CORE: Improve media paths and player reliability

Cargo.lock

@@ -1418,7 +1418,7 @@ checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
 [[package]]
 name = "furumusic"
-version = "0.1.17"
+version = "0.1.22"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1430,6 +1430,7 @@ dependencies = [
  "id3",
  "image",
  "librqbit",
+ "md-5",
  "openidconnect",
  "reqwest",
  "schemars 0.9.0",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "furumusic"
-version = "0.1.18"
+version = "0.2.0"
 edition = "2024"
 description = "Reusable web-app boilerplate: auth, OIDC/SSO, admin panel, user management, i18n, PostgreSQL"
 
@@ -20,6 +20,7 @@ symphonia = { version = "0.5", default-features = false, features = ["mp3","aac"
 id3 = "1"
 encoding_rs = "0.8"
 sha2 = "0.10"
+md-5 = "0.10"
 image = { version = "0.25", default-features = false, features = ["jpeg", "png", "webp", "gif", "bmp"] }
 sqlx = { version = "0.8", features = ["runtime-tokio-rustls", "postgres"] }
 anyhow = "1.0"

src/admin/mod.rs

@@ -20,8 +20,8 @@ use crate::i18n::I18n;
 use crate::scheduler::{JobRegistry, SchedulerHandle};
 use crate::user::User;
 use views::{
-    ArtistForm, CronForm, MetadataBackfillForm, OidcSettingsForm, ReleaseForm, ReviewsBulkForm,
-    SetImageBody, SetupForm, UploadImageBody, UserForm,
+    ArtistForm, CronForm, MetadataBackfillForm, OidcSettingsForm, ReleaseForm, ReviewApproveForm,
+    ReviewsBulkForm, SetImageBody, SetupForm, UploadImageBody, UserForm,
 };
 
 #[derive(Debug, Deserialize)]
@@ -227,6 +227,35 @@ impl App for AdminApp {
                 },
                 "admin_v2_reviews_bulk",
             ),
+            Route::with_handler_and_name(
+                "/v2/api/reviews/{id}/approve",
+                {
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    cot::router::method::post(
+                        move |session: Session,
+                              db: Database,
+                              path: Path<PathId>,
+                              json: Json<v2::ReviewEditDto>| {
+                            let pool = Arc::clone(&pool);
+                            let pool_config = Arc::clone(&pool_config);
+                            async move {
+                                let pg_pool = pool
+                                    .get_or_init(|| async {
+                                        sqlx::postgres::PgPoolOptions::new()
+                                            .max_connections(5)
+                                            .connect(&pool_config.database_url)
+                                            .await
+                                            .expect("admin pool")
+                                    })
+                                    .await;
+                                v2::approve_review(session, db, pg_pool, path.0.id, json).await
+                            }
+                        },
+                    )
+                },
+                "admin_v2_review_approve",
+            ),
             Route::with_handler_and_name(
                 "/v2/api/jobs",
                 {
@@ -399,6 +428,88 @@ impl App for AdminApp {
                 },
                 "admin_v2_library_item",
             ),
+            Route::with_handler_and_name(
+                "/v2/api/library/item/detail",
+                {
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    get(move |session: Session,
+                              db: Database,
+                              query: UrlQuery<v2::LibraryItemDetailQuery>| {
+                        let pool = Arc::clone(&pool);
+                        let pool_config = Arc::clone(&pool_config);
+                        async move {
+                            let pg_pool = pool
+                                .get_or_init(|| async {
+                                    sqlx::postgres::PgPoolOptions::new()
+                                        .max_connections(5)
+                                        .connect(&pool_config.database_url)
+                                        .await
+                                        .expect("admin pool")
+                                })
+                                .await;
+                            v2::library_item_detail(session, db, pg_pool, query.0).await
+                        }
+                    })
+                },
+                "admin_v2_library_item_detail",
+            ),
+            Route::with_handler_and_name(
+                "/v2/api/library/item/image",
+                {
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    cot::router::method::post(
+                        move |session: Session,
+                              db: Database,
+                              json: Json<v2::SetLibraryImageRequest>| {
+                            let pool = Arc::clone(&pool);
+                            let pool_config = Arc::clone(&pool_config);
+                            async move {
+                                let pg_pool = pool
+                                    .get_or_init(|| async {
+                                        sqlx::postgres::PgPoolOptions::new()
+                                            .max_connections(5)
+                                            .connect(&pool_config.database_url)
+                                            .await
+                                            .expect("admin pool")
+                                    })
+                                    .await;
+                                v2::set_library_item_image(session, db, pg_pool, json).await
+                            }
+                        },
+                    )
+                },
+                "admin_v2_library_item_image",
+            ),
+            Route::with_handler_and_name(
+                "/v2/api/library/item/upload-image",
+                {
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    cot::router::method::post(
+                        move |session: Session,
+                              db: Database,
+                              json: Json<v2::UploadLibraryImageRequest>| {
+                            let pool = Arc::clone(&pool);
+                            let pool_config = Arc::clone(&pool_config);
+                            async move {
+                                let pg_pool = pool
+                                    .get_or_init(|| async {
+                                        sqlx::postgres::PgPoolOptions::new()
+                                            .max_connections(5)
+                                            .connect(&pool_config.database_url)
+                                            .await
+                                            .expect("admin pool")
+                                    })
+                                    .await;
+                                v2::upload_library_item_image(session, db, pg_pool, json).await
+                            }
+                        },
+                    )
+                },
+                "admin_v2_library_item_upload_image",
+            ),
             Route::with_handler_and_name(
                 "/v2/api/library/bulk",
                 {
@@ -1048,7 +1159,8 @@ impl App for AdminApp {
                     let config = Arc::clone(&self.config);
                     let pool = Arc::clone(&pool);
                     let pool_config = Arc::clone(&pool_config);
-                    move |session: Session, db: Database, path: Path<PathId>| {
+                    move |session: Session, db: Database, path: Path<PathId>,
+                          form: RequestForm<ReviewApproveForm>| {
                         let config = Arc::clone(&config);
                         let pool = Arc::clone(&pool);
                         let pool_config = Arc::clone(&pool_config);
@@ -1064,7 +1176,7 @@ impl App for AdminApp {
                                     .await
                                     .expect("admin pool")
                             }).await;
-                            views::review_approve(admin, &config, &db, pg_pool, path.0.id).await
+                            views::review_approve(admin, &config, &db, pg_pool, path.0.id, form).await
                         }
                     }
                 }),

src/admin/v2.rs

@@ -1,4 +1,4 @@
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 
 use cot::db::{Database, Model};
 use cot::html::Html;
@@ -67,6 +67,31 @@ pub(super) struct UpdateLibraryItemRequest {
     id: i64,
     title: String,
     hidden: bool,
+    release_type: Option<String>,
+    year: Option<String>,
+    artist_ids: Option<Vec<i64>>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(super) struct LibraryItemDetailQuery {
+    kind: String,
+    id: i64,
+}
+
+#[derive(Debug, Deserialize)]
+pub(super) struct SetLibraryImageRequest {
+    kind: String,
+    id: i64,
+    media_file_id: Option<i64>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(super) struct UploadLibraryImageRequest {
+    kind: String,
+    id: i64,
+    data: String,
+    filename: String,
+    mime_type: String,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
@@ -156,10 +181,24 @@ struct ReviewDto {
     token_count: Option<i64>,
     tags: Vec<TagDto>,
     error_message: Option<String>,
+    normalized: ReviewEditDto,
     created_at: String,
     updated_at: String,
 }
 
+#[derive(Debug, Clone, Default, Serialize, Deserialize, JsonSchema)]
+pub(super) struct ReviewEditDto {
+    title: String,
+    artist: String,
+    album: String,
+    year: String,
+    track_number: String,
+    genre: String,
+    featured_artists: String,
+    release_type: String,
+    notes: String,
+}
+
 #[derive(Debug, Serialize, JsonSchema)]
 struct JobDto {
     name: String,
@@ -221,6 +260,8 @@ struct AdminSettingsDto {
     values: AdminSettingsValues,
     sources: AdminSettingsSources,
     lastfm_api_key_configured: bool,
+    lastfm_shared_secret_configured: bool,
+    lastfm_scrobbling_configured: bool,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
@@ -235,6 +276,7 @@ struct AdminSettingsValues {
     oidc_user_groups: String,
     swagger_enabled: bool,
     lastfm_api_key: String,
+    lastfm_shared_secret: String,
     agent_enabled: bool,
     agent_inbox_dir: String,
     agent_storage_dir: String,
@@ -258,6 +300,7 @@ struct AdminSettingsSources {
     oidc_user_groups: &'static str,
     swagger_enabled: &'static str,
     lastfm_api_key: &'static str,
+    lastfm_shared_secret: &'static str,
     agent_enabled: &'static str,
     agent_inbox_dir: &'static str,
     agent_storage_dir: &'static str,
@@ -281,6 +324,7 @@ pub(super) struct UpdateSettingsRequest {
     oidc_user_groups: String,
     swagger_enabled: bool,
     lastfm_api_key: String,
+    lastfm_shared_secret: String,
     agent_enabled: bool,
     agent_inbox_dir: String,
     agent_storage_dir: String,
@@ -334,6 +378,32 @@ struct LibraryItemDto {
     updated_at: Option<String>,
 }
 
+#[derive(Debug, Serialize, JsonSchema)]
+struct LibraryItemDetailDto {
+    item: LibraryItemDto,
+    title: String,
+    hidden: bool,
+    release_type: Option<String>,
+    year: Option<i32>,
+    current_image_url: Option<String>,
+    selected_artist_ids: Vec<i64>,
+    artists: Vec<ArtistOptionDto>,
+    available_covers: Vec<AvailableCoverDto>,
+}
+
+#[derive(Debug, Serialize, JsonSchema)]
+struct ArtistOptionDto {
+    id: i64,
+    name: String,
+}
+
+#[derive(Debug, Serialize, JsonSchema)]
+struct AvailableCoverDto {
+    media_file_id: i64,
+    release_title: String,
+    cover_url: String,
+}
+
 #[derive(Debug, sqlx::FromRow)]
 struct IdRow {
     id: i64,
@@ -533,6 +603,65 @@ pub async fn bulk_reviews(
     Json(BulkReviewsResponse { ok: true, affected }).into_response()
 }
 
+pub async fn approve_review(
+    session: Session,
+    db: Database,
+    pool: &PgPool,
+    review_id: i64,
+    Json(body): Json<ReviewEditDto>,
+) -> cot::Result<cot::response::Response> {
+    if let Err(response) = require_admin_json(&session, &db).await {
+        return Ok(response);
+    }
+
+    let mut review = crate::scheduler::PendingReview::get_by_id(&db, review_id)
+        .await
+        .map_err(|e| cot::Error::internal(e.to_string()))?
+        .ok_or_else(|| cot::Error::internal("review not found"))?;
+    let normalized = normalized_from_review_edit(&body);
+    let result_json = serde_json::to_string(&normalized)
+        .map_err(|e| cot::Error::internal(format!("failed to serialize review fields: {e}")))?;
+    review
+        .set_result_json(&db, result_json)
+        .await
+        .map_err(|e| cot::Error::internal(e.to_string()))?;
+
+    let context: serde_json::Value =
+        serde_json::from_str(review.context_json_str()).unwrap_or_default();
+    let input_path = review.input_path_str().to_owned();
+    let (live_config, _) = AppConfig::load_with_db(&db).await;
+    let stats = crate::scheduler::ProcessingStats::get_by_review_id(&db, review_id)
+        .await
+        .unwrap_or(None);
+    let model_name = stats.as_ref().map(|s| s.model_name.to_string());
+
+    match crate::jobs::inbox_process::finalize_approved(
+        &db,
+        pool,
+        &live_config,
+        &input_path,
+        &normalized,
+        &context,
+        &live_config.agent_storage_dir,
+        model_name.as_deref(),
+    )
+    .await
+    {
+        Ok(()) => {
+            let _ = review.set_approved(&db).await;
+            Json(serde_json::json!({ "ok": true })).into_response()
+        }
+        Err(error) => {
+            tracing::error!(?error, "review approval failed");
+            let _ = review.set_rejected(&db).await;
+            Ok(json_error(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "review approval failed",
+            ))
+        }
+    }
+}
+
 pub async fn jobs(
     session: Session,
     db: Database,
@@ -585,6 +714,10 @@ pub async fn update_settings(
         ("oidc_user_groups", body.oidc_user_groups.trim().to_string()),
         ("swagger_enabled", body.swagger_enabled.to_string()),
         ("lastfm_api_key", body.lastfm_api_key.trim().to_string()),
+        (
+            "lastfm_shared_secret",
+            body.lastfm_shared_secret.trim().to_string(),
+        ),
         ("agent_enabled", body.agent_enabled.to_string()),
         ("agent_inbox_dir", body.agent_inbox_dir.trim().to_string()),
         (
@@ -661,6 +794,9 @@ pub async fn settings_probe(
 fn settings_dto(config: AppConfig, sources: ConfigSources) -> AdminSettingsDto {
     AdminSettingsDto {
         lastfm_api_key_configured: !config.lastfm_api_key.trim().is_empty(),
+        lastfm_shared_secret_configured: !config.lastfm_shared_secret.trim().is_empty(),
+        lastfm_scrobbling_configured: !config.lastfm_api_key.trim().is_empty()
+            && !config.lastfm_shared_secret.trim().is_empty(),
         values: AdminSettingsValues {
             auth_password_enabled: config.auth_password_enabled,
             auth_sso_enabled: config.auth_sso_enabled,
@@ -672,6 +808,7 @@ fn settings_dto(config: AppConfig, sources: ConfigSources) -> AdminSettingsDto {
             oidc_user_groups: config.oidc_user_groups,
             swagger_enabled: config.swagger_enabled,
             lastfm_api_key: config.lastfm_api_key,
+            lastfm_shared_secret: config.lastfm_shared_secret,
             agent_enabled: config.agent_enabled,
             agent_inbox_dir: config.agent_inbox_dir,
             agent_storage_dir: config.agent_storage_dir,
@@ -693,6 +830,7 @@ fn settings_dto(config: AppConfig, sources: ConfigSources) -> AdminSettingsDto {
             oidc_user_groups: sources.oidc_user_groups.code(),
             swagger_enabled: sources.swagger_enabled.code(),
             lastfm_api_key: sources.lastfm_api_key.code(),
+            lastfm_shared_secret: sources.lastfm_shared_secret.code(),
             agent_enabled: sources.agent_enabled.code(),
             agent_inbox_dir: sources.agent_inbox_dir.code(),
             agent_storage_dir: sources.agent_storage_dir.code(),
@@ -830,6 +968,28 @@ pub async fn library(
     Json(page).into_response()
 }
 
+pub async fn library_item_detail(
+    session: Session,
+    db: Database,
+    pool: &PgPool,
+    query: LibraryItemDetailQuery,
+) -> cot::Result<cot::response::Response> {
+    if let Err(response) = require_admin_json(&session, &db).await {
+        return Ok(response);
+    }
+    let kind = normalize_library_kind(Some(query.kind.as_str()));
+    let Some(item) = fetch_library_item(pool, &kind, query.id)
+        .await
+        .map_err(|e| cot::Error::internal(e.to_string()))?
+    else {
+        return Ok(json_error(StatusCode::NOT_FOUND, "library item not found"));
+    };
+    let detail = load_library_item_detail(pool, &kind, item)
+        .await
+        .map_err(|e| cot::Error::internal(e.to_string()))?;
+    Json(detail).into_response()
+}
+
 pub async fn update_library_item(
     session: Session,
     db: Database,
@@ -863,13 +1023,27 @@ pub async fn update_library_item(
             .await
         }
         "releases" => {
+            let release_type = body
+                .release_type
+                .as_deref()
+                .map(str::trim)
+                .filter(|value| !value.is_empty())
+                .unwrap_or("album");
+            let year = body
+                .year
+                .as_deref()
+                .map(str::trim)
+                .filter(|value| !value.is_empty())
+                .and_then(|value| value.parse::<i32>().ok());
             sqlx::query(
                 "UPDATE furumusic__release \
-                 SET title = $1, title_sort = $2, is_hidden = $3, updated_at = $4 \
-                 WHERE id = $5",
+                 SET title = $1, title_sort = $2, release_type = $3, year = $4, is_hidden = $5, updated_at = $6 \
+                 WHERE id = $7",
             )
             .bind(title)
             .bind(normalize_name(title))
+            .bind(release_type)
+            .bind(year)
             .bind(body.hidden)
             .bind(&now)
             .bind(body.id)
@@ -897,6 +1071,28 @@ pub async fn update_library_item(
     if affected == 0 {
         return Ok(json_error(StatusCode::NOT_FOUND, "library item not found"));
     }
+    if kind == "releases" {
+        if let Some(mut artist_ids) = body.artist_ids {
+            let mut seen_artist_ids = HashSet::new();
+            artist_ids.retain(|id| *id > 0 && seen_artist_ids.insert(*id));
+            sqlx::query("DELETE FROM furumusic__release_artist WHERE release_id = $1")
+                .bind(body.id)
+                .execute(pool)
+                .await
+                .map_err(|e| cot::Error::internal(e.to_string()))?;
+            for (position, artist_id) in artist_ids.iter().enumerate() {
+                sqlx::query(
+                    "INSERT INTO furumusic__release_artist (release_id, artist_id, position) VALUES ($1, $2, $3)",
+                )
+                .bind(body.id)
+                .bind(*artist_id)
+                .bind(position as i32)
+                .execute(pool)
+                .await
+                .map_err(|e| cot::Error::internal(e.to_string()))?;
+            }
+        }
+    }
 
     let Some(item) = fetch_library_item(pool, &kind, body.id)
         .await
@@ -908,6 +1104,128 @@ pub async fn update_library_item(
     Json(item).into_response()
 }
 
