263 195 443 402 602 694 52 97
+      104 228 139 354 15 53 36 152 51 246 20 123 31 317 18 322 -8 4 -15 -1 -29 -19
+      -26 -33 -92 -101 -137 -141 -107 -96 -288 -218 -431 -290 -49 -24 -149 -71 -169
+      -78 -8 -3 -27 -11 -44 -18 -16 -7 -34 -14 -40 -16 -5 -2 -23 -8 -38 -14 -67 -25
+      -143 -50 -206 -68 -10 -3 -46 -13 -80 -23 -63 -19 -115 -32 -186 -47 -22 -5 -55
+      -12 -74 -16 -19 -4 -47 -10 -62 -14 -15 -3 -44 -8 -64 -10 -20 -3 -57 -8 -82 -12
+      -63 -10 -80 -12 -80 -8 0 6 15 16 42 26 15 6 56 24 90 40 34 16 91 42 126 57 95
+      42 300 147 399 205 152 88 190 110 293 178 197 129 349 246 490 379 139 129 221
+      225 306 357 159 244 256 534 310 924 3 26 7 50 26 174 6 42 19 112 34 187 15 78
+      53 213 83 299 31 89 67 168 120 268 100 185 247 349 415 460 53 35 163 86 230
+      106 62 19 57 22 -74 46 -83 15 -107 18 -190 24 -69 5 -270 7 -340 3z M10962
+      13252 c-22 -4 -51 -10 -64 -14 -13 -4 -38 -11 -56 -17 -141 -42 -381 -164 -597
+      -303 -12 -8 -31 -21 -44 -29 -71 -45 -259 -181 -345 -250 -207 -164 -321 -263
+      -550 -480 -94 -88 -287 -283 -354 -358 -17 -18 -70 -76 -120 -130 -94 -102 -172
+      -190 -256 -287 -27 -32 -62 -72 -78 -90 -16 -18 -61 -70 -100 -116 -155 -182
+      -267 -303 -416 -450 -127 -125 -183 -178 -212 -202 -13 -11 -37 -32 -54 -46 -74
+      -65 -108 -89 -108 -76 0 4 31 51 70 104 14 19 37 52 52 74 15 22 54 76 87 119 53
+      72 67 95 55 95 -6 0 -79 -23 -140 -45 -239 -85 -448 -207 -599 -353 -44 -41 -107
+      -111 -146 -160 -57 -73 -143 -211 -203 -330 -41 -80 -115 -241 -150 -326 -8 -20
+      -20 -47 -26 -60 -26 -56 -106 -258 -163 -412 -34 -92 -132 -383 -161 -476 -72
+      -235 -91 -299 -115 -394 -42 -157 -53 -203 -67 -268 -6 -27 -12 -56 -14 -64 -6
+      -23 -16 -77 -16 -88 0 -12 23 -34 74 -67 71 -47 136 -74 276 -115 176 -51 387
+      -77 708 -86 153 -5 357 -1 476 8 26 2 76 6 110 8 139 9 375 34 504 54 21 3 57 9
+      80 12 82 11 129 18 197 30 38 7 78 14 90 16 11 2 36 6 54 10 18 3 57 11 87 16 63
+      12 227 46 290 61 78 17 195 45 246 58 28 6 60 14 72 17 25 6 134 36 382 104 37
+      10 76 21 86 24 41 11 281 85 380 116 250 79 681 228 878 302 54 20 195 73 344
+      128 48 18 107 40 131 48 24 9 47 18 51 21 5 3 21 26 37 51 16 25 53 78 81 118 87
+      122 116 167 147 231 54 109 73 181 73 281 0 90 -6 109 -96 298 -78 165 -170 375
+      -229 524 -37 93 -108 303 -133 394 -36 130 -85 346 -102 446 -23 143 -30 193 -34
+      242 -2 29 -6 77 -8 108 -8 91 -5 301 4 414 16 192 38 322 90 528 34 136 90 308
+      130 399 32 75 95 200 116 235 9 14 16 28 16 32 0 10 -27 41 -100 116 -105 107
+      -159 150 -247 193 -114 58 -250 78 -371 57z m-574 -653 c0 -3 -11 -19 -24 -35
+      -56 -66 -193 -249 -280 -372 -11 -16 -37 -53 -58 -82 -36 -52 -121 -175 -270
+      -396 -75 -111 -134 -197 -180 -262 -11 -16 -37 -53 -56 -82 -20 -29 -50 -72 -68
+      -96 -17 -24 -51 -71 -75 -104 -23 -33 -53 -73 -67 -90 -13 -16 -45 -57 -70 -90
+      -25 -33 -54 -71 -66 -84 -11 -14 -36 -44 -56 -68 -211 -257 -378 -416 -712 -676
