diff --git a/.github/labeler.yml b/.github/labeler.yml
index faf72f9f..10d00f56 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -35,40 +35,39 @@
 'scope: api':
   - changed-files:
       - any-glob-to-any-file:
-          - 'src/http.rs'
-          - 'src/services.rs'
+          - 'src/api/**'
+          - 'src/app/**'
+          - 'src/http/**'
+          - 'src/services/**'
           - 'src/lib.rs'
 
 'scope: db':
   - changed-files:
       - any-glob-to-any-file:
-          - 'src/database.rs'
-          - 'src/catalog.rs'
+          - 'src/storage/**'
           - 'migrations-v2/**'
 
 'scope: auth':
   - changed-files:
       - any-glob-to-any-file:
-          - 'src/authentication.rs'
-          - 'src/oauth.rs'
-          - 'src/security.rs'
+          - 'src/auth/**'
 
 'scope: subsonic':
   - changed-files:
       - any-glob-to-any-file:
-          - 'src/subsonic.rs'
+          - 'src/subsonic/**'
           - 'docs/subsonic-compatibility.md'
 
 'scope: streaming':
   - changed-files:
       - any-glob-to-any-file:
-          - 'src/media.rs'
-          - 'src/stream_ticket.rs'
+          - 'src/media/**'
+          - 'src/auth/stream_ticket/**'
 
 'scope: scanner':
   - changed-files:
       - any-glob-to-any-file:
-          - 'src/scanner.rs'
+          - 'src/library/**'
 
 # ─────────────────────────────────────────────────────────────
 # Web fine scopes (inside webapp/src/).
diff --git a/.github/workflows/ci-rust.yml b/.github/workflows/ci-rust.yml
index 2b73276c..1265cda2 100644
--- a/.github/workflows/ci-rust.yml
+++ b/.github/workflows/ci-rust.yml
@@ -12,6 +12,7 @@ on:
       - "Cargo.toml"
       - "Cargo.lock"
       - "build.rs"
+      - "scripts/check-rust-layout.sh"
       - "src/**"
       - "migrations-v2/**"
       - "tests/**"
@@ -24,6 +25,7 @@ on:
       - "Cargo.toml"
       - "Cargo.lock"
       - "build.rs"
+      - "scripts/check-rust-layout.sh"
       - "src/**"
       - "migrations-v2/**"
       - "tests/**"
@@ -79,6 +81,12 @@ jobs:
       - name: Install FFmpeg
         run: sudo apt-get update && sudo apt-get install -y --no-install-recommends ffmpeg
 
+      # The shape the restructuring gave the tree: no source file past 800
+      # lines, no test file past 1,000, no unit test inline in the code. The
+      # limits and the one allowed exception live in the script, with why.
+      - name: Rust layout
+        run: sh scripts/check-rust-layout.sh
+
       - name: cargo fmt
         run: cargo fmt --all --check
 
@@ -88,6 +96,14 @@ jobs:
       - name: cargo check
         run: cargo check --all-targets --all-features
 
+      # An intra-doc link that resolves nowhere is a warning rustdoc prints and
+      # nobody reads; here it fails the build, so a renamed item cannot leave
+      # its links behind.
+      - name: cargo doc
+        env:
+          RUSTDOCFLAGS: -D warnings
+        run: cargo doc --no-deps --all-features
+
       - name: cargo test
         run: cargo test --all-features
 
diff --git a/AGENTS.md b/AGENTS.md
index a64d4851..45e6c54a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -20,11 +20,14 @@ cargo test --all-features
 
 Tests are hermetic and use temporary SQLite databases. No PostgreSQL or Better Auth process is required.
 
+Unit tests live in `tests.rs` beside their module (`foo/mod.rs` declares `#[cfg(test)] mod tests;`), never inline. Integration targets are declared in `Cargo.toml`; a large one is a directory whose `main.rs` declares one file per subject. CI runs `sh scripts/check-rust-layout.sh`: no source file under `src/` past 800 lines, no `tests.rs` or file under `tests/` past 1,000, no inline `mod tests {`. It also runs `cargo doc --no-deps --all-features` with `RUSTDOCFLAGS="-D warnings"`.
+
 ## v2 conventions
 
 - `src/main.rs` only loads config, initializes state, dispatches CLI commands and serves the router. Testable runtime behaviour belongs behind library functions.
-- All environment access lives in `src/config.rs`.
-- SQL stays in `src/database.rs` or later repository modules. Handlers orchestrate HTTP only.
+- `src/` is filed by domain; only `main.rs` and `lib.rs` sit at its root. `app/` (boot, state, router), `cli/`, `config/`; the surfaces `api/` and `subsonic/` over the one domain `services/`; `auth/` (sessions, sign-in guard, OAuth, setup token, instance-key cryptography, stream tickets); `library/` (scanner, watcher, tags, PIDs, credit splitting, playlist files, lyrics parsing); `storage/` (database, catalogue, sync journal, collation, pre-migration copy); `remote/` (outbound client, enrichment, portraits, LRCLIB, podcast feeds, scrobblers); `http/` (security headers, public share, `/reference`, web client); `media/`; `quality/`. A new module goes under the parent whose domain it serves, never at the root.
+- All environment access lives in `src/config/`.
+- SQL stays in `src/storage/database/`, `src/storage/catalog/` or `src/services/`. Handlers orchestrate HTTP only.
 - SQLite connections enable WAL, foreign keys and `busy_timeout`. All mutations acquire the single process-wide writer gate; libraries may scan concurrently but never create independent SQLite writers.
 - Migrations under `migrations-v2/` are immutable once merged. Schema changes always add a new dated migration.
 - Tenant isolation is enforced in repository queries through account plus library membership, not only in handlers.
diff --git a/CLAUDE.md b/CLAUDE.md
index 89eeca4e..c142d13d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -8,7 +8,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 The accepted design is [RFC-002](docs/rfcs/RFC-002-waveflow-server-v2.md). **Read it before adding a module or a public route.** [`AGENTS.md`](AGENTS.md) holds the short form of the same rules plus the milestone sequence; this file is the deeper reference.
 
-**An RFC's `Status` field never flips.** Every RFC under `docs/rfcs/` says `Proposed` whether it shipped a year ago or not at all, so the header is not evidence about the code — a `Status` line has misled a reader into holding shipped work as pending. What each one carries instead is an **`Implemented by`** line naming the pull requests, which can actually be checked. (Both keys were `Statut` and `Implémentée par` in the five French RFCs until #222 moved the series to English; a document quoting the old spellings is dated, not wrong.) And when it matters, read the code rather than either: the routes registered in `src/lib.rs` and the dated files under `migrations-v2/` are the only account of what exists.
+**An RFC's `Status` field never flips.** Every RFC under `docs/rfcs/` says `Proposed` whether it shipped a year ago or not at all, so the header is not evidence about the code — a `Status` line has misled a reader into holding shipped work as pending. What each one carries instead is an **`Implemented by`** line naming the pull requests, which can actually be checked. (Both keys were `Statut` and `Implémentée par` in the five French RFCs until #222 moved the series to English; a document quoting the old spellings is dated, not wrong.) And when it matters, read the code rather than either: the routes registered from `src/app/router.rs` and the dated files under `migrations-v2/` are the only account of what exists.
 
 **Documentation is written in English.** Every RFC, analysis, plan, guide and
 handoff under `docs/`, and these instruction files with them. The design
@@ -22,7 +22,15 @@ English.
 
 Layout:
 
-- `/` — the server crate (`waveflow-server`).
+- `/` — the server crate (`waveflow-server`). Under `src/`, only `main.rs` and `lib.rs` sit at the root; every module is filed by domain:
+  - `app/` — boot, `AppState`, the router and the OpenAPI document; `cli/` — the command line; `config/` — every setting.
+  - `api/` — `/api/v2`; `subsonic/` — the OpenSubsonic façade; `services/` — the domain both call (see below).
+  - `auth/` — accounts and sessions (`authentication`), the sign-in guard (`sign_in`), native-client OAuth (`oauth`), the setup token, the instance key's cryptography (`security`) and stream tickets.
+  - `library/` — reading the music on disk: `scanner/`, `watcher/`, the tag mapper (`tags`), derived identifiers (`pid`), `credit_split`, `link_roots`, `playlist_file` and `lyrics` (the LRC/TTML parsers and the sheets they make).
+  - `storage/` — SQLite: `database/` (the pool and the foundation repositories), `catalog/` (the catalogue repository), `sync` (the user-data change journal), `natural_order` (the collation registered on the pool) and `migration_backup`.
+  - `remote/` — everything that talks to another host: the outbound client (`outbound`), `enrichment/`, `portrait`, `lrclib`, `podcast` (the feed fetcher) and `scrobblers/`.
+  - `http/` — HTTP outside the two API surfaces: `security_headers`, `public_share`, `reference` (the `/reference` page) and `webui`.
+  - `media/` — streaming, transcoding, artwork, canvases and `replay_gain`; `quality/` — the audio analysis.
 - `webapp/` — the embedded React client, built to `webapp/dist` and compiled in by `rust_embed`. Under `webapp/src/`, only `main.tsx` (the router and the providers) sits at the root; everything else is filed by what it is: `api/` (the HTTP client, one file per resource over the session and transport in `client.ts`, re-exported by `index.ts` so the rest of the app imports `../api`; then the query keys and the query client), `pages/` (one screen per file), `components/` (pieces shared between screens), `player/`, `state/` (contexts: i18n, preferences, library scope), `lib/` (logic with no React in it) and `styles/` (the sheet and the design tokens). A test sits beside the file it tests.
 
 The desktop app at [`InstaZDLL/WaveFlow`](https://github.com/InstaZDLL/WaveFlow) is a separate repository. It consumes this API but is not part of this codebase.
@@ -37,6 +45,8 @@ cargo fmt --all --check                # CI gate
 cargo clippy --all-targets --all-features -- -D warnings   # CI gate; warnings are errors
 cargo test --all-features              # hermetic; temporary SQLite databases
 cargo test --all-features --test subsonic_contract <name>   # one test, in one target
+RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features   # CI gate; a link that resolves nowhere fails
+sh scripts/check-rust-layout.sh        # CI gate; file sizes and no inline unit tests
 
 bun --cwd=webapp install
 bun run build                          # webapp first, then cargo — the order matters
@@ -46,27 +56,29 @@ Tests need no service container: `test_app()` builds a `Config` over a `TempDir`
 
 The integration suite is twenty-three targets under `tests/`, one per subject — `auth`, `scanner`, `identity`, `catalog`, `subsonic_contract`, `subsonic_browse`, `subsonic_fields`, `subsonic_methods`, `native_api`, `sync`, `media`, `service`, `cli`, `scrobbling`, `enrichment`, `credits`, `quality`, `uploads`, `canvas`, `discovery`, `smart_playlists`, `podcasts`, `migrations` — nearly all of them sharing `tests/support/mod.rs`. `migrations` is the exception and deliberately so: every other target starts from `test_app()`, which builds its database from nothing, and that is exactly the path an upgrade does not take. It seeds a database at each **released** schema, boots the server on it, and reads the rows back through the services — and it is where anything else that needs a database *behind* this binary belongs, such as proving that a key change reads without migrating and copies the pair aside before it does. `autotests = false`, so each is a target only because `Cargo.toml` declares it: a new file under `tests/` is compiled by nothing until a `[[test]]` entry names it, and the count above is worth checking against that list rather than trusted. `support/mod.rs` is the exception that proves it — shared module code, declared nowhere, a target never. A target too large for one file becomes a directory and stays one target: its `[[test]]` entry points at `tests/<name>/main.rs`, which reaches the shared module through `#[path = "../support/mod.rs"]`, keeps the imports and helpers its files share, and declares one file per surface with `mod`; each of those starts with `use super::*;`. The target's name does not change, so `cargo test --test native_api <name>` still finds a test, now under its module (`playlists::…`) — and a new file in such a directory is compiled by nothing until `main.rs` declares it, the same trap one level down. File a new test by the surface it exercises, and check that by what it calls rather than by what its name says.
 
+Unit tests never sit inline in the code. A module with unit tests is a directory: the code in `foo/mod.rs`, which declares `#[cfg(test)] mod tests;`, and the tests in `foo/tests.rs` beside it, reaching private items through `use super::*;` — never a `foo.rs` with a `foo/` beside it. CI holds the sizes too (`scripts/check-rust-layout.sh`): a source file under `src/` stays within 800 lines, a `tests.rs` under `src/` or any file under `tests/` within 1,000, and no file under `src/` opens `mod tests {`. Past a limit, split along the file's seams into a directory, as the restructuring did, rather than raising it; the script's allowlist holds one file, a single test that cannot be cut without changing it, and says why.
+
 `cargo build` works without a client build — `build.rs` embeds a placeholder page when `webapp/dist` is absent. A real `vite build` overwrites it.
 
 ## Architecture & conventions
 
-- **Library/binary split.** `src/main.rs` only loads config, dispatches CLI commands and serves. The router is built by `waveflow_server::app(&config, state)` in `src/lib.rs`, so tests spawn the same app in-process. Put logic behind `app()`, not in `main`.
-- **`AppState`** (`src/lib.rs`) holds the shared singletons: `db`, `auth`, `secret_box`, `scanner`, `media`, `services`, plus config values copied in (`artwork_dir`, `public_url`, `stream_ticket_ttl`). Add new singletons there.
-- **Three directories carry the surfaces.** `src/api/` is `/api/v2`, one module per resource plus `error`, `access` and `web_session`; `src/subsonic/` is the façade, one module per method family; `src/services/` is the domain, several `impl DomainServices` blocks split by domain. Each `mod.rs` keeps only what its children share — the router or dispatch, the cross-cutting types, and for `services` the SQL projection macros, which sit ahead of the `mod` declarations so their textual scope reaches every child. File a new handler under the resource it serves, not in `mod.rs`.
-- **All environment access lives in `src/config.rs`.** Every tunable is a field on `Config` with its env var documented on it.
-- **No SQL in handlers.** SQL belongs in `src/database.rs`, `src/catalog.rs` or `src/services/`; handlers orchestrate HTTP only.
+- **Library/binary split.** `src/main.rs` only loads config, dispatches CLI commands and serves. The router is built by `waveflow_server::app(&config, state)` in `src/app/router.rs`, re-exported by `src/lib.rs`, so tests spawn the same app in-process. Put logic behind `app()`, not in `main`.
+- **`AppState`** (`src/app/state.rs`) holds the shared singletons: `db`, `auth`, `secret_box`, `scanner`, `media`, `services`, plus config values copied in (`artwork_dir`, `public_url`, `stream_ticket_ttl`). Add new singletons there.
+- **Three directories carry the surfaces.** `src/api/` is `/api/v2`, one module per resource plus `error`, `access` and `web_session`; `src/subsonic/` is the façade, one module per method family; `src/services/` is the domain, several `impl DomainServices` blocks split by domain. Each `mod.rs` keeps only what its children share — the router or dispatch, the cross-cutting types, and for `services` the SQL projection macros, which sit ahead of the `mod` declarations so their textual scope reaches every child. File a new handler under the resource it serves, not in `mod.rs`. Everything else in `src/` is filed by domain (see Layout): a new module goes under the parent whose domain it serves — `auth/`, `library/`, `storage/`, `remote/`, `http/`, `media/` — never at the root, and each parent's `mod.rs` holds only its `//!` and the `pub mod` lines.
+- **All environment access lives in `src/config/`.** Every tunable is a field on `Config` with its env var documented on it.
+- **No SQL in handlers.** SQL belongs in `src/storage/database/`, `src/storage/catalog/` or `src/services/`; handlers orchestrate HTTP only.
 - **One set of domain services.** `DomainServices` (`src/services/`) is the single implementation behind the native API, the Subsonic façade and the web client. A mutation reachable from two surfaces must call the same method — that convergence is the point of M4, and duplicating logic per surface is how the two drift.
 - **Tenancy is enforced in the queries**, through `library_member`, not in handlers. The shared projections are `song_select!` / `album_select!` / `artist_select!` macros that `concat!` into literals: sqlx only accepts static SQL, so composing them stays injection-proof by construction. The first bind is always the user id.
 - **404 blurs everything.** A resource that is missing, and one that belongs to another account, answer identically. `ServiceError::Forbidden` maps onto 404 for that reason. Never confirm existence to someone not entitled to it.
 - **SQLite discipline.** WAL, foreign keys, `busy_timeout`. Every mutation takes the process-wide writer gate (`db.writer_guard()`); libraries may scan concurrently but never open independent writers. `NULL` sorts first in SQLite — order explicitly with `NULLS LAST` wherever a missing tag would otherwise jump the queue.
 - **Migrations are immutable once merged.** They are embedded at compile time and checksummed, so editing an applied migration makes the server refuse to start. Schema changes are new dated files under `migrations-v2/`.
-- **Identifiers and time.** Public ids are UUIDs; timestamps are Unix epoch milliseconds. Album and artist ids are *derived* UUIDs (version 8, RFC 9562 §5.8): the identity engine in `src/pid.rs` hashes the tags that name the entity, under the configurable spec `WAVEFLOW_PID_ALBUM`/`WAVEFLOW_PID_ARTIST`, so the same files answer the same ids on a fresh install. Track ids stay drawn at random — six tables cascade off them, and a scan matches a track by path, then by content hash, then by the relocation hint in `track.pid`. That hint is the track spec evaluated over the file's tags, and it stays a hint: it is asked only when the first two have nothing to say — a file both moved and re-encoded — and it moves nothing unless it names exactly one track whose file has genuinely disappeared. Changing `WAVEFLOW_PID_TRACK` drops every stored hint on the next boot: a hint written under one spec must never be compared against a lookup computed under another, because two specs can evaluate to the same string and the hint would then hand a new file an unrelated track's identity. The next ordinary scan writes them back from its skip path, so clearing them costs no rescan — and a track spec change still re-identifies nothing. Changing a spec re-identifies everything it governs: the next boot notices, schedules a full rescan of every library, and album favourites do not survive it. A credit decision (RFC-015) is narrower: splitting a joined credit such as `Zedd, Alessia Cara` re-identifies only the artists it names. The album display string and the track hint read the tag mapper's names, before any decision, so no album or track id moves, and favourites on the joined artist are carried onto its parts through the journal.
+- **Identifiers and time.** Public ids are UUIDs; timestamps are Unix epoch milliseconds. Album and artist ids are *derived* UUIDs (version 8, RFC 9562 §5.8): the identity engine in `src/library/pid/` hashes the tags that name the entity, under the configurable spec `WAVEFLOW_PID_ALBUM`/`WAVEFLOW_PID_ARTIST`, so the same files answer the same ids on a fresh install. Track ids stay drawn at random — six tables cascade off them, and a scan matches a track by path, then by content hash, then by the relocation hint in `track.pid`. That hint is the track spec evaluated over the file's tags, and it stays a hint: it is asked only when the first two have nothing to say — a file both moved and re-encoded — and it moves nothing unless it names exactly one track whose file has genuinely disappeared. Changing `WAVEFLOW_PID_TRACK` drops every stored hint on the next boot: a hint written under one spec must never be compared against a lookup computed under another, because two specs can evaluate to the same string and the hint would then hand a new file an unrelated track's identity. The next ordinary scan writes them back from its skip path, so clearing them costs no rescan — and a track spec change still re-identifies nothing. Changing a spec re-identifies everything it governs: the next boot notices, schedules a full rescan of every library, and album favourites do not survive it. A credit decision (RFC-015) is narrower: splitting a joined credit such as `Zedd, Alessia Cara` re-identifies only the artists it names. The album display string and the track hint read the tag mapper's names, before any decision, so no album or track id moves, and favourites on the joined artist are carried onto its parts through the journal.
 - **Credentials.** Web passwords use Argon2id. Access, refresh, API and OAuth codes are stored as SHA-256 hashes only. The dedicated Subsonic password is encrypted with ChaCha20-Poly1305 under the instance key. Back up `data/waveflow.db` and `data/instance.key` together — encrypted values cannot be recovered with one without the other.
-- **Browser playback uses stream tickets** (`src/stream_ticket.rs`). `<audio src>` cannot send an `Authorization` header, so the client exchanges its session for an AEAD-sealed `(user, track, expiry)` and plays from `/api/v2/stream/{ticket}`. Access is re-checked on every redemption, so a ticket cannot outlive the membership that justified it. The TTL is an hour rather than seconds because the browser reuses that URL for every range request while seeking.
-- **Native clients use Authorization Code + PKCE** (`src/oauth.rs`). S256 only; redirect targets restricted to loopback, https or a reverse-domain private scheme. A code is spent by its first presentation whatever the outcome.
-- **The web client is a router fallback** (`src/webui.rs`). Anything not claimed by an API route is a built asset or a client-side route. Paths under `api/`, `rest/`, `share/` and the probes are excluded, so a mistyped API call stays a JSON 404 instead of returning HTML.
+- **Browser playback uses stream tickets** (`src/auth/stream_ticket/`). `<audio src>` cannot send an `Authorization` header, so the client exchanges its session for an AEAD-sealed `(user, track, expiry)` and plays from `/api/v2/stream/{ticket}`. Access is re-checked on every redemption, so a ticket cannot outlive the membership that justified it. The TTL is an hour rather than seconds because the browser reuses that URL for every range request while seeking.
+- **Native clients use Authorization Code + PKCE** (`src/auth/oauth/`). S256 only; redirect targets restricted to loopback, https or a reverse-domain private scheme. A code is spent by its first presentation whatever the outcome.
+- **The web client is a router fallback** (`src/http/webui.rs`). Anything not claimed by an API route is a built asset or a client-side route. Paths under `api/`, `rest/`, `share/` and the probes are excluded, so a mistyped API call stays a JSON 404 instead of returning HTML.
 - **Audio files are read-only.** The scanner and tag operations never rewrite them.
-- **The real quality of a file is measured, never read** ([RFC-016](docs/rfcs/RFC-016-audio-quality-analysis.md)). `src/quality/` decodes a lossless file through FFmpeg and runs the desktop's wall search on it, ported from `waveflow-core` and held to it by a test; `src/services/quality.rs` decides which files are measured and what a measurement means. The analysis runs in the background, `WAVEFLOW_QUALITY_PARALLELISM` files at a time (one by default, zero turns it off), and starts no file while a scan runs. A row in `track_quality` is current only for the content, the analyser version and the FFmpeg build that made it; boot deletes the others, so a read can call a row current on its `full_hash` alone. The verdict is SQL computed where it is read, never a column.
+- **The real quality of a file is measured, never read** ([RFC-016](docs/rfcs/RFC-016-audio-quality-analysis.md)). `src/quality/` decodes a lossless file through FFmpeg and runs the desktop's wall search on it, ported from `waveflow-core` and held to it by a test; `src/services/quality/` decides which files are measured and what a measurement means. The analysis runs in the background, `WAVEFLOW_QUALITY_PARALLELISM` files at a time (one by default, zero turns it off), and starts no file while a scan runs. A row in `track_quality` is current only for the content, the analyser version and the FFmpeg build that made it; boot deletes the others, so a read can call a row current on its `full_hash` alone. The verdict is SQL computed where it is read, never a column.
 - **The Subsonic contract is frozen** for v2.0-beta — see the "Frozen Subsonic v2.0-beta contract" section of RFC-002 and [`docs/subsonic-compatibility.md`](docs/subsonic-compatibility.md). Changing observable wire behaviour there risks the clients already validated against it.
 - **Logging.** `tracing` + `RUST_LOG`; `WAVEFLOW_LOG_FORMAT=json` for prod. Traces record `uri.path()` only, with share tokens and stream tickets redacted. Never log headers, query strings, tokens or passwords.
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b95f5aa3..87cea9ee 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -38,6 +38,17 @@ A DCO keeps contributing friction-free (one CLI flag), while still giving the pr
 
 By submitting a pull request, you agree that your contribution is licensed under [AGPL-3.0-only](LICENSE) for inclusion in this repository.
 
+## Where code and tests go
+
+The server's `src/` is filed by domain, with only `main.rs` and `lib.rs` at its root: `app/`, `cli/` and `config/`; the two API surfaces `api/` (`/api/v2`) and `subsonic/` over the domain services in `services/`; then `auth/`, `library/` (the music on disk), `storage/` (SQLite), `remote/` (anything that talks to another host), `http/` (HTTP outside the two surfaces), `media/` and `quality/`. Put a new module under the parent whose domain it serves. [CLAUDE.md](CLAUDE.md) describes each one.
+
+Tests follow two rules, and CI checks both with `scripts/check-rust-layout.sh`:
+
+- **Unit tests sit beside their module, never inline.** A module with tests is a directory: `foo/mod.rs` declares `#[cfg(test)] mod tests;` and the tests live in `foo/tests.rs`. Integration tests live under `tests/`, one `[[test]]` target per subject in `Cargo.toml`; a large target is a directory whose `main.rs` declares one file per subject.
+- **Files stay small.** A source file under `src/` stays within 800 lines; a `tests.rs`, or any file under `tests/`, within 1,000. Past that, split the file along its seams into a directory.
+
+CI also builds the docs with `RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features`, so an intra-doc link that resolves nowhere fails the build. Write a link to an item in another module as a full path, ``[`Item`](crate::module::Item)``, rather than importing the item for the link's sake.
+
 ## Commit conventions
 
 Same as the main repo: [Conventional Commits](https://www.conventionalcommits.org/) with kebab-case scopes, lowercase subject. Examples that fit this repo:
diff --git a/Cargo.toml b/Cargo.toml
index fbeffd52..e062e8c9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -109,7 +109,7 @@ tokio-tungstenite = "0.30"
 
 [[test]]
 name = "migrations"
-path = "tests/migrations.rs"
+path = "tests/migrations/main.rs"
 
 [[test]]
 name = "auth"
@@ -133,11 +133,11 @@ path = "tests/subsonic_contract/main.rs"
 
 [[test]]
 name = "subsonic_fields"
-path = "tests/subsonic_fields.rs"
+path = "tests/subsonic_fields/main.rs"
 
 [[test]]
 name = "subsonic_browse"
-path = "tests/subsonic_browse.rs"
+path = "tests/subsonic_browse/main.rs"
 
 [[test]]
 name = "subsonic_methods"
@@ -149,7 +149,7 @@ path = "tests/native_api/main.rs"
 
 [[test]]
 name = "sync"
-path = "tests/sync.rs"
+path = "tests/sync/main.rs"
 
 [[test]]
 name = "media"
@@ -157,11 +157,11 @@ path = "tests/media/main.rs"
 
 [[test]]
 name = "service"
-path = "tests/service.rs"
+path = "tests/service/main.rs"
 
 [[test]]
 name = "cli"
-path = "tests/cli.rs"
+path = "tests/cli/main.rs"
 
 [profile.release]
 codegen-units = 1
@@ -174,7 +174,7 @@ path = "tests/uploads/main.rs"
 
 [[test]]
 name = "canvas"
-path = "tests/canvas.rs"
+path = "tests/canvas/main.rs"
 
 [[test]]
 name = "scrobbling"
@@ -186,15 +186,15 @@ path = "tests/enrichment/main.rs"
 
 [[test]]
 name = "credits"
-path = "tests/credits.rs"
+path = "tests/credits/main.rs"
 
 [[test]]
 name = "quality"
-path = "tests/quality.rs"
+path = "tests/quality/main.rs"
 
 [[test]]
 name = "discovery"
-path = "tests/discovery.rs"
+path = "tests/discovery/main.rs"
 
 [[test]]
 name = "smart_playlists"
diff --git a/docs/operations.md b/docs/operations.md
index f0041447..3d760040 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -251,7 +251,7 @@ media from any `http:` or `https:` host, because internet radio is played
 straight from the station. `/rest` carries none of these headers.
 
 Every tunable is a field on `Config` in
-[`src/config.rs`](../src/config.rs), with its environment variable documented on
+[`src/config/mod.rs`](../src/config/mod.rs), with its environment variable documented on
 it. That file is the authority; this page is not a copy of it.
 
 ## Switching metadata enrichment on
diff --git a/docs/privacy.md b/docs/privacy.md
index 2a17419f..5b2447f8 100644
--- a/docs/privacy.md
+++ b/docs/privacy.md
@@ -2,9 +2,10 @@
 
 Every host a WaveFlow Server can contact, what it sends there, when, and the
 setting that stops it. This was written from the code (RFC-019 decision 4), and
-the code is the authority if the two ever disagree: `src/outbound.rs`,
-`src/enrichment.rs`, `src/portrait.rs`, `src/lrclib.rs`, `src/podcast.rs`,
-`src/services/remote_artwork.rs` and `src/scrobblers/`.
+the code is the authority if the two ever disagree: `src/remote/outbound/`,
+`src/remote/enrichment/`, `src/remote/portrait/`, `src/remote/lrclib/`,
+`src/remote/podcast/`, `src/services/remote_artwork/` and
+`src/remote/scrobblers/`.
 
 **A server left at its defaults sends nothing on its own.** Booting makes no
 request, and no background task does unless an operator configured it *and*,
@@ -16,7 +17,7 @@ account sets it (below; `WAVEFLOW_REMOTE_ARTWORK=off` stops it).
 
 ## Rules every request follows
 
-All outbound clients are built by one function, `src/outbound.rs`:
+All outbound clients are built by one function, `src/remote/outbound/mod.rs`:
 
 - **No redirect is followed by the client.** A provider cannot bounce a
   request to another host. The one exception is the podcast fetcher, below,
diff --git a/scripts/check-rust-layout.sh b/scripts/check-rust-layout.sh
new file mode 100755
index 00000000..81ebc1eb
--- /dev/null
+++ b/scripts/check-rust-layout.sh
@@ -0,0 +1,74 @@
+#!/bin/sh
+# Holds the Rust tree to the shape the restructuring gave it.
+#
+# - A source file under `src/` stays under 800 lines. Past that it holds more
+#   than one responsibility; split it along its seams into a module directory.
+# - A unit-test file under `src/` (always named `tests.rs`, beside the module
+#   it tests) stays under 1,000 lines, as does any file under `tests/`.
+# - Unit tests never sit inline in the code: `#[cfg(test)] mod tests;` names a
+#   `tests.rs` beside the module, and no file under `src/` opens `mod tests {`.
+#
+# Run from the repository root: `sh scripts/check-rust-layout.sh`. POSIX sh
+# and coreutils only, so it runs the same on a runner and on a laptop.
+
+set -eu
+
+SOURCE_LIMIT=800
+TEST_LIMIT=1000
+
+# Files allowed past their limit, one path per line, each with its reason.
+#
+# tests/subsonic_contract/compatibility.rs: one test, the frozen v2.0-beta
+# compatibility walk, which drives a single seeded instance through every
+# method a validated client calls. Splitting it means splitting that test,
+# which changes what it proves; it stays whole.
+ALLOWLIST="
+tests/subsonic_contract/compatibility.rs
+"
+
+failed=0
+
+allowed() {
+    case "$ALLOWLIST" in
+        *"
+$1
+"*) return 0 ;;
+    esac
+    return 1
+}
+
+report() {
+    # `::error` is a GitHub annotation; elsewhere it reads as a plain line.
+    echo "::error file=$1::$2"
+    failed=1
+}
+
+check_size() {
+    file=$1
+    limit=$2
+    lines=$(wc -l < "$file" | tr -d ' ')
+    if [ "$lines" -gt "$limit" ] && ! allowed "$file"; then
+        report "$file" "$file has $lines lines; the limit is $limit."
+    fi
+}
+
+for file in $(find src tests -name '*.rs' | sort); do
+    case "$file" in
+        tests/*) check_size "$file" "$TEST_LIMIT" ;;
+        */tests.rs) check_size "$file" "$TEST_LIMIT" ;;
+        *) check_size "$file" "$SOURCE_LIMIT" ;;
+    esac
+done
+
+inline=$(grep -rnE 'mod tests[[:space:]]*\{' src || true)
+if [ -n "$inline" ]; then
+    echo "$inline" | while IFS= read -r hit; do
+        echo "::error file=${hit%%:*}::inline test module; move it to a tests.rs beside the module: $hit"
+    done
+    failed=1
+fi
+
+if [ "$failed" -ne 0 ]; then
+    exit 1
+fi
+echo "Rust layout: every file within its limit, no inline test module."
diff --git a/src/api/access.rs b/src/api/access.rs
index a100fbd2..efa879bc 100644
--- a/src/api/access.rs
+++ b/src/api/access.rs
@@ -76,14 +76,15 @@ pub(crate) async fn authenticated(
     state: &AppState,
     headers: &HeaderMap,
     access: Access,
-) -> Result<crate::authentication::AuthUser, ApiError> {
+) -> Result<crate::auth::authentication::AuthUser, ApiError> {
     let token = bearer_token(headers).ok_or(ApiError::Unauthorized)?;
     let user = state
         .auth
         .authenticate(token)
         .await
         .map_err(ApiError::from)?;
-    let role_ok = access != Access::Admin || user.role == crate::database::AccountRole::Admin;
+    let role_ok =
+        access != Access::Admin || user.role == crate::storage::database::AccountRole::Admin;
     if role_ok && access.granted_by(&user.scopes) {
         Ok(user)
     } else {
@@ -97,11 +98,11 @@ pub(crate) async fn authenticated(
 /// [`Access::Admin`]. A route that admits a narrower credential must not let
 /// the account's role stand in for what the credential lacks.
 pub(crate) fn library_actor(
-    user: &crate::authentication::AuthUser,
+    user: &crate::auth::authentication::AuthUser,
 ) -> crate::services::LibraryActor {
     crate::services::LibraryActor {
         id: user.id,
-        admin_credential: user.role == crate::database::AccountRole::Admin
+        admin_credential: user.role == crate::storage::database::AccountRole::Admin
             && Access::Admin.granted_by(&user.scopes),
     }
 }
@@ -127,11 +128,11 @@ pub(super) async fn mutation_context(
     state: &AppState,
     headers: &HeaderMap,
     user_id: Uuid,
-) -> Result<crate::sync::MutationContext, ApiError> {
+) -> Result<crate::storage::sync::MutationContext, ApiError> {
     let operation_id =
         optional_uuid_header(headers, OPERATION_ID_HEADER)?.unwrap_or_else(Uuid::new_v4);
     let origin_device_id = origin_device(state, headers, user_id).await?;
-    Ok(crate::sync::MutationContext {
+    Ok(crate::storage::sync::MutationContext {
         operation_id,
         origin_device_id,
     })
diff --git a/src/api/auth.rs b/src/api/auth.rs
index cd782567..7600f17b 100644
--- a/src/api/auth.rs
+++ b/src/api/auth.rs
@@ -22,7 +22,7 @@ pub struct RefreshRequest {
     tag = "authentication",
     request_body = LoginRequest,
     responses(
-        (status = 200, body = crate::authentication::AuthTokens),
+        (status = 200, body = crate::auth::authentication::AuthTokens),
         (status = 401, body = ErrorResponse),
         (status = 422, body = ErrorResponse),
         (status = 429, body = ErrorResponse, description = "Too many failed sign-ins from this address for this account (RFC-017)",
@@ -34,14 +34,14 @@ pub async fn login(
     State(state): State<AppState>,
     client: SignInAddress,
     Json(request): Json<LoginRequest>,
-) -> Result<Json<crate::authentication::AuthTokens>, ApiError> {
+) -> Result<Json<crate::auth::authentication::AuthTokens>, ApiError> {
     state
         .auth
         .login(
             &request.username,
             &request.password,
             &request.device_name,
-            &client.on(crate::sign_in::Surface::Native),
+            &client.on(crate::auth::sign_in::Surface::Native),
         )
         .await
         .map(Json)
@@ -54,7 +54,7 @@ pub async fn login(
     tag = "authentication",
     request_body = RefreshRequest,
     responses(
-        (status = 200, body = crate::authentication::AuthTokens),
+        (status = 200, body = crate::auth::authentication::AuthTokens),
         (status = 401, body = ErrorResponse),
         (status = 503, body = ErrorResponse)
     )
@@ -62,7 +62,7 @@ pub async fn login(
 pub async fn refresh(
     State(state): State<AppState>,
     Json(request): Json<RefreshRequest>,
-) -> Result<Json<crate::authentication::AuthTokens>, ApiError> {
+) -> Result<Json<crate::auth::authentication::AuthTokens>, ApiError> {
     state
         .auth
         .refresh(&request.refresh_token)
@@ -125,7 +125,7 @@ pub async fn web_login(
             &request.username,
             &request.password,
             &request.device_name,
-            &client.on(crate::sign_in::Surface::Web),
+            &client.on(crate::auth::sign_in::Surface::Web),
         )
         .await
         .map_err(ApiError::from)?;
@@ -198,8 +198,11 @@ pub async fn web_logout(
 pub struct SignInAddress(String);
 
 impl SignInAddress {
-    fn on(self, surface: crate::sign_in::Surface) -> crate::authentication::SignInClient {
-        crate::authentication::SignInClient {
+    fn on(
+        self,
+        surface: crate::auth::sign_in::Surface,
+    ) -> crate::auth::authentication::SignInClient {
+        crate::auth::authentication::SignInClient {
             surface,
             address: self.0,
         }
@@ -213,7 +216,7 @@ impl axum::extract::FromRequestParts<AppState> for SignInAddress {
         parts: &mut axum::http::request::Parts,
         state: &AppState,
     ) -> Result<Self, Self::Rejection> {
-        Ok(Self(crate::sign_in::request_bucket(
+        Ok(Self(crate::auth::sign_in::request_bucket(
             &parts.extensions,
             &parts.headers,
             &state.trusted_proxies,
diff --git a/src/api/catalog.rs b/src/api/catalog.rs
index cd8a23f1..541598bb 100644
--- a/src/api/catalog.rs
+++ b/src/api/catalog.rs
@@ -12,7 +12,7 @@ pub struct BrowseQuery {
 }
 
 /// Album discovery parameters. `sort` accepts the same vocabulary as the
-/// Subsonic `type` parameter — both surfaces resolve to [`AlbumOrder`], so the
+/// Subsonic `type` parameter — both surfaces resolve to [`AlbumOrder`](crate::services::AlbumOrder), so the
 /// web client can build a home screen ("recently added", "most played") in one
 /// call instead of paging the whole catalogue and sorting locally.
 #[derive(Debug, Deserialize)]
diff --git a/src/api/error.rs b/src/api/error.rs
index ee4d7ae4..91a015c6 100644
--- a/src/api/error.rs
+++ b/src/api/error.rs
@@ -113,12 +113,12 @@ pub(super) fn db_error(error: sqlx::Error) -> ApiError {
     ApiError::Unavailable
 }
 
-pub(super) fn sync_error(error: crate::sync::SyncError) -> ApiError {
+pub(super) fn sync_error(error: crate::storage::sync::SyncError) -> ApiError {
     match error {
-        crate::sync::SyncError::Invalid => ApiError::Validation,
-        crate::sync::SyncError::Conflict => ApiError::Conflict,
-        crate::sync::SyncError::CursorExpired => ApiError::CursorExpired,
-        crate::sync::SyncError::Database(error) => db_error(error),
+        crate::storage::sync::SyncError::Invalid => ApiError::Validation,
+        crate::storage::sync::SyncError::Conflict => ApiError::Conflict,
+        crate::storage::sync::SyncError::CursorExpired => ApiError::CursorExpired,
+        crate::storage::sync::SyncError::Database(error) => db_error(error),
     }
 }
 
diff --git a/src/api/libraries.rs b/src/api/libraries.rs
index 963e98fe..2fa0a749 100644
--- a/src/api/libraries.rs
+++ b/src/api/libraries.rs
@@ -13,7 +13,7 @@ pub struct ScanQueuedResponse {
 pub struct CreateLibraryRequest {
     pub name: String,
     pub path: String,
-    pub visibility: crate::database::LibraryVisibility,
+    pub visibility: crate::storage::database::LibraryVisibility,
 }
 
 #[derive(Debug, Serialize, ToSchema)]
@@ -24,7 +24,7 @@ pub struct CreateLibraryResponse {
 
 #[derive(Debug, Deserialize, ToSchema)]
 pub struct SetLibraryMemberRequest {
-    pub role: crate::database::LibraryRole,
+    pub role: crate::storage::database::LibraryRole,
 }
 
 #[utoipa::path(post, path = "/api/v2/libraries/{library_id}/scans", tag = "catalog", params(("library_id" = Uuid, Path)), responses((status = 202, body = ScanQueuedResponse), (status = 401, body = ErrorResponse), (status = 404, body = ErrorResponse)))]
@@ -42,11 +42,11 @@ pub async fn start_scan(
     Ok((StatusCode::ACCEPTED, Json(ScanQueuedResponse { scan_id })))
 }
 
-#[utoipa::path(get, path = "/api/v2/libraries", tag = "catalog", responses((status = 200, body = [crate::catalog::LibraryAccess]), (status = 401, body = ErrorResponse)))]
+#[utoipa::path(get, path = "/api/v2/libraries", tag = "catalog", responses((status = 200, body = [crate::storage::catalog::LibraryAccess]), (status = 401, body = ErrorResponse)))]
 pub async fn list_libraries(
     State(state): State<AppState>,
     headers: HeaderMap,
-) -> Result<Json<Vec<crate::catalog::LibraryAccess>>, ApiError> {
+) -> Result<Json<Vec<crate::storage::catalog::LibraryAccess>>, ApiError> {
     let user = authenticated(&state, &headers, Access::Read).await?;
     state
         .db
@@ -80,7 +80,7 @@ pub async fn create_library(
             &request.name,
             &canonical,
             request.visibility,
-            crate::authentication::now_ms(),
+            crate::auth::authentication::now_ms(),
         )
         .await
         .map_err(db_error)?;
@@ -88,7 +88,7 @@ pub async fn create_library(
     let scan_id = state
         .scanner
         .trigger(
-            crate::catalog::LibraryRecord {
+            crate::storage::catalog::LibraryRecord {
                 id: library_id,
                 name: request.name,
                 root_path: canonical,
@@ -118,7 +118,7 @@ pub async fn set_library_member(
     Json(request): Json<SetLibraryMemberRequest>,
 ) -> Result<StatusCode, ApiError> {
     let actor = authenticated(&state, &headers, Access::Admin).await?;
-    if request.role == crate::database::LibraryRole::Owner
+    if request.role == crate::storage::database::LibraryRole::Owner
         || state
             .db
             .account_by_id(user_id)
@@ -142,7 +142,7 @@ pub async fn set_library_member(
             library_id,
             user_id,
             request.role,
-            crate::authentication::now_ms(),
+            crate::auth::authentication::now_ms(),
         )
         .await
         .map_err(db_error)?;
@@ -162,7 +162,7 @@ pub async fn remove_library_member(
             actor.id,
             library_id,
             user_id,
-            crate::authentication::now_ms(),
+            crate::auth::authentication::now_ms(),
         )
         .await
         .map_err(db_error)?
@@ -173,12 +173,12 @@ pub async fn remove_library_member(
     }
 }
 
-#[utoipa::path(get, path = "/api/v2/scans/{scan_id}", tag = "catalog", params(("scan_id" = Uuid, Path)), responses((status = 200, body = crate::catalog::ScanJobRecord), (status = 401, body = ErrorResponse), (status = 404, body = ErrorResponse)))]
+#[utoipa::path(get, path = "/api/v2/scans/{scan_id}", tag = "catalog", params(("scan_id" = Uuid, Path)), responses((status = 200, body = crate::storage::catalog::ScanJobRecord), (status = 401, body = ErrorResponse), (status = 404, body = ErrorResponse)))]
 pub async fn scan_status(
     State(state): State<AppState>,
     Path(scan_id): Path<Uuid>,
     headers: HeaderMap,
-) -> Result<Json<crate::catalog::ScanJobRecord>, ApiError> {
+) -> Result<Json<crate::storage::catalog::ScanJobRecord>, ApiError> {
     let user = authenticated(&state, &headers, Access::Read).await?;
     state
         .db
@@ -327,7 +327,9 @@ pub async fn library_events(
             user.id,
             library_id,
             query.after.unwrap_or(0),
-            query.limit.unwrap_or(crate::sync::DEFAULT_SYNC_LIMIT),
+            query
+                .limit
+                .unwrap_or(crate::storage::sync::DEFAULT_SYNC_LIMIT),
         )
         .await
         .map(Json)
diff --git a/src/api/mod.rs b/src/api/mod.rs
index 784cebd3..3a6d8533 100644
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@@ -20,7 +20,7 @@ use serde::{Deserialize, Serialize};
 use utoipa::ToSchema;
 use uuid::Uuid;
 
-use crate::{authentication::AuthError, AppState};
+use crate::{auth::authentication::AuthError, AppState};
 
 pub(crate) mod access;
 mod attention;
@@ -256,7 +256,7 @@ pub fn router(state: AppState) -> Router {
         .route(
             "/api/v2/artists/{artist_id}/image/{kind}",
             put(put_artist_image).delete(delete_artist_image).layer(
-                axum::extract::DefaultBodyLimit::max(crate::portrait::MAX_IMAGE_BYTES),
+                axum::extract::DefaultBodyLimit::max(crate::remote::portrait::MAX_IMAGE_BYTES),
             ),
         )
         .route(
diff --git a/src/api/oauth.rs b/src/api/oauth.rs
index a01706dc..b14a7566 100644
--- a/src/api/oauth.rs
+++ b/src/api/oauth.rs
@@ -68,24 +68,25 @@ pub async fn oauth_authorize(
     Ok(Json(AuthorizeResponse { redirect_to }))
 }
 
-#[utoipa::path(post, path = "/api/v2/oauth/token", tag = "authentication", request_body = TokenRequest, responses((status = 200, body = crate::authentication::AuthTokens), (status = 401, body = ErrorResponse), (status = 503, body = ErrorResponse)))]
+#[utoipa::path(post, path = "/api/v2/oauth/token", tag = "authentication", request_body = TokenRequest, responses((status = 200, body = crate::auth::authentication::AuthTokens), (status = 401, body = ErrorResponse), (status = 503, body = ErrorResponse)))]
 pub async fn oauth_token(
     State(state): State<AppState>,
     Json(request): Json<TokenRequest>,
-) -> Result<Json<crate::authentication::AuthTokens>, ApiError> {
+) -> Result<Json<crate::auth::authentication::AuthTokens>, ApiError> {
     // Mounted without authentication by design: the code plus the verifier are
     // the credential. Every rejection below is the same 401 so a caller cannot
     // learn whether a code existed, expired, or was already spent.
-    let now = crate::authentication::now_ms();
+    let now = crate::auth::authentication::now_ms();
     let grant = state
         .db
-        .redeem_authorization(&crate::security::token_hash(&request.code), now)
+        .redeem_authorization(&crate::auth::security::token_hash(&request.code), now)
         .await
         .map_err(db_error)?
         .ok_or(ApiError::Unauthorized)?;
     if grant.client_id != request.client_id.trim()
         || grant.redirect_uri != request.redirect_uri
-        || crate::oauth::verify_challenge(&grant.code_challenge, &request.code_verifier).is_err()
+        || crate::auth::oauth::verify_challenge(&grant.code_challenge, &request.code_verifier)
+            .is_err()
     {
         return Err(ApiError::Unauthorized);
     }
@@ -95,7 +96,7 @@ pub async fn oauth_token(
         .await
         .map(Json)
         .map_err(|error| match error {
-            crate::authentication::AuthError::Unavailable => ApiError::Unavailable,
+            crate::auth::authentication::AuthError::Unavailable => ApiError::Unavailable,
             _ => ApiError::Unauthorized,
         })
 }
diff --git a/src/api/playback.rs b/src/api/playback.rs
index 2d8c36d5..4413aa9c 100644
--- a/src/api/playback.rs
+++ b/src/api/playback.rs
@@ -81,7 +81,7 @@ pub async fn list_history(
 ) -> Result<Json<Vec<crate::services::HistoryItem>>, ApiError> {
     let user = authenticated(&state, &headers, Access::Read).await?;
     let limit = query.limit.unwrap_or(200);
-    if !(1..=crate::sync::MAX_SYNC_LIMIT).contains(&limit) {
+    if !(1..=crate::storage::sync::MAX_SYNC_LIMIT).contains(&limit) {
         return Err(ApiError::Validation);
     }
     state
diff --git a/src/api/scrobbling.rs b/src/api/scrobbling/mod.rs
similarity index 94%
rename from src/api/scrobbling.rs
rename to src/api/scrobbling/mod.rs
index 2539d6a2..b548d679 100644
--- a/src/api/scrobbling.rs
+++ b/src/api/scrobbling/mod.rs
@@ -1,7 +1,7 @@
 //! Where an account links a destination, and answers for what could not be sent.
 //!
 //! RFC-010 decision 9: a destination's base URL belongs to the deployment and
-//! lives in `src/config.rs`, but an *authorisation* belongs to a person, so it
+//! lives in `src/config/`, but an *authorisation* belongs to a person, so it
 //! is posed here rather than by an environment variable. The same gestures exist
 //! on the CLI for an operator preparing a server without a browser — both call
 //! the same `DomainServices` methods, so the two surfaces cannot drift.
@@ -47,29 +47,7 @@ pub struct RetriedScrobbleResponse {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The secret does not survive being formatted.
-    ///
-    /// The failure message deliberately carries neither the secret nor the
-    /// formatted output: if this guard were removed, that output would *be* the
-    /// token, and a panic message is a log line. The previous slice of this RFC
-    /// earned a CodeQL `rust/cleartext-logging` alert for exactly that, on a
-    /// test whose subject was also non-disclosure.
-    #[test]
-    fn a_link_request_does_not_print_its_secret() {
-        let request = LinkScrobbleRequest {
-            secret: "a-token-nobody-should-read".to_owned(),
-        };
-        let shown = format!("{request:?}");
-        assert!(
-            !shown.contains("a-token-nobody-should-read"),
-            "the debug output carried the secret"
-        );
-        assert!(shown.contains("[redacted]"), "the secret was not replaced");
-    }
-}
+mod tests;
 
 /// The destination named in a path, or a 422.
 ///
diff --git a/src/api/scrobbling/tests.rs b/src/api/scrobbling/tests.rs
new file mode 100644
index 00000000..516c3d7e
--- /dev/null
+++ b/src/api/scrobbling/tests.rs
@@ -0,0 +1,21 @@
+use super::*;
+
+/// The secret does not survive being formatted.
+///
+/// The failure message deliberately carries neither the secret nor the
+/// formatted output: if this guard were removed, that output would *be* the
+/// token, and a panic message is a log line. The previous slice of this RFC
+/// earned a CodeQL `rust/cleartext-logging` alert for exactly that, on a
+/// test whose subject was also non-disclosure.
+#[test]
+fn a_link_request_does_not_print_its_secret() {
+    let request = LinkScrobbleRequest {
+        secret: "a-token-nobody-should-read".to_owned(),
+    };
+    let shown = format!("{request:?}");
+    assert!(
+        !shown.contains("a-token-nobody-should-read"),
+        "the debug output carried the secret"
+    );
+    assert!(shown.contains("[redacted]"), "the secret was not replaced");
+}
diff --git a/src/api/setup.rs b/src/api/setup.rs
index 00ef3386..c050038c 100644
--- a/src/api/setup.rs
+++ b/src/api/setup.rs
@@ -3,7 +3,7 @@
 //! Split out of `http.rs`; `mod.rs` re-exports it, so `crate::api::*` paths are unchanged.
 
 use super::*;
-use crate::setup_token::Admission;
+use crate::auth::setup_token::Admission;
 
 #[derive(Debug, Serialize, ToSchema)]
 pub struct SetupStatusResponse {
diff --git a/src/api/subsonic_credential.rs b/src/api/subsonic_credential.rs
index 174ff18c..708e479d 100644
--- a/src/api/subsonic_credential.rs
+++ b/src/api/subsonic_credential.rs
@@ -28,11 +28,11 @@ use super::*;
 /// A `404` would be indistinguishable from a route that is not there, and a
 /// flag beside the timestamps would tell one fact twice — the body already
 /// says it by being absent.
-#[utoipa::path(get, path = "/api/v2/subsonic-credential", tag = "account", responses((status = 200, body = Option<crate::database::SubsonicCredentialStatus>), (status = 401, body = ErrorResponse)))]
+#[utoipa::path(get, path = "/api/v2/subsonic-credential", tag = "account", responses((status = 200, body = Option<crate::storage::database::SubsonicCredentialStatus>), (status = 401, body = ErrorResponse)))]
 pub async fn own_subsonic_credential(
     State(state): State<AppState>,
     headers: HeaderMap,
-) -> Result<Json<Option<crate::database::SubsonicCredentialStatus>>, ApiError> {
+) -> Result<Json<Option<crate::storage::database::SubsonicCredentialStatus>>, ApiError> {
     let user = authenticated(&state, &headers, Access::Read).await?;
     state
         .services
diff --git a/src/api/sync.rs b/src/api/sync/mod.rs
similarity index 71%
rename from src/api/sync.rs
rename to src/api/sync/mod.rs
index 7fca7c6b..cbaf1648 100644
--- a/src/api/sync.rs
+++ b/src/api/sync/mod.rs
@@ -34,7 +34,7 @@ pub struct SyncSnapshot {
     tag = "sync",
     params(("after" = Option<i64>, Query), ("limit" = Option<i64>, Query)),
     responses(
-        (status = 200, body = crate::sync::SyncPage),
+        (status = 200, body = crate::storage::sync::SyncPage),
         (status = 401, body = ErrorResponse),
         (
             status = 409,
@@ -51,11 +51,13 @@ pub async fn sync_changes(
     State(state): State<AppState>,
     headers: HeaderMap,
     Query(query): Query<SyncQuery>,
-) -> Result<Json<crate::sync::SyncPage>, ApiError> {
+) -> Result<Json<crate::storage::sync::SyncPage>, ApiError> {
     let user = authenticated(&state, &headers, Access::Read).await?;
     let after = query.after.unwrap_or(0);
-    let limit = query.limit.unwrap_or(crate::sync::DEFAULT_SYNC_LIMIT);
-    if after < 0 || limit <= 0 || limit > crate::sync::MAX_SYNC_LIMIT {
+    let limit = query
+        .limit
+        .unwrap_or(crate::storage::sync::DEFAULT_SYNC_LIMIT);
+    if after < 0 || limit <= 0 || limit > crate::storage::sync::MAX_SYNC_LIMIT {
         return Err(ApiError::Validation);
     }
     state
@@ -79,7 +81,7 @@ pub async fn sync_snapshot(
     let user = authenticated(&state, &headers, Access::Read).await?;
     let snapshot = state
         .services
-        .sync_snapshot(user.id, crate::sync::MAX_SYNC_LIMIT)
+        .sync_snapshot(user.id, crate::storage::sync::MAX_SYNC_LIMIT)
         .await
         .map_err(service_error)?;
     let favorites = snapshot
@@ -232,9 +234,12 @@ pub(super) enum SyncNoticeAction {
 }
 
 pub(super) async fn sync_notice_action(
-    sync: &crate::sync::SyncService,
+    sync: &crate::storage::sync::SyncService,
     user_id: Uuid,
-    notice: Result<(Uuid, crate::sync::SyncNotice), tokio::sync::broadcast::error::RecvError>,
+    notice: Result<
+        (Uuid, crate::storage::sync::SyncNotice),
+        tokio::sync::broadcast::error::RecvError,
+    >,
 ) -> Result<SyncNoticeAction, sqlx::Error> {
     match notice {
         Ok((notice_user, notice)) if notice_user == user_id => {
@@ -253,86 +258,10 @@ pub(super) async fn send_sync_notice(
     sender: &mut futures_util::stream::SplitSink<WebSocket, Message>,
     cursor: i64,
 ) -> Result<(), axum::Error> {
-    let body =
-        serde_json::to_string(&crate::sync::SyncNotice { cursor }).expect("sync notice serializes");
+    let body = serde_json::to_string(&crate::storage::sync::SyncNotice { cursor })
+        .expect("sync notice serializes");
     sender.send(Message::Text(body.into())).await
 }
 
 #[cfg(test)]
-mod tests {
-    use super::{sync_notice_action, SyncNoticeAction};
-
-    /// A lagged socket recovers the cursor from the journal, not from a default.
-    ///
-    /// The distinction needs a non-zero cursor to be visible at all: a user with
-    /// no events answers 0, which is also what returning a constant would give,
-    /// so the empty case alone proves only that the branch is wired to
-    /// something. The event below is written through the real journal path, so
-    /// the expected value is one the test never chose.
-    #[tokio::test]
-    async fn lagged_sync_socket_recovers_from_the_durable_cursor() {
-        let temp = tempfile::tempdir().unwrap();
-        let config = crate::Config::for_data_dir(temp.path().join("data"));
-        let db = crate::database::Database::open(&config).await.unwrap();
-        db.migrate().await.unwrap();
-        let user_id = db
-            .create_account(
-                "lagged",
-                "hash",
-                crate::database::AccountRole::User,
-                crate::authentication::now_ms(),
-            )
-            .await
-            .unwrap();
-        let sync = crate::sync::SyncService::new(db.clone());
-
-        let context = crate::sync::MutationContext::server_generated();
-        let writer = db.writer_guard().await;
-        let mut tx = db.begin_write(&writer).await.unwrap();
-        sync.claim_operation(
-            &writer,
-            &mut tx,
-            user_id,
-            context,
-            crate::sync::MutationIntent::new("set-rating", "track:seed", &serde_json::json!({})),
-        )
-        .await
-        .unwrap();
-        let receipt = sync
-            .complete_operation(
-                &mut tx,
-                user_id,
-                context,
-                "rating",
-                uuid::Uuid::new_v4(),
-                "upsert",
-                &serde_json::json!({}),
-                None,
-            )
-            .await
-            .unwrap();
-        tx.commit().await.unwrap();
-        drop(writer);
-        assert_ne!(receipt.cursor, 0);
-
-        let action = sync_notice_action(
-            &sync,
-            user_id,
-            Err(tokio::sync::broadcast::error::RecvError::Lagged(3)),
-        )
-        .await
-        .unwrap();
-        assert_eq!(action, SyncNoticeAction::Send(receipt.cursor));
-
-        // An account with nothing in the journal still falls back to the base
-        // cursor rather than failing.
-        let action = sync_notice_action(
-            &sync,
-            uuid::Uuid::new_v4(),
-            Err(tokio::sync::broadcast::error::RecvError::Lagged(3)),
-        )
-        .await
-        .unwrap();
-        assert_eq!(action, SyncNoticeAction::Send(0));
-    }
-}
+mod tests;
diff --git a/src/api/sync/tests.rs b/src/api/sync/tests.rs
new file mode 100644
index 00000000..b138f98d
--- /dev/null
+++ b/src/api/sync/tests.rs
@@ -0,0 +1,81 @@
+use super::{sync_notice_action, SyncNoticeAction};
+
+/// A lagged socket recovers the cursor from the journal, not from a default.
+///
+/// The distinction needs a non-zero cursor to be visible at all: a user with
+/// no events answers 0, which is also what returning a constant would give,
+/// so the empty case alone proves only that the branch is wired to
+/// something. The event below is written through the real journal path, so
+/// the expected value is one the test never chose.
+#[tokio::test]
+async fn lagged_sync_socket_recovers_from_the_durable_cursor() {
+    let temp = tempfile::tempdir().unwrap();
+    let config = crate::Config::for_data_dir(temp.path().join("data"));
+    let db = crate::storage::database::Database::open(&config)
+        .await
+        .unwrap();
+    db.migrate().await.unwrap();
+    let user_id = db
+        .create_account(
+            "lagged",
+            "hash",
+            crate::storage::database::AccountRole::User,
+            crate::auth::authentication::now_ms(),
+        )
+        .await
+        .unwrap();
+    let sync = crate::storage::sync::SyncService::new(db.clone());
+
+    let context = crate::storage::sync::MutationContext::server_generated();
+    let writer = db.writer_guard().await;
+    let mut tx = db.begin_write(&writer).await.unwrap();
+    sync.claim_operation(
+        &writer,
+        &mut tx,
+        user_id,
+        context,
+        crate::storage::sync::MutationIntent::new(
+            "set-rating",
+            "track:seed",
+            &serde_json::json!({}),
+        ),
+    )
+    .await
+    .unwrap();
+    let receipt = sync
+        .complete_operation(
+            &mut tx,
+            user_id,
+            context,
+            "rating",
+            uuid::Uuid::new_v4(),
+            "upsert",
+            &serde_json::json!({}),
+            None,
+        )
+        .await
+        .unwrap();
+    tx.commit().await.unwrap();
+    drop(writer);
+    assert_ne!(receipt.cursor, 0);
+
+    let action = sync_notice_action(
+        &sync,
+        user_id,
+        Err(tokio::sync::broadcast::error::RecvError::Lagged(3)),
+    )
+    .await
+    .unwrap();
+    assert_eq!(action, SyncNoticeAction::Send(receipt.cursor));
+
+    // An account with nothing in the journal still falls back to the base
+    // cursor rather than failing.
+    let action = sync_notice_action(
+        &sync,
+        uuid::Uuid::new_v4(),
+        Err(tokio::sync::broadcast::error::RecvError::Lagged(3)),
+    )
+    .await
+    .unwrap();
+    assert_eq!(action, SyncNoticeAction::Send(0));
+}
diff --git a/src/api/tokens.rs b/src/api/tokens.rs
index b9aa6f34..6731b49b 100644
--- a/src/api/tokens.rs
+++ b/src/api/tokens.rs
@@ -18,17 +18,17 @@ pub struct CreateApiTokenRequest {
 #[derive(Debug, Serialize, ToSchema)]
 pub struct CreateApiTokenResponse {
     #[serde(flatten)]
-    pub token: crate::database::ApiTokenRecord,
+    pub token: crate::storage::database::ApiTokenRecord,
     /// Shown once. Only its SHA-256 hash is stored, so it cannot be recovered.
     pub secret: String,
 }
 
-#[utoipa::path(get, path = "/api/v2/admin/users/{username}/tokens", tag = "administration", params(("username" = String, Path)), responses((status = 200, body = [crate::database::ApiTokenRecord]), (status = 401, body = ErrorResponse), (status = 403, body = ErrorResponse), (status = 404, body = ErrorResponse)))]
+#[utoipa::path(get, path = "/api/v2/admin/users/{username}/tokens", tag = "administration", params(("username" = String, Path)), responses((status = 200, body = [crate::storage::database::ApiTokenRecord]), (status = 401, body = ErrorResponse), (status = 403, body = ErrorResponse), (status = 404, body = ErrorResponse)))]
 pub async fn list_api_tokens(
     State(state): State<AppState>,
     Path(username): Path<String>,
     headers: HeaderMap,
-) -> Result<Json<Vec<crate::database::ApiTokenRecord>>, ApiError> {
+) -> Result<Json<Vec<crate::storage::database::ApiTokenRecord>>, ApiError> {
     let actor = authenticated(&state, &headers, Access::Admin).await?;
     state
         .services
@@ -104,11 +104,11 @@ pub async fn revoke_api_token(
 /// Until now it needed the instance's administrator. A listener could not find
 /// out which clients held a credential on their own library, let alone revoke
 /// one — the material was there and visible nowhere.
-#[utoipa::path(get, path = "/api/v2/api-tokens", tag = "account", responses((status = 200, body = [crate::database::ApiTokenRecord]), (status = 401, body = ErrorResponse)))]
+#[utoipa::path(get, path = "/api/v2/api-tokens", tag = "account", responses((status = 200, body = [crate::storage::database::ApiTokenRecord]), (status = 401, body = ErrorResponse)))]
 pub async fn list_own_api_tokens(
     State(state): State<AppState>,
     headers: HeaderMap,
-) -> Result<Json<Vec<crate::database::ApiTokenRecord>>, ApiError> {
+) -> Result<Json<Vec<crate::storage::database::ApiTokenRecord>>, ApiError> {
     let user = authenticated(&state, &headers, Access::Read).await?;
     state
         .services
diff --git a/src/api/tracks.rs b/src/api/tracks.rs
index 0e350b9f..8e727707 100644
--- a/src/api/tracks.rs
+++ b/src/api/tracks.rs
@@ -11,13 +11,13 @@ pub struct TrackQuery {
     pub limit: Option<i64>,
 }
 
-#[utoipa::path(get, path = "/api/v2/libraries/{library_id}/tracks", tag = "catalog", params(("library_id" = Uuid, Path), ("q" = Option<String>, Query), ("offset" = Option<i64>, Query), ("limit" = Option<i64>, Query)), responses((status = 200, body = [crate::catalog::TrackRecord]), (status = 401, body = ErrorResponse), (status = 404, body = ErrorResponse), (status = 422, body = ErrorResponse)))]
+#[utoipa::path(get, path = "/api/v2/libraries/{library_id}/tracks", tag = "catalog", params(("library_id" = Uuid, Path), ("q" = Option<String>, Query), ("offset" = Option<i64>, Query), ("limit" = Option<i64>, Query)), responses((status = 200, body = [crate::storage::catalog::TrackRecord]), (status = 401, body = ErrorResponse), (status = 404, body = ErrorResponse), (status = 422, body = ErrorResponse)))]
 pub async fn list_tracks(
     State(state): State<AppState>,
     Path(library_id): Path<Uuid>,
     Query(query): Query<TrackQuery>,
     headers: HeaderMap,
-) -> Result<Json<Vec<crate::catalog::TrackRecord>>, ApiError> {
+) -> Result<Json<Vec<crate::storage::catalog::TrackRecord>>, ApiError> {
     let user = authenticated(&state, &headers, Access::Read).await?;
     if state
         .db
@@ -92,12 +92,12 @@ pub async fn get_track(
         .ok_or(ApiError::NotFound)
 }
 
-#[utoipa::path(get, path = "/api/v2/tracks/{track_id}/lyrics", tag = "catalog", params(("track_id" = Uuid, Path)), responses((status = 200, body = crate::lyrics::LyricsList), (status = 401, body = ErrorResponse), (status = 404, body = ErrorResponse)))]
+#[utoipa::path(get, path = "/api/v2/tracks/{track_id}/lyrics", tag = "catalog", params(("track_id" = Uuid, Path)), responses((status = 200, body = crate::library::lyrics::LyricsList), (status = 401, body = ErrorResponse), (status = 404, body = ErrorResponse)))]
 pub async fn get_track_lyrics(
     State(state): State<AppState>,
     Path(track_id): Path<Uuid>,
     headers: HeaderMap,
-) -> Result<Json<crate::lyrics::LyricsList>, ApiError> {
+) -> Result<Json<crate::library::lyrics::LyricsList>, ApiError> {
     let user = authenticated(&state, &headers, Access::Read).await?;
     // The native answer: uploads included, in RFC-012's order, each sheet
     // naming its source. The Subsonic façade reads `lyrics` instead.
@@ -109,8 +109,8 @@ pub async fn get_track_lyrics(
         .map_err(service_error)
 }
 
-fn lyrics_format(value: &str) -> Result<crate::lyrics::UploadFormat, ApiError> {
-    crate::lyrics::UploadFormat::parse(value).ok_or(ApiError::NotFound)
+fn lyrics_format(value: &str) -> Result<crate::library::lyrics::UploadFormat, ApiError> {
+    crate::library::lyrics::UploadFormat::parse(value).ok_or(ApiError::NotFound)
 }
 
 /// Uploads a lyrics sheet to a track (RFC-012 decision 6).
@@ -120,13 +120,13 @@ fn lyrics_format(value: &str) -> Result<crate::lyrics::UploadFormat, ApiError> {
 /// again in the same format replaces it. A sheet with nothing usable in it is
 /// refused with `422`. Owners and managers only; anyone else gets the `404` a
 /// track they could not see would give.
-#[utoipa::path(put, path = "/api/v2/tracks/{track_id}/lyrics/{format}", tag = "catalog", params(("track_id" = Uuid, Path), ("format" = String, Path, description = "lrc, txt or ttml")), request_body(content = Vec<u8>, content_type = "application/octet-stream"), responses((status = 200, body = crate::lyrics::LyricsList), (status = 401, body = ErrorResponse), (status = 404, body = ErrorResponse), (status = 413), (status = 422, body = ErrorResponse)))]
+#[utoipa::path(put, path = "/api/v2/tracks/{track_id}/lyrics/{format}", tag = "catalog", params(("track_id" = Uuid, Path), ("format" = String, Path, description = "lrc, txt or ttml")), request_body(content = Vec<u8>, content_type = "application/octet-stream"), responses((status = 200, body = crate::library::lyrics::LyricsList), (status = 401, body = ErrorResponse), (status = 404, body = ErrorResponse), (status = 413), (status = 422, body = ErrorResponse)))]
 pub async fn put_track_lyrics(
     State(state): State<AppState>,
     Path((track_id, format)): Path<(Uuid, String)>,
     headers: HeaderMap,
     body: axum::body::Bytes,
-) -> Result<Json<crate::lyrics::LyricsList>, ApiError> {
+) -> Result<Json<crate::library::lyrics::LyricsList>, ApiError> {
     let user = authenticated(&state, &headers, Access::Write).await?;
     let format = lyrics_format(&format)?;
     state
diff --git a/src/api/users.rs b/src/api/users.rs
index c86c0bb5..ae553d98 100644
--- a/src/api/users.rs
+++ b/src/api/users.rs
@@ -8,12 +8,12 @@ use super::*;
 pub struct CreateUserRequest {
     pub username: String,
     pub web_password: String,
-    pub role: crate::database::AccountRole,
+    pub role: crate::storage::database::AccountRole,
 }
 
 #[derive(Debug, Deserialize, ToSchema)]
 pub struct UpdateUserRequest {
-    pub role: Option<crate::database::AccountRole>,
+    pub role: Option<crate::storage::database::AccountRole>,
     pub disabled: Option<bool>,
     pub library_ids: Option<Vec<Uuid>>,
     pub subsonic_password: Option<String>,
@@ -81,7 +81,7 @@ pub async fn update_user(
             crate::services::UserUpdate {
                 admin: request
                     .role
-                    .map(|role| role == crate::database::AccountRole::Admin),
+                    .map(|role| role == crate::storage::database::AccountRole::Admin),
                 disabled: request.disabled,
                 folder_ids: request.library_ids.as_deref(),
                 subsonic_password: request.subsonic_password.as_deref(),
diff --git a/src/api/web_session.rs b/src/api/web_session/mod.rs
similarity index 87%
rename from src/api/web_session.rs
rename to src/api/web_session/mod.rs
index 3f168c3e..57bac45d 100644
--- a/src/api/web_session.rs
+++ b/src/api/web_session/mod.rs
@@ -9,16 +9,16 @@ pub struct WebAuthResponse {
     pub access_token: String,
     pub token_type: &'static str,
     pub expires_in: u64,
-    pub user: crate::authentication::AuthUser,
+    pub user: crate::auth::authentication::AuthUser,
     pub device_id: Uuid,
 }
 
 pub(super) fn web_auth_response(
     state: &AppState,
     _headers: &HeaderMap,
-    tokens: crate::authentication::AuthTokens,
+    tokens: crate::auth::authentication::AuthTokens,
 ) -> Result<Response, ApiError> {
-    let csrf_token = crate::security::generate_token("wfcsrf_");
+    let csrf_token = crate::auth::security::generate_token("wfcsrf_");
     let secure = secure_cookies(state);
     let refresh_cookie = format!(
         "{WEB_REFRESH_COOKIE}={}; Path=/api/v2/web/auth; HttpOnly; SameSite=Strict; Max-Age={}{}",
@@ -86,7 +86,7 @@ pub(super) fn validate_web_request(state: &AppState, headers: &HeaderMap) -> Res
         .get(WEB_CSRF_HEADER)
         .and_then(|value| value.to_str().ok())
         .ok_or(ApiError::Forbidden)?;
-    if !crate::security::constant_time_bytes_eq(cookie.as_bytes(), supplied.as_bytes()) {
+    if !crate::auth::security::constant_time_bytes_eq(cookie.as_bytes(), supplied.as_bytes()) {
         return Err(ApiError::Forbidden);
     }
     Ok(())
@@ -126,14 +126,4 @@ pub(super) fn validate_web_origin(state: &AppState, headers: &HeaderMap) -> Resu
 }
 
 #[cfg(test)]
-mod tests {
-    use super::public_url_is_https;
-
-    #[test]
-    fn secure_cookie_detection_uses_the_parsed_url_scheme() {
-        assert!(public_url_is_https(Some("HTTPS://waveflow.test/")));
-        assert!(!public_url_is_https(Some("http://waveflow.test")));
-        assert!(!public_url_is_https(Some("not a URL")));
-        assert!(!public_url_is_https(None));
-    }
-}
+mod tests;
diff --git a/src/api/web_session/tests.rs b/src/api/web_session/tests.rs
new file mode 100644
index 00000000..433b13f9
--- /dev/null
+++ b/src/api/web_session/tests.rs
@@ -0,0 +1,9 @@
+use super::public_url_is_https;
+
+#[test]
+fn secure_cookie_detection_uses_the_parsed_url_scheme() {
+    assert!(public_url_is_https(Some("HTTPS://waveflow.test/")));
+    assert!(!public_url_is_https(Some("http://waveflow.test")));
+    assert!(!public_url_is_https(Some("not a URL")));
+    assert!(!public_url_is_https(None));
+}
diff --git a/src/app/boot.rs b/src/app/boot.rs
index dedabc2a..c06a4593 100644
--- a/src/app/boot.rs
+++ b/src/app/boot.rs
@@ -5,8 +5,9 @@ use std::{sync::Arc, time::Duration};
 
 use super::state::{chunk_body_limit, negotiation_body_limit, AppState};
 use crate::{
-    authentication, database, enrichment, link_roots, lrclib, media, migration_backup, quality,
-    scanner, scrobblers, security, services, setup_token, sync, Config,
+    auth::authentication, auth::security, auth::setup_token, library::link_roots, library::scanner,
+    media, quality, remote::enrichment, remote::lrclib, remote::scrobblers, services,
+    storage::database, storage::migration_backup, storage::sync, Config,
 };
 
 pub async fn initialize(config: &Config) -> anyhow::Result<AppState> {
diff --git a/src/app/openapi.rs b/src/app/openapi.rs
index eb56d758..e87cd174 100644
--- a/src/app/openapi.rs
+++ b/src/app/openapi.rs
@@ -5,7 +5,10 @@
 use axum::response::{IntoResponse, Response};
 use utoipa::OpenApi;
 
-use crate::{api, authentication, catalog, database, lyrics, media, services, sync};
+use crate::{
+    api, auth::authentication, library::lyrics, media, services, storage::catalog,
+    storage::database, storage::sync,
+};
 
 pub const OPENAPI_JSON_PATH: &str = "/openapi.json";
 pub const SCALAR_PATH: &str = "/reference";
@@ -339,7 +342,7 @@ pub const SCALAR_PATH: &str = "/reference";
         api::UpdateUserRequest,
         api::SetSubsonicCredentialRequest,
         api::SubsonicCredentialResponse,
-        crate::database::SubsonicCredentialStatus,
+        crate::storage::database::SubsonicCredentialStatus,
         api::BookmarkRequest,
         api::RadioStationRequest,
         api::CreateApiTokenRequest,
diff --git a/src/app/router.rs b/src/app/router.rs
index c6593b5e..57b44e97 100644
--- a/src/app/router.rs
+++ b/src/app/router.rs
@@ -12,7 +12,7 @@ use utoipa::OpenApi;
 
 use super::openapi::{openapi_response, ApiDoc, OPENAPI_JSON_PATH};
 use super::state::AppState;
-use crate::{api, media, public_share, reference, subsonic, webui, Config};
+use crate::{api, http::public_share, http::reference, http::webui, media, subsonic, Config};
 
 const REQUEST_ID_HEADER: &str = "x-request-id";
 
diff --git a/src/app/state.rs b/src/app/state.rs
index a0e8e91d..db6272e3 100644
--- a/src/app/state.rs
+++ b/src/app/state.rs
@@ -4,7 +4,8 @@
 use std::sync::Arc;
 
 use crate::{
-    authentication, config, database, media, scanner, security, services, setup_token, sync,
+    auth::authentication, auth::security, auth::setup_token, config, library::scanner, media,
+    services, storage::database, storage::sync,
 };
 
 #[derive(Clone)]
diff --git a/src/authentication.rs b/src/auth/authentication.rs
similarity index 99%
rename from src/authentication.rs
rename to src/auth/authentication.rs
index 3f7ba2f0..d4e78f27 100644
--- a/src/authentication.rs
+++ b/src/auth/authentication.rs
@@ -5,10 +5,10 @@ use utoipa::ToSchema;
 use uuid::Uuid;
 
 use crate::{
+    auth::security,
+    auth::sign_in::{self, Refusal, SignInGuard, Surface},
     config::Config,
-    database::{AccountRole, Database, NewSession},
-    security,
-    sign_in::{self, Refusal, SignInGuard, Surface},
+    storage::database::{AccountRole, Database, NewSession},
 };
 
 #[derive(Clone)]
diff --git a/src/auth/mod.rs b/src/auth/mod.rs
new file mode 100644
index 00000000..3a88da11
--- /dev/null
+++ b/src/auth/mod.rs
@@ -0,0 +1,10 @@
+//! Who is calling: accounts and sessions, the password guard, native-client
+//! OAuth, the first-run setup token, the instance key's cryptography and the
+//! stream tickets browser playback is authorised with.
+
+pub mod authentication;
+pub mod oauth;
+pub mod security;
+pub mod setup_token;
+pub mod sign_in;
+pub mod stream_ticket;
diff --git a/src/oauth.rs b/src/auth/oauth/mod.rs
similarity index 54%
rename from src/oauth.rs
rename to src/auth/oauth/mod.rs
index 39fcceb6..eb306c93 100644
--- a/src/oauth.rs
+++ b/src/auth/oauth/mod.rs
@@ -82,7 +82,7 @@ pub fn verify_challenge(challenge: &str, verifier: &str) -> Result<(), GrantErro
     let expected = challenge_for(verifier);
     // The challenge is public, but constant-time keeps the comparison uniform
     // with the rest of the credential handling in this codebase.
-    if crate::security::constant_time_bytes_eq(expected.as_bytes(), challenge.as_bytes()) {
+    if crate::auth::security::constant_time_bytes_eq(expected.as_bytes(), challenge.as_bytes()) {
         Ok(())
     } else {
         Err(GrantError::InvalidVerifier)
@@ -105,99 +105,4 @@ pub fn redirect_with_code(redirect_uri: &str, code: &str, state: Option<&str>) -
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn loopback_and_private_schemes_are_accepted_but_remote_http_is_not() {
-        assert!(validate_redirect_uri("http://127.0.0.1:49152/callback").is_ok());
-        assert!(validate_redirect_uri("http://localhost:1234/cb").is_ok());
-        assert!(validate_redirect_uri("http://[::1]:5000/cb").is_ok());
-        assert!(validate_redirect_uri("https://desktop.example.com/cb").is_ok());
-        assert!(validate_redirect_uri("com.waveflow.desktop://auth").is_ok());
-
-        // Clear-text to another host would leak the code off the machine.
-        assert_eq!(
-            validate_redirect_uri("http://evil.example.com/cb"),
-            Err(GrantError::UnsupportedRedirect)
-        );
-        // A bare scheme is claimable by any other application.
-        assert_eq!(
-            validate_redirect_uri("waveflow:/auth"),
-            Err(GrantError::UnsupportedRedirect)
-        );
-        assert_eq!(
-            validate_redirect_uri("not a url"),
-            Err(GrantError::UnsupportedRedirect)
-        );
-    }
-
-    #[test]
-    fn only_s256_challenges_are_accepted() {
-        let challenge = URL_SAFE_NO_PAD.encode(Sha256::digest(b"a".repeat(43)));
-        assert!(validate_challenge("S256", &challenge).is_ok());
-        assert!(validate_challenge("s256", &challenge).is_ok());
-        assert_eq!(
-            validate_challenge("plain", &challenge),
-            Err(GrantError::UnsupportedChallenge)
-        );
-        assert_eq!(
-            validate_challenge("S256", "short"),
-            Err(GrantError::UnsupportedChallenge)
-        );
-        assert_eq!(
-            validate_challenge("S256", &"a".repeat(64)),
-            Err(GrantError::UnsupportedChallenge),
-            "an S256 challenge is exactly 43 characters"
-        );
-        assert_eq!(
-            validate_challenge("S256", &"+".repeat(43)),
-            Err(GrantError::UnsupportedChallenge),
-            "standard base64 padding characters are not base64url"
-        );
-
-        // Right length, right alphabet, but the final character sets padding
-        // bits a digest never sets. It decodes to nothing a verifier can match.
-        let canonical = challenge_for(&"x".repeat(64));
-        const ALPHABET: &str = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-        let last = canonical.chars().last().unwrap();
-        let shifted = ALPHABET
-            .chars()
-            .nth(ALPHABET.chars().position(|c| c == last).unwrap() + 1)
-            .unwrap();
-        let non_canonical = format!("{}{shifted}", &canonical[..42]);
-        assert_eq!(non_canonical.len(), 43);
-        assert_eq!(
-            validate_challenge("S256", &non_canonical),
-            Err(GrantError::UnsupportedChallenge),
-            "a non-canonical encoding is not a challenge any verifier can match"
-        );
-    }
-
-    #[test]
-    fn a_verifier_only_matches_its_own_challenge() {
-        let verifier = "x".repeat(64);
-        let challenge = URL_SAFE_NO_PAD.encode(Sha256::digest(verifier.as_bytes()));
-        assert!(verify_challenge(&challenge, &verifier).is_ok());
-        assert_eq!(
-            verify_challenge(&challenge, &"y".repeat(64)),
-            Err(GrantError::InvalidVerifier)
-        );
-        assert_eq!(
-            verify_challenge(&challenge, "too-short"),
-            Err(GrantError::InvalidVerifier)
-        );
-    }
-
-    #[test]
-    fn redirect_preserves_existing_query_and_state() {
-        let redirected = redirect_with_code(
-            "http://127.0.0.1:49152/cb?flow=desktop",
-            "the-code",
-            Some("the-state"),
-        );
-        assert!(redirected.contains("flow=desktop"));
-        assert!(redirected.contains("code=the-code"));
-        assert!(redirected.contains("state=the-state"));
-    }
-}
+mod tests;
diff --git a/src/auth/oauth/tests.rs b/src/auth/oauth/tests.rs
new file mode 100644
index 00000000..6d307e7e
--- /dev/null
+++ b/src/auth/oauth/tests.rs
@@ -0,0 +1,94 @@
+use super::*;
+
+#[test]
+fn loopback_and_private_schemes_are_accepted_but_remote_http_is_not() {
+    assert!(validate_redirect_uri("http://127.0.0.1:49152/callback").is_ok());
+    assert!(validate_redirect_uri("http://localhost:1234/cb").is_ok());
+    assert!(validate_redirect_uri("http://[::1]:5000/cb").is_ok());
+    assert!(validate_redirect_uri("https://desktop.example.com/cb").is_ok());
+    assert!(validate_redirect_uri("com.waveflow.desktop://auth").is_ok());
+
+    // Clear-text to another host would leak the code off the machine.
+    assert_eq!(
+        validate_redirect_uri("http://evil.example.com/cb"),
+        Err(GrantError::UnsupportedRedirect)
+    );
+    // A bare scheme is claimable by any other application.
+    assert_eq!(
+        validate_redirect_uri("waveflow:/auth"),
+        Err(GrantError::UnsupportedRedirect)
+    );
+    assert_eq!(
+        validate_redirect_uri("not a url"),
+        Err(GrantError::UnsupportedRedirect)
+    );
+}
+
+#[test]
+fn only_s256_challenges_are_accepted() {
+    let challenge = URL_SAFE_NO_PAD.encode(Sha256::digest(b"a".repeat(43)));
+    assert!(validate_challenge("S256", &challenge).is_ok());
+    assert!(validate_challenge("s256", &challenge).is_ok());
+    assert_eq!(
+        validate_challenge("plain", &challenge),
+        Err(GrantError::UnsupportedChallenge)
+    );
+    assert_eq!(
+        validate_challenge("S256", "short"),
+        Err(GrantError::UnsupportedChallenge)
+    );
+    assert_eq!(
+        validate_challenge("S256", &"a".repeat(64)),
+        Err(GrantError::UnsupportedChallenge),
+        "an S256 challenge is exactly 43 characters"
+    );
+    assert_eq!(
+        validate_challenge("S256", &"+".repeat(43)),
+        Err(GrantError::UnsupportedChallenge),
+        "standard base64 padding characters are not base64url"
+    );
+
+    // Right length, right alphabet, but the final character sets padding
+    // bits a digest never sets. It decodes to nothing a verifier can match.
+    let canonical = challenge_for(&"x".repeat(64));
+    const ALPHABET: &str = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+    let last = canonical.chars().last().unwrap();
+    let shifted = ALPHABET
+        .chars()
+        .nth(ALPHABET.chars().position(|c| c == last).unwrap() + 1)
+        .unwrap();
+    let non_canonical = format!("{}{shifted}", &canonical[..42]);
+    assert_eq!(non_canonical.len(), 43);
+    assert_eq!(
+        validate_challenge("S256", &non_canonical),
+        Err(GrantError::UnsupportedChallenge),
+        "a non-canonical encoding is not a challenge any verifier can match"
+    );
+}
+
+#[test]
+fn a_verifier_only_matches_its_own_challenge() {
+    let verifier = "x".repeat(64);
+    let challenge = URL_SAFE_NO_PAD.encode(Sha256::digest(verifier.as_bytes()));
+    assert!(verify_challenge(&challenge, &verifier).is_ok());
+    assert_eq!(
+        verify_challenge(&challenge, &"y".repeat(64)),
+        Err(GrantError::InvalidVerifier)
+    );
+    assert_eq!(
+        verify_challenge(&challenge, "too-short"),
+        Err(GrantError::InvalidVerifier)
+    );
+}
+
+#[test]
+fn redirect_preserves_existing_query_and_state() {
+    let redirected = redirect_with_code(
+        "http://127.0.0.1:49152/cb?flow=desktop",
+        "the-code",
+        Some("the-state"),
+    );
+    assert!(redirected.contains("flow=desktop"));
+    assert!(redirected.contains("code=the-code"));
+    assert!(redirected.contains("state=the-state"));
+}
diff --git a/src/security.rs b/src/auth/security/mod.rs
similarity index 83%
rename from src/security.rs
rename to src/auth/security/mod.rs
index c5b3a362..b58c5171 100644
--- a/src/security.rs
+++ b/src/auth/security/mod.rs
@@ -191,7 +191,7 @@ pub fn token_matches(token: &str, expected_hash: &[u8]) -> bool {
 /// `false` means the path was already taken. [`SecretBox::load_or_create`]
 /// treats that as a race it lost and re-reads the winner's key;
 /// [`SecretBox::create_instance_key`] treats it as a refusal, because it is
-/// staging a file that must not exist. [`crate::setup_token`] writes the
+/// staging a file that must not exist. [`crate::auth::setup_token`] writes the
 /// setup token through it too, for the owner-only mode on Unix.
 pub(crate) fn write_new_secret_file(path: &Path, bytes: &[u8]) -> Result<bool, SecurityError> {
     if let Some(parent) = path.parent() {
@@ -218,47 +218,4 @@ pub(crate) fn write_new_secret_file(path: &Path, bytes: &[u8]) -> Result<bool, S
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn password_round_trip() {
-        let hash = hash_password("correct horse battery staple").unwrap();
-        assert!(verify_password("correct horse battery staple", &hash).unwrap());
-        assert!(!verify_password("incorrect password", &hash).unwrap());
-        assert!(!hash.contains("correct horse"));
-    }
-
-    #[test]
-    fn encrypted_secret_round_trip() {
-        let secret_box = SecretBox::from_key_bytes(&[7; 32]).unwrap();
-        let encrypted = secret_box.encrypt(b"subsonic-only-password").unwrap();
-        assert_ne!(encrypted.ciphertext, b"subsonic-only-password");
-        assert_eq!(
-            secret_box
-                .decrypt(&encrypted.nonce, &encrypted.ciphertext)
-                .unwrap(),
-            b"subsonic-only-password"
-        );
-    }
-
-    #[test]
-    fn share_tokens_are_stable_and_bound_to_the_instance_and_share() {
-        let secret = SecretBox::from_key_bytes(&[7; 32]).unwrap();
-        let other_secret = SecretBox::from_key_bytes(&[8; 32]).unwrap();
-        let share = uuid::Uuid::new_v4();
-
-        assert_eq!(
-            secret.derive_share_token(share),
-            secret.derive_share_token(share)
-        );
-        assert_ne!(
-            secret.derive_share_token(share),
-            secret.derive_share_token(uuid::Uuid::new_v4())
-        );
-        assert_ne!(
-            secret.derive_share_token(share),
-            other_secret.derive_share_token(share)
-        );
-    }
-}
+mod tests;
diff --git a/src/auth/security/tests.rs b/src/auth/security/tests.rs
new file mode 100644
index 00000000..e286625a
--- /dev/null
+++ b/src/auth/security/tests.rs
@@ -0,0 +1,42 @@
+use super::*;
+
+#[test]
+fn password_round_trip() {
+    let hash = hash_password("correct horse battery staple").unwrap();
+    assert!(verify_password("correct horse battery staple", &hash).unwrap());
+    assert!(!verify_password("incorrect password", &hash).unwrap());
+    assert!(!hash.contains("correct horse"));
+}
+
+#[test]
+fn encrypted_secret_round_trip() {
+    let secret_box = SecretBox::from_key_bytes(&[7; 32]).unwrap();
+    let encrypted = secret_box.encrypt(b"subsonic-only-password").unwrap();
+    assert_ne!(encrypted.ciphertext, b"subsonic-only-password");
+    assert_eq!(
+        secret_box
+            .decrypt(&encrypted.nonce, &encrypted.ciphertext)
+            .unwrap(),
+        b"subsonic-only-password"
+    );
+}
+
+#[test]
+fn share_tokens_are_stable_and_bound_to_the_instance_and_share() {
+    let secret = SecretBox::from_key_bytes(&[7; 32]).unwrap();
+    let other_secret = SecretBox::from_key_bytes(&[8; 32]).unwrap();
+    let share = uuid::Uuid::new_v4();
+
+    assert_eq!(
+        secret.derive_share_token(share),
+        secret.derive_share_token(share)
+    );
+    assert_ne!(
+        secret.derive_share_token(share),
+        secret.derive_share_token(uuid::Uuid::new_v4())
+    );
+    assert_ne!(
+        secret.derive_share_token(share),
+        other_secret.derive_share_token(share)
+    );
+}
diff --git a/src/setup_token.rs b/src/auth/setup_token/mod.rs
similarity index 63%
rename from src/setup_token.rs
rename to src/auth/setup_token/mod.rs
index e4bc83d0..4433c3e4 100644
--- a/src/setup_token.rs
+++ b/src/auth/setup_token/mod.rs
@@ -27,8 +27,8 @@
 use std::path::{Path, PathBuf};
 use std::sync::Mutex;
 
+use crate::auth::security;
 use crate::config::{Config, SETUP_TOKEN_MIN_CHARS};
-use crate::security;
 
 /// The file a drawn token is written to, inside the data directory.
 pub const FILE_NAME: &str = "setup-token";
@@ -225,129 +225,4 @@ fn remove_if_present(path: &Path) -> std::io::Result<()> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn config(temp: &tempfile::TempDir) -> Config {
-        Config::for_data_dir(temp.path().join("data"))
-    }
-
-    fn written_token(config: &Config) -> String {
-        std::fs::read_to_string(config.data_dir.join(FILE_NAME))
-            .expect("the token file")
-            .trim()
-            .to_owned()
-    }
-
-    #[test]
-    fn a_drawn_token_admits_only_itself_and_is_forgotten_on_close() {
-        let temp = tempfile::tempdir().unwrap();
-        let config = config(&temp);
-        let gate = SetupGate::prepare(&config, true).unwrap();
-        let token = written_token(&config);
-        assert!(token.starts_with(PREFIX));
-        assert_eq!(
-            gate.source(),
-            Some(TokenSource::File(config.data_dir.join(FILE_NAME)))
-        );
-
-        assert_eq!(gate.admit(None), Admission::Rejected);
-        assert_eq!(gate.admit(Some("")), Admission::Rejected);
-        let wrong = security::generate_token(PREFIX);
-        assert_eq!(gate.admit(Some(&wrong)), Admission::Rejected);
-        assert_eq!(gate.admit(Some(&token)), Admission::Admitted);
-
-        gate.close();
-        assert_eq!(gate.admit(Some(&token)), Admission::Closed);
-        assert!(!config.data_dir.join(FILE_NAME).exists());
-        assert_eq!(gate.source(), None);
-    }
-
-    #[test]
-    fn a_restart_keeps_the_token_already_written() {
-        let temp = tempfile::tempdir().unwrap();
-        let config = config(&temp);
-        SetupGate::prepare(&config, true).unwrap();
-        let first = written_token(&config);
-        let again = SetupGate::prepare(&config, true).unwrap();
-        assert_eq!(written_token(&config), first);
-        assert_eq!(again.admit(Some(&first)), Admission::Admitted);
-    }
-
-    #[test]
-    fn an_operator_token_writes_no_file_and_replaces_a_drawn_one() {
-        let temp = tempfile::tempdir().unwrap();
-        let mut config = config(&temp);
-        SetupGate::prepare(&config, true).unwrap();
-        let drawn = written_token(&config);
-
-        let chosen = uuid::Uuid::new_v4().to_string();
-        config.setup_token = Some(chosen.clone());
-        let gate = SetupGate::prepare(&config, true).unwrap();
-        assert!(!config.data_dir.join(FILE_NAME).exists());
-        assert_eq!(gate.source(), Some(TokenSource::Operator));
-        assert_eq!(gate.admit(Some(&drawn)), Admission::Rejected);
-        assert_eq!(gate.admit(Some(&chosen)), Admission::Admitted);
-    }
-
-    #[test]
-    fn a_file_another_process_has_not_finished_writing_is_refused() {
-        let temp = tempfile::tempdir().unwrap();
-        let path = temp.path().join(FILE_NAME);
-        let token = security::generate_token(PREFIX);
-        // Created and not yet written, then cut short: neither is a token, and
-        // the first would otherwise admit a request that sends none.
-        for partial in [
-            String::new(),
-            "\n".to_owned(),
-            token[..PREFIX.len() + 4].to_owned(),
-        ] {
-            std::fs::write(&path, &partial).unwrap();
-            let refused = written_by_another(&path).expect_err(&format!("{partial:?}"));
-            assert!(refused.to_string().contains(&path.display().to_string()));
-        }
-        std::fs::write(&path, format!("{token}\n")).unwrap();
-        assert_eq!(written_by_another(&path).unwrap(), token);
-    }
-
-    #[test]
-    fn an_operator_token_built_in_process_still_meets_the_floor() {
-        let temp = tempfile::tempdir().unwrap();
-        let mut config = config(&temp);
-        config.setup_token =
-            Some(uuid::Uuid::new_v4().to_string()[..SETUP_TOKEN_MIN_CHARS - 1].to_owned());
-        assert!(SetupGate::prepare(&config, true).is_err());
-        // Spaces do not count toward it.
-        config.setup_token = Some(format!(
-            "  {}  ",
-            &uuid::Uuid::new_v4().to_string()[..SETUP_TOKEN_MIN_CHARS - 1]
-        ));
-        assert!(SetupGate::prepare(&config, true).is_err());
-    }
-
-    #[test]
-    fn a_boot_with_an_account_closes_setup_and_deletes_a_stale_file() {
-        let temp = tempfile::tempdir().unwrap();
-        let config = config(&temp);
-        SetupGate::prepare(&config, true).unwrap();
-        let drawn = written_token(&config);
-
-        let gate = SetupGate::prepare(&config, false).unwrap();
-        assert!(!config.data_dir.join(FILE_NAME).exists());
-        assert_eq!(gate.admit(Some(&drawn)), Admission::Closed);
-    }
-
-    #[cfg(unix)]
-    #[test]
-    fn the_token_file_is_readable_by_its_owner_only() {
-        use std::os::unix::fs::PermissionsExt;
-        let temp = tempfile::tempdir().unwrap();
-        let config = config(&temp);
-        SetupGate::prepare(&config, true).unwrap();
-        let mode = std::fs::metadata(config.data_dir.join(FILE_NAME))
-            .unwrap()
-            .permissions()
-            .mode();
-        assert_eq!(mode & 0o077, 0, "mode {mode:o}");
-    }
-}
+mod tests;
diff --git a/src/auth/setup_token/tests.rs b/src/auth/setup_token/tests.rs
new file mode 100644
index 00000000..ea7b5efc
--- /dev/null
+++ b/src/auth/setup_token/tests.rs
@@ -0,0 +1,124 @@
+use super::*;
+
+fn config(temp: &tempfile::TempDir) -> Config {
+    Config::for_data_dir(temp.path().join("data"))
+}
+
+fn written_token(config: &Config) -> String {
+    std::fs::read_to_string(config.data_dir.join(FILE_NAME))
+        .expect("the token file")
+        .trim()
+        .to_owned()
+}
+
+#[test]
+fn a_drawn_token_admits_only_itself_and_is_forgotten_on_close() {
+    let temp = tempfile::tempdir().unwrap();
+    let config = config(&temp);
+    let gate = SetupGate::prepare(&config, true).unwrap();
+    let token = written_token(&config);
+    assert!(token.starts_with(PREFIX));
+    assert_eq!(
+        gate.source(),
+        Some(TokenSource::File(config.data_dir.join(FILE_NAME)))
+    );
+
+    assert_eq!(gate.admit(None), Admission::Rejected);
+    assert_eq!(gate.admit(Some("")), Admission::Rejected);
+    let wrong = security::generate_token(PREFIX);
+    assert_eq!(gate.admit(Some(&wrong)), Admission::Rejected);
+    assert_eq!(gate.admit(Some(&token)), Admission::Admitted);
+
+    gate.close();
+    assert_eq!(gate.admit(Some(&token)), Admission::Closed);
+    assert!(!config.data_dir.join(FILE_NAME).exists());
+    assert_eq!(gate.source(), None);
+}
+
+#[test]
+fn a_restart_keeps_the_token_already_written() {
+    let temp = tempfile::tempdir().unwrap();
+    let config = config(&temp);
+    SetupGate::prepare(&config, true).unwrap();
+    let first = written_token(&config);
+    let again = SetupGate::prepare(&config, true).unwrap();
+    assert_eq!(written_token(&config), first);
+    assert_eq!(again.admit(Some(&first)), Admission::Admitted);
+}
+
+#[test]
+fn an_operator_token_writes_no_file_and_replaces_a_drawn_one() {
+    let temp = tempfile::tempdir().unwrap();
+    let mut config = config(&temp);
+    SetupGate::prepare(&config, true).unwrap();
+    let drawn = written_token(&config);
+
+    let chosen = uuid::Uuid::new_v4().to_string();
+    config.setup_token = Some(chosen.clone());
+    let gate = SetupGate::prepare(&config, true).unwrap();
+    assert!(!config.data_dir.join(FILE_NAME).exists());
+    assert_eq!(gate.source(), Some(TokenSource::Operator));
+    assert_eq!(gate.admit(Some(&drawn)), Admission::Rejected);
+    assert_eq!(gate.admit(Some(&chosen)), Admission::Admitted);
+}
+
+#[test]
+fn a_file_another_process_has_not_finished_writing_is_refused() {
+    let temp = tempfile::tempdir().unwrap();
+    let path = temp.path().join(FILE_NAME);
+    let token = security::generate_token(PREFIX);
+    // Created and not yet written, then cut short: neither is a token, and
+    // the first would otherwise admit a request that sends none.
+    for partial in [
+        String::new(),
+        "\n".to_owned(),
+        token[..PREFIX.len() + 4].to_owned(),
+    ] {
+        std::fs::write(&path, &partial).unwrap();
+        let refused = written_by_another(&path).expect_err(&format!("{partial:?}"));
+        assert!(refused.to_string().contains(&path.display().to_string()));
+    }
+    std::fs::write(&path, format!("{token}\n")).unwrap();
+    assert_eq!(written_by_another(&path).unwrap(), token);
+}
+
+#[test]
+fn an_operator_token_built_in_process_still_meets_the_floor() {
+    let temp = tempfile::tempdir().unwrap();
+    let mut config = config(&temp);
+    config.setup_token =
+        Some(uuid::Uuid::new_v4().to_string()[..SETUP_TOKEN_MIN_CHARS - 1].to_owned());
+    assert!(SetupGate::prepare(&config, true).is_err());
+    // Spaces do not count toward it.
+    config.setup_token = Some(format!(
+        "  {}  ",
+        &uuid::Uuid::new_v4().to_string()[..SETUP_TOKEN_MIN_CHARS - 1]
+    ));
+    assert!(SetupGate::prepare(&config, true).is_err());
+}
+
+#[test]
+fn a_boot_with_an_account_closes_setup_and_deletes_a_stale_file() {
+    let temp = tempfile::tempdir().unwrap();
+    let config = config(&temp);
+    SetupGate::prepare(&config, true).unwrap();
+    let drawn = written_token(&config);
+
+    let gate = SetupGate::prepare(&config, false).unwrap();
+    assert!(!config.data_dir.join(FILE_NAME).exists());
+    assert_eq!(gate.admit(Some(&drawn)), Admission::Closed);
+}
+
+#[cfg(unix)]
+#[test]
+fn the_token_file_is_readable_by_its_owner_only() {
+    use std::os::unix::fs::PermissionsExt;
+    let temp = tempfile::tempdir().unwrap();
+    let config = config(&temp);
+    SetupGate::prepare(&config, true).unwrap();
+    let mode = std::fs::metadata(config.data_dir.join(FILE_NAME))
+        .unwrap()
+        .permissions()
+        .mode();
+    assert_eq!(mode & 0o077, 0, "mode {mode:o}");
+}
diff --git a/src/sign_in.rs b/src/auth/sign_in/mod.rs
similarity index 65%
rename from src/sign_in.rs
rename to src/auth/sign_in/mod.rs
index f3640dcf..2f90a85c 100644
--- a/src/sign_in.rs
+++ b/src/auth/sign_in/mod.rs
@@ -506,249 +506,4 @@ impl Surface {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use axum::http::HeaderValue;
-
-    fn nets(list: &[&str]) -> Vec<IpNet> {
-        list.iter().map(|net| net.parse().unwrap()).collect()
-    }
-
-    fn forwarded(values: &[&str]) -> HeaderMap {
-        let mut headers = HeaderMap::new();
-        for value in values {
-            headers.append("x-forwarded-for", HeaderValue::from_str(value).unwrap());
-        }
-        headers
-    }
-
-    fn ip(value: &str) -> IpAddr {
-        value.parse().unwrap()
-    }
-
-    #[test]
-    fn an_untrusted_peer_is_the_client_whatever_it_forwards() {
-        let headers = forwarded(&["203.0.113.9"]);
-        assert_eq!(
-            client_address(Some(ip("198.51.100.7")), &headers, &nets(&["10.0.0.0/8"])),
-            Some(ip("198.51.100.7"))
-        );
-    }
-
-    #[test]
-    fn a_trusted_proxy_is_read_from_the_right() {
-        // The client wrote 1.1.1.1; the proxy appended the real 198.51.100.7.
-        let headers = forwarded(&["1.1.1.1, 198.51.100.7"]);
-        assert_eq!(
-            client_address(Some(ip("10.0.0.2")), &headers, &nets(&["10.0.0.0/8"])),
-            Some(ip("198.51.100.7"))
-        );
-        // Two proxies, and several headers joined in order.
-        let headers = forwarded(&["1.1.1.1", "198.51.100.7, 10.0.0.3"]);
-        assert_eq!(
-            client_address(Some(ip("10.0.0.2")), &headers, &nets(&["10.0.0.0/8"])),
-            Some(ip("198.51.100.7"))
-        );
-    }
-
-    #[test]
-    fn a_mapped_ipv4_proxy_is_still_the_trusted_one() {
-        // A dual-stack listener reports the IPv4 proxy as mapped, and so may a
-        // proxy forwarding through another.
-        let headers = forwarded(&["1.1.1.1, 198.51.100.7, ::ffff:10.0.0.3"]);
-        assert_eq!(
-            client_address(
-                Some(ip("::ffff:10.0.0.2")),
-                &headers,
-                &nets(&["10.0.0.0/8"])
-            ),
-            Some(ip("198.51.100.7"))
-        );
-        // A list naming the proxy in its mapped form holds it whichever way
-        // the socket reports it, once loaded.
-        let mapped = vec![trusted_network("::ffff:10.0.0.0/104".parse().unwrap())];
-        assert_eq!(mapped, nets(&["10.0.0.0/8"]));
-        for peer in ["::ffff:10.0.0.2", "10.0.0.2"] {
-            assert_eq!(
-                client_address(Some(ip(peer)), &headers, &mapped),
-                Some(ip("198.51.100.7"))
-            );
-        }
-        // But an IPv6 block wider than the mapped range trusts no IPv4 peer:
-        // were it trusted, the walk would hand back the hop before the
-        // malformed entry instead of the peer.
-        let wide = vec![trusted_network("::/0".parse().unwrap())];
-        let headers = forwarded(&["garbage, 198.51.100.7"]);
-        for peer in ["::ffff:10.0.0.2", "10.0.0.2"] {
-            assert_eq!(
-                client_address(Some(ip(peer)), &headers, &wide),
-                Some(ip("10.0.0.2"))
-            );
-        }
-        assert_eq!(
-            trusted_network("2001:db8::/96".parse().unwrap()),
-            "2001:db8::/96".parse::<IpNet>().unwrap()
-        );
-    }
-
-    #[test]
-    fn a_malformed_or_all_trusted_chain_never_yields_a_chosen_address() {
-        let trusted = nets(&["10.0.0.0/8"]);
-        let headers = forwarded(&["1.1.1.1, garbage, 10.0.0.3"]);
-        assert_eq!(
-            client_address(Some(ip("10.0.0.2")), &headers, &trusted),
-            Some(ip("10.0.0.3"))
-        );
-        let headers = forwarded(&["10.0.0.9, 10.0.0.3"]);
-        assert_eq!(
-            client_address(Some(ip("10.0.0.2")), &headers, &trusted),
-            Some(ip("10.0.0.2"))
-        );
-        assert_eq!(
-            client_address(Some(ip("10.0.0.2")), &HeaderMap::new(), &trusted),
-            Some(ip("10.0.0.2"))
-        );
-    }
-
-    /// A byte that is not text in the part the client wrote stops nothing on
-    /// the right of it: the entry the proxy appended is still found.
-    #[test]
-    fn a_non_text_byte_in_the_client_s_part_does_not_hide_the_proxy_s_entry() {
-        let mut headers = HeaderMap::new();
-        headers.append(
-            "x-forwarded-for",
-            HeaderValue::from_bytes(b"1.1.1.1\xff, 198.51.100.7").unwrap(),
-        );
-        assert_eq!(
-            client_address(Some(ip("10.0.0.2")), &headers, &nets(&["10.0.0.0/8"])),
-            Some(ip("198.51.100.7"))
-        );
-        // And on its own, it stops the walk at the last trusted hop.
-        let mut headers = HeaderMap::new();
-        headers.append(
-            "x-forwarded-for",
-            HeaderValue::from_bytes(b"\xff, 10.0.0.3").unwrap(),
-        );
-        assert_eq!(
-            client_address(Some(ip("10.0.0.2")), &headers, &nets(&["10.0.0.0/8"])),
-            Some(ip("10.0.0.3"))
-        );
-    }
-
-    #[test]
-    fn ipv6_counts_by_its_slash_64_and_mapped_ipv4_as_ipv4() {
-        assert_eq!(
-            address_bucket(Some(ip("2001:db8:1:2:aaaa::1"))),
-            address_bucket(Some(ip("2001:db8:1:2:bbbb::9")))
-        );
-        assert_ne!(
-            address_bucket(Some(ip("2001:db8:1:2::1"))),
-            address_bucket(Some(ip("2001:db8:1:3::1")))
-        );
-        assert_eq!(
-            address_bucket(Some(ip("::ffff:198.51.100.7"))),
-            "198.51.100.7"
-        );
-    }
-
-    #[test]
-    fn case_variants_of_a_username_share_a_window() {
-        let guard = SignInGuard::new(2);
-        for name in ["Alice", "ALICE", "alice", "aLiCe"]
-            .iter()
-            .cycle()
-            .take(FAILURES_PER_WINDOW)
-        {
-            drop(guard.reserve("a", &canonical_account(name)).unwrap());
-        }
-        assert!(guard.reserve("a", &canonical_account("alice")).is_err());
-        assert_eq!(guard.window_count(), 1);
-    }
-
-    #[test]
-    fn another_address_keeps_its_own_budget() {
-        let guard = SignInGuard::new(2);
-        for _ in 0..FAILURES_PER_WINDOW {
-            drop(guard.reserve("attacker", "owner").unwrap());
-        }
-        assert_eq!(guard.reserve("attacker", "owner").err(), Some(Throttled));
-        assert!(guard.reserve("home", "owner").is_ok());
-    }
-
-    #[test]
-    fn a_released_slot_is_given_back_and_a_dropped_one_is_kept() {
-        let guard = SignInGuard::new(2);
-        for _ in 0..FAILURES_PER_WINDOW {
-            guard.reserve("a", "owner").unwrap().release();
-        }
-        assert!(guard.reserve("a", "owner").is_ok());
-    }
-
-    #[test]
-    fn one_address_never_opens_more_than_its_windows() {
-        let guard = SignInGuard::new(2);
-        // 31 accounts, one window each.
-        for index in 0..WINDOWS_PER_ADDRESS - 1 {
-            drop(guard.reserve("a", &format!("invented-{index}")).unwrap());
-        }
-        assert_eq!(guard.window_count(), WINDOWS_PER_ADDRESS - 1);
-        // The 32nd account onwards all count in the one overflow window.
-        for index in 0..FAILURES_PER_WINDOW {
-            drop(guard.reserve("a", &format!("more-{index}")).unwrap());
-        }
-        assert_eq!(guard.window_count(), WINDOWS_PER_ADDRESS);
-        assert_eq!(guard.reserve("a", "yet-another").err(), Some(Throttled));
-        // An account that already has its window keeps it.
-        assert!(guard.reserve("a", "invented-0").is_ok());
-        assert!(guard.reserve("b", "someone").is_ok());
-    }
-
-    #[test]
-    fn a_full_table_refuses_new_keys_and_keeps_live_ones() {
-        let guard = SignInGuard::new(2);
-        {
-            let mut table = guard.table.lock().unwrap();
-            let now = Instant::now();
-            for index in 0..MAX_WINDOWS {
-                table.windows.insert(
-                    window_key(&format!("filler-{index}"), "x"),
-                    Window {
-                        address: format!("filler-{index}"),
-                        overflow: false,
-                        attempts: VecDeque::from([now]),
-                    },
-                );
-            }
-        }
-        assert_eq!(guard.reserve("new", "owner").err(), Some(Throttled));
-        // A window already counting is never dropped to make room.
-        assert!(guard.reserve("filler-7", "x").is_ok());
-        assert_eq!(guard.window_count(), MAX_WINDOWS);
-    }
-
-    #[tokio::test]
-    async fn the_gate_bounds_the_queue() {
-        let guard = SignInGuard::new(1);
-        let held = guard.admit().await.expect("the first permit is free");
-        let mut waiters = Vec::new();
-        for _ in 0..WAITING_PER_PERMIT {
-            let guard = Arc::clone(&guard);
-            waiters.push(tokio::spawn(async move { guard.admit().await.is_some() }));
-        }
-        while guard.waiting() < WAITING_PER_PERMIT {
-            tokio::task::yield_now().await;
-        }
-        // The queue is full: the next one is turned away at once, not after
-        // waiting out the five seconds a queued request may wait.
-        let turned_away = tokio::time::timeout(Duration::from_millis(500), guard.admit()).await;
-        assert!(
-            matches!(turned_away, Ok(None)),
-            "a request past a full queue waited for a permit"
-        );
-        drop(held);
-        for waiter in waiters {
-            assert!(waiter.await.unwrap());
-        }
-        assert_eq!(guard.waiting(), 0);
-    }
-}
+mod tests;
diff --git a/src/auth/sign_in/tests.rs b/src/auth/sign_in/tests.rs
new file mode 100644
index 00000000..34893b01
--- /dev/null
+++ b/src/auth/sign_in/tests.rs
@@ -0,0 +1,244 @@
+use super::*;
+use axum::http::HeaderValue;
+
+fn nets(list: &[&str]) -> Vec<IpNet> {
+    list.iter().map(|net| net.parse().unwrap()).collect()
+}
+
+fn forwarded(values: &[&str]) -> HeaderMap {
+    let mut headers = HeaderMap::new();
+    for value in values {
+        headers.append("x-forwarded-for", HeaderValue::from_str(value).unwrap());
+    }
+    headers
+}
+
+fn ip(value: &str) -> IpAddr {
+    value.parse().unwrap()
+}
+
+#[test]
+fn an_untrusted_peer_is_the_client_whatever_it_forwards() {
+    let headers = forwarded(&["203.0.113.9"]);
+    assert_eq!(
+        client_address(Some(ip("198.51.100.7")), &headers, &nets(&["10.0.0.0/8"])),
+        Some(ip("198.51.100.7"))
+    );
+}
+
+#[test]
+fn a_trusted_proxy_is_read_from_the_right() {
+    // The client wrote 1.1.1.1; the proxy appended the real 198.51.100.7.
+    let headers = forwarded(&["1.1.1.1, 198.51.100.7"]);
+    assert_eq!(
+        client_address(Some(ip("10.0.0.2")), &headers, &nets(&["10.0.0.0/8"])),
+        Some(ip("198.51.100.7"))
+    );
+    // Two proxies, and several headers joined in order.
+    let headers = forwarded(&["1.1.1.1", "198.51.100.7, 10.0.0.3"]);
+    assert_eq!(
+        client_address(Some(ip("10.0.0.2")), &headers, &nets(&["10.0.0.0/8"])),
+        Some(ip("198.51.100.7"))
+    );
+}
+
+#[test]
+fn a_mapped_ipv4_proxy_is_still_the_trusted_one() {
+    // A dual-stack listener reports the IPv4 proxy as mapped, and so may a
+    // proxy forwarding through another.
+    let headers = forwarded(&["1.1.1.1, 198.51.100.7, ::ffff:10.0.0.3"]);
+    assert_eq!(
+        client_address(
+            Some(ip("::ffff:10.0.0.2")),
+            &headers,
+            &nets(&["10.0.0.0/8"])
+        ),
+        Some(ip("198.51.100.7"))
+    );
+    // A list naming the proxy in its mapped form holds it whichever way
+    // the socket reports it, once loaded.
+    let mapped = vec![trusted_network("::ffff:10.0.0.0/104".parse().unwrap())];
+    assert_eq!(mapped, nets(&["10.0.0.0/8"]));
+    for peer in ["::ffff:10.0.0.2", "10.0.0.2"] {
+        assert_eq!(
+            client_address(Some(ip(peer)), &headers, &mapped),
+            Some(ip("198.51.100.7"))
+        );
+    }
+    // But an IPv6 block wider than the mapped range trusts no IPv4 peer:
+    // were it trusted, the walk would hand back the hop before the
+    // malformed entry instead of the peer.
+    let wide = vec![trusted_network("::/0".parse().unwrap())];
+    let headers = forwarded(&["garbage, 198.51.100.7"]);
+    for peer in ["::ffff:10.0.0.2", "10.0.0.2"] {
+        assert_eq!(
+            client_address(Some(ip(peer)), &headers, &wide),
+            Some(ip("10.0.0.2"))
+        );
+    }
+    assert_eq!(
+        trusted_network("2001:db8::/96".parse().unwrap()),
+        "2001:db8::/96".parse::<IpNet>().unwrap()
+    );
+}
+
+#[test]
+fn a_malformed_or_all_trusted_chain_never_yields_a_chosen_address() {
+    let trusted = nets(&["10.0.0.0/8"]);
+    let headers = forwarded(&["1.1.1.1, garbage, 10.0.0.3"]);
+    assert_eq!(
+        client_address(Some(ip("10.0.0.2")), &headers, &trusted),
+        Some(ip("10.0.0.3"))
+    );
+    let headers = forwarded(&["10.0.0.9, 10.0.0.3"]);
+    assert_eq!(
+        client_address(Some(ip("10.0.0.2")), &headers, &trusted),
+        Some(ip("10.0.0.2"))
+    );
+    assert_eq!(
+        client_address(Some(ip("10.0.0.2")), &HeaderMap::new(), &trusted),
+        Some(ip("10.0.0.2"))
+    );
+}
+
+/// A byte that is not text in the part the client wrote stops nothing on
+/// the right of it: the entry the proxy appended is still found.
+#[test]
+fn a_non_text_byte_in_the_client_s_part_does_not_hide_the_proxy_s_entry() {
+    let mut headers = HeaderMap::new();
+    headers.append(
+        "x-forwarded-for",
+        HeaderValue::from_bytes(b"1.1.1.1\xff, 198.51.100.7").unwrap(),
+    );
+    assert_eq!(
+        client_address(Some(ip("10.0.0.2")), &headers, &nets(&["10.0.0.0/8"])),
+        Some(ip("198.51.100.7"))
+    );
+    // And on its own, it stops the walk at the last trusted hop.
+    let mut headers = HeaderMap::new();
+    headers.append(
+        "x-forwarded-for",
+        HeaderValue::from_bytes(b"\xff, 10.0.0.3").unwrap(),
+    );
+    assert_eq!(
+        client_address(Some(ip("10.0.0.2")), &headers, &nets(&["10.0.0.0/8"])),
+        Some(ip("10.0.0.3"))
+    );
+}
+
+#[test]
+fn ipv6_counts_by_its_slash_64_and_mapped_ipv4_as_ipv4() {
+    assert_eq!(
+        address_bucket(Some(ip("2001:db8:1:2:aaaa::1"))),
+        address_bucket(Some(ip("2001:db8:1:2:bbbb::9")))
+    );
+    assert_ne!(
+        address_bucket(Some(ip("2001:db8:1:2::1"))),
+        address_bucket(Some(ip("2001:db8:1:3::1")))
+    );
+    assert_eq!(
+        address_bucket(Some(ip("::ffff:198.51.100.7"))),
+        "198.51.100.7"
+    );
+}
+
+#[test]
+fn case_variants_of_a_username_share_a_window() {
+    let guard = SignInGuard::new(2);
+    for name in ["Alice", "ALICE", "alice", "aLiCe"]
+        .iter()
+        .cycle()
+        .take(FAILURES_PER_WINDOW)
+    {
+        drop(guard.reserve("a", &canonical_account(name)).unwrap());
+    }
+    assert!(guard.reserve("a", &canonical_account("alice")).is_err());
+    assert_eq!(guard.window_count(), 1);
+}
+
+#[test]
+fn another_address_keeps_its_own_budget() {
+    let guard = SignInGuard::new(2);
+    for _ in 0..FAILURES_PER_WINDOW {
+        drop(guard.reserve("attacker", "owner").unwrap());
+    }
+    assert_eq!(guard.reserve("attacker", "owner").err(), Some(Throttled));
+    assert!(guard.reserve("home", "owner").is_ok());
+}
+
+#[test]
+fn a_released_slot_is_given_back_and_a_dropped_one_is_kept() {
+    let guard = SignInGuard::new(2);
+    for _ in 0..FAILURES_PER_WINDOW {
+        guard.reserve("a", "owner").unwrap().release();
+    }
+    assert!(guard.reserve("a", "owner").is_ok());
+}
+
+#[test]
+fn one_address_never_opens_more_than_its_windows() {
+    let guard = SignInGuard::new(2);
+    // 31 accounts, one window each.
+    for index in 0..WINDOWS_PER_ADDRESS - 1 {
+        drop(guard.reserve("a", &format!("invented-{index}")).unwrap());
+    }
+    assert_eq!(guard.window_count(), WINDOWS_PER_ADDRESS - 1);
+    // The 32nd account onwards all count in the one overflow window.
+    for index in 0..FAILURES_PER_WINDOW {
+        drop(guard.reserve("a", &format!("more-{index}")).unwrap());
+    }
+    assert_eq!(guard.window_count(), WINDOWS_PER_ADDRESS);
+    assert_eq!(guard.reserve("a", "yet-another").err(), Some(Throttled));
+    // An account that already has its window keeps it.
+    assert!(guard.reserve("a", "invented-0").is_ok());
+    assert!(guard.reserve("b", "someone").is_ok());
+}
+
+#[test]
+fn a_full_table_refuses_new_keys_and_keeps_live_ones() {
+    let guard = SignInGuard::new(2);
+    {
+        let mut table = guard.table.lock().unwrap();
+        let now = Instant::now();
+        for index in 0..MAX_WINDOWS {
+            table.windows.insert(
+                window_key(&format!("filler-{index}"), "x"),
+                Window {
+                    address: format!("filler-{index}"),
+                    overflow: false,
+                    attempts: VecDeque::from([now]),
+                },
+            );
+        }
+    }
+    assert_eq!(guard.reserve("new", "owner").err(), Some(Throttled));
+    // A window already counting is never dropped to make room.
+    assert!(guard.reserve("filler-7", "x").is_ok());
+    assert_eq!(guard.window_count(), MAX_WINDOWS);
+}
+
+#[tokio::test]
+async fn the_gate_bounds_the_queue() {
+    let guard = SignInGuard::new(1);
+    let held = guard.admit().await.expect("the first permit is free");
+    let mut waiters = Vec::new();
+    for _ in 0..WAITING_PER_PERMIT {
+        let guard = Arc::clone(&guard);
+        waiters.push(tokio::spawn(async move { guard.admit().await.is_some() }));
+    }
+    while guard.waiting() < WAITING_PER_PERMIT {
+        tokio::task::yield_now().await;
+    }
+    // The queue is full: the next one is turned away at once, not after
+    // waiting out the five seconds a queued request may wait.
+    let turned_away = tokio::time::timeout(Duration::from_millis(500), guard.admit()).await;
+    assert!(
+        matches!(turned_away, Ok(None)),
+        "a request past a full queue waited for a permit"
+    );
+    drop(held);
+    for waiter in waiters {
+        assert!(waiter.await.unwrap());
+    }
+    assert_eq!(guard.waiting(), 0);
+}
diff --git a/src/stream_ticket.rs b/src/auth/stream_ticket/mod.rs
similarity index 51%
rename from src/stream_ticket.rs
rename to src/auth/stream_ticket/mod.rs
index 90a30210..d9304cdc 100644
--- a/src/stream_ticket.rs
+++ b/src/auth/stream_ticket/mod.rs
@@ -18,7 +18,7 @@
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
 use uuid::Uuid;
 
-use crate::security::{SecretBox, SecurityError};
+use crate::auth::security::{SecretBox, SecurityError};
 
 /// What a ticket opens.
 ///
@@ -121,131 +121,4 @@ pub fn verify(secret: &SecretBox, ticket: &str, now_ms: i64) -> Option<(TicketKi
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn secret() -> SecretBox {
-        SecretBox::from_key_bytes(&[7u8; 32]).unwrap()
-    }
-
-    /// Seals a payload the public API cannot express, so the test can present a
-    /// ticket that is genuine in every respect except its kind.
-    fn seal(secret: &SecretBox, payload: &[u8]) -> String {
-        let sealed = secret.encrypt(payload).unwrap();
-        let mut raw = Vec::with_capacity(NONCE_LEN + sealed.ciphertext.len());
-        raw.extend_from_slice(&sealed.nonce);
-        raw.extend_from_slice(&sealed.ciphertext);
-        URL_SAFE_NO_PAD.encode(raw)
-    }
-
-    fn payload_with_kind(byte: u8, user: Uuid, track: Uuid, expires_at: i64) -> Vec<u8> {
-        let mut payload = Vec::with_capacity(PAYLOAD_LEN);
-        payload.push(byte);
-        payload.extend_from_slice(user.as_bytes());
-        payload.extend_from_slice(track.as_bytes());
-        payload.extend_from_slice(&expires_at.to_be_bytes());
-        payload
-    }
-
-    #[test]
-    fn round_trip_returns_the_authorised_triple() {
-        let secret = secret();
-        for kind in [
-            TicketKind::Audio,
-            TicketKind::Canvas,
-            TicketKind::ShareVisit,
-        ] {
-            let user = Uuid::new_v4();
-            let track = Uuid::new_v4();
-            let ticket = mint(&secret, kind, user, track, 1_000).unwrap();
-            assert_eq!(verify(&secret, &ticket, 999), Some((kind, user, track)));
-        }
-    }
-
-    #[test]
-    fn the_kinds_do_not_answer_for_each_other() {
-        let secret = secret();
-        let user = Uuid::new_v4();
-        let track = Uuid::new_v4();
-        let audio = mint(&secret, TicketKind::Audio, user, track, 1_000).unwrap();
-        let canvas = mint(&secret, TicketKind::Canvas, user, track, 1_000).unwrap();
-        let visit = mint(&secret, TicketKind::ShareVisit, user, track, 1_000).unwrap();
-        assert_ne!(audio, canvas, "the kind is inside the sealed payload");
-        assert_eq!(
-            verify(&secret, &audio, 999).map(|(kind, ..)| kind),
-            Some(TicketKind::Audio)
-        );
-        assert_eq!(
-            verify(&secret, &canvas, 999).map(|(kind, ..)| kind),
-            Some(TicketKind::Canvas)
-        );
-        assert_eq!(
-            verify(&secret, &visit, 999).map(|(kind, ..)| kind),
-            Some(TicketKind::ShareVisit)
-        );
-    }
-
-    #[test]
-    fn an_unknown_kind_is_refused_even_under_the_right_key() {
-        let secret = secret();
-        let user = Uuid::new_v4();
-        let track = Uuid::new_v4();
-        // Sealed under the real key, correct length, live expiry: the kind byte
-        // is the only thing wrong with it. A forged ticket would prove nothing
-        // about this contract, since it already fails to decrypt.
-        for byte in [0x00, 0x04, 0xff] {
-            let ticket = seal(&secret, &payload_with_kind(byte, user, track, 1_000));
-            assert_eq!(
-                verify(&secret, &ticket, 999),
-                None,
-                "kind {byte:#04x} is not one of the kinds"
-            );
-        }
-    }
-
-    #[test]
-    fn a_payload_of_the_previous_length_is_refused() {
-        let secret = secret();
-        // What `mint` produced before the kind byte existed: user || track ||
-        // expiry, forty bytes, sealed under the current key.
-        let mut payload = Vec::with_capacity(40);
-        payload.extend_from_slice(Uuid::new_v4().as_bytes());
-        payload.extend_from_slice(Uuid::new_v4().as_bytes());
-        payload.extend_from_slice(&1_000i64.to_be_bytes());
-        let ticket = seal(&secret, &payload);
-        assert_eq!(verify(&secret, &ticket, 999), None);
-    }
-
-    #[test]
-    fn expired_forged_and_malformed_tickets_are_all_rejected() {
-        let secret = secret();
-        let ticket = mint(
-            &secret,
-            TicketKind::Audio,
-            Uuid::new_v4(),
-            Uuid::new_v4(),
-            1_000,
-        )
-        .unwrap();
-        assert_eq!(verify(&secret, &ticket, 1_000), None, "expiry is exclusive");
-        assert_eq!(verify(&secret, &ticket, 1_001), None);
-
-        let other = SecretBox::from_key_bytes(&[9u8; 32]).unwrap();
-        assert_eq!(
-            verify(&other, &ticket, 0),
-            None,
-            "a ticket minted elsewhere must not validate"
-        );
-
-        assert_eq!(verify(&secret, "not-base64!", 0), None);
-        assert_eq!(verify(&secret, "", 0), None);
-        let mut tampered = URL_SAFE_NO_PAD.decode(&ticket).unwrap();
-        let last = tampered.len() - 1;
-        tampered[last] ^= 0xff;
-        assert_eq!(
-            verify(&secret, &URL_SAFE_NO_PAD.encode(tampered), 0),
-            None,
-            "AEAD must reject a flipped bit"
-        );
-    }
-}
+mod tests;
diff --git a/src/auth/stream_ticket/tests.rs b/src/auth/stream_ticket/tests.rs
new file mode 100644
index 00000000..d72e56ba
--- /dev/null
+++ b/src/auth/stream_ticket/tests.rs
@@ -0,0 +1,126 @@
+use super::*;
+
+fn secret() -> SecretBox {
+    SecretBox::from_key_bytes(&[7u8; 32]).unwrap()
+}
+
+/// Seals a payload the public API cannot express, so the test can present a
+/// ticket that is genuine in every respect except its kind.
+fn seal(secret: &SecretBox, payload: &[u8]) -> String {
+    let sealed = secret.encrypt(payload).unwrap();
+    let mut raw = Vec::with_capacity(NONCE_LEN + sealed.ciphertext.len());
+    raw.extend_from_slice(&sealed.nonce);
+    raw.extend_from_slice(&sealed.ciphertext);
+    URL_SAFE_NO_PAD.encode(raw)
+}
+
+fn payload_with_kind(byte: u8, user: Uuid, track: Uuid, expires_at: i64) -> Vec<u8> {
+    let mut payload = Vec::with_capacity(PAYLOAD_LEN);
+    payload.push(byte);
+    payload.extend_from_slice(user.as_bytes());
+    payload.extend_from_slice(track.as_bytes());
+    payload.extend_from_slice(&expires_at.to_be_bytes());
+    payload
+}
+
+#[test]
+fn round_trip_returns_the_authorised_triple() {
+    let secret = secret();
+    for kind in [
+        TicketKind::Audio,
+        TicketKind::Canvas,
+        TicketKind::ShareVisit,
+    ] {
+        let user = Uuid::new_v4();
+        let track = Uuid::new_v4();
+        let ticket = mint(&secret, kind, user, track, 1_000).unwrap();
+        assert_eq!(verify(&secret, &ticket, 999), Some((kind, user, track)));
+    }
+}
+
+#[test]
+fn the_kinds_do_not_answer_for_each_other() {
+    let secret = secret();
+    let user = Uuid::new_v4();
+    let track = Uuid::new_v4();
+    let audio = mint(&secret, TicketKind::Audio, user, track, 1_000).unwrap();
+    let canvas = mint(&secret, TicketKind::Canvas, user, track, 1_000).unwrap();
+    let visit = mint(&secret, TicketKind::ShareVisit, user, track, 1_000).unwrap();
+    assert_ne!(audio, canvas, "the kind is inside the sealed payload");
+    assert_eq!(
+        verify(&secret, &audio, 999).map(|(kind, ..)| kind),
+        Some(TicketKind::Audio)
+    );
+    assert_eq!(
+        verify(&secret, &canvas, 999).map(|(kind, ..)| kind),
+        Some(TicketKind::Canvas)
+    );
+    assert_eq!(
+        verify(&secret, &visit, 999).map(|(kind, ..)| kind),
+        Some(TicketKind::ShareVisit)
+    );
+}
+
+#[test]
+fn an_unknown_kind_is_refused_even_under_the_right_key() {
+    let secret = secret();
+    let user = Uuid::new_v4();
+    let track = Uuid::new_v4();
+    // Sealed under the real key, correct length, live expiry: the kind byte
+    // is the only thing wrong with it. A forged ticket would prove nothing
+    // about this contract, since it already fails to decrypt.
+    for byte in [0x00, 0x04, 0xff] {
+        let ticket = seal(&secret, &payload_with_kind(byte, user, track, 1_000));
+        assert_eq!(
+            verify(&secret, &ticket, 999),
+            None,
+            "kind {byte:#04x} is not one of the kinds"
+        );
+    }
+}
+
+#[test]
+fn a_payload_of_the_previous_length_is_refused() {
+    let secret = secret();
+    // What `mint` produced before the kind byte existed: user || track ||
+    // expiry, forty bytes, sealed under the current key.
+    let mut payload = Vec::with_capacity(40);
+    payload.extend_from_slice(Uuid::new_v4().as_bytes());
+    payload.extend_from_slice(Uuid::new_v4().as_bytes());
+    payload.extend_from_slice(&1_000i64.to_be_bytes());
+    let ticket = seal(&secret, &payload);
+    assert_eq!(verify(&secret, &ticket, 999), None);
+}
+
+#[test]
+fn expired_forged_and_malformed_tickets_are_all_rejected() {
+    let secret = secret();
+    let ticket = mint(
+        &secret,
+        TicketKind::Audio,
+        Uuid::new_v4(),
+        Uuid::new_v4(),
+        1_000,
+    )
+    .unwrap();
+    assert_eq!(verify(&secret, &ticket, 1_000), None, "expiry is exclusive");
+    assert_eq!(verify(&secret, &ticket, 1_001), None);
+
+    let other = SecretBox::from_key_bytes(&[9u8; 32]).unwrap();
+    assert_eq!(
+        verify(&other, &ticket, 0),
+        None,
+        "a ticket minted elsewhere must not validate"
+    );
+
+    assert_eq!(verify(&secret, "not-base64!", 0), None);
+    assert_eq!(verify(&secret, "", 0), None);
+    let mut tampered = URL_SAFE_NO_PAD.decode(&ticket).unwrap();
+    let last = tampered.len() - 1;
+    tampered[last] ^= 0xff;
+    assert_eq!(
+        verify(&secret, &URL_SAFE_NO_PAD.encode(tampered), 0),
+        None,
+        "AEAD must reject a flipped bit"
+    );
+}
diff --git a/src/cli/account.rs b/src/cli/account.rs
index 5956f1e6..120c6deb 100644
--- a/src/cli/account.rs
+++ b/src/cli/account.rs
@@ -8,9 +8,10 @@ use super::{
     RevokeCredentialArgs, SetCredentialArgs,
 };
 use crate::{
-    authentication::now_ms,
-    database::{AccountRole, Database},
-    security, AppState,
+    auth::authentication::now_ms,
+    auth::security,
+    storage::database::{AccountRole, Database},
+    AppState,
 };
 
 pub(super) async fn create_account(
diff --git a/src/cli/database.rs b/src/cli/database.rs
index 263b6140..5a1d471c 100644
--- a/src/cli/database.rs
+++ b/src/cli/database.rs
@@ -2,7 +2,7 @@
 //! bundle.
 
 use super::{BackupArgs, RestoreArgs};
-use crate::{database::Database, security, AppState};
+use crate::{auth::security, storage::database::Database, AppState};
 
 pub(super) async fn backup(state: &AppState, args: BackupArgs) -> anyhow::Result<()> {
     if args.output.exists() {
diff --git a/src/cli/key.rs b/src/cli/key.rs
index a1039d65..fa1f77b1 100644
--- a/src/cli/key.rs
+++ b/src/cli/key.rs
@@ -8,9 +8,9 @@ use sqlx::Connection;
 
 use super::{KeyArgs, KeyCommand};
 use crate::{
-    authentication::now_ms,
-    database::{Database, KeyMaterial, Rekey, SchemaState},
-    security,
+    auth::authentication::now_ms,
+    auth::security,
+    storage::database::{Database, KeyMaterial, Rekey, SchemaState},
 };
 
 pub async fn key(config: &crate::Config, command: KeyCommand) -> anyhow::Result<()> {
diff --git a/src/cli/library.rs b/src/cli/library.rs
index bc6bd0f5..b6533efa 100644
--- a/src/cli/library.rs
+++ b/src/cli/library.rs
@@ -11,9 +11,9 @@ use super::{
     SetWatchArgs, UnavailableArgs,
 };
 use crate::{
-    authentication::now_ms,
-    catalog::LibraryRecord,
-    database::{Database, LibraryRole, LibraryVisibility},
+    auth::authentication::now_ms,
+    storage::catalog::LibraryRecord,
+    storage::database::{Database, LibraryRole, LibraryVisibility},
     AppState,
 };
 
diff --git a/src/cli/mod.rs b/src/cli/mod.rs
index 11d9d923..cfe7919f 100644
--- a/src/cli/mod.rs
+++ b/src/cli/mod.rs
@@ -31,7 +31,7 @@ use self::scrobble::{
     authorize_lastfm, exchange_lastfm, link_scrobble, scrobble_status, unlink_scrobble,
 };
 use crate::{
-    database::{AccountRole, Database},
+    storage::database::{AccountRole, Database},
     AppState,
 };
 
@@ -114,7 +114,7 @@ pub async fn execute(command: Command, state: &AppState) -> anyhow::Result<()> {
 async fn require_admin(
     db: &Database,
     username: &str,
-) -> anyhow::Result<crate::database::AccountRecord> {
+) -> anyhow::Result<crate::storage::database::AccountRecord> {
     let account = db
         .account_by_username(username)
         .await?
diff --git a/src/config/access.rs b/src/config/access.rs
index 73cf8d78..a1d3434c 100644
--- a/src/config/access.rs
+++ b/src/config/access.rs
@@ -46,7 +46,7 @@ pub(super) fn parse_proxy_addresses(list: &str) -> anyhow::Result<Vec<ipnet::IpN
             entry
                 .parse::<ipnet::IpNet>()
                 .or_else(|_| entry.parse::<std::net::IpAddr>().map(ipnet::IpNet::from))
-                .map(crate::sign_in::trusted_network)
+                .map(crate::auth::sign_in::trusted_network)
                 .map_err(|_| anyhow::anyhow!("invalid WAVEFLOW_TRUSTED_PROXIES entry {entry:?}"))
         })
         .collect()
diff --git a/src/config/for_data_dir.rs b/src/config/for_data_dir.rs
index 77e8ad43..a351a27f 100644
--- a/src/config/for_data_dir.rs
+++ b/src/config/for_data_dir.rs
@@ -50,7 +50,7 @@ impl Config {
             // Production's default: the suite purges the way a server does.
             purge_grace: Duration::from_secs(168 * 60 * 60),
             link_roots: Vec::new(),
-            subsonic_replay_gain: crate::replay_gain::ReplayGainMode::Off,
+            subsonic_replay_gain: crate::media::replay_gain::ReplayGainMode::Off,
             ffmpeg_path: PathBuf::from("ffmpeg"),
             ffprobe_path: PathBuf::from("ffprobe"),
             transcode_cache_dir,
@@ -140,7 +140,7 @@ impl Config {
                 feed_timeout: Duration::from_secs(10),
                 download_timeout: Duration::from_secs(30),
                 dir: podcast_dir_for_tests,
-                addresses: crate::portrait::AddressPolicy::AllowLoopback,
+                addresses: crate::remote::portrait::AddressPolicy::AllowLoopback,
             },
             // On, as production defaults, and admitting loopback for the same
             // reason the podcast policy above does: the image hosts the suite
@@ -149,7 +149,7 @@ impl Config {
             remote_artwork: RemoteArtworkSettings {
                 enabled: true,
                 timeout: Duration::from_secs(10),
-                addresses: crate::portrait::AddressPolicy::AllowLoopback,
+                addresses: crate::remote::portrait::AddressPolicy::AllowLoopback,
             },
             allowed_origins: Vec::new(),
             trusted_proxies: Vec::new(),
diff --git a/src/config/from_env.rs b/src/config/from_env.rs
index be238551..d11f1a9e 100644
--- a/src/config/from_env.rs
+++ b/src/config/from_env.rs
@@ -81,9 +81,9 @@ impl Config {
         let purge_grace = Duration::from_secs(purge_grace_hours.saturating_mul(60 * 60));
         let link_roots = parse_link_roots(std::env::var_os("WAVEFLOW_LINK_ROOTS"))?;
         let subsonic_replay_gain = match std::env::var("WAVEFLOW_SUBSONIC_REPLAYGAIN") {
-            Err(_) => crate::replay_gain::ReplayGainMode::Off,
-            Ok(raw) if raw.trim().is_empty() => crate::replay_gain::ReplayGainMode::Off,
-            Ok(raw) => crate::replay_gain::ReplayGainMode::parse(&raw).ok_or_else(|| {
+            Err(_) => crate::media::replay_gain::ReplayGainMode::Off,
+            Ok(raw) if raw.trim().is_empty() => crate::media::replay_gain::ReplayGainMode::Off,
+            Ok(raw) => crate::media::replay_gain::ReplayGainMode::parse(&raw).ok_or_else(|| {
                 anyhow::anyhow!(
                     "invalid WAVEFLOW_SUBSONIC_REPLAYGAIN: expected off, track or album, found {raw:?}"
                 )
@@ -243,7 +243,7 @@ impl Config {
         let remote_artwork = RemoteArtworkSettings {
             enabled: parse_bool_env("WAVEFLOW_REMOTE_ARTWORK", true)?,
             timeout: Duration::from_secs(20),
-            addresses: crate::portrait::AddressPolicy::Public,
+            addresses: crate::remote::portrait::AddressPolicy::Public,
         };
         // Absent is empty; a value that is not UTF-8 refuses to boot, rather
         // than starting with no trusted proxy and counting every client behind
@@ -279,7 +279,7 @@ impl Config {
         // Parsed here rather than at first use: a spec that cannot be parsed —
         // a recursive `albumid` above all — would otherwise re-identify the
         // whole catalogue silently at the next scan. Refusing to boot says so.
-        let pid = crate::pid::PidSpecs {
+        let pid = crate::library::pid::PidSpecs {
             album: parse_pid_spec(
                 "WAVEFLOW_PID_ALBUM",
                 DEFAULT_PID_ALBUM,
diff --git a/src/config/metadata.rs b/src/config/metadata.rs
index ef3638fd..210d1ed6 100644
--- a/src/config/metadata.rs
+++ b/src/config/metadata.rs
@@ -18,7 +18,7 @@ pub struct MetadataSettings {
     /// `WAVEFLOW_METADATA_PROVIDERS`: an ordered, comma-separated list, empty
     /// by default, of `lastfm`, `deezer` and `theaudiodb`. The order is the
     /// order fields are merged in when read.
-    pub providers: Vec<crate::enrichment::Provider>,
+    pub providers: Vec<crate::remote::enrichment::Provider>,
     /// `WAVEFLOW_METADATA_IMAGES`, on by default, `off` to keep the lookups and
     /// refuse decision 8's image fetch. A narrowing only: it switches nothing
     /// on while `providers` is empty.
@@ -95,7 +95,7 @@ impl std::fmt::Debug for MetadataSettings {
 #[derive(Debug, Clone)]
 pub struct LyricsSettings {
     /// `WAVEFLOW_LYRICS_PROVIDERS`: empty by default, or `lrclib`.
-    pub providers: Vec<crate::lrclib::LyricsProvider>,
+    pub providers: Vec<crate::remote::lrclib::LyricsProvider>,
     /// `WAVEFLOW_LYRICS_TTL_DAYS`: how long lyrics found are kept.
     pub ttl: Duration,
     /// `WAVEFLOW_LYRICS_MISS_TTL_DAYS`: how long "nothing for this track" is
@@ -179,14 +179,14 @@ pub(super) fn parse_lyrics_settings() -> anyhow::Result<LyricsSettings> {
 /// to boot, for the reason [`parse_metadata_providers`] gives.
 pub(super) fn parse_lyrics_providers(
     list: &str,
-) -> anyhow::Result<Vec<crate::lrclib::LyricsProvider>> {
+) -> anyhow::Result<Vec<crate::remote::lrclib::LyricsProvider>> {
     let mut providers = Vec::new();
     for name in list
         .split(',')
         .map(str::trim)
         .filter(|name| !name.is_empty())
     {
-        let provider = crate::lrclib::LyricsProvider::parse(name)
+        let provider = crate::remote::lrclib::LyricsProvider::parse(name)
             .ok_or_else(|| anyhow::anyhow!("invalid WAVEFLOW_LYRICS_PROVIDERS entry {name:?}"))?;
         if providers.contains(&provider) {
             anyhow::bail!("WAVEFLOW_LYRICS_PROVIDERS names {name:?} twice");
@@ -207,24 +207,24 @@ pub(super) fn parse_metadata_providers(
     list: &str,
     has_lastfm_key: bool,
     has_theaudiodb_key: bool,
-) -> anyhow::Result<Vec<crate::enrichment::Provider>> {
+) -> anyhow::Result<Vec<crate::remote::enrichment::Provider>> {
     let mut providers = Vec::new();
     for name in list
         .split(',')
         .map(str::trim)
         .filter(|name| !name.is_empty())
     {
-        let provider = crate::enrichment::Provider::parse(name)
+        let provider = crate::remote::enrichment::Provider::parse(name)
             .ok_or_else(|| anyhow::anyhow!("invalid WAVEFLOW_METADATA_PROVIDERS entry {name:?}"))?;
         if providers.contains(&provider) {
             anyhow::bail!("WAVEFLOW_METADATA_PROVIDERS names {name:?} twice");
         }
-        if provider == crate::enrichment::Provider::LastFm && !has_lastfm_key {
+        if provider == crate::remote::enrichment::Provider::LastFm && !has_lastfm_key {
             anyhow::bail!(
                 "WAVEFLOW_METADATA_PROVIDERS names lastfm without WAVEFLOW_METADATA_LASTFM_KEY"
             );
         }
-        if provider == crate::enrichment::Provider::TheAudioDb && !has_theaudiodb_key {
+        if provider == crate::remote::enrichment::Provider::TheAudioDb && !has_theaudiodb_key {
             anyhow::bail!(
                 "WAVEFLOW_METADATA_PROVIDERS names theaudiodb without WAVEFLOW_METADATA_THEAUDIODB_KEY"
             );
diff --git a/src/config/mod.rs b/src/config/mod.rs
index 28d2606a..7687fdad 100644
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -116,7 +116,7 @@ pub struct Config {
     /// `WAVEFLOW_SUBSONIC_REPLAYGAIN`: `off`, the default, `track` or
     /// `album`. A request overrides it with `replayGain=`; the original file
     /// is never transcoded to apply it.
-    pub subsonic_replay_gain: crate::replay_gain::ReplayGainMode,
+    pub subsonic_replay_gain: crate::media::replay_gain::ReplayGainMode,
     pub ffmpeg_path: PathBuf,
     pub ffprobe_path: PathBuf,
     pub transcode_cache_dir: PathBuf,
@@ -265,7 +265,7 @@ pub struct Config {
     /// instance configured differently from the run that built its catalogue
     /// schedules a full rescan rather than serving a catalogue keyed under a
     /// rule it no longer follows.
-    pub pid: crate::pid::PidSpecs,
+    pub pid: crate::library::pid::PidSpecs,
 }
 
 impl std::fmt::Debug for Config {
diff --git a/src/config/pid.rs b/src/config/pid.rs
index fa5310f5..47899665 100644
--- a/src/config/pid.rs
+++ b/src/config/pid.rs
@@ -30,18 +30,19 @@ pub(super) fn parse_pid_spec(
     name: &str,
     default: &str,
     kind: PidSpecKind,
-) -> anyhow::Result<crate::pid::PidSpec> {
+) -> anyhow::Result<crate::library::pid::PidSpec> {
     let raw = std::env::var(name).unwrap_or_else(|_| default.to_owned());
-    crate::pid::PidSpec::parse(&raw, kind.allows_album_id())
+    crate::library::pid::PidSpec::parse(&raw, kind.allows_album_id())
         .map_err(|error| anyhow::anyhow!("invalid {name}: {error}"))
 }
 
-fn default_pid_spec(default: &str, kind: PidSpecKind) -> crate::pid::PidSpec {
-    crate::pid::PidSpec::parse(default, kind.allows_album_id()).expect("built-in pid spec default")
+fn default_pid_spec(default: &str, kind: PidSpecKind) -> crate::library::pid::PidSpec {
+    crate::library::pid::PidSpec::parse(default, kind.allows_album_id())
+        .expect("built-in pid spec default")
 }
 
-pub(super) fn default_pid_specs() -> crate::pid::PidSpecs {
-    crate::pid::PidSpecs {
+pub(super) fn default_pid_specs() -> crate::library::pid::PidSpecs {
+    crate::library::pid::PidSpecs {
         album: default_pid_spec(DEFAULT_PID_ALBUM, PidSpecKind::MayNotReferenceAlbumId),
         track: default_pid_spec(DEFAULT_PID_TRACK, PidSpecKind::MayReferenceAlbumId),
         artist: default_pid_spec(DEFAULT_PID_ARTIST, PidSpecKind::MayNotReferenceAlbumId),
diff --git a/src/config/podcasts.rs b/src/config/podcasts.rs
index 3b7d1412..30418b95 100644
--- a/src/config/podcasts.rs
+++ b/src/config/podcasts.rs
@@ -45,7 +45,7 @@ pub struct PodcastSettings {
     /// Which addresses a fetch may reach. Public ones in production, always;
     /// not an environment variable. The test suite's feeds live on loopback,
     /// and its fixture admits loopback for them alone.
-    pub addresses: crate::portrait::AddressPolicy,
+    pub addresses: crate::remote::portrait::AddressPolicy,
 }
 
 /// Remote artwork: the cover a podcast feed names, and the image an account
@@ -65,7 +65,7 @@ pub struct RemoteArtworkSettings {
     pub timeout: Duration,
     /// Which addresses a fetch may reach, as for podcasts: public ones in
     /// production, always, and loopback as well for the test suite's hosts.
-    pub addresses: crate::portrait::AddressPolicy,
+    pub addresses: crate::remote::portrait::AddressPolicy,
 }
 
 /// The podcast switch and its bounds (RFC-025 decision 7).
@@ -106,6 +106,6 @@ pub(super) fn parse_podcast_settings(
             1_800u64,
         )?),
         dir: data_dir.join("podcasts"),
-        addresses: crate::portrait::AddressPolicy::Public,
+        addresses: crate::remote::portrait::AddressPolicy::Public,
     })
 }
diff --git a/src/config/scrobbling.rs b/src/config/scrobbling.rs
index 390875d9..1326a109 100644
--- a/src/config/scrobbling.rs
+++ b/src/config/scrobbling.rs
@@ -150,9 +150,9 @@ pub(super) fn test_destinations() -> Vec<ScrobbleDestination> {
     ]
     .into_iter()
     .map(|(provider, base)| {
-        let url = crate::scrobblers::validate_destination(base, true)
+        let url = crate::remote::scrobblers::validate_destination(base, true)
             .expect("a loopback destination nothing is listening on");
-        let fingerprint = crate::scrobblers::destination_fingerprint(&url);
+        let fingerprint = crate::remote::scrobblers::destination_fingerprint(&url);
         ScrobbleDestination {
             provider,
             name: DEFAULT_SCROBBLE_DESTINATION.to_owned(),
@@ -214,14 +214,14 @@ pub(super) fn parse_destinations(
             Some((name, raw)) => (name.trim(), raw.trim()),
             None => (DEFAULT_SCROBBLE_DESTINATION, entry),
         };
-        crate::scrobblers::validate_destination_name(name)
+        crate::remote::scrobblers::validate_destination_name(name)
             .map_err(|error| anyhow::anyhow!("invalid {variable} entry {name:?}: {error}"))?;
         // **Never the URL itself in the message.** `validate_destination`
         // refuses a destination carrying credentials, so the one thing this
         // branch is most likely to be handed is the one thing that must not be
         // printed: `http://user:secret@host` would land in a startup log, or a
         // support paste, in full. The name and the variant say enough.
-        let url = crate::scrobblers::validate_destination(raw, allow_plaintext)
+        let url = crate::remote::scrobblers::validate_destination(raw, allow_plaintext)
             .map_err(|error| anyhow::anyhow!("invalid {variable} entry {name:?}: {error}"))?;
         if destinations.iter().any(|existing| existing.name == name) {
             anyhow::bail!("{variable} declares {name:?} twice");
@@ -229,7 +229,7 @@ pub(super) fn parse_destinations(
         // Two names for one machine would give a member two ways to reach the
         // same profile and two links to keep in step, and the second would look
         // like a different destination in every counter.
-        let fingerprint = crate::scrobblers::destination_fingerprint(&url);
+        let fingerprint = crate::remote::scrobblers::destination_fingerprint(&url);
         if let Some(twin) = destinations
             .iter()
             .find(|existing| existing.fingerprint == fingerprint)
diff --git a/src/config/tests.rs b/src/config/tests.rs
index 51a85102..7b0fe180 100644
--- a/src/config/tests.rs
+++ b/src/config/tests.rs
@@ -37,7 +37,7 @@ fn trusted_proxies_are_read_strictly() {
 /// than starting enrichment narrower than the operator wrote.
 #[test]
 fn metadata_providers_are_read_strictly() {
-    use crate::enrichment::Provider;
+    use crate::remote::enrichment::Provider;
 
     assert_eq!(parse_metadata_providers("", false, false).unwrap(), []);
     assert_eq!(parse_metadata_providers(" , ", false, false).unwrap(), []);
@@ -72,7 +72,7 @@ fn metadata_providers_are_read_strictly() {
 /// rather than leaving lyrics quietly off.
 #[test]
 fn lyrics_providers_are_read_strictly() {
-    use crate::lrclib::LyricsProvider;
+    use crate::remote::lrclib::LyricsProvider;
 
     assert_eq!(super::metadata::parse_lyrics_providers("").unwrap(), []);
     assert_eq!(super::metadata::parse_lyrics_providers(" , ").unwrap(), []);
@@ -164,7 +164,7 @@ fn public_url_is_reduced_to_a_safe_http_origin() {
 /// whatever a person pastes into an issue. The repository's rule about
 /// secrets has no exception for an error path.
 ///
-/// It used to live in `tests/scrobbling.rs` against `initialize`, which is
+/// It used to live in `tests/scrobbling/` against `initialize`, which is
 /// where the guard used to be. Named destinations moved the refusal here,
 /// to the reading of the variable, and the test follows the guard rather
 /// than staying where it was and passing for another reason.
diff --git a/src/credit_split.rs b/src/credit_split.rs
deleted file mode 100644
index b0c2a581..00000000
--- a/src/credit_split.rs
+++ /dev/null
@@ -1,411 +0,0 @@
-//! Splitting a joined artist credit, by decision (RFC-015).
-//!
-//! The tag mapper (`crate::tags`) cuts an artist value on the separators no
-//! band name carries. A comma is not one of them — `Tyler, The Creator` is one
-//! artist, `Zedd, Alessia Cara` two — so a credit holding one is left whole,
-//! and an owner decides. This is the second step, applied to each name the
-//! first one produced:
-//!
-//! ```text
-//! tag value ── tags::credits ──▶ credit names ── decisions ──▶ participants
-//! ```
-//!
-//! Everything here is pure: a name, its sort form and the library's decisions
-//! in, names out. That is what lets a decision be applied to the stored
-//! catalogue without reading a file, and what makes a scan and an immediate
-//! split end in the same rows — they call the same function.
-
-use std::collections::{HashMap, HashSet};
-
-use uuid::Uuid;
-
-use crate::tags::{Credit, Role};
-
-/// The characters a joined credit is cut on: the desktop's set, ASCII and
-/// fullwidth commas and the two ideographic ones. Unpadded, as the desktop's
-/// cut is, so `蔡依林，周杰伦` splits.
-pub const FRAGMENT_SEPARATORS: [char; 4] = [',', '，', '、', '､'];
-
-/// The key a decision is stored under: the name folded the way the artist
-/// identity folds it, so one key names exactly the spellings that make one
-/// artist row under the default spec — and survives a change of spec, which
-/// an artist id would not.
-pub fn credit_key(name: &str) -> String {
-    crate::pid::str_clear(&name.trim().to_lowercase())
-}
-
-/// The name cut on [`FRAGMENT_SEPARATORS`], never inside parentheses, trimmed,
-/// blanks dropped — and duplicates kept, because a sort form is paired with
-/// this list position by position before anything is deduplicated.
-///
-/// The parenthesis rule is the tag mapper's (`tags::split_on`): a comma inside
-/// one qualifies a name rather than dividing two, so `Ian Asher, Olly Alexander
-/// (Years & Years)` is two artists and not three fragments.
-fn cut(value: &str) -> Vec<String> {
-    let mut parts = Vec::new();
-    let mut depth: usize = 0;
-    let mut current = String::new();
-    for character in value.chars() {
-        match character {
-            '(' => depth += 1,
-            ')' => depth = depth.saturating_sub(1),
-            _ => {}
-        }
-        if depth == 0 && FRAGMENT_SEPARATORS.contains(&character) {
-            parts.push(std::mem::take(&mut current));
-        } else {
-            current.push(character);
-        }
-    }
-    parts.push(current);
-    parts
-        .into_iter()
-        .map(|part| part.trim().to_owned())
-        .filter(|part| !part.is_empty())
-        .collect()
-}
-
-fn canonical(name: &str) -> String {
-    waveflow_core::scanner::canonical_name(name)
-}
-
-/// What a split of `name` would credit: the cut, deduplicated on the canonical
-/// name with the first spelling kept.
-pub fn fragments(name: &str) -> Vec<String> {
-    let mut seen = HashSet::new();
-    cut(name)
-        .into_iter()
-        .filter(|part| seen.insert(canonical(part)))
-        .collect()
-}
-
-/// Whether `name` is a credit an owner may be asked about: at least two
-/// fragments, none of them the whole credit again. `Solo,` never is.
-pub fn is_candidate(name: &str) -> bool {
-    let parts = fragments(name);
-    let whole = canonical(name);
-    parts.len() >= 2 && parts.iter().all(|part| canonical(part) != whole)
-}
-
-/// What a library decided about one credit.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum CreditDecision {
-    /// Replaced, wherever it is credited, by these names in this order.
-    Split(Vec<String>),
-    /// Left whole. It changes nothing a scan writes; it is what takes the
-    /// credit off the list.
-    Keep,
-}
-
-/// A library's decisions, by [`credit_key`].
-pub type Decisions = HashMap<String, CreditDecision>;
-
-/// The parts a split credit is replaced by on one track, each with the sort
-/// form this track's tags paired with it.
-///
-/// The sort form is cut by the same rule and paired with the track's own
-/// fragments **before** they are deduplicated, all or nothing as
-/// `tags::paired_sorts` pairs a joined tag. Pairing after the deduplication
-/// would compare `A, B, B, C` — three names — with four sort forms, and drop
-/// every one of them.
-fn expand(credit: &Credit, parts: &[String]) -> Vec<(String, Option<String>)> {
-    let names = cut(&credit.name);
-    let sorts = credit.sort_name.as_deref().map(cut).unwrap_or_default();
-    let paired: Vec<(String, Option<String>)> = if sorts.len() == names.len() {
-        names.into_iter().zip(sorts.into_iter().map(Some)).collect()
-    } else {
-        names.into_iter().map(|name| (name, None)).collect()
-    };
-    let mut by_name: HashMap<String, Option<String>> = HashMap::new();
-    for (name, sort) in paired {
-        by_name.entry(canonical(&name)).or_insert(sort);
-    }
-    parts
-        .iter()
-        .map(|part| {
-            let sort = by_name.get(&canonical(part)).cloned().flatten();
-            (part.clone(), sort)
-        })
-        .collect()
-}
-
-/// The participants one track credits: its first-step credits with the
-/// library's decisions applied.
-///
-/// `artist_override` is a correction someone typed (`track_override.artists`).
-/// It replaces the `artist` role whole and is final, so no decision touches
-/// it; every other role still follows the file and the decisions. A corrected
-/// name takes the album-artist sort form of the same name, as it did before
-/// this step existed.
-///
-/// `identity` is the artist id a name derives. A name whose artist already
-/// appears earlier in the same role and sub-role is not credited twice — the
-/// first occurrence wins — and positions are numbered from zero across each
-/// role, which `track_participant`'s `UNIQUE (track_id, role, position)` asks.
-pub fn resolve(
-    credits: &[Credit],
-    decisions: &Decisions,
-    artist_override: Option<&[String]>,
-    identity: impl Fn(&str) -> Uuid,
-) -> Vec<Credit> {
-    let mut ordered: Vec<&Credit> = credits.iter().collect();
-    // Role order first, then each role in its own order: the relation reads
-    // positions per role, and a stable order keeps two runs identical.
-    ordered.sort_by_key(|credit| (credit.role, credit.position));
-
-    let mut expanded: Vec<(Role, String, String, Option<String>)> = Vec::new();
-    if let Some(names) = artist_override {
-        for name in names {
-            let sort = credits
-                .iter()
-                .find(|credit| credit.role == Role::AlbumArtist && credit.name == *name)
-                .and_then(|credit| credit.sort_name.clone());
-            expanded.push((Role::Artist, String::new(), name.clone(), sort));
-        }
-    }
-    for credit in ordered {
-        if credit.role == Role::Artist && artist_override.is_some() {
-            continue;
-        }
-        match decisions.get(&credit_key(&credit.name)) {
-            Some(CreditDecision::Split(parts)) => {
-                for (name, sort) in expand(credit, parts) {
-                    expanded.push((credit.role, credit.sub_role.clone(), name, sort));
-                }
-            }
-            _ => expanded.push((
-                credit.role,
-                credit.sub_role.clone(),
-                credit.name.clone(),
-                credit.sort_name.clone(),
-            )),
-        }
-    }
-
-    let mut seen: HashSet<(Role, String, Uuid)> = HashSet::new();
-    let mut next: HashMap<Role, usize> = HashMap::new();
-    let mut resolved = Vec::with_capacity(expanded.len());
-    for (role, sub_role, name, sort_name) in expanded {
-        let name = name.trim().to_owned();
-        if name.is_empty() || !seen.insert((role, sub_role.clone(), identity(&name))) {
-            continue;
-        }
-        let position = next.entry(role).or_insert(0);
-        resolved.push(Credit {
-            role,
-            sub_role,
-            name,
-            sort_name,
-            position: *position,
-        });
-        *position += 1;
-    }
-    resolved
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn credit(role: Role, position: usize, name: &str, sort: Option<&str>) -> Credit {
-        Credit {
-            role,
-            sub_role: String::new(),
-            name: name.to_owned(),
-            sort_name: sort.map(str::to_owned),
-            position,
-        }
-    }
-
-    /// The identity the default spec derives, without a library: enough to
-    /// tell two names apart the way the catalogue does.
-    fn identity(name: &str) -> Uuid {
-        Uuid::new_v5(&Uuid::NAMESPACE_OID, credit_key(name).as_bytes())
-    }
-
-    fn names(credits: &[Credit], role: Role) -> Vec<(usize, &str)> {
-        credits
-            .iter()
-            .filter(|credit| credit.role == role)
-            .map(|credit| (credit.position, credit.name.as_str()))
-            .collect()
-    }
-
-    fn split(parts: &[&str]) -> CreditDecision {
-        CreditDecision::Split(parts.iter().map(|part| (*part).to_owned()).collect())
-    }
-
-    #[test]
-    fn the_fragments_are_the_desktops_with_parentheses_protected() {
-        assert_eq!(
-            fragments("Ashreveal, Ashish Swargiary"),
-            ["Ashreveal", "Ashish Swargiary"]
-        );
-        assert_eq!(fragments("蔡依林，周杰伦"), ["蔡依林", "周杰伦"]);
-        assert_eq!(fragments("庄心妍、祁隆"), ["庄心妍", "祁隆"]);
-        assert_eq!(fragments("A､B, C"), ["A", "B", "C"]);
-        assert_eq!(fragments("A, B, A"), ["A", "B"]);
-        assert_eq!(
-            fragments("Ian Asher, Olly Alexander (Years, Years)"),
-            ["Ian Asher", "Olly Alexander (Years, Years)"],
-            "a comma inside parentheses qualifies a name"
-        );
-    }
-
-    #[test]
-    fn a_candidate_has_two_fragments_and_none_is_the_whole() {
-        assert!(is_candidate("Zedd, Alessia Cara"));
-        assert!(is_candidate("Tyler, The Creator"), "only a person can tell");
-        assert!(!is_candidate("Solo,"));
-        assert!(!is_candidate("Simon & Garfunkel"));
-        assert!(!is_candidate("A, a"), "one fragment once deduplicated");
-    }
-
-    #[test]
-    fn the_key_folds_case_and_typographic_punctuation_only() {
-        assert_eq!(credit_key(" A, B "), credit_key("a, b"));
-        assert_eq!(credit_key("Guns N’ Roses"), credit_key("guns n' roses"));
-        assert_ne!(credit_key("AC/DC"), credit_key("AC DC"));
-    }
-
-    #[test]
-    fn a_split_replaces_the_credit_in_place_and_renumbers() {
-        let credits = [
-            credit(Role::Artist, 0, "X", None),
-            credit(Role::Artist, 1, "A, B", None),
-            credit(Role::Artist, 2, "Y", None),
-            credit(Role::AlbumArtist, 0, "A, B", None),
-        ];
-        let decisions = Decisions::from([(credit_key("A, B"), split(&["A", "B"]))]);
-        let resolved = resolve(&credits, &decisions, None, identity);
-        assert_eq!(
-            names(&resolved, Role::Artist),
-            [(0, "X"), (1, "A"), (2, "B"), (3, "Y")]
-        );
-        assert_eq!(names(&resolved, Role::AlbumArtist), [(0, "A"), (1, "B")]);
-    }
-
-    #[test]
-    fn no_decision_leaves_every_credit_as_the_file_wrote_it() {
-        let credits = [
-            credit(Role::Artist, 0, "A, B", Some("B, A")),
-            credit(Role::Composer, 0, "C, D", None),
-        ];
-        let resolved = resolve(&credits, &Decisions::new(), None, identity);
-        assert_eq!(resolved.len(), 2);
-        assert_eq!(resolved[0].sort_name.as_deref(), Some("B, A"));
-    }
-
-    #[test]
-    fn a_keep_changes_nothing() {
-        let credits = [credit(Role::Artist, 0, "Tyler, The Creator", None)];
-        let decisions = Decisions::from([(credit_key("Tyler, The Creator"), CreditDecision::Keep)]);
-        assert_eq!(
-            names(&resolve(&credits, &decisions, None, identity), Role::Artist),
-            [(0, "Tyler, The Creator")]
-        );
-    }
-
-    #[test]
-    fn a_part_already_credited_is_not_credited_twice() {
-        let credits = [
-            credit(Role::Artist, 0, "A", None),
-            credit(Role::Artist, 1, "a, B", None),
-        ];
-        let decisions = Decisions::from([(credit_key("a, B"), split(&["a", "B"]))]);
-        assert_eq!(
-            names(&resolve(&credits, &decisions, None, identity), Role::Artist),
-            [(0, "A"), (1, "B")],
-            "the first occurrence wins, and positions stay contiguous"
-        );
-    }
-
-    #[test]
-    fn two_credits_sharing_a_part_keep_the_files_order_whichever_is_undone() {
-        let credits = [
-            credit(Role::Artist, 0, "A, B", None),
-            credit(Role::Artist, 1, "A, C", None),
-        ];
-        let both = Decisions::from([
-            (credit_key("A, B"), split(&["A", "B"])),
-            (credit_key("A, C"), split(&["A", "C"])),
-        ]);
-        assert_eq!(
-            names(&resolve(&credits, &both, None, identity), Role::Artist),
-            [(0, "A"), (1, "B"), (2, "C")]
-        );
-        let first = Decisions::from([(credit_key("A, B"), split(&["A", "B"]))]);
-        assert_eq!(
-            names(&resolve(&credits, &first, None, identity), Role::Artist),
-            [(0, "A"), (1, "B"), (2, "A, C")]
-        );
-        let second = Decisions::from([(credit_key("A, C"), split(&["A", "C"]))]);
-        assert_eq!(
-            names(&resolve(&credits, &second, None, identity), Role::Artist),
-            [(0, "A, B"), (1, "A"), (2, "C")]
-        );
-    }
-
-    #[test]
-    fn sort_forms_are_paired_before_the_fragments_are_deduplicated() {
-        let credits = [credit(Role::Artist, 0, "A, B, B, C", Some("a, b, b, c"))];
-        let decisions = Decisions::from([(credit_key("A, B, B, C"), split(&["A", "B", "C"]))]);
-        let resolved = resolve(&credits, &decisions, None, identity);
-        let sorts: Vec<Option<&str>> = resolved
-            .iter()
-            .map(|credit| credit.sort_name.as_deref())
-            .collect();
-        assert_eq!(sorts, [Some("a"), Some("b"), Some("c")]);
-    }
-
-    #[test]
-    fn a_sort_form_of_another_length_pairs_with_nothing() {
-        let credits = [credit(Role::Artist, 0, "A, B", Some("a"))];
-        let decisions = Decisions::from([(credit_key("A, B"), split(&["A", "B"]))]);
-        assert!(resolve(&credits, &decisions, None, identity)
-            .iter()
-            .all(|credit| credit.sort_name.is_none()));
-    }
-
-    #[test]
-    fn a_retagged_spelling_falls_under_the_same_decision() {
-        let credits = [credit(Role::Artist, 0, "a, b", None)];
-        let decisions = Decisions::from([(credit_key("A, B"), split(&["A", "B"]))]);
-        assert_eq!(
-            names(&resolve(&credits, &decisions, None, identity), Role::Artist),
-            [(0, "A"), (1, "B")]
-        );
-    }
-
-    #[test]
-    fn a_correction_is_final_and_the_other_roles_still_follow_decisions() {
-        let credits = [
-            credit(Role::Artist, 0, "A, B", None),
-            credit(Role::AlbumArtist, 0, "A, B", Some("B, A")),
-        ];
-        let decisions = Decisions::from([(credit_key("A, B"), split(&["A", "B"]))]);
-        let corrected = ["A, B".to_owned()];
-        let resolved = resolve(&credits, &decisions, Some(&corrected), identity);
-        assert_eq!(names(&resolved, Role::Artist), [(0, "A, B")]);
-        assert_eq!(names(&resolved, Role::AlbumArtist), [(0, "A"), (1, "B")]);
-        assert_eq!(
-            resolved[0].sort_name.as_deref(),
-            Some("B, A"),
-            "a corrected name takes the album artist's sort form of that name"
-        );
-    }
-
-    #[test]
-    fn performers_number_one_sequence_across_their_instruments() {
-        let mut guitar = credit(Role::Performer, 0, "A, B", None);
-        guitar.sub_role = "Guitar".into();
-        let mut drums = credit(Role::Performer, 1, "C", None);
-        drums.sub_role = "Drums".into();
-        let decisions = Decisions::from([(credit_key("A, B"), split(&["A", "B"]))]);
-        let resolved = resolve(&[guitar, drums], &decisions, None, identity);
-        assert_eq!(
-            names(&resolved, Role::Performer),
-            [(0, "A"), (1, "B"), (2, "C")]
-        );
-    }
-}
diff --git a/src/enrichment.rs b/src/enrichment.rs
deleted file mode 100644
index 14e29bad..00000000
--- a/src/enrichment.rs
+++ /dev/null
@@ -1,959 +0,0 @@
-//! Metadata enrichment — RFC-011: the cache, and the engine that fills it.
-//!
-//! **Demand-driven and never on the answering path** (decision 6). A reader asks
-//! [`Enrichment::artist`] for what the cache holds; for every configured
-//! provider with nothing fresh, that call schedules a fill in the background
-//! and returns at once. The first visit to an artist shows nothing; the next
-//! one shows what came back.
-//!
-//! **Three outcomes** (decision 5), written on the provider's own row: a *hit*
-//! stands for the long TTL, a *miss* — the provider answered and knows nothing
-//! — for the short one, and *unreached* writes nothing at all, so the next
-//! visit asks again. A network blip must never become "this artist has no
-//! biography" for a month.
-//!
-//! **Bounded per provider**: requests are spaced to the configured rate, and
-//! concurrent first visits for one name collapse onto a single fill. The
-//! writer gate is taken for the row write only, after the requests are over.
-//!
-//! **Nothing about a request is logged but the provider and a verdict.** A
-//! Last.fm request carries the operator's key in its query string; neither the
-//! URL nor a response body is ever written to a log (decision 9).
-
-use std::{
-    path::PathBuf,
-    sync::Arc,
-    time::{Duration, Instant},
-};
-
-use dashmap::DashMap;
-use waveflow_core::metadata::{
-    deezer::{is_placeholder_artist_picture, DeezerArtistHit, DeezerClient, DeezerError},
-    lastfm::LastfmClient,
-    name_match::{normalize_name, select_by_name},
-    theaudiodb::TheAudioDbClient,
-    LookupError,
-};
-
-use crate::{
-    config::MetadataSettings,
-    database::Database,
-    portrait::{self, AddressPolicy, Refusal},
-};
-
-/// Last.fm's API root. A constant, not a setting (decision 9): there is no
-/// operator field, so there is no URL to validate.
-const LASTFM_BASE_URL: &str = "https://ws.audioscrobbler.com/2.0/";
-
-/// Deezer's API root, a constant for the same reason. It asks for no key.
-const DEEZER_BASE_URL: &str = "https://api.deezer.com";
-
-/// The hosts Deezer serves its pictures from (decision 8). A picture URL
-/// naming any other host is dropped without being contacted.
-const DEEZER_IMAGE_HOSTS: [&str; 2] = ["e-cdns-images.dzcdn.net", "cdn-images.dzcdn.net"];
-
-/// TheAudioDB's API root, a constant like the others (RFC-014 decision 1). The
-/// operator's key travels in the path, so this URL is never logged either.
-const THEAUDIODB_BASE_URL: &str = "https://www.theaudiodb.com/api/v1/json";
-
-/// The hosts TheAudioDB serves its fanart from (RFC-014 decision 2). A fanart
-/// URL naming any other host is dropped without being contacted.
-const THEAUDIODB_IMAGE_HOSTS: [&str; 2] = ["r2.theaudiodb.com", "www.theaudiodb.com"];
-
-/// TheAudioDB's own ceiling, whatever the shared rate says: thirty requests a
-/// minute on its free tier (RFC-014 decision 5). The pace is the slower of this
-/// and the operator's.
-const THEAUDIODB_INTERVAL: Duration = Duration::from_secs(2);
-
-/// How many neighbours are asked for and kept. Subsonic's `getArtistInfo`
-/// defaults to twenty; asking for more leaves room for the ones a caller cannot
-/// see, which decision 7 drops at read time.
-const SIMILAR_LIMIT: u32 = 50;
-
-/// How many fills may be waiting or running at once, across providers.
-///
-/// Pacing reserves a slot for every request and refuses none, so without this
-/// a page that opens two thousand artists would queue two thousand fills —
-/// a quarter of an hour at the default rate — and an outage, which writes no
-/// row, would let every further visit add more. Beyond the ceiling nothing is
-/// scheduled; the visit after asks again, which is what an unreached lookup
-/// does anyway.
-pub const MAX_IN_FLIGHT: usize = 64;
-
-/// A provider an operator can name in `WAVEFLOW_METADATA_PROVIDERS`.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
-pub enum Provider {
-    LastFm,
-    /// Portraits only: Deezer has no biography, and its related artists are
-    /// not asked for.
-    Deezer,
-    /// Banners only (RFC-014): TheAudioDB's fanart. Its biographies wait on a
-    /// language this server does not know.
-    TheAudioDb,
-}
-
-impl Provider {
-    pub fn parse(value: &str) -> Option<Self> {
-        match value {
-            "lastfm" => Some(Self::LastFm),
-            "deezer" => Some(Self::Deezer),
-            "theaudiodb" => Some(Self::TheAudioDb),
-            _ => None,
-        }
-    }
-
-    /// The name in the setting, in the cache's `provider` column, and in logs.
-    pub fn as_str(self) -> &'static str {
-        match self {
-            Self::LastFm => "lastfm",
-            Self::Deezer => "deezer",
-            Self::TheAudioDb => "theaudiodb",
-        }
-    }
-}
-
-/// What a provider said, when it said something. Unreached has no variant: it
-/// is the absence of a row.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Outcome {
-    Hit,
-    Miss,
-}
-
-impl Outcome {
-    pub fn parse(value: &str) -> Option<Self> {
-        match value {
-            "hit" => Some(Self::Hit),
-            "miss" => Some(Self::Miss),
-            _ => None,
-        }
-    }
-
-    pub fn as_str(self) -> &'static str {
-        match self {
-            Self::Hit => "hit",
-            Self::Miss => "miss",
-        }
-    }
-}
-
-/// One provider's cached row for one name.
-#[derive(Debug, Clone)]
-pub struct CachedArtist {
-    pub provider: Provider,
-    pub outcome: Outcome,
-    pub bio_summary: Option<String>,
-    pub bio_full: Option<String>,
-    /// The portrait this provider supplied, in the artwork store. Cleared by
-    /// the database when the sweeper takes the artwork row.
-    pub image_hash: Option<String>,
-    /// The banner this provider supplied (RFC-014), cleared the same way.
-    pub fanart_hash: Option<String>,
-    pub fetched_at: i64,
-    pub expires_at: i64,
-}
-
-/// A portrait already in the artwork store, waiting for its row.
-#[derive(Debug)]
-pub(crate) struct StoredPortrait {
-    pub(crate) hash: String,
-    pub(crate) format: &'static str,
-    pub(crate) byte_size: i64,
-}
-
-/// A Deezer artist offered as a portrait (RFC-013 decision 4), its preview
-/// already in the artwork store. The row naming the preview is the caller's to
-/// write, with whatever names it.
-#[derive(Debug)]
-pub(crate) struct DeezerCandidate {
-    pub(crate) deezer_id: i64,
-    pub(crate) name: String,
-    pub(crate) fans: Option<i64>,
-    pub(crate) preview: StoredPortrait,
-}
-
-/// Why a search for candidates gave none.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum CandidateSearchError {
-    /// Deezer is not among the operator's providers, or images are off.
-    NotConfigured,
-    /// Deezer, or a picture host it named, could not be reached, or a preview
-    /// could not be stored.
-    Unreached,
-}
-
-/// One neighbour in a provider's cached list.
-#[derive(Debug, Clone)]
-pub struct CachedSimilar {
-    pub name: String,
-    pub name_canonical: String,
-    pub score: f64,
-}
-
-/// What one fill brought back from one provider, before it is written.
-#[derive(Debug, Default)]
-pub(crate) struct ArtistAnswer {
-    pub(crate) bio_summary: Option<String>,
-    pub(crate) bio_full: Option<String>,
-    pub(crate) similar: Vec<CachedSimilar>,
-    pub(crate) image: Option<StoredPortrait>,
-    /// The banner, from TheAudioDB's fanart (RFC-014).
-    pub(crate) fanart: Option<StoredPortrait>,
-}
-
-impl ArtistAnswer {
-    /// A hit carries something; an answer with nothing in it is a miss.
-    pub(crate) fn outcome(&self) -> Outcome {
-        if self.bio_summary.is_some()
-            || self.bio_full.is_some()
-            || !self.similar.is_empty()
-            || self.image.is_some()
-            || self.fanart.is_some()
-        {
-            Outcome::Hit
-        } else {
-            Outcome::Miss
-        }
-    }
-}
-
-/// Where each provider is reached. [`Endpoints::default`] is production; the
-/// test suite points these at listeners of its own, which is the only reason
-/// the type exists.
-#[derive(Debug, Clone)]
-pub struct Endpoints {
-    pub lastfm: String,
-    pub deezer: String,
-    /// The hosts a Deezer picture may be fetched from.
-    pub deezer_image_hosts: Vec<String>,
-    pub theaudiodb: String,
-    /// The hosts a TheAudioDB fanart may be fetched from.
-    pub theaudiodb_image_hosts: Vec<String>,
-    /// The addresses a picture may be fetched from. Only the test suite,
-    /// whose image host is on loopback, sets anything but the default.
-    pub image_addresses: AddressPolicy,
-}
-
-impl Default for Endpoints {
-    fn default() -> Self {
-        Self {
-            lastfm: LASTFM_BASE_URL.to_owned(),
-            deezer: DEEZER_BASE_URL.to_owned(),
-            deezer_image_hosts: DEEZER_IMAGE_HOSTS.map(str::to_owned).to_vec(),
-            theaudiodb: THEAUDIODB_BASE_URL.to_owned(),
-            theaudiodb_image_hosts: THEAUDIODB_IMAGE_HOSTS.map(str::to_owned).to_vec(),
-            image_addresses: AddressPolicy::default(),
-        }
-    }
-}
-
-/// The engine, or its absence.
-///
-/// Cheap to clone; every clone drives the same engine. Disabled when no
-/// provider is configured, and then every call returns at once having read and
-/// sent nothing.
-#[derive(Clone)]
-pub struct Enrichment {
-    engine: Option<Arc<Engine>>,
-}
-
-struct Engine {
-    db: Database,
-    /// In the operator's order, which is the order fields are merged in.
-    sources: Vec<Source>,
-    ttl_ms: i64,
-    miss_ttl_ms: i64,
-    request_timeout: Duration,
-    /// Where fetched portraits are stored: the artwork store.
-    artwork_dir: PathBuf,
-    image_addresses: AddressPolicy,
-    /// The fills in flight, by provider and canonical name. A visit that finds
-    /// its key here schedules nothing: the fill already running answers it.
-    in_flight: DashMap<(Provider, String), ()>,
-    /// How many fills are waiting or running: the count [`MAX_IN_FLIGHT`]
-    /// bounds, and the one [`Enrichment::idle`] waits on.
-    running: tokio::sync::watch::Sender<usize>,
-}
-
-struct Source {
-    provider: Provider,
-    client: Client,
-    pace: Pace,
-}
-
-enum Client {
-    LastFm {
-        client: LastfmClient,
-        key: String,
-    },
-    Deezer {
-        client: DeezerClient,
-        image_hosts: Vec<String>,
-    },
-    TheAudioDb {
-        client: TheAudioDbClient,
-        image_hosts: Vec<String>,
-    },
-}
-
-impl Enrichment {
-    /// Enrichment switched off.
-    pub fn disabled() -> Self {
-        Self { engine: None }
-    }
-
-    /// The engine `settings` describe, against the providers' real addresses.
-    pub fn new(
-        db: Database,
-        settings: &MetadataSettings,
-        artwork_dir: PathBuf,
-    ) -> anyhow::Result<Self> {
-        Self::with_endpoints(db, settings, artwork_dir, Endpoints::default())
-    }
-
-    /// [`Self::new`], with the providers reached at `endpoints`.
-    ///
-    /// Only the configured providers are built. A key placed with no provider
-    /// naming it builds nothing — the provider list is the switch, and a key
-    /// is not consent (decision 3). With `WAVEFLOW_METADATA_IMAGES=off`,
-    /// Deezer is not built either: portraits are all it is asked for.
-    pub fn with_endpoints(
-        db: Database,
-        settings: &MetadataSettings,
-        artwork_dir: PathBuf,
-        endpoints: Endpoints,
-    ) -> anyhow::Result<Self> {
-        let mut sources = Vec::new();
-        for &provider in &settings.providers {
-            let http = crate::outbound::client(settings.request_timeout)
-                .map_err(|_| anyhow::anyhow!("the outbound client could not be built"))?;
-            let client = match provider {
-                Provider::LastFm => {
-                    let key = settings.lastfm_key.clone().ok_or_else(|| {
-                        anyhow::anyhow!("metadata provider lastfm is configured without a key")
-                    })?;
-                    Client::LastFm {
-                        client: LastfmClient::with_http(http, endpoints.lastfm.clone())?,
-                        key,
-                    }
-                }
-                Provider::Deezer if !settings.images => continue,
-                Provider::Deezer => Client::Deezer {
-                    client: DeezerClient::with_http(http, endpoints.deezer.clone()),
-                    image_hosts: endpoints.deezer_image_hosts.clone(),
-                },
-                // Banners are all it is asked for (RFC-014 decision 1).
-                Provider::TheAudioDb if !settings.images => continue,
-                Provider::TheAudioDb => {
-                    let key = settings.theaudiodb_key.clone().ok_or_else(|| {
-                        anyhow::anyhow!("metadata provider theaudiodb is configured without a key")
-                    })?;
-                    Client::TheAudioDb {
-                        client: TheAudioDbClient::with_http(
-                            http,
-                            endpoints.theaudiodb.clone(),
-                            key,
-                        )
-                        .map_err(|_| anyhow::anyhow!("the TheAudioDB address is not https"))?,
-                        image_hosts: endpoints.theaudiodb_image_hosts.clone(),
-                    }
-                }
-            };
-            let pace = match provider {
-                Provider::TheAudioDb => {
-                    Pace::with_floor(settings.rate_per_sec, THEAUDIODB_INTERVAL)
-                }
-                Provider::LastFm | Provider::Deezer => Pace::new(settings.rate_per_sec),
-            };
-            sources.push(Source {
-                provider,
-                client,
-                pace,
-            });
-        }
-        if sources.is_empty() {
-            return Ok(Self::disabled());
-        }
-        Ok(Self {
-            engine: Some(Arc::new(Engine {
-                db,
-                sources,
-                ttl_ms: duration_ms(settings.ttl),
-                miss_ttl_ms: duration_ms(settings.miss_ttl),
-                request_timeout: settings.request_timeout,
-                artwork_dir,
-                image_addresses: endpoints.image_addresses,
-                in_flight: DashMap::new(),
-                running: tokio::sync::watch::channel(0).0,
-            })),
-        })
-    }
-
-    pub fn is_enabled(&self) -> bool {
-        self.engine.is_some()
-    }
-
-    /// How many providers are configured — the number of rows a name has
-    /// once every one of them has answered.
-    pub fn provider_count(&self) -> usize {
-        self.engine
-            .as_ref()
-            .map_or(0, |engine| engine.sources.len())
-    }
-
-    /// Whether a portrait may be searched for on Deezer: the operator named
-    /// it and left images on. Asked at every call, never remembered by a
-    /// search (RFC-013 decision 4).
-    pub(crate) fn searches_deezer(&self) -> bool {
-        self.engine
-            .as_ref()
-            .is_some_and(|engine| engine.deezer().is_some())
-    }
-
-    /// Deezer's artists for `query`, in its order, at most `limit` of them,
-    /// each with its picture fetched and stored as a preview (RFC-013
-    /// decision 4).
-    ///
-    /// Every request — the search and each picture — keeps Deezer's pace,
-    /// the one enrichment keeps, so a picker cannot make the server ask
-    /// faster than the operator allowed. A hit with no real picture is not
-    /// offered, nor one whose picture the fetcher refuses for what it is:
-    /// there would be nothing to choose. A picture host that cannot be
-    /// reached fails the whole search, as the search itself failing does.
-    pub(crate) async fn deezer_candidates(
-        &self,
-        query: &str,
-        limit: usize,
-    ) -> Result<Vec<DeezerCandidate>, CandidateSearchError> {
-        let engine = self
-            .engine
-            .as_ref()
-            .ok_or(CandidateSearchError::NotConfigured)?;
-        let (source, client, image_hosts) =
-            engine.deezer().ok_or(CandidateSearchError::NotConfigured)?;
-        source.pace.wait().await;
-        let hits = engine
-            .bounded(client.search_artist(query))
-            .await
-            .map_err(|verdict| {
-                tracing::warn!(
-                    provider = source.provider.as_str(),
-                    verdict = %verdict,
-                    "portrait candidates unreached"
-                );
-                CandidateSearchError::Unreached
-            })?;
-        let mut candidates: Vec<DeezerCandidate> = Vec::new();
-        for hit in hits {
-            if candidates.len() >= limit {
-                break;
-            }
-            if candidates.iter().any(|offered| offered.deezer_id == hit.id) {
-                continue;
-            }
-            let Some(picture) = preview_picture(&hit) else {
-                continue;
-            };
-            source.pace.wait().await;
-            let fetched = portrait::fetch(
-                &picture,
-                image_hosts,
-                engine.image_addresses,
-                engine.request_timeout,
-            )
-            .await;
-            let preview = match fetched {
-                Ok(preview) => preview,
-                Err(refusal) if refusal.is_answer() => continue,
-                Err(refusal) => {
-                    tracing::warn!(
-                        provider = source.provider.as_str(),
-                        verdict = %refusal,
-                        "portrait candidate preview unreached"
-                    );
-                    return Err(CandidateSearchError::Unreached);
-                }
-            };
-            portrait::store(&engine.artwork_dir, &preview)
-                .await
-                .map_err(|_| CandidateSearchError::Unreached)?;
-            candidates.push(DeezerCandidate {
-                deezer_id: hit.id,
-                name: hit.name,
-                fans: hit.nb_fan,
-                preview: StoredPortrait {
-                    hash: preview.hash,
-                    format: preview.format,
-                    byte_size: preview.bytes.len() as i64,
-                },
-            });
-        }
-        Ok(candidates)
-    }
-
-    /// What the cache holds about the artist called `name`, one row per
-    /// configured provider that has one, in the operator's order — and a fill
-    /// scheduled for every configured provider whose row is missing or stale.
-    ///
-    /// Stale rows are returned, not withheld (decision 5): a slightly old
-    /// biography beats none, and serving it keeps a provider outage invisible.
-    /// Nothing here waits on a provider.
-    pub async fn artist(&self, name: &str) -> Result<Vec<CachedArtist>, sqlx::Error> {
-        let Some(engine) = &self.engine else {
-            return Ok(Vec::new());
-        };
-        let canonical = waveflow_core::scanner::canonical_name(name);
-        if canonical.is_empty() {
-            return Ok(Vec::new());
-        }
-        let rows = engine.db.metadata_artist_rows(&canonical).await?;
-        let now = crate::authentication::now_ms();
-        let mut ordered = Vec::new();
-        for (index, source) in engine.sources.iter().enumerate() {
-            let row = rows.iter().find(|row| row.provider == source.provider);
-            if row.is_none_or(|row| row.expires_at <= now) {
-                Arc::clone(engine).schedule(index, name, &canonical);
-            }
-            ordered.extend(row.cloned());
-        }
-        // A portrait already fetched, and an artist row that does not show
-        // it: an artist re-identified by a PID spec change, or one scanned
-        // since. Linked again from the cache, without a second download. A
-        // repair, not the answer: if it fails, the page is still served and
-        // the next visit tries again.
-        if let Some(hash) = ordered.iter().find_map(|row| row.image_hash.as_deref()) {
-            if let Err(error) = engine.db.link_artist_portrait(&canonical, hash).await {
-                tracing::warn!(%error, "cached artist portrait could not be linked");
-            }
-        }
-        // And the banner, by the same reasoning (RFC-014 decision 3).
-        if let Some(hash) = ordered.iter().find_map(|row| row.fanart_hash.as_deref()) {
-            if let Err(error) = engine.db.link_artist_fanart(&canonical, hash).await {
-                tracing::warn!(%error, "cached artist banner could not be linked");
-            }
-        }
-        Ok(ordered)
-    }
-
-    /// Waits until no fill is running.
-    ///
-    /// For the test suite, which has to know a fill is over before it can say
-    /// what the fill wrote — or that it wrote nothing.
-    #[doc(hidden)]
-    pub async fn idle(&self) {
-        let Some(engine) = &self.engine else {
-            return;
-        };
-        let mut running = engine.running.subscribe();
-        // The sender lives as long as the engine, which `self` holds.
-        let _ = running.wait_for(|count| *count == 0).await;
-    }
-}
-
-impl Engine {
-    /// Starts a fill for one provider and one name, unless one is running or
-    /// [`MAX_IN_FLIGHT`] are.
-    fn schedule(self: Arc<Self>, index: usize, name: &str, canonical: &str) {
-        let key = (self.sources[index].provider, canonical.to_owned());
-        // A place is reserved before the key is claimed, in one step under the
-        // counter's lock: a length read then an insert would let two visits on
-        // two threads both see one place left and both take it.
-        let reserved = self.running.send_if_modified(|count| {
-            let free = *count < MAX_IN_FLIGHT;
-            if free {
-                *count += 1;
-            }
-            free
-        });
-        if !reserved {
-            return;
-        }
-        if self.in_flight.insert(key.clone(), ()).is_some() {
-            self.running.send_modify(|count| *count -= 1);
-            return;
-        }
-        // Released however the fill ends — a panic, or a task dropped before
-        // its first poll included, which is why it is built here rather than
-        // inside the task. A key left behind would stop that name from ever
-        // being asked again.
-        let flight = Flight { engine: self, key };
-        let name = name.to_owned();
-        tokio::spawn(async move {
-            flight.engine.fill(index, &name, &flight.key.1).await;
-            drop(flight);
-        });
-    }
-
-    async fn fill(&self, index: usize, name: &str, canonical: &str) {
-        let source = &self.sources[index];
-        let answer = match &source.client {
-            Client::LastFm { client, key } => self.ask_lastfm(source, client, key, name).await,
-            Client::Deezer {
-                client,
-                image_hosts,
-            } => self.ask_deezer(source, client, image_hosts, name).await,
-            Client::TheAudioDb {
-                client,
-                image_hosts,
-            } => self.ask_theaudiodb(source, client, image_hosts, name).await,
-        };
-        let answer = match answer {
-            Ok(answer) => answer,
-            Err(verdict) => {
-                tracing::warn!(
-                    provider = source.provider.as_str(),
-                    verdict = %verdict,
-                    "artist lookup unreached; nothing cached"
-                );
-                return;
-            }
-        };
-        let fetched_at = crate::authentication::now_ms();
-        let outcome = answer.outcome();
-        let ttl = match outcome {
-            Outcome::Hit => self.ttl_ms,
-            Outcome::Miss => self.miss_ttl_ms,
-        };
-        if let Err(error) = self
-            .db
-            .write_metadata_artist(
-                source.provider,
-                canonical,
-                &answer,
-                fetched_at,
-                fetched_at.saturating_add(ttl),
-            )
-            .await
-        {
-            tracing::warn!(
-                provider = source.provider.as_str(),
-                error = %error,
-                "artist lookup answered but could not be cached"
-            );
-            return;
-        }
-        tracing::debug!(
-            provider = source.provider.as_str(),
-            outcome = outcome.as_str(),
-            "artist lookup cached"
-        );
-    }
-
-    /// `artist.getInfo` and `artist.getSimilar`. Both must be reached for the
-    /// answer to count: half an answer written as a whole one would cache the
-    /// missing half as "nothing" for the TTL.
-    async fn ask_lastfm(
-        &self,
-        source: &Source,
-        client: &LastfmClient,
-        key: &str,
-        name: &str,
-    ) -> Result<ArtistAnswer, Verdict> {
-        source.pace.wait().await;
-        let info = self.bounded(client.artist_get_info(name, key)).await?;
-        source.pace.wait().await;
-        let similar = self
-            .bounded(client.artist_get_similar(name, key, SIMILAR_LIMIT))
-            .await?;
-        let own = waveflow_core::scanner::canonical_name(name);
-        let similar = similar
-            .into_iter()
-            .filter_map(|neighbour| {
-                let name_canonical = waveflow_core::scanner::canonical_name(&neighbour.name);
-                (!name_canonical.is_empty() && name_canonical != own).then(|| CachedSimilar {
-                    name: neighbour.name,
-                    name_canonical,
-                    score: f64::from(neighbour.match_score),
-                })
-            })
-            .collect();
-        let (bio_summary, bio_full) = info
-            .map(|info| (info.bio_summary, info.bio_full))
-            .unwrap_or_default();
-        Ok(ArtistAnswer {
-            bio_summary,
-            bio_full,
-            similar,
-            image: None,
-            fanart: None,
-        })
-    }
-
-    /// The artist search, then the picture it names — decision 8.
-    ///
-    /// No artist by that name, or one without a picture, is a miss. So is a
-    /// picture the fetcher refuses for what it is — off the allowlist, at a
-    /// refused address, not an image, too large — since asking again would
-    /// get the same answer. A picture host that could not be reached is
-    /// unreached, like the search, and writes nothing.
-    async fn ask_deezer(
-        &self,
-        source: &Source,
-        client: &DeezerClient,
-        image_hosts: &[String],
-        name: &str,
-    ) -> Result<ArtistAnswer, Verdict> {
-        source.pace.wait().await;
-        let hits = self.bounded(client.search_artist(name)).await?;
-        let picture = select_by_name(hits, &normalize_name(name), |hit| Some(hit.name.as_str()))
-            .and_then(|hit| hit.best_picture());
-        let Some(picture) = picture else {
-            return Ok(ArtistAnswer::default());
-        };
-        let fetched = portrait::fetch(
-            &picture,
-            image_hosts,
-            self.image_addresses,
-            self.request_timeout,
-        )
-        .await;
-        let portrait = match fetched {
-            Ok(portrait) => portrait,
-            Err(refusal) if refusal.is_answer() => {
-                tracing::warn!(
-                    provider = source.provider.as_str(),
-                    verdict = %refusal,
-                    "artist portrait refused; cached as a miss"
-                );
-                return Ok(ArtistAnswer::default());
-            }
-            Err(refusal) => return Err(Verdict::Image(refusal)),
-        };
-        portrait::store(&self.artwork_dir, &portrait)
-            .await
-            .map_err(|_| Verdict::Store)?;
-        Ok(ArtistAnswer {
-            image: Some(StoredPortrait {
-                hash: portrait.hash,
-                format: portrait.format,
-                byte_size: portrait.bytes.len() as i64,
-            }),
-            ..ArtistAnswer::default()
-        })
-    }
-
-    /// The Deezer source, its client and the hosts its pictures come from.
-    fn deezer(&self) -> Option<(&Source, &DeezerClient, &[String])> {
-        self.sources.iter().find_map(|source| match &source.client {
-            Client::Deezer {
-                client,
-                image_hosts,
-            } => Some((source, client, image_hosts.as_slice())),
-            Client::LastFm { .. } | Client::TheAudioDb { .. } => None,
-        })
-    }
-
-    /// The artist search, then the first fanart that is really one (RFC-014
-    /// decision 2).
-    ///
-    /// The fanarts are tried in TheAudioDB's order: one the fetcher refuses
-    /// for what it is gives way to the next, and the first stored ends the
-    /// search. None accepted, or no artist by that name, is a miss. A picture
-    /// host that could not be reached is unreached, like the search, and
-    /// writes nothing: it says nothing about the artist.
-    async fn ask_theaudiodb(
-        &self,
-        source: &Source,
-        client: &TheAudioDbClient,
-        image_hosts: &[String],
-        name: &str,
-    ) -> Result<ArtistAnswer, Verdict> {
-        source.pace.wait().await;
-        // English is asked only because the call takes a language: the
-        // biography it selects is not kept.
-        let Some(artist) = self.bounded(client.artist_info(name, "en")).await? else {
-            return Ok(ArtistAnswer::default());
-        };
-        for fanart in &artist.fanart_urls {
-            source.pace.wait().await;
-            let fetched = portrait::fetch(
-                fanart,
-                image_hosts,
-                self.image_addresses,
-                self.request_timeout,
-            )
-            .await;
-            let picture = match fetched {
-                Ok(picture) => picture,
-                Err(refusal) if refusal.is_answer() => {
-                    tracing::debug!(
-                        provider = source.provider.as_str(),
-                        verdict = %refusal,
-                        "artist fanart refused; trying the next"
-                    );
-                    continue;
-                }
-                Err(refusal) => return Err(Verdict::Image(refusal)),
-            };
-            portrait::store(&self.artwork_dir, &picture)
-                .await
-                .map_err(|_| Verdict::Store)?;
-            return Ok(ArtistAnswer {
-                fanart: Some(StoredPortrait {
-                    hash: picture.hash,
-                    format: picture.format,
-                    byte_size: picture.bytes.len() as i64,
-                }),
-                ..ArtistAnswer::default()
-            });
-        }
-        Ok(ArtistAnswer::default())
-    }
-
-    /// One request, under the request timeout; anything but an answer is a
-    /// verdict.
-    async fn bounded<T, E>(
-        &self,
-        request: impl std::future::Future<Output = Result<T, E>>,
-    ) -> Result<T, Verdict>
-    where
-        Verdict: From<E>,
-    {
-        match tokio::time::timeout(self.request_timeout, request).await {
-            Ok(Ok(answer)) => Ok(answer),
-            Ok(Err(error)) => Err(Verdict::from(error)),
-            Err(_) => Err(Verdict::Timeout),
-        }
-    }
-}
-
-/// Releases a fill's key and count when the fill ends.
-struct Flight {
-    engine: Arc<Engine>,
-    key: (Provider, String),
-}
-
-impl Drop for Flight {
-    fn drop(&mut self) {
-        self.engine.in_flight.remove(&self.key);
-        self.engine.running.send_modify(|count| *count -= 1);
-    }
-}
-
-/// Why a lookup was unreached, in words that carry nothing from the request or
-/// the response — no URL, no body, no key.
-#[derive(Debug)]
-enum Verdict {
-    Timeout,
-    Transport,
-    Refused {
-        code: i64,
-    },
-    Status {
-        status: u16,
-    },
-    TooLarge,
-    Undecodable,
-    RateLimited,
-    /// The picture host, not the provider, was not reached.
-    Image(Refusal),
-    /// The picture came back and could not be written to the artwork store.
-    Store,
-}
-
-impl From<LookupError> for Verdict {
-    fn from(error: LookupError) -> Self {
-        match error {
-            LookupError::Http(error) if error.is_timeout() => Self::Timeout,
-            LookupError::Http(_) => Self::Transport,
-            LookupError::Refused { code } => Self::Refused { code },
-            LookupError::Status { status } => Self::Status { status },
-            LookupError::TooLarge { .. } => Self::TooLarge,
-            LookupError::Decode(_) => Self::Undecodable,
-        }
-    }
-}
-
-impl From<DeezerError> for Verdict {
-    fn from(error: DeezerError) -> Self {
-        match error {
-            DeezerError::Http(error) if error.is_timeout() => Self::Timeout,
-            DeezerError::Http(error) => {
-                error
-                    .status()
-                    .map_or(Self::Transport, |status| Self::Status {
-                        status: status.as_u16(),
-                    })
-            }
-            DeezerError::Api(error) => Self::Refused {
-                code: error.code.unwrap_or_default(),
-            },
-            DeezerError::RateLimited => Self::RateLimited,
-            DeezerError::TooLarge { .. } => Self::TooLarge,
-            DeezerError::Decode(_) => Self::Undecodable,
-        }
-    }
-}
-
-impl std::fmt::Display for Verdict {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Timeout => formatter.write_str("timed out"),
-            Self::Transport => formatter.write_str("transport failure"),
-            Self::Refused { code } => write!(formatter, "refused with code {code}"),
-            Self::Status { status } => write!(formatter, "answered HTTP {status}"),
-            Self::TooLarge => formatter.write_str("answer over the size ceiling"),
-            Self::Undecodable => formatter.write_str("answer not understood"),
-            Self::RateLimited => formatter.write_str("rate-limited"),
-            Self::Image(refusal) => refusal.fmt(formatter),
-            Self::Store => formatter.write_str("portrait could not be stored"),
-        }
-    }
-}
-
-/// Spaces one provider's requests to its rate: a token bucket that holds one
-/// token, so there is never a burst to spend.
-///
-/// The reservation is taken under the lock and the wait happens outside it, so
-/// callers queue in order without one sleeping caller holding up the rest.
-pub(crate) struct Pace {
-    interval: Duration,
-    next: std::sync::Mutex<Instant>,
-}
-
-impl Pace {
-    pub(crate) fn new(rate_per_sec: u32) -> Self {
-        Self {
-            interval: Duration::from_secs(1) / rate_per_sec.max(1),
-            next: std::sync::Mutex::new(Instant::now()),
-        }
-    }
-
-    /// The operator's rate, but never faster than one request per `floor`:
-    /// a provider's own ceiling, which the shared setting cannot raise.
-    fn with_floor(rate_per_sec: u32, floor: Duration) -> Self {
-        let pace = Self::new(rate_per_sec);
-        Self {
-            interval: pace.interval.max(floor),
-            ..pace
-        }
-    }
-
-    pub(crate) async fn wait(&self) {
-        let slot = {
-            let mut next = self
-                .next
-                .lock()
-                .unwrap_or_else(|poison| poison.into_inner());
-            let slot = (*next).max(Instant::now());
-            *next = slot + self.interval;
-            slot
-        };
-        tokio::time::sleep_until(slot.into()).await;
-    }
-}
-
-/// The picture a candidate is previewed at, and kept at if chosen: Deezer's
-/// big size, 500 pixels, since the preview is what becomes the portrait. The
-/// largest real one when that size is missing; none for Deezer's placeholder,
-/// which every size shares.
-fn preview_picture(hit: &DeezerArtistHit) -> Option<String> {
-    hit.picture_big
-        .clone()
-        .filter(|url| !is_placeholder_artist_picture(url))
-        .or_else(|| hit.best_picture())
-}
-
-fn duration_ms(duration: Duration) -> i64 {
-    i64::try_from(duration.as_millis()).unwrap_or(i64::MAX)
-}
diff --git a/src/http/mod.rs b/src/http/mod.rs
new file mode 100644
index 00000000..fd752c12
--- /dev/null
+++ b/src/http/mod.rs
@@ -0,0 +1,8 @@
+//! HTTP pieces outside the two API surfaces: the security headers on every
+//! response, the public share page, the `/reference` page and the embedded
+//! web client.
+
+pub mod public_share;
+pub mod reference;
+pub mod security_headers;
+pub mod webui;
diff --git a/src/public_share.rs b/src/http/public_share/mod.rs
similarity index 93%
rename from src/public_share.rs
rename to src/http/public_share/mod.rs
index 9db9ea60..d9b699fa 100644
--- a/src/public_share.rs
+++ b/src/http/public_share/mod.rs
@@ -27,10 +27,10 @@ use serde_json::Value;
 use uuid::Uuid;
 
 use crate::{
-    authentication::now_ms,
+    auth::authentication::now_ms,
+    auth::stream_ticket::{self, TicketKind},
     media::{OutputFormat, StreamQuery},
     services::ServiceError,
-    stream_ticket::{self, TicketKind},
     AppState,
 };
 