+pub async fn set_library_item_image(
+    session: Session,
+    db: Database,
+    pool: &PgPool,
+    Json(body): Json<SetLibraryImageRequest>,
+) -> cot::Result<cot::response::Response> {
+    if let Err(response) = require_admin_json(&session, &db).await {
+        return Ok(response);
+    }
+    let kind = normalize_library_kind(Some(body.kind.as_str()));
+    if kind != "artists" && kind != "releases" {
+        return Ok(json_error(StatusCode::BAD_REQUEST, "unsupported kind"));
+    }
+    if let Some(fid) = body.media_file_id {
+        let exists: Option<i64> = sqlx::query_scalar(
+            "SELECT id FROM furumusic__media_file WHERE id = $1 AND file_type = 'cover_art'",
+        )
+        .bind(fid)
+        .fetch_optional(pool)
+        .await
+        .map_err(|e| cot::Error::internal(e.to_string()))?;
+        if exists.is_none() {
+            return Ok(json_error(StatusCode::NOT_FOUND, "image not found"));
+        }
+    }
+    let now = now_string();
+    let result = if kind == "releases" {
+        sqlx::query(
+            "UPDATE furumusic__release SET cover_file_id = $1, updated_at = $2 WHERE id = $3",
+        )
+        .bind(body.media_file_id)
+        .bind(&now)
+        .bind(body.id)
+        .execute(pool)
+        .await
+    } else {
+        sqlx::query(
+            "UPDATE furumusic__artist SET image_file_id = $1, updated_at = $2 WHERE id = $3",
+        )
+        .bind(body.media_file_id)
+        .bind(&now)
+        .bind(body.id)
+        .execute(pool)
+        .await
+    }
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+    if result.rows_affected() == 0 {
+        return Ok(json_error(StatusCode::NOT_FOUND, "library item not found"));
+    }
+    Json(serde_json::json!({ "ok": true })).into_response()
+}
+
+pub async fn upload_library_item_image(
+    session: Session,
+    db: Database,
+    pool: &PgPool,
+    Json(body): Json<UploadLibraryImageRequest>,
+) -> cot::Result<cot::response::Response> {
+    if let Err(response) = require_admin_json(&session, &db).await {
+        return Ok(response);
+    }
+    let kind = normalize_library_kind(Some(body.kind.as_str()));
+    if kind != "artists" && kind != "releases" {
+        return Ok(json_error(StatusCode::BAD_REQUEST, "unsupported kind"));
+    }
+    let storage_dir = AppConfig::load_with_db(&db).await.0.agent_storage_dir;
+    if storage_dir.trim().is_empty() {
+        return Err(cot::Error::internal("agent_storage_dir is not configured"));
+    }
+    use base64::Engine;
+    let image_data = base64::engine::general_purpose::STANDARD
+        .decode(body.data.trim())
+        .map_err(|e| cot::Error::internal(format!("invalid base64: {e}")))?;
+    if image_data.is_empty() {
+        return Ok(json_error(StatusCode::BAD_REQUEST, "image is empty"));
+    }
+    let title: Option<String> = if kind == "releases" {
+        sqlx::query_scalar("SELECT title::text FROM furumusic__release WHERE id = $1")
+    } else {
+        sqlx::query_scalar("SELECT name::text FROM furumusic__artist WHERE id = $1")
+    }
+    .bind(body.id)
+    .fetch_optional(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+    let Some(title) = title else {
+        return Ok(json_error(StatusCode::NOT_FOUND, "library item not found"));
+    };
+    let cover = crate::agent::cover_art::CoverImage {
+        data: image_data,
+        mime_type: body.mime_type,
+        source: crate::agent::cover_art::CoverSource::FolderFile(std::path::PathBuf::from(
+            body.filename,
+        )),
+    };
+    let media_file_id = crate::agent::cover_art::save_cover_to_storage(
+        &db,
+        pool,
+        &storage_dir,
+        &title,
+        if kind == "artists" {
+            "__artist_image__"
+        } else {
+            "__release_cover__"
+        },
+        &cover,
+    )
+    .await
+    .map_err(|e| cot::Error::internal(format!("failed to save image: {e}")))?;
+    set_library_item_image(
+        session,
+        db,
+        pool,
+        Json(SetLibraryImageRequest {
+            kind,
+            id: body.id,
+            media_file_id: Some(media_file_id),
+        }),
+    )
+    .await
+}
+
 pub async fn bulk_library(
     session: Session,
     db: Database,
@@ -1209,6 +1527,11 @@ fn review_dto(
         .as_deref()
         .and_then(|json| serde_json::from_str::<serde_json::Value>(json).ok())
         .and_then(|value| value.get("confidence").and_then(|v| v.as_f64()));
+    let normalized = row
+        .result_json
+        .as_deref()
+        .map(review_edit_dto_from_json)
+        .unwrap_or_default();
 
     ReviewDto {
         id: row.id,
@@ -1224,11 +1547,72 @@ fn review_dto(
         token_count: stat.map(|s| s.prompt_tokens + s.completion_tokens),
         tags,
         error_message: row.error_message,
+        normalized,
         created_at: row.created_at,
         updated_at: row.updated_at,
     }
 }
 
+fn review_edit_dto_from_json(result_json: &str) -> ReviewEditDto {
+    let Ok(normalized) = serde_json::from_str::<crate::agent::dto::NormalizedFields>(result_json)
+    else {
+        return ReviewEditDto::default();
+    };
+    ReviewEditDto {
+        title: normalized.title.unwrap_or_default(),
+        artist: normalized.artist.unwrap_or_default(),
+        album: normalized.album.unwrap_or_default(),
+        year: normalized.year.map(|v| v.to_string()).unwrap_or_default(),
+        track_number: normalized
+            .track_number
+            .map(|v| v.to_string())
+            .unwrap_or_default(),
+        genre: normalized.genre.unwrap_or_default(),
+        featured_artists: normalized.featured_artists.join(", "),
+        release_type: normalized
+            .release_type
+            .unwrap_or_else(|| "album".to_owned()),
+        notes: normalized.notes.unwrap_or_default(),
+    }
+}
+
+fn optional_trimmed(value: &str) -> Option<String> {
+    let trimmed = value.trim();
+    if trimmed.is_empty() {
+        None
+    } else {
+        Some(trimmed.to_owned())
+    }
+}
+
+fn parse_optional_i32(value: &str) -> Option<i32> {
+    value.trim().parse::<i32>().ok()
+}
+
+fn parse_featured_artists(value: &str) -> Vec<String> {
+    value
+        .split(',')
+        .map(str::trim)
+        .filter(|part| !part.is_empty())
+        .map(str::to_owned)
+        .collect()
+}
+
+fn normalized_from_review_edit(edit: &ReviewEditDto) -> crate::agent::dto::NormalizedFields {
+    crate::agent::dto::NormalizedFields {
+        title: optional_trimmed(&edit.title),
+        artist: optional_trimmed(&edit.artist),
+        album: optional_trimmed(&edit.album),
+        year: parse_optional_i32(&edit.year),
+        track_number: parse_optional_i32(&edit.track_number),
+        genre: optional_trimmed(&edit.genre),
+        featured_artists: parse_featured_artists(&edit.featured_artists),
+        release_type: optional_trimmed(&edit.release_type).or_else(|| Some("album".to_owned())),
+        confidence: Some(1.0),
+        notes: optional_trimmed(&edit.notes),
+    }
+}
+
 fn media_tags(row: &ReviewMediaRow) -> Vec<TagDto> {
     let mut tags = Vec::new();
     if let Some(format) = row.audio_format.as_deref().filter(|s| !s.trim().is_empty()) {
@@ -1480,6 +1864,103 @@ async fn fetch_library_item(
     Ok(row.map(|row| library_item_dto(kind, row)))
 }
 
+async fn load_library_item_detail(
+    pool: &PgPool,
+    kind: &str,
+    item: LibraryItemDto,
+) -> anyhow::Result<LibraryItemDetailDto> {
+    let mut detail = LibraryItemDetailDto {
+        title: item.title.clone(),
+        hidden: item.is_hidden.unwrap_or(false),
+        release_type: None,
+        year: None,
+        current_image_url: None,
+        selected_artist_ids: Vec::new(),
+        artists: Vec::new(),
+        available_covers: Vec::new(),
+        item,
+    };
+
+    match kind {
+        "artists" => {
+            let image_file_id: Option<i64> =
+                sqlx::query_scalar("SELECT image_file_id FROM furumusic__artist WHERE id = $1")
+                    .bind(detail.item.id)
+                    .fetch_optional(pool)
+                    .await?
+                    .flatten();
+            detail.current_image_url =
+                image_file_id.map(|id| format!("/api/player/cover/{id}/large"));
+            detail.available_covers = artist_available_covers(pool, detail.item.id).await?;
+        }
+        "releases" => {
+            let row: Option<(Option<String>, Option<i32>, Option<i64>)> = sqlx::query_as(
+                "SELECT release_type::text, year, cover_file_id FROM furumusic__release WHERE id = $1",
+            )
+            .bind(detail.item.id)
+            .fetch_optional(pool)
+            .await?;
+            if let Some((release_type, year, cover_file_id)) = row {
+                detail.release_type = release_type;
+                detail.year = year;
+                detail.current_image_url =
+                    cover_file_id.map(|id| format!("/api/player/cover/{id}/large"));
+            }
+            detail.selected_artist_ids = sqlx::query_as::<_, IdRow>(
+                "SELECT artist_id AS id FROM furumusic__release_artist WHERE release_id = $1 ORDER BY position, artist_id",
+            )
+            .bind(detail.item.id)
+            .fetch_all(pool)
+            .await?
+            .into_iter()
+            .map(|row| row.id)
+            .collect();
+            detail.artists = load_artist_options(pool).await?;
+        }
+        _ => {}
+    }
+
+    Ok(detail)
+}
+
+async fn load_artist_options(pool: &PgPool) -> anyhow::Result<Vec<ArtistOptionDto>> {
+    let rows = sqlx::query_as::<_, (i64, String)>(
+        "SELECT id, name::text FROM furumusic__artist ORDER BY name ASC",
+    )
+    .fetch_all(pool)
+    .await?;
+    Ok(rows
+        .into_iter()
+        .map(|(id, name)| ArtistOptionDto { id, name })
+        .collect())
+}
+
+async fn artist_available_covers(
+    pool: &PgPool,
+    artist_id: i64,
+) -> anyhow::Result<Vec<AvailableCoverDto>> {
+    let rows = sqlx::query_as::<_, (i64, String)>(
+        "SELECT DISTINCT r.cover_file_id AS media_file_id, r.title::text AS release_title \
+         FROM furumusic__release r \
+         LEFT JOIN furumusic__release_artist ra ON ra.release_id = r.id \
+         LEFT JOIN furumusic__track t ON t.release_id = r.id \
+         LEFT JOIN furumusic__track_artist ta ON ta.track_id = t.id \
+         WHERE r.cover_file_id IS NOT NULL AND (ra.artist_id = $1 OR ta.artist_id = $1) \
+         ORDER BY r.title::text ASC",
+    )
+    .bind(artist_id)
+    .fetch_all(pool)
+    .await?;
+    Ok(rows
+        .into_iter()
+        .map(|(media_file_id, release_title)| AvailableCoverDto {
+            media_file_id,
+            release_title,
+            cover_url: format!("/api/player/cover/{media_file_id}/medium"),
+        })
+        .collect())
+}
+
 async fn library_ids_by_filter(
     pool: &PgPool,
     kind: &str,

src/admin/views.rs

@@ -184,6 +184,16 @@ fn config_display_entries(config: &AppConfig, sources: &ConfigSources) -> Vec<Co
             config.agent_concurrency.to_string(),
             defaults.agent_concurrency.to_string()
         ),
+        entry!(
+            lastfm_api_key,
+            config.lastfm_api_key.clone(),
+            defaults.lastfm_api_key.clone()
+        ),
+        entry!(
+            lastfm_shared_secret,
+            config.lastfm_shared_secret.clone(),
+            defaults.lastfm_shared_secret.clone()
+        ),
     ]
 }
 
@@ -258,6 +268,10 @@ struct SettingsTemplate {
     agent_context_limit_source: &'static str,
     agent_concurrency: String,
     agent_concurrency_source: &'static str,
+    lastfm_api_key: String,
+    lastfm_api_key_source: &'static str,
+    lastfm_shared_secret: String,
+    lastfm_shared_secret_source: &'static str,
 }
 
 pub async fn settings_handler(
@@ -310,6 +324,10 @@ pub async fn settings_handler(
         agent_context_limit_source: sources.agent_context_limit.code(),
         agent_concurrency: config.agent_concurrency.to_string(),
         agent_concurrency_source: sources.agent_concurrency.code(),
+        lastfm_api_key: config.lastfm_api_key.clone(),
+        lastfm_api_key_source: sources.lastfm_api_key.code(),
+        lastfm_shared_secret: config.lastfm_shared_secret.clone(),
+        lastfm_shared_secret_source: sources.lastfm_shared_secret.code(),
     };
     Ok(Html::new(template.render()?))
 }
@@ -334,6 +352,8 @@ pub struct OidcSettingsForm {
     agent_confidence_threshold: Option<String>,
     agent_context_limit: Option<String>,
     agent_concurrency: Option<String>,
+    lastfm_api_key: Option<String>,
+    lastfm_shared_secret: Option<String>,
 }
 
 pub async fn settings_submit(
@@ -380,7 +400,9 @@ pub async fn settings_submit(
             let agent_confidence_threshold = data.agent_confidence_threshold.unwrap_or_default();
             let agent_context_limit = data.agent_context_limit.unwrap_or_default();
             let agent_concurrency = data.agent_concurrency.unwrap_or_default();
-            let fields: [(&str, &str); 18] = [
+            let lastfm_api_key = data.lastfm_api_key.unwrap_or_default();
+            let lastfm_shared_secret = data.lastfm_shared_secret.unwrap_or_default();
+            let fields: [(&str, &str); 20] = [
                 ("auth_password_enabled", pw_enabled),
                 ("auth_sso_enabled", sso_enabled),
                 ("oidc_button_text", &oidc_button_text),
@@ -399,6 +421,8 @@ pub async fn settings_submit(
                 ("agent_confidence_threshold", &agent_confidence_threshold),
                 ("agent_context_limit", &agent_context_limit),
                 ("agent_concurrency", &agent_concurrency),
+                ("lastfm_api_key", &lastfm_api_key),
+                ("lastfm_shared_secret", &lastfm_shared_secret),
             ];
             for (key, value) in fields {
                 let mut entry = ConfigEntry::new(key.to_owned(), value.to_owned());
@@ -1794,12 +1818,104 @@ struct ReviewDetailTemplate {
     user_name: String,
     user_role: String,
     review: PendingReview,
+    edit: ReviewEditFields,
+    release_types: &'static [(&'static str, &'static str, &'static str)],
+    lang_code: &'static str,
     context_pretty: String,
     result_pretty: String,
     error_message: String,
     stats: Option<scheduler::ProcessingStats>,
 }
 
+#[derive(Debug, Default)]
+struct ReviewEditFields {
+    title: String,
+    artist: String,
+    album: String,
+    year: String,
+    track_number: String,
+    genre: String,
+    featured_artists: String,
+    release_type: String,
+    notes: String,
+}
+
+#[derive(Debug, Form)]
+pub struct ReviewApproveForm {
+    title: String,
+    artist: String,
+    album: String,
+    year: String,
+    track_number: String,
+    genre: String,
+    featured_artists: String,
+    release_type: String,
+    notes: String,
+}
+
+fn optional_trimmed(value: &str) -> Option<String> {
+    let trimmed = value.trim();
+    if trimmed.is_empty() {
+        None
+    } else {
+        Some(trimmed.to_owned())
+    }
+}
+
+fn parse_optional_i32(value: &str) -> Option<i32> {
+    value.trim().parse::<i32>().ok()
+}
+
+fn parse_featured_artists(value: &str) -> Vec<String> {
+    value
+        .split(',')
+        .map(str::trim)
+        .filter(|part| !part.is_empty())
+        .map(str::to_owned)
+        .collect()
+}
+
+fn edit_fields_from_normalized(
+    normalized: &crate::agent::dto::NormalizedFields,
+) -> ReviewEditFields {
+    ReviewEditFields {
+        title: normalized.title.clone().unwrap_or_default(),
+        artist: normalized.artist.clone().unwrap_or_default(),
+        album: normalized.album.clone().unwrap_or_default(),
+        year: normalized.year.map(|v| v.to_string()).unwrap_or_default(),
+        track_number: normalized
+            .track_number
+            .map(|v| v.to_string())
+            .unwrap_or_default(),
+        genre: normalized.genre.clone().unwrap_or_default(),
+        featured_artists: normalized.featured_artists.join(", "),
+        release_type: normalized
+            .release_type
+            .clone()
+            .unwrap_or_else(|| "album".to_owned()),
+        notes: normalized.notes.clone().unwrap_or_default(),
+    }
+}
+
+fn normalized_from_result_json(result_json: &str) -> crate::agent::dto::NormalizedFields {
+    serde_json::from_str(result_json).unwrap_or_default()
+}
+
+fn normalized_from_review_form(form: &ReviewApproveForm) -> crate::agent::dto::NormalizedFields {
+    crate::agent::dto::NormalizedFields {
+        title: optional_trimmed(&form.title),
+        artist: optional_trimmed(&form.artist),
+        album: optional_trimmed(&form.album),
+        year: parse_optional_i32(&form.year),
+        track_number: parse_optional_i32(&form.track_number),
+        genre: optional_trimmed(&form.genre),
+        featured_artists: parse_featured_artists(&form.featured_artists),
+        release_type: optional_trimmed(&form.release_type).or_else(|| Some("album".to_owned())),
+        confidence: Some(1.0),
+        notes: optional_trimmed(&form.notes),
+    }
+}
+
 pub async fn review_detail(
     admin: AuthenticatedUser,
     i18n: I18n,
@@ -1830,12 +1946,17 @@ pub async fn review_detail(
     let stats = scheduler::ProcessingStats::get_by_review_id(db, review_id)
         .await
         .unwrap_or(None);
+    let normalized = normalized_from_result_json(review.result_json_str());
+    let edit = edit_fields_from_normalized(&normalized);
 
     let template = ReviewDetailTemplate {
         t: i18n.t,
         user_name: admin.name,
         user_role: admin.role.code().to_owned(),
         review,
+        edit,
+        release_types: RELEASE_TYPES,
+        lang_code: i18n.t.lang.code(),
         context_pretty,
         result_pretty,
         error_message,
@@ -1850,24 +1971,29 @@ pub async fn review_approve(
     db: &Database,
     pool: &sqlx::PgPool,
     review_id: i64,
+    form: RequestForm<ReviewApproveForm>,
 ) -> cot::Result<cot::http::Response<Body>> {
     let mut review = PendingReview::get_by_id(db, review_id)
         .await
         .map_err(|e| cot::Error::internal(format!("db error: {e}")))?
         .ok_or_else(|| cot::Error::internal("review not found"))?;
 