+      -202 -158 -451 -314 -678 -427 -89 -44 -108 -51 -108 -43 0 6 60 71 172 186 36
+      37 101 106 144 152 43 46 93 99 110 118 35 36 141 155 190 212 17 19 46 53 66 75
+      106 116 265 304 348 409 22 28 50 62 62 76 23 26 112 138 204 254 45 57 121 152
+      238 294 56 69 157 186 190 222 14 15 39 42 54 60 81 93 266 279 418 420 102 95
+      305 256 444 353 125 86 128 88 128 76z M15278 9526 c-254 -10 -537 -42 -734 -84
+      -25 -6 -76 -16 -112 -24 -36 -8 -77 -17 -90 -20 -13 -3 -40 -9 -60 -14 -53 -12
+      -94 -23 -148 -39 -26 -7 -67 -19 -90 -26 -105 -29 -86 -17 -169 -106 -108 -115
+      -183 -200 -183 -207 0 -3 1 -6 3 -7 2 -1 60 12 129 30 238 60 436 99 672 133 378
+      53 762 62 1100 26 394 -43 669 -112 950 -237 86 -38 120 -56 199 -104 127 -76
+      190 -124 288 -220 56 -55 72 -75 59 -75 -3 0 -36 11 -75 24 -104 35 -245 74 -334
+      92 -333 70 -595 86 -899 56 -432 -43 -871 -187 -1332 -438 -230 -125 -518 -327
+      -752 -525 -121 -103 -206 -178 -288 -255 -42 -39 -93 -86 -112 -104 -177 -163
+      -532 -518 -810 -808 -46 -48 -129 -135 -184 -192 -55 -58 -148 -155 -207 -216
+      -100 -105 -332 -337 -427 -428 -81 -78 -251 -228 -320 -282 -287 -228 -476 -351
+      -804 -523 -150 -78 -582 -266 -840 -365 -243 -93 -485 -179 -676 -241 -74 -24
+      -251 -78 -274 -85 -11 -3 -36 -10 -56 -16 -106 -31 -150 -44 -280 -80 -47 -13
+      -154 -41 -238 -60 -23 -6 -56 -14 -74 -18 -49 -12 -99 -23 -152 -34 -26 -5 -77
+      -16 -113 -24 -67 -15 -315 -60 -391 -72 -24 -4 -62 -10 -84 -14 -52 -10 -236 -33
+      -245 -31 -14 3 25 18 115 45 164 49 282 91 490 173 160 63 238 98 416 183 31 15
+      73 35 93 45 168 79 470 256 681 398 361 243 556 410 872 745 370 392 569 586 811
+      794 96 82 247 200 349 274 154 112 324 220 486 308 97 53 271 133 347 160 36 13
+      31 15 98 -39 67 -55 115 -85 214 -132 36 -17 125 -51 135 -51 14 0 12 8 -3 17
+      -85 50 -155 106 -231 184 -78 80 -123 140 -167 230 -67 131 -93 230 -104 379 -10
+      146 6 266 54 414 47 145 132 289 232 396 80 84 173 154 279 208 60 31 97 45 164
+      64 90 25 155 34 256 34 89 0 130 -5 210 -22 159 -36 312 -120 437 -242 73 -71
+      127 -143 178 -242 24 -45 36 -73 65 -154 9 -25 18 -35 27 -28 4 2 29 20 56 40 28
+      20 52 40 55 45 5 11 -14 67 -52 154 -62 139 -127 230 -246 343 -51 49 -83 74
+      -130 105 -131 85 -243 133 -370 159 -57 12 -167 24 -215 24 -43 0 -151 -9 -193
+      -16 -197 -33 -383 -125 -554 -272 -110 -94 -212 -233 -282 -384 -36 -76 -52 -123
+      -78 -226 -28 -109 -38 -196 -35 -317 2 -72 1 -86 -4 -91 -3 -3 -6 -6 -6 -6 -1 0
+      -28 -10 -97 -35 -24 -9 -67 -24 -96 -35 -126 -45 -218 -78 -238 -86 -12 -5 -27
+      -10 -32 -12 -6 -2 -36 -13 -66 -25 -78 -30 -130 -50 -214 -81 -55 -20 -147 -55
+      -232 -88 -69 -26 -139 -54 -188 -72 -71 -27 -114 -43 -168 -64 -30 -12 -76 -30
+      -102 -40 -80 -31 -85 -33 -194 -76 -58 -23 -124 -48 -146 -56 -22 -8 -73 -28
+      -114 -44 -41 -16 -91 -36 -112 -44 -21 -8 -50 -19 -64 -25 -14 -5 -38 -14 -52