@@ -76,7 +76,7 @@ pub fn router(state: AppState, request_timeout: std::time::Duration) -> Router {
         .route("/share/{token}/tracks/{track_id}/cover", get(cover))
         .merge(opening)
         .layer(axum::middleware::map_response(
-            crate::security_headers::share,
+            crate::http::security_headers::share,
         ))
         .with_state(state)
 }
@@ -151,7 +151,7 @@ async fn page(state: &AppState, token: &str) -> Response {
             return StatusCode::INTERNAL_SERVER_ERROR.into_response();
         }
     };
-    let mut response = crate::webui::share_page();
+    let mut response = crate::http::webui::share_page();
     if !open && response.status() == StatusCode::OK {
         *response.status_mut() = StatusCode::NOT_FOUND;
     }
@@ -375,33 +375,4 @@ async fn cover(
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn accept(value: &str) -> HeaderMap {
-        let mut headers = HeaderMap::new();
-        headers.insert(header::ACCEPT, HeaderValue::from_str(value).unwrap());
-        headers
-    }
-
-    #[test]
-    fn only_an_explicit_html_request_is_handed_the_page() {
-        for page in [
-            "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
-            "TEXT/HTML",
-            "application/json;q=0.5, text/html",
-        ] {
-            assert!(wants_page(&accept(page)), "{page}");
-        }
-        for document in [
-            "*/*",
-            "application/json",
-            "text/*",
-            "text/html;q=0",
-            "text/htmlx",
-        ] {
-            assert!(!wants_page(&accept(document)), "{document}");
-        }
-        assert!(!wants_page(&HeaderMap::new()));
-    }
-}
+mod tests;
diff --git a/src/http/public_share/tests.rs b/src/http/public_share/tests.rs
new file mode 100644
index 00000000..be1b6570
--- /dev/null
+++ b/src/http/public_share/tests.rs
@@ -0,0 +1,28 @@
+use super::*;
+
+fn accept(value: &str) -> HeaderMap {
+    let mut headers = HeaderMap::new();
+    headers.insert(header::ACCEPT, HeaderValue::from_str(value).unwrap());
+    headers
+}
+
+#[test]
+fn only_an_explicit_html_request_is_handed_the_page() {
+    for page in [
+        "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+        "TEXT/HTML",
+        "application/json;q=0.5, text/html",
+    ] {
+        assert!(wants_page(&accept(page)), "{page}");
+    }
+    for document in [
+        "*/*",
+        "application/json",
+        "text/*",
+        "text/html;q=0",
+        "text/htmlx",
+    ] {
+        assert!(!wants_page(&accept(document)), "{document}");
+    }
+    assert!(!wants_page(&HeaderMap::new()));
+}
diff --git a/src/reference.rs b/src/http/reference/mod.rs
similarity index 70%
rename from src/reference.rs
rename to src/http/reference/mod.rs
index d24e8f33..e46890ee 100644
--- a/src/reference.rs
+++ b/src/http/reference/mod.rs
@@ -29,7 +29,7 @@
 //! in the repository and the binary. Every browser that can run the page
 //! accepts gzip; a client that does not is handed the bytes decompressed.
 //!
-//! **Under a policy of its own** ([`crate::security_headers::reference_policy`]):
+//! **Under a policy of its own** ([`crate::http::security_headers::reference_policy`]):
 //! scripts from this origin only, and no connection anywhere else.
 
 use std::{io::Read as _, sync::OnceLock};
@@ -50,7 +50,7 @@ pub const SCALAR_VERSION: &str = "1.73.1";
 pub const SCALAR_SHA256: &str = "62c34a0dda38945864011ebaf6e7fa7812a332429120d18922b34d01c4f7ccc8";
 
 /// The bundle, as `gzip -9n` left it.
-static SCALAR_GZIP: &[u8] = include_bytes!("../assets/scalar/api-reference-1.73.1.js.gz");
+static SCALAR_GZIP: &[u8] = include_bytes!("../../../assets/scalar/api-reference-1.73.1.js.gz");
 
 /// Where the page loads the bundle from. Versioned, so it can be cached for
 /// good.
@@ -119,7 +119,10 @@ fn serve_page(page: Bytes) -> Response {
     let mut response = ([(header::CONTENT_TYPE, "text/html; charset=utf-8")], page).into_response();
     let headers = response.headers_mut();
     headers.insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
-    crate::security_headers::apply_reference(headers, &crate::security_headers::reference_policy());
+    crate::http::security_headers::apply_reference(
+        headers,
+        &crate::http::security_headers::reference_policy(),
+    );
     response
 }
 
@@ -178,7 +181,7 @@ async fn serve_script(request_headers: HeaderMap) -> Response {
     if gzip {
         headers.insert(header::CONTENT_ENCODING, HeaderValue::from_static("gzip"));
     }
-    crate::security_headers::apply_reference(
+    crate::http::security_headers::apply_reference(
         headers,
         &HeaderValue::from_static("default-src 'none'; frame-ancestors 'none'"),
     );
@@ -254,102 +257,4 @@ pub fn decompressed() -> std::io::Result<Vec<u8>> {
 }
 
 #[cfg(test)]
-mod tests {
-    use sha2::{Digest, Sha256};
-
-    use super::*;
-
-    /// The embedded bytes are the release this module names, and nothing
-    /// else: a file replaced without its digest, or a digest changed without
-    /// its file, fails here.
-    #[test]
-    fn the_embedded_bundle_is_the_pinned_release() {
-        let bundle = decompressed().expect("the bundle decompresses");
-        assert_eq!(hex::encode(Sha256::digest(&bundle)), SCALAR_SHA256);
-        assert!(SCALAR_SCRIPT_PATH.contains(SCALAR_VERSION));
-    }
-
-    /// A client that takes no gzip costs one decompression per process, not
-    /// one per request: the route is open to whoever `/reference` is open to.
-    /// Served twice, and three times more, the count stays at one, and both
-    /// answers are the published bundle.
-    #[tokio::test]
-    async fn the_bundle_is_decompressed_once_whatever_the_requests() {
-        use http_body_util::BodyExt as _;
-        let mut bodies = Vec::new();
-        for _ in 0..5 {
-            let response = serve_script(HeaderMap::new()).await;
-            assert_eq!(response.status(), StatusCode::OK);
-            assert!(response.headers().get(header::CONTENT_ENCODING).is_none());
-            bodies.push(response.into_body().collect().await.unwrap().to_bytes());
-        }
-        assert_eq!(
-            DECOMPRESSIONS.load(std::sync::atomic::Ordering::SeqCst),
-            1,
-            "the bundle must be decompressed once and kept"
-        );
-        assert_eq!(hex::encode(Sha256::digest(&bodies[0])), SCALAR_SHA256);
-        assert!(bodies.iter().all(|body| body == &bodies[0]));
-    }
-
-    #[test]
-    fn gzip_is_sent_only_to_whoever_takes_it() {
-        let with = |value: &str| {
-            let mut headers = HeaderMap::new();
-            headers.insert(
-                header::ACCEPT_ENCODING,
-                HeaderValue::from_str(value).unwrap(),
-            );
-            accepts_gzip(&headers)
-        };
-        assert!(with("gzip, deflate, br, zstd"));
-        assert!(with("br;q=1.0, GZIP;q=0.5"));
-        assert!(with("*"));
-        assert!(!with("br"));
-        assert!(!with("gzip;q=0"));
-        assert!(!accepts_gzip(&HeaderMap::new()));
-        // A coding the field names is decided by its own entry, and `*` only
-        // stands for the ones it does not name (RFC 9110 §12.5.3).
-        assert!(!with("gzip;q=0, *;q=1"));
-        assert!(!with("*, gzip;q=0"));
-        assert!(with("*;q=0, gzip"));
-        assert!(!with("br, *;q=0"));
-        assert!(with("x-gzip"));
-        // Names are case-insensitive, the weight's as much as the coding's,
-        // and whitespace around `;` and `=` changes nothing.
-        assert!(!with("gzip;Q=0"));
-        assert!(!with("GZIP ; q = 0"));
-        assert!(!with("gzip;q=0.000, *"));
-        assert!(with("Gzip;Q=0.001"));
-        assert!(with("gzip;q=1.000"));
-        // A weight outside the grammar makes its entry say nothing: the next
-        // entry, or the wildcard, decides, and nothing panics.
-        for malformed in ["2", "1.5", "-1", "0.0001", "abc", "", "NaN", "inf", "1e0"] {
-            assert!(
-                !with(&format!("gzip;q={malformed}")),
-                "q={malformed} is no acceptance"
-            );
-            assert!(
-                with(&format!("gzip;q={malformed}, *")),
-                "q={malformed} leaves the wildcard deciding"
-            );
-            assert!(
-                !with(&format!("gzip;q={malformed}, gzip;q=0")),
-                "q={malformed} leaves the next gzip entry deciding"
-            );
-        }
-        // An empty field is identity only.
-        assert!(!with(""));
-        assert!(!with(" , ;q=1"));
-    }
-
-    /// No string in the document can end the block it is carried in.
-    #[test]
-    fn the_document_cannot_close_its_own_block() {
-        let mut openapi = utoipa::openapi::OpenApi::default();
-        openapi.info.description = Some("</script><script>alert(1)</script>".to_owned());
-        let page = page_template(&openapi);
-        assert_eq!(page.matches("</script>").count(), 2, "{page}");
-        assert!(page.contains("\\u003c/script>"));
-    }
-}
+mod tests;
diff --git a/src/http/reference/tests.rs b/src/http/reference/tests.rs
new file mode 100644
index 00000000..44b8a00a
--- /dev/null
+++ b/src/http/reference/tests.rs
@@ -0,0 +1,97 @@
+use sha2::{Digest, Sha256};
+
+use super::*;
+
+/// The embedded bytes are the release this module names, and nothing
+/// else: a file replaced without its digest, or a digest changed without
+/// its file, fails here.
+#[test]
+fn the_embedded_bundle_is_the_pinned_release() {
+    let bundle = decompressed().expect("the bundle decompresses");
+    assert_eq!(hex::encode(Sha256::digest(&bundle)), SCALAR_SHA256);
+    assert!(SCALAR_SCRIPT_PATH.contains(SCALAR_VERSION));
+}
+
+/// A client that takes no gzip costs one decompression per process, not
+/// one per request: the route is open to whoever `/reference` is open to.
+/// Served twice, and three times more, the count stays at one, and both
+/// answers are the published bundle.
+#[tokio::test]
+async fn the_bundle_is_decompressed_once_whatever_the_requests() {
+    use http_body_util::BodyExt as _;
+    let mut bodies = Vec::new();
+    for _ in 0..5 {
+        let response = serve_script(HeaderMap::new()).await;
+        assert_eq!(response.status(), StatusCode::OK);
+        assert!(response.headers().get(header::CONTENT_ENCODING).is_none());
+        bodies.push(response.into_body().collect().await.unwrap().to_bytes());
+    }
+    assert_eq!(
+        DECOMPRESSIONS.load(std::sync::atomic::Ordering::SeqCst),
+        1,
+        "the bundle must be decompressed once and kept"
+    );
+    assert_eq!(hex::encode(Sha256::digest(&bodies[0])), SCALAR_SHA256);
+    assert!(bodies.iter().all(|body| body == &bodies[0]));
+}
+
+#[test]
+fn gzip_is_sent_only_to_whoever_takes_it() {
+    let with = |value: &str| {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::ACCEPT_ENCODING,
+            HeaderValue::from_str(value).unwrap(),
+        );
+        accepts_gzip(&headers)
+    };
+    assert!(with("gzip, deflate, br, zstd"));
+    assert!(with("br;q=1.0, GZIP;q=0.5"));
+    assert!(with("*"));
+    assert!(!with("br"));
+    assert!(!with("gzip;q=0"));
+    assert!(!accepts_gzip(&HeaderMap::new()));
+    // A coding the field names is decided by its own entry, and `*` only
+    // stands for the ones it does not name (RFC 9110 §12.5.3).
+    assert!(!with("gzip;q=0, *;q=1"));
+    assert!(!with("*, gzip;q=0"));
+    assert!(with("*;q=0, gzip"));
+    assert!(!with("br, *;q=0"));
+    assert!(with("x-gzip"));
+    // Names are case-insensitive, the weight's as much as the coding's,
+    // and whitespace around `;` and `=` changes nothing.
+    assert!(!with("gzip;Q=0"));
+    assert!(!with("GZIP ; q = 0"));
+    assert!(!with("gzip;q=0.000, *"));
+    assert!(with("Gzip;Q=0.001"));
+    assert!(with("gzip;q=1.000"));
+    // A weight outside the grammar makes its entry say nothing: the next
+    // entry, or the wildcard, decides, and nothing panics.
+    for malformed in ["2", "1.5", "-1", "0.0001", "abc", "", "NaN", "inf", "1e0"] {
+        assert!(
+            !with(&format!("gzip;q={malformed}")),
+            "q={malformed} is no acceptance"
+        );
+        assert!(
+            with(&format!("gzip;q={malformed}, *")),
+            "q={malformed} leaves the wildcard deciding"
+        );
+        assert!(
+            !with(&format!("gzip;q={malformed}, gzip;q=0")),
+            "q={malformed} leaves the next gzip entry deciding"
+        );
+    }
+    // An empty field is identity only.
+    assert!(!with(""));
+    assert!(!with(" , ;q=1"));
+}
+
+/// No string in the document can end the block it is carried in.
+#[test]
+fn the_document_cannot_close_its_own_block() {
+    let mut openapi = utoipa::openapi::OpenApi::default();
+    openapi.info.description = Some("</script><script>alert(1)</script>".to_owned());
+    let page = page_template(&openapi);
+    assert_eq!(page.matches("</script>").count(), 2, "{page}");
+    assert!(page.contains("\\u003c/script>"));
+}
diff --git a/src/security_headers.rs b/src/http/security_headers/mod.rs
similarity index 72%
rename from src/security_headers.rs
rename to src/http/security_headers/mod.rs
index cfc2d2f4..6155f3f3 100644
--- a/src/security_headers.rs
+++ b/src/http/security_headers/mod.rs
@@ -3,11 +3,11 @@
 //!
 //! Three surfaces carry them:
 //!
-//! - **the embedded web client** ([`crate::webui`]), every response of the
+//! - **the embedded web client** ([`crate::http::webui`]), every response of the
 //!   router fallback: the shell, its assets, and its refusals;
 //! - **the public shares** under `/share/`, whose token *is* the path, so a
 //!   referrer would hand it to whatever host a page linked to;
-//! - **the API reference** at `/reference` ([`crate::reference`]), since
+//! - **the API reference** at `/reference` ([`crate::http::reference`]), since
 //!   RFC-023 serves its script from the binary and can therefore hold it to a
 //!   policy that names no other host.
 //!
@@ -204,78 +204,4 @@ fn inline_digests(html: &str, tag: &str) -> String {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn digest(content: &str) -> String {
-        format!(
-            "'sha256-{}'",
-            STANDARD.encode(Sha256::digest(content.as_bytes()))
-        )
-    }
-
-    #[test]
-    fn each_inline_block_is_admitted_by_its_digest_and_nothing_else() {
-        let style = "\n  #splash { opacity: 1; }\n";
-        let script = "\n  setTimeout(function () {}, 10000);\n";
-        let html = format!(
-            "<html><head><style>{style}</style>\
-             <script type=\"module\" crossorigin src=\"/assets/index.js\"></script>\
-             <link rel=\"stylesheet\" href=\"/assets/index.css\"></head>\
-             <body><scripts>not a tag</scripts><script>{script}</script></body></html>"
-        );
-        let policy = web_client_policy(&html);
-        assert!(
-            policy.contains(&format!("script-src 'self' {};", digest(script))),
-            "{policy}"
-        );
-        assert!(
-            policy.contains(&format!("style-src 'self' {};", digest(style))),
-            "{policy}"
-        );
-        // The bundle's own tag has a `src` and is governed by `'self'`.
-        assert_eq!(policy.matches("'sha256-").count(), 2, "{policy}");
-        assert!(!policy.contains("unsafe-inline"), "{policy}");
-        assert!(!policy.contains("unsafe-eval"), "{policy}");
-    }
-
-    #[test]
-    fn a_shell_without_inline_blocks_admits_this_origin_only() {
-        let policy = web_client_policy("<html><body><p>placeholder</p></body></html>");
-        assert!(policy.contains("script-src 'self';"), "{policy}");
-        assert!(policy.contains("style-src 'self';"), "{policy}");
-        assert!(policy.ends_with("frame-ancestors 'self'"), "{policy}");
-    }
-
-    /// The share page runs the client under the client's own policy, and is
-    /// framed by nobody (RFC-020 decision 3).
-    #[test]
-    fn the_share_page_is_the_client_policy_framed_by_nobody() {
-        let html = "<html><head><style>p{}</style></head></html>";
-        let page = share_page_policy(html);
-        assert_eq!(
-            page,
-            web_client_policy(html).replace("frame-ancestors 'self'", "frame-ancestors 'none'")
-        );
-    }
-
-    /// The share layer keeps the page's policy and gives every other share
-    /// response the framing-only one.
-    #[tokio::test]
-    async fn the_share_layer_keeps_the_page_policy_and_sets_the_rest() {
-        let page_policy = HeaderValue::from_static("default-src 'self'; frame-ancestors 'none'");
-        let mut page = Response::new(axum::body::Body::empty());
-        page.headers_mut()
-            .insert(header::CONTENT_SECURITY_POLICY, page_policy.clone());
-        let page = share(page).await;
-        assert_eq!(page.headers()[header::CONTENT_SECURITY_POLICY], page_policy);
-        assert_eq!(page.headers()[header::REFERRER_POLICY], "no-referrer");
-
-        let document = share(Response::new(axum::body::Body::empty())).await;
-        assert_eq!(
-            document.headers()[header::CONTENT_SECURITY_POLICY],
-            "frame-ancestors 'none'"
-        );
-        assert_eq!(document.headers()[header::X_FRAME_OPTIONS], "DENY");
-    }
-}
+mod tests;
diff --git a/src/http/security_headers/tests.rs b/src/http/security_headers/tests.rs
new file mode 100644
index 00000000..5c4e9d24
--- /dev/null
+++ b/src/http/security_headers/tests.rs
@@ -0,0 +1,73 @@
+use super::*;
+
+fn digest(content: &str) -> String {
+    format!(
+        "'sha256-{}'",
+        STANDARD.encode(Sha256::digest(content.as_bytes()))
+    )
+}
+
+#[test]
+fn each_inline_block_is_admitted_by_its_digest_and_nothing_else() {
+    let style = "\n  #splash { opacity: 1; }\n";
+    let script = "\n  setTimeout(function () {}, 10000);\n";
+    let html = format!(
+        "<html><head><style>{style}</style>\
+             <script type=\"module\" crossorigin src=\"/assets/index.js\"></script>\
+             <link rel=\"stylesheet\" href=\"/assets/index.css\"></head>\
+             <body><scripts>not a tag</scripts><script>{script}</script></body></html>"
+    );
+    let policy = web_client_policy(&html);
+    assert!(
+        policy.contains(&format!("script-src 'self' {};", digest(script))),
+        "{policy}"
+    );
+    assert!(
+        policy.contains(&format!("style-src 'self' {};", digest(style))),
+        "{policy}"
+    );
+    // The bundle's own tag has a `src` and is governed by `'self'`.
+    assert_eq!(policy.matches("'sha256-").count(), 2, "{policy}");
+    assert!(!policy.contains("unsafe-inline"), "{policy}");
+    assert!(!policy.contains("unsafe-eval"), "{policy}");
+}
+
+#[test]
+fn a_shell_without_inline_blocks_admits_this_origin_only() {
+    let policy = web_client_policy("<html><body><p>placeholder</p></body></html>");
+    assert!(policy.contains("script-src 'self';"), "{policy}");
+    assert!(policy.contains("style-src 'self';"), "{policy}");
+    assert!(policy.ends_with("frame-ancestors 'self'"), "{policy}");
+}
+
+/// The share page runs the client under the client's own policy, and is
+/// framed by nobody (RFC-020 decision 3).
+#[test]
+fn the_share_page_is_the_client_policy_framed_by_nobody() {
+    let html = "<html><head><style>p{}</style></head></html>";
+    let page = share_page_policy(html);
+    assert_eq!(
+        page,
+        web_client_policy(html).replace("frame-ancestors 'self'", "frame-ancestors 'none'")
+    );
+}
+
+/// The share layer keeps the page's policy and gives every other share
+/// response the framing-only one.
+#[tokio::test]
+async fn the_share_layer_keeps_the_page_policy_and_sets_the_rest() {
+    let page_policy = HeaderValue::from_static("default-src 'self'; frame-ancestors 'none'");
+    let mut page = Response::new(axum::body::Body::empty());
+    page.headers_mut()
+        .insert(header::CONTENT_SECURITY_POLICY, page_policy.clone());
+    let page = share(page).await;
+    assert_eq!(page.headers()[header::CONTENT_SECURITY_POLICY], page_policy);
+    assert_eq!(page.headers()[header::REFERRER_POLICY], "no-referrer");
+
+    let document = share(Response::new(axum::body::Body::empty())).await;
+    assert_eq!(
+        document.headers()[header::CONTENT_SECURITY_POLICY],
+        "frame-ancestors 'none'"
+    );
+    assert_eq!(document.headers()[header::X_FRAME_OPTIONS], "DENY");
+}
diff --git a/src/webui.rs b/src/http/webui.rs
similarity index 94%
rename from src/webui.rs
rename to src/http/webui.rs
index f941134d..bca2a195 100644
--- a/src/webui.rs
+++ b/src/http/webui.rs
@@ -6,7 +6,7 @@
 //! client-side route resolves by returning the shell.
 //!
 //! Every response here carries the web client's security headers, a
-//! Content-Security-Policy among them ([`crate::security_headers`]).
+//! Content-Security-Policy among them ([`crate::http::security_headers`]).
 
 use axum::{
     body::Body,
@@ -73,7 +73,7 @@ const ASSET_ONLY_PREFIXES: [&str; 2] = ["icons/", "brand/"];
 
 pub async fn handler(uri: Uri) -> Response {
     let mut response = respond(uri.path().trim_start_matches('/'));
-    crate::security_headers::apply_web_client(response.headers_mut(), policy());
+    crate::http::security_headers::apply_web_client(response.headers_mut(), policy());
     response
 }
 
@@ -83,7 +83,7 @@ pub async fn handler(uri: Uri) -> Response {
 fn policy() -> &'static HeaderValue {
     static POLICY: OnceLock<HeaderValue> = OnceLock::new();
     POLICY.get_or_init(|| {
-        HeaderValue::from_str(&crate::security_headers::web_client_policy(
+        HeaderValue::from_str(&crate::http::security_headers::web_client_policy(
             &embedded_shell(),
         ))
         // A digest is base64 and every directive is ASCII, so this cannot
@@ -124,12 +124,12 @@ fn shell() -> Response {
 /// client by accident, and the one address that does is chosen by its own
 /// route. It carries the client's policy, which the shell's inline blocks need
 /// to run, with framing refused as on every share response
-/// ([`crate::security_headers::share_page_policy`]); the share route's own
+/// ([`crate::http::security_headers::share_page_policy`]); the share route's own
 /// layer adds the rest of the share headers.
 pub fn share_page() -> Response {
     static POLICY: OnceLock<HeaderValue> = OnceLock::new();
     let policy = POLICY.get_or_init(|| {
-        HeaderValue::from_str(&crate::security_headers::share_page_policy(
+        HeaderValue::from_str(&crate::http::security_headers::share_page_policy(
             &embedded_shell(),
         ))
         .unwrap_or(HeaderValue::from_static("default-src 'none'"))
diff --git a/src/lib.rs b/src/lib.rs
index 71928351..532ba9dc 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1,43 +1,25 @@
 //! WaveFlow Server v2 library surface.
 
+// The library exists so the integration suite drives the router `main`
+// serves, and its doc comments link private items freely: a constant, a
+// projection macro, the method a public one defers to. Those links resolve
+// in an editor and under `cargo doc --document-private-items`; what CI's
+// `cargo doc` gate catches is a link that resolves nowhere.
+#![allow(rustdoc::private_intra_doc_links)]
+
 pub mod api;
 mod app;
-pub mod authentication;
-pub mod catalog;
+pub mod auth;
 pub mod cli;
 pub mod config;
-pub mod credit_split;
-pub mod database;
-pub mod enrichment;
-pub mod link_roots;
-pub mod lrclib;
-pub mod lyrics;
+pub mod http;
+pub mod library;
 pub mod media;
-pub mod migration_backup;
-pub mod natural_order;
-pub mod oauth;
-pub mod outbound;
-pub mod pid;
-pub mod playlist_file;
-pub mod podcast;
-pub mod portrait;
-pub mod public_share;
 pub mod quality;
-pub mod reference;
-pub mod replay_gain;
-pub mod scanner;
-pub mod scrobblers;
-pub mod security;
-pub mod security_headers;
+pub mod remote;
 pub mod services;
-pub mod setup_token;
-pub mod sign_in;
-pub mod stream_ticket;
+pub mod storage;
 pub mod subsonic;
-pub mod sync;
-pub mod tags;
-pub mod watcher;
-pub mod webui;
 
 pub use app::{app, initialize, shutdown_signal, ApiDoc, AppState, OPENAPI_JSON_PATH, SCALAR_PATH};
 pub use config::Config;
diff --git a/src/library/credit_split/mod.rs b/src/library/credit_split/mod.rs
new file mode 100644
index 00000000..05e05a0a
--- /dev/null
+++ b/src/library/credit_split/mod.rs
@@ -0,0 +1,207 @@
+//! Splitting a joined artist credit, by decision (RFC-015).
+//!
+//! The tag mapper (`crate::library::tags`) cuts an artist value on the separators no
+//! band name carries. A comma is not one of them — `Tyler, The Creator` is one
+//! artist, `Zedd, Alessia Cara` two — so a credit holding one is left whole,
+//! and an owner decides. This is the second step, applied to each name the
+//! first one produced:
+//!
+//! ```text
+//! tag value ── tags::credits ──▶ credit names ── decisions ──▶ participants
+//! ```
+//!
+//! Everything here is pure: a name, its sort form and the library's decisions
+//! in, names out. That is what lets a decision be applied to the stored
+//! catalogue without reading a file, and what makes a scan and an immediate
+//! split end in the same rows — they call the same function.
+
+use std::collections::{HashMap, HashSet};
+
+use uuid::Uuid;
+
+use crate::library::tags::{Credit, Role};
+
+/// The characters a joined credit is cut on: the desktop's set, ASCII and
+/// fullwidth commas and the two ideographic ones. Unpadded, as the desktop's
+/// cut is, so `蔡依林，周杰伦` splits.
+pub const FRAGMENT_SEPARATORS: [char; 4] = [',', '，', '、', '､'];
+
+/// The key a decision is stored under: the name folded the way the artist
+/// identity folds it, so one key names exactly the spellings that make one
+/// artist row under the default spec — and survives a change of spec, which
+/// an artist id would not.
+pub fn credit_key(name: &str) -> String {
+    crate::library::pid::str_clear(&name.trim().to_lowercase())
+}
+
+/// The name cut on [`FRAGMENT_SEPARATORS`], never inside parentheses, trimmed,
+/// blanks dropped — and duplicates kept, because a sort form is paired with
+/// this list position by position before anything is deduplicated.
+///
+/// The parenthesis rule is the tag mapper's (`tags::split_on`): a comma inside
+/// one qualifies a name rather than dividing two, so `Ian Asher, Olly Alexander
+/// (Years & Years)` is two artists and not three fragments.
+fn cut(value: &str) -> Vec<String> {
+    let mut parts = Vec::new();
+    let mut depth: usize = 0;
+    let mut current = String::new();
+    for character in value.chars() {
+        match character {
+            '(' => depth += 1,
+            ')' => depth = depth.saturating_sub(1),
+            _ => {}
+        }
+        if depth == 0 && FRAGMENT_SEPARATORS.contains(&character) {
+            parts.push(std::mem::take(&mut current));
+        } else {
+            current.push(character);
+        }
+    }
+    parts.push(current);
+    parts
+        .into_iter()
+        .map(|part| part.trim().to_owned())
+        .filter(|part| !part.is_empty())
+        .collect()
+}
+
+fn canonical(name: &str) -> String {
+    waveflow_core::scanner::canonical_name(name)
+}
+
+/// What a split of `name` would credit: the cut, deduplicated on the canonical
+/// name with the first spelling kept.
+pub fn fragments(name: &str) -> Vec<String> {
+    let mut seen = HashSet::new();
+    cut(name)
+        .into_iter()
+        .filter(|part| seen.insert(canonical(part)))
+        .collect()
+}
+
+/// Whether `name` is a credit an owner may be asked about: at least two
+/// fragments, none of them the whole credit again. `Solo,` never is.
+pub fn is_candidate(name: &str) -> bool {
+    let parts = fragments(name);
+    let whole = canonical(name);
+    parts.len() >= 2 && parts.iter().all(|part| canonical(part) != whole)
+}
+
+/// What a library decided about one credit.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum CreditDecision {
+    /// Replaced, wherever it is credited, by these names in this order.
+    Split(Vec<String>),
+    /// Left whole. It changes nothing a scan writes; it is what takes the
+    /// credit off the list.
+    Keep,
+}
+
+/// A library's decisions, by [`credit_key`].
+pub type Decisions = HashMap<String, CreditDecision>;
+
+/// The parts a split credit is replaced by on one track, each with the sort
+/// form this track's tags paired with it.
+///
+/// The sort form is cut by the same rule and paired with the track's own
+/// fragments **before** they are deduplicated, all or nothing as
+/// `tags::paired_sorts` pairs a joined tag. Pairing after the deduplication
+/// would compare `A, B, B, C` — three names — with four sort forms, and drop
+/// every one of them.
+fn expand(credit: &Credit, parts: &[String]) -> Vec<(String, Option<String>)> {
+    let names = cut(&credit.name);
+    let sorts = credit.sort_name.as_deref().map(cut).unwrap_or_default();
+    let paired: Vec<(String, Option<String>)> = if sorts.len() == names.len() {
+        names.into_iter().zip(sorts.into_iter().map(Some)).collect()
+    } else {
+        names.into_iter().map(|name| (name, None)).collect()
+    };
+    let mut by_name: HashMap<String, Option<String>> = HashMap::new();
+    for (name, sort) in paired {
+        by_name.entry(canonical(&name)).or_insert(sort);
+    }
+    parts
+        .iter()
+        .map(|part| {
+            let sort = by_name.get(&canonical(part)).cloned().flatten();
+            (part.clone(), sort)
+        })
+        .collect()
+}
+
+/// The participants one track credits: its first-step credits with the
+/// library's decisions applied.
+///
+/// `artist_override` is a correction someone typed (`track_override.artists`).
+/// It replaces the `artist` role whole and is final, so no decision touches
+/// it; every other role still follows the file and the decisions. A corrected
+/// name takes the album-artist sort form of the same name, as it did before
+/// this step existed.
+///
+/// `identity` is the artist id a name derives. A name whose artist already
+/// appears earlier in the same role and sub-role is not credited twice — the
+/// first occurrence wins — and positions are numbered from zero across each
+/// role, which `track_participant`'s `UNIQUE (track_id, role, position)` asks.
+pub fn resolve(
+    credits: &[Credit],
+    decisions: &Decisions,
+    artist_override: Option<&[String]>,
+    identity: impl Fn(&str) -> Uuid,
+) -> Vec<Credit> {
+    let mut ordered: Vec<&Credit> = credits.iter().collect();
+    // Role order first, then each role in its own order: the relation reads
+    // positions per role, and a stable order keeps two runs identical.
+    ordered.sort_by_key(|credit| (credit.role, credit.position));
+
+    let mut expanded: Vec<(Role, String, String, Option<String>)> = Vec::new();
+    if let Some(names) = artist_override {
+        for name in names {
+            let sort = credits
+                .iter()
+                .find(|credit| credit.role == Role::AlbumArtist && credit.name == *name)
+                .and_then(|credit| credit.sort_name.clone());
+            expanded.push((Role::Artist, String::new(), name.clone(), sort));
+        }
+    }
+    for credit in ordered {
+        if credit.role == Role::Artist && artist_override.is_some() {
+            continue;
+        }
+        match decisions.get(&credit_key(&credit.name)) {
+            Some(CreditDecision::Split(parts)) => {
+                for (name, sort) in expand(credit, parts) {
+                    expanded.push((credit.role, credit.sub_role.clone(), name, sort));
+                }
+            }
+            _ => expanded.push((
+                credit.role,
+                credit.sub_role.clone(),
+                credit.name.clone(),
+                credit.sort_name.clone(),
+            )),
+        }
+    }
+
+    let mut seen: HashSet<(Role, String, Uuid)> = HashSet::new();
+    let mut next: HashMap<Role, usize> = HashMap::new();
+    let mut resolved = Vec::with_capacity(expanded.len());
+    for (role, sub_role, name, sort_name) in expanded {
+        let name = name.trim().to_owned();
+        if name.is_empty() || !seen.insert((role, sub_role.clone(), identity(&name))) {
+            continue;
+        }
+        let position = next.entry(role).or_insert(0);
+        resolved.push(Credit {
+            role,
+            sub_role,
+            name,
+            sort_name,
+            position: *position,
+        });
+        *position += 1;
+    }
+    resolved
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/src/library/credit_split/tests.rs b/src/library/credit_split/tests.rs
new file mode 100644
index 00000000..e6208c0c
--- /dev/null
+++ b/src/library/credit_split/tests.rs
@@ -0,0 +1,203 @@
+use super::*;
+
+fn credit(role: Role, position: usize, name: &str, sort: Option<&str>) -> Credit {
+    Credit {
+        role,
+        sub_role: String::new(),
+        name: name.to_owned(),
+        sort_name: sort.map(str::to_owned),
+        position,
+    }
+}
+
+/// The identity the default spec derives, without a library: enough to
+/// tell two names apart the way the catalogue does.
+fn identity(name: &str) -> Uuid {
+    Uuid::new_v5(&Uuid::NAMESPACE_OID, credit_key(name).as_bytes())
+}
+
+fn names(credits: &[Credit], role: Role) -> Vec<(usize, &str)> {
+    credits
+        .iter()
+        .filter(|credit| credit.role == role)
+        .map(|credit| (credit.position, credit.name.as_str()))
+        .collect()
+}
+
+fn split(parts: &[&str]) -> CreditDecision {
+    CreditDecision::Split(parts.iter().map(|part| (*part).to_owned()).collect())
+}
+
+#[test]
+fn the_fragments_are_the_desktops_with_parentheses_protected() {
+    assert_eq!(
+        fragments("Ashreveal, Ashish Swargiary"),
+        ["Ashreveal", "Ashish Swargiary"]
+    );
+    assert_eq!(fragments("蔡依林，周杰伦"), ["蔡依林", "周杰伦"]);
+    assert_eq!(fragments("庄心妍、祁隆"), ["庄心妍", "祁隆"]);
+    assert_eq!(fragments("A､B, C"), ["A", "B", "C"]);
+    assert_eq!(fragments("A, B, A"), ["A", "B"]);
+    assert_eq!(
+        fragments("Ian Asher, Olly Alexander (Years, Years)"),
+        ["Ian Asher", "Olly Alexander (Years, Years)"],
+        "a comma inside parentheses qualifies a name"
+    );
+}
+
+#[test]
+fn a_candidate_has_two_fragments_and_none_is_the_whole() {
+    assert!(is_candidate("Zedd, Alessia Cara"));
+    assert!(is_candidate("Tyler, The Creator"), "only a person can tell");
+    assert!(!is_candidate("Solo,"));
+    assert!(!is_candidate("Simon & Garfunkel"));
+    assert!(!is_candidate("A, a"), "one fragment once deduplicated");
+}
+
+#[test]
+fn the_key_folds_case_and_typographic_punctuation_only() {
+    assert_eq!(credit_key(" A, B "), credit_key("a, b"));
+    assert_eq!(credit_key("Guns N’ Roses"), credit_key("guns n' roses"));
+    assert_ne!(credit_key("AC/DC"), credit_key("AC DC"));
+}
+
+#[test]
+fn a_split_replaces_the_credit_in_place_and_renumbers() {
+    let credits = [
+        credit(Role::Artist, 0, "X", None),
+        credit(Role::Artist, 1, "A, B", None),
+        credit(Role::Artist, 2, "Y", None),
+        credit(Role::AlbumArtist, 0, "A, B", None),
+    ];
+    let decisions = Decisions::from([(credit_key("A, B"), split(&["A", "B"]))]);
+    let resolved = resolve(&credits, &decisions, None, identity);
+    assert_eq!(
+        names(&resolved, Role::Artist),
+        [(0, "X"), (1, "A"), (2, "B"), (3, "Y")]
+    );
+    assert_eq!(names(&resolved, Role::AlbumArtist), [(0, "A"), (1, "B")]);
+}
+
+#[test]
+fn no_decision_leaves_every_credit_as_the_file_wrote_it() {
+    let credits = [
+        credit(Role::Artist, 0, "A, B", Some("B, A")),
+        credit(Role::Composer, 0, "C, D", None),
+    ];
+    let resolved = resolve(&credits, &Decisions::new(), None, identity);
+    assert_eq!(resolved.len(), 2);
+    assert_eq!(resolved[0].sort_name.as_deref(), Some("B, A"));
+}
+
+#[test]
+fn a_keep_changes_nothing() {
+    let credits = [credit(Role::Artist, 0, "Tyler, The Creator", None)];
+    let decisions = Decisions::from([(credit_key("Tyler, The Creator"), CreditDecision::Keep)]);
+    assert_eq!(
+        names(&resolve(&credits, &decisions, None, identity), Role::Artist),
+        [(0, "Tyler, The Creator")]
+    );
+}
+
+#[test]
+fn a_part_already_credited_is_not_credited_twice() {
+    let credits = [
+        credit(Role::Artist, 0, "A", None),
+        credit(Role::Artist, 1, "a, B", None),
+    ];
+    let decisions = Decisions::from([(credit_key("a, B"), split(&["a", "B"]))]);
+    assert_eq!(
+        names(&resolve(&credits, &decisions, None, identity), Role::Artist),
+        [(0, "A"), (1, "B")],
+        "the first occurrence wins, and positions stay contiguous"
+    );
+}
+
+#[test]
+fn two_credits_sharing_a_part_keep_the_files_order_whichever_is_undone() {
+    let credits = [
+        credit(Role::Artist, 0, "A, B", None),
+        credit(Role::Artist, 1, "A, C", None),
+    ];
+    let both = Decisions::from([
+        (credit_key("A, B"), split(&["A", "B"])),
+        (credit_key("A, C"), split(&["A", "C"])),
+    ]);
+    assert_eq!(
+        names(&resolve(&credits, &both, None, identity), Role::Artist),
+        [(0, "A"), (1, "B"), (2, "C")]
+    );
+    let first = Decisions::from([(credit_key("A, B"), split(&["A", "B"]))]);
+    assert_eq!(
+        names(&resolve(&credits, &first, None, identity), Role::Artist),
+        [(0, "A"), (1, "B"), (2, "A, C")]
+    );
+    let second = Decisions::from([(credit_key("A, C"), split(&["A", "C"]))]);
+    assert_eq!(
+        names(&resolve(&credits, &second, None, identity), Role::Artist),
+        [(0, "A, B"), (1, "A"), (2, "C")]
+    );
+}
+
+#[test]
+fn sort_forms_are_paired_before_the_fragments_are_deduplicated() {
+    let credits = [credit(Role::Artist, 0, "A, B, B, C", Some("a, b, b, c"))];
+    let decisions = Decisions::from([(credit_key("A, B, B, C"), split(&["A", "B", "C"]))]);
+    let resolved = resolve(&credits, &decisions, None, identity);
+    let sorts: Vec<Option<&str>> = resolved
+        .iter()
+        .map(|credit| credit.sort_name.as_deref())
+        .collect();
+    assert_eq!(sorts, [Some("a"), Some("b"), Some("c")]);
+}
+
+#[test]
+fn a_sort_form_of_another_length_pairs_with_nothing() {
+    let credits = [credit(Role::Artist, 0, "A, B", Some("a"))];
+    let decisions = Decisions::from([(credit_key("A, B"), split(&["A", "B"]))]);
+    assert!(resolve(&credits, &decisions, None, identity)
+        .iter()
+        .all(|credit| credit.sort_name.is_none()));
+}
+
+#[test]
+fn a_retagged_spelling_falls_under_the_same_decision() {
+    let credits = [credit(Role::Artist, 0, "a, b", None)];
+    let decisions = Decisions::from([(credit_key("A, B"), split(&["A", "B"]))]);
+    assert_eq!(
+        names(&resolve(&credits, &decisions, None, identity), Role::Artist),
+        [(0, "A"), (1, "B")]
+    );
+}
+
+#[test]
+fn a_correction_is_final_and_the_other_roles_still_follow_decisions() {
+    let credits = [
+        credit(Role::Artist, 0, "A, B", None),
+        credit(Role::AlbumArtist, 0, "A, B", Some("B, A")),
+    ];
+    let decisions = Decisions::from([(credit_key("A, B"), split(&["A", "B"]))]);
+    let corrected = ["A, B".to_owned()];
+    let resolved = resolve(&credits, &decisions, Some(&corrected), identity);
+    assert_eq!(names(&resolved, Role::Artist), [(0, "A, B")]);
+    assert_eq!(names(&resolved, Role::AlbumArtist), [(0, "A"), (1, "B")]);
+    assert_eq!(
+        resolved[0].sort_name.as_deref(),
+        Some("B, A"),
+        "a corrected name takes the album artist's sort form of that name"
+    );
+}
+
+#[test]
+fn performers_number_one_sequence_across_their_instruments() {
+    let mut guitar = credit(Role::Performer, 0, "A, B", None);
+    guitar.sub_role = "Guitar".into();
+    let mut drums = credit(Role::Performer, 1, "C", None);
+    drums.sub_role = "Drums".into();
+    let decisions = Decisions::from([(credit_key("A, B"), split(&["A", "B"]))]);
+    let resolved = resolve(&[guitar, drums], &decisions, None, identity);
+    assert_eq!(
+        names(&resolved, Role::Performer),
+        [(0, "A"), (1, "B"), (2, "C")]
+    );
+}
diff --git a/src/link_roots.rs b/src/library/link_roots/mod.rs
similarity index 77%
rename from src/link_roots.rs
rename to src/library/link_roots/mod.rs
index 34a7efa2..209aca78 100644
--- a/src/link_roots.rs
+++ b/src/library/link_roots/mod.rs
@@ -100,39 +100,4 @@ pub fn admits(roots: &[PathBuf], libraries: &[PathBuf], target: &Path) -> bool {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_target_must_sit_in_an_allowed_root_and_in_no_other_library() {
-        let roots = [PathBuf::from("/srv/beets")];
-        let libraries = [PathBuf::from("/srv/beets/shared-library")];
-        assert!(admits(&roots, &libraries, Path::new("/srv/beets/a/b.flac")));
-        assert!(!admits(
-            &roots,
-            &libraries,
-            Path::new("/srv/elsewhere/b.flac")
-        ));
-        assert!(!admits(
-            &roots,
-            &libraries,
-            Path::new("/srv/beets/shared-library/b.flac")
-        ));
-        // A prefix of a name is not a folder.
-        assert!(!admits(&roots, &[], Path::new("/srv/beetsx/b.flac")));
-        assert!(!admits(&[], &[], Path::new("/srv/beets/a.flac")));
-    }
-
-    #[test]
-    fn a_root_that_does_not_resolve_reaches_nothing() {
-        let present = tempfile::tempdir().unwrap();
-        let roots = LinkRoots::new(vec![
-            present.path().to_path_buf(),
-            present.path().join("not-there"),
-        ]);
-        assert_eq!(
-            roots.resolved(),
-            vec![std::fs::canonicalize(present.path()).unwrap()]
-        );
-    }
-}
+mod tests;
diff --git a/src/library/link_roots/tests.rs b/src/library/link_roots/tests.rs
new file mode 100644
index 00000000..8eabecda
--- /dev/null
+++ b/src/library/link_roots/tests.rs
@@ -0,0 +1,34 @@
+use super::*;
+
+#[test]
+fn a_target_must_sit_in_an_allowed_root_and_in_no_other_library() {
+    let roots = [PathBuf::from("/srv/beets")];
+    let libraries = [PathBuf::from("/srv/beets/shared-library")];
+    assert!(admits(&roots, &libraries, Path::new("/srv/beets/a/b.flac")));
+    assert!(!admits(
+        &roots,
+        &libraries,
+        Path::new("/srv/elsewhere/b.flac")
+    ));
+    assert!(!admits(
+        &roots,
+        &libraries,
+        Path::new("/srv/beets/shared-library/b.flac")
+    ));
+    // A prefix of a name is not a folder.
+    assert!(!admits(&roots, &[], Path::new("/srv/beetsx/b.flac")));
+    assert!(!admits(&[], &[], Path::new("/srv/beets/a.flac")));
+}
+
+#[test]
+fn a_root_that_does_not_resolve_reaches_nothing() {
+    let present = tempfile::tempdir().unwrap();
+    let roots = LinkRoots::new(vec![
+        present.path().to_path_buf(),
+        present.path().join("not-there"),
+    ]);
+    assert_eq!(
+        roots.resolved(),
+        vec![std::fs::canonicalize(present.path()).unwrap()]
+    );
+}
diff --git a/src/lyrics.rs b/src/library/lyrics/mod.rs
similarity index 64%
rename from src/lyrics.rs
rename to src/library/lyrics/mod.rs
index e6d634b5..1c4336f4 100644
--- a/src/lyrics.rs
+++ b/src/library/lyrics/mod.rs
@@ -423,233 +423,4 @@ fn parse_timestamp(value: &str) -> Option<i64> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_ttml_line_break_keeps_its_words_apart() {
-        let parsed = parse_ttml(
-            r#"<tt xmlns="http://www.w3.org/ns/ttml"><body><div>
-                <p begin="1s">hello<br/>world</p>
-            </div></body></tt>"#,
-        )
-        .unwrap();
-        assert_eq!(parsed.lines[0].value, "hello world");
-    }
-
-    #[test]
-    fn a_ttml_language_comes_from_the_root_or_the_body_only() {
-        let deep = parse_ttml(
-            r#"<tt xmlns="http://www.w3.org/ns/ttml"><head><metadata xml:lang="de"/></head>
-                <body><div><p begin="1s"><span xml:lang="en">hi</span></p></div></body></tt>"#,
-        )
-        .unwrap();
-        assert_eq!(deep.lang, UNKNOWN_LANG);
-        let body = parse_ttml(
-            r#"<tt xmlns="http://www.w3.org/ns/ttml"><head><metadata xml:lang="de"/></head>
-                <body xml:lang="ko"><div><p begin="1s">hi</p></div></body></tt>"#,
-        )
-        .unwrap();
-        assert_eq!(body.lang, "ko");
-        let blank_root = parse_ttml(
-            r#"<tt xmlns="http://www.w3.org/ns/ttml" xml:lang=" ">
-                <body xml:lang="ko"><div><p begin="1s">hi</p></div></body></tt>"#,
-        )
-        .unwrap();
-        assert_eq!(blank_root.lang, "ko");
-    }
-
-    #[test]
-    fn a_paragraph_nested_in_a_paragraph_reads_once() {
-        let parsed = parse_ttml(
-            r#"<tt xmlns="http://www.w3.org/ns/ttml"><body><div>
-                <p begin="1s">outer <p begin="2s">inner <p begin="3s">deepest</p></p></p>
-                <p begin="4s">next</p>
-            </div></body></tt>"#,
-        )
-        .unwrap();
-        assert_eq!(
-            parsed.lines,
-            vec![
-                LyricsLine {
-                    start: Some(1000),
-                    value: "outer inner deepest".into(),
-                },
-                LyricsLine {
-                    start: Some(4000),
-                    value: "next".into(),
-                },
-            ]
-        );
-    }
-
-    #[test]
-    fn parses_and_orders_lrc_timestamps() {
-        assert_eq!(
-            lines("[00:02.50]second\n[00:01.125][00:03]shared", true),
-            vec![
-                LyricsLine {
-                    start: Some(1125),
-                    value: "shared".into(),
-                },
-                LyricsLine {
-                    start: Some(2500),
-                    value: "second".into(),
-                },
-                LyricsLine {
-                    start: Some(3000),
-                    value: "shared".into(),
-                },
-            ]
-        );
-    }
-
-    #[test]
-    fn ignores_lrc_metadata_and_preserves_plain_lines() {
-        assert_eq!(
-            lines("[ar:WaveFlow]\r\nfirst\r\n\r\nsecond", false),
-            vec![
-                LyricsLine {
-                    start: None,
-                    value: "[ar:WaveFlow]".into(),
-                },
-                LyricsLine {
-                    start: None,
-                    value: "first".into(),
-                },
-                LyricsLine {
-                    start: None,
-                    value: "".into(),
-                },
-                LyricsLine {
-                    start: None,
-                    value: "second".into(),
-                },
-            ]
-        );
-    }
-
-    #[test]
-    fn reads_every_ttml_clock_and_offset_form() {
-        assert_eq!(ttml_time("01:02:03.5"), Some(3_723_500));
-        assert_eq!(ttml_time("2:03.250"), Some(123_250));
-        assert_eq!(ttml_time("12.345"), Some(12_345));
-        assert_eq!(ttml_time("1.5s"), Some(1_500));
-        assert_eq!(ttml_time("1500ms"), Some(1_500));
-        assert_eq!(ttml_time("2m"), Some(120_000));
-        assert_eq!(ttml_time("1h"), Some(3_600_000));
-        // Frames need a frame rate the sheet does not get to set.
-        assert_eq!(ttml_time("00:00:01:12"), None);
-        assert_eq!(ttml_time("12f"), None);
-        // Out of range, and not a time at all.
-        assert_eq!(ttml_time("00:61:00"), None);
-        assert_eq!(ttml_time("-1s"), None);
-        assert_eq!(ttml_time(""), None);
-    }
-
-    #[test]
-    fn reads_a_ttml_sheet_with_word_spans() {
-        let ttml = r#"<?xml version="1.0" encoding="UTF-8"?>
-<tt xmlns="http://www.w3.org/ns/ttml" xml:lang="ja">
-  <body><div>
-    <p begin="0:05.500" end="0:07"><span begin="0:05.500">夜の</span> <span begin="0:06">街</span></p>
-    <p begin="0:01.000">first</p>
-    <p>no time, left out</p>
-    <p begin="00:00:09:05">frames, left out</p>
-  </div></body>
-</tt>"#;
-        let parsed = parse_ttml(ttml).expect("a sheet");
-        assert_eq!(parsed.lang, "ja");
-        assert!(parsed.synced);
-        assert_eq!(
-            parsed.lines,
-            vec![
-                LyricsLine {
-                    start: Some(1_000),
-                    value: "first".into(),
-                },
-                LyricsLine {
-                    start: Some(5_500),
-                    value: "夜の 街".into(),
-                },
-            ]
-        );
-    }
-
-    #[test]
-    fn refuses_a_ttml_document_with_a_dtd() {
-        // An entity is how an XML upload reaches a file or inflates itself;
-        // the default parser options refuse the DTD that would declare one.
-        let hostile = r#"<?xml version="1.0"?>
-<!DOCTYPE tt [<!ENTITY x SYSTEM "file:///etc/passwd">]>
-<tt xmlns="http://www.w3.org/ns/ttml"><body><div><p begin="1s">&x;</p></div></body></tt>"#;
-        assert_eq!(parse_ttml(hostile), None);
-        assert_eq!(parse_upload(UploadFormat::Ttml, hostile), None);
-    }
-
-    #[test]
-    fn refuses_uploads_with_nothing_usable_in_them() {
-        assert_eq!(parse_upload(UploadFormat::Txt, " \n\t\n"), None);
-        assert_eq!(
-            parse_upload(UploadFormat::Lrc, "[ar:Someone]\n[00:01.00]\n"),
-            None
-        );
-        assert_eq!(
-            parse_upload(
-                UploadFormat::Ttml,
-                r#"<tt xmlns="http://www.w3.org/ns/ttml"><body><div><p>untimed</p></div></body></tt>"#
-            ),
-            None
-        );
-        assert_eq!(
-            parse_upload(UploadFormat::Ttml, "<html><p begin=\"1s\">x</p></html>"),
-            None
-        );
-        let lrc = parse_upload(UploadFormat::Lrc, "[la:fr]\n[00:01.00]bonjour").expect("a sheet");
-        assert_eq!(lrc.lang, "fr");
-        assert!(lrc.synced);
-        let plain = parse_upload(UploadFormat::Lrc, "no timestamps\nat all").expect("a sheet");
-        assert!(!plain.synced, "an .lrc without timings is plain text");
-    }
-
-    #[test]
-    fn writes_scanned_sheets_back_as_lrc_and_text() {
-        let synced = lines("[00:01.25]one\n[61:02.5]two", true);
-        assert_eq!(to_lrc(&synced), "[00:01.25]one\n[61:02.50]two\n");
-        assert_eq!(lines(&to_lrc(&synced), true), synced, "round trip");
-        assert_eq!(to_text(&lines("a\n\nb", false)), "a\n\nb\n");
-    }
-
-    #[test]
-    fn rejects_negative_and_overflowing_timestamps() {
-        assert_eq!(parse_timestamp("-1:00"), None);
-        assert_eq!(parse_timestamp("00:-01"), None);
-        assert_eq!(parse_timestamp(&format!("{}:00", i64::MAX)), None);
-    }
-
-    /// A line may carry several timestamps, and each is a line once read; a
-    /// sheet that piles them up is read as the text it is instead of being
-    /// expanded without end (RFC-023 decision 5).
-    ///
-    /// Sized to be told apart cheaply: twenty thousand timestamps before a
-    /// kilobyte of text is 120 KB of file and twenty megabytes expanded, so a
-    /// parser without the budget passes neither assertion and allocates
-    /// nothing a test run would notice.
-    #[test]
-    fn a_sheet_that_piles_up_timestamps_is_not_expanded() {
-        let sheet = format!("{}{}", "[0:0]".repeat(20_000), "la".repeat(512));
-        assert!(!has_lrc_timestamps(&sheet), "over the budget is not synced");
-        assert_eq!(lines(&sheet, true).len(), 1, "read as the one line it is");
-        let upload = parse_upload(UploadFormat::Lrc, &sheet).expect("still a sheet");
-        assert!(!upload.synced);
-        assert_eq!(upload.lines.len(), 1);
-
-        // A chorus repeated, as real sheets do, is still expanded.
-        let chorus = lines(
-            "[00:10.00][01:10.00][02:10.00]chorus\n[00:20.00]verse",
-            true,
-        );
-        assert_eq!(chorus.len(), 4);
-        assert_eq!(chorus[1].value, "verse");
-    }
-}
+mod tests;
diff --git a/src/library/lyrics/tests.rs b/src/library/lyrics/tests.rs
new file mode 100644
index 00000000..713a2fef
--- /dev/null
+++ b/src/library/lyrics/tests.rs
@@ -0,0 +1,228 @@
+use super::*;
+
+#[test]
+fn a_ttml_line_break_keeps_its_words_apart() {
+    let parsed = parse_ttml(
+        r#"<tt xmlns="http://www.w3.org/ns/ttml"><body><div>
+                <p begin="1s">hello<br/>world</p>
+            </div></body></tt>"#,
+    )
+    .unwrap();
+    assert_eq!(parsed.lines[0].value, "hello world");
+}
+
+#[test]
+fn a_ttml_language_comes_from_the_root_or_the_body_only() {
+    let deep = parse_ttml(
+        r#"<tt xmlns="http://www.w3.org/ns/ttml"><head><metadata xml:lang="de"/></head>
+                <body><div><p begin="1s"><span xml:lang="en">hi</span></p></div></body></tt>"#,
+    )
+    .unwrap();
+    assert_eq!(deep.lang, UNKNOWN_LANG);
+    let body = parse_ttml(
+        r#"<tt xmlns="http://www.w3.org/ns/ttml"><head><metadata xml:lang="de"/></head>
+                <body xml:lang="ko"><div><p begin="1s">hi</p></div></body></tt>"#,
+    )
+    .unwrap();
+    assert_eq!(body.lang, "ko");
+    let blank_root = parse_ttml(
+        r#"<tt xmlns="http://www.w3.org/ns/ttml" xml:lang=" ">
+                <body xml:lang="ko"><div><p begin="1s">hi</p></div></body></tt>"#,
+    )
+    .unwrap();
+    assert_eq!(blank_root.lang, "ko");
+}
+
+#[test]
+fn a_paragraph_nested_in_a_paragraph_reads_once() {
+    let parsed = parse_ttml(
+        r#"<tt xmlns="http://www.w3.org/ns/ttml"><body><div>
+                <p begin="1s">outer <p begin="2s">inner <p begin="3s">deepest</p></p></p>
+                <p begin="4s">next</p>
+            </div></body></tt>"#,
+    )
+    .unwrap();
+    assert_eq!(
+        parsed.lines,
+        vec![
+            LyricsLine {
+                start: Some(1000),
+                value: "outer inner deepest".into(),
+            },
+            LyricsLine {
+                start: Some(4000),
+                value: "next".into(),
+            },
+        ]
+    );
+}
+
+#[test]
+fn parses_and_orders_lrc_timestamps() {
+    assert_eq!(
+        lines("[00:02.50]second\n[00:01.125][00:03]shared", true),
+        vec![
+            LyricsLine {
+                start: Some(1125),
+                value: "shared".into(),
+            },
+            LyricsLine {
+                start: Some(2500),
+                value: "second".into(),
+            },
+            LyricsLine {
+                start: Some(3000),
+                value: "shared".into(),
+            },
+        ]
+    );
+}
+
+#[test]
+fn ignores_lrc_metadata_and_preserves_plain_lines() {
+    assert_eq!(
+        lines("[ar:WaveFlow]\r\nfirst\r\n\r\nsecond", false),
+        vec![
+            LyricsLine {
+                start: None,
+                value: "[ar:WaveFlow]".into(),
+            },
+            LyricsLine {
+                start: None,
+                value: "first".into(),
+            },
+            LyricsLine {
+                start: None,
+                value: "".into(),
+            },
+            LyricsLine {
+                start: None,
+                value: "second".into(),
+            },
+        ]
+    );
+}
+
+#[test]
+fn reads_every_ttml_clock_and_offset_form() {
+    assert_eq!(ttml_time("01:02:03.5"), Some(3_723_500));
+    assert_eq!(ttml_time("2:03.250"), Some(123_250));
+    assert_eq!(ttml_time("12.345"), Some(12_345));
+    assert_eq!(ttml_time("1.5s"), Some(1_500));
+    assert_eq!(ttml_time("1500ms"), Some(1_500));
+    assert_eq!(ttml_time("2m"), Some(120_000));
+    assert_eq!(ttml_time("1h"), Some(3_600_000));
+    // Frames need a frame rate the sheet does not get to set.
+    assert_eq!(ttml_time("00:00:01:12"), None);
+    assert_eq!(ttml_time("12f"), None);
+    // Out of range, and not a time at all.
+    assert_eq!(ttml_time("00:61:00"), None);
+    assert_eq!(ttml_time("-1s"), None);
+    assert_eq!(ttml_time(""), None);
+}
+
+#[test]
+fn reads_a_ttml_sheet_with_word_spans() {
+    let ttml = r#"<?xml version="1.0" encoding="UTF-8"?>
+<tt xmlns="http://www.w3.org/ns/ttml" xml:lang="ja">
+  <body><div>
+    <p begin="0:05.500" end="0:07"><span begin="0:05.500">夜の</span> <span begin="0:06">街</span></p>
+    <p begin="0:01.000">first</p>
+    <p>no time, left out</p>
+    <p begin="00:00:09:05">frames, left out</p>
+  </div></body>
+</tt>"#;
+    let parsed = parse_ttml(ttml).expect("a sheet");
+    assert_eq!(parsed.lang, "ja");
+    assert!(parsed.synced);
+    assert_eq!(
+        parsed.lines,
+        vec![
+            LyricsLine {
+                start: Some(1_000),
+                value: "first".into(),
+            },
+            LyricsLine {
+                start: Some(5_500),
+                value: "夜の 街".into(),
+            },
+        ]
+    );
+}
+
+#[test]
+fn refuses_a_ttml_document_with_a_dtd() {
+    // An entity is how an XML upload reaches a file or inflates itself;
+    // the default parser options refuse the DTD that would declare one.
+    let hostile = r#"<?xml version="1.0"?>
+<!DOCTYPE tt [<!ENTITY x SYSTEM "file:///etc/passwd">]>
+<tt xmlns="http://www.w3.org/ns/ttml"><body><div><p begin="1s">&x;</p></div></body></tt>"#;
+    assert_eq!(parse_ttml(hostile), None);
+    assert_eq!(parse_upload(UploadFormat::Ttml, hostile), None);
+}
+
+#[test]
+fn refuses_uploads_with_nothing_usable_in_them() {
+    assert_eq!(parse_upload(UploadFormat::Txt, " \n\t\n"), None);
+    assert_eq!(
+        parse_upload(UploadFormat::Lrc, "[ar:Someone]\n[00:01.00]\n"),
+        None
+    );
+    assert_eq!(
+        parse_upload(
+            UploadFormat::Ttml,
+            r#"<tt xmlns="http://www.w3.org/ns/ttml"><body><div><p>untimed</p></div></body></tt>"#
+        ),
+        None
+    );
+    assert_eq!(
+        parse_upload(UploadFormat::Ttml, "<html><p begin=\"1s\">x</p></html>"),
+        None
+    );
+    let lrc = parse_upload(UploadFormat::Lrc, "[la:fr]\n[00:01.00]bonjour").expect("a sheet");
+    assert_eq!(lrc.lang, "fr");
+    assert!(lrc.synced);
+    let plain = parse_upload(UploadFormat::Lrc, "no timestamps\nat all").expect("a sheet");
+    assert!(!plain.synced, "an .lrc without timings is plain text");
+}
+
+#[test]
+fn writes_scanned_sheets_back_as_lrc_and_text() {
+    let synced = lines("[00:01.25]one\n[61:02.5]two", true);
+    assert_eq!(to_lrc(&synced), "[00:01.25]one\n[61:02.50]two\n");
+    assert_eq!(lines(&to_lrc(&synced), true), synced, "round trip");
+    assert_eq!(to_text(&lines("a\n\nb", false)), "a\n\nb\n");
+}
+
+#[test]
+fn rejects_negative_and_overflowing_timestamps() {
+    assert_eq!(parse_timestamp("-1:00"), None);
+    assert_eq!(parse_timestamp("00:-01"), None);
+    assert_eq!(parse_timestamp(&format!("{}:00", i64::MAX)), None);
+}
+
+/// A line may carry several timestamps, and each is a line once read; a
+/// sheet that piles them up is read as the text it is instead of being
+/// expanded without end (RFC-023 decision 5).
+///
+/// Sized to be told apart cheaply: twenty thousand timestamps before a
+/// kilobyte of text is 120 KB of file and twenty megabytes expanded, so a
+/// parser without the budget passes neither assertion and allocates
+/// nothing a test run would notice.
+#[test]
+fn a_sheet_that_piles_up_timestamps_is_not_expanded() {
+    let sheet = format!("{}{}", "[0:0]".repeat(20_000), "la".repeat(512));
+    assert!(!has_lrc_timestamps(&sheet), "over the budget is not synced");
+    assert_eq!(lines(&sheet, true).len(), 1, "read as the one line it is");
+    let upload = parse_upload(UploadFormat::Lrc, &sheet).expect("still a sheet");
+    assert!(!upload.synced);
+    assert_eq!(upload.lines.len(), 1);
+
+    // A chorus repeated, as real sheets do, is still expanded.
+    let chorus = lines(
+        "[00:10.00][01:10.00][02:10.00]chorus\n[00:20.00]verse",
+        true,
+    );
+    assert_eq!(chorus.len(), 4);
+    assert_eq!(chorus[1].value, "verse");
+}
diff --git a/src/library/mod.rs b/src/library/mod.rs
new file mode 100644
index 00000000..1eed2637
--- /dev/null
+++ b/src/library/mod.rs
@@ -0,0 +1,12 @@
+//! Reading the music on disk: the scanner and the watcher that wakes it, the
+//! tag mapper, the identifiers derived from tags, credit splitting, the roots a
+//! followed link may reach, playlist files and lyrics sheets.
+
+pub mod credit_split;
+pub mod link_roots;
+pub mod lyrics;
+pub mod pid;
+pub mod playlist_file;
+pub mod scanner;
+pub mod tags;
+pub mod watcher;
diff --git a/src/pid.rs b/src/library/pid/mod.rs
similarity index 65%
rename from src/pid.rs
rename to src/library/pid/mod.rs
index 84de7967..17e7cb60 100644
--- a/src/pid.rs
+++ b/src/library/pid/mod.rs
@@ -267,167 +267,4 @@ fn hash_parts(parts: &[&str]) -> Uuid {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    struct Fixture {
-        tags: Vec<(&'static str, &'static str)>,
-        folder: &'static str,
-        album_artist: &'static str,
-        title: &'static str,
-        album: &'static str,
-    }
-
-    impl Default for Fixture {
-        fn default() -> Self {
-            Self {
-                tags: Vec::new(),
-                folder: "/music/album",
-                album_artist: "Album Artist",
-                title: "Track Title",
-                album: "Album Name",
-            }
-        }
-    }
-
-    impl PidSource for Fixture {
-        fn tag(&self, name: &str) -> Option<&str> {
-            self.tags
-                .iter()
-                .find(|(key, _)| *key == name)
-                .map(|(_, value)| *value)
-        }
-        fn folder(&self) -> &str {
-            self.folder
-        }
-        fn album_artist_display(&self) -> &str {
-            self.album_artist
-        }
-        fn title(&self) -> &str {
-            self.title
-        }
-        fn album(&self) -> &str {
-            self.album
-        }
-    }
-
-    fn default_specs() -> PidSpecs {
-        PidSpecs {
-            album: PidSpec::parse(
-                "musicbrainz_albumid|albumartistid,album,albumversion,releasedate",
-                false,
-            )
-            .expect("album spec"),
-            track: PidSpec::parse(
-                "musicbrainz_trackid|albumid,discnumber,tracknumber,title",
-                true,
-            )
-            .expect("track spec"),
-            artist: PidSpec::parse("albumartistid", false).expect("artist spec"),
-        }
-    }
-
-    const LIBRARY: Uuid = Uuid::from_u128(1);
-
-    #[test]
-    fn the_first_group_holding_a_value_wins() {
-        let specs = default_specs();
-        let untagged = Fixture::default();
-        let tagged = Fixture {
-            tags: vec![("musicbrainz_albumid", "1234")],
-            ..Fixture::default()
-        };
-        assert_ne!(
-            specs.album_id(LIBRARY, &untagged),
-            specs.album_id(LIBRARY, &tagged),
-            "a release id answers instead of the fallback group"
-        );
-        // And a tag no group names moves nothing.
-        let unrelated = Fixture {
-            tags: vec![("comment", "anything")],
-            ..Fixture::default()
-        };
-        assert_eq!(
-            specs.album_id(LIBRARY, &untagged),
-            specs.album_id(LIBRARY, &unrelated)
-        );
-    }
-
-    /// The defect this engine exists to make impossible: a joined credit used
-    /// to collapse onto the row id of its first artist.
-    #[test]
-    fn a_joined_credit_identifies_the_album_by_the_whole_string() {
-        let specs = default_specs();
-        let of = |credit: &'static str| {
-            specs.album_id(
-                LIBRARY,
-                &Fixture {
-                    album_artist: credit,
-                    ..Fixture::default()
-                },
-            )
-        };
-        assert_ne!(of("Nova Kern; Lior Sand"), of("Nova Kern; Ada Vale"));
-        assert_ne!(of("Nova Kern"), of("Nova Kern; Lior Sand"));
-        // The boundary between credits is part of the identity, which the old
-        // canonical form erased.
-        assert_ne!(of("A; B C"), of("A; B; C"));
-    }
-
-    #[test]
-    fn punctuation_and_accents_survive_normalisation() {
-        assert_eq!(str_clear("Sgt. Pepper\u{2019}s"), "Sgt. Pepper's");
-        assert_eq!(str_clear("Beyonc\u{e9}"), "Beyonc\u{e9}");
-        assert_eq!(str_clear("AC/DC"), "AC/DC");
-        assert_eq!(str_clear("Post\u{2014}Rock"), "Post-Rock");
-        assert_ne!(str_clear("AC/DC"), str_clear("AC DC"));
-    }
-
-    #[test]
-    fn the_library_separates_two_catalogues_holding_the_same_file() {
-        let specs = default_specs();
-        let other = Uuid::from_u128(2);
-        assert_ne!(
-            specs.album_id(LIBRARY, &Fixture::default()),
-            specs.album_id(other, &Fixture::default())
-        );
-        assert_ne!(
-            specs.artist_id(LIBRARY, "Nova Kern"),
-            specs.artist_id(other, "Nova Kern")
-        );
-    }
-
-    #[test]
-    fn a_track_follows_its_album() {
-        let specs = default_specs();
-        let here = Fixture::default();
-        let elsewhere = Fixture {
-            album: "Another Album",
-            ..Fixture::default()
-        };
-        assert_ne!(
-            specs.track_id(LIBRARY, &here),
-            specs.track_id(LIBRARY, &elsewhere),
-            "`albumid` reaches the album spec"
-        );
-    }
-
-    #[test]
-    fn a_recursive_album_spec_is_refused() {
-        assert!(PidSpec::parse("albumid,album", false).is_err());
-        assert!(PidSpec::parse("albumid,title", true).is_ok());
-        assert!(PidSpec::parse("", false).is_err());
-    }
-
-    #[test]
-    fn every_identifier_is_a_version_eight_uuid() {
-        let specs = default_specs();
-        assert_eq!(
-            specs
-                .album_id(LIBRARY, &Fixture::default())
-                .get_version_num(),
-            8
-        );
-        assert_eq!(specs.artist_id(LIBRARY, "Nova Kern").get_version_num(), 8);
-    }
-}
+mod tests;
diff --git a/src/library/pid/tests.rs b/src/library/pid/tests.rs
new file mode 100644
index 00000000..ceec75a4
--- /dev/null
+++ b/src/library/pid/tests.rs
@@ -0,0 +1,162 @@
+use super::*;
+
+struct Fixture {
+    tags: Vec<(&'static str, &'static str)>,
+    folder: &'static str,
+    album_artist: &'static str,
+    title: &'static str,
+    album: &'static str,
+}
+
+impl Default for Fixture {
+    fn default() -> Self {
+        Self {
+            tags: Vec::new(),
+            folder: "/music/album",
+            album_artist: "Album Artist",
+            title: "Track Title",
+            album: "Album Name",
+        }
+    }
+}
+
+impl PidSource for Fixture {
+    fn tag(&self, name: &str) -> Option<&str> {
+        self.tags
+            .iter()
+            .find(|(key, _)| *key == name)
+            .map(|(_, value)| *value)
+    }
+    fn folder(&self) -> &str {
+        self.folder
+    }
+    fn album_artist_display(&self) -> &str {
+        self.album_artist
+    }
+    fn title(&self) -> &str {
+        self.title
+    }
+    fn album(&self) -> &str {
+        self.album
+    }
+}
+
+fn default_specs() -> PidSpecs {
+    PidSpecs {
+        album: PidSpec::parse(
+            "musicbrainz_albumid|albumartistid,album,albumversion,releasedate",
+            false,
+        )
+        .expect("album spec"),
+        track: PidSpec::parse(
+            "musicbrainz_trackid|albumid,discnumber,tracknumber,title",
+            true,
+        )
+        .expect("track spec"),
+        artist: PidSpec::parse("albumartistid", false).expect("artist spec"),
+    }
+}
+
+const LIBRARY: Uuid = Uuid::from_u128(1);
+
+#[test]
+fn the_first_group_holding_a_value_wins() {
+    let specs = default_specs();
+    let untagged = Fixture::default();
+    let tagged = Fixture {
+        tags: vec![("musicbrainz_albumid", "1234")],
+        ..Fixture::default()
+    };
+    assert_ne!(
+        specs.album_id(LIBRARY, &untagged),
+        specs.album_id(LIBRARY, &tagged),
+        "a release id answers instead of the fallback group"
+    );
+    // And a tag no group names moves nothing.
+    let unrelated = Fixture {
+        tags: vec![("comment", "anything")],
+        ..Fixture::default()
+    };
+    assert_eq!(
+        specs.album_id(LIBRARY, &untagged),
+        specs.album_id(LIBRARY, &unrelated)
+    );
+}
+
+/// The defect this engine exists to make impossible: a joined credit used
+/// to collapse onto the row id of its first artist.
+#[test]
+fn a_joined_credit_identifies_the_album_by_the_whole_string() {
+    let specs = default_specs();
+    let of = |credit: &'static str| {
+        specs.album_id(
+            LIBRARY,
+            &Fixture {
+                album_artist: credit,
+                ..Fixture::default()
+            },
+        )
+    };
+    assert_ne!(of("Nova Kern; Lior Sand"), of("Nova Kern; Ada Vale"));
+    assert_ne!(of("Nova Kern"), of("Nova Kern; Lior Sand"));
+    // The boundary between credits is part of the identity, which the old
+    // canonical form erased.
+    assert_ne!(of("A; B C"), of("A; B; C"));
+}
+
+#[test]
+fn punctuation_and_accents_survive_normalisation() {
+    assert_eq!(str_clear("Sgt. Pepper\u{2019}s"), "Sgt. Pepper's");
+    assert_eq!(str_clear("Beyonc\u{e9}"), "Beyonc\u{e9}");
+    assert_eq!(str_clear("AC/DC"), "AC/DC");
+    assert_eq!(str_clear("Post\u{2014}Rock"), "Post-Rock");
+    assert_ne!(str_clear("AC/DC"), str_clear("AC DC"));
+}
+
+#[test]
+fn the_library_separates_two_catalogues_holding_the_same_file() {
+    let specs = default_specs();
+    let other = Uuid::from_u128(2);
+    assert_ne!(
+        specs.album_id(LIBRARY, &Fixture::default()),
+        specs.album_id(other, &Fixture::default())
+    );
+    assert_ne!(
+        specs.artist_id(LIBRARY, "Nova Kern"),
+        specs.artist_id(other, "Nova Kern")
+    );
+}
+
+#[test]
+fn a_track_follows_its_album() {
+    let specs = default_specs();
+    let here = Fixture::default();
+    let elsewhere = Fixture {
+        album: "Another Album",
+        ..Fixture::default()
+    };
+    assert_ne!(
+        specs.track_id(LIBRARY, &here),
+        specs.track_id(LIBRARY, &elsewhere),
+        "`albumid` reaches the album spec"
+    );
+}
+
+#[test]
+fn a_recursive_album_spec_is_refused() {
+    assert!(PidSpec::parse("albumid,album", false).is_err());
+    assert!(PidSpec::parse("albumid,title", true).is_ok());
+    assert!(PidSpec::parse("", false).is_err());
+}
+
+#[test]
+fn every_identifier_is_a_version_eight_uuid() {
+    let specs = default_specs();
+    assert_eq!(
+        specs
+            .album_id(LIBRARY, &Fixture::default())
+            .get_version_num(),
+        8
+    );
+    assert_eq!(specs.artist_id(LIBRARY, "Nova Kern").get_version_num(), 8);
+}
diff --git a/src/library/playlist_file/mod.rs b/src/library/playlist_file/mod.rs
new file mode 100644
index 00000000..d78c8cab
--- /dev/null
+++ b/src/library/playlist_file/mod.rs
@@ -0,0 +1,256 @@
+//! Reading an `.m3u` or `.m3u8` playlist file.
+//!
+//! Pure: bytes in, entries out, no database and no filesystem. What an entry
+//! *resolves to* is a catalogue question and lives in
+//! [`crate::services`]; what an entry *says* is here.
+//!
+//! Two dialects, and the simple one is a subset of the other: a plain `.m3u`
+//! is one target per line, and the extended one adds `#EXTM3U` on the first
+//! line with an optional `#EXTINF` before each target. A reader that treats
+//! every `#` line as a comment reads both, which is what this does — the
+//! `#EXTINF` metadata is kept because it is the only thing left to match on
+//! when a path resolves to nothing.
+
+use chardetng::{EncodingDetector, Iso2022JpDetection, Utf8Detection};
+use encoding_rs::Encoding;
+use serde::{Serialize, Serializer};
+
+/// How the bytes were read as text.
+///
+/// Reported rather than assumed, because the guess can be wrong and a wrong
+/// guess mangles every title. A caller that sees `shift_jis` on a file it
+/// believed was UTF-8 has been told something.
+///
+/// On the wire, the encoding's WHATWG name in lower case: `utf-8`,
+/// `utf-16le`, `windows-1252`, `shift_jis`, `gbk`, `big5`, `euc-kr` and so on.
+/// The two this answered before it read anything but UTF-8 and Windows-1252
+/// are spelled as they were.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct TextEncoding(&'static Encoding);
+
+impl TextEncoding {
+    pub const UTF_8: Self = Self(encoding_rs::UTF_8);
+
+    /// The name a report gives, `utf-8` rather than encoding_rs's `UTF-8`.
+    pub fn name(self) -> String {
+        self.0.name().to_ascii_lowercase()
+    }
+}
+
+impl Serialize for TextEncoding {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&self.name())
+    }
+}
+
+/// One line of the file that names something to play.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PlaylistFileEntry {
+    /// One-based line number of the target, for a report that can be read
+    /// against the file the user sent.
+    pub line: usize,
+    /// The target exactly as written, kept for the report: a user looking for
+    /// why an entry failed needs to see what they wrote, not what we made of
+    /// it.
+    pub raw: String,
+    /// The target reduced to path segments, separators folded and `.`/`..`
+    /// resolved. Empty for a target that names no path at all — a bare URL.
+    pub segments: Vec<String>,
+    /// `#EXTINF` duration in seconds, when the file gave one.
+    pub duration_secs: Option<i64>,
+    /// `#EXTINF` display text, usually `Artist - Title`.
+    pub title: Option<String>,
+}
+
+impl PlaylistFileEntry {
+    /// `Artist - Title` split back into its two halves, when the title looks
+    /// like one.
+    ///
+    /// The separator is " - " with spaces: a hyphen with no spaces around it
+    /// belongs to the name more often than it separates two of them.
+    pub fn artist_and_title(&self) -> Option<(&str, &str)> {
+        let title = self.title.as_deref()?;
+        let (artist, song) = title.split_once(" - ")?;
+        let (artist, song) = (artist.trim(), song.trim());
+        (!artist.is_empty() && !song.is_empty()).then_some((artist, song))
+    }
+}
+
+/// A parsed playlist file.
+#[derive(Debug, Clone)]
+pub struct PlaylistFile {
+    /// The name `#PLAYLIST` gave, when it gave one.
+    pub name: Option<String>,
+    pub encoding: TextEncoding,
+    pub entries: Vec<PlaylistFileEntry>,
+}
+
+/// The file names more entries than the caller would take.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct TooManyEntries;
+
+/// Reads the file, up to `max_entries` entries.
+///
+/// Fails on one thing only: a file naming more than `max_entries` entries,
+/// noticed at the first entry past the line, before it is built (RFC-023
+/// decision 5). The caller's ceiling used to be applied once the whole file
+/// was read, and a five-megabyte body of one-letter lines is millions of
+/// entries, each with its own strings, before anything refused it.
+///
+/// Otherwise lenient: a line this does not understand is a line it reports
+/// nothing about, and an empty result is an empty playlist rather than an
+/// error. The caller decides what an empty import means, which is a policy
+/// question and not a parsing one.
+pub fn parse(bytes: &[u8], max_entries: usize) -> Result<PlaylistFile, TooManyEntries> {
+    let (text, encoding) = decode(bytes);
+    let mut name = None;
+    let mut pending: Option<(Option<i64>, Option<String>)> = None;
+    let mut entries = Vec::new();
+    for (index, raw_line) in text.lines().enumerate() {
+        // A `.m3u` written on Windows and read here keeps its carriage
+        // returns, and a trailing `\r` in a path matches nothing.
+        let line = raw_line
+            .trim_matches(|c: char| c == '\r' || c == '\n')
+            .trim();
+        if line.is_empty() {
+            continue;
+        }
+        if let Some(directive) = line.strip_prefix('#') {
+            if let Some(value) = directive.strip_prefix("EXTINF:") {
+                pending = Some(parse_extinf(value));
+            } else if let Some(value) = directive.strip_prefix("PLAYLIST:") {
+                let value = value.trim();
+                if !value.is_empty() {
+                    name = Some(value.to_owned());
+                }
+            }
+            // Everything else — `#EXTM3U`, `#EXTALB`, `#EXTGRP`, a human
+            // comment — says nothing this import can act on.
+            continue;
+        }
+        if entries.len() == max_entries {
+            return Err(TooManyEntries);
+        }
+        let (duration_secs, title) = pending.take().unwrap_or((None, None));
+        entries.push(PlaylistFileEntry {
+            line: index + 1,
+            raw: line.to_owned(),
+            segments: segments(line),
+            duration_secs,
+            title,
+        });
+    }
+    Ok(PlaylistFile {
+        name,
+        encoding,
+        entries,
+    })
+}
+
+/// The text, read by `waveflow_core::text_encoding`, and the encoding it was
+/// read as.
+///
+/// `.m3u8` is UTF-8 by definition and `.m3u` frequently is not, but the
+/// extension is a claim and the bytes are evidence, so the bytes decide. The
+/// core decoder is the one the desktop reads the same files with: a
+/// byte-order mark names the encoding, valid UTF-8 is UTF-8, and anything
+/// else has its encoding guessed. A fixed fallback, Windows-1252 as this was
+/// until the core had a decoder, read a CJK playlist into Latin nonsense and
+/// a UTF-16 one into NULs.
+fn decode(bytes: &[u8]) -> (String, TextEncoding) {
+    let text = waveflow_core::text_encoding::decode(bytes).into_owned();
+    (text, TextEncoding(encoding_read_as(bytes)))
+}
+
+/// The encoding `waveflow_core::text_encoding::decode` reads `bytes` as.
+///
+/// The core answers the text and not its encoding, so the encoding is worked
+/// out again here by the same steps in the same order, with the detector set
+/// up the same way. Duplicated rather than trusted: a core that changed its
+/// guess would have a report name one encoding while the text was read as
+/// another, which is what `the_encoding_named_is_the_one_the_core_read`
+/// catches on the next bump.
+fn encoding_read_as(bytes: &[u8]) -> &'static Encoding {
+    if let Some((encoding, _)) = Encoding::for_bom(bytes) {
+        return encoding;
+    }
+    if std::str::from_utf8(bytes).is_ok() {
+        return encoding_rs::UTF_8;
+    }
+    let mut detector = EncodingDetector::new(Iso2022JpDetection::Deny);
+    detector.feed(bytes, true);
+    detector.guess(None, Utf8Detection::Deny)
+}
+
+/// `#EXTINF:duration,display text`.
+///
+/// The duration is `-1` for a stream and may carry attributes after it in the
+/// HLS dialect; neither is this import's business, so anything that is not a
+/// positive integer becomes `None` rather than an error.
+fn parse_extinf(value: &str) -> (Option<i64>, Option<String>) {
+    let (duration, title) = match value.split_once(',') {
+        Some((duration, title)) => (duration.trim(), title.trim()),
+        None => (value.trim(), ""),
+    };
+    let duration = duration
+        .split_whitespace()
+        .next()
+        .and_then(|head| head.parse::<i64>().ok())
+        .filter(|seconds| *seconds > 0);
+    let title = (!title.is_empty()).then(|| title.to_owned());
+    (duration, title)
+}
+
+/// A target reduced to the segments a path comparison can use.
+///
+/// Four shapes arrive, and all four are the same shape underneath:
+/// `Artist/Album/01.flac`, `../Artist/Album/01.flac`,
+/// `/home/someone/Music/Artist/Album/01.flac` and
+/// `C:\Users\someone\Music\Artist\Album\01.flac`. What they share is the tail,
+/// so the leading part is simply kept as segments and the comparison takes the
+/// tail it needs. A `file://` URL is percent-decoded first; any other scheme
+/// yields nothing, because a playlist entry pointing at a web radio is not a
+/// track this catalogue holds.
+///
+/// The scheme is matched without regard to case, as RFC 3986 defines it: a
+/// player that writes `File://` names the same thing, and reading it as an
+/// unknown scheme would have reported the entry as naming no path at all.
+fn segments(target: &str) -> Vec<String> {
+    let path = match target.split_once("://") {
+        None => percent_decode(target),
+        Some((scheme, rest)) if scheme.eq_ignore_ascii_case("file") => {
+            // `file:///C:/x` and `file://host/x`: the authority is dropped
+            // either way, because neither names anything here.
+            let rest = rest.split_once('/').map_or("", |(_, tail)| tail);
+            percent_decode(rest)
+        }
+        Some(_) => return Vec::new(),
+    };
+    let mut out: Vec<String> = Vec::new();
+    for segment in path.split(['/', '\\']) {
+        match segment {
+            "" | "." => {}
+            ".." => {
+                out.pop();
+            }
+            other => out.push(other.to_owned()),
+        }
+    }
+    out
+}
+
+/// `%20` and friends, decoded leniently.
+///
+/// A lone `%` or a truncated escape is kept as written rather than dropped: it
+/// is almost certainly a literal percent in a file name, and an entry that
+/// fails to resolve is reported with its raw text, so guessing wrong here is
+/// visible rather than silent.
+fn percent_decode(value: &str) -> String {
+    percent_encoding::percent_decode_str(value)
+        .decode_utf8()
+        .map(|decoded| decoded.into_owned())
+        .unwrap_or_else(|_| value.to_owned())
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/src/library/playlist_file/tests.rs b/src/library/playlist_file/tests.rs
new file mode 100644
index 00000000..d612f1f8
--- /dev/null
+++ b/src/library/playlist_file/tests.rs
@@ -0,0 +1,247 @@
+use super::*;
+
+/// The parser with no ceiling: what these tests are about is the reading.
+fn parse(bytes: &[u8]) -> PlaylistFile {
+    super::parse(bytes, usize::MAX).expect("no ceiling to reach")
+}
+
+/// The ceiling is noticed at the first entry past it, and a file exactly
+/// at it is read (RFC-023 decision 5). Comments and directives are not
+/// entries and count for nothing.
+#[test]
+fn a_file_past_the_ceiling_is_refused_and_one_at_it_is_read() {
+    let at = "#EXTM3U\n#EXTINF:1,A - B\na.flac\nb.flac\nc.flac\n";
+    assert_eq!(super::parse(at.as_bytes(), 3).unwrap().entries.len(), 3);
+    let past = format!("{at}d.flac\n");
+    assert_eq!(super::parse(past.as_bytes(), 3).err(), Some(TooManyEntries));
+}
+
+fn targets(file: &PlaylistFile) -> Vec<String> {
+    file.entries
+        .iter()
+        .map(|entry| entry.segments.join("/"))
+        .collect()
+}
+
+#[test]
+fn a_plain_file_is_one_target_per_line() {
+    let file = parse(b"Artist/Album/01.flac\nArtist/Album/02.flac\n");
+    assert_eq!(file.encoding, TextEncoding::UTF_8);
+    assert_eq!(file.name, None);
+    assert_eq!(
+        targets(&file),
+        ["Artist/Album/01.flac", "Artist/Album/02.flac"]
+    );
+    assert_eq!(file.entries[1].line, 2);
+    assert!(file.entries.iter().all(|entry| entry.title.is_none()));
+}
+
+#[test]
+fn the_extended_dialect_attaches_its_metadata_to_the_next_target() {
+    let file = parse(
+        b"#EXTM3U\n#PLAYLIST:Evening\n#EXTINF:245,Harbour Bells - Lamp Hymn\nArtist/01.flac\n\
+              # a human comment\n#EXTINF:-1,A stream\nArtist/02.flac\n",
+    );
+    assert_eq!(file.name.as_deref(), Some("Evening"));
+    assert_eq!(targets(&file), ["Artist/01.flac", "Artist/02.flac"]);
+    assert_eq!(file.entries[0].duration_secs, Some(245));
+    assert_eq!(
+        file.entries[0].artist_and_title(),
+        Some(("Harbour Bells", "Lamp Hymn"))
+    );
+    // `-1` is a stream's duration, which is not a measurement.
+    assert_eq!(file.entries[1].duration_secs, None);
+    assert_eq!(file.entries[1].title.as_deref(), Some("A stream"));
+    assert_eq!(file.entries[1].artist_and_title(), None);
+}
+
+#[test]
+fn an_extinf_with_no_target_after_it_carries_nothing_forward() {
+    // The metadata belongs to a target. A file that ends on `#EXTINF`
+    // must not hand it to whatever the next import reads.
+    let file = parse(b"#EXTM3U\n#EXTINF:1,Orphan\n");
+    assert!(file.entries.is_empty());
+    let file = parse(b"#EXTM3U\n#EXTINF:1,Orphan\n\n#EXTINF:2,Owner - Song\nA/01.flac\n");
+    assert_eq!(file.entries.len(), 1);
+    assert_eq!(file.entries[0].title.as_deref(), Some("Owner - Song"));
+}
+
+#[test]
+fn windows_line_endings_and_a_bom_do_not_reach_the_path() {
+    let mut bytes = vec![0xEF, 0xBB, 0xBF];
+    bytes.extend_from_slice(b"#EXTM3U\r\nArtist/Album/01.flac\r\n");
+    let file = parse(&bytes);
+    assert_eq!(file.encoding, TextEncoding::UTF_8);
+    assert_eq!(targets(&file), ["Artist/Album/01.flac"]);
+}
+
+#[test]
+fn a_file_that_is_not_utf8_is_read_as_windows_1252() {
+    // "Bj<F6>rk/Vespertine/01.flac" — the byte a Windows player writes
+    // for ö, which is not valid UTF-8.
+    let mut bytes = b"Bj".to_vec();
+    bytes.push(0xF6);
+    bytes.extend_from_slice(b"rk/Vespertine/01.flac\n");
+    let file = parse(&bytes);
+    assert_eq!(file.encoding.name(), "windows-1252");
+    assert_eq!(targets(&file), ["Björk/Vespertine/01.flac"]);
+
+    // And the thirty-two code points that tell Windows-1252 from Latin-1:
+    // 0x92 is a right single quote in a title, not a control code.
+    let mut bytes = b"#EXTINF:1,L".to_vec();
+    bytes.push(0x92);
+    bytes.extend_from_slice(b"artiste - Song\nA/01.flac\n");
+    let file = parse(&bytes);
+    assert_eq!(
+        file.entries[0].title.as_deref(),
+        Some("L\u{2019}artiste - Song")
+    );
+}
+
+/// What Notepad saves as "Unicode", and what some players export: UTF-16
+/// little-endian behind its byte-order mark. Read as Windows-1252, every
+/// other character was a NUL and no path matched anything.
+#[test]
+fn a_utf16_file_is_read_by_its_byte_order_mark() {
+    let text = "#EXTM3U\r\n#EXTINF:245,Björk - Hidden Place\r\nBjörk/Vespertine/01.flac\r\n";
+    let mut bytes = vec![0xFF, 0xFE];
+    bytes.extend(text.encode_utf16().flat_map(u16::to_le_bytes));
+    let file = parse(&bytes);
+    assert_eq!(serde_json::to_value(file.encoding).unwrap(), "utf-16le");
+    assert_eq!(targets(&file), ["Björk/Vespertine/01.flac"]);
+    assert_eq!(
+        file.entries[0].artist_and_title(),
+        Some(("Björk", "Hidden Place"))
+    );
+}
+
+/// A playlist written on a Japanese Windows, in Shift_JIS. The Windows-1252
+/// fallback read it without failing, which was worse: every name came back
+/// as Latin nonsense that matched no path and no title.
+#[test]
+fn a_file_in_an_east_asian_code_page_is_read_in_it() {
+    let text = "#EXTM3U\r\n#PLAYLIST:夏の夜に聴きたい歌\r\n\
+                    #EXTINF:245,宇多田ヒカル - 花束を君に\r\n\
+                    宇多田ヒカル/ファントーム/01 花束を君に.flac\r\n\
+                    #EXTINF:301,椎名林檎 - 丸の内サディスティック\r\n\
+                    椎名林檎/無罪モラトリアム/03 丸の内サディスティック.flac\r\n";
+    let (bytes, _, unmappable) = encoding_rs::SHIFT_JIS.encode(text);
+    assert!(!unmappable, "Shift_JIS holds the sample");
+    assert!(std::str::from_utf8(&bytes).is_err());
+    let file = parse(&bytes);
+    assert_eq!(serde_json::to_value(file.encoding).unwrap(), "shift_jis");
+    assert_eq!(file.name.as_deref(), Some("夏の夜に聴きたい歌"));
+    assert_eq!(
+        targets(&file),
+        [
+            "宇多田ヒカル/ファントーム/01 花束を君に.flac",
+            "椎名林檎/無罪モラトリアム/03 丸の内サディスティック.flac",
+        ]
+    );
+    assert_eq!(
+        file.entries[1].artist_and_title(),
+        Some(("椎名林檎", "丸の内サディスティック"))
+    );
+}
+
+/// The report names the encoding the core read, not a second guess that
+/// happens to agree today: decoding each sample with the named encoding
+/// gives back the core's text exactly.
+#[test]
+fn the_encoding_named_is_the_one_the_core_read() {
+    let samples: [(&str, &'static Encoding); 6] = [
+        (
+            "#EXTINF:1,Björk - Cocoon\nBjörk/Vespertine/02.flac\n",
+            encoding_rs::WINDOWS_1252,
+        ),
+        (
+            "#EXTINF:1,宇多田ヒカル - 花束を君に\n宇多田ヒカル/01 花束を君に.flac\n",
+            encoding_rs::SHIFT_JIS,
+        ),
+        (
+            "#EXTINF:1,王菲 - 红豆\n王菲/唱游/03 红豆.flac\n",
+            encoding_rs::GB18030,
+        ),
+        (
+            "#EXTINF:1,周杰倫 - 晴天\n周杰倫/葉惠美/01 晴天.flac\n",
+            encoding_rs::BIG5,
+        ),
+        (
+            "#EXTINF:1,아이유 - 밤편지\n아이유/팔레트/01 밤편지.flac\n",
+            encoding_rs::EUC_KR,
+        ),
+        (
+            "#EXTINF:1,Björk - Cocoon\nBjörk/Vespertine/02.flac\n",
+            encoding_rs::UTF_8,
+        ),
+    ];
+    for (text, encoding) in samples {
+        let (bytes, _, unmappable) = encoding.encode(text);
+        assert!(!unmappable, "{} holds the sample", encoding.name());
+        let named = encoding_read_as(&bytes);
+        assert_eq!(
+            named.decode_without_bom_handling(&bytes).0,
+            waveflow_core::text_encoding::decode(&bytes),
+            "{} was named {}",
+            encoding.name(),
+            named.name()
+        );
+    }
+    let mut marked = vec![0xFE, 0xFF];
+    marked.extend("Björk/01.flac".encode_utf16().flat_map(u16::to_be_bytes));
+    assert_eq!(encoding_read_as(&marked), encoding_rs::UTF_16BE);
+}
+
+#[test]
+fn every_shape_of_target_reduces_to_the_same_segments() {
+    let expected = ["Artist", "Album", "01.flac"];
+    for target in [
+        "Artist/Album/01.flac",
+        "./Artist/Album/01.flac",
+        "../../Artist/Album/01.flac",
+        "/home/someone/Music/Artist/Album/01.flac",
+        "Artist\\Album\\01.flac",
+        "C:\\Users\\someone\\Music\\Artist\\Album\\01.flac",
+        "file:///home/someone/Music/Artist/Album/01.flac",
+        "file://server/Music/Artist/Album/01.flac",
+        // A scheme is case-insensitive, and a player that shouts it names
+        // the same file.
+        "File:///home/someone/Music/Artist/Album/01.flac",
+        "FILE://server/Music/Artist/Album/01.flac",
+        "Artist/Album/%30%31.flac",
+    ] {
+        let file = parse(target.as_bytes());
+        let entry = &file.entries[0];
+        let tail = entry.segments[entry.segments.len() - 3..].to_vec();
+        assert_eq!(tail, expected, "{target}");
+        assert_eq!(entry.raw, target, "the report quotes what was written");
+    }
+}
+
+#[test]
+fn a_remote_url_names_no_path_at_all() {
+    // Deliberately not a failed path match: a web radio is not a track
+    // this catalogue could hold, and the ladder has nothing to climb.
+    // And the case-insensitive scheme match does not widen to another
+    // scheme that merely looks like one.
+    for target in [
+        "http://radio.example/stream",
+        "https://radio.example/s.mp3",
+        "HTTP://radio.example/stream",
+        "filesystem://radio.example/s.mp3",
+    ] {
+        let file = parse(target.as_bytes());
+        assert!(file.entries[0].segments.is_empty(), "{target}");
+    }
+}
+
+#[test]
+fn a_hyphen_without_spaces_belongs_to_the_name() {
+    let file = parse(b"#EXTINF:1,Jean-Michel Jarre\nA/01.flac\n");
+    assert_eq!(file.entries[0].artist_and_title(), None);
+    let file = parse(b"#EXTINF:1,Jean-Michel Jarre - Oxygene-4\nA/01.flac\n");
+    assert_eq!(
+        file.entries[0].artist_and_title(),
+        Some(("Jean-Michel Jarre", "Oxygene-4"))
+    );
+}
diff --git a/src/scanner/discovery/mod.rs b/src/library/scanner/discovery/mod.rs
similarity index 98%
rename from src/scanner/discovery/mod.rs
rename to src/library/scanner/discovery/mod.rs
index aab1bc6a..882393d9 100644
--- a/src/scanner/discovery/mod.rs
+++ b/src/library/scanner/discovery/mod.rs
@@ -175,7 +175,7 @@ impl Reach<'_> {
     /// Whether a followed link may lead to `target`, a canonical path.
     fn admits_target(&self, target: &Path) -> bool {
         target.starts_with(self.root)
-            || crate::link_roots::admits(self.link_roots, self.libraries, target)
+            || crate::library::link_roots::admits(self.link_roots, self.libraries, target)
     }
 
     /// What the walk reached at `path`: the canonical path to read it from,
@@ -196,7 +196,7 @@ impl Reach<'_> {
             let name = relative_to(self.root, &canonical);
             return Some((canonical, name));
         }
-        (crate::link_roots::admits(self.link_roots, self.libraries, &canonical)
+        (crate::library::link_roots::admits(self.link_roots, self.libraries, &canonical)
             && path.starts_with(self.root))
         .then(|| (canonical, relative_to(self.root, path)))
     }
@@ -654,10 +654,10 @@ impl Walked<'_> {
 /// a relocation is only recorded when exactly one thing did, because moving a
 /// favourite onto the wrong row is worse than not moving it at all.
 pub(super) fn unclaimed(
-    candidates: Vec<crate::catalog::ExistingTrack>,
+    candidates: Vec<crate::storage::catalog::ExistingTrack>,
     walked: &Walked<'_>,
     claimed: &HashSet<Uuid>,
-) -> Vec<crate::catalog::ExistingTrack> {
+) -> Vec<crate::storage::catalog::ExistingTrack> {
     candidates
         .into_iter()
         .filter(|candidate| {
diff --git a/src/scanner/discovery/tests.rs b/src/library/scanner/discovery/tests.rs
similarity index 100%
rename from src/scanner/discovery/tests.rs
rename to src/library/scanner/discovery/tests.rs
diff --git a/src/scanner/extract/mod.rs b/src/library/scanner/extract/mod.rs
similarity index 97%
rename from src/scanner/extract/mod.rs
rename to src/library/scanner/extract/mod.rs
index d25b7ec9..e49f102d 100644
--- a/src/scanner/extract/mod.rs
+++ b/src/library/scanner/extract/mod.rs
@@ -10,8 +10,8 @@ use lofty::{
 use uuid::Uuid;
 
 use crate::{
-    catalog::{ArtworkInput, CatalogTrackInput},
-    lyrics::{self, LyricsInput},
+    library::lyrics::{self, LyricsInput},
+    storage::catalog::{ArtworkInput, CatalogTrackInput},
 };
 
 #[cfg(test)]
@@ -38,7 +38,7 @@ pub(super) enum Scanned {
 pub(super) fn scan_file(
     path: &Path,
     artwork_dir: &Path,
-    known: Option<crate::catalog::SkipFacts>,
+    known: Option<crate::storage::catalog::SkipFacts>,
     full: bool,
 ) -> Scanned {
     let signature = sidecar_signature(path);
@@ -393,11 +393,11 @@ struct ExtendedTags {
 /// `PERFORMER` is the one role whose credit carries a second value. ID3 stores
 /// it as a musician-credits frame lofty exposes only through its own tag type,
 /// so what reaches here is the generic spelling — `Name (instrument)` — which
-/// [`crate::tags::split_performer`] takes apart.
-fn raw_credits(tag: Option<&lofty::tag::Tag>) -> crate::tags::RawCredits {
-    use crate::tags::Role;
+/// [`crate::library::tags::split_performer`] takes apart.
+fn raw_credits(tag: Option<&lofty::tag::Tag>) -> crate::library::tags::RawCredits {
+    use crate::library::tags::Role;
     let Some(tag) = tag else {
-        return crate::tags::RawCredits::default();
+        return crate::library::tags::RawCredits::default();
     };
     let values = |key: ItemKey| -> Vec<String> {
         tag.get_strings(key)
@@ -438,10 +438,10 @@ fn raw_credits(tag: Option<&lofty::tag::Tag>) -> crate::tags::RawCredits {
 
     let performer_pairs = values(ItemKey::Performer)
         .into_iter()
-        .map(|value| crate::tags::split_performer(&value))
+        .map(|value| crate::library::tags::split_performer(&value))
         .collect();
 
-    crate::tags::RawCredits {
+    crate::library::tags::RawCredits {
         artist: values(ItemKey::TrackArtist),
         artists: values(ItemKey::TrackArtists),
         album_artist: values(ItemKey::AlbumArtist),
diff --git a/src/scanner/extract/tests.rs b/src/library/scanner/extract/tests.rs
similarity index 100%
rename from src/scanner/extract/tests.rs
rename to src/library/scanner/extract/tests.rs
diff --git a/src/scanner/job.rs b/src/library/scanner/job.rs
similarity index 98%
rename from src/scanner/job.rs
rename to src/library/scanner/job.rs
index 1921c534..4db5fa94 100644
--- a/src/scanner/job.rs
+++ b/src/library/scanner/job.rs
@@ -9,7 +9,7 @@ use uuid::Uuid;
 use super::discovery::{discover_audio, unclaimed, Discovery, Reach, Walked};
 use super::extract::{scan_file, Scanned};
 use super::{normalised_scope, ScanManager, ScanProgress};
-use crate::catalog::{ApplyOutcome, CatalogApply, LibraryRecord};
+use crate::storage::catalog::{ApplyOutcome, CatalogApply, LibraryRecord};
 
 impl ScanManager {
     pub(super) async fn run(&self, scan_id: Uuid, library: LibraryRecord) -> anyhow::Result<()> {
@@ -227,7 +227,7 @@ impl ScanManager {
                                 if existing.pid.is_none() {
                                     hints.push((
                                         existing.id,
-                                        crate::catalog::track_pid(
+                                        crate::storage::catalog::track_pid(
                                             self.db.pid(),
                                             library.id,
                                             &input,
@@ -263,7 +263,7 @@ impl ScanManager {
                                     self.db
                                         .relocation_candidates_by_pid(
                                             library.id,
-                                            crate::catalog::track_pid(
+                                            crate::storage::catalog::track_pid(
                                                 self.db.pid(),
                                                 library.id,
                                                 &input,
diff --git a/src/scanner/mod.rs b/src/library/scanner/mod.rs
similarity index 97%
rename from src/scanner/mod.rs
rename to src/library/scanner/mod.rs
index e5a7fb5a..b212b6ba 100644
--- a/src/scanner/mod.rs
+++ b/src/library/scanner/mod.rs
@@ -15,8 +15,8 @@ use tokio::sync::{broadcast, watch, Mutex};
 use uuid::Uuid;
 
 use crate::{
-    catalog::{CatalogTrackInput, LibraryRecord, ScanJobRecord},
-    database::Database,
+    storage::catalog::{CatalogTrackInput, LibraryRecord, ScanJobRecord},
+    storage::database::Database,
 };
 
 /// One reading of a scan in flight, as it travels between the scanning task and
@@ -94,7 +94,7 @@ pub struct ScanManager {
     libraries: Arc<watch::Sender<u64>>,
     /// The folders outside every library a followed link may reach into
     /// (`WAVEFLOW_LINK_ROOTS`).
-    link_roots: crate::link_roots::LinkRoots,
+    link_roots: crate::library::link_roots::LinkRoots,
 }
 
 /// One scan counted as running, for as long as this lives.
@@ -150,13 +150,13 @@ impl ScanManager {
             in_flight: Arc::new(watch::Sender::new(0)),
             scanning: Arc::new(DashMap::new()),
             libraries: Arc::new(watch::Sender::new(0)),
-            link_roots: crate::link_roots::LinkRoots::default(),
+            link_roots: crate::library::link_roots::LinkRoots::default(),
         }
     }
 
     /// The folders outside every library that a library following links may
     /// reach into.
-    pub fn with_link_roots(mut self, link_roots: crate::link_roots::LinkRoots) -> Self {
+    pub fn with_link_roots(mut self, link_roots: crate::library::link_roots::LinkRoots) -> Self {
         self.link_roots = link_roots;
         self
     }
diff --git a/src/tags.rs b/src/library/tags/mod.rs
similarity index 63%
rename from src/tags.rs
rename to src/library/tags/mod.rs
index f2e94f2f..2f882199 100644
--- a/src/tags.rs
+++ b/src/library/tags/mod.rs
@@ -397,250 +397,4 @@ fn paired_sorts(names: &[String], raw: Option<&str>, separators: &[&str]) -> Vec
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn names_of(credits: &[Credit], role: Role) -> Vec<&str> {
-        credits
-            .iter()
-            .filter(|credit| credit.role == role)
-            .map(|credit| credit.name.as_str())
-            .collect()
-    }
-
-    /// The separator set is padded so a slash inside a name survives it.
-    #[test]
-    fn a_slash_inside_a_name_is_not_a_separator() {
-        let raw = RawCredits {
-            artist: vec!["AC/DC".into()],
-            ..RawCredits::default()
-        };
-        assert_eq!(names_of(&credits(&raw), Role::Artist), vec!["AC/DC"]);
-
-        let joined = RawCredits {
-            artist: vec!["Nova Kern / Lior Sand".into()],
-            ..RawCredits::default()
-        };
-        assert_eq!(
-            names_of(&credits(&joined), Role::Artist),
-            vec!["Nova Kern", "Lior Sand"]
-        );
-    }
-
-    /// A separator inside parentheses qualifies one credit; it does not divide
-    /// two. The real tag that exposed this named two people and produced three
-    /// entities, each carrying a parenthesis it never opened.
-    #[test]
-    fn a_role_separator_inside_parentheses_does_not_cut() {
-        let raw = RawCredits {
-            artist: vec!["ITZY".into()],
-            roles: vec![(
-                Role::Composer,
-                vec!["Kobee (Melange / INHOUSE), Holy M (Melange / INHOUSE)".into()],
-            )],
-            ..RawCredits::default()
-        };
-        assert_eq!(
-            names_of(&credits(&raw), Role::Composer),
-            vec!["Kobee (Melange / INHOUSE), Holy M (Melange / INHOUSE)"]
-        );
-    }
-
-    /// The parenthesis rule must not cost the cut it was added beside: a
-    /// separator outside one still divides, in the same value.
-    #[test]
-    fn a_role_separator_outside_parentheses_still_cuts() {
-        let raw = RawCredits {
-            artist: vec!["Nobody".into()],
-            roles: vec![(
-                Role::Composer,
-                vec!["Bach (arr. Gounod)/Liszt (after Bach)".into()],
-            )],
-            ..RawCredits::default()
-        };
-        assert_eq!(
-            names_of(&credits(&raw), Role::Composer),
-            vec!["Bach (arr. Gounod)", "Liszt (after Bach)"]
-        );
-    }
-
-    /// A tag whose parentheses never balance must not swallow the whole value
-    /// or hang the scan. The opening one protects only the tail it opened.
-    #[test]
-    fn an_unbalanced_parenthesis_protects_only_its_tail() {
-        let unclosed = RawCredits {
-            artist: vec!["Nobody".into()],
-            roles: vec![(
-                Role::Composer,
-                vec!["Bach/Gounod (Melange / INHOUSE".into()],
-            )],
-            ..RawCredits::default()
-        };
-        assert_eq!(
-            names_of(&credits(&unclosed), Role::Composer),
-            vec!["Bach", "Gounod (Melange / INHOUSE"]
-        );
-
-        // A stray closing parenthesis must not make the rest uncuttable.
-        let stray = RawCredits {
-            artist: vec!["Nobody".into()],
-            roles: vec![(Role::Composer, vec!["INHOUSE)/Bach".into()])],
-            ..RawCredits::default()
-        };
-        assert_eq!(
-            names_of(&credits(&stray), Role::Composer),
-            vec!["INHOUSE)", "Bach"]
-        );
-    }
-
-    /// A role tag is cut on the bare separators, where an artist tag is not.
-    #[test]
-    fn a_role_tag_is_cut_where_an_artist_tag_would_not_be() {
-        let raw = RawCredits {
-            artist: vec!["Nobody".into()],
-            roles: vec![(Role::Composer, vec!["Bach/Gounod".into()])],
-            ..RawCredits::default()
-        };
-        assert_eq!(
-            names_of(&credits(&raw), Role::Composer),
-            vec!["Bach", "Gounod"]
-        );
-    }
-
-    #[test]
-    fn the_plural_tag_wins_and_is_never_cut() {
-        let raw = RawCredits {
-            artist: vec!["Ignored; Entirely".into()],
-            artists: vec!["Nova Kern; Lior Sand".into()],
-            ..RawCredits::default()
-        };
-        assert_eq!(
-            names_of(&credits(&raw), Role::Artist),
-            vec!["Nova Kern; Lior Sand"],
-            "a tagger writing the plural tag has already said where the boundaries are"
-        );
-    }
-
-    #[test]
-    fn a_singular_tag_holding_two_frames_is_not_cut_either() {
-        let raw = RawCredits {
-            artist: vec!["Nova Kern; A".into(), "Lior Sand".into()],
-            ..RawCredits::default()
-        };
-        assert_eq!(
-            names_of(&credits(&raw), Role::Artist),
-            vec!["Nova Kern; A", "Lior Sand"]
-        );
-    }
-
-    #[test]
-    fn a_performer_carries_the_instrument_it_is_credited_on() {
-        assert_eq!(
-            split_performer("Jimmy Page (guitar)"),
-            ("Guitar".to_owned(), "Jimmy Page".to_owned())
-        );
-        assert_eq!(
-            split_performer("Salaam Remi (drums (drum set) and organ)"),
-            (
-                "Drums (Drum Set) And Organ".to_owned(),
-                "Salaam Remi".to_owned()
-            )
-        );
-        assert_eq!(
-            split_performer("Nobody In Particular"),
-            (String::new(), "Nobody In Particular".to_owned())
-        );
-    }
-
-    #[test]
-    fn a_performer_pair_names_every_player_of_its_instrument() {
-        let raw = RawCredits {
-            artist: vec!["Nobody".into()],
-            performer_pairs: vec![("guitar".into(), "Jimmy Page; Nova Kern".into())],
-            ..RawCredits::default()
-        };
-        let credits = credits(&raw);
-        let performers: Vec<(&str, &str)> = credits
-            .iter()
-            .filter(|credit| credit.role == Role::Performer)
-            .map(|credit| (credit.sub_role.as_str(), credit.name.as_str()))
-            .collect();
-        assert_eq!(
-            performers,
-            vec![("Guitar", "Jimmy Page"), ("Guitar", "Nova Kern")]
-        );
-    }
-
-    /// An album has to hang off somebody, and which somebody depends on
-    /// whether the file calls itself a compilation.
-    #[test]
-    fn a_file_naming_no_album_artist_still_has_one() {
-        let plain = RawCredits {
-            artist: vec!["Nova Kern".into()],
-            ..RawCredits::default()
-        };
-        assert_eq!(
-            names_of(&credits(&plain), Role::AlbumArtist),
-            vec!["Nova Kern"]
-        );
-
-        let compilation = RawCredits {
-            artist: vec!["Nova Kern".into()],
-            is_compilation: true,
-            ..RawCredits::default()
-        };
-        assert_eq!(
-            names_of(&credits(&compilation), Role::AlbumArtist),
-            vec![VARIOUS_ARTISTS]
-        );
-    }
-
-    #[test]
-    fn a_sort_tag_is_paired_position_by_position_or_not_at_all() {
-        let paired = RawCredits {
-            artist: vec!["The Nocturnes; Nova Kern".into()],
-            sort_artist: Some("Nocturnes, The; Kern, Nova".into()),
-            ..RawCredits::default()
-        };
-        let paired_credits = credits(&paired);
-        let sorts: Vec<Option<&str>> = paired_credits
-            .iter()
-            .filter(|credit| credit.role == Role::Artist)
-            .map(|credit| credit.sort_name.as_deref())
-            .collect();
-        assert_eq!(sorts, vec![Some("Nocturnes, The"), Some("Kern, Nova")]);
-
-        // Lengths that disagree mean the tagger did not pair them, and filing
-        // one artist under another's sort form is worse than filing none.
-        let mismatched = RawCredits {
-            artist: vec!["The Nocturnes; Nova Kern".into()],
-            sort_artist: Some("Nocturnes, The".into()),
-            ..RawCredits::default()
-        };
-        let unpaired = credits(&mismatched);
-        assert!(unpaired
-            .iter()
-            .filter(|credit| credit.role == Role::Artist)
-            .all(|credit| credit.sort_name.is_none()));
-    }
-
-    #[test]
-    fn positions_are_per_role_and_follow_tag_order() {
-        let raw = RawCredits {
-            artist: vec!["A; B".into()],
-            roles: vec![(Role::Producer, vec!["P1; P2".into()])],
-            ..RawCredits::default()
-        };
-        let credits = credits(&raw);
-        let at = |role: Role, position: usize| {
-            credits
-                .iter()
-                .find(|credit| credit.role == role && credit.position == position)
-                .map(|credit| credit.name.as_str())
-        };
-        assert_eq!(at(Role::Artist, 0), Some("A"));
-        assert_eq!(at(Role::Artist, 1), Some("B"));
-        assert_eq!(at(Role::Producer, 0), Some("P1"));
-        assert_eq!(at(Role::Producer, 1), Some("P2"));
-    }
-}
+mod tests;
diff --git a/src/library/tags/tests.rs b/src/library/tags/tests.rs
new file mode 100644
index 00000000..43798c5a
--- /dev/null
+++ b/src/library/tags/tests.rs
@@ -0,0 +1,245 @@
+use super::*;
+
+fn names_of(credits: &[Credit], role: Role) -> Vec<&str> {
+    credits
+        .iter()
+        .filter(|credit| credit.role == role)
+        .map(|credit| credit.name.as_str())
+        .collect()
+}
+
+/// The separator set is padded so a slash inside a name survives it.
+#[test]
+fn a_slash_inside_a_name_is_not_a_separator() {
+    let raw = RawCredits {
+        artist: vec!["AC/DC".into()],
+        ..RawCredits::default()
+    };
+    assert_eq!(names_of(&credits(&raw), Role::Artist), vec!["AC/DC"]);
+
+    let joined = RawCredits {
+        artist: vec!["Nova Kern / Lior Sand".into()],
+        ..RawCredits::default()
+    };
+    assert_eq!(
+        names_of(&credits(&joined), Role::Artist),
+        vec!["Nova Kern", "Lior Sand"]
+    );
+}
+
+/// A separator inside parentheses qualifies one credit; it does not divide
+/// two. The real tag that exposed this named two people and produced three
+/// entities, each carrying a parenthesis it never opened.
+#[test]
+fn a_role_separator_inside_parentheses_does_not_cut() {
+    let raw = RawCredits {
+        artist: vec!["ITZY".into()],
+        roles: vec![(
+            Role::Composer,
+            vec!["Kobee (Melange / INHOUSE), Holy M (Melange / INHOUSE)".into()],
+        )],
+        ..RawCredits::default()
+    };
+    assert_eq!(
+        names_of(&credits(&raw), Role::Composer),
+        vec!["Kobee (Melange / INHOUSE), Holy M (Melange / INHOUSE)"]
+    );
+}
+
+/// The parenthesis rule must not cost the cut it was added beside: a
+/// separator outside one still divides, in the same value.
+#[test]
+fn a_role_separator_outside_parentheses_still_cuts() {
+    let raw = RawCredits {
+        artist: vec!["Nobody".into()],
+        roles: vec![(
+            Role::Composer,
+            vec!["Bach (arr. Gounod)/Liszt (after Bach)".into()],
+        )],
+        ..RawCredits::default()
+    };
+    assert_eq!(
+        names_of(&credits(&raw), Role::Composer),
+        vec!["Bach (arr. Gounod)", "Liszt (after Bach)"]
+    );
+}
+
+/// A tag whose parentheses never balance must not swallow the whole value
+/// or hang the scan. The opening one protects only the tail it opened.
+#[test]
+fn an_unbalanced_parenthesis_protects_only_its_tail() {
+    let unclosed = RawCredits {
+        artist: vec!["Nobody".into()],
+        roles: vec![(
+            Role::Composer,
+            vec!["Bach/Gounod (Melange / INHOUSE".into()],
+        )],
+        ..RawCredits::default()
+    };
+    assert_eq!(
+        names_of(&credits(&unclosed), Role::Composer),
+        vec!["Bach", "Gounod (Melange / INHOUSE"]
+    );
+
+    // A stray closing parenthesis must not make the rest uncuttable.
+    let stray = RawCredits {
+        artist: vec!["Nobody".into()],
+        roles: vec![(Role::Composer, vec!["INHOUSE)/Bach".into()])],
+        ..RawCredits::default()
+    };
+    assert_eq!(
+        names_of(&credits(&stray), Role::Composer),
+        vec!["INHOUSE)", "Bach"]
+    );
+}
+
+/// A role tag is cut on the bare separators, where an artist tag is not.
+#[test]
+fn a_role_tag_is_cut_where_an_artist_tag_would_not_be() {
+    let raw = RawCredits {
+        artist: vec!["Nobody".into()],
+        roles: vec![(Role::Composer, vec!["Bach/Gounod".into()])],
+        ..RawCredits::default()
+    };
+    assert_eq!(
+        names_of(&credits(&raw), Role::Composer),
+        vec!["Bach", "Gounod"]
+    );
+}
+
+#[test]
+fn the_plural_tag_wins_and_is_never_cut() {
+    let raw = RawCredits {
+        artist: vec!["Ignored; Entirely".into()],
+        artists: vec!["Nova Kern; Lior Sand".into()],
+        ..RawCredits::default()
+    };
+    assert_eq!(
+        names_of(&credits(&raw), Role::Artist),
+        vec!["Nova Kern; Lior Sand"],
+        "a tagger writing the plural tag has already said where the boundaries are"
+    );
+}
+
+#[test]
+fn a_singular_tag_holding_two_frames_is_not_cut_either() {
+    let raw = RawCredits {
+        artist: vec!["Nova Kern; A".into(), "Lior Sand".into()],
+        ..RawCredits::default()
+    };
+    assert_eq!(
+        names_of(&credits(&raw), Role::Artist),
+        vec!["Nova Kern; A", "Lior Sand"]
+    );
+}
+
+#[test]
+fn a_performer_carries_the_instrument_it_is_credited_on() {
+    assert_eq!(
+        split_performer("Jimmy Page (guitar)"),
+        ("Guitar".to_owned(), "Jimmy Page".to_owned())
+    );
+    assert_eq!(
+        split_performer("Salaam Remi (drums (drum set) and organ)"),
+        (
+            "Drums (Drum Set) And Organ".to_owned(),
+            "Salaam Remi".to_owned()
+        )
+    );
+    assert_eq!(
+        split_performer("Nobody In Particular"),
+        (String::new(), "Nobody In Particular".to_owned())
+    );
+}
+
+#[test]
+fn a_performer_pair_names_every_player_of_its_instrument() {
+    let raw = RawCredits {
+        artist: vec!["Nobody".into()],
+        performer_pairs: vec![("guitar".into(), "Jimmy Page; Nova Kern".into())],
+        ..RawCredits::default()
+    };
+    let credits = credits(&raw);
+    let performers: Vec<(&str, &str)> = credits
+        .iter()
+        .filter(|credit| credit.role == Role::Performer)
+        .map(|credit| (credit.sub_role.as_str(), credit.name.as_str()))
+        .collect();
+    assert_eq!(
+        performers,
+        vec![("Guitar", "Jimmy Page"), ("Guitar", "Nova Kern")]
+    );
+}
+
+/// An album has to hang off somebody, and which somebody depends on
+/// whether the file calls itself a compilation.
+#[test]
+fn a_file_naming_no_album_artist_still_has_one() {
+    let plain = RawCredits {
+        artist: vec!["Nova Kern".into()],
+        ..RawCredits::default()
+    };
+    assert_eq!(
+        names_of(&credits(&plain), Role::AlbumArtist),
+        vec!["Nova Kern"]
+    );
+
+    let compilation = RawCredits {
+        artist: vec!["Nova Kern".into()],
+        is_compilation: true,
+        ..RawCredits::default()
+    };
+    assert_eq!(
+        names_of(&credits(&compilation), Role::AlbumArtist),
+        vec![VARIOUS_ARTISTS]
+    );
+}
+
+#[test]
+fn a_sort_tag_is_paired_position_by_position_or_not_at_all() {
+    let paired = RawCredits {
+        artist: vec!["The Nocturnes; Nova Kern".into()],
+        sort_artist: Some("Nocturnes, The; Kern, Nova".into()),
+        ..RawCredits::default()
+    };
+    let paired_credits = credits(&paired);
+    let sorts: Vec<Option<&str>> = paired_credits
+        .iter()
+        .filter(|credit| credit.role == Role::Artist)
+        .map(|credit| credit.sort_name.as_deref())
+        .collect();
+    assert_eq!(sorts, vec![Some("Nocturnes, The"), Some("Kern, Nova")]);
+
+    // Lengths that disagree mean the tagger did not pair them, and filing
+    // one artist under another's sort form is worse than filing none.
+    let mismatched = RawCredits {
+        artist: vec!["The Nocturnes; Nova Kern".into()],
+        sort_artist: Some("Nocturnes, The".into()),
+        ..RawCredits::default()
+    };
+    let unpaired = credits(&mismatched);
+    assert!(unpaired
+        .iter()
+        .filter(|credit| credit.role == Role::Artist)
+        .all(|credit| credit.sort_name.is_none()));
+}
+
+#[test]
+fn positions_are_per_role_and_follow_tag_order() {
+    let raw = RawCredits {
+        artist: vec!["A; B".into()],
+        roles: vec![(Role::Producer, vec!["P1; P2".into()])],
+        ..RawCredits::default()
+    };
+    let credits = credits(&raw);
+    let at = |role: Role, position: usize| {
+        credits
+            .iter()
+            .find(|credit| credit.role == role && credit.position == position)
+            .map(|credit| credit.name.as_str())
+    };
+    assert_eq!(at(Role::Artist, 0), Some("A"));
+    assert_eq!(at(Role::Artist, 1), Some("B"));
+    assert_eq!(at(Role::Producer, 0), Some("P1"));
+    assert_eq!(at(Role::Producer, 1), Some("P2"));
+}
diff --git a/src/watcher/mod.rs b/src/library/watcher/mod.rs
similarity index 98%
rename from src/watcher/mod.rs
rename to src/library/watcher/mod.rs
index 61c65aac..e65a760f 100644
--- a/src/watcher/mod.rs
+++ b/src/library/watcher/mod.rs
@@ -27,7 +27,9 @@ use notify::{
 use tokio::{sync::mpsc, time::Instant};
 use uuid::Uuid;
 
-use crate::{catalog::LibraryRecord, database::Database, scanner::ScanManager};
+use crate::{
+    library::scanner::ScanManager, storage::catalog::LibraryRecord, storage::database::Database,
+};
 
 /// How often the watched set is re-read even when nothing in this process said
 /// it changed: the CLI adds and removes libraries from another process.
@@ -89,7 +91,7 @@ impl Settle {
     /// The scan this settles into walks those folders only, which is what
     /// RFC-018's rules allow a scan that did not look everywhere: only what it
     /// walked may be marked missing, and relocation claims nothing outside it.
-    /// Past [`crate::scanner::MAX_SCOPE_FOLDERS`] folders the changes were
+    /// Past [`crate::library::scanner::MAX_SCOPE_FOLDERS`] folders the changes were
     /// everywhere, and the whole library is walked instead.
     pub fn touch_folder(&mut self, library_id: Uuid, folder: String, now: Instant) {
         let pending = self.pending.entry(library_id).or_insert(Pending {
@@ -100,7 +102,7 @@ impl Settle {
         pending.last = now;
         if let Some(folders) = pending.folders.as_mut() {
             folders.insert(folder);
-            if folders.len() > crate::scanner::MAX_SCOPE_FOLDERS {
+            if folders.len() > crate::library::scanner::MAX_SCOPE_FOLDERS {
                 pending.folders = None;
             }
         }
diff --git a/src/watcher/tests.rs b/src/library/watcher/tests.rs
similarity index 99%
rename from src/watcher/tests.rs
rename to src/library/watcher/tests.rs
index 817fdefc..85d0366f 100644
--- a/src/watcher/tests.rs
+++ b/src/library/watcher/tests.rs
@@ -203,7 +203,7 @@ fn a_settled_library_names_the_folders_its_changes_were_in() {
     settle.touch_folder(whole, "Rock".into(), start);
     settle.touch(whole, start);
     settle.touch_folder(whole, "Jazz".into(), start);
-    for index in 0..=crate::scanner::MAX_SCOPE_FOLDERS {
+    for index in 0..=crate::library::scanner::MAX_SCOPE_FOLDERS {
         settle.touch_folder(crowded, format!("f{index}"), start);
     }
     let mut due = settle.due_with_scope(start + delay, |_| false);
diff --git a/src/main.rs b/src/main.rs
index 3b39bf02..204db17d 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -56,11 +56,11 @@ async fn serve(config: Config, state: waveflow_server::AppState) -> anyhow::Resu
     // output is not the place for it. Where to find the token, never the token
     // (RFC-019 decision 1).
     match state.setup.source() {
-        Some(waveflow_server::setup_token::TokenSource::File(path)) => tracing::warn!(
+        Some(waveflow_server::auth::setup_token::TokenSource::File(path)) => tracing::warn!(
             path = %path.display(),
             "no account exists yet: the first administrator is created with the setup token stored in this file"
         ),
-        Some(waveflow_server::setup_token::TokenSource::Operator) => tracing::warn!(
+        Some(waveflow_server::auth::setup_token::TokenSource::Operator) => tracing::warn!(
             "no account exists yet: the first administrator is created with the value of WAVEFLOW_SETUP_TOKEN"
         ),
         None => {}
@@ -68,7 +68,7 @@ async fn serve(config: Config, state: waveflow_server::AppState) -> anyhow::Resu
     state.scanner.spawn_background(config.scan_interval);
     // A change scanned once it settles, on top of the interval (RFC-021).
     if config.watch {
-        waveflow_server::watcher::spawn(
+        waveflow_server::library::watcher::spawn(
             state.scanner.clone(),
             state.db.clone(),
             config.watch_delay,
diff --git a/src/media/canvas.rs b/src/media/canvas.rs
index 64358ebe..72a88762 100644
--- a/src/media/canvas.rs
+++ b/src/media/canvas.rs
@@ -232,14 +232,14 @@ pub async fn create_canvas_ticket(
         .ok_or(MediaError::NotFound)?;
     let expires_at = i64::try_from(state.stream_ticket_ttl.as_millis())
         .ok()
-        .and_then(|ttl| crate::authentication::now_ms().checked_add(ttl))
+        .and_then(|ttl| crate::auth::authentication::now_ms().checked_add(ttl))
         .ok_or_else(|| {
             tracing::error!("stream ticket TTL does not fit in an epoch timestamp");
             MediaError::Internal
         })?;
-    let ticket = crate::stream_ticket::mint(
+    let ticket = crate::auth::stream_ticket::mint(
         &state.secret_box,
-        crate::stream_ticket::TicketKind::Canvas,
+        crate::auth::stream_ticket::TicketKind::Canvas,
         user.id,
         track_id,
         expires_at,
@@ -276,10 +276,13 @@ pub async fn canvas_with_ticket(
     // This route serves a canvas, and it says so. Without the assertion an
     // audio ticket would open a canvas and the reverse — which is the whole
     // reason the kind is inside the sealed payload.
-    let (_, user_id, track_id) =
-        crate::stream_ticket::verify(&state.secret_box, &ticket, crate::authentication::now_ms())
-            .filter(|(kind, ..)| *kind == crate::stream_ticket::TicketKind::Canvas)
-            .ok_or(MediaError::NotFound)?;
+    let (_, user_id, track_id) = crate::auth::stream_ticket::verify(
+        &state.secret_box,
+        &ticket,
+        crate::auth::authentication::now_ms(),
+    )
+    .filter(|(kind, ..)| *kind == crate::auth::stream_ticket::TicketKind::Canvas)
+    .ok_or(MediaError::NotFound)?;
     // Re-checked on every redemption, so a ticket cannot outlive the membership
     // that justified it.
     let blob = state
diff --git a/src/media/mod.rs b/src/media/mod.rs
index db6ce7f5..07f21fae 100644
--- a/src/media/mod.rs
+++ b/src/media/mod.rs
@@ -2,6 +2,7 @@
 
 mod artwork;
 mod canvas;
+pub mod replay_gain;
 mod stream;
 #[cfg(test)]
 pub(crate) mod tests;
@@ -45,7 +46,7 @@ use tokio::{
 };
 use uuid::Uuid;
 
-use crate::{config::Config, replay_gain::ReplayGainMode, AppState};
+use crate::{config::Config, media::replay_gain::ReplayGainMode, AppState};
 
 /// Audio is tenant-scoped and reached through a bearer token or a stream
 /// ticket, so the same URL means different things to different callers. No
@@ -109,7 +110,7 @@ struct MediaInner {
     ffmpeg_digest: String,
     /// The folders outside every library a stored path may lead into through
     /// a link (`WAVEFLOW_LINK_ROOTS`).
-    link_roots: crate::link_roots::LinkRoots,
+    link_roots: crate::library::link_roots::LinkRoots,
     /// What a Subsonic transcode applies of ReplayGain unless the request
     /// says otherwise (`WAVEFLOW_SUBSONIC_REPLAYGAIN`).
     subsonic_replay_gain: ReplayGainMode,
@@ -196,7 +197,7 @@ impl MediaService {
                 cache_locks: DashMap::new(),
                 cache_access: DashMap::new(),
                 pending_fills: DashSet::new(),
-                link_roots: crate::link_roots::LinkRoots::new(config.link_roots.clone()),
+                link_roots: crate::library::link_roots::LinkRoots::new(config.link_roots.clone()),
                 subsonic_replay_gain: config.subsonic_replay_gain,
                 active_transcodes: AtomicUsize::new(0),
                 transcoding_available: true,
@@ -372,7 +373,7 @@ pub fn router(state: AppState) -> Router {
 async fn bearer_principal(
     state: &AppState,
     headers: &HeaderMap,
-) -> Result<crate::authentication::AuthUser, MediaError> {
+) -> Result<crate::auth::authentication::AuthUser, MediaError> {
     crate::api::authenticated(state, headers, crate::api::Access::Read)
         .await
         .map_err(|_| MediaError::Unauthorized)
diff --git a/src/replay_gain.rs b/src/media/replay_gain/mod.rs
similarity index 57%
rename from src/replay_gain.rs
rename to src/media/replay_gain/mod.rs
index 24f34454..b0d4c105 100644
--- a/src/replay_gain.rs
+++ b/src/media/replay_gain/mod.rs
@@ -101,84 +101,4 @@ pub fn gain(tags: ReplayGainTags, mode: ReplayGainMode) -> Option<Gain> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn tags(
-        track: (Option<f64>, Option<f64>),
-        album: (Option<f64>, Option<f64>),
-    ) -> ReplayGainTags {
-        ReplayGainTags {
-            track_gain: track.0,
-            track_peak: track.1,
-            album_gain: album.0,
-            album_peak: album.1,
-        }
-    }
-
-    #[test]
-    fn each_mode_reads_its_own_pair_and_falls_back_to_the_other() {
-        let both = tags((Some(-6.0), None), (Some(-3.0), None));
-        assert_eq!(gain(both, ReplayGainMode::Track).unwrap().decibels(), -6.0);
-        assert_eq!(gain(both, ReplayGainMode::Album).unwrap().decibels(), -3.0);
-        assert_eq!(gain(both, ReplayGainMode::Off), None);
-        let album_only = tags((None, None), (Some(-4.5), None));
-        assert_eq!(
-            gain(album_only, ReplayGainMode::Track).unwrap().decibels(),
-            -4.5
-        );
-        let track_only = tags((Some(-2.25), None), (None, None));
-        assert_eq!(
-            gain(track_only, ReplayGainMode::Album).unwrap().decibels(),
-            -2.25
-        );
-        assert_eq!(gain(ReplayGainTags::default(), ReplayGainMode::Album), None);
-        assert_eq!(
-            gain(
-                tags((Some(f64::NAN), None), (None, None)),
-                ReplayGainMode::Track
-            ),
-            None
-        );
-    }
-
-    #[test]
-    fn a_raised_track_never_clips_and_a_wrong_tag_is_bounded() {
-        // +6 dB on a peak of 0.8 would clip; it is held at what 0.8 allows.
-        let hot = tags((Some(6.0), Some(0.8)), (None, None));
-        let held = gain(hot, ReplayGainMode::Track).unwrap().decibels();
-        assert!((held - 1.94).abs() < 0.005, "{held}");
-        // A cut is never limited by the peak.
-        let cut = tags((Some(-8.0), Some(1.0)), (None, None));
-        assert_eq!(gain(cut, ReplayGainMode::Track).unwrap().decibels(), -8.0);
-        let absurd = tags((Some(90.0), None), (None, None));
-        assert_eq!(
-            gain(absurd, ReplayGainMode::Track).unwrap().decibels(),
-            18.0
-        );
-        let silent = tags((Some(-500.0), None), (None, None));
-        assert_eq!(
-            gain(silent, ReplayGainMode::Track).unwrap().decibels(),
-            -60.0
-        );
-        assert_eq!(
-            gain(
-                tags((Some(0.001), None), (None, None)),
-                ReplayGainMode::Track
-            ),
-            None
-        );
-    }
-
-    #[test]
-    fn modes_are_read_as_written() {
-        assert_eq!(ReplayGainMode::parse("Album"), Some(ReplayGainMode::Album));
-        assert_eq!(
-            ReplayGainMode::parse(" track "),
-            Some(ReplayGainMode::Track)
-        );
-        assert_eq!(ReplayGainMode::parse("off"), Some(ReplayGainMode::Off));
-        assert_eq!(ReplayGainMode::parse("loud"), None);
-        assert_eq!(Gain { centibels: -650 }.filter(), "volume=-6.50dB");
-    }
-}
+mod tests;
diff --git a/src/media/replay_gain/tests.rs b/src/media/replay_gain/tests.rs
new file mode 100644
index 00000000..63e7e411
--- /dev/null
+++ b/src/media/replay_gain/tests.rs
@@ -0,0 +1,76 @@
+use super::*;
+
+fn tags(track: (Option<f64>, Option<f64>), album: (Option<f64>, Option<f64>)) -> ReplayGainTags {
+    ReplayGainTags {
+        track_gain: track.0,
+        track_peak: track.1,
+        album_gain: album.0,
+        album_peak: album.1,
+    }
+}
+
+#[test]
+fn each_mode_reads_its_own_pair_and_falls_back_to_the_other() {
+    let both = tags((Some(-6.0), None), (Some(-3.0), None));
+    assert_eq!(gain(both, ReplayGainMode::Track).unwrap().decibels(), -6.0);
+    assert_eq!(gain(both, ReplayGainMode::Album).unwrap().decibels(), -3.0);
+    assert_eq!(gain(both, ReplayGainMode::Off), None);
+    let album_only = tags((None, None), (Some(-4.5), None));
+    assert_eq!(
+        gain(album_only, ReplayGainMode::Track).unwrap().decibels(),
+        -4.5
+    );
+    let track_only = tags((Some(-2.25), None), (None, None));
+    assert_eq!(
+        gain(track_only, ReplayGainMode::Album).unwrap().decibels(),
+        -2.25
+    );
+    assert_eq!(gain(ReplayGainTags::default(), ReplayGainMode::Album), None);
+    assert_eq!(
+        gain(
+            tags((Some(f64::NAN), None), (None, None)),
+            ReplayGainMode::Track
+        ),
+        None
+    );
+}
+
+#[test]
+fn a_raised_track_never_clips_and_a_wrong_tag_is_bounded() {
+    // +6 dB on a peak of 0.8 would clip; it is held at what 0.8 allows.
+    let hot = tags((Some(6.0), Some(0.8)), (None, None));
+    let held = gain(hot, ReplayGainMode::Track).unwrap().decibels();
+    assert!((held - 1.94).abs() < 0.005, "{held}");
+    // A cut is never limited by the peak.
+    let cut = tags((Some(-8.0), Some(1.0)), (None, None));
+    assert_eq!(gain(cut, ReplayGainMode::Track).unwrap().decibels(), -8.0);
+    let absurd = tags((Some(90.0), None), (None, None));
+    assert_eq!(
+        gain(absurd, ReplayGainMode::Track).unwrap().decibels(),
+        18.0
+    );
+    let silent = tags((Some(-500.0), None), (None, None));
+    assert_eq!(
+        gain(silent, ReplayGainMode::Track).unwrap().decibels(),
+        -60.0
+    );
+    assert_eq!(
+        gain(
+            tags((Some(0.001), None), (None, None)),
+            ReplayGainMode::Track
+        ),
+        None
+    );
+}
+
+#[test]
+fn modes_are_read_as_written() {
+    assert_eq!(ReplayGainMode::parse("Album"), Some(ReplayGainMode::Album));
+    assert_eq!(
+        ReplayGainMode::parse(" track "),
+        Some(ReplayGainMode::Track)
+    );
+    assert_eq!(ReplayGainMode::parse("off"), Some(ReplayGainMode::Off));
+    assert_eq!(ReplayGainMode::parse("loud"), None);
+    assert_eq!(Gain { centibels: -650 }.filter(), "volume=-6.50dB");
+}
diff --git a/src/media/stream.rs b/src/media/stream.rs
index eab18b51..daaf072e 100644
--- a/src/media/stream.rs
+++ b/src/media/stream.rs
@@ -27,7 +27,7 @@ use super::transcode::{cache_key, extension, fill_deadline, mime_for_format};
 use super::{
     bearer_principal, MediaError, MediaService, OutputFormat, StreamQuery, MEDIA_CACHE_CONTROL,
 };
-use crate::{catalog::StreamTrack, replay_gain::ReplayGainMode, AppState};
+use crate::{media::replay_gain::ReplayGainMode, storage::catalog::StreamTrack, AppState};
 
 const MAX_RANGE_BYTES: u64 = 8 * 1024 * 1024;
 
@@ -73,7 +73,7 @@ impl MediaService {
         range: Option<&str>,
         mode: ReplayGainMode,
     ) -> Result<Response, MediaError> {
-        let gain = crate::replay_gain::gain(track.replay_gain, mode);
+        let gain = crate::media::replay_gain::gain(track.replay_gain, mode);
         if !track.available {
             return Err(MediaError::NotFound);
         }
@@ -230,14 +230,14 @@ pub async fn create_stream_ticket(
     // cannot be represented is a misconfiguration, not something to round off.
     let expires_at = i64::try_from(state.stream_ticket_ttl.as_millis())
         .ok()
-        .and_then(|ttl| crate::authentication::now_ms().checked_add(ttl))
+        .and_then(|ttl| crate::auth::authentication::now_ms().checked_add(ttl))
         .ok_or_else(|| {
             tracing::error!("stream ticket TTL does not fit in an epoch timestamp");
             MediaError::Internal
         })?;
-    let ticket = crate::stream_ticket::mint(
+    let ticket = crate::auth::stream_ticket::mint(
         &state.secret_box,
-        crate::stream_ticket::TicketKind::Audio,
+        crate::auth::stream_ticket::TicketKind::Audio,
         user.id,
         track_id,
         expires_at,
@@ -289,10 +289,13 @@ pub async fn stream_with_ticket(
     // track, so probing tells an attacker nothing. A ticket of another kind
     // joins them: this route serves audio, and it says so rather than trusting
     // that only audio tickets reach it.
-    let (_, user_id, track_id) =
-        crate::stream_ticket::verify(&state.secret_box, &ticket, crate::authentication::now_ms())
-            .filter(|(kind, ..)| *kind == crate::stream_ticket::TicketKind::Audio)
-            .ok_or(MediaError::NotFound)?;
+    let (_, user_id, track_id) = crate::auth::stream_ticket::verify(
+        &state.secret_box,
+        &ticket,
+        crate::auth::authentication::now_ms(),
+    )
+    .filter(|(kind, ..)| *kind == crate::auth::stream_ticket::TicketKind::Audio)
+    .ok_or(MediaError::NotFound)?;
     let track = state
         .services
         .stream_source_for_user(user_id, track_id)
@@ -473,8 +476,8 @@ pub async fn stream_track(
 pub(crate) async fn secure_track_path(
     root: &Path,
     relative: &str,
-    link_roots: &crate::link_roots::LinkRoots,
-    policy: &crate::link_roots::LinkPolicy,
+    link_roots: &crate::library::link_roots::LinkRoots,
+    policy: &crate::library::link_roots::LinkPolicy,
 ) -> io::Result<PathBuf> {
     let canonical_root = tokio::fs::canonicalize(root).await?;
     let relative = Path::new(relative);
@@ -517,7 +520,7 @@ pub(crate) async fn secure_track_path(
         let (link_roots, policy, target) =
             (link_roots.clone(), policy.clone(), canonical_file.clone());
         tokio::task::spawn_blocking(move || {
-            crate::link_roots::admits(
+            crate::library::link_roots::admits(
                 &link_roots.resolved(),
                 &policy.other_libraries_resolved(),
                 &target,
diff --git a/src/media/tests.rs b/src/media/tests.rs
index 781d3c47..028a2695 100644
--- a/src/media/tests.rs
+++ b/src/media/tests.rs
@@ -82,8 +82,8 @@ async fn media_paths_reject_parent_components_and_symlinks() {
     let root = temp.path().join("library");
     std::fs::create_dir_all(&root).unwrap();
     std::fs::write(root.join("safe.wav"), b"audio").unwrap();
-    let none = crate::link_roots::LinkRoots::default();
-    let policy = crate::link_roots::LinkPolicy::default();
+    let none = crate::library::link_roots::LinkRoots::default();
+    let policy = crate::library::link_roots::LinkPolicy::default();
     assert!(secure_track_path(&root, "safe.wav", &none, &policy)
         .await
         .is_ok());
@@ -139,8 +139,8 @@ async fn a_link_is_followed_into_an_allowed_folder_only() {
         eprintln!("skipped: this system will not let the test make a symbolic link");
         return;
     }
-    let allowed = crate::link_roots::LinkRoots::new(vec![farm.clone()]);
-    let following = crate::link_roots::LinkPolicy {
+    let allowed = crate::library::link_roots::LinkRoots::new(vec![farm.clone()]);
+    let following = crate::library::link_roots::LinkPolicy {
         follow_links: true,
         other_libraries: vec![neighbour.clone()],
     };
@@ -162,11 +162,11 @@ async fn a_link_is_followed_into_an_allowed_folder_only() {
             .is_err(),
         "a link inside the root is stored by its target, never by itself"
     );
-    let none = crate::link_roots::LinkRoots::default();
+    let none = crate::library::link_roots::LinkRoots::default();
     assert!(secure_track_path(&root, "farmed.wav", &none, &following)
         .await
         .is_err());
-    let not_following = crate::link_roots::LinkPolicy {
+    let not_following = crate::library::link_roots::LinkPolicy {
         follow_links: false,
         ..following
     };
@@ -203,8 +203,8 @@ async fn cache_pruning_removes_the_least_recently_used_file() {
         active_transcodes: std::sync::atomic::AtomicUsize::new(0),
         transcoding_available: true,
         ffmpeg_digest: String::new(),
-        link_roots: crate::link_roots::LinkRoots::default(),
-        subsonic_replay_gain: crate::replay_gain::ReplayGainMode::Off,
+        link_roots: crate::library::link_roots::LinkRoots::default(),
+        subsonic_replay_gain: crate::media::replay_gain::ReplayGainMode::Off,
     };
     prune_cache(&inner).await;
     assert!(!old.exists());
@@ -352,8 +352,8 @@ fn a_media_service(dir: &std::path::Path) -> MediaService {
             active_transcodes: std::sync::atomic::AtomicUsize::new(0),
             transcoding_available: true,
             ffmpeg_digest: String::new(),
-            link_roots: crate::link_roots::LinkRoots::default(),
-            subsonic_replay_gain: crate::replay_gain::ReplayGainMode::Off,
+            link_roots: crate::library::link_roots::LinkRoots::default(),
+            subsonic_replay_gain: crate::media::replay_gain::ReplayGainMode::Off,
         }),
     }
 }
diff --git a/src/media/transcode.rs b/src/media/transcode.rs
index 94577dcd..e5a7bc58 100644
--- a/src/media/transcode.rs
+++ b/src/media/transcode.rs
@@ -29,7 +29,7 @@ use tokio_stream::wrappers::ReceiverStream;
 use uuid::Uuid;
 
 use super::{file_input, MediaError, MediaInner, MediaService, OutputFormat, MEDIA_CACHE_CONTROL};
-use crate::replay_gain::Gain;
+use crate::media::replay_gain::Gain;
 