-    let result_str = review.result_json_str().to_owned();
+    let RequestForm(form_result) = form;
+    let normalized = match form_result {
+        FormResult::Ok(data) => normalized_from_review_form(&data),
+        FormResult::ValidationError(_) => {
+            return Ok(auth::redirect(&format!("/admin/reviews/{review_id}")));
+        }
+    };
+    let result_str = serde_json::to_string(&normalized)
+        .map_err(|e| cot::Error::internal(format!("failed to serialize review fields: {e}")))?;
+    review
+        .set_result_json(db, result_str)
+        .await
+        .map_err(|e| cot::Error::internal(format!("db error: {e}")))?;
     let context_str = review.context_json_str().to_owned();
     let input_path = review.input_path_str().to_owned();
 
-    if result_str.is_empty() {
-        let _ = review.set_rejected(db).await;
-        return Ok(auth::redirect(&format!("/admin/reviews/{review_id}")));
-    }
-
-    let normalized: crate::agent::dto::NormalizedFields = serde_json::from_str(&result_str)
-        .map_err(|e| cot::Error::internal(format!("invalid result_json: {e}")))?;
-
     let context: serde_json::Value = serde_json::from_str(&context_str).unwrap_or_default();
 
     // Load live config from DB so admin-set values are used

src/agent/cover_art.rs

@@ -3,6 +3,7 @@
 //! Sources (in priority order):
 //! 1. Standalone image files in the album folder (cover.jpg, folder.jpg, etc.)
 //! 2. Embedded cover art in audio file metadata (ID3 APIC, Vorbis METADATA_BLOCK_PICTURE, etc.)
+//! 3. Remote metadata providers used by background backfill jobs.
 //!
 //! The first usable image found is saved as a MediaFile with file_type="cover_art"
 //! and linked to the Release via cover_file_id.
@@ -26,6 +27,8 @@ pub enum CoverSource {
     FolderFile(PathBuf),
     /// Embedded in an audio file's metadata.
     Embedded(PathBuf),
+    /// Downloaded from a remote metadata provider.
+    Remote(String),
 }
 
 /// Well-known cover art filenames, in priority order.
@@ -335,12 +338,7 @@ pub async fn save_cover_to_storage(
         .fetch_optional(pool)
         .await?
         {
-            let path = PathBuf::from(&file_path);
-            let path = if path.is_absolute() {
-                path
-            } else {
-                Path::new(storage_dir).join(path)
-            };
+            let path = crate::media_paths::resolve_media_file_path(storage_dir, &file_path);
             if let Err(err) = crate::agent::cover_variants::ensure_cover_variants(&path).await {
                 tracing::warn!(media_file_id = id, error = %err, "Failed to generate cover variants");
             }
@@ -362,7 +360,13 @@ pub async fn save_cover_to_storage(
     // Write image data
     tokio::fs::write(&dest_path, &cover.data).await?;
 
-    let relative_path = dest_path.to_string_lossy().to_string();
+    let relative_path = crate::media_paths::media_file_path_for_storage(storage_dir, &dest_path)
+        .ok_or_else(|| {
+            anyhow::anyhow!(
+                "cover destination is outside agent_storage_dir: {}",
+                dest_path.display()
+            )
+        })?;
     let file_size = cover.data.len() as i64;
 
     let media_file = crate::music::MediaFile::create(

src/config.rs

@@ -134,6 +134,7 @@ pub struct ConfigSources {
     pub agent_context_limit: ConfigSource,
     pub agent_concurrency: ConfigSource,
     pub lastfm_api_key: ConfigSource,
+    pub lastfm_shared_secret: ConfigSource,
 }
 
 impl Default for ConfigSources {
@@ -160,6 +161,7 @@ impl Default for ConfigSources {
             agent_context_limit: ConfigSource::Default,
             agent_concurrency: ConfigSource::Default,
             lastfm_api_key: ConfigSource::Default,
+            lastfm_shared_secret: ConfigSource::Default,
         }
     }
 }
@@ -266,6 +268,8 @@ pub struct AppConfig {
     pub agent_concurrency: u64,
     /// Last.fm API key for weekly popularity enrichment.
     pub lastfm_api_key: String,
+    /// Last.fm shared secret for authenticated scrobbling calls.
+    pub lastfm_shared_secret: String,
 }
 
 impl Default for AppConfig {
@@ -292,6 +296,7 @@ impl Default for AppConfig {
             agent_context_limit: 8192,
             agent_concurrency: 2,
             lastfm_api_key: String::new(),
+            lastfm_shared_secret: String::new(),
         }
     }
 }
@@ -319,12 +324,13 @@ impl_env_overrides!(
     agent_context_limit,
     agent_concurrency,
     lastfm_api_key,
+    lastfm_shared_secret,
 );
 
 impl AppConfig {
     fn normalize_host_paths(&mut self) {
-        self.agent_inbox_dir = normalize_host_path(&self.agent_inbox_dir);
-        self.agent_storage_dir = normalize_host_path(&self.agent_storage_dir);
+        self.agent_inbox_dir = crate::media_paths::resolve_config_path(&self.agent_inbox_dir);
+        self.agent_storage_dir = crate::media_paths::resolve_config_path(&self.agent_storage_dir);
     }
 
     /// Build config: start from defaults, then overlay env vars.
@@ -403,47 +409,10 @@ impl AppConfig {
         apply_db_field!(agent_context_limit);
         apply_db_field!(agent_concurrency);
         apply_db_field!(lastfm_api_key);
+        apply_db_field!(lastfm_shared_secret);
     }
 }
 
-fn normalize_host_path(value: &str) -> String {
-    let trimmed = value.trim();
-    if trimmed.is_empty() {
-        return String::new();
-    }
-
-    normalize_windows_user_path(trimmed).unwrap_or_else(|| trimmed.to_owned())
-}
-
-#[cfg(not(windows))]
-fn normalize_windows_user_path(value: &str) -> Option<String> {
-    let normalized = value.replace('\\', "/");
-    let mut parts = normalized.split('/').filter(|part| !part.is_empty());
-    let drive = parts.next()?;
-    if drive.len() != 2 || !drive.ends_with(':') {
-        return None;
-    }
-    if !parts.next()?.eq_ignore_ascii_case("Users") {
-        return None;
-    }
-    let user = parts.next()?;
-    if user.is_empty() {
-        return None;
-    }
-
-    let mut out = format!("/Users/{user}");
-    for part in parts {
-        out.push('/');
-        out.push_str(part);
-    }
-    Some(out)
-}
-
-#[cfg(windows)]
-fn normalize_windows_user_path(_value: &str) -> Option<String> {
-    None
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -455,21 +424,31 @@ mod tests {
         assert_eq!(cfg.log_level, "info");
     }
 
-    #[cfg(not(windows))]
     #[test]
-    fn normalizes_windows_user_path_on_unix() {
+    fn resolves_relative_media_paths_from_working_dir() {
+        let expected = std::env::current_dir()
+            .unwrap()
+            .join("media")
+            .join("uploads")
+            .to_string_lossy()
+            .to_string();
         assert_eq!(
-            normalize_host_path(r"C:\Users\ab\repos\furumusic\media\uploads"),
-            "/Users/ab/repos/furumusic/media/uploads"
+            crate::media_paths::resolve_config_path("media/uploads"),
+            expected
         );
     }
 
-    #[cfg(not(windows))]
     #[test]
-    fn leaves_unix_path_unchanged() {
+    fn maps_foreign_windows_media_paths_to_working_dir() {
+        let expected = std::env::current_dir()
+            .unwrap()
+            .join("media")
+            .join("uploads")
+            .to_string_lossy()
+            .to_string();
         assert_eq!(
-            normalize_host_path("/Users/ab/repos/furumusic/media/uploads"),
-            "/Users/ab/repos/furumusic/media/uploads"
+            crate::media_paths::resolve_config_path(r"C:\Users\ab\repos\furumusic\media\uploads"),
+            expected
         );
     }
 

src/i18n/phrases.rs

@@ -95,6 +95,10 @@ translations! {
     settings_api:             "API"                           , "API";
     settings_swagger:         "Swagger UI"                    , "Swagger UI";
     settings_swagger_help:    "Serves interactive API docs at /swagger/ (requires restart)" , "Интерактивная документация API на /swagger/ (требуется перезапуск)";
+    settings_lastfm_api_key:  "Last.fm API key"               , "API ключ Last.fm";
+    settings_lastfm_api_key_help: "Used for Last.fm popularity and account connection" , "Используется для популярности Last.fm и подключения аккаунта";
+    settings_lastfm_shared_secret: "Last.fm shared secret"    , "Shared secret Last.fm";
+    settings_lastfm_shared_secret_help: "Required for signed Last.fm scrobbling requests" , "Нужен для подписанных запросов скробблинга Last.fm";
 
     // OIDC login errors
     login_oidc_error:         "SSO login failed. Please try again." , "Ошибка входа через SSO. Попробуйте ещё раз.";
@@ -268,6 +272,7 @@ translations! {
     // Player UI
     player_library:          "Library"                         , "Библиотека";
     player_artists:          "Artists"                         , "Артисты";
+    player_release:          "Release"                         , "Релиз";
     player_releases:         "Releases"                        , "Релизы";
     player_tracks:           "Tracks"                          , "Треки";
     player_title:            "Title"                           , "Название";
@@ -291,6 +296,8 @@ translations! {
     player_likes_playlist:   "Likes"                           , "Лайки";
     player_listened:         "listened"                        , "прослушано";
     player_search_placeholder: "Search artists, releases, tracks..." , "Поиск артистов, релизов, треков...";
+    player_connection_lost: "Server connection lost"             , "Нет соединения с сервером";
+    player_connection_lost_detail: "Player cannot reach the server. Retrying..." , "Плеер не может связаться с сервером. Повторяю...";
     player_no_results:       "No results found"                , "Ничего не найдено";
     player_new_playlist:     "New Playlist"                    , "Новый плейлист";
     player_rename_playlist:  "Rename Playlist"                 , "Переименовать плейлист";
@@ -326,6 +333,14 @@ translations! {
     player_lastfm_playcount: "Last.fm plays"                   , "Прослушивания Last.fm";
     player_lastfm_updated:   "Last.fm updated"                 , "Last.fm обновлён";
     player_lastfm_not_loaded: "not loaded yet"                 , "ещё не загружено";
+    player_lastfm_profile:   "Last.fm"                         , "Last.fm";
+    player_lastfm_connect:   "Connect Last.fm"                 , "Подключить Last.fm";
+    player_lastfm_connected: "Connected as {user}"             , "Подключён: {user}";
+    player_lastfm_reconnect: "Reconnect Last.fm"               , "Переподключить Last.fm";
+    player_lastfm_not_configured: "Last.fm is not configured"  , "Last.fm не настроен";
+    player_lastfm_disconnect_confirm: "Disconnect Last.fm account {user}?" , "Отвязать аккаунт Last.fm {user}?";
+    player_lastfm_connect_failed: "Could not open Last.fm connection" , "Не удалось открыть подключение Last.fm";
+    player_lastfm_disconnect_failed: "Could not disconnect Last.fm" , "Не удалось отвязать Last.fm";
     player_play:             "Play"                            , "Играть";
     player_like:             "Like"                            , "Лайк";
     player_add_to_queue:     "Add to queue"                    , "Добавить в очередь";

src/jobs/artist_image_backfill.rs

@@ -1,60 +0,0 @@
-use crate::scheduler::{Job, JobContext, JobLog};
-
-/// Periodic job that auto-assigns artist images from their release covers.
-///
-/// For every artist that has no `image_file_id`, picks the cover of the most
-/// recent release (by year) that has one. Runs after the cover backfill job
-/// so freshly-extracted covers are available.
-pub struct ArtistImageBackfillJob;
-
-#[async_trait::async_trait]
-impl Job for ArtistImageBackfillJob {
-    fn name(&self) -> &'static str {
-        "artist_image_backfill"
-    }
-
-    fn description(&self) -> &'static str {
-        "Auto-assign artist images from release covers"
-    }
-
-    fn default_cron(&self) -> &'static str {
-        // 03:15 daily — after cover_backfill at 03:00
-        "0 15 3 * * *"
-    }
-
-    async fn run(&self, ctx: &JobContext, log: &mut JobLog) -> anyhow::Result<()> {
-        let result = sqlx::query(
-            "UPDATE furumusic__artist a \
-             SET image_file_id = ( \
-                 SELECT r.cover_file_id \
-                 FROM furumusic__release_artist ra \
-                 JOIN furumusic__release r ON r.id = ra.release_id \
-                 WHERE ra.artist_id = a.id \
-                   AND r.cover_file_id IS NOT NULL \
-                 ORDER BY r.year DESC NULLS LAST \
-                 LIMIT 1 \
-             ), \
-             updated_at = $1 \
-             WHERE a.image_file_id IS NULL \
-               AND EXISTS ( \
-                   SELECT 1 FROM furumusic__release_artist ra2 \
-                   JOIN furumusic__release r2 ON r2.id = ra2.release_id \
-                   WHERE ra2.artist_id = a.id AND r2.cover_file_id IS NOT NULL \
-               )",
-        )
-        .bind(chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string())
-        .execute(&ctx.pool)
-        .await?;
-
-        let count = result.rows_affected();
-        if count > 0 {
-            log.info(&format!(
-                "Assigned images to {count} artists from release covers"
-            ));
-        } else {
-            log.info("All artists already have images (or no covers available)");
-        }
-
-        Ok(())
-    }
-}

src/jobs/artist_track_image_backfill.rs

@@ -1,69 +0,0 @@
-use crate::scheduler::{Job, JobContext, JobLog};
-
-/// Fallback job that assigns artist images from track cover art.
-///
-/// The primary `artist_image_backfill` job uses release covers.  This job
-/// runs afterwards and covers the case where the release itself has no
-/// cover but individual tracks do (e.g. when cover art is embedded in the
-/// audio file and extracted per-track rather than per-release).
-///
-/// For every artist that *still* has no `image_file_id` after the release-
-/// based backfill, picks the `cover_file_id` of the most recent track
-/// (by year, then track id) that has one.
-pub struct ArtistTrackImageBackfillJob;
-
-#[async_trait::async_trait]
-impl Job for ArtistTrackImageBackfillJob {
-    fn name(&self) -> &'static str {
-        "artist_track_image_backfill"
-    }
-
-    fn description(&self) -> &'static str {
-        "Auto-assign artist images from track covers (fallback)"
-    }
-
-    fn default_cron(&self) -> &'static str {
-        // 03:30 daily — after artist_image_backfill at 03:15
-        "0 30 3 * * *"
-    }
-
-    async fn run(&self, ctx: &JobContext, log: &mut JobLog) -> anyhow::Result<()> {
-        let result = sqlx::query(
-            "UPDATE furumusic__artist a \
-             SET image_file_id = ( \
-                 SELECT t.cover_file_id \
-                 FROM furumusic__track_artist ta \
-                 JOIN furumusic__track t ON t.id = ta.track_id \
-                 WHERE ta.artist_id = a.id \
-                   AND t.cover_file_id IS NOT NULL \
-                   AND t.is_hidden = false \
-                 ORDER BY t.year DESC NULLS LAST, t.id DESC \
-                 LIMIT 1 \
-             ), \
-             updated_at = $1 \
-             WHERE a.image_file_id IS NULL \
-               AND a.is_hidden = false \
-               AND EXISTS ( \
-                   SELECT 1 FROM furumusic__track_artist ta2 \
-                   JOIN furumusic__track t2 ON t2.id = ta2.track_id \
-                   WHERE ta2.artist_id = a.id \
-                     AND t2.cover_file_id IS NOT NULL \
-                     AND t2.is_hidden = false \
-               )",
-        )
-        .bind(chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string())
-        .execute(&ctx.pool)
-        .await?;
-
-        let count = result.rows_affected();
-        if count > 0 {
-            log.info(&format!(
-                "Assigned images to {count} artists from track covers"
-            ));
-        } else {
-            log.info("All artists already have images (or no track covers available)");
-        }
-
-        Ok(())
-    }
-}