+      -20 -14 -5 -41 -16 -60 -23 -19 -8 -51 -20 -72 -28 -21 -8 -49 -19 -62 -24 -13
+      -5 -46 -18 -74 -28 -27 -10 -65 -25 -84 -32 -19 -7 -47 -18 -62 -24 -15 -6 -36
+      -14 -46 -18 -10 -4 -31 -12 -46 -18 -15 -6 -34 -13 -42 -16 -8 -3 -25 -9 -38 -14
+      -13 -5 -30 -11 -38 -14 -8 -3 -61 -23 -118 -44 -57 -22 -113 -43 -124 -47 -11 -4
+      -69 -25 -128 -47 -59 -22 -118 -43 -130 -48 -18 -7 -73 -27 -198 -72 -11 -4 -35
+      -13 -54 -20 -19 -7 -69 -25 -112 -41 -43 -15 -97 -34 -120 -43 -23 -8 -67 -24
+      -98 -35 -31 -11 -66 -24 -78 -29 -27 -10 -65 -24 -118 -42 -22 -7 -74 -25 -116
+      -40 -42 -15 -91 -32 -110 -38 -19 -6 -47 -16 -64 -22 -16 -6 -61 -21 -98 -34 -37
+      -13 -113 -39 -168 -58 -55 -19 -160 -54 -234 -79 -74 -24 -162 -53 -196 -65 -66
+      -23 -147 -50 -304 -101 -54 -18 -151 -50 -216 -71 -65 -21 -164 -53 -220 -71
+      -224 -70 -333 -103 -388 -119 -32 -9 -81 -24 -110 -33 -59 -18 -258 -73 -362
+      -101 -38 -10 -102 -27 -142 -38 -367 -99 -775 -177 -1038 -196 -98 -8 -291 -7
+      -360 1 -187 23 -313 72 -405 158 -49 46 -73 87 -87 147 -10 40 -10 52 0 100 43
+      209 194 467 432 740 139 159 315 325 508 480 88 71 120 95 250 191 56 41 254 173
+      304 203 16 10 46 29 67 41 41 27 244 142 307 176 172 90 263 134 484 231 46 20
+      129 52 202 78 88 31 137 49 145 54 5 2 18 22 29 45 31 59 73 139 100 186 24 41
+      27 50 20 55 -5 3 -108 -15 -168 -30 -25 -6 -56 -13 -68 -16 -100 -22 -195 -52
+      -362 -111 -217 -78 -354 -137 -565 -242 -216 -109 -445 -244 -633 -374 -169 -116
+      -247 -176 -402 -305 -78 -65 -78 -64 -205 -186 -201 -190 -371 -390 -508 -594
+      -62 -93 -121 -196 -178 -309 -19 -37 -23 -47 -60 -138 -39 -94 -61 -169 -81 -269
+      -30 -159 -29 -288 2 -424 23 -101 47 -163 97 -254 139 -249 392 -463 778 -657 66
+      -34 155 -75 203 -94 34 -13 55 -22 82 -33 35 -14 183 -68 218 -80 15 -5 43 -14
+      62 -19 19 -6 52 -16 74 -23 84 -26 175 -51 248 -68 104 -25 98 -24 220 -50 306
+      -65 634 -107 994 -126 100 -5 385 -11 458 -9 144 3 321 10 372 13 137 9 232 16
+      288 22 232 23 225 22 460 52 169 22 440 68 672 114 33 6 70 13 82 16 32 6 187 40
+      282 62 24 6 59 14 78 18 19 4 66 15 104 24 39 9 81 19 94 22 68 15 513 133 614
+      163 19 6 57 17 84 25 28 8 70 21 94 28 24 7 79 23 122 36 43 12 89 26 102 30 13
+      4 48 15 78 24 168 52 316 100 446 146 42 15 107 37 144 50 132 45 359 128 502
+      183 61 23 141 53 178 67 37 14 91 35 118 46 28 11 73 29 100 40 99 38 343 137
+      458 186 171 72 333 141 384 164 31 14 79 35 108 47 54 23 129 56 222 99 30 14 86
+      39 124 56 39 17 118 54 177 82 59 27 108 50 109 50 1 0 46 22 101 48 54 27 122
+      60 151 73 98 46 561 281 637 324 17 10 64 35 105 57 344 182 837 498 1136 730
+      178 137 220 171 330 264 68 57 138 116 204 170 27 22 62 51 78 64 17 14 53 42 82
+      64 29 22 77 59 108 82 120 91 338 241 431 297 14 9 62 38 106 65 104 64 270 158
+      363 207 40 21 92 49 117 62 25 14 77 41 116 60 39 20 116 58 171 86 55 27 114 56