 const STREAM_CHUNK_SIZE: usize = 64 * 1024;
 const TRANSCODE_PROFILE_VERSION: &str = "waveflow-ffmpeg-v1";
diff --git a/src/playlist_file.rs b/src/playlist_file.rs
deleted file mode 100644
index 589a93c9..00000000
--- a/src/playlist_file.rs
+++ /dev/null
@@ -1,504 +0,0 @@
-//! Reading an `.m3u` or `.m3u8` playlist file.
-//!
-//! Pure: bytes in, entries out, no database and no filesystem. What an entry
-//! *resolves to* is a catalogue question and lives in
-//! [`crate::services`]; what an entry *says* is here.
-//!
-//! Two dialects, and the simple one is a subset of the other: a plain `.m3u`
-//! is one target per line, and the extended one adds `#EXTM3U` on the first
-//! line with an optional `#EXTINF` before each target. A reader that treats
-//! every `#` line as a comment reads both, which is what this does — the
-//! `#EXTINF` metadata is kept because it is the only thing left to match on
-//! when a path resolves to nothing.
-
-use chardetng::{EncodingDetector, Iso2022JpDetection, Utf8Detection};
-use encoding_rs::Encoding;
-use serde::{Serialize, Serializer};
-
-/// How the bytes were read as text.
-///
-/// Reported rather than assumed, because the guess can be wrong and a wrong
-/// guess mangles every title. A caller that sees `shift_jis` on a file it
-/// believed was UTF-8 has been told something.
-///
-/// On the wire, the encoding's WHATWG name in lower case: `utf-8`,
-/// `utf-16le`, `windows-1252`, `shift_jis`, `gbk`, `big5`, `euc-kr` and so on.
-/// The two this answered before it read anything but UTF-8 and Windows-1252
-/// are spelled as they were.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct TextEncoding(&'static Encoding);
-
-impl TextEncoding {
-    pub const UTF_8: Self = Self(encoding_rs::UTF_8);
-
-    /// The name a report gives, `utf-8` rather than encoding_rs's `UTF-8`.
-    pub fn name(self) -> String {
-        self.0.name().to_ascii_lowercase()
-    }
-}
-
-impl Serialize for TextEncoding {
-    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
-        serializer.serialize_str(&self.name())
-    }
-}
-
-/// One line of the file that names something to play.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct PlaylistFileEntry {
-    /// One-based line number of the target, for a report that can be read
-    /// against the file the user sent.
-    pub line: usize,
-    /// The target exactly as written, kept for the report: a user looking for
-    /// why an entry failed needs to see what they wrote, not what we made of
-    /// it.
-    pub raw: String,
-    /// The target reduced to path segments, separators folded and `.`/`..`
-    /// resolved. Empty for a target that names no path at all — a bare URL.
-    pub segments: Vec<String>,
-    /// `#EXTINF` duration in seconds, when the file gave one.
-    pub duration_secs: Option<i64>,
-    /// `#EXTINF` display text, usually `Artist - Title`.
-    pub title: Option<String>,
-}
-
-impl PlaylistFileEntry {
-    /// `Artist - Title` split back into its two halves, when the title looks
-    /// like one.
-    ///
-    /// The separator is " - " with spaces: a hyphen with no spaces around it
-    /// belongs to the name more often than it separates two of them.
-    pub fn artist_and_title(&self) -> Option<(&str, &str)> {
-        let title = self.title.as_deref()?;
-        let (artist, song) = title.split_once(" - ")?;
-        let (artist, song) = (artist.trim(), song.trim());
-        (!artist.is_empty() && !song.is_empty()).then_some((artist, song))
-    }
-}
-
-/// A parsed playlist file.
-#[derive(Debug, Clone)]
-pub struct PlaylistFile {
-    /// The name `#PLAYLIST` gave, when it gave one.
-    pub name: Option<String>,
-    pub encoding: TextEncoding,
-    pub entries: Vec<PlaylistFileEntry>,
-}
-
-/// The file names more entries than the caller would take.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct TooManyEntries;
-
-/// Reads the file, up to `max_entries` entries.
-///
-/// Fails on one thing only: a file naming more than `max_entries` entries,
-/// noticed at the first entry past the line, before it is built (RFC-023
-/// decision 5). The caller's ceiling used to be applied once the whole file
-/// was read, and a five-megabyte body of one-letter lines is millions of
-/// entries, each with its own strings, before anything refused it.
-///
-/// Otherwise lenient: a line this does not understand is a line it reports
-/// nothing about, and an empty result is an empty playlist rather than an
-/// error. The caller decides what an empty import means, which is a policy
-/// question and not a parsing one.
-pub fn parse(bytes: &[u8], max_entries: usize) -> Result<PlaylistFile, TooManyEntries> {
-    let (text, encoding) = decode(bytes);
-    let mut name = None;
-    let mut pending: Option<(Option<i64>, Option<String>)> = None;
-    let mut entries = Vec::new();
-    for (index, raw_line) in text.lines().enumerate() {
-        // A `.m3u` written on Windows and read here keeps its carriage
-        // returns, and a trailing `\r` in a path matches nothing.
-        let line = raw_line
-            .trim_matches(|c: char| c == '\r' || c == '\n')
-            .trim();
-        if line.is_empty() {
-            continue;
-        }
-        if let Some(directive) = line.strip_prefix('#') {
-            if let Some(value) = directive.strip_prefix("EXTINF:") {
-                pending = Some(parse_extinf(value));
-            } else if let Some(value) = directive.strip_prefix("PLAYLIST:") {
-                let value = value.trim();
-                if !value.is_empty() {
-                    name = Some(value.to_owned());
-                }
-            }
-            // Everything else — `#EXTM3U`, `#EXTALB`, `#EXTGRP`, a human
-            // comment — says nothing this import can act on.
-            continue;
-        }
-        if entries.len() == max_entries {
-            return Err(TooManyEntries);
-        }
-        let (duration_secs, title) = pending.take().unwrap_or((None, None));
-        entries.push(PlaylistFileEntry {
-            line: index + 1,
-            raw: line.to_owned(),
-            segments: segments(line),
-            duration_secs,
-            title,
-        });
-    }
-    Ok(PlaylistFile {
-        name,
-        encoding,
-        entries,
-    })
-}
-
-/// The text, read by `waveflow_core::text_encoding`, and the encoding it was
-/// read as.
-///
-/// `.m3u8` is UTF-8 by definition and `.m3u` frequently is not, but the
-/// extension is a claim and the bytes are evidence, so the bytes decide. The
-/// core decoder is the one the desktop reads the same files with: a
-/// byte-order mark names the encoding, valid UTF-8 is UTF-8, and anything
-/// else has its encoding guessed. A fixed fallback, Windows-1252 as this was
-/// until the core had a decoder, read a CJK playlist into Latin nonsense and
-/// a UTF-16 one into NULs.
-fn decode(bytes: &[u8]) -> (String, TextEncoding) {
-    let text = waveflow_core::text_encoding::decode(bytes).into_owned();
-    (text, TextEncoding(encoding_read_as(bytes)))
-}
-
-/// The encoding `waveflow_core::text_encoding::decode` reads `bytes` as.
-///
-/// The core answers the text and not its encoding, so the encoding is worked
-/// out again here by the same steps in the same order, with the detector set
-/// up the same way. Duplicated rather than trusted: a core that changed its
-/// guess would have a report name one encoding while the text was read as
-/// another, which is what `the_encoding_named_is_the_one_the_core_read`
-/// catches on the next bump.
-fn encoding_read_as(bytes: &[u8]) -> &'static Encoding {
-    if let Some((encoding, _)) = Encoding::for_bom(bytes) {
-        return encoding;
-    }
-    if std::str::from_utf8(bytes).is_ok() {
-        return encoding_rs::UTF_8;
-    }
-    let mut detector = EncodingDetector::new(Iso2022JpDetection::Deny);
-    detector.feed(bytes, true);
-    detector.guess(None, Utf8Detection::Deny)
-}
-
-/// `#EXTINF:duration,display text`.
-///
-/// The duration is `-1` for a stream and may carry attributes after it in the
-/// HLS dialect; neither is this import's business, so anything that is not a
-/// positive integer becomes `None` rather than an error.
-fn parse_extinf(value: &str) -> (Option<i64>, Option<String>) {
-    let (duration, title) = match value.split_once(',') {
-        Some((duration, title)) => (duration.trim(), title.trim()),
-        None => (value.trim(), ""),
-    };
-    let duration = duration
-        .split_whitespace()
-        .next()
-        .and_then(|head| head.parse::<i64>().ok())
-        .filter(|seconds| *seconds > 0);
-    let title = (!title.is_empty()).then(|| title.to_owned());
-    (duration, title)
-}
-
-/// A target reduced to the segments a path comparison can use.
-///
-/// Four shapes arrive, and all four are the same shape underneath:
-/// `Artist/Album/01.flac`, `../Artist/Album/01.flac`,
-/// `/home/someone/Music/Artist/Album/01.flac` and
-/// `C:\Users\someone\Music\Artist\Album\01.flac`. What they share is the tail,
-/// so the leading part is simply kept as segments and the comparison takes the
-/// tail it needs. A `file://` URL is percent-decoded first; any other scheme
-/// yields nothing, because a playlist entry pointing at a web radio is not a
-/// track this catalogue holds.
-///
-/// The scheme is matched without regard to case, as RFC 3986 defines it: a
-/// player that writes `File://` names the same thing, and reading it as an
-/// unknown scheme would have reported the entry as naming no path at all.
-fn segments(target: &str) -> Vec<String> {
-    let path = match target.split_once("://") {
-        None => percent_decode(target),
-        Some((scheme, rest)) if scheme.eq_ignore_ascii_case("file") => {
-            // `file:///C:/x` and `file://host/x`: the authority is dropped
-            // either way, because neither names anything here.
-            let rest = rest.split_once('/').map_or("", |(_, tail)| tail);
-            percent_decode(rest)
-        }
-        Some(_) => return Vec::new(),
-    };
-    let mut out: Vec<String> = Vec::new();
-    for segment in path.split(['/', '\\']) {
-        match segment {
-            "" | "." => {}
-            ".." => {
-                out.pop();
-            }
-            other => out.push(other.to_owned()),
-        }
-    }
-    out
-}
-
-/// `%20` and friends, decoded leniently.
-///
-/// A lone `%` or a truncated escape is kept as written rather than dropped: it
-/// is almost certainly a literal percent in a file name, and an entry that
-/// fails to resolve is reported with its raw text, so guessing wrong here is
-/// visible rather than silent.
-fn percent_decode(value: &str) -> String {
-    percent_encoding::percent_decode_str(value)
-        .decode_utf8()
-        .map(|decoded| decoded.into_owned())
-        .unwrap_or_else(|_| value.to_owned())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The parser with no ceiling: what these tests are about is the reading.
-    fn parse(bytes: &[u8]) -> PlaylistFile {
-        super::parse(bytes, usize::MAX).expect("no ceiling to reach")
-    }
-
-    /// The ceiling is noticed at the first entry past it, and a file exactly
-    /// at it is read (RFC-023 decision 5). Comments and directives are not
-    /// entries and count for nothing.
-    #[test]
-    fn a_file_past_the_ceiling_is_refused_and_one_at_it_is_read() {
-        let at = "#EXTM3U\n#EXTINF:1,A - B\na.flac\nb.flac\nc.flac\n";
-        assert_eq!(super::parse(at.as_bytes(), 3).unwrap().entries.len(), 3);
-        let past = format!("{at}d.flac\n");
-        assert_eq!(super::parse(past.as_bytes(), 3).err(), Some(TooManyEntries));
-    }
-
-    fn targets(file: &PlaylistFile) -> Vec<String> {
-        file.entries
-            .iter()
-            .map(|entry| entry.segments.join("/"))
-            .collect()
-    }
-
-    #[test]
-    fn a_plain_file_is_one_target_per_line() {
-        let file = parse(b"Artist/Album/01.flac\nArtist/Album/02.flac\n");
-        assert_eq!(file.encoding, TextEncoding::UTF_8);
-        assert_eq!(file.name, None);
-        assert_eq!(
-            targets(&file),
-            ["Artist/Album/01.flac", "Artist/Album/02.flac"]
-        );
-        assert_eq!(file.entries[1].line, 2);
-        assert!(file.entries.iter().all(|entry| entry.title.is_none()));
-    }
-
-    #[test]
-    fn the_extended_dialect_attaches_its_metadata_to_the_next_target() {
-        let file = parse(
-            b"#EXTM3U\n#PLAYLIST:Evening\n#EXTINF:245,Harbour Bells - Lamp Hymn\nArtist/01.flac\n\
-              # a human comment\n#EXTINF:-1,A stream\nArtist/02.flac\n",
-        );
-        assert_eq!(file.name.as_deref(), Some("Evening"));
-        assert_eq!(targets(&file), ["Artist/01.flac", "Artist/02.flac"]);
-        assert_eq!(file.entries[0].duration_secs, Some(245));
-        assert_eq!(
-            file.entries[0].artist_and_title(),
-            Some(("Harbour Bells", "Lamp Hymn"))
-        );
-        // `-1` is a stream's duration, which is not a measurement.
-        assert_eq!(file.entries[1].duration_secs, None);
-        assert_eq!(file.entries[1].title.as_deref(), Some("A stream"));
-        assert_eq!(file.entries[1].artist_and_title(), None);
-    }
-
-    #[test]
-    fn an_extinf_with_no_target_after_it_carries_nothing_forward() {
-        // The metadata belongs to a target. A file that ends on `#EXTINF`
-        // must not hand it to whatever the next import reads.
-        let file = parse(b"#EXTM3U\n#EXTINF:1,Orphan\n");
-        assert!(file.entries.is_empty());
-        let file = parse(b"#EXTM3U\n#EXTINF:1,Orphan\n\n#EXTINF:2,Owner - Song\nA/01.flac\n");
-        assert_eq!(file.entries.len(), 1);
-        assert_eq!(file.entries[0].title.as_deref(), Some("Owner - Song"));
-    }
-
-    #[test]
-    fn windows_line_endings_and_a_bom_do_not_reach_the_path() {
-        let mut bytes = vec![0xEF, 0xBB, 0xBF];
-        bytes.extend_from_slice(b"#EXTM3U\r\nArtist/Album/01.flac\r\n");
-        let file = parse(&bytes);
-        assert_eq!(file.encoding, TextEncoding::UTF_8);
-        assert_eq!(targets(&file), ["Artist/Album/01.flac"]);
-    }
-
-    #[test]
-    fn a_file_that_is_not_utf8_is_read_as_windows_1252() {
-        // "Bj<F6>rk/Vespertine/01.flac" — the byte a Windows player writes
-        // for ö, which is not valid UTF-8.
-        let mut bytes = b"Bj".to_vec();
-        bytes.push(0xF6);
-        bytes.extend_from_slice(b"rk/Vespertine/01.flac\n");
-        let file = parse(&bytes);
-        assert_eq!(file.encoding.name(), "windows-1252");
-        assert_eq!(targets(&file), ["Björk/Vespertine/01.flac"]);
-
-        // And the thirty-two code points that tell Windows-1252 from Latin-1:
-        // 0x92 is a right single quote in a title, not a control code.
-        let mut bytes = b"#EXTINF:1,L".to_vec();
-        bytes.push(0x92);
-        bytes.extend_from_slice(b"artiste - Song\nA/01.flac\n");
-        let file = parse(&bytes);
-        assert_eq!(
-            file.entries[0].title.as_deref(),
-            Some("L\u{2019}artiste - Song")
-        );
-    }
-
-    /// What Notepad saves as "Unicode", and what some players export: UTF-16
-    /// little-endian behind its byte-order mark. Read as Windows-1252, every
-    /// other character was a NUL and no path matched anything.
-    #[test]
-    fn a_utf16_file_is_read_by_its_byte_order_mark() {
-        let text = "#EXTM3U\r\n#EXTINF:245,Björk - Hidden Place\r\nBjörk/Vespertine/01.flac\r\n";
-        let mut bytes = vec![0xFF, 0xFE];
-        bytes.extend(text.encode_utf16().flat_map(u16::to_le_bytes));
-        let file = parse(&bytes);
-        assert_eq!(serde_json::to_value(file.encoding).unwrap(), "utf-16le");
-        assert_eq!(targets(&file), ["Björk/Vespertine/01.flac"]);
-        assert_eq!(
-            file.entries[0].artist_and_title(),
-            Some(("Björk", "Hidden Place"))
-        );
-    }
-
-    /// A playlist written on a Japanese Windows, in Shift_JIS. The Windows-1252
-    /// fallback read it without failing, which was worse: every name came back
-    /// as Latin nonsense that matched no path and no title.
-    #[test]
-    fn a_file_in_an_east_asian_code_page_is_read_in_it() {
-        let text = "#EXTM3U\r\n#PLAYLIST:夏の夜に聴きたい歌\r\n\
-                    #EXTINF:245,宇多田ヒカル - 花束を君に\r\n\
-                    宇多田ヒカル/ファントーム/01 花束を君に.flac\r\n\
-                    #EXTINF:301,椎名林檎 - 丸の内サディスティック\r\n\
-                    椎名林檎/無罪モラトリアム/03 丸の内サディスティック.flac\r\n";
-        let (bytes, _, unmappable) = encoding_rs::SHIFT_JIS.encode(text);
-        assert!(!unmappable, "Shift_JIS holds the sample");
-        assert!(std::str::from_utf8(&bytes).is_err());
-        let file = parse(&bytes);
-        assert_eq!(serde_json::to_value(file.encoding).unwrap(), "shift_jis");
-        assert_eq!(file.name.as_deref(), Some("夏の夜に聴きたい歌"));
-        assert_eq!(
-            targets(&file),
-            [
-                "宇多田ヒカル/ファントーム/01 花束を君に.flac",
-                "椎名林檎/無罪モラトリアム/03 丸の内サディスティック.flac",
-            ]
-        );
-        assert_eq!(
-            file.entries[1].artist_and_title(),
-            Some(("椎名林檎", "丸の内サディスティック"))
-        );
-    }
-
-    /// The report names the encoding the core read, not a second guess that
-    /// happens to agree today: decoding each sample with the named encoding
-    /// gives back the core's text exactly.
-    #[test]
-    fn the_encoding_named_is_the_one_the_core_read() {
-        let samples: [(&str, &'static Encoding); 6] = [
-            (
-                "#EXTINF:1,Björk - Cocoon\nBjörk/Vespertine/02.flac\n",
-                encoding_rs::WINDOWS_1252,
-            ),
-            (
-                "#EXTINF:1,宇多田ヒカル - 花束を君に\n宇多田ヒカル/01 花束を君に.flac\n",
-                encoding_rs::SHIFT_JIS,
-            ),
-            (
-                "#EXTINF:1,王菲 - 红豆\n王菲/唱游/03 红豆.flac\n",
-                encoding_rs::GB18030,
-            ),
-            (
-                "#EXTINF:1,周杰倫 - 晴天\n周杰倫/葉惠美/01 晴天.flac\n",
-                encoding_rs::BIG5,
-            ),
-            (
-                "#EXTINF:1,아이유 - 밤편지\n아이유/팔레트/01 밤편지.flac\n",
-                encoding_rs::EUC_KR,
-            ),
-            (
-                "#EXTINF:1,Björk - Cocoon\nBjörk/Vespertine/02.flac\n",
-                encoding_rs::UTF_8,
-            ),
-        ];
-        for (text, encoding) in samples {
-            let (bytes, _, unmappable) = encoding.encode(text);
-            assert!(!unmappable, "{} holds the sample", encoding.name());
-            let named = encoding_read_as(&bytes);
-            assert_eq!(
-                named.decode_without_bom_handling(&bytes).0,
-                waveflow_core::text_encoding::decode(&bytes),
-                "{} was named {}",
-                encoding.name(),
-                named.name()
-            );
-        }
-        let mut marked = vec![0xFE, 0xFF];
-        marked.extend("Björk/01.flac".encode_utf16().flat_map(u16::to_be_bytes));
-        assert_eq!(encoding_read_as(&marked), encoding_rs::UTF_16BE);
-    }
-
-    #[test]
-    fn every_shape_of_target_reduces_to_the_same_segments() {
-        let expected = ["Artist", "Album", "01.flac"];
-        for target in [
-            "Artist/Album/01.flac",
-            "./Artist/Album/01.flac",
-            "../../Artist/Album/01.flac",
-            "/home/someone/Music/Artist/Album/01.flac",
-            "Artist\\Album\\01.flac",
-            "C:\\Users\\someone\\Music\\Artist\\Album\\01.flac",
-            "file:///home/someone/Music/Artist/Album/01.flac",
-            "file://server/Music/Artist/Album/01.flac",
-            // A scheme is case-insensitive, and a player that shouts it names
-            // the same file.
-            "File:///home/someone/Music/Artist/Album/01.flac",
-            "FILE://server/Music/Artist/Album/01.flac",
-            "Artist/Album/%30%31.flac",
-        ] {
-            let file = parse(target.as_bytes());
-            let entry = &file.entries[0];
-            let tail = entry.segments[entry.segments.len() - 3..].to_vec();
-            assert_eq!(tail, expected, "{target}");
-            assert_eq!(entry.raw, target, "the report quotes what was written");
-        }
-    }
-
-    #[test]
-    fn a_remote_url_names_no_path_at_all() {
-        // Deliberately not a failed path match: a web radio is not a track
-        // this catalogue could hold, and the ladder has nothing to climb.
-        // And the case-insensitive scheme match does not widen to another
-        // scheme that merely looks like one.
-        for target in [
-            "http://radio.example/stream",
-            "https://radio.example/s.mp3",
-            "HTTP://radio.example/stream",
-            "filesystem://radio.example/s.mp3",
-        ] {
-            let file = parse(target.as_bytes());
-            assert!(file.entries[0].segments.is_empty(), "{target}");
-        }
-    }
-
-    #[test]
-    fn a_hyphen_without_spaces_belongs_to_the_name() {
-        let file = parse(b"#EXTINF:1,Jean-Michel Jarre\nA/01.flac\n");
-        assert_eq!(file.entries[0].artist_and_title(), None);
-        let file = parse(b"#EXTINF:1,Jean-Michel Jarre - Oxygene-4\nA/01.flac\n");
-        assert_eq!(
-            file.entries[0].artist_and_title(),
-            Some(("Jean-Michel Jarre", "Oxygene-4"))
-        );
-    }
-}
diff --git a/src/quality/bandwidth.rs b/src/quality/bandwidth/mod.rs
similarity index 69%
rename from src/quality/bandwidth.rs
rename to src/quality/bandwidth/mod.rs
index f67be830..7d64bb1a 100644
--- a/src/quality/bandwidth.rs
+++ b/src/quality/bandwidth/mod.rs
@@ -7,7 +7,7 @@
 //! the search are carried here unchanged; what is added is
 //! [`BandwidthMeter::finish_with_spectrum`], which hands back the averaged
 //! spectrum the meter already computed. Two tests hold the port to the
-//! original: the public constants must be equal, and `tests/quality.rs` measures
+//! original: the public constants must be equal, and `tests/quality/analysis.rs` measures
 //! the same signals through both and compares.
 //!
 //! Every lossy encoder low-passes before it encodes: LAME cuts a 128 kbps
@@ -271,133 +271,4 @@ fn find_wall(db: &[f64], rate: f64) -> Bandwidth {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    const RATE: f64 = 44_100.0;
-
-    /// Noise shaped by a gain per frequency: white noise through an FFT
-    /// mask, in frames, so the test controls the spectrum exactly.
-    fn shaped_noise(secs: f64, gain_db: impl Fn(f64) -> f64) -> Vec<f32> {
-        let mut planner = RealFftPlanner::<f32>::new();
-        let forward = planner.plan_fft_forward(FRAME);
-        let inverse = planner.plan_fft_inverse(FRAME);
-        let mut seed = 0x1234_5678_u32;
-        let mut out = Vec::new();
-        while (out.len() as f64) < secs * RATE {
-            let mut block: Vec<f32> = (0..FRAME)
-                .map(|_| {
-                    seed ^= seed << 13;
-                    seed ^= seed >> 17;
-                    seed ^= seed << 5;
-                    (seed as f32 / u32::MAX as f32) - 0.5
-                })
-                .collect();
-            let mut spec = forward.make_output_vec();
-            forward.process(&mut block, &mut spec).unwrap();
-            for (k, bin) in spec.iter_mut().enumerate() {
-                let hz = k as f64 * RATE / FRAME as f64;
-                *bin *= 10f32.powf((gain_db(hz) / 20.0) as f32);
-            }
-            let mut back = inverse.make_output_vec();
-            inverse.process(&mut spec, &mut back).unwrap();
-            out.extend(back.iter().map(|v| v / FRAME as f32));
-        }
-        out
-    }
-
-    fn measure(signal: &[f32]) -> Bandwidth {
-        let mut meter = BandwidthMeter::new(RATE, 1);
-        for &s in signal {
-            meter.push_frame(&[s]);
-        }
-        meter.finish().expect("a spectrum")
-    }
-
-    /// A music-like tilt: the level falls 3 dB per octave above 1 kHz.
-    fn tilt(hz: f64) -> f64 {
-        -3.0 * (hz.max(1000.0) / 1000.0).log2()
-    }
-
-    #[test]
-    fn a_lossy_cut_is_found_where_it_stands() {
-        for cut in [16_000.0, 19_000.0, 20_000.0] {
-            let b = measure(&shaped_noise(20.0, |hz| {
-                tilt(hz) + if hz > cut { -60.0 } else { 0.0 }
-            }));
-            let found = b.cutoff_hz.expect("a wall");
-            assert!((found - cut).abs() < 300.0, "{cut}: {b:?}");
-        }
-    }
-
-    #[test]
-    fn a_full_band_spectrum_has_no_wall() {
-        let b = measure(&shaped_noise(20.0, tilt));
-        assert!(b.cutoff_hz.is_none(), "{b:?}");
-    }
-
-    /// An old, dull recording: the highs fade by 12 dB per octave from
-    /// 6 kHz. Low, but no wall — not a lossy file.
-    #[test]
-    fn a_gentle_fade_is_not_a_wall() {
-        let b = measure(&shaped_noise(20.0, |hz| {
-            tilt(hz) - 12.0 * (hz.max(6000.0) / 6000.0).log2()
-        }));
-        assert!(b.cutoff_hz.is_none(), "{b:?}");
-    }
-
-    #[test]
-    fn the_port_follows_the_core() {
-        use waveflow_core::analysis::bandwidth as core;
-        assert_eq!(BANDWIDTH_VERSION, core::BANDWIDTH_VERSION);
-        assert_eq!(WALL_DB, core::WALL_DB);
-        assert_eq!(LOSSY_CUTOFF_HZ, core::LOSSY_CUTOFF_HZ);
-        assert_eq!(NYQUIST_MARGIN_HZ, core::NYQUIST_MARGIN_HZ);
-    }
-
-    #[test]
-    fn the_sql_threshold_is_the_constant() {
-        let sql = waveflow_core::probable_fake_lossless_sql!();
-        assert!(
-            sql.contains(&format!(
-                "MIN({}, t.sample_rate / 2.0 - {})",
-                LOSSY_CUTOFF_HZ as i64, NYQUIST_MARGIN_HZ as i64
-            )),
-            "{sql}"
-        );
-    }
-
-    #[test]
-    fn silence_measures_nothing() {
-        let mut meter = BandwidthMeter::new(RATE, 2);
-        for _ in 0..(5.0 * RATE) as usize {
-            meter.push_frame(&[0.0, 0.0]);
-        }
-        assert!(meter.finish().is_none());
-    }
-
-    /// Highs in opposition between the channels vanish from a mono sum,
-    /// which then shows a wall at 15 kHz; channel by channel they are
-    /// there, and a genuine file is not taken for a fake.
-    #[test]
-    fn highs_in_opposition_are_not_a_wall() {
-        let lows = shaped_noise(20.0, |hz| {
-            tilt(hz) + if hz > 15_000.0 { -80.0 } else { 0.0 }
-        });
-        let highs = shaped_noise(20.0, |hz| {
-            tilt(hz) + if hz > 15_000.0 { 0.0 } else { -80.0 }
-        });
-        let mut meter = BandwidthMeter::new(RATE, 2);
-        for (&l, &h) in lows.iter().zip(&highs) {
-            meter.push_frame(&[l + h, l - h]);
-        }
-        let b = meter.finish().expect("a spectrum");
-        assert!(b.cutoff_hz.is_none(), "{b:?}");
-
-        let mono: Vec<f32> = lows.to_vec();
-        assert!(
-            measure(&mono).cutoff_hz.is_some(),
-            "the sum alone has the wall"
-        );
-    }
-}
+mod tests;
diff --git a/src/quality/bandwidth/tests.rs b/src/quality/bandwidth/tests.rs
new file mode 100644
index 00000000..ac0d251c
--- /dev/null
+++ b/src/quality/bandwidth/tests.rs
@@ -0,0 +1,128 @@
+use super::*;
+
+const RATE: f64 = 44_100.0;
+
+/// Noise shaped by a gain per frequency: white noise through an FFT
+/// mask, in frames, so the test controls the spectrum exactly.
+fn shaped_noise(secs: f64, gain_db: impl Fn(f64) -> f64) -> Vec<f32> {
+    let mut planner = RealFftPlanner::<f32>::new();
+    let forward = planner.plan_fft_forward(FRAME);
+    let inverse = planner.plan_fft_inverse(FRAME);
+    let mut seed = 0x1234_5678_u32;
+    let mut out = Vec::new();
+    while (out.len() as f64) < secs * RATE {
+        let mut block: Vec<f32> = (0..FRAME)
+            .map(|_| {
+                seed ^= seed << 13;
+                seed ^= seed >> 17;
+                seed ^= seed << 5;
+                (seed as f32 / u32::MAX as f32) - 0.5
+            })
+            .collect();
+        let mut spec = forward.make_output_vec();
+        forward.process(&mut block, &mut spec).unwrap();
+        for (k, bin) in spec.iter_mut().enumerate() {
+            let hz = k as f64 * RATE / FRAME as f64;
+            *bin *= 10f32.powf((gain_db(hz) / 20.0) as f32);
+        }
+        let mut back = inverse.make_output_vec();
+        inverse.process(&mut spec, &mut back).unwrap();
+        out.extend(back.iter().map(|v| v / FRAME as f32));
+    }
+    out
+}
+
+fn measure(signal: &[f32]) -> Bandwidth {
+    let mut meter = BandwidthMeter::new(RATE, 1);
+    for &s in signal {
+        meter.push_frame(&[s]);
+    }
+    meter.finish().expect("a spectrum")
+}
+
+/// A music-like tilt: the level falls 3 dB per octave above 1 kHz.
+fn tilt(hz: f64) -> f64 {
+    -3.0 * (hz.max(1000.0) / 1000.0).log2()
+}
+
+#[test]
+fn a_lossy_cut_is_found_where_it_stands() {
+    for cut in [16_000.0, 19_000.0, 20_000.0] {
+        let b = measure(&shaped_noise(20.0, |hz| {
+            tilt(hz) + if hz > cut { -60.0 } else { 0.0 }
+        }));
+        let found = b.cutoff_hz.expect("a wall");
+        assert!((found - cut).abs() < 300.0, "{cut}: {b:?}");
+    }
+}
+
+#[test]
+fn a_full_band_spectrum_has_no_wall() {
+    let b = measure(&shaped_noise(20.0, tilt));
+    assert!(b.cutoff_hz.is_none(), "{b:?}");
+}
+
+/// An old, dull recording: the highs fade by 12 dB per octave from
+/// 6 kHz. Low, but no wall — not a lossy file.
+#[test]
+fn a_gentle_fade_is_not_a_wall() {
+    let b = measure(&shaped_noise(20.0, |hz| {
+        tilt(hz) - 12.0 * (hz.max(6000.0) / 6000.0).log2()
+    }));
+    assert!(b.cutoff_hz.is_none(), "{b:?}");
+}
+
+#[test]
+fn the_port_follows_the_core() {
+    use waveflow_core::analysis::bandwidth as core;
+    assert_eq!(BANDWIDTH_VERSION, core::BANDWIDTH_VERSION);
+    assert_eq!(WALL_DB, core::WALL_DB);
+    assert_eq!(LOSSY_CUTOFF_HZ, core::LOSSY_CUTOFF_HZ);
+    assert_eq!(NYQUIST_MARGIN_HZ, core::NYQUIST_MARGIN_HZ);
+}
+
+#[test]
+fn the_sql_threshold_is_the_constant() {
+    let sql = waveflow_core::probable_fake_lossless_sql!();
+    assert!(
+        sql.contains(&format!(
+            "MIN({}, t.sample_rate / 2.0 - {})",
+            LOSSY_CUTOFF_HZ as i64, NYQUIST_MARGIN_HZ as i64
+        )),
+        "{sql}"
+    );
+}
+
+#[test]
+fn silence_measures_nothing() {
+    let mut meter = BandwidthMeter::new(RATE, 2);
+    for _ in 0..(5.0 * RATE) as usize {
+        meter.push_frame(&[0.0, 0.0]);
+    }
+    assert!(meter.finish().is_none());
+}
+
+/// Highs in opposition between the channels vanish from a mono sum,
+/// which then shows a wall at 15 kHz; channel by channel they are
+/// there, and a genuine file is not taken for a fake.
+#[test]
+fn highs_in_opposition_are_not_a_wall() {
+    let lows = shaped_noise(20.0, |hz| {
+        tilt(hz) + if hz > 15_000.0 { -80.0 } else { 0.0 }
+    });
+    let highs = shaped_noise(20.0, |hz| {
+        tilt(hz) + if hz > 15_000.0 { 0.0 } else { -80.0 }
+    });
+    let mut meter = BandwidthMeter::new(RATE, 2);
+    for (&l, &h) in lows.iter().zip(&highs) {
+        meter.push_frame(&[l + h, l - h]);
+    }
+    let b = meter.finish().expect("a spectrum");
+    assert!(b.cutoff_hz.is_none(), "{b:?}");
+
+    let mono: Vec<f32> = lows.to_vec();
+    assert!(
+        measure(&mono).cutoff_hz.is_some(),
+        "the sum alone has the wall"
+    );
+}
diff --git a/src/quality/mod.rs b/src/quality/mod.rs
index 30fe50b5..74ce746d 100644
--- a/src/quality/mod.rs
+++ b/src/quality/mod.rs
@@ -403,100 +403,4 @@ pub async fn spectrogram(
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_padded_sixteen_bit_file_uses_sixteen_bits() {
-        // A 16-bit sample decoded to s32 is shifted left by sixteen.
-        assert_eq!(effective_bits(0x7FFF_0000 | 0x0001_0000, false), Some(16));
-        // A 24-bit one by eight, and a genuine one sets its lowest bit.
-        assert_eq!(effective_bits(0x0000_0100, false), Some(24));
-        assert_eq!(effective_bits(0x0000_0001, false), Some(32));
-        assert_eq!(effective_bits(0, false), None);
-        assert_eq!(effective_bits(0x0001_0000, true), None);
-    }
-
-    #[test]
-    fn the_spectrum_is_stored_under_its_loudest_band() {
-        let mut db = vec![-20.0; 2049];
-        for level in db.iter_mut().skip(1500) {
-            *level = -80.0;
-        }
-        let stored = quantise_spectrum(&db);
-        assert_eq!(stored.len(), SPECTRUM_BANDS);
-        assert_eq!(stored[0], 0);
-        assert_eq!(stored[SPECTRUM_BANDS - 1], 120);
-        assert_eq!(spectrum_db(&stored)[SPECTRUM_BANDS - 1], -60.0);
-    }
-
-    #[test]
-    fn a_spectrogram_gives_up_before_the_request_does() {
-        assert_eq!(
-            spectrogram_deadline(Duration::from_secs(30)),
-            Duration::from_secs(20)
-        );
-        assert_eq!(
-            spectrogram_deadline(Duration::from_secs(10)),
-            Duration::from_secs(5)
-        );
-        assert_eq!(
-            spectrogram_deadline(Duration::from_secs(2)),
-            Duration::from_secs(1)
-        );
-        // The shortest setting the configuration accepts still leaves the
-        // route time to answer for itself.
-        assert_eq!(
-            spectrogram_deadline(Duration::from_secs(1)),
-            Duration::from_millis(500)
-        );
-    }
-
-    #[test]
-    fn the_decoder_digest_reads_past_the_first_line() {
-        let one = b"ffmpeg version 8.0\nconfiguration: --enable-libwebp\nlibavcodec 62. 11.100 / 62. 11.100\n";
-        let two = b"ffmpeg version 8.0\nconfiguration: --disable-libwebp\nlibavcodec 62. 11.100 / 62. 11.100\n";
-        let three = b"ffmpeg version 8.0\nconfiguration: --enable-libwebp\nlibavcodec 62. 11.100 / 62. 12.100\n";
-        assert_ne!(decoder_digest(one), decoder_digest(two));
-        assert_ne!(decoder_digest(one), decoder_digest(three));
-        assert_eq!(decoder_digest(one).len(), 64);
-    }
-
-    /// The probe, the measurement and the spectrogram open files and nothing
-    /// else (RFC-023 decision 2): an input that is a URL is refused by
-    /// ffprobe and by FFmpeg before either connects to anything, and a real
-    /// file still measures.
-    #[tokio::test]
-    async fn the_analysis_opens_files_and_nothing_else() {
-        let temp = tempfile::tempdir().unwrap();
-        let real = temp.path().join("real.wav");
-        crate::media::tests::silent_wav(&real, 1);
-        let ffmpeg = Path::new("ffmpeg");
-        let ffprobe = Path::new("ffprobe");
-        let deadline = Duration::from_secs(60);
-        assert!(
-            matches!(
-                measure(ffprobe, ffmpeg, &real, deadline).await,
-                Measurement::Silent { .. }
-            ),
-            "a real file must still be measured"
-        );
-
-        let (address, connections, listener) = crate::media::tests::counting_listener().await;
-        let url = format!("http://{address}/track.flac");
-        assert!(matches!(
-            measure(ffprobe, ffmpeg, Path::new(&url), deadline).await,
-            Measurement::Unreadable(Failure::Decode)
-        ));
-        assert!(spectrogram(ffmpeg, Path::new(&url), false, deadline)
-            .await
-            .is_none());
-        tokio::time::sleep(Duration::from_millis(200)).await;
-        listener.abort();
-        assert_eq!(
-            connections.load(std::sync::atomic::Ordering::SeqCst),
-            0,
-            "neither tool may contact anything"
-        );
-    }
-}
+mod tests;
diff --git a/src/quality/tests.rs b/src/quality/tests.rs
new file mode 100644
index 00000000..499ca300
--- /dev/null
+++ b/src/quality/tests.rs
@@ -0,0 +1,95 @@
+use super::*;
+
+#[test]
+fn a_padded_sixteen_bit_file_uses_sixteen_bits() {
+    // A 16-bit sample decoded to s32 is shifted left by sixteen.
+    assert_eq!(effective_bits(0x7FFF_0000 | 0x0001_0000, false), Some(16));
+    // A 24-bit one by eight, and a genuine one sets its lowest bit.
+    assert_eq!(effective_bits(0x0000_0100, false), Some(24));
+    assert_eq!(effective_bits(0x0000_0001, false), Some(32));
+    assert_eq!(effective_bits(0, false), None);
+    assert_eq!(effective_bits(0x0001_0000, true), None);
+}
+
+#[test]
+fn the_spectrum_is_stored_under_its_loudest_band() {
+    let mut db = vec![-20.0; 2049];
+    for level in db.iter_mut().skip(1500) {
+        *level = -80.0;
+    }
+    let stored = quantise_spectrum(&db);
+    assert_eq!(stored.len(), SPECTRUM_BANDS);
+    assert_eq!(stored[0], 0);
+    assert_eq!(stored[SPECTRUM_BANDS - 1], 120);
+    assert_eq!(spectrum_db(&stored)[SPECTRUM_BANDS - 1], -60.0);
+}
+
+#[test]
+fn a_spectrogram_gives_up_before_the_request_does() {
+    assert_eq!(
+        spectrogram_deadline(Duration::from_secs(30)),
+        Duration::from_secs(20)
+    );
+    assert_eq!(
+        spectrogram_deadline(Duration::from_secs(10)),
+        Duration::from_secs(5)
+    );
+    assert_eq!(
+        spectrogram_deadline(Duration::from_secs(2)),
+        Duration::from_secs(1)
+    );
+    // The shortest setting the configuration accepts still leaves the
+    // route time to answer for itself.
+    assert_eq!(
+        spectrogram_deadline(Duration::from_secs(1)),
+        Duration::from_millis(500)
+    );
+}
+
+#[test]
+fn the_decoder_digest_reads_past_the_first_line() {
+    let one = b"ffmpeg version 8.0\nconfiguration: --enable-libwebp\nlibavcodec 62. 11.100 / 62. 11.100\n";
+    let two = b"ffmpeg version 8.0\nconfiguration: --disable-libwebp\nlibavcodec 62. 11.100 / 62. 11.100\n";
+    let three = b"ffmpeg version 8.0\nconfiguration: --enable-libwebp\nlibavcodec 62. 11.100 / 62. 12.100\n";
+    assert_ne!(decoder_digest(one), decoder_digest(two));
+    assert_ne!(decoder_digest(one), decoder_digest(three));
+    assert_eq!(decoder_digest(one).len(), 64);
+}
+
+/// The probe, the measurement and the spectrogram open files and nothing
+/// else (RFC-023 decision 2): an input that is a URL is refused by
+/// ffprobe and by FFmpeg before either connects to anything, and a real
+/// file still measures.
+#[tokio::test]
+async fn the_analysis_opens_files_and_nothing_else() {
+    let temp = tempfile::tempdir().unwrap();
+    let real = temp.path().join("real.wav");
+    crate::media::tests::silent_wav(&real, 1);
+    let ffmpeg = Path::new("ffmpeg");
+    let ffprobe = Path::new("ffprobe");
+    let deadline = Duration::from_secs(60);
+    assert!(
+        matches!(
+            measure(ffprobe, ffmpeg, &real, deadline).await,
+            Measurement::Silent { .. }
+        ),
+        "a real file must still be measured"
+    );
+
+    let (address, connections, listener) = crate::media::tests::counting_listener().await;
+    let url = format!("http://{address}/track.flac");
+    assert!(matches!(
+        measure(ffprobe, ffmpeg, Path::new(&url), deadline).await,
+        Measurement::Unreadable(Failure::Decode)
+    ));
+    assert!(spectrogram(ffmpeg, Path::new(&url), false, deadline)
+        .await
+        .is_none());
+    tokio::time::sleep(Duration::from_millis(200)).await;
+    listener.abort();
+    assert_eq!(
+        connections.load(std::sync::atomic::Ordering::SeqCst),
+        0,
+        "neither tool may contact anything"
+    );
+}
diff --git a/src/remote/enrichment/engine.rs b/src/remote/enrichment/engine.rs
new file mode 100644
index 00000000..37420522
--- /dev/null
+++ b/src/remote/enrichment/engine.rs
@@ -0,0 +1,415 @@
+//! The engine behind the handle: one fill per provider and name, paced and
+//! bounded, and the verdict an unreached lookup is logged with.
+
+use std::{path::PathBuf, sync::Arc, time::Duration};
+
+use dashmap::DashMap;
+use waveflow_core::metadata::{
+    deezer::{DeezerClient, DeezerError},
+    lastfm::LastfmClient,
+    name_match::{normalize_name, select_by_name},
+    theaudiodb::TheAudioDbClient,
+    LookupError,
+};
+
+use crate::{
+    remote::portrait::{self, AddressPolicy, Refusal},
+    storage::database::Database,
+};
+
+use super::{ArtistAnswer, CachedSimilar, Outcome, Pace, Provider, StoredPortrait, MAX_IN_FLIGHT};
+
+/// How many neighbours are asked for and kept. Subsonic's `getArtistInfo`
+/// defaults to twenty; asking for more leaves room for the ones a caller cannot
+/// see, which decision 7 drops at read time.
+const SIMILAR_LIMIT: u32 = 50;
+
+pub(super) struct Engine {
+    pub(super) db: Database,
+    /// In the operator's order, which is the order fields are merged in.
+    pub(super) sources: Vec<Source>,
+    pub(super) ttl_ms: i64,
+    pub(super) miss_ttl_ms: i64,
+    pub(super) request_timeout: Duration,
+    /// Where fetched portraits are stored: the artwork store.
+    pub(super) artwork_dir: PathBuf,
+    pub(super) image_addresses: AddressPolicy,
+    /// The fills in flight, by provider and canonical name. A visit that finds
+    /// its key here schedules nothing: the fill already running answers it.
+    pub(super) in_flight: DashMap<(Provider, String), ()>,
+    /// How many fills are waiting or running: the count [`MAX_IN_FLIGHT`]
+    /// bounds, and the one [`Enrichment::idle`](super::Enrichment::idle) waits on.
+    pub(super) running: tokio::sync::watch::Sender<usize>,
+}
+
+pub(super) struct Source {
+    pub(super) provider: Provider,
+    pub(super) client: Client,
+    pub(super) pace: Pace,
+}
+
+pub(super) enum Client {
+    LastFm {
+        client: LastfmClient,
+        key: String,
+    },
+    Deezer {
+        client: DeezerClient,
+        image_hosts: Vec<String>,
+    },
+    TheAudioDb {
+        client: TheAudioDbClient,
+        image_hosts: Vec<String>,
+    },
+}
+
+impl Engine {
+    /// Starts a fill for one provider and one name, unless one is running or
+    /// [`MAX_IN_FLIGHT`] are.
+    pub(super) fn schedule(self: Arc<Self>, index: usize, name: &str, canonical: &str) {
+        let key = (self.sources[index].provider, canonical.to_owned());
+        // A place is reserved before the key is claimed, in one step under the
+        // counter's lock: a length read then an insert would let two visits on
+        // two threads both see one place left and both take it.
+        let reserved = self.running.send_if_modified(|count| {
+            let free = *count < MAX_IN_FLIGHT;
+            if free {
+                *count += 1;
+            }
+            free
+        });
+        if !reserved {
+            return;
+        }
+        if self.in_flight.insert(key.clone(), ()).is_some() {
+            self.running.send_modify(|count| *count -= 1);
+            return;
+        }
+        // Released however the fill ends — a panic, or a task dropped before
+        // its first poll included, which is why it is built here rather than
+        // inside the task. A key left behind would stop that name from ever
+        // being asked again.
+        let flight = Flight { engine: self, key };
+        let name = name.to_owned();
+        tokio::spawn(async move {
+            flight.engine.fill(index, &name, &flight.key.1).await;
+            drop(flight);
+        });
+    }
+
+    async fn fill(&self, index: usize, name: &str, canonical: &str) {
+        let source = &self.sources[index];
+        let answer = match &source.client {
+            Client::LastFm { client, key } => self.ask_lastfm(source, client, key, name).await,
+            Client::Deezer {
+                client,
+                image_hosts,
+            } => self.ask_deezer(source, client, image_hosts, name).await,
+            Client::TheAudioDb {
+                client,
+                image_hosts,
+            } => self.ask_theaudiodb(source, client, image_hosts, name).await,
+        };
+        let answer = match answer {
+            Ok(answer) => answer,
+            Err(verdict) => {
+                tracing::warn!(
+                    provider = source.provider.as_str(),
+                    verdict = %verdict,
+                    "artist lookup unreached; nothing cached"
+                );
+                return;
+            }
+        };
+        let fetched_at = crate::auth::authentication::now_ms();
+        let outcome = answer.outcome();
+        let ttl = match outcome {
+            Outcome::Hit => self.ttl_ms,
+            Outcome::Miss => self.miss_ttl_ms,
+        };
+        if let Err(error) = self
+            .db
+            .write_metadata_artist(
+                source.provider,
+                canonical,
+                &answer,
+                fetched_at,
+                fetched_at.saturating_add(ttl),
+            )
+            .await
+        {
+            tracing::warn!(
+                provider = source.provider.as_str(),
+                error = %error,
+                "artist lookup answered but could not be cached"
+            );
+            return;
+        }
+        tracing::debug!(
+            provider = source.provider.as_str(),
+            outcome = outcome.as_str(),
+            "artist lookup cached"
+        );
+    }
+
+    /// `artist.getInfo` and `artist.getSimilar`. Both must be reached for the
+    /// answer to count: half an answer written as a whole one would cache the
+    /// missing half as "nothing" for the TTL.
+    async fn ask_lastfm(
+        &self,
+        source: &Source,
+        client: &LastfmClient,
+        key: &str,
+        name: &str,
+    ) -> Result<ArtistAnswer, Verdict> {
+        source.pace.wait().await;
+        let info = self.bounded(client.artist_get_info(name, key)).await?;
+        source.pace.wait().await;
+        let similar = self
+            .bounded(client.artist_get_similar(name, key, SIMILAR_LIMIT))
+            .await?;
+        let own = waveflow_core::scanner::canonical_name(name);
+        let similar = similar
+            .into_iter()
+            .filter_map(|neighbour| {
+                let name_canonical = waveflow_core::scanner::canonical_name(&neighbour.name);
+                (!name_canonical.is_empty() && name_canonical != own).then(|| CachedSimilar {
+                    name: neighbour.name,
+                    name_canonical,
+                    score: f64::from(neighbour.match_score),
+                })
+            })
+            .collect();
+        let (bio_summary, bio_full) = info
+            .map(|info| (info.bio_summary, info.bio_full))
+            .unwrap_or_default();
+        Ok(ArtistAnswer {
+            bio_summary,
+            bio_full,
+            similar,
+            image: None,
+            fanart: None,
+        })
+    }
+
+    /// The artist search, then the picture it names — decision 8.
+    ///
+    /// No artist by that name, or one without a picture, is a miss. So is a
+    /// picture the fetcher refuses for what it is — off the allowlist, at a
+    /// refused address, not an image, too large — since asking again would
+    /// get the same answer. A picture host that could not be reached is
+    /// unreached, like the search, and writes nothing.
+    async fn ask_deezer(
+        &self,
+        source: &Source,
+        client: &DeezerClient,
+        image_hosts: &[String],
+        name: &str,
+    ) -> Result<ArtistAnswer, Verdict> {
+        source.pace.wait().await;
+        let hits = self.bounded(client.search_artist(name)).await?;
+        let picture = select_by_name(hits, &normalize_name(name), |hit| Some(hit.name.as_str()))
+            .and_then(|hit| hit.best_picture());
+        let Some(picture) = picture else {
+            return Ok(ArtistAnswer::default());
+        };
+        let fetched = portrait::fetch(
+            &picture,
+            image_hosts,
+            self.image_addresses,
+            self.request_timeout,
+        )
+        .await;
+        let portrait = match fetched {
+            Ok(portrait) => portrait,
+            Err(refusal) if refusal.is_answer() => {
+                tracing::warn!(
+                    provider = source.provider.as_str(),
+                    verdict = %refusal,
+                    "artist portrait refused; cached as a miss"
+                );
+                return Ok(ArtistAnswer::default());
+            }
+            Err(refusal) => return Err(Verdict::Image(refusal)),
+        };
+        portrait::store(&self.artwork_dir, &portrait)
+            .await
+            .map_err(|_| Verdict::Store)?;
+        Ok(ArtistAnswer {
+            image: Some(StoredPortrait {
+                hash: portrait.hash,
+                format: portrait.format,
+                byte_size: portrait.bytes.len() as i64,
+            }),
+            ..ArtistAnswer::default()
+        })
+    }
+
+    /// The Deezer source, its client and the hosts its pictures come from.
+    pub(super) fn deezer(&self) -> Option<(&Source, &DeezerClient, &[String])> {
+        self.sources.iter().find_map(|source| match &source.client {
+            Client::Deezer {
+                client,
+                image_hosts,
+            } => Some((source, client, image_hosts.as_slice())),
+            Client::LastFm { .. } | Client::TheAudioDb { .. } => None,
+        })
+    }
+
+    /// The artist search, then the first fanart that is really one (RFC-014
+    /// decision 2).
+    ///
+    /// The fanarts are tried in TheAudioDB's order: one the fetcher refuses
+    /// for what it is gives way to the next, and the first stored ends the
+    /// search. None accepted, or no artist by that name, is a miss. A picture
+    /// host that could not be reached is unreached, like the search, and
+    /// writes nothing: it says nothing about the artist.
+    async fn ask_theaudiodb(
+        &self,
+        source: &Source,
+        client: &TheAudioDbClient,
+        image_hosts: &[String],
+        name: &str,
+    ) -> Result<ArtistAnswer, Verdict> {
+        source.pace.wait().await;
+        // English is asked only because the call takes a language: the
+        // biography it selects is not kept.
+        let Some(artist) = self.bounded(client.artist_info(name, "en")).await? else {
+            return Ok(ArtistAnswer::default());
+        };
+        for fanart in &artist.fanart_urls {
+            source.pace.wait().await;
+            let fetched = portrait::fetch(
+                fanart,
+                image_hosts,
+                self.image_addresses,
+                self.request_timeout,
+            )
+            .await;
+            let picture = match fetched {
+                Ok(picture) => picture,
+                Err(refusal) if refusal.is_answer() => {
+                    tracing::debug!(
+                        provider = source.provider.as_str(),
+                        verdict = %refusal,
+                        "artist fanart refused; trying the next"
+                    );
+                    continue;
+                }
+                Err(refusal) => return Err(Verdict::Image(refusal)),
+            };
+            portrait::store(&self.artwork_dir, &picture)
+                .await
+                .map_err(|_| Verdict::Store)?;
+            return Ok(ArtistAnswer {
+                fanart: Some(StoredPortrait {
+                    hash: picture.hash,
+                    format: picture.format,
+                    byte_size: picture.bytes.len() as i64,
+                }),
+                ..ArtistAnswer::default()
+            });
+        }
+        Ok(ArtistAnswer::default())
+    }
+
+    /// One request, under the request timeout; anything but an answer is a
+    /// verdict.
+    pub(super) async fn bounded<T, E>(
+        &self,
+        request: impl std::future::Future<Output = Result<T, E>>,
+    ) -> Result<T, Verdict>
+    where
+        Verdict: From<E>,
+    {
+        match tokio::time::timeout(self.request_timeout, request).await {
+            Ok(Ok(answer)) => Ok(answer),
+            Ok(Err(error)) => Err(Verdict::from(error)),
+            Err(_) => Err(Verdict::Timeout),
+        }
+    }
+}
+
+/// Releases a fill's key and count when the fill ends.
+struct Flight {
+    engine: Arc<Engine>,
+    key: (Provider, String),
+}
+
+impl Drop for Flight {
+    fn drop(&mut self) {
+        self.engine.in_flight.remove(&self.key);
+        self.engine.running.send_modify(|count| *count -= 1);
+    }
+}
+
+/// Why a lookup was unreached, in words that carry nothing from the request or
+/// the response — no URL, no body, no key.
+#[derive(Debug)]
+pub(super) enum Verdict {
+    Timeout,
+    Transport,
+    Refused {
+        code: i64,
+    },
+    Status {
+        status: u16,
+    },
+    TooLarge,
+    Undecodable,
+    RateLimited,
+    /// The picture host, not the provider, was not reached.
+    Image(Refusal),
+    /// The picture came back and could not be written to the artwork store.
+    Store,
+}
+
+impl From<LookupError> for Verdict {
+    fn from(error: LookupError) -> Self {
+        match error {
+            LookupError::Http(error) if error.is_timeout() => Self::Timeout,
+            LookupError::Http(_) => Self::Transport,
+            LookupError::Refused { code } => Self::Refused { code },
+            LookupError::Status { status } => Self::Status { status },
+            LookupError::TooLarge { .. } => Self::TooLarge,
+            LookupError::Decode(_) => Self::Undecodable,
+        }
+    }
+}
+
+impl From<DeezerError> for Verdict {
+    fn from(error: DeezerError) -> Self {
+        match error {
+            DeezerError::Http(error) if error.is_timeout() => Self::Timeout,
+            DeezerError::Http(error) => {
+                error
+                    .status()
+                    .map_or(Self::Transport, |status| Self::Status {
+                        status: status.as_u16(),
+                    })
+            }
+            DeezerError::Api(error) => Self::Refused {
+                code: error.code.unwrap_or_default(),
+            },
+            DeezerError::RateLimited => Self::RateLimited,
+            DeezerError::TooLarge { .. } => Self::TooLarge,
+            DeezerError::Decode(_) => Self::Undecodable,
+        }
+    }
+}
+
+impl std::fmt::Display for Verdict {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Timeout => formatter.write_str("timed out"),
+            Self::Transport => formatter.write_str("transport failure"),
+            Self::Refused { code } => write!(formatter, "refused with code {code}"),
+            Self::Status { status } => write!(formatter, "answered HTTP {status}"),
+            Self::TooLarge => formatter.write_str("answer over the size ceiling"),
+            Self::Undecodable => formatter.write_str("answer not understood"),
+            Self::RateLimited => formatter.write_str("rate-limited"),
+            Self::Image(refusal) => refusal.fmt(formatter),
+            Self::Store => formatter.write_str("portrait could not be stored"),
+        }
+    }
+}
diff --git a/src/remote/enrichment/handle.rs b/src/remote/enrichment/handle.rs
new file mode 100644
index 00000000..55b4a818
--- /dev/null
+++ b/src/remote/enrichment/handle.rs
@@ -0,0 +1,355 @@
+//! The public face of the engine: building it from the settings, reading the
+//! cache and scheduling fills, and the Deezer portrait search.
+
+use std::{path::PathBuf, sync::Arc, time::Duration};
+
+use dashmap::DashMap;
+use waveflow_core::metadata::{
+    deezer::{is_placeholder_artist_picture, DeezerArtistHit, DeezerClient},
+    lastfm::LastfmClient,
+    theaudiodb::TheAudioDbClient,
+};
+
+use crate::{
+    config::MetadataSettings,
+    remote::portrait::{self, AddressPolicy},
+    storage::database::Database,
+};
+
+use super::{
+    engine::{Client, Engine, Source},
+    CachedArtist, CandidateSearchError, DeezerCandidate, Pace, Provider, StoredPortrait,
+};
+
+/// Last.fm's API root. A constant, not a setting (decision 9): there is no
+/// operator field, so there is no URL to validate.
+const LASTFM_BASE_URL: &str = "https://ws.audioscrobbler.com/2.0/";
+
+/// Deezer's API root, a constant for the same reason. It asks for no key.
+const DEEZER_BASE_URL: &str = "https://api.deezer.com";
+
+/// The hosts Deezer serves its pictures from (decision 8). A picture URL
+/// naming any other host is dropped without being contacted.
+const DEEZER_IMAGE_HOSTS: [&str; 2] = ["e-cdns-images.dzcdn.net", "cdn-images.dzcdn.net"];
+
+/// TheAudioDB's API root, a constant like the others (RFC-014 decision 1). The
+/// operator's key travels in the path, so this URL is never logged either.
+const THEAUDIODB_BASE_URL: &str = "https://www.theaudiodb.com/api/v1/json";
+
+/// The hosts TheAudioDB serves its fanart from (RFC-014 decision 2). A fanart
+/// URL naming any other host is dropped without being contacted.
+const THEAUDIODB_IMAGE_HOSTS: [&str; 2] = ["r2.theaudiodb.com", "www.theaudiodb.com"];
+
+/// TheAudioDB's own ceiling, whatever the shared rate says: thirty requests a
+/// minute on its free tier (RFC-014 decision 5). The pace is the slower of this
+/// and the operator's.
+const THEAUDIODB_INTERVAL: Duration = Duration::from_secs(2);
+
+/// Where each provider is reached. [`Endpoints::default`] is production; the
+/// test suite points these at listeners of its own, which is the only reason
+/// the type exists.
+#[derive(Debug, Clone)]
+pub struct Endpoints {
+    pub lastfm: String,
+    pub deezer: String,
+    /// The hosts a Deezer picture may be fetched from.
+    pub deezer_image_hosts: Vec<String>,
+    pub theaudiodb: String,
+    /// The hosts a TheAudioDB fanart may be fetched from.
+    pub theaudiodb_image_hosts: Vec<String>,
+    /// The addresses a picture may be fetched from. Only the test suite,
+    /// whose image host is on loopback, sets anything but the default.
+    pub image_addresses: AddressPolicy,
+}
+
+impl Default for Endpoints {
+    fn default() -> Self {
+        Self {
+            lastfm: LASTFM_BASE_URL.to_owned(),
+            deezer: DEEZER_BASE_URL.to_owned(),
+            deezer_image_hosts: DEEZER_IMAGE_HOSTS.map(str::to_owned).to_vec(),
+            theaudiodb: THEAUDIODB_BASE_URL.to_owned(),
+            theaudiodb_image_hosts: THEAUDIODB_IMAGE_HOSTS.map(str::to_owned).to_vec(),
+            image_addresses: AddressPolicy::default(),
+        }
+    }
+}
+
+/// The engine, or its absence.
+///
+/// Cheap to clone; every clone drives the same engine. Disabled when no
+/// provider is configured, and then every call returns at once having read and
+/// sent nothing.
+#[derive(Clone)]
+pub struct Enrichment {
+    engine: Option<Arc<Engine>>,
+}
+
+impl Enrichment {
+    /// Enrichment switched off.
+    pub fn disabled() -> Self {
+        Self { engine: None }
+    }
+
+    /// The engine `settings` describe, against the providers' real addresses.
+    pub fn new(
+        db: Database,
+        settings: &MetadataSettings,
+        artwork_dir: PathBuf,
+    ) -> anyhow::Result<Self> {
+        Self::with_endpoints(db, settings, artwork_dir, Endpoints::default())
+    }
+
+    /// [`Self::new`], with the providers reached at `endpoints`.
+    ///
+    /// Only the configured providers are built. A key placed with no provider
+    /// naming it builds nothing — the provider list is the switch, and a key
+    /// is not consent (decision 3). With `WAVEFLOW_METADATA_IMAGES=off`,
+    /// Deezer is not built either: portraits are all it is asked for.
+    pub fn with_endpoints(
+        db: Database,
+        settings: &MetadataSettings,
+        artwork_dir: PathBuf,
+        endpoints: Endpoints,
+    ) -> anyhow::Result<Self> {
+        let mut sources = Vec::new();
+        for &provider in &settings.providers {
+            let http = crate::remote::outbound::client(settings.request_timeout)
+                .map_err(|_| anyhow::anyhow!("the outbound client could not be built"))?;
+            let client = match provider {
+                Provider::LastFm => {
+                    let key = settings.lastfm_key.clone().ok_or_else(|| {
+                        anyhow::anyhow!("metadata provider lastfm is configured without a key")
+                    })?;
+                    Client::LastFm {
+                        client: LastfmClient::with_http(http, endpoints.lastfm.clone())?,
+                        key,
+                    }
+                }
+                Provider::Deezer if !settings.images => continue,
+                Provider::Deezer => Client::Deezer {
+                    client: DeezerClient::with_http(http, endpoints.deezer.clone()),
+                    image_hosts: endpoints.deezer_image_hosts.clone(),
+                },
+                // Banners are all it is asked for (RFC-014 decision 1).
+                Provider::TheAudioDb if !settings.images => continue,
+                Provider::TheAudioDb => {
+                    let key = settings.theaudiodb_key.clone().ok_or_else(|| {
+                        anyhow::anyhow!("metadata provider theaudiodb is configured without a key")
+                    })?;
+                    Client::TheAudioDb {
+                        client: TheAudioDbClient::with_http(
+                            http,
+                            endpoints.theaudiodb.clone(),
+                            key,
+                        )
+                        .map_err(|_| anyhow::anyhow!("the TheAudioDB address is not https"))?,
+                        image_hosts: endpoints.theaudiodb_image_hosts.clone(),
+                    }
+                }
+            };
+            let pace = match provider {
+                Provider::TheAudioDb => {
+                    Pace::with_floor(settings.rate_per_sec, THEAUDIODB_INTERVAL)
+                }
+                Provider::LastFm | Provider::Deezer => Pace::new(settings.rate_per_sec),
+            };
+            sources.push(Source {
+                provider,
+                client,
+                pace,
+            });
+        }
+        if sources.is_empty() {
+            return Ok(Self::disabled());
+        }
+        Ok(Self {
+            engine: Some(Arc::new(Engine {
+                db,
+                sources,
+                ttl_ms: duration_ms(settings.ttl),
+                miss_ttl_ms: duration_ms(settings.miss_ttl),
+                request_timeout: settings.request_timeout,
+                artwork_dir,
+                image_addresses: endpoints.image_addresses,
+                in_flight: DashMap::new(),
+                running: tokio::sync::watch::channel(0).0,
+            })),
+        })
+    }
+
+    pub fn is_enabled(&self) -> bool {
+        self.engine.is_some()
+    }
+
+    /// How many providers are configured — the number of rows a name has
+    /// once every one of them has answered.
+    pub fn provider_count(&self) -> usize {
+        self.engine
+            .as_ref()
+            .map_or(0, |engine| engine.sources.len())
+    }
+
+    /// Whether a portrait may be searched for on Deezer: the operator named
+    /// it and left images on. Asked at every call, never remembered by a
+    /// search (RFC-013 decision 4).
+    pub(crate) fn searches_deezer(&self) -> bool {
+        self.engine
+            .as_ref()
+            .is_some_and(|engine| engine.deezer().is_some())
+    }
+
+    /// Deezer's artists for `query`, in its order, at most `limit` of them,
+    /// each with its picture fetched and stored as a preview (RFC-013
+    /// decision 4).
+    ///
+    /// Every request — the search and each picture — keeps Deezer's pace,
+    /// the one enrichment keeps, so a picker cannot make the server ask
+    /// faster than the operator allowed. A hit with no real picture is not
+    /// offered, nor one whose picture the fetcher refuses for what it is:
+    /// there would be nothing to choose. A picture host that cannot be
+    /// reached fails the whole search, as the search itself failing does.
+    pub(crate) async fn deezer_candidates(
+        &self,
+        query: &str,
+        limit: usize,
+    ) -> Result<Vec<DeezerCandidate>, CandidateSearchError> {
+        let engine = self
+            .engine
+            .as_ref()
+            .ok_or(CandidateSearchError::NotConfigured)?;
+        let (source, client, image_hosts) =
+            engine.deezer().ok_or(CandidateSearchError::NotConfigured)?;
+        source.pace.wait().await;
+        let hits = engine
+            .bounded(client.search_artist(query))
+            .await
+            .map_err(|verdict| {
+                tracing::warn!(
+                    provider = source.provider.as_str(),
+                    verdict = %verdict,
+                    "portrait candidates unreached"
+                );
+                CandidateSearchError::Unreached
+            })?;
+        let mut candidates: Vec<DeezerCandidate> = Vec::new();
+        for hit in hits {
+            if candidates.len() >= limit {
+                break;
+            }
+            if candidates.iter().any(|offered| offered.deezer_id == hit.id) {
+                continue;
+            }
+            let Some(picture) = preview_picture(&hit) else {
+                continue;
+            };
+            source.pace.wait().await;
+            let fetched = portrait::fetch(
+                &picture,
+                image_hosts,
+                engine.image_addresses,
+                engine.request_timeout,
+            )
+            .await;
+            let preview = match fetched {
+                Ok(preview) => preview,
+                Err(refusal) if refusal.is_answer() => continue,
+                Err(refusal) => {
+                    tracing::warn!(
+                        provider = source.provider.as_str(),
+                        verdict = %refusal,
+                        "portrait candidate preview unreached"
+                    );
+                    return Err(CandidateSearchError::Unreached);
+                }
+            };
+            portrait::store(&engine.artwork_dir, &preview)
+                .await
+                .map_err(|_| CandidateSearchError::Unreached)?;
+            candidates.push(DeezerCandidate {
+                deezer_id: hit.id,
+                name: hit.name,
+                fans: hit.nb_fan,
+                preview: StoredPortrait {
+                    hash: preview.hash,
+                    format: preview.format,
+                    byte_size: preview.bytes.len() as i64,
+                },
+            });
+        }
+        Ok(candidates)
+    }
+
+    /// What the cache holds about the artist called `name`, one row per
+    /// configured provider that has one, in the operator's order — and a fill
+    /// scheduled for every configured provider whose row is missing or stale.
+    ///
+    /// Stale rows are returned, not withheld (decision 5): a slightly old
+    /// biography beats none, and serving it keeps a provider outage invisible.
+    /// Nothing here waits on a provider.
+    pub async fn artist(&self, name: &str) -> Result<Vec<CachedArtist>, sqlx::Error> {
+        let Some(engine) = &self.engine else {
+            return Ok(Vec::new());
+        };
+        let canonical = waveflow_core::scanner::canonical_name(name);
+        if canonical.is_empty() {
+            return Ok(Vec::new());
+        }
+        let rows = engine.db.metadata_artist_rows(&canonical).await?;
+        let now = crate::auth::authentication::now_ms();
+        let mut ordered = Vec::new();
+        for (index, source) in engine.sources.iter().enumerate() {
+            let row = rows.iter().find(|row| row.provider == source.provider);
+            if row.is_none_or(|row| row.expires_at <= now) {
+                Arc::clone(engine).schedule(index, name, &canonical);
+            }
+            ordered.extend(row.cloned());
+        }
+        // A portrait already fetched, and an artist row that does not show
+        // it: an artist re-identified by a PID spec change, or one scanned
+        // since. Linked again from the cache, without a second download. A
+        // repair, not the answer: if it fails, the page is still served and
+        // the next visit tries again.
+        if let Some(hash) = ordered.iter().find_map(|row| row.image_hash.as_deref()) {
+            if let Err(error) = engine.db.link_artist_portrait(&canonical, hash).await {
+                tracing::warn!(%error, "cached artist portrait could not be linked");
+            }
+        }
+        // And the banner, by the same reasoning (RFC-014 decision 3).
+        if let Some(hash) = ordered.iter().find_map(|row| row.fanart_hash.as_deref()) {
+            if let Err(error) = engine.db.link_artist_fanart(&canonical, hash).await {
+                tracing::warn!(%error, "cached artist banner could not be linked");
+            }
+        }
+        Ok(ordered)
+    }
+
+    /// Waits until no fill is running.
+    ///
+    /// For the test suite, which has to know a fill is over before it can say
+    /// what the fill wrote — or that it wrote nothing.
+    #[doc(hidden)]
+    pub async fn idle(&self) {
+        let Some(engine) = &self.engine else {
+            return;
+        };
+        let mut running = engine.running.subscribe();
+        // The sender lives as long as the engine, which `self` holds.
+        let _ = running.wait_for(|count| *count == 0).await;
+    }
+}
+
+/// The picture a candidate is previewed at, and kept at if chosen: Deezer's
+/// big size, 500 pixels, since the preview is what becomes the portrait. The
+/// largest real one when that size is missing; none for Deezer's placeholder,
+/// which every size shares.
+fn preview_picture(hit: &DeezerArtistHit) -> Option<String> {
+    hit.picture_big
+        .clone()
+        .filter(|url| !is_placeholder_artist_picture(url))
+        .or_else(|| hit.best_picture())
+}
+
+fn duration_ms(duration: Duration) -> i64 {
+    i64::try_from(duration.as_millis()).unwrap_or(i64::MAX)
+}
diff --git a/src/remote/enrichment/mod.rs b/src/remote/enrichment/mod.rs
new file mode 100644
index 00000000..11ac3476
--- /dev/null
+++ b/src/remote/enrichment/mod.rs
@@ -0,0 +1,83 @@
+//! Metadata enrichment — RFC-011: the cache, and the engine that fills it.
+//!
+//! **Demand-driven and never on the answering path** (decision 6). A reader asks
+//! [`Enrichment::artist`] for what the cache holds; for every configured
+//! provider with nothing fresh, that call schedules a fill in the background
+//! and returns at once. The first visit to an artist shows nothing; the next
+//! one shows what came back.
+//!
+//! **Three outcomes** (decision 5), written on the provider's own row: a *hit*
+//! stands for the long TTL, a *miss* — the provider answered and knows nothing
+//! — for the short one, and *unreached* writes nothing at all, so the next
+//! visit asks again. A network blip must never become "this artist has no
+//! biography" for a month.
+//!
+//! **Bounded per provider**: requests are spaced to the configured rate, and
+//! concurrent first visits for one name collapse onto a single fill. The
+//! writer gate is taken for the row write only, after the requests are over.
+//!
+//! **Nothing about a request is logged but the provider and a verdict.** A
+//! Last.fm request carries the operator's key in its query string; neither the
+//! URL nor a response body is ever written to a log (decision 9).
+
+use std::time::{Duration, Instant};
+
+mod engine;
+mod handle;
+mod model;
+
+pub use handle::{Endpoints, Enrichment};
+pub(crate) use model::{ArtistAnswer, CandidateSearchError, DeezerCandidate, StoredPortrait};
+pub use model::{CachedArtist, CachedSimilar, Outcome, Provider};
+
+/// How many fills may be waiting or running at once, across providers.
+///
+/// Pacing reserves a slot for every request and refuses none, so without this
+/// a page that opens two thousand artists would queue two thousand fills —
+/// a quarter of an hour at the default rate — and an outage, which writes no
+/// row, would let every further visit add more. Beyond the ceiling nothing is
+/// scheduled; the visit after asks again, which is what an unreached lookup
+/// does anyway.
+pub const MAX_IN_FLIGHT: usize = 64;
+
+/// Spaces one provider's requests to its rate: a token bucket that holds one
+/// token, so there is never a burst to spend.
+///
+/// The reservation is taken under the lock and the wait happens outside it, so
+/// callers queue in order without one sleeping caller holding up the rest.
+pub(crate) struct Pace {
+    interval: Duration,
+    next: std::sync::Mutex<Instant>,
+}
+
+impl Pace {
+    pub(crate) fn new(rate_per_sec: u32) -> Self {
+        Self {
+            interval: Duration::from_secs(1) / rate_per_sec.max(1),
+            next: std::sync::Mutex::new(Instant::now()),
+        }
+    }
+
+    /// The operator's rate, but never faster than one request per `floor`:
+    /// a provider's own ceiling, which the shared setting cannot raise.
+    fn with_floor(rate_per_sec: u32, floor: Duration) -> Self {
+        let pace = Self::new(rate_per_sec);
+        Self {
+            interval: pace.interval.max(floor),
+            ..pace
+        }
+    }
+
+    pub(crate) async fn wait(&self) {
+        let slot = {
+            let mut next = self
+                .next
+                .lock()
+                .unwrap_or_else(|poison| poison.into_inner());
+            let slot = (*next).max(Instant::now());
+            *next = slot + self.interval;
+            slot
+        };
+        tokio::time::sleep_until(slot.into()).await;
+    }
+}
diff --git a/src/remote/enrichment/model.rs b/src/remote/enrichment/model.rs
new file mode 100644
index 00000000..97b316b7
--- /dev/null
+++ b/src/remote/enrichment/model.rs
@@ -0,0 +1,140 @@
+//! What the cache holds and what a fill brings back: the providers, their
+//! outcomes, the cached rows, and the portraits and candidates on their way to
+//! the artwork store.
+
+/// A provider an operator can name in `WAVEFLOW_METADATA_PROVIDERS`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum Provider {
+    LastFm,
+    /// Portraits only: Deezer has no biography, and its related artists are
+    /// not asked for.
+    Deezer,
+    /// Banners only (RFC-014): TheAudioDB's fanart. Its biographies wait on a
+    /// language this server does not know.
+    TheAudioDb,
+}
+
+impl Provider {
+    pub fn parse(value: &str) -> Option<Self> {
+        match value {
+            "lastfm" => Some(Self::LastFm),
+            "deezer" => Some(Self::Deezer),
+            "theaudiodb" => Some(Self::TheAudioDb),
+            _ => None,
+        }
+    }
+
+    /// The name in the setting, in the cache's `provider` column, and in logs.
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::LastFm => "lastfm",
+            Self::Deezer => "deezer",
+            Self::TheAudioDb => "theaudiodb",
+        }
+    }
+}
+
+/// What a provider said, when it said something. Unreached has no variant: it
+/// is the absence of a row.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Outcome {
+    Hit,
+    Miss,
+}
+
+impl Outcome {
+    pub fn parse(value: &str) -> Option<Self> {
+        match value {
+            "hit" => Some(Self::Hit),
+            "miss" => Some(Self::Miss),
+            _ => None,
+        }
+    }
+
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Hit => "hit",
+            Self::Miss => "miss",
+        }
+    }
+}
+
+/// One provider's cached row for one name.
+#[derive(Debug, Clone)]
+pub struct CachedArtist {
+    pub provider: Provider,
+    pub outcome: Outcome,
+    pub bio_summary: Option<String>,
+    pub bio_full: Option<String>,
+    /// The portrait this provider supplied, in the artwork store. Cleared by
+    /// the database when the sweeper takes the artwork row.
+    pub image_hash: Option<String>,
+    /// The banner this provider supplied (RFC-014), cleared the same way.
+    pub fanart_hash: Option<String>,
+    pub fetched_at: i64,
+    pub expires_at: i64,
+}
+
+/// A portrait already in the artwork store, waiting for its row.
+#[derive(Debug)]
+pub(crate) struct StoredPortrait {
+    pub(crate) hash: String,
+    pub(crate) format: &'static str,
+    pub(crate) byte_size: i64,
+}
+
+/// A Deezer artist offered as a portrait (RFC-013 decision 4), its preview
+/// already in the artwork store. The row naming the preview is the caller's to
+/// write, with whatever names it.
+#[derive(Debug)]
+pub(crate) struct DeezerCandidate {
+    pub(crate) deezer_id: i64,
+    pub(crate) name: String,
+    pub(crate) fans: Option<i64>,
+    pub(crate) preview: StoredPortrait,
+}
+
+/// Why a search for candidates gave none.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum CandidateSearchError {
+    /// Deezer is not among the operator's providers, or images are off.
+    NotConfigured,
+    /// Deezer, or a picture host it named, could not be reached, or a preview
+    /// could not be stored.
+    Unreached,
+}
+
+/// One neighbour in a provider's cached list.
+#[derive(Debug, Clone)]
+pub struct CachedSimilar {
+    pub name: String,
+    pub name_canonical: String,
+    pub score: f64,
+}
+
+/// What one fill brought back from one provider, before it is written.
+#[derive(Debug, Default)]
+pub(crate) struct ArtistAnswer {
+    pub(crate) bio_summary: Option<String>,
+    pub(crate) bio_full: Option<String>,
+    pub(crate) similar: Vec<CachedSimilar>,
+    pub(crate) image: Option<StoredPortrait>,
+    /// The banner, from TheAudioDB's fanart (RFC-014).
+    pub(crate) fanart: Option<StoredPortrait>,
+}
+
+impl ArtistAnswer {
+    /// A hit carries something; an answer with nothing in it is a miss.
+    pub(crate) fn outcome(&self) -> Outcome {
+        if self.bio_summary.is_some()
+            || self.bio_full.is_some()
+            || !self.similar.is_empty()
+            || self.image.is_some()
+            || self.fanart.is_some()
+        {
+            Outcome::Hit
+        } else {
+            Outcome::Miss
+        }
+    }
+}
diff --git a/src/lrclib.rs b/src/remote/lrclib/mod.rs
similarity index 86%
rename from src/lrclib.rs
rename to src/remote/lrclib/mod.rs
index 7574390a..030f45a1 100644
--- a/src/lrclib.rs
+++ b/src/remote/lrclib/mod.rs
@@ -27,7 +27,7 @@ use std::{sync::Arc, time::Duration};
 use dashmap::DashMap;
 use serde::Deserialize;
 
-use crate::{config::LyricsSettings, database::Database, enrichment::Pace};
+use crate::{config::LyricsSettings, remote::enrichment::Pace, storage::database::Database};
 
 /// LRCLIB's root. A constant, not a setting: there is no operator field, so
 /// there is no URL to validate.
@@ -218,7 +218,7 @@ impl LyricsLookup {
         let Some(&provider) = settings.providers.first() else {
             return Ok(Self::disabled());
         };
-        let http = crate::outbound::builder(settings.request_timeout)
+        let http = crate::remote::outbound::builder(settings.request_timeout)
             .user_agent(USER_AGENT)
             .build()
             .map_err(|_| anyhow::anyhow!("the outbound client could not be built"))?;
@@ -275,7 +275,7 @@ impl LyricsLookup {
         let Some(key) = track.key() else {
             return Ok(None);
         };
-        let now = crate::authentication::now_ms();
+        let now = crate::auth::authentication::now_ms();
         if let Some(row) = engine
             .db
             .lyrics_lookup_row(engine.provider.as_str(), &key)
@@ -380,7 +380,7 @@ impl Engine {
                 return;
             }
         };
-        let fetched_at = crate::authentication::now_ms();
+        let fetched_at = crate::auth::authentication::now_ms();
         let ttl = match answer.outcome {
             LyricsOutcome::Hit | LyricsOutcome::Instrumental => self.ttl_ms,
             LyricsOutcome::Miss => self.miss_ttl_ms,
@@ -516,11 +516,11 @@ fn judge(record: Record, duration_ms: i64) -> Answer {
 /// (`outbound::read_bounded_body`), under the lyrics cap rather than its
 /// general one: a sheet is held to what an upload or a sidecar may weigh.
 async fn read_bounded(response: reqwest::Response, limit: usize) -> Result<Vec<u8>, Verdict> {
-    crate::outbound::read_bounded_body(response, limit)
+    crate::remote::outbound::read_bounded_body(response, limit)
         .await
         .map_err(|error| match error {
-            crate::outbound::BodyError::TooLarge => Verdict::TooLarge,
-            crate::outbound::BodyError::Unread => Verdict::Transport,
+            crate::remote::outbound::BodyError::TooLarge => Verdict::TooLarge,
+            crate::remote::outbound::BodyError::Unread => Verdict::Transport,
         })
 }
 
@@ -579,66 +579,4 @@ fn duration_ms(duration: Duration) -> i64 {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn record(json: &str) -> Record {
-        serde_json::from_str(json).unwrap()
-    }
-
-    #[test]
-    fn a_record_is_judged_by_what_it_carries() {
-        let hit = judge(
-            record(r#"{"duration":234,"plainLyrics":"a","syncedLyrics":"[00:01.00]a"}"#),
-            234_400,
-        );
-        assert_eq!(hit.outcome, LyricsOutcome::Hit);
-        assert_eq!(hit.synced.as_deref(), Some("[00:01.00]a"));
-        let instrumental = judge(record(r#"{"instrumental":true,"plainLyrics":"x"}"#), 1_000);
-        assert_eq!(instrumental.outcome, LyricsOutcome::Instrumental);
-        assert!(instrumental.plain.is_none());
-        let blank = judge(record(r#"{"plainLyrics":"  ","syncedLyrics":null}"#), 1_000);
-        assert_eq!(blank.outcome, LyricsOutcome::Miss);
-    }
-
-    #[test]
-    fn another_duration_is_another_recording() {
-        // Two seconds either way is LRCLIB's own tolerance; three is not.
-        let close = judge(record(r#"{"duration":236,"plainLyrics":"a"}"#), 234_000);
-        assert_eq!(close.outcome, LyricsOutcome::Hit);
-        let far = judge(record(r#"{"duration":237.5,"plainLyrics":"a"}"#), 234_000);
-        assert_eq!(far.outcome, LyricsOutcome::Miss);
-        // An instrumental is held to the same tolerance: another recording's
-        // silence is not this track's answer, and would stand for 30 days.
-        let other = judge(record(r#"{"duration":300,"instrumental":true}"#), 234_000);
-        assert_eq!(other.outcome, LyricsOutcome::Miss);
-        let ours = judge(record(r#"{"duration":235,"instrumental":true}"#), 234_000);
-        assert_eq!(ours.outcome, LyricsOutcome::Instrumental);
-    }
-
-    #[test]
-    fn the_key_folds_spelling_and_refuses_what_cannot_match() {
-        let track = |artist: &str, title: &str, duration_ms| TrackLookup {
-            artist: artist.into(),
-            title: title.into(),
-            album: Some("Post".into()),
-            duration_ms,
-        };
-        assert_eq!(
-            track("Björk", "Army of Me", 234_000).key(),
-            track("BJÖRK", "army of me", 234_200).key()
-        );
-        assert_ne!(
-            track("Björk", "Army of Me", 234_000).key(),
-            track("Björk", "Army of Me", 236_000).key()
-        );
-        assert!(track("", "Army of Me", 234_000).key().is_none());
-        assert!(track("Björk", "Army of Me", 0).key().is_none());
-    }
-
-    #[test]
-    fn the_user_agent_names_the_project() {
-        assert!(USER_AGENT.starts_with("WaveFlowServer/"));
-        assert!(USER_AGENT.ends_with("(https://github.com/InstaZDLL/waveflow-server)"));
-    }
-}
+mod tests;
diff --git a/src/remote/lrclib/tests.rs b/src/remote/lrclib/tests.rs
new file mode 100644
index 00000000..bf5e7f04
--- /dev/null
+++ b/src/remote/lrclib/tests.rs
@@ -0,0 +1,61 @@
+use super::*;
+
+fn record(json: &str) -> Record {
+    serde_json::from_str(json).unwrap()
+}
+
+#[test]
+fn a_record_is_judged_by_what_it_carries() {
+    let hit = judge(
+        record(r#"{"duration":234,"plainLyrics":"a","syncedLyrics":"[00:01.00]a"}"#),
+        234_400,
+    );
+    assert_eq!(hit.outcome, LyricsOutcome::Hit);
+    assert_eq!(hit.synced.as_deref(), Some("[00:01.00]a"));
+    let instrumental = judge(record(r#"{"instrumental":true,"plainLyrics":"x"}"#), 1_000);
+    assert_eq!(instrumental.outcome, LyricsOutcome::Instrumental);
+    assert!(instrumental.plain.is_none());
+    let blank = judge(record(r#"{"plainLyrics":"  ","syncedLyrics":null}"#), 1_000);
+    assert_eq!(blank.outcome, LyricsOutcome::Miss);
+}
+
+#[test]
+fn another_duration_is_another_recording() {
+    // Two seconds either way is LRCLIB's own tolerance; three is not.
+    let close = judge(record(r#"{"duration":236,"plainLyrics":"a"}"#), 234_000);
+    assert_eq!(close.outcome, LyricsOutcome::Hit);
+    let far = judge(record(r#"{"duration":237.5,"plainLyrics":"a"}"#), 234_000);
+    assert_eq!(far.outcome, LyricsOutcome::Miss);
+    // An instrumental is held to the same tolerance: another recording's
+    // silence is not this track's answer, and would stand for 30 days.
+    let other = judge(record(r#"{"duration":300,"instrumental":true}"#), 234_000);
+    assert_eq!(other.outcome, LyricsOutcome::Miss);
+    let ours = judge(record(r#"{"duration":235,"instrumental":true}"#), 234_000);
+    assert_eq!(ours.outcome, LyricsOutcome::Instrumental);
+}
+
+#[test]
+fn the_key_folds_spelling_and_refuses_what_cannot_match() {
+    let track = |artist: &str, title: &str, duration_ms| TrackLookup {
+        artist: artist.into(),
+        title: title.into(),
+        album: Some("Post".into()),
+        duration_ms,
+    };
+    assert_eq!(
+        track("Björk", "Army of Me", 234_000).key(),
+        track("BJÖRK", "army of me", 234_200).key()
+    );
+    assert_ne!(
+        track("Björk", "Army of Me", 234_000).key(),
+        track("Björk", "Army of Me", 236_000).key()
+    );
+    assert!(track("", "Army of Me", 234_000).key().is_none());
+    assert!(track("Björk", "Army of Me", 0).key().is_none());
+}
+
+#[test]
+fn the_user_agent_names_the_project() {
+    assert!(USER_AGENT.starts_with("WaveFlowServer/"));
+    assert!(USER_AGENT.ends_with("(https://github.com/InstaZDLL/waveflow-server)"));
+}
diff --git a/src/remote/mod.rs b/src/remote/mod.rs
new file mode 100644
index 00000000..4c824913
--- /dev/null
+++ b/src/remote/mod.rs
@@ -0,0 +1,10 @@
+//! Everything that talks to another host: the outbound HTTP client, metadata
+//! enrichment and the portraits it fetches, LRCLIB lyrics, podcast feeds and
+//! the scrobbling adapters.
+
+pub mod enrichment;
+pub mod lrclib;
+pub mod outbound;
+pub mod podcast;
+pub mod portrait;
+pub mod scrobblers;
diff --git a/src/outbound.rs b/src/remote/outbound/mod.rs
similarity index 58%
rename from src/outbound.rs
rename to src/remote/outbound/mod.rs
index c53e9ffa..fb165221 100644
--- a/src/outbound.rs
+++ b/src/remote/outbound/mod.rs
@@ -121,94 +121,4 @@ pub async fn read_bounded_body(
 }
 
 #[cfg(test)]
-pub(crate) mod tests {
-    use std::time::Duration;
-
-    use super::{read_bounded_body, BodyError};
-
-    /// A listener answering its first request with `body` and every later one
-    /// with nothing. A body built from bytes declares its length; one built
-    /// from a stream is chunked and declares none.
-    pub(crate) async fn answering(body: axum::body::Body) -> (String, tokio::task::JoinHandle<()>) {
-        let body = std::sync::Arc::new(std::sync::Mutex::new(Some(body)));
-        let router = axum::Router::new().fallback(move || {
-            let body = std::sync::Arc::clone(&body);
-            async move {
-                let body = body
-                    .lock()
-                    .unwrap()
-                    .take()
-                    .unwrap_or_else(axum::body::Body::empty);
-                axum::response::Response::builder()
-                    .status(200)
-                    .header("content-type", "application/json")
-                    .body(body)
-                    .unwrap()
-            }
-        });
-        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let address = listener.local_addr().unwrap();
-        let server = tokio::spawn(async move {
-            let _ = axum::serve(listener, router).await;
-        });
-        (format!("http://{address}/"), server)
-    }
-
-    /// A body that never ends: the same block of spaces, forever.
-    pub(crate) fn endless(prefix: &'static str) -> axum::body::Body {
-        let head = futures_util::stream::once(async move {
-            Ok::<_, std::io::Error>(bytes::Bytes::from_static(prefix.as_bytes()))
-        });
-        let tail = futures_util::stream::repeat_with(|| {
-            Ok::<_, std::io::Error>(bytes::Bytes::from(vec![b' '; 64 * 1024]))
-        });
-        axum::body::Body::from_stream(futures_util::StreamExt::chain(head, tail))
-    }
-
-    async fn read(body: axum::body::Body, limit: usize) -> Result<Vec<u8>, BodyError> {
-        let (url, server) = answering(body).await;
-        let client = super::client(Duration::from_secs(5)).unwrap();
-        let response = client.get(url).send().await.unwrap();
-        // Bounded by the test, not by the reader: without the ceiling, the
-        // endless body below is read until memory runs out, and this is what
-        // turns that into a failure with a reason.
-        let read =
-            tokio::time::timeout(Duration::from_secs(20), read_bounded_body(response, limit))
-                .await
-                .expect("a bounded read must end on its own");
-        server.abort();
-        read
-    }
-
-    #[tokio::test]
-    async fn an_answer_within_the_ceiling_is_read_whole() {
-        let body = read(axum::body::Body::from("{\"ok\":true}"), 1024).await;
-        assert_eq!(body.unwrap(), b"{\"ok\":true}");
-    }
-
-    /// The case `Content-Length` alone cannot catch: a chunked body that
-    /// never says how long it is, and never stops.
-    #[tokio::test]
-    async fn an_endless_answer_is_cut_off_at_the_ceiling() {
-        let body = read(endless("{\"status\":\"failure\""), 1024 * 1024).await;
-        assert_eq!(body, Err(BodyError::TooLarge));
-    }
-
-    /// A chunked answer that ends, but past the ceiling: the running count,
-    /// not the header, is what refuses it.
-    #[tokio::test]
-    async fn an_unannounced_answer_over_the_ceiling_is_refused() {
-        let chunks = futures_util::stream::iter(
-            (0..4).map(|_| Ok::<_, std::io::Error>(bytes::Bytes::from(vec![b'x'; 512]))),
-        );
-        let body = read(axum::body::Body::from_stream(chunks), 1024).await;
-        assert_eq!(body, Err(BodyError::TooLarge));
-    }
-
-    /// An answer that says up front it is too large is refused unread.
-    #[tokio::test]
-    async fn an_announced_giant_is_refused() {
-        let body = read(axum::body::Body::from(vec![b'x'; 4096]), 1024).await;
-        assert_eq!(body, Err(BodyError::TooLarge));
-    }
-}
+pub(crate) mod tests;
diff --git a/src/remote/outbound/tests.rs b/src/remote/outbound/tests.rs
new file mode 100644
index 00000000..af51414e
--- /dev/null
+++ b/src/remote/outbound/tests.rs
@@ -0,0 +1,88 @@
+use std::time::Duration;
+
+use super::{read_bounded_body, BodyError};
+
+/// A listener answering its first request with `body` and every later one
+/// with nothing. A body built from bytes declares its length; one built
+/// from a stream is chunked and declares none.
+pub(crate) async fn answering(body: axum::body::Body) -> (String, tokio::task::JoinHandle<()>) {
+    let body = std::sync::Arc::new(std::sync::Mutex::new(Some(body)));
+    let router = axum::Router::new().fallback(move || {
+        let body = std::sync::Arc::clone(&body);
+        async move {
+            let body = body
+                .lock()
+                .unwrap()
+                .take()
+                .unwrap_or_else(axum::body::Body::empty);
+            axum::response::Response::builder()
+                .status(200)
+                .header("content-type", "application/json")
+                .body(body)
+                .unwrap()
+        }
+    });
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let address = listener.local_addr().unwrap();
+    let server = tokio::spawn(async move {
+        let _ = axum::serve(listener, router).await;
+    });
+    (format!("http://{address}/"), server)
+}
+
+/// A body that never ends: the same block of spaces, forever.
+pub(crate) fn endless(prefix: &'static str) -> axum::body::Body {
+    let head = futures_util::stream::once(async move {
+        Ok::<_, std::io::Error>(bytes::Bytes::from_static(prefix.as_bytes()))
+    });
+    let tail = futures_util::stream::repeat_with(|| {
+        Ok::<_, std::io::Error>(bytes::Bytes::from(vec![b' '; 64 * 1024]))
+    });
+    axum::body::Body::from_stream(futures_util::StreamExt::chain(head, tail))
+}
+
+async fn read(body: axum::body::Body, limit: usize) -> Result<Vec<u8>, BodyError> {
+    let (url, server) = answering(body).await;
+    let client = super::client(Duration::from_secs(5)).unwrap();
+    let response = client.get(url).send().await.unwrap();
+    // Bounded by the test, not by the reader: without the ceiling, the
+    // endless body below is read until memory runs out, and this is what
+    // turns that into a failure with a reason.
+    let read = tokio::time::timeout(Duration::from_secs(20), read_bounded_body(response, limit))
+        .await
+        .expect("a bounded read must end on its own");
+    server.abort();
+    read
+}
+
+#[tokio::test]
+async fn an_answer_within_the_ceiling_is_read_whole() {
+    let body = read(axum::body::Body::from("{\"ok\":true}"), 1024).await;
+    assert_eq!(body.unwrap(), b"{\"ok\":true}");
+}
+
+/// The case `Content-Length` alone cannot catch: a chunked body that
+/// never says how long it is, and never stops.
+#[tokio::test]
+async fn an_endless_answer_is_cut_off_at_the_ceiling() {
+    let body = read(endless("{\"status\":\"failure\""), 1024 * 1024).await;
+    assert_eq!(body, Err(BodyError::TooLarge));
+}
+
+/// A chunked answer that ends, but past the ceiling: the running count,
+/// not the header, is what refuses it.
+#[tokio::test]
+async fn an_unannounced_answer_over_the_ceiling_is_refused() {
+    let chunks = futures_util::stream::iter(
+        (0..4).map(|_| Ok::<_, std::io::Error>(bytes::Bytes::from(vec![b'x'; 512]))),
+    );
+    let body = read(axum::body::Body::from_stream(chunks), 1024).await;
+    assert_eq!(body, Err(BodyError::TooLarge));
+}
+
+/// An answer that says up front it is too large is refused unread.
+#[tokio::test]
+async fn an_announced_giant_is_refused() {
+    let body = read(axum::body::Body::from(vec![b'x'; 4096]), 1024).await;
+    assert_eq!(body, Err(BodyError::TooLarge));
+}
diff --git a/src/podcast.rs b/src/remote/podcast/mod.rs
similarity index 73%
rename from src/podcast.rs
rename to src/remote/podcast/mod.rs
index 0caebc3c..e6918f59 100644
--- a/src/podcast.rs
+++ b/src/remote/podcast/mod.rs
@@ -32,7 +32,7 @@ use std::{
     time::Duration,
 };
 
-use crate::portrait::AddressPolicy;
+use crate::remote::portrait::AddressPolicy;
 
 /// How many redirects one fetch follows. Enclosures commonly pass through one
 /// or two measurement prefixes on their way to a CDN; five leaves room for
@@ -182,7 +182,7 @@ pub async fn open(url: &url::Url, policy: FetchPolicy) -> Result<reqwest::Respon
             .host_str()
             .ok_or(FetchError::Destination)?
             .to_owned();
-        let mut builder = crate::outbound::builder(policy.timeout);
+        let mut builder = crate::remote::outbound::builder(policy.timeout);
         if matches!(current.host(), Some(url::Host::Domain(_))) {
             builder = builder.resolve(&host, pinned);
         }
@@ -222,11 +222,11 @@ pub async fn fetch_bounded(
         let response = open(url, policy).await?;
         // The shared bounded read (RFC-023 decision 1): the same two checks,
         // written once for every fetcher.
-        crate::outbound::read_bounded_body(response, max_bytes)
+        crate::remote::outbound::read_bounded_body(response, max_bytes)
             .await
             .map_err(|error| match error {
-                crate::outbound::BodyError::TooLarge => FetchError::TooLarge,
-                crate::outbound::BodyError::Unread => FetchError::Unreached,
+                crate::remote::outbound::BodyError::TooLarge => FetchError::TooLarge,
+                crate::remote::outbound::BodyError::Unread => FetchError::Unreached,
             })
     };
     tokio::time::timeout(policy.timeout, within)
@@ -610,220 +610,4 @@ pub fn sniff_audio(head: &[u8]) -> Option<(&'static str, &'static str)> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn base() -> url::Url {
-        url::Url::parse("https://feeds.example.org/show.xml").unwrap()
-    }
-
-    #[test]
-    fn an_rss_feed_is_read_newest_first_and_an_item_without_audio_is_skipped() {
-        let feed = parse_feed(
-            br#"<?xml version="1.0" encoding="UTF-8"?>
-<rss version="2.0" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd">
-  <channel>
-    <title>The Show</title>
-    <description><![CDATA[<p>About <b>things</b></p>]]></description>
-    <link>https://example.org/</link>
-    <itunes:image href="https://example.org/cover.jpg"/>
-    <item>
-      <title>First</title>
-      <guid>ep-1</guid>
-      <pubDate>Mon, 01 Jan 2024 10:00:00 +0000</pubDate>
-      <itunes:duration>1:02:03</itunes:duration>
-      <enclosure url="/audio/1.mp3" type="audio/mpeg" length="1234"/>
-    </item>
-    <item>
-      <title>Second</title>
-      <pubDate>Tue, 02 Jan 2024 10:00:00 +0000</pubDate>
-      <enclosure url="https://cdn.example.org/2.mp3" type="audio/mpeg"/>
-    </item>
-    <item><title>No audio</title></item>
-  </channel>
-</rss>"#,
-            &base(),
-        )
-        .unwrap();
-        assert_eq!(feed.title, "The Show");
-        assert_eq!(feed.description.as_deref(), Some("About things"));
-        assert_eq!(
-            feed.image_url.as_deref(),
-            Some("https://example.org/cover.jpg")
-        );
-        assert_eq!(feed.episodes.len(), 2);
-        assert_eq!(feed.episodes[0].title, "Second");
-        assert_eq!(feed.episodes[0].guid, "https://cdn.example.org/2.mp3");
-        assert_eq!(
-            feed.episodes[1].enclosure_url,
-            "https://feeds.example.org/audio/1.mp3"
-        );
-        assert_eq!(feed.episodes[1].duration_ms, Some(3_723_000));
-        assert_eq!(feed.episodes[1].enclosure_length, Some(1234));
-    }
-
-    #[test]
-    fn an_atom_feed_is_read() {
-        let feed = parse_feed(
-            br#"<feed xmlns="http://www.w3.org/2005/Atom">
-  <title>Atom Show</title>
-  <entry>
-    <id>urn:1</id><title>One</title><updated>2024-03-01T00:00:00Z</updated>
-    <link rel="enclosure" href="https://cdn.example.org/1.ogg" type="audio/ogg"/>
-  </entry>
-</feed>"#,
-            &base(),
-        )
-        .unwrap();
-        assert_eq!(feed.title, "Atom Show");
-        assert_eq!(feed.episodes[0].guid, "urn:1");
-        assert_eq!(feed.episodes[0].published_at, Some(1_709_251_200_000));
-    }
-
-    /// The billion laughs, and its quieter relatives: any DTD is refused, so no
-    /// entity is declared and nothing expands.
-    #[test]
-    fn a_document_type_declaration_is_refused_outright() {
-        let laughs = br#"<?xml version="1.0"?>
-<!DOCTYPE lolz [<!ENTITY lol "lol"><!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">]>
-<rss><channel><title>&lol2;</title></channel></rss>"#;
-        assert_eq!(parse_feed(laughs, &base()), Err(FeedError::Invalid));
-        let external = br#"<?xml version="1.0"?>
-<!DOCTYPE rss [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
-<rss><channel><title>&xxe;</title></channel></rss>"#;
-        assert_eq!(parse_feed(external, &base()), Err(FeedError::Invalid));
-        assert_eq!(parse_feed(b"not xml", &base()), Err(FeedError::Invalid));
-        assert_eq!(
-            parse_feed(b"<html><body/></html>", &base()),
-            Err(FeedError::Invalid)
-        );
-    }
-
-    #[test]
-    fn an_enclosure_that_is_not_http_is_not_an_episode() {
-        let feed = parse_feed(
-            br#"<rss><channel><title>T</title>
-<item><enclosure url="file:///etc/passwd"/></item>
-<item><enclosure url="javascript:alert(1)"/></item>
-</channel></rss>"#,
-            &base(),
-        )
-        .unwrap();
-        assert!(feed.episodes.is_empty());
-    }
-
-    /// A secure address may move anywhere secure, a clear one anywhere; a
-    /// secure one may not move into the clear. A scheme-relative target
-    /// (`//host/path`) keeps the scheme it came from, so it never downgrades.
-    #[test]
-    fn a_redirect_never_leaves_https_for_http() {
-        let secure = url::Url::parse("https://feeds.example.org/show.xml?auth=t").unwrap();
-        let clear = url::Url::parse("http://feeds.example.org/show.xml").unwrap();
-        assert_eq!(
-            next_hop(&secure, "https://cdn.example.org/show.xml")
-                .unwrap()
-                .as_str(),
-            "https://cdn.example.org/show.xml"
-        );
-        assert_eq!(
-            next_hop(&secure, "/moved.xml").unwrap().as_str(),
-            "https://feeds.example.org/moved.xml"
-        );
-        assert_eq!(
-            next_hop(&secure, "//cdn.example.org/show.xml")
-                .unwrap()
-                .as_str(),
-            "https://cdn.example.org/show.xml"
-        );
-        assert_eq!(
-            next_hop(&clear, "//cdn.example.org/show.xml")
-                .unwrap()
-                .as_str(),
-            "http://cdn.example.org/show.xml"
-        );
-        assert_eq!(
-            next_hop(&clear, "https://cdn.example.org/show.xml")
-                .unwrap()
-                .as_str(),
-            "https://cdn.example.org/show.xml"
-        );
-        assert_eq!(
-            next_hop(&clear, "http://cdn.example.org/show.xml")
-                .unwrap()
-                .as_str(),
-            "http://cdn.example.org/show.xml"
-        );
-        assert_eq!(
-            next_hop(&secure, "http://cdn.example.org/show.xml"),
-            Err(FetchError::Destination)
-        );
-        assert_eq!(
-            next_hop(&secure, "HTTP://cdn.example.org/show.xml"),
-            Err(FetchError::Destination)
-        );
-    }
-
-    #[test]
-    fn a_feed_address_is_absolute_http_and_carries_no_credentials() {
-        let public = AddressPolicy::Public;
-        assert!(validate_feed_url("https://example.org/feed", false, public).is_some());
-        assert!(validate_feed_url("http://example.org/feed", false, public).is_none());
-        assert!(validate_feed_url("http://example.org/feed", true, public).is_some());
-        assert!(validate_feed_url("https://user:secret@example.org/feed", true, public).is_none());
-        assert!(validate_feed_url("file:///etc/passwd", true, public).is_none());
-        assert!(validate_feed_url("ftp://example.org/feed", true, public).is_none());
-        assert!(validate_feed_url("/feed.xml", true, public).is_none());
-    }
-
-    #[test]
-    fn audio_is_recognised_by_its_bytes() {
-        assert_eq!(sniff_audio(b"ID3\x04\0\0").map(|f| f.0), Some("mp3"));
-        assert_eq!(
-            sniff_audio(&[0xff, 0xfb, 0x90, 0x00]).map(|f| f.0),
-            Some("mp3")
-        );
-        assert_eq!(sniff_audio(b"\0\0\0\x20ftypM4A ").map(|f| f.0), Some("m4a"));
-        assert_eq!(sniff_audio(b"OggS\0\x02").map(|f| f.0), Some("ogg"));
-        assert_eq!(sniff_audio(b"<html>").map(|f| f.0), None);
-        assert_eq!(sniff_audio(b"MZ\x90\0").map(|f| f.0), None);
-    }
-
-    /// Text is cut where it passes its bound, exactly where the earlier count
-    /// cut it. The count is now kept as characters are pushed rather than
-    /// recomputed for each one; that recount was measured and is not slow in
-    /// practice — std's character count runs optimized even in a debug build,
-    /// and the feed above parses in well under a second either way — so this
-    /// test holds the behaviour, not a timing.
-    #[test]
-    fn long_texts_are_cut_where_they_pass_their_bound() {
-        let description = "word ".repeat(1_600);
-        let items: String = (0..MAX_EPISODES_PER_FEED)
-            .map(|index| {
-                format!(
-                    "<item><title>Episode {index}</title><description>{description}</description>\
-                     <enclosure url=\"https://cdn.example.org/{index}.mp3\"/></item>"
-                )
-            })
-            .collect();
-        let document = format!("<rss><channel><title>Long</title>{items}</channel></rss>");
-        let feed = parse_feed(document.as_bytes(), &base()).unwrap();
-        assert_eq!(feed.episodes.len(), MAX_EPISODES_PER_FEED);
-        let kept = feed.episodes[0].description.as_deref().unwrap();
-        assert_eq!(
-            kept.chars().count(),
-            MAX_DESCRIPTION_CHARS - 1,
-            "trimmed of its last space"
-        );
-        assert_eq!(plain_text("a <b>b</b>  c", 100), "a b c");
-        assert_eq!(plain_text("abcdef", 3), "abc");
-    }
-
-    #[test]
-    fn durations_take_the_three_spellings() {
-        assert_eq!(parse_duration("90"), Some(90_000));
-        assert_eq!(parse_duration("01:30"), Some(90_000));
-        assert_eq!(parse_duration("1:00:00"), Some(3_600_000));
-        assert_eq!(parse_duration("x"), None);
-        assert_eq!(parse_duration("1:2:3:4"), None);
-    }
-}
+mod tests;
diff --git a/src/remote/podcast/tests.rs b/src/remote/podcast/tests.rs
new file mode 100644
index 00000000..f01a04a2
--- /dev/null
+++ b/src/remote/podcast/tests.rs
@@ -0,0 +1,215 @@
+use super::*;
+
+fn base() -> url::Url {
+    url::Url::parse("https://feeds.example.org/show.xml").unwrap()
+}
+
+#[test]
+fn an_rss_feed_is_read_newest_first_and_an_item_without_audio_is_skipped() {
+    let feed = parse_feed(
+        br#"<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd">
+  <channel>
+    <title>The Show</title>
+    <description><![CDATA[<p>About <b>things</b></p>]]></description>
+    <link>https://example.org/</link>
+    <itunes:image href="https://example.org/cover.jpg"/>
+    <item>
+      <title>First</title>
+      <guid>ep-1</guid>
+      <pubDate>Mon, 01 Jan 2024 10:00:00 +0000</pubDate>
+      <itunes:duration>1:02:03</itunes:duration>
+      <enclosure url="/audio/1.mp3" type="audio/mpeg" length="1234"/>
+    </item>
+    <item>
+      <title>Second</title>
+      <pubDate>Tue, 02 Jan 2024 10:00:00 +0000</pubDate>
+      <enclosure url="https://cdn.example.org/2.mp3" type="audio/mpeg"/>
+    </item>
+    <item><title>No audio</title></item>
+  </channel>
+</rss>"#,
+        &base(),
+    )
+    .unwrap();
+    assert_eq!(feed.title, "The Show");
+    assert_eq!(feed.description.as_deref(), Some("About things"));
+    assert_eq!(
+        feed.image_url.as_deref(),
+        Some("https://example.org/cover.jpg")
+    );
+    assert_eq!(feed.episodes.len(), 2);
+    assert_eq!(feed.episodes[0].title, "Second");
+    assert_eq!(feed.episodes[0].guid, "https://cdn.example.org/2.mp3");
+    assert_eq!(
+        feed.episodes[1].enclosure_url,
+        "https://feeds.example.org/audio/1.mp3"
+    );
+    assert_eq!(feed.episodes[1].duration_ms, Some(3_723_000));
+    assert_eq!(feed.episodes[1].enclosure_length, Some(1234));
+}
+
+#[test]
+fn an_atom_feed_is_read() {
+    let feed = parse_feed(
+        br#"<feed xmlns="http://www.w3.org/2005/Atom">
+  <title>Atom Show</title>
+  <entry>
+    <id>urn:1</id><title>One</title><updated>2024-03-01T00:00:00Z</updated>
+    <link rel="enclosure" href="https://cdn.example.org/1.ogg" type="audio/ogg"/>
+  </entry>
+</feed>"#,
+        &base(),
+    )
+    .unwrap();
+    assert_eq!(feed.title, "Atom Show");
+    assert_eq!(feed.episodes[0].guid, "urn:1");
+    assert_eq!(feed.episodes[0].published_at, Some(1_709_251_200_000));
+}
+
+/// The billion laughs, and its quieter relatives: any DTD is refused, so no
+/// entity is declared and nothing expands.
+#[test]
+fn a_document_type_declaration_is_refused_outright() {
+    let laughs = br#"<?xml version="1.0"?>
+<!DOCTYPE lolz [<!ENTITY lol "lol"><!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">]>
+<rss><channel><title>&lol2;</title></channel></rss>"#;
+    assert_eq!(parse_feed(laughs, &base()), Err(FeedError::Invalid));
+    let external = br#"<?xml version="1.0"?>
+<!DOCTYPE rss [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+<rss><channel><title>&xxe;</title></channel></rss>"#;
+    assert_eq!(parse_feed(external, &base()), Err(FeedError::Invalid));
+    assert_eq!(parse_feed(b"not xml", &base()), Err(FeedError::Invalid));
+    assert_eq!(
+        parse_feed(b"<html><body/></html>", &base()),
+        Err(FeedError::Invalid)
+    );
+}
+
+#[test]
+fn an_enclosure_that_is_not_http_is_not_an_episode() {
+    let feed = parse_feed(
+        br#"<rss><channel><title>T</title>
+<item><enclosure url="file:///etc/passwd"/></item>
+<item><enclosure url="javascript:alert(1)"/></item>
+</channel></rss>"#,
+        &base(),
+    )
+    .unwrap();
+    assert!(feed.episodes.is_empty());
+}
+
+/// A secure address may move anywhere secure, a clear one anywhere; a
+/// secure one may not move into the clear. A scheme-relative target
+/// (`//host/path`) keeps the scheme it came from, so it never downgrades.
+#[test]
+fn a_redirect_never_leaves_https_for_http() {
+    let secure = url::Url::parse("https://feeds.example.org/show.xml?auth=t").unwrap();
+    let clear = url::Url::parse("http://feeds.example.org/show.xml").unwrap();
+    assert_eq!(
+        next_hop(&secure, "https://cdn.example.org/show.xml")
+            .unwrap()
+            .as_str(),
+        "https://cdn.example.org/show.xml"
+    );
+    assert_eq!(
+        next_hop(&secure, "/moved.xml").unwrap().as_str(),
+        "https://feeds.example.org/moved.xml"
+    );
+    assert_eq!(
+        next_hop(&secure, "//cdn.example.org/show.xml")
+            .unwrap()
+            .as_str(),
+        "https://cdn.example.org/show.xml"
+    );
+    assert_eq!(
+        next_hop(&clear, "//cdn.example.org/show.xml")
+            .unwrap()
+            .as_str(),
+        "http://cdn.example.org/show.xml"
+    );
+    assert_eq!(
+        next_hop(&clear, "https://cdn.example.org/show.xml")
+            .unwrap()
+            .as_str(),
+        "https://cdn.example.org/show.xml"
+    );
+    assert_eq!(
+        next_hop(&clear, "http://cdn.example.org/show.xml")
+            .unwrap()
+            .as_str(),
+        "http://cdn.example.org/show.xml"
+    );
+    assert_eq!(
+        next_hop(&secure, "http://cdn.example.org/show.xml"),
+        Err(FetchError::Destination)
+    );
+    assert_eq!(
+        next_hop(&secure, "HTTP://cdn.example.org/show.xml"),
+        Err(FetchError::Destination)
+    );
+}
+
+#[test]
+fn a_feed_address_is_absolute_http_and_carries_no_credentials() {
+    let public = AddressPolicy::Public;
+    assert!(validate_feed_url("https://example.org/feed", false, public).is_some());
+    assert!(validate_feed_url("http://example.org/feed", false, public).is_none());
+    assert!(validate_feed_url("http://example.org/feed", true, public).is_some());
+    assert!(validate_feed_url("https://user:secret@example.org/feed", true, public).is_none());
+    assert!(validate_feed_url("file:///etc/passwd", true, public).is_none());
+    assert!(validate_feed_url("ftp://example.org/feed", true, public).is_none());
+    assert!(validate_feed_url("/feed.xml", true, public).is_none());
+}
+
+#[test]
+fn audio_is_recognised_by_its_bytes() {
+    assert_eq!(sniff_audio(b"ID3\x04\0\0").map(|f| f.0), Some("mp3"));
+    assert_eq!(
+        sniff_audio(&[0xff, 0xfb, 0x90, 0x00]).map(|f| f.0),
+        Some("mp3")
+    );
+    assert_eq!(sniff_audio(b"\0\0\0\x20ftypM4A ").map(|f| f.0), Some("m4a"));
+    assert_eq!(sniff_audio(b"OggS\0\x02").map(|f| f.0), Some("ogg"));
+    assert_eq!(sniff_audio(b"<html>").map(|f| f.0), None);
+    assert_eq!(sniff_audio(b"MZ\x90\0").map(|f| f.0), None);
+}
+
+/// Text is cut where it passes its bound, exactly where the earlier count
+/// cut it. The count is now kept as characters are pushed rather than
+/// recomputed for each one; that recount was measured and is not slow in
+/// practice — std's character count runs optimized even in a debug build,
+/// and the feed above parses in well under a second either way — so this
+/// test holds the behaviour, not a timing.
+#[test]
+fn long_texts_are_cut_where_they_pass_their_bound() {
+    let description = "word ".repeat(1_600);
+    let items: String = (0..MAX_EPISODES_PER_FEED)
+        .map(|index| {
+            format!(
+                "<item><title>Episode {index}</title><description>{description}</description>\
+                     <enclosure url=\"https://cdn.example.org/{index}.mp3\"/></item>"
+            )
+        })
+        .collect();
+    let document = format!("<rss><channel><title>Long</title>{items}</channel></rss>");
+    let feed = parse_feed(document.as_bytes(), &base()).unwrap();
+    assert_eq!(feed.episodes.len(), MAX_EPISODES_PER_FEED);
+    let kept = feed.episodes[0].description.as_deref().unwrap();
+    assert_eq!(
+        kept.chars().count(),
+        MAX_DESCRIPTION_CHARS - 1,
+        "trimmed of its last space"
+    );
+    assert_eq!(plain_text("a <b>b</b>  c", 100), "a b c");
+    assert_eq!(plain_text("abcdef", 3), "abc");
+}
+
+#[test]
+fn durations_take_the_three_spellings() {
+    assert_eq!(parse_duration("90"), Some(90_000));
+    assert_eq!(parse_duration("01:30"), Some(90_000));
+    assert_eq!(parse_duration("1:00:00"), Some(3_600_000));
+    assert_eq!(parse_duration("x"), None);
+    assert_eq!(parse_duration("1:2:3:4"), None);
+}
diff --git a/src/portrait.rs b/src/remote/portrait/mod.rs
similarity index 86%
rename from src/portrait.rs
rename to src/remote/portrait/mod.rs
index adeffff1..a9dc88ca 100644
--- a/src/portrait.rs
+++ b/src/remote/portrait/mod.rs
@@ -237,7 +237,7 @@ async fn fetch_within(
     if plain && !pinned.ip().is_loopback() {
         return Err(Refusal::Destination);
     }
-    let client = crate::outbound::builder(timeout)
+    let client = crate::remote::outbound::builder(timeout)
         .resolve(&host, pinned)
         .build()
         .map_err(|_| Refusal::Unreached)?;
@@ -291,11 +291,11 @@ async fn checked_image(response: reqwest::Response, rule: Declared) -> Result<Po
     };
     // The shared bounded read (RFC-023 decision 1), under this fetcher's own
     // ceiling: an image is allowed to weigh more than an API answer.
-    let bytes = crate::outbound::read_bounded_body(response, MAX_IMAGE_BYTES)
+    let bytes = crate::remote::outbound::read_bounded_body(response, MAX_IMAGE_BYTES)
         .await
         .map_err(|error| match error {
-            crate::outbound::BodyError::TooLarge => Refusal::TooLarge,
-            crate::outbound::BodyError::Unread => Refusal::Unreached,
+            crate::remote::outbound::BodyError::TooLarge => Refusal::TooLarge,
+            crate::remote::outbound::BodyError::Unread => Refusal::Unreached,
         })?;
     let format = sniff(&bytes).ok_or(Refusal::NotAnImage)?;
     if declared.is_some_and(|declared| declared != format) {
@@ -314,19 +314,19 @@ async fn checked_image(response: reqwest::Response, rule: Declared) -> Result<Po
 ///
 /// There is no allowlist to hold such an address to, so it is held instead to
 /// every rule the podcast fetcher applies to a feed address
-/// ([`crate::podcast::open`]): http or https only (http where `policy` allows
+/// ([`crate::remote::podcast::open`]): http or https only (http where `policy` allows
 /// it), no user information, every address the name resolves to admitted by
 /// the address policy, checked before connecting and pinned, and redirects
-/// followed by hand, at most [`crate::podcast::MAX_REDIRECTS`], each hop put
+/// followed by hand, at most [`crate::remote::podcast::MAX_REDIRECTS`], each hop put
 /// through the same checks before it is contacted. What comes back is then
 /// held to the rules above: [`MAX_IMAGE_BYTES`], and JPEG, PNG or WebP by the
 /// bytes. The whole of it, redirects included, within `policy.timeout`.
 pub async fn fetch_followed(
     url: &url::Url,
-    policy: crate::podcast::FetchPolicy,
+    policy: crate::remote::podcast::FetchPolicy,
 ) -> Result<Portrait, Refusal> {
     let within = async {
-        let response = crate::podcast::open(url, policy)
+        let response = crate::remote::podcast::open(url, policy)
             .await
             .map_err(Refusal::from)?;
         checked_image(response, Declared::ImageOrUnlabelled).await
@@ -336,9 +336,9 @@ pub async fn fetch_followed(
         .unwrap_or(Err(Refusal::Unreached))
 }
 
-impl From<crate::podcast::FetchError> for Refusal {
-    fn from(error: crate::podcast::FetchError) -> Self {
-        use crate::podcast::FetchError;
+impl From<crate::remote::podcast::FetchError> for Refusal {
+    fn from(error: crate::remote::podcast::FetchError) -> Self {
+        use crate::remote::podcast::FetchError;
         match error {
             FetchError::Destination => Self::Destination,
             FetchError::Address => Self::Address,
@@ -397,56 +397,4 @@ pub async fn store(artwork_dir: &Path, portrait: &Portrait) -> std::io::Result<(
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The protection the suite cannot exercise end to end, since its image
-    /// host is on loopback: the default refuses loopback and every private
-    /// range, and admits a public address.
-    #[test]
-    fn the_default_policy_refuses_a_loopback_address() {
-        let policy = AddressPolicy::default();
-        for refused in [
-            "127.0.0.1",
-            "::1",
-            "::ffff:127.0.0.1",
-            "10.1.2.3",
-            "172.16.0.1",
-            "192.168.1.1",
-            "169.254.169.254",
-            "100.64.0.1",
-            "0.0.0.0",
-            "::",
-            "fd00::1",
-            "fe80::1",
-            "::ffff:192.168.1.1",
-            "198.18.0.1",
-            "240.0.0.1",
-            "fec0::1",
-            "64:ff9b::a00:1",
-            "64:ff9b:1::1",
-            "2002:a00:1::1",
-            "::10.0.0.1",
-            "192.0.0.1",
-            "192.88.99.1",
-            "2001:0:a00:1::1",
-            "2001:db8::1",
-            "100::1",
-            "::ffff:0:a00:1",
-        ] {
-            assert!(!policy.admits(refused.parse().unwrap()), "{refused}");
-        }
-        assert!(policy.admits("93.184.216.34".parse().unwrap()));
-        assert!(policy.admits("2606:4700::1111".parse().unwrap()));
-        assert!(AddressPolicy::AllowLoopback.admits("127.0.0.1".parse().unwrap()));
-        assert!(!AddressPolicy::AllowLoopback.admits("10.0.0.1".parse().unwrap()));
-    }
-
-    #[test]
-    fn the_bytes_decide_the_format() {
-        assert_eq!(sniff(&[0xff, 0xd8, 0xff, 0xe0]), Some("jpg"));
-        assert_eq!(sniff(b"\x89PNG\r\n\x1a\n...."), Some("png"));
-        assert_eq!(sniff(b"RIFF\0\0\0\0WEBPVP8 "), Some("webp"));
-        assert_eq!(sniff(b"<html>"), None);
-    }
-}
+mod tests;
diff --git a/src/remote/portrait/tests.rs b/src/remote/portrait/tests.rs
new file mode 100644
index 00000000..335e1029
--- /dev/null
+++ b/src/remote/portrait/tests.rs
@@ -0,0 +1,51 @@
+use super::*;
+
+/// The protection the suite cannot exercise end to end, since its image
+/// host is on loopback: the default refuses loopback and every private
+/// range, and admits a public address.
+#[test]
+fn the_default_policy_refuses_a_loopback_address() {
+    let policy = AddressPolicy::default();
+    for refused in [
+        "127.0.0.1",
+        "::1",
+        "::ffff:127.0.0.1",
+        "10.1.2.3",
+        "172.16.0.1",
+        "192.168.1.1",
+        "169.254.169.254",
+        "100.64.0.1",
+        "0.0.0.0",
+        "::",
+        "fd00::1",
+        "fe80::1",
+        "::ffff:192.168.1.1",
+        "198.18.0.1",
+        "240.0.0.1",
+        "fec0::1",
+        "64:ff9b::a00:1",
+        "64:ff9b:1::1",
+        "2002:a00:1::1",
+        "::10.0.0.1",
+        "192.0.0.1",
+        "192.88.99.1",
+        "2001:0:a00:1::1",
+        "2001:db8::1",
+        "100::1",
+        "::ffff:0:a00:1",
+    ] {
+        assert!(!policy.admits(refused.parse().unwrap()), "{refused}");
+    }
+    assert!(policy.admits("93.184.216.34".parse().unwrap()));
+    assert!(policy.admits("2606:4700::1111".parse().unwrap()));
+    assert!(AddressPolicy::AllowLoopback.admits("127.0.0.1".parse().unwrap()));
+    assert!(!AddressPolicy::AllowLoopback.admits("10.0.0.1".parse().unwrap()));
+}
+
+#[test]
+fn the_bytes_decide_the_format() {
+    assert_eq!(sniff(&[0xff, 0xd8, 0xff, 0xe0]), Some("jpg"));
+    assert_eq!(sniff(b"\x89PNG\r\n\x1a\n...."), Some("png"));
+    assert_eq!(sniff(b"RIFF\0\0\0\0WEBPVP8 "), Some("webp"));
+    assert_eq!(sniff(b"<html>"), None);
+}
diff --git a/src/scrobblers/lastfm.rs b/src/remote/scrobblers/lastfm/mod.rs
similarity index 69%
rename from src/scrobblers/lastfm.rs
rename to src/remote/scrobblers/lastfm/mod.rs
index fd89b865..85113a31 100644
--- a/src/scrobblers/lastfm.rs
+++ b/src/remote/scrobblers/lastfm/mod.rs
@@ -70,7 +70,7 @@ impl LastFm {
     ///
     /// Bounded twice, which is the whole of RFC-023 decision 1 for this path:
     /// in time by [`Self::deadline`], and in size by
-    /// [`crate::outbound::read_bounded_body`]. Either refusal is
+    /// [`crate::remote::outbound::read_bounded_body`]. Either refusal is
     /// `Unavailable`, a failure of the way to Last.fm rather than of what the
     /// person brought.
     ///
@@ -100,13 +100,15 @@ impl LastFm {
                 tracing::warn!(call = what, %status, "last.fm refused the call");
                 return Err(ServiceError::Invalid);
             }
-            let body =
-                crate::outbound::read_bounded_body(response, crate::outbound::MAX_ANSWER_BYTES)
-                    .await
-                    .map_err(|error| {
-                        tracing::warn!(call = what, %error, "last.fm's answer was not read");
-                        ServiceError::Unavailable
-                    })?;
+            let body = crate::remote::outbound::read_bounded_body(
+                response,
+                crate::remote::outbound::MAX_ANSWER_BYTES,
+            )
+            .await
+            .map_err(|error| {
+                tracing::warn!(call = what, %error, "last.fm's answer was not read");
+                ServiceError::Unavailable
+            })?;
             serde_json::from_slice::<T>(&body).map_err(|_| {
                 tracing::warn!(call = what, "last.fm's answer is not the expected JSON");
                 ServiceError::Unavailable
@@ -252,9 +254,9 @@ impl ScrobbleTarget for LastFm {
             if !status.is_success() {
                 return status_verdict(status, retry_after);
             }
-            let answer = match crate::outbound::read_bounded_body(
+            let answer = match crate::remote::outbound::read_bounded_body(
                 response,
-                crate::outbound::MAX_ANSWER_BYTES,
+                crate::remote::outbound::MAX_ANSWER_BYTES,
             )
             .await
             {
@@ -549,242 +551,4 @@ fn status_verdict(status: reqwest::StatusCode, retry_after: Option<Duration>) ->
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn an_envelope() -> ScrobbleEnvelope {
-        ScrobbleEnvelope {
-            played_at: 1_700_000_123_456,
-            title: "Zenith".to_owned(),
-            artists: vec!["Nova Kern".to_owned(), "Juno Vale".to_owned()],
-            album: Some("Convergence".to_owned()),
-            album_artist: Some("Nova Kern".to_owned()),
-            duration_ms: Some(245_678),
-            musicbrainz_recording_id: Some("d2b9c1f0-0000-4000-8000-000000000001".to_owned()),
-        }
-    }
-
-    /// The signature is Last.fm's own recipe, checked against a value computed
-    /// by hand from it.
-    ///
-    /// Sorted by name, name and value concatenated with nothing between them,
-    /// the shared secret appended, MD5 of the UTF-8 bytes. Every one of those is
-    /// a place to be wrong in a way no test that only signed and compared
-    /// against itself would ever notice — which is why the expectation here is a
-    /// literal rather than a second call to `signature`.
-    #[test]
-    fn the_signature_follows_the_recipe_last_fm_publishes() {
-        use md5::Digest as _;
-        let params = [
-            ("method", "auth.getSession".to_owned()),
-            ("api_key", "the-key".to_owned()),
-            ("token", "the-token".to_owned()),
-        ];
-        // "api_keythe-keymethodauth.getSessiontokenthe-token" + secret.
-        let expected = hex::encode(md5::Md5::digest(
-            b"api_keythe-keymethodauth.getSessiontokenthe-tokenthe-secret",
-        ));
-        assert_eq!(signature(&params, "the-secret"), expected);
-    }
-
-    /// `format` and `callback` are outside the signature.
-    ///
-    /// Last.fm's rule, and it is not cosmetic: including either produces a
-    /// signature they refuse, and the failure would arrive as an authentication
-    /// error that looks exactly like a bad session key.
-    #[test]
-    fn the_shape_of_the_answer_is_not_part_of_the_signature() {
-        let bare = [("method", "track.scrobble".to_owned())];
-        let dressed = [
-            ("method", "track.scrobble".to_owned()),
-            ("format", "json".to_owned()),
-            ("callback", "https://example.test/back".to_owned()),
-        ];
-        assert_eq!(
-            signature(&bare, "the-secret"),
-            signature(&dressed, "the-secret")
-        );
-    }
-
-    /// The order the parameters were built in does not reach the signature.
-    #[test]
-    fn the_signature_sorts_before_it_concatenates() {
-        let one_way = [
-            ("track", "Zenith".to_owned()),
-            ("artist", "Nova Kern".to_owned()),
-        ];
-        let the_other = [
-            ("artist", "Nova Kern".to_owned()),
-            ("track", "Zenith".to_owned()),
-        ];
-        assert_eq!(
-            signature(&one_way, "the-secret"),
-            signature(&the_other, "the-secret")
-        );
-    }
-
-    /// The instants are seconds, and every credit is carried.
-    #[test]
-    fn the_submission_carries_seconds_and_every_credit() {
-        let params = scrobble_params(&an_envelope(), "a-session-key");
-        let value = |name: &str| {
-            params
-                .iter()
-                .find(|(key, _)| *key == name)
-                .map(|(_, value)| value.as_str())
-        };
-        assert_eq!(value("timestamp"), Some("1700000123"));
-        assert_eq!(value("duration"), Some("245"));
-        assert_eq!(value("artist"), Some("Nova Kern, Juno Vale"));
-        assert_eq!(value("track"), Some("Zenith"));
-        assert_eq!(value("album"), Some("Convergence"));
-        assert_eq!(value("albumArtist"), Some("Nova Kern"));
-        assert_eq!(value("sk"), Some("a-session-key"));
-    }
-
-    /// What this server does not know is not sent.
-    #[test]
-    fn what_is_unknown_is_left_out_rather_than_sent_empty() {
-        let bare = ScrobbleEnvelope {
-            album: None,
-            album_artist: None,
-            duration_ms: None,
-            musicbrainz_recording_id: None,
-            ..an_envelope()
-        };
-        let params = scrobble_params(&bare, "a-session-key");
-        for absent in ["album", "albumArtist", "duration", "mbid"] {
-            assert!(
-                !params.iter().any(|(name, _)| *name == absent),
-                "{absent} must not be sent"
-            );
-        }
-    }
-
-    /// The endpoint keeps the trailing slash Last.fm documents.
-    ///
-    /// `/2.0` answers a redirect, and this client follows none: without the
-    /// slash every call would fail, and the adapter would read that failure as
-    /// the destination having moved.
-    #[test]
-    fn the_endpoint_keeps_the_slash_last_fm_answers_on() {
-        let base = super::super::validate_destination("https://ws.audioscrobbler.com", false)
-            .expect("a valid destination");
-        let client = super::super::outbound_client(Duration::from_secs(5)).expect("a client");
-        let application = crate::config::LastFmApplication {
-            api_key: "a-key".to_owned(),
-            secret: "a-secret".to_owned(),
-        };
-        let target =
-            LastFm::new(client, &base, application, Duration::from_secs(5)).expect("an adapter");
-        assert_eq!(
-            target.endpoint.as_str(),
-            "https://ws.audioscrobbler.com/2.0/"
-        );
-    }
-
-    /// A status line, and nothing else, decides.
-    #[test]
-    fn the_status_line_earns_the_verdict() {
-        assert!(matches!(
-            status_verdict(reqwest::StatusCode::OK, None),
-            ScrobbleVerdict::Accepted
-        ));
-        assert!(matches!(
-            status_verdict(reqwest::StatusCode::FORBIDDEN, None),
-            ScrobbleVerdict::AuthBroken
-        ));
-        assert!(matches!(
-            status_verdict(reqwest::StatusCode::BAD_REQUEST, None),
-            ScrobbleVerdict::PermanentReject
-        ));
-        assert!(matches!(
-            status_verdict(reqwest::StatusCode::TOO_MANY_REQUESTS, None),
-            ScrobbleVerdict::Retryable {
-                after: Some(Duration::ZERO)
-            }
-        ));
-    }
-
-    /// An adapter aimed at a listener of the test's own.
-    async fn reaching(body: axum::body::Body) -> (LastFm, tokio::task::JoinHandle<()>) {
-        let (url, server) = crate::outbound::tests::answering(body).await;
-        let base = super::super::validate_destination(&url, true).expect("a destination");
-        let client = super::super::outbound_client(Duration::from_secs(5)).expect("a client");
-        let application = crate::config::LastFmApplication {
-            api_key: uuid::Uuid::new_v4().to_string(),
-            secret: uuid::Uuid::new_v4().to_string(),
-        };
-        let target =
-            LastFm::new(client, &base, application, Duration::from_secs(10)).expect("an adapter");
-        (target, server)
-    }
-
-    /// A session answer that is well formed and says what it should, but is
-    /// padded past the ceiling, is not read: the exchange fails as an outage
-    /// rather than holding the whole body (RFC-023 decision 1).
-    ///
-    /// Finite on purpose, and parseable: without the ceiling this same answer
-    /// is read and yields its key, so the test tells the ceiling from its
-    /// absence by the outcome and not only by the clock.
-    #[tokio::test]
-    async fn a_session_answer_over_the_ceiling_is_not_read() {
-        use crate::services::{LastFmSessionExchange, ServiceError};
-        let key = uuid::Uuid::new_v4().simple().to_string();
-        let padding = " ".repeat(crate::outbound::MAX_ANSWER_BYTES);
-        let (target, server) = reaching(axum::body::Body::from(format!(
-            "{{\"session\":{{\"key\":\"{key}\"}}{padding}}}"
-        )))
-        .await;
-        let token = uuid::Uuid::new_v4().to_string();
-        let exchanged = target.exchange(&token).await;
-        server.abort();
-        assert!(
-            matches!(exchanged, Err(ServiceError::Unavailable)),
-            "an oversized answer must not be read"
-        );
-
-        // And the same answer within the ceiling is read, so the refusal above
-        // is the ceiling's and not the listener's.
-        let (target, server) = reaching(axum::body::Body::from(format!(
-            "{{\"session\":{{\"key\":\"{key}\"}}}}"
-        )))
-        .await;
-        let exchanged = target.exchange(&token).await;
-        server.abort();
-        assert_eq!(exchanged.ok().as_deref(), Some(key.as_str()));
-    }
-
-    /// The same for the token the CLI journey asks for first.
-    #[tokio::test]
-    async fn a_token_answer_over_the_ceiling_is_not_read() {
-        use crate::services::{LastFmSessionExchange, ServiceError};
-        let token = uuid::Uuid::new_v4().simple().to_string();
-        let padding = " ".repeat(crate::outbound::MAX_ANSWER_BYTES);
-        let (target, server) = reaching(axum::body::Body::from(format!(
-            "{{\"token\":\"{token}\"{padding}}}"
-        )))
-        .await;
-        let minted = target.request_token().await;
-        server.abort();
-        assert!(matches!(minted, Err(ServiceError::Unavailable)));
-    }
-
-    /// A listen whose acknowledgement is over the ceiling is judged by its
-    /// status line, as one that will not parse is.
-    ///
-    /// The body says `"error": 9`, a dead session key, so a reader without the
-    /// ceiling breaks the link over it; that difference is what this tells
-    /// apart.
-    #[tokio::test]
-    async fn a_scrobble_answer_over_the_ceiling_leaves_the_status_line_deciding() {
-        let padding = " ".repeat(crate::outbound::MAX_ANSWER_BYTES);
-        let (target, server) =
-            reaching(axum::body::Body::from(format!("{{\"error\":9{padding}}}"))).await;
-        let envelope = an_envelope();
-        let session_key = uuid::Uuid::new_v4().to_string();
-        let verdict = target.submit(&envelope, &session_key).await;
-        server.abort();
-        assert!(matches!(verdict, ScrobbleVerdict::Accepted));
-    }
-}
+mod tests;
diff --git a/src/remote/scrobblers/lastfm/tests.rs b/src/remote/scrobblers/lastfm/tests.rs
new file mode 100644
index 00000000..dcac63fa
--- /dev/null
+++ b/src/remote/scrobblers/lastfm/tests.rs
@@ -0,0 +1,237 @@
+use super::*;
+
+fn an_envelope() -> ScrobbleEnvelope {
+    ScrobbleEnvelope {
+        played_at: 1_700_000_123_456,
+        title: "Zenith".to_owned(),
+        artists: vec!["Nova Kern".to_owned(), "Juno Vale".to_owned()],
+        album: Some("Convergence".to_owned()),
+        album_artist: Some("Nova Kern".to_owned()),
+        duration_ms: Some(245_678),
+        musicbrainz_recording_id: Some("d2b9c1f0-0000-4000-8000-000000000001".to_owned()),
+    }
+}
+
+/// The signature is Last.fm's own recipe, checked against a value computed
+/// by hand from it.
+///
+/// Sorted by name, name and value concatenated with nothing between them,
+/// the shared secret appended, MD5 of the UTF-8 bytes. Every one of those is
+/// a place to be wrong in a way no test that only signed and compared
+/// against itself would ever notice — which is why the expectation here is a
+/// literal rather than a second call to `signature`.
+#[test]
+fn the_signature_follows_the_recipe_last_fm_publishes() {
+    use md5::Digest as _;
+    let params = [
+        ("method", "auth.getSession".to_owned()),
+        ("api_key", "the-key".to_owned()),
+        ("token", "the-token".to_owned()),
+    ];
+    // "api_keythe-keymethodauth.getSessiontokenthe-token" + secret.
+    let expected = hex::encode(md5::Md5::digest(
+        b"api_keythe-keymethodauth.getSessiontokenthe-tokenthe-secret",
+    ));
+    assert_eq!(signature(&params, "the-secret"), expected);
+}
+
+/// `format` and `callback` are outside the signature.
+///
+/// Last.fm's rule, and it is not cosmetic: including either produces a
+/// signature they refuse, and the failure would arrive as an authentication
+/// error that looks exactly like a bad session key.
+#[test]
+fn the_shape_of_the_answer_is_not_part_of_the_signature() {
+    let bare = [("method", "track.scrobble".to_owned())];
+    let dressed = [
+        ("method", "track.scrobble".to_owned()),
+        ("format", "json".to_owned()),
+        ("callback", "https://example.test/back".to_owned()),
+    ];
+    assert_eq!(
+        signature(&bare, "the-secret"),
+        signature(&dressed, "the-secret")
+    );
+}
+
+/// The order the parameters were built in does not reach the signature.
+#[test]
+fn the_signature_sorts_before_it_concatenates() {
+    let one_way = [
+        ("track", "Zenith".to_owned()),
+        ("artist", "Nova Kern".to_owned()),
+    ];
+    let the_other = [
+        ("artist", "Nova Kern".to_owned()),
+        ("track", "Zenith".to_owned()),
+    ];
+    assert_eq!(
+        signature(&one_way, "the-secret"),
+        signature(&the_other, "the-secret")
+    );
+}
+
+/// The instants are seconds, and every credit is carried.
+#[test]
+fn the_submission_carries_seconds_and_every_credit() {
+    let params = scrobble_params(&an_envelope(), "a-session-key");
+    let value = |name: &str| {
+        params
+            .iter()
+            .find(|(key, _)| *key == name)
+            .map(|(_, value)| value.as_str())
+    };
+    assert_eq!(value("timestamp"), Some("1700000123"));
+    assert_eq!(value("duration"), Some("245"));
+    assert_eq!(value("artist"), Some("Nova Kern, Juno Vale"));
+    assert_eq!(value("track"), Some("Zenith"));
+    assert_eq!(value("album"), Some("Convergence"));
+    assert_eq!(value("albumArtist"), Some("Nova Kern"));
+    assert_eq!(value("sk"), Some("a-session-key"));
+}
+
+/// What this server does not know is not sent.
+#[test]
+fn what_is_unknown_is_left_out_rather_than_sent_empty() {
+    let bare = ScrobbleEnvelope {
+        album: None,
+        album_artist: None,
+        duration_ms: None,
+        musicbrainz_recording_id: None,
+        ..an_envelope()
+    };
+    let params = scrobble_params(&bare, "a-session-key");
+    for absent in ["album", "albumArtist", "duration", "mbid"] {
+        assert!(
+            !params.iter().any(|(name, _)| *name == absent),
+            "{absent} must not be sent"
+        );
+    }
+}
+
+/// The endpoint keeps the trailing slash Last.fm documents.
+///
+/// `/2.0` answers a redirect, and this client follows none: without the
+/// slash every call would fail, and the adapter would read that failure as
+/// the destination having moved.
+#[test]
+fn the_endpoint_keeps_the_slash_last_fm_answers_on() {
+    let base = super::super::validate_destination("https://ws.audioscrobbler.com", false)
+        .expect("a valid destination");
+    let client = super::super::outbound_client(Duration::from_secs(5)).expect("a client");
+    let application = crate::config::LastFmApplication {
+        api_key: "a-key".to_owned(),
+        secret: "a-secret".to_owned(),
+    };
+    let target =
+        LastFm::new(client, &base, application, Duration::from_secs(5)).expect("an adapter");
+    assert_eq!(
+        target.endpoint.as_str(),
+        "https://ws.audioscrobbler.com/2.0/"
+    );
+}
+
+/// A status line, and nothing else, decides.
+#[test]
+fn the_status_line_earns_the_verdict() {
+    assert!(matches!(
+        status_verdict(reqwest::StatusCode::OK, None),
+        ScrobbleVerdict::Accepted
+    ));
+    assert!(matches!(
+        status_verdict(reqwest::StatusCode::FORBIDDEN, None),
+        ScrobbleVerdict::AuthBroken
+    ));
+    assert!(matches!(
+        status_verdict(reqwest::StatusCode::BAD_REQUEST, None),
+        ScrobbleVerdict::PermanentReject
+    ));
+    assert!(matches!(
+        status_verdict(reqwest::StatusCode::TOO_MANY_REQUESTS, None),
+        ScrobbleVerdict::Retryable {
+            after: Some(Duration::ZERO)
+        }
+    ));
+}
+
+/// An adapter aimed at a listener of the test's own.
+async fn reaching(body: axum::body::Body) -> (LastFm, tokio::task::JoinHandle<()>) {
+    let (url, server) = crate::remote::outbound::tests::answering(body).await;
+    let base = super::super::validate_destination(&url, true).expect("a destination");
+    let client = super::super::outbound_client(Duration::from_secs(5)).expect("a client");
+    let application = crate::config::LastFmApplication {
+        api_key: uuid::Uuid::new_v4().to_string(),
+        secret: uuid::Uuid::new_v4().to_string(),
+    };
+    let target =
+        LastFm::new(client, &base, application, Duration::from_secs(10)).expect("an adapter");
+    (target, server)
+}
+
+/// A session answer that is well formed and says what it should, but is
+/// padded past the ceiling, is not read: the exchange fails as an outage
+/// rather than holding the whole body (RFC-023 decision 1).
+///
+/// Finite on purpose, and parseable: without the ceiling this same answer
+/// is read and yields its key, so the test tells the ceiling from its
+/// absence by the outcome and not only by the clock.
+#[tokio::test]
+async fn a_session_answer_over_the_ceiling_is_not_read() {
+    use crate::services::{LastFmSessionExchange, ServiceError};
+    let key = uuid::Uuid::new_v4().simple().to_string();
+    let padding = " ".repeat(crate::remote::outbound::MAX_ANSWER_BYTES);
+    let (target, server) = reaching(axum::body::Body::from(format!(
+        "{{\"session\":{{\"key\":\"{key}\"}}{padding}}}"
+    )))
+    .await;
+    let token = uuid::Uuid::new_v4().to_string();
+    let exchanged = target.exchange(&token).await;
+    server.abort();
+    assert!(
+        matches!(exchanged, Err(ServiceError::Unavailable)),
+        "an oversized answer must not be read"
+    );
+
+    // And the same answer within the ceiling is read, so the refusal above
+    // is the ceiling's and not the listener's.
+    let (target, server) = reaching(axum::body::Body::from(format!(
+        "{{\"session\":{{\"key\":\"{key}\"}}}}"
+    )))
+    .await;
+    let exchanged = target.exchange(&token).await;
+    server.abort();
+    assert_eq!(exchanged.ok().as_deref(), Some(key.as_str()));
+}
+
+/// The same for the token the CLI journey asks for first.
+#[tokio::test]
+async fn a_token_answer_over_the_ceiling_is_not_read() {
+    use crate::services::{LastFmSessionExchange, ServiceError};
+    let token = uuid::Uuid::new_v4().simple().to_string();
+    let padding = " ".repeat(crate::remote::outbound::MAX_ANSWER_BYTES);
+    let (target, server) = reaching(axum::body::Body::from(format!(
+        "{{\"token\":\"{token}\"{padding}}}"
+    )))
+    .await;
+    let minted = target.request_token().await;
+    server.abort();
+    assert!(matches!(minted, Err(ServiceError::Unavailable)));
+}
+
+/// A listen whose acknowledgement is over the ceiling is judged by its
+/// status line, as one that will not parse is.
+///
+/// The body says `"error": 9`, a dead session key, so a reader without the
+/// ceiling breaks the link over it; that difference is what this tells
+/// apart.
+#[tokio::test]
+async fn a_scrobble_answer_over_the_ceiling_leaves_the_status_line_deciding() {
+    let padding = " ".repeat(crate::remote::outbound::MAX_ANSWER_BYTES);
+    let (target, server) =
+        reaching(axum::body::Body::from(format!("{{\"error\":9{padding}}}"))).await;
+    let envelope = an_envelope();
+    let session_key = uuid::Uuid::new_v4().to_string();
+    let verdict = target.submit(&envelope, &session_key).await;
+    server.abort();
+    assert!(matches!(verdict, ScrobbleVerdict::Accepted));
+}
diff --git a/src/scrobblers/listenbrainz.rs b/src/remote/scrobblers/listenbrainz/mod.rs
similarity index 65%
rename from src/scrobblers/listenbrainz.rs
rename to src/remote/scrobblers/listenbrainz/mod.rs
index dc26d59c..8474d0fd 100644
--- a/src/scrobblers/listenbrainz.rs
+++ b/src/remote/scrobblers/listenbrainz/mod.rs
@@ -299,165 +299,4 @@ fn reset_in(response: &reqwest::Response) -> Option<Duration> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn envelope() -> ScrobbleEnvelope {
-        ScrobbleEnvelope {
-            // 2026-09-13T11:32:42Z, and the millisecond remainder is there on
-            // purpose: it must not survive the conversion.
-            played_at: 1_789_648_362_750,
-            title: "Never Gonna Give You Up".into(),
-            artists: vec!["Rick Astley".into(), "The Guest".into()],
-            album: Some("Whenever You Need Somebody".into()),
-            album_artist: Some("Rick Astley".into()),
-            duration_ms: Some(222_000),
-            musicbrainz_recording_id: Some("98255a8c-017a-4bc7-8dd6-1fa36124572b".into()),
-        }
-    }
-
-    /// The one conversion a listening history would keep forever if it were
-    /// wrong.
-    #[test]
-    fn a_listen_is_dated_in_seconds_and_not_milliseconds() {
-        assert_eq!(played_at_seconds(1_789_648_362_750), 1_789_648_362);
-        // Truncation towards zero would answer 0 here and -1 is correct; no
-        // listen predates 1970, which is why this is worth pinning rather than
-        // assuming.
-        assert_eq!(played_at_seconds(-1), -1);
-
-        let body = serde_json::to_value(submission(&envelope())).unwrap();
-        assert_eq!(body["payload"][0]["listened_at"], 1_789_648_362);
-    }
-
-    #[test]
-    fn the_body_is_the_shape_listenbrainz_documents() {
-        let body = serde_json::to_value(submission(&envelope())).unwrap();
-        assert_eq!(body["listen_type"], "single");
-        assert_eq!(body["payload"].as_array().unwrap().len(), 1);
-
-        let metadata = &body["payload"][0]["track_metadata"];
-        assert_eq!(metadata["track_name"], "Never Gonna Give You Up");
-        assert_eq!(metadata["release_name"], "Whenever You Need Somebody");
-        // Every credit, in tag order: the envelope records what was heard, and
-        // a guest on the track was heard.
-        assert_eq!(metadata["artist_name"], "Rick Astley, The Guest");
-        assert_eq!(metadata["additional_info"]["duration_ms"], 222_000);
-        assert_eq!(
-            metadata["additional_info"]["recording_mbid"],
-            "98255a8c-017a-4bc7-8dd6-1fa36124572b"
-        );
-    }
-
-    /// An absent field is absent, rather than present and null: the destination
-    /// reads `additional_info` as a set of hints, and a null hint is a claim.
-    #[test]
-    fn what_the_listen_does_not_know_is_left_out_entirely() {
-        let bare = ScrobbleEnvelope {
-            album: None,
-            duration_ms: None,
-            musicbrainz_recording_id: None,
-            ..envelope()
-        };
-        let body = serde_json::to_value(submission(&bare)).unwrap();
-        let metadata = &body["payload"][0]["track_metadata"];
-        assert!(metadata.get("release_name").is_none());
-        assert!(metadata["additional_info"].get("duration_ms").is_none());
-        assert!(metadata["additional_info"].get("recording_mbid").is_none());
-        // And what it always knows stays.
-        assert_eq!(
-            metadata["additional_info"]["submission_client"],
-            CLIENT_NAME
-        );
-    }
-
-    /// A rate limit may ask in either of the two forms RFC 9110 allows — and
-    /// two more that are not a request to wait at all.
-    ///
-    /// Decision 6 says a delay the destination asks for is honoured. Only
-    /// ListenBrainz's own vendor header was read, so a `429` from the nginx or
-    /// the CDN in front of a self-hosted instance — which answers with the
-    /// standard header — was heard as "no delay given".
-    #[test]
-    fn a_rate_limit_may_ask_in_seconds_or_in_a_date() {
-        fn answered(header: &str, value: &str) -> Option<Duration> {
-            let response = axum::http::Response::builder()
-                .status(429)
-                .header(header, value)
-                .body(String::new())
-                .unwrap();
-            asked_wait(&reqwest::Response::from(response))
-        }
-
-        // The vendor's header, in whole seconds.
-        assert_eq!(
-            answered(RESET_IN_HEADER, "12"),
-            Some(Duration::from_secs(12))
-        );
-        // The standard one, as delta-seconds.
-        assert_eq!(answered("retry-after", "30"), Some(Duration::from_secs(30)));
-
-        // And as an HTTP date, which is the form a proxy answers with. Read as
-        // a distance from now, so it is asserted as a window rather than a
-        // value: the clock moves between building the header and reading it.
-        let soon = chrono::Utc::now() + chrono::Duration::seconds(120);
-        let asked = answered("retry-after", &soon.to_rfc2822()).expect("a future date is a wait");
-        assert!(
-            asked > Duration::from_secs(110) && asked <= Duration::from_secs(120),
-            "a date two minutes out must read as about two minutes, got {asked:?}"
-        );
-
-        // A moment already gone is not a request to wait, and neither is a
-        // header nobody can parse. Both read as absent — which sends the entry
-        // to the queue's own backoff, not to an immediate retry.
-        let past = chrono::Utc::now() - chrono::Duration::seconds(120);
-        assert_eq!(answered("retry-after", &past.to_rfc2822()), None);
-        assert_eq!(answered("retry-after", "in a little while"), None);
-        // RFC 9110's delta-seconds is `1*DIGIT`, so a signed number is not one.
-        // `u64::from_str` accepts a leading `+`, which read `+30` as a wait
-        // nobody had spelled in a form this is allowed to understand.
-        assert_eq!(answered("retry-after", "+30"), None);
-        assert_eq!(answered("x-unrelated", "30"), None);
-    }
-
-    #[test]
-    fn each_answer_earns_the_verdict_the_queue_can_act_on() {
-        use reqwest::StatusCode;
-        let no_wait = None;
-
-        assert_eq!(
-            status_verdict(StatusCode::OK, no_wait),
-            ScrobbleVerdict::Accepted
-        );
-        // A bad token breaks the link rather than the listen.
-        assert_eq!(
-            status_verdict(StatusCode::UNAUTHORIZED, no_wait),
-            ScrobbleVerdict::AuthBroken
-        );
-        // A refused payload is terminal: no retry can fix it.
-        assert_eq!(
-            status_verdict(StatusCode::BAD_REQUEST, no_wait),
-            ScrobbleVerdict::PermanentReject
-        );
-        // And a rate limit carries the destination's own answer back, exactly
-        // as it was given — bounding it is the queue's business, not this
-        // function's.
-        assert_eq!(
-            status_verdict(StatusCode::TOO_MANY_REQUESTS, Some(Duration::from_secs(12))),
-            ScrobbleVerdict::Retryable {
-                after: Some(Duration::from_secs(12))
-            }
-        );
-        // A server fault says nothing about the listen.
-        assert_eq!(
-            status_verdict(StatusCode::BAD_GATEWAY, no_wait),
-            ScrobbleVerdict::Retryable { after: None }
-        );
-        // A redirect is not followed, so it reaches here: the operator's
-        // destination moved, and the listen waits for them to notice.
-        assert_eq!(
-            status_verdict(StatusCode::FOUND, no_wait),
-            ScrobbleVerdict::Retryable { after: None }
-        );
-    }
-}
+mod tests;
diff --git a/src/remote/scrobblers/listenbrainz/tests.rs b/src/remote/scrobblers/listenbrainz/tests.rs
new file mode 100644
index 00000000..7bb3a90d
--- /dev/null
+++ b/src/remote/scrobblers/listenbrainz/tests.rs
@@ -0,0 +1,160 @@
+use super::*;
+
+fn envelope() -> ScrobbleEnvelope {
+    ScrobbleEnvelope {
+        // 2026-09-13T11:32:42Z, and the millisecond remainder is there on
+        // purpose: it must not survive the conversion.
+        played_at: 1_789_648_362_750,
+        title: "Never Gonna Give You Up".into(),
+        artists: vec!["Rick Astley".into(), "The Guest".into()],
+        album: Some("Whenever You Need Somebody".into()),
+        album_artist: Some("Rick Astley".into()),
+        duration_ms: Some(222_000),
+        musicbrainz_recording_id: Some("98255a8c-017a-4bc7-8dd6-1fa36124572b".into()),
+    }
+}
+
+/// The one conversion a listening history would keep forever if it were
+/// wrong.
+#[test]
+fn a_listen_is_dated_in_seconds_and_not_milliseconds() {
+    assert_eq!(played_at_seconds(1_789_648_362_750), 1_789_648_362);
+    // Truncation towards zero would answer 0 here and -1 is correct; no
+    // listen predates 1970, which is why this is worth pinning rather than
+    // assuming.
+    assert_eq!(played_at_seconds(-1), -1);
+
+    let body = serde_json::to_value(submission(&envelope())).unwrap();
+    assert_eq!(body["payload"][0]["listened_at"], 1_789_648_362);
+}
+
+#[test]
+fn the_body_is_the_shape_listenbrainz_documents() {
+    let body = serde_json::to_value(submission(&envelope())).unwrap();
+    assert_eq!(body["listen_type"], "single");
+    assert_eq!(body["payload"].as_array().unwrap().len(), 1);
+
+    let metadata = &body["payload"][0]["track_metadata"];
+    assert_eq!(metadata["track_name"], "Never Gonna Give You Up");
+    assert_eq!(metadata["release_name"], "Whenever You Need Somebody");
+    // Every credit, in tag order: the envelope records what was heard, and
+    // a guest on the track was heard.
+    assert_eq!(metadata["artist_name"], "Rick Astley, The Guest");
+    assert_eq!(metadata["additional_info"]["duration_ms"], 222_000);
+    assert_eq!(
+        metadata["additional_info"]["recording_mbid"],
+        "98255a8c-017a-4bc7-8dd6-1fa36124572b"
+    );
+}
+
+/// An absent field is absent, rather than present and null: the destination
+/// reads `additional_info` as a set of hints, and a null hint is a claim.
+#[test]
+fn what_the_listen_does_not_know_is_left_out_entirely() {
+    let bare = ScrobbleEnvelope {
+        album: None,
+        duration_ms: None,
+        musicbrainz_recording_id: None,
+        ..envelope()
+    };
+    let body = serde_json::to_value(submission(&bare)).unwrap();
+    let metadata = &body["payload"][0]["track_metadata"];
+    assert!(metadata.get("release_name").is_none());
+    assert!(metadata["additional_info"].get("duration_ms").is_none());
+    assert!(metadata["additional_info"].get("recording_mbid").is_none());
+    // And what it always knows stays.
+    assert_eq!(
+        metadata["additional_info"]["submission_client"],
+        CLIENT_NAME
+    );
+}
+
+/// A rate limit may ask in either of the two forms RFC 9110 allows — and
+/// two more that are not a request to wait at all.
+///
+/// Decision 6 says a delay the destination asks for is honoured. Only
+/// ListenBrainz's own vendor header was read, so a `429` from the nginx or
+/// the CDN in front of a self-hosted instance — which answers with the
+/// standard header — was heard as "no delay given".
+#[test]
+fn a_rate_limit_may_ask_in_seconds_or_in_a_date() {
+    fn answered(header: &str, value: &str) -> Option<Duration> {
+        let response = axum::http::Response::builder()
+            .status(429)
+            .header(header, value)
+            .body(String::new())
+            .unwrap();
+        asked_wait(&reqwest::Response::from(response))
+    }
+
+    // The vendor's header, in whole seconds.
+    assert_eq!(
+        answered(RESET_IN_HEADER, "12"),
+        Some(Duration::from_secs(12))
+    );
+    // The standard one, as delta-seconds.
+    assert_eq!(answered("retry-after", "30"), Some(Duration::from_secs(30)));
+
+    // And as an HTTP date, which is the form a proxy answers with. Read as
+    // a distance from now, so it is asserted as a window rather than a
+    // value: the clock moves between building the header and reading it.
+    let soon = chrono::Utc::now() + chrono::Duration::seconds(120);
+    let asked = answered("retry-after", &soon.to_rfc2822()).expect("a future date is a wait");
+    assert!(
+        asked > Duration::from_secs(110) && asked <= Duration::from_secs(120),
+        "a date two minutes out must read as about two minutes, got {asked:?}"
+    );
+
+    // A moment already gone is not a request to wait, and neither is a
+    // header nobody can parse. Both read as absent — which sends the entry
+    // to the queue's own backoff, not to an immediate retry.
+    let past = chrono::Utc::now() - chrono::Duration::seconds(120);
+    assert_eq!(answered("retry-after", &past.to_rfc2822()), None);
+    assert_eq!(answered("retry-after", "in a little while"), None);
+    // RFC 9110's delta-seconds is `1*DIGIT`, so a signed number is not one.
+    // `u64::from_str` accepts a leading `+`, which read `+30` as a wait
+    // nobody had spelled in a form this is allowed to understand.
+    assert_eq!(answered("retry-after", "+30"), None);
+    assert_eq!(answered("x-unrelated", "30"), None);
+}
+
+#[test]
+fn each_answer_earns_the_verdict_the_queue_can_act_on() {
+    use reqwest::StatusCode;
+    let no_wait = None;
+
+    assert_eq!(
+        status_verdict(StatusCode::OK, no_wait),
+        ScrobbleVerdict::Accepted
+    );
+    // A bad token breaks the link rather than the listen.
+    assert_eq!(
+        status_verdict(StatusCode::UNAUTHORIZED, no_wait),
+        ScrobbleVerdict::AuthBroken
+    );
+    // A refused payload is terminal: no retry can fix it.
+    assert_eq!(
+        status_verdict(StatusCode::BAD_REQUEST, no_wait),
+        ScrobbleVerdict::PermanentReject
+    );
+    // And a rate limit carries the destination's own answer back, exactly
+    // as it was given — bounding it is the queue's business, not this
+    // function's.
+    assert_eq!(
+        status_verdict(StatusCode::TOO_MANY_REQUESTS, Some(Duration::from_secs(12))),
+        ScrobbleVerdict::Retryable {
+            after: Some(Duration::from_secs(12))
+        }
+    );
+    // A server fault says nothing about the listen.
+    assert_eq!(
+        status_verdict(StatusCode::BAD_GATEWAY, no_wait),
+        ScrobbleVerdict::Retryable { after: None }
+    );
+    // A redirect is not followed, so it reaches here: the operator's
+    // destination moved, and the listen waits for them to notice.
+    assert_eq!(
+        status_verdict(StatusCode::FOUND, no_wait),
+        ScrobbleVerdict::Retryable { after: None }
+    );
+}
diff --git a/src/scrobblers/maloja.rs b/src/remote/scrobblers/maloja/mod.rs
similarity index 63%
rename from src/scrobblers/maloja.rs
rename to src/remote/scrobblers/maloja/mod.rs
index de28f7f7..6856f1a1 100644
--- a/src/scrobblers/maloja.rs
+++ b/src/remote/scrobblers/maloja/mod.rs
@@ -154,9 +154,9 @@ impl ScrobbleTarget for Maloja {
             // answer over it, or one that breaks off, is not read at all, and
             // the status line decides — exactly as for a body that will not
             // parse. The verdict is logged; the body never is.
-            let refused = match crate::outbound::read_bounded_body(
+            let refused = match crate::remote::outbound::read_bounded_body(
                 response,
-                crate::outbound::MAX_ANSWER_BYTES,
+                crate::remote::outbound::MAX_ANSWER_BYTES,
             )
             .await
             {
@@ -256,160 +256,4 @@ fn status_verdict(status: reqwest::StatusCode, retry_after: Option<Duration>) ->
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn an_envelope() -> ScrobbleEnvelope {
-        ScrobbleEnvelope {
-            played_at: 1_700_000_123_456,
-            title: "Zenith".to_owned(),
-            artists: vec!["Nova Kern".to_owned(), "Juno Vale".to_owned()],
-            album: Some("Convergence".to_owned()),
-            album_artist: Some("Nova Kern".to_owned()),
-            duration_ms: Some(245_678),
-            musicbrainz_recording_id: Some("d2b9c1f0-0000-4000-8000-000000000001".to_owned()),
-        }
-    }
-
-    /// Every credit arrives as a credit.
-    ///
-    /// This is the whole reason decision 11 puts Maloja second. A body that
-    /// joined the artists would work, and would quietly turn a duo into a band
-    /// nobody has heard of in somebody's statistics.
-    #[test]
-    fn the_envelope_pours_in_without_losing_a_credit() {
-        let envelope = an_envelope();
-        let body = serde_json::to_value(submission(&envelope, "a-key")).unwrap();
-        assert_eq!(
-            body["artists"],
-            serde_json::json!(["Nova Kern", "Juno Vale"])
-        );
-        assert_eq!(body["albumartists"], serde_json::json!(["Nova Kern"]));
-        assert_eq!(body["album"], "Convergence");
-        assert_eq!(body["title"], "Zenith");
-    }
-
-    /// Both instants are seconds, and both are truncated the same way.
-    ///
-    /// Milliseconds handed over unconverted would date every listen about fifty
-    /// thousand years from now, and a listening history keeps that for good.
-    #[test]
-    fn the_instants_are_seconds_and_not_milliseconds() {
-        let envelope = an_envelope();
-        let body = serde_json::to_value(submission(&envelope, "a-key")).unwrap();
-        assert_eq!(body["time"], 1_700_000_123);
-        assert_eq!(body["length"], 245);
-
-        // `div_euclid`, so an instant before 1970 rounds down rather than
-        // towards zero. No listen has one; the point is not to depend on that.
-        let ancient = ScrobbleEnvelope {
-            played_at: -1_500,
-            ..an_envelope()
-        };
-        let body = serde_json::to_value(submission(&ancient, "a-key")).unwrap();
-        assert_eq!(body["time"], -2);
-    }
-
-    /// What this server does not know is not sent.
-    ///
-    /// An absent album and an absent duration are absent, not empty: a
-    /// destination matching on `album` treats `""` as a title, and Maloja's
-    /// `duration` is a listened length this server never measured.
-    #[test]
-    fn what_is_unknown_is_left_out_rather_than_sent_empty() {
-        let bare = ScrobbleEnvelope {
-            album: None,
-            album_artist: None,
-            duration_ms: None,
-            ..an_envelope()
-        };
-        let body = serde_json::to_value(submission(&bare, "a-key")).unwrap();
-        let object = body.as_object().unwrap();
-        for absent in ["album", "albumartists", "length", "duration"] {
-            assert!(!object.contains_key(absent), "{absent} must not be sent");
-        }
-        // And what is always known is always sent.
-        for present in ["key", "title", "artists", "time"] {
-            assert!(object.contains_key(present), "{present} must be sent");
-        }
-    }
-
-    /// The body carries a secret, so it does not survive being formatted.
-    ///
-    /// The failure message deliberately carries neither the key nor the
-    /// formatted output: if this guard were removed, that output would *be* the
-    /// credential, and a panic message is a log line.
-    #[test]
-    fn a_submission_does_not_print_its_key() {
-        let envelope = an_envelope();
-        let shown = format!("{:?}", submission(&envelope, "a-key-nobody-should-read"));
-        assert!(
-            !shown.contains("a-key-nobody-should-read"),
-            "the debug output carried the key"
-        );
-        assert!(shown.contains("[redacted]"), "the key was not replaced");
-    }
-
-    /// A status line, and nothing else, decides.
-    #[test]
-    fn the_status_line_earns_the_verdict() {
-        assert!(matches!(
-            status_verdict(reqwest::StatusCode::OK, None),
-            ScrobbleVerdict::Accepted
-        ));
-        for refused in [401, 403] {
-            assert!(
-                matches!(
-                    status_verdict(reqwest::StatusCode::from_u16(refused).unwrap(), None),
-                    ScrobbleVerdict::AuthBroken
-                ),
-                "{refused}"
-            );
-        }
-        for refused in [400, 413, 422] {
-            assert!(
-                matches!(
-                    status_verdict(reqwest::StatusCode::from_u16(refused).unwrap(), None),
-                    ScrobbleVerdict::PermanentReject
-                ),
-                "{refused}"
-            );
-        }
-        // A rate limit with no readable header still rests the link: the status
-        // says room was asked for, the header only says how much.
-        assert!(matches!(
-            status_verdict(reqwest::StatusCode::TOO_MANY_REQUESTS, None),
-            ScrobbleVerdict::Retryable {
-                after: Some(Duration::ZERO)
-            }
-        ));
-        // A redirect is not followed, and means the destination moved.
-        assert!(matches!(
-            status_verdict(reqwest::StatusCode::FOUND, None),
-            ScrobbleVerdict::Retryable { after: None }
-        ));
-    }
-
-    /// A `200` whose body is over the ceiling is not read, and the status line
-    /// decides (RFC-023 decision 1).
-    ///
-    /// The body is the one refusal this adapter reads, padded: a reader
-    /// without the ceiling reads all of it and rejects the listen for good,
-    /// which is the difference this tells apart.
-    #[tokio::test]
-    async fn an_answer_over_the_ceiling_leaves_the_status_line_deciding() {
-        let padding = " ".repeat(crate::outbound::MAX_ANSWER_BYTES);
-        let (url, server) = crate::outbound::tests::answering(axum::body::Body::from(format!(
-            "{{\"status\":\"failure\"{padding}}}"
-        )))
-        .await;
-        let base = super::super::validate_destination(&url, true).expect("a destination");
-        let client = super::super::outbound_client(Duration::from_secs(5)).expect("a client");
-        let target = Maloja::new(client, &base).expect("an adapter");
-        let secret = uuid::Uuid::new_v4().to_string();
-        let envelope = an_envelope();
-        let verdict = target.submit(&envelope, &secret).await;
-        server.abort();
-        assert!(matches!(verdict, ScrobbleVerdict::Accepted));
-    }
-}
+mod tests;
diff --git a/src/remote/scrobblers/maloja/tests.rs b/src/remote/scrobblers/maloja/tests.rs
new file mode 100644
index 00000000..abb14917
--- /dev/null
+++ b/src/remote/scrobblers/maloja/tests.rs
@@ -0,0 +1,155 @@
+use super::*;
+
+fn an_envelope() -> ScrobbleEnvelope {
+    ScrobbleEnvelope {
+        played_at: 1_700_000_123_456,
+        title: "Zenith".to_owned(),
+        artists: vec!["Nova Kern".to_owned(), "Juno Vale".to_owned()],
+        album: Some("Convergence".to_owned()),
+        album_artist: Some("Nova Kern".to_owned()),
+        duration_ms: Some(245_678),
+        musicbrainz_recording_id: Some("d2b9c1f0-0000-4000-8000-000000000001".to_owned()),
+    }
+}
+
+/// Every credit arrives as a credit.
+///
+/// This is the whole reason decision 11 puts Maloja second. A body that
+/// joined the artists would work, and would quietly turn a duo into a band
+/// nobody has heard of in somebody's statistics.
+#[test]
+fn the_envelope_pours_in_without_losing_a_credit() {
+    let envelope = an_envelope();
+    let body = serde_json::to_value(submission(&envelope, "a-key")).unwrap();
+    assert_eq!(
+        body["artists"],
+        serde_json::json!(["Nova Kern", "Juno Vale"])
+    );
+    assert_eq!(body["albumartists"], serde_json::json!(["Nova Kern"]));
+    assert_eq!(body["album"], "Convergence");
+    assert_eq!(body["title"], "Zenith");
+}
+
+/// Both instants are seconds, and both are truncated the same way.
+///
+/// Milliseconds handed over unconverted would date every listen about fifty
+/// thousand years from now, and a listening history keeps that for good.
+#[test]
+fn the_instants_are_seconds_and_not_milliseconds() {
+    let envelope = an_envelope();
+    let body = serde_json::to_value(submission(&envelope, "a-key")).unwrap();
+    assert_eq!(body["time"], 1_700_000_123);
+    assert_eq!(body["length"], 245);
+
+    // `div_euclid`, so an instant before 1970 rounds down rather than
+    // towards zero. No listen has one; the point is not to depend on that.
+    let ancient = ScrobbleEnvelope {
+        played_at: -1_500,
+        ..an_envelope()
+    };
+    let body = serde_json::to_value(submission(&ancient, "a-key")).unwrap();
+    assert_eq!(body["time"], -2);
+}
+
+/// What this server does not know is not sent.
+///
+/// An absent album and an absent duration are absent, not empty: a
+/// destination matching on `album` treats `""` as a title, and Maloja's
+/// `duration` is a listened length this server never measured.
+#[test]
+fn what_is_unknown_is_left_out_rather_than_sent_empty() {
+    let bare = ScrobbleEnvelope {
+        album: None,
+        album_artist: None,
+        duration_ms: None,
+        ..an_envelope()
+    };
+    let body = serde_json::to_value(submission(&bare, "a-key")).unwrap();
+    let object = body.as_object().unwrap();
+    for absent in ["album", "albumartists", "length", "duration"] {
+        assert!(!object.contains_key(absent), "{absent} must not be sent");
+    }
+    // And what is always known is always sent.
+    for present in ["key", "title", "artists", "time"] {
+        assert!(object.contains_key(present), "{present} must be sent");
+    }
+}
+
+/// The body carries a secret, so it does not survive being formatted.
+///
+/// The failure message deliberately carries neither the key nor the
+/// formatted output: if this guard were removed, that output would *be* the
+/// credential, and a panic message is a log line.
+#[test]
+fn a_submission_does_not_print_its_key() {
+    let envelope = an_envelope();
+    let shown = format!("{:?}", submission(&envelope, "a-key-nobody-should-read"));
+    assert!(
+        !shown.contains("a-key-nobody-should-read"),
+        "the debug output carried the key"
+    );
+    assert!(shown.contains("[redacted]"), "the key was not replaced");
+}
+
+/// A status line, and nothing else, decides.
+#[test]
+fn the_status_line_earns_the_verdict() {
+    assert!(matches!(
+        status_verdict(reqwest::StatusCode::OK, None),
+        ScrobbleVerdict::Accepted
+    ));
+    for refused in [401, 403] {
+        assert!(
+            matches!(
+                status_verdict(reqwest::StatusCode::from_u16(refused).unwrap(), None),
+                ScrobbleVerdict::AuthBroken
+            ),
+            "{refused}"
+        );
+    }
+    for refused in [400, 413, 422] {
+        assert!(
+            matches!(
+                status_verdict(reqwest::StatusCode::from_u16(refused).unwrap(), None),
+                ScrobbleVerdict::PermanentReject
+            ),
+            "{refused}"
+        );
+    }
+    // A rate limit with no readable header still rests the link: the status
+    // says room was asked for, the header only says how much.
+    assert!(matches!(
+        status_verdict(reqwest::StatusCode::TOO_MANY_REQUESTS, None),
+        ScrobbleVerdict::Retryable {
+            after: Some(Duration::ZERO)
+        }
+    ));
+    // A redirect is not followed, and means the destination moved.
+    assert!(matches!(
+        status_verdict(reqwest::StatusCode::FOUND, None),
+        ScrobbleVerdict::Retryable { after: None }
+    ));
+}
+
+/// A `200` whose body is over the ceiling is not read, and the status line
+/// decides (RFC-023 decision 1).
+///
+/// The body is the one refusal this adapter reads, padded: a reader
+/// without the ceiling reads all of it and rejects the listen for good,
+/// which is the difference this tells apart.
+#[tokio::test]
+async fn an_answer_over_the_ceiling_leaves_the_status_line_deciding() {
+    let padding = " ".repeat(crate::remote::outbound::MAX_ANSWER_BYTES);
+    let (url, server) = crate::remote::outbound::tests::answering(axum::body::Body::from(format!(
+        "{{\"status\":\"failure\"{padding}}}"
+    )))
+    .await;
+    let base = super::super::validate_destination(&url, true).expect("a destination");
+    let client = super::super::outbound_client(Duration::from_secs(5)).expect("a client");
+    let target = Maloja::new(client, &base).expect("an adapter");
+    let secret = uuid::Uuid::new_v4().to_string();
+    let envelope = an_envelope();
+    let verdict = target.submit(&envelope, &secret).await;
+    server.abort();
+    assert!(matches!(verdict, ScrobbleVerdict::Accepted));
+}
diff --git a/src/scrobblers/mod.rs b/src/remote/scrobblers/mod.rs
similarity index 73%
rename from src/scrobblers/mod.rs
rename to src/remote/scrobblers/mod.rs
index fe70ab5c..4cb2cab3 100644
--- a/src/scrobblers/mod.rs
+++ b/src/remote/scrobblers/mod.rs
@@ -7,7 +7,7 @@
 //!
 //! Decision 10 calls outbound requests the real risk of the whole RFC — a
 //! server that calls a URL is a server somebody can make call a URL — so the
-//! rules live once, in [`crate::outbound`], rather than in each adapter. That
+//! rules live once, in [`crate::remote::outbound`], rather than in each adapter. That
 //! module is shared with metadata enrichment (RFC-011), the server's only other
 //! outbound surface.
 
@@ -69,7 +69,7 @@ pub fn validate_destination_name(name: &str) -> Result<(), OutboundError> {
 /// The canonical spelling of a destination, as an identity rather than as an
 /// address.
 ///
-/// **Not `normalize_public_url` (`src/config.rs`), and the difference is
+/// **Not `normalize_public_url` (`src/config/access.rs`), and the difference is
 /// load-bearing.** That one answers an *origin* — scheme, host, port — and
 /// throws the path away, because that is what a share link needs. A
 /// destination is not an origin: [`validate_destination`] accepts a path, so
@@ -114,15 +114,15 @@ pub fn canonical_destination(url: &url::Url) -> String {
 /// keep `scrobble_link` free of destination addresses, which decision 10 says
 /// it holds none of.
 pub fn destination_fingerprint(url: &url::Url) -> String {
-    hex::encode(crate::security::bytes_hash(
+    hex::encode(crate::auth::security::bytes_hash(
         canonical_destination(url).as_bytes(),
     ))
 }
 
-/// The client every adapter shares: [`crate::outbound::client`], which holds
+/// The client every adapter shares: [`crate::remote::outbound::client`], which holds
 /// decision 10's rules and is shared with metadata enrichment.
 pub fn outbound_client(timeout: Duration) -> Result<reqwest::Client, OutboundError> {
-    crate::outbound::client(timeout).map_err(|_| OutboundError::Unbuildable)
+    crate::remote::outbound::client(timeout).map_err(|_| OutboundError::Unbuildable)
 }
 
 /// Checks a destination an operator configured, before it is ever called.
@@ -316,126 +316,4 @@ pub(super) fn retry_after(response: &reqwest::Response) -> Option<Duration> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_destination_must_be_https_unless_the_operator_said_otherwise() {
-        assert!(validate_destination("https://api.listenbrainz.org", false).is_ok());
-
-        // The default refuses plaintext, because the request carries a personal
-        // token and the operator has not said this is their own network.
-        assert_eq!(
-            validate_destination("http://maloja.local", false),
-            Err(OutboundError::NotHttps)
-        );
-        // And permits it when they have.
-        assert!(validate_destination("http://maloja.local", true).is_ok());
-
-        // Nothing else is a destination.
-        for refused in ["ftp://host", "file:///etc/passwd", "not a url"] {
-            assert!(validate_destination(refused, true).is_err(), "{refused}");
-        }
-    }
-
-    /// The escape reaches exactly as far as the sentence that justifies it.
-    #[test]
-    fn plaintext_is_allowed_only_towards_the_operators_own_network() {
-        // The shapes decision 10 carved it for: a container named on a Docker
-        // network, the intranet suffixes, and the addresses that cannot be
-        // routed across the internet.
-        for own in [
-            "http://maloja.local",
-            "http://listens.internal",
-            "http://listens.home.arpa",
-            "http://127.0.0.1:8080",
-            "http://10.0.0.2",
-            "http://172.16.4.9",
-            "http://192.168.1.50",
-            "http://169.254.7.7",
-            "http://[::1]:8080",
-            "http://[fd00::1]",
-            "http://[fe80::1]",
-            // The same private addresses written the IPv4-mapped way. The doc
-            // above promises "their IPv6 equivalents", and an operator who
-            // spells one like this was getting a boot failure saying their own
-            // network was public.
-            "http://[::ffff:127.0.0.1]",
-            "http://[::ffff:10.0.0.1]",
-            "http://[::ffff:c0a8:1]",
-        ] {
-            assert!(validate_destination(own, true).is_ok(), "{own}");
-        }
-
-        // And never a public host, whatever the flag says: the first request
-        // to it would carry `Authorization: Token …` in clear.
-        for public in [
-            // A bare label is completed by the resolver's search list, so this
-            // one names whatever `search` says it does — which the string
-            // itself cannot tell us. It was accepted until a review made the
-            // point twice.
-            "http://maloja",
-            "http://api.listenbrainz.org",
-            "http://maloja.example.com",
-            "http://1.1.1.1",
-            "http://[2606:4700::1111]",
-            // A trailing dot and a capital spell the same public name.
-            "http://API.ListenBrainz.ORG.",
-            // And the mapped form of a public address is still public.
-            "http://[::ffff:1.1.1.1]",
-            // A name that is nothing but dots trims to the empty string, which
-            // has no dot in it and was therefore reading as "ours". Nobody's
-            // network is called that; accepting it was an accident of the test
-            // rather than a decision.
-            "http://.",
-            "http://..",
-        ] {
-            assert_eq!(
-                validate_destination(public, true),
-                Err(OutboundError::PlaintextToPublicHost),
-                "{public}"
-            );
-        }
-
-        // HTTPS reaches all of them, which is the point: the rule is about a
-        // credential crossing in clear, not about where it is going.
-        assert!(validate_destination("https://api.listenbrainz.org", false).is_ok());
-    }
-
-    #[test]
-    fn a_destination_carries_no_credentials_query_or_fragment() {
-        for refused in [
-            "https://user:secret@host",
-            "https://host?token=secret",
-            "https://host#fragment",
-        ] {
-            assert_eq!(
-                validate_destination(refused, false),
-                Err(OutboundError::NotABareOrigin),
-                "{refused}"
-            );
-        }
-        // A path is fine: a self-hosted instance may live under one.
-        assert!(validate_destination("https://host/listenbrainz", false).is_ok());
-    }
-
-    #[test]
-    fn an_endpoint_is_appended_and_never_escapes_the_configured_prefix() {
-        let base = validate_destination("https://host/listenbrainz", false).unwrap();
-        assert_eq!(
-            endpoint(&base, "/1/submit-listens").unwrap().as_str(),
-            "https://host/listenbrainz/1/submit-listens",
-            "a leading slash must not replace the operator's prefix"
-        );
-
-        // The same answer whether or not the operator typed a trailing slash.
-        let slashed = validate_destination("https://host/listenbrainz/", false).unwrap();
-        assert_eq!(
-            endpoint(&slashed, "1/submit-listens").unwrap().as_str(),
-            endpoint(&base, "1/submit-listens").unwrap().as_str()
-        );
-
-        // And no path climbs out of it.
-        assert!(endpoint(&base, "../elsewhere").is_err());
-    }
-}
+mod tests;
diff --git a/src/remote/scrobblers/tests.rs b/src/remote/scrobblers/tests.rs
new file mode 100644
index 00000000..446a2612
--- /dev/null
+++ b/src/remote/scrobblers/tests.rs
@@ -0,0 +1,121 @@
+use super::*;
+
+#[test]
+fn a_destination_must_be_https_unless_the_operator_said_otherwise() {
+    assert!(validate_destination("https://api.listenbrainz.org", false).is_ok());
+
+    // The default refuses plaintext, because the request carries a personal
+    // token and the operator has not said this is their own network.
+    assert_eq!(
+        validate_destination("http://maloja.local", false),
+        Err(OutboundError::NotHttps)
+    );
+    // And permits it when they have.
+    assert!(validate_destination("http://maloja.local", true).is_ok());
+
+    // Nothing else is a destination.
+    for refused in ["ftp://host", "file:///etc/passwd", "not a url"] {
+        assert!(validate_destination(refused, true).is_err(), "{refused}");
+    }
+}
+
+/// The escape reaches exactly as far as the sentence that justifies it.
+#[test]
+fn plaintext_is_allowed_only_towards_the_operators_own_network() {
+    // The shapes decision 10 carved it for: a container named on a Docker
+    // network, the intranet suffixes, and the addresses that cannot be
+    // routed across the internet.
+    for own in [
+        "http://maloja.local",
+        "http://listens.internal",
+        "http://listens.home.arpa",
+        "http://127.0.0.1:8080",
+        "http://10.0.0.2",
+        "http://172.16.4.9",
+        "http://192.168.1.50",
+        "http://169.254.7.7",
+        "http://[::1]:8080",
+        "http://[fd00::1]",
+        "http://[fe80::1]",
+        // The same private addresses written the IPv4-mapped way. The doc
+        // above promises "their IPv6 equivalents", and an operator who
+        // spells one like this was getting a boot failure saying their own
+        // network was public.
+        "http://[::ffff:127.0.0.1]",
+        "http://[::ffff:10.0.0.1]",
+        "http://[::ffff:c0a8:1]",
+    ] {
+        assert!(validate_destination(own, true).is_ok(), "{own}");
+    }
+
+    // And never a public host, whatever the flag says: the first request
+    // to it would carry `Authorization: Token …` in clear.
+    for public in [
+        // A bare label is completed by the resolver's search list, so this
+        // one names whatever `search` says it does — which the string
+        // itself cannot tell us. It was accepted until a review made the
+        // point twice.
+        "http://maloja",
+        "http://api.listenbrainz.org",
+        "http://maloja.example.com",
+        "http://1.1.1.1",
+        "http://[2606:4700::1111]",
+        // A trailing dot and a capital spell the same public name.
+        "http://API.ListenBrainz.ORG.",
+        // And the mapped form of a public address is still public.
+        "http://[::ffff:1.1.1.1]",
+        // A name that is nothing but dots trims to the empty string, which
+        // has no dot in it and was therefore reading as "ours". Nobody's
+        // network is called that; accepting it was an accident of the test
+        // rather than a decision.
+        "http://.",
+        "http://..",
+    ] {
+        assert_eq!(
+            validate_destination(public, true),
+            Err(OutboundError::PlaintextToPublicHost),
+            "{public}"
+        );
+    }
+
+    // HTTPS reaches all of them, which is the point: the rule is about a
+    // credential crossing in clear, not about where it is going.
+    assert!(validate_destination("https://api.listenbrainz.org", false).is_ok());
+}
+
+#[test]
+fn a_destination_carries_no_credentials_query_or_fragment() {
+    for refused in [
+        "https://user:secret@host",
+        "https://host?token=secret",
+        "https://host#fragment",
+    ] {
+        assert_eq!(
+            validate_destination(refused, false),
+            Err(OutboundError::NotABareOrigin),
+            "{refused}"
+        );
+    }
+    // A path is fine: a self-hosted instance may live under one.
+    assert!(validate_destination("https://host/listenbrainz", false).is_ok());
+}
+
+#[test]
+fn an_endpoint_is_appended_and_never_escapes_the_configured_prefix() {
+    let base = validate_destination("https://host/listenbrainz", false).unwrap();
+    assert_eq!(
+        endpoint(&base, "/1/submit-listens").unwrap().as_str(),
+        "https://host/listenbrainz/1/submit-listens",
+        "a leading slash must not replace the operator's prefix"
+    );
+
+    // The same answer whether or not the operator typed a trailing slash.
+    let slashed = validate_destination("https://host/listenbrainz/", false).unwrap();
+    assert_eq!(
+        endpoint(&slashed, "1/submit-listens").unwrap().as_str(),
+        endpoint(&base, "1/submit-listens").unwrap().as_str()
+    );
+
+    // And no path climbs out of it.
+    assert!(endpoint(&base, "../elsewhere").is_err());
+}
diff --git a/src/services/admin.rs b/src/services/admin.rs
index 5733f7c0..bd716386 100644
--- a/src/services/admin.rs
+++ b/src/services/admin.rs
@@ -397,7 +397,7 @@ impl DomainServices {
         let record = self
             .db
             .create_api_token(
-                crate::database::NewApiToken {
+                crate::storage::database::NewApiToken {
                     actor_id,
                     user_id: account_id,
                     name,
diff --git a/src/services/artist_enrichment/mod.rs b/src/services/artist_enrichment/mod.rs
index 70212c09..35ca7e47 100644
--- a/src/services/artist_enrichment/mod.rs
+++ b/src/services/artist_enrichment/mod.rs
@@ -15,7 +15,7 @@
 //! handed out with an id a client could not follow.
 
 use super::*;
-use crate::enrichment::{CachedArtist, Outcome, Provider};
+use crate::remote::enrichment::{CachedArtist, Outcome, Provider};
 
 /// How many neighbours the native artist page carries.
 pub const ARTIST_PAGE_SIMILAR: usize = 20;
@@ -93,7 +93,7 @@ impl DomainServices {
         // refresh scheduled, and an expired miss is not "nobody knows" but
         // "being asked again" — `pending`, as decision 11 defines it. Stale
         // content still shows, and `ready` wins over both.
-        let now = crate::authentication::now_ms();
+        let now = crate::auth::authentication::now_ms();
         let answered = rows.iter().filter(|row| row.expires_at > now).count();
         let state = state_of(
             bio.is_some() || image.is_some() || banner.is_some() || similar.is_some(),
diff --git a/src/services/artist_enrichment/tests.rs b/src/services/artist_enrichment/tests.rs
index 3d2ed233..44fee857 100644
--- a/src/services/artist_enrichment/tests.rs
+++ b/src/services/artist_enrichment/tests.rs
@@ -1,5 +1,5 @@
 use super::{merged_bio, state_of};
-use crate::enrichment::{CachedArtist, Outcome, Provider};
+use crate::remote::enrichment::{CachedArtist, Outcome, Provider};
 use crate::services::EnrichmentState;
 
 fn row(outcome: Outcome, bio: Option<&str>, fetched_at: i64) -> CachedArtist {
diff --git a/src/services/artist_image_search/mod.rs b/src/services/artist_image_search/mod.rs
index f3b9ccd0..0e4de3da 100644
--- a/src/services/artist_image_search/mod.rs
+++ b/src/services/artist_image_search/mod.rs
@@ -23,8 +23,8 @@ use uuid::Uuid;
 
 use super::artist_images::{chooser_library, record_artist_change, write_choice};
 use super::{ArtistImageKind, DomainServices, ServiceError};
-use crate::authentication::now_ms;
-use crate::enrichment::{DeezerCandidate, Enrichment};
+use crate::auth::authentication::now_ms;
+use crate::remote::enrichment::{DeezerCandidate, Enrichment};
 
 /// How many candidates one search offers: two rows of a picker, and twenty
 /// image fetches at most behind one request.
diff --git a/src/services/artist_images.rs b/src/services/artist_images.rs
index e4e29568..c9612cef 100644
--- a/src/services/artist_images.rs
+++ b/src/services/artist_images.rs
@@ -12,9 +12,9 @@ use sqlx::{Row, Sqlite, Transaction};
 use uuid::Uuid;
 
 use super::{DomainServices, ImageChoice, ImageChoices, ServiceError};
-use crate::authentication::now_ms;
-use crate::database::LibraryRole;
-use crate::portrait::Portrait;
+use crate::auth::authentication::now_ms;
+use crate::remote::portrait::Portrait;
+use crate::storage::database::LibraryRole;
 
 /// Which of the two images.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -74,9 +74,9 @@ pub(super) async fn record_artist_change(
     artist_id: Uuid,
     now: i64,
 ) -> Result<(), sqlx::Error> {
-    crate::catalog::record_library_event(
+    crate::storage::catalog::record_library_event(
         tx,
-        crate::catalog::LibraryChange {
+        crate::storage::catalog::LibraryChange {
             library_id,
             entity_type: "artist",
             entity_id: artist_id,
@@ -181,7 +181,7 @@ impl DomainServices {
             let mut read = self.db.pool().begin().await?;
             chooser_library(&mut read, user_id, artist_id).await?;
         }
-        crate::portrait::store(&self.artwork_dir, &image)
+        crate::remote::portrait::store(&self.artwork_dir, &image)
             .await
             .map_err(|_| ServiceError::Unavailable)?;
         let _writer = self.db.writer_guard().await;
diff --git a/src/services/artwork.rs b/src/services/artwork.rs
index ce4566b7..803b9be9 100644
--- a/src/services/artwork.rs
+++ b/src/services/artwork.rs
@@ -234,8 +234,11 @@ impl DomainServices {
         // The spent portrait searches first (RFC-013), in the same
         // transaction: their previews become unreferenced here, and a preview
         // a choice already names is kept by the clause below.
-        super::artist_image_search::forget_spent_searches(&mut tx, crate::authentication::now_ms())
-            .await?;
+        super::artist_image_search::forget_spent_searches(
+            &mut tx,
+            crate::auth::authentication::now_ms(),
+        )
+        .await?;
         let removed = sqlx::query(
             "DELETE FROM artwork WHERE \
                NOT EXISTS (SELECT 1 FROM artist WHERE artist.artwork_hash = artwork.hash) \
diff --git a/src/services/canvas/mod.rs b/src/services/canvas/mod.rs
index 7ce04036..84ec048e 100644
--- a/src/services/canvas/mod.rs
+++ b/src/services/canvas/mod.rs
@@ -36,7 +36,7 @@ use sqlx::Row;
 use uuid::Uuid;
 
 use super::{parse_uuid, CanvasBlob, DomainServices, ServiceError};
-use crate::authentication::now_ms;
+use crate::auth::authentication::now_ms;
 
 mod placement;
 mod probe;
diff --git a/src/services/canvas/placement.rs b/src/services/canvas/placement.rs
index 74de14c6..5acfcc3b 100644
--- a/src/services/canvas/placement.rs
+++ b/src/services/canvas/placement.rs
@@ -193,7 +193,7 @@ impl DomainServices {
         .fetch_optional(&mut *tx)
         .await?
         .ok_or(ServiceError::NotFound)?;
-        let role = crate::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
+        let role = crate::storage::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
             .map_err(|_| ServiceError::Invalid)?;
         if !role.may_upload() {
             return Err(ServiceError::Forbidden);
@@ -311,9 +311,9 @@ impl DomainServices {
         origin_device_id: Option<Uuid>,
         now: i64,
     ) -> Result<(), ServiceError> {
-        crate::catalog::record_library_event(
+        crate::storage::catalog::record_library_event(
             tx,
-            crate::catalog::LibraryChange {
+            crate::storage::catalog::LibraryChange {
                 library_id: parse_uuid(library_id.to_owned())?,
                 entity_type: "track",
                 entity_id: track_id,
@@ -350,8 +350,9 @@ impl DomainServices {
             .fetch_optional(&mut *tx)
             .await?
             .ok_or(ServiceError::NotFound)?;
-            let role = crate::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
-                .map_err(|_| ServiceError::Invalid)?;
+            let role =
+                crate::storage::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
+                    .map_err(|_| ServiceError::Invalid)?;
             if !role.may_upload() {
                 return Err(ServiceError::Forbidden);
             }
@@ -507,7 +508,7 @@ impl DomainServices {
         .fetch_optional(self.db.pool())
         .await?
         .ok_or(ServiceError::NotFound)?;
-        let role = crate::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
+        let role = crate::storage::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
             .map_err(|_| ServiceError::Invalid)?;
         if !role.may_upload() || row.try_get::<i64, _>("accepts_canvas")? == 0 {
             return Err(ServiceError::Forbidden);
diff --git a/src/services/catalog.rs b/src/services/catalog.rs
index a7fd1860..01270ebc 100644
--- a/src/services/catalog.rs
+++ b/src/services/catalog.rs
@@ -148,7 +148,7 @@ impl DomainServices {
         album_page: BrowsePage,
         song_page: BrowsePage,
     ) -> Result<CatalogSearch, ServiceError> {
-        let Some(fts) = crate::catalog::fts_prefix_query(query) else {
+        let Some(fts) = crate::storage::catalog::fts_prefix_query(query) else {
             return Ok(CatalogSearch {
                 artists: Vec::new(),
                 albums: Vec::new(),
diff --git a/src/services/credentials.rs b/src/services/credentials.rs
index b8733a02..f01c4973 100644
--- a/src/services/credentials.rs
+++ b/src/services/credentials.rs
@@ -80,10 +80,13 @@ impl DomainServices {
         user_id: Uuid,
         request: AuthorizationRequest<'_>,
     ) -> Result<String, ServiceError> {
-        crate::oauth::validate_redirect_uri(request.redirect_uri)
-            .map_err(|_| ServiceError::Invalid)?;
-        crate::oauth::validate_challenge(request.code_challenge_method, request.code_challenge)
+        crate::auth::oauth::validate_redirect_uri(request.redirect_uri)
             .map_err(|_| ServiceError::Invalid)?;
+        crate::auth::oauth::validate_challenge(
+            request.code_challenge_method,
+            request.code_challenge,
+        )
+        .map_err(|_| ServiceError::Invalid)?;
         let client_id = request.client_id.trim();
         let device_name = request.device_name.trim();
         // Checked before the code exists: a name the session issuer would
@@ -95,7 +98,7 @@ impl DomainServices {
         let code = security::generate_token("wfc_");
         let now = now_ms();
         self.db
-            .create_authorization(crate::database::NewAuthorization {
+            .create_authorization(crate::storage::database::NewAuthorization {
                 code_hash: security::token_hash(&code),
                 user_id,
                 client_id,
@@ -103,11 +106,11 @@ impl DomainServices {
                 code_challenge: request.code_challenge,
                 device_name,
                 now_ms: now,
-                expires_at: now + crate::oauth::AUTHORIZATION_CODE_TTL_MS,
+                expires_at: now + crate::auth::oauth::AUTHORIZATION_CODE_TTL_MS,
                 scopes: request.scopes,
             })
             .await?;
-        Ok(crate::oauth::redirect_with_code(
+        Ok(crate::auth::oauth::redirect_with_code(
             request.redirect_uri,
             &code,
             request.state,
diff --git a/src/services/credit_decisions.rs b/src/services/credit_decisions.rs
index e33ebe6f..06d8aa48 100644
--- a/src/services/credit_decisions.rs
+++ b/src/services/credit_decisions.rs
@@ -3,7 +3,7 @@
 //! A decision belongs to the library: taken by its owners and managers, read
 //! back by every scan, applied at once to the stored catalogue without
 //! reading a file, and undone the same way. The rule itself is
-//! `crate::credit_split`; this is who may invoke it, and what follows from it
+//! `crate::library::credit_split`; this is who may invoke it, and what follows from it
 //! — the library feed, the derivations a scan would rerun, and the favourites
 //! and ratings that would otherwise point at an artist nobody credits.
 