src/jobs/artwork_backfill.rs

@@ -0,0 +1,965 @@
+use std::path::PathBuf;
+
+use reqwest::Client;
+use serde::Deserialize;
+
+use crate::agent::cover_art::{self, CoverImage, CoverSource};
+use crate::agent::cover_variants;
+use crate::scheduler::{Job, JobContext, JobLog};
+
+pub struct ArtworkBackfillJob;
+
+const LASTFM_REQUEST_DELAY: std::time::Duration = std::time::Duration::from_millis(1200);
+const MAX_LASTFM_RELEASE_LOOKUPS: i64 = 200;
+const MAX_LASTFM_ARTIST_LOOKUPS: i64 = 200;
+
+#[derive(Debug, sqlx::FromRow)]
+struct ReleaseCandidate {
+    id: i64,
+    title: String,
+    artist_name: Option<String>,
+}
+
+#[derive(Debug, sqlx::FromRow)]
+struct ArtistCandidate {
+    id: i64,
+    name: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct LastfmAlbumResponse {
+    album: Option<LastfmImageContainer>,
+    error: Option<i32>,
+    message: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct LastfmArtistResponse {
+    artist: Option<LastfmImageContainer>,
+    error: Option<i32>,
+    message: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct LastfmImageContainer {
+    image: Option<Vec<LastfmImage>>,
+}
+
+#[derive(Debug, Deserialize)]
+struct LastfmImage {
+    #[serde(rename = "#text")]
+    url: String,
+    size: String,
+}
+
+#[derive(Default)]
+struct ArtworkStats {
+    release_local_assigned: u64,
+    release_lastfm_assigned: u64,
+    release_lastfm_not_found: u64,
+    release_skipped_no_audio: u64,
+    artist_lastfm_assigned: u64,
+    artist_lastfm_not_found: u64,
+    artist_album_fallback_assigned: u64,
+    variants_created: usize,
+    variants_unchanged: usize,
+    variants_missing_original: usize,
+    failed: u64,
+}
+
+#[async_trait::async_trait]
+impl Job for ArtworkBackfillJob {
+    fn name(&self) -> &'static str {
+        "artwork_backfill"
+    }
+
+    fn description(&self) -> &'static str {
+        "Backfill and repair release, track, and artist artwork"
+    }
+
+    fn default_cron(&self) -> &'static str {
+        // Nightly, after inbox processing has had a chance to import new files.
+        "0 30 3 * * *"
+    }
+
+    async fn run(&self, ctx: &JobContext, log: &mut JobLog) -> anyhow::Result<()> {
+        let storage_dir = ctx.config.agent_storage_dir.trim();
+        if storage_dir.is_empty() {
+            log.warn("agent_storage_dir is not configured, skipping artwork backfill");
+            return Ok(());
+        }
+
+        let client = Client::builder()
+            .user_agent(format!(
+                "furumusic-artwork-backfill/{}",
+                env!("CARGO_PKG_VERSION")
+            ))
+            .timeout(std::time::Duration::from_secs(20))
+            .build()?;
+        let mut stats = ArtworkStats::default();
+
+        let normalized_paths =
+            crate::media_paths::normalize_media_file_paths(&ctx.pool, storage_dir).await?;
+        if normalized_paths > 0 {
+            log.info(&format!(
+                "Media path normalization pass: rewrote {normalized_paths} media file path(s) to relative storage paths"
+            ));
+        } else {
+            log.info("Media path normalization pass: all media file paths are already relative");
+        }
+
+        backfill_release_local(ctx, log, storage_dir, &mut stats).await?;
+
+        let api_key = ctx.config.lastfm_api_key.trim();
+        if api_key.is_empty() {
+            log.warn("lastfm_api_key is not configured; skipping Last.fm artwork fallback");
+        } else {
+            backfill_release_lastfm(ctx, log, storage_dir, api_key, &client, &mut stats).await?;
+            backfill_artist_lastfm(ctx, log, storage_dir, api_key, &client, &mut stats).await?;
+        }
+
+        repair_cover_variants(ctx, log, storage_dir, &mut stats).await?;
+
+        log.info(&format!(
+            "Artwork backfill complete: release_local_assigned={}, release_lastfm_assigned={}, release_lastfm_not_found={}, release_skipped_no_audio={}, artist_lastfm_assigned={}, artist_lastfm_not_found={}, artist_album_fallback_assigned={}, variants_created={}, variants_unchanged={}, variants_missing_original={}, failed={}",
+            stats.release_local_assigned,
+            stats.release_lastfm_assigned,
+            stats.release_lastfm_not_found,
+            stats.release_skipped_no_audio,
+            stats.artist_lastfm_assigned,
+            stats.artist_lastfm_not_found,
+            stats.artist_album_fallback_assigned,
+            stats.variants_created,
+            stats.variants_unchanged,
+            stats.variants_missing_original,
+            stats.failed
+        ));
+        Ok(())
+    }
+}
+
+async fn backfill_release_local(
+    ctx: &JobContext,
+    log: &mut JobLog,
+    storage_dir: &str,
+    stats: &mut ArtworkStats,
+) -> anyhow::Result<()> {
+    let releases = sqlx::query_as::<_, ReleaseCandidate>(
+        r#"SELECT r.id,
+                  r.title::text AS title,
+                  (
+                    SELECT a.name::text
+                      FROM furumusic__release_artist ra
+                      JOIN furumusic__artist a ON a.id = ra.artist_id
+                     WHERE ra.release_id = r.id
+                     ORDER BY ra.position
+                     LIMIT 1
+                  ) AS artist_name
+             FROM furumusic__release r
+            WHERE r.cover_file_id IS NULL
+              AND r.is_hidden = false
+            ORDER BY r.id"#,
+    )
+    .fetch_all(&ctx.pool)
+    .await?;
+
+    if releases.is_empty() {
+        log.info("Release local artwork pass: all visible releases already have covers");
+        return Ok(());
+    }
+    log.info(&format!(
+        "Release local artwork pass: checking {} release(s) without covers",
+        releases.len()
+    ));
+
+    for (index, release) in releases.iter().enumerate() {
+        log.info(&format!(
+            "Release local artwork {}/{}: release {} \"{}\"",
+            index + 1,
+            releases.len(),
+            release.id,
+            release.title
+        ));
+
+        let audio_paths: Vec<String> = sqlx::query_scalar(
+            r#"SELECT mf.file_path::text
+                 FROM furumusic__track t
+                 JOIN furumusic__media_file mf ON mf.id = t.audio_file_id
+                WHERE t.release_id = $1
+                  AND mf.file_type = 'audio'
+                ORDER BY t.disc_number NULLS LAST, t.track_number NULLS LAST, t.id"#,
+        )
+        .bind(release.id)
+        .fetch_all(&ctx.pool)
+        .await
+        .unwrap_or_default();
+
+        if audio_paths.is_empty() {
+            stats.release_skipped_no_audio += 1;
+            log.warn(&format!(
+                "Release {} \"{}\": no audio files found for local cover extraction",
+                release.id, release.title
+            ));
+            continue;
+        }
+
+        let audio_files: Vec<PathBuf> = audio_paths
+            .iter()
+            .map(|path| crate::media_paths::resolve_media_file_path(storage_dir, path))
+            .collect();
+        let Some(folder) = audio_files.first().and_then(|path| path.parent()) else {
+            stats.failed += 1;
+            log.warn(&format!(
+                "Release {} \"{}\": could not determine audio folder",
+                release.id, release.title
+            ));
+            continue;
+        };
+
+        let Some(cover) = cover_art::find_best_cover(folder, &audio_files).await else {
+            continue;
+        };
+
+        let source_desc = cover_source_description(&cover.source);
+        let artist_name = release.artist_name.as_deref().unwrap_or("Unknown Artist");
+        match cover_art::save_cover_to_storage(
+            &ctx.db,
+            &ctx.pool,
+            storage_dir,
+            artist_name,
+            &release.title,
+            &cover,
+        )
+        .await
+        {
+            Ok(cover_file_id) => {
+                cover_art::assign_cover_to_release(&ctx.pool, release.id, cover_file_id).await?;
+                stats.release_local_assigned += 1;
+                log.info(&format!(
+                    "Release {} \"{}\": assigned local cover from {source_desc}",
+                    release.id, release.title
+                ));
+            }
+            Err(err) => {
+                stats.failed += 1;
+                log.warn(&format!(
+                    "Release {} \"{}\": failed to save local cover: {err}",
+                    release.id, release.title
+                ));
+            }
+        }
+    }
+
+    Ok(())
+}
+
+async fn backfill_release_lastfm(
+    ctx: &JobContext,
+    log: &mut JobLog,
+    storage_dir: &str,
+    api_key: &str,
+    client: &Client,
+    stats: &mut ArtworkStats,
+) -> anyhow::Result<()> {
+    let failed_cutoff = cutoff_iso(1);
+    let not_found_cutoff = cutoff_iso(30);
+    let releases = sqlx::query_as::<_, ReleaseCandidate>(
+        r#"SELECT r.id,
+                  r.title::text AS title,
+                  COALESCE(
+                    (
+                      SELECT a.name::text
+                        FROM furumusic__release_artist ra
+                        JOIN furumusic__artist a ON a.id = ra.artist_id
+                       WHERE ra.release_id = r.id
+                       ORDER BY ra.position
+                       LIMIT 1
+                    ),
+                    (
+                      SELECT a.name::text
+                        FROM furumusic__track t
+                        JOIN furumusic__track_artist ta ON ta.track_id = t.id
+                        JOIN furumusic__artist a ON a.id = ta.artist_id
+                       WHERE t.release_id = r.id AND ta.role <> 'featuring'
+                       ORDER BY t.disc_number NULLS LAST, t.track_number NULLS LAST, ta.position
+                       LIMIT 1
+                    )
+                  ) AS artist_name
+             FROM furumusic__release r
+             LEFT JOIN furumusic__artwork_lookup_state s
+               ON s.entity_kind = 'release'
+              AND s.entity_id = r.id
+              AND s.source = 'lastfm'
+            WHERE r.cover_file_id IS NULL
+              AND r.is_hidden = false
+              AND (
+                    s.entity_id IS NULL
+                 OR s.status = 'failed' AND s.last_attempt_at < $1
+                 OR s.status = 'not_found' AND (s.attempt_count < 3 OR s.last_attempt_at < $2)
+                 OR s.status = 'found' AND s.last_attempt_at < $1
+              )
+            ORDER BY s.last_attempt_at NULLS FIRST, r.id
+            LIMIT $3"#,
+    )
+    .bind(&failed_cutoff)
+    .bind(&not_found_cutoff)
+    .bind(MAX_LASTFM_RELEASE_LOOKUPS)
+    .fetch_all(&ctx.pool)
+    .await?;
+
+    if releases.is_empty() {
+        log.info("Release Last.fm artwork pass: no eligible releases need lookup");
+        return Ok(());
+    }
+    log.info(&format!(
+        "Release Last.fm artwork pass: looking up {} release(s)",
+        releases.len()
+    ));
+
+    for (index, release) in releases.iter().enumerate() {
+        let Some(artist_name) = release
+            .artist_name
+            .as_deref()
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+        else {
+            stats.release_lastfm_not_found += 1;
+            record_lookup_state(
+                &ctx.pool,
+                "release",
+                release.id,
+                "not_found",
+                Some("release has no primary artist for Last.fm lookup"),
+                None,
+            )
+            .await?;
+            log.warn(&format!(
+                "Release {} \"{}\": no primary artist for Last.fm lookup",
+                release.id, release.title
+            ));
+            continue;
+        };
+
+        log.info(&format!(
+            "Release Last.fm artwork {}/{}: release {} \"{}\" by \"{}\"",
+            index + 1,
+            releases.len(),
+            release.id,
+            release.title,
+            artist_name
+        ));
+
+        match fetch_lastfm_album_image(client, api_key, artist_name, &release.title).await {
+            Ok(Some(image_url)) => match download_remote_cover(client, &image_url).await {
+                Ok(cover) => match cover_art::save_cover_to_storage(
+                    &ctx.db,
+                    &ctx.pool,
+                    storage_dir,
+                    artist_name,
+                    &release.title,
+                    &cover,
+                )
+                .await
+                {
+                    Ok(cover_file_id) => {
+                        cover_art::assign_cover_to_release(&ctx.pool, release.id, cover_file_id)
+                            .await?;
+                        record_lookup_state(
+                            &ctx.pool,
+                            "release",
+                            release.id,
+                            "found",
+                            None,
+                            Some(&image_url),
+                        )
+                        .await?;
+                        stats.release_lastfm_assigned += 1;
+                        log.info(&format!(
+                            "Release {} \"{}\": assigned Last.fm cover",
+                            release.id, release.title
+                        ));
+                    }
+                    Err(err) => {
+                        stats.failed += 1;
+                        record_lookup_state(
+                            &ctx.pool,
+                            "release",
+                            release.id,
+                            "failed",
+                            Some(&err.to_string()),
+                            Some(&image_url),
+                        )
+                        .await?;
+                        log.warn(&format!(
+                            "Release {} \"{}\": failed to save Last.fm cover: {err}",
+                            release.id, release.title
+                        ));
+                    }
+                },
+                Err(err) => {
+                    stats.failed += 1;
+                    record_lookup_state(
+                        &ctx.pool,
+                        "release",
+                        release.id,
+                        "failed",
+                        Some(&err.to_string()),
+                        Some(&image_url),
+                    )
+                    .await?;
+                    log.warn(&format!(
+                        "Release {} \"{}\": failed to download Last.fm cover: {err}",
+                        release.id, release.title
+                    ));
+                }
+            },
+            Ok(None) => {
+                stats.release_lastfm_not_found += 1;
+                record_lookup_state(&ctx.pool, "release", release.id, "not_found", None, None)
+                    .await?;
+                log.info(&format!(
+                    "Release {} \"{}\": Last.fm did not return artwork",
+                    release.id, release.title
+                ));
+            }
+            Err(err) if err.to_string().contains("rate limit") => {
+                stats.failed += 1;
+                record_lookup_state(
+                    &ctx.pool,
+                    "release",
+                    release.id,
+                    "failed",
+                    Some(&err.to_string()),
+                    None,
+                )
+                .await?;
+                log.error(
+                    "Last.fm rate limit exceeded during release artwork lookup; stopping this pass",
+                );
+                break;
+            }
+            Err(err) => {
+                stats.failed += 1;
+                record_lookup_state(
+                    &ctx.pool,
+                    "release",
+                    release.id,
+                    "failed",
+                    Some(&err.to_string()),
+                    None,
+                )
+                .await?;
+                log.warn(&format!(
+                    "Release {} \"{}\": Last.fm artwork lookup failed: {err}",
+                    release.id, release.title
+                ));
+            }
+        }
+
+        tokio::time::sleep(LASTFM_REQUEST_DELAY).await;
+    }
+
+    Ok(())
+}
+
+async fn backfill_artist_lastfm(
+    ctx: &JobContext,
+    log: &mut JobLog,
+    storage_dir: &str,
+    api_key: &str,
+    client: &Client,
+    stats: &mut ArtworkStats,
+) -> anyhow::Result<()> {
+    let failed_cutoff = cutoff_iso(1);
+    let not_found_cutoff = cutoff_iso(30);
+    let artists = sqlx::query_as::<_, ArtistCandidate>(
+        r#"SELECT a.id, a.name::text AS name
+             FROM furumusic__artist a
+             LEFT JOIN furumusic__artwork_lookup_state s
+               ON s.entity_kind = 'artist'
+              AND s.entity_id = a.id
+              AND s.source = 'lastfm'
+            WHERE a.image_file_id IS NULL
+              AND a.is_hidden = false
+              AND (
+                    s.entity_id IS NULL
+                 OR s.status = 'failed' AND s.last_attempt_at < $1
+                 OR s.status = 'not_found' AND (s.attempt_count < 3 OR s.last_attempt_at < $2)
+                 OR s.status = 'found' AND s.last_attempt_at < $1
+              )
+            ORDER BY s.last_attempt_at NULLS FIRST, a.id
+            LIMIT $3"#,
+    )
+    .bind(&failed_cutoff)
+    .bind(&not_found_cutoff)
+    .bind(MAX_LASTFM_ARTIST_LOOKUPS)
+    .fetch_all(&ctx.pool)
+    .await?;
+
+    if artists.is_empty() {
+        log.info("Artist Last.fm artwork pass: no eligible artists need lookup");
+        return Ok(());
+    }
+    log.info(&format!(
+        "Artist Last.fm artwork pass: looking up {} artist(s)",
+        artists.len()
+    ));
+
+    for (index, artist) in artists.iter().enumerate() {
+        log.info(&format!(
+            "Artist Last.fm artwork {}/{}: artist {} \"{}\"",
+            index + 1,
+            artists.len(),
+            artist.id,
+            artist.name
+        ));
+
+        match fetch_lastfm_artist_image(client, api_key, &artist.name).await {
+            Ok(Some(image_url)) => match download_remote_cover(client, &image_url).await {
+                Ok(cover) => match cover_art::save_cover_to_storage(
+                    &ctx.db,
+                    &ctx.pool,
+                    storage_dir,
+                    &artist.name,
+                    "__artist_image__",
+                    &cover,
+                )
+                .await
+                {
+                    Ok(image_file_id) => {
+                        sqlx::query(
+                            r#"UPDATE furumusic__artist
+                                      SET image_file_id = $1,
+                                          updated_at = $3
+                                    WHERE id = $2
+                                      AND image_file_id IS NULL"#,
+                        )
+                        .bind(image_file_id)
+                        .bind(artist.id)
+                        .bind(now_iso())
+                        .execute(&ctx.pool)
+                        .await?;
+                        record_lookup_state(
+                            &ctx.pool,
+                            "artist",
+                            artist.id,
+                            "found",
+                            None,
+                            Some(&image_url),
+                        )
+                        .await?;
+                        stats.artist_lastfm_assigned += 1;
+                        log.info(&format!(
+                            "Artist {} \"{}\": assigned Last.fm image",
+                            artist.id, artist.name
+                        ));
+                    }
+                    Err(err) => {
+                        stats.failed += 1;
+                        record_lookup_state(
+                            &ctx.pool,
+                            "artist",
+                            artist.id,
+                            "failed",
+                            Some(&err.to_string()),
+                            Some(&image_url),
+                        )
+                        .await?;
+                        log.warn(&format!(
+                            "Artist {} \"{}\": failed to save Last.fm image: {err}",
+                            artist.id, artist.name
+                        ));
+                    }
+                },
+                Err(err) => {
+                    stats.failed += 1;
+                    record_lookup_state(
+                        &ctx.pool,
+                        "artist",
+                        artist.id,
+                        "failed",
+                        Some(&err.to_string()),
+                        Some(&image_url),
+                    )
+                    .await?;
+                    log.warn(&format!(
+                        "Artist {} \"{}\": failed to download Last.fm image: {err}",
+                        artist.id, artist.name
+                    ));
+                }
+            },
+            Ok(None) => {
+                record_lookup_state(&ctx.pool, "artist", artist.id, "not_found", None, None)
+                    .await?;
+                log.info(&format!(
+                    "Artist {} \"{}\": Last.fm did not return artwork",
+                    artist.id, artist.name
+                ));
+                stats.artist_lastfm_not_found += 1;
+                match assign_artist_album_fallback(ctx, artist.id).await {
+                    Ok(Some(media_file_id)) => {
+                        stats.artist_album_fallback_assigned += 1;
+                        log.info(&format!(
+                            "Artist {} \"{}\": assigned random local album cover (media_file_id={media_file_id})",
+                            artist.id, artist.name
+                        ));
+                    }
+                    Ok(None) => {
+                        log.info(&format!(
+                            "Artist {} \"{}\": no local album cover available for fallback",
+                            artist.id, artist.name
+                        ));
+                    }
+                    Err(err) => {
+                        stats.failed += 1;
+                        log.warn(&format!(
+                            "Artist {} \"{}\": failed to assign album fallback artwork: {err}",
+                            artist.id, artist.name
+                        ));
+                    }
+                }
+            }
+            Err(err) if err.to_string().contains("rate limit") => {
+                stats.failed += 1;
+                record_lookup_state(
+                    &ctx.pool,
+                    "artist",
+                    artist.id,
+                    "failed",
+                    Some(&err.to_string()),
+                    None,
+                )
+                .await?;
+                log.error(
+                    "Last.fm rate limit exceeded during artist artwork lookup; stopping this pass",
+                );
+                break;
+            }
+            Err(err) => {
+                stats.failed += 1;
+                record_lookup_state(
+                    &ctx.pool,
+                    "artist",
+                    artist.id,
+                    "failed",
+                    Some(&err.to_string()),
+                    None,
+                )
+                .await?;
+                log.warn(&format!(
+                    "Artist {} \"{}\": Last.fm artwork lookup failed: {err}",
+                    artist.id, artist.name
+                ));
+            }
+        }
+
+        tokio::time::sleep(LASTFM_REQUEST_DELAY).await;
+    }
+
+    Ok(())
+}
+
+async fn repair_cover_variants(
+    ctx: &JobContext,
+    log: &mut JobLog,
+    storage_dir: &str,
+    stats: &mut ArtworkStats,
+) -> anyhow::Result<()> {
+    let rows: Vec<(i64, String)> = sqlx::query_as(
+        "SELECT id, file_path FROM furumusic__media_file WHERE file_type = 'cover_art' ORDER BY id",
+    )
+    .fetch_all(&ctx.pool)
+    .await?;
+
+    if rows.is_empty() {
+        log.info("Cover variant pass: no cover art media files found");
+        return Ok(());
+    }
+    log.info(&format!(
+        "Cover variant pass: checking {} cover art media file(s)",
+        rows.len()
+    ));
+
+    for (media_file_id, file_path) in rows {
+        let path = crate::media_paths::resolve_media_file_path(storage_dir, &file_path);
+        if !path.exists() {
+            stats.variants_missing_original += 1;
+            log.warn(&format!(
+                "Media file {media_file_id}: original cover not found at {}",
+                path.display()
+            ));
+            continue;
+        }
+
+        match cover_variants::ensure_cover_variants(&path).await {
+            Ok(0) => stats.variants_unchanged += 1,
+            Ok(count) => {
+                stats.variants_created += count;
+                log.info(&format!(
+                    "Media file {media_file_id}: created {count} variant(s)"
+                ));
+            }
+            Err(err) => {
+                stats.failed += 1;
+                log.warn(&format!(
+                    "Media file {media_file_id}: failed to create variants: {err}"
+                ));
+            }
+        }
+    }
+
+    Ok(())
+}
+
+async fn assign_artist_album_fallback(
+    ctx: &JobContext,
+    artist_id: i64,
+) -> anyhow::Result<Option<i64>> {
+    let media_file_id: Option<i64> = sqlx::query_scalar(
+        r#"SELECT media_file_id
+             FROM (
+                    SELECT DISTINCT r.cover_file_id AS media_file_id
+                      FROM furumusic__release r
+                      JOIN furumusic__release_artist ra ON ra.release_id = r.id
+                     WHERE ra.artist_id = $1
+                       AND r.cover_file_id IS NOT NULL
+                       AND r.is_hidden = false
+                    UNION
+                    SELECT DISTINCT r.cover_file_id AS media_file_id
+                      FROM furumusic__release r
+                      JOIN furumusic__track t ON t.release_id = r.id
+                      JOIN furumusic__track_artist ta ON ta.track_id = t.id
+                     WHERE ta.artist_id = $1
+                       AND r.cover_file_id IS NOT NULL
+                       AND r.is_hidden = false
+                  ) covers
+            ORDER BY random()
+            LIMIT 1"#,
+    )
+    .bind(artist_id)
+    .fetch_optional(&ctx.pool)
+    .await?;
+
+    let Some(media_file_id) = media_file_id else {
+        return Ok(None);
+    };
+
+    let result = sqlx::query(
+        r#"UPDATE furumusic__artist
+              SET image_file_id = $1,
+                  updated_at = $3
+            WHERE id = $2
+              AND image_file_id IS NULL"#,
+    )
+    .bind(media_file_id)
+    .bind(artist_id)
+    .bind(now_iso())
+    .execute(&ctx.pool)
+    .await?;
+
+    if result.rows_affected() == 0 {
+        Ok(None)
+    } else {
+        Ok(Some(media_file_id))
+    }
+}
+
+async fn fetch_lastfm_album_image(
+    client: &Client,
+    api_key: &str,
+    artist: &str,
+    album: &str,
+) -> anyhow::Result<Option<String>> {
+    let response = client
+        .get("https://ws.audioscrobbler.com/2.0/")
+        .query(&[
+            ("method", "album.getInfo"),
+            ("api_key", api_key),
+            ("artist", artist),
+            ("album", album),
+            ("autocorrect", "1"),
+            ("format", "json"),
+        ])
+        .send()
+        .await?;
+    let body = response.text().await?;
+    let parsed: LastfmAlbumResponse = serde_json::from_str(&body)?;
+    if let Some(code) = parsed.error {
+        if code == 6 || code == 7 {
+            return Ok(None);
+        }
+        if code == 29 {
+            anyhow::bail!("Last.fm rate limit exceeded");
+        }
+        anyhow::bail!(
+            "Last.fm API error {code}: {}",
+            parsed.message.unwrap_or_default()
+        );
+    }
+    Ok(parsed
+        .album
+        .and_then(|album| choose_best_image(album.image)))
+}
+
+async fn fetch_lastfm_artist_image(
+    client: &Client,
+    api_key: &str,
+    artist: &str,
+) -> anyhow::Result<Option<String>> {
+    let response = client
+        .get("https://ws.audioscrobbler.com/2.0/")
+        .query(&[
+            ("method", "artist.getInfo"),
+            ("api_key", api_key),
+            ("artist", artist),
+            ("autocorrect", "1"),
+            ("format", "json"),
+        ])
+        .send()
+        .await?;
+    let body = response.text().await?;
+    let parsed: LastfmArtistResponse = serde_json::from_str(&body)?;
+    if let Some(code) = parsed.error {
+        if code == 6 || code == 7 {
+            return Ok(None);
+        }
+        if code == 29 {
+            anyhow::bail!("Last.fm rate limit exceeded");
+        }
+        anyhow::bail!(
+            "Last.fm API error {code}: {}",
+            parsed.message.unwrap_or_default()
+        );
+    }
+    Ok(parsed
+        .artist
+        .and_then(|artist| choose_best_image(artist.image)))
+}
+
+fn choose_best_image(images: Option<Vec<LastfmImage>>) -> Option<String> {
+    let mut images = images.unwrap_or_default();
+    images.sort_by_key(|image| image_size_rank(&image.size));
+    images
+        .into_iter()
+        .rev()
+        .map(|image| image.url.trim().to_string())
+        .find(|url| is_usable_lastfm_image(url))
+}
+
+fn image_size_rank(size: &str) -> u8 {
+    match size {
+        "mega" => 5,
+        "extralarge" => 4,
+        "large" => 3,
+        "medium" => 2,
+        "small" => 1,
+        _ => 0,
+    }
+}
+
+fn is_usable_lastfm_image(url: &str) -> bool {
+    let value = url.trim();
+    !value.is_empty()
+        && !value.contains("2a96cbd8b46e442fc41c2b86b821562f")
+        && !value.contains("default_")
+}
+
+async fn download_remote_cover(client: &Client, url: &str) -> anyhow::Result<CoverImage> {
+    let response = client.get(url).send().await?;
+    if !response.status().is_success() {
+        anyhow::bail!("image download failed with HTTP {}", response.status());
+    }
+    let header_mime = response
+        .headers()
+        .get(reqwest::header::CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+        .and_then(normalize_image_mime);
+    let data = response.bytes().await?.to_vec();
+    if data.is_empty() {
+        anyhow::bail!("downloaded image is empty");
+    }
+    let mime_type = header_mime
+        .or_else(|| guess_image_mime(&data))
+        .ok_or_else(|| anyhow::anyhow!("downloaded file is not a supported image"))?;
+    Ok(CoverImage {
+        data,
+        mime_type,
+        source: CoverSource::Remote(url.to_string()),
+    })
+}
+
+fn normalize_image_mime(value: &str) -> Option<String> {
+    let mime = value.split(';').next()?.trim().to_ascii_lowercase();
+    match mime.as_str() {
+        "image/jpeg" | "image/jpg" => Some("image/jpeg".to_string()),
+        "image/png" => Some("image/png".to_string()),
+        "image/webp" => Some("image/webp".to_string()),
+        "image/gif" => Some("image/gif".to_string()),
+        "image/bmp" => Some("image/bmp".to_string()),
+        _ => None,
+    }
+}
+
+fn guess_image_mime(data: &[u8]) -> Option<String> {
+    if data.starts_with(&[0xFF, 0xD8, 0xFF]) {
+        Some("image/jpeg".to_string())
+    } else if data.starts_with(&[0x89, 0x50, 0x4E, 0x47]) {
+        Some("image/png".to_string())
+    } else if data.starts_with(b"RIFF") && data.len() > 12 && &data[8..12] == b"WEBP" {
+        Some("image/webp".to_string())
+    } else if data.starts_with(b"GIF8") {
+        Some("image/gif".to_string())
+    } else if data.starts_with(&[0x42, 0x4D]) {
+        Some("image/bmp".to_string())
+    } else {
+        None
+    }
+}
+
+async fn record_lookup_state(
+    pool: &sqlx::PgPool,
+    entity_kind: &str,
+    entity_id: i64,
+    status: &str,
+    error: Option<&str>,
+    source_url: Option<&str>,
+) -> anyhow::Result<()> {
+    sqlx::query(
+        r#"INSERT INTO furumusic__artwork_lookup_state
+              (entity_kind, entity_id, source, status, attempt_count, last_attempt_at, last_error, source_url)
+           VALUES ($1, $2, 'lastfm', $3, 1, $4, $5, $6)
+           ON CONFLICT (entity_kind, entity_id, source) DO UPDATE SET
+              status = EXCLUDED.status,
+              attempt_count = furumusic__artwork_lookup_state.attempt_count + 1,
+              last_attempt_at = EXCLUDED.last_attempt_at,
+              last_error = EXCLUDED.last_error,
+              source_url = EXCLUDED.source_url"#,
+    )
+    .bind(entity_kind)
+    .bind(entity_id)
+    .bind(status)
+    .bind(now_iso())
+    .bind(error)
+    .bind(source_url)
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+fn cover_source_description(source: &CoverSource) -> String {
+    match source {
+        CoverSource::FolderFile(path) => format!("folder: {}", path.display()),
+        CoverSource::Embedded(path) => format!("embedded: {}", path.display()),
+        CoverSource::Remote(url) => format!("remote: {url}"),
+    }
+}
+
+fn cutoff_iso(days: i64) -> String {
+    (chrono::Utc::now() - chrono::Duration::days(days))
+        .format("%Y-%m-%dT%H:%M:%SZ")
+        .to_string()
+}
+
+fn now_iso() -> String {
+    chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string()
+}