+      130 63 17 7 65 31 109 52 43 22 97 48 120 58 73 33 280 130 304 143 15 8 24 15
+      25 21 3 12 -21 90 -44 140 -22 48 -70 133 -106 188 -43 65 -110 143 -189 220
+      -117 115 -171 158 -301 237 -91 55 -165 95 -220 120 -24 11 -54 24 -66 30 -71 32
+      -189 73 -324 112 -54 16 -219 52 -294 65 -109 18 -272 36 -380 42 -88 4 -259 8
+      -312 6z M12694 8423 c-3 -7 -6 -19 -8 -27 -5 -24 -26 -84 -47 -132 -43 -96 -79
+      -152 -141 -214 -80 -81 -161 -130 -292 -178 -26 -9 -40 -16 -40 -20 0 -4 12 -10
+      36 -17 161 -51 276 -136 366 -270 42 -63 97 -192 120 -281 9 -35 20 -34 28 2 10
+      46 53 165 78 212 44 86 102 158 170 214 70 57 129 89 222 120 52 17 55 23 20 33
+      -118 35 -241 107 -308 180 -78 84 -148 224 -177 359 -8 35 -17 42 -27 19z M5933
+      7589 c-7 -5 -39 -97 -53 -154 -7 -27 -15 -59 -18 -71 -16 -59 -50 -198 -58 -230
+      -4 -20 -16 -73 -26 -118 -19 -86 -24 -107 -40 -196 -29 -151 -30 -170 -18 -231
+      25 -131 110 -235 254 -311 83 -44 266 -98 352 -104 32 -3 32 -3 96 23 35 14 91
+      36 124 49 80 31 216 86 258 104 19 8 55 23 80 33 55 21 143 57 185 75 16 7 83 34
+      148 60 64 25 122 48 127 51 9 4 70 28 144 58 17 7 61 24 98 39 37 15 97 38 132
+      52 73 29 135 53 216 84 31 12 68 26 82 32 14 6 58 22 96 37 64 24 131 50 246 95
+      24 10 71 28 104 40 33 12 66 25 74 28 8 3 27 10 42 16 15 6 34 13 42 16 19 8 98
+      38 144 55 61 23 177 66 194 71 9 3 48 17 88 32 40 15 93 34 118 42 53 17 92 34
+      92 39 0 6 -35 2 -148 -15 -21 -3 -69 -10 -106 -14 -37 -5 -91 -12 -120 -16 -223
+      -33 -612 -69 -900 -84 -387 -19 -756 -12 -1049 20 -168 18 -373 60 -496 100 -165
+      54 -271 105 -368 177 -43 32 -106 90 -116 108 -7 11 -11 13 -20 8z"/>
+    <path fill="#4A6B5C" d="M11642 17427 c4 -332 10 -651 14 -799 7 -251 10 -586 5 -589 -2 -2 -16 2 -31 7
+      -43 15 -81 19 -148 17 -47 -1 -68 -4 -100 -12 -101 -26 -179 -72 -254 -147 -67
+      -67 -115 -151 -141 -248 -7 -28 -9 -45 -9 -92 0 -73 10 -119 38 -178 25 -50 48
+      -79 89 -110 124 -94 277 -104 429 -29 169 84 285 250 316 453 7 45 8 269 2 534
+      -2 92 -5 254 -6 359 -3 182 -3 191 4 194 4 1 11 0 17 -3 5 -3 26 -17 48 -30 117
+      -70 178 -120 234 -190 68 -85 98 -225 73 -346 -13 -62 -52 -158 -78 -190 -12 -16
+      -20 -29 -20 -36 0 -25 127 73 179 137 40 51 79 136 102 225 42 157 12 352 -73
+      488 -71 112 -130 174 -264 274 -104 78 -211 178 -269 252 -31 40 -97 143 -124
+      193 -15 26 -21 35 -28 35 -8 0 -8 -1 -5 -169z M9054 17478 c-44 -17 -84 -32 -90
+      -34 -5 -2 -34 -13 -64 -24 -30 -11 -90 -34 -134 -50 -92 -34 -137 -51 -188 -71
+      -32 -13 -121 -46 -204 -76 -42 -16 -95 -36 -165 -63 -35 -14 -69 -27 -77 -30 -78
+      -29 -158 -59 -196 -74 -16 -6 -62 -23 -102 -38 -40 -15 -82 -30 -94 -35 -12 -4
+      -28 -10 -36 -13 -8 -3 -45 -17 -82 -31 -98 -39 -154 -60 -201 -77 -62 -22 -59
+      -18 -58 -86 1 -32 3 -89 5 -128 2 -38 6 -140 8 -226 2 -86 6 -186 8 -222 2 -36 6
+      -125 8 -198 2 -73 7 -195 10 -272 3 -77 8 -199 10 -272 2 -73 6 -162 8 -198 6