@@ -13,9 +13,9 @@ use sqlx::{Sqlite, Transaction};
 use tokio::sync::OwnedMutexGuard;
 
 use super::*;
-use crate::authentication::now_ms;
-use crate::credit_split::{credit_key, fragments, is_candidate};
-use crate::database::LibraryRole;
+use crate::auth::authentication::now_ms;
+use crate::library::credit_split::{credit_key, fragments, is_candidate};
+use crate::storage::database::LibraryRole;
 
 /// One fragment of a credit an owner is asked about, and whether the library
 /// already has an artist of that name — the strongest hint that a split is
@@ -109,8 +109,8 @@ fn record_event(
     action: &'static str,
     payload: serde_json::Value,
     now: i64,
-) -> crate::catalog::LibraryChange<'static> {
-    crate::catalog::LibraryChange {
+) -> crate::storage::catalog::LibraryChange<'static> {
+    crate::storage::catalog::LibraryChange {
         library_id,
         entity_type,
         entity_id,
@@ -301,7 +301,7 @@ impl DomainServices {
                 .map(|part| self.db.pid().artist_id(library_id, part.trim()))
                 .collect();
             for part in &part_ids {
-                crate::catalog::record_library_event(
+                crate::storage::catalog::record_library_event(
                     &mut tx,
                     record_event(
                         library_id,
@@ -318,7 +318,7 @@ impl DomainServices {
                 receipts = self
                     .carry_user_data(&writer, &mut tx, artist_id, &part_ids)
                     .await?;
-                crate::catalog::record_library_event(
+                crate::storage::catalog::record_library_event(
                     &mut tx,
                     record_event(
                         library_id,
@@ -408,7 +408,7 @@ impl DomainServices {
             self.record_moved(&mut tx, library_id, &moved, now).await?;
             let joined = self.db.pid().artist_id(library_id, credit.trim());
             if still_credited(&mut tx, joined).await? {
-                crate::catalog::record_library_event(
+                crate::storage::catalog::record_library_event(
                     &mut tx,
                     record_event(
                         library_id,
@@ -427,7 +427,7 @@ impl DomainServices {
                 } else {
                     "delete"
                 };
-                crate::catalog::record_library_event(
+                crate::storage::catalog::record_library_event(
                     &mut tx,
                     record_event(
                         library_id,
@@ -456,11 +456,11 @@ impl DomainServices {
         tracks: &[String],
         now: i64,
     ) -> Result<Moved, ServiceError> {
-        let decisions = crate::catalog::credit_decisions(tx, library_id).await?;
+        let decisions = crate::storage::catalog::credit_decisions(tx, library_id).await?;
         let mut moved = Moved::default();
         for track in tracks {
             let track_id = parse_uuid(track.clone())?;
-            let outcome = crate::catalog::recompute_track_participants(
+            let outcome = crate::storage::catalog::recompute_track_participants(
                 tx,
                 self.db.pid(),
                 library_id,
@@ -487,7 +487,7 @@ impl DomainServices {
         now: i64,
     ) -> Result<(), ServiceError> {
         for (track, full_hash) in &moved.tracks {
-            crate::catalog::record_library_event(
+            crate::storage::catalog::record_library_event(
                 tx,
                 record_event(
                     library_id,
@@ -501,7 +501,7 @@ impl DomainServices {
             .await?;
         }
         for album in &moved.albums {
-            crate::catalog::record_library_event(
+            crate::storage::catalog::record_library_event(
                 tx,
                 record_event(
                     library_id,
@@ -720,8 +720,8 @@ impl DomainServices {
 /// the feed has already announced as deleted, and a retry would only answer
 /// `409`. Together, the two land or neither does.
 async fn rederive(tx: &mut Transaction<'_, Sqlite>, library_id: Uuid) -> Result<(), sqlx::Error> {
-    crate::database::Database::consolidate_sort_names_in(tx, library_id).await?;
-    crate::database::Database::consolidate_catalog_derivations_in(tx, library_id).await
+    crate::storage::database::Database::consolidate_sort_names_in(tx, library_id).await?;
+    crate::storage::database::Database::consolidate_catalog_derivations_in(tx, library_id).await
 }
 
 /// Whether anything still credits an artist: a participant, or an album that
diff --git a/src/services/lastfm.rs b/src/services/lastfm.rs
index c208acaf..23366d2f 100644
--- a/src/services/lastfm.rs
+++ b/src/services/lastfm.rs
@@ -109,7 +109,7 @@ pub(super) fn lastfm_unavailability(
 
 /// Turns a request token into a session key.
 ///
-/// Implemented in `src/scrobblers/lastfm.rs`, because that is the only place in
+/// Implemented in `src/remote/scrobblers/lastfm/`, because that is the only place in
 /// this server that makes an outbound request. Registered like a
 /// [`ScrobbleTarget`] and for the same reason: a test drives the whole journey
 /// against a double, and a server with no application registers neither.
@@ -195,8 +195,8 @@ impl DomainServices {
         // state is the only thing separating a legitimate return from a
         // fabricated one, and the cookie is the only thing separating *this*
         // browser's return from anybody who came by the URL afterwards.
-        let state = crate::security::generate_token("");
-        let cookie = crate::security::generate_token("");
+        let state = crate::auth::security::generate_token("");
+        let cookie = crate::auth::security::generate_token("");
         let now = now_ms();
         let expires_at =
             now.saturating_add(i64::try_from(JOURNEY_TTL.as_millis()).unwrap_or(i64::MAX));
@@ -218,7 +218,7 @@ impl DomainServices {
         .bind(user_id.to_string())
         .bind(destination)
         .bind(&fingerprint)
-        .bind(crate::security::token_hash(&cookie).as_slice())
+        .bind(crate::auth::security::token_hash(&cookie).as_slice())
         .bind(now)
         .bind(expires_at)
         .execute(&mut *tx)
@@ -300,7 +300,7 @@ impl DomainServices {
             // One refusal for every way of being wrong: expired, or the wrong
             // browser. Distinguishing them would tell whoever found the URL
             // which half they are missing.
-            if now >= expires_at || !crate::security::token_matches(cookie, &cookie_hash) {
+            if now >= expires_at || !crate::auth::security::token_matches(cookie, &cookie_hash) {
                 return Err(ServiceError::NotFound);
             }
             (
diff --git a/src/services/library_events.rs b/src/services/library_events.rs
index 5d10efe1..287c0859 100644
--- a/src/services/library_events.rs
+++ b/src/services/library_events.rs
@@ -1,10 +1,10 @@
 //! Reading a library's change feed.
 //!
 //! The counterpart of the RFC-003 journal for the half of the server that had
-//! no feed at all. Written by scans in `catalog.rs`; read here.
+//! no feed at all. Written by scans in `storage/catalog/`; read here.
 
 use super::*;
-use crate::sync::MAX_SYNC_LIMIT;
+use crate::storage::sync::MAX_SYNC_LIMIT;
 
 /// How often the feed is trimmed.
 ///
diff --git a/src/services/library_folders/mod.rs b/src/services/library_folders/mod.rs
index 8e9043c0..ce7ec2be 100644
--- a/src/services/library_folders/mod.rs
+++ b/src/services/library_folders/mod.rs
@@ -18,8 +18,8 @@ use uuid::Uuid;
 use super::{
     attach_song_relations, song_from_row, BrowsePage, DomainServices, ServiceError, SongItem,
 };
-use crate::authentication::now_ms;
-use crate::database::LibraryRole;
+use crate::auth::authentication::now_ms;
+use crate::storage::database::LibraryRole;
 
 /// The deepest a folder may sit: the root is 0, a folder at the root is 1.
 pub const MAX_FOLDER_DEPTH: i64 = 16;
diff --git a/src/services/library_lifecycle/edit.rs b/src/services/library_lifecycle/edit.rs
index 6f26808a..eb8efa72 100644
--- a/src/services/library_lifecycle/edit.rs
+++ b/src/services/library_lifecycle/edit.rs
@@ -209,7 +209,7 @@ impl DomainServices {
         // the job queued, and the next boot runs it (`ScanManager::boot`).
         self.scanner.spawn(
             scan_id,
-            crate::catalog::LibraryRecord {
+            crate::storage::catalog::LibraryRecord {
                 id: library_id,
                 name: name.unwrap_or(before.library.name),
                 root_path: root.unwrap_or(before.library.root_path),
diff --git a/src/services/library_tree/mod.rs b/src/services/library_tree/mod.rs
index 6d3a2e73..1f27d82f 100644
--- a/src/services/library_tree/mod.rs
+++ b/src/services/library_tree/mod.rs
@@ -126,7 +126,7 @@ impl DomainServices {
     /// of an empty library is an empty listing. `Invalid` for a malformed path.
     ///
     /// Folders and tracks sort by name in natural order — numbers by value,
-    /// letters case-folded (`crate::natural_order`) — so `2 …` comes before
+    /// letters case-folded (`crate::storage::natural_order`) — so `2 …` comes before
     /// `10 …`. Tracks sort by file name, except in the received folder, whose file names are hashes: there they
     /// sort by artist then title, a missing artist last.
     pub async fn disk_tree(
diff --git a/src/services/lyrics_uploads.rs b/src/services/lyrics_uploads.rs
index f21db405..b36a92dd 100644
--- a/src/services/lyrics_uploads.rs
+++ b/src/services/lyrics_uploads.rs
@@ -14,8 +14,8 @@ use sqlx::Row;
 use uuid::Uuid;
 
 use super::{DomainServices, ServiceError};
-use crate::authentication::now_ms;
-use crate::lyrics::{self, LyricsList, StructuredLyrics, UploadFormat};
+use crate::auth::authentication::now_ms;
+use crate::library::lyrics::{self, LyricsList, StructuredLyrics, UploadFormat};
 
 /// The sidecar's cap, so an upload is held to what a scan would read.
 pub const MAX_UPLOAD_BYTES: usize = 1024 * 1024;
@@ -313,7 +313,7 @@ impl DomainServices {
         .fetch_optional(&mut **tx)
         .await?
         .ok_or(ServiceError::NotFound)?;
-        let role = crate::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
+        let role = crate::storage::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
             .map_err(|_| ServiceError::Invalid)?;
         if !role.may_write_metadata() {
             return Err(ServiceError::Forbidden);
diff --git a/src/services/mod.rs b/src/services/mod.rs
index a7390884..7f4b2240 100644
--- a/src/services/mod.rs
+++ b/src/services/mod.rs
@@ -8,12 +8,16 @@ use utoipa::ToSchema;
 use uuid::Uuid;
 
 use crate::{
-    authentication::now_ms,
-    database::{AccountRecord, AccountRole, ApiTokenRecord, Database, SubsonicCredentialStatus},
-    lyrics::{self, LyricsList, StructuredLyrics},
-    playlist_file::{self, PlaylistFileEntry},
-    security::{self, EncryptedSecret, SecretBox},
-    sync::{MutationContext, MutationIntent, MutationReceipt, OperationClaim, SyncService},
+    auth::authentication::now_ms,
+    auth::security::{self, EncryptedSecret, SecretBox},
+    library::lyrics::{self, LyricsList, StructuredLyrics},
+    library::playlist_file::{self, PlaylistFileEntry},
+    storage::database::{
+        AccountRecord, AccountRole, ApiTokenRecord, Database, SubsonicCredentialStatus,
+    },
+    storage::sync::{
+        MutationContext, MutationIntent, MutationReceipt, OperationClaim, SyncService,
+    },
 };
 
 #[macro_use]
@@ -24,7 +28,7 @@ pub struct DomainServices {
     db: Database,
     secret_box: Arc<SecretBox>,
     sync: SyncService,
-    scanner: crate::scanner::ScanManager,
+    scanner: crate::library::scanner::ScanManager,
     uploads: crate::config::UploadLimits,
     library_event_retention: crate::config::LibraryEventRetention,
     /// How long a missing track is kept before the retention pass purges it,
@@ -36,7 +40,7 @@ pub struct DomainServices {
     /// The folders outside every library a stored path may lead into through
     /// a link (`WAVEFLOW_LINK_ROOTS`): the quality analysis reads those files
     /// as the stream does.
-    link_roots: crate::link_roots::LinkRoots,
+    link_roots: crate::library::link_roots::LinkRoots,
     /// Bounds a credential an account mints for itself. See the field on
     /// [`crate::config::Config`] for why the administrative path is not
     /// bounded by it.
@@ -95,7 +99,7 @@ pub struct DomainServices {
     /// Metadata enrichment — RFC-011. Disabled at construction and placed by
     /// [`Self::use_enrichment`], like the scrobbling adapters and for the same
     /// reason: a test drives it against a provider of its own.
-    enrichment: Arc<std::sync::RwLock<crate::enrichment::Enrichment>>,
+    enrichment: Arc<std::sync::RwLock<crate::remote::enrichment::Enrichment>>,
     /// How long a portrait search's task may run, in milliseconds (RFC-013):
     /// [`ARTIST_IMAGE_SEARCH_DEADLINE`], except where a test shortens it
     /// rather than wait five minutes.
@@ -105,7 +109,7 @@ pub struct DomainServices {
     quality: quality::QualityRuntime,
     /// Lyrics from LRCLIB — RFC-024. Disabled at construction and placed by
     /// [`Self::use_lyrics_lookup`], like enrichment and for the same reason.
-    lyrics_lookup: Arc<std::sync::RwLock<crate::lrclib::LyricsLookup>>,
+    lyrics_lookup: Arc<std::sync::RwLock<crate::remote::lrclib::LyricsLookup>>,
     /// Podcasts (RFC-025): the settings, and the one download permit and one
     /// refresh lock the background work shares.
     podcasts: podcasts::PodcastRuntime,
@@ -141,17 +145,16 @@ pub enum ServiceError {
     Security(#[from] security::SecurityError),
 }
 
-impl From<crate::sync::SyncError> for ServiceError {
-    fn from(error: crate::sync::SyncError) -> Self {
+impl From<crate::storage::sync::SyncError> for ServiceError {
+    fn from(error: crate::storage::sync::SyncError) -> Self {
         match error {
-            crate::sync::SyncError::Invalid => Self::Invalid,
+            crate::storage::sync::SyncError::Invalid => Self::Invalid,
             // Mutations claim operations; they never read the journal, so
             // CursorExpired cannot reach this conversion. Folded into Conflict
             // rather than given a domain variant nothing would ever construct.
-            crate::sync::SyncError::Conflict | crate::sync::SyncError::CursorExpired => {
-                Self::Conflict
-            }
-            crate::sync::SyncError::Database(error) => Self::Database(error),
+            crate::storage::sync::SyncError::Conflict
+            | crate::storage::sync::SyncError::CursorExpired => Self::Conflict,
+            crate::storage::sync::SyncError::Database(error) => Self::Database(error),
         }
     }
 }
@@ -305,7 +308,7 @@ impl DomainServices {
         db: Database,
         secret_box: Arc<SecretBox>,
         sync: SyncService,
-        scanner: crate::scanner::ScanManager,
+        scanner: crate::library::scanner::ScanManager,
         config: &crate::config::Config,
     ) -> Self {
         // Copied here rather than borrowed, which is why mutating a `Config`
@@ -320,7 +323,7 @@ impl DomainServices {
             library_event_retention: config.library_event_retention,
             unavailable_retention: config.unavailable_retention,
             purge_grace: config.purge_grace,
-            link_roots: crate::link_roots::LinkRoots::new(config.link_roots.clone()),
+            link_roots: crate::library::link_roots::LinkRoots::new(config.link_roots.clone()),
             api_token_ttl: config.api_token_ttl,
             upload_locks: Arc::new(dashmap::DashMap::new()),
             canvas: config.canvas,
@@ -347,7 +350,7 @@ impl DomainServices {
             lastfm_unavailable: lastfm::lastfm_unavailability(config),
             lastfm_exchanges: Arc::new(dashmap::DashMap::new()),
             enrichment: Arc::new(std::sync::RwLock::new(
-                crate::enrichment::Enrichment::disabled(),
+                crate::remote::enrichment::Enrichment::disabled(),
             )),
             image_search_deadline_ms: Arc::new(std::sync::atomic::AtomicU64::new(
                 u64::try_from(ARTIST_IMAGE_SEARCH_DEADLINE.as_millis()).unwrap_or(u64::MAX),
@@ -357,7 +360,7 @@ impl DomainServices {
                 config.request_timeout,
             ),
             lyrics_lookup: Arc::new(std::sync::RwLock::new(
-                crate::lrclib::LyricsLookup::disabled(),
+                crate::remote::lrclib::LyricsLookup::disabled(),
             )),
             podcasts: podcasts::PodcastRuntime::new(config.podcasts.clone()),
             remote_artwork: config.remote_artwork,
@@ -367,7 +370,7 @@ impl DomainServices {
     }
 
     /// Places the enrichment engine every reader goes through.
-    pub fn use_enrichment(&self, enrichment: crate::enrichment::Enrichment) {
+    pub fn use_enrichment(&self, enrichment: crate::remote::enrichment::Enrichment) {
         *self
             .enrichment
             .write()
diff --git a/src/services/model/accounts.rs b/src/services/model/accounts.rs
index 8d392c2b..ff36243f 100644
--- a/src/services/model/accounts.rs
+++ b/src/services/model/accounts.rs
@@ -6,8 +6,8 @@ use utoipa::ToSchema;
 use uuid::Uuid;
 
 use crate::{
-    database::{AccountRecord, AccountRole},
-    security::EncryptedSecret,
+    auth::security::EncryptedSecret,
+    storage::database::{AccountRecord, AccountRole},
 };
 
 pub struct SubsonicCredentialRecord {
diff --git a/src/services/model/browse.rs b/src/services/model/browse.rs
index 1c04255d..249ebab1 100644
--- a/src/services/model/browse.rs
+++ b/src/services/model/browse.rs
@@ -98,7 +98,7 @@ impl Default for BrowsePage {
 ///
 /// This is the single implementation of the ten Subsonic `getAlbumList2` modes,
 /// and it lives in the domain services rather than in the facade for two
-/// reasons. The facade used to sort in Rust over [`DomainServices::catalog_snapshot`],
+/// reasons. The facade used to sort in Rust over [`DomainServices::catalog_snapshot`](crate::services::DomainServices::catalog_snapshot),
 /// which materialises every folder, artist, album *and track* the tenant can
 /// see on each call — `byGenre` then rescanned every track once per album, and
 /// `songCount` needed the whole track list just to be counted. And the native
diff --git a/src/services/model/catalog.rs b/src/services/model/catalog.rs
index 5561f225..00e6682f 100644
--- a/src/services/model/catalog.rs
+++ b/src/services/model/catalog.rs
@@ -328,7 +328,7 @@ pub struct ArtistDetail {
     /// while the artist is not one of the album's own artists — "Appears on"
     /// (RFC-022 decision 3).
     ///
-    /// Filled by [`DomainServices::artist_page`] alone, like the enrichment:
+    /// Filled by [`DomainServices::artist_page`](crate::services::DomainServices::artist_page) alone, like the enrichment:
     /// the Subsonic `getArtist` path has nowhere to put it, and a client that
     /// syncs every artist would pay for a query it never reads.
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -336,7 +336,7 @@ pub struct ArtistDetail {
     /// What metadata enrichment says about this artist — RFC-011 decision 11.
     ///
     /// Always present on `GET /api/v2/artists/{id}`, whose answer comes from
-    /// [`DomainServices::artist_page`]. Left out of the Subsonic `getArtist`
+    /// [`DomainServices::artist_page`](crate::services::DomainServices::artist_page). Left out of the Subsonic `getArtist`
     /// path, which renders its own nodes: clients that sync call it for every
     /// artist, and asking providers about the whole catalogue at sync time is
     /// the prefill decision 6 refuses.
diff --git a/src/services/model/playlists.rs b/src/services/model/playlists.rs
index fe3a43a6..1118fecf 100644
--- a/src/services/model/playlists.rs
+++ b/src/services/model/playlists.rs
@@ -6,7 +6,7 @@ use utoipa::ToSchema;
 use uuid::Uuid;
 
 use super::catalog::SongItem;
-use crate::playlist_file::TextEncoding;
+use crate::library::playlist_file::TextEncoding;
 
 #[derive(Debug, Clone, Serialize, ToSchema)]
 pub struct PlaylistItem {
@@ -82,7 +82,7 @@ pub enum UnresolvedReason {
     Duplicate,
 }
 
-/// Optional fields a playlist update may blank out. See [`ShareClear`].
+/// Optional fields a playlist update may blank out. See [`ShareClear`](crate::services::ShareClear).
 #[derive(Debug, Clone, Copy, Default)]
 pub struct PlaylistClear {
     pub comment: bool,
diff --git a/src/services/playlists/files.rs b/src/services/playlists/files.rs
index e301706a..39555716 100644
--- a/src/services/playlists/files.rs
+++ b/src/services/playlists/files.rs
@@ -5,7 +5,7 @@ use super::*;
 impl DomainServices {
     /// Imports an `.m3u` or `.m3u8` file as a playlist of this account's.
     ///
-    /// The file is read by [`crate::playlist_file`]; what is left here is the
+    /// The file is read by [`crate::library::playlist_file`]; what is left here is the
     /// part that needs the catalogue — turning what an entry *says* into a
     /// track this account can actually reach.
     ///
diff --git a/src/services/podcasts/episodes.rs b/src/services/podcasts/episodes.rs
index 15bbea2c..4f44bc97 100644
--- a/src/services/podcasts/episodes.rs
+++ b/src/services/podcasts/episodes.rs
@@ -263,7 +263,7 @@ impl DomainServices {
     pub async fn podcast_stream_source(
         &self,
         episode_id: Uuid,
-    ) -> Result<Option<crate::catalog::StreamTrack>, ServiceError> {
+    ) -> Result<Option<crate::storage::catalog::StreamTrack>, ServiceError> {
         let row = sqlx::query(
             "SELECT file_name, content_hash, suffix, duration_ms FROM podcast_episode \
              WHERE id=? AND status='completed'",
@@ -274,7 +274,7 @@ impl DomainServices {
         let Some(row) = row else {
             return Ok(None);
         };
-        Ok(Some(crate::catalog::StreamTrack {
+        Ok(Some(crate::storage::catalog::StreamTrack {
             id: episode_id,
             library_id: Uuid::nil(),
             library_root: self.podcasts.settings.dir.clone(),
@@ -287,8 +287,8 @@ impl DomainServices {
             // The server's own folder, written by its downloads: no link in
             // it is ever followed (RFC-021), and an episode carries no
             // ReplayGain tags (RFC-022).
-            link_policy: crate::link_roots::LinkPolicy::default(),
-            replay_gain: crate::replay_gain::ReplayGainTags::default(),
+            link_policy: crate::library::link_roots::LinkPolicy::default(),
+            replay_gain: crate::media::replay_gain::ReplayGainTags::default(),
         }))
     }
 
@@ -298,7 +298,7 @@ impl DomainServices {
         &self,
         user_id: Uuid,
         id: Uuid,
-    ) -> Result<Option<crate::catalog::StreamTrack>, ServiceError> {
+    ) -> Result<Option<crate::storage::catalog::StreamTrack>, ServiceError> {
         if let Some(track) = self.db.stream_track_for_user(user_id, id).await? {
             return Ok(Some(track));
         }
diff --git a/src/services/podcasts/mod.rs b/src/services/podcasts/mod.rs
index 9347982e..b3eae33b 100644
--- a/src/services/podcasts/mod.rs
+++ b/src/services/podcasts/mod.rs
@@ -26,7 +26,7 @@
 use std::path::Path;
 
 use super::*;
-use crate::podcast::{self, FetchPolicy};
+use crate::remote::podcast::{self, FetchPolicy};
 
 /// How many episodes `getNewestPodcasts` answers when it is not told, as the
 /// specification has it, and the most it answers.
@@ -135,7 +135,7 @@ pub struct EpisodeBookmark {
 pub enum PodcastFailure {
     Service(ServiceError),
     /// The feed could not be fetched or read, as a word from the fixed list
-    /// `src/podcast.rs` defines. Nothing was stored.
+    /// `src/remote/podcast/` defines. Nothing was stored.
     Feed(String),
 }
 
diff --git a/src/services/quality/analysis.rs b/src/services/quality/analysis.rs
index eb0ccd0c..8b161138 100644
--- a/src/services/quality/analysis.rs
+++ b/src/services/quality/analysis.rs
@@ -128,7 +128,7 @@ impl DomainServices {
                     full_hash: row.try_get("full_hash")?,
                     root_path: row.try_get("root_path")?,
                     relative_path: row.try_get("relative_path")?,
-                    link_policy: crate::link_roots::LinkPolicy::from_columns(
+                    link_policy: crate::library::link_roots::LinkPolicy::from_columns(
                         row.try_get("follow_links")?,
                         row.try_get::<Option<String>, _>("other_roots")?.as_deref(),
                     ),
diff --git a/src/services/quality/mod.rs b/src/services/quality/mod.rs
index 0f324521..24d1685b 100644
--- a/src/services/quality/mod.rs
+++ b/src/services/quality/mod.rs
@@ -374,7 +374,7 @@ struct Pending {
     full_hash: String,
     root_path: String,
     relative_path: String,
-    link_policy: crate::link_roots::LinkPolicy,
+    link_policy: crate::library::link_roots::LinkPolicy,
     duration_ms: i64,
     created_at: i64,
 }
diff --git a/src/services/quality/reads.rs b/src/services/quality/reads.rs
index 558f2bff..86f447f4 100644
--- a/src/services/quality/reads.rs
+++ b/src/services/quality/reads.rs
@@ -213,7 +213,10 @@ impl DomainServices {
             std::path::Path::new(&root_path),
             &relative_path,
             &self.link_roots,
-            &crate::link_roots::LinkPolicy::from_columns(follow_links, other_roots.as_deref()),
+            &crate::library::link_roots::LinkPolicy::from_columns(
+                follow_links,
+                other_roots.as_deref(),
+            ),
         )
         .await
         .map_err(|_| ServiceError::Unavailable)?;
diff --git a/src/services/radio/mod.rs b/src/services/radio/mod.rs
index 6f51e1fb..bcaeaf68 100644
--- a/src/services/radio/mod.rs
+++ b/src/services/radio/mod.rs
@@ -17,7 +17,7 @@
 //! `img-src`, and the listener's address that would leak with it). So the
 //! server fetches it when an account sets or changes it — never on a timer, and
 //! never while anybody listens — through the rules a podcast cover is fetched
-//! under ([`crate::portrait::fetch_followed`]): public addresses only, checked
+//! under ([`crate::remote::portrait::fetch_followed`]): public addresses only, checked
 //! and pinned, redirects followed by hand and each hop checked, 10 MiB, and the
 //! bytes sniffed as JPEG, PNG or WebP. Only the image comes back, and only into
 //! the artwork store; a failure keeps the address and shows no image, and the
diff --git a/src/services/remote_artwork/mod.rs b/src/services/remote_artwork/mod.rs
index 996404e9..a83032ea 100644
--- a/src/services/remote_artwork/mod.rs
+++ b/src/services/remote_artwork/mod.rs
@@ -4,7 +4,7 @@
 //! The web client cannot show either from where it lives. RFC-019's
 //! Content-Security-Policy keeps `img-src` to this origin, and an image loaded
 //! from the feed's host would hand that host the address of every listener. So
-//! the server fetches it once, through [`crate::portrait::fetch_followed`],
+//! the server fetches it once, through [`crate::remote::portrait::fetch_followed`],
 //! stores the bytes in the artwork store beside the scanned covers, and every
 //! surface hands out the hash — never the address it came from.
 //!
@@ -81,19 +81,19 @@ impl DomainServices {
             tracing::warn!(subject, reason = "unparsable", "remote artwork not fetched");
             return None;
         };
-        let policy = crate::podcast::FetchPolicy {
+        let policy = crate::remote::podcast::FetchPolicy {
             addresses: self.remote_artwork.addresses,
             allow_http,
             timeout: self.remote_artwork.timeout,
         };
-        let image = match crate::portrait::fetch_followed(&parsed, policy).await {
+        let image = match crate::remote::portrait::fetch_followed(&parsed, policy).await {
             Ok(image) => image,
             Err(refusal) => {
                 tracing::warn!(subject, reason = %refusal, "remote artwork not fetched");
                 return None;
             }
         };
-        if let Err(error) = crate::portrait::store(&self.artwork_dir, &image).await {
+        if let Err(error) = crate::remote::portrait::store(&self.artwork_dir, &image).await {
             tracing::warn!(subject, %error, "remote artwork could not be stored");
             return None;
         }
diff --git a/src/services/remote_lyrics/mod.rs b/src/services/remote_lyrics/mod.rs
index a89c7bbd..b31e8cc5 100644
--- a/src/services/remote_lyrics/mod.rs
+++ b/src/services/remote_lyrics/mod.rs
@@ -14,7 +14,7 @@
 //! read from the cache or sent anywhere.
 
 use super::*;
-use crate::lrclib::{FoundLyrics, LyricsLookup, TrackLookup};
+use crate::remote::lrclib::{FoundLyrics, LyricsLookup, TrackLookup};
 
 impl DomainServices {
     /// Places the LRCLIB lookup every lyrics reader goes through.
diff --git a/src/services/remote_lyrics/tests.rs b/src/services/remote_lyrics/tests.rs
index f7d91ef9..a1ebcd0e 100644
--- a/src/services/remote_lyrics/tests.rs
+++ b/src/services/remote_lyrics/tests.rs
@@ -1,5 +1,5 @@
 use super::sheet_of;
-use crate::lrclib::FoundLyrics;
+use crate::remote::lrclib::FoundLyrics;
 
 #[test]
 fn timings_win_and_a_sheet_without_words_is_none() {
diff --git a/src/services/scan.rs b/src/services/scan.rs
index ad662d7b..72323d87 100644
--- a/src/services/scan.rs
+++ b/src/services/scan.rs
@@ -54,7 +54,7 @@ impl DomainServices {
     /// only when nothing at all could be queued.
     ///
     /// Re-queuing a library that is already scanning is deliberately allowed,
-    /// exactly as calling the native endpoint twice is: [`crate::scanner::ScanManager`]
+    /// exactly as calling the native endpoint twice is: [`crate::library::scanner::ScanManager`]
     /// serialises jobs per library and a scan converges on file content, so a
     /// redundant pass costs time and changes nothing.
     pub async fn start_visible_scans(&self, user_id: Uuid) -> Result<Vec<Uuid>, ServiceError> {
diff --git a/src/services/scrobbling/mod.rs b/src/services/scrobbling/mod.rs
index 09f321e6..2abb308e 100644
--- a/src/services/scrobbling/mod.rs
+++ b/src/services/scrobbling/mod.rs
@@ -33,7 +33,7 @@ pub enum ScrobbleProvider {
     /// `LastFm` into `last_fm` — names the `CHECK` constraint refuses and
     /// `FromStr` cannot read, so the API would publish a destination no client
     /// could send back in. One rule per variant, and no interaction between
-    /// two. [`tests::the_four_spellings_of_a_destination_agree`] holds them
+    /// two. `tests::the_four_spellings_of_a_destination_agree` holds them
     /// together.
     #[serde(rename = "listenbrainz")]
     ListenBrainz,
diff --git a/src/services/search.rs b/src/services/search.rs
index 71b7ebab..1418b68e 100644
--- a/src/services/search.rs
+++ b/src/services/search.rs
@@ -111,7 +111,7 @@ impl DomainServices {
         // querying on each keystroke would otherwise get nothing until the word
         // is complete — "ech" returned zero results while "echo" returned the
         // album. Native clients type incrementally just as Subsonic ones do.
-        let Some(fts) = crate::catalog::fts_prefix_query(query) else {
+        let Some(fts) = crate::storage::catalog::fts_prefix_query(query) else {
             return Ok(SearchResult {
                 artists: Vec::new(),
                 albums: Vec::new(),
diff --git a/src/services/shares/tests.rs b/src/services/shares/tests.rs
index 8c200021..25365062 100644
--- a/src/services/shares/tests.rs
+++ b/src/services/shares/tests.rs
@@ -57,7 +57,7 @@ async fn a_share(state: &crate::AppState) -> (String, Uuid, Uuid) {
     )
     .bind(share.to_string())
     .bind(account.to_string())
-    .bind(crate::security::token_hash(&token).as_slice())
+    .bind(crate::auth::security::token_hash(&token).as_slice())
     .execute(pool)
     .await
     .expect("share");
diff --git a/src/services/smart_playlists/mod.rs b/src/services/smart_playlists/mod.rs
index cd806326..070cff42 100644
--- a/src/services/smart_playlists/mod.rs
+++ b/src/services/smart_playlists/mod.rs
@@ -10,7 +10,7 @@
 //!    nothing that was refused is stored. The service methods take the parsed
 //!    type, never the JSON, so there is no way to reach the database with rules
 //!    that skipped the parse.
-//! 2. **One static statement.** [`EVALUATE`] is a single literal, assembled by
+//! 2. **One static statement.** [`EVALUATE`](crate::services::smart_playlists::statement::EVALUATE) is a single literal, assembled by
 //!    `concat!` like every projection here. The rules reach it as *one bound
 //!    value* — a JSON document SQLite takes apart with `json_each` — and every
 //!    field name, operator and logical connective in it is compared against a
diff --git a/src/services/smart_playlists/rules.rs b/src/services/smart_playlists/rules.rs
index 509b6c27..993ab525 100644
--- a/src/services/smart_playlists/rules.rs
+++ b/src/services/smart_playlists/rules.rs
@@ -263,7 +263,7 @@ impl SmartOperator {
 impl SmartSort {
     /// The sort keys, in the order their codes are numbered: entry `i` sorts
     /// ascending under code `2i + 1` and descending under `2i + 2`. The codes
-    /// are what [`EVALUATE`] compares against, so this order and the `ORDER BY`
+    /// are what [`EVALUATE`](crate::services::smart_playlists::statement::EVALUATE) compares against, so this order and the `ORDER BY`
     /// list there are one table written twice; `the_sort_codes_match_the_statement`
     /// holds them together.
     const ALL: [(&'static str, SmartSort); 11] = [
@@ -281,7 +281,7 @@ impl SmartSort {
     ];
 }
 
-/// The code [`EVALUATE`] reads for "no sort": its fixed tie-break alone.
+/// The code [`EVALUATE`](crate::services::smart_playlists::statement::EVALUATE) reads for "no sort": its fixed tie-break alone.
 const SORT_NONE: i64 = 0;
 /// The code for a random order, whatever direction was asked.
 pub(super) const SORT_RANDOM: i64 = 99;
@@ -379,7 +379,7 @@ impl SmartRules {
         serde_json::to_string(self).expect("rule serialization cannot fail")
     }
 
-    /// The code [`EVALUATE`] orders by.
+    /// The code [`EVALUATE`](crate::services::smart_playlists::statement::EVALUATE) orders by.
     pub(super) fn sort_code(&self) -> i64 {
         match self.sort {
             None => SORT_NONE,
@@ -528,7 +528,7 @@ fn date_ms(value: &str) -> Option<i64> {
     Some(date.and_hms_opt(0, 0, 0)?.and_utc().timestamp_millis())
 }
 
-/// One condition as [`EVALUATE`] binds it.
+/// One condition as [`EVALUATE`](crate::services::smart_playlists::statement::EVALUATE) binds it.
 ///
 /// `o` is the elementary comparison: `eq`, `ne`, `has`, `hasnt`, `sw`, `ew` for
 /// text; `eq`, `ne`, `gt`, `lt`, `bt` for numbers; `ge` and `lt` for dates.
diff --git a/src/services/track_metadata.rs b/src/services/track_metadata.rs
index 5ddd7aac..57309f29 100644
--- a/src/services/track_metadata.rs
+++ b/src/services/track_metadata.rs
@@ -116,8 +116,10 @@ impl DomainServices {
             .bind(user_id.to_string())
             .fetch_optional(self.db.pool())
             .await?;
-            let role = crate::database::LibraryRole::from_str(&role.ok_or(ServiceError::NotFound)?)
-                .map_err(|_| ServiceError::Invalid)?;
+            let role = crate::storage::database::LibraryRole::from_str(
+                &role.ok_or(ServiceError::NotFound)?,
+            )
+            .map_err(|_| ServiceError::Invalid)?;
             if !role.may_write_metadata() {
                 return Err(ServiceError::Forbidden);
             }
@@ -164,9 +166,10 @@ impl DomainServices {
                     // not the authority and does not need to be: it exists so a
                     // caller who may not write cannot make the server read a
                     // file and hash it end to end before being told no.
-                    let role =
-                        crate::database::LibraryRole::from_str(hint.try_get::<&str, _>("role")?)
-                            .map_err(|_| ServiceError::Invalid)?;
+                    let role = crate::storage::database::LibraryRole::from_str(
+                        hint.try_get::<&str, _>("role")?,
+                    )
+                    .map_err(|_| ServiceError::Invalid)?;
                     // Only an explicit `null` drops a list. A list the patch
                     // leaves out keeps its correction, so there is nothing to
                     // restore and no reason to read the file.
@@ -227,7 +230,7 @@ impl DomainServices {
         let scanned_title: String = row.try_get("title")?;
         let full_hash: String = row.try_get("full_hash")?;
         let last_seen_scan_id: Option<String> = row.try_get("last_seen_scan_id")?;
-        let role = crate::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
+        let role = crate::storage::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
             .map_err(|_| ServiceError::Invalid)?;
         if !role.may_write_metadata() {
             // Blurred onto 404 by the surfaces above, like every other refusal
@@ -244,7 +247,7 @@ impl DomainServices {
         // a stored list it cannot decode instead of reading it as none. Read as
         // none, a patch that never mentioned it would erase it by writing the
         // merge back.
-        let stored_lists = crate::catalog::track_override_lists(&mut tx, track_id).await?;
+        let stored_lists = crate::storage::catalog::track_override_lists(&mut tx, track_id).await?;
         let title = merge(requested_title, row.try_get("o_title")?);
         let sort_title = merge(requested_sort_title, row.try_get("o_sort_title")?);
         let year = merge(patch.year, row.try_get("o_year")?);
@@ -326,13 +329,13 @@ impl DomainServices {
             // have refused every received file until a scan happened to walk
             // past it.
             let scan_id = last_seen_scan_id.map(parse_uuid).transpose()?;
-            let decisions = crate::catalog::credit_decisions(&mut tx, library_id).await?;
-            crate::database::Database::apply_catalog_track_in_transaction(
+            let decisions = crate::storage::catalog::credit_decisions(&mut tx, library_id).await?;
+            crate::storage::database::Database::apply_catalog_track_in_transaction(
                 &mut tx,
                 self.db.pid(),
                 library_id,
                 scan_id,
-                &crate::catalog::CatalogApply {
+                &crate::storage::catalog::CatalogApply {
                     input,
                     existing_id: Some(track_id),
                     moved: false,
@@ -356,12 +359,12 @@ impl DomainServices {
         // something merely similar. Only for a list this patch set: one it left
         // out already has its rows, and rewriting them identically would still
         // delete and reinsert every credit.
-        let effective = crate::catalog::TrackOverrideLists {
+        let effective = crate::storage::catalog::TrackOverrideLists {
             title: title.clone(),
             artists: requested_artists.flatten(),
             genres: requested_genres.flatten(),
         };
-        crate::catalog::apply_track_override_lists(
+        crate::storage::catalog::apply_track_override_lists(
             &mut tx,
             self.db.pid(),
             library_id,
@@ -413,9 +416,9 @@ impl DomainServices {
         // belongs to the library and every member sees it. The hash travels
         // with it unchanged, which is the client's evidence that its link
         // survived the edit.
-        crate::catalog::record_library_event(
+        crate::storage::catalog::record_library_event(
             &mut tx,
-            crate::catalog::LibraryChange {
+            crate::storage::catalog::LibraryChange {
                 library_id,
                 entity_type: "track",
                 entity_id: track_id,
diff --git a/src/services/uploads/negotiate.rs b/src/services/uploads/negotiate.rs
index a6b11978..007b0117 100644
--- a/src/services/uploads/negotiate.rs
+++ b/src/services/uploads/negotiate.rs
@@ -96,7 +96,7 @@ impl DomainServices {
         .fetch_optional(&mut *tx)
         .await?
         .ok_or(ServiceError::NotFound)?;
-        let role = crate::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
+        let role = crate::storage::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
             .map_err(|_| ServiceError::Invalid)?;
         if !role.may_upload() {
             // Blurred onto 404 by the surface above. A caller who may not
diff --git a/src/services/uploads/transfer.rs b/src/services/uploads/transfer.rs
index 791aca35..ef85af13 100644
--- a/src/services/uploads/transfer.rs
+++ b/src/services/uploads/transfer.rs
@@ -75,7 +75,7 @@ impl DomainServices {
         .fetch_optional(self.db.pool())
         .await?
         .ok_or(ServiceError::NotFound)?;
-        let role = crate::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
+        let role = crate::storage::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
             .map_err(|_| ServiceError::Invalid)?;
         if !role.may_upload() {
             // Blurred onto 404: someone who may no longer upload learns nothing
@@ -353,8 +353,9 @@ impl DomainServices {
                 .bind(&relative)
                 .fetch_optional(&mut *tx)
                 .await?;
-        let decisions = crate::catalog::credit_decisions(&mut tx, target.library_id).await?;
-        crate::database::Database::apply_catalog_track_in_transaction(
+        let decisions =
+            crate::storage::catalog::credit_decisions(&mut tx, target.library_id).await?;
+        crate::storage::database::Database::apply_catalog_track_in_transaction(
             &mut tx,
             self.db.pid(),
             target.library_id,
@@ -362,7 +363,7 @@ impl DomainServices {
             // borrowing an unrelated job's identity, and the end-of-scan sweep
             // knows what that means.
             None,
-            &crate::catalog::CatalogApply {
+            &crate::storage::catalog::CatalogApply {
                 input,
                 existing_id: existing_id.map(parse_uuid).transpose()?,
                 moved: false,
diff --git a/src/catalog/apply.rs b/src/storage/catalog/apply.rs
similarity index 97%
rename from src/catalog/apply.rs
rename to src/storage/catalog/apply.rs
index c77d4d4c..d1ae4577 100644
--- a/src/catalog/apply.rs
+++ b/src/storage/catalog/apply.rs
@@ -4,7 +4,7 @@
 use sqlx::{Sqlite, Transaction};
 use uuid::Uuid;
 
-use crate::{authentication::now_ms, database::Database};
+use crate::{auth::authentication::now_ms, storage::database::Database};
 
 use super::{
     credit_decisions,
@@ -38,7 +38,7 @@ pub struct CatalogTrackInput {
     pub artists: Vec<String>,
     pub album_artists: Vec<String>,
     /// Every other role the file names, as it spelled them.
-    pub roles: Vec<(crate::tags::Role, Vec<String>)>,
+    pub roles: Vec<(crate::library::tags::Role, Vec<String>)>,
     /// Performer credits, already split into instrument and name.
     pub performer_pairs: Vec<(String, String)>,
     pub album: Option<String>,
@@ -94,7 +94,7 @@ pub struct CatalogTrackInput {
     pub disc_subtitle: Option<String>,
     pub artwork: Option<ArtworkInput>,
     pub lyrics_hash: String,
-    pub lyrics: Vec<crate::lyrics::LyricsInput>,
+    pub lyrics: Vec<crate::library::lyrics::LyricsInput>,
 }
 
 #[derive(Debug, Clone)]
@@ -200,11 +200,11 @@ impl Database {
     /// scan failed to find.
     pub(crate) async fn apply_catalog_track_in_transaction(
         tx: &mut Transaction<'_, Sqlite>,
-        pid: &crate::pid::PidSpecs,
+        pid: &crate::library::pid::PidSpecs,
         library_id: Uuid,
         scan_id: Option<Uuid>,
         apply: &CatalogApply,
-        decisions: &crate::credit_split::Decisions,
+        decisions: &crate::library::credit_split::Decisions,
         now: i64,
     ) -> Result<ApplyOutcome, sqlx::Error> {
         let input = &apply.input;
@@ -227,7 +227,7 @@ impl Database {
         // composer or a conductor comes from the file and nobody corrected it.
         let overrides = track_override_lists(tx, track_id).await?;
         // The library's decisions, read by the caller inside this transaction.
-        let credits = crate::credit_split::resolve(
+        let credits = crate::library::credit_split::resolve(
             &file_credits,
             decisions,
             overrides.artists.as_deref(),
@@ -246,13 +246,13 @@ impl Database {
         // tag mapper's whole job, and it applies the reference's rules rather
         // than this file's old `;`-only cut. What is left here is turning
         // names into rows.
-        let artist_names: Vec<String> = credit_names(&credits, crate::tags::Role::Artist);
+        let artist_names: Vec<String> = credit_names(&credits, crate::library::tags::Role::Artist);
         let mut artist_ids = Vec::with_capacity(artist_names.len());
         for artist in &artist_names {
             artist_ids.push(upsert_artist(tx, pid, library_id, artist, now).await?);
         }
         let album_artist_names: Vec<String> =
-            credit_names(&credits, crate::tags::Role::AlbumArtist);
+            credit_names(&credits, crate::library::tags::Role::AlbumArtist);
         // The first step's names, not the decisions': the display string is
         // what the album's identity hashes (RFC-015 decision 4).
         let album_artist = album_artist_display(input, &file_credits);
@@ -413,11 +413,11 @@ impl Database {
             .await?;
         for credit in &credits {
             let artist_id = match credit.role {
-                crate::tags::Role::Artist => artist_ids
+                crate::library::tags::Role::Artist => artist_ids
                     .get(credit.position)
                     .copied()
                     .expect("every artist credit was upserted above"),
-                crate::tags::Role::AlbumArtist => album_artist_ids
+                crate::library::tags::Role::AlbumArtist => album_artist_ids
                     .get(credit.position)
                     .copied()
                     .expect("every album-artist credit was upserted above"),
@@ -533,7 +533,7 @@ async fn upsert_artwork(
 /// real character are two artists, as they are in the reference.
 pub(super) async fn upsert_artist(
     tx: &mut Transaction<'_, Sqlite>,
-    pid: &crate::pid::PidSpecs,
+    pid: &crate::library::pid::PidSpecs,
     library: Uuid,
     name: &str,
     now: i64,
@@ -583,7 +583,7 @@ pub(super) async fn upsert_genre(
 /// and nothing has to notice.
 async fn upsert_album(
     tx: &mut Transaction<'_, Sqlite>,
-    pid: &crate::pid::PidSpecs,
+    pid: &crate::library::pid::PidSpecs,
     library: Uuid,
     input: &CatalogTrackInput,
     album_artist: Option<&str>,
diff --git a/src/catalog/availability.rs b/src/storage/catalog/availability.rs
similarity index 99%
rename from src/catalog/availability.rs
rename to src/storage/catalog/availability.rs
index 2466a6d1..aebd7f87 100644
--- a/src/catalog/availability.rs
+++ b/src/storage/catalog/availability.rs
@@ -5,7 +5,7 @@
 use sqlx::Row;
 use uuid::Uuid;
 
-use crate::{authentication::now_ms, database::Database};
+use crate::{auth::authentication::now_ms, storage::database::Database};
 
 use super::{parse_uuid, record_library_event, LibraryChange};
 
diff --git a/src/catalog/credits.rs b/src/storage/catalog/credits.rs
similarity index 87%
rename from src/catalog/credits.rs
rename to src/storage/catalog/credits.rs
index 1e15c1ed..08b1ae07 100644
--- a/src/catalog/credits.rs
+++ b/src/storage/catalog/credits.rs
@@ -11,10 +11,10 @@ use super::{apply::upsert_artist, parse_uuid, track_override_lists};
 /// The two lists derived from it are read in lockstep — a name and the sort
 /// form paired with it — so they have to come from one ordering.
 fn credits_in_role(
-    credits: &[crate::tags::Credit],
-    role: crate::tags::Role,
-) -> Vec<&crate::tags::Credit> {
-    let mut named: Vec<&crate::tags::Credit> = credits
+    credits: &[crate::library::tags::Credit],
+    role: crate::library::tags::Role,
+) -> Vec<&crate::library::tags::Credit> {
+    let mut named: Vec<&crate::library::tags::Credit> = credits
         .iter()
         .filter(|credit| credit.role == role)
         .collect();
@@ -32,17 +32,16 @@ fn credits_in_role(
 /// `track_credit` holds the sort form a participant gets and a decision splits
 /// the same one a scan would.
 pub(super) fn with_album_artist_sorts(
-    mut credits: Vec<crate::tags::Credit>,
-) -> Vec<crate::tags::Credit> {
+    mut credits: Vec<crate::library::tags::Credit>,
+) -> Vec<crate::library::tags::Credit> {
     let album: Vec<(String, Option<String>)> =
-        credits_in_role(&credits, crate::tags::Role::AlbumArtist)
+        credits_in_role(&credits, crate::library::tags::Role::AlbumArtist)
             .iter()
             .map(|credit| (credit.name.clone(), credit.sort_name.clone()))
             .collect();
-    for credit in credits
-        .iter_mut()
-        .filter(|credit| credit.role == crate::tags::Role::Artist && credit.sort_name.is_none())
-    {
+    for credit in credits.iter_mut().filter(|credit| {
+        credit.role == crate::library::tags::Role::Artist && credit.sort_name.is_none()
+    }) {
         credit.sort_name = album
             .iter()
             .find(|(name, _)| *name == credit.name)
@@ -59,22 +58,22 @@ pub(super) fn with_album_artist_sorts(
 pub(crate) async fn credit_decisions(
     tx: &mut Transaction<'_, Sqlite>,
     library_id: Uuid,
-) -> Result<crate::credit_split::Decisions, sqlx::Error> {
+) -> Result<crate::library::credit_split::Decisions, sqlx::Error> {
     let rows = sqlx::query(
         "SELECT credit_key, decision, parts FROM artist_credit_decision WHERE library_id = ?",
     )
     .bind(library_id.to_string())
     .fetch_all(&mut **tx)
     .await?;
-    let mut decisions = crate::credit_split::Decisions::new();
+    let mut decisions = crate::library::credit_split::Decisions::new();
     for row in rows {
         let key: String = row.try_get("credit_key")?;
         let decision = match row.try_get::<&str, _>("decision")? {
-            "keep" => crate::credit_split::CreditDecision::Keep,
+            "keep" => crate::library::credit_split::CreditDecision::Keep,
             _ => {
                 let parts: Option<String> = row.try_get("parts")?;
                 match parts.and_then(|parts| serde_json::from_str::<Vec<String>>(&parts).ok()) {
-                    Some(parts) => crate::credit_split::CreditDecision::Split(parts),
+                    Some(parts) => crate::library::credit_split::CreditDecision::Split(parts),
                     None => continue,
                 }
             }
@@ -89,7 +88,7 @@ pub(crate) async fn write_track_credits(
     tx: &mut Transaction<'_, Sqlite>,
     library_id: Uuid,
     track_id: Uuid,
-    credits: &[crate::tags::Credit],
+    credits: &[crate::library::tags::Credit],
 ) -> Result<(), sqlx::Error> {
     sqlx::query("DELETE FROM track_credit WHERE track_id = ?")
         .bind(track_id.to_string())
@@ -120,7 +119,7 @@ pub(crate) async fn write_track_credits(
 pub(crate) async fn read_track_credits(
     tx: &mut Transaction<'_, Sqlite>,
     track_id: Uuid,
-) -> Result<Vec<crate::tags::Credit>, sqlx::Error> {
+) -> Result<Vec<crate::library::tags::Credit>, sqlx::Error> {
     let rows = sqlx::query(
         "SELECT role, sub_role, position, name, sort_name FROM track_credit          WHERE track_id = ? ORDER BY role, position",
     )
@@ -131,10 +130,10 @@ pub(crate) async fn read_track_credits(
     for row in rows {
         // A role this binary does not know was written by a newer one; it is
         // left out rather than guessed, as `track_participant` leaves it.
-        let Some(role) = crate::tags::Role::parse(row.try_get::<&str, _>("role")?) else {
+        let Some(role) = crate::library::tags::Role::parse(row.try_get::<&str, _>("role")?) else {
             continue;
         };
-        credits.push(crate::tags::Credit {
+        credits.push(crate::library::tags::Credit {
             role,
             sub_role: row.try_get("sub_role")?,
             name: row.try_get("name")?,
@@ -163,10 +162,10 @@ pub(crate) struct Recomputed {
 /// behind.
 pub(crate) async fn recompute_track_participants(
     tx: &mut Transaction<'_, Sqlite>,
-    pid: &crate::pid::PidSpecs,
+    pid: &crate::library::pid::PidSpecs,
     library_id: Uuid,
     track_id: Uuid,
-    decisions: &crate::credit_split::Decisions,
+    decisions: &crate::library::credit_split::Decisions,
     now: i64,
 ) -> Result<Recomputed, sqlx::Error> {
     let row = sqlx::query("SELECT album_id, full_hash, artist_display FROM track WHERE id = ?")
@@ -182,7 +181,7 @@ pub(crate) async fn recompute_track_participants(
 
     let file_credits = read_track_credits(tx, track_id).await?;
     let overrides = track_override_lists(tx, track_id).await?;
-    let credits = crate::credit_split::resolve(
+    let credits = crate::library::credit_split::resolve(
         &file_credits,
         decisions,
         overrides.artists.as_deref(),
@@ -222,7 +221,7 @@ pub(crate) async fn recompute_track_participants(
     let mut first_album_artist = None;
     for credit in &credits {
         let artist_id = upsert_artist(tx, pid, library_id, &credit.name, now).await?;
-        if credit.role == crate::tags::Role::AlbumArtist && first_album_artist.is_none() {
+        if credit.role == crate::library::tags::Role::AlbumArtist && first_album_artist.is_none() {
             first_album_artist = Some(artist_id);
         }
         sqlx::query(
@@ -270,8 +269,8 @@ pub(crate) async fn recompute_track_participants(
 }
 
 pub(super) fn credit_names(
-    credits: &[crate::tags::Credit],
-    role: crate::tags::Role,
+    credits: &[crate::library::tags::Credit],
+    role: crate::library::tags::Role,
 ) -> Vec<String> {
     credits_in_role(credits, role)
         .iter()
diff --git a/src/catalog/derivations.rs b/src/storage/catalog/derivations.rs
similarity index 99%
rename from src/catalog/derivations.rs
rename to src/storage/catalog/derivations.rs
index 525c0970..4df6c04c 100644
--- a/src/catalog/derivations.rs
+++ b/src/storage/catalog/derivations.rs
@@ -4,7 +4,7 @@
 use sqlx::{Sqlite, Transaction};
 use uuid::Uuid;
 
-use crate::database::Database;
+use crate::storage::database::Database;
 
 impl Database {
     /// Re-derives `album.sort_name` and `artist.sort_name` from the tags the
diff --git a/src/catalog/identity.rs b/src/storage/catalog/identity.rs
similarity index 97%
rename from src/catalog/identity.rs
rename to src/storage/catalog/identity.rs
index 3a944859..87ba5be1 100644
--- a/src/catalog/identity.rs
+++ b/src/storage/catalog/identity.rs
@@ -5,7 +5,7 @@
 use sqlx::{Row, Sqlite, Transaction};
 use uuid::Uuid;
 
-use crate::database::Database;
+use crate::storage::database::Database;
 
 use super::{credits::credit_names, parse_uuid, CatalogTrackInput};
 
@@ -35,7 +35,7 @@ impl Database {
     /// Returns how many libraries were marked, so a caller can say so.
     pub async fn reconcile_catalog_identity(
         &self,
-        specs: &crate::pid::PidSpecs,
+        specs: &crate::library::pid::PidSpecs,
     ) -> Result<u64, sqlx::Error> {
         // `pid.track` is handled apart, and never by re-identifying anything:
         // a track's id is its path, then its content hash, then the relocation
@@ -106,7 +106,7 @@ impl Database {
     /// before that first scan free.
     async fn clear_track_hints_if_spec_changed(
         &self,
-        specs: &crate::pid::PidSpecs,
+        specs: &crate::library::pid::PidSpecs,
     ) -> Result<(), sqlx::Error> {
         let active = specs.track.source();
         // A catalogue built before the property existed is not evidence of a
@@ -165,7 +165,7 @@ impl Database {
     /// user already stars what it would have become.
     async fn remap_artist_user_data(
         &self,
-        specs: &crate::pid::PidSpecs,
+        specs: &crate::library::pid::PidSpecs,
     ) -> Result<u64, sqlx::Error> {
         let rows = sqlx::query("SELECT id, library_id, name FROM artist")
             .fetch_all(self.pool())
@@ -328,8 +328,8 @@ impl<'a> TrackIdentity<'a> {
 /// Derived here rather than by the scanner because this is where identity is
 /// written — and now also where the relocation hint is, which has to hash the
 /// same values the row is built from.
-pub(super) fn track_credits(input: &CatalogTrackInput) -> Vec<crate::tags::Credit> {
-    crate::tags::credits(&crate::tags::RawCredits {
+pub(super) fn track_credits(input: &CatalogTrackInput) -> Vec<crate::library::tags::Credit> {
+    crate::library::tags::credits(&crate::library::tags::RawCredits {
         artist: input.artist.iter().cloned().collect(),
         artists: input.artists.clone(),
         album_artist: input.album_artist.iter().cloned().collect(),
@@ -346,9 +346,9 @@ pub(super) fn track_credits(input: &CatalogTrackInput) -> Vec<crate::tags::Credi
 /// hangs off the first credited artist.
 pub(super) fn album_artist_display(
     input: &CatalogTrackInput,
-    credits: &[crate::tags::Credit],
+    credits: &[crate::library::tags::Credit],
 ) -> Option<String> {
-    let names = credit_names(credits, crate::tags::Role::AlbumArtist);
+    let names = credit_names(credits, crate::library::tags::Role::AlbumArtist);
     input
         .album_artist
         .as_deref()
@@ -365,7 +365,7 @@ pub(super) fn album_artist_display(
 /// only tells a scan that the file it is looking at is probably the one whose
 /// path disappeared, when neither the path nor the content hash can say so.
 pub fn track_pid(
-    specs: &crate::pid::PidSpecs,
+    specs: &crate::library::pid::PidSpecs,
     library_id: Uuid,
     input: &CatalogTrackInput,
 ) -> Uuid {
@@ -374,7 +374,7 @@ pub fn track_pid(
     specs.track_id(library_id, &TrackIdentity::new(input, &album_artist))
 }
 
-impl crate::pid::PidSource for TrackIdentity<'_> {
+impl crate::library::pid::PidSource for TrackIdentity<'_> {
     fn tag(&self, name: &str) -> Option<&str> {
         let value = match name {
             "musicbrainz_albumid" => self.input.musicbrainz_release_id.as_deref(),
diff --git a/src/catalog/libraries.rs b/src/storage/catalog/libraries.rs
similarity index 94%
rename from src/catalog/libraries.rs
rename to src/storage/catalog/libraries.rs
index be00ad33..c58cfea1 100644
--- a/src/catalog/libraries.rs
+++ b/src/storage/catalog/libraries.rs
@@ -8,7 +8,7 @@ use sqlx::Row;
 use utoipa::ToSchema;
 use uuid::Uuid;
 
-use crate::{authentication::now_ms, database::Database};
+use crate::{auth::authentication::now_ms, storage::database::Database};
 
 use super::parse_uuid;
 
@@ -34,8 +34,8 @@ pub struct LibraryScanSettings {
 pub struct LibraryAccess {
     pub id: Uuid,
     pub name: String,
-    pub visibility: crate::database::LibraryVisibility,
-    pub role: crate::database::LibraryRole,
+    pub visibility: crate::storage::database::LibraryVisibility,
+    pub role: crate::storage::database::LibraryRole,
     pub last_scan_started_at: Option<i64>,
     pub last_scan_completed_at: Option<i64>,
     /// Whether the library takes files at all. The operator's decision, set
@@ -76,12 +76,14 @@ impl Database {
                 Ok(LibraryAccess {
                     id: parse_uuid(row.try_get("id")?)?,
                     name: row.try_get("name")?,
-                    visibility: crate::database::LibraryVisibility::from_str(
+                    visibility: crate::storage::database::LibraryVisibility::from_str(
                         row.try_get::<&str, _>("visibility")?,
                     )
                     .map_err(|error| sqlx::Error::Decode(error.into()))?,
-                    role: crate::database::LibraryRole::from_str(row.try_get::<&str, _>("role")?)
-                        .map_err(|error| sqlx::Error::Decode(error.into()))?,
+                    role: crate::storage::database::LibraryRole::from_str(
+                        row.try_get::<&str, _>("role")?,
+                    )
+                    .map_err(|error| sqlx::Error::Decode(error.into()))?,
                     last_scan_started_at: row.try_get("last_scan_started_at")?,
                     last_scan_completed_at: row.try_get("last_scan_completed_at")?,
                     accepts_uploads: row.try_get::<i64, _>("accepts_uploads")? != 0,
diff --git a/src/catalog/mod.rs b/src/storage/catalog/mod.rs
similarity index 100%
rename from src/catalog/mod.rs
rename to src/storage/catalog/mod.rs
diff --git a/src/catalog/overrides.rs b/src/storage/catalog/overrides.rs
similarity index 99%
rename from src/catalog/overrides.rs
rename to src/storage/catalog/overrides.rs
index db767a72..32838ad3 100644
--- a/src/catalog/overrides.rs
+++ b/src/storage/catalog/overrides.rs
@@ -74,7 +74,7 @@ pub(crate) async fn track_override_lists(
 /// which is why the delete is narrowed rather than wholesale.
 pub(crate) async fn apply_track_override_lists(
     tx: &mut Transaction<'_, Sqlite>,
-    pid: &crate::pid::PidSpecs,
+    pid: &crate::library::pid::PidSpecs,
     library_id: Uuid,
     track_id: Uuid,
     lists: &TrackOverrideLists,
diff --git a/src/catalog/scan_jobs.rs b/src/storage/catalog/scan_jobs.rs
similarity index 99%
rename from src/catalog/scan_jobs.rs
rename to src/storage/catalog/scan_jobs.rs
index 0da15169..daac5884 100644
--- a/src/catalog/scan_jobs.rs
+++ b/src/storage/catalog/scan_jobs.rs
@@ -6,7 +6,7 @@ use sqlx::{Row, Sqlite, Transaction};
 use utoipa::ToSchema;
 use uuid::Uuid;
 
-use crate::{authentication::now_ms, database::Database};
+use crate::{auth::authentication::now_ms, storage::database::Database};
 
 use super::parse_uuid;
 
@@ -171,7 +171,7 @@ impl Database {
     /// Membership alone is not that grant. A scan walks the owner's files and
     /// competes for the writer gate, so it is reserved to `owner` and
     /// `manager`: a `listener` is entitled to read the catalogue, not to spend
-    /// someone else's disk on it. [`crate::database::LibraryRole::may_scan`]
+    /// someone else's disk on it. [`crate::storage::database::LibraryRole::may_scan`]
     /// names the same rule for callers that have the row in hand.
     ///
     /// Returns `None` when the user is not, or no longer, entitled. Callers
diff --git a/src/catalog/tests.rs b/src/storage/catalog/tests.rs
similarity index 100%
rename from src/catalog/tests.rs
rename to src/storage/catalog/tests.rs
diff --git a/src/catalog/tracks.rs b/src/storage/catalog/tracks.rs
similarity index 96%
rename from src/catalog/tracks.rs
rename to src/storage/catalog/tracks.rs
index 88a207b0..fe768cb2 100644
--- a/src/catalog/tracks.rs
+++ b/src/storage/catalog/tracks.rs
@@ -8,7 +8,7 @@ use sqlx::Row;
 use utoipa::ToSchema;
 use uuid::Uuid;
 
-use crate::database::Database;
+use crate::storage::database::Database;
 
 use super::parse_uuid;
 
@@ -25,9 +25,9 @@ pub struct StreamTrack {
     pub available: bool,
     /// Whether, and how far, a link in `relative_path` may be followed when
     /// the file is opened (RFC-021, links outside the root).
-    pub link_policy: crate::link_roots::LinkPolicy,
+    pub link_policy: crate::library::link_roots::LinkPolicy,
     /// The track's ReplayGain tags, for a transcode asked to apply them.
-    pub replay_gain: crate::replay_gain::ReplayGainTags,
+    pub replay_gain: crate::media::replay_gain::ReplayGainTags,
 }
 
 #[derive(Debug, Clone, Serialize, ToSchema)]
@@ -204,11 +204,11 @@ fn stream_track_from_row(row: sqlx::sqlite::SqliteRow) -> Result<StreamTrack, sq
         bitrate: row.try_get("bitrate")?,
         duration_ms: row.try_get("duration_ms")?,
         available: row.try_get::<i64, _>("is_available")? != 0,
-        link_policy: crate::link_roots::LinkPolicy::from_columns(
+        link_policy: crate::library::link_roots::LinkPolicy::from_columns(
             row.try_get("follow_links")?,
             row.try_get::<Option<String>, _>("other_roots")?.as_deref(),
         ),
-        replay_gain: crate::replay_gain::ReplayGainTags {
+        replay_gain: crate::media::replay_gain::ReplayGainTags {
             track_gain: row.try_get("replay_gain_track_gain")?,
             track_peak: row.try_get("replay_gain_track_peak")?,
             album_gain: row.try_get("replay_gain_album_gain")?,
diff --git a/src/database/accounts.rs b/src/storage/database/accounts.rs
similarity index 100%
rename from src/database/accounts.rs
rename to src/storage/database/accounts.rs
diff --git a/src/database/keys.rs b/src/storage/database/keys.rs
similarity index 97%
rename from src/database/keys.rs
rename to src/storage/database/keys.rs
index eb4ff9ed..fda7132d 100644
--- a/src/database/keys.rs
+++ b/src/storage/database/keys.rs
@@ -32,7 +32,7 @@ pub struct KeyMaterial {
 /// not a detail of a single operation.
 pub enum Rekey<'a> {
     /// The old key is in hand. Every ciphertext is read and written back.
-    Reencrypt(&'a crate::security::SecretBox),
+    Reencrypt(&'a crate::auth::security::SecretBox),
     /// The old key is gone. Nothing can be read, so the rows go.
     Discard,
 }
@@ -129,7 +129,7 @@ impl Database {
     ///
     /// Shares are rewritten whichever plan runs, and they are the reason this
     /// is one function rather than two. A share token is *derived* from the
-    /// key rather than stored ([`crate::security::SecretBox::derive_share_token`]),
+    /// key rather than stored ([`crate::auth::security::SecretBox::derive_share_token`]),
     /// so after a key change the stored hash is one the new key can never
     /// produce: the share is not merely re-addressed, it is unreachable, and
     /// its owner is shown a URL that answers 404. Recomputing the hash is what
@@ -137,7 +137,7 @@ impl Database {
     pub async fn rekey(
         connection: &mut SqliteConnection,
         plan: Rekey<'_>,
-        new_key: &crate::security::SecretBox,
+        new_key: &crate::auth::security::SecretBox,
         new_fingerprint: &[u8],
         now_ms: i64,
     ) -> anyhow::Result<KeyMaterial> {
@@ -275,7 +275,7 @@ impl Database {
             // every synchronising client a modification with no journal entry
             // behind it.
             sqlx::query("UPDATE share SET token_hash=? WHERE id=?")
-                .bind(crate::security::token_hash(&token).as_slice())
+                .bind(crate::auth::security::token_hash(&token).as_slice())
                 .bind(&id)
                 .execute(&mut *tx)
                 .await?;
diff --git a/src/database/libraries.rs b/src/storage/database/libraries.rs
similarity index 100%
rename from src/database/libraries.rs
rename to src/storage/database/libraries.rs
diff --git a/src/database/metadata.rs b/src/storage/database/metadata.rs
similarity index 92%
rename from src/database/metadata.rs
rename to src/storage/database/metadata.rs
index 320ae663..8f592423 100644
--- a/src/database/metadata.rs
+++ b/src/storage/database/metadata.rs
@@ -7,7 +7,7 @@ use uuid::Uuid;
 
 use super::Database;
 
-/// RFC-011's cache, which [`crate::enrichment`] fills and reads.
+/// RFC-011's cache, which [`crate::remote::enrichment`] fills and reads.
 ///
 /// No user id and no tenancy anywhere in it: what a provider says about a name
 /// is the same whoever asks, and nothing here is account data (decision 4).
@@ -22,7 +22,7 @@ impl Database {
     pub async fn metadata_artist_rows(
         &self,
         name_canonical: &str,
-    ) -> Result<Vec<crate::enrichment::CachedArtist>, sqlx::Error> {
+    ) -> Result<Vec<crate::remote::enrichment::CachedArtist>, sqlx::Error> {
         let rows = sqlx::query(
             "SELECT provider, outcome, bio_summary, bio_full, image_hash, fanart_hash, \
                     fetched_at, expires_at \
@@ -34,14 +34,14 @@ impl Database {
         let mut cached = Vec::with_capacity(rows.len());
         for row in rows {
             let provider: String = row.try_get("provider")?;
-            let Some(provider) = crate::enrichment::Provider::parse(&provider) else {
+            let Some(provider) = crate::remote::enrichment::Provider::parse(&provider) else {
                 continue;
             };
             let outcome: String = row.try_get("outcome")?;
-            let outcome = crate::enrichment::Outcome::parse(&outcome).ok_or_else(|| {
+            let outcome = crate::remote::enrichment::Outcome::parse(&outcome).ok_or_else(|| {
                 sqlx::Error::Decode(format!("unknown enrichment outcome {outcome:?}").into())
             })?;
-            cached.push(crate::enrichment::CachedArtist {
+            cached.push(crate::remote::enrichment::CachedArtist {
                 provider,
                 outcome,
                 bio_summary: row.try_get("bio_summary")?,
@@ -58,9 +58,9 @@ impl Database {
     /// One provider's ranked neighbours for one canonical name, best first.
     pub async fn metadata_artist_similar(
         &self,
-        provider: crate::enrichment::Provider,
+        provider: crate::remote::enrichment::Provider,
         name_canonical: &str,
-    ) -> Result<Vec<crate::enrichment::CachedSimilar>, sqlx::Error> {
+    ) -> Result<Vec<crate::remote::enrichment::CachedSimilar>, sqlx::Error> {
         let rows = sqlx::query(
             "SELECT similar_name, similar_canonical, score FROM metadata_artist_similar \
              WHERE provider = ? AND name_canonical = ? ORDER BY rank",
@@ -71,7 +71,7 @@ impl Database {
         .await?;
         rows.into_iter()
             .map(|row| {
-                Ok(crate::enrichment::CachedSimilar {
+                Ok(crate::remote::enrichment::CachedSimilar {
                     name: row.try_get("similar_name")?,
                     name_canonical: row.try_get("similar_canonical")?,
                     score: row.try_get("score")?,
@@ -109,7 +109,7 @@ impl Database {
             &mut tx,
             name_canonical,
             hash,
-            crate::authentication::now_ms(),
+            crate::auth::authentication::now_ms(),
         )
         .await?;
         tx.commit().await
@@ -140,7 +140,7 @@ impl Database {
             &mut tx,
             name_canonical,
             Some(hash),
-            crate::authentication::now_ms(),
+            crate::auth::authentication::now_ms(),
         )
         .await?;
         tx.commit().await
@@ -152,7 +152,7 @@ impl Database {
         &self,
         provider: &str,
         lookup_key: &str,
-    ) -> Result<Option<crate::lrclib::CachedLyrics>, sqlx::Error> {
+    ) -> Result<Option<crate::remote::lrclib::CachedLyrics>, sqlx::Error> {
         let Some(row) = sqlx::query(
             "SELECT outcome, synced_lyrics, plain_lyrics, fetched_at, expires_at \
              FROM lyrics_lookup WHERE provider = ? AND lookup_key = ?",
@@ -165,10 +165,10 @@ impl Database {
             return Ok(None);
         };
         let outcome: String = row.try_get("outcome")?;
-        let outcome = crate::lrclib::LyricsOutcome::parse(&outcome).ok_or_else(|| {
+        let outcome = crate::remote::lrclib::LyricsOutcome::parse(&outcome).ok_or_else(|| {
             sqlx::Error::Decode(format!("unknown lyrics outcome {outcome:?}").into())
         })?;
-        Ok(Some(crate::lrclib::CachedLyrics {
+        Ok(Some(crate::remote::lrclib::CachedLyrics {
             outcome,
             synced: row.try_get("synced_lyrics")?,
             plain: row.try_get("plain_lyrics")?,
@@ -183,7 +183,7 @@ impl Database {
         &self,
         provider: &str,
         lookup_key: &str,
-        answer: &crate::lrclib::CachedLyrics,
+        answer: &crate::remote::lrclib::CachedLyrics,
     ) -> Result<(), sqlx::Error> {
         let _writer = self.writer_guard().await;
         let mut tx = self.begin_write(&_writer).await?;
@@ -220,9 +220,9 @@ impl Database {
     /// ever runs under it.
     pub(crate) async fn write_metadata_artist(
         &self,
-        provider: crate::enrichment::Provider,
+        provider: crate::remote::enrichment::Provider,
         name_canonical: &str,
-        answer: &crate::enrichment::ArtistAnswer,
+        answer: &crate::remote::enrichment::ArtistAnswer,
         fetched_at: i64,
         expires_at: i64,
     ) -> Result<(), sqlx::Error> {
@@ -351,9 +351,9 @@ async fn link_portrait_in(
         let library_id: String = row.try_get("library_id")?;
         let parse =
             |value: &str| Uuid::parse_str(value).map_err(|error| sqlx::Error::Decode(error.into()));
-        crate::catalog::record_library_event(
+        crate::storage::catalog::record_library_event(
             tx,
-            crate::catalog::LibraryChange {
+            crate::storage::catalog::LibraryChange {
                 library_id: parse(&library_id)?,
                 entity_type: "artist",
                 entity_id: parse(&id)?,
@@ -435,9 +435,9 @@ async fn record_artist_moves(
         let library_id: String = row.try_get("library_id")?;
         let parse =
             |value: &str| Uuid::parse_str(value).map_err(|error| sqlx::Error::Decode(error.into()));
-        crate::catalog::record_library_event(
+        crate::storage::catalog::record_library_event(
             tx,
-            crate::catalog::LibraryChange {
+            crate::storage::catalog::LibraryChange {
                 library_id: parse(&library_id)?,
                 entity_type: "artist",
                 entity_id: parse(&id)?,
diff --git a/src/database/mod.rs b/src/storage/database/mod.rs
similarity index 98%
rename from src/database/mod.rs
rename to src/storage/database/mod.rs
index 64ae8094..e27a9dc7 100644
--- a/src/database/mod.rs
+++ b/src/storage/database/mod.rs
@@ -60,7 +60,7 @@ pub struct Database {
     /// the writer's business: the test suite applies catalogue rows directly,
     /// and putting the specs anywhere else would have those tests exercise a
     /// different identity path than production.
-    pid: crate::pid::PidSpecs,
+    pid: crate::library::pid::PidSpecs,
 }
 
 impl Database {
@@ -76,8 +76,8 @@ impl Database {
             // Numbers in names by value, for listings paged in SQL; see
             // `natural_order` for why no schema object may name it.
             .collation(
-                crate::natural_order::COLLATION,
-                crate::natural_order::compare,
+                crate::storage::natural_order::COLLATION,
+                crate::storage::natural_order::compare,
             );
 
         let pool = SqlitePoolOptions::new()
@@ -364,7 +364,7 @@ impl Database {
     }
 
     /// The identity rules the catalogue is written under.
-    pub fn pid(&self) -> &crate::pid::PidSpecs {
+    pub fn pid(&self) -> &crate::library::pid::PidSpecs {
         &self.pid
     }
 
diff --git a/src/database/sessions.rs b/src/storage/database/sessions.rs
similarity index 99%
rename from src/database/sessions.rs
rename to src/storage/database/sessions.rs
index bfba20b7..c614b72e 100644
--- a/src/database/sessions.rs
+++ b/src/storage/database/sessions.rs
@@ -196,7 +196,7 @@ impl Database {
             loop {
                 ticker.tick().await;
                 match db
-                    .prune_authorizations(crate::authentication::now_ms())
+                    .prune_authorizations(crate::auth::authentication::now_ms())
                     .await
                 {
                     Ok(0) => {}
diff --git a/src/database/subsonic_credentials.rs b/src/storage/database/subsonic_credentials.rs
similarity index 99%
rename from src/database/subsonic_credentials.rs
rename to src/storage/database/subsonic_credentials.rs
index 9307c53e..5ba80b81 100644
--- a/src/database/subsonic_credentials.rs
+++ b/src/storage/database/subsonic_credentials.rs
@@ -3,7 +3,7 @@
 
 use uuid::Uuid;
 
-use crate::security::EncryptedSecret;
+use crate::auth::security::EncryptedSecret;
 
 use super::{insert_audit, Database};
 
diff --git a/src/database/sync_operations.rs b/src/storage/database/sync_operations.rs
similarity index 100%
rename from src/database/sync_operations.rs
rename to src/storage/database/sync_operations.rs
diff --git a/src/database/tests.rs b/src/storage/database/tests.rs
similarity index 100%
rename from src/database/tests.rs
rename to src/storage/database/tests.rs
diff --git a/src/migration_backup.rs b/src/storage/migration_backup.rs
similarity index 96%
rename from src/migration_backup.rs
rename to src/storage/migration_backup.rs
index 0e07657b..a803f7d6 100644
--- a/src/migration_backup.rs
+++ b/src/storage/migration_backup.rs
@@ -32,7 +32,7 @@ use std::path::{Path, PathBuf};
 use anyhow::Context;
 
 use crate::config::Config;
-use crate::database::{Database, SchemaState};
+use crate::storage::database::{Database, SchemaState};
 
 /// What every copy directory made here is named after, followed by the epoch
 /// milliseconds it was taken at. Pruning recognises nothing else.
@@ -53,7 +53,7 @@ pub async fn before_migrating(db: &Database, config: &Config) -> anyhow::Result<
     };
     let directory = config
         .data_dir
-        .join(format!("{PREFIX}{}", crate::authentication::now_ms()));
+        .join(format!("{PREFIX}{}", crate::auth::authentication::now_ms()));
     let refused = |what: &str| {
         format!(
             "could not copy the {what} before applying {pending} migration(s) to {}; \
@@ -146,9 +146,12 @@ async fn copy_pair(
         let key = tokio::fs::read(&copied_key)
             .await
             .with_context(|| refused("instance key"))?;
-        if !Database::check_file_instance_key(&copied_database, &crate::security::bytes_hash(&key))
-            .await
-            .with_context(|| refused("database"))?
+        if !Database::check_file_instance_key(
+            &copied_database,
+            &crate::auth::security::bytes_hash(&key),
+        )
+        .await
+        .with_context(|| refused("database"))?
         {
             anyhow::bail!(
                 "instance.key does not match waveflow.db; nothing has been applied. \
diff --git a/src/storage/mod.rs b/src/storage/mod.rs
new file mode 100644
index 00000000..b59a1e24
--- /dev/null
+++ b/src/storage/mod.rs
@@ -0,0 +1,9 @@
+//! The SQLite database: the connection and its foundation repositories, the
+//! catalogue repository, the user-data change journal, the natural-order
+//! collation registered on the pool, and the copy taken before a migration.
+
+pub mod catalog;
+pub mod database;
+pub mod migration_backup;
+pub mod natural_order;
+pub mod sync;
diff --git a/src/natural_order.rs b/src/storage/natural_order/mod.rs
similarity index 62%
rename from src/natural_order.rs
rename to src/storage/natural_order/mod.rs
index 9bc51319..2c5874aa 100644
--- a/src/natural_order.rs
+++ b/src/storage/natural_order/mod.rs
@@ -63,59 +63,4 @@ fn digits(chars: &mut Peekable<Chars<'_>>) -> String {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn sorted(names: &[&str]) -> Vec<String> {
-        let mut names: Vec<String> = names.iter().map(|name| (*name).to_owned()).collect();
-        names.sort_by(|a, b| compare(a, b));
-        names
-    }
-
-    #[test]
-    fn numbers_sort_by_value() {
-        assert_eq!(
-            sorted(&[
-                "100 Snooze.m4a",
-                "2 Paradise.m4a",
-                "10 Ballad.m4a",
-                "1 Morning.mp3"
-            ]),
-            [
-                "1 Morning.mp3",
-                "2 Paradise.m4a",
-                "10 Ballad.m4a",
-                "100 Snooze.m4a"
-            ]
-        );
-        assert_eq!(
-            sorted(&["Disc 10", "Disc 9", "Disc 1"]),
-            ["Disc 1", "Disc 9", "Disc 10"]
-        );
-    }
-
-    #[test]
-    fn letters_fold_case_beyond_ascii() {
-        assert_eq!(
-            sorted(&["b", "Été", "A", "étoile"]),
-            ["A", "b", "étoile", "Été"]
-        );
-        assert_eq!(compare("abc", "ABD"), Ordering::Less);
-    }
-
-    #[test]
-    fn only_identical_names_compare_equal() {
-        assert_eq!(compare("7", "7"), Ordering::Equal);
-        assert_ne!(compare("07", "7"), Ordering::Equal);
-        assert_ne!(compare("Abc", "abc"), Ordering::Equal);
-        assert_eq!(compare("07", "7"), compare("07", "7"));
-        assert_eq!(compare("07", "7"), compare("7", "07").reverse());
-    }
-
-    #[test]
-    fn a_run_longer_than_any_integer_still_sorts() {
-        let huge = "9".repeat(40);
-        assert_eq!(compare("1", &huge), Ordering::Less);
-        assert_eq!(compare(&format!("{huge}0"), &huge), Ordering::Greater);
-    }
-}
+mod tests;
diff --git a/src/storage/natural_order/tests.rs b/src/storage/natural_order/tests.rs
new file mode 100644
index 00000000..20afad2a
--- /dev/null
+++ b/src/storage/natural_order/tests.rs
@@ -0,0 +1,54 @@
+use super::*;
+
+fn sorted(names: &[&str]) -> Vec<String> {
+    let mut names: Vec<String> = names.iter().map(|name| (*name).to_owned()).collect();
+    names.sort_by(|a, b| compare(a, b));
+    names
+}
+
+#[test]
+fn numbers_sort_by_value() {
+    assert_eq!(
+        sorted(&[
+            "100 Snooze.m4a",
+            "2 Paradise.m4a",
+            "10 Ballad.m4a",
+            "1 Morning.mp3"
+        ]),
+        [
+            "1 Morning.mp3",
+            "2 Paradise.m4a",
+            "10 Ballad.m4a",
+            "100 Snooze.m4a"
+        ]
+    );
+    assert_eq!(
+        sorted(&["Disc 10", "Disc 9", "Disc 1"]),
+        ["Disc 1", "Disc 9", "Disc 10"]
+    );
+}
+
+#[test]
+fn letters_fold_case_beyond_ascii() {
+    assert_eq!(
+        sorted(&["b", "Été", "A", "étoile"]),
+        ["A", "b", "étoile", "Été"]
+    );
+    assert_eq!(compare("abc", "ABD"), Ordering::Less);
+}
+
+#[test]
+fn only_identical_names_compare_equal() {
+    assert_eq!(compare("7", "7"), Ordering::Equal);
+    assert_ne!(compare("07", "7"), Ordering::Equal);
+    assert_ne!(compare("Abc", "abc"), Ordering::Equal);
+    assert_eq!(compare("07", "7"), compare("07", "7"));
+    assert_eq!(compare("07", "7"), compare("7", "07").reverse());
+}
+
+#[test]
+fn a_run_longer_than_any_integer_still_sorts() {
+    let huge = "9".repeat(40);
+    assert_eq!(compare("1", &huge), Ordering::Less);
+    assert_eq!(compare(&format!("{huge}0"), &huge), Ordering::Greater);
+}
diff --git a/src/sync.rs b/src/storage/sync/mod.rs
similarity index 90%
rename from src/sync.rs
rename to src/storage/sync/mod.rs
index 834b626a..47d8b168 100644
--- a/src/sync.rs
+++ b/src/storage/sync/mod.rs
@@ -11,8 +11,8 @@ use utoipa::ToSchema;
 use uuid::Uuid;
 
 use crate::{
-    authentication::now_ms,
-    database::{Database, SyncOperationReservation},
+    auth::authentication::now_ms,
+    storage::database::{Database, SyncOperationReservation},
 };
 
 pub const DEFAULT_SYNC_LIMIT: i64 = 100;
@@ -415,48 +415,4 @@ fn parse_uuid(value: String) -> Result<Uuid, sqlx::Error> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::MutationIntent;
-
-    #[test]
-    fn mutation_intents_are_canonical_and_scope_action_target_and_payload() {
-        let first = MutationIntent::new(
-            "update",
-            "playlist:one",
-            &serde_json::json!({ "name": "Road", "tracks": ["a", "b"] }),
-        );
-        let reordered = MutationIntent::new(
-            "update",
-            "playlist:one",
-            &serde_json::json!({ "tracks": ["a", "b"], "name": "Road" }),
-        );
-        assert_eq!(first.as_bytes(), reordered.as_bytes());
-        assert_ne!(
-            first.as_bytes(),
-            MutationIntent::new(
-                "delete",
-                "playlist:one",
-                &serde_json::json!({ "name": "Road", "tracks": ["a", "b"] }),
-            )
-            .as_bytes()
-        );
-        assert_ne!(
-            first.as_bytes(),
-            MutationIntent::new(
-                "update",
-                "playlist:two",
-                &serde_json::json!({ "name": "Road", "tracks": ["a", "b"] }),
-            )
-            .as_bytes()
-        );
-        assert_ne!(
-            first.as_bytes(),
-            MutationIntent::new(
-                "update",
-                "playlist:one",
-                &serde_json::json!({ "name": "Night", "tracks": ["a", "b"] }),
-            )
-            .as_bytes()
-        );
-    }
-}
+mod tests;
diff --git a/src/storage/sync/tests.rs b/src/storage/sync/tests.rs
new file mode 100644
index 00000000..bead30c6
--- /dev/null
+++ b/src/storage/sync/tests.rs
@@ -0,0 +1,43 @@
+use super::MutationIntent;
+
+#[test]
+fn mutation_intents_are_canonical_and_scope_action_target_and_payload() {
+    let first = MutationIntent::new(
+        "update",
+        "playlist:one",
+        &serde_json::json!({ "name": "Road", "tracks": ["a", "b"] }),
+    );
+    let reordered = MutationIntent::new(
+        "update",
+        "playlist:one",
+        &serde_json::json!({ "tracks": ["a", "b"], "name": "Road" }),
+    );
+    assert_eq!(first.as_bytes(), reordered.as_bytes());
+    assert_ne!(
+        first.as_bytes(),
+        MutationIntent::new(
+            "delete",
+            "playlist:one",
+            &serde_json::json!({ "name": "Road", "tracks": ["a", "b"] }),
+        )
+        .as_bytes()
+    );
+    assert_ne!(
+        first.as_bytes(),
+        MutationIntent::new(
+            "update",
+            "playlist:two",
+            &serde_json::json!({ "name": "Road", "tracks": ["a", "b"] }),
+        )
+        .as_bytes()
+    );
+    assert_ne!(
+        first.as_bytes(),
+        MutationIntent::new(
+            "update",
+            "playlist:one",
+            &serde_json::json!({ "name": "Night", "tracks": ["a", "b"] }),
+        )
+        .as_bytes()
+    );
+}
diff --git a/src/subsonic/auth.rs b/src/subsonic/auth.rs
index cce95b7b..ec1b1eac 100644
--- a/src/subsonic/auth.rs
+++ b/src/subsonic/auth.rs
@@ -3,7 +3,7 @@
 //! Split out of `subsonic.rs`; the wire contract is frozen, so this moved nothing.
 
 use super::*;
-use crate::sign_in::{Refusal, Surface};
+use crate::auth::sign_in::{Refusal, Surface};
 
 pub(super) async fn authenticate(
     state: &AppState,
@@ -28,7 +28,8 @@ pub(super) async fn authenticate(
     }
 
     let username = params.first("u").ok_or_else(missing)?;
-    let Ok(reservation) = guard.reserve(address, &crate::sign_in::canonical_account(username))
+    let Ok(reservation) =
+        guard.reserve(address, &crate::auth::sign_in::canonical_account(username))
     else {
         guard.note(Surface::Subsonic, Refusal::Throttled);
         return Err(auth_error());
diff --git a/src/subsonic/lyrics.rs b/src/subsonic/lyrics.rs
index 98c5cf88..50913053 100644
--- a/src/subsonic/lyrics.rs
+++ b/src/subsonic/lyrics.rs
@@ -57,7 +57,7 @@ pub(super) async fn get_lyrics_by_song_id(
         .children(lyrics.structured_lyrics.iter().map(structured_lyrics_node)))
 }
 
-pub(super) fn structured_lyrics_node(lyrics: &crate::lyrics::StructuredLyrics) -> Node {
+pub(super) fn structured_lyrics_node(lyrics: &crate::library::lyrics::StructuredLyrics) -> Node {
     Node::new("structuredLyrics")
         .maybe_attr("displayArtist", lyrics.display_artist.clone())
         .attr("displayTitle", lyrics.display_title.clone())
diff --git a/src/subsonic/media.rs b/src/subsonic/media.rs
index 99cf2042..a18ff113 100644
--- a/src/subsonic/media.rs
+++ b/src/subsonic/media.rs
@@ -81,7 +81,7 @@ pub(super) async fn media_response(
     // other server ignores — the operator's default otherwise. Only a
     // transcode carries it; the original is never re-encoded to apply it.
     let replay_gain = match params.first("replayGain") {
-        Some(mode) => crate::replay_gain::ReplayGainMode::parse(mode)
+        Some(mode) => crate::media::replay_gain::ReplayGainMode::parse(mode)
             .ok_or_else(|| invalid("Invalid replayGain"))?,
         None => state.media.subsonic_replay_gain(),
     };
diff --git a/src/subsonic/mod.rs b/src/subsonic/mod.rs
index c650beed..bdff241f 100644
--- a/src/subsonic/mod.rs
+++ b/src/subsonic/mod.rs
@@ -15,13 +15,13 @@ use serde_json::{Map, Value};
 use uuid::Uuid;
 
 use crate::{
-    database::AccountRole,
+    auth::security,
     media::{MediaError, OutputFormat, StreamQuery},
-    security,
     services::{
         AlbumItem, AlbumListQuery, AlbumOrder, ArtistItem, ArtistSummary, BrowsePage, PlaylistItem,
         ServiceError, SongItem,
     },
+    storage::database::AccountRole,
     AppState,
 };
 
@@ -184,7 +184,7 @@ struct ProtocolError {
 pub fn router(state: AppState) -> Router {
     // `/rest` carries none of the security headers: the façade's wire
     // behaviour is frozen (RFC-019 decision 2). The public shares, which do
-    // carry them, are served by `crate::public_share` since RFC-020.
+    // carry them, are served by `crate::http::public_share` since RFC-020.
     Router::new()
         .route("/rest/{method}", get(handle).post(handle))
         .with_state(state)
@@ -198,7 +198,7 @@ pub async fn handle(
     let request_method = request.method().clone();
     let query = request.uri().query().unwrap_or_default().to_owned();
     // Read before the body is: a POST's request is consumed below.
-    let address = crate::sign_in::request_bucket(
+    let address = crate::auth::sign_in::request_bucket(
         request.extensions(),
         request.headers(),
         &state.trusted_proxies,
diff --git a/tests/auth/main.rs b/tests/auth/main.rs
index 0ea86974..f557b578 100644
--- a/tests/auth/main.rs
+++ b/tests/auth/main.rs
@@ -9,11 +9,11 @@ use axum::http::StatusCode;
 use sqlx::Row;
 use tower::ServiceExt;
 use uuid::Uuid;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::database::AccountRole;
-use waveflow_server::database::LibraryRole;
-use waveflow_server::database::LibraryVisibility;
-use waveflow_server::security;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
+use waveflow_server::storage::database::AccountRole;
+use waveflow_server::storage::database::LibraryRole;
+use waveflow_server::storage::database::LibraryVisibility;
 
 // Not every target uses every fixture, and a shared module is not dead
 // code for being partly unused here.
diff --git a/tests/auth/oauth.rs b/tests/auth/oauth.rs
index 657b5903..1a43e3b9 100644
--- a/tests/auth/oauth.rs
+++ b/tests/auth/oauth.rs
@@ -54,7 +54,7 @@ async fn pkce_authorization_grants_a_native_session_exactly_once() {
     let token = login_token(&router, "pkce-user", password).await;
 
     let verifier = "H1r8mQ2xY7pL4vC0nB6zK9tW3sD5gJ8fA2eR7uI1oP4";
-    let challenge = waveflow_server::oauth::challenge_for(verifier);
+    let challenge = waveflow_server::auth::oauth::challenge_for(verifier);
     let redirect_uri = "http://127.0.0.1:49152/callback";
 
     let authorize = |body: serde_json::Value, bearer: Option<String>| {
diff --git a/tests/auth/sessions.rs b/tests/auth/sessions.rs
index 4cae5677..e67126d5 100644
--- a/tests/auth/sessions.rs
+++ b/tests/auth/sessions.rs
@@ -375,7 +375,7 @@ async fn a_disabled_account_s_tokens_and_grants_all_stop_working() {
     let grant = serde_json::json!({
         "client_id": "com.waveflow.desktop",
         "redirect_uri": redirect_uri,
-        "code_challenge": waveflow_server::oauth::challenge_for(&verifier),
+        "code_challenge": waveflow_server::auth::oauth::challenge_for(&verifier),
         "code_challenge_method": "S256",
         "device_name": "Disabled Desktop"
     });
diff --git a/tests/auth/setup.rs b/tests/auth/setup.rs
index eb382e65..fe195897 100644
--- a/tests/auth/setup.rs
+++ b/tests/auth/setup.rs
@@ -176,7 +176,7 @@ fn setup_token_on_disk(config: &waveflow_server::Config) -> String {
     std::fs::read_to_string(
         config
             .data_dir
-            .join(waveflow_server::setup_token::FILE_NAME),
+            .join(waveflow_server::auth::setup_token::FILE_NAME),
     )
     .expect("a fresh instance writes its setup token")
     .trim()
@@ -203,7 +203,7 @@ async fn setup_is_refused_without_the_token_and_forgets_it_once_used() {
     let router = waveflow_server::app(&config, state.clone());
     let token_file = config
         .data_dir
-        .join(waveflow_server::setup_token::FILE_NAME);
+        .join(waveflow_server::auth::setup_token::FILE_NAME);
     let token = setup_token_on_disk(&config);
     let password = Uuid::new_v4().to_string();
 
@@ -286,7 +286,7 @@ async fn an_operator_chosen_setup_token_replaces_the_drawn_one() {
     let router = waveflow_server::app(&config, state);
     assert!(!config
         .data_dir
-        .join(waveflow_server::setup_token::FILE_NAME)
+        .join(waveflow_server::auth::setup_token::FILE_NAME)
         .exists());
 
     let password = Uuid::new_v4().to_string();
diff --git a/tests/auth/subsonic_credential.rs b/tests/auth/subsonic_credential.rs
index 3c19dce7..82d435d7 100644
--- a/tests/auth/subsonic_credential.rs
+++ b/tests/auth/subsonic_credential.rs
@@ -75,7 +75,7 @@ async fn an_account_rotates_or_switches_off_its_own_subsonic_credential() {
     state
         .db
         .create_api_token(
-            waveflow_server::database::NewApiToken {
+            waveflow_server::storage::database::NewApiToken {
                 actor_id: listener,
                 user_id: listener,
                 name: "a narrowed client",
@@ -91,7 +91,7 @@ async fn an_account_rotates_or_switches_off_its_own_subsonic_credential() {
     state
         .db
         .create_api_token(
-            waveflow_server::database::NewApiToken {
+            waveflow_server::storage::database::NewApiToken {
                 actor_id: listener,
                 user_id: listener,
                 name: "a client with a deadline",
diff --git a/tests/auth/throttling.rs b/tests/auth/throttling.rs
index 93d91064..5e20bcf7 100644
--- a/tests/auth/throttling.rs
+++ b/tests/auth/throttling.rs
@@ -120,7 +120,7 @@ async fn subsonic_sign_in(router: &axum::Router, credentials: &str, peer: &str)
 #[tokio::test]
 async fn failed_sign_ins_are_limited_per_address_and_account() {
     let (_temp, app) = guarded(&[]).await;
-    for _ in 0..waveflow_server::sign_in::FAILURES_PER_WINDOW {
+    for _ in 0..waveflow_server::auth::sign_in::FAILURES_PER_WINDOW {
         let refused =
             native_sign_in(&app.router, "Guarded", &app.wrong, "198.51.100.7", None).await;
         assert_eq!(refused.status(), StatusCode::UNAUTHORIZED);
@@ -189,10 +189,10 @@ async fn concurrent_guesses_cannot_slip_past_the_limit() {
         .iter()
         .filter(|status| **status == StatusCode::TOO_MANY_REQUESTS)
         .count();
-    assert_eq!(checked, waveflow_server::sign_in::FAILURES_PER_WINDOW);
+    assert_eq!(checked, waveflow_server::auth::sign_in::FAILURES_PER_WINDOW);
     assert_eq!(
         throttled,
-        40 - waveflow_server::sign_in::FAILURES_PER_WINDOW
+        40 - waveflow_server::auth::sign_in::FAILURES_PER_WINDOW
     );
 }
 
@@ -244,7 +244,7 @@ async fn an_unknown_account_costs_a_verification() {
 #[tokio::test]
 async fn subsonic_failures_are_limited_per_address_and_case_folded() {
     let (_temp, app) = guarded(&[]).await;
-    for index in 0..waveflow_server::sign_in::FAILURES_PER_WINDOW {
+    for index in 0..waveflow_server::auth::sign_in::FAILURES_PER_WINDOW {
         let name = if index % 2 == 0 { "Guarded" } else { "GUARDED" };
         assert_eq!(
             subsonic_sign_in(&app.router, &format!("u={name}&p=wrong"), "198.51.100.7").await,
@@ -301,7 +301,7 @@ async fn a_trusted_proxy_names_the_client_and_a_stranger_cannot() {
                 .status()
         }
     };
-    for index in 0..waveflow_server::sign_in::FAILURES_PER_WINDOW {
+    for index in 0..waveflow_server::auth::sign_in::FAILURES_PER_WINDOW {
         let forwarded = format!("192.0.2.{index}, 198.51.100.7");
         assert_eq!(
             sign_in(app.wrong.clone(), "10.0.0.2", forwarded).await,
@@ -322,7 +322,7 @@ async fn a_trusted_proxy_names_the_client_and_a_stranger_cannot() {
         StatusCode::OK
     );
 
-    for index in 0..waveflow_server::sign_in::FAILURES_PER_WINDOW {
+    for index in 0..waveflow_server::auth::sign_in::FAILURES_PER_WINDOW {
         assert_eq!(
             sign_in(
                 app.wrong.clone(),
@@ -395,7 +395,7 @@ async fn an_unreadable_hash_is_not_a_line_per_attempt() {
     let router = waveflow_server::app(&config, state);
 
     let password = Uuid::new_v4().to_string();
-    for _ in 0..waveflow_server::sign_in::FAILURES_PER_WINDOW + 5 {
+    for _ in 0..waveflow_server::auth::sign_in::FAILURES_PER_WINDOW + 5 {
         let refused = native_sign_in(&router, "Damaged", &password, "198.51.100.40", None).await;
         assert_eq!(refused.status(), StatusCode::SERVICE_UNAVAILABLE);
     }
diff --git a/tests/auth/tokens.rs b/tests/auth/tokens.rs
index d64af5ab..00fadce9 100644
--- a/tests/auth/tokens.rs
+++ b/tests/auth/tokens.rs
@@ -18,7 +18,7 @@ async fn long_lived_native_api_tokens_authenticate_and_honor_revocation() {
     state
         .db
         .create_api_token(
-            waveflow_server::database::NewApiToken {
+            waveflow_server::storage::database::NewApiToken {
                 // The actor the audit entry records: here the account itself.
                 actor_id: user_id,
                 user_id,
@@ -103,7 +103,7 @@ async fn an_account_manages_its_own_clients_and_cannot_widen_one() {
     let theirs = state
         .db
         .create_api_token(
-            waveflow_server::database::NewApiToken {
+            waveflow_server::storage::database::NewApiToken {
                 // The actor the audit entry records.
                 actor_id: stranger,
                 user_id: stranger,
@@ -122,7 +122,7 @@ async fn an_account_manages_its_own_clients_and_cannot_widen_one() {
     state
         .db
         .create_api_token(
-            waveflow_server::database::NewApiToken {
+            waveflow_server::storage::database::NewApiToken {
                 // The actor the audit entry records: here the account itself.
                 actor_id: owner,
                 user_id: owner,
@@ -305,7 +305,7 @@ async fn a_self_minted_credential_expires_and_the_admin_path_is_bounded_too() {
     state
         .db
         .create_api_token(
-            waveflow_server::database::NewApiToken {
+            waveflow_server::storage::database::NewApiToken {
                 // The actor the audit entry records: here the account itself.
                 actor_id: boss,
                 user_id: boss,
@@ -405,7 +405,7 @@ async fn a_self_minted_credential_expires_and_the_admin_path_is_bounded_too() {
     state
         .db
         .create_api_token(
-            waveflow_server::database::NewApiToken {
+            waveflow_server::storage::database::NewApiToken {
                 // The actor the audit entry records: here the account itself.
                 actor_id: owner_of_ttl_user,
                 user_id: owner_of_ttl_user,
diff --git a/tests/canvas.rs b/tests/canvas.rs
deleted file mode 100644
index 148a3918..00000000
--- a/tests/canvas.rs
+++ /dev/null
@@ -1,1489 +0,0 @@
-//! The loop a member attaches to a track. RFC-009.
-//!
-//! No routes yet: this drives `DomainServices` directly, which is the whole of
-//! what the domain half of the canvas is. What the store does with bytes, what
-//! it charges for them, and what it refuses are decided here rather than at the
-//! surface, so they are tested here.
-
-use axum::body::Body;
-use axum::http::Request;
-use axum::http::StatusCode;
-use tower::ServiceExt;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::catalog::LibraryRecord;
-use waveflow_server::config::CanvasLimits;
-use waveflow_server::database::AccountRole;
-use waveflow_server::database::LibraryVisibility;
-use waveflow_server::security;
-
-// Not every target uses every fixture, and a shared module is not dead
-// code for being partly unused here.
-#[allow(dead_code)]
-mod support;
-use support::*;
-
-/// An app whose canvas limits this test chose.
-///
-/// Tuned before `initialize`, never after: `DomainServices` copies these values
-/// out of `Config` when it is built, so a test that raises a ceiling on the
-/// returned `Config` silently exercises the old one.
-async fn canvas_app(
-    tune: impl FnOnce(&mut CanvasLimits),
-) -> (
-    tempfile::TempDir,
-    waveflow_server::Config,
-    waveflow_server::AppState,
-) {
-    let temp = tempfile::tempdir().unwrap();
-    let mut config = waveflow_server::Config::for_data_dir(temp.path().join("data"));
-    tune(&mut config.canvas);
-    let state = waveflow_server::initialize(&config).await.unwrap();
-    (temp, config, state)
-}
-
-struct Fixture {
-    owner: uuid::Uuid,
-    library: uuid::Uuid,
-    tracks: Vec<uuid::Uuid>,
-    token: String,
-}
-
-/// An owner, an open library, and `count` scanned tracks in it.
-async fn fixture(
-    config: &waveflow_server::Config,
-    state: &waveflow_server::AppState,
-    name: &str,
-    count: usize,
-) -> Fixture {
-    let hash = security::hash_password("correct horse battery staple").unwrap();
-    let owner = state
-        .db
-        .create_account(name, &hash, AccountRole::Admin, now_ms())
-        .await
-        .unwrap();
-    let music = config.data_dir.join(name);
-    std::fs::create_dir_all(&music).unwrap();
-    for index in 0..count {
-        write_test_wav(&music.join(format!("Track {index}.wav")));
-    }
-    let root = std::fs::canonicalize(&music).unwrap();
-    let library = state
-        .db
-        .create_library(owner, name, &root, LibraryVisibility::Private, now_ms())
-        .await
-        .unwrap();
-    run_scan(
-        state,
-        owner,
-        LibraryRecord {
-            id: library,
-            name: name.into(),
-            root_path: root,
-        },
-    )
-    .await;
-    // A canvas spends the operator's disk, so it follows the deposit rules: a
-    // server that was merely upgraded must not have become one. Its own flag,
-    // not the upload one — the fixture leaves `accepts_uploads` off precisely
-    // so that every test here runs on a library that takes no audio.
-    state
-        .db
-        .set_library_accepts_canvas(owner, library, true, now_ms())
-        .await
-        .unwrap();
-    let mut tracks: Vec<uuid::Uuid> = state
-        .db
-        .list_tracks_for_user(owner, library)
-        .await
-        .unwrap()
-        .into_iter()
-        .map(|track| track.id)
-        .collect();
-    tracks.sort();
-    assert_eq!(tracks.len(), count);
-    let token = login_token(
-        &waveflow_server::app(config, state.clone()),
-        name,
-        "correct horse battery staple",
-    )
-    .await;
-    Fixture {
-        owner,
-        library,
-        tracks,
-        token,
-    }
-}
-
-/// A real container, because the server reads the bytes rather than the name.
-///
-/// `mpeg4` rather than `libx264` or `libvpx`: it is built into FFmpeg itself,
-/// so this fixture does not depend on which encoders a machine happens to ship.
-fn canvas_bytes(dir: &std::path::Path, name: &str, seconds: &str, colour: &str) -> Vec<u8> {
-    let path = dir.join(name);
-    let output = std::process::Command::new("ffmpeg")
-        .args([
-            "-hide_banner",
-            "-loglevel",
-            "error",
-            "-y",
-            "-f",
-            "lavfi",
-            "-i",
-            &format!("color=c={colour}:s=64x64:r=10:d={seconds}"),
-            "-c:v",
-            "mpeg4",
-        ])
-        .arg(&path)
-        .output()
-        .expect("ffmpeg must be on PATH");
-    assert!(
-        output.status.success(),
-        "ffmpeg failed: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    std::fs::read(&path).unwrap()
-}
-
-/// An mp4 carrying sound and no picture. A canvas without a video stream is not
-/// a canvas, whatever else it is.
-fn soundtrack_only(dir: &std::path::Path) -> Vec<u8> {
-    let path = dir.join("audio-only.mp4");
-    let output = std::process::Command::new("ffmpeg")
-        .args([
-            "-hide_banner",
-            "-loglevel",
-            "error",
-            "-y",
-            "-f",
-            "lavfi",
-            "-i",
-            "sine=frequency=440:duration=1",
-            "-c:a",
-            "aac",
-        ])
-        .arg(&path)
-        .output()
-        .expect("ffmpeg must be on PATH");
-    assert!(output.status.success());
-    std::fs::read(&path).unwrap()
-}
-
-fn stored_files(config: &waveflow_server::Config) -> Vec<String> {
-    let Ok(entries) = std::fs::read_dir(&config.canvas_dir) else {
-        return Vec::new();
-    };
-    let mut names: Vec<String> = entries
-        .map(|entry| entry.unwrap().file_name().to_string_lossy().into_owned())
-        .collect();
-    names.sort();
-    names
-}
-
-#[tokio::test]
-async fn a_canvas_is_stored_once_shared_by_reference_and_erased_with_the_last_link() {
-    let (temp, config, state) = canvas_app(|_| {}).await;
-    let fixture = fixture(&config, &state, "canvas-store", 2).await;
-    let bytes = canvas_bytes(temp.path(), "loop.mp4", "1", "black");
-
-    let placed = state
-        .services
-        .place_canvas(fixture.owner, fixture.tracks[0], &bytes, None)
-        .await
-        .unwrap();
-    assert_eq!(placed.format, "mp4");
-    assert_eq!(placed.byte_size, bytes.len() as i64);
-    assert_eq!(stored_files(&config), vec![placed.file_name()]);
-
-    // The alias resolves the link, and the fingerprint resolves the content.
-    // Both answer the same blob to somebody entitled to the track.
-    assert_eq!(
-        state
-            .services
-            .canvas_for_track(fixture.owner, fixture.tracks[0])
-            .await
-            .unwrap(),
-        Some(placed.clone())
-    );
-    assert_eq!(
-        state
-            .services
-            .canvas_for_user(fixture.owner, &placed.hash)
-            .await
-            .unwrap(),
-        Some(placed.clone())
-    );
-
-    // The twelve tracks of an album that share one loop share the bytes. Here
-    // there are two, and one file.
-    let second = state
-        .services
-        .place_canvas(fixture.owner, fixture.tracks[1], &bytes, None)
-        .await
-        .unwrap();
-    assert_eq!(second, placed);
-    assert_eq!(stored_files(&config), vec![placed.file_name()]);
-
-    // Removing one link removes a row, not a blob: the other track still names
-    // it, and a file erased here would be a dead link for somebody else.
-    state
-        .services
-        .remove_canvas(fixture.owner, fixture.tracks[0], None)
-        .await
-        .unwrap();
-    assert_eq!(
-        state
-            .services
-            .canvas_for_track(fixture.owner, fixture.tracks[0])
-            .await
-            .unwrap(),
-        None
-    );
-    assert_eq!(stored_files(&config), vec![placed.file_name()]);
-    assert!(state
-        .services
-        .canvas_for_user(fixture.owner, &placed.hash)
-        .await
-        .unwrap()
-        .is_some());
-
-    // The last one takes the bytes with it.
-    state
-        .services
-        .remove_canvas(fixture.owner, fixture.tracks[1], None)
-        .await
-        .unwrap();
-    assert!(stored_files(&config).is_empty());
-    assert_eq!(
-        state
-            .services
-            .canvas_for_user(fixture.owner, &placed.hash)
-            .await
-            .unwrap(),
-        None
-    );
-
-    // Removing what is not there is not a silent success: there was nothing to
-    // take away, and the caller asked to take something away.
-    assert!(matches!(
-        state
-            .services
-            .remove_canvas(fixture.owner, fixture.tracks[1], None)
-            .await,
-        Err(waveflow_server::services::ServiceError::NotFound)
-    ));
-}
-
-#[tokio::test]
-async fn replacing_a_canvas_releases_the_one_it_replaced() {
-    let (temp, config, state) = canvas_app(|_| {}).await;
-    let fixture = fixture(&config, &state, "canvas-replace", 2).await;
-    let first = canvas_bytes(temp.path(), "first.mp4", "1", "black");
-    let second = canvas_bytes(temp.path(), "second.mp4", "1", "white");
-
-    let first = state
-        .services
-        .place_canvas(fixture.owner, fixture.tracks[0], &first, None)
-        .await
-        .unwrap();
-    let second = state
-        .services
-        .place_canvas(fixture.owner, fixture.tracks[0], &second, None)
-        .await
-        .unwrap();
-    assert_ne!(first.hash, second.hash);
-    // A replacement is a removal too. The loop the track used to carry lost its
-    // last reference, so its row and its bytes are gone.
-    assert_eq!(stored_files(&config), vec![second.file_name()]);
-    assert_eq!(
-        state
-            .services
-            .canvas_for_user(fixture.owner, &first.hash)
-            .await
-            .unwrap(),
-        None
-    );
-
-    // Unless another track still holds it. Both tracks take the first loop,
-    // then the first track is given the second one back: the blob survives the
-    // replacement because track two is still naming it.
-    let first_bytes = std::fs::read(temp.path().join("first.mp4")).unwrap();
-    let second_bytes = std::fs::read(temp.path().join("second.mp4")).unwrap();
-    for track in &fixture.tracks {
-        assert_eq!(
-            state
-                .services
-                .place_canvas(fixture.owner, *track, &first_bytes, None)
-                .await
-                .unwrap()
-                .hash,
-            first.hash
-        );
-    }
-    assert_eq!(stored_files(&config), vec![first.file_name()]);
-
-    state
-        .services
-        .place_canvas(fixture.owner, fixture.tracks[0], &second_bytes, None)
-        .await
-        .unwrap();
-    let mut expected = vec![first.file_name(), second.file_name()];
-    expected.sort();
-    assert_eq!(stored_files(&config), expected);
-}
-
-#[tokio::test]
-async fn a_canvas_belongs_to_the_library_and_not_to_whoever_knows_its_name() {
-    let (temp, config, state) = canvas_app(|_| {}).await;
-    let owner = fixture(&config, &state, "canvas-owner", 1).await;
-    let stranger = fixture(&config, &state, "canvas-stranger", 1).await;
-    let bytes = canvas_bytes(temp.path(), "loop.mp4", "1", "black");
-
-    let placed = state
-        .services
-        .place_canvas(owner.owner, owner.tracks[0], &bytes, None)
-        .await
-        .unwrap();
-
-    // A hash identifies content and proves nothing. Two accounts that are
-    // strangers to each other can hold the same loop, so knowing the
-    // fingerprint establishes no more than knowing a track id does.
-    assert_eq!(
-        state
-            .services
-            .canvas_for_user(stranger.owner, &placed.hash)
-            .await
-            .unwrap(),
-        None
-    );
-    // A track of another library is missing and belongs to someone else, and
-    // both answer the same thing.
-    assert_eq!(
-        state
-            .services
-            .canvas_for_track(stranger.owner, owner.tracks[0])
-            .await
-            .unwrap(),
-        None
-    );
-    assert!(matches!(
-        state
-            .services
-            .place_canvas(stranger.owner, owner.tracks[0], &bytes, None)
-            .await,
-        Err(waveflow_server::services::ServiceError::NotFound)
-    ));
-    assert!(matches!(
-        state
-            .services
-            .remove_canvas(stranger.owner, owner.tracks[0], None)
-            .await,
-        Err(waveflow_server::services::ServiceError::NotFound)
-    ));
-
-    // And the stranger placing on their own track shares the blob without
-    // learning anything about the neighbour who already held it.
-    let theirs = state
-        .services
-        .place_canvas(stranger.owner, stranger.tracks[0], &bytes, None)
-        .await
-        .unwrap();
-    assert_eq!(theirs.hash, placed.hash);
-    assert_eq!(stored_files(&config), vec![placed.file_name()]);
-}
-
-#[tokio::test]
-async fn a_closed_library_takes_no_canvas_but_still_gives_one_back() {
-    let (temp, config, state) = canvas_app(|_| {}).await;
-    let fixture = fixture(&config, &state, "canvas-closed", 1).await;
-    let bytes = canvas_bytes(temp.path(), "loop.mp4", "1", "black");
-    state
-        .services
-        .place_canvas(fixture.owner, fixture.tracks[0], &bytes, None)
-        .await
-        .unwrap();
-
-    state
-        .db
-        .set_library_accepts_canvas(fixture.owner, fixture.library, false, now_ms())
-        .await
-        .unwrap();
-
-    // The flag answers "may a member spend the operator's disk", so it closes
-    // the door that spends it.
-    assert!(matches!(
-        state
-            .services
-            .place_canvas(fixture.owner, fixture.tracks[0], &bytes, None)
-            .await,
-        Err(waveflow_server::services::ServiceError::Forbidden)
-    ));
-    // Taking something away never spends it, and closing a library must not
-    // strand what it already holds.
-    state
-        .services
-        .remove_canvas(fixture.owner, fixture.tracks[0], None)
-        .await
-        .unwrap();
-    assert!(stored_files(&config).is_empty());
-}
-
-#[tokio::test]
-async fn what_is_not_a_short_loop_is_refused_and_leaves_nothing_behind() {
-    let (temp, config, state) = canvas_app(|canvas| canvas.max_duration_secs = 2).await;
-    let library = fixture(&config, &state, "canvas-refused", 1).await;
-
-    // Bytes ffprobe cannot read at all. A verdict on the offer, not an outage.
-    assert!(matches!(
-        state
-            .services
-            .place_canvas(
-                library.owner,
-                library.tracks[0],
-                b"this is not a container",
-                None
-            )
-            .await,
-        Err(waveflow_server::services::ServiceError::Invalid)
-    ));
-
-    // A container on the list, carrying sound and no picture.
-    assert!(matches!(
-        state
-            .services
-            .place_canvas(
-                library.owner,
-                library.tracks[0],
-                &soundtrack_only(temp.path()),
-                None
-            )
-            .await,
-        Err(waveflow_server::services::ServiceError::Invalid)
-    ));
-
-    // A loop that is not short. Without this bound, "a short loop" becomes
-    // video hosting, which is a different product with different costs.
-    let long = canvas_bytes(temp.path(), "long.mp4", "5", "black");
-    assert!(matches!(
-        state
-            .services
-            .place_canvas(library.owner, library.tracks[0], &long, None)
-            .await,
-        Err(waveflow_server::services::ServiceError::Invalid)
-    ));
-
-    // Larger than the ceiling, refused before anything is written.
-    let (temp2, config2, state2) = canvas_app(|canvas| {
-        canvas.max_bytes = 1024;
-        canvas.library_quota_bytes = 1024 * 1024;
-    })
-    .await;
-    let small = fixture(&config2, &state2, "canvas-ceiling", 1).await;
-    let ordinary = canvas_bytes(temp2.path(), "loop.mp4", "1", "black");
-    assert!(ordinary.len() > 1024, "the fixture must exceed the ceiling");
-    assert!(matches!(
-        state2
-            .services
-            .place_canvas(small.owner, small.tracks[0], &ordinary, None)
-            .await,
-        Err(waveflow_server::services::ServiceError::Invalid)
-    ));
-
-    // Nothing refused leaves anything behind — no staged file, no blob, no row.
-    assert!(stored_files(&config).is_empty());
-    assert!(stored_files(&config2).is_empty());
-    assert_eq!(
-        state
-            .services
-            .canvas_for_track(library.owner, library.tracks[0])
-            .await
-            .unwrap(),
-        None
-    );
-}
-
-#[tokio::test]
-async fn the_quota_counts_distinct_blobs_and_refuses_the_one_that_would_cross_it() {
-    let first_size = {
-        let probe = tempfile::tempdir().unwrap();
-        canvas_bytes(probe.path(), "probe.mp4", "1", "black").len() as i64
-    };
-    // Room for one canvas of that size and not two. The second placement is the
-    // one that has to be refused, and a quota nothing ever meets proves nothing.
-    let (temp, config, state) = canvas_app(|canvas| {
-        canvas.max_bytes = first_size * 2;
-        canvas.library_quota_bytes = first_size + first_size / 2;
-    })
-    .await;
-    let fixture = fixture(&config, &state, "canvas-quota", 3).await;
-    let first = canvas_bytes(temp.path(), "first.mp4", "1", "black");
-    let second = canvas_bytes(temp.path(), "second.mp4", "1", "white");
-    // The boundary this test is about, stated rather than assumed, and stated
-    // against the limits the app actually runs under rather than against the
-    // arithmetic that chose them. `first_size` came from a separate ffmpeg run,
-    // so it sized the quota but it is not what the quota will charge: that is
-    // `first.len()`.
-    let first_used = first.len() as i64;
-    let second_used = second.len() as i64;
-    assert!(
-        first_used <= config.canvas.library_quota_bytes,
-        "the first canvas has to fit, or the refusal below proves nothing"
-    );
-    assert!(
-        second_used <= config.canvas.max_bytes,
-        "the second has to pass the per-canvas ceiling, so what stops it is the quota"
-    );
-    assert!(
-        first_used + second_used > config.canvas.library_quota_bytes,
-        "and it has to be the one that crosses"
-    );
-
-    let placed = state
-        .services
-        .place_canvas(fixture.owner, fixture.tracks[0], &first, None)
-        .await
-        .unwrap();
-
-    // The same blob on another track is free: an album's shared loop is billed
-    // once however many tracks name it, which is the deduplication showing up
-    // in the price.
-    state
-        .services
-        .place_canvas(fixture.owner, fixture.tracks[1], &first, None)
-        .await
-        .unwrap();
-    assert_eq!(stored_files(&config), vec![placed.file_name()]);
-
-    // A different blob is not.
-    assert!(matches!(
-        state
-            .services
-            .place_canvas(fixture.owner, fixture.tracks[2], &second, None)
-            .await,
-        Err(waveflow_server::services::ServiceError::Conflict)
-    ));
-    // And the refusal left no bytes: the file was written before the row, so a
-    // transaction that says no has to take them back.
-    assert_eq!(stored_files(&config), vec![placed.file_name()]);
-}
-
-// ---------------------------------------------------------------------------
-// The surfaces. RFC-009 decisions 3 and 4.
-// ---------------------------------------------------------------------------
-
-fn authorized(request: axum::http::request::Builder, token: &str) -> axum::http::request::Builder {
-    request.header("authorization", format!("Bearer {token}"))
-}
-
-#[tokio::test]
-async fn a_canvas_is_placed_read_back_and_taken_away_over_http() {
-    let (temp, config, state) = canvas_app(|_| {}).await;
-    let fixture = fixture(&config, &state, "canvas-routes", 1).await;
-    let router = waveflow_server::app(&config, state.clone());
-    let bytes = canvas_bytes(temp.path(), "loop.mp4", "1", "black");
-    let track = fixture.tracks[0];
-
-    let placed = router
-        .clone()
-        .oneshot(
-            authorized(
-                Request::put(format!("/api/v2/tracks/{track}/canvas")),
-                &fixture.token,
-            )
-            .body(Body::from(bytes.clone()))
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(placed.status(), StatusCode::OK);
-    let placed = json_body(placed).await;
-    assert_eq!(placed["format"], "mp4");
-    assert_eq!(placed["byte_size"], bytes.len() as i64);
-    let hash = placed["hash"].as_str().unwrap().to_owned();
-    assert_eq!(placed["url"], format!("/api/v2/canvas/{hash}"));
-
-    // Addressed by content: this URL can never answer differently, so the
-    // client is told to stop asking.
-    let by_hash = router
-        .clone()
-        .oneshot(
-            authorized(
-                Request::get(format!("/api/v2/canvas/{hash}")),
-                &fixture.token,
-            )
-            .body(Body::empty())
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(by_hash.status(), StatusCode::OK);
-    assert_eq!(by_hash.headers()["content-type"], "video/mp4");
-    assert_eq!(
-        by_hash.headers()["cache-control"],
-        "private, max-age=31536000, immutable"
-    );
-    let etag = by_hash.headers()["etag"].to_str().unwrap().to_owned();
-    assert_eq!(etag, format!("\"{hash}\""));
-
-    // Addressed by track: it resolves the link of the moment, which a member
-    // can replace, so it stays revalidatable.
-    let alias = router
-        .clone()
-        .oneshot(
-            authorized(
-                Request::get(format!("/api/v2/tracks/{track}/canvas")),
-                &fixture.token,
-            )
-            .body(Body::empty())
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(alias.status(), StatusCode::OK);
-    assert_eq!(alias.headers()["cache-control"], "private, no-cache");
-    // The validator is the hash either way, which is what makes revalidating
-    // the alias a 304 rather than a second transfer of the same bytes.
-    assert_eq!(alias.headers()["etag"], etag);
-
-    // Revalidation on both shapes. The alias is the one that has to answer 304
-    // — it is the URL a client keeps asking about — but the canonical one must
-    // too, or a client that does ask pays for the bytes twice.
-    for path in [
-        format!("/api/v2/tracks/{track}/canvas"),
-        format!("/api/v2/canvas/{hash}"),
-    ] {
-        let revalidated = router
-            .clone()
-            .oneshot(
-                authorized(Request::get(&path), &fixture.token)
-                    .header("if-none-match", &etag)
-                    .body(Body::empty())
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-        assert_eq!(revalidated.status(), StatusCode::NOT_MODIFIED, "{path}");
-        // The validator comes back with the 304, so the entry stays fresh
-        // rather than being evicted for having lost its tag.
-        assert_eq!(revalidated.headers()["etag"], etag, "{path}");
-    }
-
-    // A <video> element asks for ranges, and it asks the ticket URL. All three
-    // ways in serve the same file through the same helper, so all three answer
-    // 206 and carry the validator on the partial too.
-    let ticket = json_body(
-        router
-            .clone()
-            .oneshot(
-                authorized(
-                    Request::post(format!("/api/v2/tracks/{track}/canvas-ticket")),
-                    &fixture.token,
-                )
-                .body(Body::empty())
-                .unwrap(),
-            )
-            .await
-            .unwrap(),
-    )
-    .await["url"]
-        .as_str()
-        .unwrap()
-        .to_owned();
-    for (path, bearer) in [
-        (format!("/api/v2/canvas/{hash}"), true),
-        (format!("/api/v2/tracks/{track}/canvas"), true),
-        // No Authorization header at all: the sealed ticket is the credential.
-        (ticket, false),
-    ] {
-        let request = Request::get(&path);
-        let request = if bearer {
-            authorized(request, &fixture.token)
-        } else {
-            request
-        };
-        let ranged = router
-            .clone()
-            .oneshot(
-                request
-                    .header("range", "bytes=0-15")
-                    .body(Body::empty())
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-        assert_eq!(ranged.status(), StatusCode::PARTIAL_CONTENT, "{path}");
-        assert_eq!(ranged.headers()["etag"], etag, "{path}");
-        assert_eq!(ranged.headers()["content-length"], "16", "{path}");
-    }
-
-    let removed = router
-        .clone()
-        .oneshot(
-            authorized(
-                Request::delete(format!("/api/v2/tracks/{track}/canvas")),
-                &fixture.token,
-            )
-            .body(Body::empty())
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(removed.status(), StatusCode::NO_CONTENT);
-
-    for gone in [
-        format!("/api/v2/tracks/{track}/canvas"),
-        format!("/api/v2/canvas/{hash}"),
-    ] {
-        let response = router
-            .clone()
-            .oneshot(
-                authorized(Request::get(&gone), &fixture.token)
-                    .body(Body::empty())
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-        assert_eq!(response.status(), StatusCode::NOT_FOUND, "{gone}");
-    }
-}
-
-#[tokio::test]
-async fn a_ticket_opens_the_canvas_it_was_minted_for_and_nothing_else() {
-    let (temp, config, state) = canvas_app(|_| {}).await;
-    let fixture = fixture(&config, &state, "canvas-ticket", 1).await;
-    let router = waveflow_server::app(&config, state.clone());
-    let track = fixture.tracks[0];
-    state
-        .services
-        .place_canvas(
-            fixture.owner,
-            track,
-            &canvas_bytes(temp.path(), "loop.mp4", "1", "black"),
-            None,
-        )
-        .await
-        .unwrap();
-
-    let minted = router
-        .clone()
-        .oneshot(
-            authorized(
-                Request::post(format!("/api/v2/tracks/{track}/canvas-ticket")),
-                &fixture.token,
-            )
-            .body(Body::empty())
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(minted.status(), StatusCode::OK);
-    let url = json_body(minted).await["url"].as_str().unwrap().to_owned();
-    assert!(url.starts_with("/api/v2/canvas-stream/"));
-
-    // What <video src> does: no Authorization header at all.
-    let played = router
-        .clone()
-        .oneshot(Request::get(&url).body(Body::empty()).unwrap())
-        .await
-        .unwrap();
-    assert_eq!(played.status(), StatusCode::OK);
-    assert_eq!(played.headers()["content-type"], "video/mp4");
-
-    // The two kinds do not answer for each other, which is the whole reason the
-    // kind is sealed inside the payload. An audio ticket for this very track,
-    // minted for this very account and unexpired, does not open the canvas.
-    let audio = waveflow_server::stream_ticket::mint(
-        &state.secret_box,
-        waveflow_server::stream_ticket::TicketKind::Audio,
-        fixture.owner,
-        track,
-        now_ms() + 60_000,
-    )
-    .unwrap();
-    let refused = router
-        .clone()
-        .oneshot(
-            Request::get(format!("/api/v2/canvas-stream/{audio}"))
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(refused.status(), StatusCode::NOT_FOUND);
-
-    // And the reverse: the canvas ticket does not open the audio route.
-    let canvas_ticket = url.rsplit('/').next().unwrap();
-    let refused = router
-        .clone()
-        .oneshot(
-            Request::get(format!("/api/v2/stream/{canvas_ticket}"))
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(refused.status(), StatusCode::NOT_FOUND);
-}
-
-#[tokio::test]
-async fn the_route_carries_its_own_ceiling_and_the_neighbour_sees_nothing() {
-    let (temp, config, state) = canvas_app(|canvas| {
-        canvas.max_bytes = 4096;
-        canvas.library_quota_bytes = 1024 * 1024;
-    })
-    .await;
-    let owner = fixture(&config, &state, "canvas-ceiling-http", 1).await;
-    let router = waveflow_server::app(&config, state.clone());
-    let track = owner.tracks[0];
-
-    // Over the route's own ceiling. The router's global 16 KiB limit would have
-    // let this through, so what refuses it is the limit this route carries.
-    let oversized = router
-        .clone()
-        .oneshot(
-            authorized(
-                Request::put(format!("/api/v2/tracks/{track}/canvas")),
-                &owner.token,
-            )
-            .body(Body::from(vec![0u8; 8192]))
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(oversized.status(), StatusCode::PAYLOAD_TOO_LARGE);
-
-    // Under the ceiling and still not a loop: the request was well formed, and
-    // what it carried is not something this server will keep.
-    let garbage = router
-        .clone()
-        .oneshot(
-            authorized(
-                Request::put(format!("/api/v2/tracks/{track}/canvas")),
-                &owner.token,
-            )
-            .body(Body::from(vec![7u8; 2048]))
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(garbage.status(), StatusCode::UNPROCESSABLE_ENTITY);
-
-    // A real one, so the neighbour has something to fail to see.
-    let (_temp2, config2, state2) = canvas_app(|_| {}).await;
-    let roomy = fixture(&config2, &state2, "canvas-roomy", 1).await;
-    let router2 = waveflow_server::app(&config2, state2.clone());
-    let placed = state2
-        .services
-        .place_canvas(
-            roomy.owner,
-            roomy.tracks[0],
-            &canvas_bytes(temp.path(), "loop.mp4", "1", "black"),
-            None,
-        )
-        .await
-        .unwrap();
-    let neighbour = fixture(&config2, &state2, "canvas-neighbour-2", 1).await;
-
-    // Knowing the hash establishes nothing, and neither does knowing the track.
-    for path in [
-        format!("/api/v2/canvas/{}", placed.hash),
-        format!("/api/v2/tracks/{}/canvas", roomy.tracks[0]),
-    ] {
-        let response = router2
-            .clone()
-            .oneshot(
-                authorized(Request::get(&path), &neighbour.token)
-                    .body(Body::empty())
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-        assert_eq!(response.status(), StatusCode::NOT_FOUND, "{path}");
-    }
-    // And they cannot put one on somebody else's track either.
-    let intruding = router2
-        .clone()
-        .oneshot(
-            authorized(
-                Request::put(format!("/api/v2/tracks/{}/canvas", roomy.tracks[0])),
-                &neighbour.token,
-            )
-            .body(Body::from(vec![7u8; 512]))
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(intruding.status(), StatusCode::NOT_FOUND);
-}
-
-#[tokio::test]
-async fn placing_and_removing_a_canvas_travels_in_the_track_upsert() {
-    let (temp, config, state) = canvas_app(|_| {}).await;
-    let fixture = fixture(&config, &state, "canvas-feed", 1).await;
-    let router = waveflow_server::app(&config, state.clone());
-    let (token, device) =
-        login_session(&router, "canvas-feed", "correct horse battery staple").await;
-    let track = fixture.tracks[0];
-    let library = fixture.library;
-
-    // Where the feed already stood, so what follows is what this test caused
-    // rather than what the scan left behind.
-    let before = library_events(&router, &token, library).await.len();
-
-    let placed = router
-        .clone()
-        .oneshot(
-            authorized(
-                Request::put(format!("/api/v2/tracks/{track}/canvas")),
-                &token,
-            )
-            .header("x-waveflow-device-id", &device)
-            .body(Body::from(canvas_bytes(
-                temp.path(),
-                "loop.mp4",
-                "1",
-                "black",
-            )))
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(placed.status(), StatusCode::OK);
-
-    let events = library_events(&router, &token, library).await;
-    assert_eq!(events.len(), before + 1, "one event, and only one");
-    let event = events.last().unwrap();
-    // RFC-009 decision 7: no event for the blob, because the bytes behind a
-    // hash never change. Only the link is a change, and the link is part of the
-    // track — so it travels in the track's own upsert.
-    assert_eq!(event["entity_type"], "track");
-    assert_eq!(event["action"], "upsert");
-    assert_eq!(event["entity_id"], track.to_string());
-    // And the payload does not grow. `full_hash` is there because nothing else
-    // carries it; a canvas link is read off the track the client refetches.
-    assert!(
-        event["payload"]["full_hash"].is_string(),
-        "the payload is the one a tag correction sends"
-    );
-    assert!(
-        event["payload"].get("canvas").is_none(),
-        "no canvas field: that would make the payload a partial projection"
-    );
-    // So the client that just placed it does not read it back as a discovery.
-    assert_eq!(event["origin_device_id"], device);
-
-    // Taking it away is a change too, and it is the same shape.
-    let removed = router
-        .clone()
-        .oneshot(
-            authorized(
-                Request::delete(format!("/api/v2/tracks/{track}/canvas")),
-                &token,
-            )
-            .header("x-waveflow-device-id", &device)
-            .body(Body::empty())
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(removed.status(), StatusCode::NO_CONTENT);
-    let events = library_events(&router, &token, library).await;
-    assert_eq!(events.len(), before + 2);
-    assert_eq!(events.last().unwrap()["action"], "upsert");
-
-    // A removal that found nothing changed nothing, and says nothing.
-    let again = router
-        .clone()
-        .oneshot(
-            authorized(
-                Request::delete(format!("/api/v2/tracks/{track}/canvas")),
-                &token,
-            )
-            .body(Body::empty())
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(again.status(), StatusCode::NOT_FOUND);
-    assert_eq!(
-        library_events(&router, &token, library).await.len(),
-        before + 2,
-        "nothing happened, so nothing was announced"
-    );
-}
-
-async fn library_events(
-    router: &axum::Router,
-    token: &str,
-    library: uuid::Uuid,
-) -> Vec<serde_json::Value> {
-    let feed = router
-        .clone()
-        .oneshot(
-            authorized(
-                Request::get(format!(
-                    "/api/v2/libraries/{library}/events?after=0&limit=500"
-                )),
-                token,
-            )
-            .body(Body::empty())
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(feed.status(), StatusCode::OK);
-    json_body(feed).await["events"]
-        .as_array()
-        .expect("the feed answers a list")
-        .clone()
-}
-
-#[tokio::test]
-async fn the_two_doors_are_independent_in_both_directions() {
-    let (temp, config, state) = canvas_app(|_| {}).await;
-    let fixture = fixture(&config, &state, "canvas-doors", 1).await;
-    let bytes = canvas_bytes(temp.path(), "loop.mp4", "1", "black");
-    let track = fixture.tracks[0];
-
-    // The case that made this a separate flag. `fixture` opened the canvas door
-    // and left the upload one shut, which is the read-only server the desktop
-    // named: it refuses to grow in audio and still takes a loop.
-    // Stated rather than inherited from the fixture, so the situation this test
-    // is about is visible in the test.
-    state
-        .db
-        .set_library_accepts_uploads(fixture.owner, fixture.library, false, now_ms())
-        .await
-        .unwrap();
-    state
-        .services
-        .place_canvas(fixture.owner, track, &bytes, None)
-        .await
-        .unwrap();
-
-    // And the reverse: opening the library to files says nothing about loops.
-    // A flag inherited from the other would be the operator opting into
-    // something he never named.
-    state
-        .services
-        .remove_canvas(fixture.owner, track, None)
-        .await
-        .unwrap();
-    state
-        .db
-        .set_library_accepts_canvas(fixture.owner, fixture.library, false, now_ms())
-        .await
-        .unwrap();
-    state
-        .db
-        .set_library_accepts_uploads(fixture.owner, fixture.library, true, now_ms())
-        .await
-        .unwrap();
-    assert!(matches!(
-        state
-            .services
-            .place_canvas(fixture.owner, track, &bytes, None)
-            .await,
-        Err(waveflow_server::services::ServiceError::Forbidden)
-    ));
-}
-
-/// RFC-009 decision 9. A canvas plays over a track that is already playing and
-/// the desktop's `<video>` carries a hard-coded `muted`, so there is no client
-/// that could choose to hear this. Keeping it would spend the ceiling on bytes
-/// nobody can hear.
-#[tokio::test]
-async fn a_loop_that_carries_sound_is_taken_without_it() {
-    let (temp, config, state) = canvas_app(|_| {}).await;
-    let library = fixture(&config, &state, "canvas-sound", 2).await;
-    let noisy = noisy_canvas_bytes(temp.path());
-
-    // Accepted rather than refused: an otherwise perfectly good mp4 must not be
-    // rejected over a stream the sender did not necessarily choose to include.
-    let placed = state
-        .services
-        .place_canvas(library.owner, library.tracks[0], &noisy, None)
-        .await
-        .unwrap();
-    assert_eq!(placed.format, "mp4");
-    assert_eq!(stored_files(&config), vec![placed.file_name()]);
-
-    // And stored without it. This is the assertion the previous shape of this
-    // test was missing: accepting the file was true before the strip existed.
-    let stored = config.canvas_dir.join(placed.file_name());
-    assert!(
-        !has_audio_stream(&stored),
-        "the soundtrack must not be in the store"
-    );
-    assert_eq!(
-        placed.byte_size,
-        std::fs::metadata(&stored).unwrap().len() as i64,
-        "the quota is charged what the store holds"
-    );
-    assert!(
-        placed.byte_size < noisy.len() as i64,
-        "and what it holds is smaller than what arrived"
-    );
-
-    // The strip has to be deterministic or the deduplication of decision 1
-    // quietly stops working: the same loop offered twice would land as two
-    // blobs and be charged twice.
-    let again = state
-        .services
-        .place_canvas(library.owner, library.tracks[1], &noisy, None)
-        .await
-        .unwrap();
-    assert_eq!(again, placed, "the same source must give the same blob");
-    assert_eq!(stored_files(&config), vec![placed.file_name()]);
-
-    // And the quota charges what the store holds, not what arrived. Asserting
-    // `byte_size` above says what the row carries; this says what the quota
-    // spends, which is the number that can silently go wrong.
-    //
-    // It cannot be shown by squeezing the quota to the stripped size, because
-    // `validate_canvas` refuses a per-canvas ceiling above the library quota
-    // and the ceiling has to admit the *arriving* bytes. So the room is filled
-    // instead: a first canvas takes all but exactly the stripped size, and the
-    // noisy one fits only if it is charged what it became.
-    // A test pattern rather than a flat colour: flat black compresses to about
-    // a kilobyte a second, far too little to fill a quota against an 11 KB
-    // arrival, and a filler long enough to get there would trip the duration
-    // ceiling instead.
-    let filler = detailed_canvas_bytes(temp.path());
-    let (_temp2, config2, state2) = canvas_app(|canvas| {
-        // The ceiling has to admit both arrivals — the filler and the noisy
-        // one — while staying under the quota, which is what makes this a
-        // configuration the server would actually start with.
-        canvas.max_bytes = filler.len().max(noisy.len()) as i64;
-        canvas.library_quota_bytes = filler.len() as i64 + placed.byte_size;
-    })
-    .await;
-    assert!(
-        filler.len() as i64 + placed.byte_size >= filler.len().max(noisy.len()) as i64,
-        "the ceiling must fit under the quota, or this config would not validate"
-    );
-    let tight = fixture(&config2, &state2, "canvas-charged", 2).await;
-    state2
-        .services
-        .place_canvas(tight.owner, tight.tracks[0], &filler, None)
-        .await
-        .unwrap();
-    // Exactly the stripped size is left. Charged `noisy.len()` this is a
-    // `Conflict`; charged what the store holds it fits to the byte.
-    let squeezed = state2
-        .services
-        .place_canvas(tight.owner, tight.tracks[1], &noisy, None)
-        .await
-        .unwrap();
-    assert_eq!(squeezed.byte_size, placed.byte_size);
-}
-
-/// An mp4 big enough to fill a quota without running long enough to trip the
-/// duration ceiling: detail costs bytes where duration costs seconds.
-fn detailed_canvas_bytes(dir: &std::path::Path) -> Vec<u8> {
-    let path = dir.join("filler.mp4");
-    let output = std::process::Command::new("ffmpeg")
-        .args([
-            "-hide_banner",
-            "-loglevel",
-            "error",
-            "-y",
-            "-f",
-            "lavfi",
-            "-i",
-            "testsrc=s=160x120:r=10:d=2",
-            "-c:v",
-            "mpeg4",
-        ])
-        .arg(&path)
-        .output()
-        .expect("ffmpeg must be on PATH");
-    assert!(
-        output.status.success(),
-        "ffmpeg failed: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    std::fs::read(&path).unwrap()
-}
-
-/// An mp4 carrying both a picture and a soundtrack.
-fn noisy_canvas_bytes(dir: &std::path::Path) -> Vec<u8> {
-    let path = dir.join("noisy.mp4");
-    let output = std::process::Command::new("ffmpeg")
-        .args([
-            "-hide_banner",
-            "-loglevel",
-            "error",
-            "-y",
-            "-f",
-            "lavfi",
-            "-i",
-            "color=c=black:s=64x64:r=10:d=1",
-            "-f",
-            "lavfi",
-            "-i",
-            "sine=frequency=440:duration=1",
-            "-c:v",
-            "mpeg4",
-            "-c:a",
-            "aac",
-            "-shortest",
-        ])
-        .arg(&path)
-        .output()
-        .expect("ffmpeg must be on PATH");
-    assert!(
-        output.status.success(),
-        "ffmpeg failed: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let bytes = std::fs::read(&path).unwrap();
-    assert!(has_audio_stream(&path), "the fixture must carry sound");
-    bytes
-}
-
-fn has_audio_stream(path: &std::path::Path) -> bool {
-    let output = std::process::Command::new("ffprobe")
-        .args([
-            "-v",
-            "error",
-            "-select_streams",
-            "a",
-            "-show_entries",
-            "stream=codec_type",
-            "-of",
-            "csv=p=0",
-        ])
-        .arg(path)
-        .output()
-        .expect("ffprobe must be on PATH");
-    assert!(output.status.success());
-    !String::from_utf8_lossy(&output.stdout).trim().is_empty()
-}
-
-// ---------------------------------------------------------------------------
-// The store sweep. RFC-009 left it open; this is what it collects, and — more
-// to the point — what it refuses to touch.
-// ---------------------------------------------------------------------------
-
-#[tokio::test]
-async fn the_sweep_collects_orphans_and_leaves_everything_else_alone() {
-    let (temp, config, state) = canvas_app(|_| {}).await;
-    let library = fixture(&config, &state, "canvas-sweep", 1).await;
-    let placed = state
-        .services
-        .place_canvas(
-            library.owner,
-            library.tracks[0],
-            &canvas_bytes(temp.path(), "loop.mp4", "1", "black"),
-            None,
-        )
-        .await
-        .unwrap();
-
-    let store = &config.canvas_dir;
-    // Bytes no row names: what a crash between the commit and the unlink
-    // leaves, and what a placement that died before its row leaves.
-    let orphan = format!("{}.mp4", "a".repeat(64));
-    std::fs::write(store.join(&orphan), b"orphaned bytes").unwrap();
-    // A working file old enough that no request could still be holding it.
-    let stale = store.join(format!("{}.part", uuid::Uuid::new_v4()));
-    std::fs::write(&stale, b"abandoned").unwrap();
-    set_age(&stale, std::time::Duration::from_secs(2 * 60 * 60));
-    // And one that a request could: this is the placement running right now.
-    let fresh = store.join(format!("{}.silent", uuid::Uuid::new_v4()));
-    std::fs::write(&fresh, b"in flight").unwrap();
-    // Something the sweep did not write. The store sits under the operator's
-    // `data/`, and a sweep that deletes what it cannot name is one nobody
-    // should run.
-    std::fs::write(store.join("operator-notes.txt"), b"do not delete").unwrap();
-    // And the same thing wearing this module's extension. The stem is what
-    // says whose file it is: a working name has a UUID for a stem because
-    // `place_canvas` put one there, and `notes.part` is not that. Backdated so
-    // that only the stem stands between it and deletion.
-    let disguised = store.join("operator-notes.part");
-    std::fs::write(&disguised, b"do not delete either").unwrap();
-    set_age(&disguised, std::time::Duration::from_secs(2 * 60 * 60));
-
-    let swept = state.services.sweep_canvas_store().await.unwrap();
-    assert_eq!(swept.blobs_removed, 1, "the unreferenced blob goes");
-    assert_eq!(swept.staging_removed, 1, "the abandoned working file goes");
-    assert_eq!(
-        swept.unknown, 2,
-        "and the strangers are counted, not removed"
-    );
-    assert_eq!(swept.dead_links, 0);
-
-    let left = stored_files(&config);
-    assert!(left.contains(&placed.file_name()), "the live canvas stays");
-    for kept in ["operator-notes.txt", "operator-notes.part"] {
-        assert!(
-            left.contains(&kept.to_owned()),
-            "a file the sweep does not recognise is left exactly where it was: {kept}"
-        );
-    }
-    assert!(
-        left.iter().any(|name| name.ends_with(".silent")),
-        "a working file young enough to belong to a live request stays"
-    );
-    assert!(!left.contains(&orphan), "the orphan is gone");
-
-    // The canvas is still servable, which is the assertion that would catch a
-    // sweep that removed the wrong file.
-    assert_eq!(
-        state
-            .services
-            .canvas_for_track(library.owner, library.tracks[0])
-            .await
-            .unwrap(),
-        Some(placed.clone())
-    );
-
-    // The other direction is reported and never repaired: deleting the row
-    // would answer a dead link by making it a missing one.
-    std::fs::remove_file(config.canvas_dir.join(placed.file_name())).unwrap();
-    let swept = state.services.sweep_canvas_store().await.unwrap();
-    assert_eq!(swept.dead_links, 1);
-    assert_eq!(swept.blobs_removed, 0);
-    assert!(
-        state
-            .services
-            .canvas_for_track(library.owner, library.tracks[0])
-            .await
-            .unwrap()
-            .is_some(),
-        "the row is somebody's canvas and the sweep does not take it"
-    );
-}
-
-/// Backdates a file so the sweep sees it as abandoned without the test waiting
-/// an hour for it.
-fn set_age(path: &std::path::Path, age: std::time::Duration) {
-    let when = std::time::SystemTime::now() - age;
-    let file = std::fs::File::options().write(true).open(path).unwrap();
-    file.set_modified(when).unwrap();
-}
-
-/// Whether a library takes canvases is on the list of libraries, apart from
-/// whether it takes files, and it follows the operator's switch.
-///
-/// Two doors, and the list has to show both. A client that could read only
-/// `accepts_uploads` would hide the canvas in exactly the library RFC-009 split
-/// the flag for — one that refuses audio and takes loops — and a client that
-/// could read neither would offer a canvas everywhere, to learn the answer only
-/// after sending the whole file.
-#[tokio::test]
-async fn the_library_list_says_whether_a_library_takes_canvases() {
-    let (_temp, config, state) = canvas_app(|_| {}).await;
-    let fixture = fixture(&config, &state, "canvas-flag-reader", 1).await;
-    let listed = || {
-        let router = waveflow_server::app(&config, state.clone());
-        let token = fixture.token.clone();
-        async move {
-            let response = router
-                .oneshot(
-                    Request::builder()
-                        .uri("/api/v2/libraries")
-                        .header("authorization", format!("Bearer {token}"))
-                        .body(Body::empty())
-                        .unwrap(),
-                )
-                .await
-                .unwrap();
-            assert_eq!(response.status(), StatusCode::OK);
-            json_body(response).await
-        }
-    };
-
-    let open = listed().await;
-    assert_eq!(open[0]["accepts_canvas"], true, "the fixture opened it");
-    assert_eq!(
-        open[0]["accepts_uploads"], false,
-        "and left the other door shut, which the list must not confuse with it"
-    );
-    state
-        .db
-        .set_library_accepts_canvas(fixture.owner, fixture.library, false, now_ms())
-        .await
-        .unwrap();
-    assert_eq!(listed().await[0]["accepts_canvas"], false);
-}
-
-/// RFC-023 decision 4: a canvas ticket minted before its account was disabled
-/// stops opening the canvas, as an audio ticket stops playing. The ticket is
-/// sealed rather than looked up, so the redemption's own read is what asks.
-#[tokio::test]
-async fn a_disabled_account_s_canvas_ticket_opens_nothing() {
-    let (temp, config, state) = canvas_app(|_| {}).await;
-    let (owner, _token) = admin_with_api_token(&state, "canvas-disabled").await;
-    let music = config.data_dir.join("canvas-disabled");
-    std::fs::create_dir_all(&music).unwrap();
-    write_test_wav(&music.join("Looped.wav"));
-    let root = std::fs::canonicalize(&music).unwrap();
-    let library = state
-        .db
-        .create_library(
-            owner,
-            "canvas-disabled",
-            &root,
-            LibraryVisibility::Private,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    run_scan(
-        &state,
-        owner,
-        LibraryRecord {
-            id: library,
-            name: "canvas-disabled".into(),
-            root_path: root,
-        },
-    )
-    .await;
-    state
-        .db
-        .set_library_accepts_canvas(owner, library, true, now_ms())
-        .await
-        .unwrap();
-    let track = state.db.list_tracks_for_user(owner, library).await.unwrap()[0].id;
-    state
-        .services
-        .place_canvas(
-            owner,
-            track,
-            &canvas_bytes(temp.path(), "loop.mp4", "1", "black"),
-            None,
-        )
-        .await
-        .unwrap();
-    let ticket = waveflow_server::stream_ticket::mint(
-        &state.secret_box,
-        waveflow_server::stream_ticket::TicketKind::Canvas,
-        owner,
-        track,
-        now_ms() + 60_000,
-    )
-    .unwrap();
-    let router = waveflow_server::app(&config, state.clone());
-    let open = || {
-        let router = router.clone();
-        let ticket = ticket.clone();
-        async move {
-            router
-                .oneshot(
-                    Request::get(format!("/api/v2/canvas-stream/{ticket}"))
-                        .body(Body::empty())
-                        .unwrap(),
-                )
-                .await
-                .unwrap()
-                .status()
-        }
-    };
-    assert_eq!(open().await, StatusCode::OK);
-    set_disabled(&state, owner, true).await;
-    assert_eq!(open().await, StatusCode::NOT_FOUND);
-    set_disabled(&state, owner, false).await;
-    assert_eq!(open().await, StatusCode::OK);
-}
diff --git a/tests/canvas/ingest.rs b/tests/canvas/ingest.rs
new file mode 100644
index 00000000..2b4883d3
--- /dev/null
+++ b/tests/canvas/ingest.rs
@@ -0,0 +1,589 @@
+//! Taking a canvas in: stored once and shared by reference, owned by the
+//! library, refused when it is not a short loop or crosses the quota, and
+//! stripped of any sound.
+
+use super::*;
+
+/// An mp4 carrying sound and no picture. A canvas without a video stream is not
+/// a canvas, whatever else it is.
+fn soundtrack_only(dir: &std::path::Path) -> Vec<u8> {
+    let path = dir.join("audio-only.mp4");
+    let output = std::process::Command::new("ffmpeg")
+        .args([
+            "-hide_banner",
+            "-loglevel",
+            "error",
+            "-y",
+            "-f",
+            "lavfi",
+            "-i",
+            "sine=frequency=440:duration=1",
+            "-c:a",
+            "aac",
+        ])
+        .arg(&path)
+        .output()
+        .expect("ffmpeg must be on PATH");
+    assert!(output.status.success());
+    std::fs::read(&path).unwrap()
+}
+
+#[tokio::test]
+async fn a_canvas_is_stored_once_shared_by_reference_and_erased_with_the_last_link() {
+    let (temp, config, state) = canvas_app(|_| {}).await;
+    let fixture = fixture(&config, &state, "canvas-store", 2).await;
+    let bytes = canvas_bytes(temp.path(), "loop.mp4", "1", "black");
+
+    let placed = state
+        .services
+        .place_canvas(fixture.owner, fixture.tracks[0], &bytes, None)
+        .await
+        .unwrap();
+    assert_eq!(placed.format, "mp4");
+    assert_eq!(placed.byte_size, bytes.len() as i64);
+    assert_eq!(stored_files(&config), vec![placed.file_name()]);
+
+    // The alias resolves the link, and the fingerprint resolves the content.
+    // Both answer the same blob to somebody entitled to the track.
+    assert_eq!(
+        state
+            .services
+            .canvas_for_track(fixture.owner, fixture.tracks[0])
+            .await
+            .unwrap(),
+        Some(placed.clone())
+    );
+    assert_eq!(
+        state
+            .services
+            .canvas_for_user(fixture.owner, &placed.hash)
+            .await
+            .unwrap(),
+        Some(placed.clone())
+    );
+
+    // The twelve tracks of an album that share one loop share the bytes. Here
+    // there are two, and one file.
+    let second = state
+        .services
+        .place_canvas(fixture.owner, fixture.tracks[1], &bytes, None)
+        .await
+        .unwrap();
+    assert_eq!(second, placed);
+    assert_eq!(stored_files(&config), vec![placed.file_name()]);
+
+    // Removing one link removes a row, not a blob: the other track still names
+    // it, and a file erased here would be a dead link for somebody else.
+    state
+        .services
+        .remove_canvas(fixture.owner, fixture.tracks[0], None)
+        .await
+        .unwrap();
+    assert_eq!(
+        state
+            .services
+            .canvas_for_track(fixture.owner, fixture.tracks[0])
+            .await
+            .unwrap(),
+        None
+    );
+    assert_eq!(stored_files(&config), vec![placed.file_name()]);
+    assert!(state
+        .services
+        .canvas_for_user(fixture.owner, &placed.hash)
+        .await
+        .unwrap()
+        .is_some());
+
+    // The last one takes the bytes with it.
+    state
+        .services
+        .remove_canvas(fixture.owner, fixture.tracks[1], None)
+        .await
+        .unwrap();
+    assert!(stored_files(&config).is_empty());
+    assert_eq!(
+        state
+            .services
+            .canvas_for_user(fixture.owner, &placed.hash)
+            .await
+            .unwrap(),
+        None
+    );
+
+    // Removing what is not there is not a silent success: there was nothing to
+    // take away, and the caller asked to take something away.
+    assert!(matches!(
+        state
+            .services
+            .remove_canvas(fixture.owner, fixture.tracks[1], None)
+            .await,
+        Err(waveflow_server::services::ServiceError::NotFound)
+    ));
+}
+
+#[tokio::test]
+async fn replacing_a_canvas_releases_the_one_it_replaced() {
+    let (temp, config, state) = canvas_app(|_| {}).await;
+    let fixture = fixture(&config, &state, "canvas-replace", 2).await;
+    let first = canvas_bytes(temp.path(), "first.mp4", "1", "black");
+    let second = canvas_bytes(temp.path(), "second.mp4", "1", "white");
+
+    let first = state
+        .services
+        .place_canvas(fixture.owner, fixture.tracks[0], &first, None)
+        .await
+        .unwrap();
+    let second = state
+        .services
+        .place_canvas(fixture.owner, fixture.tracks[0], &second, None)
+        .await
+        .unwrap();
+    assert_ne!(first.hash, second.hash);
+    // A replacement is a removal too. The loop the track used to carry lost its
+    // last reference, so its row and its bytes are gone.
+    assert_eq!(stored_files(&config), vec![second.file_name()]);
+    assert_eq!(
+        state
+            .services
+            .canvas_for_user(fixture.owner, &first.hash)
+            .await
+            .unwrap(),
+        None
+    );
+
+    // Unless another track still holds it. Both tracks take the first loop,
+    // then the first track is given the second one back: the blob survives the
+    // replacement because track two is still naming it.
+    let first_bytes = std::fs::read(temp.path().join("first.mp4")).unwrap();
+    let second_bytes = std::fs::read(temp.path().join("second.mp4")).unwrap();
+    for track in &fixture.tracks {
+        assert_eq!(
+            state
+                .services
+                .place_canvas(fixture.owner, *track, &first_bytes, None)
+                .await
+                .unwrap()
+                .hash,
+            first.hash
+        );
+    }
+    assert_eq!(stored_files(&config), vec![first.file_name()]);
+
+    state
+        .services
+        .place_canvas(fixture.owner, fixture.tracks[0], &second_bytes, None)
+        .await
+        .unwrap();
+    let mut expected = vec![first.file_name(), second.file_name()];
+    expected.sort();
+    assert_eq!(stored_files(&config), expected);
+}
+
+#[tokio::test]
+async fn a_canvas_belongs_to_the_library_and_not_to_whoever_knows_its_name() {
+    let (temp, config, state) = canvas_app(|_| {}).await;
+    let owner = fixture(&config, &state, "canvas-owner", 1).await;
+    let stranger = fixture(&config, &state, "canvas-stranger", 1).await;
+    let bytes = canvas_bytes(temp.path(), "loop.mp4", "1", "black");
+
+    let placed = state
+        .services
+        .place_canvas(owner.owner, owner.tracks[0], &bytes, None)
+        .await
+        .unwrap();
+
+    // A hash identifies content and proves nothing. Two accounts that are
+    // strangers to each other can hold the same loop, so knowing the
+    // fingerprint establishes no more than knowing a track id does.
+    assert_eq!(
+        state
+            .services
+            .canvas_for_user(stranger.owner, &placed.hash)
+            .await
+            .unwrap(),
+        None
+    );
+    // A track of another library is missing and belongs to someone else, and
+    // both answer the same thing.
+    assert_eq!(
+        state
+            .services
+            .canvas_for_track(stranger.owner, owner.tracks[0])
+            .await
+            .unwrap(),
+        None
+    );
+    assert!(matches!(
+        state
+            .services
+            .place_canvas(stranger.owner, owner.tracks[0], &bytes, None)
+            .await,
+        Err(waveflow_server::services::ServiceError::NotFound)
+    ));
+    assert!(matches!(
+        state
+            .services
+            .remove_canvas(stranger.owner, owner.tracks[0], None)
+            .await,
+        Err(waveflow_server::services::ServiceError::NotFound)
+    ));
+
+    // And the stranger placing on their own track shares the blob without
+    // learning anything about the neighbour who already held it.
+    let theirs = state
+        .services
+        .place_canvas(stranger.owner, stranger.tracks[0], &bytes, None)
+        .await
+        .unwrap();
+    assert_eq!(theirs.hash, placed.hash);
+    assert_eq!(stored_files(&config), vec![placed.file_name()]);
+}
+
+#[tokio::test]
+async fn a_closed_library_takes_no_canvas_but_still_gives_one_back() {
+    let (temp, config, state) = canvas_app(|_| {}).await;
+    let fixture = fixture(&config, &state, "canvas-closed", 1).await;
+    let bytes = canvas_bytes(temp.path(), "loop.mp4", "1", "black");
+    state
+        .services
+        .place_canvas(fixture.owner, fixture.tracks[0], &bytes, None)
+        .await
+        .unwrap();
+
+    state
+        .db
+        .set_library_accepts_canvas(fixture.owner, fixture.library, false, now_ms())
+        .await
+        .unwrap();
+
+    // The flag answers "may a member spend the operator's disk", so it closes
+    // the door that spends it.
+    assert!(matches!(
+        state
+            .services
+            .place_canvas(fixture.owner, fixture.tracks[0], &bytes, None)
+            .await,
+        Err(waveflow_server::services::ServiceError::Forbidden)
+    ));
+    // Taking something away never spends it, and closing a library must not
+    // strand what it already holds.
+    state
+        .services
+        .remove_canvas(fixture.owner, fixture.tracks[0], None)
+        .await
+        .unwrap();
+    assert!(stored_files(&config).is_empty());
+}
+
+#[tokio::test]
+async fn what_is_not_a_short_loop_is_refused_and_leaves_nothing_behind() {
+    let (temp, config, state) = canvas_app(|canvas| canvas.max_duration_secs = 2).await;
+    let library = fixture(&config, &state, "canvas-refused", 1).await;
+
+    // Bytes ffprobe cannot read at all. A verdict on the offer, not an outage.
+    assert!(matches!(
+        state
+            .services
+            .place_canvas(
+                library.owner,
+                library.tracks[0],
+                b"this is not a container",
+                None
+            )
+            .await,
+        Err(waveflow_server::services::ServiceError::Invalid)
+    ));
+
+    // A container on the list, carrying sound and no picture.
+    assert!(matches!(
+        state
+            .services
+            .place_canvas(
+                library.owner,
+                library.tracks[0],
+                &soundtrack_only(temp.path()),
+                None
+            )
+            .await,
+        Err(waveflow_server::services::ServiceError::Invalid)
+    ));
+
+    // A loop that is not short. Without this bound, "a short loop" becomes
+    // video hosting, which is a different product with different costs.
+    let long = canvas_bytes(temp.path(), "long.mp4", "5", "black");
+    assert!(matches!(
+        state
+            .services
+            .place_canvas(library.owner, library.tracks[0], &long, None)
+            .await,
+        Err(waveflow_server::services::ServiceError::Invalid)
+    ));
+
+    // Larger than the ceiling, refused before anything is written.
+    let (temp2, config2, state2) = canvas_app(|canvas| {
+        canvas.max_bytes = 1024;
+        canvas.library_quota_bytes = 1024 * 1024;
+    })
+    .await;
+    let small = fixture(&config2, &state2, "canvas-ceiling", 1).await;
+    let ordinary = canvas_bytes(temp2.path(), "loop.mp4", "1", "black");
+    assert!(ordinary.len() > 1024, "the fixture must exceed the ceiling");
+    assert!(matches!(
+        state2
+            .services
+            .place_canvas(small.owner, small.tracks[0], &ordinary, None)
+            .await,
+        Err(waveflow_server::services::ServiceError::Invalid)
+    ));
+
+    // Nothing refused leaves anything behind — no staged file, no blob, no row.
+    assert!(stored_files(&config).is_empty());
+    assert!(stored_files(&config2).is_empty());
+    assert_eq!(
+        state
+            .services
+            .canvas_for_track(library.owner, library.tracks[0])
+            .await
+            .unwrap(),
+        None
+    );
+}
+
+#[tokio::test]
+async fn the_quota_counts_distinct_blobs_and_refuses_the_one_that_would_cross_it() {
+    let first_size = {
+        let probe = tempfile::tempdir().unwrap();
+        canvas_bytes(probe.path(), "probe.mp4", "1", "black").len() as i64
+    };
+    // Room for one canvas of that size and not two. The second placement is the
+    // one that has to be refused, and a quota nothing ever meets proves nothing.
+    let (temp, config, state) = canvas_app(|canvas| {
+        canvas.max_bytes = first_size * 2;
+        canvas.library_quota_bytes = first_size + first_size / 2;
+    })
+    .await;
+    let fixture = fixture(&config, &state, "canvas-quota", 3).await;
+    let first = canvas_bytes(temp.path(), "first.mp4", "1", "black");
+    let second = canvas_bytes(temp.path(), "second.mp4", "1", "white");
+    // The boundary this test is about, stated rather than assumed, and stated
+    // against the limits the app actually runs under rather than against the
+    // arithmetic that chose them. `first_size` came from a separate ffmpeg run,
+    // so it sized the quota but it is not what the quota will charge: that is
+    // `first.len()`.
+    let first_used = first.len() as i64;
+    let second_used = second.len() as i64;
+    assert!(
+        first_used <= config.canvas.library_quota_bytes,
+        "the first canvas has to fit, or the refusal below proves nothing"
+    );
+    assert!(
+        second_used <= config.canvas.max_bytes,
+        "the second has to pass the per-canvas ceiling, so what stops it is the quota"
+    );
+    assert!(
+        first_used + second_used > config.canvas.library_quota_bytes,
+        "and it has to be the one that crosses"
+    );
+
+    let placed = state
+        .services
+        .place_canvas(fixture.owner, fixture.tracks[0], &first, None)
+        .await
+        .unwrap();
+
+    // The same blob on another track is free: an album's shared loop is billed
+    // once however many tracks name it, which is the deduplication showing up
+    // in the price.
+    state
+        .services
+        .place_canvas(fixture.owner, fixture.tracks[1], &first, None)
+        .await
+        .unwrap();
+    assert_eq!(stored_files(&config), vec![placed.file_name()]);
+
+    // A different blob is not.
+    assert!(matches!(
+        state
+            .services
+            .place_canvas(fixture.owner, fixture.tracks[2], &second, None)
+            .await,
+        Err(waveflow_server::services::ServiceError::Conflict)
+    ));
+    // And the refusal left no bytes: the file was written before the row, so a
+    // transaction that says no has to take them back.
+    assert_eq!(stored_files(&config), vec![placed.file_name()]);
+}
+
+/// RFC-009 decision 9. A canvas plays over a track that is already playing and
+/// the desktop's `<video>` carries a hard-coded `muted`, so there is no client
+/// that could choose to hear this. Keeping it would spend the ceiling on bytes
+/// nobody can hear.
+#[tokio::test]
+async fn a_loop_that_carries_sound_is_taken_without_it() {
+    let (temp, config, state) = canvas_app(|_| {}).await;
+    let library = fixture(&config, &state, "canvas-sound", 2).await;
+    let noisy = noisy_canvas_bytes(temp.path());
+
+    // Accepted rather than refused: an otherwise perfectly good mp4 must not be
+    // rejected over a stream the sender did not necessarily choose to include.
+    let placed = state
+        .services
+        .place_canvas(library.owner, library.tracks[0], &noisy, None)
+        .await
+        .unwrap();
+    assert_eq!(placed.format, "mp4");
+    assert_eq!(stored_files(&config), vec![placed.file_name()]);
+
+    // And stored without it. This is the assertion the previous shape of this
+    // test was missing: accepting the file was true before the strip existed.
+    let stored = config.canvas_dir.join(placed.file_name());
+    assert!(
+        !has_audio_stream(&stored),
+        "the soundtrack must not be in the store"
+    );
+    assert_eq!(
+        placed.byte_size,
+        std::fs::metadata(&stored).unwrap().len() as i64,
+        "the quota is charged what the store holds"
+    );
+    assert!(
+        placed.byte_size < noisy.len() as i64,
+        "and what it holds is smaller than what arrived"
+    );
+
+    // The strip has to be deterministic or the deduplication of decision 1
+    // quietly stops working: the same loop offered twice would land as two
+    // blobs and be charged twice.
+    let again = state
+        .services
+        .place_canvas(library.owner, library.tracks[1], &noisy, None)
+        .await
+        .unwrap();
+    assert_eq!(again, placed, "the same source must give the same blob");
+    assert_eq!(stored_files(&config), vec![placed.file_name()]);
+
+    // And the quota charges what the store holds, not what arrived. Asserting
+    // `byte_size` above says what the row carries; this says what the quota
+    // spends, which is the number that can silently go wrong.
+    //
+    // It cannot be shown by squeezing the quota to the stripped size, because
+    // `validate_canvas` refuses a per-canvas ceiling above the library quota
+    // and the ceiling has to admit the *arriving* bytes. So the room is filled
+    // instead: a first canvas takes all but exactly the stripped size, and the
+    // noisy one fits only if it is charged what it became.
+    // A test pattern rather than a flat colour: flat black compresses to about
+    // a kilobyte a second, far too little to fill a quota against an 11 KB
+    // arrival, and a filler long enough to get there would trip the duration
+    // ceiling instead.
+    let filler = detailed_canvas_bytes(temp.path());
+    let (_temp2, config2, state2) = canvas_app(|canvas| {
+        // The ceiling has to admit both arrivals — the filler and the noisy
+        // one — while staying under the quota, which is what makes this a
+        // configuration the server would actually start with.
+        canvas.max_bytes = filler.len().max(noisy.len()) as i64;
+        canvas.library_quota_bytes = filler.len() as i64 + placed.byte_size;
+    })
+    .await;
+    assert!(
+        filler.len() as i64 + placed.byte_size >= filler.len().max(noisy.len()) as i64,
+        "the ceiling must fit under the quota, or this config would not validate"
+    );
+    let tight = fixture(&config2, &state2, "canvas-charged", 2).await;
+    state2
+        .services
+        .place_canvas(tight.owner, tight.tracks[0], &filler, None)
+        .await
+        .unwrap();
+    // Exactly the stripped size is left. Charged `noisy.len()` this is a
+    // `Conflict`; charged what the store holds it fits to the byte.
+    let squeezed = state2
+        .services
+        .place_canvas(tight.owner, tight.tracks[1], &noisy, None)
+        .await
+        .unwrap();
+    assert_eq!(squeezed.byte_size, placed.byte_size);
+}
+
+/// An mp4 big enough to fill a quota without running long enough to trip the
+/// duration ceiling: detail costs bytes where duration costs seconds.
+fn detailed_canvas_bytes(dir: &std::path::Path) -> Vec<u8> {
+    let path = dir.join("filler.mp4");
+    let output = std::process::Command::new("ffmpeg")
+        .args([
+            "-hide_banner",
+            "-loglevel",
+            "error",
+            "-y",
+            "-f",
+            "lavfi",
+            "-i",
+            "testsrc=s=160x120:r=10:d=2",
+            "-c:v",
+            "mpeg4",
+        ])
+        .arg(&path)
+        .output()
+        .expect("ffmpeg must be on PATH");
+    assert!(
+        output.status.success(),
+        "ffmpeg failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    std::fs::read(&path).unwrap()
+}
+
+/// An mp4 carrying both a picture and a soundtrack.
+fn noisy_canvas_bytes(dir: &std::path::Path) -> Vec<u8> {
+    let path = dir.join("noisy.mp4");
+    let output = std::process::Command::new("ffmpeg")
+        .args([
+            "-hide_banner",
+            "-loglevel",
+            "error",
+            "-y",
+            "-f",
+            "lavfi",
+            "-i",
+            "color=c=black:s=64x64:r=10:d=1",
+            "-f",
+            "lavfi",
+            "-i",
+            "sine=frequency=440:duration=1",
+            "-c:v",
+            "mpeg4",
+            "-c:a",
+            "aac",
+            "-shortest",
+        ])
+        .arg(&path)
+        .output()
+        .expect("ffmpeg must be on PATH");
+    assert!(
+        output.status.success(),
+        "ffmpeg failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let bytes = std::fs::read(&path).unwrap();
+    assert!(has_audio_stream(&path), "the fixture must carry sound");
+    bytes
+}
+
+fn has_audio_stream(path: &std::path::Path) -> bool {
+    let output = std::process::Command::new("ffprobe")
+        .args([
+            "-v",
+            "error",
+            "-select_streams",
+            "a",
+            "-show_entries",
+            "stream=codec_type",
+            "-of",
+            "csv=p=0",
+        ])
+        .arg(path)
+        .output()
+        .expect("ffprobe must be on PATH");
+    assert!(output.status.success());
+    !String::from_utf8_lossy(&output.stdout).trim().is_empty()
+}
diff --git a/tests/canvas/main.rs b/tests/canvas/main.rs
new file mode 100644
index 00000000..a2439fa5
--- /dev/null
+++ b/tests/canvas/main.rs
@@ -0,0 +1,162 @@
+//! The loop a member attaches to a track. RFC-009.
+//!
+//! No routes yet: this drives `DomainServices` directly, which is the whole of
+//! what the domain half of the canvas is. What the store does with bytes, what
+//! it charges for them, and what it refuses are decided here rather than at the
+//! surface, so they are tested here.
+
+use axum::body::Body;
+use axum::http::Request;
+use axum::http::StatusCode;
+use tower::ServiceExt;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
+use waveflow_server::config::CanvasLimits;
+use waveflow_server::storage::catalog::LibraryRecord;
+use waveflow_server::storage::database::AccountRole;
+use waveflow_server::storage::database::LibraryVisibility;
+
+// Not every target uses every fixture, and a shared module is not dead
+// code for being partly unused here.
+#[allow(dead_code)]
+#[path = "../support/mod.rs"]
+mod support;
+use support::*;
+
+/// An app whose canvas limits this test chose.
+///
+/// Tuned before `initialize`, never after: `DomainServices` copies these values
+/// out of `Config` when it is built, so a test that raises a ceiling on the
+/// returned `Config` silently exercises the old one.
+async fn canvas_app(
+    tune: impl FnOnce(&mut CanvasLimits),
+) -> (
+    tempfile::TempDir,
+    waveflow_server::Config,
+    waveflow_server::AppState,
+) {
+    let temp = tempfile::tempdir().unwrap();
+    let mut config = waveflow_server::Config::for_data_dir(temp.path().join("data"));
+    tune(&mut config.canvas);
+    let state = waveflow_server::initialize(&config).await.unwrap();
+    (temp, config, state)
+}
+
+struct Fixture {
+    owner: uuid::Uuid,
+    library: uuid::Uuid,
+    tracks: Vec<uuid::Uuid>,
+    token: String,
+}
+
+/// An owner, an open library, and `count` scanned tracks in it.
+async fn fixture(
+    config: &waveflow_server::Config,
+    state: &waveflow_server::AppState,
+    name: &str,
+    count: usize,
+) -> Fixture {
+    let hash = security::hash_password("correct horse battery staple").unwrap();
+    let owner = state
+        .db
+        .create_account(name, &hash, AccountRole::Admin, now_ms())
+        .await
+        .unwrap();
+    let music = config.data_dir.join(name);
+    std::fs::create_dir_all(&music).unwrap();
+    for index in 0..count {
+        write_test_wav(&music.join(format!("Track {index}.wav")));
+    }
+    let root = std::fs::canonicalize(&music).unwrap();
+    let library = state
+        .db
+        .create_library(owner, name, &root, LibraryVisibility::Private, now_ms())
+        .await
+        .unwrap();
+    run_scan(
+        state,
+        owner,
+        LibraryRecord {
+            id: library,
+            name: name.into(),
+            root_path: root,
+        },
+    )
+    .await;
+    // A canvas spends the operator's disk, so it follows the deposit rules: a
+    // server that was merely upgraded must not have become one. Its own flag,
+    // not the upload one — the fixture leaves `accepts_uploads` off precisely
+    // so that every test here runs on a library that takes no audio.
+    state
+        .db
+        .set_library_accepts_canvas(owner, library, true, now_ms())
+        .await
+        .unwrap();
+    let mut tracks: Vec<uuid::Uuid> = state
+        .db
+        .list_tracks_for_user(owner, library)
+        .await
+        .unwrap()
+        .into_iter()
+        .map(|track| track.id)
+        .collect();
+    tracks.sort();
+    assert_eq!(tracks.len(), count);
+    let token = login_token(
+        &waveflow_server::app(config, state.clone()),
+        name,
+        "correct horse battery staple",
+    )
+    .await;
+    Fixture {
+        owner,
+        library,
+        tracks,
+        token,
+    }
+}
+
+/// A real container, because the server reads the bytes rather than the name.
+///
+/// `mpeg4` rather than `libx264` or `libvpx`: it is built into FFmpeg itself,
+/// so this fixture does not depend on which encoders a machine happens to ship.
+fn canvas_bytes(dir: &std::path::Path, name: &str, seconds: &str, colour: &str) -> Vec<u8> {
+    let path = dir.join(name);
+    let output = std::process::Command::new("ffmpeg")
+        .args([
+            "-hide_banner",
+            "-loglevel",
+            "error",
+            "-y",
+            "-f",
+            "lavfi",
+            "-i",
+            &format!("color=c={colour}:s=64x64:r=10:d={seconds}"),
+            "-c:v",
+            "mpeg4",
+        ])
+        .arg(&path)
+        .output()
+        .expect("ffmpeg must be on PATH");
+    assert!(
+        output.status.success(),
+        "ffmpeg failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    std::fs::read(&path).unwrap()
+}
+
+fn stored_files(config: &waveflow_server::Config) -> Vec<String> {
+    let Ok(entries) = std::fs::read_dir(&config.canvas_dir) else {
+        return Vec::new();
+    };
+    let mut names: Vec<String> = entries
+        .map(|entry| entry.unwrap().file_name().to_string_lossy().into_owned())
+        .collect();
+    names.sort();
+    names
+}
+
+mod ingest;
+mod routes;
+mod sweep;
diff --git a/tests/canvas/routes.rs b/tests/canvas/routes.rs
new file mode 100644
index 00000000..8e731d97
--- /dev/null
+++ b/tests/canvas/routes.rs
@@ -0,0 +1,650 @@
+//! A canvas over HTTP: placed, read back and taken away, the ticket that opens
+//! it, the route's ceiling, the track upsert that carries it, and who sees
+//! nothing.
+
+use super::*;
+
+// ---------------------------------------------------------------------------
+// The surfaces. RFC-009 decisions 3 and 4.
+// ---------------------------------------------------------------------------
+
+fn authorized(request: axum::http::request::Builder, token: &str) -> axum::http::request::Builder {
+    request.header("authorization", format!("Bearer {token}"))
+}
+
+#[tokio::test]
+async fn a_canvas_is_placed_read_back_and_taken_away_over_http() {
+    let (temp, config, state) = canvas_app(|_| {}).await;
+    let fixture = fixture(&config, &state, "canvas-routes", 1).await;
+    let router = waveflow_server::app(&config, state.clone());
+    let bytes = canvas_bytes(temp.path(), "loop.mp4", "1", "black");
+    let track = fixture.tracks[0];
+
+    let placed = router
+        .clone()
+        .oneshot(
+            authorized(
+                Request::put(format!("/api/v2/tracks/{track}/canvas")),
+                &fixture.token,
+            )
+            .body(Body::from(bytes.clone()))
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(placed.status(), StatusCode::OK);
+    let placed = json_body(placed).await;
+    assert_eq!(placed["format"], "mp4");
+    assert_eq!(placed["byte_size"], bytes.len() as i64);
+    let hash = placed["hash"].as_str().unwrap().to_owned();
+    assert_eq!(placed["url"], format!("/api/v2/canvas/{hash}"));
+
+    // Addressed by content: this URL can never answer differently, so the
+    // client is told to stop asking.
+    let by_hash = router
+        .clone()
+        .oneshot(
+            authorized(
+                Request::get(format!("/api/v2/canvas/{hash}")),
+                &fixture.token,
+            )
+            .body(Body::empty())
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(by_hash.status(), StatusCode::OK);
+    assert_eq!(by_hash.headers()["content-type"], "video/mp4");
+    assert_eq!(
+        by_hash.headers()["cache-control"],
+        "private, max-age=31536000, immutable"
+    );
+    let etag = by_hash.headers()["etag"].to_str().unwrap().to_owned();
+    assert_eq!(etag, format!("\"{hash}\""));
+
+    // Addressed by track: it resolves the link of the moment, which a member
+    // can replace, so it stays revalidatable.
+    let alias = router
+        .clone()
+        .oneshot(
+            authorized(
+                Request::get(format!("/api/v2/tracks/{track}/canvas")),
+                &fixture.token,
+            )
+            .body(Body::empty())
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(alias.status(), StatusCode::OK);
+    assert_eq!(alias.headers()["cache-control"], "private, no-cache");
+    // The validator is the hash either way, which is what makes revalidating
+    // the alias a 304 rather than a second transfer of the same bytes.
+    assert_eq!(alias.headers()["etag"], etag);
+
+    // Revalidation on both shapes. The alias is the one that has to answer 304
+    // — it is the URL a client keeps asking about — but the canonical one must
+    // too, or a client that does ask pays for the bytes twice.
+    for path in [
+        format!("/api/v2/tracks/{track}/canvas"),
+        format!("/api/v2/canvas/{hash}"),
+    ] {
+        let revalidated = router
+            .clone()
+            .oneshot(
+                authorized(Request::get(&path), &fixture.token)
+                    .header("if-none-match", &etag)
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(revalidated.status(), StatusCode::NOT_MODIFIED, "{path}");
+        // The validator comes back with the 304, so the entry stays fresh
+        // rather than being evicted for having lost its tag.
+        assert_eq!(revalidated.headers()["etag"], etag, "{path}");
+    }
+
+    // A <video> element asks for ranges, and it asks the ticket URL. All three
+    // ways in serve the same file through the same helper, so all three answer
+    // 206 and carry the validator on the partial too.
+    let ticket = json_body(
+        router
+            .clone()
+            .oneshot(
+                authorized(
+                    Request::post(format!("/api/v2/tracks/{track}/canvas-ticket")),
+                    &fixture.token,
+                )
+                .body(Body::empty())
+                .unwrap(),
+            )
+            .await
+            .unwrap(),
+    )
+    .await["url"]
+        .as_str()
+        .unwrap()
+        .to_owned();
+    for (path, bearer) in [
+        (format!("/api/v2/canvas/{hash}"), true),
+        (format!("/api/v2/tracks/{track}/canvas"), true),
+        // No Authorization header at all: the sealed ticket is the credential.
+        (ticket, false),
+    ] {
+        let request = Request::get(&path);
+        let request = if bearer {
+            authorized(request, &fixture.token)
+        } else {
+            request
+        };
+        let ranged = router
+            .clone()
+            .oneshot(
+                request
+                    .header("range", "bytes=0-15")
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(ranged.status(), StatusCode::PARTIAL_CONTENT, "{path}");
+        assert_eq!(ranged.headers()["etag"], etag, "{path}");
+        assert_eq!(ranged.headers()["content-length"], "16", "{path}");
+    }
+
+    let removed = router
+        .clone()
+        .oneshot(
+            authorized(
+                Request::delete(format!("/api/v2/tracks/{track}/canvas")),
+                &fixture.token,
+            )
+            .body(Body::empty())
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(removed.status(), StatusCode::NO_CONTENT);
+
+    for gone in [
+        format!("/api/v2/tracks/{track}/canvas"),
+        format!("/api/v2/canvas/{hash}"),
+    ] {
+        let response = router
+            .clone()
+            .oneshot(
+                authorized(Request::get(&gone), &fixture.token)
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::NOT_FOUND, "{gone}");
+    }
+}
+
+#[tokio::test]
+async fn a_ticket_opens_the_canvas_it_was_minted_for_and_nothing_else() {
+    let (temp, config, state) = canvas_app(|_| {}).await;
+    let fixture = fixture(&config, &state, "canvas-ticket", 1).await;
+    let router = waveflow_server::app(&config, state.clone());
+    let track = fixture.tracks[0];
+    state
+        .services
+        .place_canvas(
+            fixture.owner,
+            track,
+            &canvas_bytes(temp.path(), "loop.mp4", "1", "black"),
+            None,
+        )
+        .await
+        .unwrap();
+
+    let minted = router
+        .clone()
+        .oneshot(
+            authorized(
+                Request::post(format!("/api/v2/tracks/{track}/canvas-ticket")),
+                &fixture.token,
+            )
+            .body(Body::empty())
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(minted.status(), StatusCode::OK);
+    let url = json_body(minted).await["url"].as_str().unwrap().to_owned();
+    assert!(url.starts_with("/api/v2/canvas-stream/"));
+
+    // What <video src> does: no Authorization header at all.
+    let played = router
+        .clone()
+        .oneshot(Request::get(&url).body(Body::empty()).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(played.status(), StatusCode::OK);
+    assert_eq!(played.headers()["content-type"], "video/mp4");
+
+    // The two kinds do not answer for each other, which is the whole reason the
+    // kind is sealed inside the payload. An audio ticket for this very track,
+    // minted for this very account and unexpired, does not open the canvas.
+    let audio = waveflow_server::auth::stream_ticket::mint(
+        &state.secret_box,
+        waveflow_server::auth::stream_ticket::TicketKind::Audio,
+        fixture.owner,
+        track,
+        now_ms() + 60_000,
+    )
+    .unwrap();
+    let refused = router
+        .clone()
+        .oneshot(
+            Request::get(format!("/api/v2/canvas-stream/{audio}"))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(refused.status(), StatusCode::NOT_FOUND);
+
+    // And the reverse: the canvas ticket does not open the audio route.
+    let canvas_ticket = url.rsplit('/').next().unwrap();
+    let refused = router
+        .clone()
+        .oneshot(
+            Request::get(format!("/api/v2/stream/{canvas_ticket}"))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(refused.status(), StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn the_route_carries_its_own_ceiling_and_the_neighbour_sees_nothing() {
+    let (temp, config, state) = canvas_app(|canvas| {
+        canvas.max_bytes = 4096;
+        canvas.library_quota_bytes = 1024 * 1024;
+    })
+    .await;
+    let owner = fixture(&config, &state, "canvas-ceiling-http", 1).await;
+    let router = waveflow_server::app(&config, state.clone());
+    let track = owner.tracks[0];
+
+    // Over the route's own ceiling. The router's global 16 KiB limit would have
+    // let this through, so what refuses it is the limit this route carries.
+    let oversized = router
+        .clone()
+        .oneshot(
+            authorized(
+                Request::put(format!("/api/v2/tracks/{track}/canvas")),
+                &owner.token,
+            )
+            .body(Body::from(vec![0u8; 8192]))
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(oversized.status(), StatusCode::PAYLOAD_TOO_LARGE);
+
+    // Under the ceiling and still not a loop: the request was well formed, and
+    // what it carried is not something this server will keep.
+    let garbage = router
+        .clone()
+        .oneshot(
+            authorized(
+                Request::put(format!("/api/v2/tracks/{track}/canvas")),
+                &owner.token,
+            )
+            .body(Body::from(vec![7u8; 2048]))
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(garbage.status(), StatusCode::UNPROCESSABLE_ENTITY);
+
+    // A real one, so the neighbour has something to fail to see.
+    let (_temp2, config2, state2) = canvas_app(|_| {}).await;
+    let roomy = fixture(&config2, &state2, "canvas-roomy", 1).await;
+    let router2 = waveflow_server::app(&config2, state2.clone());
+    let placed = state2
+        .services
+        .place_canvas(
+            roomy.owner,
+            roomy.tracks[0],
+            &canvas_bytes(temp.path(), "loop.mp4", "1", "black"),
+            None,
+        )
+        .await
+        .unwrap();
+    let neighbour = fixture(&config2, &state2, "canvas-neighbour-2", 1).await;
+
+    // Knowing the hash establishes nothing, and neither does knowing the track.
+    for path in [
+        format!("/api/v2/canvas/{}", placed.hash),
+        format!("/api/v2/tracks/{}/canvas", roomy.tracks[0]),
+    ] {
+        let response = router2
+            .clone()
+            .oneshot(
+                authorized(Request::get(&path), &neighbour.token)
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::NOT_FOUND, "{path}");
+    }
+    // And they cannot put one on somebody else's track either.
+    let intruding = router2
+        .clone()
+        .oneshot(
+            authorized(
+                Request::put(format!("/api/v2/tracks/{}/canvas", roomy.tracks[0])),
+                &neighbour.token,
+            )
+            .body(Body::from(vec![7u8; 512]))
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(intruding.status(), StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn placing_and_removing_a_canvas_travels_in_the_track_upsert() {
+    let (temp, config, state) = canvas_app(|_| {}).await;
+    let fixture = fixture(&config, &state, "canvas-feed", 1).await;
+    let router = waveflow_server::app(&config, state.clone());
+    let (token, device) =
+        login_session(&router, "canvas-feed", "correct horse battery staple").await;
+    let track = fixture.tracks[0];
+    let library = fixture.library;
+
+    // Where the feed already stood, so what follows is what this test caused
+    // rather than what the scan left behind.
+    let before = library_events(&router, &token, library).await.len();
+
+    let placed = router
+        .clone()
+        .oneshot(
+            authorized(
+                Request::put(format!("/api/v2/tracks/{track}/canvas")),
+                &token,
+            )
+            .header("x-waveflow-device-id", &device)
+            .body(Body::from(canvas_bytes(
+                temp.path(),
+                "loop.mp4",
+                "1",
+                "black",
+            )))
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(placed.status(), StatusCode::OK);
+
+    let events = library_events(&router, &token, library).await;
+    assert_eq!(events.len(), before + 1, "one event, and only one");
+    let event = events.last().unwrap();
+    // RFC-009 decision 7: no event for the blob, because the bytes behind a
+    // hash never change. Only the link is a change, and the link is part of the
+    // track — so it travels in the track's own upsert.
+    assert_eq!(event["entity_type"], "track");
+    assert_eq!(event["action"], "upsert");
+    assert_eq!(event["entity_id"], track.to_string());
+    // And the payload does not grow. `full_hash` is there because nothing else
+    // carries it; a canvas link is read off the track the client refetches.
+    assert!(
+        event["payload"]["full_hash"].is_string(),
+        "the payload is the one a tag correction sends"
+    );
+    assert!(
+        event["payload"].get("canvas").is_none(),
+        "no canvas field: that would make the payload a partial projection"
+    );
+    // So the client that just placed it does not read it back as a discovery.
+    assert_eq!(event["origin_device_id"], device);
+
+    // Taking it away is a change too, and it is the same shape.
+    let removed = router
+        .clone()
+        .oneshot(
+            authorized(
+                Request::delete(format!("/api/v2/tracks/{track}/canvas")),
+                &token,
+            )
+            .header("x-waveflow-device-id", &device)
+            .body(Body::empty())
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(removed.status(), StatusCode::NO_CONTENT);
+    let events = library_events(&router, &token, library).await;
+    assert_eq!(events.len(), before + 2);
+    assert_eq!(events.last().unwrap()["action"], "upsert");
+
+    // A removal that found nothing changed nothing, and says nothing.
+    let again = router
+        .clone()
+        .oneshot(
+            authorized(
+                Request::delete(format!("/api/v2/tracks/{track}/canvas")),
+                &token,
+            )
+            .body(Body::empty())
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(again.status(), StatusCode::NOT_FOUND);
+    assert_eq!(
+        library_events(&router, &token, library).await.len(),
+        before + 2,
+        "nothing happened, so nothing was announced"
+    );
+}
+
+async fn library_events(
+    router: &axum::Router,
+    token: &str,
+    library: uuid::Uuid,
+) -> Vec<serde_json::Value> {
+    let feed = router
+        .clone()
+        .oneshot(
+            authorized(
+                Request::get(format!(
+                    "/api/v2/libraries/{library}/events?after=0&limit=500"
+                )),
+                token,
+            )
+            .body(Body::empty())
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(feed.status(), StatusCode::OK);
+    json_body(feed).await["events"]
+        .as_array()
+        .expect("the feed answers a list")
+        .clone()
+}
+
+#[tokio::test]
+async fn the_two_doors_are_independent_in_both_directions() {
+    let (temp, config, state) = canvas_app(|_| {}).await;
+    let fixture = fixture(&config, &state, "canvas-doors", 1).await;
+    let bytes = canvas_bytes(temp.path(), "loop.mp4", "1", "black");
+    let track = fixture.tracks[0];
+
+    // The case that made this a separate flag. `fixture` opened the canvas door
+    // and left the upload one shut, which is the read-only server the desktop
+    // named: it refuses to grow in audio and still takes a loop.
+    // Stated rather than inherited from the fixture, so the situation this test
+    // is about is visible in the test.
+    state
+        .db
+        .set_library_accepts_uploads(fixture.owner, fixture.library, false, now_ms())
+        .await
+        .unwrap();
+    state
+        .services
+        .place_canvas(fixture.owner, track, &bytes, None)
+        .await
+        .unwrap();
+
+    // And the reverse: opening the library to files says nothing about loops.
+    // A flag inherited from the other would be the operator opting into
+    // something he never named.
+    state
+        .services
+        .remove_canvas(fixture.owner, track, None)
+        .await
+        .unwrap();
+    state
+        .db
+        .set_library_accepts_canvas(fixture.owner, fixture.library, false, now_ms())
+        .await
+        .unwrap();
+    state
+        .db
+        .set_library_accepts_uploads(fixture.owner, fixture.library, true, now_ms())
+        .await
+        .unwrap();
+    assert!(matches!(
+        state
+            .services
+            .place_canvas(fixture.owner, track, &bytes, None)
+            .await,
+        Err(waveflow_server::services::ServiceError::Forbidden)
+    ));
+}
+
+/// Whether a library takes canvases is on the list of libraries, apart from
+/// whether it takes files, and it follows the operator's switch.
+///
+/// Two doors, and the list has to show both. A client that could read only
+/// `accepts_uploads` would hide the canvas in exactly the library RFC-009 split
+/// the flag for — one that refuses audio and takes loops — and a client that
+/// could read neither would offer a canvas everywhere, to learn the answer only
+/// after sending the whole file.
+#[tokio::test]
+async fn the_library_list_says_whether_a_library_takes_canvases() {
+    let (_temp, config, state) = canvas_app(|_| {}).await;
+    let fixture = fixture(&config, &state, "canvas-flag-reader", 1).await;
+    let listed = || {
+        let router = waveflow_server::app(&config, state.clone());
+        let token = fixture.token.clone();
+        async move {
+            let response = router
+                .oneshot(
+                    Request::builder()
+                        .uri("/api/v2/libraries")
+                        .header("authorization", format!("Bearer {token}"))
+                        .body(Body::empty())
+                        .unwrap(),
+                )
+                .await
+                .unwrap();
+            assert_eq!(response.status(), StatusCode::OK);
+            json_body(response).await
+        }
+    };
+
+    let open = listed().await;
+    assert_eq!(open[0]["accepts_canvas"], true, "the fixture opened it");
+    assert_eq!(
+        open[0]["accepts_uploads"], false,
+        "and left the other door shut, which the list must not confuse with it"
+    );
+    state
+        .db
+        .set_library_accepts_canvas(fixture.owner, fixture.library, false, now_ms())
+        .await
+        .unwrap();
+    assert_eq!(listed().await[0]["accepts_canvas"], false);
+}
+
+/// RFC-023 decision 4: a canvas ticket minted before its account was disabled
+/// stops opening the canvas, as an audio ticket stops playing. The ticket is
+/// sealed rather than looked up, so the redemption's own read is what asks.
+#[tokio::test]
+async fn a_disabled_account_s_canvas_ticket_opens_nothing() {
+    let (temp, config, state) = canvas_app(|_| {}).await;
+    let (owner, _token) = admin_with_api_token(&state, "canvas-disabled").await;
+    let music = config.data_dir.join("canvas-disabled");
+    std::fs::create_dir_all(&music).unwrap();
+    write_test_wav(&music.join("Looped.wav"));
+    let root = std::fs::canonicalize(&music).unwrap();
+    let library = state
+        .db
+        .create_library(
+            owner,
+            "canvas-disabled",
+            &root,
+            LibraryVisibility::Private,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    run_scan(
+        &state,
+        owner,
+        LibraryRecord {
+            id: library,
+            name: "canvas-disabled".into(),
+            root_path: root,
+        },
+    )
+    .await;
+    state
+        .db
+        .set_library_accepts_canvas(owner, library, true, now_ms())
+        .await
+        .unwrap();
+    let track = state.db.list_tracks_for_user(owner, library).await.unwrap()[0].id;
+    state
+        .services
+        .place_canvas(
+            owner,
+            track,
+            &canvas_bytes(temp.path(), "loop.mp4", "1", "black"),
+            None,
+        )
+        .await
+        .unwrap();
+    let ticket = waveflow_server::auth::stream_ticket::mint(
+        &state.secret_box,
+        waveflow_server::auth::stream_ticket::TicketKind::Canvas,
+        owner,
+        track,
+        now_ms() + 60_000,
+    )
+    .unwrap();
+    let router = waveflow_server::app(&config, state.clone());
+    let open = || {
+        let router = router.clone();
+        let ticket = ticket.clone();
+        async move {
+            router
+                .oneshot(
+                    Request::get(format!("/api/v2/canvas-stream/{ticket}"))
+                        .body(Body::empty())
+                        .unwrap(),
+                )
+                .await
+                .unwrap()
+                .status()
+        }
+    };
+    assert_eq!(open().await, StatusCode::OK);
+    set_disabled(&state, owner, true).await;
+    assert_eq!(open().await, StatusCode::NOT_FOUND);
+    set_disabled(&state, owner, false).await;
+    assert_eq!(open().await, StatusCode::OK);
+}
diff --git a/tests/canvas/sweep.rs b/tests/canvas/sweep.rs
new file mode 100644
index 00000000..72d3f987
--- /dev/null
+++ b/tests/canvas/sweep.rs
@@ -0,0 +1,106 @@
+//! The sweep: orphans collected, everything else left alone.
+
+use super::*;
+
+// ---------------------------------------------------------------------------
+// The store sweep. RFC-009 left it open; this is what it collects, and — more
+// to the point — what it refuses to touch.
+// ---------------------------------------------------------------------------
+
+#[tokio::test]
+async fn the_sweep_collects_orphans_and_leaves_everything_else_alone() {
+    let (temp, config, state) = canvas_app(|_| {}).await;
+    let library = fixture(&config, &state, "canvas-sweep", 1).await;
+    let placed = state
+        .services
+        .place_canvas(
+            library.owner,
+            library.tracks[0],
+            &canvas_bytes(temp.path(), "loop.mp4", "1", "black"),
+            None,
+        )
+        .await
+        .unwrap();
+
+    let store = &config.canvas_dir;
+    // Bytes no row names: what a crash between the commit and the unlink
+    // leaves, and what a placement that died before its row leaves.
+    let orphan = format!("{}.mp4", "a".repeat(64));
+    std::fs::write(store.join(&orphan), b"orphaned bytes").unwrap();
+    // A working file old enough that no request could still be holding it.
+    let stale = store.join(format!("{}.part", uuid::Uuid::new_v4()));
+    std::fs::write(&stale, b"abandoned").unwrap();
+    set_age(&stale, std::time::Duration::from_secs(2 * 60 * 60));
+    // And one that a request could: this is the placement running right now.
+    let fresh = store.join(format!("{}.silent", uuid::Uuid::new_v4()));
+    std::fs::write(&fresh, b"in flight").unwrap();
+    // Something the sweep did not write. The store sits under the operator's
+    // `data/`, and a sweep that deletes what it cannot name is one nobody
+    // should run.
+    std::fs::write(store.join("operator-notes.txt"), b"do not delete").unwrap();
+    // And the same thing wearing this module's extension. The stem is what
+    // says whose file it is: a working name has a UUID for a stem because
+    // `place_canvas` put one there, and `notes.part` is not that. Backdated so
+    // that only the stem stands between it and deletion.
+    let disguised = store.join("operator-notes.part");
+    std::fs::write(&disguised, b"do not delete either").unwrap();
+    set_age(&disguised, std::time::Duration::from_secs(2 * 60 * 60));
+
+    let swept = state.services.sweep_canvas_store().await.unwrap();
+    assert_eq!(swept.blobs_removed, 1, "the unreferenced blob goes");
+    assert_eq!(swept.staging_removed, 1, "the abandoned working file goes");
+    assert_eq!(
+        swept.unknown, 2,
+        "and the strangers are counted, not removed"
+    );
+    assert_eq!(swept.dead_links, 0);
+
+    let left = stored_files(&config);
+    assert!(left.contains(&placed.file_name()), "the live canvas stays");
+    for kept in ["operator-notes.txt", "operator-notes.part"] {
+        assert!(
+            left.contains(&kept.to_owned()),
+            "a file the sweep does not recognise is left exactly where it was: {kept}"
+        );
+    }
+    assert!(
+        left.iter().any(|name| name.ends_with(".silent")),
+        "a working file young enough to belong to a live request stays"
+    );
+    assert!(!left.contains(&orphan), "the orphan is gone");
+
+    // The canvas is still servable, which is the assertion that would catch a
+    // sweep that removed the wrong file.
+    assert_eq!(
+        state
+            .services
+            .canvas_for_track(library.owner, library.tracks[0])
+            .await
+            .unwrap(),
+        Some(placed.clone())
+    );
+
+    // The other direction is reported and never repaired: deleting the row
+    // would answer a dead link by making it a missing one.
+    std::fs::remove_file(config.canvas_dir.join(placed.file_name())).unwrap();
+    let swept = state.services.sweep_canvas_store().await.unwrap();
+    assert_eq!(swept.dead_links, 1);
+    assert_eq!(swept.blobs_removed, 0);
+    assert!(
+        state
+            .services
+            .canvas_for_track(library.owner, library.tracks[0])
+            .await
+            .unwrap()
+            .is_some(),
+        "the row is somebody's canvas and the sweep does not take it"
+    );
+}
+
+/// Backdates a file so the sweep sees it as abandoned without the test waiting
+/// an hour for it.
+fn set_age(path: &std::path::Path, age: std::time::Duration) {
+    let when = std::time::SystemTime::now() - age;
+    let file = std::fs::File::options().write(true).open(path).unwrap();
+    file.set_modified(when).unwrap();
+}
diff --git a/tests/catalog/credits.rs b/tests/catalog/credits.rs
index ede2832c..ff50eeb8 100644
--- a/tests/catalog/credits.rs
+++ b/tests/catalog/credits.rs
@@ -292,11 +292,11 @@ async fn a_contributor_is_not_one_of_the_track_artists() {
     input.is_compilation = false;
     input.roles = vec![
         (
-            waveflow_server::tags::Role::Producer,
+            waveflow_server::library::tags::Role::Producer,
             vec!["Rita Sound".into()],
         ),
         (
-            waveflow_server::tags::Role::Composer,
+            waveflow_server::library::tags::Role::Composer,
             vec!["Otto Pen".into()],
         ),
     ];
diff --git a/tests/catalog/main.rs b/tests/catalog/main.rs
index 9d2a686a..630990e4 100644
--- a/tests/catalog/main.rs
+++ b/tests/catalog/main.rs
@@ -6,11 +6,11 @@ use axum::body::Body;
 use axum::http::Request;
 use axum::http::StatusCode;
 use tower::ServiceExt;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::database::AccountRole;
-use waveflow_server::database::LibraryVisibility;
-use waveflow_server::security;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
 use waveflow_server::services::ServiceError;
+use waveflow_server::storage::database::AccountRole;
+use waveflow_server::storage::database::LibraryVisibility;
 