src/jobs/cover_backfill.rs

@@ -1,167 +0,0 @@
-use std::path::{Path, PathBuf};
-
-use crate::agent::cover_art;
-use crate::scheduler::{Job, JobContext, JobLog};
-
-/// One-shot / periodic job that finds releases without cover art and attempts
-/// to extract or discover covers from their audio files in storage.
-pub struct CoverBackfillJob;
-
-#[async_trait::async_trait]
-impl Job for CoverBackfillJob {
-    fn name(&self) -> &'static str {
-        "cover_backfill"
-    }
-
-    fn description(&self) -> &'static str {
-        "Backfill cover art for releases missing covers"
-    }
-
-    fn default_cron(&self) -> &'static str {
-        // Once a day at 03:00
-        "0 0 3 * * *"
-    }
-
-    async fn run(&self, ctx: &JobContext, log: &mut JobLog) -> anyhow::Result<()> {
-        let storage_dir = &ctx.config.agent_storage_dir;
-        if storage_dir.is_empty() {
-            log.warn("agent_storage_dir is not configured, skipping cover backfill");
-            return Ok(());
-        }
-
-        // Find all releases without a cover
-        let rows: Vec<(i64, String)> = sqlx::query_as(
-            "SELECT r.id, r.title \
-             FROM furumusic__release r \
-             WHERE r.cover_file_id IS NULL \
-             ORDER BY r.id",
-        )
-        .fetch_all(&ctx.pool)
-        .await?;
-
-        if rows.is_empty() {
-            log.info("All releases already have cover art, nothing to backfill");
-            return Ok(());
-        }
-
-        log.info(&format!(
-            "Found {} releases without cover art, starting backfill...",
-            rows.len()
-        ));
-
-        let mut assigned = 0u32;
-        let mut failed = 0u32;
-        let mut skipped_no_audio = 0u32;
-        let mut skipped_no_cover = 0u32;
-        let total = rows.len();
-
-        for (i, (release_id, release_title)) in rows.iter().enumerate() {
-            log.info(&format!(
-                "[{}/{}] Processing release {release_id} \"{release_title}\"...",
-                i + 1,
-                total,
-            ));
-
-            // Find audio files belonging to this release via tracks → media_file
-            let audio_paths: Vec<(String,)> = sqlx::query_as(
-                "SELECT mf.file_path \
-                 FROM furumusic__track t \
-                 JOIN furumusic__media_file mf ON mf.id = t.audio_file_id \
-                 WHERE t.release_id = $1 AND mf.file_type = 'audio'",
-            )
-            .bind(release_id)
-            .fetch_all(&ctx.pool)
-            .await
-            .unwrap_or_default();
-
-            if audio_paths.is_empty() {
-                log.warn(&format!(
-                    "Release {release_id} \"{release_title}\": no audio files found, skipping"
-                ));
-                skipped_no_audio += 1;
-                continue;
-            }
-
-            // Determine the folder from the first audio file's path
-            let first_path = Path::new(&audio_paths[0].0);
-            let folder = first_path.parent().unwrap_or(Path::new("."));
-
-            // Collect all audio file paths as PathBuf
-            let audio_files: Vec<PathBuf> =
-                audio_paths.iter().map(|(p,)| PathBuf::from(p)).collect();
-
-            // Try to find cover art
-            let cover = match cover_art::find_best_cover(folder, &audio_files).await {
-                Some(c) => c,
-                None => {
-                    log.info(&format!(
-                        "Release {release_id} \"{release_title}\": no cover image found in {} audio files, skipping",
-                        audio_files.len(),
-                    ));
-                    skipped_no_cover += 1;
-                    continue;
-                }
-            };
-
-            let source_desc = match &cover.source {
-                cover_art::CoverSource::FolderFile(p) => format!("folder: {}", p.display()),
-                cover_art::CoverSource::Embedded(p) => format!("embedded: {}", p.display()),
-            };
-
-            // Look up artist name for storage path
-            let artist_name: String = sqlx::query_scalar(
-                "SELECT a.name FROM furumusic__artist a \
-                 JOIN furumusic__release_artist ra ON ra.artist_id = a.id \
-                 WHERE ra.release_id = $1 \
-                 ORDER BY ra.position LIMIT 1",
-            )
-            .bind(release_id)
-            .fetch_optional(&ctx.pool)
-            .await
-            .ok()
-            .flatten()
-            .unwrap_or_else(|| "Unknown Artist".to_string());
-
-            match cover_art::save_cover_to_storage(
-                &ctx.db,
-                &ctx.pool,
-                storage_dir,
-                &artist_name,
-                release_title,
-                &cover,
-            )
-            .await
-            {
-                Ok(cover_file_id) => {
-                    if let Err(e) =
-                        cover_art::assign_cover_to_release(&ctx.pool, *release_id, cover_file_id)
-                            .await
-                    {
-                        log.warn(&format!(
-                            "Release {release_id} \"{release_title}\": saved cover but failed to assign: {e}"
-                        ));
-                        failed += 1;
-                    } else {
-                        log.info(&format!(
-                            "Release {release_id} \"{release_title}\": assigned cover from {source_desc}"
-                        ));
-                        assigned += 1;
-                    }
-                }
-                Err(e) => {
-                    log.warn(&format!(
-                        "Release {release_id} \"{release_title}\": failed to save cover: {e}"
-                    ));
-                    failed += 1;
-                }
-            }
-        }
-
-        log.info(&format!(
-            "Cover backfill complete: {assigned} assigned, {failed} failed, \
-             {skipped_no_audio} skipped (no audio), {skipped_no_cover} skipped (no cover found)"
-        ));
-
-        Ok(())
-    }
-}

src/jobs/cover_variant_backfill.rs

@@ -1,96 +0,0 @@
-use std::path::{Path, PathBuf};
-
-use crate::agent::cover_variants;
-use crate::scheduler::{Job, JobContext, JobLog};
-
-pub struct CoverVariantBackfillJob;
-
-#[async_trait::async_trait]
-impl Job for CoverVariantBackfillJob {
-    fn name(&self) -> &'static str {
-        "cover_variant_backfill"
-    }
-
-    fn description(&self) -> &'static str {
-        "Generate missing resized cover image variants"
-    }
-
-    fn default_cron(&self) -> &'static str {
-        // Once a day after cover extraction and artist image assignment.
-        "0 45 3 * * *"
-    }
-
-    async fn run(&self, ctx: &JobContext, log: &mut JobLog) -> anyhow::Result<()> {
-        let storage_dir = &ctx.config.agent_storage_dir;
-        if storage_dir.is_empty() {
-            log.warn("agent_storage_dir is not configured, skipping cover variant backfill");
-            return Ok(());
-        }
-
-        let rows: Vec<(i64, String)> = sqlx::query_as(
-            "SELECT id, file_path FROM furumusic__media_file WHERE file_type = 'cover_art' ORDER BY id",
-        )
-        .fetch_all(&ctx.pool)
-        .await?;
-
-        if rows.is_empty() {
-            log.info("No cover art media files found");
-            return Ok(());
-        }
-
-        log.info(&format!(
-            "Found {} cover art media file(s), checking variants...",
-            rows.len()
-        ));
-
-        let mut created = 0usize;
-        let mut unchanged = 0usize;
-        let mut missing_original = 0usize;
-        let mut failed = 0usize;
-
-        for (media_file_id, file_path) in rows {
-            let path = resolve_media_path(storage_dir, &file_path);
-            if !path.exists() {
-                missing_original += 1;
-                log.warn(&format!(
-                    "Media file {media_file_id}: original cover not found at {}",
-                    path.display()
-                ));
-                continue;
-            }
-
-            match cover_variants::ensure_cover_variants(&path).await {
-                Ok(0) => unchanged += 1,
-                Ok(count) => {
-                    created += count;
-                    log.info(&format!(
-                        "Media file {media_file_id}: created {count} variant(s)"
-                    ));
-                }
-                Err(err) => {
-                    failed += 1;
-                    log.warn(&format!(
-                        "Media file {media_file_id}: failed to create variants: {err}"
-                    ));
-                }
-            }
-        }
-
-        log.info(&format!(
-            "Cover variant backfill complete: {created} variant(s) created, \
-             {unchanged} original(s) already complete, {missing_original} missing original(s), \
-             {failed} failed original(s)"
-        ));
-
-        Ok(())
-    }
-}
-
-fn resolve_media_path(storage_dir: &str, file_path: &str) -> PathBuf {
-    let path = PathBuf::from(file_path);
-    if path.is_absolute() {
-        path
-    } else {
-        Path::new(storage_dir).join(path)
-    }
-}

src/jobs/inbox_process.rs

@@ -798,16 +798,29 @@ pub async fn finalize_approved(
         )
         .await?
         {
-            mover::MoveOutcome::Moved(p) => p.to_string_lossy().to_string(),
-            mover::MoveOutcome::Merged(p) => p.to_string_lossy().to_string(),
+            mover::MoveOutcome::Moved(p) | mover::MoveOutcome::Merged(p) => {
+                crate::media_paths::media_file_path_for_storage(storage_dir_str, &p).ok_or_else(
+                    || {
+                        anyhow::anyhow!(
+                            "storage destination is outside agent_storage_dir: {}",
+                            p.display()
+                        )
+                    },
+                )?
+            }
         }
     } else {
-        storage_dir
+        let expected_path = storage_dir
             .join(sanitize_filename(artist_name))
             .join(sanitize_filename(release_title))
-            .join(&dest_filename)
-            .to_string_lossy()
-            .to_string()
+            .join(&dest_filename);
+        crate::media_paths::media_file_path_for_storage(storage_dir_str, &expected_path)
+            .ok_or_else(|| {
+                anyhow::anyhow!(
+                    "storage destination is outside agent_storage_dir: {}",
+                    expected_path.display()
+                )
+            })?
     };
 
     let media_file = MediaFile::create(
@@ -887,6 +900,9 @@ pub async fn finalize_approved(
                     crate::agent::cover_art::CoverSource::Embedded(p) => {
                         format!("embedded in: {}", p.display())
                     }
+                    crate::agent::cover_art::CoverSource::Remote(url) => {
+                        format!("remote: {url}")
+                    }
                 };
                 match crate::agent::cover_art::save_cover_to_storage(
                     db,

src/jobs/lastfm_scrobble.rs

@@ -0,0 +1,34 @@
+use crate::lastfm;
+use crate::scheduler::{Job, JobContext, JobLog};
+
+pub struct LastfmScrobbleJob;
+
+#[async_trait::async_trait]
+impl Job for LastfmScrobbleJob {
+    fn name(&self) -> &'static str {
+        "lastfm_scrobble"
+    }
+
+    fn description(&self) -> &'static str {
+        "Send queued Last.fm scrobbles for connected users"
+    }
+
+    fn default_cron(&self) -> &'static str {
+        // Every minute.
+        "0 * * * * *"
+    }
+
+    async fn run(&self, ctx: &JobContext, log: &mut JobLog) -> anyhow::Result<()> {
+        if !lastfm::is_configured(&ctx.config) {
+            log.warn("Last.fm API key/shared secret are not configured; skipping scrobble outbox");
+            return Ok(());
+        }
+
+        let summary = lastfm::process_pending_scrobbles(&ctx.pool, &ctx.config, None, 50).await?;
+        log.info(&format!(
+            "Last.fm scrobble outbox processed: considered={}, sent={}, failed={}, blocked={}, skipped={}",
+            summary.considered, summary.sent, summary.failed, summary.blocked, summary.skipped
+        ));
+        Ok(())
+    }
+}

src/jobs/metadata_backfill.rs

@@ -1,5 +1,3 @@
-use std::path::{Path, PathBuf};
-
 use crate::scheduler::{Job, JobContext, JobLog};
 