+      -101 5 -198 -1 -203 -4 -3 -11 -2 -27 3 -29 10 -89 19 -136 23 -73 4 -157 -13
+      -231 -49 -132 -63 -232 -160 -302 -294 -54 -103 -78 -243 -61 -348 16 -92 49
+      -158 110 -220 45 -46 94 -75 164 -98 32 -11 38 -12 106 -12 66 0 75 1 112 11 95
+      25 152 54 220 111 117 99 204 229 239 360 28 104 32 152 27 330 -2 77 -6 208 -8
+      292 -2 84 -6 207 -8 274 -2 67 -7 208 -10 312 -3 105 -8 237 -10 294 -8 244 -9
+      300 -3 307 5 6 26 16 65 29 9 3 38 14 64 24 26 10 85 32 130 48 45 17 105 39 132
+      50 28 11 82 32 122 46 90 33 112 41 134 50 27 11 86 34 118 46 15 6 34 13 42 16
+      19 8 77 30 154 58 75 28 161 60 210 80 58 23 159 57 170 58 12 0 12 0 15 -34 1
+      -19 2 -71 3 -116 0 -78 3 -202 12 -494 2 -73 5 -212 6 -309 3 -204 7 -188 -38
+      -173 -87 27 -205 27 -295 -1 -167 -53 -300 -170 -379 -333 -64 -133 -74 -282 -26
+      -407 32 -82 102 -158 182 -197 61 -30 98 -39 171 -41 50 -2 64 -1 99 7 155 33
+      282 127 389 285 51 77 87 173 106 287 5 36 6 66 6 202 -1 88 -3 235 -5 326 -6
+      240 -15 700 -18 860 -1 76 -4 212 -6 302 -2 90 -5 234 -6 320 -2 93 -5 158 -7
+      161 -2 3 -7 5 -10 5 -4 0 -43 -14 -87 -30z M10590 16917 c-241 -7 -571 -39 -792
+      -76 -20 -3 -48 -7 -62 -9 -59 -9 -147 -29 -177 -41 -54 -21 -82 -53 -117 -131
+      -27 -61 -25 -67 22 -58 96 19 176 34 190 36 9 1 54 8 100 16 199 32 325 50 476
+      64 33 3 76 8 96 10 166 19 676 42 990 46 76 1 78 1 79 9 3 19 -49 74 -84 89 -39
+      17 -188 37 -327 44 -76 4 -295 4 -394 1z M12612 16699 c-3 -5 -3 -12 2 -32 3 -14
+      7 -38 8 -54 4 -35 9 -41 45 -49 12 -3 47 -11 77 -19 30 -7 76 -19 102 -26 105
+      -26 423 -127 520 -165 26 -10 57 -22 68 -26 56 -20 134 -52 186 -75 32 -14 74
+      -32 94 -40 20 -7 89 -40 153 -72 64 -32 118 -57 119 -56 5 4 -39 38 -122 93 -47
+      31 -100 65 -118 76 -18 11 -35 22 -38 24 -3 3 -22 13 -42 24 -20 11 -50 27 -68
+      37 -53 30 -201 103 -260 128 -48 21 -131 54 -236 95 -24 10 -209 70 -260 86 -22
+      6 -219 56 -224 56 0 0 -3 -2 -6 -5z M7107 16128 c-9 -5 -50 -24 -92 -43 -323
+      -143 -696 -369 -1031 -626 -221 -170 -375 -306 -558 -494 -111 -115 -112 -116
+      -93 -140 6 -6 22 -29 36 -51 39 -59 40 -60 50 -56 5 2 42 35 82 72 203 190 371
+      336 516 449 58 45 189 143 234 174 18 12 46 32 62 44 28 21 70 49 173 115 29 18
+      64 41 78 50 14 9 47 29 72 44 25 15 57 34 70 42 33 20 113 66 206 119 44 24 88
+      50 98 58 11 7 35 24 53 37 18 12 41 30 51 39 18 17 19 18 22 49 3 18 4 53 3 78
+      -1 52 -3 55 -32 40z M10520 15886 c-173 -8 -506 -53 -752 -102 -120 -24 -324 -75
+      -333 -83 -7 -6 -7 -14 -6 -92 0 -59 2 -88 5 -92 5 -6 11 -5 75 10 317 80 557 129
+      797 163 163 23 352 47 410 51 32 3 57 7 61 10 3 3 10 16 15 30 5 14 17 40 26 58
+      20 36 21 44 11 46 -8 2 -265 2 -309 1z M12215 15662 c-35 -7 -64 -14 -65 -15 -7
+      -7 3 -15 25 -19 13 -2 46 -10 75 -16 29 -6 64 -14 78 -16 32 -6 243 -58 314 -78
+      145 -41 396 -121 476 -151 112 -43 195 -71 205 -71 7 0 20 8 36 20 28 22 32 29