 // Not every target uses every fixture, and a shared module is not dead
 // code for being partly unused here.
diff --git a/tests/cli.rs b/tests/cli.rs
deleted file mode 100644
index a8c15d5f..00000000
--- a/tests/cli.rs
+++ /dev/null
@@ -1,1374 +0,0 @@
-//! The command line: what an operator can do on a host with no browser.
-//!
-//! Split out of `service.rs`, which names probes, the embedded client and the
-//! backup bundle and had quietly accumulated these as well. A test belongs to
-//! the surface it exercises, and this one is reached by argv and answered on
-//! two streams — not by a request.
-
-use clap::Parser;
-use waveflow_server::authentication::now_ms;
-
-// Not every target uses every fixture, and a shared module is not dead
-// code for being partly unused here.
-#[allow(dead_code)]
-mod support;
-use support::*;
-
-/// One command line, parsed the way a shell would hand it over.
-///
-/// Through `Cli::parse_from` rather than by building the argument struct: the
-/// fields are private, which is the hint, and this way the flag names and the
-/// defaults are part of what these tests hold still. A command surface gets
-/// those wrong far more easily than it gets the call wrong.
-async fn run_cli(state: &waveflow_server::AppState, argv: &[&str]) -> anyhow::Result<()> {
-    let mut full = vec!["waveflow-server"];
-    full.extend_from_slice(argv);
-    let cli = waveflow_server::cli::Cli::try_parse_from(full)?;
-    waveflow_server::cli::execute(cli.command.expect("a command was given"), state).await
-}
-
-/// An account inserted rather than created, with a placeholder where a hash
-/// would be.
-///
-/// These never authenticate: the CLI resolves them by username and checks a
-/// role, and nothing in this file logs in as one. Calling
-/// `security::hash_password` for them would add another occurrence of the
-/// repository's fixture password, which CodeQL raises as a hard-coded
-/// credential on every new one — there are already seventy-seven of those
-/// dismissed on `main`, and adding to that pile for accounts that cannot log in
-/// would be spending somebody else's attention.
-async fn inserted_account(
-    state: &waveflow_server::AppState,
-    username: &str,
-    role: &str,
-) -> uuid::Uuid {
-    let id = uuid::Uuid::new_v4();
-    let now = now_ms();
-    sqlx::query(
-        "INSERT INTO account (id, username, password_hash, role, disabled, created_at, updated_at) \
-         VALUES (?, ?, 'this-account-never-authenticates', ?, 0, ?, ?)",
-    )
-    .bind(id.to_string())
-    .bind(username)
-    .bind(role)
-    .bind(now)
-    .bind(now)
-    .execute(state.db.pool())
-    .await
-    .unwrap();
-    id
-}
-
-/// The binary, with nothing `WAVEFLOW_*` inherited from whoever ran the suite.
-///
-/// `Config::from_env` runs before anything else and verifies the FFmpeg paths
-/// it finds there, so one stray `WAVEFLOW_FFPROBE_PATH` on a developer's
-/// machine fails these commands before they reach a single assertion. A test
-/// that passes or fails on the environment of the person running it is
-/// measuring that, and not the code.
-///
-/// Not `env_clear`: on Windows that takes `SystemRoot` with it, and the process
-/// then cannot start at all. Only this server's own namespace is removed, and
-/// each caller puts back the variables its command actually needs.
-///
-/// Matched without regard to case, because Windows keeps the name as it was
-/// first spelled and resolves it case-insensitively: `set waveflow_ffprobe_path`
-/// stores that spelling, `std::env::var("WAVEFLOW_FFPROBE_PATH")` in the child
-/// still finds it, and an exact-case filter would walk straight past it. On Unix
-/// the two are different variables and only the upper one is ever read, so
-/// dropping the other costs nothing.
-fn cli_command() -> std::process::Command {
-    let mut command = std::process::Command::new(env!("CARGO_BIN_EXE_waveflow-server"));
-    for (name, _) in std::env::vars_os() {
-        if name
-            .to_string_lossy()
-            .to_ascii_uppercase()
-            .starts_with("WAVEFLOW_")
-        {
-            command.env_remove(name);
-        }
-    }
-    command
-}
-
-/// The CLI reads a queue and withdraws an authorisation, and says which
-/// variable it wanted when the token is not there.
-///
-/// **Named for what it does.** It was called `..._links_and_unlinks_...` while
-/// the link itself was posed through `DomainServices` — so it would have passed
-/// with `cli::link_scrobble` deleted, which is the defect class this file's
-/// commit set out to remove, reintroduced one file over.
-///
-/// What `link` *is* covered for: the admin check, the account lookup and the
-/// provider parse, all of which run before the secret is read, and which the
-/// absent-variable case below therefore traverses. What it is not covered for is
-/// the two lines after that — the successful `read_secret_env` and the service
-/// call. Driving those from here would need the process environment mutated
-/// while sibling threads read it, which is the race this test exists without.
-/// `a_minted_secret_leaves_on_standard_output_by_itself`, below, closes it with
-/// a subprocess against `CARGO_BIN_EXE_waveflow-server`, where an environment
-/// variable reaches the command without any sibling thread reading it.
-#[tokio::test]
-async fn the_cli_reads_a_queue_and_withdraws_an_authorisation() {
-    let (_temp, _config, state) = test_app().await;
-    inserted_account(&state, "cli-scrobble-admin", "admin").await;
-    let user = inserted_account(&state, "cli-scrobble-user", "user").await;
-
-    // **No `set_var` here, and that is the whole design of this test.** A review
-    // pointed out that a unique variable name solves collision and not the
-    // race: `cargo test` runs these as threads in one process, and mutating the
-    // environment while a sibling thread reads it — `tempfile::tempdir()` reads
-    // `TMPDIR` on every one of them — is undefined behaviour, which is why
-    // edition 2024 made `set_var` unsafe. So `link` is exercised at the one
-    // seam that needs no environment at all: a variable that is *absent*, which
-    // is the default state of the process.
-    let missing = run_cli(
-        &state,
-        &[
-            "scrobble",
-            "link",
-            "--actor",
-            "cli-scrobble-admin",
-            "--username",
-            "cli-scrobble-user",
-            "--provider",
-            "listenbrainz",
-            "--destination",
-            "default",
-            "--token-env",
-            "WAVEFLOW_TEST_TOKEN_THAT_IS_NEVER_SET",
-        ],
-    )
-    .await
-    .unwrap_err();
-    // Naming the variable is the whole job of that message: the person who has
-    // to fix this cannot see which one the command looked for.
-    assert!(
-        missing
-            .to_string()
-            .contains("WAVEFLOW_TEST_TOKEN_THAT_IS_NEVER_SET"),
-        "{missing}"
-    );
-
-    // And the flag surface is pinned by parsing rather than by running, so the
-    // names and the default are held still without the process being touched.
-    let parsed = format!(
-        "{:?}",
-        waveflow_server::cli::Cli::try_parse_from([
-            "waveflow-server",
-            "scrobble",
-            "link",
-            "--actor",
-            "a",
-            "--username",
-            "b",
-            "--provider",
-            "listenbrainz",
-            "--destination",
-            "default",
-        ])
-        .expect("the scrobble link flags have to parse — that is what this pins")
-        .command
-        .unwrap()
-    );
-    assert!(parsed.contains("WAVEFLOW_SCROBBLE_TOKEN"), "{parsed}");
-
-    // The link itself is posed through the service, which is what the command
-    // calls anyway — the assertions below then read it back the same way.
-    state
-        .services
-        .link_scrobble(
-            user,
-            waveflow_server::services::ScrobbleProvider::ListenBrainz,
-            "default",
-            "lb-token-from-the-shell",
-        )
-        .await
-        .unwrap();
-
-    let links = state.services.scrobble_links(user).await.unwrap();
-    assert_eq!(links.len(), 1);
-    assert_eq!(links[0].provider.as_str(), "listenbrainz");
-    assert_eq!(links[0].health, "healthy");
-
-    // Reading the queue is a third gesture and must not need the secret.
-    run_cli(
-        &state,
-        &[
-            "scrobble",
-            "status",
-            "--actor",
-            "cli-scrobble-admin",
-            "--username",
-            "cli-scrobble-user",
-        ],
-    )
-    .await
-    .unwrap();
-
-    run_cli(
-        &state,
-        &[
-            "scrobble",
-            "unlink",
-            "--actor",
-            "cli-scrobble-admin",
-            "--username",
-            "cli-scrobble-user",
-            "--provider",
-            "listenbrainz",
-            "--destination",
-            "default",
-        ],
-    )
-    .await
-    .unwrap();
-    assert!(state
-        .services
-        .scrobble_links(user)
-        .await
-        .unwrap()
-        .is_empty());
-}
-
-/// What the command refuses, and who it refuses.
-///
-/// Both failures happen before any secret is read or sealed, which is the point
-/// of checking them: a destination this server cannot name and an actor who is
-/// not an administrator are both answered by the command rather than by the
-/// database refusing a `CHECK` afterwards.
-#[tokio::test]
-async fn the_cli_refuses_an_unknown_destination_and_a_non_administrator() {
-    let (_temp, _config, state) = test_app().await;
-    inserted_account(&state, "cli-refusing-admin", "admin").await;
-    inserted_account(&state, "cli-refusing-user", "user").await;
-
-    let unknown = run_cli(
-        &state,
-        &[
-            "scrobble",
-            "unlink",
-            "--actor",
-            "cli-refusing-admin",
-            "--username",
-            "cli-refusing-user",
-            "--provider",
-            "spotify",
-            "--destination",
-            "default",
-        ],
-    )
-    .await
-    .unwrap_err();
-    // The message names the three this server knows, because the person who
-    // typed the fourth cannot be expected to guess them.
-    let said = unknown.to_string();
-    assert!(said.contains("listenbrainz"), "{said}");
-    assert!(said.contains("maloja"), "{said}");
-    assert!(said.contains("lastfm"), "{said}");
-
-    // An ordinary account cannot pose an authorisation for somebody else, which
-    // is the whole difference between this surface and the self-scoped route.
-    let forbidden = run_cli(
-        &state,
-        &[
-            "scrobble",
-            "status",
-            "--actor",
-            "cli-refusing-user",
-            "--username",
-            "cli-refusing-user",
-        ],
-    )
-    .await
-    .unwrap_err();
-    assert!(
-        forbidden.to_string().contains("administrator"),
-        "{forbidden}"
-    );
-
-    // **Admin before secret, and nothing else pins it.** `link` checks the
-    // admin, resolves the account, parses the provider, and only then reads the
-    // secret. The absent-variable case above traverses all four but asserts
-    // about the last, so hoisting `read_secret_env` to the top of
-    // `link_scrobble` would leave every CLI test green. This is what notices.
-    //
-    // It pins that one edge and not the whole order: moving the read between
-    // the admin check and the account lookup still fails the admin first, and
-    // this would stay green. Said plainly rather than claimed wider.
-    let too_early = run_cli(
-        &state,
-        &[
-            "scrobble",
-            "link",
-            "--actor",
-            "cli-refusing-user",
-            "--username",
-            "cli-refusing-user",
-            "--provider",
-            "listenbrainz",
-            "--destination",
-            "default",
-            "--token-env",
-            "WAVEFLOW_TEST_TOKEN_THAT_IS_NEVER_SET",
-        ],
-    )
-    .await
-    .unwrap_err();
-    let said = too_early.to_string();
-    assert!(said.contains("administrator"), "{said}");
-    assert!(
-        !said.contains("WAVEFLOW_TEST_TOKEN_THAT_IS_NEVER_SET"),
-        "the token lookup must not have happened yet"
-    );
-}
-
-/// Every secret the CLI mints goes to standard output alone, prose elsewhere.
-///
-/// Through a subprocess because that is the only place the two streams are
-/// separable: `cli::execute` called in-process writes both into the test
-/// harness's own output, where nothing can tell them apart. This is the gap
-/// `the_cli_reads_a_queue_and_withdraws_an_authorisation` names and leaves open.
-///
-/// What it buys is not tidiness. `token create … > secret` now yields a file
-/// holding the token and nothing else, so the one copy of a freshly minted
-/// secret need never be lifted out of a terminal that keeps its scrollback.
-#[tokio::test]
-async fn a_minted_secret_leaves_on_standard_output_by_itself() {
-    let (temp, config, state) = test_app().await;
-    inserted_account(&state, "stream-split-admin", "admin").await;
-    inserted_account(&state, "stream-split-user", "user").await;
-    // Closed before the subprocess opens the same database: one writer at a
-    // time is this server's rule between threads, and it is no weaker between
-    // processes.
-    state.db.pool().close().await;
-
-    let run = cli_command()
-        .current_dir(temp.path())
-        .env("WAVEFLOW_DATA_DIR", &config.data_dir)
-        .args([
-            "token",
-            "create",
-            "--actor",
-            "stream-split-admin",
-            "--username",
-            "stream-split-user",
-            "--name",
-            "a name for the listing",
-            "--scopes",
-            "library:read",
-        ])
-        .output()
-        .unwrap();
-    let stdout = String::from_utf8(run.stdout).unwrap();
-    let stderr = String::from_utf8(run.stderr).unwrap();
-    assert!(
-        run.status.success(),
-        "minting a token failed; its diagnostics were: {stderr}"
-    );
-    // One line, and that line is the token. Counted before trimming: trimming
-    // first would fold `token\n\n` into `token` and call it one line, and a
-    // blank line after a secret is exactly the kind of stray output this is
-    // here to notice.
-    let lines: Vec<&str> = stdout.lines().collect();
-    assert_eq!(
-        lines.len(),
-        1,
-        "standard output should hold one line, and held: {lines:?}"
-    );
-    let token = lines[0];
-    assert!(
-        token.starts_with("wfapi_"),
-        "standard output should hold the token itself, not a sentence about it"
-    );
-
-    // The prose is on the other stream, and — the point of the whole change —
-    // the secret is not repeated there. A split that announced the token on
-    // both streams would pass every assertion above and protect nobody.
-    assert!(
-        stderr.contains("stream-split-user"),
-        "the human-readable half should say whose token this is"
-    );
-    assert!(
-        !stderr.contains(token),
-        "standard error must not repeat the secret"
-    );
-
-    // The other site that mints a secret, split the same way — and reached
-    // through the same subprocess, which is also what lets the password arrive
-    // in an environment variable without racing the sibling threads that read
-    // the process environment in-process.
-    let run = cli_command()
-        .current_dir(temp.path())
-        .env("WAVEFLOW_DATA_DIR", &config.data_dir)
-        .env("WAVEFLOW_SUBSONIC_PASSWORD", "a long enough password")
-        .args([
-            "credential",
-            "set",
-            "--actor",
-            "stream-split-admin",
-            "--username",
-            "stream-split-user",
-        ])
-        .output()
-        .unwrap();
-    let stdout = String::from_utf8(run.stdout).unwrap();
-    let stderr = String::from_utf8(run.stderr).unwrap();
-    assert!(
-        run.status.success(),
-        "setting a credential failed; its diagnostics were: {stderr}"
-    );
-    let lines: Vec<&str> = stdout.lines().collect();
-    assert_eq!(
-        lines.len(),
-        1,
-        "standard output should hold one line, and held: {lines:?}"
-    );
-    let api_key = lines[0];
-    assert!(
-        api_key.starts_with("wfsk_"),
-        "standard output should hold the API key and nothing else"
-    );
-    assert!(
-        !stderr.contains(api_key),
-        "standard error must not repeat the API key"
-    );
-    // The password it was handed is a secret too, and nothing prints it.
-    assert!(
-        !stderr.contains("a long enough password") && !stdout.contains("a long enough password"),
-        "neither stream may echo the password it was given"
-    );
-}
-
-/// A double for the half of the Last.fm protocol that would leave this machine.
-///
-/// Small and local rather than shared with `tests/scrobbling/lastfm_journey.rs`: what this
-/// file needs is an exchange that exists, and a token it can recognise coming
-/// back out.
-struct Approves;
-
-impl waveflow_server::services::LastFmSessionExchange for Approves {
-    fn exchange<'a>(
-        &'a self,
-        token: &'a str,
-    ) -> futures_util::future::BoxFuture<'a, Result<String, waveflow_server::services::ServiceError>>
-    {
-        Box::pin(async move { Ok(format!("session-for-{token}")) })
-    }
-
-    fn request_token<'a>(
-        &'a self,
-    ) -> futures_util::future::BoxFuture<
-        'a,
-        Result<waveflow_server::services::LastFmApproval, waveflow_server::services::ServiceError>,
-    > {
-        Box::pin(async move {
-            Ok(waveflow_server::services::LastFmApproval {
-                authorize_url: "https://www.last.fm/api/auth/?api_key=k&token=t".to_owned(),
-                token: "t".to_owned(),
-            })
-        })
-    }
-}
-
-/// Last.fm, from a host with no browser on it — which is this file's premise.
-///
-/// `link` cannot serve here: Last.fm hands out no secret a person can paste,
-/// so the two commands split where the person has to leave and come back.
-/// `authorize` writes nothing down — the request token is Last.fm's, and it
-/// expires on Last.fm's clock — which is why this test can assert that running
-/// it leaves the account exactly as unlinked as it found it.
-///
-/// `exchange` is exercised at the seam that needs no environment, for the
-/// reason the test above gives at length: mutating the process environment
-/// while sibling threads read it is the race this file exists without.
-#[tokio::test]
-async fn the_cli_authorises_last_fm_without_a_browser() {
-    let (_temp, _config, state) = test_app().await;
-    inserted_account(&state, "cli-lastfm-admin", "admin").await;
-    let user = inserted_account(&state, "cli-lastfm-user", "user").await;
-    state.services.register_lastfm_exchange(
-        "default",
-        std::sync::Arc::new(Approves)
-            as std::sync::Arc<dyn waveflow_server::services::LastFmSessionExchange>,
-    );
-
-    // The whole first command, end to end: it needs no secret from the
-    // environment, so nothing here has to be mutated for it to run.
-    run_cli(
-        &state,
-        &[
-            "scrobble",
-            "authorize",
-            "--actor",
-            "cli-lastfm-admin",
-            "--username",
-            "cli-lastfm-user",
-            "--destination",
-            "default",
-        ],
-    )
-    .await
-    .unwrap();
-
-    // And it left nothing behind. Asking Last.fm for a token is not half a
-    // link: an authorisation nobody completes has to cost this account
-    // nothing, and there is no row of ours for a purge to have to find.
-    assert!(state
-        .services
-        .scrobble_links(user)
-        .await
-        .unwrap()
-        .is_empty());
-
-    // An instance nobody declared is refused, and by the command rather than
-    // by the service being lenient.
-    assert!(run_cli(
-        &state,
-        &[
-            "scrobble",
-            "authorize",
-            "--actor",
-            "cli-lastfm-admin",
-            "--username",
-            "cli-lastfm-user",
-            "--destination",
-            "not-declared",
-        ],
-    )
-    .await
-    .is_err());
-
-    let missing = run_cli(
-        &state,
-        &[
-            "scrobble",
-            "exchange",
-            "--actor",
-            "cli-lastfm-admin",
-            "--username",
-            "cli-lastfm-user",
-            "--destination",
-            "default",
-            "--token-env",
-            "WAVEFLOW_TEST_LASTFM_TOKEN_THAT_IS_NEVER_SET",
-        ],
-    )
-    .await
-    .unwrap_err();
-    assert!(
-        missing
-            .to_string()
-            .contains("WAVEFLOW_TEST_LASTFM_TOKEN_THAT_IS_NEVER_SET"),
-        "{missing}"
-    );
-
-    // The flag surface, pinned by parsing rather than by running — including
-    // the default variable name, which is what an operator reads in `--help`
-    // and types into their shell.
-    let parsed = format!(
-        "{:?}",
-        waveflow_server::cli::Cli::try_parse_from([
-            "waveflow-server",
-            "scrobble",
-            "exchange",
-            "--actor",
-            "a",
-            "--username",
-            "b",
-            "--destination",
-            "default",
-        ])
-        .expect("the scrobble exchange flags have to parse — that is what this pins")
-        .command
-        .unwrap()
-    );
-    assert!(parsed.contains("WAVEFLOW_LASTFM_TOKEN"), "{parsed}");
-
-    // The second half, through the service the command calls: the token comes
-    // back, and the link is made under the session key it was exchanged for.
-    state
-        .services
-        .complete_lastfm_approval(user, "default", "t")
-        .await
-        .unwrap();
-    let links = state.services.scrobble_links(user).await.unwrap();
-    assert_eq!(links.len(), 1);
-    assert_eq!(links[0].provider.as_str(), "lastfm");
-    assert_eq!(links[0].destination, "default");
-}
-
-// ---------------------------------------------------------------------------
-// Replacing the instance key
-//
-// These four run against `cli::key` rather than `cli::execute`, because that is
-// where the commands live: they answer the boot that aborts on a mismatched
-// pair, so they cannot be reached through an `AppState` the boot would never
-// have built. The suite's other CLI tests all start from one.
-//
-// Every fixture below closes the pool and drops the state before the command
-// runs. That is not tidiness: `open_alone` refuses a database another
-// connection is holding, and leaving one open is how three of these would pass
-// by refusing for the wrong reason.
-// ---------------------------------------------------------------------------
-
-/// One installation holding every value an instance key governs.
-struct Sealed {
-    owner: uuid::Uuid,
-    track: uuid::Uuid,
-    /// Drawn here rather than written in, so an assertion that it came back
-    /// cannot be met by a constant the code could have carried.
-    subsonic_password: String,
-    scrobble_secret: String,
-    share: uuid::Uuid,
-    /// The public URL as it stood under the first key.
-    share_token: String,
-}
-
-/// How many of each the fixture seeds.
-///
-/// Four different numbers, on purpose. An earlier version seeded one of
-/// everything, and an assertion on the line the command prints then held just
-/// as well with two of its four fields swapped — the inversion that found it
-/// passed. A count can only be checked against a count nothing else shares.
-const SEALED_CREDENTIALS: usize = 2;
-const SEALED_LISTENS: usize = 3;
-const SEALED_SHARES: usize = 4;
-
-async fn sealed_installation(
-    config: &waveflow_server::Config,
-    state: &waveflow_server::AppState,
-    name: &str,
-) -> Sealed {
-    let owner = inserted_account(state, name, "admin").await;
-
-    let music = config.data_dir.join(name);
-    std::fs::create_dir_all(&music).unwrap();
-    generate_audio_fixture(&music.join("sealed.flac"), "flac", "flac");
-    let root = std::fs::canonicalize(&music).unwrap();
-    let library = state
-        .db
-        .create_library(
-            owner,
-            name,
-            &root,
-            waveflow_server::database::LibraryVisibility::Private,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    run_scan(
-        state,
-        owner,
-        waveflow_server::catalog::LibraryRecord {
-            id: library,
-            name: name.into(),
-            root_path: root,
-        },
-    )
-    .await;
-    let track: uuid::Uuid =
-        sqlx::query_scalar::<_, String>("SELECT id FROM track WHERE library_id=?")
-            .bind(library.to_string())
-            .fetch_one(state.db.pool())
-            .await
-            .expect("the fixture file must have been scanned")
-            .parse()
-            .unwrap();
-
-    let subsonic_password = format!("subsonic-{}", uuid::Uuid::new_v4());
-    state
-        .services
-        .set_subsonic_credential(owner, name, &subsonic_password)
-        .await
-        .unwrap();
-    for extra in 1..SEALED_CREDENTIALS {
-        let other = format!("{name}-{extra}");
-        inserted_account(state, &other, "user").await;
-        state
-            .services
-            .set_subsonic_credential(owner, &other, &format!("subsonic-{}", uuid::Uuid::new_v4()))
-            .await
-            .unwrap();
-    }
-
-    let scrobble_secret = format!("listenbrainz-{}", uuid::Uuid::new_v4());
-    state
-        .services
-        .link_scrobble(
-            owner,
-            waveflow_server::services::ScrobbleProvider::ListenBrainz,
-            "default",
-            &scrobble_secret,
-        )
-        .await
-        .unwrap();
-    // Listens behind the link, which `ON DELETE CASCADE` takes with it. Dated
-    // apart so none of them is the same listen twice.
-    for listen in 0..SEALED_LISTENS {
-        state
-            .services
-            .scrobble(
-                owner,
-                track,
-                true,
-                Some(now_ms() - (listen as i64 + 1) * 600_000),
-            )
-            .await
-            .unwrap();
-    }
-
-    let mut share = state
-        .services
-        .create_share(owner, &[track], Some("carried over"), None)
-        .await
-        .unwrap();
-    for extra in 1..SEALED_SHARES {
-        state
-            .services
-            .create_share(owner, &[track], Some(&format!("also {extra}")), None)
-            .await
-            .unwrap();
-    }
-    let share_token = share.url_token.take().expect("a new share names its URL");
-    assert!(
-        state.services.public_share(&share_token).await.is_ok(),
-        "the fixture share must resolve before the key changes"
-    );
-    for (table, query, expected) in [
-        (
-            "subsonic_credential",
-            "SELECT COUNT(*) FROM subsonic_credential",
-            SEALED_CREDENTIALS,
-        ),
-        ("scrobble_link", "SELECT COUNT(*) FROM scrobble_link", 1),
-        (
-            "scrobble_outbox",
-            "SELECT COUNT(*) FROM scrobble_outbox",
-            SEALED_LISTENS,
-        ),
-        ("share", "SELECT COUNT(*) FROM share", SEALED_SHARES),
-    ] {
-        assert_eq!(
-            count(state, query).await as usize,
-            expected,
-            "the fixture must seed {expected} row(s) in {table}"
-        );
-    }
-
-    Sealed {
-        owner,
-        track,
-        subsonic_password,
-        scrobble_secret,
-        share: share.id,
-        share_token,
-    }
-}
-
-/// Closes every connection, so the command can take the database.
-async fn stop_server(state: waveflow_server::AppState) {
-    state.db.pool().close().await;
-    drop(state);
-}
-
-async fn count(state: &waveflow_server::AppState, query: &'static str) -> i64 {
-    sqlx::query_scalar::<_, i64>(query)
-        .fetch_one(state.db.pool())
-        .await
-        .unwrap()
-}
-
-/// The sealed scrobbling secret, read the way the drain reads it.
-///
-/// There is no public accessor for it — `due_scrobbles` is private and joins
-/// the outbox — so the row is read here and opened with the same `SecretBox`
-/// the drain would use. What is being checked is the ciphertext, not the join.
-///
-/// `None` rather than a panic when it will not open, because that is the
-/// failure a rotation that skipped this table produces, and a test must fail
-/// on the assertion that names the defect rather than on the line before it.
-async fn scrobble_secret(state: &waveflow_server::AppState) -> Option<Vec<u8>> {
-    let (nonce, ciphertext) = sqlx::query_as::<_, (Vec<u8>, Vec<u8>)>(
-        "SELECT credential_nonce, credential_ciphertext FROM scrobble_link",
-    )
-    .fetch_one(state.db.pool())
-    .await
-    .expect("the link must still be there");
-    state.secret_box.decrypt(&nonce, &ciphertext).ok()
-}
-
-/// Whether the command refused, and said why.
-///
-/// Read as a value rather than through `unwrap_err`: a command that went
-/// ahead when it should have refused must fail on the assertion that names the
-/// refusal, not on the unwrapping above it.
-fn refused_with(outcome: &anyhow::Result<()>, reason: &str) -> bool {
-    outcome
-        .as_ref()
-        .err()
-        .is_some_and(|error| error.to_string().contains(reason))
-}
-
-/// The single `pre-key-*` directory the command left behind.
-fn recovery_directory(config: &waveflow_server::Config) -> std::path::PathBuf {
-    let mut found: Vec<_> = std::fs::read_dir(&config.data_dir)
-        .unwrap()
-        .map(|entry| entry.unwrap().path())
-        .filter(|path| {
-            path.file_name()
-                .and_then(|name| name.to_str())
-                .is_some_and(|name| name.starts_with("pre-key-"))
-        })
-        .collect();
-    assert_eq!(found.len(), 1, "exactly one recovery directory: {found:?}");
-    found.pop().unwrap()
-}
-
-/// Rotation carries every secret onto the new key, and re-points the shares.
-///
-/// The share half is the one worth stating plainly. A share token is derived
-/// from the instance key rather than stored, so a key change that left
-/// `token_hash` alone would not re-address the share — it would strand it,
-/// behind a URL its owner is still shown and nobody can open. "Shares survive
-/// with a new URL" is only true because `rekey` recomputes the hash, and the
-/// two assertions below are what separate that from the wish.
-#[tokio::test]
-async fn rotating_the_key_keeps_every_secret_and_re_points_the_shares() {
-    let (_temp, config, state) = test_app().await;
-    let sealed = sealed_installation(&config, &state, "rotate-owner").await;
-    let key_before = std::fs::read(&config.instance_key_path).unwrap();
-    let queued_before = count(&state, "SELECT COUNT(*) FROM scrobble_outbox").await;
-    stop_server(state).await;
-
-    waveflow_server::cli::key(
-        &config,
-        waveflow_server::cli::KeyCommand::Rotate(waveflow_server::cli::KeyArgs { confirm: true }),
-    )
-    .await
-    .unwrap();
-
-    let key_after = std::fs::read(&config.instance_key_path).unwrap();
-    assert_ne!(key_after, key_before, "the key file was not replaced");
-    let recovery = recovery_directory(&config);
-    assert_eq!(
-        std::fs::read(recovery.join("instance.key")).ok().as_deref(),
-        Some(key_before.as_slice()),
-        "the recovery bundle must hold the key as it was"
-    );
-    assert!(
-        waveflow_server::database::Database::check_file(&recovery.join("waveflow.db"))
-            .await
-            .unwrap_or(false),
-        "the recovery copy must be a sound database"
-    );
-
-    let state = waveflow_server::initialize(&config).await.unwrap();
-    let credential = state
-        .services
-        .credential_by_username("rotate-owner")
-        .await
-        .unwrap()
-        .expect("the credential must still be there");
-    assert_eq!(
-        state
-            .services
-            .decrypt_subsonic_password(&credential)
-            .ok()
-            .as_deref(),
-        Some(sealed.subsonic_password.as_bytes()),
-        "the Subsonic password did not survive the rotation"
-    );
-    assert_eq!(
-        scrobble_secret(&state).await.as_deref(),
-        Some(sealed.scrobble_secret.as_bytes()),
-        "the scrobbling secret did not survive the rotation"
-    );
-    assert_eq!(
-        count(&state, "SELECT COUNT(*) FROM scrobble_outbox").await,
-        queued_before,
-        "rotation must not touch the queue"
-    );
-
-    let moved = state.secret_box.derive_share_token(sealed.share);
-    assert_ne!(moved, sealed.share_token, "the URL did not change");
-    assert!(
-        matches!(
-            state.services.public_share(&sealed.share_token).await,
-            Err(waveflow_server::services::ServiceError::NotFound)
-        ),
-        "a link handed out under the old key still opens"
-    );
-    let reached = state
-        .services
-        .public_share(&moved)
-        .await
-        .expect("the share must answer on its new URL");
-    assert_eq!(reached.id, sealed.share);
-    assert_eq!(
-        reached.songs.len(),
-        1,
-        "the share must still carry its track"
-    );
-}
-
-/// Adoption discards what cannot be read, and only that.
-///
-/// The queue is the part an operator would not predict: the outbox hangs off
-/// `scrobble_link` by `ON DELETE CASCADE`, which only fires with foreign keys
-/// enforced — and the migration this command runs first leaves them off.
-///
-/// Three things would have to go for a stranded queue to reach anybody: the
-/// `PRAGMA` `rekey` asks for itself, the orphan count it rolls back on, and
-/// the `foreign_key_check` the next boot runs. Removing the first fails this
-/// test on the command; removing the first two fails it on the boot below. So
-/// the count further down never gets to be the line that fails, and is kept
-/// as the statement of what an adoption leaves behind rather than as the
-/// guard — which is where the guard actually is.
-#[tokio::test]
-async fn adopting_a_database_discards_what_the_lost_key_sealed_and_nothing_else() {
-    let (_temp, config, state) = test_app().await;
-    let sealed = sealed_installation(&config, &state, "adopt-owner").await;
-    stop_server(state).await;
-    // The situation this command exists for, in its harder form: not a file
-    // that is gone but one that is no longer a key. `adopt` has to accept it
-    // — refusing to read it would refuse the operator holding it — and move
-    // it aside with the rest of the pair.
-    std::fs::write(&config.instance_key_path, [1u8; 7]).unwrap();
-
-    waveflow_server::cli::key(
-        &config,
-        waveflow_server::cli::KeyCommand::Adopt(waveflow_server::cli::KeyArgs { confirm: true }),
-    )
-    .await
-    .unwrap();
-
-    let state = waveflow_server::initialize(&config).await.unwrap();
-    assert_eq!(
-        count(&state, "SELECT COUNT(*) FROM subsonic_credential").await,
-        0,
-        "an unreadable Subsonic password was kept"
-    );
-    assert_eq!(
-        count(&state, "SELECT COUNT(*) FROM scrobble_link").await,
-        0,
-        "an unreadable scrobbling secret was kept"
-    );
-    assert_eq!(
-        count(&state, "SELECT COUNT(*) FROM scrobble_outbox").await,
-        0,
-        "the queue outlived the links it belongs to"
-    );
-
-    // Everything the key never touched.
-    assert_eq!(
-        count(&state, "SELECT COUNT(*) FROM account").await,
-        SEALED_CREDENTIALS as i64,
-        "an account was lost with the secret it held"
-    );
-    assert_eq!(count(&state, "SELECT COUNT(*) FROM track").await, 1);
-    assert_eq!(
-        count(&state, "SELECT COUNT(*) FROM share").await,
-        SEALED_SHARES as i64,
-        "a share was lost rather than re-addressed"
-    );
-    let songs = state
-        .services
-        .songs_by_ids(sealed.owner, &[sealed.track])
-        .await
-        .unwrap();
-    assert_eq!(songs.len(), 1, "the catalogue must come back untouched");
-
-    let moved = state.secret_box.derive_share_token(sealed.share);
-    assert_ne!(moved, sealed.share_token);
-    let reached = state
-        .services
-        .public_share(&moved)
-        .await
-        .expect("a share survives an adoption, with a new URL");
-    assert_eq!(reached.id, sealed.share);
-
-    let recovery = recovery_directory(&config);
-    assert_eq!(
-        std::fs::read(recovery.join("instance.key")).ok().as_deref(),
-        Some([1u8; 7].as_slice()),
-        "the unusable key was dropped instead of being moved aside"
-    );
-}
-
-/// The three situations in which a key change must not happen at all.
-#[tokio::test]
-async fn a_key_change_refuses_a_live_server_a_matching_key_and_a_foreign_one() {
-    let (_temp, config, state) = test_app().await;
-    sealed_installation(&config, &state, "refusal-owner").await;
-    let key_before = std::fs::read(&config.instance_key_path).unwrap();
-
-    // One: the server is still holding the database.
-    let refused = waveflow_server::cli::key(
-        &config,
-        waveflow_server::cli::KeyCommand::Rotate(waveflow_server::cli::KeyArgs { confirm: true }),
-    )
-    .await;
-    assert!(
-        refused_with(&refused, "open in another process"),
-        "a live server was not detected: {refused:?}"
-    );
-    stop_server(state).await;
-
-    // Two: the key is sitting beside the database, so nothing is lost and
-    // nothing may be destroyed.
-    let refused = waveflow_server::cli::key(
-        &config,
-        waveflow_server::cli::KeyCommand::Adopt(waveflow_server::cli::KeyArgs { confirm: true }),
-    )
-    .await;
-    assert!(
-        refused_with(&refused, "key rotate"),
-        "adoption did not send the operator to rotation: {refused:?}"
-    );
-
-    // Three: the key present is some other installation's.
-    std::fs::write(&config.instance_key_path, [3u8; 32]).unwrap();
-    let refused = waveflow_server::cli::key(
-        &config,
-        waveflow_server::cli::KeyCommand::Rotate(waveflow_server::cli::KeyArgs { confirm: true }),
-    )
-    .await;
-    assert!(
-        refused_with(&refused, "not the one it was bound to"),
-        "a foreign key was accepted for rotation: {refused:?}"
-    );
-
-    std::fs::write(&config.instance_key_path, &key_before).unwrap();
-    let state = waveflow_server::initialize(&config).await.unwrap();
-    assert_eq!(
-        count(&state, "SELECT COUNT(*) FROM subsonic_credential").await,
-        SEALED_CREDENTIALS as i64,
-        "a refused key change still changed something"
-    );
-}
-
-/// Without `--confirm` the command is a reading, and leaves no trace.
-#[tokio::test]
-async fn a_key_change_without_confirmation_changes_nothing() {
-    let (_temp, config, state) = test_app().await;
-    let sealed = sealed_installation(&config, &state, "dry-run-owner").await;
-    let key_before = std::fs::read(&config.instance_key_path).unwrap();
-    stop_server(state).await;
-
-    waveflow_server::cli::key(
-        &config,
-        waveflow_server::cli::KeyCommand::Rotate(waveflow_server::cli::KeyArgs { confirm: false }),
-    )
-    .await
-    .unwrap();
-
-    assert_eq!(
-        std::fs::read(&config.instance_key_path).unwrap(),
-        key_before,
-        "a reading replaced the key"
-    );
-    assert!(
-        !std::fs::read_dir(&config.data_dir).unwrap().any(|entry| {
-            entry
-                .unwrap()
-                .file_name()
-                .to_string_lossy()
-                .starts_with("pre-key-")
-        }),
-        "a reading left a recovery directory behind"
-    );
-
-    let state = waveflow_server::initialize(&config).await.unwrap();
-    assert!(
-        state
-            .services
-            .public_share(&sealed.share_token)
-            .await
-            .is_ok(),
-        "a reading moved the shares"
-    );
-    let credential = state
-        .services
-        .credential_by_username("dry-run-owner")
-        .await
-        .unwrap()
-        .expect("the credential must still be there");
-    assert_eq!(
-        state
-            .services
-            .decrypt_subsonic_password(&credential)
-            .ok()
-            .as_deref(),
-        Some(sealed.subsonic_password.as_bytes())
-    );
-}
-
-/// What the operator actually reads, reached the way they reach it.
-///
-/// Through the binary rather than through `cli::key`, because the subject here
-/// is the surface: the `key` group and its `--confirm` flag as clap parses
-/// them, and the two counts printed — the one read from the tables before the
-/// decision, and the one answered by the statements that carried it out. The
-/// in-process tests above hold what the commands *do*; nothing in them would
-/// notice `--confirm` renamed, or a count printed from the wrong field.
-#[tokio::test]
-async fn a_key_change_prints_what_it_costs_and_then_what_it_did() {
-    let (temp, config, state) = test_app().await;
-    sealed_installation(&config, &state, "printed-owner").await;
-    stop_server(state).await;
-    // Adoption refuses a key that still opens the database, so this is the
-    // situation it is for.
-    std::fs::remove_file(&config.instance_key_path).unwrap();
-
-    let reading = cli_command()
-        .current_dir(temp.path())
-        .env("WAVEFLOW_DATA_DIR", &config.data_dir)
-        .args(["key", "adopt"])
-        .output()
-        .unwrap();
-    let stdout = String::from_utf8(reading.stdout).unwrap();
-    let stderr = String::from_utf8(reading.stderr).unwrap();
-    assert!(reading.status.success(), "the reading failed: {stderr}");
-    for expected in [
-        "2 Subsonic credential(s) — deleted, password and `wfsk_` API key together",
-        "1 scrobbling link(s) — deleted, and the 3 queued listen(s) behind them",
-        "4 share(s) — kept, but every public URL changes",
-        "Nothing has been changed. Re-run with --confirm.",
-    ] {
-        assert!(
-            stdout.contains(expected),
-            "the reading never said {expected:?}; it said: {stdout}"
-        );
-    }
-    assert!(!config.instance_key_path.exists(), "a reading minted a key");
-
-    let done = cli_command()
-        .current_dir(temp.path())
-        .env("WAVEFLOW_DATA_DIR", &config.data_dir)
-        .args(["key", "adopt", "--confirm"])
-        .output()
-        .unwrap();
-    let stdout = String::from_utf8(done.stdout).unwrap();
-    let stderr = String::from_utf8(done.stderr).unwrap();
-    assert!(done.status.success(), "the adoption failed: {stderr}");
-    assert!(
-        stdout.contains(
-            "Done. 2 Subsonic credential(s) and 1 scrobbling link(s) deleted, \
-             with 3 queued listen(s); 4 share(s) re-addressed."
-        ),
-        "the closing line did not report the operation: {stdout}"
-    );
-    assert!(
-        config.instance_key_path.exists(),
-        "the adoption left no key behind"
-    );
-}
-
-/// RFC-018: an incremental scan skips a file whose size and modification time
-/// are unchanged, so the operator needs a way to have every file read again.
-/// The request is stored on every library and spent by its next scan.
-#[tokio::test]
-async fn database_rescan_full_asks_every_library_to_read_everything() {
-    let (_temp, config, state) = test_app().await;
-    let owner = inserted_account(&state, "rescan-owner", "admin").await;
-    let music = config.data_dir.join("rescan-music");
-    std::fs::create_dir_all(&music).unwrap();
-    let library = state
-        .db
-        .create_library(
-            owner,
-            "Rescan",
-            &std::fs::canonicalize(&music).unwrap(),
-            waveflow_server::database::LibraryVisibility::Private,
-            waveflow_server::authentication::now_ms(),
-        )
-        .await
-        .unwrap();
-    assert!(!state.db.full_scan_requested(library).await.unwrap());
-
-    run_cli(&state, &["database", "rescan-full"]).await.unwrap();
-
-    assert!(state.db.full_scan_requested(library).await.unwrap());
-}
-
-/// RFC-021 decision 5 from the command line: rename, move with its scan,
-/// purge the missing, and a deletion that refuses until the name is typed.
-#[tokio::test]
-async fn the_cli_renames_moves_purges_and_deletes_a_library() {
-    let (temp, config, state) = test_app().await;
-    let admin = inserted_account(&state, "lifecycle-admin", "admin").await;
-    let music = config.data_dir.join("lifecycle-music");
-    std::fs::create_dir_all(&music).unwrap();
-    write_test_wav(&music.join("Kept.wav"));
-    write_test_wav_of_len(&music.join("Gone.wav"), 900);
-    let root = std::fs::canonicalize(&music).unwrap();
-    let library = state
-        .db
-        .create_library(
-            admin,
-            "Lifecycle",
-            &root,
-            waveflow_server::database::LibraryVisibility::Private,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let id = library.to_string();
-    scan_once(
-        &state,
-        admin,
-        waveflow_server::catalog::LibraryRecord {
-            id: library,
-            name: "Lifecycle".into(),
-            root_path: root.clone(),
-        },
-    )
-    .await;
-
-    run_cli(
-        &state,
-        &[
-            "library",
-            "rename",
-            "--actor",
-            "lifecycle-admin",
-            "--library-id",
-            &id,
-            "--name",
-            "Renamed",
-        ],
-    )
-    .await
-    .unwrap();
-    assert_eq!(
-        count(
-            &state,
-            "SELECT COUNT(*) FROM library WHERE name = 'Renamed'"
-        )
-        .await,
-        1
-    );
-
-    // Moved with one file fewer: the scan the move queues finds it missing.
-    let moved = temp.path().join("lifecycle-moved");
-    std::fs::rename(&music, &moved).unwrap();
-    std::fs::remove_file(moved.join("Gone.wav")).unwrap();
-    let moved_text = moved.to_string_lossy().into_owned();
-    run_cli(
-        &state,
-        &[
-            "library",
-            "set-path",
-            "--actor",
-            "lifecycle-admin",
-            "--library-id",
-            &id,
-            "--path",
-            &moved_text,
-        ],
-    )
-    .await
-    .unwrap();
-    assert_eq!(
-        count(&state, "SELECT COUNT(*) FROM track WHERE is_available = 0").await,
-        1
-    );
-
-    let unnamed = run_cli(
-        &state,
-        &[
-            "library",
-            "purge",
-            "--actor",
-            "lifecycle-admin",
-            "--library-id",
-            &id,
-        ],
-    )
-    .await;
-    assert!(unnamed.is_err(), "a purge naming nothing must refuse");
-    run_cli(
-        &state,
-        &[
-            "library",
-            "purge",
-            "--actor",
-            "lifecycle-admin",
-            "--library-id",
-            &id,
-            "--all",
-        ],
-    )
-    .await
-    .unwrap();
-    assert_eq!(
-        count(&state, "SELECT COUNT(*) FROM track WHERE purged_at IS NULL").await,
-        1
-    );
-    // Within the grace window, a purge is taken back.
-    run_cli(
-        &state,
-        &[
-            "library",
-            "restore",
-            "--actor",
-            "lifecycle-admin",
-            "--library-id",
-            &id,
-            "--all",
-        ],
-    )
-    .await
-    .unwrap();
-    assert_eq!(
-        count(
-            &state,
-            "SELECT COUNT(*) FROM track WHERE purged_at IS NOT NULL"
-        )
-        .await,
-        0
-    );
-    assert_eq!(
-        count(&state, "SELECT COUNT(*) FROM track WHERE is_available = 0").await,
-        1
-    );
-
-    let mistyped = run_cli(
-        &state,
-        &[
-            "library",
-            "delete",
-            "--actor",
-            "lifecycle-admin",
-            "--library-id",
-            &id,
-            "--confirm",
-            "Lifecycle",
-        ],
-    )
-    .await;
-    assert!(
-        mistyped.is_err(),
-        "the old name must not confirm a deletion"
-    );
-    assert_eq!(count(&state, "SELECT COUNT(*) FROM library").await, 1);
-    run_cli(
-        &state,
-        &[
-            "library",
-            "delete",
-            "--actor",
-            "lifecycle-admin",
-            "--library-id",
-            &id,
-            "--confirm",
-            "Renamed",
-        ],
-    )
-    .await
-    .unwrap();
-    assert_eq!(count(&state, "SELECT COUNT(*) FROM library").await, 0);
-    assert_eq!(count(&state, "SELECT COUNT(*) FROM track").await, 0);
-    assert!(moved.join("Kept.wav").exists(), "a file was touched");
-}
diff --git a/tests/cli/key.rs b/tests/cli/key.rs
new file mode 100644
index 00000000..f1130820
--- /dev/null
+++ b/tests/cli/key.rs
@@ -0,0 +1,566 @@
+//! Changing the instance key: rotating it, adopting a database without it,
+//! and what each refuses.
+
+use super::*;
+
+// ---------------------------------------------------------------------------
+// Replacing the instance key
+//
+// These four run against `cli::key` rather than `cli::execute`, because that is
+// where the commands live: they answer the boot that aborts on a mismatched
+// pair, so they cannot be reached through an `AppState` the boot would never
+// have built. The suite's other CLI tests all start from one.
+//
+// Every fixture below closes the pool and drops the state before the command
+// runs. That is not tidiness: `open_alone` refuses a database another
+// connection is holding, and leaving one open is how three of these would pass
+// by refusing for the wrong reason.
+// ---------------------------------------------------------------------------
+
+/// One installation holding every value an instance key governs.
+struct Sealed {
+    owner: uuid::Uuid,
+    track: uuid::Uuid,
+    /// Drawn here rather than written in, so an assertion that it came back
+    /// cannot be met by a constant the code could have carried.
+    subsonic_password: String,
+    scrobble_secret: String,
+    share: uuid::Uuid,
+    /// The public URL as it stood under the first key.
+    share_token: String,
+}
+
+/// How many of each the fixture seeds.
+///
+/// Four different numbers, on purpose. An earlier version seeded one of
+/// everything, and an assertion on the line the command prints then held just
+/// as well with two of its four fields swapped — the inversion that found it
+/// passed. A count can only be checked against a count nothing else shares.
+const SEALED_CREDENTIALS: usize = 2;
+
+const SEALED_LISTENS: usize = 3;
+
+const SEALED_SHARES: usize = 4;
+
+async fn sealed_installation(
+    config: &waveflow_server::Config,
+    state: &waveflow_server::AppState,
+    name: &str,
+) -> Sealed {
+    let owner = inserted_account(state, name, "admin").await;
+
+    let music = config.data_dir.join(name);
+    std::fs::create_dir_all(&music).unwrap();
+    generate_audio_fixture(&music.join("sealed.flac"), "flac", "flac");
+    let root = std::fs::canonicalize(&music).unwrap();
+    let library = state
+        .db
+        .create_library(
+            owner,
+            name,
+            &root,
+            waveflow_server::storage::database::LibraryVisibility::Private,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    run_scan(
+        state,
+        owner,
+        waveflow_server::storage::catalog::LibraryRecord {
+            id: library,
+            name: name.into(),
+            root_path: root,
+        },
+    )
+    .await;
+    let track: uuid::Uuid =
+        sqlx::query_scalar::<_, String>("SELECT id FROM track WHERE library_id=?")
+            .bind(library.to_string())
+            .fetch_one(state.db.pool())
+            .await
+            .expect("the fixture file must have been scanned")
+            .parse()
+            .unwrap();
+
+    let subsonic_password = format!("subsonic-{}", uuid::Uuid::new_v4());
+    state
+        .services
+        .set_subsonic_credential(owner, name, &subsonic_password)
+        .await
+        .unwrap();
+    for extra in 1..SEALED_CREDENTIALS {
+        let other = format!("{name}-{extra}");
+        inserted_account(state, &other, "user").await;
+        state
+            .services
+            .set_subsonic_credential(owner, &other, &format!("subsonic-{}", uuid::Uuid::new_v4()))
+            .await
+            .unwrap();
+    }
+
+    let scrobble_secret = format!("listenbrainz-{}", uuid::Uuid::new_v4());
+    state
+        .services
+        .link_scrobble(
+            owner,
+            waveflow_server::services::ScrobbleProvider::ListenBrainz,
+            "default",
+            &scrobble_secret,
+        )
+        .await
+        .unwrap();
+    // Listens behind the link, which `ON DELETE CASCADE` takes with it. Dated
+    // apart so none of them is the same listen twice.
+    for listen in 0..SEALED_LISTENS {
+        state
+            .services
+            .scrobble(
+                owner,
+                track,
+                true,
+                Some(now_ms() - (listen as i64 + 1) * 600_000),
+            )
+            .await
+            .unwrap();
+    }
+
+    let mut share = state
+        .services
+        .create_share(owner, &[track], Some("carried over"), None)
+        .await
+        .unwrap();
+    for extra in 1..SEALED_SHARES {
+        state
+            .services
+            .create_share(owner, &[track], Some(&format!("also {extra}")), None)
+            .await
+            .unwrap();
+    }
+    let share_token = share.url_token.take().expect("a new share names its URL");
+    assert!(
+        state.services.public_share(&share_token).await.is_ok(),
+        "the fixture share must resolve before the key changes"
+    );
+    for (table, query, expected) in [
+        (
+            "subsonic_credential",
+            "SELECT COUNT(*) FROM subsonic_credential",
+            SEALED_CREDENTIALS,
+        ),
+        ("scrobble_link", "SELECT COUNT(*) FROM scrobble_link", 1),
+        (
+            "scrobble_outbox",
+            "SELECT COUNT(*) FROM scrobble_outbox",
+            SEALED_LISTENS,
+        ),
+        ("share", "SELECT COUNT(*) FROM share", SEALED_SHARES),
+    ] {
+        assert_eq!(
+            count(state, query).await as usize,
+            expected,
+            "the fixture must seed {expected} row(s) in {table}"
+        );
+    }
+
+    Sealed {
+        owner,
+        track,
+        subsonic_password,
+        scrobble_secret,
+        share: share.id,
+        share_token,
+    }
+}
+
+/// Closes every connection, so the command can take the database.
+async fn stop_server(state: waveflow_server::AppState) {
+    state.db.pool().close().await;
+    drop(state);
+}
+
+/// The sealed scrobbling secret, read the way the drain reads it.
+///
+/// There is no public accessor for it — `due_scrobbles` is private and joins
+/// the outbox — so the row is read here and opened with the same `SecretBox`
+/// the drain would use. What is being checked is the ciphertext, not the join.
+///
+/// `None` rather than a panic when it will not open, because that is the
+/// failure a rotation that skipped this table produces, and a test must fail
+/// on the assertion that names the defect rather than on the line before it.
+async fn scrobble_secret(state: &waveflow_server::AppState) -> Option<Vec<u8>> {
+    let (nonce, ciphertext) = sqlx::query_as::<_, (Vec<u8>, Vec<u8>)>(
+        "SELECT credential_nonce, credential_ciphertext FROM scrobble_link",
+    )
+    .fetch_one(state.db.pool())
+    .await
+    .expect("the link must still be there");
+    state.secret_box.decrypt(&nonce, &ciphertext).ok()
+}
+
+/// Whether the command refused, and said why.
+///
+/// Read as a value rather than through `unwrap_err`: a command that went
+/// ahead when it should have refused must fail on the assertion that names the
+/// refusal, not on the unwrapping above it.
+fn refused_with(outcome: &anyhow::Result<()>, reason: &str) -> bool {
+    outcome
+        .as_ref()
+        .err()
+        .is_some_and(|error| error.to_string().contains(reason))
+}
+
+/// The single `pre-key-*` directory the command left behind.
+fn recovery_directory(config: &waveflow_server::Config) -> std::path::PathBuf {
+    let mut found: Vec<_> = std::fs::read_dir(&config.data_dir)
+        .unwrap()
+        .map(|entry| entry.unwrap().path())
+        .filter(|path| {
+            path.file_name()
+                .and_then(|name| name.to_str())
+                .is_some_and(|name| name.starts_with("pre-key-"))
+        })
+        .collect();
+    assert_eq!(found.len(), 1, "exactly one recovery directory: {found:?}");
+    found.pop().unwrap()
+}
+
+/// Rotation carries every secret onto the new key, and re-points the shares.
+///
+/// The share half is the one worth stating plainly. A share token is derived
+/// from the instance key rather than stored, so a key change that left
+/// `token_hash` alone would not re-address the share — it would strand it,
+/// behind a URL its owner is still shown and nobody can open. "Shares survive
+/// with a new URL" is only true because `rekey` recomputes the hash, and the
+/// two assertions below are what separate that from the wish.
+#[tokio::test]
+async fn rotating_the_key_keeps_every_secret_and_re_points_the_shares() {
+    let (_temp, config, state) = test_app().await;
+    let sealed = sealed_installation(&config, &state, "rotate-owner").await;
+    let key_before = std::fs::read(&config.instance_key_path).unwrap();
+    let queued_before = count(&state, "SELECT COUNT(*) FROM scrobble_outbox").await;
+    stop_server(state).await;
+
+    waveflow_server::cli::key(
+        &config,
+        waveflow_server::cli::KeyCommand::Rotate(waveflow_server::cli::KeyArgs { confirm: true }),
+    )
+    .await
+    .unwrap();
+
+    let key_after = std::fs::read(&config.instance_key_path).unwrap();
+    assert_ne!(key_after, key_before, "the key file was not replaced");
+    let recovery = recovery_directory(&config);
+    assert_eq!(
+        std::fs::read(recovery.join("instance.key")).ok().as_deref(),
+        Some(key_before.as_slice()),
+        "the recovery bundle must hold the key as it was"
+    );
+    assert!(
+        waveflow_server::storage::database::Database::check_file(&recovery.join("waveflow.db"))
+            .await
+            .unwrap_or(false),
+        "the recovery copy must be a sound database"
+    );
+
+    let state = waveflow_server::initialize(&config).await.unwrap();
+    let credential = state
+        .services
+        .credential_by_username("rotate-owner")
+        .await
+        .unwrap()
+        .expect("the credential must still be there");
+    assert_eq!(
+        state
+            .services
+            .decrypt_subsonic_password(&credential)
+            .ok()
+            .as_deref(),
+        Some(sealed.subsonic_password.as_bytes()),
+        "the Subsonic password did not survive the rotation"
+    );
+    assert_eq!(
+        scrobble_secret(&state).await.as_deref(),
+        Some(sealed.scrobble_secret.as_bytes()),
+        "the scrobbling secret did not survive the rotation"
+    );
+    assert_eq!(
+        count(&state, "SELECT COUNT(*) FROM scrobble_outbox").await,
+        queued_before,
+        "rotation must not touch the queue"
+    );
+
+    let moved = state.secret_box.derive_share_token(sealed.share);
+    assert_ne!(moved, sealed.share_token, "the URL did not change");
+    assert!(
+        matches!(
+            state.services.public_share(&sealed.share_token).await,
+            Err(waveflow_server::services::ServiceError::NotFound)
+        ),
+        "a link handed out under the old key still opens"
+    );
+    let reached = state
+        .services
+        .public_share(&moved)
+        .await
+        .expect("the share must answer on its new URL");
+    assert_eq!(reached.id, sealed.share);
+    assert_eq!(
+        reached.songs.len(),
+        1,
+        "the share must still carry its track"
+    );
+}
+
+/// Adoption discards what cannot be read, and only that.
+///
+/// The queue is the part an operator would not predict: the outbox hangs off
+/// `scrobble_link` by `ON DELETE CASCADE`, which only fires with foreign keys
+/// enforced — and the migration this command runs first leaves them off.
+///
+/// Three things would have to go for a stranded queue to reach anybody: the
+/// `PRAGMA` `rekey` asks for itself, the orphan count it rolls back on, and
+/// the `foreign_key_check` the next boot runs. Removing the first fails this
+/// test on the command; removing the first two fails it on the boot below. So
+/// the count further down never gets to be the line that fails, and is kept
+/// as the statement of what an adoption leaves behind rather than as the
+/// guard — which is where the guard actually is.
+#[tokio::test]
+async fn adopting_a_database_discards_what_the_lost_key_sealed_and_nothing_else() {
+    let (_temp, config, state) = test_app().await;
+    let sealed = sealed_installation(&config, &state, "adopt-owner").await;
+    stop_server(state).await;
+    // The situation this command exists for, in its harder form: not a file
+    // that is gone but one that is no longer a key. `adopt` has to accept it
+    // — refusing to read it would refuse the operator holding it — and move
+    // it aside with the rest of the pair.
+    std::fs::write(&config.instance_key_path, [1u8; 7]).unwrap();
+
+    waveflow_server::cli::key(
+        &config,
+        waveflow_server::cli::KeyCommand::Adopt(waveflow_server::cli::KeyArgs { confirm: true }),
+    )
+    .await
+    .unwrap();
+
+    let state = waveflow_server::initialize(&config).await.unwrap();
+    assert_eq!(
+        count(&state, "SELECT COUNT(*) FROM subsonic_credential").await,
+        0,
+        "an unreadable Subsonic password was kept"
+    );
+    assert_eq!(
+        count(&state, "SELECT COUNT(*) FROM scrobble_link").await,
+        0,
+        "an unreadable scrobbling secret was kept"
+    );
+    assert_eq!(
+        count(&state, "SELECT COUNT(*) FROM scrobble_outbox").await,
+        0,
+        "the queue outlived the links it belongs to"
+    );
+
+    // Everything the key never touched.
+    assert_eq!(
+        count(&state, "SELECT COUNT(*) FROM account").await,
+        SEALED_CREDENTIALS as i64,
+        "an account was lost with the secret it held"
+    );
+    assert_eq!(count(&state, "SELECT COUNT(*) FROM track").await, 1);
+    assert_eq!(
+        count(&state, "SELECT COUNT(*) FROM share").await,
+        SEALED_SHARES as i64,
+        "a share was lost rather than re-addressed"
+    );
+    let songs = state
+        .services
+        .songs_by_ids(sealed.owner, &[sealed.track])
+        .await
+        .unwrap();
+    assert_eq!(songs.len(), 1, "the catalogue must come back untouched");
+
+    let moved = state.secret_box.derive_share_token(sealed.share);
+    assert_ne!(moved, sealed.share_token);
+    let reached = state
+        .services
+        .public_share(&moved)
+        .await
+        .expect("a share survives an adoption, with a new URL");
+    assert_eq!(reached.id, sealed.share);
+
+    let recovery = recovery_directory(&config);
+    assert_eq!(
+        std::fs::read(recovery.join("instance.key")).ok().as_deref(),
+        Some([1u8; 7].as_slice()),
+        "the unusable key was dropped instead of being moved aside"
+    );
+}
+
+/// The three situations in which a key change must not happen at all.
+#[tokio::test]
+async fn a_key_change_refuses_a_live_server_a_matching_key_and_a_foreign_one() {
+    let (_temp, config, state) = test_app().await;
+    sealed_installation(&config, &state, "refusal-owner").await;
+    let key_before = std::fs::read(&config.instance_key_path).unwrap();
+
+    // One: the server is still holding the database.
+    let refused = waveflow_server::cli::key(
+        &config,
+        waveflow_server::cli::KeyCommand::Rotate(waveflow_server::cli::KeyArgs { confirm: true }),
+    )
+    .await;
+    assert!(
+        refused_with(&refused, "open in another process"),
+        "a live server was not detected: {refused:?}"
+    );
+    stop_server(state).await;
+
+    // Two: the key is sitting beside the database, so nothing is lost and
+    // nothing may be destroyed.
+    let refused = waveflow_server::cli::key(
+        &config,
+        waveflow_server::cli::KeyCommand::Adopt(waveflow_server::cli::KeyArgs { confirm: true }),
+    )
+    .await;
+    assert!(
+        refused_with(&refused, "key rotate"),
+        "adoption did not send the operator to rotation: {refused:?}"
+    );
+
+    // Three: the key present is some other installation's.
+    std::fs::write(&config.instance_key_path, [3u8; 32]).unwrap();
+    let refused = waveflow_server::cli::key(
+        &config,
+        waveflow_server::cli::KeyCommand::Rotate(waveflow_server::cli::KeyArgs { confirm: true }),
+    )
+    .await;
+    assert!(
+        refused_with(&refused, "not the one it was bound to"),
+        "a foreign key was accepted for rotation: {refused:?}"
+    );
+
+    std::fs::write(&config.instance_key_path, &key_before).unwrap();
+    let state = waveflow_server::initialize(&config).await.unwrap();
+    assert_eq!(
+        count(&state, "SELECT COUNT(*) FROM subsonic_credential").await,
+        SEALED_CREDENTIALS as i64,
+        "a refused key change still changed something"
+    );
+}
+
+/// Without `--confirm` the command is a reading, and leaves no trace.
+#[tokio::test]
+async fn a_key_change_without_confirmation_changes_nothing() {
+    let (_temp, config, state) = test_app().await;
+    let sealed = sealed_installation(&config, &state, "dry-run-owner").await;
+    let key_before = std::fs::read(&config.instance_key_path).unwrap();
+    stop_server(state).await;
+
+    waveflow_server::cli::key(
+        &config,
+        waveflow_server::cli::KeyCommand::Rotate(waveflow_server::cli::KeyArgs { confirm: false }),
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(
+        std::fs::read(&config.instance_key_path).unwrap(),
+        key_before,
+        "a reading replaced the key"
+    );
+    assert!(
+        !std::fs::read_dir(&config.data_dir).unwrap().any(|entry| {
+            entry
+                .unwrap()
+                .file_name()
+                .to_string_lossy()
+                .starts_with("pre-key-")
+        }),
+        "a reading left a recovery directory behind"
+    );
+
+    let state = waveflow_server::initialize(&config).await.unwrap();
+    assert!(
+        state
+            .services
+            .public_share(&sealed.share_token)
+            .await
+            .is_ok(),
+        "a reading moved the shares"
+    );
+    let credential = state
+        .services
+        .credential_by_username("dry-run-owner")
+        .await
+        .unwrap()
+        .expect("the credential must still be there");
+    assert_eq!(
+        state
+            .services
+            .decrypt_subsonic_password(&credential)
+            .ok()
+            .as_deref(),
+        Some(sealed.subsonic_password.as_bytes())
+    );
+}
+
+/// What the operator actually reads, reached the way they reach it.
+///
+/// Through the binary rather than through `cli::key`, because the subject here
+/// is the surface: the `key` group and its `--confirm` flag as clap parses
+/// them, and the two counts printed — the one read from the tables before the
+/// decision, and the one answered by the statements that carried it out. The
+/// in-process tests above hold what the commands *do*; nothing in them would
+/// notice `--confirm` renamed, or a count printed from the wrong field.
+#[tokio::test]
+async fn a_key_change_prints_what_it_costs_and_then_what_it_did() {
+    let (temp, config, state) = test_app().await;
+    sealed_installation(&config, &state, "printed-owner").await;
+    stop_server(state).await;
+    // Adoption refuses a key that still opens the database, so this is the
+    // situation it is for.
+    std::fs::remove_file(&config.instance_key_path).unwrap();
+
+    let reading = cli_command()
+        .current_dir(temp.path())
+        .env("WAVEFLOW_DATA_DIR", &config.data_dir)
+        .args(["key", "adopt"])
+        .output()
+        .unwrap();
+    let stdout = String::from_utf8(reading.stdout).unwrap();
+    let stderr = String::from_utf8(reading.stderr).unwrap();
+    assert!(reading.status.success(), "the reading failed: {stderr}");
+    for expected in [
+        "2 Subsonic credential(s) — deleted, password and `wfsk_` API key together",
+        "1 scrobbling link(s) — deleted, and the 3 queued listen(s) behind them",
+        "4 share(s) — kept, but every public URL changes",
+        "Nothing has been changed. Re-run with --confirm.",
+    ] {
+        assert!(
+            stdout.contains(expected),
+            "the reading never said {expected:?}; it said: {stdout}"
+        );
+    }
+    assert!(!config.instance_key_path.exists(), "a reading minted a key");
+
+    let done = cli_command()
+        .current_dir(temp.path())
+        .env("WAVEFLOW_DATA_DIR", &config.data_dir)
+        .args(["key", "adopt", "--confirm"])
+        .output()
+        .unwrap();
+    let stdout = String::from_utf8(done.stdout).unwrap();
+    let stderr = String::from_utf8(done.stderr).unwrap();
+    assert!(done.status.success(), "the adoption failed: {stderr}");
+    assert!(
+        stdout.contains(
+            "Done. 2 Subsonic credential(s) and 1 scrobbling link(s) deleted, \
+             with 3 queued listen(s); 4 share(s) re-addressed."
+        ),
+        "the closing line did not report the operation: {stdout}"
+    );
+    assert!(
+        config.instance_key_path.exists(),
+        "the adoption left no key behind"
+    );
+}
diff --git a/tests/cli/library.rs b/tests/cli/library.rs
new file mode 100644
index 00000000..842cd69a
--- /dev/null
+++ b/tests/cli/library.rs
@@ -0,0 +1,212 @@
+//! The library commands: a full rescan, and renaming, moving, purging and
+//! deleting a library.
+
+use super::*;
+
+/// RFC-018: an incremental scan skips a file whose size and modification time
+/// are unchanged, so the operator needs a way to have every file read again.
+/// The request is stored on every library and spent by its next scan.
+#[tokio::test]
+async fn database_rescan_full_asks_every_library_to_read_everything() {
+    let (_temp, config, state) = test_app().await;
+    let owner = inserted_account(&state, "rescan-owner", "admin").await;
+    let music = config.data_dir.join("rescan-music");
+    std::fs::create_dir_all(&music).unwrap();
+    let library = state
+        .db
+        .create_library(
+            owner,
+            "Rescan",
+            &std::fs::canonicalize(&music).unwrap(),
+            waveflow_server::storage::database::LibraryVisibility::Private,
+            waveflow_server::auth::authentication::now_ms(),
+        )
+        .await
+        .unwrap();
+    assert!(!state.db.full_scan_requested(library).await.unwrap());
+
+    run_cli(&state, &["database", "rescan-full"]).await.unwrap();
+
+    assert!(state.db.full_scan_requested(library).await.unwrap());
+}
+
+/// RFC-021 decision 5 from the command line: rename, move with its scan,
+/// purge the missing, and a deletion that refuses until the name is typed.
+#[tokio::test]
+async fn the_cli_renames_moves_purges_and_deletes_a_library() {
+    let (temp, config, state) = test_app().await;
+    let admin = inserted_account(&state, "lifecycle-admin", "admin").await;
+    let music = config.data_dir.join("lifecycle-music");
+    std::fs::create_dir_all(&music).unwrap();
+    write_test_wav(&music.join("Kept.wav"));
+    write_test_wav_of_len(&music.join("Gone.wav"), 900);
+    let root = std::fs::canonicalize(&music).unwrap();
+    let library = state
+        .db
+        .create_library(
+            admin,
+            "Lifecycle",
+            &root,
+            waveflow_server::storage::database::LibraryVisibility::Private,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let id = library.to_string();
+    scan_once(
+        &state,
+        admin,
+        waveflow_server::storage::catalog::LibraryRecord {
+            id: library,
+            name: "Lifecycle".into(),
+            root_path: root.clone(),
+        },
+    )
+    .await;
+
+    run_cli(
+        &state,
+        &[
+            "library",
+            "rename",
+            "--actor",
+            "lifecycle-admin",
+            "--library-id",
+            &id,
+            "--name",
+            "Renamed",
+        ],
+    )
+    .await
+    .unwrap();
+    assert_eq!(
+        count(
+            &state,
+            "SELECT COUNT(*) FROM library WHERE name = 'Renamed'"
+        )
+        .await,
+        1
+    );
+
+    // Moved with one file fewer: the scan the move queues finds it missing.
+    let moved = temp.path().join("lifecycle-moved");
+    std::fs::rename(&music, &moved).unwrap();
+    std::fs::remove_file(moved.join("Gone.wav")).unwrap();
+    let moved_text = moved.to_string_lossy().into_owned();
+    run_cli(
+        &state,
+        &[
+            "library",
+            "set-path",
+            "--actor",
+            "lifecycle-admin",
+            "--library-id",
+            &id,
+            "--path",
+            &moved_text,
+        ],
+    )
+    .await
+    .unwrap();
+    assert_eq!(
+        count(&state, "SELECT COUNT(*) FROM track WHERE is_available = 0").await,
+        1
+    );
+
+    let unnamed = run_cli(
+        &state,
+        &[
+            "library",
+            "purge",
+            "--actor",
+            "lifecycle-admin",
+            "--library-id",
+            &id,
+        ],
+    )
+    .await;
+    assert!(unnamed.is_err(), "a purge naming nothing must refuse");
+    run_cli(
+        &state,
+        &[
+            "library",
+            "purge",
+            "--actor",
+            "lifecycle-admin",
+            "--library-id",
+            &id,
+            "--all",
+        ],
+    )
+    .await
+    .unwrap();
+    assert_eq!(
+        count(&state, "SELECT COUNT(*) FROM track WHERE purged_at IS NULL").await,
+        1
+    );
+    // Within the grace window, a purge is taken back.
+    run_cli(
+        &state,
+        &[
+            "library",
+            "restore",
+            "--actor",
+            "lifecycle-admin",
+            "--library-id",
+            &id,
+            "--all",
+        ],
+    )
+    .await
+    .unwrap();
+    assert_eq!(
+        count(
+            &state,
+            "SELECT COUNT(*) FROM track WHERE purged_at IS NOT NULL"
+        )
+        .await,
+        0
+    );
+    assert_eq!(
+        count(&state, "SELECT COUNT(*) FROM track WHERE is_available = 0").await,
+        1
+    );
+
+    let mistyped = run_cli(
+        &state,
+        &[
+            "library",
+            "delete",
+            "--actor",
+            "lifecycle-admin",
+            "--library-id",
+            &id,
+            "--confirm",
+            "Lifecycle",
+        ],
+    )
+    .await;
+    assert!(
+        mistyped.is_err(),
+        "the old name must not confirm a deletion"
+    );
+    assert_eq!(count(&state, "SELECT COUNT(*) FROM library").await, 1);
+    run_cli(
+        &state,
+        &[
+            "library",
+            "delete",
+            "--actor",
+            "lifecycle-admin",
+            "--library-id",
+            &id,
+            "--confirm",
+            "Renamed",
+        ],
+    )
+    .await
+    .unwrap();
+    assert_eq!(count(&state, "SELECT COUNT(*) FROM library").await, 0);
+    assert_eq!(count(&state, "SELECT COUNT(*) FROM track").await, 0);
+    assert!(moved.join("Kept.wav").exists(), "a file was touched");
+}
diff --git a/tests/cli/main.rs b/tests/cli/main.rs
new file mode 100644
index 00000000..7c5568c0
--- /dev/null
+++ b/tests/cli/main.rs
@@ -0,0 +1,104 @@
+//! The command line: what an operator can do on a host with no browser.
+//!
+//! Split out of `service.rs`, which names probes, the embedded client and the
+//! backup bundle and had quietly accumulated these as well. A test belongs to
+//! the surface it exercises, and this one is reached by argv and answered on
+//! two streams — not by a request.
+
+use clap::Parser;
+use waveflow_server::auth::authentication::now_ms;
+
+// Not every target uses every fixture, and a shared module is not dead
+// code for being partly unused here.
+#[allow(dead_code)]
+#[path = "../support/mod.rs"]
+mod support;
+use support::*;
+
+/// One command line, parsed the way a shell would hand it over.
+///
+/// Through `Cli::parse_from` rather than by building the argument struct: the
+/// fields are private, which is the hint, and this way the flag names and the
+/// defaults are part of what these tests hold still. A command surface gets
+/// those wrong far more easily than it gets the call wrong.
+async fn run_cli(state: &waveflow_server::AppState, argv: &[&str]) -> anyhow::Result<()> {
+    let mut full = vec!["waveflow-server"];
+    full.extend_from_slice(argv);
+    let cli = waveflow_server::cli::Cli::try_parse_from(full)?;
+    waveflow_server::cli::execute(cli.command.expect("a command was given"), state).await
+}
+
+/// An account inserted rather than created, with a placeholder where a hash
+/// would be.
+///
+/// These never authenticate: the CLI resolves them by username and checks a
+/// role, and nothing in this file logs in as one. Calling
+/// `security::hash_password` for them would add another occurrence of the
+/// repository's fixture password, which CodeQL raises as a hard-coded
+/// credential on every new one — there are already seventy-seven of those
+/// dismissed on `main`, and adding to that pile for accounts that cannot log in
+/// would be spending somebody else's attention.
+async fn inserted_account(
+    state: &waveflow_server::AppState,
+    username: &str,
+    role: &str,
+) -> uuid::Uuid {
+    let id = uuid::Uuid::new_v4();
+    let now = now_ms();
+    sqlx::query(
+        "INSERT INTO account (id, username, password_hash, role, disabled, created_at, updated_at) \
+         VALUES (?, ?, 'this-account-never-authenticates', ?, 0, ?, ?)",
+    )
+    .bind(id.to_string())
+    .bind(username)
+    .bind(role)
+    .bind(now)
+    .bind(now)
+    .execute(state.db.pool())
+    .await
+    .unwrap();
+    id
+}
+
+/// The binary, with nothing `WAVEFLOW_*` inherited from whoever ran the suite.
+///
+/// `Config::from_env` runs before anything else and verifies the FFmpeg paths
+/// it finds there, so one stray `WAVEFLOW_FFPROBE_PATH` on a developer's
+/// machine fails these commands before they reach a single assertion. A test
+/// that passes or fails on the environment of the person running it is
+/// measuring that, and not the code.
+///
+/// Not `env_clear`: on Windows that takes `SystemRoot` with it, and the process
+/// then cannot start at all. Only this server's own namespace is removed, and
+/// each caller puts back the variables its command actually needs.
+///
+/// Matched without regard to case, because Windows keeps the name as it was
+/// first spelled and resolves it case-insensitively: `set waveflow_ffprobe_path`
+/// stores that spelling, `std::env::var("WAVEFLOW_FFPROBE_PATH")` in the child
+/// still finds it, and an exact-case filter would walk straight past it. On Unix
+/// the two are different variables and only the upper one is ever read, so
+/// dropping the other costs nothing.
+fn cli_command() -> std::process::Command {
+    let mut command = std::process::Command::new(env!("CARGO_BIN_EXE_waveflow-server"));
+    for (name, _) in std::env::vars_os() {
+        if name
+            .to_string_lossy()
+            .to_ascii_uppercase()
+            .starts_with("WAVEFLOW_")
+        {
+            command.env_remove(name);
+        }
+    }
+    command
+}
+
+async fn count(state: &waveflow_server::AppState, query: &'static str) -> i64 {
+    sqlx::query_scalar::<_, i64>(query)
+        .fetch_one(state.db.pool())
+        .await
+        .unwrap()
+}
+
+mod key;
+mod library;
+mod scrobbling;
diff --git a/tests/cli/scrobbling.rs b/tests/cli/scrobbling.rs
new file mode 100644
index 00000000..07b8ba19
--- /dev/null
+++ b/tests/cli/scrobbling.rs
@@ -0,0 +1,511 @@
+//! The scrobbling commands: the queue, authorisations, destinations and the
+//! secrets they mint.
+
+use super::*;
+
+/// The CLI reads a queue and withdraws an authorisation, and says which
+/// variable it wanted when the token is not there.
+///
+/// **Named for what it does.** It was called `..._links_and_unlinks_...` while
+/// the link itself was posed through `DomainServices` — so it would have passed
+/// with `cli::link_scrobble` deleted, which is the defect class this file's
+/// commit set out to remove, reintroduced one file over.
+///
+/// What `link` *is* covered for: the admin check, the account lookup and the
+/// provider parse, all of which run before the secret is read, and which the
+/// absent-variable case below therefore traverses. What it is not covered for is
+/// the two lines after that — the successful `read_secret_env` and the service
+/// call. Driving those from here would need the process environment mutated
+/// while sibling threads read it, which is the race this test exists without.
+/// `a_minted_secret_leaves_on_standard_output_by_itself`, below, closes it with
+/// a subprocess against `CARGO_BIN_EXE_waveflow-server`, where an environment
+/// variable reaches the command without any sibling thread reading it.
+#[tokio::test]
+async fn the_cli_reads_a_queue_and_withdraws_an_authorisation() {
+    let (_temp, _config, state) = test_app().await;
+    inserted_account(&state, "cli-scrobble-admin", "admin").await;
+    let user = inserted_account(&state, "cli-scrobble-user", "user").await;
+
+    // **No `set_var` here, and that is the whole design of this test.** A review
+    // pointed out that a unique variable name solves collision and not the
+    // race: `cargo test` runs these as threads in one process, and mutating the
+    // environment while a sibling thread reads it — `tempfile::tempdir()` reads
+    // `TMPDIR` on every one of them — is undefined behaviour, which is why
+    // edition 2024 made `set_var` unsafe. So `link` is exercised at the one
+    // seam that needs no environment at all: a variable that is *absent*, which
+    // is the default state of the process.
+    let missing = run_cli(
+        &state,
+        &[
+            "scrobble",
+            "link",
+            "--actor",
+            "cli-scrobble-admin",
+            "--username",
+            "cli-scrobble-user",
+            "--provider",
+            "listenbrainz",
+            "--destination",
+            "default",
+            "--token-env",
+            "WAVEFLOW_TEST_TOKEN_THAT_IS_NEVER_SET",
+        ],
+    )
+    .await
+    .unwrap_err();
+    // Naming the variable is the whole job of that message: the person who has
+    // to fix this cannot see which one the command looked for.
+    assert!(
+        missing
+            .to_string()
+            .contains("WAVEFLOW_TEST_TOKEN_THAT_IS_NEVER_SET"),
+        "{missing}"
+    );
+
+    // And the flag surface is pinned by parsing rather than by running, so the
+    // names and the default are held still without the process being touched.
+    let parsed = format!(
+        "{:?}",
+        waveflow_server::cli::Cli::try_parse_from([
+            "waveflow-server",
+            "scrobble",
+            "link",
+            "--actor",
+            "a",
+            "--username",
+            "b",
+            "--provider",
+            "listenbrainz",
+            "--destination",
+            "default",
+        ])
+        .expect("the scrobble link flags have to parse — that is what this pins")
+        .command
+        .unwrap()
+    );
+    assert!(parsed.contains("WAVEFLOW_SCROBBLE_TOKEN"), "{parsed}");
+
+    // The link itself is posed through the service, which is what the command
+    // calls anyway — the assertions below then read it back the same way.
+    state
+        .services
+        .link_scrobble(
+            user,
+            waveflow_server::services::ScrobbleProvider::ListenBrainz,
+            "default",
+            "lb-token-from-the-shell",
+        )
+        .await
+        .unwrap();
+
+    let links = state.services.scrobble_links(user).await.unwrap();
+    assert_eq!(links.len(), 1);
+    assert_eq!(links[0].provider.as_str(), "listenbrainz");
+    assert_eq!(links[0].health, "healthy");
+
+    // Reading the queue is a third gesture and must not need the secret.
+    run_cli(
+        &state,
+        &[
+            "scrobble",
+            "status",
+            "--actor",
+            "cli-scrobble-admin",
+            "--username",
+            "cli-scrobble-user",
+        ],
+    )
+    .await
+    .unwrap();
+
+    run_cli(
+        &state,
+        &[
+            "scrobble",
+            "unlink",
+            "--actor",
+            "cli-scrobble-admin",
+            "--username",
+            "cli-scrobble-user",
+            "--provider",
+            "listenbrainz",
+            "--destination",
+            "default",
+        ],
+    )
+    .await
+    .unwrap();
+    assert!(state
+        .services
+        .scrobble_links(user)
+        .await
+        .unwrap()
+        .is_empty());
+}
+
+/// What the command refuses, and who it refuses.
+///
+/// Both failures happen before any secret is read or sealed, which is the point
+/// of checking them: a destination this server cannot name and an actor who is
+/// not an administrator are both answered by the command rather than by the
+/// database refusing a `CHECK` afterwards.
+#[tokio::test]
+async fn the_cli_refuses_an_unknown_destination_and_a_non_administrator() {
+    let (_temp, _config, state) = test_app().await;
+    inserted_account(&state, "cli-refusing-admin", "admin").await;
+    inserted_account(&state, "cli-refusing-user", "user").await;
+
+    let unknown = run_cli(
+        &state,
+        &[
+            "scrobble",
+            "unlink",
+            "--actor",
+            "cli-refusing-admin",
+            "--username",
+            "cli-refusing-user",
+            "--provider",
+            "spotify",
+            "--destination",
+            "default",
+        ],
+    )
+    .await
+    .unwrap_err();
+    // The message names the three this server knows, because the person who
+    // typed the fourth cannot be expected to guess them.
+    let said = unknown.to_string();
+    assert!(said.contains("listenbrainz"), "{said}");
+    assert!(said.contains("maloja"), "{said}");
+    assert!(said.contains("lastfm"), "{said}");
+
+    // An ordinary account cannot pose an authorisation for somebody else, which
+    // is the whole difference between this surface and the self-scoped route.
+    let forbidden = run_cli(
+        &state,
+        &[
+            "scrobble",
+            "status",
+            "--actor",
+            "cli-refusing-user",
+            "--username",
+            "cli-refusing-user",
+        ],
+    )
+    .await
+    .unwrap_err();
+    assert!(
+        forbidden.to_string().contains("administrator"),
+        "{forbidden}"
+    );
+
+    // **Admin before secret, and nothing else pins it.** `link` checks the
+    // admin, resolves the account, parses the provider, and only then reads the
+    // secret. The absent-variable case above traverses all four but asserts
+    // about the last, so hoisting `read_secret_env` to the top of
+    // `link_scrobble` would leave every CLI test green. This is what notices.
+    //
+    // It pins that one edge and not the whole order: moving the read between
+    // the admin check and the account lookup still fails the admin first, and
+    // this would stay green. Said plainly rather than claimed wider.
+    let too_early = run_cli(
+        &state,
+        &[
+            "scrobble",
+            "link",
+            "--actor",
+            "cli-refusing-user",
+            "--username",
+            "cli-refusing-user",
+            "--provider",
+            "listenbrainz",
+            "--destination",
+            "default",
+            "--token-env",
+            "WAVEFLOW_TEST_TOKEN_THAT_IS_NEVER_SET",
+        ],
+    )
+    .await
+    .unwrap_err();
+    let said = too_early.to_string();
+    assert!(said.contains("administrator"), "{said}");
+    assert!(
+        !said.contains("WAVEFLOW_TEST_TOKEN_THAT_IS_NEVER_SET"),
+        "the token lookup must not have happened yet"
+    );
+}
+
+/// Every secret the CLI mints goes to standard output alone, prose elsewhere.
+///
+/// Through a subprocess because that is the only place the two streams are
+/// separable: `cli::execute` called in-process writes both into the test
+/// harness's own output, where nothing can tell them apart. This is the gap
+/// `the_cli_reads_a_queue_and_withdraws_an_authorisation` names and leaves open.
+///
+/// What it buys is not tidiness. `token create … > secret` now yields a file
+/// holding the token and nothing else, so the one copy of a freshly minted
+/// secret need never be lifted out of a terminal that keeps its scrollback.
+#[tokio::test]
+async fn a_minted_secret_leaves_on_standard_output_by_itself() {
+    let (temp, config, state) = test_app().await;
+    inserted_account(&state, "stream-split-admin", "admin").await;
+    inserted_account(&state, "stream-split-user", "user").await;
+    // Closed before the subprocess opens the same database: one writer at a
+    // time is this server's rule between threads, and it is no weaker between
+    // processes.
+    state.db.pool().close().await;
+
+    let run = cli_command()
+        .current_dir(temp.path())
+        .env("WAVEFLOW_DATA_DIR", &config.data_dir)
+        .args([
+            "token",
+            "create",
+            "--actor",
+            "stream-split-admin",
+            "--username",
+            "stream-split-user",
+            "--name",
+            "a name for the listing",
+            "--scopes",
+            "library:read",
+        ])
+        .output()
+        .unwrap();
+    let stdout = String::from_utf8(run.stdout).unwrap();
+    let stderr = String::from_utf8(run.stderr).unwrap();
+    assert!(
+        run.status.success(),
+        "minting a token failed; its diagnostics were: {stderr}"
+    );
+    // One line, and that line is the token. Counted before trimming: trimming
+    // first would fold `token\n\n` into `token` and call it one line, and a
+    // blank line after a secret is exactly the kind of stray output this is
+    // here to notice.
+    let lines: Vec<&str> = stdout.lines().collect();
+    assert_eq!(
+        lines.len(),
+        1,
+        "standard output should hold one line, and held: {lines:?}"
+    );
+    let token = lines[0];
+    assert!(
+        token.starts_with("wfapi_"),
+        "standard output should hold the token itself, not a sentence about it"
+    );
+
+    // The prose is on the other stream, and — the point of the whole change —
+    // the secret is not repeated there. A split that announced the token on
+    // both streams would pass every assertion above and protect nobody.
+    assert!(
+        stderr.contains("stream-split-user"),
+        "the human-readable half should say whose token this is"
+    );
+    assert!(
+        !stderr.contains(token),
+        "standard error must not repeat the secret"
+    );
+
+    // The other site that mints a secret, split the same way — and reached
+    // through the same subprocess, which is also what lets the password arrive
+    // in an environment variable without racing the sibling threads that read
+    // the process environment in-process.
+    let run = cli_command()
+        .current_dir(temp.path())
+        .env("WAVEFLOW_DATA_DIR", &config.data_dir)
+        .env("WAVEFLOW_SUBSONIC_PASSWORD", "a long enough password")
+        .args([
+            "credential",
+            "set",
+            "--actor",
+            "stream-split-admin",
+            "--username",
+            "stream-split-user",
+        ])
+        .output()
+        .unwrap();
+    let stdout = String::from_utf8(run.stdout).unwrap();
+    let stderr = String::from_utf8(run.stderr).unwrap();
+    assert!(
+        run.status.success(),
+        "setting a credential failed; its diagnostics were: {stderr}"
+    );
+    let lines: Vec<&str> = stdout.lines().collect();
+    assert_eq!(
+        lines.len(),
+        1,
+        "standard output should hold one line, and held: {lines:?}"
+    );
+    let api_key = lines[0];
+    assert!(
+        api_key.starts_with("wfsk_"),
+        "standard output should hold the API key and nothing else"
+    );
+    assert!(
+        !stderr.contains(api_key),
+        "standard error must not repeat the API key"
+    );
+    // The password it was handed is a secret too, and nothing prints it.
+    assert!(
+        !stderr.contains("a long enough password") && !stdout.contains("a long enough password"),
+        "neither stream may echo the password it was given"
+    );
+}
+
+/// A double for the half of the Last.fm protocol that would leave this machine.
+///
+/// Small and local rather than shared with `tests/scrobbling/lastfm_journey.rs`: what this
+/// file needs is an exchange that exists, and a token it can recognise coming
+/// back out.
+struct Approves;
+
+impl waveflow_server::services::LastFmSessionExchange for Approves {
+    fn exchange<'a>(
+        &'a self,
+        token: &'a str,
+    ) -> futures_util::future::BoxFuture<'a, Result<String, waveflow_server::services::ServiceError>>
+    {
+        Box::pin(async move { Ok(format!("session-for-{token}")) })
+    }
+
+    fn request_token<'a>(
+        &'a self,
+    ) -> futures_util::future::BoxFuture<
+        'a,
+        Result<waveflow_server::services::LastFmApproval, waveflow_server::services::ServiceError>,
+    > {
+        Box::pin(async move {
+            Ok(waveflow_server::services::LastFmApproval {
+                authorize_url: "https://www.last.fm/api/auth/?api_key=k&token=t".to_owned(),
+                token: "t".to_owned(),
+            })
+        })
+    }
+}
+
+/// Last.fm, from a host with no browser on it — which is this file's premise.
+///
+/// `link` cannot serve here: Last.fm hands out no secret a person can paste,
+/// so the two commands split where the person has to leave and come back.
+/// `authorize` writes nothing down — the request token is Last.fm's, and it
+/// expires on Last.fm's clock — which is why this test can assert that running
+/// it leaves the account exactly as unlinked as it found it.
+///
+/// `exchange` is exercised at the seam that needs no environment, for the
+/// reason the test above gives at length: mutating the process environment
+/// while sibling threads read it is the race this file exists without.
+#[tokio::test]
+async fn the_cli_authorises_last_fm_without_a_browser() {
+    let (_temp, _config, state) = test_app().await;
+    inserted_account(&state, "cli-lastfm-admin", "admin").await;
+    let user = inserted_account(&state, "cli-lastfm-user", "user").await;
+    state.services.register_lastfm_exchange(
+        "default",
+        std::sync::Arc::new(Approves)
+            as std::sync::Arc<dyn waveflow_server::services::LastFmSessionExchange>,
+    );
+
+    // The whole first command, end to end: it needs no secret from the
+    // environment, so nothing here has to be mutated for it to run.
+    run_cli(
+        &state,
+        &[
+            "scrobble",
+            "authorize",
+            "--actor",
+            "cli-lastfm-admin",
+            "--username",
+            "cli-lastfm-user",
+            "--destination",
+            "default",
+        ],
+    )
+    .await
+    .unwrap();
+
+    // And it left nothing behind. Asking Last.fm for a token is not half a
+    // link: an authorisation nobody completes has to cost this account
+    // nothing, and there is no row of ours for a purge to have to find.
+    assert!(state
+        .services
+        .scrobble_links(user)
+        .await
+        .unwrap()
+        .is_empty());
+
+    // An instance nobody declared is refused, and by the command rather than
+    // by the service being lenient.
+    assert!(run_cli(
+        &state,
+        &[
+            "scrobble",
+            "authorize",
+            "--actor",
+            "cli-lastfm-admin",
+            "--username",
+            "cli-lastfm-user",
+            "--destination",
+            "not-declared",
+        ],
+    )
+    .await
+    .is_err());
+
+    let missing = run_cli(
+        &state,
+        &[
+            "scrobble",
+            "exchange",
+            "--actor",
+            "cli-lastfm-admin",
+            "--username",
+            "cli-lastfm-user",
+            "--destination",
+            "default",
+            "--token-env",
+            "WAVEFLOW_TEST_LASTFM_TOKEN_THAT_IS_NEVER_SET",
+        ],
+    )
+    .await
+    .unwrap_err();
+    assert!(
+        missing
+            .to_string()
+            .contains("WAVEFLOW_TEST_LASTFM_TOKEN_THAT_IS_NEVER_SET"),
+        "{missing}"
+    );
+
+    // The flag surface, pinned by parsing rather than by running — including
+    // the default variable name, which is what an operator reads in `--help`
+    // and types into their shell.
+    let parsed = format!(
+        "{:?}",
+        waveflow_server::cli::Cli::try_parse_from([
+            "waveflow-server",
+            "scrobble",
+            "exchange",
+            "--actor",
+            "a",
+            "--username",
+            "b",
+            "--destination",
+            "default",
+        ])
+        .expect("the scrobble exchange flags have to parse — that is what this pins")
+        .command
+        .unwrap()
+    );
+    assert!(parsed.contains("WAVEFLOW_LASTFM_TOKEN"), "{parsed}");
+
+    // The second half, through the service the command calls: the token comes
+    // back, and the link is made under the session key it was exchanged for.
+    state
+        .services
+        .complete_lastfm_approval(user, "default", "t")
+        .await
+        .unwrap();
+    let links = state.services.scrobble_links(user).await.unwrap();
+    assert_eq!(links.len(), 1);
+    assert_eq!(links[0].provider.as_str(), "lastfm");
+    assert_eq!(links[0].destination, "default");
+}
diff --git a/tests/credits.rs b/tests/credits.rs
deleted file mode 100644
index 284e04ea..00000000
--- a/tests/credits.rs
+++ /dev/null
@@ -1,1094 +0,0 @@
-//! Splitting a joined artist credit, by decision, and "Needs attention"
-//! (RFC-015).
-//!
-//! The accounts here are rows written by hand and reach the routes through an
-//! API token, as in `tests/catalog/listings.rs`: nothing in this target authenticates
-//! with a password, so nothing in it hands a literal to a hash.
-
-#[allow(dead_code)]
-mod support;
-
-use axum::body::Body;
-use axum::http::{Request, StatusCode};
-use serde_json::json;
-use support::*;
-use tower::ServiceExt;
-use uuid::Uuid;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::catalog::CatalogTrackInput;
-use waveflow_server::database::{LibraryRole, LibraryVisibility};
-use waveflow_server::services::{
-    AttentionCategory, BrowsePage, CreditDecisionKind, TrackMetadataPatch,
-};
-use waveflow_server::AppState;
-
-/// One credited row: track, role, position, name, sort form.
-type Row = (String, String, i64, String, Option<String>);
-
-struct Shelf {
-    state: AppState,
-    config: waveflow_server::Config,
-    owner: Uuid,
-    library: Uuid,
-    scan: Uuid,
-    _temp: tempfile::TempDir,
-}
-
-async fn account(state: &AppState, name: &str) -> Uuid {
-    let id = Uuid::new_v4();
-    let now = now_ms();
-    sqlx::query(
-        "INSERT INTO account (id, username, password_hash, role, disabled, created_at, updated_at) \
-         VALUES (?, ?, 'this-account-never-authenticates', 'admin', 0, ?, ?)",
-    )
-    .bind(id.to_string())
-    .bind(name)
-    .bind(now)
-    .bind(now)
-    .execute(state.db.pool())
-    .await
-    .unwrap();
-    id
-}
-
-async fn shelf(name: &str) -> Shelf {
-    let (temp, config, state) = test_app().await;
-    let owner = account(&state, name).await;
-    let music = config.data_dir.join(name);
-    std::fs::create_dir_all(&music).unwrap();
-    let library = state
-        .db
-        .create_library(
-            owner,
-            name,
-            &std::fs::canonicalize(&music).unwrap(),
-            LibraryVisibility::Private,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let scan = state
-        .db
-        .create_scan_job(library, Some(owner), "manual")
-        .await
-        .unwrap();
-    state.db.start_scan_job(scan, 1, false).await.unwrap();
-    Shelf {
-        state,
-        config,
-        owner,
-        library,
-        scan,
-        _temp: temp,
-    }
-}
-
-/// A file crediting `artist`, on its own album unless one is named, with no
-/// album-artist tag and no compilation flag: the album then hangs off the
-/// track's own credit, which is the case a split could have moved.
-fn file(index: usize, artist: &str, album: Option<&str>) -> CatalogTrackInput {
-    let mut input = catalog_input(index, artist);
-    input.title = format!("Track {index}");
-    input.album = album.map(str::to_owned);
-    input.is_compilation = false;
-    input.genre = None;
-    input
-}
-
-impl Shelf {
-    async fn apply(&self, input: &CatalogTrackInput) {
-        let existing: Option<String> =
-            sqlx::query_scalar("SELECT id FROM track WHERE library_id = ? AND relative_path = ?")
-                .bind(self.library.to_string())
-                .bind(&input.relative_path)
-                .fetch_optional(self.state.db.pool())
-                .await
-                .unwrap();
-        self.state
-            .db
-            .apply_catalog_track(
-                self.library,
-                self.scan,
-                input,
-                existing.map(|id| Uuid::parse_str(&id).unwrap()),
-                false,
-            )
-            .await
-            .unwrap();
-    }
-
-    /// The end of a scan, in the scanner's order: sort names first, because
-    /// the derivations index each artist with its sort name.
-    async fn settle(&self) {
-        self.state
-            .db
-            .consolidate_sort_names(self.library)
-            .await
-            .unwrap();
-        self.state
-            .db
-            .consolidate_catalog_derivations(self.library)
-            .await
-            .unwrap();
-    }
-
-    async fn artist(&self, name: &str) -> Uuid {
-        let id: String =
-            sqlx::query_scalar("SELECT id FROM artist WHERE library_id = ? AND name = ?")
-                .bind(self.library.to_string())
-                .bind(name)
-                .fetch_one(self.state.db.pool())
-                .await
-                .unwrap_or_else(|_| panic!("no artist named {name:?}"));
-        Uuid::parse_str(&id).unwrap()
-    }
-
-    async fn artist_names(&self) -> Vec<String> {
-        sqlx::query_scalar("SELECT name FROM artist WHERE library_id = ? ORDER BY name")
-            .bind(self.library.to_string())
-            .fetch_all(self.state.db.pool())
-            .await
-            .unwrap()
-    }
-
-    async fn split(&self, name: &str) -> Uuid {
-        let artist = self.artist(name).await;
-        self.state
-            .services
-            .decide_credit(self.owner, self.library, artist, CreditDecisionKind::Split)
-            .await
-            .unwrap()
-            .id
-    }
-
-    async fn undo(&self, decision: Uuid) {
-        self.state
-            .services
-            .remove_credit_decision(self.owner, self.library, decision)
-            .await
-            .unwrap();
-    }
-
-    /// Every credited row of the library, by file, role and position.
-    async fn rows(&self) -> Vec<Row> {
-        sqlx::query_as(
-            "SELECT t.relative_path, tp.role, tp.position, ar.name, tp.sort_name \
-             FROM track_participant tp JOIN track t ON t.id = tp.track_id \
-             JOIN artist ar ON ar.id = tp.artist_id \
-             WHERE t.library_id = ? ORDER BY t.relative_path, tp.role, tp.position",
-        )
-        .bind(self.library.to_string())
-        .fetch_all(self.state.db.pool())
-        .await
-        .unwrap()
-    }
-
-    /// One file's names in one role, in order.
-    async fn credited(&self, index: usize, role: &str) -> Vec<String> {
-        sqlx::query_scalar(
-            "SELECT ar.name FROM track_participant tp JOIN track t ON t.id = tp.track_id \
-             JOIN artist ar ON ar.id = tp.artist_id \
-             WHERE t.library_id = ? AND t.relative_path = ? AND tp.role = ? \
-             ORDER BY tp.position",
-        )
-        .bind(self.library.to_string())
-        .bind(format!("track-{index}.flac"))
-        .bind(role)
-        .fetch_all(self.state.db.pool())
-        .await
-        .unwrap()
-    }
-
-    async fn token(&self, user: Uuid, name: &str) -> String {
-        self.state
-            .services
-            .create_api_token(user, &[], name, "credit decisions", &[])
-            .await
-            .unwrap()
-            .1
-    }
-}
-
-fn names(values: &[&str]) -> Vec<String> {
-    values.iter().map(|value| (*value).to_owned()).collect()
-}
-
-#[tokio::test]
-async fn a_split_lands_on_the_artists_the_parts_name() {
-    let shelf = shelf("split-lands").await;
-    shelf
-        .apply(&file(0, "Ashreveal, Ashish Swargiary", Some("Duo")))
-        .await;
-    shelf.apply(&file(1, "Ashreveal", Some("Solo"))).await;
-    shelf.settle().await;
-    let solo = shelf.artist("Ashreveal").await;
-
-    shelf.split("Ashreveal, Ashish Swargiary").await;
-
-    assert_eq!(
-        shelf.credited(0, "artist").await,
-        names(&["Ashreveal", "Ashish Swargiary"])
-    );
-    assert_eq!(
-        shelf.artist("Ashreveal").await,
-        solo,
-        "the split credit lands on the artist the solo tracks already name"
-    );
-    assert_eq!(
-        shelf.artist_names().await,
-        names(&["Ashish Swargiary", "Ashreveal"]),
-        "the joined artist is swept once nothing credits it"
-    );
-}
-
-#[tokio::test]
-async fn an_album_keeps_its_id_through_a_split() {
-    let shelf = shelf("album-keeps").await;
-    shelf
-        .apply(&file(0, "Zedd, Alessia Cara", Some("Stay")))
-        .await;
-    shelf.settle().await;
-    let before: (String, String) =
-        sqlx::query_as("SELECT id, album_artist_name FROM album WHERE library_id = ?")
-            .bind(shelf.library.to_string())
-            .fetch_one(shelf.state.db.pool())
-            .await
-            .unwrap();
-
-    shelf.split("Zedd, Alessia Cara").await;
-    // Right after the decision, and again after the scan that reads the file
-    // afterwards: the decision's own pass and the scan each write the album.
-    for moment in ["after the decision", "after a rescan"] {
-        if moment == "after a rescan" {
-            shelf
-                .apply(&file(0, "Zedd, Alessia Cara", Some("Stay")))
-                .await;
-            shelf.settle().await;
-        }
-        let after: Vec<(String, String, String)> = sqlx::query_as(
-            "SELECT id, album_artist_name, album_artist_id FROM album WHERE library_id = ?",
-        )
-        .bind(shelf.library.to_string())
-        .fetch_all(shelf.state.db.pool())
-        .await
-        .unwrap();
-        assert_eq!(
-            after.len(),
-            1,
-            "{moment}: one album, not a second one minted beside it"
-        );
-        assert_eq!(
-            (after[0].0.clone(), after[0].1.clone()),
-            before,
-            "{moment}: the album's id and display stay what the file said"
-        );
-        assert_eq!(
-            after[0].2,
-            shelf.artist("Zedd").await.to_string(),
-            "{moment}: the album hangs off the first part"
-        );
-        assert_eq!(
-            shelf.credited(0, "albumartist").await,
-            names(&["Zedd", "Alessia Cara"]),
-            "{moment}"
-        );
-    }
-}
-
-#[tokio::test]
-async fn a_scan_applies_a_decision_to_every_file_it_reads() {
-    let shelf = shelf("scan-applies").await;
-    shelf
-        .apply(&file(0, "Ice Spice, Central Cee", Some("Did It First")))
-        .await;
-    shelf.settle().await;
-    shelf.split("Ice Spice, Central Cee").await;
-
-    // A file the scan reads for the first time, and one it reads again
-    // because it changed: both come back split, which the desktop's own
-    // split never survived.
-    shelf
-        .apply(&file(1, "Ice Spice, Central Cee", Some("Single")))
-        .await;
-    let mut changed = file(0, "Ice Spice, Central Cee", Some("Did It First"));
-    changed.modified_at += 1;
-    changed.title = "Did It First (retagged)".into();
-    shelf.apply(&changed).await;
-    shelf.settle().await;
-
-    for index in [0, 1] {
-        assert_eq!(
-            shelf.credited(index, "artist").await,
-            names(&["Ice Spice", "Central Cee"]),
-            "file {index}"
-        );
-    }
-    assert!(
-        !shelf
-            .artist_names()
-            .await
-            .contains(&"Ice Spice, Central Cee".to_owned()),
-        "no scan brings the joined artist back"
-    );
-}
-
-#[tokio::test]
-async fn an_undo_restores_what_a_scan_without_the_decision_writes() {
-    let shelf = shelf("undo-restores").await;
-    let mut lead = file(0, "X, Y", Some("Pair"));
-    lead.sort_artist = Some("Xsort, Ysort".into());
-    shelf.apply(&lead).await;
-    shelf.apply(&file(1, "Z feat. X, Y", Some("Guest"))).await;
-    shelf.settle().await;
-    let whole = shelf.rows().await;
-
-    let decision = shelf.split("X, Y").await;
-    let split = shelf.rows().await;
-    assert_ne!(split, whole);
-    // A rescan of the same files writes exactly what the decision wrote.
-    shelf.apply(&lead).await;
-    shelf.apply(&file(1, "Z feat. X, Y", Some("Guest"))).await;
-    shelf.settle().await;
-    assert_eq!(shelf.rows().await, split, "a split and a rescan agree");
-
-    shelf.undo(decision).await;
-    assert_eq!(shelf.rows().await, whole, "the undo is a scan without it");
-    assert!(shelf.artist_names().await.contains(&"X, Y".to_owned()));
-    assert!(shelf
-        .state
-        .services
-        .credit_decisions(shelf.owner, shelf.library)
-        .await
-        .unwrap()
-        .is_empty());
-}
-
-#[tokio::test]
-async fn two_credits_sharing_a_part_keep_the_files_order_whichever_is_undone() {
-    let shelf = shelf("shared-part").await;
-    let mut both = file(0, "ignored", Some("Shared"));
-    // The plural tag is never cut by the first step, so each value is one
-    // credit and the two share their first fragment. Out of alphabetical
-    // order on purpose, at every level: an order taken from the names rather
-    // than from the file would put every list below the other way round.
-    both.artists = names(&["Z, Y", "Z, X"]);
-    shelf.apply(&both).await;
-    shelf.settle().await;
-
-    let first = shelf.split("Z, Y").await;
-    let second = shelf.split("Z, X").await;
-    assert_eq!(shelf.credited(0, "artist").await, names(&["Z", "Y", "X"]));
-
-    shelf.undo(second).await;
-    assert_eq!(
-        shelf.credited(0, "artist").await,
-        names(&["Z", "Y", "Z, X"])
-    );
-
-    let second = shelf.split("Z, X").await;
-    shelf.undo(first).await;
-    assert_eq!(
-        shelf.credited(0, "artist").await,
-        names(&["Z, Y", "Z", "X"]),
-        "the order is the file's, not what the shared part became"
-    );
-    shelf.undo(second).await;
-    assert_eq!(shelf.credited(0, "artist").await, names(&["Z, Y", "Z, X"]));
-}
-
-#[tokio::test]
-async fn a_correction_survives_a_split_and_a_rescan() {
-    let shelf = shelf("correction-final").await;
-    let mut input = file(0, "Hanumankind, Kalmi", Some("Big Dawgs"));
-    input.album_artist = Some("Hanumankind, Kalmi".into());
-    shelf.apply(&input).await;
-    shelf.settle().await;
-    let track: String = sqlx::query_scalar("SELECT id FROM track WHERE library_id = ?")
-        .bind(shelf.library.to_string())
-        .fetch_one(shelf.state.db.pool())
-        .await
-        .unwrap();
-    shelf
-        .state
-        .services
-        .set_track_metadata(
-            shelf.owner,
-            Uuid::parse_str(&track).unwrap(),
-            TrackMetadataPatch {
-                artists: Some(Some(names(&["Hanumankind, Kalmi"]))),
-                ..TrackMetadataPatch::default()
-            },
-            None,
-        )
-        .await
-        .unwrap();
-
-    shelf.split("Hanumankind, Kalmi").await;
-    // Right after the decision, whose own pass rewrites the track, and after
-    // the scan that reads the file again: each could undo the correction.
-    for moment in ["after the decision", "after a rescan"] {
-        if moment == "after a rescan" {
-            shelf.apply(&input).await;
-            shelf.settle().await;
-        }
-        assert_eq!(
-            shelf.credited(0, "artist").await,
-            names(&["Hanumankind, Kalmi"]),
-            "{moment}: a list someone typed is final"
-        );
-        assert_eq!(
-            shelf.credited(0, "albumartist").await,
-            names(&["Hanumankind", "Kalmi"]),
-            "{moment}: the roles the correction does not cover still follow the decision"
-        );
-    }
-}
-
-#[tokio::test]
-async fn a_split_keeps_each_parts_sort_form() {
-    let shelf = shelf("sort-forms").await;
-    let mut input = file(0, "A, B, B, C", Some("Sorted"));
-    input.sort_artist = Some("a, b, b, c".into());
-    shelf.apply(&input).await;
-    shelf.settle().await;
-
-    shelf.split("A, B, B, C").await;
-
-    let sorts: Vec<(String, Option<String>)> = sqlx::query_as(
-        "SELECT ar.name, tp.sort_name FROM track_participant tp \
-         JOIN artist ar ON ar.id = tp.artist_id \
-         WHERE tp.library_id = ? AND tp.role = 'artist' ORDER BY tp.position",
-    )
-    .bind(shelf.library.to_string())
-    .fetch_all(shelf.state.db.pool())
-    .await
-    .unwrap();
-    assert_eq!(
-        sorts,
-        vec![
-            ("A".to_owned(), Some("a".to_owned())),
-            ("B".to_owned(), Some("b".to_owned())),
-            ("C".to_owned(), Some("c".to_owned())),
-        ]
-    );
-    // And the artists themselves carry them, in the search index as well:
-    // the index is rebuilt from the artist rows, so the sort names have to be
-    // voted before it is, as at the end of a scan.
-    let indexed: Vec<(String, String, String)> = sqlx::query_as(
-        "SELECT ar.name, COALESCE(ar.sort_name, ''), fts.sort_name FROM artist ar          JOIN artist_fts fts ON fts.artist_id = ar.id          WHERE ar.library_id = ? ORDER BY ar.name",
-    )
-    .bind(shelf.library.to_string())
-    .fetch_all(shelf.state.db.pool())
-    .await
-    .unwrap();
-    assert_eq!(
-        indexed,
-        vec![
-            ("A".to_owned(), "a".to_owned(), "a".to_owned()),
-            ("B".to_owned(), "b".to_owned(), "b".to_owned()),
-            ("C".to_owned(), "c".to_owned(), "c".to_owned()),
-        ]
-    );
-}
-
-#[tokio::test]
-async fn a_retagged_spelling_is_still_split_and_still_undone() {
-    let shelf = shelf("retagged").await;
-    shelf
-        .apply(&file(0, "Drake, Lil Durk", Some("Laugh Now")))
-        .await;
-    shelf.settle().await;
-    let decision = shelf.split("Drake, Lil Durk").await;
-
-    let mut retagged = file(0, "drake, lil durk", Some("Laugh Now"));
-    retagged.modified_at += 1;
-    shelf.apply(&retagged).await;
-    shelf.settle().await;
-    assert_eq!(
-        shelf.credited(0, "artist").await,
-        names(&["Drake", "Lil Durk"]),
-        "the key folds case, so the new spelling is the same credit"
-    );
-
-    shelf.undo(decision).await;
-    assert_eq!(
-        shelf.credited(0, "artist").await,
-        names(&["drake, lil durk"]),
-        "the undo restores this file's own spelling"
-    );
-}
-
-#[tokio::test]
-async fn favourites_and_ratings_follow_the_parts_through_the_journal() {
-    let shelf = shelf("favourites-follow").await;
-    shelf
-        .apply(&file(0, "Tame Impala, JENNIE", Some("Dracula")))
-        .await;
-    shelf.apply(&file(1, "JENNIE", Some("Ruby"))).await;
-    shelf.settle().await;
-    let joined = shelf.artist("Tame Impala, JENNIE").await;
-    let jennie = shelf.artist("JENNIE").await;
-    let services = &shelf.state.services;
-    services
-        .set_star(shelf.owner, "artist", joined, true)
-        .await
-        .unwrap();
-    services
-        .set_rating(shelf.owner, "artist", joined, 4)
-        .await
-        .unwrap();
-    services
-        .set_rating(shelf.owner, "artist", jennie, 2)
-        .await
-        .unwrap();
-
-    shelf.split("Tame Impala, JENNIE").await;
-    let tame = shelf.artist("Tame Impala").await;
-
-    let starred: Vec<String> = sqlx::query_scalar(
-        "SELECT entity_id FROM user_star WHERE user_id = ? AND entity_type = 'artist' \
-         ORDER BY entity_id",
-    )
-    .bind(shelf.owner.to_string())
-    .fetch_all(shelf.state.db.pool())
-    .await
-    .unwrap();
-    let mut expected = vec![tame.to_string(), jennie.to_string()];
-    expected.sort();
-    assert_eq!(starred, expected, "the favourite is on every part");
-
-    let rated: Vec<(String, i64)> = sqlx::query_as(
-        "SELECT entity_id, rating FROM user_rating WHERE user_id = ? AND entity_type = 'artist' \
-         ORDER BY entity_id",
-    )
-    .bind(shelf.owner.to_string())
-    .fetch_all(shelf.state.db.pool())
-    .await
-    .unwrap();
-    let mut expected = vec![(tame.to_string(), 4), (jennie.to_string(), 2)];
-    expected.sort();
-    assert_eq!(rated, expected, "a part rated on its own keeps its rating");
-
-    // The journal says what moved, so a mirror converges on the same state.
-    let journal: Vec<(String, String, String)> = sqlx::query_as(
-        "SELECT entity_type, entity_id, action FROM sync_event WHERE user_id = ? \
-         AND entity_id IN (?, ?, ?) ORDER BY cursor",
-    )
-    .bind(shelf.owner.to_string())
-    .bind(joined.to_string())
-    .bind(tame.to_string())
-    .bind(jennie.to_string())
-    .fetch_all(shelf.state.db.pool())
-    .await
-    .unwrap();
-    for entry in [
-        ("favorite", joined, "delete"),
-        ("favorite", tame, "upsert"),
-        ("favorite", jennie, "upsert"),
-        ("rating", joined, "delete"),
-        ("rating", tame, "upsert"),
-    ] {
-        let entry = (entry.0.to_owned(), entry.1.to_string(), entry.2.to_owned());
-        assert!(
-            journal.contains(&entry),
-            "{entry:?} missing from {journal:?}"
-        );
-    }
-}
-
-#[tokio::test]
-async fn the_feed_announces_what_a_split_moved() {
-    let shelf = shelf("feed").await;
-    shelf.apply(&file(0, "Curio, Lucy", Some("Echoes"))).await;
-    shelf.settle().await;
-    let joined = shelf.artist("Curio, Lucy").await;
-    let cursor: i64 = sqlx::query_scalar("SELECT COALESCE(MAX(cursor), 0) FROM library_event")
-        .fetch_one(shelf.state.db.pool())
-        .await
-        .unwrap();
-
-    shelf.split("Curio, Lucy").await;
-
-    let events: Vec<(String, String, String)> = sqlx::query_as(
-        "SELECT entity_type, entity_id, action FROM library_event \
-         WHERE library_id = ? AND cursor > ? ORDER BY cursor",
-    )
-    .bind(shelf.library.to_string())
-    .bind(cursor)
-    .fetch_all(shelf.state.db.pool())
-    .await
-    .unwrap();
-    let kinds: Vec<(&str, &str)> = events
-        .iter()
-        .map(|(kind, _, action)| (kind.as_str(), action.as_str()))
-        .collect();
-    assert!(kinds.contains(&("track", "upsert")), "{events:?}");
-    assert!(kinds.contains(&("album", "upsert")), "{events:?}");
-    assert!(
-        events.contains(&("artist".into(), joined.to_string(), "delete".into())),
-        "{events:?}"
-    );
-}
-
-/// The migration fills `track_credit` from the participants. Rebuilding it
-/// that way on a scanned library must answer what the scan's own credits
-/// answer, under no decision, a split and its undo — including a file that
-/// repeats a credit and one whose credits share a part.
-#[tokio::test]
-async fn the_migrations_copy_gives_what_a_scan_gives() {
-    let migration = include_str!("../migrations-v2/20261024020000_artist_credit_decision.sql");
-    let copy = &migration[migration
-        .find("INSERT INTO track_credit")
-        .expect("the migration copies the participants")..];
-
-    let inputs = || {
-        let mut repeated = file(0, "ignored", Some("Twice"));
-        repeated.artists = names(&["A, C", "A, C"]);
-        let mut shared = file(1, "ignored", Some("Shared"));
-        shared.artists = names(&["A, B", "A, C"]);
-        let mut sorted = file(2, "A, B", Some("Sorted"));
-        sorted.sort_artist = Some("a, b".into());
-        [repeated, shared, sorted]
-    };
-    let mut answers = Vec::new();
-    for copied in [false, true] {
-        let shelf = shelf(if copied { "copied" } else { "scanned" }).await;
-        for input in inputs() {
-            shelf.apply(&input).await;
-        }
-        shelf.settle().await;
-        if copied {
-            sqlx::query("DELETE FROM track_credit")
-                .execute(shelf.state.db.pool())
-                .await
-                .unwrap();
-            sqlx::raw_sql(copy)
-                .execute(shelf.state.db.pool())
-                .await
-                .unwrap();
-        }
-        let whole = shelf.rows().await;
-        let first = shelf.split("A, B").await;
-        let second = shelf.split("A, C").await;
-        let split = shelf.rows().await;
-        shelf.undo(first).await;
-        let half = shelf.rows().await;
-        shelf.undo(second).await;
-        let undone = shelf.rows().await;
-        assert_eq!(undone, whole, "copied: {copied}");
-        answers.push((whole, split, half));
-    }
-    assert_eq!(answers[0], answers[1]);
-}
-
-#[tokio::test]
-async fn the_candidates_are_the_desktops_sorted_as_the_desktop_sorts_them() {
-    let shelf = shelf("candidates").await;
-    shelf
-        .apply(&file(0, "Megan Thee Stallion, TWICE", Some("Mamushi")))
-        .await;
-    shelf.apply(&file(1, "TWICE", Some("Fancy"))).await;
-    shelf
-        .apply(&file(2, "Didier Super, The Aro String Band", Some("A")))
-        .await;
-    shelf
-        .apply(&file(3, "Didier Super, The Aro String Band", Some("B")))
-        .await;
-    shelf
-        .apply(&file(4, "Tyler, The Creator", Some("Igor")))
-        .await;
-    shelf
-        .apply(&file(5, "Simon & Garfunkel", Some("Bookends")))
-        .await;
-    shelf
-        .apply(&file(
-            6,
-            "Ian Asher, Olly Alexander (Years, Years)",
-            Some("Sun"),
-        ))
-        .await;
-    shelf.apply(&file(7, "Solo,", Some("Alone"))).await;
-    shelf.settle().await;
-
-    let candidates = shelf
-        .state
-        .services
-        .credit_candidates(shelf.owner, shelf.library)
-        .await
-        .unwrap();
-    let listed: Vec<&str> = candidates.iter().map(|c| c.name.as_str()).collect();
-    assert_eq!(
-        listed,
-        [
-            "Megan Thee Stallion, TWICE",
-            "Didier Super, The Aro String Band",
-            "Ian Asher, Olly Alexander (Years, Years)",
-            "Tyler, The Creator",
-        ],
-        "a known fragment first, then the most tracks, then the name"
-    );
-    let megan = &candidates[0];
-    assert_eq!(megan.track_count, 1);
-    assert_eq!(megan.fragments[1].name, "TWICE");
-    assert_eq!(
-        megan.fragments[1].artist_id,
-        Some(shelf.artist("TWICE").await)
-    );
-    assert_eq!(megan.fragments[0].artist_id, None);
-
-    let tyler = shelf.artist("Tyler, The Creator").await;
-    shelf
-        .state
-        .services
-        .decide_credit(shelf.owner, shelf.library, tyler, CreditDecisionKind::Keep)
-        .await
-        .unwrap();
-    assert!(
-        shelf
-            .state
-            .services
-            .credit_candidates(shelf.owner, shelf.library)
-            .await
-            .unwrap()
-            .iter()
-            .all(|candidate| candidate.name != "Tyler, The Creator"),
-        "a keep takes the credit off the list"
-    );
-    assert_eq!(
-        shelf.credited(4, "artist").await,
-        names(&["Tyler, The Creator"]),
-        "and changes nothing it credits"
-    );
-}
-
-#[tokio::test]
-async fn only_owners_and_managers_reach_the_page_and_its_decisions() {
-    let shelf = shelf("page-access").await;
-    shelf
-        .apply(&file(0, "Chris Lake, Abel Balder", Some("A")))
-        .await;
-    shelf.apply(&file(1, "Plain", Some("B"))).await;
-    shelf.settle().await;
-    let listener = account(&shelf.state, "listener").await;
-    let manager = account(&shelf.state, "manager").await;
-    for (user, role) in [
-        (listener, LibraryRole::Listener),
-        (manager, LibraryRole::Manager),
-    ] {
-        shelf
-            .state
-            .db
-            .add_library_member(shelf.owner, shelf.library, user, role, now_ms())
-            .await
-            .unwrap();
-    }
-    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
-    let library = shelf.library;
-    let send = |token: String, request: Request<Body>| {
-        let router = router.clone();
-        async move {
-            let (mut parts, body) = request.into_parts();
-            parts
-                .headers
-                .insert("authorization", format!("Bearer {token}").parse().unwrap());
-            router
-                .oneshot(Request::from_parts(parts, body))
-                .await
-                .unwrap()
-        }
-    };
-    let listening = shelf.token(listener, "listener").await;
-    let managing = shelf.token(manager, "manager").await;
-    let joined = shelf.artist("Chris Lake, Abel Balder").await;
-    let plain = shelf.artist("Plain").await;
-    let get = |path: &str| {
-        Request::get(format!("/api/v2/libraries/{library}{path}"))
-            .body(Body::empty())
-            .unwrap()
-    };
-    let decide = |artist: Uuid| {
-        json_request(
-            &format!("/api/v2/libraries/{library}/credit-decisions"),
-            json!({ "artist_id": artist, "decision": "split" }),
-        )
-    };
-
-    for path in [
-        "/attention",
-        "/attention/credits",
-        "/attention/tracks?category=missing_year",
-        "/credit-decisions",
-    ] {
-        assert_eq!(
-            send(listening.clone(), get(path)).await.status(),
-            StatusCode::NOT_FOUND,
-            "a listener is told nothing at {path}"
-        );
-        assert_eq!(
-            send(managing.clone(), get(path)).await.status(),
-            StatusCode::OK,
-            "a manager reads {path}"
-        );
-    }
-    assert_eq!(
-        send(listening.clone(), decide(joined)).await.status(),
-        StatusCode::NOT_FOUND
-    );
-    assert_eq!(
-        send(
-            managing.clone(),
-            get("/attention/tracks?category=split_credits")
-        )
-        .await
-        .status(),
-        StatusCode::UNPROCESSABLE_ENTITY,
-        "credits are not a track category"
-    );
-    assert_eq!(
-        send(managing.clone(), decide(plain)).await.status(),
-        StatusCode::UNPROCESSABLE_ENTITY,
-        "a name with nothing to split is not a candidate"
-    );
-
-    let created = send(managing.clone(), decide(joined)).await;
-    assert_eq!(created.status(), StatusCode::CREATED);
-    let created = json_body(created).await;
-    assert_eq!(created["decision"], "split");
-    assert_eq!(created["parts"], json!(["Chris Lake", "Abel Balder"]));
-    assert_eq!(created["decided_by"], "manager");
-
-    // Decided, the joined artist is gone: deciding again names nothing.
-    assert_eq!(
-        send(managing.clone(), decide(joined)).await.status(),
-        StatusCode::NOT_FOUND
-    );
-    let id = created["id"].as_str().unwrap().to_owned();
-    let remove = || {
-        Request::delete(format!("/api/v2/libraries/{library}/credit-decisions/{id}"))
-            .body(Body::empty())
-            .unwrap()
-    };
-    assert_eq!(
-        send(listening.clone(), remove()).await.status(),
-        StatusCode::NOT_FOUND
-    );
-    assert_eq!(
-        send(managing.clone(), remove()).await.status(),
-        StatusCode::NO_CONTENT
-    );
-    assert_eq!(
-        send(managing.clone(), remove()).await.status(),
-        StatusCode::NOT_FOUND
-    );
-
-    // Undone, the credit can be decided again; a part of it is no candidate.
-    assert_eq!(
-        send(managing.clone(), decide(joined)).await.status(),
-        StatusCode::CREATED
-    );
-    let keep = json_request(
-        &format!("/api/v2/libraries/{library}/credit-decisions"),
-        json!({ "artist_id": shelf.artist("Chris Lake").await, "decision": "keep" }),
-    );
-    assert_eq!(
-        send(managing.clone(), keep).await.status(),
-        StatusCode::UNPROCESSABLE_ENTITY
-    );
-}
-
-#[tokio::test]
-async fn a_second_decision_on_one_credit_is_a_conflict() {
-    let shelf = shelf("conflict").await;
-    shelf.apply(&file(0, "Jonas Blue, Malive", Some("A"))).await;
-    shelf.settle().await;
-    let joined = shelf.artist("Jonas Blue, Malive").await;
-    let services = &shelf.state.services;
-    services
-        .decide_credit(shelf.owner, shelf.library, joined, CreditDecisionKind::Keep)
-        .await
-        .unwrap();
-    let again = services
-        .decide_credit(
-            shelf.owner,
-            shelf.library,
-            joined,
-            CreditDecisionKind::Split,
-        )
-        .await;
-    // Asserted on the variant alone: printing the result would put the
-    // decision's identifiers in the failure message for nothing.
-    assert!(
-        matches!(
-            again,
-            Err(waveflow_server::services::ServiceError::Conflict)
-        ),
-        "a second decision on one credit is a conflict"
-    );
-}
-
-#[tokio::test]
-async fn each_track_category_lists_what_its_criterion_names() {
-    let shelf = shelf("categories").await;
-    let mut tracks = Vec::new();
-    // A gap on disc one: 1, 2, 4.
-    for (index, number) in [(0, 1), (1, 2), (2, 4)] {
-        let mut input = file(index, "Gap Band", Some("Gaps"));
-        input.track_number = Some(number);
-        tracks.push(input);
-    }
-    // Two tracks numbered 1 on the same disc.
-    for index in [3, 4] {
-        let mut input = file(index, "Dup Band", Some("Dups"));
-        input.track_number = Some(1);
-        tracks.push(input);
-    }
-    // Two years on one album.
-    for (index, year) in [(5, 2001), (6, 2002)] {
-        let mut input = file(index, "Year Band", Some("Years"));
-        input.year = Some(year);
-        tracks.push(input);
-    }
-    // No year, no number, no album.
-    let mut bare = file(7, "Bare Band", None);
-    bare.year = None;
-    bare.track_number = None;
-    tracks.push(bare);
-    // The same recording twice, a second apart.
-    for (index, album, duration) in [(8, "First", 180_000), (9, "Second", 181_000)] {
-        let mut input = file(index, "Echo Band", Some(album));
-        input.title = "Echo".into();
-        input.duration_ms = duration;
-        tracks.push(input);
-    }
-    // A compilation that names no album artist.
-    let mut various = file(10, "Some Band", Some("Hits"));
-    various.is_compilation = true;
-    tracks.push(various);
-    for input in &tracks {
-        shelf.apply(input).await;
-    }
-    shelf.settle().await;
-
-    let listed = |category: AttentionCategory| {
-        let shelf = &shelf;
-        async move {
-            let mut paths: Vec<String> = shelf
-                .state
-                .services
-                .attention_tracks(
-                    shelf.owner,
-                    shelf.library,
-                    category,
-                    BrowsePage::new(None, None).unwrap(),
-                )
-                .await
-                .unwrap()
-                .into_iter()
-                .map(|track| track.song.relative_path)
-                .collect();
-            paths.sort();
-            paths
-        }
-    };
-    let paths = |indices: &[usize]| -> Vec<String> {
-        let mut paths: Vec<String> = indices
-            .iter()
-            .map(|index| format!("track-{index}.flac"))
-            .collect();
-        paths.sort();
-        paths
-    };
-    assert_eq!(
-        listed(AttentionCategory::TrackNumberGap).await,
-        paths(&[0, 1, 2])
-    );
-    assert_eq!(
-        listed(AttentionCategory::DuplicateTrackNumber).await,
-        paths(&[3, 4])
-    );
-    assert_eq!(
-        listed(AttentionCategory::AlbumYearConflict).await,
-        paths(&[5, 6])
-    );
-    assert_eq!(listed(AttentionCategory::MissingYear).await, paths(&[7]));
-    assert_eq!(
-        listed(AttentionCategory::MissingTrackNumber).await,
-        paths(&[7])
-    );
-    assert_eq!(listed(AttentionCategory::MissingAlbum).await, paths(&[7]));
-    assert_eq!(
-        listed(AttentionCategory::ProbableDuplicate).await,
-        paths(&[8, 9])
-    );
-    assert_eq!(
-        listed(AttentionCategory::CompilationNoAlbumArtist).await,
-        paths(&[10])
-    );
-    assert!(listed(AttentionCategory::MissingArtist).await.is_empty());
-    assert_eq!(
-        listed(AttentionCategory::MissingCover).await.len(),
-        tracks.len(),
-        "no file here carries a cover"
-    );
-
-    // A correction is an effective value: the corrected track leaves its
-    // category at once, with no rescan.
-    let bare: String =
-        sqlx::query_scalar("SELECT id FROM track WHERE library_id = ? AND relative_path = ?")
-            .bind(shelf.library.to_string())
-            .bind("track-7.flac")
-            .fetch_one(shelf.state.db.pool())
-            .await
-            .unwrap();
-    shelf
-        .state
-        .services
-        .set_track_metadata(
-            shelf.owner,
-            Uuid::parse_str(&bare).unwrap(),
-            TrackMetadataPatch {
-                year: Some(Some(1999)),
-                ..TrackMetadataPatch::default()
-            },
-            None,
-        )
-        .await
-        .unwrap();
-    assert!(listed(AttentionCategory::MissingYear).await.is_empty());
-
-    let summary = shelf
-        .state
-        .services
-        .attention_summary(shelf.owner, shelf.library)
-        .await
-        .unwrap();
-    let count = |category: AttentionCategory| {
-        summary
-            .iter()
-            .find(|entry| entry.category == category)
-            .map(|entry| entry.count)
-    };
-    assert_eq!(summary.len(), AttentionCategory::ALL.len());
-    assert_eq!(summary[0].category, AttentionCategory::SplitCredits);
-    assert_eq!(count(AttentionCategory::TrackNumberGap), Some(3));
-    assert_eq!(count(AttentionCategory::ProbableDuplicate), Some(2));
-    assert_eq!(count(AttentionCategory::MissingYear), Some(0));
-
-    let duplicates = shelf
-        .state
-        .services
-        .attention_tracks(
-            shelf.owner,
-            shelf.library,
-            AttentionCategory::ProbableDuplicate,
-            BrowsePage::new(None, None).unwrap(),
-        )
-        .await
-        .unwrap();
-    assert!(
-        duplicates
-            .iter()
-            .all(|track| track.duplicate_group == Some(1)),
-        "both are one group"
-    );
-}
diff --git a/tests/credits/main.rs b/tests/credits/main.rs
new file mode 100644
index 00000000..704234e4
--- /dev/null
+++ b/tests/credits/main.rs
@@ -0,0 +1,218 @@
+//! Splitting a joined artist credit, by decision, and "Needs attention"
+//! (RFC-015).
+//!
+//! The accounts here are rows written by hand and reach the routes through an
+//! API token, as in `tests/catalog/listings.rs`: nothing in this target authenticates
+//! with a password, so nothing in it hands a literal to a hash.
+
+#[allow(dead_code)]
+#[path = "../support/mod.rs"]
+mod support;
+
+use axum::body::Body;
+use axum::http::{Request, StatusCode};
+use serde_json::json;
+use support::*;
+use tower::ServiceExt;
+use uuid::Uuid;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::services::{
+    AttentionCategory, BrowsePage, CreditDecisionKind, TrackMetadataPatch,
+};
+use waveflow_server::storage::catalog::CatalogTrackInput;
+use waveflow_server::storage::database::{LibraryRole, LibraryVisibility};
+use waveflow_server::AppState;
+
+/// One credited row: track, role, position, name, sort form.
+type Row = (String, String, i64, String, Option<String>);
+
+struct Shelf {
+    state: AppState,
+    config: waveflow_server::Config,
+    owner: Uuid,
+    library: Uuid,
+    scan: Uuid,
+    _temp: tempfile::TempDir,
+}
+
+async fn account(state: &AppState, name: &str) -> Uuid {
+    let id = Uuid::new_v4();
+    let now = now_ms();
+    sqlx::query(
+        "INSERT INTO account (id, username, password_hash, role, disabled, created_at, updated_at) \
+         VALUES (?, ?, 'this-account-never-authenticates', 'admin', 0, ?, ?)",
+    )
+    .bind(id.to_string())
+    .bind(name)
+    .bind(now)
+    .bind(now)
+    .execute(state.db.pool())
+    .await
+    .unwrap();
+    id
+}
+
+async fn shelf(name: &str) -> Shelf {
+    let (temp, config, state) = test_app().await;
+    let owner = account(&state, name).await;
+    let music = config.data_dir.join(name);
+    std::fs::create_dir_all(&music).unwrap();
+    let library = state
+        .db
+        .create_library(
+            owner,
+            name,
+            &std::fs::canonicalize(&music).unwrap(),
+            LibraryVisibility::Private,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let scan = state
+        .db
+        .create_scan_job(library, Some(owner), "manual")
+        .await
+        .unwrap();
+    state.db.start_scan_job(scan, 1, false).await.unwrap();
+    Shelf {
+        state,
+        config,
+        owner,
+        library,
+        scan,
+        _temp: temp,
+    }
+}
+
+/// A file crediting `artist`, on its own album unless one is named, with no
+/// album-artist tag and no compilation flag: the album then hangs off the
+/// track's own credit, which is the case a split could have moved.
+fn file(index: usize, artist: &str, album: Option<&str>) -> CatalogTrackInput {
+    let mut input = catalog_input(index, artist);
+    input.title = format!("Track {index}");
+    input.album = album.map(str::to_owned);
+    input.is_compilation = false;
+    input.genre = None;
+    input
+}
+
+impl Shelf {
+    async fn apply(&self, input: &CatalogTrackInput) {
+        let existing: Option<String> =
+            sqlx::query_scalar("SELECT id FROM track WHERE library_id = ? AND relative_path = ?")
+                .bind(self.library.to_string())
+                .bind(&input.relative_path)
+                .fetch_optional(self.state.db.pool())
+                .await
+                .unwrap();
+        self.state
+            .db
+            .apply_catalog_track(
+                self.library,
+                self.scan,
+                input,
+                existing.map(|id| Uuid::parse_str(&id).unwrap()),
+                false,
+            )
+            .await
+            .unwrap();
+    }
+
+    /// The end of a scan, in the scanner's order: sort names first, because
+    /// the derivations index each artist with its sort name.
+    async fn settle(&self) {
+        self.state
+            .db
+            .consolidate_sort_names(self.library)
+            .await
+            .unwrap();
+        self.state
+            .db
+            .consolidate_catalog_derivations(self.library)
+            .await
+            .unwrap();
+    }
+
+    async fn artist(&self, name: &str) -> Uuid {
+        let id: String =
+            sqlx::query_scalar("SELECT id FROM artist WHERE library_id = ? AND name = ?")
+                .bind(self.library.to_string())
+                .bind(name)
+                .fetch_one(self.state.db.pool())
+                .await
+                .unwrap_or_else(|_| panic!("no artist named {name:?}"));
+        Uuid::parse_str(&id).unwrap()
+    }
+
+    async fn artist_names(&self) -> Vec<String> {
+        sqlx::query_scalar("SELECT name FROM artist WHERE library_id = ? ORDER BY name")
+            .bind(self.library.to_string())
+            .fetch_all(self.state.db.pool())
+            .await
+            .unwrap()
+    }
+
+    async fn split(&self, name: &str) -> Uuid {
+        let artist = self.artist(name).await;
+        self.state
+            .services
+            .decide_credit(self.owner, self.library, artist, CreditDecisionKind::Split)
+            .await
+            .unwrap()
+            .id
+    }
+
+    async fn undo(&self, decision: Uuid) {
+        self.state
+            .services
+            .remove_credit_decision(self.owner, self.library, decision)
+            .await
+            .unwrap();
+    }
+
+    /// Every credited row of the library, by file, role and position.
+    async fn rows(&self) -> Vec<Row> {
+        sqlx::query_as(
+            "SELECT t.relative_path, tp.role, tp.position, ar.name, tp.sort_name \
+             FROM track_participant tp JOIN track t ON t.id = tp.track_id \
+             JOIN artist ar ON ar.id = tp.artist_id \
+             WHERE t.library_id = ? ORDER BY t.relative_path, tp.role, tp.position",
+        )
+        .bind(self.library.to_string())
+        .fetch_all(self.state.db.pool())
+        .await
+        .unwrap()
+    }
+
+    /// One file's names in one role, in order.
+    async fn credited(&self, index: usize, role: &str) -> Vec<String> {
+        sqlx::query_scalar(
+            "SELECT ar.name FROM track_participant tp JOIN track t ON t.id = tp.track_id \
+             JOIN artist ar ON ar.id = tp.artist_id \
+             WHERE t.library_id = ? AND t.relative_path = ? AND tp.role = ? \
+             ORDER BY tp.position",
+        )
+        .bind(self.library.to_string())
+        .bind(format!("track-{index}.flac"))
+        .bind(role)
+        .fetch_all(self.state.db.pool())
+        .await
+        .unwrap()
+    }
+
+    async fn token(&self, user: Uuid, name: &str) -> String {
+        self.state
+            .services
+            .create_api_token(user, &[], name, "credit decisions", &[])
+            .await
+            .unwrap()
+            .1
+    }
+}
+
+fn names(values: &[&str]) -> Vec<String> {
+    values.iter().map(|value| (*value).to_owned()).collect()
+}
+
+mod page;
+mod splits;
diff --git a/tests/credits/page.rs b/tests/credits/page.rs
new file mode 100644
index 00000000..5eec7398
--- /dev/null
+++ b/tests/credits/page.rs
@@ -0,0 +1,416 @@
+//! The credits page: its candidates, who reaches it, a conflicting second
+//! decision, and the track categories it lists.
+
+use super::*;
+
+#[tokio::test]
+async fn the_candidates_are_the_desktops_sorted_as_the_desktop_sorts_them() {
+    let shelf = shelf("candidates").await;
+    shelf
+        .apply(&file(0, "Megan Thee Stallion, TWICE", Some("Mamushi")))
+        .await;
+    shelf.apply(&file(1, "TWICE", Some("Fancy"))).await;
+    shelf
+        .apply(&file(2, "Didier Super, The Aro String Band", Some("A")))
+        .await;
+    shelf
+        .apply(&file(3, "Didier Super, The Aro String Band", Some("B")))
+        .await;
+    shelf
+        .apply(&file(4, "Tyler, The Creator", Some("Igor")))
+        .await;
+    shelf
+        .apply(&file(5, "Simon & Garfunkel", Some("Bookends")))
+        .await;
+    shelf
+        .apply(&file(
+            6,
+            "Ian Asher, Olly Alexander (Years, Years)",
+            Some("Sun"),
+        ))
+        .await;
+    shelf.apply(&file(7, "Solo,", Some("Alone"))).await;
+    shelf.settle().await;
+
+    let candidates = shelf
+        .state
+        .services
+        .credit_candidates(shelf.owner, shelf.library)
+        .await
+        .unwrap();
+    let listed: Vec<&str> = candidates.iter().map(|c| c.name.as_str()).collect();
+    assert_eq!(
+        listed,
+        [
+            "Megan Thee Stallion, TWICE",
+            "Didier Super, The Aro String Band",
+            "Ian Asher, Olly Alexander (Years, Years)",
+            "Tyler, The Creator",
+        ],
+        "a known fragment first, then the most tracks, then the name"
+    );
+    let megan = &candidates[0];
+    assert_eq!(megan.track_count, 1);
+    assert_eq!(megan.fragments[1].name, "TWICE");
+    assert_eq!(
+        megan.fragments[1].artist_id,
+        Some(shelf.artist("TWICE").await)
+    );
+    assert_eq!(megan.fragments[0].artist_id, None);
+
+    let tyler = shelf.artist("Tyler, The Creator").await;
+    shelf
+        .state
+        .services
+        .decide_credit(shelf.owner, shelf.library, tyler, CreditDecisionKind::Keep)
+        .await
+        .unwrap();
+    assert!(
+        shelf
+            .state
+            .services
+            .credit_candidates(shelf.owner, shelf.library)
+            .await
+            .unwrap()
+            .iter()
+            .all(|candidate| candidate.name != "Tyler, The Creator"),
+        "a keep takes the credit off the list"
+    );
+    assert_eq!(
+        shelf.credited(4, "artist").await,
+        names(&["Tyler, The Creator"]),
+        "and changes nothing it credits"
+    );
+}
+
+#[tokio::test]
+async fn only_owners_and_managers_reach_the_page_and_its_decisions() {
+    let shelf = shelf("page-access").await;
+    shelf
+        .apply(&file(0, "Chris Lake, Abel Balder", Some("A")))
+        .await;
+    shelf.apply(&file(1, "Plain", Some("B"))).await;
+    shelf.settle().await;
+    let listener = account(&shelf.state, "listener").await;
+    let manager = account(&shelf.state, "manager").await;
+    for (user, role) in [
+        (listener, LibraryRole::Listener),
+        (manager, LibraryRole::Manager),
+    ] {
+        shelf
+            .state
+            .db
+            .add_library_member(shelf.owner, shelf.library, user, role, now_ms())
+            .await
+            .unwrap();
+    }
+    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
+    let library = shelf.library;
+    let send = |token: String, request: Request<Body>| {
+        let router = router.clone();
+        async move {
+            let (mut parts, body) = request.into_parts();
+            parts
+                .headers
+                .insert("authorization", format!("Bearer {token}").parse().unwrap());
+            router
+                .oneshot(Request::from_parts(parts, body))
+                .await
+                .unwrap()
+        }
+    };
+    let listening = shelf.token(listener, "listener").await;
+    let managing = shelf.token(manager, "manager").await;
+    let joined = shelf.artist("Chris Lake, Abel Balder").await;
+    let plain = shelf.artist("Plain").await;
+    let get = |path: &str| {
+        Request::get(format!("/api/v2/libraries/{library}{path}"))
+            .body(Body::empty())
+            .unwrap()
+    };
+    let decide = |artist: Uuid| {
+        json_request(
+            &format!("/api/v2/libraries/{library}/credit-decisions"),
+            json!({ "artist_id": artist, "decision": "split" }),
+        )
+    };
+
+    for path in [
+        "/attention",
+        "/attention/credits",
+        "/attention/tracks?category=missing_year",
+        "/credit-decisions",
+    ] {
+        assert_eq!(
+            send(listening.clone(), get(path)).await.status(),
+            StatusCode::NOT_FOUND,
+            "a listener is told nothing at {path}"
+        );
+        assert_eq!(
+            send(managing.clone(), get(path)).await.status(),
+            StatusCode::OK,
+            "a manager reads {path}"
+        );
+    }
+    assert_eq!(
+        send(listening.clone(), decide(joined)).await.status(),
+        StatusCode::NOT_FOUND
+    );
+    assert_eq!(
+        send(
+            managing.clone(),
+            get("/attention/tracks?category=split_credits")
+        )
+        .await
+        .status(),
+        StatusCode::UNPROCESSABLE_ENTITY,
+        "credits are not a track category"
+    );
+    assert_eq!(
+        send(managing.clone(), decide(plain)).await.status(),
+        StatusCode::UNPROCESSABLE_ENTITY,
+        "a name with nothing to split is not a candidate"
+    );
+
+    let created = send(managing.clone(), decide(joined)).await;
+    assert_eq!(created.status(), StatusCode::CREATED);
+    let created = json_body(created).await;
+    assert_eq!(created["decision"], "split");
+    assert_eq!(created["parts"], json!(["Chris Lake", "Abel Balder"]));
+    assert_eq!(created["decided_by"], "manager");
+
+    // Decided, the joined artist is gone: deciding again names nothing.
+    assert_eq!(
+        send(managing.clone(), decide(joined)).await.status(),
+        StatusCode::NOT_FOUND
+    );
+    let id = created["id"].as_str().unwrap().to_owned();
+    let remove = || {
+        Request::delete(format!("/api/v2/libraries/{library}/credit-decisions/{id}"))
+            .body(Body::empty())
+            .unwrap()
+    };
+    assert_eq!(
+        send(listening.clone(), remove()).await.status(),
+        StatusCode::NOT_FOUND
+    );
+    assert_eq!(
+        send(managing.clone(), remove()).await.status(),
+        StatusCode::NO_CONTENT
+    );
+    assert_eq!(
+        send(managing.clone(), remove()).await.status(),
+        StatusCode::NOT_FOUND
+    );
+
+    // Undone, the credit can be decided again; a part of it is no candidate.
+    assert_eq!(
+        send(managing.clone(), decide(joined)).await.status(),
+        StatusCode::CREATED
+    );
+    let keep = json_request(
+        &format!("/api/v2/libraries/{library}/credit-decisions"),
+        json!({ "artist_id": shelf.artist("Chris Lake").await, "decision": "keep" }),
+    );
+    assert_eq!(
+        send(managing.clone(), keep).await.status(),
+        StatusCode::UNPROCESSABLE_ENTITY
+    );
+}
+
+#[tokio::test]
+async fn a_second_decision_on_one_credit_is_a_conflict() {
+    let shelf = shelf("conflict").await;
+    shelf.apply(&file(0, "Jonas Blue, Malive", Some("A"))).await;
+    shelf.settle().await;
+    let joined = shelf.artist("Jonas Blue, Malive").await;
+    let services = &shelf.state.services;
+    services
+        .decide_credit(shelf.owner, shelf.library, joined, CreditDecisionKind::Keep)
+        .await
+        .unwrap();
+    let again = services
+        .decide_credit(
+            shelf.owner,
+            shelf.library,
+            joined,
+            CreditDecisionKind::Split,
+        )
+        .await;
+    // Asserted on the variant alone: printing the result would put the
+    // decision's identifiers in the failure message for nothing.
+    assert!(
+        matches!(
+            again,
+            Err(waveflow_server::services::ServiceError::Conflict)
+        ),
+        "a second decision on one credit is a conflict"
+    );
+}
+
+#[tokio::test]
+async fn each_track_category_lists_what_its_criterion_names() {
+    let shelf = shelf("categories").await;
+    let mut tracks = Vec::new();
+    // A gap on disc one: 1, 2, 4.
+    for (index, number) in [(0, 1), (1, 2), (2, 4)] {
+        let mut input = file(index, "Gap Band", Some("Gaps"));
+        input.track_number = Some(number);
+        tracks.push(input);
+    }
+    // Two tracks numbered 1 on the same disc.
+    for index in [3, 4] {
+        let mut input = file(index, "Dup Band", Some("Dups"));
+        input.track_number = Some(1);
+        tracks.push(input);
+    }
+    // Two years on one album.
+    for (index, year) in [(5, 2001), (6, 2002)] {
+        let mut input = file(index, "Year Band", Some("Years"));
+        input.year = Some(year);
+        tracks.push(input);
+    }
+    // No year, no number, no album.
+    let mut bare = file(7, "Bare Band", None);
+    bare.year = None;
+    bare.track_number = None;
+    tracks.push(bare);
+    // The same recording twice, a second apart.
+    for (index, album, duration) in [(8, "First", 180_000), (9, "Second", 181_000)] {
+        let mut input = file(index, "Echo Band", Some(album));
+        input.title = "Echo".into();
+        input.duration_ms = duration;
+        tracks.push(input);
+    }
+    // A compilation that names no album artist.
+    let mut various = file(10, "Some Band", Some("Hits"));
+    various.is_compilation = true;
+    tracks.push(various);
+    for input in &tracks {
+        shelf.apply(input).await;
+    }
+    shelf.settle().await;
+
+    let listed = |category: AttentionCategory| {
+        let shelf = &shelf;
+        async move {
+            let mut paths: Vec<String> = shelf
+                .state
+                .services
+                .attention_tracks(
+                    shelf.owner,
+                    shelf.library,
+                    category,
+                    BrowsePage::new(None, None).unwrap(),
+                )
+                .await
+                .unwrap()
+                .into_iter()
+                .map(|track| track.song.relative_path)
+                .collect();
+            paths.sort();
+            paths
+        }
+    };
+    let paths = |indices: &[usize]| -> Vec<String> {
+        let mut paths: Vec<String> = indices
+            .iter()
+            .map(|index| format!("track-{index}.flac"))
+            .collect();
+        paths.sort();
+        paths
+    };
+    assert_eq!(
+        listed(AttentionCategory::TrackNumberGap).await,
+        paths(&[0, 1, 2])
+    );
+    assert_eq!(
+        listed(AttentionCategory::DuplicateTrackNumber).await,
+        paths(&[3, 4])
+    );
+    assert_eq!(
+        listed(AttentionCategory::AlbumYearConflict).await,
+        paths(&[5, 6])
+    );
+    assert_eq!(listed(AttentionCategory::MissingYear).await, paths(&[7]));
+    assert_eq!(
+        listed(AttentionCategory::MissingTrackNumber).await,
+        paths(&[7])
+    );
+    assert_eq!(listed(AttentionCategory::MissingAlbum).await, paths(&[7]));
+    assert_eq!(
+        listed(AttentionCategory::ProbableDuplicate).await,
+        paths(&[8, 9])
+    );
+    assert_eq!(
+        listed(AttentionCategory::CompilationNoAlbumArtist).await,
+        paths(&[10])
+    );
+    assert!(listed(AttentionCategory::MissingArtist).await.is_empty());
+    assert_eq!(
+        listed(AttentionCategory::MissingCover).await.len(),
+        tracks.len(),
+        "no file here carries a cover"
+    );
+
+    // A correction is an effective value: the corrected track leaves its
+    // category at once, with no rescan.
+    let bare: String =
+        sqlx::query_scalar("SELECT id FROM track WHERE library_id = ? AND relative_path = ?")
+            .bind(shelf.library.to_string())
+            .bind("track-7.flac")
+            .fetch_one(shelf.state.db.pool())
+            .await
+            .unwrap();
+    shelf
+        .state
+        .services
+        .set_track_metadata(
+            shelf.owner,
+            Uuid::parse_str(&bare).unwrap(),
+            TrackMetadataPatch {
+                year: Some(Some(1999)),
+                ..TrackMetadataPatch::default()
+            },
+            None,
+        )
+        .await
+        .unwrap();
+    assert!(listed(AttentionCategory::MissingYear).await.is_empty());
+
+    let summary = shelf
+        .state
+        .services
+        .attention_summary(shelf.owner, shelf.library)
+        .await
+        .unwrap();
+    let count = |category: AttentionCategory| {
+        summary
+            .iter()
+            .find(|entry| entry.category == category)
+            .map(|entry| entry.count)
+    };
+    assert_eq!(summary.len(), AttentionCategory::ALL.len());
+    assert_eq!(summary[0].category, AttentionCategory::SplitCredits);
+    assert_eq!(count(AttentionCategory::TrackNumberGap), Some(3));
+    assert_eq!(count(AttentionCategory::ProbableDuplicate), Some(2));
+    assert_eq!(count(AttentionCategory::MissingYear), Some(0));
+
+    let duplicates = shelf
+        .state
+        .services
+        .attention_tracks(
+            shelf.owner,
+            shelf.library,
+            AttentionCategory::ProbableDuplicate,
+            BrowsePage::new(None, None).unwrap(),
+        )
+        .await
+        .unwrap();
+    assert!(
+        duplicates
+            .iter()
+            .all(|track| track.duplicate_group == Some(1)),
+        "both are one group"
+    );
+}
diff --git a/tests/credits/splits.rs b/tests/credits/splits.rs
new file mode 100644
index 00000000..7f021975
--- /dev/null
+++ b/tests/credits/splits.rs
@@ -0,0 +1,472 @@
+//! A split decision at work: the artists and ids it lands on, what a scan and
+//! an undo do with it, and what follows the parts through the journal.
+
+use super::*;
+
+#[tokio::test]
+async fn a_split_lands_on_the_artists_the_parts_name() {
+    let shelf = shelf("split-lands").await;
+    shelf
+        .apply(&file(0, "Ashreveal, Ashish Swargiary", Some("Duo")))
+        .await;
+    shelf.apply(&file(1, "Ashreveal", Some("Solo"))).await;
+    shelf.settle().await;
+    let solo = shelf.artist("Ashreveal").await;
+
+    shelf.split("Ashreveal, Ashish Swargiary").await;
+
+    assert_eq!(
+        shelf.credited(0, "artist").await,
+        names(&["Ashreveal", "Ashish Swargiary"])
+    );
+    assert_eq!(
+        shelf.artist("Ashreveal").await,
+        solo,
+        "the split credit lands on the artist the solo tracks already name"
+    );
+    assert_eq!(
+        shelf.artist_names().await,
+        names(&["Ashish Swargiary", "Ashreveal"]),
+        "the joined artist is swept once nothing credits it"
+    );
+}
+
+#[tokio::test]
+async fn an_album_keeps_its_id_through_a_split() {
+    let shelf = shelf("album-keeps").await;
+    shelf
+        .apply(&file(0, "Zedd, Alessia Cara", Some("Stay")))
+        .await;
+    shelf.settle().await;
+    let before: (String, String) =
+        sqlx::query_as("SELECT id, album_artist_name FROM album WHERE library_id = ?")
+            .bind(shelf.library.to_string())
+            .fetch_one(shelf.state.db.pool())
+            .await
+            .unwrap();
+
+    shelf.split("Zedd, Alessia Cara").await;
+    // Right after the decision, and again after the scan that reads the file
+    // afterwards: the decision's own pass and the scan each write the album.
+    for moment in ["after the decision", "after a rescan"] {
+        if moment == "after a rescan" {
+            shelf
+                .apply(&file(0, "Zedd, Alessia Cara", Some("Stay")))
+                .await;
+            shelf.settle().await;
+        }
+        let after: Vec<(String, String, String)> = sqlx::query_as(
+            "SELECT id, album_artist_name, album_artist_id FROM album WHERE library_id = ?",
+        )
+        .bind(shelf.library.to_string())
+        .fetch_all(shelf.state.db.pool())
+        .await
+        .unwrap();
+        assert_eq!(
+            after.len(),
+            1,
+            "{moment}: one album, not a second one minted beside it"
+        );
+        assert_eq!(
+            (after[0].0.clone(), after[0].1.clone()),
+            before,
+            "{moment}: the album's id and display stay what the file said"
+        );
+        assert_eq!(
+            after[0].2,
+            shelf.artist("Zedd").await.to_string(),
+            "{moment}: the album hangs off the first part"
+        );
+        assert_eq!(
+            shelf.credited(0, "albumartist").await,
+            names(&["Zedd", "Alessia Cara"]),
+            "{moment}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn a_scan_applies_a_decision_to_every_file_it_reads() {
+    let shelf = shelf("scan-applies").await;
+    shelf
+        .apply(&file(0, "Ice Spice, Central Cee", Some("Did It First")))
+        .await;
+    shelf.settle().await;
+    shelf.split("Ice Spice, Central Cee").await;
+
+    // A file the scan reads for the first time, and one it reads again
+    // because it changed: both come back split, which the desktop's own
+    // split never survived.
+    shelf
+        .apply(&file(1, "Ice Spice, Central Cee", Some("Single")))
+        .await;
+    let mut changed = file(0, "Ice Spice, Central Cee", Some("Did It First"));
+    changed.modified_at += 1;
+    changed.title = "Did It First (retagged)".into();
+    shelf.apply(&changed).await;
+    shelf.settle().await;
+
+    for index in [0, 1] {
+        assert_eq!(
+            shelf.credited(index, "artist").await,
+            names(&["Ice Spice", "Central Cee"]),
+            "file {index}"
+        );
+    }
+    assert!(
+        !shelf
+            .artist_names()
+            .await
+            .contains(&"Ice Spice, Central Cee".to_owned()),
+        "no scan brings the joined artist back"
+    );
+}
+
+#[tokio::test]
+async fn an_undo_restores_what_a_scan_without_the_decision_writes() {
+    let shelf = shelf("undo-restores").await;
+    let mut lead = file(0, "X, Y", Some("Pair"));
+    lead.sort_artist = Some("Xsort, Ysort".into());
+    shelf.apply(&lead).await;
+    shelf.apply(&file(1, "Z feat. X, Y", Some("Guest"))).await;
+    shelf.settle().await;
+    let whole = shelf.rows().await;
+
+    let decision = shelf.split("X, Y").await;
+    let split = shelf.rows().await;
+    assert_ne!(split, whole);
+    // A rescan of the same files writes exactly what the decision wrote.
+    shelf.apply(&lead).await;
+    shelf.apply(&file(1, "Z feat. X, Y", Some("Guest"))).await;
+    shelf.settle().await;
+    assert_eq!(shelf.rows().await, split, "a split and a rescan agree");
+
+    shelf.undo(decision).await;
+    assert_eq!(shelf.rows().await, whole, "the undo is a scan without it");
+    assert!(shelf.artist_names().await.contains(&"X, Y".to_owned()));
+    assert!(shelf
+        .state
+        .services
+        .credit_decisions(shelf.owner, shelf.library)
+        .await
+        .unwrap()
+        .is_empty());
+}
+
+#[tokio::test]
+async fn two_credits_sharing_a_part_keep_the_files_order_whichever_is_undone() {
+    let shelf = shelf("shared-part").await;
+    let mut both = file(0, "ignored", Some("Shared"));
+    // The plural tag is never cut by the first step, so each value is one
+    // credit and the two share their first fragment. Out of alphabetical
+    // order on purpose, at every level: an order taken from the names rather
+    // than from the file would put every list below the other way round.
+    both.artists = names(&["Z, Y", "Z, X"]);
+    shelf.apply(&both).await;
+    shelf.settle().await;
+
+    let first = shelf.split("Z, Y").await;
+    let second = shelf.split("Z, X").await;
+    assert_eq!(shelf.credited(0, "artist").await, names(&["Z", "Y", "X"]));
+
+    shelf.undo(second).await;
+    assert_eq!(
+        shelf.credited(0, "artist").await,
+        names(&["Z", "Y", "Z, X"])
+    );
+
+    let second = shelf.split("Z, X").await;
+    shelf.undo(first).await;
+    assert_eq!(
+        shelf.credited(0, "artist").await,
+        names(&["Z, Y", "Z", "X"]),
+        "the order is the file's, not what the shared part became"
+    );
+    shelf.undo(second).await;
+    assert_eq!(shelf.credited(0, "artist").await, names(&["Z, Y", "Z, X"]));
+}
+
+#[tokio::test]
+async fn a_correction_survives_a_split_and_a_rescan() {
+    let shelf = shelf("correction-final").await;
+    let mut input = file(0, "Hanumankind, Kalmi", Some("Big Dawgs"));
+    input.album_artist = Some("Hanumankind, Kalmi".into());
+    shelf.apply(&input).await;
+    shelf.settle().await;
+    let track: String = sqlx::query_scalar("SELECT id FROM track WHERE library_id = ?")
+        .bind(shelf.library.to_string())
+        .fetch_one(shelf.state.db.pool())
+        .await
+        .unwrap();
+    shelf
+        .state
+        .services
+        .set_track_metadata(
+            shelf.owner,
+            Uuid::parse_str(&track).unwrap(),
+            TrackMetadataPatch {
+                artists: Some(Some(names(&["Hanumankind, Kalmi"]))),
+                ..TrackMetadataPatch::default()
+            },
+            None,
+        )
+        .await
+        .unwrap();
+
+    shelf.split("Hanumankind, Kalmi").await;
+    // Right after the decision, whose own pass rewrites the track, and after
+    // the scan that reads the file again: each could undo the correction.
+    for moment in ["after the decision", "after a rescan"] {
+        if moment == "after a rescan" {
+            shelf.apply(&input).await;
+            shelf.settle().await;
+        }
+        assert_eq!(
+            shelf.credited(0, "artist").await,
+            names(&["Hanumankind, Kalmi"]),
+            "{moment}: a list someone typed is final"
+        );
+        assert_eq!(
+            shelf.credited(0, "albumartist").await,
+            names(&["Hanumankind", "Kalmi"]),
+            "{moment}: the roles the correction does not cover still follow the decision"
+        );
+    }
+}
+
+#[tokio::test]
+async fn a_split_keeps_each_parts_sort_form() {
+    let shelf = shelf("sort-forms").await;
+    let mut input = file(0, "A, B, B, C", Some("Sorted"));
+    input.sort_artist = Some("a, b, b, c".into());
+    shelf.apply(&input).await;
+    shelf.settle().await;
+
+    shelf.split("A, B, B, C").await;
+
+    let sorts: Vec<(String, Option<String>)> = sqlx::query_as(
+        "SELECT ar.name, tp.sort_name FROM track_participant tp \
+         JOIN artist ar ON ar.id = tp.artist_id \
+         WHERE tp.library_id = ? AND tp.role = 'artist' ORDER BY tp.position",
+    )
+    .bind(shelf.library.to_string())
+    .fetch_all(shelf.state.db.pool())
+    .await
+    .unwrap();
+    assert_eq!(
+        sorts,
+        vec![
+            ("A".to_owned(), Some("a".to_owned())),
+            ("B".to_owned(), Some("b".to_owned())),
+            ("C".to_owned(), Some("c".to_owned())),
+        ]
+    );
+    // And the artists themselves carry them, in the search index as well:
+    // the index is rebuilt from the artist rows, so the sort names have to be
+    // voted before it is, as at the end of a scan.
+    let indexed: Vec<(String, String, String)> = sqlx::query_as(
+        "SELECT ar.name, COALESCE(ar.sort_name, ''), fts.sort_name FROM artist ar          JOIN artist_fts fts ON fts.artist_id = ar.id          WHERE ar.library_id = ? ORDER BY ar.name",
+    )
+    .bind(shelf.library.to_string())
+    .fetch_all(shelf.state.db.pool())
+    .await
+    .unwrap();
+    assert_eq!(
+        indexed,
+        vec![
+            ("A".to_owned(), "a".to_owned(), "a".to_owned()),
+            ("B".to_owned(), "b".to_owned(), "b".to_owned()),
+            ("C".to_owned(), "c".to_owned(), "c".to_owned()),
+        ]
+    );
+}
+
+#[tokio::test]
+async fn a_retagged_spelling_is_still_split_and_still_undone() {
+    let shelf = shelf("retagged").await;
+    shelf
+        .apply(&file(0, "Drake, Lil Durk", Some("Laugh Now")))
+        .await;
+    shelf.settle().await;
+    let decision = shelf.split("Drake, Lil Durk").await;
+
+    let mut retagged = file(0, "drake, lil durk", Some("Laugh Now"));
+    retagged.modified_at += 1;
+    shelf.apply(&retagged).await;
+    shelf.settle().await;
+    assert_eq!(
+        shelf.credited(0, "artist").await,
+        names(&["Drake", "Lil Durk"]),
+        "the key folds case, so the new spelling is the same credit"
+    );
+
+    shelf.undo(decision).await;
+    assert_eq!(
+        shelf.credited(0, "artist").await,
+        names(&["drake, lil durk"]),
+        "the undo restores this file's own spelling"
+    );
+}
+
+#[tokio::test]
+async fn favourites_and_ratings_follow_the_parts_through_the_journal() {
+    let shelf = shelf("favourites-follow").await;
+    shelf
+        .apply(&file(0, "Tame Impala, JENNIE", Some("Dracula")))
+        .await;
+    shelf.apply(&file(1, "JENNIE", Some("Ruby"))).await;
+    shelf.settle().await;
+    let joined = shelf.artist("Tame Impala, JENNIE").await;
+    let jennie = shelf.artist("JENNIE").await;
+    let services = &shelf.state.services;
+    services
+        .set_star(shelf.owner, "artist", joined, true)
+        .await
+        .unwrap();
+    services
+        .set_rating(shelf.owner, "artist", joined, 4)
+        .await
+        .unwrap();
+    services
+        .set_rating(shelf.owner, "artist", jennie, 2)
+        .await
+        .unwrap();
+
+    shelf.split("Tame Impala, JENNIE").await;
+    let tame = shelf.artist("Tame Impala").await;
+
+    let starred: Vec<String> = sqlx::query_scalar(
+        "SELECT entity_id FROM user_star WHERE user_id = ? AND entity_type = 'artist' \
+         ORDER BY entity_id",
+    )
+    .bind(shelf.owner.to_string())
+    .fetch_all(shelf.state.db.pool())
+    .await
+    .unwrap();
+    let mut expected = vec![tame.to_string(), jennie.to_string()];
+    expected.sort();
+    assert_eq!(starred, expected, "the favourite is on every part");
+
+    let rated: Vec<(String, i64)> = sqlx::query_as(
+        "SELECT entity_id, rating FROM user_rating WHERE user_id = ? AND entity_type = 'artist' \
+         ORDER BY entity_id",
+    )
+    .bind(shelf.owner.to_string())
+    .fetch_all(shelf.state.db.pool())
+    .await
+    .unwrap();
+    let mut expected = vec![(tame.to_string(), 4), (jennie.to_string(), 2)];
+    expected.sort();
+    assert_eq!(rated, expected, "a part rated on its own keeps its rating");
+
+    // The journal says what moved, so a mirror converges on the same state.
+    let journal: Vec<(String, String, String)> = sqlx::query_as(
+        "SELECT entity_type, entity_id, action FROM sync_event WHERE user_id = ? \
+         AND entity_id IN (?, ?, ?) ORDER BY cursor",
+    )
+    .bind(shelf.owner.to_string())
+    .bind(joined.to_string())
+    .bind(tame.to_string())
+    .bind(jennie.to_string())
+    .fetch_all(shelf.state.db.pool())
+    .await
+    .unwrap();
+    for entry in [
+        ("favorite", joined, "delete"),
+        ("favorite", tame, "upsert"),
+        ("favorite", jennie, "upsert"),
+        ("rating", joined, "delete"),
+        ("rating", tame, "upsert"),
+    ] {
+        let entry = (entry.0.to_owned(), entry.1.to_string(), entry.2.to_owned());
+        assert!(
+            journal.contains(&entry),
+            "{entry:?} missing from {journal:?}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn the_feed_announces_what_a_split_moved() {
+    let shelf = shelf("feed").await;
+    shelf.apply(&file(0, "Curio, Lucy", Some("Echoes"))).await;
+    shelf.settle().await;
+    let joined = shelf.artist("Curio, Lucy").await;
+    let cursor: i64 = sqlx::query_scalar("SELECT COALESCE(MAX(cursor), 0) FROM library_event")
+        .fetch_one(shelf.state.db.pool())
+        .await
+        .unwrap();
+
+    shelf.split("Curio, Lucy").await;
+
+    let events: Vec<(String, String, String)> = sqlx::query_as(
+        "SELECT entity_type, entity_id, action FROM library_event \
+         WHERE library_id = ? AND cursor > ? ORDER BY cursor",
+    )
+    .bind(shelf.library.to_string())
+    .bind(cursor)
+    .fetch_all(shelf.state.db.pool())
+    .await
+    .unwrap();
+    let kinds: Vec<(&str, &str)> = events
+        .iter()
+        .map(|(kind, _, action)| (kind.as_str(), action.as_str()))
+        .collect();
+    assert!(kinds.contains(&("track", "upsert")), "{events:?}");
+    assert!(kinds.contains(&("album", "upsert")), "{events:?}");
+    assert!(
+        events.contains(&("artist".into(), joined.to_string(), "delete".into())),
+        "{events:?}"
+    );
+}
+
+/// The migration fills `track_credit` from the participants. Rebuilding it
+/// that way on a scanned library must answer what the scan's own credits
+/// answer, under no decision, a split and its undo — including a file that
+/// repeats a credit and one whose credits share a part.
+#[tokio::test]
+async fn the_migrations_copy_gives_what_a_scan_gives() {
+    let migration = include_str!("../../migrations-v2/20261024020000_artist_credit_decision.sql");
+    let copy = &migration[migration
+        .find("INSERT INTO track_credit")
+        .expect("the migration copies the participants")..];
+
+    let inputs = || {
+        let mut repeated = file(0, "ignored", Some("Twice"));
+        repeated.artists = names(&["A, C", "A, C"]);
+        let mut shared = file(1, "ignored", Some("Shared"));
+        shared.artists = names(&["A, B", "A, C"]);
+        let mut sorted = file(2, "A, B", Some("Sorted"));
+        sorted.sort_artist = Some("a, b".into());
+        [repeated, shared, sorted]
+    };
+    let mut answers = Vec::new();
+    for copied in [false, true] {
+        let shelf = shelf(if copied { "copied" } else { "scanned" }).await;
+        for input in inputs() {
+            shelf.apply(&input).await;
+        }
+        shelf.settle().await;
+        if copied {
+            sqlx::query("DELETE FROM track_credit")
+                .execute(shelf.state.db.pool())
+                .await
+                .unwrap();
+            sqlx::raw_sql(copy)
+                .execute(shelf.state.db.pool())
+                .await
+                .unwrap();
+        }
+        let whole = shelf.rows().await;
+        let first = shelf.split("A, B").await;
+        let second = shelf.split("A, C").await;
+        let split = shelf.rows().await;
+        shelf.undo(first).await;
+        let half = shelf.rows().await;
+        shelf.undo(second).await;
+        let undone = shelf.rows().await;
+        assert_eq!(undone, whole, "copied: {copied}");
+        answers.push((whole, split, half));
+    }
+    assert_eq!(answers[0], answers[1]);
+}
diff --git a/tests/discovery.rs b/tests/discovery.rs
deleted file mode 100644
index dbc3c3bf..00000000
--- a/tests/discovery.rs
+++ /dev/null
@@ -1,1304 +0,0 @@
-//! RFC-024: lyrics from LRCLIB, listening statistics, mixes and the local
-//! fallback for similar songs.
-//!
-//! LRCLIB is always a fake on a loopback listener of the test's own; the
-//! suite never reaches `lrclib.net`. The fake counts what it is asked, which
-//! is what most of the lyrics assertions are about.
-//!
-//! Accounts are inserted as rows rather than through `create_account`, as in
-//! `tests/enrichment/main.rs`: these tests need user ids, not a login, and the API
-//! is reached through tokens and Subsonic keys drawn at run time.
-
-#[allow(dead_code)]
-mod support;
-
-use std::{
-    collections::HashMap,
-    sync::{
-        atomic::{AtomicUsize, Ordering},
-        Arc, Mutex,
-    },
-    time::Duration,
-};
-
-use axum::{
-    extract::{Query, State},
-    http::{header, HeaderMap, StatusCode},
-    response::{IntoResponse, Response},
-    routing::get,
-    Router,
-};
-use uuid::Uuid;
-use waveflow_server::{
-    config::LyricsSettings,
-    lrclib::{LyricsLookup, LyricsProvider},
-    lyrics::LyricsInput,
-    services::ServiceError,
-    AppState, Config,
-};
-
-// ── Fixtures ──
-
-async fn account(state: &AppState, username: &str) -> Uuid {
-    let id = Uuid::new_v4();
-    let now = waveflow_server::authentication::now_ms();
-    sqlx::query(
-        "INSERT INTO account (id, username, password_hash, role, disabled, created_at, updated_at) \
-         VALUES (?, ?, 'this-account-never-authenticates', 'admin', 0, ?, ?)",
-    )
-    .bind(id.to_string())
-    .bind(username)
-    .bind(now)
-    .bind(now)
-    .execute(state.db.pool())
-    .await
-    .unwrap();
-    id
-}
-
-/// One file of a fixture library.
-#[derive(Clone)]
-struct File {
-    title: String,
-    artists: Vec<String>,
-    album: String,
-    album_artist: String,
-    genre: Option<String>,
-    year: Option<i64>,
-    duration_ms: i64,
-    lyrics: Option<&'static str>,
-}
-
-fn file(title: &str, artist: &str, genre: Option<&str>, year: Option<i64>) -> File {
-    File {
-        title: title.to_owned(),
-        artists: vec![artist.to_owned()],
-        album: format!("{artist} album"),
-        album_artist: artist.to_owned(),
-        genre: genre.map(str::to_owned),
-        year,
-        duration_ms: 234_000,
-        lyrics: None,
-    }
-}
-
-/// A private library of `owner`'s holding `files`, and the ids of their
-/// tracks in the order given. Every library gets its own range of hashes.
-async fn library(
-    state: &AppState,
-    config: &Config,
-    owner: Uuid,
-    name: &str,
-    files: &[File],
-) -> (Uuid, Vec<Uuid>) {
-    static NEXT: AtomicUsize = AtomicUsize::new(0);
-    let now = waveflow_server::authentication::now_ms();
-    let root = config.data_dir.join(name);
-    std::fs::create_dir_all(&root).unwrap();
-    let library = state
-        .db
-        .create_library(
-            owner,
-            name,
-            &std::fs::canonicalize(&root).unwrap(),
-            waveflow_server::database::LibraryVisibility::Private,
-            now,
-        )
-        .await
-        .unwrap();
-    let scan = state
-        .db
-        .create_scan_job(library, Some(owner), "manual")
-        .await
-        .unwrap();
-    state
-        .db
-        .start_scan_job(scan, files.len() as i64, false)
-        .await
-        .unwrap();
-    for (offset, spec) in files.iter().enumerate() {
-        let index = NEXT.fetch_add(1, Ordering::SeqCst) + 10_000;
-        let mut input = support::browse_input(
-            index,
-            &spec.title,
-            &spec.album,
-            &spec.artists.join(", "),
-            Some(offset as i64 + 1),
-            Some(1),
-        );
-        input.artists = spec.artists.clone();
-        input.album_artist = Some(spec.album_artist.clone());
-        input.genre = spec.genre.clone();
-        input.year = spec.year;
-        input.duration_ms = spec.duration_ms;
-        input.relative_path = format!("{name}/{offset}.flac");
-        if let Some(words) = spec.lyrics {
-            input.lyrics = vec![LyricsInput {
-                source: "embedded",
-                lang: "eng".into(),
-                synced: false,
-                content: words.into(),
-            }];
-        }
-        state
-            .db
-            .apply_catalog_track(library, scan, &input, None, false)
-            .await
-            .unwrap();
-    }
-    state
-        .db
-        .consolidate_catalog_derivations(library)
-        .await
-        .unwrap();
-    state.db.finish_scan_job(scan, 0).await.unwrap();
-    let mut ids = Vec::new();
-    for offset in 0..files.len() {
-        let id: String =
-            sqlx::query_scalar("SELECT id FROM track WHERE library_id=? AND relative_path=?")
-                .bind(library.to_string())
-                .bind(format!("{name}/{offset}.flac"))
-                .fetch_one(state.db.pool())
-                .await
-                .unwrap();
-        ids.push(id.parse().unwrap());
-    }
-    (library, ids)
-}
-
-async fn token(state: &AppState, user: Uuid, username: &str) -> String {
-    state
-        .services
-        .create_api_token(user, &[], username, "discovery", &[])
-        .await
-        .unwrap()
-        .1
-}
-
-async fn subsonic_key(state: &AppState, user: Uuid) -> String {
-    let api_key = format!("wfsk_{}", Uuid::new_v4().simple());
-    let password = Uuid::new_v4().simple().to_string();
-    state
-        .db
-        .set_subsonic_credential(
-            user,
-            user,
-            &state.secret_box.encrypt(password.as_bytes()).unwrap(),
-            &waveflow_server::security::token_hash(&api_key),
-            waveflow_server::authentication::now_ms(),
-        )
-        .await
-        .unwrap();
-    api_key
-}
-
-async fn get_json(router: &Router, uri: &str, token: &str) -> (StatusCode, serde_json::Value) {
-    let response = support::send_json(router, "GET", uri, token, None).await;
-    let status = response.status();
-    let text = support::body_text(response).await;
-    (status, serde_json::from_str(&text).unwrap_or_default())
-}
-
-/// A listen of `track` by `user`, `ago` milliseconds before now.
-async fn listen(state: &AppState, user: Uuid, track: Uuid, ago: i64) {
-    let at = waveflow_server::authentication::now_ms() - ago;
-    state
-        .services
-        .scrobble(user, track, true, Some(at))
-        .await
-        .unwrap();
-}
-
-const MINUTE: i64 = 60_000;
-const DAY: i64 = 24 * 60 * MINUTE;
-
-// ── A fake LRCLIB ──
-
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum Mode {
-    /// Synced and plain lyrics, for any track.
-    Hit,
-    /// LRCLIB's 404.
-    Miss,
-    /// An instrumental record.
-    Instrumental,
-    /// A 503 with a body that is not LRCLIB's.
-    Unavailable,
-    /// A `302` to `/followed`, which answers like `Hit`.
-    Redirect,
-    /// A well-formed answer two mebibytes long.
-    Oversized,
-}
-
-#[derive(Clone)]
-struct Fake {
-    mode: Arc<Mutex<Mode>>,
-    delay: Duration,
-    asked: Arc<AtomicUsize>,
-    followed: Arc<AtomicUsize>,
-    /// The query of the last request, and its User-Agent.
-    last: Arc<Mutex<Option<Asked>>>,
-}
-
-/// One request's query parameters, and the agent that sent them.
-type Asked = (HashMap<String, String>, String);
-
-struct Listener {
-    fake: Fake,
-    base_url: String,
-}
-
-async fn fake_lrclib(mode: Mode, delay: Duration) -> Listener {
-    let fake = Fake {
-        mode: Arc::new(Mutex::new(mode)),
-        delay,
-        asked: Arc::default(),
-        followed: Arc::default(),
-        last: Arc::default(),
-    };
-    let router = Router::new()
-        .route("/api/get", get(answer))
-        .route("/followed", get(followed))
-        .with_state(fake.clone());
-    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-    let address = listener.local_addr().unwrap();
-    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });
-    Listener {
-        fake,
-        base_url: format!("http://{address}"),
-    }
-}
-
-const SYNCED: &str = "[00:01.00]If you complain once more\n[00:04.50]You'll meet an army of me";
-const PLAIN: &str = "If you complain once more\nYou'll meet an army of me";
-
-async fn answer(
-    State(fake): State<Fake>,
-    Query(query): Query<HashMap<String, String>>,
-    headers: HeaderMap,
-) -> Response {
-    fake.asked.fetch_add(1, Ordering::SeqCst);
-    let agent = headers
-        .get(header::USER_AGENT)
-        .and_then(|value| value.to_str().ok())
-        .unwrap_or_default()
-        .to_owned();
-    let duration: f64 = query
-        .get("duration")
-        .and_then(|value| value.parse().ok())
-        .unwrap_or_default();
-    *fake.last.lock().unwrap() = Some((query, agent));
-    tokio::time::sleep(fake.delay).await;
-    let mode = *fake.mode.lock().unwrap();
-    match mode {
-        Mode::Hit => record(duration),
-        Mode::Miss => (
-            StatusCode::NOT_FOUND,
-            [(header::CONTENT_TYPE, "application/json")],
-            r#"{"code":404,"name":"TrackNotFound","message":"Failed to find specified track"}"#,
-        )
-            .into_response(),
-        Mode::Instrumental => json(format!(
-            r#"{{"id":1,"duration":{duration},"instrumental":true,"plainLyrics":null,"syncedLyrics":null}}"#
-        )),
-        Mode::Unavailable => (StatusCode::SERVICE_UNAVAILABLE, "<html>down</html>").into_response(),
-        Mode::Redirect => (StatusCode::FOUND, [(header::LOCATION, "/followed")]).into_response(),
-        Mode::Oversized => json(format!(
-            r#"{{"duration":{duration},"plainLyrics":"{}"}}"#,
-            "a".repeat(2 * 1024 * 1024)
-        )),
-    }
-}
-
-async fn followed(State(fake): State<Fake>) -> Response {
-    fake.followed.fetch_add(1, Ordering::SeqCst);
-    record(234.0)
-}
-
-fn record(duration: f64) -> Response {
-    json(
-        serde_json::json!({
-            "id": 1,
-            "trackName": "Army of Me",
-            "artistName": "Björk",
-            "albumName": "Post",
-            "duration": duration,
-            "instrumental": false,
-            "plainLyrics": PLAIN,
-            "syncedLyrics": SYNCED,
-        })
-        .to_string(),
-    )
-}
-
-fn json(body: String) -> Response {
-    ([(header::CONTENT_TYPE, "application/json")], body).into_response()
-}
-
-fn settings(providers: Vec<LyricsProvider>) -> LyricsSettings {
-    LyricsSettings {
-        providers,
-        // Fast enough that pacing never decides a test.
-        rate_per_sec: 1_000,
-        request_timeout: Duration::from_secs(5),
-        ..LyricsSettings::off()
-    }
-}
-
-fn lookup(state: &AppState, listener: &Listener) -> LyricsLookup {
-    LyricsLookup::with_base_url(
-        state.db.clone(),
-        &settings(vec![LyricsProvider::Lrclib]),
-        listener.base_url.clone(),
-    )
-    .unwrap()
-}
-
-async fn lookup_rows(state: &AppState) -> Vec<(String, i64, i64)> {
-    sqlx::query_as("SELECT outcome, fetched_at, expires_at FROM lyrics_lookup")
-        .fetch_all(state.db.pool())
-        .await
-        .unwrap()
-}
-
-/// One owner, one library: a track with no lyrics, one with embedded lyrics
-/// and one that will be given an upload.
-struct Shelf {
-    _temp: tempfile::TempDir,
-    config: Config,
-    state: AppState,
-    owner: Uuid,
-    bare: Uuid,
-    embedded: Uuid,
-    uploaded: Uuid,
-}
-
-async fn shelf() -> Shelf {
-    let (temp, config, state) = support::test_app().await;
-    let owner = account(&state, "lyrics-owner").await;
-    let mut army = file("Army of Me", "Björk", Some("Pop"), Some(1995));
-    army.album = "Post".into();
-    let mut hyper = file("Hyperballad", "Björk", Some("Pop"), Some(1995));
-    hyper.lyrics = Some("We live on a mountain");
-    let isobel = file("Isobel", "Björk", Some("Pop"), Some(1995));
-    let (_, ids) = library(&state, &config, owner, "lyrics", &[army, hyper, isobel]).await;
-    state
-        .services
-        .upload_lyrics(
-            owner,
-            ids[2],
-            waveflow_server::lyrics::UploadFormat::Txt,
-            b"My name Isobel",
-        )
-        .await
-        .unwrap();
-    Shelf {
-        _temp: temp,
-        config,
-        state,
-        owner,
-        bare: ids[0],
-        embedded: ids[1],
-        uploaded: ids[2],
-    }
-}
-
-// ── LRCLIB: decisions 1 to 5 ──
-
-/// Decision 1: the list is the switch. Built with no provider, the lookup is
-/// disabled and the fake is never asked.
-#[tokio::test]
-async fn nothing_is_asked_while_lrclib_is_not_named() {
-    let shelf = shelf().await;
-    let listener = fake_lrclib(Mode::Hit, Duration::ZERO).await;
-    let off = LyricsLookup::with_base_url(
-        shelf.state.db.clone(),
-        &settings(Vec::new()),
-        listener.base_url.clone(),
-    )
-    .unwrap();
-    assert!(!off.is_enabled());
-    shelf.state.services.use_lyrics_lookup(off);
-
-    let native = shelf
-        .state
-        .services
-        .track_lyrics(shelf.owner, shelf.bare)
-        .await
-        .unwrap();
-    assert!(native.structured_lyrics.is_empty());
-    let facade = shelf
-        .state
-        .services
-        .lyrics(shelf.owner, shelf.bare)
-        .await
-        .unwrap();
-    assert!(facade.structured_lyrics.is_empty());
-    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 0);
-    assert!(lookup_rows(&shelf.state).await.is_empty());
-}
-
-/// Decisions 2, 3 and 5: a track with no lyrics is looked up on the first
-/// ask, answered with the synced sheet credited to LRCLIB, and the second
-/// ask reads the cache.
-#[tokio::test]
-async fn a_track_without_lyrics_is_looked_up_once_and_credited() {
-    let shelf = shelf().await;
-    let listener = fake_lrclib(Mode::Hit, Duration::ZERO).await;
-    shelf
-        .state
-        .services
-        .use_lyrics_lookup(lookup(&shelf.state, &listener));
-    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
-    let bearer = token(&shelf.state, shelf.owner, "lyrics-owner").await;
-
-    let (status, body) = get_json(
-        &router,
-        &format!("/api/v2/tracks/{}/lyrics", shelf.bare),
-        &bearer,
-    )
-    .await;
-    assert_eq!(status, StatusCode::OK, "{body}");
-    let sheets = body["structuredLyrics"].as_array().unwrap();
-    assert_eq!(sheets.len(), 1, "{body}");
-    assert_eq!(sheets[0]["source"], "lrclib");
-    assert_eq!(sheets[0]["synced"], true);
-    assert_eq!(sheets[0]["lang"], "xxx");
-    assert_eq!(sheets[0]["line"][1]["start"], 4_500);
-    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 1);
-
-    // What was sent: the four fields LRCLIB matches on, and an agent that
-    // names the project.
-    let (query, agent) = listener.fake.last.lock().unwrap().clone().unwrap();
-    assert_eq!(query["artist_name"], "Björk");
-    assert_eq!(query["track_name"], "Army of Me");
-    assert_eq!(query["album_name"], "Post");
-    assert_eq!(query["duration"], "234");
-    assert!(agent.starts_with("WaveFlowServer/"), "{agent}");
-    assert!(
-        agent.contains("https://github.com/InstaZDLL/waveflow-server"),
-        "{agent}"
-    );
-
-    // The cache answers the second ask, and the download serves the sheet.
-    let again = shelf
-        .state
-        .services
-        .track_lyrics(shelf.owner, shelf.bare)
-        .await
-        .unwrap();
-    assert_eq!(again.structured_lyrics.len(), 1);
-    let download = shelf
-        .state
-        .services
-        .lyrics_file(shelf.owner, shelf.bare, None)
-        .await
-        .unwrap();
-    assert!(download.name.ends_with(".lrc"), "{}", download.name);
-    assert!(download.content.contains("[00:04.50]"));
-    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 1);
-    let rows = lookup_rows(&shelf.state).await;
-    assert_eq!(rows.len(), 1);
-    assert_eq!(rows[0].0, "hit");
-    assert_eq!(rows[0].2 - rows[0].1, 30 * DAY);
-}
-
-/// Decision 2: the file and the uploads always win, on every surface.
-#[tokio::test]
-async fn a_track_with_lyrics_of_its_own_is_never_looked_up() {
-    let shelf = shelf().await;
-    let listener = fake_lrclib(Mode::Hit, Duration::ZERO).await;
-    shelf
-        .state
-        .services
-        .use_lyrics_lookup(lookup(&shelf.state, &listener));
-
-    let embedded = shelf
-        .state
-        .services
-        .track_lyrics(shelf.owner, shelf.embedded)
-        .await
-        .unwrap();
-    assert_eq!(embedded.structured_lyrics.len(), 1);
-    assert_eq!(
-        embedded.structured_lyrics[0].source.as_deref(),
-        Some("embedded")
-    );
-    let uploaded = shelf
-        .state
-        .services
-        .track_lyrics(shelf.owner, shelf.uploaded)
-        .await
-        .unwrap();
-    assert_eq!(
-        uploaded.structured_lyrics[0].source.as_deref(),
-        Some("upload_txt")
-    );
-    // The façade does not serve uploads (RFC-012), and still does not look
-    // the track up: its owner chose its words.
-    let facade = shelf
-        .state
-        .services
-        .lyrics(shelf.owner, shelf.uploaded)
-        .await
-        .unwrap();
-    assert!(facade.structured_lyrics.is_empty());
-    let facade = shelf
-        .state
-        .services
-        .lyrics(shelf.owner, shelf.embedded)
-        .await
-        .unwrap();
-    assert_eq!(facade.structured_lyrics.len(), 1);
-    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 0);
-}
-
-/// Decision 5: `getLyricsBySongId` carries the sheet, synced, with no source
-/// attribute — the frozen element has none — and `getLyrics` finds it by
-/// exact artist and title.
-#[tokio::test]
-async fn the_facade_serves_the_sheet_without_a_source() {
-    let shelf = shelf().await;
-    let listener = fake_lrclib(Mode::Hit, Duration::ZERO).await;
-    shelf
-        .state
-        .services
-        .use_lyrics_lookup(lookup(&shelf.state, &listener));
-    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
-    let api_key = subsonic_key(&shelf.state, shelf.owner).await;
-
-    let by_id = support::subsonic_json(
-        &router,
-        "getLyricsBySongId",
-        &api_key,
-        &format!("&id={}", shelf.bare),
-    )
-    .await;
-    let sheets = by_id["subsonic-response"]["lyricsList"]["structuredLyrics"]
-        .as_array()
-        .unwrap_or_else(|| panic!("a list: {by_id}"));
-    assert_eq!(sheets.len(), 1);
-    assert_eq!(sheets[0]["synced"], true);
-    assert!(support::omits(&sheets[0], "source"), "{by_id}");
-    // And at the service the façade reads, not only in the node it builds:
-    // the sheet names no source there either.
-    let facade = shelf
-        .state
-        .services
-        .lyrics(shelf.owner, shelf.bare)
-        .await
-        .unwrap();
-    assert_eq!(facade.structured_lyrics.len(), 1);
-    assert!(facade.structured_lyrics[0].source.is_none());
-
-    let by_name = support::subsonic_json(
-        &router,
-        "getLyrics",
-        &api_key,
-        "&artist=Bj%C3%B6rk&title=Army%20of%20Me",
-    )
-    .await;
-    let value = by_name["subsonic-response"]["lyrics"]["value"]
-        .as_str()
-        .unwrap_or_else(|| panic!("lyrics text: {by_name}"));
-    assert!(value.contains("army of me"), "{by_name}");
-    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 1);
-}
-
-/// Decision 4: a 404 and an instrumental are answers, cached; a miss for the
-/// short TTL, an instrumental for the long one, and neither is a sheet.
-#[tokio::test]
-async fn a_miss_and_an_instrumental_are_cached_as_answers() {
-    for (mode, outcome, ttl) in [
-        (Mode::Miss, "miss", 7 * DAY),
-        (Mode::Instrumental, "instrumental", 30 * DAY),
-    ] {
-        let shelf = shelf().await;
-        let listener = fake_lrclib(mode, Duration::ZERO).await;
-        shelf
-            .state
-            .services
-            .use_lyrics_lookup(lookup(&shelf.state, &listener));
-        for _ in 0..2 {
-            let answer = shelf
-                .state
-                .services
-                .track_lyrics(shelf.owner, shelf.bare)
-                .await
-                .unwrap();
-            assert!(answer.structured_lyrics.is_empty());
-        }
-        assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 1, "{outcome}");
-        let rows = lookup_rows(&shelf.state).await;
-        assert_eq!(rows.len(), 1);
-        assert_eq!(rows[0].0, outcome);
-        assert_eq!(rows[0].2 - rows[0].1, ttl, "{outcome}");
-    }
-}
-
-/// Decision 4: an outage, a redirect and an oversized answer are unreached.
-/// They write nothing, so the next ask tries again — and the redirect is not
-/// followed.
-#[tokio::test]
-async fn an_unreached_lookup_writes_nothing_and_is_asked_again() {
-    for mode in [Mode::Unavailable, Mode::Redirect, Mode::Oversized] {
-        let shelf = shelf().await;
-        let listener = fake_lrclib(mode, Duration::ZERO).await;
-        let lookup = lookup(&shelf.state, &listener);
-        shelf.state.services.use_lyrics_lookup(lookup.clone());
-        for _ in 0..2 {
-            let answer = shelf
-                .state
-                .services
-                .track_lyrics(shelf.owner, shelf.bare)
-                .await
-                .unwrap();
-            assert!(answer.structured_lyrics.is_empty());
-            lookup.idle().await;
-        }
-        assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 2);
-        assert_eq!(listener.fake.followed.load(Ordering::SeqCst), 0);
-        assert!(lookup_rows(&shelf.state).await.is_empty());
-    }
-}
-
-/// Decision 3: concurrent asks for one track wait on one request.
-#[tokio::test]
-async fn concurrent_asks_make_one_request() {
-    let shelf = shelf().await;
-    let listener = fake_lrclib(Mode::Hit, Duration::from_millis(300)).await;
-    shelf
-        .state
-        .services
-        .use_lyrics_lookup(lookup(&shelf.state, &listener));
-    let asks = (0..6).map(|_| {
-        let services = shelf.state.services.clone();
-        let (owner, track) = (shelf.owner, shelf.bare);
-        tokio::spawn(async move { services.track_lyrics(owner, track).await.unwrap() })
-    });
-    for ask in futures_util::future::join_all(asks).await {
-        assert_eq!(ask.unwrap().structured_lyrics.len(), 1);
-    }
-    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 1);
-}
-
-/// Decision 3: the answering path waits a bounded time. A slower answer is
-/// not waited for, and is in the cache for the next listen.
-#[tokio::test]
-async fn a_slow_answer_is_not_waited_for_and_lands_for_the_next_listen() {
-    let shelf = shelf().await;
-    let listener = fake_lrclib(Mode::Hit, Duration::from_millis(600)).await;
-    let lookup = lookup(&shelf.state, &listener).with_answer_wait(Duration::from_millis(50));
-    shelf.state.services.use_lyrics_lookup(lookup.clone());
-
-    let started = std::time::Instant::now();
-    let first = shelf
-        .state
-        .services
-        .track_lyrics(shelf.owner, shelf.bare)
-        .await
-        .unwrap();
-    assert!(first.structured_lyrics.is_empty());
-    assert!(started.elapsed() < Duration::from_millis(500));
-    lookup.idle().await;
-    let next = shelf
-        .state
-        .services
-        .track_lyrics(shelf.owner, shelf.bare)
-        .await
-        .unwrap();
-    assert_eq!(next.structured_lyrics.len(), 1);
-    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 1);
-}
-
-/// Decision 4: a stale row is served at once, and its refresh is scheduled.
-#[tokio::test]
-async fn a_stale_answer_is_served_while_it_is_refreshed() {
-    let shelf = shelf().await;
-    let listener = fake_lrclib(Mode::Hit, Duration::ZERO).await;
-    let lookup = lookup(&shelf.state, &listener);
-    shelf.state.services.use_lyrics_lookup(lookup.clone());
-    shelf
-        .state
-        .services
-        .track_lyrics(shelf.owner, shelf.bare)
-        .await
-        .unwrap();
-    sqlx::query("UPDATE lyrics_lookup SET expires_at = 1")
-        .execute(shelf.state.db.pool())
-        .await
-        .unwrap();
-    *listener.fake.mode.lock().unwrap() = Mode::Miss;
-
-    let stale = shelf
-        .state
-        .services
-        .track_lyrics(shelf.owner, shelf.bare)
-        .await
-        .unwrap();
-    assert_eq!(
-        stale.structured_lyrics.len(),
-        1,
-        "the stale sheet is served"
-    );
-    lookup.idle().await;
-    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 2);
-    assert_eq!(lookup_rows(&shelf.state).await[0].0, "miss");
-}
-
-/// Decision 4: the tenancy lookup comes first. Another account's track is
-/// not found, and nothing is read or sent about it.
-#[tokio::test]
-async fn another_account_s_track_is_not_found_and_not_looked_up() {
-    let shelf = shelf().await;
-    let outsider = account(&shelf.state, "lyrics-outsider").await;
-    let listener = fake_lrclib(Mode::Hit, Duration::ZERO).await;
-    shelf
-        .state
-        .services
-        .use_lyrics_lookup(lookup(&shelf.state, &listener));
-
-    assert!(matches!(
-        shelf
-            .state
-            .services
-            .track_lyrics(outsider, shelf.bare)
-            .await,
-        Err(ServiceError::NotFound)
-    ));
-    assert!(matches!(
-        shelf.state.services.lyrics(outsider, shelf.bare).await,
-        Err(ServiceError::NotFound)
-    ));
-    let by_name = shelf
-        .state
-        .services
-        .lyrics_by_metadata(outsider, Some("Björk"), Some("Army of Me"))
-        .await
-        .unwrap();
-    assert!(by_name.is_none());
-    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 0);
-}
-
-// ── Statistics: decision 6 ──
-
-/// Two accounts, each with a library; the first also reaches the second's
-/// for a while, then leaves it.
-#[tokio::test]
-async fn statistics_count_the_caller_s_listens_on_tracks_they_still_reach() {
-    let (_temp, config, state) = support::test_app().await;
-    let me = account(&state, "stats-me").await;
-    let other = account(&state, "stats-other").await;
-    let (_, mine) = library(
-        &state,
-        &config,
-        me,
-        "stats-mine",
-        &[
-            file("One", "Björk", Some("Pop"), Some(1995)),
-            file("Two", "Björk", Some("Pop; Electronic"), Some(1997)),
-            file("Three", "Sigur Rós", Some("Post-Rock"), Some(2002)),
-        ],
-    )
-    .await;
-    let (theirs_id, theirs) = library(
-        &state,
-        &config,
-        other,
-        "stats-theirs",
-        &[file("Elsewhere", "Björk", Some("Pop"), Some(2001))],
-    )
-    .await;
-    // Joined for a while: my listen there counts while I am a member.
-    sqlx::query(
-        "INSERT INTO library_member (library_id, user_id, role, created_at) \
-         VALUES (?, ?, 'listener', 0)",
-    )
-    .bind(theirs_id.to_string())
-    .bind(me.to_string())
-    .execute(state.db.pool())
-    .await
-    .unwrap();
-    listen(&state, me, theirs[0], 3 * MINUTE).await;
-    for ago in [MINUTE, 2 * DAY, 40 * DAY] {
-        listen(&state, me, mine[1], ago).await;
-    }
-    listen(&state, me, mine[0], 5 * DAY).await;
-    listen(&state, me, mine[2], 6 * DAY).await;
-    // The other account's listens are never mine.
-    for _ in 0..5 {
-        listen(&state, other, theirs[0], MINUTE).await;
-    }
-    // A now playing is not a listen.
-    state
-        .services
-        .scrobble(me, mine[2], false, None)
-        .await
-        .unwrap();
-
-    let query = |period| waveflow_server::services::StatsQuery::new(Some(period), None, None);
-    let week = state
-        .services
-        .listening_stats(me, query("7d").unwrap())
-        .await
-        .unwrap();
-    assert_eq!(week.totals.plays, 5);
-    assert_eq!(week.totals.listening_ms, 5 * 234_000);
-    assert_eq!(week.totals.tracks, 4);
-    // Björk in two libraries is one artist.
-    assert_eq!(week.totals.artists, 2);
-    assert_eq!(week.top_tracks[0].song.title, "Two");
-    assert_eq!(week.top_tracks[0].plays, 2);
-    assert_eq!(week.top_artists[0].artist.name, "Björk");
-    assert_eq!(week.top_artists[0].plays, 4);
-    assert_eq!(week.top_genres[0].name, "Pop");
-    assert_eq!(week.top_genres[0].plays, 4);
-    assert_eq!(week.timeline.len(), 7);
-    assert_eq!(
-        week.timeline.iter().map(|bucket| bucket.plays).sum::<i64>(),
-        5
-    );
-    assert_eq!(week.first_play.as_ref().unwrap().song.title, "Three");
-    assert_eq!(week.last_play.as_ref().unwrap().song.title, "Two");
-    assert!(week.top_albums.iter().all(|entry| entry.plays > 0));
-
-    let month = state
-        .services
-        .listening_stats(me, query("30d").unwrap())
-        .await
-        .unwrap();
-    assert_eq!(month.totals.plays, 5);
-    assert_eq!(month.timeline.len(), 30);
-    let all = state
-        .services
-        .listening_stats(me, query("all").unwrap())
-        .await
-        .unwrap();
-    assert_eq!(all.totals.plays, 6);
-    assert!(all.from.is_none());
-    let year = state
-        .services
-        .listening_stats(me, query("365d").unwrap())
-        .await
-        .unwrap();
-    assert_eq!(year.timeline.len(), 12);
-
-    // Leaving the library takes its listens out, as it takes the track out
-    // of every other answer.
-    sqlx::query("DELETE FROM library_member WHERE library_id=? AND user_id=?")
-        .bind(theirs_id.to_string())
-        .bind(me.to_string())
-        .execute(state.db.pool())
-        .await
-        .unwrap();
-    let after = state
-        .services
-        .listening_stats(me, query("7d").unwrap())
-        .await
-        .unwrap();
-    assert_eq!(after.totals.plays, 4);
-    assert!(after
-        .top_tracks
-        .iter()
-        .all(|entry| entry.song.title != "Elsewhere"));
-
-    // And the other account sees only its own five.
-    let theirs_stats = state
-        .services
-        .listening_stats(other, query("7d").unwrap())
-        .await
-        .unwrap();
-    assert_eq!(theirs_stats.totals.plays, 5);
-}
-
-/// The route: its parameters are validated and it needs a credential.
-#[tokio::test]
-async fn the_statistics_route_validates_its_parameters() {
-    let (_temp, config, state) = support::test_app().await;
-    let me = account(&state, "stats-route").await;
-    let router = waveflow_server::app(&config, state.clone());
-    let bearer = token(&state, me, "stats-route").await;
-
-    let (status, body) = get_json(
-        &router,
-        "/api/v2/stats?period=7d&utc_offset_minutes=120",
-        &bearer,
-    )
-    .await;
-    assert_eq!(status, StatusCode::OK, "{body}");
-    assert_eq!(body["period"], "7d");
-    assert_eq!(body["bucket"], "day");
-    assert_eq!(body["totals"]["plays"], 0);
-    assert_eq!(body["timeline"].as_array().unwrap().len(), 7);
-    for bad in [
-        "period=90d",
-        "limit=0",
-        "limit=51",
-        "utc_offset_minutes=900",
-    ] {
-        let (status, _) = get_json(&router, &format!("/api/v2/stats?{bad}"), &bearer).await;
-        assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY, "{bad}");
-    }
-    let anonymous = support::send_json(&router, "GET", "/api/v2/stats", "not-a-token", None).await;
-    assert_eq!(anonymous.status(), StatusCode::UNAUTHORIZED);
-}
-
-// ── Mixes: decision 7 ──
-
-#[tokio::test]
-async fn mixes_are_listed_and_an_empty_one_is_left_out() {
-    let (_temp, config, state) = support::test_app().await;
-    let me = account(&state, "mix-list").await;
-    let files: Vec<File> = (0..12)
-        .map(|n| {
-            file(
-                &format!("Song {n}"),
-                &format!("Artist {n}"),
-                Some("Jazz"),
-                Some(1960),
-            )
-        })
-        .collect();
-    library(&state, &config, me, "mix-list", &files).await;
-    let query = waveflow_server::services::MixQuery::new(Vec::new(), None, None).unwrap();
-
-    let mixes = state.services.list_mixes(me, &query).await.unwrap();
-    let ids: Vec<&str> = mixes.iter().map(|mix| mix.id.as_str()).collect();
-    // Nothing played and nothing starred: those two are not offered.
-    assert_eq!(
-        ids,
-        [
-            "recently-added",
-            "never-played",
-            "genre:jazz",
-            "decade:1960"
-        ],
-        "{ids:?}"
-    );
-    assert_eq!(mixes[2].genre.as_deref(), Some("Jazz"));
-    assert_eq!(mixes[3].decade, Some(1960));
-    assert!(mixes.iter().all(|mix| mix.track_count == 12));
-    assert!(matches!(
-        state.services.mix(me, "most-played", &query).await,
-        Err(ServiceError::NotFound)
-    ));
-    assert!(matches!(
-        state.services.mix(me, "no-such-mix", &query).await,
-        Err(ServiceError::NotFound)
-    ));
-}
-
-/// Variety and determinism: no artist holds more than its share, two asks
-/// on one day answer one mix, and a listened track leaves "never played".
-#[tokio::test]
-async fn a_mix_is_varied_and_the_same_all_day() {
-    let (_temp, config, state) = support::test_app().await;
-    let me = account(&state, "mix-vary").await;
-    let mut files: Vec<File> = (0..30)
-        .map(|n| {
-            file(
-                &format!("Prolific {n}"),
-                "Prolific",
-                Some("Rock"),
-                Some(1990),
-            )
-        })
-        .collect();
-    files.extend((0..10).map(|n| {
-        file(
-            &format!("Other {n}"),
-            &format!("Other {n}"),
-            Some("Rock"),
-            Some(1990),
-        )
-    }));
-    let (_, ids) = library(&state, &config, me, "mix-vary", &files).await;
-    let query = waveflow_server::services::MixQuery::new(Vec::new(), Some(20), None).unwrap();
-
-    let first = state
-        .services
-        .mix(me, "never-played", &query)
-        .await
-        .unwrap();
-    let again = state
-        .services
-        .mix(me, "never-played", &query)
-        .await
-        .unwrap();
-    let order = |mix: &waveflow_server::services::Mix| {
-        mix.songs.iter().map(|song| song.id).collect::<Vec<_>>()
-    };
-    assert_eq!(order(&first), order(&again));
-    let prolific = first
-        .songs
-        .iter()
-        .filter(|song| song.artist.as_deref() == Some("Prolific"))
-        .count();
-    assert_eq!(prolific, 2, "a tenth of twenty, and never fewer than two");
-    assert_eq!(first.songs.len(), 12);
-    for pair in first.songs.windows(2) {
-        assert_ne!(pair[0].artist, pair[1].artist);
-    }
-
-    // Most played is a ranking: twice before once, whatever came last.
-    listen(&state, me, ids[31], 3 * MINUTE).await;
-    listen(&state, me, ids[31], 2 * MINUTE).await;
-    listen(&state, me, ids[30], MINUTE).await;
-    let played = state.services.mix(me, "most-played", &query).await.unwrap();
-    assert_eq!(order(&played), [ids[31], ids[30]]);
-    let never = state
-        .services
-        .mix(me, "never-played", &query)
-        .await
-        .unwrap();
-    assert!(!order(&never).contains(&ids[30]));
-    assert!(!order(&never).contains(&ids[31]));
-}
-
-/// A favourite is forgotten when starred long ago and not listened to
-/// lately; a fresh star and a recent listen both keep it out.
-#[tokio::test]
-async fn forgotten_favourites_are_old_stars_not_listened_to_lately() {
-    let (_temp, config, state) = support::test_app().await;
-    let me = account(&state, "mix-forgotten").await;
-    let files: Vec<File> = (0..3)
-        .map(|n| file(&format!("Star {n}"), &format!("Starred {n}"), None, None))
-        .collect();
-    let (_, ids) = library(&state, &config, me, "mix-forgotten", &files).await;
-    let now = waveflow_server::authentication::now_ms();
-    for (track, starred_ago) in [(ids[0], 60 * DAY), (ids[1], DAY), (ids[2], 60 * DAY)] {
-        sqlx::query(
-            "INSERT INTO user_star (user_id, entity_type, entity_id, starred_at) \
-             VALUES (?, 'track', ?, ?)",
-        )
-        .bind(me.to_string())
-        .bind(track.to_string())
-        .bind(now - starred_ago)
-        .execute(state.db.pool())
-        .await
-        .unwrap();
-    }
-    listen(&state, me, ids[2], 10 * DAY).await;
-    let query = waveflow_server::services::MixQuery::new(Vec::new(), None, None).unwrap();
-    let mix = state
-        .services
-        .mix(me, "forgotten-favourites", &query)
-        .await
-        .unwrap();
-    assert_eq!(
-        mix.songs.iter().map(|song| song.id).collect::<Vec<_>>(),
-        [ids[0]]
-    );
-}
-
-/// Tenancy: another account's tracks are never in a mix, and a genre only
-/// another account holds is not found.
-#[tokio::test]
-async fn a_mix_holds_only_the_caller_s_tracks() {
-    let (_temp, config, state) = support::test_app().await;
-    let me = account(&state, "mix-me").await;
-    let other = account(&state, "mix-other").await;
-    let (_, mine) = library(
-        &state,
-        &config,
-        me,
-        "mix-me",
-        &[file("Mine", "Me", Some("Folk"), Some(1970))],
-    )
-    .await;
-    library(
-        &state,
-        &config,
-        other,
-        "mix-other",
-        &[file("Theirs", "Them", Some("Grime"), Some(2005))],
-    )
-    .await;
-    let router = waveflow_server::app(&config, state.clone());
-    let bearer = token(&state, me, "mix-me").await;
-
-    let (status, body) = get_json(&router, "/api/v2/mixes/never-played", &bearer).await;
-    assert_eq!(status, StatusCode::OK, "{body}");
-    assert_eq!(support::song_ids(&body["songs"]), [mine[0].to_string()]);
-    let (status, _) = get_json(&router, "/api/v2/mixes/genre%3Agrime", &bearer).await;
-    assert_eq!(status, StatusCode::NOT_FOUND);
-    let (status, _) = get_json(&router, "/api/v2/mixes/decade%3A2000", &bearer).await;
-    assert_eq!(status, StatusCode::NOT_FOUND);
-    let (status, body) = get_json(&router, "/api/v2/mixes", &bearer).await;
-    assert_eq!(status, StatusCode::OK);
-    assert!(body
-        .as_array()
-        .unwrap()
-        .iter()
-        .all(|mix| mix["id"] != "genre:grime"));
-    let (status, _) = get_json(&router, "/api/v2/mixes?limit=101", &bearer).await;
-    assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY);
-}
-
-// ── Similar songs without a provider: decision 8 ──
-
-async fn drawn(state: &AppState, user: Uuid, id: Uuid) -> Vec<String> {
-    let mut names: Vec<String> = state
-        .services
-        .similar_songs(user, id, 50)
-        .await
-        .unwrap()
-        .into_iter()
-        .map(|song| song.artist.unwrap_or_default())
-        .collect();
-    names.sort();
-    names.dedup();
-    names
-}
-
-async fn artist_named(state: &AppState, user: Uuid, name: &str) -> Uuid {
-    state
-        .services
-        .list_artists(
-            user,
-            None,
-            waveflow_server::services::BrowsePage::new(None, None).unwrap(),
-        )
-        .await
-        .unwrap()
-        .into_iter()
-        .find(|artist| artist.artist.name == name)
-        .unwrap_or_else(|| panic!("{name} is not visible"))
-        .artist
-        .id
-}
-
-/// A shared genre makes a neighbour; an artist sharing nothing does not,
-/// even of the same era; and an artist in another account's library is never
-/// one, whatever it shares.
-#[tokio::test]
-async fn a_shared_genre_makes_a_local_neighbour_and_nothing_foreign_does() {
-    let (_temp, config, state) = support::test_app().await;
-    let me = account(&state, "similar-me").await;
-    let other = account(&state, "similar-other").await;
-    library(
-        &state,
-        &config,
-        me,
-        "similar-me",
-        &[
-            file("Hyperballad", "Björk", Some("Electronic"), Some(1995)),
-            // No year, so its score is the genre alone — the score each
-            // foreign artist below would have.
-            file("Svefn-g-englar", "Sigur Rós", Some("Electronic"), None),
-            file("Enter Sandman", "Metallica", Some("Metal"), Some(1995)),
-        ],
-    )
-    .await;
-    // Twenty artists sharing the genre, in a library the caller is not in,
-    // named to sort before Sigur Rós: counted as neighbours, they would take
-    // every place and push the visible one out of the draw.
-    let foreign: Vec<File> = (0..20)
-        .map(|n| file("Elsewhere", &format!("Aa {n:02}"), Some("Electronic"), None))
-        .collect();
-    library(&state, &config, other, "similar-other", &foreign).await;
-    let bjork = artist_named(&state, me, "Björk").await;
-
-    assert_eq!(drawn(&state, me, bjork).await, ["Björk", "Sigur Rós"]);
-}
-
-/// A co-credit makes a neighbour without a shared genre, and so does
-/// listening to an artist straight after the seed.
-#[tokio::test]
-async fn a_co_credit_and_a_co_listen_make_local_neighbours() {
-    let (_temp, config, state) = support::test_app().await;
-    let me = account(&state, "similar-credit").await;
-    let mut duet = file("Nattura", "Björk", None, None);
-    duet.artists = vec!["Björk".into(), "Thom Yorke".into()];
-    let (_, ids) = library(
-        &state,
-        &config,
-        me,
-        "similar-credit",
-        &[
-            file("Joga", "Björk", None, None),
-            duet,
-            file("Clair de lune", "Debussy", None, None),
-            file("Unrelated", "Nobody Near", None, None),
-            file("Analyse", "Thom Yorke", None, None),
-        ],
-    )
-    .await;
-    let bjork = artist_named(&state, me, "Björk").await;
-    // Thom Yorke's own track is drawn because of the duet; Debussy and
-    // Nobody Near share nothing with Björk yet.
-    assert_eq!(
-        drawn(&state, me, bjork).await,
-        ["Björk", "Björk, Thom Yorke", "Thom Yorke"]
-    );
-
-    // Debussy straight after Björk, twice; Nobody Near a day later.
-    listen(&state, me, ids[0], 60 * MINUTE).await;
-    listen(&state, me, ids[2], 55 * MINUTE).await;
-    listen(&state, me, ids[0], 20 * MINUTE).await;
-    listen(&state, me, ids[2], 15 * MINUTE).await;
-    listen(&state, me, ids[3], 2 * DAY).await;
-    let names = drawn(&state, me, bjork).await;
-    assert!(names.contains(&"Debussy".to_owned()), "{names:?}");
-    assert!(!names.contains(&"Nobody Near".to_owned()), "{names:?}");
-}
-
-/// The façade end to end with no provider: both methods answer songs where
-/// they used to answer an empty container, and the native route is the same
-/// draw.
-#[tokio::test]
-async fn the_similar_songs_methods_answer_without_a_provider() {
-    let (_temp, config, state) = support::test_app().await;
-    let me = account(&state, "similar-route").await;
-    let other = account(&state, "similar-route-other").await;
-    library(
-        &state,
-        &config,
-        me,
-        "similar-route",
-        &[
-            file("Hyperballad", "Björk", Some("Electronic"), Some(1995)),
-            file(
-                "Svefn-g-englar",
-                "Sigur Rós",
-                Some("Electronic"),
-                Some(1999),
-            ),
-        ],
-    )
-    .await;
-    library(
-        &state,
-        &config,
-        other,
-        "similar-route-other",
-        &[file("Far", "Far Away", None, None)],
-    )
-    .await;
-    let bjork = artist_named(&state, me, "Björk").await;
-    let far = artist_named(&state, other, "Far Away").await;
-    let router = waveflow_server::app(&config, state.clone());
-    let api_key = subsonic_key(&state, me).await;
-    let bearer = token(&state, me, "similar-route").await;
-
-    for (method, container) in [
-        ("getSimilarSongs", "similarSongs"),
-        ("getSimilarSongs2", "similarSongs2"),
-    ] {
-        let body = support::subsonic_json(&router, method, &api_key, &format!("&id={bjork}")).await;
-        let songs = body["subsonic-response"][container]["song"]
-            .as_array()
-            .unwrap_or_else(|| panic!("an array: {body}"));
-        assert_eq!(songs.len(), 2, "{method}");
-    }
-    let (status, body) = get_json(
-        &router,
-        &format!("/api/v2/similar-songs/{bjork}?limit=1"),
-        &bearer,
-    )
-    .await;
-    assert_eq!(status, StatusCode::OK, "{body}");
-    assert_eq!(body.as_array().unwrap().len(), 1);
-    let (status, _) = get_json(&router, &format!("/api/v2/similar-songs/{far}"), &bearer).await;
-    assert_eq!(status, StatusCode::NOT_FOUND);
-}
diff --git a/tests/discovery/listening.rs b/tests/discovery/listening.rs
new file mode 100644
index 00000000..333bd4d3
--- /dev/null
+++ b/tests/discovery/listening.rs
@@ -0,0 +1,358 @@
+//! What the caller's listens make: the statistics and the mixes.
+
+use super::*;
+
+// ── Statistics: decision 6 ──
+
+/// Two accounts, each with a library; the first also reaches the second's
+/// for a while, then leaves it.
+#[tokio::test]
+async fn statistics_count_the_caller_s_listens_on_tracks_they_still_reach() {
+    let (_temp, config, state) = support::test_app().await;
+    let me = account(&state, "stats-me").await;
+    let other = account(&state, "stats-other").await;
+    let (_, mine) = library(
+        &state,
+        &config,
+        me,
+        "stats-mine",
+        &[
+            file("One", "Björk", Some("Pop"), Some(1995)),
+            file("Two", "Björk", Some("Pop; Electronic"), Some(1997)),
+            file("Three", "Sigur Rós", Some("Post-Rock"), Some(2002)),
+        ],
+    )
+    .await;
+    let (theirs_id, theirs) = library(
+        &state,
+        &config,
+        other,
+        "stats-theirs",
+        &[file("Elsewhere", "Björk", Some("Pop"), Some(2001))],
+    )
+    .await;
+    // Joined for a while: my listen there counts while I am a member.
+    sqlx::query(
+        "INSERT INTO library_member (library_id, user_id, role, created_at) \
+         VALUES (?, ?, 'listener', 0)",
+    )
+    .bind(theirs_id.to_string())
+    .bind(me.to_string())
+    .execute(state.db.pool())
+    .await
+    .unwrap();
+    listen(&state, me, theirs[0], 3 * MINUTE).await;
+    for ago in [MINUTE, 2 * DAY, 40 * DAY] {
+        listen(&state, me, mine[1], ago).await;
+    }
+    listen(&state, me, mine[0], 5 * DAY).await;
+    listen(&state, me, mine[2], 6 * DAY).await;
+    // The other account's listens are never mine.
+    for _ in 0..5 {
+        listen(&state, other, theirs[0], MINUTE).await;
+    }
+    // A now playing is not a listen.
+    state
+        .services
+        .scrobble(me, mine[2], false, None)
+        .await
+        .unwrap();
+
+    let query = |period| waveflow_server::services::StatsQuery::new(Some(period), None, None);
+    let week = state
+        .services
+        .listening_stats(me, query("7d").unwrap())
+        .await
+        .unwrap();
+    assert_eq!(week.totals.plays, 5);
+    assert_eq!(week.totals.listening_ms, 5 * 234_000);
+    assert_eq!(week.totals.tracks, 4);
+    // Björk in two libraries is one artist.
+    assert_eq!(week.totals.artists, 2);
+    assert_eq!(week.top_tracks[0].song.title, "Two");
+    assert_eq!(week.top_tracks[0].plays, 2);
+    assert_eq!(week.top_artists[0].artist.name, "Björk");
+    assert_eq!(week.top_artists[0].plays, 4);
+    assert_eq!(week.top_genres[0].name, "Pop");
+    assert_eq!(week.top_genres[0].plays, 4);
+    assert_eq!(week.timeline.len(), 7);
+    assert_eq!(
+        week.timeline.iter().map(|bucket| bucket.plays).sum::<i64>(),
+        5
+    );
+    assert_eq!(week.first_play.as_ref().unwrap().song.title, "Three");
+    assert_eq!(week.last_play.as_ref().unwrap().song.title, "Two");
+    assert!(week.top_albums.iter().all(|entry| entry.plays > 0));
+
+    let month = state
+        .services
+        .listening_stats(me, query("30d").unwrap())
+        .await
+        .unwrap();
+    assert_eq!(month.totals.plays, 5);
+    assert_eq!(month.timeline.len(), 30);
+    let all = state
+        .services
+        .listening_stats(me, query("all").unwrap())
+        .await
+        .unwrap();
+    assert_eq!(all.totals.plays, 6);
+    assert!(all.from.is_none());
+    let year = state
+        .services
+        .listening_stats(me, query("365d").unwrap())
+        .await
+        .unwrap();
+    assert_eq!(year.timeline.len(), 12);
+
+    // Leaving the library takes its listens out, as it takes the track out
+    // of every other answer.
+    sqlx::query("DELETE FROM library_member WHERE library_id=? AND user_id=?")
+        .bind(theirs_id.to_string())
+        .bind(me.to_string())
+        .execute(state.db.pool())
+        .await
+        .unwrap();
+    let after = state
+        .services
+        .listening_stats(me, query("7d").unwrap())
+        .await
+        .unwrap();
+    assert_eq!(after.totals.plays, 4);
+    assert!(after
+        .top_tracks
+        .iter()
+        .all(|entry| entry.song.title != "Elsewhere"));
+
+    // And the other account sees only its own five.
+    let theirs_stats = state
+        .services
+        .listening_stats(other, query("7d").unwrap())
+        .await
+        .unwrap();
+    assert_eq!(theirs_stats.totals.plays, 5);
+}
+
+/// The route: its parameters are validated and it needs a credential.
+#[tokio::test]
+async fn the_statistics_route_validates_its_parameters() {
+    let (_temp, config, state) = support::test_app().await;
+    let me = account(&state, "stats-route").await;
+    let router = waveflow_server::app(&config, state.clone());
+    let bearer = token(&state, me, "stats-route").await;
+
+    let (status, body) = get_json(
+        &router,
+        "/api/v2/stats?period=7d&utc_offset_minutes=120",
+        &bearer,
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    assert_eq!(body["period"], "7d");
+    assert_eq!(body["bucket"], "day");
+    assert_eq!(body["totals"]["plays"], 0);
+    assert_eq!(body["timeline"].as_array().unwrap().len(), 7);
+    for bad in [
+        "period=90d",
+        "limit=0",
+        "limit=51",
+        "utc_offset_minutes=900",
+    ] {
+        let (status, _) = get_json(&router, &format!("/api/v2/stats?{bad}"), &bearer).await;
+        assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY, "{bad}");
+    }
+    let anonymous = support::send_json(&router, "GET", "/api/v2/stats", "not-a-token", None).await;
+    assert_eq!(anonymous.status(), StatusCode::UNAUTHORIZED);
+}
+
+// ── Mixes: decision 7 ──
+
+#[tokio::test]
+async fn mixes_are_listed_and_an_empty_one_is_left_out() {
+    let (_temp, config, state) = support::test_app().await;
+    let me = account(&state, "mix-list").await;
+    let files: Vec<File> = (0..12)
+        .map(|n| {
+            file(
+                &format!("Song {n}"),
+                &format!("Artist {n}"),
+                Some("Jazz"),
+                Some(1960),
+            )
+        })
+        .collect();
+    library(&state, &config, me, "mix-list", &files).await;
+    let query = waveflow_server::services::MixQuery::new(Vec::new(), None, None).unwrap();
+
+    let mixes = state.services.list_mixes(me, &query).await.unwrap();
+    let ids: Vec<&str> = mixes.iter().map(|mix| mix.id.as_str()).collect();
+    // Nothing played and nothing starred: those two are not offered.
+    assert_eq!(
+        ids,
+        [
+            "recently-added",
+            "never-played",
+            "genre:jazz",
+            "decade:1960"
+        ],
+        "{ids:?}"
+    );
+    assert_eq!(mixes[2].genre.as_deref(), Some("Jazz"));
+    assert_eq!(mixes[3].decade, Some(1960));
+    assert!(mixes.iter().all(|mix| mix.track_count == 12));
+    assert!(matches!(
+        state.services.mix(me, "most-played", &query).await,
+        Err(ServiceError::NotFound)
+    ));
+    assert!(matches!(
+        state.services.mix(me, "no-such-mix", &query).await,
+        Err(ServiceError::NotFound)
+    ));
+}
+
+/// Variety and determinism: no artist holds more than its share, two asks
+/// on one day answer one mix, and a listened track leaves "never played".
+#[tokio::test]
+async fn a_mix_is_varied_and_the_same_all_day() {
+    let (_temp, config, state) = support::test_app().await;
+    let me = account(&state, "mix-vary").await;
+    let mut files: Vec<File> = (0..30)
+        .map(|n| {
+            file(
+                &format!("Prolific {n}"),
+                "Prolific",
+                Some("Rock"),
+                Some(1990),
+            )
+        })
+        .collect();
+    files.extend((0..10).map(|n| {
+        file(
+            &format!("Other {n}"),
+            &format!("Other {n}"),
+            Some("Rock"),
+            Some(1990),
+        )
+    }));
+    let (_, ids) = library(&state, &config, me, "mix-vary", &files).await;
+    let query = waveflow_server::services::MixQuery::new(Vec::new(), Some(20), None).unwrap();
+
+    let first = state
+        .services
+        .mix(me, "never-played", &query)
+        .await
+        .unwrap();
+    let again = state
+        .services
+        .mix(me, "never-played", &query)
+        .await
+        .unwrap();
+    let order = |mix: &waveflow_server::services::Mix| {
+        mix.songs.iter().map(|song| song.id).collect::<Vec<_>>()
+    };
+    assert_eq!(order(&first), order(&again));
+    let prolific = first
+        .songs
+        .iter()
+        .filter(|song| song.artist.as_deref() == Some("Prolific"))
+        .count();
+    assert_eq!(prolific, 2, "a tenth of twenty, and never fewer than two");
+    assert_eq!(first.songs.len(), 12);
+    for pair in first.songs.windows(2) {
+        assert_ne!(pair[0].artist, pair[1].artist);
+    }
+
+    // Most played is a ranking: twice before once, whatever came last.
+    listen(&state, me, ids[31], 3 * MINUTE).await;
+    listen(&state, me, ids[31], 2 * MINUTE).await;
+    listen(&state, me, ids[30], MINUTE).await;
+    let played = state.services.mix(me, "most-played", &query).await.unwrap();
+    assert_eq!(order(&played), [ids[31], ids[30]]);
+    let never = state
+        .services
+        .mix(me, "never-played", &query)
+        .await
+        .unwrap();
+    assert!(!order(&never).contains(&ids[30]));
+    assert!(!order(&never).contains(&ids[31]));
+}
+
+/// A favourite is forgotten when starred long ago and not listened to
+/// lately; a fresh star and a recent listen both keep it out.
+#[tokio::test]
+async fn forgotten_favourites_are_old_stars_not_listened_to_lately() {
+    let (_temp, config, state) = support::test_app().await;
+    let me = account(&state, "mix-forgotten").await;
+    let files: Vec<File> = (0..3)
+        .map(|n| file(&format!("Star {n}"), &format!("Starred {n}"), None, None))
+        .collect();
+    let (_, ids) = library(&state, &config, me, "mix-forgotten", &files).await;
+    let now = waveflow_server::auth::authentication::now_ms();
+    for (track, starred_ago) in [(ids[0], 60 * DAY), (ids[1], DAY), (ids[2], 60 * DAY)] {
+        sqlx::query(
+            "INSERT INTO user_star (user_id, entity_type, entity_id, starred_at) \
+             VALUES (?, 'track', ?, ?)",
+        )
+        .bind(me.to_string())
+        .bind(track.to_string())
+        .bind(now - starred_ago)
+        .execute(state.db.pool())
+        .await
+        .unwrap();
+    }
+    listen(&state, me, ids[2], 10 * DAY).await;
+    let query = waveflow_server::services::MixQuery::new(Vec::new(), None, None).unwrap();
+    let mix = state
+        .services
+        .mix(me, "forgotten-favourites", &query)
+        .await
+        .unwrap();
+    assert_eq!(
+        mix.songs.iter().map(|song| song.id).collect::<Vec<_>>(),
+        [ids[0]]
+    );
+}
+
+/// Tenancy: another account's tracks are never in a mix, and a genre only
+/// another account holds is not found.
+#[tokio::test]
+async fn a_mix_holds_only_the_caller_s_tracks() {
+    let (_temp, config, state) = support::test_app().await;
+    let me = account(&state, "mix-me").await;
+    let other = account(&state, "mix-other").await;
+    let (_, mine) = library(
+        &state,
+        &config,
+        me,
+        "mix-me",
+        &[file("Mine", "Me", Some("Folk"), Some(1970))],
+    )
+    .await;
+    library(
+        &state,
+        &config,
+        other,
+        "mix-other",
+        &[file("Theirs", "Them", Some("Grime"), Some(2005))],
+    )
+    .await;
+    let router = waveflow_server::app(&config, state.clone());
+    let bearer = token(&state, me, "mix-me").await;
+
+    let (status, body) = get_json(&router, "/api/v2/mixes/never-played", &bearer).await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    assert_eq!(support::song_ids(&body["songs"]), [mine[0].to_string()]);
+    let (status, _) = get_json(&router, "/api/v2/mixes/genre%3Agrime", &bearer).await;
+    assert_eq!(status, StatusCode::NOT_FOUND);
+    let (status, _) = get_json(&router, "/api/v2/mixes/decade%3A2000", &bearer).await;
+    assert_eq!(status, StatusCode::NOT_FOUND);
+    let (status, body) = get_json(&router, "/api/v2/mixes", &bearer).await;
+    assert_eq!(status, StatusCode::OK);
+    assert!(body
+        .as_array()
+        .unwrap()
+        .iter()
+        .all(|mix| mix["id"] != "genre:grime"));
+    let (status, _) = get_json(&router, "/api/v2/mixes?limit=101", &bearer).await;
+    assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY);
+}
diff --git a/tests/discovery/lyrics.rs b/tests/discovery/lyrics.rs
new file mode 100644
index 00000000..2d145b6a
--- /dev/null
+++ b/tests/discovery/lyrics.rs
@@ -0,0 +1,475 @@
+//! Lyrics looked up on LRCLIB, against a fake of it: when a track is asked
+//! for, what is cached, and what is never asked.
+
+use super::*;
+
+struct Listener {
+    fake: Fake,
+    base_url: String,
+}
+
+async fn fake_lrclib(mode: Mode, delay: Duration) -> Listener {
+    let fake = Fake {
+        mode: Arc::new(Mutex::new(mode)),
+        delay,
+        asked: Arc::default(),
+        followed: Arc::default(),
+        last: Arc::default(),
+    };
+    let router = Router::new()
+        .route("/api/get", get(answer))
+        .route("/followed", get(followed))
+        .with_state(fake.clone());
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let address = listener.local_addr().unwrap();
+    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });
+    Listener {
+        fake,
+        base_url: format!("http://{address}"),
+    }
+}
+
+fn settings(providers: Vec<LyricsProvider>) -> LyricsSettings {
+    LyricsSettings {
+        providers,
+        // Fast enough that pacing never decides a test.
+        rate_per_sec: 1_000,
+        request_timeout: Duration::from_secs(5),
+        ..LyricsSettings::off()
+    }
+}
+
+fn lookup(state: &AppState, listener: &Listener) -> LyricsLookup {
+    LyricsLookup::with_base_url(
+        state.db.clone(),
+        &settings(vec![LyricsProvider::Lrclib]),
+        listener.base_url.clone(),
+    )
+    .unwrap()
+}
+
+async fn lookup_rows(state: &AppState) -> Vec<(String, i64, i64)> {
+    sqlx::query_as("SELECT outcome, fetched_at, expires_at FROM lyrics_lookup")
+        .fetch_all(state.db.pool())
+        .await
+        .unwrap()
+}
+
+/// One owner, one library: a track with no lyrics, one with embedded lyrics
+/// and one that will be given an upload.
+struct Shelf {
+    _temp: tempfile::TempDir,
+    config: Config,
+    state: AppState,
+    owner: Uuid,
+    bare: Uuid,
+    embedded: Uuid,
+    uploaded: Uuid,
+}
+
+async fn shelf() -> Shelf {
+    let (temp, config, state) = support::test_app().await;
+    let owner = account(&state, "lyrics-owner").await;
+    let mut army = file("Army of Me", "Björk", Some("Pop"), Some(1995));
+    army.album = "Post".into();
+    let mut hyper = file("Hyperballad", "Björk", Some("Pop"), Some(1995));
+    hyper.lyrics = Some("We live on a mountain");
+    let isobel = file("Isobel", "Björk", Some("Pop"), Some(1995));
+    let (_, ids) = library(&state, &config, owner, "lyrics", &[army, hyper, isobel]).await;
+    state
+        .services
+        .upload_lyrics(
+            owner,
+            ids[2],
+            waveflow_server::library::lyrics::UploadFormat::Txt,
+            b"My name Isobel",
+        )
+        .await
+        .unwrap();
+    Shelf {
+        _temp: temp,
+        config,
+        state,
+        owner,
+        bare: ids[0],
+        embedded: ids[1],
+        uploaded: ids[2],
+    }
+}
+
+// ── LRCLIB: decisions 1 to 5 ──
+
+/// Decision 1: the list is the switch. Built with no provider, the lookup is
+/// disabled and the fake is never asked.
+#[tokio::test]
+async fn nothing_is_asked_while_lrclib_is_not_named() {
+    let shelf = shelf().await;
+    let listener = fake_lrclib(Mode::Hit, Duration::ZERO).await;
+    let off = LyricsLookup::with_base_url(
+        shelf.state.db.clone(),
+        &settings(Vec::new()),
+        listener.base_url.clone(),
+    )
+    .unwrap();
+    assert!(!off.is_enabled());
+    shelf.state.services.use_lyrics_lookup(off);
+
+    let native = shelf
+        .state
+        .services
+        .track_lyrics(shelf.owner, shelf.bare)
+        .await
+        .unwrap();
+    assert!(native.structured_lyrics.is_empty());
+    let facade = shelf
+        .state
+        .services
+        .lyrics(shelf.owner, shelf.bare)
+        .await
+        .unwrap();
+    assert!(facade.structured_lyrics.is_empty());
+    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 0);
+    assert!(lookup_rows(&shelf.state).await.is_empty());
+}
+
+/// Decisions 2, 3 and 5: a track with no lyrics is looked up on the first
+/// ask, answered with the synced sheet credited to LRCLIB, and the second
+/// ask reads the cache.
+#[tokio::test]
+async fn a_track_without_lyrics_is_looked_up_once_and_credited() {
+    let shelf = shelf().await;
+    let listener = fake_lrclib(Mode::Hit, Duration::ZERO).await;
+    shelf
+        .state
+        .services
+        .use_lyrics_lookup(lookup(&shelf.state, &listener));
+    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
+    let bearer = token(&shelf.state, shelf.owner, "lyrics-owner").await;
+
+    let (status, body) = get_json(
+        &router,
+        &format!("/api/v2/tracks/{}/lyrics", shelf.bare),
+        &bearer,
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    let sheets = body["structuredLyrics"].as_array().unwrap();
+    assert_eq!(sheets.len(), 1, "{body}");
+    assert_eq!(sheets[0]["source"], "lrclib");
+    assert_eq!(sheets[0]["synced"], true);
+    assert_eq!(sheets[0]["lang"], "xxx");
+    assert_eq!(sheets[0]["line"][1]["start"], 4_500);
+    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 1);
+
+    // What was sent: the four fields LRCLIB matches on, and an agent that
+    // names the project.
+    let (query, agent) = listener.fake.last.lock().unwrap().clone().unwrap();
+    assert_eq!(query["artist_name"], "Björk");
+    assert_eq!(query["track_name"], "Army of Me");
+    assert_eq!(query["album_name"], "Post");
+    assert_eq!(query["duration"], "234");
+    assert!(agent.starts_with("WaveFlowServer/"), "{agent}");
+    assert!(
+        agent.contains("https://github.com/InstaZDLL/waveflow-server"),
+        "{agent}"
+    );
+
+    // The cache answers the second ask, and the download serves the sheet.
+    let again = shelf
+        .state
+        .services
+        .track_lyrics(shelf.owner, shelf.bare)
+        .await
+        .unwrap();
+    assert_eq!(again.structured_lyrics.len(), 1);
+    let download = shelf
+        .state
+        .services
+        .lyrics_file(shelf.owner, shelf.bare, None)
+        .await
+        .unwrap();
+    assert!(download.name.ends_with(".lrc"), "{}", download.name);
+    assert!(download.content.contains("[00:04.50]"));
+    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 1);
+    let rows = lookup_rows(&shelf.state).await;
+    assert_eq!(rows.len(), 1);
+    assert_eq!(rows[0].0, "hit");
+    assert_eq!(rows[0].2 - rows[0].1, 30 * DAY);
+}
+
+/// Decision 2: the file and the uploads always win, on every surface.
+#[tokio::test]
+async fn a_track_with_lyrics_of_its_own_is_never_looked_up() {
+    let shelf = shelf().await;
+    let listener = fake_lrclib(Mode::Hit, Duration::ZERO).await;
+    shelf
+        .state
+        .services
+        .use_lyrics_lookup(lookup(&shelf.state, &listener));
+
+    let embedded = shelf
+        .state
+        .services
+        .track_lyrics(shelf.owner, shelf.embedded)
+        .await
+        .unwrap();
+    assert_eq!(embedded.structured_lyrics.len(), 1);
+    assert_eq!(
+        embedded.structured_lyrics[0].source.as_deref(),
+        Some("embedded")
+    );
+    let uploaded = shelf
+        .state
+        .services
+        .track_lyrics(shelf.owner, shelf.uploaded)
+        .await
+        .unwrap();
+    assert_eq!(
+        uploaded.structured_lyrics[0].source.as_deref(),
+        Some("upload_txt")
+    );
+    // The façade does not serve uploads (RFC-012), and still does not look
+    // the track up: its owner chose its words.
+    let facade = shelf
+        .state
+        .services
+        .lyrics(shelf.owner, shelf.uploaded)
+        .await
+        .unwrap();
+    assert!(facade.structured_lyrics.is_empty());
+    let facade = shelf
+        .state
+        .services
+        .lyrics(shelf.owner, shelf.embedded)
+        .await
+        .unwrap();
+    assert_eq!(facade.structured_lyrics.len(), 1);
+    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 0);
+}
+
+/// Decision 5: `getLyricsBySongId` carries the sheet, synced, with no source
+/// attribute — the frozen element has none — and `getLyrics` finds it by
+/// exact artist and title.
+#[tokio::test]
+async fn the_facade_serves_the_sheet_without_a_source() {
+    let shelf = shelf().await;
+    let listener = fake_lrclib(Mode::Hit, Duration::ZERO).await;
+    shelf
+        .state
+        .services
+        .use_lyrics_lookup(lookup(&shelf.state, &listener));
+    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
+    let api_key = subsonic_key(&shelf.state, shelf.owner).await;
+
+    let by_id = support::subsonic_json(
+        &router,
+        "getLyricsBySongId",
+        &api_key,
+        &format!("&id={}", shelf.bare),
+    )
+    .await;
+    let sheets = by_id["subsonic-response"]["lyricsList"]["structuredLyrics"]
+        .as_array()
+        .unwrap_or_else(|| panic!("a list: {by_id}"));
+    assert_eq!(sheets.len(), 1);
+    assert_eq!(sheets[0]["synced"], true);
+    assert!(support::omits(&sheets[0], "source"), "{by_id}");
+    // And at the service the façade reads, not only in the node it builds:
+    // the sheet names no source there either.
+    let facade = shelf
+        .state
+        .services
+        .lyrics(shelf.owner, shelf.bare)
+        .await
+        .unwrap();
+    assert_eq!(facade.structured_lyrics.len(), 1);
+    assert!(facade.structured_lyrics[0].source.is_none());
+
+    let by_name = support::subsonic_json(
+        &router,
+        "getLyrics",
+        &api_key,
+        "&artist=Bj%C3%B6rk&title=Army%20of%20Me",
+    )
+    .await;
+    let value = by_name["subsonic-response"]["lyrics"]["value"]
+        .as_str()
+        .unwrap_or_else(|| panic!("lyrics text: {by_name}"));
+    assert!(value.contains("army of me"), "{by_name}");
+    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 1);
+}
+
+/// Decision 4: a 404 and an instrumental are answers, cached; a miss for the
+/// short TTL, an instrumental for the long one, and neither is a sheet.
+#[tokio::test]
+async fn a_miss_and_an_instrumental_are_cached_as_answers() {
+    for (mode, outcome, ttl) in [
+        (Mode::Miss, "miss", 7 * DAY),
+        (Mode::Instrumental, "instrumental", 30 * DAY),
+    ] {
+        let shelf = shelf().await;
+        let listener = fake_lrclib(mode, Duration::ZERO).await;
+        shelf
+            .state
+            .services
+            .use_lyrics_lookup(lookup(&shelf.state, &listener));
+        for _ in 0..2 {
+            let answer = shelf
+                .state
+                .services
+                .track_lyrics(shelf.owner, shelf.bare)
+                .await
+                .unwrap();
+            assert!(answer.structured_lyrics.is_empty());
+        }
+        assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 1, "{outcome}");
+        let rows = lookup_rows(&shelf.state).await;
+        assert_eq!(rows.len(), 1);
+        assert_eq!(rows[0].0, outcome);
+        assert_eq!(rows[0].2 - rows[0].1, ttl, "{outcome}");
+    }
+}
+
+/// Decision 4: an outage, a redirect and an oversized answer are unreached.
+/// They write nothing, so the next ask tries again — and the redirect is not
+/// followed.
+#[tokio::test]
+async fn an_unreached_lookup_writes_nothing_and_is_asked_again() {
+    for mode in [Mode::Unavailable, Mode::Redirect, Mode::Oversized] {
+        let shelf = shelf().await;
+        let listener = fake_lrclib(mode, Duration::ZERO).await;
+        let lookup = lookup(&shelf.state, &listener);
+        shelf.state.services.use_lyrics_lookup(lookup.clone());
+        for _ in 0..2 {
+            let answer = shelf
+                .state
+                .services
+                .track_lyrics(shelf.owner, shelf.bare)
+                .await
+                .unwrap();
+            assert!(answer.structured_lyrics.is_empty());
+            lookup.idle().await;
+        }
+        assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 2);
+        assert_eq!(listener.fake.followed.load(Ordering::SeqCst), 0);
+        assert!(lookup_rows(&shelf.state).await.is_empty());
+    }
+}
+
+/// Decision 3: concurrent asks for one track wait on one request.
+#[tokio::test]
+async fn concurrent_asks_make_one_request() {
+    let shelf = shelf().await;
+    let listener = fake_lrclib(Mode::Hit, Duration::from_millis(300)).await;
+    shelf
+        .state
+        .services
+        .use_lyrics_lookup(lookup(&shelf.state, &listener));
+    let asks = (0..6).map(|_| {
+        let services = shelf.state.services.clone();
+        let (owner, track) = (shelf.owner, shelf.bare);
+        tokio::spawn(async move { services.track_lyrics(owner, track).await.unwrap() })
+    });
+    for ask in futures_util::future::join_all(asks).await {
+        assert_eq!(ask.unwrap().structured_lyrics.len(), 1);
+    }
+    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 1);
+}
+
+/// Decision 3: the answering path waits a bounded time. A slower answer is
+/// not waited for, and is in the cache for the next listen.
+#[tokio::test]
+async fn a_slow_answer_is_not_waited_for_and_lands_for_the_next_listen() {
+    let shelf = shelf().await;
+    let listener = fake_lrclib(Mode::Hit, Duration::from_millis(600)).await;
+    let lookup = lookup(&shelf.state, &listener).with_answer_wait(Duration::from_millis(50));
+    shelf.state.services.use_lyrics_lookup(lookup.clone());
+
+    let started = std::time::Instant::now();
+    let first = shelf
+        .state
+        .services
+        .track_lyrics(shelf.owner, shelf.bare)
+        .await
+        .unwrap();
+    assert!(first.structured_lyrics.is_empty());
+    assert!(started.elapsed() < Duration::from_millis(500));
+    lookup.idle().await;
+    let next = shelf
+        .state
+        .services
+        .track_lyrics(shelf.owner, shelf.bare)
+        .await
+        .unwrap();
+    assert_eq!(next.structured_lyrics.len(), 1);
+    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 1);
+}
+
+/// Decision 4: a stale row is served at once, and its refresh is scheduled.
+#[tokio::test]
+async fn a_stale_answer_is_served_while_it_is_refreshed() {
+    let shelf = shelf().await;
+    let listener = fake_lrclib(Mode::Hit, Duration::ZERO).await;
+    let lookup = lookup(&shelf.state, &listener);
+    shelf.state.services.use_lyrics_lookup(lookup.clone());
+    shelf
+        .state
+        .services
+        .track_lyrics(shelf.owner, shelf.bare)
+        .await
+        .unwrap();
+    sqlx::query("UPDATE lyrics_lookup SET expires_at = 1")
+        .execute(shelf.state.db.pool())
+        .await
+        .unwrap();
+    *listener.fake.mode.lock().unwrap() = Mode::Miss;
+
+    let stale = shelf
+        .state
+        .services
+        .track_lyrics(shelf.owner, shelf.bare)
+        .await
+        .unwrap();
+    assert_eq!(
+        stale.structured_lyrics.len(),
+        1,
+        "the stale sheet is served"
+    );
+    lookup.idle().await;
+    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 2);
+    assert_eq!(lookup_rows(&shelf.state).await[0].0, "miss");
+}
+
+/// Decision 4: the tenancy lookup comes first. Another account's track is
+/// not found, and nothing is read or sent about it.
+#[tokio::test]
+async fn another_account_s_track_is_not_found_and_not_looked_up() {
+    let shelf = shelf().await;
+    let outsider = account(&shelf.state, "lyrics-outsider").await;
+    let listener = fake_lrclib(Mode::Hit, Duration::ZERO).await;
+    shelf
+        .state
+        .services
+        .use_lyrics_lookup(lookup(&shelf.state, &listener));
+
+    assert!(matches!(
+        shelf
+            .state
+            .services
+            .track_lyrics(outsider, shelf.bare)
+            .await,
+        Err(ServiceError::NotFound)
+    ));
+    assert!(matches!(
+        shelf.state.services.lyrics(outsider, shelf.bare).await,
+        Err(ServiceError::NotFound)
+    ));
+    let by_name = shelf
+        .state
+        .services
+        .lyrics_by_metadata(outsider, Some("Björk"), Some("Army of Me"))
+        .await
+        .unwrap();
+    assert!(by_name.is_none());
+    assert_eq!(listener.fake.asked.load(Ordering::SeqCst), 0);
+}
diff --git a/tests/discovery/main.rs b/tests/discovery/main.rs
new file mode 100644
index 00000000..afade1a6
--- /dev/null
+++ b/tests/discovery/main.rs
@@ -0,0 +1,317 @@
+//! RFC-024: lyrics from LRCLIB, listening statistics, mixes and the local
+//! fallback for similar songs.
+//!
+//! LRCLIB is always a fake on a loopback listener of the test's own; the
+//! suite never reaches `lrclib.net`. The fake counts what it is asked, which
+//! is what most of the lyrics assertions are about.
+//!
+//! Accounts are inserted as rows rather than through `create_account`, as in
+//! `tests/enrichment/main.rs`: these tests need user ids, not a login, and the API
+//! is reached through tokens and Subsonic keys drawn at run time.
+
+#[allow(dead_code)]
+#[path = "../support/mod.rs"]
+mod support;
+
+use std::{
+    collections::HashMap,
+    sync::{
+        atomic::{AtomicUsize, Ordering},
+        Arc, Mutex,
+    },
+    time::Duration,
+};
+
+use axum::{
+    extract::{Query, State},
+    http::{header, HeaderMap, StatusCode},
+    response::{IntoResponse, Response},
+    routing::get,
+    Router,
+};
+use uuid::Uuid;
+use waveflow_server::{
+    config::LyricsSettings,
+    library::lyrics::LyricsInput,
+    remote::lrclib::{LyricsLookup, LyricsProvider},
+    services::ServiceError,
+    AppState, Config,
+};
+
+// ── Fixtures ──
+
+async fn account(state: &AppState, username: &str) -> Uuid {
+    let id = Uuid::new_v4();
+    let now = waveflow_server::auth::authentication::now_ms();
+    sqlx::query(
+        "INSERT INTO account (id, username, password_hash, role, disabled, created_at, updated_at) \
+         VALUES (?, ?, 'this-account-never-authenticates', 'admin', 0, ?, ?)",
+    )
+    .bind(id.to_string())
+    .bind(username)
+    .bind(now)
+    .bind(now)
+    .execute(state.db.pool())
+    .await
+    .unwrap();
+    id
+}
+
+/// One file of a fixture library.
+#[derive(Clone)]
+struct File {
+    title: String,
+    artists: Vec<String>,
+    album: String,
+    album_artist: String,
+    genre: Option<String>,
+    year: Option<i64>,
+    duration_ms: i64,
+    lyrics: Option<&'static str>,
+}
+
+fn file(title: &str, artist: &str, genre: Option<&str>, year: Option<i64>) -> File {
+    File {
+        title: title.to_owned(),
+        artists: vec![artist.to_owned()],
+        album: format!("{artist} album"),
+        album_artist: artist.to_owned(),
+        genre: genre.map(str::to_owned),
+        year,
+        duration_ms: 234_000,
+        lyrics: None,
+    }
+}
+
+/// A private library of `owner`'s holding `files`, and the ids of their
+/// tracks in the order given. Every library gets its own range of hashes.
+async fn library(
+    state: &AppState,
+    config: &Config,
+    owner: Uuid,
+    name: &str,
+    files: &[File],
+) -> (Uuid, Vec<Uuid>) {
+    static NEXT: AtomicUsize = AtomicUsize::new(0);
+    let now = waveflow_server::auth::authentication::now_ms();
+    let root = config.data_dir.join(name);
+    std::fs::create_dir_all(&root).unwrap();
+    let library = state
+        .db
+        .create_library(
+            owner,
+            name,
+            &std::fs::canonicalize(&root).unwrap(),
+            waveflow_server::storage::database::LibraryVisibility::Private,
+            now,
+        )
+        .await
+        .unwrap();
+    let scan = state
+        .db
+        .create_scan_job(library, Some(owner), "manual")
+        .await
+        .unwrap();
+    state
+        .db
+        .start_scan_job(scan, files.len() as i64, false)
+        .await
+        .unwrap();
+    for (offset, spec) in files.iter().enumerate() {
+        let index = NEXT.fetch_add(1, Ordering::SeqCst) + 10_000;
+        let mut input = support::browse_input(
+            index,
+            &spec.title,
+            &spec.album,
+            &spec.artists.join(", "),
+            Some(offset as i64 + 1),
+            Some(1),
+        );
+        input.artists = spec.artists.clone();
+        input.album_artist = Some(spec.album_artist.clone());
+        input.genre = spec.genre.clone();
+        input.year = spec.year;
+        input.duration_ms = spec.duration_ms;
+        input.relative_path = format!("{name}/{offset}.flac");
+        if let Some(words) = spec.lyrics {
+            input.lyrics = vec![LyricsInput {
+                source: "embedded",
+                lang: "eng".into(),
+                synced: false,
+                content: words.into(),
+            }];
+        }
+        state
+            .db
+            .apply_catalog_track(library, scan, &input, None, false)
+            .await
+            .unwrap();
+    }
+    state
+        .db
+        .consolidate_catalog_derivations(library)
+        .await
+        .unwrap();
+    state.db.finish_scan_job(scan, 0).await.unwrap();
+    let mut ids = Vec::new();
+    for offset in 0..files.len() {
+        let id: String =
+            sqlx::query_scalar("SELECT id FROM track WHERE library_id=? AND relative_path=?")
+                .bind(library.to_string())
+                .bind(format!("{name}/{offset}.flac"))
+                .fetch_one(state.db.pool())
+                .await
+                .unwrap();
+        ids.push(id.parse().unwrap());
+    }
+    (library, ids)
+}
+
+async fn token(state: &AppState, user: Uuid, username: &str) -> String {
+    state
+        .services
+        .create_api_token(user, &[], username, "discovery", &[])
+        .await
+        .unwrap()
+        .1
+}
+
+async fn subsonic_key(state: &AppState, user: Uuid) -> String {
+    let api_key = format!("wfsk_{}", Uuid::new_v4().simple());
+    let password = Uuid::new_v4().simple().to_string();
+    state
+        .db
+        .set_subsonic_credential(
+            user,
+            user,
+            &state.secret_box.encrypt(password.as_bytes()).unwrap(),
+            &waveflow_server::auth::security::token_hash(&api_key),
+            waveflow_server::auth::authentication::now_ms(),
+        )
+        .await
+        .unwrap();
+    api_key
+}
+
+async fn get_json(router: &Router, uri: &str, token: &str) -> (StatusCode, serde_json::Value) {
+    let response = support::send_json(router, "GET", uri, token, None).await;
+    let status = response.status();
+    let text = support::body_text(response).await;
+    (status, serde_json::from_str(&text).unwrap_or_default())
+}
+
+/// A listen of `track` by `user`, `ago` milliseconds before now.
+async fn listen(state: &AppState, user: Uuid, track: Uuid, ago: i64) {
+    let at = waveflow_server::auth::authentication::now_ms() - ago;
+    state
+        .services
+        .scrobble(user, track, true, Some(at))
+        .await
+        .unwrap();
+}
+
+const MINUTE: i64 = 60_000;
+
+const DAY: i64 = 24 * 60 * MINUTE;
+
+// ── A fake LRCLIB ──
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Mode {
+    /// Synced and plain lyrics, for any track.
+    Hit,
+    /// LRCLIB's 404.
+    Miss,
+    /// An instrumental record.
+    Instrumental,
+    /// A 503 with a body that is not LRCLIB's.
+    Unavailable,
+    /// A `302` to `/followed`, which answers like `Hit`.
+    Redirect,
+    /// A well-formed answer two mebibytes long.
+    Oversized,
+}
+
+#[derive(Clone)]
+struct Fake {
+    mode: Arc<Mutex<Mode>>,
+    delay: Duration,
+    asked: Arc<AtomicUsize>,
+    followed: Arc<AtomicUsize>,
+    /// The query of the last request, and its User-Agent.
+    last: Arc<Mutex<Option<Asked>>>,
+}
+
+/// One request's query parameters, and the agent that sent them.
+type Asked = (HashMap<String, String>, String);
+
+const SYNCED: &str = "[00:01.00]If you complain once more\n[00:04.50]You'll meet an army of me";
+
+const PLAIN: &str = "If you complain once more\nYou'll meet an army of me";
+
+async fn answer(
+    State(fake): State<Fake>,
+    Query(query): Query<HashMap<String, String>>,
+    headers: HeaderMap,
+) -> Response {
+    fake.asked.fetch_add(1, Ordering::SeqCst);
+    let agent = headers
+        .get(header::USER_AGENT)
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or_default()
+        .to_owned();
+    let duration: f64 = query
+        .get("duration")
+        .and_then(|value| value.parse().ok())
+        .unwrap_or_default();
+    *fake.last.lock().unwrap() = Some((query, agent));
+    tokio::time::sleep(fake.delay).await;
+    let mode = *fake.mode.lock().unwrap();
+    match mode {
+        Mode::Hit => record(duration),
+        Mode::Miss => (
+            StatusCode::NOT_FOUND,
+            [(header::CONTENT_TYPE, "application/json")],
+            r#"{"code":404,"name":"TrackNotFound","message":"Failed to find specified track"}"#,
+        )
+            .into_response(),
+        Mode::Instrumental => json(format!(
+            r#"{{"id":1,"duration":{duration},"instrumental":true,"plainLyrics":null,"syncedLyrics":null}}"#
+        )),
+        Mode::Unavailable => (StatusCode::SERVICE_UNAVAILABLE, "<html>down</html>").into_response(),
+        Mode::Redirect => (StatusCode::FOUND, [(header::LOCATION, "/followed")]).into_response(),
+        Mode::Oversized => json(format!(
+            r#"{{"duration":{duration},"plainLyrics":"{}"}}"#,
+            "a".repeat(2 * 1024 * 1024)
+        )),
+    }
+}
+
+async fn followed(State(fake): State<Fake>) -> Response {
+    fake.followed.fetch_add(1, Ordering::SeqCst);
+    record(234.0)
+}
+
+fn record(duration: f64) -> Response {
+    json(
+        serde_json::json!({
+            "id": 1,
+            "trackName": "Army of Me",
+            "artistName": "Björk",
+            "albumName": "Post",
+            "duration": duration,
+            "instrumental": false,
+            "plainLyrics": PLAIN,
+            "syncedLyrics": SYNCED,
+        })
+        .to_string(),
+    )
+}
+
+fn json(body: String) -> Response {
+    ([(header::CONTENT_TYPE, "application/json")], body).into_response()
+}
+
+mod listening;
+mod lyrics;
+mod similar;
diff --git a/tests/discovery/similar.rs b/tests/discovery/similar.rs
new file mode 100644
index 00000000..d76b60dc
--- /dev/null
+++ b/tests/discovery/similar.rs
@@ -0,0 +1,171 @@
+//! Local neighbours, and the similar-songs methods that answer from them.
+
+use super::*;
+
+// ── Similar songs without a provider: decision 8 ──
+
+async fn drawn(state: &AppState, user: Uuid, id: Uuid) -> Vec<String> {
+    let mut names: Vec<String> = state
+        .services
+        .similar_songs(user, id, 50)
+        .await
+        .unwrap()
+        .into_iter()
+        .map(|song| song.artist.unwrap_or_default())
+        .collect();
+    names.sort();
+    names.dedup();
+    names
+}
+
+async fn artist_named(state: &AppState, user: Uuid, name: &str) -> Uuid {
+    state
+        .services
+        .list_artists(
+            user,
+            None,
+            waveflow_server::services::BrowsePage::new(None, None).unwrap(),
+        )
+        .await
+        .unwrap()
+        .into_iter()
+        .find(|artist| artist.artist.name == name)
+        .unwrap_or_else(|| panic!("{name} is not visible"))
+        .artist
+        .id
+}
+
+/// A shared genre makes a neighbour; an artist sharing nothing does not,
+/// even of the same era; and an artist in another account's library is never
+/// one, whatever it shares.
+#[tokio::test]
+async fn a_shared_genre_makes_a_local_neighbour_and_nothing_foreign_does() {
+    let (_temp, config, state) = support::test_app().await;
+    let me = account(&state, "similar-me").await;
+    let other = account(&state, "similar-other").await;
+    library(
+        &state,
+        &config,
+        me,
+        "similar-me",
+        &[
+            file("Hyperballad", "Björk", Some("Electronic"), Some(1995)),
+            // No year, so its score is the genre alone — the score each
+            // foreign artist below would have.
+            file("Svefn-g-englar", "Sigur Rós", Some("Electronic"), None),
+            file("Enter Sandman", "Metallica", Some("Metal"), Some(1995)),
+        ],
+    )
+    .await;
+    // Twenty artists sharing the genre, in a library the caller is not in,
+    // named to sort before Sigur Rós: counted as neighbours, they would take
+    // every place and push the visible one out of the draw.
+    let foreign: Vec<File> = (0..20)
+        .map(|n| file("Elsewhere", &format!("Aa {n:02}"), Some("Electronic"), None))
+        .collect();
+    library(&state, &config, other, "similar-other", &foreign).await;
+    let bjork = artist_named(&state, me, "Björk").await;
+
+    assert_eq!(drawn(&state, me, bjork).await, ["Björk", "Sigur Rós"]);
+}
+
+/// A co-credit makes a neighbour without a shared genre, and so does
+/// listening to an artist straight after the seed.
+#[tokio::test]
+async fn a_co_credit_and_a_co_listen_make_local_neighbours() {
+    let (_temp, config, state) = support::test_app().await;
+    let me = account(&state, "similar-credit").await;
+    let mut duet = file("Nattura", "Björk", None, None);
+    duet.artists = vec!["Björk".into(), "Thom Yorke".into()];
+    let (_, ids) = library(
+        &state,
+        &config,
+        me,
+        "similar-credit",
+        &[
+            file("Joga", "Björk", None, None),
+            duet,
+            file("Clair de lune", "Debussy", None, None),
+            file("Unrelated", "Nobody Near", None, None),
+            file("Analyse", "Thom Yorke", None, None),
+        ],
+    )
+    .await;
+    let bjork = artist_named(&state, me, "Björk").await;
+    // Thom Yorke's own track is drawn because of the duet; Debussy and
+    // Nobody Near share nothing with Björk yet.
+    assert_eq!(
+        drawn(&state, me, bjork).await,
+        ["Björk", "Björk, Thom Yorke", "Thom Yorke"]
+    );
+
+    // Debussy straight after Björk, twice; Nobody Near a day later.
+    listen(&state, me, ids[0], 60 * MINUTE).await;
+    listen(&state, me, ids[2], 55 * MINUTE).await;
+    listen(&state, me, ids[0], 20 * MINUTE).await;
+    listen(&state, me, ids[2], 15 * MINUTE).await;
+    listen(&state, me, ids[3], 2 * DAY).await;
+    let names = drawn(&state, me, bjork).await;
+    assert!(names.contains(&"Debussy".to_owned()), "{names:?}");
+    assert!(!names.contains(&"Nobody Near".to_owned()), "{names:?}");
+}
+
+/// The façade end to end with no provider: both methods answer songs where
+/// they used to answer an empty container, and the native route is the same
+/// draw.
+#[tokio::test]
+async fn the_similar_songs_methods_answer_without_a_provider() {
+    let (_temp, config, state) = support::test_app().await;
+    let me = account(&state, "similar-route").await;
+    let other = account(&state, "similar-route-other").await;
+    library(
+        &state,
+        &config,
+        me,
+        "similar-route",
+        &[
+            file("Hyperballad", "Björk", Some("Electronic"), Some(1995)),
+            file(
+                "Svefn-g-englar",
+                "Sigur Rós",
+                Some("Electronic"),
+                Some(1999),
+            ),
+        ],
+    )
+    .await;
+    library(
+        &state,
+        &config,
+        other,
+        "similar-route-other",
+        &[file("Far", "Far Away", None, None)],
+    )
+    .await;
+    let bjork = artist_named(&state, me, "Björk").await;
+    let far = artist_named(&state, other, "Far Away").await;
+    let router = waveflow_server::app(&config, state.clone());
+    let api_key = subsonic_key(&state, me).await;
+    let bearer = token(&state, me, "similar-route").await;
+
+    for (method, container) in [
+        ("getSimilarSongs", "similarSongs"),
+        ("getSimilarSongs2", "similarSongs2"),
+    ] {
+        let body = support::subsonic_json(&router, method, &api_key, &format!("&id={bjork}")).await;
+        let songs = body["subsonic-response"][container]["song"]
+            .as_array()
+            .unwrap_or_else(|| panic!("an array: {body}"));
+        assert_eq!(songs.len(), 2, "{method}");
+    }
+    let (status, body) = get_json(
+        &router,
+        &format!("/api/v2/similar-songs/{bjork}?limit=1"),
+        &bearer,
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    assert_eq!(body.as_array().unwrap().len(), 1);
+    let (status, _) = get_json(&router, &format!("/api/v2/similar-songs/{far}"), &bearer).await;
+    assert_eq!(status, StatusCode::NOT_FOUND);
+}
diff --git a/tests/enrichment/banners.rs b/tests/enrichment/banners.rs
index fc9f3394..39afa86b 100644
--- a/tests/enrichment/banners.rs
+++ b/tests/enrichment/banners.rs
@@ -181,7 +181,7 @@ async fn a_banner_is_the_first_real_fanart_and_is_shown_on_every_artist() {
     assert_eq!(linked[1].as_deref(), Some(hash.as_str()));
     assert_eq!(
         hash,
-        waveflow_server::portrait::Portrait::from_bytes(fake.picture("second.jpg"))
+        waveflow_server::remote::portrait::Portrait::from_bytes(fake.picture("second.jpg"))
             .unwrap()
             .hash
     );
diff --git a/tests/enrichment/image_search.rs b/tests/enrichment/image_search.rs
index 59c0eb44..1de1815f 100644
--- a/tests/enrichment/image_search.rs
+++ b/tests/enrichment/image_search.rs
@@ -190,12 +190,12 @@ async fn send(
 #[tokio::test]
 async fn candidates_are_previewed_by_the_server_and_picked_from_a_live_search() {
     use axum::http::Method;
-    use waveflow_server::database::{AccountRole, LibraryRole};
+    use waveflow_server::storage::database::{AccountRole, LibraryRole};
 