 #[derive(Debug, Clone, Copy)]
@@ -104,11 +102,15 @@ pub async fn run_with_options(
 
     for row in rows {
         scanned += 1;
-        let Some(path) = resolve_media_path(&row.file_path, &ctx.config.agent_storage_dir) else {
+        let path = crate::media_paths::resolve_media_file_path(
+            &ctx.config.agent_storage_dir,
+            &row.file_path,
+        );
+        if !path.exists() {
             missing += 1;
             log.warn(&format!("missing file: {}", row.file_path));
             continue;
-        };
+        }
 
         let extract_path = path.clone();
         let raw_meta = match tokio::task::spawn_blocking(move || {
@@ -218,17 +220,3 @@ fn should_update<T>(current: Option<T>, overwrite: bool) -> bool {
 fn should_update_duration(current: Option<f64>, overwrite: bool) -> bool {
     overwrite || current.unwrap_or(0.0) <= 0.0
 }
-
-fn resolve_media_path(file_path: &str, storage_dir: &str) -> Option<PathBuf> {
-    let path = Path::new(file_path);
-    if path.exists() {
-        return Some(path.to_path_buf());
-    }
-    if path.is_relative() && !storage_dir.is_empty() {
-        let joined = Path::new(storage_dir).join(path);
-        if joined.exists() {
-            return Some(joined);
-        }
-    }
-    None
-}

src/jobs/mod.rs

@@ -1,10 +1,8 @@
-pub mod artist_image_backfill;
-pub mod artist_track_image_backfill;
-pub mod cover_backfill;
-pub mod cover_variant_backfill;
+pub mod artwork_backfill;
 pub mod inbox_discover;
 pub mod inbox_process;
 pub mod lastfm_popularity;
+pub mod lastfm_scrobble;
 pub mod metadata_backfill;
 
 use std::path::{Component, Path, PathBuf};

src/lastfm.rs

@@ -0,0 +1,619 @@
+use std::collections::BTreeMap;
+use std::time::Duration;
+
+use anyhow::Context;
+use md5::{Digest, Md5};
+use reqwest::Client;
+use serde::Deserialize;
+use sqlx::PgPool;
+
+use crate::config::AppConfig;
+
+const LASTFM_API_URL: &str = "https://ws.audioscrobbler.com/2.0/";
+const MAX_BATCH_SIZE: i64 = 50;
+const MAX_ATTEMPTS: i32 = 8;
+
+#[derive(Debug, Clone)]
+pub struct LastfmCredentials {
+    api_key: String,
+    shared_secret: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct LastfmSession {
+    pub username: String,
+    pub session_key: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct LastfmTrackPayload {
+    pub artist: String,
+    pub track: String,
+    pub album: Option<String>,
+    pub album_artist: Option<String>,
+    pub track_number: Option<i32>,
+    pub duration_seconds: Option<i32>,
+}
+
+#[derive(Debug, Clone)]
+pub struct LastfmScrobblePayload {
+    pub track: LastfmTrackPayload,
+    pub timestamp: i64,
+}
+
+#[derive(Debug)]
+pub struct LastfmApiError {
+    pub code: Option<i32>,
+    pub message: String,
+}
+
+impl std::fmt::Display for LastfmApiError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self.code {
+            Some(code) => write!(f, "Last.fm API error {code}: {}", self.message),
+            None => write!(f, "Last.fm API error: {}", self.message),
+        }
+    }
+}
+
+impl std::error::Error for LastfmApiError {}
+
+impl LastfmApiError {
+    fn new(code: Option<i32>, message: impl Into<String>) -> Self {
+        Self {
+            code,
+            message: message.into(),
+        }
+    }
+
+    pub fn is_invalid_session(&self) -> bool {
+        self.code == Some(9)
+    }
+
+    pub fn is_retryable(&self) -> bool {
+        matches!(self.code, Some(11 | 16 | 29) | None)
+    }
+}
+
+#[derive(Debug, Default)]
+pub struct ScrobbleProcessSummary {
+    pub considered: u64,
+    pub sent: u64,
+    pub failed: u64,
+    pub blocked: u64,
+    pub skipped: u64,
+}
+
+pub fn is_configured(config: &AppConfig) -> bool {
+    !config.lastfm_api_key.trim().is_empty() && !config.lastfm_shared_secret.trim().is_empty()
+}
+
+impl LastfmCredentials {
+    pub fn from_config(config: &AppConfig) -> Option<Self> {
+        let api_key = config.lastfm_api_key.trim();
+        let shared_secret = config.lastfm_shared_secret.trim();
+        if api_key.is_empty() || shared_secret.is_empty() {
+            return None;
+        }
+        Some(Self {
+            api_key: api_key.to_owned(),
+            shared_secret: shared_secret.to_owned(),
+        })
+    }
+
+    pub fn api_key(&self) -> &str {
+        &self.api_key
+    }
+}
+
+pub struct LastfmClient {
+    client: Client,
+    credentials: LastfmCredentials,
+}
+
+impl LastfmClient {
+    pub fn new(credentials: LastfmCredentials) -> anyhow::Result<Self> {
+        let client = Client::builder()
+            .user_agent(format!(
+                "furumusic-lastfm-scrobbler/{}",
+                env!("CARGO_PKG_VERSION")
+            ))
+            .timeout(Duration::from_secs(15))
+            .build()
+            .context("failed to build Last.fm HTTP client")?;
+        Ok(Self {
+            client,
+            credentials,
+        })
+    }
+
+    pub async fn get_session(&self, token: &str) -> Result<LastfmSession, LastfmApiError> {
+        let params = self.signed_params(
+            "auth.getSession",
+            None,
+            vec![("token".to_string(), token.to_string())],
+        );
+        let body = self.post(params).await?;
+        let response: AuthSessionResponse = serde_json::from_str(&body)
+            .map_err(|err| LastfmApiError::new(None, err.to_string()))?;
+        if let Some(code) = response.error {
+            return Err(LastfmApiError::new(
+                Some(code),
+                response
+                    .message
+                    .unwrap_or_else(|| "authentication failed".to_string()),
+            ));
+        }
+        let Some(session) = response.session else {
+            return Err(LastfmApiError::new(
+                None,
+                "Last.fm auth response did not include a session",
+            ));
+        };
+        Ok(LastfmSession {
+            username: session.name,
+            session_key: session.key,
+        })
+    }
+
+    pub async fn update_now_playing(
+        &self,
+        session_key: &str,
+        track: &LastfmTrackPayload,
+    ) -> Result<(), LastfmApiError> {
+        let mut extra = vec![
+            ("artist".to_string(), track.artist.clone()),
+            ("track".to_string(), track.track.clone()),
+        ];
+        push_optional(&mut extra, "album", track.album.as_deref());
+        push_optional(&mut extra, "albumArtist", track.album_artist.as_deref());
+        push_optional_i32(&mut extra, "trackNumber", track.track_number);
+        push_optional_i32(&mut extra, "duration", track.duration_seconds);
+
+        let params = self.signed_params("track.updateNowPlaying", Some(session_key), extra);
+        let body = self.post(params).await?;
+        check_lastfm_error(&body)
+    }
+
+    pub async fn scrobble_batch(
+        &self,
+        session_key: &str,
+        scrobbles: &[LastfmScrobblePayload],
+    ) -> Result<(), LastfmApiError> {
+        let mut extra = Vec::new();
+        for (index, scrobble) in scrobbles.iter().take(MAX_BATCH_SIZE as usize).enumerate() {
+            let suffix = format!("[{index}]");
+            extra.push((format!("artist{suffix}"), scrobble.track.artist.clone()));
+            extra.push((format!("track{suffix}"), scrobble.track.track.clone()));
+            extra.push((format!("timestamp{suffix}"), scrobble.timestamp.to_string()));
+            push_optional(
+                &mut extra,
+                &format!("album{suffix}"),
+                scrobble.track.album.as_deref(),
+            );
+            push_optional(
+                &mut extra,
+                &format!("albumArtist{suffix}"),
+                scrobble.track.album_artist.as_deref(),
+            );
+            push_optional_i32(
+                &mut extra,
+                &format!("trackNumber{suffix}"),
+                scrobble.track.track_number,
+            );
+            push_optional_i32(
+                &mut extra,
+                &format!("duration{suffix}"),
+                scrobble.track.duration_seconds,
+            );
+        }
+
+        let params = self.signed_params("track.scrobble", Some(session_key), extra);
+        let body = self.post(params).await?;
+        check_lastfm_error(&body)
+    }
+
+    fn signed_params(
+        &self,
+        method: &str,
+        session_key: Option<&str>,
+        extra: Vec<(String, String)>,
+    ) -> Vec<(String, String)> {
+        let mut params = BTreeMap::new();
+        params.insert("api_key".to_string(), self.credentials.api_key.clone());
+        params.insert("method".to_string(), method.to_string());
+        if let Some(session_key) = session_key {
+            params.insert("sk".to_string(), session_key.to_string());
+        }
+        for (key, value) in extra {
+            params.insert(key, value);
+        }
+
+        let mut signature_input = String::new();
+        for (key, value) in &params {
+            signature_input.push_str(key);
+            signature_input.push_str(value);
+        }
+        signature_input.push_str(&self.credentials.shared_secret);
+        let digest = Md5::digest(signature_input.as_bytes());
+        let api_sig = format!("{digest:x}");
+
+        let mut out = params.into_iter().collect::<Vec<_>>();
+        out.push(("api_sig".to_string(), api_sig));
+        out.push(("format".to_string(), "json".to_string()));
+        out
+    }
+
+    async fn post(&self, params: Vec<(String, String)>) -> Result<String, LastfmApiError> {
+        let response = self
+            .client
+            .post(LASTFM_API_URL)
+            .form(&params)
+            .send()
+            .await
+            .map_err(|err| LastfmApiError::new(None, err.to_string()))?;
+        let status = response.status();
+        let body = response
+            .text()
+            .await
+            .map_err(|err| LastfmApiError::new(None, err.to_string()))?;
+        if !status.is_success() {
+            if let Some(err) = parse_error(&body) {
+                return Err(err);
+            }
+            return Err(LastfmApiError::new(None, format!("HTTP {status}: {body}")));
+        }
+        Ok(body)
+    }
+}
+
+pub async fn process_pending_scrobbles(
+    pool: &PgPool,
+    config: &AppConfig,
+    user_id: Option<i64>,
+    limit_per_user: i64,
+) -> anyhow::Result<ScrobbleProcessSummary> {
+    let Some(credentials) = LastfmCredentials::from_config(config) else {
+        return Ok(ScrobbleProcessSummary::default());
+    };
+    let client = LastfmClient::new(credentials)?;
+    let user_ids = pending_user_ids(pool, user_id).await?;
+    let mut summary = ScrobbleProcessSummary::default();
+
+    for uid in user_ids {
+        let rows = fetch_pending_scrobbles(pool, uid, limit_per_user.min(MAX_BATCH_SIZE)).await?;
+        if rows.is_empty() {
+            continue;
+        }
+        summary.considered += rows.len() as u64;
+
+        let mut ids = Vec::new();
+        let mut attempt_rows = Vec::new();
+        let mut payloads = Vec::new();
+        for row in &rows {
+            match row.payload() {
+                Some(payload) => {
+                    ids.push(row.id);
+                    attempt_rows.push((row.id, row.attempt_count));
+                    payloads.push(payload);
+                }
+                None => {
+                    mark_row_failed(pool, row.id, "track has no primary Last.fm artist").await?;
+                    summary.skipped += 1;
+                }
+            }
+        }
+        if ids.is_empty() {
+            continue;
+        }
+
+        match client.scrobble_batch(&rows[0].session_key, &payloads).await {
+            Ok(()) => {
+                mark_rows_sent(pool, &ids).await?;
+                clear_account_error(pool, uid).await?;
+                summary.sent += ids.len() as u64;
+            }
+            Err(err) if err.is_invalid_session() => {
+                mark_account_reauth_required(pool, uid, &err.to_string()).await?;
+                mark_rows_blocked(pool, &ids, &err.to_string()).await?;
+                summary.blocked += ids.len() as u64;
+            }
+            Err(err) => {
+                mark_rows_retry_or_failed(pool, &attempt_rows, &err).await?;
+                summary.failed += ids.len() as u64;
+                if err.code == Some(29) {
+                    break;
+                }
+            }
+        }
+    }
+
+    Ok(summary)
+}
+
+#[derive(Debug, Deserialize)]
+struct AuthSessionResponse {
+    session: Option<AuthSession>,
+    error: Option<i32>,
+    message: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct AuthSession {
+    name: String,
+    key: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct ErrorEnvelope {
+    error: Option<i32>,
+    message: Option<String>,
+}
+
+#[derive(Debug, sqlx::FromRow)]
+struct PendingScrobbleRow {
+    id: i64,
+    started_at: i64,
+    duration_seconds: i32,
+    attempt_count: i32,
+    session_key: String,
+    title: String,
+    artist_name: Option<String>,
+    album_title: Option<String>,
+    album_artist_name: Option<String>,
+    track_number: Option<i32>,
+}
+
+impl PendingScrobbleRow {
+    fn payload(&self) -> Option<LastfmScrobblePayload> {
+        let artist = self
+            .artist_name
+            .as_deref()
+            .map(str::trim)
+            .filter(|value| !value.is_empty())?
+            .to_string();
+        Some(LastfmScrobblePayload {
+            track: LastfmTrackPayload {
+                artist,
+                track: self.title.clone(),
+                album: non_empty(self.album_title.as_deref()),
+                album_artist: non_empty(self.album_artist_name.as_deref()),
+                track_number: self.track_number,
+                duration_seconds: Some(self.duration_seconds),
+            },
+            timestamp: self.started_at,
+        })
+    }
+}
+
+fn non_empty(value: Option<&str>) -> Option<String> {
+    value
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(ToOwned::to_owned)
+}
+
+fn push_optional(params: &mut Vec<(String, String)>, key: &str, value: Option<&str>) {
+    if let Some(value) = value.map(str::trim).filter(|value| !value.is_empty()) {
+        params.push((key.to_string(), value.to_string()));
+    }
+}
+
+fn push_optional_i32(params: &mut Vec<(String, String)>, key: &str, value: Option<i32>) {
+    if let Some(value) = value {
+        params.push((key.to_string(), value.to_string()));
+    }
+}
+
+fn check_lastfm_error(body: &str) -> Result<(), LastfmApiError> {
+    if let Some(err) = parse_error(body) {
+        return Err(err);
+    }
+    Ok(())
+}
+
+fn parse_error(body: &str) -> Option<LastfmApiError> {
+    let envelope: ErrorEnvelope = serde_json::from_str(body).ok()?;
+    envelope
+        .error
+        .map(|code| LastfmApiError::new(Some(code), envelope.message.unwrap_or_default()))
+}
+
+async fn pending_user_ids(pool: &PgPool, user_id: Option<i64>) -> anyhow::Result<Vec<i64>> {
+    if let Some(user_id) = user_id {
+        return Ok(vec![user_id]);
+    }
+    let rows = sqlx::query_scalar::<_, i64>(
+        r#"SELECT DISTINCT o.user_id
+             FROM furumusic__lastfm_scrobble_outbox o
+             JOIN furumusic__lastfm_account a ON a.user_id = o.user_id
+            WHERE o.status IN ('pending', 'retry')
+              AND a.reauth_required = false
+            ORDER BY o.user_id"#,
+    )
+    .fetch_all(pool)
+    .await?;
+    Ok(rows)
+}
+
+async fn fetch_pending_scrobbles(
+    pool: &PgPool,
+    user_id: i64,
+    limit: i64,
+) -> anyhow::Result<Vec<PendingScrobbleRow>> {
+    let rows = sqlx::query_as::<_, PendingScrobbleRow>(
+        r#"SELECT o.id,
+                  o.started_at,
+                  o.duration_seconds,
+                  o.attempt_count,
+                  a.session_key::text AS session_key,
+                  t.title::text AS title,
+                  r.title::text AS album_title,
+                  t.track_number,
+                  (
+                    SELECT ar.name::text
+                      FROM furumusic__track_artist ta
+                      JOIN furumusic__artist ar ON ar.id = ta.artist_id
+                     WHERE ta.track_id = t.id AND ta.role <> 'featuring'
+                     ORDER BY ta.position
+                     LIMIT 1
+                  ) AS artist_name,
+                  (
+                    SELECT ar.name::text
+                      FROM furumusic__release_artist ra
+                      JOIN furumusic__artist ar ON ar.id = ra.artist_id
+                     WHERE ra.release_id = r.id
+                     ORDER BY ra.position
+                     LIMIT 1
+                  ) AS album_artist_name
+             FROM furumusic__lastfm_scrobble_outbox o
+             JOIN furumusic__lastfm_account a ON a.user_id = o.user_id
+             JOIN furumusic__track t ON t.id = o.track_id
+             LEFT JOIN furumusic__release r ON r.id = t.release_id
+            WHERE o.user_id = $1
+              AND o.status IN ('pending', 'retry')
+              AND a.reauth_required = false
+            ORDER BY o.created_at, o.id
+            LIMIT $2"#,
+    )
+    .bind(user_id)
+    .bind(limit)
+    .fetch_all(pool)
+    .await?;
+    Ok(rows)
+}
+
+async fn clear_account_error(pool: &PgPool, user_id: i64) -> anyhow::Result<()> {
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_account
+              SET last_error = NULL,
+                  reauth_required = false,
+                  updated_at = $2
+            WHERE user_id = $1"#,
+    )
+    .bind(user_id)
+    .bind(now_iso())
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+async fn mark_account_reauth_required(
+    pool: &PgPool,
+    user_id: i64,
+    error: &str,
+) -> anyhow::Result<()> {
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_account
+              SET reauth_required = true,
+                  last_error = $2,
+                  updated_at = $3
+            WHERE user_id = $1"#,
+    )
+    .bind(user_id)
+    .bind(error)
+    .bind(now_iso())
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+async fn mark_rows_sent(pool: &PgPool, ids: &[i64]) -> anyhow::Result<()> {
+    if ids.is_empty() {
+        return Ok(());
+    }
+    let now = now_iso();
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_scrobble_outbox
+              SET status = 'sent',
+                  updated_at = $2,
+                  scrobbled_at = $2,
+                  last_error = NULL
+            WHERE id = ANY($1)"#,
+    )
+    .bind(ids)
+    .bind(now)
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+async fn mark_row_failed(pool: &PgPool, id: i64, error: &str) -> anyhow::Result<()> {
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_scrobble_outbox
+              SET status = 'failed',
+                  attempt_count = attempt_count + 1,
+                  last_error = $2,
+                  updated_at = $3
+            WHERE id = $1"#,
+    )
+    .bind(id)
+    .bind(error)
+    .bind(now_iso())
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+async fn mark_rows_blocked(pool: &PgPool, ids: &[i64], error: &str) -> anyhow::Result<()> {
+    if ids.is_empty() {
+        return Ok(());
+    }
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_scrobble_outbox
+              SET status = 'blocked',
+                  attempt_count = attempt_count + 1,
+                  last_error = $2,
+                  updated_at = $3
+            WHERE id = ANY($1)"#,
+    )
+    .bind(ids)
+    .bind(error)
+    .bind(now_iso())
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+async fn mark_rows_retry_or_failed(
+    pool: &PgPool,
+    rows: &[(i64, i32)],
+    error: &LastfmApiError,
+) -> anyhow::Result<()> {
+    if rows.is_empty() {
+        return Ok(());
+    }
+    let ids: Vec<i64> = rows.iter().map(|(id, _)| *id).collect();
+    let next_status = if error.is_retryable()
+        && rows
+            .iter()
+            .any(|(_, attempt_count)| attempt_count + 1 < MAX_ATTEMPTS)
+    {
+        "retry"
+    } else {
+        "failed"
+    };
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_scrobble_outbox
+              SET status = CASE
+                    WHEN attempt_count + 1 >= $2 THEN 'failed'
+                    ELSE $3
+                  END,
+                  attempt_count = attempt_count + 1,
+                  last_error = $4,
+                  updated_at = $5
+            WHERE id = ANY($1)"#,
+    )
+    .bind(&ids)
+    .bind(MAX_ATTEMPTS)
+    .bind(next_status)
+    .bind(error.to_string())
+    .bind(now_iso())
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+fn now_iso() -> String {
+    chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string()
+}