+      25 38 -7 9 -174 90 -254 124 -174 74 -276 111 -414 151 -86 25 -89 26 -205 37
+      -147 14 -213 13 -296 -4z M4890 15080 c-8 -13 -6 -751 6 -2098 2 -253 3 -483 1
+      -512 -4 -61 1 -57 -55 -38 -75 26 -179 34 -265 22 -80 -12 -190 -56 -270 -108
+      -89 -56 -190 -168 -241 -264 -60 -114 -78 -180 -81 -300 -1 -61 -1 -83 5 -112 12
+      -67 38 -129 81 -194 63 -95 171 -162 292 -182 214 -34 443 73 605 283 93 120 153
+      267 172 421 3 25 4 228 3 690 0 360 0 742 0 850 1 108 1 200 1 205 0 6 2 9 7 9 6
+      0 108 -66 205 -132 102 -70 218 -182 280 -270 132 -187 162 -383 91 -596 -31 -93
+      -101 -215 -158 -275 -24 -25 -28 -35 -15 -35 10 0 96 43 123 61 94 64 168 140
+      219 227 23 37 69 140 84 185 32 96 46 187 46 309 0 121 -11 186 -50 305 -33 100
+      -73 178 -148 287 -55 82 -102 140 -174 216 -117 125 -256 277 -304 332 -158 184
+      -324 442 -415 646 -29 63 -32 69 -38 71 -2 1 -6 -1 -7 -3z M6454 14216 c-4 -5
+      -30 -27 -56 -49 -162 -137 -326 -292 -326 -310 0 -5 11 -29 25 -54 14 -25 34 -64
+      44 -87 10 -23 21 -44 24 -46 5 -3 35 24 125 111 108 105 152 145 251 231 19 16
+      35 33 36 37 2 4 -3 14 -12 24 -23 28 -50 71 -68 111 -19 42 -28 49 -43 32z M4552
+      13379 c-42 -45 -92 -104 -122 -143 -16 -21 -44 -57 -62 -80 -51 -65 -155 -224
+      -237 -360 -26 -43 -73 -127 -160 -286 -82 -152 -244 -485 -311 -640 -26 -60 -68
+      -161 -76 -184 -4 -11 -11 -30 -16 -42 -8 -21 -21 -56 -61 -168 -10 -27 -34 -99
+      -53 -158 -19 -59 -36 -112 -38 -118 -2 -5 -6 -20 -10 -32 -3 -12 -14 -53 -24 -90
+      -27 -101 -59 -231 -78 -326 -15 -70 -48 -260 -60 -338 -50 -343 -62 -711 -32
+      -1028 10 -108 22 -209 30 -254 12 -65 39 -198 46 -232 4 -19 12 -56 18 -82 12
+      -55 16 -69 46 -175 11 -38 72 -221 86 -256 14 -37 36 -96 49 -127 5 -14 24 -57
+      40 -94 56 -126 184 -370 194 -370 7 0 -2 30 -33 102 -39 93 -68 173 -118 332 -10
+      33 -21 67 -24 76 -12 35 -34 119 -68 256 -25 104 -49 226 -74 376 -20 125 -23
+      156 -36 300 -11 120 -16 255 -16 400 0 314 25 562 88 879 7 33 15 73 18 90 20
+      104 73 321 115 461 32 110 105 326 145 430 5 13 15 39 22 58 7 19 18 46 25 60 12
+      26 12 26 13 138 0 97 2 118 9 160 27 144 62 233 136 348 44 67 121 150 207 222
+      36 30 36 30 118 174 78 136 124 212 202 336 117 185 143 228 156 267 5 14 5 21 0
+      55 -11 66 -16 86 -23 87 -5 1 -16 -8 -31 -24z M4548 11050 c-43 -28 -87 -50 -120
+      -59 -47 -14 -47 -14 -60 -34 -36 -51 -112 -312 -159 -541 -36 -173 -50 -258 -69
+      -422 -19 -166 -28 -402 -20 -546 11 -213 12 -221 40 -432 9 -70 54 -300 71 -366
+      50 -190 136 -430 215 -598 84 -179 112 -228 129 -228 10 0 29 16 29 24 0 3 -11
+      30 -24 61 -74 171 -142 387 -200 631 -15 62 -53 270 -64 348 -41 293 -46 648 -14
+      964 12 113 55 379 82 504 35 163 93 371 156 559 24 73 44 137 44 141 0 12 -11 10
+      -36 -6z"/>
  </g>
 </svg>
@@ -6,26 +6,36 @@
  // is actually running (came up debugging the in-app update flow when
  // it wasn't obvious whether v2026.05.10.0 or .1 was deployed).