     let (_temp, config, state, gallery, owner, bjork) = picker(false, true).await;
     let password = uuid::Uuid::new_v4().to_string();
-    let hash = waveflow_server::security::hash_password(&password).unwrap();
-    let now = waveflow_server::authentication::now_ms();
+    let hash = waveflow_server::auth::security::hash_password(&password).unwrap();
+    let now = waveflow_server::auth::authentication::now_ms();
     sqlx::query("UPDATE account SET username='gallery-owner', password_hash=? WHERE id=?")
         .bind(&hash)
         .bind(owner.to_string())
@@ -487,7 +487,7 @@ async fn a_search_stops_at_its_deadline() {
 #[tokio::test]
 async fn the_sweep_takes_spent_searches_and_their_previews_only() {
     let (_temp, _config, state, _gallery, owner, bjork) = picker(false, true).await;
-    let now = waveflow_server::authentication::now_ms();
+    let now = waveflow_server::auth::authentication::now_ms();
     let stale = uuid::Uuid::new_v4().to_string();
     let fetching = uuid::Uuid::new_v4().to_string();
     for (id, by, at) in [
@@ -569,7 +569,7 @@ async fn the_sweep_takes_spent_searches_and_their_previews_only() {
 #[tokio::test]
 async fn boot_deletes_the_searches_left_fetching() {
     let (_temp, config, state, _gallery, owner, bjork) = picker(false, true).await;
-    let now = waveflow_server::authentication::now_ms();
+    let now = waveflow_server::auth::authentication::now_ms();
     for (complete, expires_at) in [(0, None), (1, Some(now + 60 * 60 * 1000))] {
         sqlx::query(
             "INSERT INTO artist_image_search \
@@ -630,7 +630,7 @@ async fn previews_keep_deezer_s_pace() {
 async fn a_search_outlives_the_ordinary_request_timeout() {
     let (_temp, config, state, gallery, owner, bjork) = picker(false, false).await;
     let password = uuid::Uuid::new_v4().to_string();
-    let hash = waveflow_server::security::hash_password(&password).unwrap();
+    let hash = waveflow_server::auth::security::hash_password(&password).unwrap();
     sqlx::query("UPDATE account SET username='slow-owner', password_hash=? WHERE id=?")
         .bind(&hash)
         .bind(owner.to_string())
diff --git a/tests/enrichment/lastfm.rs b/tests/enrichment/lastfm.rs
index aa674bc2..02cfeb60 100644
--- a/tests/enrichment/lastfm.rs
+++ b/tests/enrichment/lastfm.rs
@@ -158,7 +158,7 @@ async fn no_more_than_the_ceiling_of_fills_is_ever_queued() {
         &listener,
     );
 
-    let names: Vec<String> = (0..=waveflow_server::enrichment::MAX_IN_FLIGHT)
+    let names: Vec<String> = (0..=waveflow_server::remote::enrichment::MAX_IN_FLIGHT)
         .map(|index| format!("Artist {index}"))
         .collect();
     let visits = names.iter().map(|name| enrichment.artist(name));
@@ -169,7 +169,7 @@ async fn no_more_than_the_ceiling_of_fills_is_ever_queued() {
 
     assert_eq!(
         listener.fake.info.load(Ordering::SeqCst),
-        waveflow_server::enrichment::MAX_IN_FLIGHT
+        waveflow_server::remote::enrichment::MAX_IN_FLIGHT
     );
 }
 
diff --git a/tests/enrichment/main.rs b/tests/enrichment/main.rs
index 5a279815..af2ae832 100644
--- a/tests/enrichment/main.rs
+++ b/tests/enrichment/main.rs
@@ -31,8 +31,8 @@ use axum::{
 };
 use waveflow_server::{
     config::MetadataSettings,
-    enrichment::{Endpoints, Enrichment, Outcome, Provider},
-    portrait::AddressPolicy,
+    remote::enrichment::{Endpoints, Enrichment, Outcome, Provider},
+    remote::portrait::AddressPolicy,
 };
 
 mod artist_info;
@@ -179,7 +179,7 @@ fn engine(
 // token and a Subsonic key minted at run time.
 async fn account(state: &waveflow_server::AppState, username: &str) -> uuid::Uuid {
     let id = uuid::Uuid::new_v4();
-    let now = waveflow_server::authentication::now_ms();
+    let now = waveflow_server::auth::authentication::now_ms();
     sqlx::query(
         "INSERT INTO account (id, username, password_hash, role, disabled, created_at, updated_at) \
          VALUES (?, ?, 'this-account-never-authenticates', 'admin', 0, ?, ?)",
@@ -215,7 +215,7 @@ async fn library_with(
     name: &str,
     artists: &[(&str, &str)],
 ) {
-    let now = waveflow_server::authentication::now_ms();
+    let now = waveflow_server::auth::authentication::now_ms();
     let root = config.data_dir.join(name);
     std::fs::create_dir_all(&root).unwrap();
     let library = state
@@ -224,7 +224,7 @@ async fn library_with(
             owner,
             name,
             &std::fs::canonicalize(&root).unwrap(),
-            waveflow_server::database::LibraryVisibility::Private,
+            waveflow_server::storage::database::LibraryVisibility::Private,
             now,
         )
         .await
@@ -311,8 +311,8 @@ async fn subsonic_key(state: &waveflow_server::AppState, user: uuid::Uuid) -> St
             user,
             user,
             &state.secret_box.encrypt(password.as_bytes()).unwrap(),
-            &waveflow_server::security::token_hash(&api_key),
-            waveflow_server::authentication::now_ms(),
+            &waveflow_server::auth::security::token_hash(&api_key),
+            waveflow_server::auth::authentication::now_ms(),
         )
         .await
         .unwrap();
diff --git a/tests/identity.rs b/tests/identity.rs
index d428013a..2de241cb 100644
--- a/tests/identity.rs
+++ b/tests/identity.rs
@@ -3,11 +3,11 @@
 //! Split out of `v2_foundations.rs`.
 
 use tempfile::TempDir;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::catalog::LibraryRecord;
-use waveflow_server::database::AccountRole;
-use waveflow_server::database::LibraryVisibility;
-use waveflow_server::security;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
+use waveflow_server::storage::catalog::LibraryRecord;
+use waveflow_server::storage::database::AccountRole;
+use waveflow_server::storage::database::LibraryVisibility;
 use waveflow_server::Config;
 
 // Not every target uses every fixture, and a shared module is not dead
@@ -301,10 +301,10 @@ async fn a_changed_track_spec_drops_every_relocation_hint_without_a_rescan() {
     // computed under another: two specs can evaluate to the same string, and
     // the hint would then hand a new file this track's identity — and this
     // track's favourite. So the stale values go.
-    let altered = waveflow_server::pid::PidSpecs {
+    let altered = waveflow_server::library::pid::PidSpecs {
         album: config.pid.album.clone(),
         artist: config.pid.artist.clone(),
-        track: waveflow_server::pid::PidSpec::parse("folder,title", true).unwrap(),
+        track: waveflow_server::library::pid::PidSpec::parse("folder,title", true).unwrap(),
     };
     let rescans = state.db.reconcile_catalog_identity(&altered).await.unwrap();
     assert_eq!(
@@ -398,10 +398,11 @@ async fn a_changed_artist_spec_carries_the_favourite_onto_the_new_identifier() {
         .await
         .unwrap();
 
-    let altered = waveflow_server::pid::PidSpecs {
+    let altered = waveflow_server::library::pid::PidSpecs {
         album: config.pid.album.clone(),
         track: config.pid.track.clone(),
-        artist: waveflow_server::pid::PidSpec::parse("albumartistid,title", false).unwrap(),
+        artist: waveflow_server::library::pid::PidSpec::parse("albumartistid,title", false)
+            .unwrap(),
     };
     let expected = altered.artist_id(library_id, "Nova Kern");
     assert_ne!(
@@ -434,10 +435,11 @@ async fn a_remap_whose_targets_chain_does_not_change_who_owns_what() {
     let (_temp, config, state) = test_app().await;
     let (owner, library_id) = remap_fixture(&state, &config, "chained").await;
 
-    let altered = waveflow_server::pid::PidSpecs {
+    let altered = waveflow_server::library::pid::PidSpecs {
         album: config.pid.album.clone(),
         track: config.pid.track.clone(),
-        artist: waveflow_server::pid::PidSpec::parse("albumartistid,title", false).unwrap(),
+        artist: waveflow_server::library::pid::PidSpec::parse("albumartistid,title", false)
+            .unwrap(),
     };
     // Built by hand: no spec this engine can parse makes one artist's new
     // identifier another's old one, because only `albumartistid` carries a
@@ -474,10 +476,10 @@ async fn two_artists_folding_onto_one_identifier_keep_a_single_favourite() {
     // `title` names nothing for an artist, so every artist evaluates to the
     // same empty string and the whole library folds onto one identifier. A
     // degenerate spec, and exactly the shape the collision handling is for.
-    let altered = waveflow_server::pid::PidSpecs {
+    let altered = waveflow_server::library::pid::PidSpecs {
         album: config.pid.album.clone(),
         track: config.pid.track.clone(),
-        artist: waveflow_server::pid::PidSpec::parse("title", false).unwrap(),
+        artist: waveflow_server::library::pid::PidSpec::parse("title", false).unwrap(),
     };
     let folded = altered.artist_id(library_id, "Fold One");
     assert_eq!(folded, altered.artist_id(library_id, "Fold Two"));
diff --git a/tests/media/main.rs b/tests/media/main.rs
index 771520b8..e3371548 100644
--- a/tests/media/main.rs
+++ b/tests/media/main.rs
@@ -7,11 +7,11 @@ use axum::http::Request;
 use axum::http::StatusCode;
 use http_body_util::BodyExt;
 use tower::ServiceExt;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::catalog::LibraryRecord;
-use waveflow_server::database::AccountRole;
-use waveflow_server::database::LibraryVisibility;
-use waveflow_server::security;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
+use waveflow_server::storage::catalog::LibraryRecord;
+use waveflow_server::storage::database::AccountRole;
+use waveflow_server::storage::database::LibraryVisibility;
 use waveflow_server::Config;
 
 // Not every target uses every fixture, and a shared module is not dead
diff --git a/tests/media/stream_tickets.rs b/tests/media/stream_tickets.rs
index bdbd770e..bd601f8a 100644
--- a/tests/media/stream_tickets.rs
+++ b/tests/media/stream_tickets.rs
@@ -192,9 +192,9 @@ async fn stream_tickets_authorise_browser_playback_without_a_bearer() {
     }
 
     // An expired ticket is refused even though it is otherwise well formed.
-    let expired = waveflow_server::stream_ticket::mint(
+    let expired = waveflow_server::auth::stream_ticket::mint(
         &secret_box,
-        waveflow_server::stream_ticket::TicketKind::Audio,
+        waveflow_server::auth::stream_ticket::TicketKind::Audio,
         owner,
         uuid::Uuid::parse_str(&track_id).unwrap(),
         now_ms() - 1,
@@ -215,9 +215,9 @@ async fn stream_tickets_authorise_browser_playback_without_a_bearer() {
     // track by this very account under the instance key, and unexpired. The
     // kind is the only thing separating it from the ticket that works two
     // assertions above — which is the whole reason the byte exists.
-    let wrong_kind = waveflow_server::stream_ticket::mint(
+    let wrong_kind = waveflow_server::auth::stream_ticket::mint(
         &secret_box,
-        waveflow_server::stream_ticket::TicketKind::Canvas,
+        waveflow_server::auth::stream_ticket::TicketKind::Canvas,
         owner,
         uuid::Uuid::parse_str(&track_id).unwrap(),
         now_ms() + 60_000,
diff --git a/tests/migrations.rs b/tests/migrations.rs
deleted file mode 100644
index 5863bf4f..00000000
--- a/tests/migrations.rs
+++ /dev/null
@@ -1,1112 +0,0 @@
-//! Upgrades — the one path every other target skips.
-//!
-//! `test_app()` builds its database from nothing, so the whole suite proves
-//! the schema can be **created** and never that it can be **upgraded** (#223).
-//! An upgrade is what every existing installation does, and it is the failure
-//! that costs most: migrations are embedded and checksummed, so one that goes
-//! wrong leaves the server refusing to start — found by somebody who has just
-//! updated, on a database that is already theirs.
-//!
-//! The fixture is built by code rather than checked in as a database file. A
-//! file is a snapshot of a real installation and catches what nobody thought
-//! to write; code is honest about what it exercises, survives a re-run, and
-//! carries no binary blob into the repository. The second was chosen for the
-//! last reason as much as the first — a blob nobody can read is a fixture
-//! nobody can correct.
-//!
-//! Not the first migration test: `a_populated_database_survives_a_table_rebuild`
-//! in `src/database.rs` already applies a prefix and migrates from there. It is
-//! pinned to **one** boundary — the participants rebuild it was written for —
-//! and asserts raw counts. This asks the general question instead, from every
-//! schema a tag actually shipped, and answers it through the services rather
-//! than through `SELECT COUNT(*)`: a row that survives a migration and is no
-//! longer reachable by a query has not survived in any sense a user would
-//! recognise.
-
-use sqlx::migrate::Migrate;
-use sqlx::Connection;
-use sqlx::SqliteConnection;
-use waveflow_server::database::Database;
-use waveflow_server::database::MIGRATOR;
-use waveflow_server::services::AlbumListQuery;
-use waveflow_server::services::BrowsePage;
-use waveflow_server::Config;
-
-/// The schema each released tag left on disk, named by its last migration.
-///
-/// **Add a line when a tag ships, and never edit one.** These are the states
-/// real databases are sitting in: a released schema stops being a hypothesis
-/// the moment somebody installs it. Both were measured with
-/// `git ls-tree --name-only <tag> migrations-v2/`, not read off the changelog,
-/// because the changelog records what was written and the tree records what
-/// shipped.
-///
-/// Remembering was the whole mechanism, so
-/// `the_version_being_shipped_has_its_schema_recorded` now holds it: the PR
-/// that bumps `version` in `Cargo.toml` for a release fails until it adds that
-/// tag here, with the newest migration of that moment as its baseline.
-const RELEASED_SCHEMAS: [(&str, i64); 2] = [
-    ("v2.0.0-beta.0", 20_260_823_020_000),
-    ("v2.0.0-beta.1", 20_260_914_030_000),
-];
-
-/// The crate's version is the tag it ships as, so it must name a line above.
-///
-/// A release is cut by a PR that bumps `version` and is then tagged, and the
-/// version stays put until the next one. So this holds between releases, and
-/// fails exactly on the bump that forgot the schema — before the tag exists,
-/// which is the only moment the baseline is still the newest migration and
-/// needs no archaeology to find.
-#[test]
-fn the_version_being_shipped_has_its_schema_recorded() {
-    let tag = concat!("v", env!("CARGO_PKG_VERSION"));
-    assert!(
-        RELEASED_SCHEMAS
-            .iter()
-            .any(|(released, _)| *released == tag),
-        "Cargo.toml is at {tag}, and RELEASED_SCHEMAS has no line for it: add \
-         (\"{tag}\", <version of the newest file under migrations-v2/>)"
-    );
-}
-
-/// The identifiers the fixture below writes and the assertions read back.
-///
-/// UUIDs because every real row's is: a fixture shaped unlike production is
-/// one a production-shaped defect can pass through.
-const ACCOUNT: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a1";
-const LIBRARY: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a2";
-const ARTIST_LEAD: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a3";
-const ARTIST_GUEST: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a4";
-const ALBUM: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a5";
-const TRACK: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a6";
-const GENRE: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a7";
-const PLAYLIST: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a8";
-const SCAN: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a9";
-
-/// One account, one library, and a catalogue with every shape a later
-/// migration might have to carry.
-///
-/// Written against the **oldest** schema in [`RELEASED_SCHEMAS`], which every
-/// later one is a superset of, so one fixture serves them all. Every column is
-/// named explicitly for the same reason: a migration that adds one must not
-/// silently change what this inserts.
-///
-/// What it holds is chosen, not arbitrary. An album credited to **two**
-/// artists is here because a credit model that only ever saw one was how the
-/// participants rebuild shipped; a genre, a playlist, a favourite and a play
-/// event are the user data that no rescan can reconstruct, which is what makes
-/// losing it unrecoverable rather than merely slow.
-async fn seed_an_installation(connection: &mut SqliteConnection) {
-    // `password_hash` is a placeholder written straight into the row rather
-    // than derived: nothing here ever authenticates, and putting a literal
-    // through Argon2 is what makes CodeQL report a hard-coded cryptographic
-    // value on a test that has no credentials in it.
-    for (statement, binds) in [
-        (
-            "INSERT INTO account (id, username, password_hash, role, created_at, updated_at) \
-               VALUES (?, 'upgrade-owner', 'placeholder', 'admin', 1000, 1000)",
-            vec![ACCOUNT],
-        ),
-        (
-            "INSERT INTO library (id, owner_user_id, name, root_path, visibility, \
-                                  created_at, updated_at) \
-               VALUES (?, ?, 'Upgraded library', '/music/upgraded', 'private', 1000, 1000)",
-            vec![LIBRARY, ACCOUNT],
-        ),
-        (
-            "INSERT INTO library_member (library_id, user_id, role, created_at) \
-               VALUES (?, ?, 'owner', 1000)",
-            vec![LIBRARY, ACCOUNT],
-        ),
-        (
-            "INSERT INTO artist (id, library_id, name, canonical_name, created_at, updated_at) \
-               VALUES (?, ?, 'Nova Kern', 'nova kern', 1000, 1000)",
-            vec![ARTIST_LEAD, LIBRARY],
-        ),
-        (
-            "INSERT INTO artist (id, library_id, name, canonical_name, created_at, updated_at) \
-               VALUES (?, ?, 'Vale Ortiz', 'vale ortiz', 1000, 1000)",
-            vec![ARTIST_GUEST, LIBRARY],
-        ),
-        (
-            "INSERT INTO artist_fts (artist_id, library_id, name, sort_name) \
-               VALUES (?, ?, 'Nova Kern', '')",
-            vec![ARTIST_LEAD, LIBRARY],
-        ),
-        (
-            "INSERT INTO artist_fts (artist_id, library_id, name, sort_name) \
-               VALUES (?, ?, 'Vale Ortiz', '')",
-            vec![ARTIST_GUEST, LIBRARY],
-        ),
-        (
-            "INSERT INTO album (id, library_id, title, canonical_title, album_artist_id, \
-                                album_artist_name, year, created_at, updated_at) \
-               VALUES (?, ?, 'Convergence', 'convergence', ?, 'Nova Kern', 2026, 1000, 1000)",
-            vec![ALBUM, LIBRARY, ARTIST_LEAD],
-        ),
-        (
-            "INSERT INTO album_participant (album_id, artist_id, library_id, role, position) \
-               VALUES (?, ?, ?, 'albumartist', 0)",
-            vec![ALBUM, ARTIST_LEAD, LIBRARY],
-        ),
-        (
-            "INSERT INTO album_participant (album_id, artist_id, library_id, role, position) \
-               VALUES (?, ?, ?, 'artist', 0)",
-            vec![ALBUM, ARTIST_LEAD, LIBRARY],
-        ),
-        (
-            "INSERT INTO album_participant (album_id, artist_id, library_id, role, position) \
-               VALUES (?, ?, ?, 'artist', 1)",
-            vec![ALBUM, ARTIST_GUEST, LIBRARY],
-        ),
-        (
-            "INSERT INTO genre (id, library_id, name, canonical_name, created_at) \
-               VALUES (?, ?, 'Ambient', 'ambient', 1000)",
-            vec![GENRE, LIBRARY],
-        ),
-        (
-            // The scan that last saw the track, with an error of its own: the
-            // two rows that point at `scan_job`, which RFC-021 rebuilds.
-            "INSERT INTO scan_job (id, library_id, requested_by, trigger, status, total_files, \
-                                   processed_files, added, errors, created_at, started_at, \
-                                   completed_at) \
-               VALUES (?, ?, ?, 'boot', 'completed', 1, 1, 1, 1, 1000, 1000, 1000)",
-            vec![SCAN, LIBRARY, ACCOUNT],
-        ),
-        (
-            "INSERT INTO scan_error (scan_id, relative_path, message, created_at) \
-               VALUES (?, 'convergence/02.flac', 'unreadable', 1000)",
-            vec![SCAN],
-        ),
-        (
-            "INSERT INTO track (id, library_id, album_id, relative_path, file_size, \
-                                file_modified_at, quick_hash, full_hash, title, album_title, \
-                                artist_display, genre_display, year, track_number, disc_number, \
-                                duration_ms, is_available, last_seen_scan_id, created_at, \
-                                updated_at) \
-               VALUES (?, ?, ?, 'convergence/01.flac', 4096, 1000, ?, ?, 'Zenith', \
-                       'Convergence', 'Nova Kern', 'Ambient', 2026, 1, 1, 210000, 1, ?, 1000, \
-                       1000)",
-            vec![
-                TRACK,
-                LIBRARY,
-                ALBUM,
-                &"1".repeat(64),
-                &"2".repeat(64),
-                SCAN,
-            ],
-        ),
-        (
-            "INSERT INTO track_participant (track_id, artist_id, library_id, role, sub_role, \
-                                            position) \
-               VALUES (?, ?, ?, 'artist', '', 0)",
-            vec![TRACK, ARTIST_LEAD, LIBRARY],
-        ),
-        (
-            "INSERT INTO track_participant (track_id, artist_id, library_id, role, sub_role, \
-                                            position) \
-               VALUES (?, ?, ?, 'artist', '', 1)",
-            vec![TRACK, ARTIST_GUEST, LIBRARY],
-        ),
-        (
-            // `albumartist`, not only `artist`: the scanner copies every
-            // track role onto the album, and the services that answer an
-            // album's credits select this one alone. Seeding `artist` by
-            // itself left `albums[0].artists` empty, so an upgrade losing
-            // every album credit would have passed (constat de revue,
-            // pris).
-            "INSERT INTO track_participant (track_id, artist_id, library_id, role, sub_role, \
-                                            position) \
-               VALUES (?, ?, ?, 'albumartist', '', 0)",
-            vec![TRACK, ARTIST_LEAD, LIBRARY],
-        ),
-        (
-            "INSERT INTO track_genre (track_id, genre_id, library_id) VALUES (?, ?, ?)",
-            vec![TRACK, GENRE, LIBRARY],
-        ),
-        (
-            "INSERT INTO track_fts (track_id, library_id, title, album, artists, genres) \
-               VALUES (?, ?, 'Zenith', 'Convergence', 'Nova Kern Vale Ortiz', 'Ambient')",
-            vec![TRACK, LIBRARY],
-        ),
-        (
-            "INSERT INTO artist_role_stats (artist_id, library_id, role, album_count, song_count) \
-               VALUES (?, ?, 'artist', 1, 1)",
-            vec![ARTIST_LEAD, LIBRARY],
-        ),
-        (
-            "INSERT INTO artist_role_stats (artist_id, library_id, role, album_count, song_count) \
-               VALUES (?, ?, 'artist', 1, 1)",
-            vec![ARTIST_GUEST, LIBRARY],
-        ),
-        (
-            "INSERT INTO playlist (id, owner_user_id, name, comment, public, created_at, \
-                                   updated_at) \
-               VALUES (?, ?, 'Carried over', 'written before the upgrade', 0, 1000, 1000)",
-            vec![PLAYLIST, ACCOUNT],
-        ),
-        (
-            "INSERT INTO playlist_track (playlist_id, track_id, position, added_at) \
-               VALUES (?, ?, 0, 1000)",
-            vec![PLAYLIST, TRACK],
-        ),
-        (
-            "INSERT INTO user_star (user_id, entity_type, entity_id, starred_at) \
-               VALUES (?, 'album', ?, 1000)",
-            vec![ACCOUNT, ALBUM],
-        ),
-        (
-            "INSERT INTO play_event (user_id, track_id, submission, played_at) \
-               VALUES (?, ?, 1, 1000)",
-            vec![ACCOUNT, TRACK],
-        ),
-    ] {
-        let mut query = sqlx::query(statement);
-        for bind in binds {
-            query = query.bind(bind.to_owned());
-        }
-        query
-            .execute(&mut *connection)
-            .await
-            .unwrap_or_else(|error| panic!("seeding `{statement}` failed: {error}"));
-    }
-}
-
-async fn count(connection: &mut SqliteConnection, query: &'static str) -> i64 {
-    sqlx::query_scalar(query)
-        .fetch_one(&mut *connection)
-        .await
-        .unwrap_or_else(|error| panic!("`{query}` failed: {error}"))
-}
-
-#[tokio::test]
-async fn every_released_schema_upgrades_with_the_rows_it_was_holding() {
-    let total = MIGRATOR.iter().count();
-
-    for (tag, baseline) in RELEASED_SCHEMAS {
-        let temp = tempfile::tempdir().expect("temporary directory");
-        let config = Config::for_data_dir(temp.path().join("data"));
-
-        // Step one: a database at the released schema, holding rows.
-        let database = Database::open(&config).await.expect("open the database");
-        let mut connection = database.pool().acquire().await.expect("connection");
-        connection
-            .ensure_migrations_table(&MIGRATOR.table_name)
-            .await
-            .expect("migrations table");
-        // A baseline that names no migration is a typo, and a typo here is
-        // silent: the filter below would still apply *some* prefix, and every
-        // assertion would then hold about a schema no tag ever shipped
-        // (constat de revue, pris).
-        assert!(
-            MIGRATOR
-                .iter()
-                .any(|migration| migration.version == baseline),
-            "{tag}: no migration has version {baseline}"
-        );
-        for migration in MIGRATOR
-            .iter()
-            .filter(|migration| migration.version <= baseline)
-        {
-            connection
-                .apply(&MIGRATOR.table_name, migration)
-                .await
-                .unwrap_or_else(|error| {
-                    panic!("{tag}: migration {} failed: {error}", migration.version)
-                });
-        }
-        seed_an_installation(&mut connection).await;
-
-        // **This is what keeps the test from being a fresh-install test in
-        // disguise.** If the prefix silently applied everything, the rows
-        // above would have been written into today's schema and the upgrade
-        // below would have nothing left to do — green, on the right lines, and
-        // proving none of what it claims.
-        let applied_before = count(&mut connection, "SELECT COUNT(*) FROM _sqlx_migrations").await;
-        assert!(
-            (applied_before as usize) < total,
-            "{tag}: the baseline applied all {total} migrations, so nothing is being upgraded"
-        );
-        drop(connection);
-        database.pool().close().await;
-        drop(database);
-
-        // Step two: the upgrade, through the boot path rather than a bare
-        // `migrate()` call — an installation that updates runs all of it, and
-        // the key binding and identity reconciliation read the same rows.
-        let state = waveflow_server::initialize(&config)
-            .await
-            .unwrap_or_else(|error| panic!("{tag}: a populated database refused to boot: {error}"));
-
-        let mut connection = state.db.pool().acquire().await.expect("connection");
-        let applied_after = count(&mut connection, "SELECT COUNT(*) FROM _sqlx_migrations").await;
-        assert_eq!(
-            applied_after as usize, total,
-            "{tag}: the upgrade left migrations unapplied"
-        );
-
-        // Step three: the rows are still there — and still *mean* something.
-        // A count proves the statements ran; reading them back through the
-        // services proves the upgraded schema is the one the server queries.
-        let violations = sqlx::query("PRAGMA foreign_key_check")
-            .fetch_all(&mut *connection)
-            .await
-            .expect("foreign key check");
-        assert!(
-            violations.is_empty(),
-            "{tag}: the upgrade left {} broken reference(s)",
-            violations.len()
-        );
-        drop(connection);
-
-        let account: uuid::Uuid = ACCOUNT.parse().expect("account id");
-        let album: uuid::Uuid = ALBUM.parse().expect("album id");
-        let track: uuid::Uuid = TRACK.parse().expect("track id");
-
-        let albums = state
-            .services
-            .list_albums(account, &AlbumListQuery::default())
-            .await
-            .expect("list albums");
-        assert_eq!(albums.len(), 1, "{tag}: the album did not survive");
-        assert_eq!(albums[0].title, "Convergence", "{tag}");
-        assert_eq!(
-            albums[0]
-                .artists
-                .iter()
-                .map(|artist| artist.name.as_str())
-                .collect::<Vec<_>>(),
-            vec!["Nova Kern"],
-            "{tag}: the album credit did not survive the upgrade"
-        );
-
-        let found = state
-            .services
-            .catalog_search(
-                account,
-                &[],
-                "Zenith",
-                BrowsePage::default(),
-                BrowsePage::default(),
-                BrowsePage::default(),
-            )
-            .await
-            .expect("search");
-        assert_eq!(
-            found.songs.len(),
-            1,
-            "{tag}: the search index did not come through the upgrade"
-        );
-
-        let playlists = state.services.playlists(account).await.expect("playlists");
-        assert_eq!(playlists.len(), 1, "{tag}: the playlist did not survive");
-        assert_eq!(playlists[0].name, "Carried over", "{tag}");
-
-        // The three relations the fixture carries that nothing read back
-        // until now (constat de revue, pris). A seeded row no assertion reads
-        // is how a fixture comes to claim more than it proves — and the
-        // second credit is the one that matters most here, because a credit
-        // model that could only ever see the first is exactly what the
-        // participants rebuild replaced.
-        let playlist = state
-            .services
-            .playlist(account, PLAYLIST.parse().expect("playlist id"))
-            .await
-            .expect("playlist");
-        assert_eq!(
-            playlist
-                .songs
-                .iter()
-                .map(|song| song.id)
-                .collect::<Vec<_>>(),
-            vec![track],
-            "{tag}: the playlist lost the track it held"
-        );
-        assert_eq!(
-            playlist.songs[0]
-                .artists
-                .iter()
-                .map(|artist| artist.name.as_str())
-                .collect::<Vec<_>>(),
-            vec!["Nova Kern", "Vale Ortiz"],
-            "{tag}: a credit did not survive the upgrade"
-        );
-        assert_eq!(
-            playlist.songs[0].genres,
-            vec!["Ambient".to_owned()],
-            "{tag}: the genre relation did not survive the upgrade"
-        );
-
-        let starred = state.services.starred(account, &[]).await.expect("starred");
-        assert_eq!(
-            starred
-                .albums
-                .iter()
-                .map(|item| item.id)
-                .collect::<Vec<_>>(),
-            vec![album],
-            "{tag}: the favourite did not survive"
-        );
-
-        // Listening history is the one thing a rescan cannot rebuild, and the
-        // only reader that proves the rows are still joinable to a track.
-        let top = state
-            .services
-            .artist_top_songs_by_name(account, "Nova Kern", 10)
-            .await
-            .expect("top songs");
-        assert_eq!(
-            top.len(),
-            1,
-            "{tag}: the play history did not survive the upgrade"
-        );
-        assert_eq!(top[0].title, "Zenith", "{tag}");
-
-        // The scan history, through the table RFC-021 rebuilt to admit two
-        // more triggers: the job, its error, and the track that names it as
-        // the scan that last saw it. A rebuild run with foreign keys on would
-        // have cascaded the error away and nulled the track's reference — and
-        // a null there makes the next scan treat the track as never seen.
-        let scan: uuid::Uuid = SCAN.parse().expect("scan id");
-        let job = state
-            .db
-            .scan_job(scan)
-            .await
-            .expect("read the job")
-            .unwrap_or_else(|| panic!("{tag}: the scan history did not survive"));
-        assert_eq!(
-            (job.status.as_str(), job.added, job.errors),
-            ("completed", 1, 1),
-            "{tag}"
-        );
-        assert_eq!((job.excluded, job.skipped_links), (0, 0), "{tag}");
-        let mut connection = state.db.pool().acquire().await.expect("connection");
-        assert_eq!(
-            count(
-                &mut connection,
-                "SELECT COUNT(*) FROM scan_error WHERE scan_id = '6f1d1b6e-0f1a-4a3d-9c21-0000000000a9'"
-            )
-            .await,
-            1,
-            "{tag}: the scan's error did not survive"
-        );
-        assert_eq!(
-            count(
-                &mut connection,
-                "SELECT COUNT(*) FROM track WHERE last_seen_scan_id = '6f1d1b6e-0f1a-4a3d-9c21-0000000000a9'"
-            )
-            .await,
-            1,
-            "{tag}: the track lost the scan that last saw it"
-        );
-    }
-}
-
-const TRACK_TWO: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a9";
-const SHARE: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000aa";
-
-/// The two lists RFC-020 rebuilt come through with every row, in its order,
-/// and take a repeat afterwards.
-///
-/// `playlist_track` and `share_track` were keyed on `(list, track)` and are
-/// keyed on `(list, position)` since `20261026000000`. A rebuild is a copy into
-/// a new table, and the failure it invites is quiet: rows dropped by a
-/// mistyped column, or positions renumbered so the order changes. So the
-/// fixture stores its two tracks **against** their insertion order — the
-/// second track first — which a rebuild that numbered rows as it read them
-/// would get wrong, and reads them back through the services. Then it adds a
-/// copy of a track the playlist already holds, which is what the new key is
-/// for and what the old one refused.
-#[tokio::test]
-async fn the_rebuilt_lists_keep_their_rows_in_order_and_then_take_a_repeat() {
-    for (tag, baseline) in RELEASED_SCHEMAS {
-        let temp = tempfile::tempdir().expect("temporary directory");
-        let config = Config::for_data_dir(temp.path().join("data"));
-        let database = Database::open(&config).await.expect("open the database");
-        let mut connection = database.pool().acquire().await.expect("connection");
-        connection
-            .ensure_migrations_table(&MIGRATOR.table_name)
-            .await
-            .expect("migrations table");
-        for migration in MIGRATOR
-            .iter()
-            .filter(|migration| migration.version <= baseline)
-        {
-            connection
-                .apply(&MIGRATOR.table_name, migration)
-                .await
-                .unwrap_or_else(|error| {
-                    panic!("{tag}: migration {} failed: {error}", migration.version)
-                });
-        }
-        seed_an_installation(&mut connection).await;
-        for (statement, binds) in [
-            (
-                "INSERT INTO track (id, library_id, album_id, relative_path, file_size, \
-                                    file_modified_at, quick_hash, full_hash, title, album_title, \
-                                    artist_display, duration_ms, is_available, created_at, \
-                                    updated_at) \
-                   VALUES (?, ?, ?, 'convergence/02.flac', 4096, 1000, ?, ?, 'Nadir', \
-                           'Convergence', 'Nova Kern', 180000, 1, 1000, 1000)",
-                vec![TRACK_TWO, LIBRARY, ALBUM, &"5".repeat(64), &"6".repeat(64)],
-            ),
-            // The fixture's playlist already holds TRACK at position 0; it is
-            // moved behind the new one, so the stored order is not the order
-            // the rows were written in.
-            (
-                "UPDATE playlist_track SET position=1 WHERE playlist_id=? AND track_id=?",
-                vec![PLAYLIST, TRACK],
-            ),
-            (
-                "INSERT INTO playlist_track (playlist_id, track_id, position, added_at) \
-                   VALUES (?, ?, 0, 1000)",
-                vec![PLAYLIST, TRACK_TWO],
-            ),
-            (
-                "INSERT INTO share (id, owner_user_id, token_hash, description, created_at, \
-                                    updated_at, visit_count) \
-                   VALUES (?, ?, randomblob(32), 'Carried share', 1000, 1000, 7)",
-                vec![SHARE, ACCOUNT],
-            ),
-            (
-                "INSERT INTO share_track (share_id, track_id, position) VALUES (?, ?, 1)",
-                vec![SHARE, TRACK],
-            ),
-            (
-                "INSERT INTO share_track (share_id, track_id, position) VALUES (?, ?, 0)",
-                vec![SHARE, TRACK_TWO],
-            ),
-        ] {
-            let mut query = sqlx::query(statement);
-            for bind in binds {
-                query = query.bind(bind.to_owned());
-            }
-            query
-                .execute(&mut *connection)
-                .await
-                .unwrap_or_else(|error| panic!("{tag}: `{statement}` failed: {error}"));
-        }
-        drop(connection);
-        database.pool().close().await;
-        drop(database);
-
-        let state = waveflow_server::initialize(&config)
-            .await
-            .unwrap_or_else(|error| panic!("{tag}: a populated database refused to boot: {error}"));
-        let account: uuid::Uuid = ACCOUNT.parse().expect("account id");
-        let playlist_id: uuid::Uuid = PLAYLIST.parse().expect("playlist id");
-        let track: uuid::Uuid = TRACK.parse().expect("track id");
-        let track_two: uuid::Uuid = TRACK_TWO.parse().expect("track id");
-
-        let playlist = state
-            .services
-            .playlist(account, playlist_id)
-            .await
-            .expect("playlist");
-        assert_eq!(
-            playlist
-                .songs
-                .iter()
-                .map(|song| song.id)
-                .collect::<Vec<_>>(),
-            vec![track_two, track],
-            "{tag}: the playlist lost a row or its order"
-        );
-        assert_eq!(playlist.owner_username, "upgrade-owner", "{tag}");
-
-        let shares = state.services.shares(account).await.expect("shares");
-        assert_eq!(shares.len(), 1, "{tag}: the share did not survive");
-        assert_eq!(shares[0].visit_count, 7, "{tag}");
-        assert_eq!(shares[0].max_visits, None, "{tag}: an old share has no cap");
-        assert_eq!(
-            shares[0]
-                .songs
-                .iter()
-                .map(|song| song.id)
-                .collect::<Vec<_>>(),
-            vec![track_two, track],
-            "{tag}: the share lost a row or its order"
-        );
-
-        let repeated = state
-            .services
-            .update_playlist(
-                account,
-                playlist_id,
-                None,
-                None,
-                None,
-                &[track_two],
-                &[],
-                Default::default(),
-            )
-            .await
-            .unwrap_or_else(|error| panic!("{tag}: a repeat was refused: {error}"));
-        assert_eq!(
-            repeated
-                .songs
-                .iter()
-                .map(|song| song.id)
-                .collect::<Vec<_>>(),
-            vec![track_two, track, track_two],
-            "{tag}"
-        );
-    }
-}
-
-/// A key change reads without migrating, and copies before it does.
-///
-/// Here rather than beside the other key tests in `cli.rs` for the reason this
-/// whole target exists: `test_app()` builds a current schema, and on a current
-/// schema a reading that migrates and one that does not are the same reading.
-/// Only a database *behind* the binary can tell them apart, and building one
-/// is what this file already knows how to do.
-///
-/// Two promises, both of which only a lagging schema can hold to account:
-///
-/// - **a reading changes nothing**, so `key rotate` without `--confirm` must
-///   leave `_sqlx_migrations` exactly as it found it — applying a migration is
-///   a change, whatever else it is;
-/// - **the recovery copy is the database as found**, so it must still be at
-///   the old schema after the confirmed run brought the live one forward. A
-///   copy taken afterwards would restore the operator to a schema they never
-///   chose to run.
-#[tokio::test]
-async fn a_key_change_reads_without_migrating_and_copies_before_it_migrates() {
-    let total = MIGRATOR.iter().count();
-    let (tag, baseline) = RELEASED_SCHEMAS[RELEASED_SCHEMAS.len() - 1];
-    let temp = tempfile::tempdir().expect("temporary directory");
-    let config = Config::for_data_dir(temp.path().join("data"));
-
-    let database = Database::open(&config).await.expect("open the database");
-    let mut connection = database.pool().acquire().await.expect("connection");
-    connection
-        .ensure_migrations_table(&MIGRATOR.table_name)
-        .await
-        .expect("migrations table");
-    for migration in MIGRATOR
-        .iter()
-        .filter(|migration| migration.version <= baseline)
-    {
-        connection
-            .apply(&MIGRATOR.table_name, migration)
-            .await
-            .unwrap_or_else(|error| {
-                panic!("{tag}: migration {} failed: {error}", migration.version)
-            });
-    }
-    // The pair that schema was running under. Written by hand because the only
-    // thing this test needs from it is that the two halves agree: `rotate`
-    // refuses a key the database was not bound to, and that refusal is not
-    // what is being measured here.
-    let key = [5u8; 32];
-    std::fs::write(&config.instance_key_path, key).expect("the key file");
-    sqlx::query(
-        "INSERT INTO instance_metadata (singleton, key_fingerprint, created_at) VALUES (1, ?, 0)",
-    )
-    .bind(waveflow_server::security::bytes_hash(&key).as_slice())
-    .execute(&mut *connection)
-    .await
-    .expect("bind the key");
-    let behind = count(&mut connection, "SELECT COUNT(*) FROM _sqlx_migrations").await;
-    assert!(
-        (behind as usize) < total,
-        "{tag}: the baseline applied all {total} migrations, so nothing is behind"
-    );
-    drop(connection);
-    database.pool().close().await;
-    drop(database);
-
-    // One: the reading. It is told there is an upgrade waiting, and leaves it
-    // waiting.
-    waveflow_server::cli::key(
-        &config,
-        waveflow_server::cli::KeyCommand::Rotate(waveflow_server::cli::KeyArgs { confirm: false }),
-    )
-    .await
-    .expect("a reading of a lagging database");
-    assert_eq!(
-        applied_in(&config.database_path).await,
-        behind,
-        "a reading applied a migration"
-    );
-    assert_eq!(
-        std::fs::read(&config.instance_key_path).unwrap(),
-        key,
-        "a reading replaced the key"
-    );
-
-    // Two: the change. The copy is the database as it was found.
-    waveflow_server::cli::key(
-        &config,
-        waveflow_server::cli::KeyCommand::Rotate(waveflow_server::cli::KeyArgs { confirm: true }),
-    )
-    .await
-    .expect("a confirmed rotation of a lagging database");
-    assert_ne!(
-        std::fs::read(&config.instance_key_path).unwrap(),
-        key,
-        "the rotation kept the old key"
-    );
-    let recovery = std::fs::read_dir(&config.data_dir)
-        .unwrap()
-        .map(|entry| entry.unwrap().path())
-        .find(|path| {
-            path.file_name()
-                .and_then(|name| name.to_str())
-                .is_some_and(|name| name.starts_with("pre-key-"))
-        })
-        .expect("a recovery directory");
-    assert_eq!(
-        applied_in(&recovery.join("waveflow.db")).await,
-        behind,
-        "the recovery copy was taken after the schema had already moved"
-    );
-    assert_eq!(
-        applied_in(&config.database_path).await as usize,
-        total,
-        "the rotation left migrations unapplied"
-    );
-
-    // And the pair it leaves behind is one the server opens.
-    waveflow_server::initialize(&config)
-        .await
-        .expect("the rotated pair must boot");
-}
-
-/// A database at the newest released schema, bound to a key on disk, as an
-/// installation that is about to upgrade has it. Answers the key and how many
-/// migrations the database has run.
-///
-/// `extra` runs on the database before it is closed, for a test that needs it
-/// shaped some further way.
-async fn an_installation_behind(config: &Config, extra: Option<&'static str>) -> ([u8; 32], i64) {
-    let (tag, baseline) = RELEASED_SCHEMAS[RELEASED_SCHEMAS.len() - 1];
-    let database = Database::open(config).await.expect("open the database");
-    let mut connection = database.pool().acquire().await.expect("connection");
-    connection
-        .ensure_migrations_table(&MIGRATOR.table_name)
-        .await
-        .expect("migrations table");
-    for migration in MIGRATOR
-        .iter()
-        .filter(|migration| migration.version <= baseline)
-    {
-        connection
-            .apply(&MIGRATOR.table_name, migration)
-            .await
-            .unwrap_or_else(|error| {
-                panic!("{tag}: migration {} failed: {error}", migration.version)
-            });
-    }
-    seed_an_installation(&mut connection).await;
-    // Drawn, not written down: the test needs the two halves to agree, and a
-    // key in the source would be a key in the source.
-    let key: [u8; 32] = [
-        *uuid::Uuid::new_v4().as_bytes(),
-        *uuid::Uuid::new_v4().as_bytes(),
-    ]
-    .concat()
-    .try_into()
-    .unwrap();
-    std::fs::write(&config.instance_key_path, key).expect("the key file");
-    sqlx::query(
-        "INSERT INTO instance_metadata (singleton, key_fingerprint, created_at) VALUES (1, ?, 0)",
-    )
-    .bind(waveflow_server::security::bytes_hash(&key).as_slice())
-    .execute(&mut *connection)
-    .await
-    .expect("bind the key");
-    if let Some(statement) = extra {
-        sqlx::query(statement)
-            .execute(&mut *connection)
-            .await
-            .unwrap_or_else(|error| panic!("`{statement}` failed: {error}"));
-    }
-    let behind = count(&mut connection, "SELECT COUNT(*) FROM _sqlx_migrations").await;
-    assert!(
-        (behind as usize) < MIGRATOR.iter().count(),
-        "{tag}: the baseline applied every migration, so nothing is behind"
-    );
-    drop(connection);
-    database.pool().close().await;
-    (key, behind)
-}
-
-/// The copy directories a boot made before migrating, newest first.
-fn pre_migration_copies(config: &Config) -> Vec<std::path::PathBuf> {
-    let mut copies: Vec<(u64, std::path::PathBuf)> = std::fs::read_dir(&config.data_dir)
-        .unwrap()
-        .map(|entry| entry.unwrap().path())
-        .filter_map(|path| {
-            let taken_at = path
-                .file_name()?
-                .to_str()?
-                .strip_prefix(waveflow_server::migration_backup::PREFIX)?
-                .parse::<u64>()
-                .ok()?;
-            Some((taken_at, path))
-        })
-        .collect();
-    copies.sort_by_key(|(taken_at, _)| std::cmp::Reverse(*taken_at));
-    copies.into_iter().map(|(_, path)| path).collect()
-}
-
-/// RFC-019 decision 3: an upgrade copies the database **as it found it**, with
-/// the key it was bound to, keeps the newest copies only, touches nothing it
-/// did not make — and a boot with nothing to apply copies nothing.
-#[tokio::test]
-async fn an_upgrade_copies_the_database_and_its_key_before_migrating() {
-    let temp = tempfile::tempdir().expect("temporary directory");
-    let config = Config::for_data_dir(temp.path().join("data"));
-    let (key, behind) = an_installation_behind(&config, None).await;
-    // Four older copies, and two directories that only look like one.
-    for stale in ["1", "2", "3", "4"] {
-        std::fs::create_dir_all(config.data_dir.join(format!(
-            "{}{stale}",
-            waveflow_server::migration_backup::PREFIX
-        )))
-        .unwrap();
-    }
-    let lookalike = config.data_dir.join(format!(
-        "{}notes",
-        waveflow_server::migration_backup::PREFIX
-    ));
-    let restore = config.data_dir.join("pre-restore-5");
-    std::fs::create_dir_all(&lookalike).unwrap();
-    std::fs::create_dir_all(&restore).unwrap();
-
-    let state = waveflow_server::initialize(&config)
-        .await
-        .expect("an installation behind boots");
-    state.db.pool().close().await;
-    drop(state);
-
-    let copies = pre_migration_copies(&config);
-    assert_eq!(
-        copies.len(),
-        config.migration_backups,
-        "kept {copies:?}, expected the newest {}",
-        config.migration_backups
-    );
-    let newest = &copies[0];
-    assert_eq!(
-        applied_in(&newest.join("waveflow.db")).await,
-        behind,
-        "the copy was taken after the schema had moved"
-    );
-    assert_eq!(
-        std::fs::read(newest.join("instance.key")).unwrap(),
-        key,
-        "the copy does not carry the key its database is bound to"
-    );
-    assert!(
-        Database::check_file_instance_key(
-            &newest.join("waveflow.db"),
-            &waveflow_server::security::bytes_hash(&key)
-        )
-        .await
-        .unwrap(),
-        "the copied pair does not agree"
-    );
-    let prefix = waveflow_server::migration_backup::PREFIX;
-    for gone in ["1", "2"] {
-        assert!(!config.data_dir.join(format!("{prefix}{gone}")).exists());
-    }
-    for kept in ["3", "4"] {
-        assert!(config.data_dir.join(format!("{prefix}{kept}")).exists());
-    }
-    assert!(
-        lookalike.exists(),
-        "pruning deleted a directory it did not make"
-    );
-    assert!(
-        restore.exists(),
-        "pruning deleted a restore's recovery copy"
-    );
-
-    // Nothing left to apply: nothing copied.
-    waveflow_server::initialize(&config)
-        .await
-        .expect("an upgraded installation boots");
-    assert_eq!(pre_migration_copies(&config), copies);
-}
-
-/// A migration that fails says where the copy is, and the copy is whole.
-#[tokio::test]
-async fn a_failed_upgrade_names_the_copy_it_can_be_restored_from() {
-    let temp = tempfile::tempdir().expect("temporary directory");
-    let config = Config::for_data_dir(temp.path().join("data"));
-    // A table a later migration creates, already there: that migration fails.
-    let (key, behind) = an_installation_behind(
-        &config,
-        Some("CREATE TABLE radio_station (id TEXT PRIMARY KEY)"),
-    )
-    .await;
-
-    let error = match waveflow_server::initialize(&config).await {
-        Ok(_) => panic!("a migration that cannot apply booted"),
-        Err(error) => format!("{error:#}"),
-    };
-    let copies = pre_migration_copies(&config);
-    assert_eq!(copies.len(), 1, "{copies:?}");
-    let copy = copies[0].display().to_string();
-    assert!(
-        error.contains(&format!("database restore --input {copy}")),
-        "the failure does not say how to go back: {error}"
-    );
-    assert!(error.contains("v2 migration failed"), "{error}");
-    assert_eq!(applied_in(&copies[0].join("waveflow.db")).await, behind);
-    assert_eq!(std::fs::read(copies[0].join("instance.key")).unwrap(), key);
-}
-
-/// A copy that cannot be made stops the boot before anything is applied, and
-/// leaves no half-made directory for pruning to count as a whole one.
-#[tokio::test]
-async fn a_copy_that_cannot_be_made_leaves_nothing_behind() {
-    let temp = tempfile::tempdir().expect("temporary directory");
-    let mut config = Config::for_data_dir(temp.path().join("data"));
-    let (_, behind) = an_installation_behind(&config, None).await;
-    // The database copies; the key cannot, because a directory stands where
-    // the key should be.
-    config.instance_key_path = config.data_dir.join("key-is-a-directory");
-    std::fs::create_dir_all(&config.instance_key_path).unwrap();
-
-    let error = match waveflow_server::initialize(&config).await {
-        Ok(_) => panic!("a boot without its copy went ahead"),
-        Err(error) => format!("{error:#}"),
-    };
-    assert!(error.contains("could not copy the instance key"), "{error}");
-    assert!(
-        pre_migration_copies(&config).is_empty(),
-        "an incomplete copy was left behind: {:?}",
-        pre_migration_copies(&config)
-    );
-    assert_eq!(
-        applied_in(&config.database_path).await,
-        behind,
-        "a migration ran without its copy"
-    );
-}
-
-/// A database bound to a key is copied only with that key: missing or wrong,
-/// the pair would be no way back, so the boot refuses before migrating — and
-/// before minting a key of its own beside a database that has one. A
-/// database never bound to a key is still copied alone; the released-schema
-/// test above stands on that.
-#[tokio::test]
-async fn a_bound_database_is_not_copied_without_its_own_key() {
-    for (case, damage) in [
-        ("missing", None),
-        ("wrong", Some(*uuid::Uuid::new_v4().as_bytes())),
-    ] {
-        let temp = tempfile::tempdir().expect("temporary directory");
-        let config = Config::for_data_dir(temp.path().join("data"));
-        let (_, behind) = an_installation_behind(&config, None).await;
-        match damage {
-            None => std::fs::remove_file(&config.instance_key_path).unwrap(),
-            Some(other) => {
-                std::fs::write(&config.instance_key_path, [other, other].concat()).unwrap()
-            }
-        }
-
-        let error = match waveflow_server::initialize(&config).await {
-            Ok(_) => panic!("{case}: a boot with no matching key went ahead"),
-            Err(error) => format!("{error:#}"),
-        };
-        assert!(
-            error.contains("nothing has been applied"),
-            "{case}: {error}"
-        );
-        assert!(
-            pre_migration_copies(&config).is_empty(),
-            "{case}: a pair restore would refuse was kept: {:?}",
-            pre_migration_copies(&config)
-        );
-        assert_eq!(
-            applied_in(&config.database_path).await,
-            behind,
-            "{case}: migrated a database whose key is not there"
-        );
-        if damage.is_none() {
-            assert!(error.contains("key adopt"), "{error}");
-            assert!(
-                !config.instance_key_path.exists(),
-                "a key was minted beside a database bound to another"
-            );
-        }
-    }
-}
-
-/// The copy a boot has just made is kept even when its name sorts below the
-/// others — a clock that went back, or copies dated in the future.
-#[tokio::test]
-async fn the_copy_just_made_survives_a_clock_that_went_back() {
-    let temp = tempfile::tempdir().expect("temporary directory");
-    let config = Config::for_data_dir(temp.path().join("data"));
-    let (_, behind) = an_installation_behind(&config, None).await;
-    let prefix = waveflow_server::migration_backup::PREFIX;
-    // Three copies dated long after anything this boot can read off its clock.
-    let future = ["99999999999991", "99999999999992", "99999999999993"];
-    for stamp in future {
-        std::fs::create_dir_all(config.data_dir.join(format!("{prefix}{stamp}"))).unwrap();
-    }
-
-    let state = waveflow_server::initialize(&config)
-        .await
-        .expect("an installation behind boots");
-    state.db.pool().close().await;
-    drop(state);
-
-    let copies = pre_migration_copies(&config);
-    assert_eq!(copies.len(), config.migration_backups, "{copies:?}");
-    let made = copies
-        .iter()
-        .find(|copy| copy.join("waveflow.db").exists())
-        .unwrap_or_else(|| panic!("the copy this boot made was deleted: {copies:?}"));
-    assert_eq!(applied_in(&made.join("waveflow.db")).await, behind);
-    // The room it needed came from the oldest of the others.
-    assert!(!config
-        .data_dir
-        .join(format!("{prefix}{}", future[0]))
-        .exists());
-    for kept in &future[1..] {
-        assert!(config.data_dir.join(format!("{prefix}{kept}")).exists());
-    }
-}
-
-/// Zero copies is a setting: an operator with backups of their own upgrades
-/// without one.
-#[tokio::test]
-async fn no_copy_is_taken_when_the_operator_set_none() {
-    let temp = tempfile::tempdir().expect("temporary directory");
-    let mut config = Config::for_data_dir(temp.path().join("data"));
-    config.migration_backups = 0;
-    an_installation_behind(&config, None).await;
-    waveflow_server::initialize(&config)
-        .await
-        .expect("an installation behind boots");
-    assert!(pre_migration_copies(&config).is_empty());
-
-    // And a fresh install, with copies on, has nothing to copy.
-    let fresh = tempfile::tempdir().expect("temporary directory");
-    let config = Config::for_data_dir(fresh.path().join("data"));
-    waveflow_server::initialize(&config)
-        .await
-        .expect("a fresh install boots");
-    assert!(pre_migration_copies(&config).is_empty());
-}
-
-/// How many migrations a database on disk has run.
-///
-/// Opened alone and closed again between readings: the key commands take the
-/// file exclusively, and a connection this test forgot to close would make the
-/// next one fail for a reason that has nothing to do with what it asserts.
-async fn applied_in(path: &std::path::Path) -> i64 {
-    let mut connection = Database::open_alone(path, std::time::Duration::from_secs(5))
-        .await
-        .unwrap_or_else(|error| panic!("{}: {error}", path.display()));
-    let applied = count(&mut connection, "SELECT COUNT(*) FROM _sqlx_migrations").await;
-    connection.close().await.expect("close");
-    applied
-}
diff --git a/tests/migrations/copies.rs b/tests/migrations/copies.rs
new file mode 100644
index 00000000..57e9f0cc
--- /dev/null
+++ b/tests/migrations/copies.rs
@@ -0,0 +1,461 @@
+//! The copy taken before a migration, and a key change that reads without
+//! migrating.
+
+use super::*;
+
+/// A key change reads without migrating, and copies before it does.
+///
+/// Here rather than beside the other key tests in `cli/key.rs` for the reason this
+/// whole target exists: `test_app()` builds a current schema, and on a current
+/// schema a reading that migrates and one that does not are the same reading.
+/// Only a database *behind* the binary can tell them apart, and building one
+/// is what this file already knows how to do.
+///
+/// Two promises, both of which only a lagging schema can hold to account:
+///
+/// - **a reading changes nothing**, so `key rotate` without `--confirm` must
+///   leave `_sqlx_migrations` exactly as it found it — applying a migration is
+///   a change, whatever else it is;
+/// - **the recovery copy is the database as found**, so it must still be at
+///   the old schema after the confirmed run brought the live one forward. A
+///   copy taken afterwards would restore the operator to a schema they never
+///   chose to run.
+#[tokio::test]
+async fn a_key_change_reads_without_migrating_and_copies_before_it_migrates() {
+    let total = MIGRATOR.iter().count();
+    let (tag, baseline) = RELEASED_SCHEMAS[RELEASED_SCHEMAS.len() - 1];
+    let temp = tempfile::tempdir().expect("temporary directory");
+    let config = Config::for_data_dir(temp.path().join("data"));
+
+    let database = Database::open(&config).await.expect("open the database");
+    let mut connection = database.pool().acquire().await.expect("connection");
+    connection
+        .ensure_migrations_table(&MIGRATOR.table_name)
+        .await
+        .expect("migrations table");
+    for migration in MIGRATOR
+        .iter()
+        .filter(|migration| migration.version <= baseline)
+    {
+        connection
+            .apply(&MIGRATOR.table_name, migration)
+            .await
+            .unwrap_or_else(|error| {
+                panic!("{tag}: migration {} failed: {error}", migration.version)
+            });
+    }
+    // The pair that schema was running under. Written by hand because the only
+    // thing this test needs from it is that the two halves agree: `rotate`
+    // refuses a key the database was not bound to, and that refusal is not
+    // what is being measured here.
+    let key = [5u8; 32];
+    std::fs::write(&config.instance_key_path, key).expect("the key file");
+    sqlx::query(
+        "INSERT INTO instance_metadata (singleton, key_fingerprint, created_at) VALUES (1, ?, 0)",
+    )
+    .bind(waveflow_server::auth::security::bytes_hash(&key).as_slice())
+    .execute(&mut *connection)
+    .await
+    .expect("bind the key");
+    let behind = count(&mut connection, "SELECT COUNT(*) FROM _sqlx_migrations").await;
+    assert!(
+        (behind as usize) < total,
+        "{tag}: the baseline applied all {total} migrations, so nothing is behind"
+    );
+    drop(connection);
+    database.pool().close().await;
+    drop(database);
+
+    // One: the reading. It is told there is an upgrade waiting, and leaves it
+    // waiting.
+    waveflow_server::cli::key(
+        &config,
+        waveflow_server::cli::KeyCommand::Rotate(waveflow_server::cli::KeyArgs { confirm: false }),
+    )
+    .await
+    .expect("a reading of a lagging database");
+    assert_eq!(
+        applied_in(&config.database_path).await,
+        behind,
+        "a reading applied a migration"
+    );
+    assert_eq!(
+        std::fs::read(&config.instance_key_path).unwrap(),
+        key,
+        "a reading replaced the key"
+    );
+
+    // Two: the change. The copy is the database as it was found.
+    waveflow_server::cli::key(
+        &config,
+        waveflow_server::cli::KeyCommand::Rotate(waveflow_server::cli::KeyArgs { confirm: true }),
+    )
+    .await
+    .expect("a confirmed rotation of a lagging database");
+    assert_ne!(
+        std::fs::read(&config.instance_key_path).unwrap(),
+        key,
+        "the rotation kept the old key"
+    );
+    let recovery = std::fs::read_dir(&config.data_dir)
+        .unwrap()
+        .map(|entry| entry.unwrap().path())
+        .find(|path| {
+            path.file_name()
+                .and_then(|name| name.to_str())
+                .is_some_and(|name| name.starts_with("pre-key-"))
+        })
+        .expect("a recovery directory");
+    assert_eq!(
+        applied_in(&recovery.join("waveflow.db")).await,
+        behind,
+        "the recovery copy was taken after the schema had already moved"
+    );
+    assert_eq!(
+        applied_in(&config.database_path).await as usize,
+        total,
+        "the rotation left migrations unapplied"
+    );
+
+    // And the pair it leaves behind is one the server opens.
+    waveflow_server::initialize(&config)
+        .await
+        .expect("the rotated pair must boot");
+}
+
+/// A database at the newest released schema, bound to a key on disk, as an
+/// installation that is about to upgrade has it. Answers the key and how many
+/// migrations the database has run.
+///
+/// `extra` runs on the database before it is closed, for a test that needs it
+/// shaped some further way.
+async fn an_installation_behind(config: &Config, extra: Option<&'static str>) -> ([u8; 32], i64) {
+    let (tag, baseline) = RELEASED_SCHEMAS[RELEASED_SCHEMAS.len() - 1];
+    let database = Database::open(config).await.expect("open the database");
+    let mut connection = database.pool().acquire().await.expect("connection");
+    connection
+        .ensure_migrations_table(&MIGRATOR.table_name)
+        .await
+        .expect("migrations table");
+    for migration in MIGRATOR
+        .iter()
+        .filter(|migration| migration.version <= baseline)
+    {
+        connection
+            .apply(&MIGRATOR.table_name, migration)
+            .await
+            .unwrap_or_else(|error| {
+                panic!("{tag}: migration {} failed: {error}", migration.version)
+            });
+    }
+    seed_an_installation(&mut connection).await;
+    // Drawn, not written down: the test needs the two halves to agree, and a
+    // key in the source would be a key in the source.
+    let key: [u8; 32] = [
+        *uuid::Uuid::new_v4().as_bytes(),
+        *uuid::Uuid::new_v4().as_bytes(),
+    ]
+    .concat()
+    .try_into()
+    .unwrap();
+    std::fs::write(&config.instance_key_path, key).expect("the key file");
+    sqlx::query(
+        "INSERT INTO instance_metadata (singleton, key_fingerprint, created_at) VALUES (1, ?, 0)",
+    )
+    .bind(waveflow_server::auth::security::bytes_hash(&key).as_slice())
+    .execute(&mut *connection)
+    .await
+    .expect("bind the key");
+    if let Some(statement) = extra {
+        sqlx::query(statement)
+            .execute(&mut *connection)
+            .await
+            .unwrap_or_else(|error| panic!("`{statement}` failed: {error}"));
+    }
+    let behind = count(&mut connection, "SELECT COUNT(*) FROM _sqlx_migrations").await;
+    assert!(
+        (behind as usize) < MIGRATOR.iter().count(),
+        "{tag}: the baseline applied every migration, so nothing is behind"
+    );
+    drop(connection);
+    database.pool().close().await;
+    (key, behind)
+}
+
+/// The copy directories a boot made before migrating, newest first.
+fn pre_migration_copies(config: &Config) -> Vec<std::path::PathBuf> {
+    let mut copies: Vec<(u64, std::path::PathBuf)> = std::fs::read_dir(&config.data_dir)
+        .unwrap()
+        .map(|entry| entry.unwrap().path())
+        .filter_map(|path| {
+            let taken_at = path
+                .file_name()?
+                .to_str()?
+                .strip_prefix(waveflow_server::storage::migration_backup::PREFIX)?
+                .parse::<u64>()
+                .ok()?;
+            Some((taken_at, path))
+        })
+        .collect();
+    copies.sort_by_key(|(taken_at, _)| std::cmp::Reverse(*taken_at));
+    copies.into_iter().map(|(_, path)| path).collect()
+}
+
+/// RFC-019 decision 3: an upgrade copies the database **as it found it**, with
+/// the key it was bound to, keeps the newest copies only, touches nothing it
+/// did not make — and a boot with nothing to apply copies nothing.
+#[tokio::test]
+async fn an_upgrade_copies_the_database_and_its_key_before_migrating() {
+    let temp = tempfile::tempdir().expect("temporary directory");
+    let config = Config::for_data_dir(temp.path().join("data"));
+    let (key, behind) = an_installation_behind(&config, None).await;
+    // Four older copies, and two directories that only look like one.
+    for stale in ["1", "2", "3", "4"] {
+        std::fs::create_dir_all(config.data_dir.join(format!(
+            "{}{stale}",
+            waveflow_server::storage::migration_backup::PREFIX
+        )))
+        .unwrap();
+    }
+    let lookalike = config.data_dir.join(format!(
+        "{}notes",
+        waveflow_server::storage::migration_backup::PREFIX
+    ));
+    let restore = config.data_dir.join("pre-restore-5");
+    std::fs::create_dir_all(&lookalike).unwrap();
+    std::fs::create_dir_all(&restore).unwrap();
+
+    let state = waveflow_server::initialize(&config)
+        .await
+        .expect("an installation behind boots");
+    state.db.pool().close().await;
+    drop(state);
+
+    let copies = pre_migration_copies(&config);
+    assert_eq!(
+        copies.len(),
+        config.migration_backups,
+        "kept {copies:?}, expected the newest {}",
+        config.migration_backups
+    );
+    let newest = &copies[0];
+    assert_eq!(
+        applied_in(&newest.join("waveflow.db")).await,
+        behind,
+        "the copy was taken after the schema had moved"
+    );
+    assert_eq!(
+        std::fs::read(newest.join("instance.key")).unwrap(),
+        key,
+        "the copy does not carry the key its database is bound to"
+    );
+    assert!(
+        Database::check_file_instance_key(
+            &newest.join("waveflow.db"),
+            &waveflow_server::auth::security::bytes_hash(&key)
+        )
+        .await
+        .unwrap(),
+        "the copied pair does not agree"
+    );
+    let prefix = waveflow_server::storage::migration_backup::PREFIX;
+    for gone in ["1", "2"] {
+        assert!(!config.data_dir.join(format!("{prefix}{gone}")).exists());
+    }
+    for kept in ["3", "4"] {
+        assert!(config.data_dir.join(format!("{prefix}{kept}")).exists());
+    }
+    assert!(
+        lookalike.exists(),
+        "pruning deleted a directory it did not make"
+    );
+    assert!(
+        restore.exists(),
+        "pruning deleted a restore's recovery copy"
+    );
+
+    // Nothing left to apply: nothing copied.
+    waveflow_server::initialize(&config)
+        .await
+        .expect("an upgraded installation boots");
+    assert_eq!(pre_migration_copies(&config), copies);
+}
+
+/// A migration that fails says where the copy is, and the copy is whole.
+#[tokio::test]
+async fn a_failed_upgrade_names_the_copy_it_can_be_restored_from() {
+    let temp = tempfile::tempdir().expect("temporary directory");
+    let config = Config::for_data_dir(temp.path().join("data"));
+    // A table a later migration creates, already there: that migration fails.
+    let (key, behind) = an_installation_behind(
+        &config,
+        Some("CREATE TABLE radio_station (id TEXT PRIMARY KEY)"),
+    )
+    .await;
+
+    let error = match waveflow_server::initialize(&config).await {
+        Ok(_) => panic!("a migration that cannot apply booted"),
+        Err(error) => format!("{error:#}"),
+    };
+    let copies = pre_migration_copies(&config);
+    assert_eq!(copies.len(), 1, "{copies:?}");
+    let copy = copies[0].display().to_string();
+    assert!(
+        error.contains(&format!("database restore --input {copy}")),
+        "the failure does not say how to go back: {error}"
+    );
+    assert!(error.contains("v2 migration failed"), "{error}");
+    assert_eq!(applied_in(&copies[0].join("waveflow.db")).await, behind);
+    assert_eq!(std::fs::read(copies[0].join("instance.key")).unwrap(), key);
+}
+
+/// A copy that cannot be made stops the boot before anything is applied, and
+/// leaves no half-made directory for pruning to count as a whole one.
+#[tokio::test]
+async fn a_copy_that_cannot_be_made_leaves_nothing_behind() {
+    let temp = tempfile::tempdir().expect("temporary directory");
+    let mut config = Config::for_data_dir(temp.path().join("data"));
+    let (_, behind) = an_installation_behind(&config, None).await;
+    // The database copies; the key cannot, because a directory stands where
+    // the key should be.
+    config.instance_key_path = config.data_dir.join("key-is-a-directory");
+    std::fs::create_dir_all(&config.instance_key_path).unwrap();
+
+    let error = match waveflow_server::initialize(&config).await {
+        Ok(_) => panic!("a boot without its copy went ahead"),
+        Err(error) => format!("{error:#}"),
+    };
+    assert!(error.contains("could not copy the instance key"), "{error}");
+    assert!(
+        pre_migration_copies(&config).is_empty(),
+        "an incomplete copy was left behind: {:?}",
+        pre_migration_copies(&config)
+    );
+    assert_eq!(
+        applied_in(&config.database_path).await,
+        behind,
+        "a migration ran without its copy"
+    );
+}
+
+/// A database bound to a key is copied only with that key: missing or wrong,
+/// the pair would be no way back, so the boot refuses before migrating — and
+/// before minting a key of its own beside a database that has one. A
+/// database never bound to a key is still copied alone; the released-schema
+/// test in `upgrades.rs` stands on that.
+#[tokio::test]
+async fn a_bound_database_is_not_copied_without_its_own_key() {
+    for (case, damage) in [
+        ("missing", None),
+        ("wrong", Some(*uuid::Uuid::new_v4().as_bytes())),
+    ] {
+        let temp = tempfile::tempdir().expect("temporary directory");
+        let config = Config::for_data_dir(temp.path().join("data"));
+        let (_, behind) = an_installation_behind(&config, None).await;
+        match damage {
+            None => std::fs::remove_file(&config.instance_key_path).unwrap(),
+            Some(other) => {
+                std::fs::write(&config.instance_key_path, [other, other].concat()).unwrap()
+            }
+        }
+
+        let error = match waveflow_server::initialize(&config).await {
+            Ok(_) => panic!("{case}: a boot with no matching key went ahead"),
+            Err(error) => format!("{error:#}"),
+        };
+        assert!(
+            error.contains("nothing has been applied"),
+            "{case}: {error}"
+        );
+        assert!(
+            pre_migration_copies(&config).is_empty(),
+            "{case}: a pair restore would refuse was kept: {:?}",
+            pre_migration_copies(&config)
+        );
+        assert_eq!(
+            applied_in(&config.database_path).await,
+            behind,
+            "{case}: migrated a database whose key is not there"
+        );
+        if damage.is_none() {
+            assert!(error.contains("key adopt"), "{error}");
+            assert!(
+                !config.instance_key_path.exists(),
+                "a key was minted beside a database bound to another"
+            );
+        }
+    }
+}
+
+/// The copy a boot has just made is kept even when its name sorts below the
+/// others — a clock that went back, or copies dated in the future.
+#[tokio::test]
+async fn the_copy_just_made_survives_a_clock_that_went_back() {
+    let temp = tempfile::tempdir().expect("temporary directory");
+    let config = Config::for_data_dir(temp.path().join("data"));
+    let (_, behind) = an_installation_behind(&config, None).await;
+    let prefix = waveflow_server::storage::migration_backup::PREFIX;
+    // Three copies dated long after anything this boot can read off its clock.
+    let future = ["99999999999991", "99999999999992", "99999999999993"];
+    for stamp in future {
+        std::fs::create_dir_all(config.data_dir.join(format!("{prefix}{stamp}"))).unwrap();
+    }
+
+    let state = waveflow_server::initialize(&config)
+        .await
+        .expect("an installation behind boots");
+    state.db.pool().close().await;
+    drop(state);
+
+    let copies = pre_migration_copies(&config);
+    assert_eq!(copies.len(), config.migration_backups, "{copies:?}");
+    let made = copies
+        .iter()
+        .find(|copy| copy.join("waveflow.db").exists())
+        .unwrap_or_else(|| panic!("the copy this boot made was deleted: {copies:?}"));
+    assert_eq!(applied_in(&made.join("waveflow.db")).await, behind);
+    // The room it needed came from the oldest of the others.
+    assert!(!config
+        .data_dir
+        .join(format!("{prefix}{}", future[0]))
+        .exists());
+    for kept in &future[1..] {
+        assert!(config.data_dir.join(format!("{prefix}{kept}")).exists());
+    }
+}
+
+/// Zero copies is a setting: an operator with backups of their own upgrades
+/// without one.
+#[tokio::test]
+async fn no_copy_is_taken_when_the_operator_set_none() {
+    let temp = tempfile::tempdir().expect("temporary directory");
+    let mut config = Config::for_data_dir(temp.path().join("data"));
+    config.migration_backups = 0;
+    an_installation_behind(&config, None).await;
+    waveflow_server::initialize(&config)
+        .await
+        .expect("an installation behind boots");
+    assert!(pre_migration_copies(&config).is_empty());
+
+    // And a fresh install, with copies on, has nothing to copy.
+    let fresh = tempfile::tempdir().expect("temporary directory");
+    let config = Config::for_data_dir(fresh.path().join("data"));
+    waveflow_server::initialize(&config)
+        .await
+        .expect("a fresh install boots");
+    assert!(pre_migration_copies(&config).is_empty());
+}
+
+/// How many migrations a database on disk has run.
+///
+/// Opened alone and closed again between readings: the key commands take the
+/// file exclusively, and a connection this test forgot to close would make the
+/// next one fail for a reason that has nothing to do with what it asserts.
+async fn applied_in(path: &std::path::Path) -> i64 {
+    let mut connection = Database::open_alone(path, std::time::Duration::from_secs(5))
+        .await
+        .unwrap_or_else(|error| panic!("{}: {error}", path.display()));
+    let applied = count(&mut connection, "SELECT COUNT(*) FROM _sqlx_migrations").await;
+    connection.close().await.expect("close");
+    applied
+}
diff --git a/tests/migrations/main.rs b/tests/migrations/main.rs
new file mode 100644
index 00000000..0d358f26
--- /dev/null
+++ b/tests/migrations/main.rs
@@ -0,0 +1,272 @@
+//! Upgrades — the one path every other target skips.
+//!
+//! `test_app()` builds its database from nothing, so the whole suite proves
+//! the schema can be **created** and never that it can be **upgraded** (#223).
+//! An upgrade is what every existing installation does, and it is the failure
+//! that costs most: migrations are embedded and checksummed, so one that goes
+//! wrong leaves the server refusing to start — found by somebody who has just
+//! updated, on a database that is already theirs.
+//!
+//! The fixture is built by code rather than checked in as a database file. A
+//! file is a snapshot of a real installation and catches what nobody thought
+//! to write; code is honest about what it exercises, survives a re-run, and
+//! carries no binary blob into the repository. The second was chosen for the
+//! last reason as much as the first — a blob nobody can read is a fixture
+//! nobody can correct.
+//!
+//! Not the first migration test: `a_populated_database_survives_a_table_rebuild`
+//! in `src/storage/database/tests.rs` already applies a prefix and migrates from there. It is
+//! pinned to **one** boundary — the participants rebuild it was written for —
+//! and asserts raw counts. This asks the general question instead, from every
+//! schema a tag actually shipped, and answers it through the services rather
+//! than through `SELECT COUNT(*)`: a row that survives a migration and is no
+//! longer reachable by a query has not survived in any sense a user would
+//! recognise.
+
+use sqlx::migrate::Migrate;
+use sqlx::Connection;
+use sqlx::SqliteConnection;
+use waveflow_server::services::AlbumListQuery;
+use waveflow_server::services::BrowsePage;
+use waveflow_server::storage::database::Database;
+use waveflow_server::storage::database::MIGRATOR;
+use waveflow_server::Config;
+
+/// The schema each released tag left on disk, named by its last migration.
+///
+/// **Add a line when a tag ships, and never edit one.** These are the states
+/// real databases are sitting in: a released schema stops being a hypothesis
+/// the moment somebody installs it. Both were measured with
+/// `git ls-tree --name-only <tag> migrations-v2/`, not read off the changelog,
+/// because the changelog records what was written and the tree records what
+/// shipped.
+///
+/// Remembering was the whole mechanism, so
+/// `the_version_being_shipped_has_its_schema_recorded` now holds it: the PR
+/// that bumps `version` in `Cargo.toml` for a release fails until it adds that
+/// tag here, with the newest migration of that moment as its baseline.
+const RELEASED_SCHEMAS: [(&str, i64); 2] = [
+    ("v2.0.0-beta.0", 20_260_823_020_000),
+    ("v2.0.0-beta.1", 20_260_914_030_000),
+];
+
+/// The identifiers the fixture below writes and the assertions read back.
+///
+/// UUIDs because every real row's is: a fixture shaped unlike production is
+/// one a production-shaped defect can pass through.
+const ACCOUNT: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a1";
+
+const LIBRARY: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a2";
+
+const ARTIST_LEAD: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a3";
+
+const ARTIST_GUEST: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a4";
+
+const ALBUM: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a5";
+
+const TRACK: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a6";
+
+const GENRE: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a7";
+
+const PLAYLIST: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a8";
+
+const SCAN: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a9";
+
+/// One account, one library, and a catalogue with every shape a later
+/// migration might have to carry.
+///
+/// Written against the **oldest** schema in [`RELEASED_SCHEMAS`], which every
+/// later one is a superset of, so one fixture serves them all. Every column is
+/// named explicitly for the same reason: a migration that adds one must not
+/// silently change what this inserts.
+///
+/// What it holds is chosen, not arbitrary. An album credited to **two**
+/// artists is here because a credit model that only ever saw one was how the
+/// participants rebuild shipped; a genre, a playlist, a favourite and a play
+/// event are the user data that no rescan can reconstruct, which is what makes
+/// losing it unrecoverable rather than merely slow.
+async fn seed_an_installation(connection: &mut SqliteConnection) {
+    // `password_hash` is a placeholder written straight into the row rather
+    // than derived: nothing here ever authenticates, and putting a literal
+    // through Argon2 is what makes CodeQL report a hard-coded cryptographic
+    // value on a test that has no credentials in it.
+    for (statement, binds) in [
+        (
+            "INSERT INTO account (id, username, password_hash, role, created_at, updated_at) \
+               VALUES (?, 'upgrade-owner', 'placeholder', 'admin', 1000, 1000)",
+            vec![ACCOUNT],
+        ),
+        (
+            "INSERT INTO library (id, owner_user_id, name, root_path, visibility, \
+                                  created_at, updated_at) \
+               VALUES (?, ?, 'Upgraded library', '/music/upgraded', 'private', 1000, 1000)",
+            vec![LIBRARY, ACCOUNT],
+        ),
+        (
+            "INSERT INTO library_member (library_id, user_id, role, created_at) \
+               VALUES (?, ?, 'owner', 1000)",
+            vec![LIBRARY, ACCOUNT],
+        ),
+        (
+            "INSERT INTO artist (id, library_id, name, canonical_name, created_at, updated_at) \
+               VALUES (?, ?, 'Nova Kern', 'nova kern', 1000, 1000)",
+            vec![ARTIST_LEAD, LIBRARY],
+        ),
+        (
+            "INSERT INTO artist (id, library_id, name, canonical_name, created_at, updated_at) \
+               VALUES (?, ?, 'Vale Ortiz', 'vale ortiz', 1000, 1000)",
+            vec![ARTIST_GUEST, LIBRARY],
+        ),
+        (
+            "INSERT INTO artist_fts (artist_id, library_id, name, sort_name) \
+               VALUES (?, ?, 'Nova Kern', '')",
+            vec![ARTIST_LEAD, LIBRARY],
+        ),
+        (
+            "INSERT INTO artist_fts (artist_id, library_id, name, sort_name) \
+               VALUES (?, ?, 'Vale Ortiz', '')",
+            vec![ARTIST_GUEST, LIBRARY],
+        ),
+        (
+            "INSERT INTO album (id, library_id, title, canonical_title, album_artist_id, \
+                                album_artist_name, year, created_at, updated_at) \
+               VALUES (?, ?, 'Convergence', 'convergence', ?, 'Nova Kern', 2026, 1000, 1000)",
+            vec![ALBUM, LIBRARY, ARTIST_LEAD],
+        ),
+        (
+            "INSERT INTO album_participant (album_id, artist_id, library_id, role, position) \
+               VALUES (?, ?, ?, 'albumartist', 0)",
+            vec![ALBUM, ARTIST_LEAD, LIBRARY],
+        ),
+        (
+            "INSERT INTO album_participant (album_id, artist_id, library_id, role, position) \
+               VALUES (?, ?, ?, 'artist', 0)",
+            vec![ALBUM, ARTIST_LEAD, LIBRARY],
+        ),
+        (
+            "INSERT INTO album_participant (album_id, artist_id, library_id, role, position) \
+               VALUES (?, ?, ?, 'artist', 1)",
+            vec![ALBUM, ARTIST_GUEST, LIBRARY],
+        ),
+        (
+            "INSERT INTO genre (id, library_id, name, canonical_name, created_at) \
+               VALUES (?, ?, 'Ambient', 'ambient', 1000)",
+            vec![GENRE, LIBRARY],
+        ),
+        (
+            // The scan that last saw the track, with an error of its own: the
+            // two rows that point at `scan_job`, which RFC-021 rebuilds.
+            "INSERT INTO scan_job (id, library_id, requested_by, trigger, status, total_files, \
+                                   processed_files, added, errors, created_at, started_at, \
+                                   completed_at) \
+               VALUES (?, ?, ?, 'boot', 'completed', 1, 1, 1, 1, 1000, 1000, 1000)",
+            vec![SCAN, LIBRARY, ACCOUNT],
+        ),
+        (
+            "INSERT INTO scan_error (scan_id, relative_path, message, created_at) \
+               VALUES (?, 'convergence/02.flac', 'unreadable', 1000)",
+            vec![SCAN],
+        ),
+        (
+            "INSERT INTO track (id, library_id, album_id, relative_path, file_size, \
+                                file_modified_at, quick_hash, full_hash, title, album_title, \
+                                artist_display, genre_display, year, track_number, disc_number, \
+                                duration_ms, is_available, last_seen_scan_id, created_at, \
+                                updated_at) \
+               VALUES (?, ?, ?, 'convergence/01.flac', 4096, 1000, ?, ?, 'Zenith', \
+                       'Convergence', 'Nova Kern', 'Ambient', 2026, 1, 1, 210000, 1, ?, 1000, \
+                       1000)",
+            vec![
+                TRACK,
+                LIBRARY,
+                ALBUM,
+                &"1".repeat(64),
+                &"2".repeat(64),
+                SCAN,
+            ],
+        ),
+        (
+            "INSERT INTO track_participant (track_id, artist_id, library_id, role, sub_role, \
+                                            position) \
+               VALUES (?, ?, ?, 'artist', '', 0)",
+            vec![TRACK, ARTIST_LEAD, LIBRARY],
+        ),
+        (
+            "INSERT INTO track_participant (track_id, artist_id, library_id, role, sub_role, \
+                                            position) \
+               VALUES (?, ?, ?, 'artist', '', 1)",
+            vec![TRACK, ARTIST_GUEST, LIBRARY],
+        ),
+        (
+            // `albumartist`, not only `artist`: the scanner copies every
+            // track role onto the album, and the services that answer an
+            // album's credits select this one alone. Seeding `artist` by
+            // itself left `albums[0].artists` empty, so an upgrade losing
+            // every album credit would have passed (constat de revue,
+            // pris).
+            "INSERT INTO track_participant (track_id, artist_id, library_id, role, sub_role, \
+                                            position) \
+               VALUES (?, ?, ?, 'albumartist', '', 0)",
+            vec![TRACK, ARTIST_LEAD, LIBRARY],
+        ),
+        (
+            "INSERT INTO track_genre (track_id, genre_id, library_id) VALUES (?, ?, ?)",
+            vec![TRACK, GENRE, LIBRARY],
+        ),
+        (
+            "INSERT INTO track_fts (track_id, library_id, title, album, artists, genres) \
+               VALUES (?, ?, 'Zenith', 'Convergence', 'Nova Kern Vale Ortiz', 'Ambient')",
+            vec![TRACK, LIBRARY],
+        ),
+        (
+            "INSERT INTO artist_role_stats (artist_id, library_id, role, album_count, song_count) \
+               VALUES (?, ?, 'artist', 1, 1)",
+            vec![ARTIST_LEAD, LIBRARY],
+        ),
+        (
+            "INSERT INTO artist_role_stats (artist_id, library_id, role, album_count, song_count) \
+               VALUES (?, ?, 'artist', 1, 1)",
+            vec![ARTIST_GUEST, LIBRARY],
+        ),
+        (
+            "INSERT INTO playlist (id, owner_user_id, name, comment, public, created_at, \
+                                   updated_at) \
+               VALUES (?, ?, 'Carried over', 'written before the upgrade', 0, 1000, 1000)",
+            vec![PLAYLIST, ACCOUNT],
+        ),
+        (
+            "INSERT INTO playlist_track (playlist_id, track_id, position, added_at) \
+               VALUES (?, ?, 0, 1000)",
+            vec![PLAYLIST, TRACK],
+        ),
+        (
+            "INSERT INTO user_star (user_id, entity_type, entity_id, starred_at) \
+               VALUES (?, 'album', ?, 1000)",
+            vec![ACCOUNT, ALBUM],
+        ),
+        (
+            "INSERT INTO play_event (user_id, track_id, submission, played_at) \
+               VALUES (?, ?, 1, 1000)",
+            vec![ACCOUNT, TRACK],
+        ),
+    ] {
+        let mut query = sqlx::query(statement);
+        for bind in binds {
+            query = query.bind(bind.to_owned());
+        }
+        query
+            .execute(&mut *connection)
+            .await
+            .unwrap_or_else(|error| panic!("seeding `{statement}` failed: {error}"));
+    }
+}
+
+async fn count(connection: &mut SqliteConnection, query: &'static str) -> i64 {
+    sqlx::query_scalar(query)
+        .fetch_one(&mut *connection)
+        .await
+        .unwrap_or_else(|error| panic!("`{query}` failed: {error}"))
+}
+
+mod copies;
+mod upgrades;
diff --git a/tests/migrations/upgrades.rs b/tests/migrations/upgrades.rs
new file mode 100644
index 00000000..62fc7a02
--- /dev/null
+++ b/tests/migrations/upgrades.rs
@@ -0,0 +1,400 @@
+//! Every released schema upgrades with the rows it was holding, and the
+//! rebuilt lists keep their order.
+
+use super::*;
+
+/// The crate's version is the tag it ships as, so it must name a line of
+/// `RELEASED_SCHEMAS`, in `main.rs`.
+///
+/// A release is cut by a PR that bumps `version` and is then tagged, and the
+/// version stays put until the next one. So this holds between releases, and
+/// fails exactly on the bump that forgot the schema — before the tag exists,
+/// which is the only moment the baseline is still the newest migration and
+/// needs no archaeology to find.
+#[test]
+fn the_version_being_shipped_has_its_schema_recorded() {
+    let tag = concat!("v", env!("CARGO_PKG_VERSION"));
+    assert!(
+        RELEASED_SCHEMAS
+            .iter()
+            .any(|(released, _)| *released == tag),
+        "Cargo.toml is at {tag}, and RELEASED_SCHEMAS has no line for it: add \
+         (\"{tag}\", <version of the newest file under migrations-v2/>)"
+    );
+}
+
+#[tokio::test]
+async fn every_released_schema_upgrades_with_the_rows_it_was_holding() {
+    let total = MIGRATOR.iter().count();
+
+    for (tag, baseline) in RELEASED_SCHEMAS {
+        let temp = tempfile::tempdir().expect("temporary directory");
+        let config = Config::for_data_dir(temp.path().join("data"));
+
+        // Step one: a database at the released schema, holding rows.
+        let database = Database::open(&config).await.expect("open the database");
+        let mut connection = database.pool().acquire().await.expect("connection");
+        connection
+            .ensure_migrations_table(&MIGRATOR.table_name)
+            .await
+            .expect("migrations table");
+        // A baseline that names no migration is a typo, and a typo here is
+        // silent: the filter below would still apply *some* prefix, and every
+        // assertion would then hold about a schema no tag ever shipped
+        // (constat de revue, pris).
+        assert!(
+            MIGRATOR
+                .iter()
+                .any(|migration| migration.version == baseline),
+            "{tag}: no migration has version {baseline}"
+        );
+        for migration in MIGRATOR
+            .iter()
+            .filter(|migration| migration.version <= baseline)
+        {
+            connection
+                .apply(&MIGRATOR.table_name, migration)
+                .await
+                .unwrap_or_else(|error| {
+                    panic!("{tag}: migration {} failed: {error}", migration.version)
+                });
+        }
+        seed_an_installation(&mut connection).await;
+
+        // **This is what keeps the test from being a fresh-install test in
+        // disguise.** If the prefix silently applied everything, the rows
+        // above would have been written into today's schema and the upgrade
+        // below would have nothing left to do — green, on the right lines, and
+        // proving none of what it claims.
+        let applied_before = count(&mut connection, "SELECT COUNT(*) FROM _sqlx_migrations").await;
+        assert!(
+            (applied_before as usize) < total,
+            "{tag}: the baseline applied all {total} migrations, so nothing is being upgraded"
+        );
+        drop(connection);
+        database.pool().close().await;
+        drop(database);
+
+        // Step two: the upgrade, through the boot path rather than a bare
+        // `migrate()` call — an installation that updates runs all of it, and
+        // the key binding and identity reconciliation read the same rows.
+        let state = waveflow_server::initialize(&config)
+            .await
+            .unwrap_or_else(|error| panic!("{tag}: a populated database refused to boot: {error}"));
+
+        let mut connection = state.db.pool().acquire().await.expect("connection");
+        let applied_after = count(&mut connection, "SELECT COUNT(*) FROM _sqlx_migrations").await;
+        assert_eq!(
+            applied_after as usize, total,
+            "{tag}: the upgrade left migrations unapplied"
+        );
+
+        // Step three: the rows are still there — and still *mean* something.
+        // A count proves the statements ran; reading them back through the
+        // services proves the upgraded schema is the one the server queries.
+        let violations = sqlx::query("PRAGMA foreign_key_check")
+            .fetch_all(&mut *connection)
+            .await
+            .expect("foreign key check");
+        assert!(
+            violations.is_empty(),
+            "{tag}: the upgrade left {} broken reference(s)",
+            violations.len()
+        );
+        drop(connection);
+
+        let account: uuid::Uuid = ACCOUNT.parse().expect("account id");
+        let album: uuid::Uuid = ALBUM.parse().expect("album id");
+        let track: uuid::Uuid = TRACK.parse().expect("track id");
+
+        let albums = state
+            .services
+            .list_albums(account, &AlbumListQuery::default())
+            .await
+            .expect("list albums");
+        assert_eq!(albums.len(), 1, "{tag}: the album did not survive");
+        assert_eq!(albums[0].title, "Convergence", "{tag}");
+        assert_eq!(
+            albums[0]
+                .artists
+                .iter()
+                .map(|artist| artist.name.as_str())
+                .collect::<Vec<_>>(),
+            vec!["Nova Kern"],
+            "{tag}: the album credit did not survive the upgrade"
+        );
+
+        let found = state
+            .services
+            .catalog_search(
+                account,
+                &[],
+                "Zenith",
+                BrowsePage::default(),
+                BrowsePage::default(),
+                BrowsePage::default(),
+            )
+            .await
+            .expect("search");
+        assert_eq!(
+            found.songs.len(),
+            1,
+            "{tag}: the search index did not come through the upgrade"
+        );
+
+        let playlists = state.services.playlists(account).await.expect("playlists");
+        assert_eq!(playlists.len(), 1, "{tag}: the playlist did not survive");
+        assert_eq!(playlists[0].name, "Carried over", "{tag}");
+
+        // The three relations the fixture carries that nothing read back
+        // until now (constat de revue, pris). A seeded row no assertion reads
+        // is how a fixture comes to claim more than it proves — and the
+        // second credit is the one that matters most here, because a credit
+        // model that could only ever see the first is exactly what the
+        // participants rebuild replaced.
+        let playlist = state
+            .services
+            .playlist(account, PLAYLIST.parse().expect("playlist id"))
+            .await
+            .expect("playlist");
+        assert_eq!(
+            playlist
+                .songs
+                .iter()
+                .map(|song| song.id)
+                .collect::<Vec<_>>(),
+            vec![track],
+            "{tag}: the playlist lost the track it held"
+        );
+        assert_eq!(
+            playlist.songs[0]
+                .artists
+                .iter()
+                .map(|artist| artist.name.as_str())
+                .collect::<Vec<_>>(),
+            vec!["Nova Kern", "Vale Ortiz"],
+            "{tag}: a credit did not survive the upgrade"
+        );
+        assert_eq!(
+            playlist.songs[0].genres,
+            vec!["Ambient".to_owned()],
+            "{tag}: the genre relation did not survive the upgrade"
+        );
+
+        let starred = state.services.starred(account, &[]).await.expect("starred");
+        assert_eq!(
+            starred
+                .albums
+                .iter()
+                .map(|item| item.id)
+                .collect::<Vec<_>>(),
+            vec![album],
+            "{tag}: the favourite did not survive"
+        );
+
+        // Listening history is the one thing a rescan cannot rebuild, and the
+        // only reader that proves the rows are still joinable to a track.
+        let top = state
+            .services
+            .artist_top_songs_by_name(account, "Nova Kern", 10)
+            .await
+            .expect("top songs");
+        assert_eq!(
+            top.len(),
+            1,
+            "{tag}: the play history did not survive the upgrade"
+        );
+        assert_eq!(top[0].title, "Zenith", "{tag}");
+
+        // The scan history, through the table RFC-021 rebuilt to admit two
+        // more triggers: the job, its error, and the track that names it as
+        // the scan that last saw it. A rebuild run with foreign keys on would
+        // have cascaded the error away and nulled the track's reference — and
+        // a null there makes the next scan treat the track as never seen.
+        let scan: uuid::Uuid = SCAN.parse().expect("scan id");
+        let job = state
+            .db
+            .scan_job(scan)
+            .await
+            .expect("read the job")
+            .unwrap_or_else(|| panic!("{tag}: the scan history did not survive"));
+        assert_eq!(
+            (job.status.as_str(), job.added, job.errors),
+            ("completed", 1, 1),
+            "{tag}"
+        );
+        assert_eq!((job.excluded, job.skipped_links), (0, 0), "{tag}");
+        let mut connection = state.db.pool().acquire().await.expect("connection");
+        assert_eq!(
+            count(
+                &mut connection,
+                "SELECT COUNT(*) FROM scan_error WHERE scan_id = '6f1d1b6e-0f1a-4a3d-9c21-0000000000a9'"
+            )
+            .await,
+            1,
+            "{tag}: the scan's error did not survive"
+        );
+        assert_eq!(
+            count(
+                &mut connection,
+                "SELECT COUNT(*) FROM track WHERE last_seen_scan_id = '6f1d1b6e-0f1a-4a3d-9c21-0000000000a9'"
+            )
+            .await,
+            1,
+            "{tag}: the track lost the scan that last saw it"
+        );
+    }
+}
+
+const TRACK_TWO: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000a9";
+
+const SHARE: &str = "6f1d1b6e-0f1a-4a3d-9c21-0000000000aa";
+
+/// The two lists RFC-020 rebuilt come through with every row, in its order,
+/// and take a repeat afterwards.
+///
+/// `playlist_track` and `share_track` were keyed on `(list, track)` and are
+/// keyed on `(list, position)` since `20261026000000`. A rebuild is a copy into
+/// a new table, and the failure it invites is quiet: rows dropped by a
+/// mistyped column, or positions renumbered so the order changes. So the
+/// fixture stores its two tracks **against** their insertion order — the
+/// second track first — which a rebuild that numbered rows as it read them
+/// would get wrong, and reads them back through the services. Then it adds a
+/// copy of a track the playlist already holds, which is what the new key is
+/// for and what the old one refused.
+#[tokio::test]
+async fn the_rebuilt_lists_keep_their_rows_in_order_and_then_take_a_repeat() {
+    for (tag, baseline) in RELEASED_SCHEMAS {
+        let temp = tempfile::tempdir().expect("temporary directory");
+        let config = Config::for_data_dir(temp.path().join("data"));
+        let database = Database::open(&config).await.expect("open the database");
+        let mut connection = database.pool().acquire().await.expect("connection");
+        connection
+            .ensure_migrations_table(&MIGRATOR.table_name)
+            .await
+            .expect("migrations table");
+        for migration in MIGRATOR
+            .iter()
+            .filter(|migration| migration.version <= baseline)
+        {
+            connection
+                .apply(&MIGRATOR.table_name, migration)
+                .await
+                .unwrap_or_else(|error| {
+                    panic!("{tag}: migration {} failed: {error}", migration.version)
+                });
+        }
+        seed_an_installation(&mut connection).await;
+        for (statement, binds) in [
+            (
+                "INSERT INTO track (id, library_id, album_id, relative_path, file_size, \
+                                    file_modified_at, quick_hash, full_hash, title, album_title, \
+                                    artist_display, duration_ms, is_available, created_at, \
+                                    updated_at) \
+                   VALUES (?, ?, ?, 'convergence/02.flac', 4096, 1000, ?, ?, 'Nadir', \
+                           'Convergence', 'Nova Kern', 180000, 1, 1000, 1000)",
+                vec![TRACK_TWO, LIBRARY, ALBUM, &"5".repeat(64), &"6".repeat(64)],
+            ),
+            // The fixture's playlist already holds TRACK at position 0; it is
+            // moved behind the new one, so the stored order is not the order
+            // the rows were written in.
+            (
+                "UPDATE playlist_track SET position=1 WHERE playlist_id=? AND track_id=?",
+                vec![PLAYLIST, TRACK],
+            ),
+            (
+                "INSERT INTO playlist_track (playlist_id, track_id, position, added_at) \
+                   VALUES (?, ?, 0, 1000)",
+                vec![PLAYLIST, TRACK_TWO],
+            ),
+            (
+                "INSERT INTO share (id, owner_user_id, token_hash, description, created_at, \
+                                    updated_at, visit_count) \
+                   VALUES (?, ?, randomblob(32), 'Carried share', 1000, 1000, 7)",
+                vec![SHARE, ACCOUNT],
+            ),
+            (
+                "INSERT INTO share_track (share_id, track_id, position) VALUES (?, ?, 1)",
+                vec![SHARE, TRACK],
+            ),
+            (
+                "INSERT INTO share_track (share_id, track_id, position) VALUES (?, ?, 0)",
+                vec![SHARE, TRACK_TWO],
+            ),
+        ] {
+            let mut query = sqlx::query(statement);
+            for bind in binds {
+                query = query.bind(bind.to_owned());
+            }
+            query
+                .execute(&mut *connection)
+                .await
+                .unwrap_or_else(|error| panic!("{tag}: `{statement}` failed: {error}"));
+        }
+        drop(connection);
+        database.pool().close().await;
+        drop(database);
+
+        let state = waveflow_server::initialize(&config)
+            .await
+            .unwrap_or_else(|error| panic!("{tag}: a populated database refused to boot: {error}"));
+        let account: uuid::Uuid = ACCOUNT.parse().expect("account id");
+        let playlist_id: uuid::Uuid = PLAYLIST.parse().expect("playlist id");
+        let track: uuid::Uuid = TRACK.parse().expect("track id");
+        let track_two: uuid::Uuid = TRACK_TWO.parse().expect("track id");
+
+        let playlist = state
+            .services
+            .playlist(account, playlist_id)
+            .await
+            .expect("playlist");
+        assert_eq!(
+            playlist
+                .songs
+                .iter()
+                .map(|song| song.id)
+                .collect::<Vec<_>>(),
+            vec![track_two, track],
+            "{tag}: the playlist lost a row or its order"
+        );
+        assert_eq!(playlist.owner_username, "upgrade-owner", "{tag}");
+
+        let shares = state.services.shares(account).await.expect("shares");
+        assert_eq!(shares.len(), 1, "{tag}: the share did not survive");
+        assert_eq!(shares[0].visit_count, 7, "{tag}");
+        assert_eq!(shares[0].max_visits, None, "{tag}: an old share has no cap");
+        assert_eq!(
+            shares[0]
+                .songs
+                .iter()
+                .map(|song| song.id)
+                .collect::<Vec<_>>(),
+            vec![track_two, track],
+            "{tag}: the share lost a row or its order"
+        );
+
+        let repeated = state
+            .services
+            .update_playlist(
+                account,
+                playlist_id,
+                None,
+                None,
+                None,
+                &[track_two],
+                &[],
+                Default::default(),
+            )
+            .await
+            .unwrap_or_else(|error| panic!("{tag}: a repeat was refused: {error}"));
+        assert_eq!(
+            repeated
+                .songs
+                .iter()
+                .map(|song| song.id)
+                .collect::<Vec<_>>(),
+            vec![track_two, track, track_two],
+            "{tag}"
+        );
+    }
+}
diff --git a/tests/native_api/artists.rs b/tests/native_api/artists.rs
index 3531831c..e70e2728 100644
--- a/tests/native_api/artists.rs
+++ b/tests/native_api/artists.rs
@@ -42,7 +42,7 @@ async fn chosen_artist_images_lead_every_reader_and_outlive_the_portrait_fill()
             owner,
             library_id,
             listener,
-            waveflow_server::database::LibraryRole::Listener,
+            waveflow_server::storage::database::LibraryRole::Listener,
             now_ms(),
         )
         .await
@@ -475,7 +475,7 @@ async fn an_artist_page_groups_its_discography_and_lists_its_appearances() {
         input.track_number = Some(index as i64 + 1);
         if title == "Nine" {
             input.roles = vec![(
-                waveflow_server::tags::Role::Composer,
+                waveflow_server::library::tags::Role::Composer,
                 vec!["Disco Artist".into()],
             )];
         }
diff --git a/tests/native_api/folders.rs b/tests/native_api/folders.rs
index bfdf2976..57e2c026 100644
--- a/tests/native_api/folders.rs
+++ b/tests/native_api/folders.rs
@@ -38,7 +38,7 @@ async fn the_disk_tree_lists_one_level_of_the_indexed_paths_to_members_only() {
             owner,
             library_id,
             listener,
-            waveflow_server::database::LibraryRole::Listener,
+            waveflow_server::storage::database::LibraryRole::Listener,
             now_ms(),
         )
         .await
@@ -328,7 +328,7 @@ async fn filed_folders_sort_a_library_in_the_database_only() {
             owner,
             library,
             listener,
-            waveflow_server::database::LibraryRole::Listener,
+            waveflow_server::storage::database::LibraryRole::Listener,
             now_ms(),
         )
         .await
diff --git a/tests/native_api/libraries.rs b/tests/native_api/libraries.rs
index d18aeba7..eaae9079 100644
--- a/tests/native_api/libraries.rs
+++ b/tests/native_api/libraries.rs
@@ -223,7 +223,7 @@ async fn account_with_token(
     state
         .db
         .create_api_token(
-            waveflow_server::database::NewApiToken {
+            waveflow_server::storage::database::NewApiToken {
                 actor_id: id,
                 user_id: id,
                 name: "lifecycle",
@@ -277,7 +277,7 @@ async fn the_library_lifecycle_routes_answer_by_standing() {
             owner,
             library_id,
             listener,
-            waveflow_server::database::LibraryRole::Listener,
+            waveflow_server::storage::database::LibraryRole::Listener,
             now_ms(),
         )
         .await
@@ -481,7 +481,7 @@ async fn a_narrowed_admin_token_has_no_say_over_a_foreign_library() {
     state
         .db
         .create_api_token(
-            waveflow_server::database::NewApiToken {
+            waveflow_server::storage::database::NewApiToken {
                 actor_id: admin,
                 user_id: admin,
                 name: "write only",
diff --git a/tests/native_api/lyrics.rs b/tests/native_api/lyrics.rs
index bd44cf0c..9c05b09a 100644
--- a/tests/native_api/lyrics.rs
+++ b/tests/native_api/lyrics.rs
@@ -39,7 +39,7 @@ async fn uploaded_lyrics_lead_the_order_download_as_they_came_and_stay_off_subso
             owner,
             library_id,
             listener,
-            waveflow_server::database::LibraryRole::Listener,
+            waveflow_server::storage::database::LibraryRole::Listener,
             now_ms(),
         )
         .await
diff --git a/tests/native_api/main.rs b/tests/native_api/main.rs
index bf8f2712..53fd707b 100644
--- a/tests/native_api/main.rs
+++ b/tests/native_api/main.rs
@@ -8,16 +8,16 @@ use axum::http::Request;
 use axum::http::StatusCode;
 use futures_util::future::BoxFuture;
 use tower::ServiceExt;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::catalog::LibraryRecord;
-use waveflow_server::database::AccountRole;
-use waveflow_server::database::LibraryVisibility;
-use waveflow_server::security;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
 use waveflow_server::services::ServiceError;
 use waveflow_server::services::MAX_HISTORY_LIMIT;
 use waveflow_server::services::{
     ScrobbleEnvelope, ScrobbleProvider, ScrobbleTarget, ScrobbleVerdict,
 };
+use waveflow_server::storage::catalog::LibraryRecord;
+use waveflow_server::storage::database::AccountRole;
+use waveflow_server::storage::database::LibraryVisibility;
 
 // Not every target uses every fixture, and a shared module is not dead
 // code for being partly unused here.
diff --git a/tests/native_api/playlists.rs b/tests/native_api/playlists.rs
index 227a0762..d885a0a6 100644
--- a/tests/native_api/playlists.rs
+++ b/tests/native_api/playlists.rs
@@ -184,7 +184,7 @@ async fn a_public_playlist_is_read_by_other_accounts_through_their_own_libraries
             owner,
             shared,
             viewer,
-            waveflow_server::database::LibraryRole::Listener,
+            waveflow_server::storage::database::LibraryRole::Listener,
             now_ms(),
         )
         .await
diff --git a/tests/podcasts/covers.rs b/tests/podcasts/covers.rs
index 5fe908ab..a2a8e0b0 100644
--- a/tests/podcasts/covers.rs
+++ b/tests/podcasts/covers.rs
@@ -185,7 +185,7 @@ async fn a_cover_that_is_not_a_safe_image_stores_nothing() {
     let router = waveflow_server::app(&config, state.clone());
     let token = login_token(&router, "cover-guard", &password).await;
 
-    use waveflow_server::portrait::Refusal;
+    use waveflow_server::remote::portrait::Refusal;
     let cases = [
         ("/huge.jpg", Refusal::TooLarge, "declared over the ceiling"),
         (
@@ -225,14 +225,14 @@ async fn a_cover_that_is_not_a_safe_image_stores_nothing() {
     // And each for its own reason, asked of the fetcher itself: a refusal and
     // an unreachable host store the same nothing, and only the reason tells
     // a checked hop from one that was attempted and happened to fail.
-    let policy = waveflow_server::podcast::FetchPolicy {
-        addresses: waveflow_server::portrait::AddressPolicy::AllowLoopback,
+    let policy = waveflow_server::remote::podcast::FetchPolicy {
+        addresses: waveflow_server::remote::portrait::AddressPolicy::AllowLoopback,
         allow_http: false,
         timeout: std::time::Duration::from_secs(10),
     };
     for (cover, refusal, why) in cases {
         let url = url::Url::parse(&format!("{}{cover}", host.base)).unwrap();
-        let fetched = waveflow_server::portrait::fetch_followed(&url, policy).await;
+        let fetched = waveflow_server::remote::portrait::fetch_followed(&url, policy).await;
         assert_eq!(fetched.err(), Some(refusal), "{why}");
     }
     assert_eq!(artwork_rows(&state).await, 0);
diff --git a/tests/podcasts/main.rs b/tests/podcasts/main.rs
index c992ebe0..97c967a0 100644
--- a/tests/podcasts/main.rs
+++ b/tests/podcasts/main.rs
@@ -28,9 +28,9 @@ use axum::{
 use serde_json::json;
 use tower::ServiceExt;
 use uuid::Uuid;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::database::AccountRole;
-use waveflow_server::security;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
+use waveflow_server::storage::database::AccountRole;
 