src/main.rs

@@ -5,6 +5,8 @@ mod auth;
 mod config;
 mod i18n;
 mod jobs;
+mod lastfm;
+mod media_paths;
 mod music;
 mod oidc;
 mod player;
@@ -49,12 +51,10 @@ fn build_registry() -> Arc<JobRegistry> {
     registry.register(jobs::inbox_discover::InboxDiscoverJob);
     registry.register(jobs::inbox_process::InboxProcessJob);
     registry.register(jobs::inbox_process::FileProcessJob);
-    registry.register(jobs::cover_backfill::CoverBackfillJob);
-    registry.register(jobs::artist_image_backfill::ArtistImageBackfillJob);
-    registry.register(jobs::artist_track_image_backfill::ArtistTrackImageBackfillJob);
-    registry.register(jobs::cover_variant_backfill::CoverVariantBackfillJob);
+    registry.register(jobs::artwork_backfill::ArtworkBackfillJob);
     registry.register(jobs::metadata_backfill::MetadataBackfillJob);
     registry.register(jobs::lastfm_popularity::LastfmPopularityJob);
+    registry.register(jobs::lastfm_scrobble::LastfmScrobbleJob);
     Arc::new(registry)
 }
 

src/media_paths.rs

@@ -0,0 +1,310 @@
+use std::path::{Component, Path, PathBuf};
+
+const KNOWN_MEDIA_ROOTS: &[&str] = &["media/library", "media/uploads"];
+
+pub fn resolve_config_path(value: &str) -> String {
+    let path = resolve_config_path_buf(value);
+    if path.as_os_str().is_empty() {
+        String::new()
+    } else {
+        path.to_string_lossy().to_string()
+    }
+}
+
+pub fn resolve_config_path_buf(value: &str) -> PathBuf {
+    let trimmed = value.trim();
+    if trimmed.is_empty() {
+        return PathBuf::new();
+    }
+
+    let normalized = normalize_slashes(trimmed);
+    if is_host_absolute(&normalized) {
+        return PathBuf::from(normalized);
+    }
+
+    if looks_like_windows_absolute(&normalized) {
+        if let Some(relative) = extract_known_media_root(&normalized) {
+            return app_root().join(slash_path(&relative));
+        }
+        return PathBuf::from(normalized);
+    }
+
+    app_root().join(slash_path(&normalized))
+}
+
+pub fn resolve_media_file_path(storage_dir: &str, file_path: &str) -> PathBuf {
+    let storage_root = resolve_config_path_buf(storage_dir);
+    if let Some(relative) = normalize_stored_media_file_path(storage_dir, file_path) {
+        return storage_root.join(slash_path(&relative));
+    }
+
+    let normalized = normalize_slashes(file_path.trim());
+    let path = PathBuf::from(&normalized);
+    if path.is_absolute() {
+        path
+    } else {
+        storage_root.join(path)
+    }
+}
+
+pub fn media_file_path_for_storage(storage_dir: &str, path: &Path) -> Option<String> {
+    let storage_root = resolve_config_path_buf(storage_dir);
+    if let Ok(relative) = path.strip_prefix(&storage_root) {
+        return relative_path_string(relative);
+    }
+
+    let normalized = normalize_slashes(&path.to_string_lossy());
+    relative_after_storage_marker(&storage_root, &normalized).or_else(|| {
+        if !is_host_absolute(&normalized) && !looks_like_windows_absolute(&normalized) {
+            normalize_relative_path(&normalized)
+        } else {
+            None
+        }
+    })
+}
+
+pub fn normalize_stored_media_file_path(storage_dir: &str, file_path: &str) -> Option<String> {
+    let trimmed = file_path.trim();
+    if trimmed.is_empty() {
+        return None;
+    }
+
+    let storage_root = resolve_config_path_buf(storage_dir);
+    let normalized = normalize_slashes(trimmed);
+    let path = PathBuf::from(&normalized);
+    if path.is_absolute() {
+        if let Ok(relative) = path.strip_prefix(&storage_root) {
+            return relative_path_string(relative);
+        }
+        return relative_after_storage_marker(&storage_root, &normalized);
+    }
+
+    if looks_like_windows_absolute(&normalized) {
+        return relative_after_storage_marker(&storage_root, &normalized);
+    }
+
+    if let Some(relative) = relative_after_storage_marker_prefix(&storage_root, &normalized) {
+        return Some(relative);
+    }
+
+    normalize_relative_path(&normalized)
+}
+
+pub async fn normalize_media_file_paths(
+    pool: &sqlx::PgPool,
+    storage_dir: &str,
+) -> anyhow::Result<u64> {
+    let rows: Vec<(i64, String)> =
+        sqlx::query_as("SELECT id, file_path FROM furumusic__media_file ORDER BY id")
+            .fetch_all(pool)
+            .await?;
+
+    let mut updated = 0;
+    for (id, file_path) in rows {
+        let Some(relative) = normalize_stored_media_file_path(storage_dir, &file_path) else {
+            continue;
+        };
+        if relative == file_path {
+            continue;
+        }
+        sqlx::query("UPDATE furumusic__media_file SET file_path = $1 WHERE id = $2")
+            .bind(&relative)
+            .bind(id)
+            .execute(pool)
+            .await?;
+        updated += 1;
+    }
+
+    Ok(updated)
+}
+
+fn app_root() -> PathBuf {
+    std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."))
+}
+
+fn normalize_slashes(value: &str) -> String {
+    value.trim().replace('\\', "/")
+}
+
+fn is_host_absolute(value: &str) -> bool {
+    Path::new(value).is_absolute()
+}
+
+fn looks_like_windows_absolute(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    bytes.len() >= 3 && bytes[1] == b':' && bytes[2] == b'/' && bytes[0].is_ascii_alphabetic()
+}
+
+fn slash_path(value: &str) -> PathBuf {
+    value
+        .split('/')
+        .filter(|part| !part.is_empty() && *part != ".")
+        .fold(PathBuf::new(), |mut path, part| {
+            path.push(part);
+            path
+        })
+}
+
+fn normalize_relative_path(value: &str) -> Option<String> {
+    let parts: Vec<&str> = value
+        .split('/')
+        .filter(|part| !part.is_empty() && *part != ".")
+        .collect();
+    if parts.is_empty() || parts.iter().any(|part| *part == "..") {
+        return None;
+    }
+    Some(parts.join("/"))
+}
+
+fn relative_path_string(path: &Path) -> Option<String> {
+    let mut parts = Vec::new();
+    for component in path.components() {
+        match component {
+            Component::Normal(value) => parts.push(value.to_string_lossy().to_string()),
+            Component::CurDir => {}
+            _ => return None,
+        }
+    }
+    if parts.is_empty() {
+        None
+    } else {
+        Some(parts.join("/"))
+    }
+}
+
+fn extract_known_media_root(value: &str) -> Option<String> {
+    KNOWN_MEDIA_ROOTS
+        .iter()
+        .filter_map(|marker| relative_from_marker(value, marker, true))
+        .next()
+}
+
+fn relative_after_storage_marker(storage_root: &Path, value: &str) -> Option<String> {
+    let marker = storage_marker(storage_root)?;
+    relative_from_marker(value, &marker, false)
+}
+
+fn relative_after_storage_marker_prefix(storage_root: &Path, value: &str) -> Option<String> {
+    let marker = storage_marker(storage_root)?;
+    let normalized = normalize_slashes(value);
+    let normalized_lower = normalized.to_ascii_lowercase();
+    let marker_lower = marker.to_ascii_lowercase();
+    if normalized_lower == marker_lower {
+        return None;
+    }
+    normalized_lower
+        .strip_prefix(&(marker_lower + "/"))
+        .and_then(|_| normalize_relative_path(&normalized[marker.len() + 1..]))
+}
+
+fn storage_marker(storage_root: &Path) -> Option<String> {
+    let parts: Vec<String> = storage_root
+        .components()
+        .filter_map(|component| match component {
+            Component::Normal(value) => Some(value.to_string_lossy().to_string()),
+            _ => None,
+        })
+        .collect();
+
+    if parts.len() >= 2 {
+        Some(format!(
+            "{}/{}",
+            parts[parts.len() - 2],
+            parts[parts.len() - 1]
+        ))
+    } else {
+        parts.last().cloned()
+    }
+}
+
+fn relative_from_marker(value: &str, marker: &str, include_marker: bool) -> Option<String> {
+    let normalized = normalize_slashes(value);
+    let haystack = format!("/{}", normalized.trim_matches('/'));
+    let marker = marker.trim_matches('/');
+    let needle = format!("/{marker}");
+    let haystack_lower = haystack.to_ascii_lowercase();
+    let needle_lower = needle.to_ascii_lowercase();
+    let index = haystack_lower.rfind(&needle_lower)?;
+    let after_marker = index + needle.len();
+    if after_marker < haystack.len() && haystack.as_bytes().get(after_marker) != Some(&b'/') {
+        return None;
+    }
+    let tail = haystack[after_marker..].trim_matches('/');
+    if include_marker {
+        if tail.is_empty() {
+            Some(marker.to_string())
+        } else {
+            Some(format!("{marker}/{tail}"))
+        }
+    } else {
+        normalize_relative_path(tail)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn resolves_relative_config_path_from_app_root() {
+        let expected = app_root().join("media").join("library");
+        assert_eq!(resolve_config_path_buf("media/library"), expected);
+    }
+
+    #[test]
+    fn maps_foreign_windows_config_media_root_to_app_root() {
+        let expected = app_root().join("media").join("uploads");
+        assert_eq!(
+            resolve_config_path_buf(r"C:\Users\ab\repos\furumusic\media\uploads"),
+            expected
+        );
+    }
+
+    #[test]
+    fn stores_path_relative_to_storage_root() {
+        let storage = app_root().join("media").join("library");
+        let path = storage.join("Artist").join("Album").join("track.flac");
+        assert_eq!(
+            media_file_path_for_storage(&storage.to_string_lossy(), &path).as_deref(),
+            Some("Artist/Album/track.flac")
+        );
+    }
+
+    #[test]
+    fn normalizes_legacy_windows_media_file_path() {
+        let storage = app_root().join("media").join("library");
+        assert_eq!(
+            normalize_stored_media_file_path(
+                &storage.to_string_lossy(),
+                r"C:\Users\ab\repos\furumusic\media\library\Buckethead\Pike\cover.jpg",
+            )
+            .as_deref(),
+            Some("Buckethead/Pike/cover.jpg")
+        );
+    }
+
+    #[test]
+    fn strips_accidental_relative_storage_root_prefix() {
+        let storage = app_root().join("media").join("library");
+        assert_eq!(
+            normalize_stored_media_file_path(
+                &storage.to_string_lossy(),
+                "media/library/Buckethead/Pike/cover.jpg",
+            )
+            .as_deref(),
+            Some("Buckethead/Pike/cover.jpg")
+        );
+    }
+
+    #[test]
+    fn resolves_legacy_windows_media_file_path_to_current_storage() {
+        let storage = app_root().join("media").join("library");
+        assert_eq!(
+            resolve_media_file_path(
+                &storage.to_string_lossy(),
+                r"C:\Users\ab\repos\furumusic\media\library\Buckethead\Pike\cover.jpg",
+            ),
+            storage.join("Buckethead").join("Pike").join("cover.jpg")
+        );
+    }
+}

src/music/mod.rs

@@ -1692,6 +1692,129 @@ pub mod db_migrations {
             &[Operation::custom(create_lastfm_track_popularity).build()];
     }
 
+    // -- M0033: Last.fm scrobbling -----------------------------------------
+
+    #[cot::db::migrations::migration_op]
+    async fn create_lastfm_scrobbling(
+        ctx: migrations::MigrationContext<'_>,
+    ) -> cot::db::Result<()> {
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__lastfm_account (
+                    user_id BIGINT PRIMARY KEY,
+                    lastfm_username VARCHAR(255) NOT NULL,
+                    session_key TEXT NOT NULL,
+                    connected_at VARCHAR(32) NOT NULL,
+                    updated_at VARCHAR(32) NOT NULL,
+                    last_error TEXT,
+                    reauth_required BOOLEAN NOT NULL DEFAULT FALSE
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__lastfm_auth_state (
+                    state VARCHAR(64) PRIMARY KEY,
+                    user_id BIGINT NOT NULL,
+                    created_at VARCHAR(32) NOT NULL
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__lastfm_scrobble_outbox (
+                    id BIGSERIAL PRIMARY KEY,
+                    user_id BIGINT NOT NULL,
+                    track_id BIGINT NOT NULL,
+                    started_at BIGINT NOT NULL,
+                    listened_seconds INTEGER NOT NULL,
+                    duration_seconds INTEGER NOT NULL,
+                    status VARCHAR(32) NOT NULL,
+                    attempt_count INTEGER NOT NULL DEFAULT 0,
+                    last_error TEXT,
+                    created_at VARCHAR(32) NOT NULL,
+                    updated_at VARCHAR(32) NOT NULL,
+                    scrobbled_at VARCHAR(32),
+                    dedupe_key VARCHAR(128) NOT NULL UNIQUE
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_lastfm_scrobble_outbox_status
+                   ON furumusic__lastfm_scrobble_outbox (status, created_at, id)",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_lastfm_scrobble_outbox_user
+                   ON furumusic__lastfm_scrobble_outbox (user_id, status, created_at)",
+            )
+            .await?;
+        Ok(())
+    }
+
+    #[derive(Debug, Copy, Clone)]
+    pub struct M0033CreateLastfmScrobbling;
+
+    impl migrations::Migration for M0033CreateLastfmScrobbling {
+        const APP_NAME: &'static str = "furumusic";
+        const MIGRATION_NAME: &'static str = "m_0033_create_lastfm_scrobbling";
+        const DEPENDENCIES: &'static [migrations::MigrationDependency] =
+            &[migrations::MigrationDependency::migration(
+                "furumusic",
+                "m_0032_create_lastfm_track_popularity",
+            )];
+        const OPERATIONS: &'static [Operation] =
+            &[Operation::custom(create_lastfm_scrobbling).build()];
+    }
+
+    // -- M0034: Artwork lookup state --------------------------------------
+
+    #[cot::db::migrations::migration_op]
+    async fn create_artwork_lookup_state(
+        ctx: migrations::MigrationContext<'_>,
+    ) -> cot::db::Result<()> {
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__artwork_lookup_state (
+                    id BIGSERIAL PRIMARY KEY,
+                    entity_kind VARCHAR(32) NOT NULL,
+                    entity_id BIGINT NOT NULL,
+                    source VARCHAR(32) NOT NULL,
+                    status VARCHAR(32) NOT NULL,
+                    attempt_count INTEGER NOT NULL DEFAULT 0,
+                    last_attempt_at VARCHAR(32) NOT NULL,
+                    last_error TEXT,
+                    source_url TEXT,
+                    UNIQUE(entity_kind, entity_id, source)
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_artwork_lookup_state_retry
+                   ON furumusic__artwork_lookup_state (entity_kind, source, status, last_attempt_at)",
+            )
+            .await?;
+        Ok(())
+    }
+
+    #[derive(Debug, Copy, Clone)]
+    pub struct M0034CreateArtworkLookupState;
+
+    impl migrations::Migration for M0034CreateArtworkLookupState {
+        const APP_NAME: &'static str = "furumusic";
+        const MIGRATION_NAME: &'static str = "m_0034_create_artwork_lookup_state";
+        const DEPENDENCIES: &'static [migrations::MigrationDependency] =
+            &[migrations::MigrationDependency::migration(
+                "furumusic",
+                "m_0033_create_lastfm_scrobbling",
+            )];
+        const OPERATIONS: &'static [Operation] =
+            &[Operation::custom(create_artwork_lookup_state).build()];
+    }
+
     pub const MIGRATIONS: &[&SyncDynMigration] = &[
         &M0006CreateMediaFile,
         &M0007CreateArtist,
@@ -1715,5 +1838,7 @@ pub mod db_migrations {
         &M0030AddMediaFileUploader,
         &M0031CreateTorrentSession,
         &M0032CreateLastfmTrackPopularity,
+        &M0033CreateLastfmScrobbling,
+        &M0034CreateArtworkLookupState,
     ];
 }

src/player/dto.rs

@@ -55,6 +55,8 @@ pub(super) struct TrackItem {
     pub(super) duration_seconds: f64,
     pub(super) artists: Vec<ArtistRef>,
     pub(super) featured_artists: Vec<ArtistRef>,
+    pub(super) release_id: i64,
+    pub(super) release_title: String,
     pub(super) release_year: Option<i32>,
     pub(super) cover_url: Option<String>,
     pub(super) stream_url: String,
@@ -170,6 +172,35 @@ pub(super) struct UserProfile {
     pub(super) stats: UserStats,
 }
 