  //
+  // This is now the ONLY place an operator can see which build they are on.
+  // Image tags stopped carrying the version on 2026-09-10 — :latest and :dev
+  // are rolling names and :<sha> answers "which commit", not "which build" —
+  // so the server's self-report is the answer.
+  //
+  // The channel is shown BESIDE the version, never spliced into it: the same
+  // commit built on both lanes reports an identical version and differs only
+  // in channel, so "2026.09.10.1449 · dev" and "2026.09.10.1449 · stable" are
+  // the same code on two lines. Suppressed for stable, which is the
+  // unremarkable case and would just be noise on every install.
+  //
  // /healthz is unauthenticated, so the bare fetch works without
  // credentials. Renders nothing on parse failure or pre-version
  // images that don't include the field — graceful degradation.

-  type Health = { status: string; version?: string };
+  type Health = { status: string; version?: string; channel?: string };

  let version = $state<string | null>(null);
+  let channel = $state<string | null>(null);

  onMount(async () => {
    try {
      const res = await fetch('/healthz');
      if (!res.ok) return;
      const body = (await res.json()) as Partial<Health>;
-      if (body.version && body.version !== 'dev') {
-        version = body.version;
-      } else if (body.version === 'dev') {
-        // Local dev images report "dev" — show it so the operator
-        // can tell they're not on a release tag.
-        version = 'dev';
-      }
+      if (!body.version) return;
+      version = body.version;
+      // Reported verbatim rather than validated against an enum — a build
+      // claiming something unexpected is better shown than dropped.
+      channel = body.channel && body.channel !== 'stable' ? body.channel : null;
    } catch {
      // network / parse error — silent.
    }
@@ -33,5 +43,7 @@
 </script>

 {#if version}
-  <p class="text-xs text-text-secondary">Server {version}</p>
+  <p class="text-xs text-text-secondary">
+    Server {version}{#if channel}&nbsp;·&nbsp;{channel}{/if}
+  </p>
 {/if}
@@ -71,7 +71,7 @@
      href="/"
      class="flex items-center gap-2 font-semibold text-sm md:text-base whitespace-nowrap justify-self-start"
    >
-      <MinstrelMark size={20} class="shrink-0" />
+      <MinstrelMark size={28} class="shrink-0" />
      {appName()}
    </a>

@@ -0,0 +1,80 @@
+import { readFileSync, readdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, test } from 'vitest';
+
+// A deployed instance has no outbound network, so every asset the app draws
+// itself with has to come from our own origin. This regressed once already
+// (the font stylesheet was linked straight from Google), and the failure is
+// invisible in development — the dev machine HAS internet, so the fonts load
+// fine and only a real deployment renders in fallback faces.
+//
+// The assertion is on the PROPERTY, not on a vendor: any absolute URL in a
+// resource-loading attribute fails, whoever is hosting it. Naming
+// `fonts.googleapis.com` would pass the day someone reached for a different
+// CDN, which is the same bug.
+
+// fileURLToPath rather than import.meta.dirname: the latter needs Node 20.11+
+// and this repo's toolchain is still on 18, where it is silently undefined.
+const WEB = join(dirname(fileURLToPath(import.meta.url)), '../..');
+
+/** Strip comments before asserting an ABSENCE — otherwise prose describing
+ *  the forbidden thing satisfies the check that forbids it. */
+const stripComments = (html: string) => html.replace(/<!--[\s\S]*?-->/g, '');
+
+/** href/src on anything that makes the browser fetch a subresource. */
+const RESOURCE_URL = /<(?:link|script|img|source|iframe)\b[^>]*?\b(?:href|src)\s*=\s*["']([^"']+)["']/gi;
+
+const externalUrlsIn = (html: string) =>
+  [...stripComments(html).matchAll(RESOURCE_URL)]
+    .map((m) => m[1])
+    .filter((u) => /^(?:https?:)?\/\//i.test(u));
+
+describe('the app ships every asset it draws itself with', () => {
+  test('app.html loads no subresource from a third-party origin', () => {
+    const html = readFileSync(join(WEB, 'src/app.html'), 'utf8');
+    expect(externalUrlsIn(html)).toEqual([]);
+  });
+
+  test('app.html does not preconnect or dns-prefetch to any host', () => {
+    // preconnect carries no href-fetch of its own, so the check above misses
+    // it — but it is the fingerprint of a third-party asset about to be added.