 #[allow(dead_code)]
 #[path = "../support/mod.rs"]
diff --git a/tests/quality.rs b/tests/quality.rs
deleted file mode 100644
index c579e87e..00000000
--- a/tests/quality.rs
+++ /dev/null
@@ -1,1193 +0,0 @@
-//! The real quality of a file, measured from its audio (RFC-016).
-//!
-//! Every file here is made by FFmpeg from noise, so its spectrum is known: a
-//! full band, the wall LAME leaves at 128 kbps, the filter of a 44.1 kHz
-//! source resampled to 96 kHz, a 16-bit signal in a 24-bit container. The
-//! scanner indexes them for real, and the analysis measures them through the
-//! same FFmpeg the server runs.
-//!
-//! The accounts are rows written by hand and reach the routes through an API
-//! token, as in `tests/credits.rs`: nothing here hands a literal to a hash.
-
-#[allow(dead_code)]
-mod support;
-
-use std::path::{Path, PathBuf};
-
-use axum::body::Body;
-use axum::http::{header, Request, StatusCode};
-use http_body_util::BodyExt;
-use support::*;
-use tower::ServiceExt;
-use uuid::Uuid;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::catalog::LibraryRecord;
-use waveflow_server::database::{LibraryRole, LibraryVisibility};
-use waveflow_server::services::{AnalysisState, AttentionCategory, BrowsePage, QualityVerdict};
-use waveflow_server::AppState;
-
-struct Shelf {
-    state: AppState,
-    config: waveflow_server::Config,
-    owner: Uuid,
-    library: LibraryRecord,
-    music: PathBuf,
-    _temp: tempfile::TempDir,
-}
-
-async fn account(state: &AppState, name: &str) -> Uuid {
-    let id = Uuid::new_v4();
-    let now = now_ms();
-    sqlx::query(
-        "INSERT INTO account (id, username, password_hash, role, disabled, created_at, updated_at) \
-         VALUES (?, ?, 'this-account-never-authenticates', 'admin', 0, ?, ?)",
-    )
-    .bind(id.to_string())
-    .bind(name)
-    .bind(now)
-    .bind(now)
-    .execute(state.db.pool())
-    .await
-    .unwrap();
-    id
-}
-
-async fn shelf(name: &str) -> Shelf {
-    let (temp, config, state) = test_app().await;
-    let owner = account(&state, name).await;
-    let music = config.data_dir.join(name);
-    std::fs::create_dir_all(&music).unwrap();
-    let root = std::fs::canonicalize(&music).unwrap();
-    let id = state
-        .db
-        .create_library(owner, name, &root, LibraryVisibility::Private, now_ms())
-        .await
-        .unwrap();
-    Shelf {
-        state,
-        config,
-        owner,
-        library: LibraryRecord {
-            id,
-            name: name.into(),
-            root_path: root,
-        },
-        music,
-        _temp: temp,
-    }
-}
-
-/// Runs FFmpeg with these arguments, failing the test on any error.
-fn ffmpeg(args: &[&str]) {
-    let output = std::process::Command::new("ffmpeg")
-        .args(["-hide_banner", "-loglevel", "error", "-nostdin", "-y"])
-        .args(args)
-        .output()
-        .expect("FFmpeg must be on PATH");
-    assert!(
-        output.status.success(),
-        "ffmpeg {args:?}: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-}
-
-/// White noise: a full band, which no lossy encoder keeps.
-fn noise(rate: u32, seconds: u32, seed: u32) -> String {
-    format!("anoisesrc=d={seconds}:c=white:a=0.3:r={rate}:s={seed}")
-}
-
-/// A genuine 16-bit FLAC: the full band, and every bit it declares.
-fn genuine(path: &Path, seed: u32) {
-    ffmpeg(&[
-        "-f",
-        "lavfi",
-        "-i",
-        &noise(44_100, 6, seed),
-        "-ac",
-        "2",
-        "-sample_fmt",
-        "s16",
-        "-c:a",
-        "flac",
-        path.to_str().unwrap(),
-    ]);
-}
-
-/// A FLAC made from a 128 kbps MP3 of the same noise.
-fn from_mp3(path: &Path, scratch: &Path) {
-    let mp3 = scratch.join(format!(
-        "{}.mp3",
-        path.file_stem().unwrap().to_string_lossy()
-    ));
-    ffmpeg(&[
-        "-f",
-        "lavfi",
-        "-i",
-        &noise(44_100, 6, 7),
-        "-ac",
-        "2",
-        "-c:a",
-        "libmp3lame",
-        "-b:a",
-        "128k",
-        mp3.to_str().unwrap(),
-    ]);
-    ffmpeg(&[
-        "-i",
-        mp3.to_str().unwrap(),
-        "-sample_fmt",
-        "s16",
-        "-c:a",
-        "flac",
-        path.to_str().unwrap(),
-    ]);
-}
-
-/// A 44.1 kHz recording resampled to 96 kHz and written at 24 bits: a hi-res
-/// file holding nothing past what the CD held.
-fn upsampled(path: &Path) {
-    ffmpeg(&[
-        "-f",
-        "lavfi",
-        "-i",
-        &noise(44_100, 6, 11),
-        "-ac",
-        "2",
-        "-af",
-        "aresample=96000",
-        "-sample_fmt",
-        "s32",
-        "-bits_per_raw_sample",
-        "24",
-        "-c:a",
-        "flac",
-        path.to_str().unwrap(),
-    ]);
-}
-
-/// Noise recorded at 96 kHz: a genuine hi-res file, full band to Nyquist.
-fn hi_res(path: &Path) {
-    ffmpeg(&[
-        "-f",
-        "lavfi",
-        "-i",
-        &noise(96_000, 6, 13),
-        "-ac",
-        "2",
-        "-sample_fmt",
-        "s32",
-        "-bits_per_raw_sample",
-        "24",
-        "-c:a",
-        "flac",
-        path.to_str().unwrap(),
-    ]);
-}
-
-/// A 16-bit signal written into a 24-bit container: its low eight bits are
-/// zero in every sample.
-///
-/// Through a 16-bit WAV, in two runs: in one filter graph FFmpeg negotiates
-/// the 16-bit step away and the noise keeps all 24 bits.
-fn padded(path: &Path, scratch: &Path) {
-    let wav = scratch.join("padded-16.wav");
-    ffmpeg(&[
-        "-f",
-        "lavfi",
-        "-i",
-        &noise(44_100, 6, 17),
-        "-ac",
-        "2",
-        "-c:a",
-        "pcm_s16le",
-        wav.to_str().unwrap(),
-    ]);
-    ffmpeg(&[
-        "-i",
-        wav.to_str().unwrap(),
-        "-sample_fmt",
-        "s32",
-        "-bits_per_raw_sample",
-        "24",
-        "-c:a",
-        "flac",
-        path.to_str().unwrap(),
-    ]);
-}
-
-impl Shelf {
-    async fn scan(&self) {
-        run_scan(&self.state, self.owner, self.library.clone()).await;
-    }
-
-    async fn analyze(&self) -> usize {
-        self.state.services.analyze_pending_quality().await.unwrap()
-    }
-
-    async fn track(&self, relative: &str) -> Uuid {
-        let id: String =
-            sqlx::query_scalar("SELECT id FROM track WHERE library_id = ? AND relative_path = ?")
-                .bind(self.library.id.to_string())
-                .bind(relative)
-                .fetch_one(self.state.db.pool())
-                .await
-                .unwrap_or_else(|_| panic!("no track at {relative:?}"));
-        Uuid::parse_str(&id).unwrap()
-    }
-
-    async fn verdict(&self, relative: &str) -> QualityVerdict {
-        let track = self.track(relative).await;
-        self.state
-            .services
-            .track_quality(self.owner, track)
-            .await
-            .unwrap()
-            .quality
-            .verdict
-    }
-
-    async fn rows(&self) -> i64 {
-        sqlx::query_scalar("SELECT COUNT(*) FROM track_quality")
-            .fetch_one(self.state.db.pool())
-            .await
-            .unwrap()
-    }
-
-    /// A token for the account named `username`, minted by the owner.
-    async fn token(&self, username: &str) -> String {
-        self.state
-            .services
-            .create_api_token(self.owner, &[], username, "quality", &[])
-            .await
-            .unwrap()
-            .1
-    }
-
-    async fn join(&self, user: Uuid, role: LibraryRole) {
-        self.state
-            .db
-            .add_library_member(self.owner, self.library.id, user, role, now_ms())
-            .await
-            .unwrap();
-    }
-}
-
-async fn send(
-    router: &axum::Router,
-    token: &str,
-    request: Request<Body>,
-) -> axum::response::Response {
-    let (mut parts, body) = request.into_parts();
-    parts
-        .headers
-        .insert("authorization", format!("Bearer {token}").parse().unwrap());
-    router
-        .clone()
-        .oneshot(Request::from_parts(parts, body))
-        .await
-        .unwrap()
-}
-
-fn get(uri: &str) -> Request<Body> {
-    Request::get(uri).body(Body::empty()).unwrap()
-}
-
-#[tokio::test]
-async fn each_claim_is_checked_against_the_audio() {
-    let shelf = shelf("claims").await;
-    let scratch = shelf.config.data_dir.join("scratch");
-    std::fs::create_dir_all(&scratch).unwrap();
-    genuine(&shelf.music.join("genuine.flac"), 3);
-    from_mp3(&shelf.music.join("from-mp3.flac"), &scratch);
-    upsampled(&shelf.music.join("upsampled.flac"));
-    hi_res(&shelf.music.join("hi-res.flac"));
-    padded(&shelf.music.join("padded.flac"), &scratch);
-    std::fs::copy(scratch.join("from-mp3.mp3"), shelf.music.join("lossy.mp3")).unwrap();
-    shelf.scan().await;
-
-    assert_eq!(
-        shelf.verdict("genuine.flac").await,
-        QualityVerdict::Pending,
-        "nothing is measured on the answering path"
-    );
-    assert_eq!(
-        shelf.analyze().await,
-        5,
-        "the five lossless files, not the MP3"
-    );
-
-    let detail = |relative: &'static str| {
-        let shelf = &shelf;
-        async move {
-            let track = shelf.track(relative).await;
-            shelf
-                .state
-                .services
-                .track_quality(shelf.owner, track)
-                .await
-                .unwrap()
-        }
-    };
-    let fake = detail("from-mp3.flac").await;
-    assert_eq!(fake.quality.verdict, QualityVerdict::LossySource);
-    let cutoff = fake.quality.cutoff_hz.expect("a wall");
-    assert!(
-        (15_000.0..18_000.0).contains(&cutoff),
-        "LAME's wall at 128 kbps, found at {cutoff}"
-    );
-    assert_eq!(fake.spectrum.as_ref().map(Vec::len), Some(256));
-
-    let genuine = detail("genuine.flac").await;
-    assert_eq!(genuine.quality.verdict, QualityVerdict::Consistent);
-    assert_eq!(genuine.quality.cutoff_hz, None, "white noise has no wall");
-    assert_eq!(genuine.quality.effective_bits, Some(16));
-
-    let resampled = detail("upsampled.flac").await;
-    assert_eq!(
-        resampled.quality.verdict,
-        QualityVerdict::Upsampled,
-        "{:?}",
-        resampled.quality
-    );
-    assert_eq!(
-        detail("hi-res.flac").await.quality.verdict,
-        QualityVerdict::Consistent
-    );
-
-    let padded = detail("padded.flac").await;
-    assert_eq!(padded.quality.verdict, QualityVerdict::Padded);
-    assert_eq!(padded.quality.effective_bits, Some(16));
-
-    assert_eq!(shelf.verdict("lossy.mp3").await, QualityVerdict::Lossy);
-    assert_eq!(
-        shelf.analyze().await,
-        0,
-        "a measured file is not measured again"
-    );
-}
-
-#[tokio::test]
-async fn a_measurement_belongs_to_the_content_it_measured() {
-    let shelf = shelf("content").await;
-    genuine(&shelf.music.join("a.flac"), 3);
-    genuine(&shelf.music.join("b.flac"), 5);
-    shelf.scan().await;
-    assert_eq!(shelf.analyze().await, 2);
-    let a = shelf.track("a.flac").await;
-
-    // Moved: the scanner relocates it by its hash, and the measurement holds.
-    std::fs::create_dir_all(shelf.music.join("moved")).unwrap();
-    std::fs::rename(
-        shelf.music.join("a.flac"),
-        shelf.music.join("moved").join("a.flac"),
-    )
-    .unwrap();
-    shelf.scan().await;
-    assert_eq!(shelf.track("moved/a.flac").await, a, "the same track");
-    assert_eq!(
-        shelf.verdict("moved/a.flac").await,
-        QualityVerdict::Consistent
-    );
-    assert_eq!(shelf.analyze().await, 0, "a move re-measures nothing");
-
-    // Changed in place: the same track, another content, nothing current.
-    let b = shelf.track("b.flac").await;
-    genuine(&shelf.music.join("b.flac"), 9);
-    shelf.scan().await;
-    assert_eq!(shelf.track("b.flac").await, b, "the same track");
-    assert_eq!(shelf.verdict("b.flac").await, QualityVerdict::Pending);
-    assert_eq!(shelf.analyze().await, 1);
-    assert_eq!(shelf.verdict("b.flac").await, QualityVerdict::Consistent);
-}
-
-#[tokio::test]
-async fn another_ffmpeg_or_another_analyser_measures_again() {
-    let shelf = shelf("decoder").await;
-    genuine(&shelf.music.join("a.flac"), 3);
-    genuine(&shelf.music.join("b.flac"), 5);
-    shelf.scan().await;
-    assert_eq!(shelf.analyze().await, 2);
-    let digest = shelf.state.media.ffmpeg_digest().to_owned();
-    sqlx::query("UPDATE track_quality SET decoder = ? WHERE track_id = ?")
-        .bind("0".repeat(64))
-        .bind(shelf.track("a.flac").await.to_string())
-        .execute(shelf.state.db.pool())
-        .await
-        .unwrap();
-    sqlx::query("UPDATE track_quality SET version = version + 1 WHERE track_id = ?")
-        .bind(shelf.track("b.flac").await.to_string())
-        .execute(shelf.state.db.pool())
-        .await
-        .unwrap();
-
-    // What the boot does, with this process's own FFmpeg.
-    let removed = shelf
-        .state
-        .services
-        .use_quality_decoder(waveflow_server::quality::Decoder {
-            digest,
-            webp: false,
-        })
-        .await
-        .unwrap();
-    assert_eq!(removed, 2);
-    assert_eq!(shelf.verdict("a.flac").await, QualityVerdict::Pending);
-    assert_eq!(shelf.verdict("b.flac").await, QualityVerdict::Pending);
-    assert_eq!(shelf.analyze().await, 2);
-}
-
-/// Where a FLAC file's first audio frame starts: past `fLaC` and every
-/// metadata block, the last of which sets the top bit of its header.
-fn flac_frames_start(bytes: &[u8]) -> usize {
-    assert_eq!(&bytes[..4], b"fLaC");
-    let mut at = 4;
-    loop {
-        let last = bytes[at] & 0x80 != 0;
-        let length = u32::from_be_bytes([0, bytes[at + 1], bytes[at + 2], bytes[at + 3]]) as usize;
-        at += 4 + length;
-        if last {
-            return at;
-        }
-    }
-}
-
-#[tokio::test]
-async fn a_file_ffmpeg_cannot_read_is_recorded_once() {
-    let shelf = shelf("unreadable").await;
-    let whole = shelf.config.data_dir.join("whole.flac");
-    genuine(&whole, 3);
-    // The metadata intact and every frame zeroed: the scanner reads the
-    // stream's description, and FFmpeg finds no frame to decode.
-    let mut bytes = std::fs::read(&whole).unwrap();
-    let frames = flac_frames_start(&bytes);
-    bytes[frames..].fill(0);
-    std::fs::write(shelf.music.join("broken.flac"), &bytes).unwrap();
-    shelf.scan().await;
-
-    assert_eq!(shelf.analyze().await, 1);
-    assert_eq!(
-        shelf.verdict("broken.flac").await,
-        QualityVerdict::Unreadable
-    );
-    assert_eq!(
-        shelf.analyze().await,
-        0,
-        "not retried while it is the same file"
-    );
-}
-
-#[tokio::test]
-async fn a_running_scan_holds_the_analysis_back() {
-    let shelf = shelf("yield").await;
-    genuine(&shelf.music.join("a.flac"), 3);
-    shelf.scan().await;
-
-    let scan = shelf.state.scanner.begin_scan(shelf.library.id);
-    let services = shelf.state.services.clone();
-    let pass = tokio::spawn(async move { services.analyze_pending_quality().await.unwrap() });
-    tokio::time::sleep(std::time::Duration::from_millis(1500)).await;
-    assert_eq!(
-        shelf.rows().await,
-        0,
-        "nothing is measured while a scan runs"
-    );
-    assert!(!pass.is_finished());
-
-    drop(scan);
-    assert_eq!(pass.await.unwrap(), 1);
-    assert_eq!(shelf.rows().await, 1);
-}
-
-/// Shaped noise, as the desktop's own tests make it: white noise through an
-/// FFT mask, so the spectrum is exactly what the test says.
-fn shaped_noise(rate: f64, seconds: f64, seed: u32, gain_db: impl Fn(f64) -> f64) -> Vec<f32> {
-    use realfft::RealFftPlanner;
-    const FRAME: usize = 4096;
-    let mut planner = RealFftPlanner::<f32>::new();
-    let forward = planner.plan_fft_forward(FRAME);
-    let inverse = planner.plan_fft_inverse(FRAME);
-    let mut state = seed;
-    let mut out = Vec::new();
-    while (out.len() as f64) < seconds * rate {
-        let mut block: Vec<f32> = (0..FRAME)
-            .map(|_| {
-                state ^= state << 13;
-                state ^= state >> 17;
-                state ^= state << 5;
-                (state as f32 / u32::MAX as f32) - 0.5
-            })
-            .collect();
-        let mut spectrum = forward.make_output_vec();
-        forward.process(&mut block, &mut spectrum).unwrap();
-        for (k, bin) in spectrum.iter_mut().enumerate() {
-            let hz = k as f64 * rate / FRAME as f64;
-            *bin *= 10f32.powf((gain_db(hz) / 20.0) as f32);
-        }
-        let mut back = inverse.make_output_vec();
-        inverse.process(&mut spectrum, &mut back).unwrap();
-        out.extend(back.iter().map(|value| value / FRAME as f32));
-    }
-    out
-}
-
-/// A 16-bit PCM WAV, so both decoders hand the meter the same integers.
-fn write_wav(path: &Path, rate: u32, channels: &[Vec<f32>]) {
-    let frames = channels[0].len();
-    let count = channels.len() as u16;
-    let data_len = (frames * channels.len() * 2) as u32;
-    let mut bytes = Vec::with_capacity(44 + data_len as usize);
-    bytes.extend_from_slice(b"RIFF");
-    bytes.extend_from_slice(&(36 + data_len).to_le_bytes());
-    bytes.extend_from_slice(b"WAVEfmt ");
-    bytes.extend_from_slice(&16u32.to_le_bytes());
-    bytes.extend_from_slice(&1u16.to_le_bytes());
-    bytes.extend_from_slice(&count.to_le_bytes());
-    bytes.extend_from_slice(&rate.to_le_bytes());
-    bytes.extend_from_slice(&(rate * u32::from(count) * 2).to_le_bytes());
-    bytes.extend_from_slice(&(count * 2).to_le_bytes());
-    bytes.extend_from_slice(&16u16.to_le_bytes());
-    bytes.extend_from_slice(b"data");
-    bytes.extend_from_slice(&data_len.to_le_bytes());
-    for frame in 0..frames {
-        for channel in channels {
-            let sample = (channel[frame] * 4.0).clamp(-1.0, 1.0);
-            bytes.extend_from_slice(&((sample * 32_767.0) as i16).to_le_bytes());
-        }
-    }
-    std::fs::write(path, bytes).unwrap();
-}
-
-/// The server's pipeline and the desktop's `analyze_file` find the same wall,
-/// or the same absence of one, on the desktop's own test signals (RFC-016
-/// decision 2).
-#[tokio::test]
-async fn the_port_finds_what_the_desktop_finds() {
-    let temp = tempfile::tempdir().unwrap();
-    let rate = 44_100.0;
-    let tilt = |hz: f64| -3.0 * (hz.max(1000.0) / 1000.0).log2();
-    let mut signals: Vec<(String, Vec<Vec<f32>>)> = Vec::new();
-    for cut in [16_000.0, 19_000.0, 20_000.0] {
-        signals.push((
-            format!("cut-{cut}"),
-            vec![shaped_noise(rate, 10.0, 1, |hz| {
-                tilt(hz) + if hz > cut { -60.0 } else { 0.0 }
-            })],
-        ));
-    }
-    signals.push(("full".into(), vec![shaped_noise(rate, 10.0, 2, tilt)]));
-    signals.push((
-        "fade".into(),
-        vec![shaped_noise(rate, 10.0, 3, |hz| {
-            tilt(hz) - 12.0 * (hz.max(6000.0) / 6000.0).log2()
-        })],
-    ));
-    let lows = shaped_noise(rate, 10.0, 4, |hz| {
-        tilt(hz) + if hz > 15_000.0 { -80.0 } else { 0.0 }
-    });
-    let highs = shaped_noise(rate, 10.0, 5, |hz| {
-        tilt(hz) + if hz > 15_000.0 { 0.0 } else { -80.0 }
-    });
-    signals.push((
-        "opposition".into(),
-        vec![
-            lows.iter().zip(&highs).map(|(l, h)| l + h).collect(),
-            lows.iter().zip(&highs).map(|(l, h)| l - h).collect(),
-        ],
-    ));
-
-    let bin = rate / 4096.0;
-    let mut walls = 0;
-    for (name, channels) in signals {
-        let path = temp.path().join(format!("{name}.wav"));
-        write_wav(&path, rate as u32, &channels);
-        let desktop = waveflow_core::analysis::analyze_file(&path)
-            .unwrap()
-            .bandwidth
-            .expect("the desktop measured it");
-        let server = waveflow_server::quality::measure(
-            Path::new("ffprobe"),
-            Path::new("ffmpeg"),
-            &path,
-            std::time::Duration::from_secs(60),
-        )
-        .await;
-        let waveflow_server::quality::Measurement::Measured { cutoff_hz, .. } = server else {
-            panic!("{name}: the server measured nothing: {server:?}");
-        };
-        match (desktop.cutoff_hz, cutoff_hz) {
-            (None, None) => {}
-            (Some(a), Some(b)) => {
-                walls += 1;
-                assert!((a - b).abs() <= bin, "{name}: {a} against {b}");
-            }
-            other => panic!("{name}: the two disagree on the wall: {other:?}"),
-        }
-    }
-    assert_eq!(walls, 3, "the three cuts, and nothing else");
-}
-
-#[tokio::test]
-async fn members_read_the_quality_and_only_curators_ask_for_it_again() {
-    let shelf = shelf("routes").await;
-    let scratch = shelf.config.data_dir.join("scratch");
-    std::fs::create_dir_all(&scratch).unwrap();
-    genuine(&shelf.music.join("genuine.flac"), 3);
-    from_mp3(&shelf.music.join("from-mp3.flac"), &scratch);
-    shelf.scan().await;
-    shelf.analyze().await;
-    let listener = account(&shelf.state, "listener").await;
-    account(&shelf.state, "stranger").await;
-    shelf.join(listener, LibraryRole::Listener).await;
-    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
-    let owning = shelf.token("routes").await;
-    let listening = shelf.token("listener").await;
-    let outside = shelf.token("stranger").await;
-    let library = shelf.library.id;
-    let fake = shelf.track("from-mp3.flac").await;
-
-    let summary = json_body(
-        send(
-            &router,
-            &listening,
-            get(&format!("/api/v2/libraries/{library}/quality")),
-        )
-        .await,
-    )
-    .await;
-    assert_eq!(summary["enabled"], true);
-    assert_eq!(summary["lossless"], 2);
-    assert_eq!(summary["measured"], 2);
-    assert_eq!(summary["verdicts"][0]["verdict"], "lossy_source");
-    assert_eq!(summary["verdicts"][0]["count"], 1);
-
-    let list = json_body(
-        send(
-            &router,
-            &listening,
-            get(&format!("/api/v2/libraries/{library}/quality/tracks")),
-        )
-        .await,
-    )
-    .await;
-    let list = list.as_array().unwrap();
-    assert_eq!(list.len(), 2);
-    assert_eq!(list[0]["id"], fake.to_string(), "the worst first");
-    assert_eq!(list[0]["quality"]["verdict"], "lossy_source");
-    assert_eq!(list[0]["quality"]["nyquist_hz"], 22_050.0);
-    assert_eq!(list[1]["quality"]["verdict"], "consistent");
-
-    let filtered = json_body(
-        send(
-            &router,
-            &owning,
-            get(&format!(
-                "/api/v2/libraries/{library}/quality/tracks?verdict=consistent"
-            )),
-        )
-        .await,
-    )
-    .await;
-    assert_eq!(filtered.as_array().unwrap().len(), 1);
-    assert_eq!(
-        send(
-            &router,
-            &owning,
-            get(&format!(
-                "/api/v2/libraries/{library}/quality/tracks?verdict=fine"
-            )),
-        )
-        .await
-        .status(),
-        StatusCode::UNPROCESSABLE_ENTITY
-    );
-
-    let detail = json_body(
-        send(
-            &router,
-            &listening,
-            get(&format!("/api/v2/tracks/{fake}/quality")),
-        )
-        .await,
-    )
-    .await;
-    assert_eq!(detail["verdict"], "lossy_source");
-    assert_eq!(detail["spectrum"].as_array().unwrap().len(), 256);
-
-    let analysis = || {
-        Request::post(format!("/api/v2/libraries/{library}/quality/analysis"))
-            .body(Body::empty())
-            .unwrap()
-    };
-    assert_eq!(
-        send(&router, &listening, analysis()).await.status(),
-        StatusCode::NOT_FOUND,
-        "a listener cannot spend the operator's CPU"
-    );
-    assert_eq!(shelf.rows().await, 2);
-    assert_eq!(
-        send(&router, &owning, analysis()).await.status(),
-        StatusCode::ACCEPTED
-    );
-    assert_eq!(
-        shelf.rows().await,
-        0,
-        "the library's measurements are dropped"
-    );
-    assert_eq!(shelf.analyze().await, 2);
-
-    for uri in [
-        format!("/api/v2/libraries/{library}/quality"),
-        format!("/api/v2/libraries/{library}/quality/tracks"),
-        format!("/api/v2/tracks/{fake}/quality"),
-        format!("/api/v2/tracks/{fake}/spectrogram"),
-    ] {
-        assert_eq!(
-            send(&router, &outside, get(&uri)).await.status(),
-            StatusCode::NOT_FOUND,
-            "a stranger is told nothing at {uri}"
-        );
-    }
-    assert_eq!(
-        send(&router, &outside, analysis()).await.status(),
-        StatusCode::NOT_FOUND
-    );
-}
-
-#[tokio::test]
-async fn the_spectrogram_is_revalidated_by_whoever_asks() {
-    let shelf = shelf("spectrogram").await;
-    genuine(&shelf.music.join("a.flac"), 3);
-    shelf.scan().await;
-    let listener = account(&shelf.state, "listener").await;
-    shelf.join(listener, LibraryRole::Listener).await;
-    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
-    let listening = shelf.token("listener").await;
-    let track = shelf.track("a.flac").await;
-    let uri = format!("/api/v2/tracks/{track}/spectrogram");
-
-    let response = send(&router, &listening, get(&uri)).await;
-    assert_eq!(response.status(), StatusCode::OK);
-    let content_type = response.headers()[header::CONTENT_TYPE]
-        .to_str()
-        .unwrap()
-        .to_owned();
-    assert!(
-        content_type == "image/webp" || content_type == "image/jpeg",
-        "{content_type}"
-    );
-    assert_eq!(
-        response.headers()[header::CACHE_CONTROL],
-        "private, no-cache",
-        "kept, but asked about before every use"
-    );
-    let etag = response.headers()[header::ETAG]
-        .to_str()
-        .unwrap()
-        .to_owned();
-    let bytes = response.into_body().collect().await.unwrap().to_bytes();
-    let magic: &[u8] = if content_type == "image/webp" {
-        b"RIFF"
-    } else {
-        &[0xFF, 0xD8]
-    };
-    assert!(bytes.starts_with(magic), "a picture of the type it names");
-
-    let revalidate = || {
-        Request::get(&uri)
-            .header(header::IF_NONE_MATCH, &etag)
-            .body(Body::empty())
-            .unwrap()
-    };
-    assert_eq!(
-        send(&router, &listening, revalidate()).await.status(),
-        StatusCode::NOT_MODIFIED
-    );
-
-    shelf
-        .state
-        .db
-        .remove_library_member(shelf.owner, shelf.library.id, listener, now_ms())
-        .await
-        .unwrap();
-    assert_eq!(
-        send(&router, &listening, revalidate()).await.status(),
-        StatusCode::NOT_FOUND,
-        "a browser's copy does not outlive the membership"
-    );
-}
-
-#[tokio::test]
-async fn one_spectrogram_per_account_at_a_time() {
-    let shelf = shelf("bound").await;
-    // Long enough that the first is still being drawn when the second asks.
-    ffmpeg(&[
-        "-f",
-        "lavfi",
-        "-i",
-        &noise(44_100, 240, 3),
-        "-ac",
-        "2",
-        "-sample_fmt",
-        "s16",
-        "-c:a",
-        "flac",
-        shelf.music.join("long.flac").to_str().unwrap(),
-    ]);
-    shelf.scan().await;
-    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
-    let token = shelf.token("bound").await;
-    let uri = format!(
-        "/api/v2/tracks/{}/spectrogram",
-        shelf.track("long.flac").await
-    );
-
-    let (first, second) = tokio::join!(
-        send(&router, &token, get(&uri)),
-        send(&router, &token, get(&uri))
-    );
-    let mut statuses = [first.status(), second.status()];
-    statuses.sort();
-    assert_eq!(statuses, [StatusCode::OK, StatusCode::TOO_MANY_REQUESTS]);
-    let busy = if first.status() == StatusCode::TOO_MANY_REQUESTS {
-        first
-    } else {
-        second
-    };
-    assert!(busy.headers().contains_key(header::RETRY_AFTER));
-}
-
-#[tokio::test]
-async fn needs_attention_lists_the_fake_lossless_files() {
-    let shelf = shelf("attention").await;
-    let scratch = shelf.config.data_dir.join("scratch");
-    std::fs::create_dir_all(&scratch).unwrap();
-    genuine(&shelf.music.join("genuine.flac"), 3);
-    from_mp3(&shelf.music.join("from-mp3.flac"), &scratch);
-    padded(&shelf.music.join("padded.flac"), &scratch);
-    shelf.scan().await;
-
-    let count = || async {
-        shelf
-            .state
-            .services
-            .attention_summary(shelf.owner, shelf.library.id)
-            .await
-            .unwrap()
-            .into_iter()
-            .find(|item| item.category == AttentionCategory::ProbableFakeLossless)
-            .unwrap()
-            .count
-    };
-    assert_eq!(count().await, 0, "nothing before it is measured");
-    shelf.analyze().await;
-    assert_eq!(count().await, 1, "the fake, and not the padded file");
-    let tracks = shelf
-        .state
-        .services
-        .attention_tracks(
-            shelf.owner,
-            shelf.library.id,
-            AttentionCategory::ProbableFakeLossless,
-            BrowsePage::default(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(tracks.len(), 1);
-    assert_eq!(tracks[0].song.id, shelf.track("from-mp3.flac").await);
-}
-
-/// With the analysis off, the server draws one spectrogram at a time; a
-/// stranger who asks while that one is drawn is told nothing exists, not that
-/// the server is busy with it.
-#[tokio::test]
-async fn a_stranger_is_told_nothing_even_at_the_bound() {
-    let temp = tempfile::tempdir().unwrap();
-    let mut config = waveflow_server::Config::for_data_dir(temp.path().join("data"));
-    config.quality_parallelism = 0;
-    let state = waveflow_server::initialize(&config).await.unwrap();
-    let owner = account(&state, "off").await;
-    let music = config.data_dir.join("off");
-    std::fs::create_dir_all(&music).unwrap();
-    let root = std::fs::canonicalize(&music).unwrap();
-    let id = state
-        .db
-        .create_library(owner, "off", &root, LibraryVisibility::Private, now_ms())
-        .await
-        .unwrap();
-    let shelf = Shelf {
-        state,
-        config,
-        owner,
-        library: LibraryRecord {
-            id,
-            name: "off".into(),
-            root_path: root,
-        },
-        music,
-        _temp: temp,
-    };
-    ffmpeg(&[
-        "-f",
-        "lavfi",
-        "-i",
-        &noise(44_100, 240, 3),
-        "-ac",
-        "2",
-        "-sample_fmt",
-        "s16",
-        "-c:a",
-        "flac",
-        shelf.music.join("long.flac").to_str().unwrap(),
-    ]);
-    shelf.scan().await;
-    account(&shelf.state, "stranger").await;
-    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
-    let owning = shelf.token("off").await;
-    let outside = shelf.token("stranger").await;
-    let track = shelf.track("long.flac").await;
-    let uri = format!("/api/v2/tracks/{track}/spectrogram");
-
-    assert_eq!(shelf.analyze().await, 0, "the operator turned it off");
-    let summary = json_body(
-        send(
-            &router,
-            &owning,
-            get(&format!("/api/v2/libraries/{}/quality", shelf.library.id)),
-        )
-        .await,
-    )
-    .await;
-    assert_eq!(summary["enabled"], false);
-    assert_eq!(summary["measured"], 0);
-
-    let (drawn, refused) = tokio::join!(send(&router, &owning, get(&uri)), async {
-        tokio::time::sleep(std::time::Duration::from_millis(150)).await;
-        send(&router, &outside, get(&uri)).await
-    });
-    assert_eq!(drawn.status(), StatusCode::OK);
-    assert_eq!(
-        refused.status(),
-        StatusCode::NOT_FOUND,
-        "access is checked before the bound"
-    );
-}
-
-/// The analysis's state, as the library's owner reads it.
-async fn analysis(shelf: &Shelf) -> waveflow_server::services::QualityAnalysis {
-    shelf
-        .state
-        .services
-        .quality_summary(shelf.owner, shelf.library.id)
-        .await
-        .unwrap()
-        .analysis
-}
-
-/// A minute of noise: long enough that a pass over a few of them can be
-/// watched while it runs.
-fn minute(path: &Path, seed: u32) {
-    ffmpeg(&[
-        "-f",
-        "lavfi",
-        "-i",
-        &noise(44_100, 60, seed),
-        "-ac",
-        "2",
-        "-sample_fmt",
-        "s16",
-        "-c:a",
-        "flac",
-        path.to_str().unwrap(),
-    ]);
-}
-
-#[tokio::test]
-async fn the_summary_says_where_the_analysis_stands() {
-    let shelf = shelf("status").await;
-    genuine(&shelf.music.join("a.flac"), 3);
-    shelf.scan().await;
-
-    let before = analysis(&shelf).await;
-    assert_eq!(
-        before.state,
-        AnalysisState::Queued,
-        "files wait, and no pass is on them"
-    );
-    assert_eq!(before.in_flight, 0);
-    assert_eq!(before.last_measured_at, None);
-
-    let scan = shelf.state.scanner.begin_scan(shelf.library.id);
-    assert_eq!(
-        analysis(&shelf).await.state,
-        AnalysisState::WaitingForScan,
-        "its own library is being scanned"
-    );
-    drop(scan);
-
-    shelf.analyze().await;
-    let after = analysis(&shelf).await;
-    assert_eq!(after.state, AnalysisState::Idle);
-    assert_eq!(after.in_flight, 0);
-    assert_eq!(after.pass_started_at, None);
-    assert!(after.last_measured_at.is_some());
-}
-
-/// A pass over three files is watched while it runs: it says it is running,
-/// names the file it is decoding, and the count moves one file at a time
-/// rather than all at once at the end.
-#[tokio::test]
-async fn a_running_pass_moves_one_file_at_a_time() {
-    let shelf = shelf("moving").await;
-    for (index, seed) in [3, 5, 7].into_iter().enumerate() {
-        minute(&shelf.music.join(format!("{index}.flac")), seed);
-    }
-    shelf.scan().await;
-
-    let services = shelf.state.services.clone();
-    let pass = tokio::spawn(async move { services.analyze_pending_quality().await.unwrap() });
-    let mut seen_running = false;
-    let mut seen_partial = false;
-    for _ in 0..2000 {
-        if pass.is_finished() {
-            break;
-        }
-        let now = analysis(&shelf).await;
-        if now.state == AnalysisState::Running && now.in_flight == 1 {
-            assert!(now.pass_started_at.is_some());
-            seen_running = true;
-        }
-        let rows = shelf.rows().await;
-        if (1..3).contains(&rows) && !pass.is_finished() {
-            seen_partial = true;
-        }
-        if seen_running && seen_partial {
-            break;
-        }
-        tokio::time::sleep(std::time::Duration::from_millis(20)).await;
-    }
-    assert!(
-        seen_running,
-        "a running pass says so, with its file in flight"
-    );
-    assert!(
-        seen_partial,
-        "a measurement is written as it finishes, not at the end of the pass"
-    );
-    assert_eq!(pass.await.unwrap(), 3);
-    assert_eq!(analysis(&shelf).await.state, AnalysisState::Idle);
-}
-
-/// A scan of somebody else's library holds every measurement back, but it
-/// changes nothing its outsiders are shown: the pass reads as running and its
-/// file as in flight, exactly as with no scan at all.
-#[tokio::test]
-async fn a_scan_the_caller_cannot_see_is_not_named() {
-    let shelf = shelf("mine").await;
-    genuine(&shelf.music.join("a.flac"), 3);
-    shelf.scan().await;
-    let stranger = account(&shelf.state, "stranger").await;
-    let theirs_root = shelf.config.data_dir.join("theirs");
-    std::fs::create_dir_all(&theirs_root).unwrap();
-    let theirs = shelf
-        .state
-        .db
-        .create_library(
-            stranger,
-            "theirs",
-            &std::fs::canonicalize(&theirs_root).unwrap(),
-            LibraryVisibility::Private,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-
-    let scan = shelf.state.scanner.begin_scan(theirs);
-    let services = shelf.state.services.clone();
-    let pass = tokio::spawn(async move { services.analyze_pending_quality().await.unwrap() });
-    // Long enough for the pass to have reached the scan and stopped there.
-    tokio::time::sleep(std::time::Duration::from_millis(500)).await;
-    assert!(!pass.is_finished(), "the pass waits for the scan");
-    let held = analysis(&shelf).await;
-    assert_eq!(
-        (held.state, held.in_flight),
-        (AnalysisState::Running, 1),
-        "nothing says another library is being scanned"
-    );
-    assert!(held.pass_started_at.is_some());
-
-    drop(scan);
-    assert_eq!(pass.await.unwrap(), 1);
-    assert_eq!(analysis(&shelf).await.state, AnalysisState::Idle);
-}
-
-#[tokio::test]
-async fn the_route_carries_the_analysis() {
-    let shelf = shelf("route-status").await;
-    genuine(&shelf.music.join("a.flac"), 3);
-    shelf.scan().await;
-    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
-    let token = shelf.token("route-status").await;
-    let summary = json_body(
-        send(
-            &router,
-            &token,
-            get(&format!("/api/v2/libraries/{}/quality", shelf.library.id)),
-        )
-        .await,
-    )
-    .await;
-    assert_eq!(summary["analysis"]["state"], "queued");
-    assert_eq!(summary["analysis"]["in_flight"], 0);
-    assert!(summary["analysis"]["last_measured_at"].is_null());
-}
-
-/// The header and the list are one answer: for every verdict, the summary
-/// counts exactly the files the list carries under it, including when some
-/// files are measured, some wait, and a measured one has gone unavailable.
-#[tokio::test]
-async fn the_summary_counts_what_the_list_lists() {
-    let shelf = shelf("agree").await;
-    let scratch = shelf.config.data_dir.join("scratch");
-    std::fs::create_dir_all(&scratch).unwrap();
-    genuine(&shelf.music.join("genuine.flac"), 3);
-    from_mp3(&shelf.music.join("from-mp3.flac"), &scratch);
-    padded(&shelf.music.join("padded.flac"), &scratch);
-    genuine(&shelf.music.join("gone.flac"), 9);
-    std::fs::copy(scratch.join("from-mp3.mp3"), shelf.music.join("lossy.mp3")).unwrap();
-    shelf.scan().await;
-    shelf.analyze().await;
-    // Measured, then gone: its row stays, and neither side may count it.
-    std::fs::remove_file(shelf.music.join("gone.flac")).unwrap();
-    // Added after the pass: pending on both sides.
-    genuine(&shelf.music.join("late.flac"), 11);
-    shelf.scan().await;
-
-    let summary = shelf
-        .state
-        .services
-        .quality_summary(shelf.owner, shelf.library.id)
-        .await
-        .unwrap();
-    let listed = shelf
-        .state
-        .services
-        .quality_tracks(
-            shelf.owner,
-            shelf.library.id,
-            None,
-            None,
-            BrowsePage::default(),
-        )
-        .await
-        .unwrap();
-    for entry in &summary.verdicts {
-        let in_list = listed
-            .iter()
-            .filter(|track| track.quality.verdict == entry.verdict)
-            .count() as i64;
-        assert_eq!(entry.count, in_list, "{:?}", entry.verdict);
-    }
-    assert_eq!(listed.len(), 5);
-    assert_eq!(summary.lossless, 4);
-    assert_eq!(summary.measured, 3);
-}
diff --git a/tests/quality/analysis.rs b/tests/quality/analysis.rs
new file mode 100644
index 00000000..17a2101c
--- /dev/null
+++ b/tests/quality/analysis.rs
@@ -0,0 +1,380 @@
+//! The analysis itself: each claim checked against the audio, when a
+//! measurement is current, what a failure records, and the port held to the
+//! desktop.
+
+use super::*;
+
+/// A 44.1 kHz recording resampled to 96 kHz and written at 24 bits: a hi-res
+/// file holding nothing past what the CD held.
+fn upsampled(path: &Path) {
+    ffmpeg(&[
+        "-f",
+        "lavfi",
+        "-i",
+        &noise(44_100, 6, 11),
+        "-ac",
+        "2",
+        "-af",
+        "aresample=96000",
+        "-sample_fmt",
+        "s32",
+        "-bits_per_raw_sample",
+        "24",
+        "-c:a",
+        "flac",
+        path.to_str().unwrap(),
+    ]);
+}
+
+/// Noise recorded at 96 kHz: a genuine hi-res file, full band to Nyquist.
+fn hi_res(path: &Path) {
+    ffmpeg(&[
+        "-f",
+        "lavfi",
+        "-i",
+        &noise(96_000, 6, 13),
+        "-ac",
+        "2",
+        "-sample_fmt",
+        "s32",
+        "-bits_per_raw_sample",
+        "24",
+        "-c:a",
+        "flac",
+        path.to_str().unwrap(),
+    ]);
+}
+
+#[tokio::test]
+async fn each_claim_is_checked_against_the_audio() {
+    let shelf = shelf("claims").await;
+    let scratch = shelf.config.data_dir.join("scratch");
+    std::fs::create_dir_all(&scratch).unwrap();
+    genuine(&shelf.music.join("genuine.flac"), 3);
+    from_mp3(&shelf.music.join("from-mp3.flac"), &scratch);
+    upsampled(&shelf.music.join("upsampled.flac"));
+    hi_res(&shelf.music.join("hi-res.flac"));
+    padded(&shelf.music.join("padded.flac"), &scratch);
+    std::fs::copy(scratch.join("from-mp3.mp3"), shelf.music.join("lossy.mp3")).unwrap();
+    shelf.scan().await;
+
+    assert_eq!(
+        shelf.verdict("genuine.flac").await,
+        QualityVerdict::Pending,
+        "nothing is measured on the answering path"
+    );
+    assert_eq!(
+        shelf.analyze().await,
+        5,
+        "the five lossless files, not the MP3"
+    );
+
+    let detail = |relative: &'static str| {
+        let shelf = &shelf;
+        async move {
+            let track = shelf.track(relative).await;
+            shelf
+                .state
+                .services
+                .track_quality(shelf.owner, track)
+                .await
+                .unwrap()
+        }
+    };
+    let fake = detail("from-mp3.flac").await;
+    assert_eq!(fake.quality.verdict, QualityVerdict::LossySource);
+    let cutoff = fake.quality.cutoff_hz.expect("a wall");
+    assert!(
+        (15_000.0..18_000.0).contains(&cutoff),
+        "LAME's wall at 128 kbps, found at {cutoff}"
+    );
+    assert_eq!(fake.spectrum.as_ref().map(Vec::len), Some(256));
+
+    let genuine = detail("genuine.flac").await;
+    assert_eq!(genuine.quality.verdict, QualityVerdict::Consistent);
+    assert_eq!(genuine.quality.cutoff_hz, None, "white noise has no wall");
+    assert_eq!(genuine.quality.effective_bits, Some(16));
+
+    let resampled = detail("upsampled.flac").await;
+    assert_eq!(
+        resampled.quality.verdict,
+        QualityVerdict::Upsampled,
+        "{:?}",
+        resampled.quality
+    );
+    assert_eq!(
+        detail("hi-res.flac").await.quality.verdict,
+        QualityVerdict::Consistent
+    );
+
+    let padded = detail("padded.flac").await;
+    assert_eq!(padded.quality.verdict, QualityVerdict::Padded);
+    assert_eq!(padded.quality.effective_bits, Some(16));
+
+    assert_eq!(shelf.verdict("lossy.mp3").await, QualityVerdict::Lossy);
+    assert_eq!(
+        shelf.analyze().await,
+        0,
+        "a measured file is not measured again"
+    );
+}
+
+#[tokio::test]
+async fn a_measurement_belongs_to_the_content_it_measured() {
+    let shelf = shelf("content").await;
+    genuine(&shelf.music.join("a.flac"), 3);
+    genuine(&shelf.music.join("b.flac"), 5);
+    shelf.scan().await;
+    assert_eq!(shelf.analyze().await, 2);
+    let a = shelf.track("a.flac").await;
+
+    // Moved: the scanner relocates it by its hash, and the measurement holds.
+    std::fs::create_dir_all(shelf.music.join("moved")).unwrap();
+    std::fs::rename(
+        shelf.music.join("a.flac"),
+        shelf.music.join("moved").join("a.flac"),
+    )
+    .unwrap();
+    shelf.scan().await;
+    assert_eq!(shelf.track("moved/a.flac").await, a, "the same track");
+    assert_eq!(
+        shelf.verdict("moved/a.flac").await,
+        QualityVerdict::Consistent
+    );
+    assert_eq!(shelf.analyze().await, 0, "a move re-measures nothing");
+
+    // Changed in place: the same track, another content, nothing current.
+    let b = shelf.track("b.flac").await;
+    genuine(&shelf.music.join("b.flac"), 9);
+    shelf.scan().await;
+    assert_eq!(shelf.track("b.flac").await, b, "the same track");
+    assert_eq!(shelf.verdict("b.flac").await, QualityVerdict::Pending);
+    assert_eq!(shelf.analyze().await, 1);
+    assert_eq!(shelf.verdict("b.flac").await, QualityVerdict::Consistent);
+}
+
+#[tokio::test]
+async fn another_ffmpeg_or_another_analyser_measures_again() {
+    let shelf = shelf("decoder").await;
+    genuine(&shelf.music.join("a.flac"), 3);
+    genuine(&shelf.music.join("b.flac"), 5);
+    shelf.scan().await;
+    assert_eq!(shelf.analyze().await, 2);
+    let digest = shelf.state.media.ffmpeg_digest().to_owned();
+    sqlx::query("UPDATE track_quality SET decoder = ? WHERE track_id = ?")
+        .bind("0".repeat(64))
+        .bind(shelf.track("a.flac").await.to_string())
+        .execute(shelf.state.db.pool())
+        .await
+        .unwrap();
+    sqlx::query("UPDATE track_quality SET version = version + 1 WHERE track_id = ?")
+        .bind(shelf.track("b.flac").await.to_string())
+        .execute(shelf.state.db.pool())
+        .await
+        .unwrap();
+
+    // What the boot does, with this process's own FFmpeg.
+    let removed = shelf
+        .state
+        .services
+        .use_quality_decoder(waveflow_server::quality::Decoder {
+            digest,
+            webp: false,
+        })
+        .await
+        .unwrap();
+    assert_eq!(removed, 2);
+    assert_eq!(shelf.verdict("a.flac").await, QualityVerdict::Pending);
+    assert_eq!(shelf.verdict("b.flac").await, QualityVerdict::Pending);
+    assert_eq!(shelf.analyze().await, 2);
+}
+
+/// Where a FLAC file's first audio frame starts: past `fLaC` and every
+/// metadata block, the last of which sets the top bit of its header.
+fn flac_frames_start(bytes: &[u8]) -> usize {
+    assert_eq!(&bytes[..4], b"fLaC");
+    let mut at = 4;
+    loop {
+        let last = bytes[at] & 0x80 != 0;
+        let length = u32::from_be_bytes([0, bytes[at + 1], bytes[at + 2], bytes[at + 3]]) as usize;
+        at += 4 + length;
+        if last {
+            return at;
+        }
+    }
+}
+
+#[tokio::test]
+async fn a_file_ffmpeg_cannot_read_is_recorded_once() {
+    let shelf = shelf("unreadable").await;
+    let whole = shelf.config.data_dir.join("whole.flac");
+    genuine(&whole, 3);
+    // The metadata intact and every frame zeroed: the scanner reads the
+    // stream's description, and FFmpeg finds no frame to decode.
+    let mut bytes = std::fs::read(&whole).unwrap();
+    let frames = flac_frames_start(&bytes);
+    bytes[frames..].fill(0);
+    std::fs::write(shelf.music.join("broken.flac"), &bytes).unwrap();
+    shelf.scan().await;
+
+    assert_eq!(shelf.analyze().await, 1);
+    assert_eq!(
+        shelf.verdict("broken.flac").await,
+        QualityVerdict::Unreadable
+    );
+    assert_eq!(
+        shelf.analyze().await,
+        0,
+        "not retried while it is the same file"
+    );
+}
+
+#[tokio::test]
+async fn a_running_scan_holds_the_analysis_back() {
+    let shelf = shelf("yield").await;
+    genuine(&shelf.music.join("a.flac"), 3);
+    shelf.scan().await;
+
+    let scan = shelf.state.scanner.begin_scan(shelf.library.id);
+    let services = shelf.state.services.clone();
+    let pass = tokio::spawn(async move { services.analyze_pending_quality().await.unwrap() });
+    tokio::time::sleep(std::time::Duration::from_millis(1500)).await;
+    assert_eq!(
+        shelf.rows().await,
+        0,
+        "nothing is measured while a scan runs"
+    );
+    assert!(!pass.is_finished());
+
+    drop(scan);
+    assert_eq!(pass.await.unwrap(), 1);
+    assert_eq!(shelf.rows().await, 1);
+}
+
+/// Shaped noise, as the desktop's own tests make it: white noise through an
+/// FFT mask, so the spectrum is exactly what the test says.
+fn shaped_noise(rate: f64, seconds: f64, seed: u32, gain_db: impl Fn(f64) -> f64) -> Vec<f32> {
+    use realfft::RealFftPlanner;
+    const FRAME: usize = 4096;
+    let mut planner = RealFftPlanner::<f32>::new();
+    let forward = planner.plan_fft_forward(FRAME);
+    let inverse = planner.plan_fft_inverse(FRAME);
+    let mut state = seed;
+    let mut out = Vec::new();
+    while (out.len() as f64) < seconds * rate {
+        let mut block: Vec<f32> = (0..FRAME)
+            .map(|_| {
+                state ^= state << 13;
+                state ^= state >> 17;
+                state ^= state << 5;
+                (state as f32 / u32::MAX as f32) - 0.5
+            })
+            .collect();
+        let mut spectrum = forward.make_output_vec();
+        forward.process(&mut block, &mut spectrum).unwrap();
+        for (k, bin) in spectrum.iter_mut().enumerate() {
+            let hz = k as f64 * rate / FRAME as f64;
+            *bin *= 10f32.powf((gain_db(hz) / 20.0) as f32);
+        }
+        let mut back = inverse.make_output_vec();
+        inverse.process(&mut spectrum, &mut back).unwrap();
+        out.extend(back.iter().map(|value| value / FRAME as f32));
+    }
+    out
+}
+
+/// A 16-bit PCM WAV, so both decoders hand the meter the same integers.
+fn write_wav(path: &Path, rate: u32, channels: &[Vec<f32>]) {
+    let frames = channels[0].len();
+    let count = channels.len() as u16;
+    let data_len = (frames * channels.len() * 2) as u32;
+    let mut bytes = Vec::with_capacity(44 + data_len as usize);
+    bytes.extend_from_slice(b"RIFF");
+    bytes.extend_from_slice(&(36 + data_len).to_le_bytes());
+    bytes.extend_from_slice(b"WAVEfmt ");
+    bytes.extend_from_slice(&16u32.to_le_bytes());
+    bytes.extend_from_slice(&1u16.to_le_bytes());
+    bytes.extend_from_slice(&count.to_le_bytes());
+    bytes.extend_from_slice(&rate.to_le_bytes());
+    bytes.extend_from_slice(&(rate * u32::from(count) * 2).to_le_bytes());
+    bytes.extend_from_slice(&(count * 2).to_le_bytes());
+    bytes.extend_from_slice(&16u16.to_le_bytes());
+    bytes.extend_from_slice(b"data");
+    bytes.extend_from_slice(&data_len.to_le_bytes());
+    for frame in 0..frames {
+        for channel in channels {
+            let sample = (channel[frame] * 4.0).clamp(-1.0, 1.0);
+            bytes.extend_from_slice(&((sample * 32_767.0) as i16).to_le_bytes());
+        }
+    }
+    std::fs::write(path, bytes).unwrap();
+}
+
+/// The server's pipeline and the desktop's `analyze_file` find the same wall,
+/// or the same absence of one, on the desktop's own test signals (RFC-016
+/// decision 2).
+#[tokio::test]
+async fn the_port_finds_what_the_desktop_finds() {
+    let temp = tempfile::tempdir().unwrap();
+    let rate = 44_100.0;
+    let tilt = |hz: f64| -3.0 * (hz.max(1000.0) / 1000.0).log2();
+    let mut signals: Vec<(String, Vec<Vec<f32>>)> = Vec::new();
+    for cut in [16_000.0, 19_000.0, 20_000.0] {
+        signals.push((
+            format!("cut-{cut}"),
+            vec![shaped_noise(rate, 10.0, 1, |hz| {
+                tilt(hz) + if hz > cut { -60.0 } else { 0.0 }
+            })],
+        ));
+    }
+    signals.push(("full".into(), vec![shaped_noise(rate, 10.0, 2, tilt)]));
+    signals.push((
+        "fade".into(),
+        vec![shaped_noise(rate, 10.0, 3, |hz| {
+            tilt(hz) - 12.0 * (hz.max(6000.0) / 6000.0).log2()
+        })],
+    ));
+    let lows = shaped_noise(rate, 10.0, 4, |hz| {
+        tilt(hz) + if hz > 15_000.0 { -80.0 } else { 0.0 }
+    });
+    let highs = shaped_noise(rate, 10.0, 5, |hz| {
+        tilt(hz) + if hz > 15_000.0 { 0.0 } else { -80.0 }
+    });
+    signals.push((
+        "opposition".into(),
+        vec![
+            lows.iter().zip(&highs).map(|(l, h)| l + h).collect(),
+            lows.iter().zip(&highs).map(|(l, h)| l - h).collect(),
+        ],
+    ));
+
+    let bin = rate / 4096.0;
+    let mut walls = 0;
+    for (name, channels) in signals {
+        let path = temp.path().join(format!("{name}.wav"));
+        write_wav(&path, rate as u32, &channels);
+        let desktop = waveflow_core::analysis::analyze_file(&path)
+            .unwrap()
+            .bandwidth
+            .expect("the desktop measured it");
+        let server = waveflow_server::quality::measure(
+            Path::new("ffprobe"),
+            Path::new("ffmpeg"),
+            &path,
+            std::time::Duration::from_secs(60),
+        )
+        .await;
+        let waveflow_server::quality::Measurement::Measured { cutoff_hz, .. } = server else {
+            panic!("{name}: the server measured nothing: {server:?}");
+        };
+        match (desktop.cutoff_hz, cutoff_hz) {
+            (None, None) => {}
+            (Some(a), Some(b)) => {
+                walls += 1;
+                assert!((a - b).abs() <= bin, "{name}: {a} against {b}");
+            }
+            other => panic!("{name}: the two disagree on the wall: {other:?}"),
+        }
+    }
+    assert_eq!(walls, 3, "the three cuts, and nothing else");
+}
diff --git a/tests/quality/main.rs b/tests/quality/main.rs
new file mode 100644
index 00000000..ce232464
--- /dev/null
+++ b/tests/quality/main.rs
@@ -0,0 +1,247 @@
+//! The real quality of a file, measured from its audio (RFC-016).
+//!
+//! Every file here is made by FFmpeg from noise, so its spectrum is known: a
+//! full band, the wall LAME leaves at 128 kbps, the filter of a 44.1 kHz
+//! source resampled to 96 kHz, a 16-bit signal in a 24-bit container. The
+//! scanner indexes them for real, and the analysis measures them through the
+//! same FFmpeg the server runs.
+//!
+//! The accounts are rows written by hand and reach the routes through an API
+//! token, as in `tests/credits/`: nothing here hands a literal to a hash.
+
+#[allow(dead_code)]
+#[path = "../support/mod.rs"]
+mod support;
+
+use std::path::{Path, PathBuf};
+
+use axum::body::Body;
+use axum::http::{header, Request, StatusCode};
+use http_body_util::BodyExt;
+use support::*;
+use tower::ServiceExt;
+use uuid::Uuid;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::services::{AnalysisState, AttentionCategory, BrowsePage, QualityVerdict};
+use waveflow_server::storage::catalog::LibraryRecord;
+use waveflow_server::storage::database::{LibraryRole, LibraryVisibility};
+use waveflow_server::AppState;
+
+struct Shelf {
+    state: AppState,
+    config: waveflow_server::Config,
+    owner: Uuid,
+    library: LibraryRecord,
+    music: PathBuf,
+    _temp: tempfile::TempDir,
+}
+
+async fn account(state: &AppState, name: &str) -> Uuid {
+    let id = Uuid::new_v4();
+    let now = now_ms();
+    sqlx::query(
+        "INSERT INTO account (id, username, password_hash, role, disabled, created_at, updated_at) \
+         VALUES (?, ?, 'this-account-never-authenticates', 'admin', 0, ?, ?)",
+    )
+    .bind(id.to_string())
+    .bind(name)
+    .bind(now)
+    .bind(now)
+    .execute(state.db.pool())
+    .await
+    .unwrap();
+    id
+}
+
+async fn shelf(name: &str) -> Shelf {
+    let (temp, config, state) = test_app().await;
+    let owner = account(&state, name).await;
+    let music = config.data_dir.join(name);
+    std::fs::create_dir_all(&music).unwrap();
+    let root = std::fs::canonicalize(&music).unwrap();
+    let id = state
+        .db
+        .create_library(owner, name, &root, LibraryVisibility::Private, now_ms())
+        .await
+        .unwrap();
+    Shelf {
+        state,
+        config,
+        owner,
+        library: LibraryRecord {
+            id,
+            name: name.into(),
+            root_path: root,
+        },
+        music,
+        _temp: temp,
+    }
+}
+
+/// Runs FFmpeg with these arguments, failing the test on any error.
+fn ffmpeg(args: &[&str]) {
+    let output = std::process::Command::new("ffmpeg")
+        .args(["-hide_banner", "-loglevel", "error", "-nostdin", "-y"])
+        .args(args)
+        .output()
+        .expect("FFmpeg must be on PATH");
+    assert!(
+        output.status.success(),
+        "ffmpeg {args:?}: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
+
+/// White noise: a full band, which no lossy encoder keeps.
+fn noise(rate: u32, seconds: u32, seed: u32) -> String {
+    format!("anoisesrc=d={seconds}:c=white:a=0.3:r={rate}:s={seed}")
+}
+
+/// A genuine 16-bit FLAC: the full band, and every bit it declares.
+fn genuine(path: &Path, seed: u32) {
+    ffmpeg(&[
+        "-f",
+        "lavfi",
+        "-i",
+        &noise(44_100, 6, seed),
+        "-ac",
+        "2",
+        "-sample_fmt",
+        "s16",
+        "-c:a",
+        "flac",
+        path.to_str().unwrap(),
+    ]);
+}
+
+/// A FLAC made from a 128 kbps MP3 of the same noise.
+fn from_mp3(path: &Path, scratch: &Path) {
+    let mp3 = scratch.join(format!(
+        "{}.mp3",
+        path.file_stem().unwrap().to_string_lossy()
+    ));
+    ffmpeg(&[
+        "-f",
+        "lavfi",
+        "-i",
+        &noise(44_100, 6, 7),
+        "-ac",
+        "2",
+        "-c:a",
+        "libmp3lame",
+        "-b:a",
+        "128k",
+        mp3.to_str().unwrap(),
+    ]);
+    ffmpeg(&[
+        "-i",
+        mp3.to_str().unwrap(),
+        "-sample_fmt",
+        "s16",
+        "-c:a",
+        "flac",
+        path.to_str().unwrap(),
+    ]);
+}
+
+/// A 16-bit signal written into a 24-bit container: its low eight bits are
+/// zero in every sample.
+///
+/// Through a 16-bit WAV, in two runs: in one filter graph FFmpeg negotiates
+/// the 16-bit step away and the noise keeps all 24 bits.
+fn padded(path: &Path, scratch: &Path) {
+    let wav = scratch.join("padded-16.wav");
+    ffmpeg(&[
+        "-f",
+        "lavfi",
+        "-i",
+        &noise(44_100, 6, 17),
+        "-ac",
+        "2",
+        "-c:a",
+        "pcm_s16le",
+        wav.to_str().unwrap(),
+    ]);
+    ffmpeg(&[
+        "-i",
+        wav.to_str().unwrap(),
+        "-sample_fmt",
+        "s32",
+        "-bits_per_raw_sample",
+        "24",
+        "-c:a",
+        "flac",
+        path.to_str().unwrap(),
+    ]);
+}
+
+impl Shelf {
+    async fn scan(&self) {
+        run_scan(&self.state, self.owner, self.library.clone()).await;
+    }
+
+    async fn analyze(&self) -> usize {
+        self.state.services.analyze_pending_quality().await.unwrap()
+    }
+
+    async fn track(&self, relative: &str) -> Uuid {
+        let id: String =
+            sqlx::query_scalar("SELECT id FROM track WHERE library_id = ? AND relative_path = ?")
+                .bind(self.library.id.to_string())
+                .bind(relative)
+                .fetch_one(self.state.db.pool())
+                .await
+                .unwrap_or_else(|_| panic!("no track at {relative:?}"));
+        Uuid::parse_str(&id).unwrap()
+    }
+
+    async fn verdict(&self, relative: &str) -> QualityVerdict {
+        let track = self.track(relative).await;
+        self.state
+            .services
+            .track_quality(self.owner, track)
+            .await
+            .unwrap()
+            .quality
+            .verdict
+    }
+
+    async fn rows(&self) -> i64 {
+        sqlx::query_scalar("SELECT COUNT(*) FROM track_quality")
+            .fetch_one(self.state.db.pool())
+            .await
+            .unwrap()
+    }
+
+    /// A token for the account named `username`, minted by the owner.
+    async fn token(&self, username: &str) -> String {
+        self.state
+            .services
+            .create_api_token(self.owner, &[], username, "quality", &[])
+            .await
+            .unwrap()
+            .1
+    }
+
+    async fn join(&self, user: Uuid, role: LibraryRole) {
+        self.state
+            .db
+            .add_library_member(self.owner, self.library.id, user, role, now_ms())
+            .await
+            .unwrap();
+    }
+}
+
+/// The analysis's state, as the library's owner reads it.
+async fn analysis(shelf: &Shelf) -> waveflow_server::services::QualityAnalysis {
+    shelf
+        .state
+        .services
+        .quality_summary(shelf.owner, shelf.library.id)
+        .await
+        .unwrap()
+        .analysis
+}
+
+mod analysis;
+mod routes;
diff --git a/tests/quality/routes.rs b/tests/quality/routes.rs
new file mode 100644
index 00000000..2d632bc0
--- /dev/null
+++ b/tests/quality/routes.rs
@@ -0,0 +1,579 @@
+//! What the routes say about the analysis: the verdicts, the spectrogram, the
+//! attention list and the summary, and who may read or ask for each.
+
+use super::*;
+
+async fn send(
+    router: &axum::Router,
+    token: &str,
+    request: Request<Body>,
+) -> axum::response::Response {
+    let (mut parts, body) = request.into_parts();
+    parts
+        .headers
+        .insert("authorization", format!("Bearer {token}").parse().unwrap());
+    router
+        .clone()
+        .oneshot(Request::from_parts(parts, body))
+        .await
+        .unwrap()
+}
+
+fn get(uri: &str) -> Request<Body> {
+    Request::get(uri).body(Body::empty()).unwrap()
+}
+
+#[tokio::test]
+async fn members_read_the_quality_and_only_curators_ask_for_it_again() {
+    let shelf = shelf("routes").await;
+    let scratch = shelf.config.data_dir.join("scratch");
+    std::fs::create_dir_all(&scratch).unwrap();
+    genuine(&shelf.music.join("genuine.flac"), 3);
+    from_mp3(&shelf.music.join("from-mp3.flac"), &scratch);
+    shelf.scan().await;
+    shelf.analyze().await;
+    let listener = account(&shelf.state, "listener").await;
+    account(&shelf.state, "stranger").await;
+    shelf.join(listener, LibraryRole::Listener).await;
+    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
+    let owning = shelf.token("routes").await;
+    let listening = shelf.token("listener").await;
+    let outside = shelf.token("stranger").await;
+    let library = shelf.library.id;
+    let fake = shelf.track("from-mp3.flac").await;
+
+    let summary = json_body(
+        send(
+            &router,
+            &listening,
+            get(&format!("/api/v2/libraries/{library}/quality")),
+        )
+        .await,
+    )
+    .await;
+    assert_eq!(summary["enabled"], true);
+    assert_eq!(summary["lossless"], 2);
+    assert_eq!(summary["measured"], 2);
+    assert_eq!(summary["verdicts"][0]["verdict"], "lossy_source");
+    assert_eq!(summary["verdicts"][0]["count"], 1);
+
+    let list = json_body(
+        send(
+            &router,
+            &listening,
+            get(&format!("/api/v2/libraries/{library}/quality/tracks")),
+        )
+        .await,
+    )
+    .await;
+    let list = list.as_array().unwrap();
+    assert_eq!(list.len(), 2);
+    assert_eq!(list[0]["id"], fake.to_string(), "the worst first");
+    assert_eq!(list[0]["quality"]["verdict"], "lossy_source");
+    assert_eq!(list[0]["quality"]["nyquist_hz"], 22_050.0);
+    assert_eq!(list[1]["quality"]["verdict"], "consistent");
+
+    let filtered = json_body(
+        send(
+            &router,
+            &owning,
+            get(&format!(
+                "/api/v2/libraries/{library}/quality/tracks?verdict=consistent"
+            )),
+        )
+        .await,
+    )
+    .await;
+    assert_eq!(filtered.as_array().unwrap().len(), 1);
+    assert_eq!(
+        send(
+            &router,
+            &owning,
+            get(&format!(
+                "/api/v2/libraries/{library}/quality/tracks?verdict=fine"
+            )),
+        )
+        .await
+        .status(),
+        StatusCode::UNPROCESSABLE_ENTITY
+    );
+
+    let detail = json_body(
+        send(
+            &router,
+            &listening,
+            get(&format!("/api/v2/tracks/{fake}/quality")),
+        )
+        .await,
+    )
+    .await;
+    assert_eq!(detail["verdict"], "lossy_source");
+    assert_eq!(detail["spectrum"].as_array().unwrap().len(), 256);
+
+    let analysis = || {
+        Request::post(format!("/api/v2/libraries/{library}/quality/analysis"))
+            .body(Body::empty())
+            .unwrap()
+    };
+    assert_eq!(
+        send(&router, &listening, analysis()).await.status(),
+        StatusCode::NOT_FOUND,
+        "a listener cannot spend the operator's CPU"
+    );
+    assert_eq!(shelf.rows().await, 2);
+    assert_eq!(
+        send(&router, &owning, analysis()).await.status(),
+        StatusCode::ACCEPTED
+    );
+    assert_eq!(
+        shelf.rows().await,
+        0,
+        "the library's measurements are dropped"
+    );
+    assert_eq!(shelf.analyze().await, 2);
+
+    for uri in [
+        format!("/api/v2/libraries/{library}/quality"),
+        format!("/api/v2/libraries/{library}/quality/tracks"),
+        format!("/api/v2/tracks/{fake}/quality"),
+        format!("/api/v2/tracks/{fake}/spectrogram"),
+    ] {
+        assert_eq!(
+            send(&router, &outside, get(&uri)).await.status(),
+            StatusCode::NOT_FOUND,
+            "a stranger is told nothing at {uri}"
+        );
+    }
+    assert_eq!(
+        send(&router, &outside, analysis()).await.status(),
+        StatusCode::NOT_FOUND
+    );
+}
+
+#[tokio::test]
+async fn the_spectrogram_is_revalidated_by_whoever_asks() {
+    let shelf = shelf("spectrogram").await;
+    genuine(&shelf.music.join("a.flac"), 3);
+    shelf.scan().await;
+    let listener = account(&shelf.state, "listener").await;
+    shelf.join(listener, LibraryRole::Listener).await;
+    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
+    let listening = shelf.token("listener").await;
+    let track = shelf.track("a.flac").await;
+    let uri = format!("/api/v2/tracks/{track}/spectrogram");
+
+    let response = send(&router, &listening, get(&uri)).await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let content_type = response.headers()[header::CONTENT_TYPE]
+        .to_str()
+        .unwrap()
+        .to_owned();
+    assert!(
+        content_type == "image/webp" || content_type == "image/jpeg",
+        "{content_type}"
+    );
+    assert_eq!(
+        response.headers()[header::CACHE_CONTROL],
+        "private, no-cache",
+        "kept, but asked about before every use"
+    );
+    let etag = response.headers()[header::ETAG]
+        .to_str()
+        .unwrap()
+        .to_owned();
+    let bytes = response.into_body().collect().await.unwrap().to_bytes();
+    let magic: &[u8] = if content_type == "image/webp" {
+        b"RIFF"
+    } else {
+        &[0xFF, 0xD8]
+    };
+    assert!(bytes.starts_with(magic), "a picture of the type it names");
+
+    let revalidate = || {
+        Request::get(&uri)
+            .header(header::IF_NONE_MATCH, &etag)
+            .body(Body::empty())
+            .unwrap()
+    };
+    assert_eq!(
+        send(&router, &listening, revalidate()).await.status(),
+        StatusCode::NOT_MODIFIED
+    );
+
+    shelf
+        .state
+        .db
+        .remove_library_member(shelf.owner, shelf.library.id, listener, now_ms())
+        .await
+        .unwrap();
+    assert_eq!(
+        send(&router, &listening, revalidate()).await.status(),
+        StatusCode::NOT_FOUND,
+        "a browser's copy does not outlive the membership"
+    );
+}
+
+#[tokio::test]
+async fn one_spectrogram_per_account_at_a_time() {
+    let shelf = shelf("bound").await;
+    // Long enough that the first is still being drawn when the second asks.
+    ffmpeg(&[
+        "-f",
+        "lavfi",
+        "-i",
+        &noise(44_100, 240, 3),
+        "-ac",
+        "2",
+        "-sample_fmt",
+        "s16",
+        "-c:a",
+        "flac",
+        shelf.music.join("long.flac").to_str().unwrap(),
+    ]);
+    shelf.scan().await;
+    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
+    let token = shelf.token("bound").await;
+    let uri = format!(
+        "/api/v2/tracks/{}/spectrogram",
+        shelf.track("long.flac").await
+    );
+
+    let (first, second) = tokio::join!(
+        send(&router, &token, get(&uri)),
+        send(&router, &token, get(&uri))
+    );
+    let mut statuses = [first.status(), second.status()];
+    statuses.sort();
+    assert_eq!(statuses, [StatusCode::OK, StatusCode::TOO_MANY_REQUESTS]);
+    let busy = if first.status() == StatusCode::TOO_MANY_REQUESTS {
+        first
+    } else {
+        second
+    };
+    assert!(busy.headers().contains_key(header::RETRY_AFTER));
+}
+
+#[tokio::test]
+async fn needs_attention_lists_the_fake_lossless_files() {
+    let shelf = shelf("attention").await;
+    let scratch = shelf.config.data_dir.join("scratch");
+    std::fs::create_dir_all(&scratch).unwrap();
+    genuine(&shelf.music.join("genuine.flac"), 3);
+    from_mp3(&shelf.music.join("from-mp3.flac"), &scratch);
+    padded(&shelf.music.join("padded.flac"), &scratch);
+    shelf.scan().await;
+
+    let count = || async {
+        shelf
+            .state
+            .services
+            .attention_summary(shelf.owner, shelf.library.id)
+            .await
+            .unwrap()
+            .into_iter()
+            .find(|item| item.category == AttentionCategory::ProbableFakeLossless)
+            .unwrap()
+            .count
+    };
+    assert_eq!(count().await, 0, "nothing before it is measured");
+    shelf.analyze().await;
+    assert_eq!(count().await, 1, "the fake, and not the padded file");
+    let tracks = shelf
+        .state
+        .services
+        .attention_tracks(
+            shelf.owner,
+            shelf.library.id,
+            AttentionCategory::ProbableFakeLossless,
+            BrowsePage::default(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(tracks.len(), 1);
+    assert_eq!(tracks[0].song.id, shelf.track("from-mp3.flac").await);
+}
+
+/// With the analysis off, the server draws one spectrogram at a time; a
+/// stranger who asks while that one is drawn is told nothing exists, not that
+/// the server is busy with it.
+#[tokio::test]
+async fn a_stranger_is_told_nothing_even_at_the_bound() {
+    let temp = tempfile::tempdir().unwrap();
+    let mut config = waveflow_server::Config::for_data_dir(temp.path().join("data"));
+    config.quality_parallelism = 0;
+    let state = waveflow_server::initialize(&config).await.unwrap();
+    let owner = account(&state, "off").await;
+    let music = config.data_dir.join("off");
+    std::fs::create_dir_all(&music).unwrap();
+    let root = std::fs::canonicalize(&music).unwrap();
+    let id = state
+        .db
+        .create_library(owner, "off", &root, LibraryVisibility::Private, now_ms())
+        .await
+        .unwrap();
+    let shelf = Shelf {
+        state,
+        config,
+        owner,
+        library: LibraryRecord {
+            id,
+            name: "off".into(),
+            root_path: root,
+        },
+        music,
+        _temp: temp,
+    };
+    ffmpeg(&[
+        "-f",
+        "lavfi",
+        "-i",
+        &noise(44_100, 240, 3),
+        "-ac",
+        "2",
+        "-sample_fmt",
+        "s16",
+        "-c:a",
+        "flac",
+        shelf.music.join("long.flac").to_str().unwrap(),
+    ]);
+    shelf.scan().await;
+    account(&shelf.state, "stranger").await;
+    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
+    let owning = shelf.token("off").await;
+    let outside = shelf.token("stranger").await;
+    let track = shelf.track("long.flac").await;
+    let uri = format!("/api/v2/tracks/{track}/spectrogram");
+
+    assert_eq!(shelf.analyze().await, 0, "the operator turned it off");
+    let summary = json_body(
+        send(
+            &router,
+            &owning,
+            get(&format!("/api/v2/libraries/{}/quality", shelf.library.id)),
+        )
+        .await,
+    )
+    .await;
+    assert_eq!(summary["enabled"], false);
+    assert_eq!(summary["measured"], 0);
+
+    let (drawn, refused) = tokio::join!(send(&router, &owning, get(&uri)), async {
+        tokio::time::sleep(std::time::Duration::from_millis(150)).await;
+        send(&router, &outside, get(&uri)).await
+    });
+    assert_eq!(drawn.status(), StatusCode::OK);
+    assert_eq!(
+        refused.status(),
+        StatusCode::NOT_FOUND,
+        "access is checked before the bound"
+    );
+}
+
+/// A minute of noise: long enough that a pass over a few of them can be
+/// watched while it runs.
+fn minute(path: &Path, seed: u32) {
+    ffmpeg(&[
+        "-f",
+        "lavfi",
+        "-i",
+        &noise(44_100, 60, seed),
+        "-ac",
+        "2",
+        "-sample_fmt",
+        "s16",
+        "-c:a",
+        "flac",
+        path.to_str().unwrap(),
+    ]);
+}
+
+#[tokio::test]
+async fn the_summary_says_where_the_analysis_stands() {
+    let shelf = shelf("status").await;
+    genuine(&shelf.music.join("a.flac"), 3);
+    shelf.scan().await;
+
+    let before = analysis(&shelf).await;
+    assert_eq!(
+        before.state,
+        AnalysisState::Queued,
+        "files wait, and no pass is on them"
+    );
+    assert_eq!(before.in_flight, 0);
+    assert_eq!(before.last_measured_at, None);
+
+    let scan = shelf.state.scanner.begin_scan(shelf.library.id);
+    assert_eq!(
+        analysis(&shelf).await.state,
+        AnalysisState::WaitingForScan,
+        "its own library is being scanned"
+    );
+    drop(scan);
+
+    shelf.analyze().await;
+    let after = analysis(&shelf).await;
+    assert_eq!(after.state, AnalysisState::Idle);
+    assert_eq!(after.in_flight, 0);
+    assert_eq!(after.pass_started_at, None);
+    assert!(after.last_measured_at.is_some());
+}
+
+/// A pass over three files is watched while it runs: it says it is running,
+/// names the file it is decoding, and the count moves one file at a time
+/// rather than all at once at the end.
+#[tokio::test]
+async fn a_running_pass_moves_one_file_at_a_time() {
+    let shelf = shelf("moving").await;
+    for (index, seed) in [3, 5, 7].into_iter().enumerate() {
+        minute(&shelf.music.join(format!("{index}.flac")), seed);
+    }
+    shelf.scan().await;
+
+    let services = shelf.state.services.clone();
+    let pass = tokio::spawn(async move { services.analyze_pending_quality().await.unwrap() });
+    let mut seen_running = false;
+    let mut seen_partial = false;
+    for _ in 0..2000 {
+        if pass.is_finished() {
+            break;
+        }
+        let now = analysis(&shelf).await;
+        if now.state == AnalysisState::Running && now.in_flight == 1 {
+            assert!(now.pass_started_at.is_some());
+            seen_running = true;
+        }
+        let rows = shelf.rows().await;
+        if (1..3).contains(&rows) && !pass.is_finished() {
+            seen_partial = true;
+        }
+        if seen_running && seen_partial {
+            break;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(20)).await;
+    }
+    assert!(
+        seen_running,
+        "a running pass says so, with its file in flight"
+    );
+    assert!(
+        seen_partial,
+        "a measurement is written as it finishes, not at the end of the pass"
+    );
+    assert_eq!(pass.await.unwrap(), 3);
+    assert_eq!(analysis(&shelf).await.state, AnalysisState::Idle);
+}
+
+/// A scan of somebody else's library holds every measurement back, but it
+/// changes nothing its outsiders are shown: the pass reads as running and its
+/// file as in flight, exactly as with no scan at all.
+#[tokio::test]
+async fn a_scan_the_caller_cannot_see_is_not_named() {
+    let shelf = shelf("mine").await;
+    genuine(&shelf.music.join("a.flac"), 3);
+    shelf.scan().await;
+    let stranger = account(&shelf.state, "stranger").await;
+    let theirs_root = shelf.config.data_dir.join("theirs");
+    std::fs::create_dir_all(&theirs_root).unwrap();
+    let theirs = shelf
+        .state
+        .db
+        .create_library(
+            stranger,
+            "theirs",
+            &std::fs::canonicalize(&theirs_root).unwrap(),
+            LibraryVisibility::Private,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+
+    let scan = shelf.state.scanner.begin_scan(theirs);
+    let services = shelf.state.services.clone();
+    let pass = tokio::spawn(async move { services.analyze_pending_quality().await.unwrap() });
+    // Long enough for the pass to have reached the scan and stopped there.
+    tokio::time::sleep(std::time::Duration::from_millis(500)).await;
+    assert!(!pass.is_finished(), "the pass waits for the scan");
+    let held = analysis(&shelf).await;
+    assert_eq!(
+        (held.state, held.in_flight),
+        (AnalysisState::Running, 1),
+        "nothing says another library is being scanned"
+    );
+    assert!(held.pass_started_at.is_some());
+
+    drop(scan);
+    assert_eq!(pass.await.unwrap(), 1);
+    assert_eq!(analysis(&shelf).await.state, AnalysisState::Idle);
+}
+
+#[tokio::test]
+async fn the_route_carries_the_analysis() {
+    let shelf = shelf("route-status").await;
+    genuine(&shelf.music.join("a.flac"), 3);
+    shelf.scan().await;
+    let router = waveflow_server::app(&shelf.config, shelf.state.clone());
+    let token = shelf.token("route-status").await;
+    let summary = json_body(
+        send(
+            &router,
+            &token,
+            get(&format!("/api/v2/libraries/{}/quality", shelf.library.id)),
+        )
+        .await,
+    )
+    .await;
+    assert_eq!(summary["analysis"]["state"], "queued");
+    assert_eq!(summary["analysis"]["in_flight"], 0);
+    assert!(summary["analysis"]["last_measured_at"].is_null());
+}
+
+/// The header and the list are one answer: for every verdict, the summary
+/// counts exactly the files the list carries under it, including when some
+/// files are measured, some wait, and a measured one has gone unavailable.
+#[tokio::test]
+async fn the_summary_counts_what_the_list_lists() {
+    let shelf = shelf("agree").await;
+    let scratch = shelf.config.data_dir.join("scratch");
+    std::fs::create_dir_all(&scratch).unwrap();
+    genuine(&shelf.music.join("genuine.flac"), 3);
+    from_mp3(&shelf.music.join("from-mp3.flac"), &scratch);
+    padded(&shelf.music.join("padded.flac"), &scratch);
+    genuine(&shelf.music.join("gone.flac"), 9);
+    std::fs::copy(scratch.join("from-mp3.mp3"), shelf.music.join("lossy.mp3")).unwrap();
+    shelf.scan().await;
+    shelf.analyze().await;
+    // Measured, then gone: its row stays, and neither side may count it.
+    std::fs::remove_file(shelf.music.join("gone.flac")).unwrap();
+    // Added after the pass: pending on both sides.
+    genuine(&shelf.music.join("late.flac"), 11);
+    shelf.scan().await;
+
+    let summary = shelf
+        .state
+        .services
+        .quality_summary(shelf.owner, shelf.library.id)
+        .await
+        .unwrap();
+    let listed = shelf
+        .state
+        .services
+        .quality_tracks(
+            shelf.owner,
+            shelf.library.id,
+            None,
+            None,
+            BrowsePage::default(),
+        )
+        .await
+        .unwrap();
+    for entry in &summary.verdicts {
+        let in_list = listed
+            .iter()
+            .filter(|track| track.quality.verdict == entry.verdict)
+            .count() as i64;
+        assert_eq!(entry.count, in_list, "{:?}", entry.verdict);
+    }
+    assert_eq!(listed.len(), 5);
+    assert_eq!(summary.lossless, 4);
+    assert_eq!(summary.measured, 3);
+}
diff --git a/tests/scanner/indexing.rs b/tests/scanner/indexing.rs
index edf77117..5427ada6 100644
--- a/tests/scanner/indexing.rs
+++ b/tests/scanner/indexing.rs
@@ -598,7 +598,7 @@ async fn a_re_encoded_file_that_moved_keeps_its_track_and_its_favourite() {
 fn scan_progress_converts_into_the_shape_the_stream_sends() {
     let scan = uuid::Uuid::new_v4();
     let library = uuid::Uuid::new_v4();
-    let record = waveflow_server::scanner::ScanProgress {
+    let record = waveflow_server::library::scanner::ScanProgress {
         scan_id: scan,
         library_id: library,
         status: "running".into(),
diff --git a/tests/scanner/lifecycle.rs b/tests/scanner/lifecycle.rs
index af3c5eeb..a6f3fb3f 100644
--- a/tests/scanner/lifecycle.rs
+++ b/tests/scanner/lifecycle.rs
@@ -78,7 +78,7 @@ async fn the_lifecycle_follows_the_role_model() {
             owner,
             library.id,
             listener,
-            waveflow_server::database::LibraryRole::Listener,
+            waveflow_server::storage::database::LibraryRole::Listener,
             now_ms(),
         )
         .await
diff --git a/tests/scanner/main.rs b/tests/scanner/main.rs
index 1092e9b0..40c94b86 100644
--- a/tests/scanner/main.rs
+++ b/tests/scanner/main.rs
@@ -3,12 +3,12 @@
 //! Split out of `v2_foundations.rs`.
 
 use sqlx::Row;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::catalog::ApplyOutcome;
-use waveflow_server::catalog::LibraryRecord;
-use waveflow_server::database::AccountRole;
-use waveflow_server::database::LibraryVisibility;
-use waveflow_server::security;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
+use waveflow_server::storage::catalog::ApplyOutcome;
+use waveflow_server::storage::catalog::LibraryRecord;
+use waveflow_server::storage::database::AccountRole;
+use waveflow_server::storage::database::LibraryVisibility;
 
 // Not every target uses every fixture, and a shared module is not dead
 // code for being partly unused here.
@@ -72,7 +72,7 @@ async fn job(
     state: &waveflow_server::AppState,
     owner: uuid::Uuid,
     scan: uuid::Uuid,
-) -> waveflow_server::catalog::ScanJobRecord {
+) -> waveflow_server::storage::catalog::ScanJobRecord {
     state
         .db
         .scan_job_for_user(owner, scan)
@@ -129,7 +129,7 @@ async fn settled(
     state: &waveflow_server::AppState,
     owner: uuid::Uuid,
     scan: uuid::Uuid,
-) -> waveflow_server::catalog::ScanJobRecord {
+) -> waveflow_server::storage::catalog::ScanJobRecord {
     for _ in 0..500 {
         let record = job(state, owner, scan).await;
         if record.status == "completed" || record.status == "failed" {
diff --git a/tests/scanner/purges.rs b/tests/scanner/purges.rs
index d6b58cab..b005fcdf 100644
--- a/tests/scanner/purges.rs
+++ b/tests/scanner/purges.rs
@@ -195,7 +195,7 @@ async fn a_purge_is_explicit_and_waits_for_no_scan() {
             owner,
             library.id,
             listener,
-            waveflow_server::database::LibraryRole::Listener,
+            waveflow_server::storage::database::LibraryRole::Listener,
             now_ms(),
         )
         .await
@@ -339,7 +339,7 @@ async fn a_purge_can_be_taken_back_and_tells_every_journal_when_it_lands() {
             owner,
             library.id,
             listener,
-            waveflow_server::database::LibraryRole::Listener,
+            waveflow_server::storage::database::LibraryRole::Listener,
             now_ms(),
         )
         .await
diff --git a/tests/scanner/scheduling.rs b/tests/scanner/scheduling.rs
index a4bed3de..75b6811c 100644
--- a/tests/scanner/scheduling.rs
+++ b/tests/scanner/scheduling.rs
@@ -11,7 +11,7 @@ async fn a_watched_change_is_scanned_once_it_settles() {
     })
     .await;
     scan_once(&state, owner, library.clone()).await;
-    let watcher = waveflow_server::watcher::spawn(
+    let watcher = waveflow_server::library::watcher::spawn(
         state.scanner.clone(),
         state.db.clone(),
         std::time::Duration::from_millis(200),
@@ -88,11 +88,16 @@ async fn a_scan_the_watcher_cannot_queue_stays_pending() {
         },
     )]);
     let delay = std::time::Duration::from_millis(10);
-    let mut settle = waveflow_server::watcher::Settle::new(delay);
+    let mut settle = waveflow_server::library::watcher::Settle::new(delay);
     let start = tokio::time::Instant::now();
     settle.touch(ghost, start);
-    waveflow_server::watcher::dispatch_due(&mut settle, &watched, &state.scanner, start + delay)
-        .await;
+    waveflow_server::library::watcher::dispatch_due(
+        &mut settle,
+        &watched,
+        &state.scanner,
+        start + delay,
+    )
+    .await;
     assert!(
         settle.is_pending(ghost),
         "a change whose scan could not be queued was dropped"
@@ -319,7 +324,7 @@ async fn a_library_is_watched_only_when_it_asks_and_in_the_folder_that_changed()
         "a switch queues no scan"
     );
     assert!(state.db.watched_libraries().await.unwrap().is_empty());
-    let watcher = waveflow_server::watcher::spawn(
+    let watcher = waveflow_server::library::watcher::spawn(
         state.scanner.clone(),
         state.db.clone(),
         std::time::Duration::from_millis(200),
diff --git a/tests/scrobbling/adapters.rs b/tests/scrobbling/adapters.rs
index 61014f02..f3a640b3 100644
--- a/tests/scrobbling/adapters.rs
+++ b/tests/scrobbling/adapters.rs
@@ -5,9 +5,9 @@ use super::*;
 
 /// Points Maloja's declared instance at `base`, leaving the others alone.
 fn maloja_reaching(config: &mut waveflow_server::Config, base: &str) {
-    let url = waveflow_server::scrobblers::validate_destination(base, true)
+    let url = waveflow_server::remote::scrobblers::validate_destination(base, true)
         .expect("a destination the suite chose");
-    let fingerprint = waveflow_server::scrobblers::destination_fingerprint(&url);
+    let fingerprint = waveflow_server::remote::scrobblers::destination_fingerprint(&url);
     config
         .destinations
         .retain(|declared| declared.provider != ScrobbleProvider::Maloja);
@@ -180,8 +180,8 @@ async fn a_last_fm_session_key_that_died_breaks_the_link_rather_than_looking_sen
     .await;
     let temp = tempfile::tempdir().unwrap();
     let mut config = lastfm_app(&temp);
-    let url = waveflow_server::scrobblers::validate_destination(&base, true).unwrap();
-    let fingerprint = waveflow_server::scrobblers::destination_fingerprint(&url);
+    let url = waveflow_server::remote::scrobblers::validate_destination(&base, true).unwrap();
+    let fingerprint = waveflow_server::remote::scrobblers::destination_fingerprint(&url);
     config.destinations = vec![waveflow_server::config::ScrobbleDestination {
         provider: ScrobbleProvider::LastFm,
         name: "default".to_owned(),
@@ -219,8 +219,8 @@ async fn lastfm_app_reaching(
     base: &str,
 ) -> (waveflow_server::Config, AppState) {
     let mut config = lastfm_app(temp);
-    let url = waveflow_server::scrobblers::validate_destination(base, true).unwrap();
-    let fingerprint = waveflow_server::scrobblers::destination_fingerprint(&url);
+    let url = waveflow_server::remote::scrobblers::validate_destination(base, true).unwrap();
+    let fingerprint = waveflow_server::remote::scrobblers::destination_fingerprint(&url);
     config.destinations = vec![waveflow_server::config::ScrobbleDestination {
         provider: ScrobbleProvider::LastFm,
         name: "default".to_owned(),
@@ -296,9 +296,9 @@ async fn the_adapter_asks_last_fm_for_a_token_and_names_it_in_the_address() {
     let base = spawn_answering("/2.0/", r#"{"token":"a-real-request-token"}"#).await;
     let temp = tempfile::tempdir().unwrap();
     let mut config = waveflow_server::Config::for_data_dir(temp.path().join("data"));
-    let url = waveflow_server::scrobblers::validate_destination(&base, true)
+    let url = waveflow_server::remote::scrobblers::validate_destination(&base, true)
         .expect("a destination the suite chose");
-    let fingerprint = waveflow_server::scrobblers::destination_fingerprint(&url);
+    let fingerprint = waveflow_server::remote::scrobblers::destination_fingerprint(&url);
     config
         .destinations
         .retain(|declared| declared.provider != ScrobbleProvider::LastFm);
@@ -350,9 +350,9 @@ async fn an_answer_carrying_no_token_is_refused_rather_than_passed_on() {
     let base = spawn_answering("/2.0/", r#"{"error":4,"message":"Invalid API key"}"#).await;
     let temp = tempfile::tempdir().unwrap();
     let mut config = waveflow_server::Config::for_data_dir(temp.path().join("data"));
-    let url = waveflow_server::scrobblers::validate_destination(&base, true)
+    let url = waveflow_server::remote::scrobblers::validate_destination(&base, true)
         .expect("a destination the suite chose");
-    let fingerprint = waveflow_server::scrobblers::destination_fingerprint(&url);
+    let fingerprint = waveflow_server::remote::scrobblers::destination_fingerprint(&url);
     config
         .destinations
         .retain(|declared| declared.provider != ScrobbleProvider::LastFm);
diff --git a/tests/scrobbling/instances.rs b/tests/scrobbling/instances.rs
index 1a7ebc44..0a2a554b 100644
--- a/tests/scrobbling/instances.rs
+++ b/tests/scrobbling/instances.rs
@@ -543,7 +543,7 @@ async fn a_retry_refuses_an_instance_that_is_no_longer_the_one_it_was_made_again
 /// server published and never describes a URL, so a name it never published is
 /// a resource that is not there. Held here rather than only at the route,
 /// because the CLI reaches the same method — `scrobble link` cannot be driven
-/// with a secret in `tests/cli.rs`, which refuses to mutate the environment
+/// with a secret in `tests/cli/scrobbling.rs`, which refuses to mutate the environment
 /// while sibling threads read it, so what both surfaces share is tested where
 /// it lives.
 ///
diff --git a/tests/scrobbling/lastfm_journey.rs b/tests/scrobbling/lastfm_journey.rs
index 6ac975b9..19cfcace 100644
--- a/tests/scrobbling/lastfm_journey.rs
+++ b/tests/scrobbling/lastfm_journey.rs
@@ -680,7 +680,7 @@ async fn a_journey_without_a_browser_needs_no_public_address() {
 
 /// The web journey never asks for a token of its own.
 ///
-/// This is the mistake `src/scrobblers/lastfm.rs` warns about in as many
+/// This is the mistake `src/remote/scrobblers/lastfm/` warns about in as many
 /// words: the two halves of Last.fm's protocol resemble each other enough to
 /// be mixed up, and a server that minted a token and then received a different
 /// one would hold the wrong one. Until `auth.getToken` existed there was
diff --git a/tests/scrobbling/listenbrainz.rs b/tests/scrobbling/listenbrainz.rs
index c845143b..7e18319a 100644
--- a/tests/scrobbling/listenbrainz.rs
+++ b/tests/scrobbling/listenbrainz.rs
@@ -10,9 +10,9 @@ use super::*;
 /// and leaves the other recipients alone, because more than one test needs a
 /// second destination in the same queue.
 fn reaching(config: &mut waveflow_server::Config, base: &str) {
-    let url = waveflow_server::scrobblers::validate_destination(base, true)
+    let url = waveflow_server::remote::scrobblers::validate_destination(base, true)
         .expect("a destination the suite chose");
-    let fingerprint = waveflow_server::scrobblers::destination_fingerprint(&url);
+    let fingerprint = waveflow_server::remote::scrobblers::destination_fingerprint(&url);
     config
         .destinations
         .retain(|declared| declared.provider != ScrobbleProvider::ListenBrainz);
diff --git a/tests/scrobbling/main.rs b/tests/scrobbling/main.rs
index 67ff2a9b..fe04604a 100644
--- a/tests/scrobbling/main.rs
+++ b/tests/scrobbling/main.rs
@@ -36,14 +36,14 @@ use std::time::Duration;
 
 use futures_util::future::BoxFuture;
 use tower::ServiceExt as _;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::catalog::LibraryRecord;
+use waveflow_server::auth::authentication::now_ms;
 use waveflow_server::config::ScrobbleLimits;
-use waveflow_server::database::LibraryVisibility;
 use waveflow_server::services::{
     ScrobbleEnvelope, ScrobbleProvider, ScrobbleTarget, ScrobbleUnavailable, ScrobbleVerdict,
     ServiceError,
 };
+use waveflow_server::storage::catalog::LibraryRecord;
+use waveflow_server::storage::database::LibraryVisibility;
 use waveflow_server::AppState;
 
 // Not every target uses every fixture, and a shared module is not dead code
@@ -324,7 +324,7 @@ async fn spawn_delaying(status: u16, delay: Option<(&'static str, String)>) -> D
 /// their own threads after the drop has returned, and the last of them
 /// checkpoints the WAL under an exclusive lock. The next `initialize` raced
 /// that close, and on a loaded Windows runner it outwaited `busy_timeout` and
-/// failed with `database is locked`. `cli.rs` closes before it restarts for
+/// failed with `database is locked`. `cli/key.rs` closes before it restarts for
 /// the same reason.
 async fn stop(state: AppState) {
     state.db.pool().close().await;
@@ -345,9 +345,9 @@ fn declaring(
     config.destinations = declared
         .iter()
         .map(|(provider, name, base)| {
-            let url = waveflow_server::scrobblers::validate_destination(base, true)
+            let url = waveflow_server::remote::scrobblers::validate_destination(base, true)
                 .expect("a destination the suite chose");
-            let fingerprint = waveflow_server::scrobblers::destination_fingerprint(&url);
+            let fingerprint = waveflow_server::remote::scrobblers::destination_fingerprint(&url);
             waveflow_server::config::ScrobbleDestination {
                 provider: *provider,
                 name: (*name).to_owned(),
diff --git a/tests/service.rs b/tests/service.rs
deleted file mode 100644
index 0a2915fa..00000000
--- a/tests/service.rs
+++ /dev/null
@@ -1,1028 +0,0 @@
-//! Probes, the embedded client, the backup bundle, and how a request is named.
-//!
-//! Split out of `v2_foundations.rs`; the command-line tests left for `cli.rs`.
-
-use axum::body::Body;
-use axum::http::Request;
-use axum::http::StatusCode;
-use tower::ServiceExt;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::database::AccountRole;
-use waveflow_server::security;
-
-// Not every target uses every fixture, and a shared module is not dead
-// code for being partly unused here.
-#[allow(dead_code)]
-mod support;
-use support::*;
-
-#[tokio::test]
-async fn probes_and_openapi_are_available_without_scan_readiness() {
-    let (_temp, mut config, state) = test_app().await;
-    config.allowed_origins = vec!["http://127.0.0.1:9180".parse().unwrap()];
-    let router = waveflow_server::app(&config, state);
-
-    let health = router
-        .clone()
-        .oneshot(Request::get("/health").body(Body::empty()).unwrap())
-        .await
-        .unwrap();
-    assert_eq!(health.status(), StatusCode::OK);
-    assert_eq!(json_body(health).await["schema"], 2);
-
-    let ready = router
-        .clone()
-        .oneshot(Request::get("/ready").body(Body::empty()).unwrap())
-        .await
-        .unwrap();
-    assert_eq!(ready.status(), StatusCode::OK);
-    assert_eq!(json_body(ready).await["database"], "ok");
-
-    let cors = router
-        .clone()
-        .oneshot(
-            Request::get("/health")
-                .header("origin", "http://127.0.0.1:9180")
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(
-        cors.headers()["access-control-allow-origin"],
-        "http://127.0.0.1:9180"
-    );
-    let rejected = router
-        .clone()
-        .oneshot(
-            Request::get("/health")
-                .header("origin", "https://untrusted.example")
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert!(rejected
-        .headers()
-        .get("access-control-allow-origin")
-        .is_none());
-
-    let openapi = router
-        .oneshot(Request::get("/openapi.json").body(Body::empty()).unwrap())
-        .await
-        .unwrap();
-    assert_eq!(openapi.status(), StatusCode::OK);
-    let document = json_body(openapi).await;
-    assert!(document["paths"]["/api/v2/auth/login"].is_object());
-    // RFC-017: both password sign-ins can answer 429, and say when to retry.
-    for path in ["/api/v2/auth/login", "/api/v2/web/auth/login"] {
-        let throttled = &document["paths"][path]["post"]["responses"]["429"];
-        assert!(
-            throttled["headers"]["Retry-After"].is_object(),
-            "{path}: {throttled}"
-        );
-    }
-    for path in [
-        "/api/v2/setup",
-        "/api/v2/web/auth/login",
-        "/api/v2/libraries",
-        "/api/v2/admin/users",
-        "/api/v2/sync/snapshot",
-        "/api/v2/sync/changes",
-        "/api/v2/sync/ack",
-        "/api/v2/sync/socket",
-        "/api/v2/transcode/status",
-        "/api/v2/tracks/{track_id}/lyrics",
-        "/api/v2/libraries/{library_id}/uploads",
-        "/api/v2/uploads/{session_id}",
-        "/api/v2/uploads/{session_id}/chunks/{index}",
-        "/api/v2/uploads/{session_id}/commit",
-        "/api/v2/canvas/{canvas_hash}",
-        "/api/v2/tracks/{track_id}/canvas",
-        "/api/v2/tracks/{track_id}/canvas-ticket",
-        "/api/v2/canvas-stream/{ticket}",
-    ] {
-        assert!(document["paths"][path].is_object(), "missing {path}");
-    }
-
-    // A track correction has three states per field — absent, `null`, a value —
-    // and only the schema can tell a generated client that `null` is one of
-    // them. A required field would forbid the absent state; a type without
-    // `null` would forbid the removal. Either loses #177 in translation.
-    let correction = &document["components"]["schemas"]["TrackMetadataPatch"];
-    assert!(
-        correction.get("required").is_none(),
-        "no field of a partial patch may be required"
-    );
-    for field in [
-        "title",
-        "sort_title",
-        "year",
-        "track_number",
-        "disc_number",
-        "musicbrainz_recording_id",
-        "comment",
-        "artists",
-        "genres",
-    ] {
-        assert!(
-            correction["properties"][field]["type"]
-                .as_array()
-                .is_some_and(|types| types.iter().any(|kind| kind == "null")),
-            "{field} must admit null"
-        );
-    }
-
-    // A client generated from this document alone must authenticate correctly
-    // and keep replay safety. Neither is inferable from the paths.
-    assert_eq!(
-        document["components"]["securitySchemes"]["bearer"]["scheme"],
-        "bearer"
-    );
-    assert_eq!(
-        document["security"][0]["bearer"].as_array().map(Vec::len),
-        Some(0)
-    );
-
-    // Endpoints carrying their own credential, or none, must opt out of the
-    // global requirement — otherwise the document claims a token is needed to
-    // log in, and that the stream ticket is not itself the credential.
-    for (path, method) in [
-        ("/health", "get"),
-        ("/api/v2/auth/login", "post"),
-        ("/api/v2/oauth/token", "post"),
-        ("/api/v2/stream/{ticket}", "get"),
-        ("/api/v2/canvas-stream/{ticket}", "get"),
-    ] {
-        assert_eq!(
-            document["paths"][path][method]["security"]
-                .as_array()
-                .map(Vec::len),
-            Some(0),
-            "{method} {path} should be documented as public"
-        );
-    }
-
-    // The two mutation headers are what the native API offers over the Subsonic
-    // facade; a document that omits them yields clients that never replay
-    // safely.
-    let headers = document["paths"]["/api/v2/scrobbles"]["post"]["parameters"]
-        .as_array()
-        .map(|parameters| {
-            parameters
-                .iter()
-                .filter_map(|parameter| parameter["name"].as_str().map(str::to_owned))
-                .collect::<Vec<_>>()
-        })
-        .unwrap_or_default();
-    assert!(
-        headers.iter().any(|name| name == "x-waveflow-operation-id"),
-        "scrobbles should document the operation id header, got {headers:?}"
-    );
-    assert!(
-        headers.iter().any(|name| name == "x-waveflow-device-id"),
-        "scrobbles should document the device id header, got {headers:?}"
-    );
-    // Every user-data write can fail on a replayed operation id, so the 409 is
-    // part of their contract — a client that only handles 2xx/4xx generically
-    // would retry it forever.
-    assert!(document["paths"]["/api/v2/scrobbles"]["post"]["responses"]["409"].is_object());
-    // And the sync read has its own 409, with a different code and a different
-    // recovery. Documenting one without the other would be worse than neither.
-    assert!(document["paths"]["/api/v2/sync/changes"]["get"]["responses"]["409"].is_object());
-
-    // Reads carry no operation id: annotating them would tell a generator to
-    // send headers the handler never looks at.
-    let read_parameters = document["paths"]["/api/v2/favorites"]["get"]["parameters"]
-        .as_array()
-        .map(|parameters| {
-            parameters
-                .iter()
-                .filter_map(|parameter| parameter["name"].as_str().map(str::to_owned))
-                .collect::<Vec<_>>()
-        })
-        .unwrap_or_default();
-    assert!(
-        !read_parameters
-            .iter()
-            .any(|name| name.starts_with("x-waveflow-")),
-        "a read should not advertise mutation headers, got {read_parameters:?}"
-    );
-}
-
-/// The files that make the client installable, and the brand's images, are
-/// served as themselves, or answered a JSON 404 — never the shell (RFC-022
-/// decision 4).
-///
-/// Which of the two is required depends on what is embedded, and the test
-/// asks the binary rather than the source tree: `build.rs` embeds the real
-/// client when `webapp/dist` holds one and a placeholder page otherwise, and
-/// the shell at `/` says which. With the real client, every install asset must
-/// be served with its own type — a build that dropped one would not be
-/// installable, and accepting a 404 there would let it pass. With the
-/// placeholder, each must be a definitive JSON 404. Neither may ever be
-/// `text/html`, which is what the router fallback gives any path it does not
-/// know, and which a browser reading a manifest fails on without saying why.
-#[tokio::test]
-async fn the_install_manifest_and_icons_are_never_answered_with_the_shell() {
-    let (_temp, config, state) = test_app().await;
-    let router = waveflow_server::app(&config, state);
-    let get = |path: &'static str| {
-        let router = router.clone();
-        async move {
-            router
-                .oneshot(Request::get(path).body(Body::empty()).unwrap())
-                .await
-                .unwrap()
-        }
-    };
-    let shell = body_text(get("/").await).await;
-    // The placeholder's own sentence, in `build.rs`.
-    let built = !shell.contains("The web client is not built");
-
-    for (path, expected) in [
-        ("/manifest.webmanifest", "application/manifest+json"),
-        ("/apple-touch-icon.png", "image/png"),
-        ("/icons/icon-192.png", "image/png"),
-        ("/icons/icon-512.png", "image/png"),
-        ("/icons/maskable-512.png", "image/png"),
-        // The two favicons `index.html` declares, and the logo the sidebar
-        // and the first-load screen draw: all from the logo kit, all images.
-        ("/favicon.ico", "image/x-icon"),
-        ("/favicon.svg", "image/svg+xml"),
-        ("/brand/waveflow-logo-horizontal-color.svg", "image/svg+xml"),
-        ("/brand/waveflow-logo-horizontal-dark.svg", "image/svg+xml"),
-        ("/brand/waveflow-symbol-mint.svg", "image/svg+xml"),
-        // The service worker (RFC-022): a script, never the shell, and never
-        // frozen in a cache, or a deploy could not replace it.
-        ("/sw.js", "javascript"),
-    ] {
-        let response = get(path).await;
-        let status = response.status();
-        let kind = response
-            .headers()
-            .get("content-type")
-            .map(|value| value.to_str().unwrap().to_owned())
-            .unwrap_or_default();
-        assert!(!kind.starts_with("text/html"), "{path} answered the shell");
-        if built {
-            assert_eq!(status, StatusCode::OK, "{path} is missing from the build");
-            if path == "/sw.js" {
-                assert!(kind.contains(expected), "{path}: {kind}");
-                assert_eq!(response.headers()["cache-control"], "no-cache");
-                continue;
-            }
-            assert_eq!(kind, expected, "{path}");
-            if path == "/manifest.webmanifest" {
-                let manifest: serde_json::Value =
-                    serde_json::from_str(&body_text(response).await).unwrap();
-                assert_eq!(manifest["start_url"], "/");
-                assert_eq!(manifest["display"], "standalone");
-                assert!(manifest["icons"]
-                    .as_array()
-                    .is_some_and(|icons| icons.iter().any(|icon| icon["purpose"] == "maskable")));
-                // The brand's Wave green, as the logo kit's own manifest sets
-                // both.
-                assert_eq!(manifest["theme_color"], "#10B981");
-                assert_eq!(manifest["background_color"], "#10B981");
-            }
-        } else {
-            assert_eq!(status, StatusCode::NOT_FOUND, "{path}");
-            assert!(kind.starts_with("application/json"), "{path}");
-        }
-    }
-
-    // A name no build ships is a JSON 404 whatever is embedded: the case that
-    // still tells the asset-only rule from the fallback when a real client is
-    // embedded and every shipped icon exists.
-    for path in ["/icons/not-shipped.png", "/brand/not-shipped.svg"] {
-        let missing = get(path).await;
-        assert_eq!(missing.status(), StatusCode::NOT_FOUND, "{path}");
-        assert!(
-            missing
-                .headers()
-                .get("content-type")
-                .map(|value| value.to_str().unwrap().to_owned())
-                .unwrap_or_default()
-                .starts_with("application/json"),
-            "{path}"
-        );
-    }
-}
-
-#[tokio::test]
-async fn embedded_web_client_serves_shell_without_shadowing_the_api() {
-    let (_temp, config, state) = test_app().await;
-    let router = waveflow_server::app(&config, state);
-
-    let get = |uri: &'static str| {
-        let router = router.clone();
-        async move {
-            router
-                .oneshot(Request::get(uri).body(Body::empty()).unwrap())
-                .await
-                .unwrap()
-        }
-    };
-
-    // The shell is served at the root.
-    let root = get("/").await;
-    assert_eq!(root.status(), StatusCode::OK);
-    assert!(root.headers()["content-type"]
-        .to_str()
-        .unwrap()
-        .starts_with("text/html"));
-    // The shell must never be cached: it is what points at the hashed assets.
-    assert_eq!(root.headers()["cache-control"], "no-cache");
-
-    // Client-side routes resolve to the same shell rather than 404.
-    let deep = get("/albums/some-client-route").await;
-    assert_eq!(deep.status(), StatusCode::OK);
-    assert!(deep.headers()["content-type"]
-        .to_str()
-        .unwrap()
-        .starts_with("text/html"));
-
-    // A route parameter carrying an encoded slash still resolves to the shell.
-    // Genres are the case that raises it — "Rock/Pop" is one tag, and the
-    // client routes it as /genres/Rock%2FPop — so a link to one, shared or
-    // reloaded, must not decode into a two-segment path that matches nothing.
-    let encoded = get("/genres/Rock%2FPop").await;
-    assert_eq!(encoded.status(), StatusCode::OK);
-    assert!(encoded.headers()["content-type"]
-        .to_str()
-        .unwrap()
-        .starts_with("text/html"));
-
-    // An unknown API path stays a JSON 404 instead of silently returning HTML.
-    let missing_api = get("/api/v2/does-not-exist").await;
-    assert_eq!(missing_api.status(), StatusCode::NOT_FOUND);
-    assert_eq!(
-        missing_api.headers()["content-type"]
-            .to_str()
-            .unwrap()
-            .split(';')
-            .next()
-            .unwrap(),
-        "application/json"
-    );
-
-    // The other server namespaces answer as themselves rather than falling
-    // through. /rest keeps its Subsonic contract — HTTP 200 with the failure in
-    // the body — and /share is a plain 404. Neither may return the client shell.
-    let unknown_method = get("/rest/nope").await;
-    assert_eq!(unknown_method.status(), StatusCode::OK);
-    assert!(!unknown_method.headers()["content-type"]
-        .to_str()
-        .unwrap()
-        .starts_with("text/html"));
-    let unknown_method = body_text(unknown_method).await;
-    assert!(unknown_method.starts_with("<subsonic-response"));
-    assert!(unknown_method.contains("status=\"failed\""));
-
-    let unknown_share = get("/share/nope").await;
-    assert_eq!(unknown_share.status(), StatusCode::NOT_FOUND);
-    assert!(!unknown_share
-        .headers()
-        .get("content-type")
-        .map(|value| value.to_str().unwrap().to_owned())
-        .unwrap_or_default()
-        .starts_with("text/html"));
-
-    // An icon request is answered once, or not at all — never with the shell.
-    //
-    // Before a build shipped a `favicon.ico`, the fallback handed the browser
-    // the client page. It cannot decode HTML as an image, learns nothing from
-    // a 200, and asks again: sixty-six requests in fifty-one seconds on a real
-    // session, forty kilobytes of markup spent on a tab icon. The real client
-    // ships the logo kit's icon now, and the placeholder ships none, so the
-    // answer is the icon or a definitive 404 — whichever this binary embeds.
-    //
-    // Stated as what it *is* rather than as what it is not: "not HTML" is also
-    // satisfied by a header that never arrived, so it would pin nothing about
-    // the answer actually given.
-    let built = !body_text(get("/").await)
-        .await
-        .contains("The web client is not built");
-    let icon = get("/favicon.ico").await;
-    let kind = icon
-        .headers()
-        .get("content-type")
-        .map(|value| value.to_str().unwrap().to_owned())
-        .unwrap_or_default();
-    if built {
-        assert_eq!(icon.status(), StatusCode::OK);
-        assert_eq!(kind, "image/x-icon");
-    } else {
-        assert_eq!(icon.status(), StatusCode::NOT_FOUND);
-        assert!(kind.starts_with("application/json"), "{kind}");
-    }
-
-    // A client route that merely starts like a reserved endpoint is not one.
-    let lookalike = get("/reference-guide").await;
-    assert_eq!(lookalike.status(), StatusCode::OK);
-    assert!(lookalike.headers()["content-type"]
-        .to_str()
-        .unwrap()
-        .starts_with("text/html"));
-
-    // Real routes are untouched by the fallback.
-    let health = get("/health").await;
-    assert_eq!(health.status(), StatusCode::OK);
-    assert_eq!(json_body(health).await["status"], "ok");
-}
-
-/// RFC-019 decision 2: the web client and the public shares tell a browser
-/// how far to trust them, and the Subsonic façade, whose wire is frozen, is
-/// left exactly as it was.
-#[tokio::test]
-async fn the_web_client_and_shares_carry_security_headers_and_rest_does_not() {
-    use base64::Engine;
-    use sha2::Digest;
-
-    let (_temp, config, state) = test_app().await;
-    let router = waveflow_server::app(&config, state);
-    let get = |uri: &'static str| {
-        let router = router.clone();
-        async move {
-            router
-                .oneshot(Request::get(uri).body(Body::empty()).unwrap())
-                .await
-                .unwrap()
-        }
-    };
-    let header = |response: &axum::response::Response, name: &str| {
-        response
-            .headers()
-            .get(name)
-            .map(|value| value.to_str().unwrap().to_owned())
-    };
-
-    // The shell, a client route, and a refusal from the fallback alike.
-    for uri in ["/", "/albums/some-client-route", "/icons/not-shipped.png"] {
-        let response = get(uri).await;
-        assert_eq!(
-            header(&response, "x-content-type-options").as_deref(),
-            Some("nosniff"),
-            "{uri}"
-        );
-        // Nothing to another host; not `no-referrer`, which adds nothing to
-        // that and can null the `Origin` the sign-in checks (RFC-019).
-        assert_eq!(
-            header(&response, "referrer-policy").as_deref(),
-            Some("same-origin"),
-            "{uri}"
-        );
-        assert_eq!(
-            header(&response, "x-frame-options").as_deref(),
-            Some("SAMEORIGIN"),
-            "{uri}"
-        );
-        let policy = header(&response, "content-security-policy").expect(uri);
-        assert!(policy.contains("frame-ancestors 'self'"), "{uri}: {policy}");
-        assert!(policy.contains("object-src 'none'"), "{uri}: {policy}");
-        assert!(!policy.contains("unsafe-inline"), "{uri}: {policy}");
-    }
-
-    // Each inline block of the shell actually served is admitted by its own
-    // digest — computed here, apart from the server's parser — and the policy
-    // admits no more of them than the shell holds. With the placeholder shell
-    // CI embeds there are none; with a real client build there are two.
-    let shell = get("/").await;
-    let policy = header(&shell, "content-security-policy").unwrap();
-    let html = body_text(shell).await;
-    let mut inline = 0;
-    for tag in ["script", "style"] {
-        let open = format!("<{tag}>");
-        let close = format!("</{tag}>");
-        for (start, _) in html.match_indices(&open) {
-            let content = &html[start + open.len()..];
-            let content = &content[..content.find(&close).expect("a closed block")];
-            let digest = base64::engine::general_purpose::STANDARD
-                .encode(sha2::Sha256::digest(content.as_bytes()));
-            assert!(
-                policy.contains(&format!("'sha256-{digest}'")),
-                "the inline {tag} is not admitted: {policy}"
-            );
-            inline += 1;
-        }
-    }
-    assert_eq!(policy.matches("'sha256-").count(), inline, "{policy}");
-
-    // A share's token is its path, so nothing may carry it away as a referrer.
-    // A route that matched and found no share answers with the headers too.
-    let share = get("/share/nope").await;
-    assert_eq!(share.status(), StatusCode::NOT_FOUND);
-    assert_eq!(
-        header(&share, "referrer-policy").as_deref(),
-        Some("no-referrer")
-    );
-    assert_eq!(
-        header(&share, "x-content-type-options").as_deref(),
-        Some("nosniff")
-    );
-    assert_eq!(header(&share, "x-frame-options").as_deref(), Some("DENY"));
-    assert_eq!(
-        header(&share, "content-security-policy").as_deref(),
-        Some("frame-ancestors 'none'")
-    );
-
-    // The façade: none of them.
-    let rest = get("/rest/ping").await;
-    for name in [
-        "content-security-policy",
-        "x-content-type-options",
-        "referrer-policy",
-        "x-frame-options",
-    ] {
-        assert_eq!(header(&rest, name), None, "/rest carries {name}");
-    }
-}
-
-#[tokio::test]
-async fn sqlite_and_instance_key_backup_restore_as_one_consistent_bundle() {
-    let (_temp, config, state) = test_app().await;
-    let password = "backup-web-password";
-    let user = state
-        .db
-        .create_account(
-            "backup-admin",
-            &security::hash_password(password).unwrap(),
-            AccountRole::Admin,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let encrypted = state.secret_box.encrypt(b"backup-subsonic-secret").unwrap();
-    state
-        .db
-        .set_subsonic_credential(
-            user,
-            user,
-            &encrypted,
-            &security::token_hash("wfsk_backup"),
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let bundle = config.data_dir.with_file_name("backup-bundle");
-    std::fs::create_dir_all(&bundle).unwrap();
-    state
-        .db
-        .backup_to(&bundle.join("waveflow.db"))
-        .await
-        .unwrap();
-    std::fs::copy(&config.instance_key_path, bundle.join("instance.key")).unwrap();
-    assert!(
-        waveflow_server::database::Database::check_file(&bundle.join("waveflow.db"))
-            .await
-            .unwrap()
-    );
-    state.db.pool().close().await;
-    drop(state);
-
-    let mismatched_bundle = config.data_dir.with_file_name("mismatched-backup-bundle");
-    std::fs::create_dir_all(&mismatched_bundle).unwrap();
-    std::fs::copy(
-        bundle.join("waveflow.db"),
-        mismatched_bundle.join("waveflow.db"),
-    )
-    .unwrap();
-    std::fs::write(mismatched_bundle.join("instance.key"), [9u8; 32]).unwrap();
-    let database_before = std::fs::read(&config.database_path).unwrap();
-    let key_before = std::fs::read(&config.instance_key_path).unwrap();
-    let error = waveflow_server::cli::restore(
-        &config,
-        waveflow_server::cli::RestoreArgs {
-            input: mismatched_bundle,
-        },
-    )
-    .await
-    .unwrap_err();
-    assert!(error.to_string().contains("do not match"));
-    assert_eq!(
-        std::fs::read(&config.database_path).unwrap(),
-        database_before
-    );
-    assert_eq!(
-        std::fs::read(&config.instance_key_path).unwrap(),
-        key_before
-    );
-
-    waveflow_server::cli::restore(
-        &config,
-        waveflow_server::cli::RestoreArgs {
-            input: bundle.clone(),
-        },
-    )
-    .await
-    .unwrap();
-    let restored = waveflow_server::initialize(&config).await.unwrap();
-    let credential = restored
-        .services
-        .credential_by_username("backup-admin")
-        .await
-        .unwrap()
-        .unwrap();
-    assert_eq!(
-        restored
-            .services
-            .decrypt_subsonic_password(&credential)
-            .unwrap(),
-        b"backup-subsonic-secret"
-    );
-    assert!(restored.db.integrity_check().await.unwrap());
-}
-
-/// A request is named by this server, whatever the caller proposed.
-///
-/// The name goes in every `http_request` span, and `CLAUDE.md` allows no header
-/// into a trace sink. A well-formed id is no safer than a malformed one for
-/// that purpose — reuse somebody else's and the trace record stops telling two
-/// callers apart — so the header is dropped on the way in and one is minted
-/// here, whatever arrived.
-///
-/// The round trip below is the only way to see which id the server actually
-/// used: `PropagateRequestIdLayer` puts it on the response, which is also what
-/// keeps correlation possible — an upstream records the name it was given.
-/// A boot that is refused closes the database before it says so.
-///
-/// Dropping a pool is not closing it: sqlx closes each connection on its own
-/// thread after the drop has returned, and the last of them checkpoints the
-/// WAL under an exclusive lock. A refusal that only dropped left whoever opens
-/// the file next — the operator retrying, or a test right after the refusal —
-/// racing that close, and losing it as `database is locked`. A zero
-/// `busy_timeout` makes the next open fail rather than wait, so a lock still
-/// held is seen however briefly it lasts.
-#[tokio::test]
-async fn a_refused_boot_gives_the_database_back_before_it_returns() {
-    let (_temp, config, state) = test_app().await;
-    state.db.pool().close().await;
-    drop(state);
-    std::fs::write(&config.instance_key_path, [7u8; 32]).unwrap();
-    let mut impatient = config.clone();
-    impatient.sqlite_busy_timeout = std::time::Duration::ZERO;
-
-    for attempt in 0..30 {
-        let refusal = match waveflow_server::initialize(&config).await {
-            Ok(_) => panic!("a key that is not the database's must stop the boot"),
-            Err(error) => format!("{error:#}"),
-        };
-        assert!(
-            refusal.contains("instance.key does not match"),
-            "attempt {attempt}: refused for another reason: {refusal}"
-        );
-        let next = waveflow_server::database::Database::open(&impatient)
-            .await
-            .unwrap_or_else(|error| {
-                panic!("attempt {attempt}: the refused boot still held the database: {error}")
-            });
-        next.pool().close().await;
-    }
-}
-
-#[tokio::test]
-async fn a_caller_cannot_name_its_own_request() {
-    let (_temp, config, state) = test_app().await;
-    let router = waveflow_server::app(&config, state.clone());
-    let named = |value: Option<&str>| {
-        let router = router.clone();
-        let value = value.map(str::to_owned);
-        async move {
-            let mut request = Request::get("/health");
-            if let Some(value) = value.as_deref() {
-                request = request.header("x-request-id", value);
-            }
-            // Named rather than `unwrap`ed because every value below has to
-            // reach the router for its case to mean anything, and one of them
-            // is not ASCII. `http` accepts it: a header value may hold any byte
-            // from 0x20 up except 0x7f, so `café` builds — it is `to_str`, on
-            // the way back, that would refuse it, which is why the answer is
-            // read as bytes further down.
-            let request = request
-                .body(Body::empty())
-                .expect("every proposed id has to reach the router");
-            let response = router.oneshot(request).await.unwrap();
-            // Read as bytes, not as `&str`. A `HeaderValue` may hold any byte
-            // above 0x1f, `to_str` refuses the ones above 0x7f, and the point
-            // of the non-ASCII case below is that such a value is not kept — so
-            // reading it that way would panic instead of failing the assertion
-            // that says so, and only when the drop is removed. A test that
-            // crashes rather than fails proves nothing about the reason.
-            response
-                .headers()
-                .get("x-request-id")
-                .map(|value| value.as_bytes().to_vec())
-        }
-    };
-
-    // Every request carries one, minted here, when the caller offered nothing.
-    let unprompted = named(None).await.expect("a request is always named");
-    assert!(uuid::Uuid::parse_str(&String::from_utf8_lossy(&unprompted)).is_ok());
-
-    for proposed in [
-        // The case a shape check would have let through, and the reason there
-        // is no shape check: an id belonging to another caller's requests.
-        "550e8400-e29b-41d4-a716-446655440000",
-        // The one a proxy would plausibly mint, and equally not kept.
-        "01JD5X-trace_id.7f",
-        // Unbounded length.
-        "x".repeat(65).as_str(),
-        // A space, which reads as two fields wherever a trace is parsed.
-        "two words",
-        // Punctuation an identifier has no use for.
-        "id;drop",
-        // Non-ASCII, which a sink may re-encode.
-        "identifiant-café",
-        // Nothing at all, which would name a request the empty string.
-        "",
-    ] {
-        let answered = named(Some(proposed))
-            .await
-            .expect("a request is named even when the caller proposed nothing usable");
-        let shown = String::from_utf8_lossy(&answered);
-        assert_ne!(
-            answered.as_slice(),
-            proposed.as_bytes(),
-            "the server adopted a name the caller chose: {shown}"
-        );
-        // And what replaced it is a minted id, not an edited version of what
-        // arrived: a sanitiser would still be letting the caller choose most
-        // of it.
-        assert!(
-            uuid::Uuid::parse_str(&shown).is_ok(),
-            "the name a request carries is one this server minted, and was: {shown}"
-        );
-        assert_ne!(
-            answered, unprompted,
-            "each request is named once, not named the same thing twice"
-        );
-    }
-
-    // A browser reading a cross-origin response sees only the headers CORS
-    // exposes, so the id being on the response is not the same as the client
-    // being able to quote it. The API guide says it can; this is what makes
-    // that true.
-    let mut cors_config = config.clone();
-    cors_config.allowed_origins = vec!["http://127.0.0.1:9180".parse().unwrap()];
-    let cors_router = waveflow_server::app(&cors_config, state);
-    let response = cors_router
-        .clone()
-        .oneshot(
-            Request::get("/health")
-                .header("origin", "http://127.0.0.1:9180")
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    let exposed = response.headers()["access-control-expose-headers"]
-        .to_str()
-        .unwrap()
-        .to_ascii_lowercase();
-    assert!(
-        exposed.split(',').any(|name| name.trim() == "x-request-id"),
-        "a browser client cannot read an id it is not allowed to see: {exposed}"
-    );
-
-    // And a preflight is a response too. `CorsLayer` answers one itself without
-    // calling the service beneath it, so for as long as the request-id layers
-    // sat inside it this was the one request nobody could name — and an origin
-    // this server rejects is precisely what an operator needs to find in a log.
-    let response = cors_router
-        .oneshot(
-            Request::builder()
-                .method(axum::http::Method::OPTIONS)
-                .uri("/api/v2/albums")
-                .header("origin", "http://127.0.0.1:9180")
-                .header("access-control-request-method", "GET")
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    let named = response
-        .headers()
-        .get("x-request-id")
-        .map(|value| String::from_utf8_lossy(value.as_bytes()).into_owned())
-        .expect("a preflight is answered by this server, so it is named by it");
-    assert!(
-        uuid::Uuid::parse_str(&named).is_ok(),
-        "a preflight carries a minted id like any other response, and carried: {named}"
-    );
-
-    // Exposed on the way out and not allowed on the way in, which is the pair
-    // the guide describes: a browser may read the name this server gave, and a
-    // browser that sends one has its preflight refused rather than its value
-    // quietly dropped. Adding it to `allow_headers` would make the guide wrong,
-    // which is why this reads that list too.
-    let allowed = response.headers()["access-control-allow-headers"]
-        .to_str()
-        .unwrap()
-        .to_ascii_lowercase();
-    assert!(
-        !allowed.split(',').any(|name| name.trim() == "x-request-id"),
-        "a caller has no business sending this one: {allowed}"
-    );
-}
-
-/// A browser opening a share link is handed the web client, which plays the
-/// share; every other caller keeps the JSON it always had (RFC-020
-/// decision 3).
-///
-/// `/share/{token}` answered JSON to everyone, so the person a link was sent to
-/// saw a document of identifiers where a player should have been. And handing
-/// out the page costs no visit: a link preview fetching it to draw a card has
-/// not listened to anything, and a cap must not be spent on one.
-#[tokio::test]
-async fn a_browser_opening_a_share_link_is_handed_the_player() {
-    let (_temp, config, state) = test_app().await;
-    let hash = security::hash_password(&uuid::Uuid::new_v4().to_string()).unwrap();
-    let owner = state
-        .db
-        .create_account("page-owner", &hash, AccountRole::User, now_ms())
-        .await
-        .unwrap();
-    let (_library, tracks) =
-        seed_titles(&state, &config, owner, "page-music", 5_000, &["Sent Over"]).await;
-    let share = state
-        .services
-        .create_share(owner, &tracks, Some("For you"), None)
-        .await
-        .unwrap();
-    let url = format!("/share/{}", share.url_token.clone().unwrap());
-    let router = waveflow_server::app(&config, state.clone());
-    let get = |uri: String, accept: Option<&'static str>| {
-        let router = router.clone();
-        async move {
-            let mut request = Request::get(uri);
-            if let Some(accept) = accept {
-                request = request.header("accept", accept);
-            }
-            router
-                .oneshot(request.body(Body::empty()).unwrap())
-                .await
-                .unwrap()
-        }
-    };
-    let content_type = |response: &axum::response::Response| {
-        response.headers()["content-type"]
-            .to_str()
-            .unwrap()
-            .to_owned()
-    };
-
-    // What a browser sends when somebody clicks the link.
-    let navigation = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8";
-    let page = get(url.clone(), Some(navigation)).await;
-    assert_eq!(page.status(), StatusCode::OK);
-    assert!(content_type(&page).starts_with("text/html"));
-    assert_eq!(page.headers()["vary"], "accept");
-    assert_eq!(page.headers()["cache-control"], "no-store");
-    // The share headers of RFC-019, on the page as on everything under
-    // `/share/` — and the web client's own policy, without which the shell's
-    // inline blocks would not run, with framing refused as on every share.
-    assert_eq!(page.headers()["referrer-policy"], "no-referrer");
-    assert_eq!(page.headers()["x-content-type-options"], "nosniff");
-    assert_eq!(page.headers()["x-frame-options"], "DENY");
-    let page_policy = page.headers()["content-security-policy"]
-        .to_str()
-        .unwrap()
-        .to_owned();
-    assert!(
-        page_policy.starts_with("default-src 'self'; script-src 'self'"),
-        "{page_policy}"
-    );
-    assert!(
-        page_policy.ends_with("frame-ancestors 'none'"),
-        "{page_policy}"
-    );
-    let visits = || async { state.services.shares(owner).await.unwrap()[0].visit_count };
-    assert_eq!(visits().await, 0, "handing out the page is not a visit");
-
-    // Nor is a `HEAD`, which is what an uptime monitor or a link previewer
-    // sends, and which names no `Accept` at all. It is answered as the page
-    // is, status included, and the cap is not spent on it.
-    let head = |uri: String| {
-        let router = router.clone();
-        async move {
-            router
-                .oneshot(Request::head(uri).body(Body::empty()).unwrap())
-                .await
-                .unwrap()
-        }
-    };
-    let probed = head(url.clone()).await;
-    assert_eq!(probed.status(), StatusCode::OK);
-    assert!(content_type(&probed).starts_with("text/html"));
-    assert_eq!(
-        head("/share/wfs_nothing-here".into()).await.status(),
-        StatusCode::NOT_FOUND
-    );
-    assert_eq!(visits().await, 0, "a HEAD is not a visit");
-
-    // Everybody else, including a caller that says nothing, keeps the JSON.
-    for accept in [None, Some("*/*"), Some("application/json")] {
-        let document = get(url.clone(), accept).await;
-        assert_eq!(document.status(), StatusCode::OK, "{accept:?}");
-        assert!(
-            content_type(&document).starts_with("application/json"),
-            "{accept:?}"
-        );
-        assert_eq!(document.headers()["vary"], "accept");
-        assert_eq!(
-            document.headers()["content-security-policy"],
-            "frame-ancestors 'none'"
-        );
-        assert_eq!(document.headers()["referrer-policy"], "no-referrer");
-        assert_eq!(document.headers()["x-frame-options"], "DENY");
-    }
-    assert_eq!(visits().await, 3);
-
-    // A link that opens nothing says so in the page, with the status a
-    // missing resource has.
-    let dead = get("/share/wfs_nothing-here".into(), Some(navigation)).await;
-    assert_eq!(dead.status(), StatusCode::NOT_FOUND);
-    assert!(content_type(&dead).starts_with("text/html"));
-    // The rest of the namespace stays the server's, whatever the caller accepts.
-    let below = get(format!("{url}/elsewhere"), Some(navigation)).await;
-    assert_eq!(below.status(), StatusCode::NOT_FOUND);
-    assert!(!content_type(&below).starts_with("text/html"));
-}
-
-/// RFC-023 decision 3: `/reference` names no host but this one. The page loads
-/// the Scalar bundle the binary carries, at a versioned address, under a policy
-/// that admits scripts and connections from this origin only.
-#[tokio::test]
-async fn the_api_reference_is_served_from_the_binary() {
-    use http_body_util::BodyExt;
-
-    let (_temp, config, state) = test_app().await;
-    let router = waveflow_server::app(&config, state);
-    let get = |uri: &'static str, encoding: Option<&'static str>| {
-        let router = router.clone();
-        async move {
-            let mut request = Request::get(uri);
-            if let Some(encoding) = encoding {
-                request = request.header("accept-encoding", encoding);
-            }
-            router
-                .oneshot(request.body(Body::empty()).unwrap())
-                .await
-                .unwrap()
-        }
-    };
-
-    let page = get("/reference", None).await;
-    assert_eq!(page.status(), StatusCode::OK);
-    let policy = page.headers()["content-security-policy"]
-        .to_str()
-        .unwrap()
-        .to_owned();
-    for directive in [
-        "default-src 'none'",
-        "script-src 'self';",
-        "connect-src 'self';",
-        "frame-ancestors 'self'",
-    ] {
-        assert!(policy.contains(directive), "{directive} in {policy}");
-    }
-    assert!(!policy.contains("unsafe-eval"), "{policy}");
-    assert_eq!(page.headers()["x-content-type-options"], "nosniff");
-    let html = body_text(page).await;
-    assert!(
-        html.contains(&format!(
-            "<script src=\"{}\"></script>",
-            waveflow_server::reference::SCALAR_SCRIPT_PATH
-        )),
-        "{html}"
-    );
-    assert!(!html.contains("jsdelivr"), "no CDN");
-    assert_eq!(html.matches("<script src=").count(), 1, "one script, ours");
-    assert!(
-        html.contains("/api/v2/auth/login"),
-        "the document is in the page"
-    );
-
-    // Stored compressed and sent as stored to whoever takes gzip…
-    let script = get(
-        waveflow_server::reference::SCALAR_SCRIPT_PATH,
-        Some("gzip, br"),
-    )
-    .await;
-    assert_eq!(script.status(), StatusCode::OK);
-    assert_eq!(script.headers()["content-encoding"], "gzip");
-    assert!(script.headers()["content-type"]
-        .to_str()
-        .unwrap()
-        .starts_with("text/javascript"));
-    assert!(script.headers()["cache-control"]
-        .to_str()
-        .unwrap()
-        .contains("immutable"));
-    // …and decompressed for a client that takes none.
-    let plain = get(waveflow_server::reference::SCALAR_SCRIPT_PATH, None).await;
-    assert!(plain.headers().get("content-encoding").is_none());
-    let bytes = plain.into_body().collect().await.unwrap().to_bytes();
-    assert_eq!(bytes, waveflow_server::reference::decompressed().unwrap());
-}
diff --git a/tests/service/lifecycle.rs b/tests/service/lifecycle.rs
new file mode 100644
index 00000000..6bbf0d28
--- /dev/null
+++ b/tests/service/lifecycle.rs
@@ -0,0 +1,134 @@
+//! The backup bundle, and a refused boot that gives the database back.
+
+use super::*;
+
+#[tokio::test]
+async fn sqlite_and_instance_key_backup_restore_as_one_consistent_bundle() {
+    let (_temp, config, state) = test_app().await;
+    let password = "backup-web-password";
+    let user = state
+        .db
+        .create_account(
+            "backup-admin",
+            &security::hash_password(password).unwrap(),
+            AccountRole::Admin,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let encrypted = state.secret_box.encrypt(b"backup-subsonic-secret").unwrap();
+    state
+        .db
+        .set_subsonic_credential(
+            user,
+            user,
+            &encrypted,
+            &security::token_hash("wfsk_backup"),
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let bundle = config.data_dir.with_file_name("backup-bundle");
+    std::fs::create_dir_all(&bundle).unwrap();
+    state
+        .db
+        .backup_to(&bundle.join("waveflow.db"))
+        .await
+        .unwrap();
+    std::fs::copy(&config.instance_key_path, bundle.join("instance.key")).unwrap();
+    assert!(
+        waveflow_server::storage::database::Database::check_file(&bundle.join("waveflow.db"))
+            .await
+            .unwrap()
+    );
+    state.db.pool().close().await;
+    drop(state);
+
+    let mismatched_bundle = config.data_dir.with_file_name("mismatched-backup-bundle");
+    std::fs::create_dir_all(&mismatched_bundle).unwrap();
+    std::fs::copy(
+        bundle.join("waveflow.db"),
+        mismatched_bundle.join("waveflow.db"),
+    )
+    .unwrap();
+    std::fs::write(mismatched_bundle.join("instance.key"), [9u8; 32]).unwrap();
+    let database_before = std::fs::read(&config.database_path).unwrap();
+    let key_before = std::fs::read(&config.instance_key_path).unwrap();
+    let error = waveflow_server::cli::restore(
+        &config,
+        waveflow_server::cli::RestoreArgs {
+            input: mismatched_bundle,
+        },
+    )
+    .await
+    .unwrap_err();
+    assert!(error.to_string().contains("do not match"));
+    assert_eq!(
+        std::fs::read(&config.database_path).unwrap(),
+        database_before
+    );
+    assert_eq!(
+        std::fs::read(&config.instance_key_path).unwrap(),
+        key_before
+    );
+
+    waveflow_server::cli::restore(
+        &config,
+        waveflow_server::cli::RestoreArgs {
+            input: bundle.clone(),
+        },
+    )
+    .await
+    .unwrap();
+    let restored = waveflow_server::initialize(&config).await.unwrap();
+    let credential = restored
+        .services
+        .credential_by_username("backup-admin")
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(
+        restored
+            .services
+            .decrypt_subsonic_password(&credential)
+            .unwrap(),
+        b"backup-subsonic-secret"
+    );
+    assert!(restored.db.integrity_check().await.unwrap());
+}
+
+/// A boot that is refused closes the database before it says so.
+///
+/// Dropping a pool is not closing it: sqlx closes each connection on its own
+/// thread after the drop has returned, and the last of them checkpoints the
+/// WAL under an exclusive lock. A refusal that only dropped left whoever opens
+/// the file next — the operator retrying, or a test right after the refusal —
+/// racing that close, and losing it as `database is locked`. A zero
+/// `busy_timeout` makes the next open fail rather than wait, so a lock still
+/// held is seen however briefly it lasts.
+#[tokio::test]
+async fn a_refused_boot_gives_the_database_back_before_it_returns() {
+    let (_temp, config, state) = test_app().await;
+    state.db.pool().close().await;
+    drop(state);
+    std::fs::write(&config.instance_key_path, [7u8; 32]).unwrap();
+    let mut impatient = config.clone();
+    impatient.sqlite_busy_timeout = std::time::Duration::ZERO;
+
+    for attempt in 0..30 {
+        let refusal = match waveflow_server::initialize(&config).await {
+            Ok(_) => panic!("a key that is not the database's must stop the boot"),
+            Err(error) => format!("{error:#}"),
+        };
+        assert!(
+            refusal.contains("instance.key does not match"),
+            "attempt {attempt}: refused for another reason: {refusal}"
+        );
+        let next = waveflow_server::storage::database::Database::open(&impatient)
+            .await
+            .unwrap_or_else(|error| {
+                panic!("attempt {attempt}: the refused boot still held the database: {error}")
+            });
+        next.pool().close().await;
+    }
+}
diff --git a/tests/service/main.rs b/tests/service/main.rs
new file mode 100644
index 00000000..00e993ad
--- /dev/null
+++ b/tests/service/main.rs
@@ -0,0 +1,22 @@
+//! Probes, the embedded client, the backup bundle, and how a request is named.
+//!
+//! Split out of `v2_foundations.rs`; the command-line tests left for `cli/`.
+
+use axum::body::Body;
+use axum::http::Request;
+use axum::http::StatusCode;
+use tower::ServiceExt;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
+use waveflow_server::storage::database::AccountRole;
+
+// Not every target uses every fixture, and a shared module is not dead
+// code for being partly unused here.
+#[allow(dead_code)]
+#[path = "../support/mod.rs"]
+mod support;
+use support::*;
+
+mod lifecycle;
+mod probes;
+mod web;
diff --git a/tests/service/probes.rs b/tests/service/probes.rs
new file mode 100644
index 00000000..59828cfc
--- /dev/null
+++ b/tests/service/probes.rs
@@ -0,0 +1,434 @@
+//! The probes, the OpenAPI document and the reference page, and the request id
+//! the server mints for every request.
+
+use super::*;
+
+#[tokio::test]
+async fn probes_and_openapi_are_available_without_scan_readiness() {
+    let (_temp, mut config, state) = test_app().await;
+    config.allowed_origins = vec!["http://127.0.0.1:9180".parse().unwrap()];
+    let router = waveflow_server::app(&config, state);
+
+    let health = router
+        .clone()
+        .oneshot(Request::get("/health").body(Body::empty()).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(health.status(), StatusCode::OK);
+    assert_eq!(json_body(health).await["schema"], 2);
+
+    let ready = router
+        .clone()
+        .oneshot(Request::get("/ready").body(Body::empty()).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(ready.status(), StatusCode::OK);
+    assert_eq!(json_body(ready).await["database"], "ok");
+
+    let cors = router
+        .clone()
+        .oneshot(
+            Request::get("/health")
+                .header("origin", "http://127.0.0.1:9180")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(
+        cors.headers()["access-control-allow-origin"],
+        "http://127.0.0.1:9180"
+    );
+    let rejected = router
+        .clone()
+        .oneshot(
+            Request::get("/health")
+                .header("origin", "https://untrusted.example")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert!(rejected
+        .headers()
+        .get("access-control-allow-origin")
+        .is_none());
+
+    let openapi = router
+        .oneshot(Request::get("/openapi.json").body(Body::empty()).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(openapi.status(), StatusCode::OK);
+    let document = json_body(openapi).await;
+    assert!(document["paths"]["/api/v2/auth/login"].is_object());
+    // RFC-017: both password sign-ins can answer 429, and say when to retry.
+    for path in ["/api/v2/auth/login", "/api/v2/web/auth/login"] {
+        let throttled = &document["paths"][path]["post"]["responses"]["429"];
+        assert!(
+            throttled["headers"]["Retry-After"].is_object(),
+            "{path}: {throttled}"
+        );
+    }
+    for path in [
+        "/api/v2/setup",
+        "/api/v2/web/auth/login",
+        "/api/v2/libraries",
+        "/api/v2/admin/users",
+        "/api/v2/sync/snapshot",
+        "/api/v2/sync/changes",
+        "/api/v2/sync/ack",
+        "/api/v2/sync/socket",
+        "/api/v2/transcode/status",
+        "/api/v2/tracks/{track_id}/lyrics",
+        "/api/v2/libraries/{library_id}/uploads",
+        "/api/v2/uploads/{session_id}",
+        "/api/v2/uploads/{session_id}/chunks/{index}",
+        "/api/v2/uploads/{session_id}/commit",
+        "/api/v2/canvas/{canvas_hash}",
+        "/api/v2/tracks/{track_id}/canvas",
+        "/api/v2/tracks/{track_id}/canvas-ticket",
+        "/api/v2/canvas-stream/{ticket}",
+    ] {
+        assert!(document["paths"][path].is_object(), "missing {path}");
+    }
+
+    // A track correction has three states per field — absent, `null`, a value —
+    // and only the schema can tell a generated client that `null` is one of
+    // them. A required field would forbid the absent state; a type without
+    // `null` would forbid the removal. Either loses #177 in translation.
+    let correction = &document["components"]["schemas"]["TrackMetadataPatch"];
+    assert!(
+        correction.get("required").is_none(),
+        "no field of a partial patch may be required"
+    );
+    for field in [
+        "title",
+        "sort_title",
+        "year",
+        "track_number",
+        "disc_number",
+        "musicbrainz_recording_id",
+        "comment",
+        "artists",
+        "genres",
+    ] {
+        assert!(
+            correction["properties"][field]["type"]
+                .as_array()
+                .is_some_and(|types| types.iter().any(|kind| kind == "null")),
+            "{field} must admit null"
+        );
+    }
+
+    // A client generated from this document alone must authenticate correctly
+    // and keep replay safety. Neither is inferable from the paths.
+    assert_eq!(
+        document["components"]["securitySchemes"]["bearer"]["scheme"],
+        "bearer"
+    );
+    assert_eq!(
+        document["security"][0]["bearer"].as_array().map(Vec::len),
+        Some(0)
+    );
+
+    // Endpoints carrying their own credential, or none, must opt out of the
+    // global requirement — otherwise the document claims a token is needed to
+    // log in, and that the stream ticket is not itself the credential.
+    for (path, method) in [
+        ("/health", "get"),
+        ("/api/v2/auth/login", "post"),
+        ("/api/v2/oauth/token", "post"),
+        ("/api/v2/stream/{ticket}", "get"),
+        ("/api/v2/canvas-stream/{ticket}", "get"),
+    ] {
+        assert_eq!(
+            document["paths"][path][method]["security"]
+                .as_array()
+                .map(Vec::len),
+            Some(0),
+            "{method} {path} should be documented as public"
+        );
+    }
+
+    // The two mutation headers are what the native API offers over the Subsonic
+    // facade; a document that omits them yields clients that never replay
+    // safely.
+    let headers = document["paths"]["/api/v2/scrobbles"]["post"]["parameters"]
+        .as_array()
+        .map(|parameters| {
+            parameters
+                .iter()
+                .filter_map(|parameter| parameter["name"].as_str().map(str::to_owned))
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default();
+    assert!(
+        headers.iter().any(|name| name == "x-waveflow-operation-id"),
+        "scrobbles should document the operation id header, got {headers:?}"
+    );
+    assert!(
+        headers.iter().any(|name| name == "x-waveflow-device-id"),
+        "scrobbles should document the device id header, got {headers:?}"
+    );
+    // Every user-data write can fail on a replayed operation id, so the 409 is
+    // part of their contract — a client that only handles 2xx/4xx generically
+    // would retry it forever.
+    assert!(document["paths"]["/api/v2/scrobbles"]["post"]["responses"]["409"].is_object());
+    // And the sync read has its own 409, with a different code and a different
+    // recovery. Documenting one without the other would be worse than neither.
+    assert!(document["paths"]["/api/v2/sync/changes"]["get"]["responses"]["409"].is_object());
+
+    // Reads carry no operation id: annotating them would tell a generator to
+    // send headers the handler never looks at.
+    let read_parameters = document["paths"]["/api/v2/favorites"]["get"]["parameters"]
+        .as_array()
+        .map(|parameters| {
+            parameters
+                .iter()
+                .filter_map(|parameter| parameter["name"].as_str().map(str::to_owned))
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default();
+    assert!(
+        !read_parameters
+            .iter()
+            .any(|name| name.starts_with("x-waveflow-")),
+        "a read should not advertise mutation headers, got {read_parameters:?}"
+    );
+}
+
+/// A request is named by this server, whatever the caller proposed.
+///
+/// The name goes in every `http_request` span, and `CLAUDE.md` allows no header
+/// into a trace sink. A well-formed id is no safer than a malformed one for
+/// that purpose — reuse somebody else's and the trace record stops telling two
+/// callers apart — so the header is dropped on the way in and one is minted
+/// here, whatever arrived.
+///
+/// The round trip below is the only way to see which id the server actually
+/// used: `PropagateRequestIdLayer` puts it on the response, which is also what
+/// keeps correlation possible — an upstream records the name it was given.
+#[tokio::test]
+async fn a_caller_cannot_name_its_own_request() {
+    let (_temp, config, state) = test_app().await;
+    let router = waveflow_server::app(&config, state.clone());
+    let named = |value: Option<&str>| {
+        let router = router.clone();
+        let value = value.map(str::to_owned);
+        async move {
+            let mut request = Request::get("/health");
+            if let Some(value) = value.as_deref() {
+                request = request.header("x-request-id", value);
+            }
+            // Named rather than `unwrap`ed because every value below has to
+            // reach the router for its case to mean anything, and one of them
+            // is not ASCII. `http` accepts it: a header value may hold any byte
+            // from 0x20 up except 0x7f, so `café` builds — it is `to_str`, on
+            // the way back, that would refuse it, which is why the answer is
+            // read as bytes further down.
+            let request = request
+                .body(Body::empty())
+                .expect("every proposed id has to reach the router");
+            let response = router.oneshot(request).await.unwrap();
+            // Read as bytes, not as `&str`. A `HeaderValue` may hold any byte
+            // above 0x1f, `to_str` refuses the ones above 0x7f, and the point
+            // of the non-ASCII case below is that such a value is not kept — so
+            // reading it that way would panic instead of failing the assertion
+            // that says so, and only when the drop is removed. A test that
+            // crashes rather than fails proves nothing about the reason.
+            response
+                .headers()
+                .get("x-request-id")
+                .map(|value| value.as_bytes().to_vec())
+        }
+    };
+
+    // Every request carries one, minted here, when the caller offered nothing.
+    let unprompted = named(None).await.expect("a request is always named");
+    assert!(uuid::Uuid::parse_str(&String::from_utf8_lossy(&unprompted)).is_ok());
+
+    for proposed in [
+        // The case a shape check would have let through, and the reason there
+        // is no shape check: an id belonging to another caller's requests.
+        "550e8400-e29b-41d4-a716-446655440000",
+        // The one a proxy would plausibly mint, and equally not kept.
+        "01JD5X-trace_id.7f",
+        // Unbounded length.
+        "x".repeat(65).as_str(),
+        // A space, which reads as two fields wherever a trace is parsed.
+        "two words",
+        // Punctuation an identifier has no use for.
+        "id;drop",
+        // Non-ASCII, which a sink may re-encode.
+        "identifiant-café",
+        // Nothing at all, which would name a request the empty string.
+        "",
+    ] {
+        let answered = named(Some(proposed))
+            .await
+            .expect("a request is named even when the caller proposed nothing usable");
+        let shown = String::from_utf8_lossy(&answered);
+        assert_ne!(
+            answered.as_slice(),
+            proposed.as_bytes(),
+            "the server adopted a name the caller chose: {shown}"
+        );
+        // And what replaced it is a minted id, not an edited version of what
+        // arrived: a sanitiser would still be letting the caller choose most
+        // of it.
+        assert!(
+            uuid::Uuid::parse_str(&shown).is_ok(),
+            "the name a request carries is one this server minted, and was: {shown}"
+        );
+        assert_ne!(
+            answered, unprompted,
+            "each request is named once, not named the same thing twice"
+        );
+    }
+
+    // A browser reading a cross-origin response sees only the headers CORS
+    // exposes, so the id being on the response is not the same as the client
+    // being able to quote it. The API guide says it can; this is what makes
+    // that true.
+    let mut cors_config = config.clone();
+    cors_config.allowed_origins = vec!["http://127.0.0.1:9180".parse().unwrap()];
+    let cors_router = waveflow_server::app(&cors_config, state);
+    let response = cors_router
+        .clone()
+        .oneshot(
+            Request::get("/health")
+                .header("origin", "http://127.0.0.1:9180")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    let exposed = response.headers()["access-control-expose-headers"]
+        .to_str()
+        .unwrap()
+        .to_ascii_lowercase();
+    assert!(
+        exposed.split(',').any(|name| name.trim() == "x-request-id"),
+        "a browser client cannot read an id it is not allowed to see: {exposed}"
+    );
+
+    // And a preflight is a response too. `CorsLayer` answers one itself without
+    // calling the service beneath it, so for as long as the request-id layers
+    // sat inside it this was the one request nobody could name — and an origin
+    // this server rejects is precisely what an operator needs to find in a log.
+    let response = cors_router
+        .oneshot(
+            Request::builder()
+                .method(axum::http::Method::OPTIONS)
+                .uri("/api/v2/albums")
+                .header("origin", "http://127.0.0.1:9180")
+                .header("access-control-request-method", "GET")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    let named = response
+        .headers()
+        .get("x-request-id")
+        .map(|value| String::from_utf8_lossy(value.as_bytes()).into_owned())
+        .expect("a preflight is answered by this server, so it is named by it");
+    assert!(
+        uuid::Uuid::parse_str(&named).is_ok(),
+        "a preflight carries a minted id like any other response, and carried: {named}"
+    );
+
+    // Exposed on the way out and not allowed on the way in, which is the pair
+    // the guide describes: a browser may read the name this server gave, and a
+    // browser that sends one has its preflight refused rather than its value
+    // quietly dropped. Adding it to `allow_headers` would make the guide wrong,
+    // which is why this reads that list too.
+    let allowed = response.headers()["access-control-allow-headers"]
+        .to_str()
+        .unwrap()
+        .to_ascii_lowercase();
+    assert!(
+        !allowed.split(',').any(|name| name.trim() == "x-request-id"),
+        "a caller has no business sending this one: {allowed}"
+    );
+}
+
+/// RFC-023 decision 3: `/reference` names no host but this one. The page loads
+/// the Scalar bundle the binary carries, at a versioned address, under a policy
+/// that admits scripts and connections from this origin only.
+#[tokio::test]
+async fn the_api_reference_is_served_from_the_binary() {
+    use http_body_util::BodyExt;
+
+    let (_temp, config, state) = test_app().await;
+    let router = waveflow_server::app(&config, state);
+    let get = |uri: &'static str, encoding: Option<&'static str>| {
+        let router = router.clone();
+        async move {
+            let mut request = Request::get(uri);
+            if let Some(encoding) = encoding {
+                request = request.header("accept-encoding", encoding);
+            }
+            router
+                .oneshot(request.body(Body::empty()).unwrap())
+                .await
+                .unwrap()
+        }
+    };
+
+    let page = get("/reference", None).await;
+    assert_eq!(page.status(), StatusCode::OK);
+    let policy = page.headers()["content-security-policy"]
+        .to_str()
+        .unwrap()
+        .to_owned();
+    for directive in [
+        "default-src 'none'",
+        "script-src 'self';",
+        "connect-src 'self';",
+        "frame-ancestors 'self'",
+    ] {
+        assert!(policy.contains(directive), "{directive} in {policy}");
+    }
+    assert!(!policy.contains("unsafe-eval"), "{policy}");
+    assert_eq!(page.headers()["x-content-type-options"], "nosniff");
+    let html = body_text(page).await;
+    assert!(
+        html.contains(&format!(
+            "<script src=\"{}\"></script>",
+            waveflow_server::http::reference::SCALAR_SCRIPT_PATH
+        )),
+        "{html}"
+    );
+    assert!(!html.contains("jsdelivr"), "no CDN");
+    assert_eq!(html.matches("<script src=").count(), 1, "one script, ours");
+    assert!(
+        html.contains("/api/v2/auth/login"),
+        "the document is in the page"
+    );
+
+    // Stored compressed and sent as stored to whoever takes gzip…
+    let script = get(
+        waveflow_server::http::reference::SCALAR_SCRIPT_PATH,
+        Some("gzip, br"),
+    )
+    .await;
+    assert_eq!(script.status(), StatusCode::OK);
+    assert_eq!(script.headers()["content-encoding"], "gzip");
+    assert!(script.headers()["content-type"]
+        .to_str()
+        .unwrap()
+        .starts_with("text/javascript"));
+    assert!(script.headers()["cache-control"]
+        .to_str()
+        .unwrap()
+        .contains("immutable"));
+    // …and decompressed for a client that takes none.
+    let plain = get(waveflow_server::http::reference::SCALAR_SCRIPT_PATH, None).await;
+    assert!(plain.headers().get("content-encoding").is_none());
+    let bytes = plain.into_body().collect().await.unwrap().to_bytes();
+    assert_eq!(
+        bytes,
+        waveflow_server::http::reference::decompressed().unwrap()
+    );
+}
diff --git a/tests/service/web.rs b/tests/service/web.rs
new file mode 100644
index 00000000..c38bd8d8
--- /dev/null
+++ b/tests/service/web.rs
@@ -0,0 +1,457 @@
+//! The embedded web client: its shell, its manifest and icons, the share page
+//! it hands a browser, and the security headers on what it serves.
+
+use super::*;
+
+/// The files that make the client installable, and the brand's images, are
+/// served as themselves, or answered a JSON 404 — never the shell (RFC-022
+/// decision 4).
+///
+/// Which of the two is required depends on what is embedded, and the test
+/// asks the binary rather than the source tree: `build.rs` embeds the real
+/// client when `webapp/dist` holds one and a placeholder page otherwise, and
+/// the shell at `/` says which. With the real client, every install asset must
+/// be served with its own type — a build that dropped one would not be
+/// installable, and accepting a 404 there would let it pass. With the
+/// placeholder, each must be a definitive JSON 404. Neither may ever be
+/// `text/html`, which is what the router fallback gives any path it does not
+/// know, and which a browser reading a manifest fails on without saying why.
+#[tokio::test]
+async fn the_install_manifest_and_icons_are_never_answered_with_the_shell() {
+    let (_temp, config, state) = test_app().await;
+    let router = waveflow_server::app(&config, state);
+    let get = |path: &'static str| {
+        let router = router.clone();
+        async move {
+            router
+                .oneshot(Request::get(path).body(Body::empty()).unwrap())
+                .await
+                .unwrap()
+        }
+    };
+    let shell = body_text(get("/").await).await;
+    // The placeholder's own sentence, in `build.rs`.
+    let built = !shell.contains("The web client is not built");
+
+    for (path, expected) in [
+        ("/manifest.webmanifest", "application/manifest+json"),
+        ("/apple-touch-icon.png", "image/png"),
+        ("/icons/icon-192.png", "image/png"),
+        ("/icons/icon-512.png", "image/png"),
+        ("/icons/maskable-512.png", "image/png"),
+        // The two favicons `index.html` declares, and the logo the sidebar
+        // and the first-load screen draw: all from the logo kit, all images.
+        ("/favicon.ico", "image/x-icon"),
+        ("/favicon.svg", "image/svg+xml"),
+        ("/brand/waveflow-logo-horizontal-color.svg", "image/svg+xml"),
+        ("/brand/waveflow-logo-horizontal-dark.svg", "image/svg+xml"),
+        ("/brand/waveflow-symbol-mint.svg", "image/svg+xml"),
+        // The service worker (RFC-022): a script, never the shell, and never
+        // frozen in a cache, or a deploy could not replace it.
+        ("/sw.js", "javascript"),
+    ] {
+        let response = get(path).await;
+        let status = response.status();
+        let kind = response
+            .headers()
+            .get("content-type")
+            .map(|value| value.to_str().unwrap().to_owned())
+            .unwrap_or_default();
+        assert!(!kind.starts_with("text/html"), "{path} answered the shell");
+        if built {
+            assert_eq!(status, StatusCode::OK, "{path} is missing from the build");
+            if path == "/sw.js" {
+                assert!(kind.contains(expected), "{path}: {kind}");
+                assert_eq!(response.headers()["cache-control"], "no-cache");
+                continue;
+            }
+            assert_eq!(kind, expected, "{path}");
+            if path == "/manifest.webmanifest" {
+                let manifest: serde_json::Value =
+                    serde_json::from_str(&body_text(response).await).unwrap();
+                assert_eq!(manifest["start_url"], "/");
+                assert_eq!(manifest["display"], "standalone");
+                assert!(manifest["icons"]
+                    .as_array()
+                    .is_some_and(|icons| icons.iter().any(|icon| icon["purpose"] == "maskable")));
+                // The brand's Wave green, as the logo kit's own manifest sets
+                // both.
+                assert_eq!(manifest["theme_color"], "#10B981");
+                assert_eq!(manifest["background_color"], "#10B981");
+            }
+        } else {
+            assert_eq!(status, StatusCode::NOT_FOUND, "{path}");
+            assert!(kind.starts_with("application/json"), "{path}");
+        }
+    }
+
+    // A name no build ships is a JSON 404 whatever is embedded: the case that
+    // still tells the asset-only rule from the fallback when a real client is
+    // embedded and every shipped icon exists.
+    for path in ["/icons/not-shipped.png", "/brand/not-shipped.svg"] {
+        let missing = get(path).await;
+        assert_eq!(missing.status(), StatusCode::NOT_FOUND, "{path}");
+        assert!(
+            missing
+                .headers()
+                .get("content-type")
+                .map(|value| value.to_str().unwrap().to_owned())
+                .unwrap_or_default()
+                .starts_with("application/json"),
+            "{path}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn embedded_web_client_serves_shell_without_shadowing_the_api() {
+    let (_temp, config, state) = test_app().await;
+    let router = waveflow_server::app(&config, state);
+
+    let get = |uri: &'static str| {
+        let router = router.clone();
+        async move {
+            router
+                .oneshot(Request::get(uri).body(Body::empty()).unwrap())
+                .await
+                .unwrap()
+        }
+    };
+
+    // The shell is served at the root.
+    let root = get("/").await;
+    assert_eq!(root.status(), StatusCode::OK);
+    assert!(root.headers()["content-type"]
+        .to_str()
+        .unwrap()
+        .starts_with("text/html"));
+    // The shell must never be cached: it is what points at the hashed assets.
+    assert_eq!(root.headers()["cache-control"], "no-cache");
+
+    // Client-side routes resolve to the same shell rather than 404.
+    let deep = get("/albums/some-client-route").await;
+    assert_eq!(deep.status(), StatusCode::OK);
+    assert!(deep.headers()["content-type"]
+        .to_str()
+        .unwrap()
+        .starts_with("text/html"));
+
+    // A route parameter carrying an encoded slash still resolves to the shell.
+    // Genres are the case that raises it — "Rock/Pop" is one tag, and the
+    // client routes it as /genres/Rock%2FPop — so a link to one, shared or
+    // reloaded, must not decode into a two-segment path that matches nothing.
+    let encoded = get("/genres/Rock%2FPop").await;
+    assert_eq!(encoded.status(), StatusCode::OK);
+    assert!(encoded.headers()["content-type"]
+        .to_str()
+        .unwrap()
+        .starts_with("text/html"));
+
+    // An unknown API path stays a JSON 404 instead of silently returning HTML.
+    let missing_api = get("/api/v2/does-not-exist").await;
+    assert_eq!(missing_api.status(), StatusCode::NOT_FOUND);
+    assert_eq!(
+        missing_api.headers()["content-type"]
+            .to_str()
+            .unwrap()
+            .split(';')
+            .next()
+            .unwrap(),
+        "application/json"
+    );
+
+    // The other server namespaces answer as themselves rather than falling
+    // through. /rest keeps its Subsonic contract — HTTP 200 with the failure in
+    // the body — and /share is a plain 404. Neither may return the client shell.
+    let unknown_method = get("/rest/nope").await;
+    assert_eq!(unknown_method.status(), StatusCode::OK);
+    assert!(!unknown_method.headers()["content-type"]
+        .to_str()
+        .unwrap()
+        .starts_with("text/html"));
+    let unknown_method = body_text(unknown_method).await;
+    assert!(unknown_method.starts_with("<subsonic-response"));
+    assert!(unknown_method.contains("status=\"failed\""));
+
+    let unknown_share = get("/share/nope").await;
+    assert_eq!(unknown_share.status(), StatusCode::NOT_FOUND);
+    assert!(!unknown_share
+        .headers()
+        .get("content-type")
+        .map(|value| value.to_str().unwrap().to_owned())
+        .unwrap_or_default()
+        .starts_with("text/html"));
+
+    // An icon request is answered once, or not at all — never with the shell.
+    //
+    // Before a build shipped a `favicon.ico`, the fallback handed the browser
+    // the client page. It cannot decode HTML as an image, learns nothing from
+    // a 200, and asks again: sixty-six requests in fifty-one seconds on a real
+    // session, forty kilobytes of markup spent on a tab icon. The real client
+    // ships the logo kit's icon now, and the placeholder ships none, so the
+    // answer is the icon or a definitive 404 — whichever this binary embeds.
+    //
+    // Stated as what it *is* rather than as what it is not: "not HTML" is also
+    // satisfied by a header that never arrived, so it would pin nothing about
+    // the answer actually given.
+    let built = !body_text(get("/").await)
+        .await
+        .contains("The web client is not built");
+    let icon = get("/favicon.ico").await;
+    let kind = icon
+        .headers()
+        .get("content-type")
+        .map(|value| value.to_str().unwrap().to_owned())
+        .unwrap_or_default();
+    if built {
+        assert_eq!(icon.status(), StatusCode::OK);
+        assert_eq!(kind, "image/x-icon");
+    } else {
+        assert_eq!(icon.status(), StatusCode::NOT_FOUND);
+        assert!(kind.starts_with("application/json"), "{kind}");
+    }
+
+    // A client route that merely starts like a reserved endpoint is not one.
+    let lookalike = get("/reference-guide").await;
+    assert_eq!(lookalike.status(), StatusCode::OK);
+    assert!(lookalike.headers()["content-type"]
+        .to_str()
+        .unwrap()
+        .starts_with("text/html"));
+
+    // Real routes are untouched by the fallback.
+    let health = get("/health").await;
+    assert_eq!(health.status(), StatusCode::OK);
+    assert_eq!(json_body(health).await["status"], "ok");
+}
+
+/// RFC-019 decision 2: the web client and the public shares tell a browser
+/// how far to trust them, and the Subsonic façade, whose wire is frozen, is
+/// left exactly as it was.
+#[tokio::test]
+async fn the_web_client_and_shares_carry_security_headers_and_rest_does_not() {
+    use base64::Engine;
+    use sha2::Digest;
+
+    let (_temp, config, state) = test_app().await;
+    let router = waveflow_server::app(&config, state);
+    let get = |uri: &'static str| {
+        let router = router.clone();
+        async move {
+            router
+                .oneshot(Request::get(uri).body(Body::empty()).unwrap())
+                .await
+                .unwrap()
+        }
+    };
+    let header = |response: &axum::response::Response, name: &str| {
+        response
+            .headers()
+            .get(name)
+            .map(|value| value.to_str().unwrap().to_owned())
+    };
+
+    // The shell, a client route, and a refusal from the fallback alike.
+    for uri in ["/", "/albums/some-client-route", "/icons/not-shipped.png"] {
+        let response = get(uri).await;
+        assert_eq!(
+            header(&response, "x-content-type-options").as_deref(),
+            Some("nosniff"),
+            "{uri}"
+        );
+        // Nothing to another host; not `no-referrer`, which adds nothing to
+        // that and can null the `Origin` the sign-in checks (RFC-019).
+        assert_eq!(
+            header(&response, "referrer-policy").as_deref(),
+            Some("same-origin"),
+            "{uri}"
+        );
+        assert_eq!(
+            header(&response, "x-frame-options").as_deref(),
+            Some("SAMEORIGIN"),
+            "{uri}"
+        );
+        let policy = header(&response, "content-security-policy").expect(uri);
+        assert!(policy.contains("frame-ancestors 'self'"), "{uri}: {policy}");
+        assert!(policy.contains("object-src 'none'"), "{uri}: {policy}");
+        assert!(!policy.contains("unsafe-inline"), "{uri}: {policy}");
+    }
+
+    // Each inline block of the shell actually served is admitted by its own
+    // digest — computed here, apart from the server's parser — and the policy
+    // admits no more of them than the shell holds. With the placeholder shell
+    // CI embeds there are none; with a real client build there are two.
+    let shell = get("/").await;
+    let policy = header(&shell, "content-security-policy").unwrap();
+    let html = body_text(shell).await;
+    let mut inline = 0;
+    for tag in ["script", "style"] {
+        let open = format!("<{tag}>");
+        let close = format!("</{tag}>");
+        for (start, _) in html.match_indices(&open) {
+            let content = &html[start + open.len()..];
+            let content = &content[..content.find(&close).expect("a closed block")];
+            let digest = base64::engine::general_purpose::STANDARD
+                .encode(sha2::Sha256::digest(content.as_bytes()));
+            assert!(
+                policy.contains(&format!("'sha256-{digest}'")),
+                "the inline {tag} is not admitted: {policy}"
+            );
+            inline += 1;
+        }
+    }
+    assert_eq!(policy.matches("'sha256-").count(), inline, "{policy}");
+
+    // A share's token is its path, so nothing may carry it away as a referrer.
+    // A route that matched and found no share answers with the headers too.
+    let share = get("/share/nope").await;
+    assert_eq!(share.status(), StatusCode::NOT_FOUND);
+    assert_eq!(
+        header(&share, "referrer-policy").as_deref(),
+        Some("no-referrer")
+    );
+    assert_eq!(
+        header(&share, "x-content-type-options").as_deref(),
+        Some("nosniff")
+    );
+    assert_eq!(header(&share, "x-frame-options").as_deref(), Some("DENY"));
+    assert_eq!(
+        header(&share, "content-security-policy").as_deref(),
+        Some("frame-ancestors 'none'")
+    );
+
+    // The façade: none of them.
+    let rest = get("/rest/ping").await;
+    for name in [
+        "content-security-policy",
+        "x-content-type-options",
+        "referrer-policy",
+        "x-frame-options",
+    ] {
+        assert_eq!(header(&rest, name), None, "/rest carries {name}");
+    }
+}
+
+/// A browser opening a share link is handed the web client, which plays the
+/// share; every other caller keeps the JSON it always had (RFC-020
+/// decision 3).
+///
+/// `/share/{token}` answered JSON to everyone, so the person a link was sent to
+/// saw a document of identifiers where a player should have been. And handing
+/// out the page costs no visit: a link preview fetching it to draw a card has
+/// not listened to anything, and a cap must not be spent on one.
+#[tokio::test]
+async fn a_browser_opening_a_share_link_is_handed_the_player() {
+    let (_temp, config, state) = test_app().await;
+    let hash = security::hash_password(&uuid::Uuid::new_v4().to_string()).unwrap();
+    let owner = state
+        .db
+        .create_account("page-owner", &hash, AccountRole::User, now_ms())
+        .await
+        .unwrap();
+    let (_library, tracks) =
+        seed_titles(&state, &config, owner, "page-music", 5_000, &["Sent Over"]).await;
+    let share = state
+        .services
+        .create_share(owner, &tracks, Some("For you"), None)
+        .await
+        .unwrap();
+    let url = format!("/share/{}", share.url_token.clone().unwrap());
+    let router = waveflow_server::app(&config, state.clone());
+    let get = |uri: String, accept: Option<&'static str>| {
+        let router = router.clone();
+        async move {
+            let mut request = Request::get(uri);
+            if let Some(accept) = accept {
+                request = request.header("accept", accept);
+            }
+            router
+                .oneshot(request.body(Body::empty()).unwrap())
+                .await
+                .unwrap()
+        }
+    };
+    let content_type = |response: &axum::response::Response| {
+        response.headers()["content-type"]
+            .to_str()
+            .unwrap()
+            .to_owned()
+    };
+
+    // What a browser sends when somebody clicks the link.
+    let navigation = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8";
+    let page = get(url.clone(), Some(navigation)).await;
+    assert_eq!(page.status(), StatusCode::OK);
+    assert!(content_type(&page).starts_with("text/html"));
+    assert_eq!(page.headers()["vary"], "accept");
+    assert_eq!(page.headers()["cache-control"], "no-store");
+    // The share headers of RFC-019, on the page as on everything under
+    // `/share/` — and the web client's own policy, without which the shell's
+    // inline blocks would not run, with framing refused as on every share.
+    assert_eq!(page.headers()["referrer-policy"], "no-referrer");
+    assert_eq!(page.headers()["x-content-type-options"], "nosniff");
+    assert_eq!(page.headers()["x-frame-options"], "DENY");
+    let page_policy = page.headers()["content-security-policy"]
+        .to_str()
+        .unwrap()
+        .to_owned();
+    assert!(
+        page_policy.starts_with("default-src 'self'; script-src 'self'"),
+        "{page_policy}"
+    );
+    assert!(
+        page_policy.ends_with("frame-ancestors 'none'"),
+        "{page_policy}"
+    );
+    let visits = || async { state.services.shares(owner).await.unwrap()[0].visit_count };
+    assert_eq!(visits().await, 0, "handing out the page is not a visit");
+
+    // Nor is a `HEAD`, which is what an uptime monitor or a link previewer
+    // sends, and which names no `Accept` at all. It is answered as the page
+    // is, status included, and the cap is not spent on it.
+    let head = |uri: String| {
+        let router = router.clone();
+        async move {
+            router
+                .oneshot(Request::head(uri).body(Body::empty()).unwrap())
+                .await
+                .unwrap()
+        }
+    };
+    let probed = head(url.clone()).await;
+    assert_eq!(probed.status(), StatusCode::OK);
+    assert!(content_type(&probed).starts_with("text/html"));
+    assert_eq!(
+        head("/share/wfs_nothing-here".into()).await.status(),
+        StatusCode::NOT_FOUND
+    );
+    assert_eq!(visits().await, 0, "a HEAD is not a visit");
+
+    // Everybody else, including a caller that says nothing, keeps the JSON.
+    for accept in [None, Some("*/*"), Some("application/json")] {
+        let document = get(url.clone(), accept).await;
+        assert_eq!(document.status(), StatusCode::OK, "{accept:?}");
+        assert!(
+            content_type(&document).starts_with("application/json"),
+            "{accept:?}"
+        );
+        assert_eq!(document.headers()["vary"], "accept");
+        assert_eq!(
+            document.headers()["content-security-policy"],
+            "frame-ancestors 'none'"
+        );
+        assert_eq!(document.headers()["referrer-policy"], "no-referrer");
+        assert_eq!(document.headers()["x-frame-options"], "DENY");
+    }
+    assert_eq!(visits().await, 3);
+
+    // A link that opens nothing says so in the page, with the status a
+    // missing resource has.
+    let dead = get("/share/wfs_nothing-here".into(), Some(navigation)).await;
+    assert_eq!(dead.status(), StatusCode::NOT_FOUND);
+    assert!(content_type(&dead).starts_with("text/html"));
+    // The rest of the namespace stays the server's, whatever the caller accepts.
+    let below = get(format!("{url}/elsewhere"), Some(navigation)).await;
+    assert_eq!(below.status(), StatusCode::NOT_FOUND);
+    assert!(!content_type(&below).starts_with("text/html"));
+}
diff --git a/tests/smart_playlists.rs b/tests/smart_playlists.rs
index a8178781..dd52156d 100644
--- a/tests/smart_playlists.rs
+++ b/tests/smart_playlists.rs
@@ -5,10 +5,10 @@
 use axum::http::StatusCode;
 use serde_json::json;
 use uuid::Uuid;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::catalog::CatalogTrackInput;
-use waveflow_server::database::{AccountRole, LibraryRole, LibraryVisibility};
-use waveflow_server::security;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
+use waveflow_server::storage::catalog::CatalogTrackInput;
+use waveflow_server::storage::database::{AccountRole, LibraryRole, LibraryVisibility};
 