+    const html = stripComments(readFileSync(join(WEB, 'src/app.html'), 'utf8'));
+    const hints = [...html.matchAll(/<link\b[^>]*\brel\s*=\s*["']([^"']+)["'][^>]*>/gi)]
+      .filter((m) => /\b(?:preconnect|dns-prefetch)\b/i.test(m[1]));
+    expect(hints.map((m) => m[0])).toEqual([]);
+  });
+
+  test('the vendored font stylesheet exists and points only at local files', () => {
+    const dir = join(WEB, 'static/fonts');
+    const css = readFileSync(join(dir, 'fonts.css'), 'utf8');
+
+    const urls = [...css.matchAll(/url\(\s*['"]?([^'")]+)['"]?\s*\)/gi)].map((m) => m[1]);
+    expect(urls.length).toBeGreaterThan(0);
+    expect(urls.filter((u) => /^(?:https?:)?\/\//i.test(u))).toEqual([]);
+
+    // Every referenced file is actually present — a stylesheet pointing at a
+    // woff2 nobody committed fails exactly like a CDN link would, offline.
+    const present = new Set(readdirSync(dir));
+    const missing = urls
+      .map((u) => u.replace(/^\.\//, ''))
+      .filter((f) => !present.has(f));
+    expect(missing).toEqual([]);
+  });
+
+  test('every font family the tokens name is actually vendored', () => {
+    // Pins the families to the TOKENS rather than to a hardcoded list, so
+    // swapping a typeface in tokens.json fails here until it is vendored.
+    const tokens = JSON.parse(
+      readFileSync(join(WEB, 'src/lib/styles/tokens.json'), 'utf8')
+    ) as { fonts: Record<string, string> };
+    const files = readdirSync(join(WEB, 'static/fonts'));
+    for (const family of Object.values(tokens.fonts)) {
+      const prefix = `${family.replace(/\s+/g, '')}-`;
+      expect(
+        files.some((f) => f.startsWith(prefix) && f.endsWith('.woff2')),
+        `no vendored woff2 for "${family}"`
+      ).toBe(true);
+    }
+  });
+});
@@ -40,6 +40,8 @@
  "request_not_pending": "This request is no longer pending.",
  "request_not_found": "That request no longer exists.",
  "track_not_found": "That track no longer exists.",
+  "library_not_writable": "The music library isn't writable by the server.",
+  "file_delete_failed": "The file couldn't be deleted.",
  "album_not_found": "That album no longer exists.",
  "artist_not_found": "That artist no longer exists.",
  "playlist_not_found": "That playlist no longer exists.",
@@ -6,6 +6,7 @@
    resetTuning,
    getTrends,
    type TuningScope,
+    type WeightProfileScope,
    type TuningSnapshot,
    type WeightProfile,
    type TasteTuning,
@@ -49,9 +50,15 @@
    { key: 'snooze_days',        label: 'Snooze length (days)', hint: 'How long "not right now" parks a suggestion before it returns on its own. Records no opinion about the artist and never feeds the taste profile.' }
  ];

-  const profileScopes: { scope: 'radio' | 'daily_mix'; label: string; blurb: string }[] = [
+  const profileScopes: { scope: WeightProfileScope; label: string; blurb: string }[] = [
    { scope: 'radio', label: 'Radio', blurb: 'Seed-directed listening — the user picked a direction.' },
-    { scope: 'daily_mix', label: 'Daily mixes', blurb: 'For You, Songs like…, and the discovery mixes.' }
+    { scope: 'daily_mix', label: 'Daily mixes', blurb: 'For You, the discovery mixes, and "You might like".' },
+    {
+      scope: 'songs_like',
+      label: 'Songs like…',
+      blurb:
+        'The tightest surface: everything here should sound like the seed track. Similarity dominates on purpose — raising like/taste/recency here is what makes these mixes wander.'
+    }
  ];

  let snapshot = $state<TuningSnapshot | null>(null);
@@ -64,10 +71,11 @@
    const f: Record<string, Record<string, string>> = {
      radio: {},
      daily_mix: {},
+      songs_like: {},
      taste: {},
      discover: {}
    };
-    for (const p of ['radio', 'daily_mix'] as const) {
+    for (const p of profileScopes.map((s) => s.scope)) {
      for (const { key } of weightFields) f[p][key] = String(snap.profiles[p][key]);
    }
    for (const { key } of tasteFields) f.taste[key] = String(snap.taste[key]);
--- a/Show More
+++ b/Show More