 #[allow(dead_code)]
 mod support;
diff --git a/tests/subsonic_browse.rs b/tests/subsonic_browse.rs
deleted file mode 100644
index f278a789..00000000
--- a/tests/subsonic_browse.rs
+++ /dev/null
@@ -1,1334 +0,0 @@
-//! Browsing, listing and searching through the facade.
-//!
-//! Split out of `v2_foundations.rs`.
-
-use axum::body::Body;
-use axum::http::Request;
-use axum::http::StatusCode;
-use tower::ServiceExt;
-use uuid::Uuid;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::database::AccountRole;
-use waveflow_server::database::LibraryVisibility;
-use waveflow_server::security;
-use waveflow_server::services::ServiceError;
-
-// Not every target uses every fixture, and a shared module is not dead
-// code for being partly unused here.
-#[allow(dead_code)]
-mod support;
-use support::*;
-
-/// The ten Subsonic album-list modes and their native equivalents resolve
-/// through one SQL implementation, so both surfaces agree by construction and
-/// neither loads the catalogue to sort it.
-#[tokio::test]
-async fn album_discovery_orders_and_filters_in_sql_for_both_surfaces() {
-    let (_temp, config, state) = test_app().await;
-    let password = "correct horse battery staple";
-    let hash = security::hash_password(password).unwrap();
-    let api_key = "wfsk_discovery-key";
-    let owner = state
-        .db
-        .create_account("discovery-owner", &hash, AccountRole::Admin, now_ms())
-        .await
-        .unwrap();
-    state
-        .db
-        .set_subsonic_credential(
-            owner,
-            owner,
-            &state.secret_box.encrypt(b"discovery-secret").unwrap(),
-            &security::token_hash(api_key),
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let music = config.data_dir.join("discovery-music");
-    std::fs::create_dir_all(&music).unwrap();
-    let library = state
-        .db
-        .create_library(
-            owner,
-            "Discovery",
-            &std::fs::canonicalize(&music).unwrap(),
-            LibraryVisibility::Private,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let scan = state
-        .db
-        .create_scan_job(library, Some(owner), "manual")
-        .await
-        .unwrap();
-    state.db.start_scan_job(scan, 5, false).await.unwrap();
-    // "delta moon" is lowercase on purpose: a byte-wise sort would file it after
-    // "Gamma Sun", and album order is documented as case-insensitive.
-    for (index, (title, album, artist, genre, year)) in [
-        ("Tidewater", "Alpha Sea", "Zed Waves", "Rock", 1999),
-        ("Undertow", "Alpha Sea", "Zed Waves", "Rock", 1999),
-        ("Cirrus", "Beta Sky", "Aria Lux", "Jazz; Rock", 2010),
-        ("Corona", "Gamma Sun", "Mono Field", "Jazz", 2024),
-        ("Waning", "delta moon", "Beta Person", "Hip-Hop", 2005),
-    ]
-    .into_iter()
-    .enumerate()
-    {
-        let mut input = browse_input(index + 40, title, album, artist, Some(1), Some(1));
-        input.genre = Some(genre.into());
-        input.year = Some(year);
-        state
-            .db
-            .apply_catalog_track(library, scan, &input, None, false)
-            .await
-            .unwrap();
-    }
-    state.db.finish_scan_job(scan, 0).await.unwrap();
-
-    // Albums created inside one scan share a millisecond, and the tie-break is a
-    // random UUID. Pinning created_at is what makes `newest` assertable at all.
-    for (title, created_at) in [
-        ("Alpha Sea", 1_000_i64),
-        ("Beta Sky", 2_000),
-        ("Gamma Sun", 3_000),
-        ("delta moon", 4_000),
-    ] {
-        sqlx::query("UPDATE album SET created_at = ? WHERE title = ?")
-            .bind(created_at)
-            .bind(title)
-            .execute(state.db.pool())
-            .await
-            .unwrap();
-    }
-
-    let albums = state
-        .services
-        .list_albums(owner, &Default::default())
-        .await
-        .unwrap();
-    let album_id = |title: &str| {
-        albums
-            .iter()
-            .find(|album| album.title == title)
-            .unwrap_or_else(|| panic!("{title} was indexed"))
-            .id
-    };
-
-    state
-        .services
-        .set_rating(owner, "album", album_id("Gamma Sun"), 5)
-        .await
-        .unwrap();
-    state
-        .services
-        .set_rating(owner, "album", album_id("Alpha Sea"), 3)
-        .await
-        .unwrap();
-    state
-        .services
-        .set_star(owner, "album", album_id("Beta Sky"), true)
-        .await
-        .unwrap();
-    let gamma_track = state
-        .services
-        .album(owner, album_id("Gamma Sun"))
-        .await
-        .unwrap()
-        .songs[0]
-        .id;
-    let alpha_track = state
-        .services
-        .album(owner, album_id("Alpha Sea"))
-        .await
-        .unwrap()
-        .songs[0]
-        .id;
-    for time in [1_000_i64, 2_000, 3_000] {
-        state
-            .services
-            .scrobble(owner, gamma_track, true, Some(time))
-            .await
-            .unwrap();
-    }
-    // Played once but most recently: `frequent` and `recent` must not agree.
-    state
-        .services
-        .scrobble(owner, alpha_track, true, Some(9_000))
-        .await
-        .unwrap();
-
-    let router = waveflow_server::app(&config, state.clone());
-    let token = login_token(&router, "discovery-owner", password).await;
-
-    let subsonic_titles = |kind: String| {
-        let router = router.clone();
-        async move {
-            let response = subsonic_json(&router, "getAlbumList2", api_key, &kind).await;
-            response["subsonic-response"]["albumList2"]["album"]
-                .as_array()
-                .unwrap()
-                .iter()
-                .map(|album| album["name"].as_str().unwrap().to_owned())
-                .collect::<Vec<_>>()
-        }
-    };
-    let native_titles = |query: String| {
-        let router = router.clone();
-        let token = token.clone();
-        async move {
-            let response = router
-                .oneshot(
-                    Request::get(format!("/api/v2/albums?{query}"))
-                        .header("authorization", format!("Bearer {token}"))
-                        .body(Body::empty())
-                        .unwrap(),
-                )
-                .await
-                .unwrap();
-            assert_eq!(response.status(), StatusCode::OK, "{query}");
-            json_body(response)
-                .await
-                .as_array()
-                .unwrap()
-                .iter()
-                .map(|album| album["title"].as_str().unwrap().to_owned())
-                .collect::<Vec<_>>()
-        }
-    };
-
-    for (kind, native, expected) in [
-        (
-            "&type=alphabeticalByName&size=500",
-            "sort=alphabeticalByName&limit=500",
-            vec!["Alpha Sea", "Beta Sky", "delta moon", "Gamma Sun"],
-        ),
-        (
-            "&type=alphabeticalByArtist&size=500",
-            "sort=alphabeticalByArtist&limit=500",
-            vec!["Beta Sky", "delta moon", "Gamma Sun", "Alpha Sea"],
-        ),
-        (
-            "&type=newest&size=500",
-            "sort=newest&limit=500",
-            vec!["delta moon", "Gamma Sun", "Beta Sky", "Alpha Sea"],
-        ),
-        (
-            "&type=highest&size=500",
-            "sort=highest&limit=500",
-            vec!["Gamma Sun", "Alpha Sea"],
-        ),
-        (
-            "&type=frequent&size=500",
-            "sort=frequent&limit=500",
-            vec!["Gamma Sun", "Alpha Sea"],
-        ),
-        (
-            "&type=recent&size=500",
-            "sort=recent&limit=500",
-            vec!["Alpha Sea", "Gamma Sun"],
-        ),
-        (
-            "&type=starred&size=500",
-            "sort=starred&limit=500",
-            vec!["Beta Sky"],
-        ),
-        (
-            "&type=byYear&fromYear=2000&toYear=2020&size=500",
-            "sort=byYear&from_year=2000&to_year=2020&limit=500",
-            vec!["delta moon", "Beta Sky"],
-        ),
-        (
-            // A reversed range is how Subsonic asks for descending years.
-            "&type=byYear&fromYear=2020&toYear=2000&size=500",
-            "sort=byYear&from_year=2020&to_year=2000&limit=500",
-            vec!["Beta Sky", "delta moon"],
-        ),
-        (
-            "&type=byGenre&genre=Rock&size=500",
-            "sort=byGenre&genre=Rock&limit=500",
-            vec!["Alpha Sea", "Beta Sky"],
-        ),
-        (
-            // Genre matching is on the canonical form, so punctuation and case
-            // no longer split one genre in two.
-            "&type=byGenre&genre=hip%20hop&size=500",
-            "sort=byGenre&genre=hip+hop&limit=500",
-            vec!["delta moon"],
-        ),
-    ] {
-        assert_eq!(subsonic_titles(kind.into()).await, expected, "{kind}");
-        assert_eq!(native_titles(native.into()).await, expected, "{native}");
-    }
-
-    // `random` draws from the same set as every other ordering. Its page
-    // contents cannot be asserted: SQLite reshuffles per statement, so two
-    // requests are two independent draws and a title may repeat or be missed
-    // across them. What must hold is membership — no ordering may surface an
-    // album the account cannot see.
-    let catalogue = vec!["Alpha Sea", "Beta Sky", "Gamma Sun", "delta moon"];
-    let mut shuffled = subsonic_titles("&type=random&size=500".into()).await;
-    shuffled.sort();
-    assert_eq!(shuffled, catalogue);
-    for offset in [0, 2] {
-        let page = subsonic_titles(format!("&type=random&size=2&offset={offset}")).await;
-        assert!(page.len() <= 2, "offset {offset} returned {page:?}");
-        for title in &page {
-            assert!(
-                catalogue.contains(&title.as_str()),
-                "offset {offset} returned {title}"
-            );
-        }
-    }
-
-    // Paging happens in SQL now; the second page of an ordered list is exact.
-    // Both surfaces are asserted because they reach `page` by different routes:
-    // Subsonic clamps `size` before building it, the native handler maps
-    // `offset`/`limit` straight onto `BrowsePage::new`.
-    assert_eq!(
-        subsonic_titles("&type=alphabeticalByName&size=2&offset=2".into()).await,
-        vec!["delta moon", "Gamma Sun"]
-    );
-    assert_eq!(
-        native_titles("sort=alphabeticalByName&limit=2&offset=2".into()).await,
-        vec!["delta moon", "Gamma Sun"]
-    );
-    assert_eq!(
-        native_titles("sort=newest&limit=1&offset=1".into()).await,
-        vec!["Gamma Sun"]
-    );
-
-    // An empty page is where the two surfaces deliberately diverge. Subsonic
-    // answered `size=0` with an empty container long before this change and
-    // still does, while the native contract is `1 <= limit <= 500` and rejects
-    // the bound like it rejects 501.
-    let empty_page = subsonic_json(&router, "getAlbumList2", api_key, "&type=newest&size=0").await;
-    let empty_page = &empty_page["subsonic-response"]["albumList2"];
-    assert!(empty_page.is_object());
-    assert!(empty_page.get("album").is_none());
-    for query in ["sort=newest&limit=0", "sort=newest&limit=501"] {
-        let out_of_bounds = router
-            .clone()
-            .oneshot(
-                Request::get(format!("/api/v2/albums?{query}"))
-                    .header("authorization", format!("Bearer {token}"))
-                    .body(Body::empty())
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-        assert_eq!(
-            out_of_bounds.status(),
-            StatusCode::UNPROCESSABLE_ENTITY,
-            "{query}"
-        );
-    }
-
-    // An unknown ordering is refused on both surfaces rather than silently
-    // falling back to the default.
-    let rejected = router
-        .clone()
-        .oneshot(
-            Request::get(format!(
-                "/rest/getAlbumList2.view?apiKey={api_key}&v=1.16.1&c=golden&f=json&type=nope"
-            ))
-            .body(Body::empty())
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(
-        json_body(rejected).await["subsonic-response"]["error"]["code"],
-        10
-    );
-    let rejected_native = router
-        .clone()
-        .oneshot(
-            Request::get("/api/v2/albums?sort=nope")
-                .header("authorization", format!("Bearer {token}"))
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(rejected_native.status(), StatusCode::UNPROCESSABLE_ENTITY);
-    // byGenre without a genre would silently drop the filter if it were not
-    // refused, so both surfaces reject it.
-    let missing_genre = router
-        .clone()
-        .oneshot(
-            Request::get("/api/v2/albums?sort=byGenre")
-                .header("authorization", format!("Bearer {token}"))
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(missing_genre.status(), StatusCode::UNPROCESSABLE_ENTITY);
-    let missing_genre_subsonic = router
-        .clone()
-        .oneshot(
-            Request::get(format!(
-                "/rest/getAlbumList2.view?apiKey={api_key}&v=1.16.1&c=golden&f=json&type=byGenre"
-            ))
-            .body(Body::empty())
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(missing_genre_subsonic.status(), StatusCode::OK);
-    assert_eq!(
-        json_body(missing_genre_subsonic).await["subsonic-response"]["error"]["code"],
-        10
-    );
-
-    // songCount and duration describe the album, not the tracks the caller
-    // happened to load. "Tidewater" matches one of Alpha Sea's two tracks.
-    let hit = subsonic_json(&router, "search3", api_key, "&query=Tidewater").await;
-    let matched = &hit["subsonic-response"]["searchResult3"]["album"][0];
-    assert_eq!(matched["name"], "Alpha Sea");
-    assert_eq!(matched["songCount"], 2);
-    assert_eq!(matched["duration"], 240);
-
-    // Genres are counted once per canonical name across every visible library,
-    // on both surfaces.
-    let genres = subsonic_json(&router, "getGenres", api_key, "").await;
-    let genres = genres["subsonic-response"]["genres"]["genre"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .map(|genre| {
-            (
-                genre["value"].as_str().unwrap().to_owned(),
-                genre["songCount"].as_i64().unwrap(),
-                genre["albumCount"].as_i64().unwrap(),
-            )
-        })
-        .collect::<Vec<_>>();
-    assert_eq!(
-        genres,
-        vec![
-            ("Hip-Hop".to_owned(), 1, 1),
-            ("Jazz".to_owned(), 2, 2),
-            ("Rock".to_owned(), 3, 2),
-        ]
-    );
-    let native_genres = router
-        .clone()
-        .oneshot(
-            Request::get("/api/v2/genres")
-                .header("authorization", format!("Bearer {token}"))
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(native_genres.status(), StatusCode::OK);
-    let native_genres = json_body(native_genres).await;
-    assert_eq!(
-        native_genres
-            .as_array()
-            .unwrap()
-            .iter()
-            .map(|genre| (
-                genre["name"].as_str().unwrap().to_owned(),
-                genre["song_count"].as_i64().unwrap(),
-                genre["album_count"].as_i64().unwrap()
-            ))
-            .collect::<Vec<_>>(),
-        vec![
-            ("Hip-Hop".to_owned(), 1, 1),
-            ("Jazz".to_owned(), 2, 2),
-            ("Rock".to_owned(), 3, 2),
-        ]
-    );
-}
-
-/// The browse methods used to resolve through a snapshot of every visible
-/// track. They now ask for what they render, which is only observable as
-/// behaviour at the edges: a foreign id is still not found, an album still
-/// comes back in sleeve order, and the match-all search still pages.
-#[tokio::test]
-async fn browse_methods_read_only_what_they_render() {
-    let (_temp, config, state) = test_app().await;
-    let api_key = "wfsk_browse-key";
-    let hash = security::hash_password("correct horse battery staple").unwrap();
-    let owner = state
-        .db
-        .create_account("browse-owner", &hash, AccountRole::Admin, now_ms())
-        .await
-        .unwrap();
-    state
-        .db
-        .set_subsonic_credential(
-            owner,
-            owner,
-            &state.secret_box.encrypt(b"browse-secret").unwrap(),
-            &security::token_hash(api_key),
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let outsider = state
-        .db
-        .create_account("browse-outsider", &hash, AccountRole::User, now_ms())
-        .await
-        .unwrap();
-
-    let seed = |account: Uuid, name: &'static str, artist: &'static str| {
-        let state = state.clone();
-        let root = config.data_dir.join(name);
-        async move {
-            std::fs::create_dir_all(&root).unwrap();
-            let library = state
-                .db
-                .create_library(
-                    account,
-                    name,
-                    &std::fs::canonicalize(&root).unwrap(),
-                    LibraryVisibility::Private,
-                    now_ms(),
-                )
-                .await
-                .unwrap();
-            let scan = state
-                .db
-                .create_scan_job(library, Some(account), "manual")
-                .await
-                .unwrap();
-            state.db.start_scan_job(scan, 3, false).await.unwrap();
-            // Deliberately out of sleeve order, and titled so that ordering by
-            // title would give a different answer from ordering by track.
-            for (index, (title, track)) in [("Zephyr", 1), ("Anvil", 2), ("Marrow", 3)]
-                .into_iter()
-                .enumerate()
-            {
-                let mut input = browse_input(
-                    500 + index + name.len() * 10,
-                    title,
-                    "Ordered",
-                    artist,
-                    Some(track),
-                    Some(1),
-                );
-                input.relative_path = format!("{name}-{index}.flac");
-                input.quick_hash = format!("{:064x}", index + 51_000 + name.len() * 100);
-                input.full_hash = format!("{:064x}", index + 52_000 + name.len() * 100);
-                state
-                    .db
-                    .apply_catalog_track(library, scan, &input, None, false)
-                    .await
-                    .unwrap();
-            }
-            state
-                .db
-                .consolidate_catalog_derivations(library)
-                .await
-                .unwrap();
-            state.db.finish_scan_job(scan, 0).await.unwrap();
-            library
-        }
-    };
-    let library = seed(owner, "browse-own", "Own Artist").await;
-    seed(outsider, "browse-foreign", "Foreign Artist").await;
-
-    let router = waveflow_server::app(&config, state.clone());
-    let mine = state.services.catalog_snapshot(owner, &[]).await.unwrap();
-    let theirs = state
-        .services
-        .catalog_snapshot(outsider, &[])
-        .await
-        .unwrap();
-
-    // getAlbum asks for one album, and returns it in sleeve order rather than
-    // alphabetically.
-    let album = subsonic_json(
-        &router,
-        "getAlbum",
-        api_key,
-        &format!("&id={}", mine.albums[0].id),
-    )
-    .await;
-    let titles = album["subsonic-response"]["album"]["song"]
-        .as_array()
-        .expect("the album lists its songs")
-        .iter()
-        .map(|song| song["title"].as_str().unwrap_or_default().to_owned())
-        .collect::<Vec<_>>();
-    assert_eq!(titles, vec!["Zephyr", "Anvil", "Marrow"]);
-
-    // A foreign album is not found, indistinguishably from one that does not
-    // exist. This is what the snapshot used to enforce by simply not holding
-    // the row.
-    for (method, id) in [
-        ("getAlbum", theirs.albums[0].id),
-        ("getArtist", theirs.artists[0].artist.id),
-        ("getMusicDirectory", theirs.albums[0].id),
-    ] {
-        let response = subsonic_json(&router, method, api_key, &format!("&id={id}")).await;
-        assert_eq!(
-            response["subsonic-response"]["error"]["code"], 70,
-            "{method} reached another account: {response}"
-        );
-    }
-
-    // getMusicDirectory answers at all three levels, and the album level is the
-    // only one that loads tracks.
-    let folder = subsonic_json(
-        &router,
-        "getMusicDirectory",
-        api_key,
-        &format!("&id={library}"),
-    )
-    .await;
-    assert_eq!(
-        folder["subsonic-response"]["directory"]["child"][0]["name"],
-        "Own Artist"
-    );
-    let artist_dir = subsonic_json(
-        &router,
-        "getMusicDirectory",
-        api_key,
-        &format!("&id={}", mine.artists[0].artist.id),
-    )
-    .await;
-    assert_eq!(
-        artist_dir["subsonic-response"]["directory"]["child"][0]["title"],
-        "Ordered"
-    );
-    let album_dir = subsonic_json(
-        &router,
-        "getMusicDirectory",
-        api_key,
-        &format!("&id={}", mine.albums[0].id),
-    )
-    .await;
-    assert_eq!(
-        album_dir["subsonic-response"]["directory"]["child"]
-            .as_array()
-            .expect("the album directory lists its tracks")
-            .len(),
-        3
-    );
-
-    // getStarred reads the star join rather than the catalogue, and reports one
-    // of each kind.
-    for (entity, id) in [
-        ("artist", mine.artists[0].artist.id),
-        ("album", mine.albums[0].id),
-        ("track", mine.songs[0].id),
-    ] {
-        state
-            .services
-            .set_star(owner, entity, id, true)
-            .await
-            .unwrap();
-    }
-    let starred = subsonic_json(&router, "getStarred2", api_key, "").await;
-    let starred = &starred["subsonic-response"]["starred2"];
-    for field in ["artist", "album", "song"] {
-        assert_eq!(
-            starred[field].as_array().expect(field).len(),
-            1,
-            "{field}: {starred}"
-        );
-    }
-    assert!(starred["song"][0]["starred"].is_string());
-
-    // search3's match-all pages in SQL. Two pages of two cover three songs and
-    // stop, and the third page is empty rather than an error.
-    let page = |offset: usize| {
-        let router = router.clone();
-        async move {
-            let response = subsonic_json(
-                &router,
-                "search3",
-                api_key,
-                &format!(
-                    "&query=%22%22&songCount=2&songOffset={offset}&artistCount=0&albumCount=0"
-                ),
-            )
-            .await;
-            response["subsonic-response"]["searchResult3"]["song"]
-                .as_array()
-                .map(|songs| {
-                    songs
-                        .iter()
-                        .map(|song| song["title"].as_str().unwrap_or_default().to_owned())
-                        .collect::<Vec<_>>()
-                })
-                .unwrap_or_default()
-        }
-    };
-    let first = page(0).await;
-    let second = page(2).await;
-    let third = page(4).await;
-    assert_eq!(first.len(), 2);
-    assert_eq!(second.len(), 1);
-    assert!(third.is_empty());
-    // The pages do not overlap, and between them they are the whole library —
-    // the outsider's tracks are in neither.
-    let mut seen = first;
-    seen.extend(second);
-    seen.sort();
-    assert_eq!(seen, vec!["Anvil", "Marrow", "Zephyr"]);
-}
-
-/// `search3` runs on the FTS5 index rather than filtering a fully materialised
-/// catalogue in memory. That is not a pure refactor — it changes which queries
-/// match — so the trade is pinned here rather than left to a client to discover.
-#[tokio::test]
-async fn subsonic_search_matches_through_the_fts_index() {
-    let (_temp, config, state) = test_app().await;
-    let subsonic_password = "subsonic-secret-123";
-    let api_key = "wfsk_search-key";
-    let admin = state
-        .db
-        .create_account(
-            "search-admin",
-            &security::hash_password("correct horse battery staple").unwrap(),
-            AccountRole::Admin,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let encrypted = state
-        .secret_box
-        .encrypt(subsonic_password.as_bytes())
-        .unwrap();
-    state
-        .db
-        .set_subsonic_credential(
-            admin,
-            admin,
-            &encrypted,
-            &security::token_hash(api_key),
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let music = config.data_dir.join("search-music");
-    std::fs::create_dir_all(&music).unwrap();
-    let root = std::fs::canonicalize(&music).unwrap();
-    let library = state
-        .db
-        .create_library(admin, "Search", &root, LibraryVisibility::Private, now_ms())
-        .await
-        .unwrap();
-    let scan = state
-        .db
-        .create_scan_job(library, Some(admin), "manual")
-        .await
-        .unwrap();
-    state.db.start_scan_job(scan, 3, false).await.unwrap();
-    // One album of three tracks, one of them accented.
-    for (index, title) in ["Echo Chamber", "Écho lointain", "Silent Partner"]
-        .into_iter()
-        .enumerate()
-    {
-        let mut input = catalog_input(index, "Nocturne");
-        input.title = title.to_owned();
-        input.album = Some("Night Sessions".into());
-        input.is_compilation = false;
-        state
-            .db
-            .apply_catalog_track(library, scan, &input, None, false)
-            .await
-            .unwrap();
-    }
-    state.db.finish_scan_job(scan, 0).await.unwrap();
-    let router = waveflow_server::app(&config, state.clone());
-
-    let titles = |result: &serde_json::Value| -> Vec<String> {
-        result["subsonic-response"]["searchResult3"]["song"]
-            .as_array()
-            .map(|songs| {
-                songs
-                    .iter()
-                    .filter_map(|song| song["title"].as_str().map(str::to_owned))
-                    .collect()
-            })
-            .unwrap_or_default()
-    };
-
-    // Whole-word match, as before.
-    let whole = subsonic_json(&router, "search3", api_key, "&query=Echo&songCount=10").await;
-    assert!(titles(&whole).contains(&"Echo Chamber".to_owned()));
-
-    // Search-as-you-type: the trailing term matches as a prefix, so a client
-    // querying on every keystroke keeps getting results.
-    let prefix = subsonic_json(&router, "search3", api_key, "&query=Ech&songCount=10").await;
-    assert!(titles(&prefix).contains(&"Echo Chamber".to_owned()));
-
-    // Gained: the tokenizer folds diacritics, so "echo" now reaches "Écho".
-    // The previous lowercase substring test did not.
-    assert!(titles(&prefix).contains(&"Écho lointain".to_owned()));
-
-    // Given up: matching inside a word. "cho" used to find "Echo Chamber"
-    // through a substring test and no longer does. Documented, not accidental.
-    let infix = subsonic_json(&router, "search3", api_key, "&query=cho&songCount=10").await;
-    assert!(!titles(&infix).contains(&"Echo Chamber".to_owned()));
-
-    // Terms narrow rather than widen.
-    let narrowed = subsonic_json(
-        &router,
-        "search3",
-        api_key,
-        "&query=Echo%20Silent&songCount=10",
-    )
-    .await;
-    assert!(titles(&narrowed).is_empty());
-
-    // An album reports its own size, not how much of it the query hit: two of
-    // the three tracks match "echo", and songCount must still read 3.
-    let album = subsonic_json(
-        &router,
-        "search3",
-        api_key,
-        "&query=Echo&albumCount=10&songCount=0",
-    )
-    .await;
-    let albums = album["subsonic-response"]["searchResult3"]["album"]
-        .as_array()
-        .cloned()
-        .unwrap_or_default();
-    let night = albums
-        .iter()
-        .find(|album| album["name"] == "Night Sessions")
-        .expect("matching album should be returned");
-    assert_eq!(
-        night["songCount"], 3,
-        "songCount must describe the album, not the query"
-    );
-
-    // The documented match-all query still returns the whole catalogue.
-    let all = subsonic_json(
-        &router,
-        "search3",
-        api_key,
-        "&query=%22%22&songCount=500&albumCount=500&artistCount=500",
-    )
-    .await;
-    assert_eq!(titles(&all).len(), 3);
-
-    // Only that literal pair of quotes browses everything. An empty or blank
-    // query names no term, and answers an empty result rather than the
-    // catalogue — as docs/subsonic-compatibility.md says.
-    for blank in ["", "%20%20"] {
-        let none = subsonic_json(
-            &router,
-            "search3",
-            api_key,
-            &format!("&query={blank}&songCount=500&albumCount=500&artistCount=500"),
-        )
-        .await;
-        assert_eq!(none["subsonic-response"]["status"], "ok", "query={blank:?}");
-        assert!(titles(&none).is_empty(), "query={blank:?}");
-        for kind in ["artist", "album"] {
-            assert!(
-                none["subsonic-response"]["searchResult3"][kind]
-                    .as_array()
-                    .is_none_or(Vec::is_empty),
-                "query={blank:?}: {kind}"
-            );
-        }
-    }
-}
-
-#[tokio::test]
-async fn search_pages_each_kind_in_sql_and_bounds_what_one_request_may_name() {
-    let (_temp, config, state) = test_app().await;
-    let router = waveflow_server::app(&config, state.clone());
-    let hash = security::hash_password("correct horse battery staple").unwrap();
-    let owner = state
-        .db
-        .create_account("pager", &hash, AccountRole::Admin, now_ms())
-        .await
-        .unwrap();
-    let encrypted = state
-        .secret_box
-        .encrypt(b"dedicated-subsonic-secret")
-        .unwrap();
-    let api_key = "wfsk_pager-key";
-    state
-        .db
-        .set_subsonic_credential(
-            owner,
-            owner,
-            &encrypted,
-            &security::token_hash(api_key),
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let music = config.data_dir.join("pager-music");
-    std::fs::create_dir_all(&music).unwrap();
-    let library_id = state
-        .db
-        .create_library(
-            owner,
-            "Pager library",
-            &std::fs::canonicalize(&music).unwrap(),
-            LibraryVisibility::Private,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let scan_id = state
-        .db
-        .create_scan_job(library_id, Some(owner), "manual")
-        .await
-        .unwrap();
-    state.db.start_scan_job(scan_id, 5, false).await.unwrap();
-    // One token every kind matches on, so the three pages are exercised by one
-    // query rather than by three that happen not to overlap.
-    for (index, name) in ["Aria", "Bela", "Cyd", "Dara", "Eno"]
-        .into_iter()
-        .enumerate()
-    {
-        let mut input = catalog_input(index, &format!("Nocturne {name}"));
-        input.title = format!("Nocturne {index}");
-        state
-            .db
-            .apply_catalog_track(library_id, scan_id, &input, None, false)
-            .await
-            .unwrap();
-    }
-    state.db.finish_scan_job(scan_id, 0).await.unwrap();
-    // What a real scan does after applying its rows, and what builds the
-    // artist search index this query has to reach.
-    state
-        .db
-        .consolidate_catalog_derivations(library_id)
-        .await
-        .unwrap();
-
-    let paged = subsonic_json(
-        &router,
-        "search3",
-        api_key,
-        "&query=Nocturne&songCount=2&songOffset=1&artistCount=1&artistOffset=2&albumCount=5&albumOffset=1",
-    )
-    .await;
-    let result = &paged["subsonic-response"]["searchResult3"];
-    assert_eq!(
-        result["song"]
-            .as_array()
-            .unwrap()
-            .iter()
-            .map(|song| song["title"].as_str().unwrap())
-            .collect::<Vec<_>>(),
-        vec!["Nocturne 1", "Nocturne 2"],
-        "the song offset has to skip in SQL and still land on the same rows"
-    );
-    assert_eq!(
-        result["artist"]
-            .as_array()
-            .unwrap()
-            .iter()
-            .map(|artist| artist["name"].as_str().unwrap())
-            .collect::<Vec<_>>(),
-        vec!["Nocturne Cyd"],
-        "each kind pages independently, which is what search3 has always allowed"
-    );
-    // Five tracks, one album between them: an offset of one leaves nothing, and
-    // `searchResult3` omits a kind it has no rows for rather than sending `[]`.
-    assert!(result["album"].is_null());
-
-    // A request may not name more identifiers than one request may carry:
-    // each one costs a mutation under the process-wide writer gate.
-    let track_id = state
-        .services
-        .catalog_snapshot(owner, &[])
-        .await
-        .unwrap()
-        .songs[0]
-        .id;
-    let oversized = (0..=waveflow_server::services::MAX_REQUEST_IDENTIFIERS)
-        .map(|_| format!("&id={track_id}"))
-        .collect::<String>();
-    let refused = subsonic_json(&router, "star", api_key, &oversized).await;
-    assert_eq!(refused["subsonic-response"]["status"], "failed");
-    assert_eq!(refused["subsonic-response"]["error"]["code"], 10);
-    // And one below the ceiling still works.
-    let accepted = subsonic_json(&router, "star", api_key, &format!("&id={track_id}")).await;
-    assert_eq!(accepted["subsonic-response"]["status"], "ok");
-
-    // A playlist is bounded on what it holds rather than on what one request
-    // carries, because it grows across many of them.
-    let too_many = vec![track_id; waveflow_server::services::MAX_PLAYLIST_TRACKS + 1];
-    assert!(matches!(
-        state
-            .services
-            .create_playlist(owner, "Oversized", &too_many)
-            .await,
-        Err(ServiceError::Invalid)
-    ));
-}
-
-/// An artist's most played tracks, on both surfaces, from local history alone.
-///
-/// `getTopSongs` answered an empty container because the reference server fills
-/// it from a remote service WaveFlow does not query. `play_event` can answer a
-/// narrower question with the same shape — what *this account* played — and one
-/// service answers it for the native route and the facade both.
-///
-/// Four things are asserted that a discography sorted by anything would also
-/// satisfy, and which pin this to the history instead:
-/// - a track nobody played is absent, rather than last;
-/// - the counting is per account, so a second member's listening moves its own
-///   list and not the owner's;
-/// - a guest track counts for the album's artist, which is what the artist page
-///   lists albums by;
-/// - another artist's heavily played track stays out.
-#[tokio::test]
-async fn an_artists_most_played_comes_from_local_history_on_both_surfaces() {
-    let (_temp, config, state) = test_app().await;
-    let now = now_ms();
-    // Inserted rather than created: `create_account` wants a password hash, and
-    // this account authenticates by API key and bearer token only.
-    let account = |id: Uuid, username: &'static str| {
-        let state = &state;
-        async move {
-            sqlx::query(
-                "INSERT INTO account (id, username, password_hash, role, disabled, created_at, updated_at) \
-                 VALUES (?, ?, 'this-account-never-authenticates', 'admin', 0, ?, ?)",
-            )
-            .bind(id.to_string())
-            .bind(username)
-            .bind(now)
-            .bind(now)
-            .execute(state.db.pool())
-            .await
-            .unwrap();
-        }
-    };
-    let owner = Uuid::new_v4();
-    let listener = Uuid::new_v4();
-    let stranger = Uuid::new_v4();
-    account(owner, "lamp-owner").await;
-    account(listener, "lamp-listener").await;
-    account(stranger, "lamp-stranger").await;
-
-    let api_key = security::generate_token("wfsk_");
-    state
-        .db
-        .set_subsonic_credential(
-            owner,
-            owner,
-            &state.secret_box.encrypt(b"lamp-secret").unwrap(),
-            &security::token_hash(&api_key),
-            now,
-        )
-        .await
-        .unwrap();
-
-    let music = config.data_dir.join("lamp-music");
-    std::fs::create_dir_all(&music).unwrap();
-    let library = state
-        .db
-        .create_library(
-            owner,
-            "Lamp",
-            &std::fs::canonicalize(&music).unwrap(),
-            LibraryVisibility::Private,
-            now,
-        )
-        .await
-        .unwrap();
-    state
-        .db
-        .add_library_member(
-            owner,
-            library,
-            listener,
-            waveflow_server::database::LibraryRole::Listener,
-            now,
-        )
-        .await
-        .unwrap();
-    let scan = state
-        .db
-        .create_scan_job(library, Some(owner), "manual")
-        .await
-        .unwrap();
-    state.db.start_scan_job(scan, 5, false).await.unwrap();
-    for (index, title, album, credited) in [
-        (80, "Lamp Hymn", "Lamp Songs", "Harbour Bells"),
-        (81, "Lamp Echo", "Lamp Songs", "Harbour Bells"),
-        (82, "Lamp Silence", "Lamp Songs", "Harbour Bells"),
-        // Credited to someone else on the file, on an album that is Harbour
-        // Bells': the album-artist half of the question.
-        (83, "Guest Turn", "Lamp Guests", "Visiting Horn"),
-        (84, "Other Tide", "Other Shore", "Rival Keepers"),
-    ] {
-        let mut input = browse_input(index, title, album, credited, Some(1), Some(1));
-        if title == "Guest Turn" {
-            input.album_artist = Some("Harbour Bells".into());
-        }
-        state
-            .db
-            .apply_catalog_track(library, scan, &input, None, false)
-            .await
-            .unwrap();
-    }
-    state
-        .db
-        .consolidate_catalog_derivations(library)
-        .await
-        .unwrap();
-    state.db.finish_scan_job(scan, 0).await.unwrap();
-
-    let songs = state
-        .services
-        .list_songs(owner, &Default::default())
-        .await
-        .unwrap();
-    let track = |title: &str| {
-        songs
-            .iter()
-            .find(|song| song.title == title)
-            .unwrap_or_else(|| panic!("{title} was indexed"))
-            .id
-    };
-    let artists = state
-        .services
-        .list_artists(owner, None, Default::default())
-        .await
-        .unwrap();
-    let artist = |name: &str| {
-        artists
-            .iter()
-            .find(|summary| summary.artist.name == name)
-            .unwrap_or_else(|| panic!("{name} was indexed"))
-            .artist
-            .id
-    };
-
-    // The history. "Lamp Silence" is played by nobody on purpose, and "Other
-    // Tide" is played more than anything else by another artist.
-    for (user, title, count) in [
-        (owner, "Lamp Hymn", 3),
-        (owner, "Guest Turn", 2),
-        (owner, "Lamp Echo", 1),
-        (owner, "Other Tide", 9),
-        (listener, "Lamp Echo", 4),
-    ] {
-        for _ in 0..count {
-            state
-                .services
-                .scrobble(user, track(title), true, None)
-                .await
-                .unwrap();
-        }
-    }
-    // A play that was never submitted is a now-playing ping, and the
-    // projections count submissions only.
-    state
-        .services
-        .scrobble(owner, track("Lamp Silence"), false, None)
-        .await
-        .unwrap();
-
-    let bells = artist("Harbour Bells");
-    let (_record, owner_token) = state
-        .services
-        .create_api_token(owner, &[], "lamp-owner", "owner reader", &[])
-        .await
-        .unwrap();
-    let (_record, listener_token) = state
-        .services
-        .create_api_token(listener, &[], "lamp-listener", "listener reader", &[])
-        .await
-        .unwrap();
-    let (_record, stranger_token) = state
-        .services
-        .create_api_token(stranger, &[], "lamp-stranger", "stranger reader", &[])
-        .await
-        .unwrap();
-    let router = waveflow_server::app(&config, state);
-
-    let native = |uri: String, token: String| {
-        let router = router.clone();
-        async move {
-            let response = router
-                .oneshot(
-                    Request::get(uri)
-                        .header("authorization", format!("Bearer {token}"))
-                        .body(Body::empty())
-                        .unwrap(),
-                )
-                .await
-                .unwrap();
-            let status = response.status();
-            (status, json_body(response).await)
-        }
-    };
-    let titles_and_counts = |value: &serde_json::Value| {
-        value
-            .as_array()
-            .expect("the route answers a list")
-            .iter()
-            .map(|song| {
-                (
-                    song["title"].as_str().unwrap().to_owned(),
-                    song["play_count"].as_i64().unwrap(),
-                )
-            })
-            .collect::<Vec<_>>()
-    };
-
-    let (status, body) = native(
-        format!("/api/v2/artists/{bells}/top-songs"),
-        owner_token.clone(),
-    )
-    .await;
-    assert_eq!(status, StatusCode::OK);
-    assert_eq!(
-        titles_and_counts(&body),
-        [
-            ("Lamp Hymn".to_owned(), 3),
-            ("Guest Turn".to_owned(), 2),
-            ("Lamp Echo".to_owned(), 1),
-        ],
-        "most played first, the unplayed track absent, and the guest counted"
-    );
-
-    // The same question from the other member of the same library. Same
-    // catalogue, different history, different answer — which is what makes the
-    // list above the owner's rather than the instance's.
-    let (status, body) = native(
-        format!("/api/v2/artists/{bells}/top-songs"),
-        listener_token.clone(),
-    )
-    .await;
-    assert_eq!(status, StatusCode::OK);
-    assert_eq!(
-        titles_and_counts(&body),
-        [("Lamp Echo".to_owned(), 4)],
-        "a second member sees its own listening"
-    );
-
-    let (_status, body) = native(
-        format!("/api/v2/artists/{bells}/top-songs?limit=1"),
-        owner_token.clone(),
-    )
-    .await;
-    assert_eq!(titles_and_counts(&body), [("Lamp Hymn".to_owned(), 3)]);
-
-    // The catalogue's bounds, as every other listing applies them.
-    for limit in ["0", "501"] {
-        let (status, _body) = native(
-            format!("/api/v2/artists/{bells}/top-songs?limit={limit}"),
-            owner_token.clone(),
-        )
-        .await;
-        assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY, "limit={limit}");
-    }
-
-    // An artist nobody can reach, and one that does not exist, answer the same
-    // way: 404 either way, so neither confirms the identifier.
-    let (status, _body) = native(
-        format!("/api/v2/artists/{bells}/top-songs"),
-        stranger_token.clone(),
-    )
-    .await;
-    assert_eq!(status, StatusCode::NOT_FOUND, "a non-member is refused");
-    let (status, _body) = native(
-        format!("/api/v2/artists/{}/top-songs", Uuid::new_v4()),
-        owner_token.clone(),
-    )
-    .await;
-    assert_eq!(status, StatusCode::NOT_FOUND);
-
-    // And the facade, which asks by name.
-    let facade = |extra: String| {
-        let router = router.clone();
-        let api_key = api_key.clone();
-        async move {
-            let body = subsonic_json(&router, "getTopSongs", &api_key, &extra).await;
-            body["subsonic-response"]["topSongs"].clone()
-        }
-    };
-    let facade_titles = |value: &serde_json::Value| {
-        value["song"]
-            .as_array()
-            .map(|songs| {
-                songs
-                    .iter()
-                    .map(|song| song["title"].as_str().unwrap().to_owned())
-                    .collect::<Vec<_>>()
-            })
-            .unwrap_or_default()
-    };
-
-    let answered = facade("&artist=Harbour%20Bells".into()).await;
-    assert_eq!(
-        facade_titles(&answered),
-        ["Lamp Hymn", "Guest Turn", "Lamp Echo"],
-        "the facade answers what the native route does"
-    );
-    assert_eq!(
-        answered["song"][0]["playCount"].as_i64(),
-        Some(3),
-        "and carries the count it ordered by"
-    );
-
-    // Matched on the canonical name, the one folding rule the rest of the
-    // catalogue uses: a client echoing a name back finds the artist whatever
-    // the punctuation and case did on the way.
-    let folded = facade("&artist=harbour---BELLS".into()).await;
-    assert_eq!(
-        facade_titles(&folded),
-        ["Lamp Hymn", "Guest Turn", "Lamp Echo"]
-    );
-
-    let one = facade("&artist=Harbour%20Bells&count=1".into()).await;
-    // Named rather than implied. A single child is the one case that catches
-    // the container collapsing back into an object, and `facade_titles` reads
-    // the shape through `as_array().unwrap_or_default()` — so a regression would
-    // fail on a list of titles and say nothing about the frozen rule it broke.
-    assert!(one["song"].is_array(), "topSongs.song is a list: {one}");
-    assert_eq!(facade_titles(&one), ["Lamp Hymn"], "{one}");
-
-    // A page of nothing is a valid request here, as it is for getAlbumList.
-    let none = facade("&artist=Harbour%20Bells&count=0".into()).await;
-    assert!(none.is_object() && none.get("song").is_none());
-
-    // A name is not an identifier: an unknown one is an empty list, not a
-    // refusal, because nothing about the catalogue is revealed by it.
-    let unknown = facade("&artist=Nobody%20In%20This%20Library".into()).await;
-    assert!(unknown.is_object() && unknown.get("song").is_none());
-
-    // The parameter itself is still required.
-    let bare = subsonic_json(&router, "getTopSongs", &api_key, "").await;
-    assert_eq!(
-        bare["subsonic-response"]["error"]["code"].as_i64(),
-        Some(10),
-        "a missing artist is a malformed request"
-    );
-
-    // The two neighbours this change left empty are filled since RFC-024 by
-    // the catalogue's own neighbours, and are not a history: what they draw
-    // is the artist and its neighbours, not this account's most played.
-    for method in ["getSimilarSongs", "getSimilarSongs2"] {
-        let body = subsonic_json(
-            &router,
-            method,
-            &api_key,
-            &format!("&id={}", track("Lamp Hymn")),
-        )
-        .await;
-        let container = &body["subsonic-response"][match method {
-            "getSimilarSongs" => "similarSongs",
-            _ => "similarSongs2",
-        }];
-        let drawn = container["song"]
-            .as_array()
-            .unwrap_or_else(|| panic!("{method} draws songs: {body}"));
-        assert!(
-            drawn.iter().any(|song| song["title"] == "Lamp Silence"),
-            "{method} draws the artist's unplayed track too: {body}"
-        );
-    }
-}
diff --git a/tests/subsonic_browse/album_lists.rs b/tests/subsonic_browse/album_lists.rs
new file mode 100644
index 00000000..32ae67d5
--- /dev/null
+++ b/tests/subsonic_browse/album_lists.rs
@@ -0,0 +1,428 @@
+//! Album discovery, ordered and filtered in SQL for both surfaces.
+
+use super::*;
+
+/// The ten Subsonic album-list modes and their native equivalents resolve
+/// through one SQL implementation, so both surfaces agree by construction and
+/// neither loads the catalogue to sort it.
+#[tokio::test]
+async fn album_discovery_orders_and_filters_in_sql_for_both_surfaces() {
+    let (_temp, config, state) = test_app().await;
+    let password = "correct horse battery staple";
+    let hash = security::hash_password(password).unwrap();
+    let api_key = "wfsk_discovery-key";
+    let owner = state
+        .db
+        .create_account("discovery-owner", &hash, AccountRole::Admin, now_ms())
+        .await
+        .unwrap();
+    state
+        .db
+        .set_subsonic_credential(
+            owner,
+            owner,
+            &state.secret_box.encrypt(b"discovery-secret").unwrap(),
+            &security::token_hash(api_key),
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let music = config.data_dir.join("discovery-music");
+    std::fs::create_dir_all(&music).unwrap();
+    let library = state
+        .db
+        .create_library(
+            owner,
+            "Discovery",
+            &std::fs::canonicalize(&music).unwrap(),
+            LibraryVisibility::Private,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let scan = state
+        .db
+        .create_scan_job(library, Some(owner), "manual")
+        .await
+        .unwrap();
+    state.db.start_scan_job(scan, 5, false).await.unwrap();
+    // "delta moon" is lowercase on purpose: a byte-wise sort would file it after
+    // "Gamma Sun", and album order is documented as case-insensitive.
+    for (index, (title, album, artist, genre, year)) in [
+        ("Tidewater", "Alpha Sea", "Zed Waves", "Rock", 1999),
+        ("Undertow", "Alpha Sea", "Zed Waves", "Rock", 1999),
+        ("Cirrus", "Beta Sky", "Aria Lux", "Jazz; Rock", 2010),
+        ("Corona", "Gamma Sun", "Mono Field", "Jazz", 2024),
+        ("Waning", "delta moon", "Beta Person", "Hip-Hop", 2005),
+    ]
+    .into_iter()
+    .enumerate()
+    {
+        let mut input = browse_input(index + 40, title, album, artist, Some(1), Some(1));
+        input.genre = Some(genre.into());
+        input.year = Some(year);
+        state
+            .db
+            .apply_catalog_track(library, scan, &input, None, false)
+            .await
+            .unwrap();
+    }
+    state.db.finish_scan_job(scan, 0).await.unwrap();
+
+    // Albums created inside one scan share a millisecond, and the tie-break is a
+    // random UUID. Pinning created_at is what makes `newest` assertable at all.
+    for (title, created_at) in [
+        ("Alpha Sea", 1_000_i64),
+        ("Beta Sky", 2_000),
+        ("Gamma Sun", 3_000),
+        ("delta moon", 4_000),
+    ] {
+        sqlx::query("UPDATE album SET created_at = ? WHERE title = ?")
+            .bind(created_at)
+            .bind(title)
+            .execute(state.db.pool())
+            .await
+            .unwrap();
+    }
+
+    let albums = state
+        .services
+        .list_albums(owner, &Default::default())
+        .await
+        .unwrap();
+    let album_id = |title: &str| {
+        albums
+            .iter()
+            .find(|album| album.title == title)
+            .unwrap_or_else(|| panic!("{title} was indexed"))
+            .id
+    };
+
+    state
+        .services
+        .set_rating(owner, "album", album_id("Gamma Sun"), 5)
+        .await
+        .unwrap();
+    state
+        .services
+        .set_rating(owner, "album", album_id("Alpha Sea"), 3)
+        .await
+        .unwrap();
+    state
+        .services
+        .set_star(owner, "album", album_id("Beta Sky"), true)
+        .await
+        .unwrap();
+    let gamma_track = state
+        .services
+        .album(owner, album_id("Gamma Sun"))
+        .await
+        .unwrap()
+        .songs[0]
+        .id;
+    let alpha_track = state
+        .services
+        .album(owner, album_id("Alpha Sea"))
+        .await
+        .unwrap()
+        .songs[0]
+        .id;
+    for time in [1_000_i64, 2_000, 3_000] {
+        state
+            .services
+            .scrobble(owner, gamma_track, true, Some(time))
+            .await
+            .unwrap();
+    }
+    // Played once but most recently: `frequent` and `recent` must not agree.
+    state
+        .services
+        .scrobble(owner, alpha_track, true, Some(9_000))
+        .await
+        .unwrap();
+
+    let router = waveflow_server::app(&config, state.clone());
+    let token = login_token(&router, "discovery-owner", password).await;
+
+    let subsonic_titles = |kind: String| {
+        let router = router.clone();
+        async move {
+            let response = subsonic_json(&router, "getAlbumList2", api_key, &kind).await;
+            response["subsonic-response"]["albumList2"]["album"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .map(|album| album["name"].as_str().unwrap().to_owned())
+                .collect::<Vec<_>>()
+        }
+    };
+    let native_titles = |query: String| {
+        let router = router.clone();
+        let token = token.clone();
+        async move {
+            let response = router
+                .oneshot(
+                    Request::get(format!("/api/v2/albums?{query}"))
+                        .header("authorization", format!("Bearer {token}"))
+                        .body(Body::empty())
+                        .unwrap(),
+                )
+                .await
+                .unwrap();
+            assert_eq!(response.status(), StatusCode::OK, "{query}");
+            json_body(response)
+                .await
+                .as_array()
+                .unwrap()
+                .iter()
+                .map(|album| album["title"].as_str().unwrap().to_owned())
+                .collect::<Vec<_>>()
+        }
+    };
+
+    for (kind, native, expected) in [
+        (
+            "&type=alphabeticalByName&size=500",
+            "sort=alphabeticalByName&limit=500",
+            vec!["Alpha Sea", "Beta Sky", "delta moon", "Gamma Sun"],
+        ),
+        (
+            "&type=alphabeticalByArtist&size=500",
+            "sort=alphabeticalByArtist&limit=500",
+            vec!["Beta Sky", "delta moon", "Gamma Sun", "Alpha Sea"],
+        ),
+        (
+            "&type=newest&size=500",
+            "sort=newest&limit=500",
+            vec!["delta moon", "Gamma Sun", "Beta Sky", "Alpha Sea"],
+        ),
+        (
+            "&type=highest&size=500",
+            "sort=highest&limit=500",
+            vec!["Gamma Sun", "Alpha Sea"],
+        ),
+        (
+            "&type=frequent&size=500",
+            "sort=frequent&limit=500",
+            vec!["Gamma Sun", "Alpha Sea"],
+        ),
+        (
+            "&type=recent&size=500",
+            "sort=recent&limit=500",
+            vec!["Alpha Sea", "Gamma Sun"],
+        ),
+        (
+            "&type=starred&size=500",
+            "sort=starred&limit=500",
+            vec!["Beta Sky"],
+        ),
+        (
+            "&type=byYear&fromYear=2000&toYear=2020&size=500",
+            "sort=byYear&from_year=2000&to_year=2020&limit=500",
+            vec!["delta moon", "Beta Sky"],
+        ),
+        (
+            // A reversed range is how Subsonic asks for descending years.
+            "&type=byYear&fromYear=2020&toYear=2000&size=500",
+            "sort=byYear&from_year=2020&to_year=2000&limit=500",
+            vec!["Beta Sky", "delta moon"],
+        ),
+        (
+            "&type=byGenre&genre=Rock&size=500",
+            "sort=byGenre&genre=Rock&limit=500",
+            vec!["Alpha Sea", "Beta Sky"],
+        ),
+        (
+            // Genre matching is on the canonical form, so punctuation and case
+            // no longer split one genre in two.
+            "&type=byGenre&genre=hip%20hop&size=500",
+            "sort=byGenre&genre=hip+hop&limit=500",
+            vec!["delta moon"],
+        ),
+    ] {
+        assert_eq!(subsonic_titles(kind.into()).await, expected, "{kind}");
+        assert_eq!(native_titles(native.into()).await, expected, "{native}");
+    }
+
+    // `random` draws from the same set as every other ordering. Its page
+    // contents cannot be asserted: SQLite reshuffles per statement, so two
+    // requests are two independent draws and a title may repeat or be missed
+    // across them. What must hold is membership — no ordering may surface an
+    // album the account cannot see.
+    let catalogue = vec!["Alpha Sea", "Beta Sky", "Gamma Sun", "delta moon"];
+    let mut shuffled = subsonic_titles("&type=random&size=500".into()).await;
+    shuffled.sort();
+    assert_eq!(shuffled, catalogue);
+    for offset in [0, 2] {
+        let page = subsonic_titles(format!("&type=random&size=2&offset={offset}")).await;
+        assert!(page.len() <= 2, "offset {offset} returned {page:?}");
+        for title in &page {
+            assert!(
+                catalogue.contains(&title.as_str()),
+                "offset {offset} returned {title}"
+            );
+        }
+    }
+
+    // Paging happens in SQL now; the second page of an ordered list is exact.
+    // Both surfaces are asserted because they reach `page` by different routes:
+    // Subsonic clamps `size` before building it, the native handler maps
+    // `offset`/`limit` straight onto `BrowsePage::new`.
+    assert_eq!(
+        subsonic_titles("&type=alphabeticalByName&size=2&offset=2".into()).await,
+        vec!["delta moon", "Gamma Sun"]
+    );
+    assert_eq!(
+        native_titles("sort=alphabeticalByName&limit=2&offset=2".into()).await,
+        vec!["delta moon", "Gamma Sun"]
+    );
+    assert_eq!(
+        native_titles("sort=newest&limit=1&offset=1".into()).await,
+        vec!["Gamma Sun"]
+    );
+
+    // An empty page is where the two surfaces deliberately diverge. Subsonic
+    // answered `size=0` with an empty container long before this change and
+    // still does, while the native contract is `1 <= limit <= 500` and rejects
+    // the bound like it rejects 501.
+    let empty_page = subsonic_json(&router, "getAlbumList2", api_key, "&type=newest&size=0").await;
+    let empty_page = &empty_page["subsonic-response"]["albumList2"];
+    assert!(empty_page.is_object());
+    assert!(empty_page.get("album").is_none());
+    for query in ["sort=newest&limit=0", "sort=newest&limit=501"] {
+        let out_of_bounds = router
+            .clone()
+            .oneshot(
+                Request::get(format!("/api/v2/albums?{query}"))
+                    .header("authorization", format!("Bearer {token}"))
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(
+            out_of_bounds.status(),
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "{query}"
+        );
+    }
+
+    // An unknown ordering is refused on both surfaces rather than silently
+    // falling back to the default.
+    let rejected = router
+        .clone()
+        .oneshot(
+            Request::get(format!(
+                "/rest/getAlbumList2.view?apiKey={api_key}&v=1.16.1&c=golden&f=json&type=nope"
+            ))
+            .body(Body::empty())
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(
+        json_body(rejected).await["subsonic-response"]["error"]["code"],
+        10
+    );
+    let rejected_native = router
+        .clone()
+        .oneshot(
+            Request::get("/api/v2/albums?sort=nope")
+                .header("authorization", format!("Bearer {token}"))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(rejected_native.status(), StatusCode::UNPROCESSABLE_ENTITY);
+    // byGenre without a genre would silently drop the filter if it were not
+    // refused, so both surfaces reject it.
+    let missing_genre = router
+        .clone()
+        .oneshot(
+            Request::get("/api/v2/albums?sort=byGenre")
+                .header("authorization", format!("Bearer {token}"))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(missing_genre.status(), StatusCode::UNPROCESSABLE_ENTITY);
+    let missing_genre_subsonic = router
+        .clone()
+        .oneshot(
+            Request::get(format!(
+                "/rest/getAlbumList2.view?apiKey={api_key}&v=1.16.1&c=golden&f=json&type=byGenre"
+            ))
+            .body(Body::empty())
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(missing_genre_subsonic.status(), StatusCode::OK);
+    assert_eq!(
+        json_body(missing_genre_subsonic).await["subsonic-response"]["error"]["code"],
+        10
+    );
+
+    // songCount and duration describe the album, not the tracks the caller
+    // happened to load. "Tidewater" matches one of Alpha Sea's two tracks.
+    let hit = subsonic_json(&router, "search3", api_key, "&query=Tidewater").await;
+    let matched = &hit["subsonic-response"]["searchResult3"]["album"][0];
+    assert_eq!(matched["name"], "Alpha Sea");
+    assert_eq!(matched["songCount"], 2);
+    assert_eq!(matched["duration"], 240);
+
+    // Genres are counted once per canonical name across every visible library,
+    // on both surfaces.
+    let genres = subsonic_json(&router, "getGenres", api_key, "").await;
+    let genres = genres["subsonic-response"]["genres"]["genre"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|genre| {
+            (
+                genre["value"].as_str().unwrap().to_owned(),
+                genre["songCount"].as_i64().unwrap(),
+                genre["albumCount"].as_i64().unwrap(),
+            )
+        })
+        .collect::<Vec<_>>();
+    assert_eq!(
+        genres,
+        vec![
+            ("Hip-Hop".to_owned(), 1, 1),
+            ("Jazz".to_owned(), 2, 2),
+            ("Rock".to_owned(), 3, 2),
+        ]
+    );
+    let native_genres = router
+        .clone()
+        .oneshot(
+            Request::get("/api/v2/genres")
+                .header("authorization", format!("Bearer {token}"))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(native_genres.status(), StatusCode::OK);
+    let native_genres = json_body(native_genres).await;
+    assert_eq!(
+        native_genres
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|genre| (
+                genre["name"].as_str().unwrap().to_owned(),
+                genre["song_count"].as_i64().unwrap(),
+                genre["album_count"].as_i64().unwrap()
+            ))
+            .collect::<Vec<_>>(),
+        vec![
+            ("Hip-Hop".to_owned(), 1, 1),
+            ("Jazz".to_owned(), 2, 2),
+            ("Rock".to_owned(), 3, 2),
+        ]
+    );
+}
diff --git a/tests/subsonic_browse/browse.rs b/tests/subsonic_browse/browse.rs
new file mode 100644
index 00000000..53b9faf8
--- /dev/null
+++ b/tests/subsonic_browse/browse.rs
@@ -0,0 +1,233 @@
+//! The browse methods, reading only what they render.
+
+use super::*;
+
+/// The browse methods used to resolve through a snapshot of every visible
+/// track. They now ask for what they render, which is only observable as
+/// behaviour at the edges: a foreign id is still not found, an album still
+/// comes back in sleeve order, and the match-all search still pages.
+#[tokio::test]
+async fn browse_methods_read_only_what_they_render() {
+    let (_temp, config, state) = test_app().await;
+    let api_key = "wfsk_browse-key";
+    let hash = security::hash_password("correct horse battery staple").unwrap();
+    let owner = state
+        .db
+        .create_account("browse-owner", &hash, AccountRole::Admin, now_ms())
+        .await
+        .unwrap();
+    state
+        .db
+        .set_subsonic_credential(
+            owner,
+            owner,
+            &state.secret_box.encrypt(b"browse-secret").unwrap(),
+            &security::token_hash(api_key),
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let outsider = state
+        .db
+        .create_account("browse-outsider", &hash, AccountRole::User, now_ms())
+        .await
+        .unwrap();
+
+    let seed = |account: Uuid, name: &'static str, artist: &'static str| {
+        let state = state.clone();
+        let root = config.data_dir.join(name);
+        async move {
+            std::fs::create_dir_all(&root).unwrap();
+            let library = state
+                .db
+                .create_library(
+                    account,
+                    name,
+                    &std::fs::canonicalize(&root).unwrap(),
+                    LibraryVisibility::Private,
+                    now_ms(),
+                )
+                .await
+                .unwrap();
+            let scan = state
+                .db
+                .create_scan_job(library, Some(account), "manual")
+                .await
+                .unwrap();
+            state.db.start_scan_job(scan, 3, false).await.unwrap();
+            // Deliberately out of sleeve order, and titled so that ordering by
+            // title would give a different answer from ordering by track.
+            for (index, (title, track)) in [("Zephyr", 1), ("Anvil", 2), ("Marrow", 3)]
+                .into_iter()
+                .enumerate()
+            {
+                let mut input = browse_input(
+                    500 + index + name.len() * 10,
+                    title,
+                    "Ordered",
+                    artist,
+                    Some(track),
+                    Some(1),
+                );
+                input.relative_path = format!("{name}-{index}.flac");
+                input.quick_hash = format!("{:064x}", index + 51_000 + name.len() * 100);
+                input.full_hash = format!("{:064x}", index + 52_000 + name.len() * 100);
+                state
+                    .db
+                    .apply_catalog_track(library, scan, &input, None, false)
+                    .await
+                    .unwrap();
+            }
+            state
+                .db
+                .consolidate_catalog_derivations(library)
+                .await
+                .unwrap();
+            state.db.finish_scan_job(scan, 0).await.unwrap();
+            library
+        }
+    };
+    let library = seed(owner, "browse-own", "Own Artist").await;
+    seed(outsider, "browse-foreign", "Foreign Artist").await;
+
+    let router = waveflow_server::app(&config, state.clone());
+    let mine = state.services.catalog_snapshot(owner, &[]).await.unwrap();
+    let theirs = state
+        .services
+        .catalog_snapshot(outsider, &[])
+        .await
+        .unwrap();
+
+    // getAlbum asks for one album, and returns it in sleeve order rather than
+    // alphabetically.
+    let album = subsonic_json(
+        &router,
+        "getAlbum",
+        api_key,
+        &format!("&id={}", mine.albums[0].id),
+    )
+    .await;
+    let titles = album["subsonic-response"]["album"]["song"]
+        .as_array()
+        .expect("the album lists its songs")
+        .iter()
+        .map(|song| song["title"].as_str().unwrap_or_default().to_owned())
+        .collect::<Vec<_>>();
+    assert_eq!(titles, vec!["Zephyr", "Anvil", "Marrow"]);
+
+    // A foreign album is not found, indistinguishably from one that does not
+    // exist. This is what the snapshot used to enforce by simply not holding
+    // the row.
+    for (method, id) in [
+        ("getAlbum", theirs.albums[0].id),
+        ("getArtist", theirs.artists[0].artist.id),
+        ("getMusicDirectory", theirs.albums[0].id),
+    ] {
+        let response = subsonic_json(&router, method, api_key, &format!("&id={id}")).await;
+        assert_eq!(
+            response["subsonic-response"]["error"]["code"], 70,
+            "{method} reached another account: {response}"
+        );
+    }
+
+    // getMusicDirectory answers at all three levels, and the album level is the
+    // only one that loads tracks.
+    let folder = subsonic_json(
+        &router,
+        "getMusicDirectory",
+        api_key,
+        &format!("&id={library}"),
+    )
+    .await;
+    assert_eq!(
+        folder["subsonic-response"]["directory"]["child"][0]["name"],
+        "Own Artist"
+    );
+    let artist_dir = subsonic_json(
+        &router,
+        "getMusicDirectory",
+        api_key,
+        &format!("&id={}", mine.artists[0].artist.id),
+    )
+    .await;
+    assert_eq!(
+        artist_dir["subsonic-response"]["directory"]["child"][0]["title"],
+        "Ordered"
+    );
+    let album_dir = subsonic_json(
+        &router,
+        "getMusicDirectory",
+        api_key,
+        &format!("&id={}", mine.albums[0].id),
+    )
+    .await;
+    assert_eq!(
+        album_dir["subsonic-response"]["directory"]["child"]
+            .as_array()
+            .expect("the album directory lists its tracks")
+            .len(),
+        3
+    );
+
+    // getStarred reads the star join rather than the catalogue, and reports one
+    // of each kind.
+    for (entity, id) in [
+        ("artist", mine.artists[0].artist.id),
+        ("album", mine.albums[0].id),
+        ("track", mine.songs[0].id),
+    ] {
+        state
+            .services
+            .set_star(owner, entity, id, true)
+            .await
+            .unwrap();
+    }
+    let starred = subsonic_json(&router, "getStarred2", api_key, "").await;
+    let starred = &starred["subsonic-response"]["starred2"];
+    for field in ["artist", "album", "song"] {
+        assert_eq!(
+            starred[field].as_array().expect(field).len(),
+            1,
+            "{field}: {starred}"
+        );
+    }
+    assert!(starred["song"][0]["starred"].is_string());
+
+    // search3's match-all pages in SQL. Two pages of two cover three songs and
+    // stop, and the third page is empty rather than an error.
+    let page = |offset: usize| {
+        let router = router.clone();
+        async move {
+            let response = subsonic_json(
+                &router,
+                "search3",
+                api_key,
+                &format!(
+                    "&query=%22%22&songCount=2&songOffset={offset}&artistCount=0&albumCount=0"
+                ),
+            )
+            .await;
+            response["subsonic-response"]["searchResult3"]["song"]
+                .as_array()
+                .map(|songs| {
+                    songs
+                        .iter()
+                        .map(|song| song["title"].as_str().unwrap_or_default().to_owned())
+                        .collect::<Vec<_>>()
+                })
+                .unwrap_or_default()
+        }
+    };
+    let first = page(0).await;
+    let second = page(2).await;
+    let third = page(4).await;
+    assert_eq!(first.len(), 2);
+    assert_eq!(second.len(), 1);
+    assert!(third.is_empty());
+    // The pages do not overlap, and between them they are the whole library —
+    // the outsider's tracks are in neither.
+    let mut seen = first;
+    seen.extend(second);
+    seen.sort();
+    assert_eq!(seen, vec!["Anvil", "Marrow", "Zephyr"]);
+}
diff --git a/tests/subsonic_browse/main.rs b/tests/subsonic_browse/main.rs
new file mode 100644
index 00000000..601acd8d
--- /dev/null
+++ b/tests/subsonic_browse/main.rs
@@ -0,0 +1,26 @@
+//! Browsing, listing and searching through the facade.
+//!
+//! Split out of `v2_foundations.rs`.
+
+use axum::body::Body;
+use axum::http::Request;
+use axum::http::StatusCode;
+use tower::ServiceExt;
+use uuid::Uuid;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
+use waveflow_server::services::ServiceError;
+use waveflow_server::storage::database::AccountRole;
+use waveflow_server::storage::database::LibraryVisibility;
+
+// Not every target uses every fixture, and a shared module is not dead
+// code for being partly unused here.
+#[allow(dead_code)]
+#[path = "../support/mod.rs"]
+mod support;
+use support::*;
+
+mod album_lists;
+mod browse;
+mod search;
+mod top_songs;
diff --git a/tests/subsonic_browse/search.rs b/tests/subsonic_browse/search.rs
new file mode 100644
index 00000000..df2e8df3
--- /dev/null
+++ b/tests/subsonic_browse/search.rs
@@ -0,0 +1,295 @@
+//! Search through the FTS index, paged per kind in SQL.
+
+use super::*;
+
+/// `search3` runs on the FTS5 index rather than filtering a fully materialised
+/// catalogue in memory. That is not a pure refactor — it changes which queries
+/// match — so the trade is pinned here rather than left to a client to discover.
+#[tokio::test]
+async fn subsonic_search_matches_through_the_fts_index() {
+    let (_temp, config, state) = test_app().await;
+    let subsonic_password = "subsonic-secret-123";
+    let api_key = "wfsk_search-key";
+    let admin = state
+        .db
+        .create_account(
+            "search-admin",
+            &security::hash_password("correct horse battery staple").unwrap(),
+            AccountRole::Admin,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let encrypted = state
+        .secret_box
+        .encrypt(subsonic_password.as_bytes())
+        .unwrap();
+    state
+        .db
+        .set_subsonic_credential(
+            admin,
+            admin,
+            &encrypted,
+            &security::token_hash(api_key),
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let music = config.data_dir.join("search-music");
+    std::fs::create_dir_all(&music).unwrap();
+    let root = std::fs::canonicalize(&music).unwrap();
+    let library = state
+        .db
+        .create_library(admin, "Search", &root, LibraryVisibility::Private, now_ms())
+        .await
+        .unwrap();
+    let scan = state
+        .db
+        .create_scan_job(library, Some(admin), "manual")
+        .await
+        .unwrap();
+    state.db.start_scan_job(scan, 3, false).await.unwrap();
+    // One album of three tracks, one of them accented.
+    for (index, title) in ["Echo Chamber", "Écho lointain", "Silent Partner"]
+        .into_iter()
+        .enumerate()
+    {
+        let mut input = catalog_input(index, "Nocturne");
+        input.title = title.to_owned();
+        input.album = Some("Night Sessions".into());
+        input.is_compilation = false;
+        state
+            .db
+            .apply_catalog_track(library, scan, &input, None, false)
+            .await
+            .unwrap();
+    }
+    state.db.finish_scan_job(scan, 0).await.unwrap();
+    let router = waveflow_server::app(&config, state.clone());
+
+    let titles = |result: &serde_json::Value| -> Vec<String> {
+        result["subsonic-response"]["searchResult3"]["song"]
+            .as_array()
+            .map(|songs| {
+                songs
+                    .iter()
+                    .filter_map(|song| song["title"].as_str().map(str::to_owned))
+                    .collect()
+            })
+            .unwrap_or_default()
+    };
+
+    // Whole-word match, as before.
+    let whole = subsonic_json(&router, "search3", api_key, "&query=Echo&songCount=10").await;
+    assert!(titles(&whole).contains(&"Echo Chamber".to_owned()));
+
+    // Search-as-you-type: the trailing term matches as a prefix, so a client
+    // querying on every keystroke keeps getting results.
+    let prefix = subsonic_json(&router, "search3", api_key, "&query=Ech&songCount=10").await;
+    assert!(titles(&prefix).contains(&"Echo Chamber".to_owned()));
+
+    // Gained: the tokenizer folds diacritics, so "echo" now reaches "Écho".
+    // The previous lowercase substring test did not.
+    assert!(titles(&prefix).contains(&"Écho lointain".to_owned()));
+
+    // Given up: matching inside a word. "cho" used to find "Echo Chamber"
+    // through a substring test and no longer does. Documented, not accidental.
+    let infix = subsonic_json(&router, "search3", api_key, "&query=cho&songCount=10").await;
+    assert!(!titles(&infix).contains(&"Echo Chamber".to_owned()));
+
+    // Terms narrow rather than widen.
+    let narrowed = subsonic_json(
+        &router,
+        "search3",
+        api_key,
+        "&query=Echo%20Silent&songCount=10",
+    )
+    .await;
+    assert!(titles(&narrowed).is_empty());
+
+    // An album reports its own size, not how much of it the query hit: two of
+    // the three tracks match "echo", and songCount must still read 3.
+    let album = subsonic_json(
+        &router,
+        "search3",
+        api_key,
+        "&query=Echo&albumCount=10&songCount=0",
+    )
+    .await;
+    let albums = album["subsonic-response"]["searchResult3"]["album"]
+        .as_array()
+        .cloned()
+        .unwrap_or_default();
+    let night = albums
+        .iter()
+        .find(|album| album["name"] == "Night Sessions")
+        .expect("matching album should be returned");
+    assert_eq!(
+        night["songCount"], 3,
+        "songCount must describe the album, not the query"
+    );
+
+    // The documented match-all query still returns the whole catalogue.
+    let all = subsonic_json(
+        &router,
+        "search3",
+        api_key,
+        "&query=%22%22&songCount=500&albumCount=500&artistCount=500",
+    )
+    .await;
+    assert_eq!(titles(&all).len(), 3);
+
+    // Only that literal pair of quotes browses everything. An empty or blank
+    // query names no term, and answers an empty result rather than the
+    // catalogue — as docs/subsonic-compatibility.md says.
+    for blank in ["", "%20%20"] {
+        let none = subsonic_json(
+            &router,
+            "search3",
+            api_key,
+            &format!("&query={blank}&songCount=500&albumCount=500&artistCount=500"),
+        )
+        .await;
+        assert_eq!(none["subsonic-response"]["status"], "ok", "query={blank:?}");
+        assert!(titles(&none).is_empty(), "query={blank:?}");
+        for kind in ["artist", "album"] {
+            assert!(
+                none["subsonic-response"]["searchResult3"][kind]
+                    .as_array()
+                    .is_none_or(Vec::is_empty),
+                "query={blank:?}: {kind}"
+            );
+        }
+    }
+}
+
+#[tokio::test]
+async fn search_pages_each_kind_in_sql_and_bounds_what_one_request_may_name() {
+    let (_temp, config, state) = test_app().await;
+    let router = waveflow_server::app(&config, state.clone());
+    let hash = security::hash_password("correct horse battery staple").unwrap();
+    let owner = state
+        .db
+        .create_account("pager", &hash, AccountRole::Admin, now_ms())
+        .await
+        .unwrap();
+    let encrypted = state
+        .secret_box
+        .encrypt(b"dedicated-subsonic-secret")
+        .unwrap();
+    let api_key = "wfsk_pager-key";
+    state
+        .db
+        .set_subsonic_credential(
+            owner,
+            owner,
+            &encrypted,
+            &security::token_hash(api_key),
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let music = config.data_dir.join("pager-music");
+    std::fs::create_dir_all(&music).unwrap();
+    let library_id = state
+        .db
+        .create_library(
+            owner,
+            "Pager library",
+            &std::fs::canonicalize(&music).unwrap(),
+            LibraryVisibility::Private,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let scan_id = state
+        .db
+        .create_scan_job(library_id, Some(owner), "manual")
+        .await
+        .unwrap();
+    state.db.start_scan_job(scan_id, 5, false).await.unwrap();
+    // One token every kind matches on, so the three pages are exercised by one
+    // query rather than by three that happen not to overlap.
+    for (index, name) in ["Aria", "Bela", "Cyd", "Dara", "Eno"]
+        .into_iter()
+        .enumerate()
+    {
+        let mut input = catalog_input(index, &format!("Nocturne {name}"));
+        input.title = format!("Nocturne {index}");
+        state
+            .db
+            .apply_catalog_track(library_id, scan_id, &input, None, false)
+            .await
+            .unwrap();
+    }
+    state.db.finish_scan_job(scan_id, 0).await.unwrap();
+    // What a real scan does after applying its rows, and what builds the
+    // artist search index this query has to reach.
+    state
+        .db
+        .consolidate_catalog_derivations(library_id)
+        .await
+        .unwrap();
+
+    let paged = subsonic_json(
+        &router,
+        "search3",
+        api_key,
+        "&query=Nocturne&songCount=2&songOffset=1&artistCount=1&artistOffset=2&albumCount=5&albumOffset=1",
+    )
+    .await;
+    let result = &paged["subsonic-response"]["searchResult3"];
+    assert_eq!(
+        result["song"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|song| song["title"].as_str().unwrap())
+            .collect::<Vec<_>>(),
+        vec!["Nocturne 1", "Nocturne 2"],
+        "the song offset has to skip in SQL and still land on the same rows"
+    );
+    assert_eq!(
+        result["artist"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|artist| artist["name"].as_str().unwrap())
+            .collect::<Vec<_>>(),
+        vec!["Nocturne Cyd"],
+        "each kind pages independently, which is what search3 has always allowed"
+    );
+    // Five tracks, one album between them: an offset of one leaves nothing, and
+    // `searchResult3` omits a kind it has no rows for rather than sending `[]`.
+    assert!(result["album"].is_null());
+
+    // A request may not name more identifiers than one request may carry:
+    // each one costs a mutation under the process-wide writer gate.
+    let track_id = state
+        .services
+        .catalog_snapshot(owner, &[])
+        .await
+        .unwrap()
+        .songs[0]
+        .id;
+    let oversized = (0..=waveflow_server::services::MAX_REQUEST_IDENTIFIERS)
+        .map(|_| format!("&id={track_id}"))
+        .collect::<String>();
+    let refused = subsonic_json(&router, "star", api_key, &oversized).await;
+    assert_eq!(refused["subsonic-response"]["status"], "failed");
+    assert_eq!(refused["subsonic-response"]["error"]["code"], 10);
+    // And one below the ceiling still works.
+    let accepted = subsonic_json(&router, "star", api_key, &format!("&id={track_id}")).await;
+    assert_eq!(accepted["subsonic-response"]["status"], "ok");
+
+    // A playlist is bounded on what it holds rather than on what one request
+    // carries, because it grows across many of them.
+    let too_many = vec![track_id; waveflow_server::services::MAX_PLAYLIST_TRACKS + 1];
+    assert!(matches!(
+        state
+            .services
+            .create_playlist(owner, "Oversized", &too_many)
+            .await,
+        Err(ServiceError::Invalid)
+    ));
+}
diff --git a/tests/subsonic_browse/top_songs.rs b/tests/subsonic_browse/top_songs.rs
new file mode 100644
index 00000000..3a02d510
--- /dev/null
+++ b/tests/subsonic_browse/top_songs.rs
@@ -0,0 +1,370 @@
+//! An artist's most played, from local history, on both surfaces.
+
+use super::*;
+
+/// An artist's most played tracks, on both surfaces, from local history alone.
+///
+/// `getTopSongs` answered an empty container because the reference server fills
+/// it from a remote service WaveFlow does not query. `play_event` can answer a
+/// narrower question with the same shape — what *this account* played — and one
+/// service answers it for the native route and the facade both.
+///
+/// Four things are asserted that a discography sorted by anything would also
+/// satisfy, and which pin this to the history instead:
+/// - a track nobody played is absent, rather than last;
+/// - the counting is per account, so a second member's listening moves its own
+///   list and not the owner's;
+/// - a guest track counts for the album's artist, which is what the artist page
+///   lists albums by;
+/// - another artist's heavily played track stays out.
+#[tokio::test]
+async fn an_artists_most_played_comes_from_local_history_on_both_surfaces() {
+    let (_temp, config, state) = test_app().await;
+    let now = now_ms();
+    // Inserted rather than created: `create_account` wants a password hash, and
+    // this account authenticates by API key and bearer token only.
+    let account = |id: Uuid, username: &'static str| {
+        let state = &state;
+        async move {
+            sqlx::query(
+                "INSERT INTO account (id, username, password_hash, role, disabled, created_at, updated_at) \
+                 VALUES (?, ?, 'this-account-never-authenticates', 'admin', 0, ?, ?)",
+            )
+            .bind(id.to_string())
+            .bind(username)
+            .bind(now)
+            .bind(now)
+            .execute(state.db.pool())
+            .await
+            .unwrap();
+        }
+    };
+    let owner = Uuid::new_v4();
+    let listener = Uuid::new_v4();
+    let stranger = Uuid::new_v4();
+    account(owner, "lamp-owner").await;
+    account(listener, "lamp-listener").await;
+    account(stranger, "lamp-stranger").await;
+
+    let api_key = security::generate_token("wfsk_");
+    state
+        .db
+        .set_subsonic_credential(
+            owner,
+            owner,
+            &state.secret_box.encrypt(b"lamp-secret").unwrap(),
+            &security::token_hash(&api_key),
+            now,
+        )
+        .await
+        .unwrap();
+
+    let music = config.data_dir.join("lamp-music");
+    std::fs::create_dir_all(&music).unwrap();
+    let library = state
+        .db
+        .create_library(
+            owner,
+            "Lamp",
+            &std::fs::canonicalize(&music).unwrap(),
+            LibraryVisibility::Private,
+            now,
+        )
+        .await
+        .unwrap();
+    state
+        .db
+        .add_library_member(
+            owner,
+            library,
+            listener,
+            waveflow_server::storage::database::LibraryRole::Listener,
+            now,
+        )
+        .await
+        .unwrap();
+    let scan = state
+        .db
+        .create_scan_job(library, Some(owner), "manual")
+        .await
+        .unwrap();
+    state.db.start_scan_job(scan, 5, false).await.unwrap();
+    for (index, title, album, credited) in [
+        (80, "Lamp Hymn", "Lamp Songs", "Harbour Bells"),
+        (81, "Lamp Echo", "Lamp Songs", "Harbour Bells"),
+        (82, "Lamp Silence", "Lamp Songs", "Harbour Bells"),
+        // Credited to someone else on the file, on an album that is Harbour
+        // Bells': the album-artist half of the question.
+        (83, "Guest Turn", "Lamp Guests", "Visiting Horn"),
+        (84, "Other Tide", "Other Shore", "Rival Keepers"),
+    ] {
+        let mut input = browse_input(index, title, album, credited, Some(1), Some(1));
+        if title == "Guest Turn" {
+            input.album_artist = Some("Harbour Bells".into());
+        }
+        state
+            .db
+            .apply_catalog_track(library, scan, &input, None, false)
+            .await
+            .unwrap();
+    }
+    state
+        .db
+        .consolidate_catalog_derivations(library)
+        .await
+        .unwrap();
+    state.db.finish_scan_job(scan, 0).await.unwrap();
+
+    let songs = state
+        .services
+        .list_songs(owner, &Default::default())
+        .await
+        .unwrap();
+    let track = |title: &str| {
+        songs
+            .iter()
+            .find(|song| song.title == title)
+            .unwrap_or_else(|| panic!("{title} was indexed"))
+            .id
+    };
+    let artists = state
+        .services
+        .list_artists(owner, None, Default::default())
+        .await
+        .unwrap();
+    let artist = |name: &str| {
+        artists
+            .iter()
+            .find(|summary| summary.artist.name == name)
+            .unwrap_or_else(|| panic!("{name} was indexed"))
+            .artist
+            .id
+    };
+
+    // The history. "Lamp Silence" is played by nobody on purpose, and "Other
+    // Tide" is played more than anything else by another artist.
+    for (user, title, count) in [
+        (owner, "Lamp Hymn", 3),
+        (owner, "Guest Turn", 2),
+        (owner, "Lamp Echo", 1),
+        (owner, "Other Tide", 9),
+        (listener, "Lamp Echo", 4),
+    ] {
+        for _ in 0..count {
+            state
+                .services
+                .scrobble(user, track(title), true, None)
+                .await
+                .unwrap();
+        }
+    }
+    // A play that was never submitted is a now-playing ping, and the
+    // projections count submissions only.
+    state
+        .services
+        .scrobble(owner, track("Lamp Silence"), false, None)
+        .await
+        .unwrap();
+
+    let bells = artist("Harbour Bells");
+    let (_record, owner_token) = state
+        .services
+        .create_api_token(owner, &[], "lamp-owner", "owner reader", &[])
+        .await
+        .unwrap();
+    let (_record, listener_token) = state
+        .services
+        .create_api_token(listener, &[], "lamp-listener", "listener reader", &[])
+        .await
+        .unwrap();
+    let (_record, stranger_token) = state
+        .services
+        .create_api_token(stranger, &[], "lamp-stranger", "stranger reader", &[])
+        .await
+        .unwrap();
+    let router = waveflow_server::app(&config, state);
+
+    let native = |uri: String, token: String| {
+        let router = router.clone();
+        async move {
+            let response = router
+                .oneshot(
+                    Request::get(uri)
+                        .header("authorization", format!("Bearer {token}"))
+                        .body(Body::empty())
+                        .unwrap(),
+                )
+                .await
+                .unwrap();
+            let status = response.status();
+            (status, json_body(response).await)
+        }
+    };
+    let titles_and_counts = |value: &serde_json::Value| {
+        value
+            .as_array()
+            .expect("the route answers a list")
+            .iter()
+            .map(|song| {
+                (
+                    song["title"].as_str().unwrap().to_owned(),
+                    song["play_count"].as_i64().unwrap(),
+                )
+            })
+            .collect::<Vec<_>>()
+    };
+
+    let (status, body) = native(
+        format!("/api/v2/artists/{bells}/top-songs"),
+        owner_token.clone(),
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(
+        titles_and_counts(&body),
+        [
+            ("Lamp Hymn".to_owned(), 3),
+            ("Guest Turn".to_owned(), 2),
+            ("Lamp Echo".to_owned(), 1),
+        ],
+        "most played first, the unplayed track absent, and the guest counted"
+    );
+
+    // The same question from the other member of the same library. Same
+    // catalogue, different history, different answer — which is what makes the
+    // list above the owner's rather than the instance's.
+    let (status, body) = native(
+        format!("/api/v2/artists/{bells}/top-songs"),
+        listener_token.clone(),
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(
+        titles_and_counts(&body),
+        [("Lamp Echo".to_owned(), 4)],
+        "a second member sees its own listening"
+    );
+
+    let (_status, body) = native(
+        format!("/api/v2/artists/{bells}/top-songs?limit=1"),
+        owner_token.clone(),
+    )
+    .await;
+    assert_eq!(titles_and_counts(&body), [("Lamp Hymn".to_owned(), 3)]);
+
+    // The catalogue's bounds, as every other listing applies them.
+    for limit in ["0", "501"] {
+        let (status, _body) = native(
+            format!("/api/v2/artists/{bells}/top-songs?limit={limit}"),
+            owner_token.clone(),
+        )
+        .await;
+        assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY, "limit={limit}");
+    }
+
+    // An artist nobody can reach, and one that does not exist, answer the same
+    // way: 404 either way, so neither confirms the identifier.
+    let (status, _body) = native(
+        format!("/api/v2/artists/{bells}/top-songs"),
+        stranger_token.clone(),
+    )
+    .await;
+    assert_eq!(status, StatusCode::NOT_FOUND, "a non-member is refused");
+    let (status, _body) = native(
+        format!("/api/v2/artists/{}/top-songs", Uuid::new_v4()),
+        owner_token.clone(),
+    )
+    .await;
+    assert_eq!(status, StatusCode::NOT_FOUND);
+
+    // And the facade, which asks by name.
+    let facade = |extra: String| {
+        let router = router.clone();
+        let api_key = api_key.clone();
+        async move {
+            let body = subsonic_json(&router, "getTopSongs", &api_key, &extra).await;
+            body["subsonic-response"]["topSongs"].clone()
+        }
+    };
+    let facade_titles = |value: &serde_json::Value| {
+        value["song"]
+            .as_array()
+            .map(|songs| {
+                songs
+                    .iter()
+                    .map(|song| song["title"].as_str().unwrap().to_owned())
+                    .collect::<Vec<_>>()
+            })
+            .unwrap_or_default()
+    };
+
+    let answered = facade("&artist=Harbour%20Bells".into()).await;
+    assert_eq!(
+        facade_titles(&answered),
+        ["Lamp Hymn", "Guest Turn", "Lamp Echo"],
+        "the facade answers what the native route does"
+    );
+    assert_eq!(
+        answered["song"][0]["playCount"].as_i64(),
+        Some(3),
+        "and carries the count it ordered by"
+    );
+
+    // Matched on the canonical name, the one folding rule the rest of the
+    // catalogue uses: a client echoing a name back finds the artist whatever
+    // the punctuation and case did on the way.
+    let folded = facade("&artist=harbour---BELLS".into()).await;
+    assert_eq!(
+        facade_titles(&folded),
+        ["Lamp Hymn", "Guest Turn", "Lamp Echo"]
+    );
+
+    let one = facade("&artist=Harbour%20Bells&count=1".into()).await;
+    // Named rather than implied. A single child is the one case that catches
+    // the container collapsing back into an object, and `facade_titles` reads
+    // the shape through `as_array().unwrap_or_default()` — so a regression would
+    // fail on a list of titles and say nothing about the frozen rule it broke.
+    assert!(one["song"].is_array(), "topSongs.song is a list: {one}");
+    assert_eq!(facade_titles(&one), ["Lamp Hymn"], "{one}");
+
+    // A page of nothing is a valid request here, as it is for getAlbumList.
+    let none = facade("&artist=Harbour%20Bells&count=0".into()).await;
+    assert!(none.is_object() && none.get("song").is_none());
+
+    // A name is not an identifier: an unknown one is an empty list, not a
+    // refusal, because nothing about the catalogue is revealed by it.
+    let unknown = facade("&artist=Nobody%20In%20This%20Library".into()).await;
+    assert!(unknown.is_object() && unknown.get("song").is_none());
+
+    // The parameter itself is still required.
+    let bare = subsonic_json(&router, "getTopSongs", &api_key, "").await;
+    assert_eq!(
+        bare["subsonic-response"]["error"]["code"].as_i64(),
+        Some(10),
+        "a missing artist is a malformed request"
+    );
+
+    // The two neighbours this change left empty are filled since RFC-024 by
+    // the catalogue's own neighbours, and are not a history: what they draw
+    // is the artist and its neighbours, not this account's most played.
+    for method in ["getSimilarSongs", "getSimilarSongs2"] {
+        let body = subsonic_json(
+            &router,
+            method,
+            &api_key,
+            &format!("&id={}", track("Lamp Hymn")),
+        )
+        .await;
+        let container = &body["subsonic-response"][match method {
+            "getSimilarSongs" => "similarSongs",
+            _ => "similarSongs2",
+        }];
+        let drawn = container["song"]
+            .as_array()
+            .unwrap_or_else(|| panic!("{method} draws songs: {body}"));
+        assert!(
+            drawn.iter().any(|song| song["title"] == "Lamp Silence"),
+            "{method} draws the artist's unplayed track too: {body}"
+        );
+    }
+}
diff --git a/tests/subsonic_contract/compatibility.rs b/tests/subsonic_contract/compatibility.rs
index 26ba7f5c..8e1e819b 100644
--- a/tests/subsonic_contract/compatibility.rs
+++ b/tests/subsonic_contract/compatibility.rs
@@ -114,7 +114,7 @@ async fn subsonic_xml_json_auth_catalog_and_user_data_are_compatible() {
         Some(1),
         Some(1),
     );
-    foreign_input.lyrics = vec![waveflow_server::lyrics::LyricsInput {
+    foreign_input.lyrics = vec![waveflow_server::library::lyrics::LyricsInput {
         source: "embedded",
         lang: "eng".into(),
         synced: false,
diff --git a/tests/subsonic_contract/main.rs b/tests/subsonic_contract/main.rs
index a7f09d62..6f2d9383 100644
--- a/tests/subsonic_contract/main.rs
+++ b/tests/subsonic_contract/main.rs
@@ -8,11 +8,11 @@ use axum::http::StatusCode;
 use http_body_util::BodyExt;
 use tower::ServiceExt;
 use uuid::Uuid;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::catalog::LibraryRecord;
-use waveflow_server::database::AccountRole;
-use waveflow_server::database::LibraryVisibility;
-use waveflow_server::security;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
+use waveflow_server::storage::catalog::LibraryRecord;
+use waveflow_server::storage::database::AccountRole;
+use waveflow_server::storage::database::LibraryVisibility;
 
 // Not every target uses every fixture, and a shared module is not dead
 // code for being partly unused here.
diff --git a/tests/subsonic_fields.rs b/tests/subsonic_fields.rs
deleted file mode 100644
index 9fd8a2a0..00000000
--- a/tests/subsonic_fields.rs
+++ /dev/null
@@ -1,1139 +0,0 @@
-//! The shape of what the facade emits, in both encodings.
-//!
-//! Split out of `v2_foundations.rs`.
-
-use axum::body::Body;
-use axum::http::Request;
-use axum::http::StatusCode;
-use tower::ServiceExt;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::database::AccountRole;
-use waveflow_server::database::LibraryVisibility;
-use waveflow_server::security;
-
-// Not every target uses every fixture, and a shared module is not dead
-// code for being partly unused here.
-#[allow(dead_code)]
-mod support;
-use support::*;
-
-/// OpenSubsonic reports support for a field by emitting it even when the value
-/// is unknown, so a track with nothing tagged is as much a test of the contract
-/// as a fully tagged one — in both encodings, since XML and JSON build the
-/// arrays through different code paths.
-#[tokio::test]
-async fn media_items_carry_the_modern_opensubsonic_fields_in_both_encodings() {
-    let (_temp, config, state) = test_app().await;
-    let api_key = "wfsk_fields-key";
-    let subsonic_password = "fields-secret";
-    let owner = state
-        .db
-        .create_account(
-            "fields-owner",
-            &security::hash_password("correct horse battery staple").unwrap(),
-            AccountRole::Admin,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    state
-        .db
-        .set_subsonic_credential(
-            owner,
-            owner,
-            &state
-                .secret_box
-                .encrypt(subsonic_password.as_bytes())
-                .unwrap(),
-            &security::token_hash(api_key),
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let music = config.data_dir.join("fields-music");
-    std::fs::create_dir_all(&music).unwrap();
-    let library = state
-        .db
-        .create_library(
-            owner,
-            "Fields",
-            &std::fs::canonicalize(&music).unwrap(),
-            LibraryVisibility::Private,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let scan = state
-        .db
-        .create_scan_job(library, Some(owner), "manual")
-        .await
-        .unwrap();
-    state.db.start_scan_job(scan, 2, false).await.unwrap();
-
-    // Two credited artists and two genres, so tag order and the split are both
-    // observable. The album is a compilation, which is stored and was never
-    // surfaced before.
-    let mut tagged = browse_input(80, "Tagged", "Sun Bloom", "Aria Lux", Some(1), Some(1));
-    tagged.artist = Some("Aria Lux; Mono Field".into());
-    tagged.album_artist = Some("Aria Lux".into());
-    tagged.genre = Some("Rock; Jazz".into());
-    tagged.is_compilation = true;
-    tagged.musicbrainz_recording_id = Some("9f4c1d2e-recording".into());
-    tagged.musicbrainz_release_id = Some("3a8b7c6d-release".into());
-    tagged.musicbrainz_artist_id = Some("1b2c3d4e-artist".into());
-    tagged.replay_gain_track_gain = Some(-7.32);
-    tagged.replay_gain_track_peak = Some(0.988_525);
-    tagged.replay_gain_album_gain = Some(-6.5);
-    tagged.replay_gain_album_peak = Some(1.0);
-    tagged.bpm = Some(128);
-    tagged.sort_title = Some("Tagged, The".into());
-    tagged.comment = Some("ripped from vinyl".into());
-    tagged.isrc = Some("FRZ039800212; GBAYE0601498".into());
-    tagged.moods = Some("Melancholic; Warm".into());
-    tagged.explicit_status = Some("clean".into());
-    state
-        .db
-        .apply_catalog_track(library, scan, &tagged, None, false)
-        .await
-        .unwrap();
-
-    // Nothing tagged and nothing decoded: the case where every added field has
-    // to be present with its default rather than omitted.
-    let mut bare = browse_input(81, "Bare", "Sun Bloom", "Aria Lux", Some(2), Some(1));
-    bare.artist = None;
-    bare.album_artist = Some("Aria Lux".into());
-    bare.genre = None;
-    bare.is_compilation = true;
-    bare.sample_rate = None;
-    bare.channels = None;
-    bare.bit_depth = None;
-    state
-        .db
-        .apply_catalog_track(library, scan, &bare, None, false)
-        .await
-        .unwrap();
-    state.db.finish_scan_job(scan, 0).await.unwrap();
-
-    let songs = state
-        .services
-        .catalog_snapshot(owner, &[])
-        .await
-        .unwrap()
-        .songs;
-    let song_id = |title: &str| {
-        songs
-            .iter()
-            .find(|song| song.title == title)
-            .unwrap_or_else(|| panic!("{title} was indexed"))
-            .id
-    };
-    let tagged_id = song_id("Tagged");
-    let bare_id = song_id("Bare");
-    state
-        .services
-        .scrobble(owner, tagged_id, true, Some(1_700_000_000_000))
-        .await
-        .unwrap();
-
-    let router = waveflow_server::app(&config, state.clone());
-
-    let tagged_json = subsonic_json(&router, "getSong", api_key, &format!("&id={tagged_id}")).await;
-    let tagged_json = &tagged_json["subsonic-response"]["song"];
-    assert_eq!(tagged_json["samplingRate"], 44_100);
-    assert_eq!(tagged_json["channelCount"], 2);
-    assert_eq!(tagged_json["bitDepth"], 16);
-    assert_eq!(tagged_json["mediaType"], "song");
-    assert_eq!(tagged_json["isVideo"], false);
-    assert_eq!(tagged_json["playCount"], 1);
-    assert!(tagged_json["played"].is_string());
-    assert_eq!(tagged_json["displayArtist"], "Aria Lux; Mono Field");
-    // Tag order, not alphabetical: "Mono Field" is credited second.
-    let artists = tagged_json["artists"].as_array().unwrap();
-    assert_eq!(artists.len(), 2);
-    assert_eq!(artists[0]["name"], "Aria Lux");
-    assert_eq!(artists[1]["name"], "Mono Field");
-    assert!(artists[0]["id"].is_string());
-    // The primary credit still matches the frozen artistId.
-    assert_eq!(tagged_json["artistId"], artists[0]["id"]);
-    assert_eq!(tagged_json["musicBrainzId"], "9f4c1d2e-recording");
-    assert_eq!(tagged_json["bpm"], 128);
-    assert_eq!(tagged_json["sortName"], "Tagged, The");
-    assert_eq!(tagged_json["comment"], "ripped from vinyl");
-    // Multi-valued like artists and genres, and split the same way.
-    assert_eq!(
-        tagged_json["isrc"],
-        serde_json::json!(["FRZ039800212", "GBAYE0601498"])
-    );
-    assert_eq!(
-        tagged_json["replayGain"],
-        serde_json::json!({
-            "trackGain": -7.32,
-            "trackPeak": 0.988_525,
-            "albumGain": -6.5,
-            "albumPeak": 1.0
-        })
-    );
-    assert_eq!(
-        tagged_json["moods"],
-        serde_json::json!(["Melancholic", "Warm"])
-    );
-    assert_eq!(tagged_json["explicitStatus"], "clean");
-    // Genres are ordered by name so two identical catalogues answer identically.
-    let genres = tagged_json["genres"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .map(|genre| genre["name"].as_str().unwrap().to_owned())
-        .collect::<Vec<_>>();
-    assert_eq!(genres, vec!["Jazz", "Rock"]);
-
-    let bare_json = subsonic_json(&router, "getSong", api_key, &format!("&id={bare_id}")).await;
-    let bare_json = &bare_json["subsonic-response"]["song"];
-    // Present with their defaults. Omitting them would tell the client this
-    // server does not implement the fields at all.
-    assert_eq!(bare_json["samplingRate"], 0);
-    assert_eq!(bare_json["channelCount"], 0);
-    assert_eq!(bare_json["bitDepth"], 0);
-    assert_eq!(bare_json["playCount"], 0);
-    assert_eq!(bare_json["displayArtist"], "");
-    assert_eq!(bare_json["artists"], serde_json::json!([]));
-    assert_eq!(bare_json["genres"], serde_json::json!([]));
-    assert_eq!(bare_json["musicBrainzId"], "");
-    assert_eq!(bare_json["bpm"], 0);
-    assert_eq!(bare_json["sortName"], "");
-    assert_eq!(bare_json["comment"], "");
-    assert_eq!(bare_json["isrc"], serde_json::json!([]));
-    assert_eq!(bare_json["moods"], serde_json::json!([]));
-    assert_eq!(bare_json["explicitStatus"], "");
-    // replayGain is the one addition whose members the specification says to
-    // omit when unknown. The container still has to be there: it is what says
-    // the server reads gain tags at all.
-    assert_eq!(bare_json["replayGain"], serde_json::json!({}));
-    // The documented exception: an empty string is not a timestamp, and
-    // playCount already signals that play statistics are supported.
-    assert!(bare_json.get("played").is_none());
-
-    // XML builds the arrays as repeated child elements rather than as a JSON
-    // array, so it is asserted separately rather than assumed.
-    let plain_auth = format!("u=fields-owner&p={subsonic_password}&v=1.16.1&c=golden");
-    let xml_song = |id: uuid::Uuid| {
-        let router = router.clone();
-        let plain_auth = plain_auth.clone();
-        async move {
-            let response = router
-                .oneshot(
-                    Request::get(format!("/rest/getSong.view?{plain_auth}&id={id}"))
-                        .body(Body::empty())
-                        .unwrap(),
-                )
-                .await
-                .unwrap();
-            assert_eq!(response.status(), StatusCode::OK);
-            body_text(response).await
-        }
-    };
-    let tagged_xml = xml_song(tagged_id).await;
-    assert!(tagged_xml.contains("samplingRate=\"44100\""));
-    assert!(tagged_xml.contains("channelCount=\"2\""));
-    assert!(tagged_xml.contains("bitDepth=\"16\""));
-    assert!(tagged_xml.contains("mediaType=\"song\""));
-    assert!(tagged_xml.contains("isVideo=\"false\""));
-    assert!(tagged_xml.contains("<artists "));
-    assert!(tagged_xml.contains("name=\"Mono Field\""));
-    assert!(tagged_xml.contains("<genres name=\"Jazz\"/>"));
-    assert!(tagged_xml.contains("<genres name=\"Rock\"/>"));
-    assert!(tagged_xml.contains("played="));
-    assert!(tagged_xml.contains("musicBrainzId=\"9f4c1d2e-recording\""));
-    assert!(tagged_xml.contains("bpm=\"128\""));
-    assert!(tagged_xml.contains("<isrc>FRZ039800212</isrc>"));
-    assert!(tagged_xml.contains("<isrc>GBAYE0601498</isrc>"));
-    assert!(tagged_xml.contains("trackGain=\"-7.32\""));
-    assert!(tagged_xml.contains("<moods>Melancholic</moods>"));
-    assert!(tagged_xml.contains("explicitStatus=\"clean\""));
-
-    let bare_xml = xml_song(bare_id).await;
-    assert!(bare_xml.contains("samplingRate=\"0\""));
-    assert!(bare_xml.contains("bitDepth=\"0\""));
-    assert!(bare_xml.contains("displayArtist=\"\""));
-    // An empty array has no repeated element to render, which is exactly why
-    // the JSON branch needs its own rule and gets its own assertion above.
-    assert!(!bare_xml.contains("<artists "));
-    assert!(!bare_xml.contains("<genres "));
-    assert!(!bare_xml.contains("played="));
-    assert!(bare_xml.contains("musicBrainzId=\"\""));
-    assert!(bare_xml.contains("bpm=\"0\""));
-    assert!(!bare_xml.contains("<isrc>"));
-    // Present but empty, in both encodings.
-    assert!(bare_xml.contains("<replayGain/>"));
-
-    // Albums carry their own additions.
-    let album_id = state
-        .services
-        .catalog_snapshot(owner, &[])
-        .await
-        .unwrap()
-        .albums[0]
-        .id;
-    let album = subsonic_json(&router, "getAlbum", api_key, &format!("&id={album_id}")).await;
-    let album = &album["subsonic-response"]["album"];
-    assert_eq!(album["isCompilation"], true);
-    assert_eq!(album["playCount"], 1);
-    assert_eq!(album["displayArtist"], "Aria Lux");
-    assert!(album["played"].is_string());
-
-    // The native surface reads the same projection, so the structured relations
-    // reach it without a second implementation.
-    let token = login_token(&router, "fields-owner", "correct horse battery staple").await;
-    let native = router
-        .clone()
-        .oneshot(
-            Request::get(format!("/api/v2/tracks/{tagged_id}"))
-                .header("authorization", format!("Bearer {token}"))
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(native.status(), StatusCode::OK);
-    let native = json_body(native).await;
-    assert_eq!(native["sample_rate"], 44_100);
-    assert_eq!(native["play_count"], 1);
-    assert_eq!(
-        native["artists"]
-            .as_array()
-            .unwrap()
-            .iter()
-            .map(|artist| artist["name"].as_str().unwrap().to_owned())
-            .collect::<Vec<_>>(),
-        vec!["Aria Lux", "Mono Field"]
-    );
-    assert_eq!(native["genres"], serde_json::json!(["Jazz", "Rock"]));
-    assert_eq!(native["musicbrainz_id"], "9f4c1d2e-recording");
-    assert_eq!(native["bpm"], 128);
-    assert_eq!(
-        native["isrc"],
-        serde_json::json!(["FRZ039800212", "GBAYE0601498"])
-    );
-}
-
-/// Two artist projections that are deliberately not the same shape, pinned in
-/// both encodings so neither drifts into the other.
-///
-/// `artists[]` and `albumArtists[]` are *references*: an identifier and a
-/// display name, and nothing else. The entries `getMusicDirectory` renders as
-/// `child` are the artist and album nodes themselves, minus `musicBrainzId`,
-/// so they do carry `sortName` and the rest. A field added to the node reaches
-/// the second and must not leak into the first.
-#[tokio::test]
-async fn an_artist_reference_is_not_an_artist_record() {
-    let (_temp, config, state) = test_app().await;
-    let api_key = "wfsk_reference-key";
-    let admin = state
-        .db
-        .create_account(
-            "reference-admin",
-            &security::hash_password("correct horse battery staple").unwrap(),
-            AccountRole::Admin,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let encrypted = state.secret_box.encrypt(b"subsonic-secret-123").unwrap();
-    state
-        .db
-        .set_subsonic_credential(
-            admin,
-            admin,
-            &encrypted,
-            &security::token_hash(api_key),
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let music = config.data_dir.join("reference-music");
-    std::fs::create_dir_all(&music).unwrap();
-    let root = std::fs::canonicalize(&music).unwrap();
-    let library = state
-        .db
-        .create_library(admin, "Refs", &root, LibraryVisibility::Private, now_ms())
-        .await
-        .unwrap();
-    let scan = state
-        .db
-        .create_scan_job(library, Some(admin), "manual")
-        .await
-        .unwrap();
-    state.db.start_scan_job(scan, 1, false).await.unwrap();
-    let mut input = catalog_input(0, "The Nocturnes");
-    input.title = "Opening".into();
-    input.album = Some("The Night Sessions".into());
-    input.album_artist = Some("The Nocturnes".into());
-    input.is_compilation = false;
-    input.sort_album = Some("Night Sessions, The".into());
-    input.sort_album_artist = Some("Nocturnes, The".into());
-    input.sort_artist = Some("Nocturnes, The".into());
-    // A contributor, so the whitelist below actually has one to check.
-    input.roles = vec![(
-        waveflow_server::tags::Role::Producer,
-        vec!["Rita Sound".into()],
-    )];
-    state
-        .db
-        .apply_catalog_track(library, scan, &input, None, false)
-        .await
-        .unwrap();
-    state
-        .db
-        .consolidate_catalog_derivations(library)
-        .await
-        .unwrap();
-    state.db.consolidate_sort_names(library).await.unwrap();
-    state.db.finish_scan_job(scan, 0).await.unwrap();
-    let router = waveflow_server::app(&config, state.clone());
-
-    // JSON: the album carries its own sortName; its `artists[]` entry carries
-    // an identifier and a name, and no third key.
-    let albums = subsonic_json(
-        &router,
-        "getAlbumList2",
-        api_key,
-        "&type=alphabeticalByName",
-    )
-    .await;
-    let album = albums["subsonic-response"]["albumList2"]["album"][0].clone();
-    assert_eq!(album["sortName"], serde_json::json!("Night Sessions, The"));
-    let reference_keys = |value: &serde_json::Value, what: &str| {
-        let entry = value
-            .as_object()
-            .unwrap_or_else(|| panic!("{what} is an object: {value}"))
-            .clone();
-        let mut keys: Vec<String> = entry.keys().cloned().collect();
-        keys.sort_unstable();
-        assert_eq!(
-            keys,
-            vec!["id".to_owned(), "name".to_owned()],
-            "{what} is a reference, not an ArtistID3: {entry:?}"
-        );
-    };
-    reference_keys(&album["artists"][0], "an album's artists[] entry");
-
-    // `albumArtists[]` is a reference too, and it is emitted on media items
-    // rather than on the album — the album's own credit is `artists[]`. So it
-    // is pinned on a song of the album.
-    let album_json = subsonic_json(
-        &router,
-        "getAlbum",
-        api_key,
-        &format!("&id={}", album["id"].as_str().expect("the album id")),
-    )
-    .await;
-    let song = album_json["subsonic-response"]["album"]["song"][0].clone();
-    reference_keys(&song["artists"][0], "a song's artists[] entry");
-    reference_keys(&song["albumArtists"][0], "a song's albumArtists[] entry");
-    // A contributor's artist is a reference on the same terms, and the
-    // contributor itself carries only what names the credit.
-    // Unconditional: the fixture credits a producer, so a contributor that
-    // stopped being emitted would fail here rather than skip the check.
-    {
-        let credit = song["contributors"][0].clone();
-        reference_keys(&credit["artist"], "a contributor's artist");
-        let mut keys: Vec<String> = credit
-            .as_object()
-            .expect("a contributor is an object")
-            .keys()
-            .cloned()
-            .collect();
-        keys.sort_unstable();
-        assert!(
-            keys == vec!["artist".to_owned(), "role".to_owned()]
-                || keys == vec!["artist".to_owned(), "role".to_owned(), "subRole".to_owned()],
-            "a contributor names the credit and nothing more: {credit:?}"
-        );
-    }
-
-    // XML: the same statement, in the encoding where an absent attribute is
-    // absent rather than a missing key.
-    let directory = router
-        .clone()
-        .oneshot(
-            Request::get(format!(
-                "/rest/getMusicDirectory.view?apiKey={api_key}&v=1.16.1&c=fixtures&id={library}"
-            ))
-            .body(Body::empty())
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(directory.status(), StatusCode::OK);
-    let directory = body_text(directory).await;
-    // The browsing child is the artist node minus musicBrainzId, so the sort
-    // name reaches it, carrying the tagged value.
-    assert!(
-        directory.contains(r#"sortName="Nocturnes, The""#),
-        "a getMusicDirectory child carries the artist's sortName: {directory}"
-    );
-    // ...while the references carry neither that field nor any other one
-    // belonging to the record. They live on the album and on its songs, so
-    // this reads the album document rather than the folder listing — where a
-    // library holding no album-less track has no song child at all.
-    let album_xml = router
-        .clone()
-        .oneshot(
-            Request::get(format!(
-                "/rest/getAlbum.view?apiKey={api_key}&v=1.16.1&c=fixtures&id={}",
-                album["id"].as_str().expect("the album id")
-            ))
-            .body(Body::empty())
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(album_xml.status(), StatusCode::OK);
-    let album_xml = body_text(album_xml).await;
-    for name in ["<artists ", "<albumArtists "] {
-        let mut references = 0;
-        for element in album_xml.split(name).skip(1) {
-            let element = element.split("/>").next().unwrap_or_default();
-            references += 1;
-            // The whitelist, rather than a list of fields to reject: a field
-            // added to the artist node has to fail here even if nobody thought
-            // to name it.
-            // Split on the quote rather than on whitespace: an attribute
-            // value holds spaces, and `name="The Nocturnes"` would otherwise
-            // read as two attributes.
-            let mut attributes: Vec<String> = element
-                .split('"')
-                .step_by(2)
-                .map(|key| key.trim().trim_end_matches('=').trim().to_owned())
-                .filter(|key| !key.is_empty())
-                .collect();
-            // Sorted before comparing, like the JSON side: which attributes
-            // are present is the contract, the order they are written in is
-            // not, and pinning it would fail a reordering that changes
-            // nothing observable.
-            attributes.sort_unstable();
-            assert_eq!(
-                attributes,
-                vec!["id".to_owned(), "name".to_owned()],
-                "{name} is a reference, not an ArtistID3: {element}"
-            );
-        }
-        assert!(
-            references > 0,
-            "the fixture must exercise {name}: {album_xml}"
-        );
-    }
-}
-
-/// The credits OpenSubsonic asks for, and the presence rule they follow.
-///
-/// These three fields were absent because the columns they need did not
-/// exist — and under the presence rule absent is a statement: it says the
-/// server does not read them. Now that it does, they are emitted with their
-/// default on a track that names nobody, which is the difference between
-/// "unsupported" and "this file credits no composer".
-#[tokio::test]
-async fn credits_reach_the_wire_in_both_encodings() {
-    let (_temp, config, state) = test_app().await;
-    let api_key = "wfsk_credits-key";
-    let admin = state
-        .db
-        .create_account(
-            "credit-admin",
-            &security::hash_password("correct horse battery staple").unwrap(),
-            AccountRole::Admin,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let encrypted = state.secret_box.encrypt(b"subsonic-secret-123").unwrap();
-    state
-        .db
-        .set_subsonic_credential(
-            admin,
-            admin,
-            &encrypted,
-            &security::token_hash(api_key),
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let music = config.data_dir.join("credit-wire");
-    std::fs::create_dir_all(&music).unwrap();
-    let root = std::fs::canonicalize(&music).unwrap();
-    let library = state
-        .db
-        .create_library(
-            admin,
-            "Credits",
-            &root,
-            LibraryVisibility::Private,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let scan = state
-        .db
-        .create_scan_job(library, Some(admin), "manual")
-        .await
-        .unwrap();
-    state.db.start_scan_job(scan, 2, false).await.unwrap();
-
-    let mut credited = catalog_input(0, "Nova Kern");
-    credited.title = "Credited".into();
-    credited.album = Some("The Record".into());
-    credited.album_artist = Some("Nova Kern; Lior Sand".into());
-    credited.is_compilation = false;
-    credited.roles = vec![
-        (
-            waveflow_server::tags::Role::Composer,
-            vec!["Otto Pen; Ada Vale".into()],
-        ),
-        (
-            waveflow_server::tags::Role::Producer,
-            vec!["Rita Sound".into()],
-        ),
-    ];
-    credited.performer_pairs = vec![("guitar".into(), "Jimmy Page".into())];
-    state
-        .db
-        .apply_catalog_track(library, scan, &credited, None, false)
-        .await
-        .unwrap();
-
-    let mut bare = catalog_input(1, "Nova Kern");
-    bare.title = "Bare".into();
-    bare.album = Some("The Record".into());
-    bare.album_artist = Some("Nova Kern; Lior Sand".into());
-    bare.is_compilation = false;
-    state
-        .db
-        .apply_catalog_track(library, scan, &bare, None, false)
-        .await
-        .unwrap();
-    state
-        .db
-        .consolidate_catalog_derivations(library)
-        .await
-        .unwrap();
-    state.db.finish_scan_job(scan, 0).await.unwrap();
-    let router = waveflow_server::app(&config, state.clone());
-
-    let albums = subsonic_json(
-        &router,
-        "getAlbumList2",
-        api_key,
-        "&type=alphabeticalByName",
-    )
-    .await;
-    let album_id = albums["subsonic-response"]["albumList2"]["album"][0]["id"]
-        .as_str()
-        .expect("the album is listed")
-        .to_owned();
-    let album = subsonic_json(&router, "getAlbum", api_key, &format!("&id={album_id}")).await;
-    let songs = album["subsonic-response"]["album"]["song"]
-        .as_array()
-        .expect("the album lists its songs")
-        .clone();
-    let song = |title: &str| {
-        songs
-            .iter()
-            .find(|song| song["title"] == title)
-            .unwrap_or_else(|| panic!("missing {title}"))
-            .clone()
-    };
-
-    let credited = song("Credited");
-    let contributors = credited["contributors"]
-        .as_array()
-        .expect("contributors is an array");
-    let mut named: Vec<(String, String)> = contributors
-        .iter()
-        .map(|credit| {
-            (
-                credit["role"].as_str().unwrap().to_owned(),
-                credit["artist"]["name"].as_str().unwrap().to_owned(),
-            )
-        })
-        .collect();
-    named.sort();
-    assert_eq!(
-        named,
-        vec![
-            ("composer".to_owned(), "Ada Vale".to_owned()),
-            ("composer".to_owned(), "Otto Pen".to_owned()),
-            ("performer".to_owned(), "Jimmy Page".to_owned()),
-            ("producer".to_owned(), "Rita Sound".to_owned()),
-        ],
-        "every role but artist and albumartist is a contributor"
-    );
-    let performer = contributors
-        .iter()
-        .find(|credit| credit["role"] == "performer")
-        .expect("the performer is credited");
-    assert_eq!(
-        performer["subRole"], "Guitar",
-        "a performer carries the instrument, title-cased"
-    );
-    assert_eq!(
-        credited["displayComposer"], "Otto Pen \u{2022} Ada Vale",
-        "the composers, in tag order, joined the way the reference joins them"
-    );
-    let album_artists: Vec<&str> = credited["albumArtists"]
-        .as_array()
-        .expect("albumArtists is an array")
-        .iter()
-        .map(|artist| artist["name"].as_str().unwrap())
-        .collect();
-    assert_eq!(album_artists, vec!["Nova Kern", "Lior Sand"]);
-
-    let bare = song("Bare");
-    assert_eq!(bare["contributors"], serde_json::json!([]));
-    assert_eq!(bare["displayComposer"], "");
-
-    let artists = subsonic_json(&router, "getArtists", api_key, "").await;
-    let indexed: Vec<serde_json::Value> = artists["subsonic-response"]["artists"]["index"]
-        .as_array()
-        .expect("the artist index")
-        .iter()
-        .flat_map(|index| index["artist"].as_array().unwrap().clone())
-        .collect();
-    let named = |name: &str| {
-        indexed
-            .iter()
-            .find(|artist| artist["name"] == name)
-            .unwrap_or_else(|| panic!("{name} is indexed"))
-            .clone()
-    };
-    assert_eq!(
-        named("Nova Kern")["roles"],
-        serde_json::json!(["albumartist", "artist"]),
-        "an album artist who also performs says both, in a stable order"
-    );
-    // A composer holds no album, so the index does not list them — but the
-    // artist is still in the catalogue, findable by name, and still says what
-    // it is. The second half is what makes the first acceptable: filtering the
-    // index would otherwise put a credited artist out of reach entirely.
-    let found = subsonic_json(&router, "search3", api_key, "&query=Otto").await;
-    let found_artists: Vec<&str> = found["subsonic-response"]["searchResult3"]["artist"]
-        .as_array()
-        .map(|all| {
-            all.iter()
-                .filter_map(|artist| artist["name"].as_str())
-                .collect()
-        })
-        .unwrap_or_default();
-    assert!(
-        found_artists.contains(&"Otto Pen"),
-        "a composer is reachable by searching their own name: {found_artists:?}"
-    );
-    assert!(
-        !indexed.iter().any(|artist| artist["name"] == "Otto Pen"),
-        "an artist credited on no album is not one of the library's artists"
-    );
-    let catalogue = state
-        .services
-        .list_artists(admin, None, Default::default())
-        .await
-        .unwrap();
-    let composer = catalogue
-        .iter()
-        .find(|summary| summary.artist.name == "Otto Pen")
-        .expect("the composer is in the catalogue");
-    assert_eq!(composer.artist.roles, vec!["composer".to_owned()]);
-
-    // An artist whose credits nothing has counted yet still says the field is
-    // supported. The presence rule turns on emitting the default, and a record
-    // that omits its own array is a server saying it does not read roles at
-    // all — which is what the classification above must not do.
-    let indexed_artist = named("Nova Kern");
-    assert!(
-        indexed_artist["roles"].is_array(),
-        "a full artist record carries its roles array: {indexed_artist:?}"
-    );
-    // The same record through a second surface, because `getStarred2` builds
-    // its artists from the same projection and the same node.
-    let artist_id = indexed_artist["id"].as_str().expect("the artist id");
-    subsonic_json(&router, "star", api_key, &format!("&artistId={artist_id}")).await;
-    let starred = subsonic_json(&router, "getStarred2", api_key, "").await;
-    let starred_artist = starred["subsonic-response"]["starred2"]["artist"]
-        .as_array()
-        .expect("the starred artists are an array")
-        .iter()
-        .find(|artist| artist["id"] == artist_id)
-        .expect("the artist that was just starred")
-        .clone();
-    assert!(
-        starred_artist["roles"].is_array(),
-        "and carries it there too: {starred_artist:?}"
-    );
-    // A browsing child is an artist or an album under the element name a song
-    // uses, and only `isDir` tells them apart. A folder entry must not answer
-    // with a track's relations: an artist reporting `isrc: []` would be the
-    // server claiming it read a recording identifier off a directory.
-    let folders = subsonic_json(&router, "getMusicFolders", api_key, "").await;
-    let folder_id = folders["subsonic-response"]["musicFolders"]["musicFolder"][0]["id"]
-        .as_str()
-        .expect("the library is listed")
-        .to_owned();
-    let directory = subsonic_json(
-        &router,
-        "getMusicDirectory",
-        api_key,
-        &format!("&id={folder_id}"),
-    )
-    .await;
-    let entry = directory["subsonic-response"]["directory"]["child"]
-        .as_array()
-        .and_then(|children| children.iter().find(|child| child["isDir"] == true))
-        .expect("the folder lists its artists")
-        .clone();
-    for absent in [
-        "isrc",
-        "moods",
-        "albumArtists",
-        "contributors",
-        "artists",
-        "genres",
-    ] {
-        assert!(
-            entry.get(absent).is_none(),
-            "a directory entry carries no {absent}: {entry:?}"
-        );
-    }
-    assert!(
-        entry["roles"].is_array(),
-        "but it keeps the artist record shape it is rendered from: {entry:?}"
-    );
-
-    let xml = router
-        .clone()
-        .oneshot(
-            Request::get(format!(
-                "/rest/getAlbum.view?apiKey={api_key}&v=1.16.1&c=fixtures&id={album_id}"
-            ))
-            .body(Body::empty())
-            .unwrap(),
-        )
-        .await
-        .unwrap();
-    let xml = body_text(xml).await;
-    assert!(
-        xml.contains("<contributors role=\"performer\" subRole=\"Guitar\">"),
-        "the performer credit is an element carrying its instrument: {xml}"
-    );
-    assert!(
-        xml.contains("displayComposer=\"Otto Pen \u{2022} Ada Vale\""),
-        "the composer display string reaches XML too: {xml}"
-    );
-    // And the case that needs the field injected rather than rendered: an
-    // artist whose files have all gone missing keeps its row and its credits,
-    // but nothing counts them any more, so it holds no role at all. It still
-    // has to say the field is supported.
-    sqlx::query("UPDATE track SET is_available = 0 WHERE library_id = ?")
-        .bind(library.to_string())
-        .execute(state.db.pool())
-        .await
-        .unwrap();
-    state
-        .db
-        .consolidate_catalog_derivations(library)
-        .await
-        .unwrap();
-    let bereft = subsonic_json(&router, "getArtist", api_key, &format!("&id={artist_id}")).await;
-    assert_eq!(
-        bereft["subsonic-response"]["artist"]["roles"],
-        serde_json::json!([]),
-        "empty, not absent: absent would say the server does not read roles"
-    );
-}
-
-#[tokio::test]
-async fn an_album_reports_its_release_details_and_its_disc_titles() {
-    let (_temp, config, state) = test_app().await;
-    let router = waveflow_server::app(&config, state.clone());
-    let hash = security::hash_password("correct horse battery staple").unwrap();
-    let owner = state
-        .db
-        .create_account("release", &hash, AccountRole::Admin, now_ms())
-        .await
-        .unwrap();
-    let encrypted = state
-        .secret_box
-        .encrypt(b"dedicated-subsonic-secret")
-        .unwrap();
-    let api_key = "wfsk_release-key";
-    state
-        .db
-        .set_subsonic_credential(
-            owner,
-            owner,
-            &encrypted,
-            &security::token_hash(api_key),
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let music = config.data_dir.join("release-music");
-    std::fs::create_dir_all(&music).unwrap();
-    let library_id = state
-        .db
-        .create_library(
-            owner,
-            "Release library",
-            &std::fs::canonicalize(&music).unwrap(),
-            LibraryVisibility::Private,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let scan_id = state
-        .db
-        .create_scan_job(library_id, Some(owner), "manual")
-        .await
-        .unwrap();
-    state.db.start_scan_job(scan_id, 2, false).await.unwrap();
-
-    for (index, disc, subtitle) in [(0usize, 1i64, "The Session"), (1, 2, "The Rehearsal")] {
-        let mut input = catalog_input(index, "Nova Kern");
-        input.disc_number = Some(disc);
-        input.disc_subtitle = Some(subtitle.into());
-        if index == 0 {
-            // Only the first track carries them: the album takes the first
-            // value it is given and later tracks do not overwrite it.
-            input.original_release_date = Some("1998-11".into());
-            input.release_date = Some("2019-04-05".into());
-            input.release_types = Some("Album; Compilation".into());
-            input.record_labels = Some("Nightfall Records; Second Imprint".into());
-        }
-        state
-            .db
-            .apply_catalog_track(library_id, scan_id, &input, None, false)
-            .await
-            .unwrap();
-    }
-    // What a real scan does after applying its rows, before closing the job:
-    // it builds the artist index and the role statistics a folder listing
-    // reads. Driving the pipeline in another order would prove something about
-    // an order nothing runs.
-    state
-        .db
-        .consolidate_catalog_derivations(library_id)
-        .await
-        .unwrap();
-    state.db.finish_scan_job(scan_id, 0).await.unwrap();
-
-    let album_id = state
-        .services
-        .catalog_snapshot(owner, &[])
-        .await
-        .unwrap()
-        .albums[0]
-        .id;
-    let detail = state.services.album(owner, album_id).await.unwrap();
-    assert_eq!(
-        detail.album.record_labels,
-        vec!["Nightfall Records", "Second Imprint"]
-    );
-    assert_eq!(detail.album.release_types, vec!["Album", "Compilation"]);
-    assert_eq!(
-        detail
-            .album
-            .disc_titles
-            .iter()
-            .map(|disc| (disc.disc, disc.title.as_str()))
-            .collect::<Vec<_>>(),
-        vec![(1, "The Session"), (2, "The Rehearsal")]
-    );
-
-    let album = subsonic_json(&router, "getAlbum", api_key, &format!("&id={album_id}")).await;
-    let album = &album["subsonic-response"]["album"];
-    assert_eq!(
-        album["recordLabels"],
-        serde_json::json!([{"name": "Nightfall Records"}, {"name": "Second Imprint"}])
-    );
-    assert_eq!(
-        album["releaseTypes"],
-        serde_json::json!(["Album", "Compilation"])
-    );
-    assert_eq!(
-        album["discTitles"],
-        serde_json::json!([
-            {"disc": 1, "title": "The Session"},
-            {"disc": 2, "title": "The Rehearsal"}
-        ])
-    );
-    // A tag naming a year and a month is a year and a month. Reporting a day
-    // it never claimed would be inventing precision.
-    assert_eq!(
-        album["originalReleaseDate"],
-        serde_json::json!({"year": 1998, "month": 11})
-    );
-    assert_eq!(
-        album["releaseDate"],
-        serde_json::json!({"year": 2019, "month": 4, "day": 5})
-    );
-
-    // An album with none of these tags declares the fields supported and
-    // unset — empty arrays rather than absent keys — and names no date at all.
-    let bare_scan = state
-        .db
-        .create_scan_job(library_id, Some(owner), "manual")
-        .await
-        .unwrap();
-    state.db.start_scan_job(bare_scan, 1, false).await.unwrap();
-    let mut bare = catalog_input(7, "Quiet Hand");
-    bare.album = Some("Bare release".into());
-    bare.is_compilation = false;
-    state
-        .db
-        .apply_catalog_track(library_id, bare_scan, &bare, None, false)
-        .await
-        .unwrap();
-    // What a real scan does after applying its rows, before closing the job:
-    // it builds the artist index and the role statistics a folder listing
-    // reads. Driving the pipeline in another order would prove something about
-    // an order nothing runs.
-    state
-        .db
-        .consolidate_catalog_derivations(library_id)
-        .await
-        .unwrap();
-    state.db.finish_scan_job(bare_scan, 0).await.unwrap();
-    let bare_id = state
-        .services
-        .catalog_snapshot(owner, &[])
-        .await
-        .unwrap()
-        .albums
-        .into_iter()
-        .find(|album| album.title == "Bare release")
-        .unwrap()
-        .id;
-    // A song is not a release. The three arrays share their element name with
-    // an album inside a directory, and a recording answering `recordLabels: []`
-    // would claim the server reads a label off a track.
-    let song = &album["song"][0];
-    assert!(omits(song, "recordLabels"));
-    assert!(omits(song, "releaseTypes"));
-    assert!(omits(song, "discTitles"));
-    // Its own arrays are still there, empty rather than absent.
-    assert_eq!(song["moods"], serde_json::json!([]));
-
-    let bare = subsonic_json(&router, "getAlbum", api_key, &format!("&id={bare_id}")).await;
-    let bare = &bare["subsonic-response"]["album"];
-    assert_eq!(bare["recordLabels"], serde_json::json!([]));
-    assert_eq!(bare["releaseTypes"], serde_json::json!([]));
-    assert_eq!(bare["discTitles"], serde_json::json!([]));
-    assert!(omits(bare, "originalReleaseDate"));
-    assert!(omits(bare, "releaseDate"));
-
-    // A third album carrying exactly one of each. This is the shape the array
-    // rule is for: with one child and no rule, a record label renders as a bare
-    // object instead of a list of one.
-    let solo_scan = state
-        .db
-        .create_scan_job(library_id, Some(owner), "manual")
-        .await
-        .unwrap();
-    state.db.start_scan_job(solo_scan, 1, false).await.unwrap();
-    let mut solo_input = catalog_input(9, "Solo Hand");
-    solo_input.album = Some("Single imprint".into());
-    solo_input.is_compilation = false;
-    solo_input.disc_number = Some(1);
-    solo_input.disc_subtitle = Some("Only disc".into());
-    solo_input.release_types = Some("EP".into());
-    solo_input.record_labels = Some("Solo Records".into());
-    state
-        .db
-        .apply_catalog_track(library_id, solo_scan, &solo_input, None, false)
-        .await
-        .unwrap();
-    // What a real scan does after applying its rows, before closing the job:
-    // it builds the artist index and the role statistics a folder listing
-    // reads. Driving the pipeline in another order would prove something about
-    // an order nothing runs.
-    state
-        .db
-        .consolidate_catalog_derivations(library_id)
-        .await
-        .unwrap();
-    state.db.finish_scan_job(solo_scan, 0).await.unwrap();
-    let solo_id = state
-        .services
-        .catalog_snapshot(owner, &[])
-        .await
-        .unwrap()
-        .albums
-        .into_iter()
-        .find(|album| album.title == "Single imprint")
-        .unwrap()
-        .id;
-    let solo = subsonic_json(&router, "getAlbum", api_key, &format!("&id={solo_id}")).await;
-    let solo = &solo["subsonic-response"]["album"];
-    assert_eq!(
-        solo["recordLabels"],
-        serde_json::json!([{"name": "Solo Records"}]),
-        "one record label is a list of one, not a bare object"
-    );
-    assert_eq!(solo["releaseTypes"], serde_json::json!(["EP"]));
-    assert_eq!(
-        solo["discTitles"],
-        serde_json::json!([{"disc": 1, "title": "Only disc"}])
-    );
-
-    // `getMusicDirectory` renames an album to `child`, and both the array rule
-    // and the injection guard are keyed on that name. Under it an album has to
-    // answer exactly what it answers as `album` — for several values, for one,
-    // and for none — or a client browsing folders reads a single record label
-    // as a bare object and an empty list as "not supported".
-    for (id, rendered) in [(album_id, album), (solo_id, solo), (bare_id, bare)] {
-        let artist_id: String =
-            sqlx::query_scalar("SELECT album_artist_id FROM album WHERE id = ?")
-                .bind(id.to_string())
-                .fetch_one(state.db.pool())
-                .await
-                .unwrap();
-        let directory = subsonic_json(
-            &router,
-            "getMusicDirectory",
-            api_key,
-            &format!("&id={artist_id}"),
-        )
-        .await;
-        let children = directory["subsonic-response"]["directory"]["child"]
-            .as_array()
-            .unwrap()
-            .clone();
-        let child = children
-            .iter()
-            .find(|child| child["id"] == id.to_string())
-            .unwrap_or_else(|| panic!("the folder of {artist_id} has to list {id}"));
-        for key in ["recordLabels", "releaseTypes", "discTitles"] {
-            assert_eq!(
-                child[key], rendered[key],
-                "{key} must read the same under `child` as under `album`"
-            );
-        }
-        // And a song wearing that same element name carries none of the three.
-        // Browsed from the album's own folder rather than the artist's: an
-        // artist folder lists albums, so filtering it for songs would assert
-        // nothing at all.
-        let songs =
-            subsonic_json(&router, "getMusicDirectory", api_key, &format!("&id={id}")).await;
-        let songs = songs["subsonic-response"]["directory"]["child"]
-            .as_array()
-            .unwrap();
-        assert!(!songs.is_empty(), "every album here has at least one track");
-        for song in songs {
-            assert_eq!(song["isDir"], false);
-            for key in ["recordLabels", "releaseTypes", "discTitles"] {
-                assert!(
-                    omits(song, key),
-                    "a song must not answer {key}: {}",
-                    song["title"]
-                );
-            }
-        }
-    }
-}
diff --git a/tests/subsonic_fields/albums.rs b/tests/subsonic_fields/albums.rs
new file mode 100644
index 00000000..c562a2ed
--- /dev/null
+++ b/tests/subsonic_fields/albums.rs
@@ -0,0 +1,293 @@
+//! An album's release details and disc titles.
+
+use super::*;
+
+#[tokio::test]
+async fn an_album_reports_its_release_details_and_its_disc_titles() {
+    let (_temp, config, state) = test_app().await;
+    let router = waveflow_server::app(&config, state.clone());
+    let hash = security::hash_password("correct horse battery staple").unwrap();
+    let owner = state
+        .db
+        .create_account("release", &hash, AccountRole::Admin, now_ms())
+        .await
+        .unwrap();
+    let encrypted = state
+        .secret_box
+        .encrypt(b"dedicated-subsonic-secret")
+        .unwrap();
+    let api_key = "wfsk_release-key";
+    state
+        .db
+        .set_subsonic_credential(
+            owner,
+            owner,
+            &encrypted,
+            &security::token_hash(api_key),
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let music = config.data_dir.join("release-music");
+    std::fs::create_dir_all(&music).unwrap();
+    let library_id = state
+        .db
+        .create_library(
+            owner,
+            "Release library",
+            &std::fs::canonicalize(&music).unwrap(),
+            LibraryVisibility::Private,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let scan_id = state
+        .db
+        .create_scan_job(library_id, Some(owner), "manual")
+        .await
+        .unwrap();
+    state.db.start_scan_job(scan_id, 2, false).await.unwrap();
+
+    for (index, disc, subtitle) in [(0usize, 1i64, "The Session"), (1, 2, "The Rehearsal")] {
+        let mut input = catalog_input(index, "Nova Kern");
+        input.disc_number = Some(disc);
+        input.disc_subtitle = Some(subtitle.into());
+        if index == 0 {
+            // Only the first track carries them: the album takes the first
+            // value it is given and later tracks do not overwrite it.
+            input.original_release_date = Some("1998-11".into());
+            input.release_date = Some("2019-04-05".into());
+            input.release_types = Some("Album; Compilation".into());
+            input.record_labels = Some("Nightfall Records; Second Imprint".into());
+        }
+        state
+            .db
+            .apply_catalog_track(library_id, scan_id, &input, None, false)
+            .await
+            .unwrap();
+    }
+    // What a real scan does after applying its rows, before closing the job:
+    // it builds the artist index and the role statistics a folder listing
+    // reads. Driving the pipeline in another order would prove something about
+    // an order nothing runs.
+    state
+        .db
+        .consolidate_catalog_derivations(library_id)
+        .await
+        .unwrap();
+    state.db.finish_scan_job(scan_id, 0).await.unwrap();
+
+    let album_id = state
+        .services
+        .catalog_snapshot(owner, &[])
+        .await
+        .unwrap()
+        .albums[0]
+        .id;
+    let detail = state.services.album(owner, album_id).await.unwrap();
+    assert_eq!(
+        detail.album.record_labels,
+        vec!["Nightfall Records", "Second Imprint"]
+    );
+    assert_eq!(detail.album.release_types, vec!["Album", "Compilation"]);
+    assert_eq!(
+        detail
+            .album
+            .disc_titles
+            .iter()
+            .map(|disc| (disc.disc, disc.title.as_str()))
+            .collect::<Vec<_>>(),
+        vec![(1, "The Session"), (2, "The Rehearsal")]
+    );
+
+    let album = subsonic_json(&router, "getAlbum", api_key, &format!("&id={album_id}")).await;
+    let album = &album["subsonic-response"]["album"];
+    assert_eq!(
+        album["recordLabels"],
+        serde_json::json!([{"name": "Nightfall Records"}, {"name": "Second Imprint"}])
+    );
+    assert_eq!(
+        album["releaseTypes"],
+        serde_json::json!(["Album", "Compilation"])
+    );
+    assert_eq!(
+        album["discTitles"],
+        serde_json::json!([
+            {"disc": 1, "title": "The Session"},
+            {"disc": 2, "title": "The Rehearsal"}
+        ])
+    );
+    // A tag naming a year and a month is a year and a month. Reporting a day
+    // it never claimed would be inventing precision.
+    assert_eq!(
+        album["originalReleaseDate"],
+        serde_json::json!({"year": 1998, "month": 11})
+    );
+    assert_eq!(
+        album["releaseDate"],
+        serde_json::json!({"year": 2019, "month": 4, "day": 5})
+    );
+
+    // An album with none of these tags declares the fields supported and
+    // unset — empty arrays rather than absent keys — and names no date at all.
+    let bare_scan = state
+        .db
+        .create_scan_job(library_id, Some(owner), "manual")
+        .await
+        .unwrap();
+    state.db.start_scan_job(bare_scan, 1, false).await.unwrap();
+    let mut bare = catalog_input(7, "Quiet Hand");
+    bare.album = Some("Bare release".into());
+    bare.is_compilation = false;
+    state
+        .db
+        .apply_catalog_track(library_id, bare_scan, &bare, None, false)
+        .await
+        .unwrap();
+    // What a real scan does after applying its rows, before closing the job:
+    // it builds the artist index and the role statistics a folder listing
+    // reads. Driving the pipeline in another order would prove something about
+    // an order nothing runs.
+    state
+        .db
+        .consolidate_catalog_derivations(library_id)
+        .await
+        .unwrap();
+    state.db.finish_scan_job(bare_scan, 0).await.unwrap();
+    let bare_id = state
+        .services
+        .catalog_snapshot(owner, &[])
+        .await
+        .unwrap()
+        .albums
+        .into_iter()
+        .find(|album| album.title == "Bare release")
+        .unwrap()
+        .id;
+    // A song is not a release. The three arrays share their element name with
+    // an album inside a directory, and a recording answering `recordLabels: []`
+    // would claim the server reads a label off a track.
+    let song = &album["song"][0];
+    assert!(omits(song, "recordLabels"));
+    assert!(omits(song, "releaseTypes"));
+    assert!(omits(song, "discTitles"));
+    // Its own arrays are still there, empty rather than absent.
+    assert_eq!(song["moods"], serde_json::json!([]));
+
+    let bare = subsonic_json(&router, "getAlbum", api_key, &format!("&id={bare_id}")).await;
+    let bare = &bare["subsonic-response"]["album"];
+    assert_eq!(bare["recordLabels"], serde_json::json!([]));
+    assert_eq!(bare["releaseTypes"], serde_json::json!([]));
+    assert_eq!(bare["discTitles"], serde_json::json!([]));
+    assert!(omits(bare, "originalReleaseDate"));
+    assert!(omits(bare, "releaseDate"));
+
+    // A third album carrying exactly one of each. This is the shape the array
+    // rule is for: with one child and no rule, a record label renders as a bare
+    // object instead of a list of one.
+    let solo_scan = state
+        .db
+        .create_scan_job(library_id, Some(owner), "manual")
+        .await
+        .unwrap();
+    state.db.start_scan_job(solo_scan, 1, false).await.unwrap();
+    let mut solo_input = catalog_input(9, "Solo Hand");
+    solo_input.album = Some("Single imprint".into());
+    solo_input.is_compilation = false;
+    solo_input.disc_number = Some(1);
+    solo_input.disc_subtitle = Some("Only disc".into());
+    solo_input.release_types = Some("EP".into());
+    solo_input.record_labels = Some("Solo Records".into());
+    state
+        .db
+        .apply_catalog_track(library_id, solo_scan, &solo_input, None, false)
+        .await
+        .unwrap();
+    // What a real scan does after applying its rows, before closing the job:
+    // it builds the artist index and the role statistics a folder listing
+    // reads. Driving the pipeline in another order would prove something about
+    // an order nothing runs.
+    state
+        .db
+        .consolidate_catalog_derivations(library_id)
+        .await
+        .unwrap();
+    state.db.finish_scan_job(solo_scan, 0).await.unwrap();
+    let solo_id = state
+        .services
+        .catalog_snapshot(owner, &[])
+        .await
+        .unwrap()
+        .albums
+        .into_iter()
+        .find(|album| album.title == "Single imprint")
+        .unwrap()
+        .id;
+    let solo = subsonic_json(&router, "getAlbum", api_key, &format!("&id={solo_id}")).await;
+    let solo = &solo["subsonic-response"]["album"];
+    assert_eq!(
+        solo["recordLabels"],
+        serde_json::json!([{"name": "Solo Records"}]),
+        "one record label is a list of one, not a bare object"
+    );
+    assert_eq!(solo["releaseTypes"], serde_json::json!(["EP"]));
+    assert_eq!(
+        solo["discTitles"],
+        serde_json::json!([{"disc": 1, "title": "Only disc"}])
+    );
+
+    // `getMusicDirectory` renames an album to `child`, and both the array rule
+    // and the injection guard are keyed on that name. Under it an album has to
+    // answer exactly what it answers as `album` — for several values, for one,
+    // and for none — or a client browsing folders reads a single record label
+    // as a bare object and an empty list as "not supported".
+    for (id, rendered) in [(album_id, album), (solo_id, solo), (bare_id, bare)] {
+        let artist_id: String =
+            sqlx::query_scalar("SELECT album_artist_id FROM album WHERE id = ?")
+                .bind(id.to_string())
+                .fetch_one(state.db.pool())
+                .await
+                .unwrap();
+        let directory = subsonic_json(
+            &router,
+            "getMusicDirectory",
+            api_key,
+            &format!("&id={artist_id}"),
+        )
+        .await;
+        let children = directory["subsonic-response"]["directory"]["child"]
+            .as_array()
+            .unwrap()
+            .clone();
+        let child = children
+            .iter()
+            .find(|child| child["id"] == id.to_string())
+            .unwrap_or_else(|| panic!("the folder of {artist_id} has to list {id}"));
+        for key in ["recordLabels", "releaseTypes", "discTitles"] {
+            assert_eq!(
+                child[key], rendered[key],
+                "{key} must read the same under `child` as under `album`"
+            );
+        }
+        // And a song wearing that same element name carries none of the three.
+        // Browsed from the album's own folder rather than the artist's: an
+        // artist folder lists albums, so filtering it for songs would assert
+        // nothing at all.
+        let songs =
+            subsonic_json(&router, "getMusicDirectory", api_key, &format!("&id={id}")).await;
+        let songs = songs["subsonic-response"]["directory"]["child"]
+            .as_array()
+            .unwrap();
+        assert!(!songs.is_empty(), "every album here has at least one track");
+        for song in songs {
+            assert_eq!(song["isDir"], false);
+            for key in ["recordLabels", "releaseTypes", "discTitles"] {
+                assert!(
+                    omits(song, key),
+                    "a song must not answer {key}: {}",
+                    song["title"]
+                );
+            }
+        }
+    }
+}
diff --git a/tests/subsonic_fields/credits.rs b/tests/subsonic_fields/credits.rs
new file mode 100644
index 00000000..f0209c9d
--- /dev/null
+++ b/tests/subsonic_fields/credits.rs
@@ -0,0 +1,535 @@
+//! Artist references and credits on the wire, in both encodings.
+
+use super::*;
+
+/// Two artist projections that are deliberately not the same shape, pinned in
+/// both encodings so neither drifts into the other.
+///
+/// `artists[]` and `albumArtists[]` are *references*: an identifier and a
+/// display name, and nothing else. The entries `getMusicDirectory` renders as
+/// `child` are the artist and album nodes themselves, minus `musicBrainzId`,
+/// so they do carry `sortName` and the rest. A field added to the node reaches
+/// the second and must not leak into the first.
+#[tokio::test]
+async fn an_artist_reference_is_not_an_artist_record() {
+    let (_temp, config, state) = test_app().await;
+    let api_key = "wfsk_reference-key";
+    let admin = state
+        .db
+        .create_account(
+            "reference-admin",
+            &security::hash_password("correct horse battery staple").unwrap(),
+            AccountRole::Admin,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let encrypted = state.secret_box.encrypt(b"subsonic-secret-123").unwrap();
+    state
+        .db
+        .set_subsonic_credential(
+            admin,
+            admin,
+            &encrypted,
+            &security::token_hash(api_key),
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let music = config.data_dir.join("reference-music");
+    std::fs::create_dir_all(&music).unwrap();
+    let root = std::fs::canonicalize(&music).unwrap();
+    let library = state
+        .db
+        .create_library(admin, "Refs", &root, LibraryVisibility::Private, now_ms())
+        .await
+        .unwrap();
+    let scan = state
+        .db
+        .create_scan_job(library, Some(admin), "manual")
+        .await
+        .unwrap();
+    state.db.start_scan_job(scan, 1, false).await.unwrap();
+    let mut input = catalog_input(0, "The Nocturnes");
+    input.title = "Opening".into();
+    input.album = Some("The Night Sessions".into());
+    input.album_artist = Some("The Nocturnes".into());
+    input.is_compilation = false;
+    input.sort_album = Some("Night Sessions, The".into());
+    input.sort_album_artist = Some("Nocturnes, The".into());
+    input.sort_artist = Some("Nocturnes, The".into());
+    // A contributor, so the whitelist below actually has one to check.
+    input.roles = vec![(
+        waveflow_server::library::tags::Role::Producer,
+        vec!["Rita Sound".into()],
+    )];
+    state
+        .db
+        .apply_catalog_track(library, scan, &input, None, false)
+        .await
+        .unwrap();
+    state
+        .db
+        .consolidate_catalog_derivations(library)
+        .await
+        .unwrap();
+    state.db.consolidate_sort_names(library).await.unwrap();
+    state.db.finish_scan_job(scan, 0).await.unwrap();
+    let router = waveflow_server::app(&config, state.clone());
+
+    // JSON: the album carries its own sortName; its `artists[]` entry carries
+    // an identifier and a name, and no third key.
+    let albums = subsonic_json(
+        &router,
+        "getAlbumList2",
+        api_key,
+        "&type=alphabeticalByName",
+    )
+    .await;
+    let album = albums["subsonic-response"]["albumList2"]["album"][0].clone();
+    assert_eq!(album["sortName"], serde_json::json!("Night Sessions, The"));
+    let reference_keys = |value: &serde_json::Value, what: &str| {
+        let entry = value
+            .as_object()
+            .unwrap_or_else(|| panic!("{what} is an object: {value}"))
+            .clone();
+        let mut keys: Vec<String> = entry.keys().cloned().collect();
+        keys.sort_unstable();
+        assert_eq!(
+            keys,
+            vec!["id".to_owned(), "name".to_owned()],
+            "{what} is a reference, not an ArtistID3: {entry:?}"
+        );
+    };
+    reference_keys(&album["artists"][0], "an album's artists[] entry");
+
+    // `albumArtists[]` is a reference too, and it is emitted on media items
+    // rather than on the album — the album's own credit is `artists[]`. So it
+    // is pinned on a song of the album.
+    let album_json = subsonic_json(
+        &router,
+        "getAlbum",
+        api_key,
+        &format!("&id={}", album["id"].as_str().expect("the album id")),
+    )
+    .await;
+    let song = album_json["subsonic-response"]["album"]["song"][0].clone();
+    reference_keys(&song["artists"][0], "a song's artists[] entry");
+    reference_keys(&song["albumArtists"][0], "a song's albumArtists[] entry");
+    // A contributor's artist is a reference on the same terms, and the
+    // contributor itself carries only what names the credit.
+    // Unconditional: the fixture credits a producer, so a contributor that
+    // stopped being emitted would fail here rather than skip the check.
+    {
+        let credit = song["contributors"][0].clone();
+        reference_keys(&credit["artist"], "a contributor's artist");
+        let mut keys: Vec<String> = credit
+            .as_object()
+            .expect("a contributor is an object")
+            .keys()
+            .cloned()
+            .collect();
+        keys.sort_unstable();
+        assert!(
+            keys == vec!["artist".to_owned(), "role".to_owned()]
+                || keys == vec!["artist".to_owned(), "role".to_owned(), "subRole".to_owned()],
+            "a contributor names the credit and nothing more: {credit:?}"
+        );
+    }
+
+    // XML: the same statement, in the encoding where an absent attribute is
+    // absent rather than a missing key.
+    let directory = router
+        .clone()
+        .oneshot(
+            Request::get(format!(
+                "/rest/getMusicDirectory.view?apiKey={api_key}&v=1.16.1&c=fixtures&id={library}"
+            ))
+            .body(Body::empty())
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(directory.status(), StatusCode::OK);
+    let directory = body_text(directory).await;
+    // The browsing child is the artist node minus musicBrainzId, so the sort
+    // name reaches it, carrying the tagged value.
+    assert!(
+        directory.contains(r#"sortName="Nocturnes, The""#),
+        "a getMusicDirectory child carries the artist's sortName: {directory}"
+    );
+    // ...while the references carry neither that field nor any other one
+    // belonging to the record. They live on the album and on its songs, so
+    // this reads the album document rather than the folder listing — where a
+    // library holding no album-less track has no song child at all.
+    let album_xml = router
+        .clone()
+        .oneshot(
+            Request::get(format!(
+                "/rest/getAlbum.view?apiKey={api_key}&v=1.16.1&c=fixtures&id={}",
+                album["id"].as_str().expect("the album id")
+            ))
+            .body(Body::empty())
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(album_xml.status(), StatusCode::OK);
+    let album_xml = body_text(album_xml).await;
+    for name in ["<artists ", "<albumArtists "] {
+        let mut references = 0;
+        for element in album_xml.split(name).skip(1) {
+            let element = element.split("/>").next().unwrap_or_default();
+            references += 1;
+            // The whitelist, rather than a list of fields to reject: a field
+            // added to the artist node has to fail here even if nobody thought
+            // to name it.
+            // Split on the quote rather than on whitespace: an attribute
+            // value holds spaces, and `name="The Nocturnes"` would otherwise
+            // read as two attributes.
+            let mut attributes: Vec<String> = element
+                .split('"')
+                .step_by(2)
+                .map(|key| key.trim().trim_end_matches('=').trim().to_owned())
+                .filter(|key| !key.is_empty())
+                .collect();
+            // Sorted before comparing, like the JSON side: which attributes
+            // are present is the contract, the order they are written in is
+            // not, and pinning it would fail a reordering that changes
+            // nothing observable.
+            attributes.sort_unstable();
+            assert_eq!(
+                attributes,
+                vec!["id".to_owned(), "name".to_owned()],
+                "{name} is a reference, not an ArtistID3: {element}"
+            );
+        }
+        assert!(
+            references > 0,
+            "the fixture must exercise {name}: {album_xml}"
+        );
+    }
+}
+
+/// The credits OpenSubsonic asks for, and the presence rule they follow.
+///
+/// These three fields were absent because the columns they need did not
+/// exist — and under the presence rule absent is a statement: it says the
+/// server does not read them. Now that it does, they are emitted with their
+/// default on a track that names nobody, which is the difference between
+/// "unsupported" and "this file credits no composer".
+#[tokio::test]
+async fn credits_reach_the_wire_in_both_encodings() {
+    let (_temp, config, state) = test_app().await;
+    let api_key = "wfsk_credits-key";
+    let admin = state
+        .db
+        .create_account(
+            "credit-admin",
+            &security::hash_password("correct horse battery staple").unwrap(),
+            AccountRole::Admin,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let encrypted = state.secret_box.encrypt(b"subsonic-secret-123").unwrap();
+    state
+        .db
+        .set_subsonic_credential(
+            admin,
+            admin,
+            &encrypted,
+            &security::token_hash(api_key),
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let music = config.data_dir.join("credit-wire");
+    std::fs::create_dir_all(&music).unwrap();
+    let root = std::fs::canonicalize(&music).unwrap();
+    let library = state
+        .db
+        .create_library(
+            admin,
+            "Credits",
+            &root,
+            LibraryVisibility::Private,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let scan = state
+        .db
+        .create_scan_job(library, Some(admin), "manual")
+        .await
+        .unwrap();
+    state.db.start_scan_job(scan, 2, false).await.unwrap();
+
+    let mut credited = catalog_input(0, "Nova Kern");
+    credited.title = "Credited".into();
+    credited.album = Some("The Record".into());
+    credited.album_artist = Some("Nova Kern; Lior Sand".into());
+    credited.is_compilation = false;
+    credited.roles = vec![
+        (
+            waveflow_server::library::tags::Role::Composer,
+            vec!["Otto Pen; Ada Vale".into()],
+        ),
+        (
+            waveflow_server::library::tags::Role::Producer,
+            vec!["Rita Sound".into()],
+        ),
+    ];
+    credited.performer_pairs = vec![("guitar".into(), "Jimmy Page".into())];
+    state
+        .db
+        .apply_catalog_track(library, scan, &credited, None, false)
+        .await
+        .unwrap();
+
+    let mut bare = catalog_input(1, "Nova Kern");
+    bare.title = "Bare".into();
+    bare.album = Some("The Record".into());
+    bare.album_artist = Some("Nova Kern; Lior Sand".into());
+    bare.is_compilation = false;
+    state
+        .db
+        .apply_catalog_track(library, scan, &bare, None, false)
+        .await
+        .unwrap();
+    state
+        .db
+        .consolidate_catalog_derivations(library)
+        .await
+        .unwrap();
+    state.db.finish_scan_job(scan, 0).await.unwrap();
+    let router = waveflow_server::app(&config, state.clone());
+
+    let albums = subsonic_json(
+        &router,
+        "getAlbumList2",
+        api_key,
+        "&type=alphabeticalByName",
+    )
+    .await;
+    let album_id = albums["subsonic-response"]["albumList2"]["album"][0]["id"]
+        .as_str()
+        .expect("the album is listed")
+        .to_owned();
+    let album = subsonic_json(&router, "getAlbum", api_key, &format!("&id={album_id}")).await;
+    let songs = album["subsonic-response"]["album"]["song"]
+        .as_array()
+        .expect("the album lists its songs")
+        .clone();
+    let song = |title: &str| {
+        songs
+            .iter()
+            .find(|song| song["title"] == title)
+            .unwrap_or_else(|| panic!("missing {title}"))
+            .clone()
+    };
+
+    let credited = song("Credited");
+    let contributors = credited["contributors"]
+        .as_array()
+        .expect("contributors is an array");
+    let mut named: Vec<(String, String)> = contributors
+        .iter()
+        .map(|credit| {
+            (
+                credit["role"].as_str().unwrap().to_owned(),
+                credit["artist"]["name"].as_str().unwrap().to_owned(),
+            )
+        })
+        .collect();
+    named.sort();
+    assert_eq!(
+        named,
+        vec![
+            ("composer".to_owned(), "Ada Vale".to_owned()),
+            ("composer".to_owned(), "Otto Pen".to_owned()),
+            ("performer".to_owned(), "Jimmy Page".to_owned()),
+            ("producer".to_owned(), "Rita Sound".to_owned()),
+        ],
+        "every role but artist and albumartist is a contributor"
+    );
+    let performer = contributors
+        .iter()
+        .find(|credit| credit["role"] == "performer")
+        .expect("the performer is credited");
+    assert_eq!(
+        performer["subRole"], "Guitar",
+        "a performer carries the instrument, title-cased"
+    );
+    assert_eq!(
+        credited["displayComposer"], "Otto Pen \u{2022} Ada Vale",
+        "the composers, in tag order, joined the way the reference joins them"
+    );
+    let album_artists: Vec<&str> = credited["albumArtists"]
+        .as_array()
+        .expect("albumArtists is an array")
+        .iter()
+        .map(|artist| artist["name"].as_str().unwrap())
+        .collect();
+    assert_eq!(album_artists, vec!["Nova Kern", "Lior Sand"]);
+
+    let bare = song("Bare");
+    assert_eq!(bare["contributors"], serde_json::json!([]));
+    assert_eq!(bare["displayComposer"], "");
+
+    let artists = subsonic_json(&router, "getArtists", api_key, "").await;
+    let indexed: Vec<serde_json::Value> = artists["subsonic-response"]["artists"]["index"]
+        .as_array()
+        .expect("the artist index")
+        .iter()
+        .flat_map(|index| index["artist"].as_array().unwrap().clone())
+        .collect();
+    let named = |name: &str| {
+        indexed
+            .iter()
+            .find(|artist| artist["name"] == name)
+            .unwrap_or_else(|| panic!("{name} is indexed"))
+            .clone()
+    };
+    assert_eq!(
+        named("Nova Kern")["roles"],
+        serde_json::json!(["albumartist", "artist"]),
+        "an album artist who also performs says both, in a stable order"
+    );
+    // A composer holds no album, so the index does not list them — but the
+    // artist is still in the catalogue, findable by name, and still says what
+    // it is. The second half is what makes the first acceptable: filtering the
+    // index would otherwise put a credited artist out of reach entirely.
+    let found = subsonic_json(&router, "search3", api_key, "&query=Otto").await;
+    let found_artists: Vec<&str> = found["subsonic-response"]["searchResult3"]["artist"]
+        .as_array()
+        .map(|all| {
+            all.iter()
+                .filter_map(|artist| artist["name"].as_str())
+                .collect()
+        })
+        .unwrap_or_default();
+    assert!(
+        found_artists.contains(&"Otto Pen"),
+        "a composer is reachable by searching their own name: {found_artists:?}"
+    );
+    assert!(
+        !indexed.iter().any(|artist| artist["name"] == "Otto Pen"),
+        "an artist credited on no album is not one of the library's artists"
+    );
+    let catalogue = state
+        .services
+        .list_artists(admin, None, Default::default())
+        .await
+        .unwrap();
+    let composer = catalogue
+        .iter()
+        .find(|summary| summary.artist.name == "Otto Pen")
+        .expect("the composer is in the catalogue");
+    assert_eq!(composer.artist.roles, vec!["composer".to_owned()]);
+
+    // An artist whose credits nothing has counted yet still says the field is
+    // supported. The presence rule turns on emitting the default, and a record
+    // that omits its own array is a server saying it does not read roles at
+    // all — which is what the classification above must not do.
+    let indexed_artist = named("Nova Kern");
+    assert!(
+        indexed_artist["roles"].is_array(),
+        "a full artist record carries its roles array: {indexed_artist:?}"
+    );
+    // The same record through a second surface, because `getStarred2` builds
+    // its artists from the same projection and the same node.
+    let artist_id = indexed_artist["id"].as_str().expect("the artist id");
+    subsonic_json(&router, "star", api_key, &format!("&artistId={artist_id}")).await;
+    let starred = subsonic_json(&router, "getStarred2", api_key, "").await;
+    let starred_artist = starred["subsonic-response"]["starred2"]["artist"]
+        .as_array()
+        .expect("the starred artists are an array")
+        .iter()
+        .find(|artist| artist["id"] == artist_id)
+        .expect("the artist that was just starred")
+        .clone();
+    assert!(
+        starred_artist["roles"].is_array(),
+        "and carries it there too: {starred_artist:?}"
+    );
+    // A browsing child is an artist or an album under the element name a song
+    // uses, and only `isDir` tells them apart. A folder entry must not answer
+    // with a track's relations: an artist reporting `isrc: []` would be the
+    // server claiming it read a recording identifier off a directory.
+    let folders = subsonic_json(&router, "getMusicFolders", api_key, "").await;
+    let folder_id = folders["subsonic-response"]["musicFolders"]["musicFolder"][0]["id"]
+        .as_str()
+        .expect("the library is listed")
+        .to_owned();
+    let directory = subsonic_json(
+        &router,
+        "getMusicDirectory",
+        api_key,
+        &format!("&id={folder_id}"),
+    )
+    .await;
+    let entry = directory["subsonic-response"]["directory"]["child"]
+        .as_array()
+        .and_then(|children| children.iter().find(|child| child["isDir"] == true))
+        .expect("the folder lists its artists")
+        .clone();
+    for absent in [
+        "isrc",
+        "moods",
+        "albumArtists",
+        "contributors",
+        "artists",
+        "genres",
+    ] {
+        assert!(
+            entry.get(absent).is_none(),
+            "a directory entry carries no {absent}: {entry:?}"
+        );
+    }
+    assert!(
+        entry["roles"].is_array(),
+        "but it keeps the artist record shape it is rendered from: {entry:?}"
+    );
+
+    let xml = router
+        .clone()
+        .oneshot(
+            Request::get(format!(
+                "/rest/getAlbum.view?apiKey={api_key}&v=1.16.1&c=fixtures&id={album_id}"
+            ))
+            .body(Body::empty())
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    let xml = body_text(xml).await;
+    assert!(
+        xml.contains("<contributors role=\"performer\" subRole=\"Guitar\">"),
+        "the performer credit is an element carrying its instrument: {xml}"
+    );
+    assert!(
+        xml.contains("displayComposer=\"Otto Pen \u{2022} Ada Vale\""),
+        "the composer display string reaches XML too: {xml}"
+    );
+    // And the case that needs the field injected rather than rendered: an
+    // artist whose files have all gone missing keeps its row and its credits,
+    // but nothing counts them any more, so it holds no role at all. It still
+    // has to say the field is supported.
+    sqlx::query("UPDATE track SET is_available = 0 WHERE library_id = ?")
+        .bind(library.to_string())
+        .execute(state.db.pool())
+        .await
+        .unwrap();
+    state
+        .db
+        .consolidate_catalog_derivations(library)
+        .await
+        .unwrap();
+    let bereft = subsonic_json(&router, "getArtist", api_key, &format!("&id={artist_id}")).await;
+    assert_eq!(
+        bereft["subsonic-response"]["artist"]["roles"],
+        serde_json::json!([]),
+        "empty, not absent: absent would say the server does not read roles"
+    );
+}
diff --git a/tests/subsonic_fields/main.rs b/tests/subsonic_fields/main.rs
new file mode 100644
index 00000000..3cdeab8a
--- /dev/null
+++ b/tests/subsonic_fields/main.rs
@@ -0,0 +1,23 @@
+//! The shape of what the facade emits, in both encodings.
+//!
+//! Split out of `v2_foundations.rs`.
+
+use axum::body::Body;
+use axum::http::Request;
+use axum::http::StatusCode;
+use tower::ServiceExt;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
+use waveflow_server::storage::database::AccountRole;
+use waveflow_server::storage::database::LibraryVisibility;
+
+// Not every target uses every fixture, and a shared module is not dead
+// code for being partly unused here.
+#[allow(dead_code)]
+#[path = "../support/mod.rs"]
+mod support;
+use support::*;
+
+mod albums;
+mod credits;
+mod media_items;
diff --git a/tests/subsonic_fields/media_items.rs b/tests/subsonic_fields/media_items.rs
new file mode 100644
index 00000000..a1b76833
--- /dev/null
+++ b/tests/subsonic_fields/media_items.rs
@@ -0,0 +1,302 @@
+//! The modern OpenSubsonic fields a media item carries, in both encodings.
+
+use super::*;
+
+/// OpenSubsonic reports support for a field by emitting it even when the value
+/// is unknown, so a track with nothing tagged is as much a test of the contract
+/// as a fully tagged one — in both encodings, since XML and JSON build the
+/// arrays through different code paths.
+#[tokio::test]
+async fn media_items_carry_the_modern_opensubsonic_fields_in_both_encodings() {
+    let (_temp, config, state) = test_app().await;
+    let api_key = "wfsk_fields-key";
+    let subsonic_password = "fields-secret";
+    let owner = state
+        .db
+        .create_account(
+            "fields-owner",
+            &security::hash_password("correct horse battery staple").unwrap(),
+            AccountRole::Admin,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    state
+        .db
+        .set_subsonic_credential(
+            owner,
+            owner,
+            &state
+                .secret_box
+                .encrypt(subsonic_password.as_bytes())
+                .unwrap(),
+            &security::token_hash(api_key),
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let music = config.data_dir.join("fields-music");
+    std::fs::create_dir_all(&music).unwrap();
+    let library = state
+        .db
+        .create_library(
+            owner,
+            "Fields",
+            &std::fs::canonicalize(&music).unwrap(),
+            LibraryVisibility::Private,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let scan = state
+        .db
+        .create_scan_job(library, Some(owner), "manual")
+        .await
+        .unwrap();
+    state.db.start_scan_job(scan, 2, false).await.unwrap();
+
+    // Two credited artists and two genres, so tag order and the split are both
+    // observable. The album is a compilation, which is stored and was never
+    // surfaced before.
+    let mut tagged = browse_input(80, "Tagged", "Sun Bloom", "Aria Lux", Some(1), Some(1));
+    tagged.artist = Some("Aria Lux; Mono Field".into());
+    tagged.album_artist = Some("Aria Lux".into());
+    tagged.genre = Some("Rock; Jazz".into());
+    tagged.is_compilation = true;
+    tagged.musicbrainz_recording_id = Some("9f4c1d2e-recording".into());
+    tagged.musicbrainz_release_id = Some("3a8b7c6d-release".into());
+    tagged.musicbrainz_artist_id = Some("1b2c3d4e-artist".into());
+    tagged.replay_gain_track_gain = Some(-7.32);
+    tagged.replay_gain_track_peak = Some(0.988_525);
+    tagged.replay_gain_album_gain = Some(-6.5);
+    tagged.replay_gain_album_peak = Some(1.0);
+    tagged.bpm = Some(128);
+    tagged.sort_title = Some("Tagged, The".into());
+    tagged.comment = Some("ripped from vinyl".into());
+    tagged.isrc = Some("FRZ039800212; GBAYE0601498".into());
+    tagged.moods = Some("Melancholic; Warm".into());
+    tagged.explicit_status = Some("clean".into());
+    state
+        .db
+        .apply_catalog_track(library, scan, &tagged, None, false)
+        .await
+        .unwrap();
+
+    // Nothing tagged and nothing decoded: the case where every added field has
+    // to be present with its default rather than omitted.
+    let mut bare = browse_input(81, "Bare", "Sun Bloom", "Aria Lux", Some(2), Some(1));
+    bare.artist = None;
+    bare.album_artist = Some("Aria Lux".into());
+    bare.genre = None;
+    bare.is_compilation = true;
+    bare.sample_rate = None;
+    bare.channels = None;
+    bare.bit_depth = None;
+    state
+        .db
+        .apply_catalog_track(library, scan, &bare, None, false)
+        .await
+        .unwrap();
+    state.db.finish_scan_job(scan, 0).await.unwrap();
+
+    let songs = state
+        .services
+        .catalog_snapshot(owner, &[])
+        .await
+        .unwrap()
+        .songs;
+    let song_id = |title: &str| {
+        songs
+            .iter()
+            .find(|song| song.title == title)
+            .unwrap_or_else(|| panic!("{title} was indexed"))
+            .id
+    };
+    let tagged_id = song_id("Tagged");
+    let bare_id = song_id("Bare");
+    state
+        .services
+        .scrobble(owner, tagged_id, true, Some(1_700_000_000_000))
+        .await
+        .unwrap();
+
+    let router = waveflow_server::app(&config, state.clone());
+
+    let tagged_json = subsonic_json(&router, "getSong", api_key, &format!("&id={tagged_id}")).await;
+    let tagged_json = &tagged_json["subsonic-response"]["song"];
+    assert_eq!(tagged_json["samplingRate"], 44_100);
+    assert_eq!(tagged_json["channelCount"], 2);
+    assert_eq!(tagged_json["bitDepth"], 16);
+    assert_eq!(tagged_json["mediaType"], "song");
+    assert_eq!(tagged_json["isVideo"], false);
+    assert_eq!(tagged_json["playCount"], 1);
+    assert!(tagged_json["played"].is_string());
+    assert_eq!(tagged_json["displayArtist"], "Aria Lux; Mono Field");
+    // Tag order, not alphabetical: "Mono Field" is credited second.
+    let artists = tagged_json["artists"].as_array().unwrap();
+    assert_eq!(artists.len(), 2);
+    assert_eq!(artists[0]["name"], "Aria Lux");
+    assert_eq!(artists[1]["name"], "Mono Field");
+    assert!(artists[0]["id"].is_string());
+    // The primary credit still matches the frozen artistId.
+    assert_eq!(tagged_json["artistId"], artists[0]["id"]);
+    assert_eq!(tagged_json["musicBrainzId"], "9f4c1d2e-recording");
+    assert_eq!(tagged_json["bpm"], 128);
+    assert_eq!(tagged_json["sortName"], "Tagged, The");
+    assert_eq!(tagged_json["comment"], "ripped from vinyl");
+    // Multi-valued like artists and genres, and split the same way.
+    assert_eq!(
+        tagged_json["isrc"],
+        serde_json::json!(["FRZ039800212", "GBAYE0601498"])
+    );
+    assert_eq!(
+        tagged_json["replayGain"],
+        serde_json::json!({
+            "trackGain": -7.32,
+            "trackPeak": 0.988_525,
+            "albumGain": -6.5,
+            "albumPeak": 1.0
+        })
+    );
+    assert_eq!(
+        tagged_json["moods"],
+        serde_json::json!(["Melancholic", "Warm"])
+    );
+    assert_eq!(tagged_json["explicitStatus"], "clean");
+    // Genres are ordered by name so two identical catalogues answer identically.
+    let genres = tagged_json["genres"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|genre| genre["name"].as_str().unwrap().to_owned())
+        .collect::<Vec<_>>();
+    assert_eq!(genres, vec!["Jazz", "Rock"]);
+
+    let bare_json = subsonic_json(&router, "getSong", api_key, &format!("&id={bare_id}")).await;
+    let bare_json = &bare_json["subsonic-response"]["song"];
+    // Present with their defaults. Omitting them would tell the client this
+    // server does not implement the fields at all.
+    assert_eq!(bare_json["samplingRate"], 0);
+    assert_eq!(bare_json["channelCount"], 0);
+    assert_eq!(bare_json["bitDepth"], 0);
+    assert_eq!(bare_json["playCount"], 0);
+    assert_eq!(bare_json["displayArtist"], "");
+    assert_eq!(bare_json["artists"], serde_json::json!([]));
+    assert_eq!(bare_json["genres"], serde_json::json!([]));
+    assert_eq!(bare_json["musicBrainzId"], "");
+    assert_eq!(bare_json["bpm"], 0);
+    assert_eq!(bare_json["sortName"], "");
+    assert_eq!(bare_json["comment"], "");
+    assert_eq!(bare_json["isrc"], serde_json::json!([]));
+    assert_eq!(bare_json["moods"], serde_json::json!([]));
+    assert_eq!(bare_json["explicitStatus"], "");
+    // replayGain is the one addition whose members the specification says to
+    // omit when unknown. The container still has to be there: it is what says
+    // the server reads gain tags at all.
+    assert_eq!(bare_json["replayGain"], serde_json::json!({}));
+    // The documented exception: an empty string is not a timestamp, and
+    // playCount already signals that play statistics are supported.
+    assert!(bare_json.get("played").is_none());
+
+    // XML builds the arrays as repeated child elements rather than as a JSON
+    // array, so it is asserted separately rather than assumed.
+    let plain_auth = format!("u=fields-owner&p={subsonic_password}&v=1.16.1&c=golden");
+    let xml_song = |id: uuid::Uuid| {
+        let router = router.clone();
+        let plain_auth = plain_auth.clone();
+        async move {
+            let response = router
+                .oneshot(
+                    Request::get(format!("/rest/getSong.view?{plain_auth}&id={id}"))
+                        .body(Body::empty())
+                        .unwrap(),
+                )
+                .await
+                .unwrap();
+            assert_eq!(response.status(), StatusCode::OK);
+            body_text(response).await
+        }
+    };
+    let tagged_xml = xml_song(tagged_id).await;
+    assert!(tagged_xml.contains("samplingRate=\"44100\""));
+    assert!(tagged_xml.contains("channelCount=\"2\""));
+    assert!(tagged_xml.contains("bitDepth=\"16\""));
+    assert!(tagged_xml.contains("mediaType=\"song\""));
+    assert!(tagged_xml.contains("isVideo=\"false\""));
+    assert!(tagged_xml.contains("<artists "));
+    assert!(tagged_xml.contains("name=\"Mono Field\""));
+    assert!(tagged_xml.contains("<genres name=\"Jazz\"/>"));
+    assert!(tagged_xml.contains("<genres name=\"Rock\"/>"));
+    assert!(tagged_xml.contains("played="));
+    assert!(tagged_xml.contains("musicBrainzId=\"9f4c1d2e-recording\""));
+    assert!(tagged_xml.contains("bpm=\"128\""));
+    assert!(tagged_xml.contains("<isrc>FRZ039800212</isrc>"));
+    assert!(tagged_xml.contains("<isrc>GBAYE0601498</isrc>"));
+    assert!(tagged_xml.contains("trackGain=\"-7.32\""));
+    assert!(tagged_xml.contains("<moods>Melancholic</moods>"));
+    assert!(tagged_xml.contains("explicitStatus=\"clean\""));
+
+    let bare_xml = xml_song(bare_id).await;
+    assert!(bare_xml.contains("samplingRate=\"0\""));
+    assert!(bare_xml.contains("bitDepth=\"0\""));
+    assert!(bare_xml.contains("displayArtist=\"\""));
+    // An empty array has no repeated element to render, which is exactly why
+    // the JSON branch needs its own rule and gets its own assertion above.
+    assert!(!bare_xml.contains("<artists "));
+    assert!(!bare_xml.contains("<genres "));
+    assert!(!bare_xml.contains("played="));
+    assert!(bare_xml.contains("musicBrainzId=\"\""));
+    assert!(bare_xml.contains("bpm=\"0\""));
+    assert!(!bare_xml.contains("<isrc>"));
+    // Present but empty, in both encodings.
+    assert!(bare_xml.contains("<replayGain/>"));
+
+    // Albums carry their own additions.
+    let album_id = state
+        .services
+        .catalog_snapshot(owner, &[])
+        .await
+        .unwrap()
+        .albums[0]
+        .id;
+    let album = subsonic_json(&router, "getAlbum", api_key, &format!("&id={album_id}")).await;
+    let album = &album["subsonic-response"]["album"];
+    assert_eq!(album["isCompilation"], true);
+    assert_eq!(album["playCount"], 1);
+    assert_eq!(album["displayArtist"], "Aria Lux");
+    assert!(album["played"].is_string());
+
+    // The native surface reads the same projection, so the structured relations
+    // reach it without a second implementation.
+    let token = login_token(&router, "fields-owner", "correct horse battery staple").await;
+    let native = router
+        .clone()
+        .oneshot(
+            Request::get(format!("/api/v2/tracks/{tagged_id}"))
+                .header("authorization", format!("Bearer {token}"))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(native.status(), StatusCode::OK);
+    let native = json_body(native).await;
+    assert_eq!(native["sample_rate"], 44_100);
+    assert_eq!(native["play_count"], 1);
+    assert_eq!(
+        native["artists"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|artist| artist["name"].as_str().unwrap().to_owned())
+            .collect::<Vec<_>>(),
+        vec!["Aria Lux", "Mono Field"]
+    );
+    assert_eq!(native["genres"], serde_json::json!(["Jazz", "Rock"]));
+    assert_eq!(native["musicbrainz_id"], "9f4c1d2e-recording");
+    assert_eq!(native["bpm"], 128);
+    assert_eq!(
+        native["isrc"],
+        serde_json::json!(["FRZ039800212", "GBAYE0601498"])
+    );
+}
diff --git a/tests/subsonic_methods/main.rs b/tests/subsonic_methods/main.rs
index 869c2c00..d97d39a7 100644
--- a/tests/subsonic_methods/main.rs
+++ b/tests/subsonic_methods/main.rs
@@ -7,12 +7,12 @@ use axum::http::Request;
 use axum::http::StatusCode;
 use tower::ServiceExt;
 use uuid::Uuid;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::database::AccountRole;
-use waveflow_server::database::LibraryRole;
-use waveflow_server::database::LibraryVisibility;
-use waveflow_server::security;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
 use waveflow_server::services::ServiceError;
+use waveflow_server::storage::database::AccountRole;
+use waveflow_server::storage::database::LibraryRole;
+use waveflow_server::storage::database::LibraryVisibility;
 
 // Not every target uses every fixture, and a shared module is not dead
 // code for being partly unused here.
diff --git a/tests/subsonic_methods/transcoding.rs b/tests/subsonic_methods/transcoding.rs
index 1a0337ae..7107fb71 100644
--- a/tests/subsonic_methods/transcoding.rs
+++ b/tests/subsonic_methods/transcoding.rs
@@ -58,7 +58,7 @@ async fn a_format_the_facade_cannot_produce_falls_back_and_aac_is_produced() {
     run_scan(
         &state,
         owner,
-        waveflow_server::catalog::LibraryRecord {
+        waveflow_server::storage::catalog::LibraryRecord {
             id: library,
             name: "Formats".into(),
             root_path: root,
@@ -148,7 +148,7 @@ async fn a_subsonic_transcode_carries_the_tracks_replay_gain_when_asked() {
 
     let temp = tempfile::tempdir().unwrap();
     let mut config = waveflow_server::Config::for_data_dir(temp.path().join("data"));
-    config.subsonic_replay_gain = waveflow_server::replay_gain::ReplayGainMode::Track;
+    config.subsonic_replay_gain = waveflow_server::media::replay_gain::ReplayGainMode::Track;
     let state = waveflow_server::initialize(&config).await.unwrap();
     let (owner, api_key) = subsonic_account(&state, "levelled").await;
     let music = config.data_dir.join("levelled-music");
@@ -186,7 +186,7 @@ async fn a_subsonic_transcode_carries_the_tracks_replay_gain_when_asked() {
     run_scan(
         &state,
         owner,
-        waveflow_server::catalog::LibraryRecord {
+        waveflow_server::storage::catalog::LibraryRecord {
             id: library,
             name: "levelled".into(),
             root_path: root,
diff --git a/tests/support/mod.rs b/tests/support/mod.rs
index cc61cde9..1bc6edfd 100644
--- a/tests/support/mod.rs
+++ b/tests/support/mod.rs
@@ -9,8 +9,8 @@ use axum::http::StatusCode;
 use http_body_util::BodyExt;
 use tempfile::TempDir;
 use tower::ServiceExt;
-use waveflow_server::catalog::CatalogTrackInput;
-use waveflow_server::catalog::LibraryRecord;
+use waveflow_server::storage::catalog::CatalogTrackInput;
+use waveflow_server::storage::catalog::LibraryRecord;
 use waveflow_server::Config;
 
 pub async fn test_app() -> (TempDir, Config, waveflow_server::AppState) {
@@ -445,8 +445,8 @@ pub async fn seed_titles(
             account,
             name,
             &std::fs::canonicalize(&root).unwrap(),
-            waveflow_server::database::LibraryVisibility::Private,
-            waveflow_server::authentication::now_ms(),
+            waveflow_server::storage::database::LibraryVisibility::Private,
+            waveflow_server::auth::authentication::now_ms(),
         )
         .await
         .unwrap();
@@ -537,7 +537,7 @@ pub async fn admin_with_api_token(
     username: &str,
 ) -> (uuid::Uuid, String) {
     let id = uuid::Uuid::new_v4();
-    let now = waveflow_server::authentication::now_ms();
+    let now = waveflow_server::auth::authentication::now_ms();
     sqlx::query(
         "INSERT INTO account (id, username, password_hash, role, disabled, created_at, updated_at) \
          VALUES (?, ?, 'this-account-never-authenticates', 'admin', 0, ?, ?)",
diff --git a/tests/sync/claims.rs b/tests/sync/claims.rs
new file mode 100644
index 00000000..db4b2840
--- /dev/null
+++ b/tests/sync/claims.rs
@@ -0,0 +1,331 @@
+//! A claim precedes validation, and an invalid one rolls back.
+
+use super::*;
+
+#[tokio::test]
+async fn sync_claim_precedes_state_validation_and_invalid_claims_roll_back() {
+    let (_temp, config, state) = test_app().await;
+    let hash = security::hash_password(&Uuid::new_v4().to_string()).unwrap();
+    let owner = state
+        .db
+        .create_account("claim-owner", &hash, AccountRole::Admin, now_ms())
+        .await
+        .unwrap();
+    let listener = state
+        .db
+        .create_account("claim-listener", &hash, AccountRole::User, now_ms())
+        .await
+        .unwrap();
+    let music = config.data_dir.join("claim-music");
+    std::fs::create_dir_all(&music).unwrap();
+    let library = state
+        .db
+        .create_library(
+            owner,
+            "Claim library",
+            &std::fs::canonicalize(&music).unwrap(),
+            LibraryVisibility::Private,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let scan = state
+        .db
+        .create_scan_job(library, Some(owner), "manual")
+        .await
+        .unwrap();
+    state.db.start_scan_job(scan, 1, false).await.unwrap();
+    state
+        .db
+        .apply_catalog_track(
+            library,
+            scan,
+            &browse_input(
+                0,
+                "Claimed Song",
+                "Claimed Album",
+                "Claimed Artist",
+                Some(1),
+                Some(1),
+            ),
+            None,
+            false,
+        )
+        .await
+        .unwrap();
+    state.db.finish_scan_job(scan, 0).await.unwrap();
+    let track = state.db.list_tracks_for_user(owner, library).await.unwrap()[0].id;
+
+    let playlist_context = MutationContext {
+        operation_id: Uuid::new_v4(),
+        origin_device_id: None,
+    };
+    let playlist = state
+        .services
+        .create_playlist_with_context(owner, "Claimed playlist", &[track], playlist_context)
+        .await
+        .unwrap();
+    state
+        .services
+        .delete_playlist(owner, playlist.id)
+        .await
+        .unwrap();
+    let missing_playlist_context = MutationContext {
+        operation_id: Uuid::new_v4(),
+        origin_device_id: None,
+    };
+    assert!(matches!(
+        state
+            .services
+            .update_playlist_with_context(
+                owner,
+                playlist.id,
+                Some("Changed after deletion"),
+                None,
+                None,
+                &[],
+                &[],
+                Default::default(),
+                missing_playlist_context,
+            )
+            .await,
+        Err(ServiceError::NotFound)
+    ));
+    assert!(matches!(
+        state
+            .services
+            .update_playlist_with_context(
+                owner,
+                playlist.id,
+                Some("Divergent replay after deletion"),
+                None,
+                None,
+                &[],
+                &[],
+                Default::default(),
+                playlist_context,
+            )
+            .await,
+        Err(ServiceError::Conflict)
+    ));
+
+    state
+        .db
+        .add_library_member(owner, library, listener, LibraryRole::Listener, now_ms())
+        .await
+        .unwrap();
+    let inaccessible_context = MutationContext {
+        operation_id: Uuid::new_v4(),
+        origin_device_id: None,
+    };
+    state
+        .services
+        .set_star_with_context(listener, "track", track, true, inaccessible_context)
+        .await
+        .unwrap();
+    assert!(state
+        .db
+        .remove_library_member(owner, library, listener, now_ms())
+        .await
+        .unwrap());
+    state
+        .services
+        .set_star_with_context(listener, "track", track, true, inaccessible_context)
+        .await
+        .unwrap();
+    // The row survives the replay, but a revoked membership must stop exposing
+    // it: favourites are filtered by visibility exactly like ratings are.
+    assert!(state
+        .services
+        .starred_ids(listener)
+        .await
+        .unwrap()
+        .iter()
+        .all(|(_, entity_id, _)| *entity_id != track));
+    assert!(matches!(
+        state
+            .services
+            .set_rating_with_context(listener, "track", track, 5, inaccessible_context)
+            .await,
+        Err(ServiceError::Conflict)
+    ));
+    let fresh_inaccessible_context = MutationContext {
+        operation_id: Uuid::new_v4(),
+        origin_device_id: None,
+    };
+    assert!(matches!(
+        state
+            .services
+            .set_rating_with_context(listener, "track", track, 5, fresh_inaccessible_context)
+            .await,
+        Err(ServiceError::NotFound)
+    ));
+
+    let invalid_replay_context = MutationContext {
+        operation_id: Uuid::new_v4(),
+        origin_device_id: None,
+    };
+    state
+        .services
+        .set_rating_with_context(owner, "track", track, 5, invalid_replay_context)
+        .await
+        .unwrap();
+    assert!(matches!(
+        state
+            .services
+            .set_rating_with_context(owner, "track", track, 4, invalid_replay_context)
+            .await,
+        Err(ServiceError::Conflict)
+    ));
+
+    let rolled_back_context = MutationContext {
+        operation_id: Uuid::new_v4(),
+        origin_device_id: None,
+    };
+    assert!(matches!(
+        state
+            .services
+            .set_rating_with_context(owner, "track", track, 6, rolled_back_context)
+            .await,
+        Err(ServiceError::Invalid)
+    ));
+    let reservation_count: i64 = sqlx::query_scalar(
+        "SELECT COUNT(*) FROM sync_operation WHERE user_id=? AND operation_id=?",
+    )
+    .bind(owner.to_string())
+    .bind(rolled_back_context.operation_id.to_string())
+    .fetch_one(state.db.pool())
+    .await
+    .unwrap();
+    assert_eq!(reservation_count, 0);
+    state
+        .services
+        .set_rating_with_context(owner, "track", track, 4, rolled_back_context)
+        .await
+        .unwrap();
+
+    let oversized_queue = vec![track; MAX_QUEUE_TRACKS + 1];
+    assert!(matches!(
+        state
+            .services
+            .save_queue(owner, &oversized_queue, Some(track), 0, Some("limit-test"))
+            .await,
+        Err(ServiceError::Invalid)
+    ));
+    let oversized_share = vec![track; MAX_SHARE_TRACKS + 1];
+    assert!(matches!(
+        state
+            .services
+            .create_share(owner, &oversized_share, Some("limit-test"), None)
+            .await,
+        Err(ServiceError::Invalid)
+    ));
+
+    state
+        .services
+        .save_queue(
+            owner,
+            &[track, track],
+            Some(track),
+            0,
+            Some("duplicate-test"),
+        )
+        .await
+        .unwrap();
+    let duplicate_queue = state.services.queue(owner).await.unwrap().unwrap();
+    assert_eq!(
+        duplicate_queue
+            .songs
+            .iter()
+            .map(|song| song.id)
+            .collect::<Vec<_>>(),
+        vec![track, track]
+    );
+    let positions = sqlx::query_scalar::<_, i64>(
+        "SELECT position FROM play_queue_track WHERE user_id=? ORDER BY position",
+    )
+    .bind(owner.to_string())
+    .fetch_all(state.db.pool())
+    .await
+    .unwrap();
+    assert_eq!(positions, vec![0, 1]);
+
+    let aggregate_playlist = state
+        .services
+        .create_playlist(owner, "Unavailable aggregate", &[track])
+        .await
+        .unwrap();
+    let aggregate_share = state
+        .services
+        .create_share(owner, &[track], Some("Unavailable aggregate"), None)
+        .await
+        .unwrap();
+    let empty_scan = state
+        .db
+        .create_scan_job(library, Some(owner), "manual")
+        .await
+        .unwrap();
+    state.db.start_scan_job(empty_scan, 1, false).await.unwrap();
+    assert_eq!(
+        state
+            .db
+            .mark_unseen_unavailable(library, empty_scan)
+            .await
+            .unwrap(),
+        1
+    );
+    state.db.finish_scan_job(empty_scan, 1).await.unwrap();
+    let updated_playlist = state
+        .services
+        .update_playlist(
+            owner,
+            aggregate_playlist.id,
+            Some("Unavailable aggregate renamed"),
+            None,
+            None,
+            &[],
+            &[],
+            Default::default(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(updated_playlist.name, "Unavailable aggregate renamed");
+    assert!(updated_playlist.songs.is_empty());
+    let persisted_playlist_tracks: i64 =
+        sqlx::query_scalar("SELECT COUNT(*) FROM playlist_track WHERE playlist_id=?")
+            .bind(aggregate_playlist.id.to_string())
+            .fetch_one(state.db.pool())
+            .await
+            .unwrap();
+    assert_eq!(persisted_playlist_tracks, 1);
+    let unavailable_queue = state.services.queue(owner).await.unwrap().unwrap();
+    assert!(unavailable_queue.songs.is_empty());
+    // The saved row still names a current track. The projection must not, once
+    // that track is no longer among the songs it hands back.
+    assert!(unavailable_queue.current.is_none());
+    assert!(state
+        .services
+        .shares(owner)
+        .await
+        .unwrap()
+        .into_iter()
+        .find(|share| share.id == aggregate_share.id)
+        .unwrap()
+        .songs
+        .is_empty());
+    // A visitor sees the same thing as the owner: the share survives its last
+    // track going unavailable, rather than answering not-found after the visit
+    // has already been counted.
+    let visited = state
+        .services
+        .public_share(
+            aggregate_share
+                .url_token
+                .as_deref()
+                .expect("a freshly created share carries its token"),
+        )
+        .await
+        .expect("a share outlives a track that went unavailable");
+    assert!(visited.songs.is_empty());
+    state.services.sync_snapshot(owner, 100).await.unwrap();
+}
diff --git a/tests/sync.rs b/tests/sync/journal.rs
similarity index 61%
rename from tests/sync.rs
rename to tests/sync/journal.rs
index f4a94617..8a829d14 100644
--- a/tests/sync.rs
+++ b/tests/sync/journal.rs
@@ -1,33 +1,7 @@
-//! The two change feeds: the user journal and the library event stream —
-//! claims, cursors and tenancy.
-//!
-//! Split out of `v2_foundations.rs`.
+//! The user journal: idempotent, cursor-based and tenant-isolated, a write
+//! that waits for a lock still held, and the socket that wakes a client.
 
-use axum::body::Body;
-use axum::http::Request;
-use axum::http::StatusCode;
-use futures_util::StreamExt;
-use tokio_tungstenite::tungstenite::client::IntoClientRequest;
-use tower::ServiceExt;
-use uuid::Uuid;
-use waveflow_server::authentication::now_ms;
-use waveflow_server::catalog::LibraryRecord;
-use waveflow_server::database::AccountRole;
-use waveflow_server::database::LibraryRole;
-use waveflow_server::database::LibraryVisibility;
-use waveflow_server::security;
-use waveflow_server::services::ServiceError;
-use waveflow_server::services::MAX_QUEUE_TRACKS;
-use waveflow_server::services::MAX_SHARE_TRACKS;
-use waveflow_server::sync::MutationContext;
-use waveflow_server::sync::SyncError;
-use waveflow_server::sync::MAX_SYNC_LIMIT;
-
-// Not every target uses every fixture, and a shared module is not dead
-// code for being partly unused here.
-#[allow(dead_code)]
-mod support;
-use support::*;
+use super::*;
 
 #[tokio::test]
 async fn sync_journal_is_idempotent_cursor_based_and_tenant_isolated() {
@@ -800,540 +774,6 @@ async fn a_write_waits_for_a_lock_another_connection_still_holds() {
     );
 }
 
-#[tokio::test]
-async fn sync_claim_precedes_state_validation_and_invalid_claims_roll_back() {
-    let (_temp, config, state) = test_app().await;
-    let hash = security::hash_password(&Uuid::new_v4().to_string()).unwrap();
-    let owner = state
-        .db
-        .create_account("claim-owner", &hash, AccountRole::Admin, now_ms())
-        .await
-        .unwrap();
-    let listener = state
-        .db
-        .create_account("claim-listener", &hash, AccountRole::User, now_ms())
-        .await
-        .unwrap();
-    let music = config.data_dir.join("claim-music");
-    std::fs::create_dir_all(&music).unwrap();
-    let library = state
-        .db
-        .create_library(
-            owner,
-            "Claim library",
-            &std::fs::canonicalize(&music).unwrap(),
-            LibraryVisibility::Private,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let scan = state
-        .db
-        .create_scan_job(library, Some(owner), "manual")
-        .await
-        .unwrap();
-    state.db.start_scan_job(scan, 1, false).await.unwrap();
-    state
-        .db
-        .apply_catalog_track(
-            library,
-            scan,
-            &browse_input(
-                0,
-                "Claimed Song",
-                "Claimed Album",
-                "Claimed Artist",
-                Some(1),
-                Some(1),
-            ),
-            None,
-            false,
-        )
-        .await
-        .unwrap();
-    state.db.finish_scan_job(scan, 0).await.unwrap();
-    let track = state.db.list_tracks_for_user(owner, library).await.unwrap()[0].id;
-
-    let playlist_context = MutationContext {
-        operation_id: Uuid::new_v4(),
-        origin_device_id: None,
-    };
-    let playlist = state
-        .services
-        .create_playlist_with_context(owner, "Claimed playlist", &[track], playlist_context)
-        .await
-        .unwrap();
-    state
-        .services
-        .delete_playlist(owner, playlist.id)
-        .await
-        .unwrap();
-    let missing_playlist_context = MutationContext {
-        operation_id: Uuid::new_v4(),
-        origin_device_id: None,
-    };
-    assert!(matches!(
-        state
-            .services
-            .update_playlist_with_context(
-                owner,
-                playlist.id,
-                Some("Changed after deletion"),
-                None,
-                None,
-                &[],
-                &[],
-                Default::default(),
-                missing_playlist_context,
-            )
-            .await,
-        Err(ServiceError::NotFound)
-    ));
-    assert!(matches!(
-        state
-            .services
-            .update_playlist_with_context(
-                owner,
-                playlist.id,
-                Some("Divergent replay after deletion"),
-                None,
-                None,
-                &[],
-                &[],
-                Default::default(),
-                playlist_context,
-            )
-            .await,
-        Err(ServiceError::Conflict)
-    ));
-
-    state
-        .db
-        .add_library_member(owner, library, listener, LibraryRole::Listener, now_ms())
-        .await
-        .unwrap();
-    let inaccessible_context = MutationContext {
-        operation_id: Uuid::new_v4(),
-        origin_device_id: None,
-    };
-    state
-        .services
-        .set_star_with_context(listener, "track", track, true, inaccessible_context)
-        .await
-        .unwrap();
-    assert!(state
-        .db
-        .remove_library_member(owner, library, listener, now_ms())
-        .await
-        .unwrap());
-    state
-        .services
-        .set_star_with_context(listener, "track", track, true, inaccessible_context)
-        .await
-        .unwrap();
-    // The row survives the replay, but a revoked membership must stop exposing
-    // it: favourites are filtered by visibility exactly like ratings are.
-    assert!(state
-        .services
-        .starred_ids(listener)
-        .await
-        .unwrap()
-        .iter()
-        .all(|(_, entity_id, _)| *entity_id != track));
-    assert!(matches!(
-        state
-            .services
-            .set_rating_with_context(listener, "track", track, 5, inaccessible_context)
-            .await,
-        Err(ServiceError::Conflict)
-    ));
-    let fresh_inaccessible_context = MutationContext {
-        operation_id: Uuid::new_v4(),
-        origin_device_id: None,
-    };
-    assert!(matches!(
-        state
-            .services
-            .set_rating_with_context(listener, "track", track, 5, fresh_inaccessible_context)
-            .await,
-        Err(ServiceError::NotFound)
-    ));
-
-    let invalid_replay_context = MutationContext {
-        operation_id: Uuid::new_v4(),
-        origin_device_id: None,
-    };
-    state
-        .services
-        .set_rating_with_context(owner, "track", track, 5, invalid_replay_context)
-        .await
-        .unwrap();
-    assert!(matches!(
-        state
-            .services
-            .set_rating_with_context(owner, "track", track, 4, invalid_replay_context)
-            .await,
-        Err(ServiceError::Conflict)
-    ));
-
-    let rolled_back_context = MutationContext {
-        operation_id: Uuid::new_v4(),
-        origin_device_id: None,
-    };
-    assert!(matches!(
-        state
-            .services
-            .set_rating_with_context(owner, "track", track, 6, rolled_back_context)
-            .await,
-        Err(ServiceError::Invalid)
-    ));
-    let reservation_count: i64 = sqlx::query_scalar(
-        "SELECT COUNT(*) FROM sync_operation WHERE user_id=? AND operation_id=?",
-    )
-    .bind(owner.to_string())
-    .bind(rolled_back_context.operation_id.to_string())
-    .fetch_one(state.db.pool())
-    .await
-    .unwrap();
-    assert_eq!(reservation_count, 0);
-    state
-        .services
-        .set_rating_with_context(owner, "track", track, 4, rolled_back_context)
-        .await
-        .unwrap();
-
-    let oversized_queue = vec![track; MAX_QUEUE_TRACKS + 1];
-    assert!(matches!(
-        state
-            .services
-            .save_queue(owner, &oversized_queue, Some(track), 0, Some("limit-test"))
-            .await,
-        Err(ServiceError::Invalid)
-    ));
-    let oversized_share = vec![track; MAX_SHARE_TRACKS + 1];
-    assert!(matches!(
-        state
-            .services
-            .create_share(owner, &oversized_share, Some("limit-test"), None)
-            .await,
-        Err(ServiceError::Invalid)
-    ));
-
-    state
-        .services
-        .save_queue(
-            owner,
-            &[track, track],
-            Some(track),
-            0,
-            Some("duplicate-test"),
-        )
-        .await
-        .unwrap();
-    let duplicate_queue = state.services.queue(owner).await.unwrap().unwrap();
-    assert_eq!(
-        duplicate_queue
-            .songs
-            .iter()
-            .map(|song| song.id)
-            .collect::<Vec<_>>(),
-        vec![track, track]
-    );
-    let positions = sqlx::query_scalar::<_, i64>(
-        "SELECT position FROM play_queue_track WHERE user_id=? ORDER BY position",
-    )
-    .bind(owner.to_string())
-    .fetch_all(state.db.pool())
-    .await
-    .unwrap();
-    assert_eq!(positions, vec![0, 1]);
-
-    let aggregate_playlist = state
-        .services
-        .create_playlist(owner, "Unavailable aggregate", &[track])
-        .await
-        .unwrap();
-    let aggregate_share = state
-        .services
-        .create_share(owner, &[track], Some("Unavailable aggregate"), None)
-        .await
-        .unwrap();
-    let empty_scan = state
-        .db
-        .create_scan_job(library, Some(owner), "manual")
-        .await
-        .unwrap();
-    state.db.start_scan_job(empty_scan, 1, false).await.unwrap();
-    assert_eq!(
-        state
-            .db
-            .mark_unseen_unavailable(library, empty_scan)
-            .await
-            .unwrap(),
-        1
-    );
-    state.db.finish_scan_job(empty_scan, 1).await.unwrap();
-    let updated_playlist = state
-        .services
-        .update_playlist(
-            owner,
-            aggregate_playlist.id,
-            Some("Unavailable aggregate renamed"),
-            None,
-            None,
-            &[],
-            &[],
-            Default::default(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(updated_playlist.name, "Unavailable aggregate renamed");
-    assert!(updated_playlist.songs.is_empty());
-    let persisted_playlist_tracks: i64 =
-        sqlx::query_scalar("SELECT COUNT(*) FROM playlist_track WHERE playlist_id=?")
-            .bind(aggregate_playlist.id.to_string())
-            .fetch_one(state.db.pool())
-            .await
-            .unwrap();
-    assert_eq!(persisted_playlist_tracks, 1);
-    let unavailable_queue = state.services.queue(owner).await.unwrap().unwrap();
-    assert!(unavailable_queue.songs.is_empty());
-    // The saved row still names a current track. The projection must not, once
-    // that track is no longer among the songs it hands back.
-    assert!(unavailable_queue.current.is_none());
-    assert!(state
-        .services
-        .shares(owner)
-        .await
-        .unwrap()
-        .into_iter()
-        .find(|share| share.id == aggregate_share.id)
-        .unwrap()
-        .songs
-        .is_empty());
-    // A visitor sees the same thing as the owner: the share survives its last
-    // track going unavailable, rather than answering not-found after the visit
-    // has already been counted.
-    let visited = state
-        .services
-        .public_share(
-            aggregate_share
-                .url_token
-                .as_deref()
-                .expect("a freshly created share carries its token"),
-        )
-        .await
-        .expect("a share outlives a track that went unavailable");
-    assert!(visited.songs.is_empty());
-    state.services.sync_snapshot(owner, 100).await.unwrap();
-}
-
-/// The library half of the server can finally say what changed.
-///
-/// Until this feed existed a client's only way to learn a catalogue had moved
-/// was to poll it, and a poll that compares counts catches an added track and
-/// misses every retag. The property that matters most is the last one asserted
-/// here: a file retagged outside the API keeps its track id while its
-/// `full_hash` moves, and nothing else on the wire carries that.
-#[tokio::test]
-async fn the_library_feed_reports_what_a_scan_changed() {
-    let (_temp, config, state) = test_app().await;
-    let router = waveflow_server::app(&config, state.clone());
-    let password = "correct horse battery staple";
-    let hash = security::hash_password(password).unwrap();
-    let owner = state
-        .db
-        .create_account("feed-owner", &hash, AccountRole::Admin, now_ms())
-        .await
-        .unwrap();
-    let stranger = state
-        .db
-        .create_account("feed-stranger", &hash, AccountRole::User, now_ms())
-        .await
-        .unwrap();
-    let music = config.data_dir.join("feed-music");
-    std::fs::create_dir_all(&music).unwrap();
-    write_test_wav(&music.join("Kept.wav"));
-    write_test_wav_of_len(&music.join("Doomed.wav"), 1_600);
-    let root = std::fs::canonicalize(&music).unwrap();
-    let library_id = state
-        .db
-        .create_library(
-            owner,
-            "Feed library",
-            &root,
-            LibraryVisibility::Private,
-            now_ms(),
-        )
-        .await
-        .unwrap();
-    let library = LibraryRecord {
-        id: library_id,
-        name: "Feed library".into(),
-        root_path: root,
-    };
-    run_scan(&state, owner, library.clone()).await;
-
-    let owner_token = login_token(&router, "feed-owner", password).await;
-    let feed = |token: String, after: i64, limit: i64| {
-        let router = router.clone();
-        async move {
-            let response = router
-                .oneshot(
-                    Request::get(format!(
-                        "/api/v2/libraries/{library_id}/events?after={after}&limit={limit}"
-                    ))
-                    .header("authorization", format!("Bearer {token}"))
-                    .body(Body::empty())
-                    .unwrap(),
-                )
-                .await
-                .unwrap();
-            (response.status(), json_body(response).await)
-        }
-    };
-
-    let (status, page) = feed(owner_token.clone(), 0, 500).await;
-    assert_eq!(status, StatusCode::OK);
-    // Nothing has been cut, so the client's margin is the whole feed. Reported
-    // rather than left to be discovered: without it the first sign of trouble
-    // is the refusal itself, and by then the resync has to happen right now
-    // instead of at a moment the client would have chosen.
-    assert_eq!(page["purged_through"], 0);
-    let events = page["events"].as_array().unwrap();
-    assert_eq!(events.len(), 2, "one upsert per track the scan applied");
-    for event in events {
-        assert_eq!(event["entity_type"], "track");
-        assert_eq!(event["action"], "upsert");
-        // Nothing else on the wire carries this, which is the whole point.
-        assert_eq!(
-            event["payload"]["full_hash"].as_str().unwrap().len(),
-            64,
-            "a track upsert carries the file's hash"
-        );
-    }
-    assert_eq!(page["has_more"], false);
-    let after_first_scan = page["next_cursor"].as_i64().unwrap();
-    assert!(after_first_scan > 0);
-
-    // Paging is by cursor, not by offset: one at a time reaches the same two.
-    let (_, first_page) = feed(owner_token.clone(), 0, 1).await;
-    assert_eq!(first_page["events"].as_array().unwrap().len(), 1);
-    assert_eq!(first_page["has_more"], true);
-    let (_, second_page) = feed(
-        owner_token.clone(),
-        first_page["next_cursor"].as_i64().unwrap(),
-        1,
-    )
-    .await;
-    assert_eq!(second_page["events"].as_array().unwrap().len(), 1);
-    assert_eq!(second_page["has_more"], false);
-
-    // A file that disappears is a fact the feed names, not a count it reports.
-    std::fs::remove_file(music.join("Doomed.wav")).unwrap();
-    run_scan(&state, owner, library.clone()).await;
-    let (_, page) = feed(owner_token.clone(), after_first_scan, 500).await;
-    let deletes: Vec<&serde_json::Value> = page["events"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .filter(|event| event["action"] == "delete")
-        .collect();
-    assert_eq!(deletes.len(), 1, "exactly the track whose file is gone");
-    assert_eq!(deletes[0]["entity_type"], "track");
-
-    // The headline: a file retagged outside the API keeps its track id while
-    // its bytes move. The scan is the only witness, and this is where it says
-    // so — a client comparing counts would see nothing at all.
-    let kept_before = page["events"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .chain(events.iter())
-        .find(|event| event["action"] == "upsert")
-        .map(|event| event["payload"]["full_hash"].as_str().unwrap().to_owned());
-    let after_delete = page["next_cursor"].as_i64().unwrap();
-    write_test_wav_of_len(&music.join("Kept.wav"), 2_400);
-    run_scan(&state, owner, library).await;
-    let (_, page) = feed(owner_token, after_delete, 500).await;
-    let retagged = page["events"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .find(|event| event["action"] == "upsert")
-        .expect("rewriting the file makes the scan apply it again");
-    assert_ne!(
-        Some(
-            retagged["payload"]["full_hash"]
-                .as_str()
-                .unwrap()
-                .to_owned()
-        ),
-        kept_before,
-        "the hash in the feed has to be the file's new one"
-    );
-
-    // A caller who is not a member is told the library is not there, not that
-    // it is forbidden: answering differently would confirm it exists.
-    let stranger_token = login_token(&router, "feed-stranger", password).await;
-    let (status, _) = feed(stranger_token.clone(), 0, 500).await;
-    assert_eq!(status, StatusCode::NOT_FOUND);
-
-    // Admitted, then revoked. Membership is read on every request and cached
-    // nowhere, so losing it stops delivery at once — there is no subscriber
-    // list to fall out of step with.
-    sqlx::query(
-        "INSERT INTO library_member (library_id, user_id, role, created_at) \
-         VALUES (?, ?, 'listener', ?)",
-    )
-    .bind(library_id.to_string())
-    .bind(stranger.to_string())
-    .bind(now_ms())
-    .execute(state.db.pool())
-    .await
-    .unwrap();
-    let (status, admitted) = feed(stranger_token.clone(), 0, 500).await;
-    assert_eq!(status, StatusCode::OK);
-    assert!(!admitted["events"].as_array().unwrap().is_empty());
-    sqlx::query("DELETE FROM library_member WHERE library_id = ? AND user_id = ?")
-        .bind(library_id.to_string())
-        .bind(stranger.to_string())
-        .execute(state.db.pool())
-        .await
-        .unwrap();
-    let (status, _) = feed(stranger_token, 0, 500).await;
-    assert_eq!(status, StatusCode::NOT_FOUND, "revocation is not deferred");
-
-    // A cursor below what has been cut away has missed events, and the feed
-    // says so rather than handing back a tail that would pass for a catch-up.
-    // The watermark records what was purged; nothing purges yet, so the test
-    // moves it by hand — which is exactly what a retention pass will do.
-    let owner_token = login_token(&router, "feed-owner", password).await;
-    sqlx::query("UPDATE library SET events_purged_through = 3 WHERE id = ?")
-        .bind(library_id.to_string())
-        .execute(state.db.pool())
-        .await
-        .unwrap();
-    let (status, _) = feed(owner_token.clone(), 2, 500).await;
-    assert_eq!(status, StatusCode::CONFLICT);
-    // Standing exactly at the cut is not standing before it.
-    let (status, page) = feed(owner_token, 3, 500).await;
-    assert_eq!(status, StatusCode::OK);
-    // And the page says where the cut is, while it is still being served
-    // rather than after it is refused. This client asked from 3 and the cut is
-    // at 3, so it holds no slack at all — one more purge and it is sent to the
-    // snapshot — and it can read that off the page it just received.
-    assert_eq!(page["purged_through"], 3);
-    // The margin is measured against the cursor the client held, not against
-    // `next_cursor`: that one is the end of the page just served, so it says
-    // what the margin becomes once this page is processed.
-    assert_eq!(3 - page["purged_through"].as_i64().unwrap(), 0);
-    assert!(
-        page["next_cursor"].as_i64().unwrap() > 3,
-        "the page advanced it"
-    );
-}
-
 /// The sync socket closes on a message larger than it would ever need to read,
 /// instead of buffering it whole (RFC-023 decision 5).
 ///
diff --git a/tests/sync/library_feed.rs b/tests/sync/library_feed.rs
new file mode 100644
index 00000000..69e5a9e7
--- /dev/null
+++ b/tests/sync/library_feed.rs
@@ -0,0 +1,209 @@
+//! The library event stream: what a scan changed.
+
+use super::*;
+
+/// The library half of the server can finally say what changed.
+///
+/// Until this feed existed a client's only way to learn a catalogue had moved
+/// was to poll it, and a poll that compares counts catches an added track and
+/// misses every retag. The property that matters most is the last one asserted
+/// here: a file retagged outside the API keeps its track id while its
+/// `full_hash` moves, and nothing else on the wire carries that.
+#[tokio::test]
+async fn the_library_feed_reports_what_a_scan_changed() {
+    let (_temp, config, state) = test_app().await;
+    let router = waveflow_server::app(&config, state.clone());
+    let password = "correct horse battery staple";
+    let hash = security::hash_password(password).unwrap();
+    let owner = state
+        .db
+        .create_account("feed-owner", &hash, AccountRole::Admin, now_ms())
+        .await
+        .unwrap();
+    let stranger = state
+        .db
+        .create_account("feed-stranger", &hash, AccountRole::User, now_ms())
+        .await
+        .unwrap();
+    let music = config.data_dir.join("feed-music");
+    std::fs::create_dir_all(&music).unwrap();
+    write_test_wav(&music.join("Kept.wav"));
+    write_test_wav_of_len(&music.join("Doomed.wav"), 1_600);
+    let root = std::fs::canonicalize(&music).unwrap();
+    let library_id = state
+        .db
+        .create_library(
+            owner,
+            "Feed library",
+            &root,
+            LibraryVisibility::Private,
+            now_ms(),
+        )
+        .await
+        .unwrap();
+    let library = LibraryRecord {
+        id: library_id,
+        name: "Feed library".into(),
+        root_path: root,
+    };
+    run_scan(&state, owner, library.clone()).await;
+
+    let owner_token = login_token(&router, "feed-owner", password).await;
+    let feed = |token: String, after: i64, limit: i64| {
+        let router = router.clone();
+        async move {
+            let response = router
+                .oneshot(
+                    Request::get(format!(
+                        "/api/v2/libraries/{library_id}/events?after={after}&limit={limit}"
+                    ))
+                    .header("authorization", format!("Bearer {token}"))
+                    .body(Body::empty())
+                    .unwrap(),
+                )
+                .await
+                .unwrap();
+            (response.status(), json_body(response).await)
+        }
+    };
+
+    let (status, page) = feed(owner_token.clone(), 0, 500).await;
+    assert_eq!(status, StatusCode::OK);
+    // Nothing has been cut, so the client's margin is the whole feed. Reported
+    // rather than left to be discovered: without it the first sign of trouble
+    // is the refusal itself, and by then the resync has to happen right now
+    // instead of at a moment the client would have chosen.
+    assert_eq!(page["purged_through"], 0);
+    let events = page["events"].as_array().unwrap();
+    assert_eq!(events.len(), 2, "one upsert per track the scan applied");
+    for event in events {
+        assert_eq!(event["entity_type"], "track");
+        assert_eq!(event["action"], "upsert");
+        // Nothing else on the wire carries this, which is the whole point.
+        assert_eq!(
+            event["payload"]["full_hash"].as_str().unwrap().len(),
+            64,
+            "a track upsert carries the file's hash"
+        );
+    }
+    assert_eq!(page["has_more"], false);
+    let after_first_scan = page["next_cursor"].as_i64().unwrap();
+    assert!(after_first_scan > 0);
+
+    // Paging is by cursor, not by offset: one at a time reaches the same two.
+    let (_, first_page) = feed(owner_token.clone(), 0, 1).await;
+    assert_eq!(first_page["events"].as_array().unwrap().len(), 1);
+    assert_eq!(first_page["has_more"], true);
+    let (_, second_page) = feed(
+        owner_token.clone(),
+        first_page["next_cursor"].as_i64().unwrap(),
+        1,
+    )
+    .await;
+    assert_eq!(second_page["events"].as_array().unwrap().len(), 1);
+    assert_eq!(second_page["has_more"], false);
+
+    // A file that disappears is a fact the feed names, not a count it reports.
+    std::fs::remove_file(music.join("Doomed.wav")).unwrap();
+    run_scan(&state, owner, library.clone()).await;
+    let (_, page) = feed(owner_token.clone(), after_first_scan, 500).await;
+    let deletes: Vec<&serde_json::Value> = page["events"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .filter(|event| event["action"] == "delete")
+        .collect();
+    assert_eq!(deletes.len(), 1, "exactly the track whose file is gone");
+    assert_eq!(deletes[0]["entity_type"], "track");
+
+    // The headline: a file retagged outside the API keeps its track id while
+    // its bytes move. The scan is the only witness, and this is where it says
+    // so — a client comparing counts would see nothing at all.
+    let kept_before = page["events"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .chain(events.iter())
+        .find(|event| event["action"] == "upsert")
+        .map(|event| event["payload"]["full_hash"].as_str().unwrap().to_owned());
+    let after_delete = page["next_cursor"].as_i64().unwrap();
+    write_test_wav_of_len(&music.join("Kept.wav"), 2_400);
+    run_scan(&state, owner, library).await;
+    let (_, page) = feed(owner_token, after_delete, 500).await;
+    let retagged = page["events"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|event| event["action"] == "upsert")
+        .expect("rewriting the file makes the scan apply it again");
+    assert_ne!(
+        Some(
+            retagged["payload"]["full_hash"]
+                .as_str()
+                .unwrap()
+                .to_owned()
+        ),
+        kept_before,
+        "the hash in the feed has to be the file's new one"
+    );
+
+    // A caller who is not a member is told the library is not there, not that
+    // it is forbidden: answering differently would confirm it exists.
+    let stranger_token = login_token(&router, "feed-stranger", password).await;
+    let (status, _) = feed(stranger_token.clone(), 0, 500).await;
+    assert_eq!(status, StatusCode::NOT_FOUND);
+
+    // Admitted, then revoked. Membership is read on every request and cached
+    // nowhere, so losing it stops delivery at once — there is no subscriber
+    // list to fall out of step with.
+    sqlx::query(
+        "INSERT INTO library_member (library_id, user_id, role, created_at) \
+         VALUES (?, ?, 'listener', ?)",
+    )
+    .bind(library_id.to_string())
+    .bind(stranger.to_string())
+    .bind(now_ms())
+    .execute(state.db.pool())
+    .await
+    .unwrap();
+    let (status, admitted) = feed(stranger_token.clone(), 0, 500).await;
+    assert_eq!(status, StatusCode::OK);
+    assert!(!admitted["events"].as_array().unwrap().is_empty());
+    sqlx::query("DELETE FROM library_member WHERE library_id = ? AND user_id = ?")
+        .bind(library_id.to_string())
+        .bind(stranger.to_string())
+        .execute(state.db.pool())
+        .await
+        .unwrap();
+    let (status, _) = feed(stranger_token, 0, 500).await;
+    assert_eq!(status, StatusCode::NOT_FOUND, "revocation is not deferred");
+
+    // A cursor below what has been cut away has missed events, and the feed
+    // says so rather than handing back a tail that would pass for a catch-up.
+    // The watermark records what was purged; nothing purges yet, so the test
+    // moves it by hand — which is exactly what a retention pass will do.
+    let owner_token = login_token(&router, "feed-owner", password).await;
+    sqlx::query("UPDATE library SET events_purged_through = 3 WHERE id = ?")
+        .bind(library_id.to_string())
+        .execute(state.db.pool())
+        .await
+        .unwrap();
+    let (status, _) = feed(owner_token.clone(), 2, 500).await;
+    assert_eq!(status, StatusCode::CONFLICT);
+    // Standing exactly at the cut is not standing before it.
+    let (status, page) = feed(owner_token, 3, 500).await;
+    assert_eq!(status, StatusCode::OK);
+    // And the page says where the cut is, while it is still being served
+    // rather than after it is refused. This client asked from 3 and the cut is
+    // at 3, so it holds no slack at all — one more purge and it is sent to the
+    // snapshot — and it can read that off the page it just received.
+    assert_eq!(page["purged_through"], 3);
+    // The margin is measured against the cursor the client held, not against
+    // `next_cursor`: that one is the end of the page just served, so it says
+    // what the margin becomes once this page is processed.
+    assert_eq!(3 - page["purged_through"].as_i64().unwrap(), 0);
+    assert!(
+        page["next_cursor"].as_i64().unwrap() > 3,
+        "the page advanced it"
+    );
+}
diff --git a/tests/sync/main.rs b/tests/sync/main.rs
new file mode 100644
index 00000000..ac73c761
--- /dev/null
+++ b/tests/sync/main.rs
@@ -0,0 +1,35 @@
+//! The two change feeds: the user journal and the library event stream —
+//! claims, cursors and tenancy.
+//!
+//! Split out of `v2_foundations.rs`.
+
+use axum::body::Body;
+use axum::http::Request;
+use axum::http::StatusCode;
+use futures_util::StreamExt;
+use tokio_tungstenite::tungstenite::client::IntoClientRequest;
+use tower::ServiceExt;
+use uuid::Uuid;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
+use waveflow_server::services::ServiceError;
+use waveflow_server::services::MAX_QUEUE_TRACKS;
+use waveflow_server::services::MAX_SHARE_TRACKS;
+use waveflow_server::storage::catalog::LibraryRecord;
+use waveflow_server::storage::database::AccountRole;
+use waveflow_server::storage::database::LibraryRole;
+use waveflow_server::storage::database::LibraryVisibility;
+use waveflow_server::storage::sync::MutationContext;
+use waveflow_server::storage::sync::SyncError;
+use waveflow_server::storage::sync::MAX_SYNC_LIMIT;
+
+// Not every target uses every fixture, and a shared module is not dead
+// code for being partly unused here.
+#[allow(dead_code)]
+#[path = "../support/mod.rs"]
+mod support;
+use support::*;
+
+mod claims;
+mod journal;
+mod library_feed;
diff --git a/tests/uploads/listings.rs b/tests/uploads/listings.rs
index c4cfb701..03360e84 100644
--- a/tests/uploads/listings.rs
+++ b/tests/uploads/listings.rs
@@ -45,7 +45,7 @@ async fn a_client_can_tell_its_own_upload_from_a_discovery() {
     run_scan(
         &state,
         owner,
-        waveflow_server::catalog::LibraryRecord {
+        waveflow_server::storage::catalog::LibraryRecord {
             id: library,
             name: "Attributed".into(),
             root_path: root,
diff --git a/tests/uploads/main.rs b/tests/uploads/main.rs
index 5b58e562..1f07a7fc 100644
--- a/tests/uploads/main.rs
+++ b/tests/uploads/main.rs
@@ -7,12 +7,12 @@ use axum::body::Body;
 use axum::http::Request;
 use axum::http::StatusCode;
 use tower::ServiceExt;
-use waveflow_server::authentication::now_ms;
+use waveflow_server::auth::authentication::now_ms;
+use waveflow_server::auth::security;
 use waveflow_server::config::UploadLimits;
-use waveflow_server::database::AccountRole;
-use waveflow_server::database::LibraryRole;
-use waveflow_server::database::LibraryVisibility;
-use waveflow_server::security;
+use waveflow_server::storage::database::AccountRole;
+use waveflow_server::storage::database::LibraryRole;
+use waveflow_server::storage::database::LibraryVisibility;
 
 // Not every target uses every fixture, and a shared module is not dead
 // code for being partly unused here.