+#[derive(Debug, Serialize, JsonSchema)]
+pub(super) struct LastfmStatus {
+    pub(super) configured: bool,
+    pub(super) connected: bool,
+    pub(super) username: Option<String>,
+    pub(super) reauth_required: bool,
+    pub(super) last_error: Option<String>,
+}
+
+#[derive(Debug, Serialize, JsonSchema)]
+pub(super) struct LastfmActionResponse {
+    pub(super) ok: bool,
+    pub(super) queued: bool,
+    pub(super) sent: bool,
+    pub(super) message: Option<String>,
+}
+
+#[derive(Debug, Deserialize, JsonSchema)]
+pub(super) struct LastfmNowPlayingRequest {
+    pub(super) track_id: i64,
+}
+
+#[derive(Debug, Deserialize, JsonSchema)]
+pub(super) struct LastfmScrobbleRequest {
+    pub(super) track_id: i64,
+    pub(super) started_at: Option<i64>,
+    pub(super) listened_seconds: i32,
+}
+
 #[derive(Debug, Serialize, JsonSchema)]
 pub(super) struct AgentQueueStatus {
     pub(super) queued_count: i64,

src/player/mod.rs

@@ -16,6 +16,7 @@ use cot::{App, Body, Template};
 use crate::auth;
 use crate::config::AppConfig;
 use crate::i18n::Translations;
+use crate::lastfm::{LastfmClient, LastfmCredentials, LastfmTrackPayload};
 use crate::scheduler::SchedulerHandle;
 use crate::torrents::{TorrentPreviewRequest, TorrentService, TorrentStartRequest};
 
@@ -49,6 +50,36 @@ struct LocalUploadResponse {
     size: u64,
 }
 
+#[derive(Debug, sqlx::FromRow)]
+struct LastfmAccountApiRow {
+    session_key: String,
+    reauth_required: bool,
+    last_error: Option<String>,
+}
+
+#[derive(Debug, sqlx::FromRow)]
+struct LastfmStatusRow {
+    username: String,
+    reauth_required: bool,
+    last_error: Option<String>,
+}
+
+#[derive(Debug, sqlx::FromRow)]
+struct LastfmTrackMetaRow {
+    title: String,
+    duration_seconds: f64,
+    track_number: Option<i32>,
+    album_title: Option<String>,
+    artist_name: Option<String>,
+    album_artist_name: Option<String>,
+}
+
+#[derive(Debug, serde::Deserialize)]
+struct LastfmCallbackQuery {
+    token: Option<String>,
+    state: Option<String>,
+}
+
 // ---------------------------------------------------------------------------
 // SPA shell
 // ---------------------------------------------------------------------------
@@ -114,6 +145,509 @@ async fn me_handler(
     .into_response()
 }
 
+// ---------------------------------------------------------------------------
+// Last.fm account + scrobbling
+// ---------------------------------------------------------------------------
+
+fn redirect_response(location: &str) -> cot::response::Response {
+    cot::http::Response::builder()
+        .status(StatusCode::SEE_OTHER)
+        .header(cot::http::header::LOCATION, location)
+        .body(Body::fixed(""))
+        .expect("valid response")
+}
+
+fn request_origin(request: &cot::request::Request) -> Option<String> {
+    let headers = request.headers();
+    let host = headers
+        .get("x-forwarded-host")
+        .or_else(|| headers.get("host"))?
+        .to_str()
+        .ok()?;
+    let proto = headers
+        .get("x-forwarded-proto")
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or("http");
+    Some(format!("{proto}://{host}"))
+}
+
+async fn lastfm_status_handler(
+    session: Session,
+    db: Database,
+    pool: &sqlx::PgPool,
+) -> cot::Result<cot::response::Response> {
+    let Some(user) = auth::get_session_user(&session, &db).await else {
+        return Ok(json_error(StatusCode::UNAUTHORIZED, "not authenticated"));
+    };
+    let (config, _) = AppConfig::load_with_db(&db).await;
+    let configured = crate::lastfm::is_configured(&config);
+    let account = sqlx::query_as::<_, LastfmStatusRow>(
+        r#"SELECT lastfm_username::text AS username,
+                  reauth_required,
+                  last_error::text AS last_error
+             FROM furumusic__lastfm_account
+            WHERE user_id = $1"#,
+    )
+    .bind(user.id)
+    .fetch_optional(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+
+    Json(LastfmStatus {
+        configured,
+        connected: account.is_some(),
+        username: account.as_ref().map(|row| row.username.clone()),
+        reauth_required: account
+            .as_ref()
+            .map(|row| row.reauth_required)
+            .unwrap_or(false),
+        last_error: account.and_then(|row| row.last_error),
+    })
+    .into_response()
+}
+
+async fn lastfm_connect_handler(
+    session: Session,
+    db: Database,
+    pool: &sqlx::PgPool,
+    request: cot::request::Request,
+) -> cot::Result<cot::response::Response> {
+    let Some(user) = auth::get_session_user(&session, &db).await else {
+        return Ok(redirect_response("/login"));
+    };
+    let (config, _) = AppConfig::load_with_db(&db).await;
+    let Some(credentials) = LastfmCredentials::from_config(&config) else {
+        return Ok(redirect_response("/"));
+    };
+    let Some(origin) = request_origin(&request) else {
+        return Ok(redirect_response("/"));
+    };
+
+    let state = uuid::Uuid::new_v4().simple().to_string();
+    let now = chrono::Utc::now();
+    let stale = (now - chrono::Duration::hours(1))
+        .format("%Y-%m-%dT%H:%M:%SZ")
+        .to_string();
+    sqlx::query("DELETE FROM furumusic__lastfm_auth_state WHERE created_at < $1")
+        .bind(stale)
+        .execute(pool)
+        .await
+        .map_err(|e| cot::Error::internal(e.to_string()))?;
+    sqlx::query(
+        r#"INSERT INTO furumusic__lastfm_auth_state (state, user_id, created_at)
+           VALUES ($1, $2, $3)
+           ON CONFLICT (state) DO NOTHING"#,
+    )
+    .bind(&state)
+    .bind(user.id)
+    .bind(now.format("%Y-%m-%dT%H:%M:%SZ").to_string())
+    .execute(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+
+    let callback = format!("{origin}/api/player/lastfm/callback?state={state}");
+    let mut url = reqwest::Url::parse("https://www.last.fm/api/auth/")
+        .map_err(|e| cot::Error::internal(e.to_string()))?;
+    url.query_pairs_mut()
+        .append_pair("api_key", credentials.api_key())
+        .append_pair("cb", &callback);
+    Ok(redirect_response(url.as_str()))
+}
+
+async fn lastfm_callback_handler(
+    session: Session,
+    db: Database,
+    pool: &sqlx::PgPool,
+    query: cot::request::extractors::UrlQuery<LastfmCallbackQuery>,
+) -> cot::Result<cot::response::Response> {
+    let Some(user) = auth::get_session_user(&session, &db).await else {
+        return Ok(redirect_response("/login"));
+    };
+    let Some(token) = query
+        .0
+        .token
+        .as_deref()
+        .map(str::trim)
+        .filter(|v| !v.is_empty())
+    else {
+        return Ok(redirect_response("/"));
+    };
+    let Some(state) = query
+        .0
+        .state
+        .as_deref()
+        .map(str::trim)
+        .filter(|v| !v.is_empty())
+    else {
+        return Ok(redirect_response("/"));
+    };
+
+    let state_user_id = sqlx::query_scalar::<_, i64>(
+        "SELECT user_id FROM furumusic__lastfm_auth_state WHERE state = $1",
+    )
+    .bind(state)
+    .fetch_optional(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+    if state_user_id != Some(user.id) {
+        return Ok(redirect_response("/"));
+    }
+    sqlx::query("DELETE FROM furumusic__lastfm_auth_state WHERE state = $1")
+        .bind(state)
+        .execute(pool)
+        .await
+        .map_err(|e| cot::Error::internal(e.to_string()))?;
+
+    let (config, _) = AppConfig::load_with_db(&db).await;
+    let Some(credentials) = LastfmCredentials::from_config(&config) else {
+        return Ok(redirect_response("/"));
+    };
+    let client = LastfmClient::new(credentials).map_err(|e| cot::Error::internal(e.to_string()))?;
+    match client.get_session(token).await {
+        Ok(lastfm_session) => {
+            let now = chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string();
+            sqlx::query(
+                r#"INSERT INTO furumusic__lastfm_account
+                      (user_id, lastfm_username, session_key, connected_at, updated_at, last_error, reauth_required)
+                   VALUES ($1, $2, $3, $4, $4, NULL, false)
+                   ON CONFLICT (user_id) DO UPDATE SET
+                      lastfm_username = EXCLUDED.lastfm_username,
+                      session_key = EXCLUDED.session_key,
+                      updated_at = EXCLUDED.updated_at,
+                      last_error = NULL,
+                      reauth_required = false"#,
+            )
+            .bind(user.id)
+            .bind(&lastfm_session.username)
+            .bind(&lastfm_session.session_key)
+            .bind(&now)
+            .execute(pool)
+            .await
+            .map_err(|e| cot::Error::internal(e.to_string()))?;
+            Ok(redirect_response("/"))
+        }
+        Err(err) => {
+            tracing::warn!("Last.fm auth failed for user {}: {err}", user.id);
+            Ok(redirect_response("/"))
+        }
+    }
+}
+
+async fn lastfm_disconnect_handler(
+    session: Session,
+    db: Database,
+    pool: &sqlx::PgPool,
+) -> cot::Result<cot::response::Response> {
+    let Some(user) = auth::get_session_user(&session, &db).await else {
+        return Ok(json_error(StatusCode::UNAUTHORIZED, "not authenticated"));
+    };
+    let now = chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string();
+    sqlx::query("DELETE FROM furumusic__lastfm_account WHERE user_id = $1")
+        .bind(user.id)
+        .execute(pool)
+        .await
+        .map_err(|e| cot::Error::internal(e.to_string()))?;
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_scrobble_outbox
+              SET status = 'blocked',
+                  last_error = 'Last.fm account disconnected',
+                  updated_at = $2
+            WHERE user_id = $1 AND status IN ('pending', 'retry')"#,
+    )
+    .bind(user.id)
+    .bind(now)
+    .execute(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+    Json(serde_json::json!({"ok": true})).into_response()
+}
+
+async fn load_lastfm_account(
+    pool: &sqlx::PgPool,
+    user_id: i64,
+) -> cot::Result<Option<LastfmAccountApiRow>> {
+    sqlx::query_as::<_, LastfmAccountApiRow>(
+        r#"SELECT session_key::text AS session_key,
+                  reauth_required,
+                  last_error::text AS last_error
+             FROM furumusic__lastfm_account
+            WHERE user_id = $1"#,
+    )
+    .bind(user_id)
+    .fetch_optional(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))
+}
+
+async fn load_lastfm_track_payload(
+    pool: &sqlx::PgPool,
+    track_id: i64,
+) -> cot::Result<Option<LastfmTrackPayload>> {
+    let row = sqlx::query_as::<_, LastfmTrackMetaRow>(
+        r#"SELECT t.title::text AS title,
+                  t.duration_seconds,
+                  t.track_number,
+                  r.title::text AS album_title,
+                  (
+                    SELECT a.name::text
+                      FROM furumusic__track_artist ta
+                      JOIN furumusic__artist a ON a.id = ta.artist_id
+                     WHERE ta.track_id = t.id AND ta.role <> 'featuring'
+                     ORDER BY ta.position
+                     LIMIT 1
+                  ) AS artist_name,
+                  (
+                    SELECT a.name::text
+                      FROM furumusic__release_artist ra
+                      JOIN furumusic__artist a ON a.id = ra.artist_id
+                     WHERE ra.release_id = r.id
+                     ORDER BY ra.position
+                     LIMIT 1
+                  ) AS album_artist_name
+             FROM furumusic__track t
+             LEFT JOIN furumusic__release r ON r.id = t.release_id
+            WHERE t.id = $1 AND t.is_hidden = false"#,
+    )
+    .bind(track_id)
+    .fetch_optional(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+
+    Ok(row.and_then(|row| {
+        let artist = row
+            .artist_name
+            .as_deref()
+            .map(str::trim)
+            .filter(|value| !value.is_empty())?
+            .to_string();
+        Some(LastfmTrackPayload {
+            artist,
+            track: row.title,
+            album: row
+                .album_title
+                .map(|value| value.trim().to_string())
+                .filter(|value| !value.is_empty()),
+            album_artist: row
+                .album_artist_name
+                .map(|value| value.trim().to_string())
+                .filter(|value| !value.is_empty()),
+            track_number: row.track_number,
+            duration_seconds: Some(row.duration_seconds.round() as i32),
+        })
+    }))
+}
+
+async fn update_lastfm_account_error(
+    pool: &sqlx::PgPool,
+    user_id: i64,
+    error: &str,
+    reauth_required: bool,
+) -> cot::Result<()> {
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_account
+              SET last_error = $2,
+                  reauth_required = $3,
+                  updated_at = $4
+            WHERE user_id = $1"#,
+    )
+    .bind(user_id)
+    .bind(error)
+    .bind(reauth_required)
+    .bind(chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string())
+    .execute(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+    Ok(())
+}
+
+async fn enqueue_lastfm_scrobble(
+    pool: &sqlx::PgPool,
+    config: &AppConfig,
+    user_id: i64,
+    track_id: i64,
+    started_at: Option<i64>,
+    listened_seconds: i32,
+) -> cot::Result<LastfmActionResponse> {
+    if !crate::lastfm::is_configured(config) {
+        return Ok(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Last.fm is not configured".to_string()),
+        });
+    }
+    if load_lastfm_account(pool, user_id).await?.is_none() {
+        return Ok(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Last.fm account is not connected".to_string()),
+        });
+    }
+    let Some(track) = load_lastfm_track_payload(pool, track_id).await? else {
+        return Ok(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Track has no primary artist for Last.fm".to_string()),
+        });
+    };
+    let duration_seconds = track.duration_seconds.unwrap_or(0).max(0);
+    if duration_seconds <= 30 {
+        return Ok(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Track is too short to scrobble".to_string()),
+        });
+    }
+    let threshold = ((duration_seconds as f64 / 2.0).min(240.0)).ceil() as i32;
+    let listened_seconds = listened_seconds.max(0);
+    if listened_seconds < threshold {
+        return Ok(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Scrobble threshold has not been reached".to_string()),
+        });
+    }
+
+    let now_ts = chrono::Utc::now().timestamp();
+    let started_at = started_at
+        .unwrap_or(now_ts - listened_seconds as i64)
+        .min(now_ts);
+    let now = chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string();
+    let dedupe_key = format!("{user_id}:{track_id}:{started_at}");
+    sqlx::query(
+        r#"INSERT INTO furumusic__lastfm_scrobble_outbox
+              (user_id, track_id, started_at, listened_seconds, duration_seconds, status, created_at, updated_at, dedupe_key)
+           VALUES ($1, $2, $3, $4, $5, 'pending', $6, $6, $7)
+           ON CONFLICT (dedupe_key) DO NOTHING"#,
+    )
+    .bind(user_id)
+    .bind(track_id)
+    .bind(started_at)
+    .bind(listened_seconds)
+    .bind(duration_seconds)
+    .bind(&now)
+    .bind(&dedupe_key)
+    .execute(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+
+    let sent = match crate::lastfm::process_pending_scrobbles(pool, config, Some(user_id), 10).await
+    {
+        Ok(summary) => summary.sent > 0,
+        Err(err) => {
+            tracing::warn!("Last.fm immediate scrobble send failed: {err:#}");
+            false
+        }
+    };
+
+    Ok(LastfmActionResponse {
+        ok: true,
+        queued: true,
+        sent,
+        message: None,
+    })
+}
+
+async fn lastfm_now_playing_handler(
+    session: Session,
+    db: Database,
+    pool: &sqlx::PgPool,
+    Json(entry): Json<LastfmNowPlayingRequest>,
+) -> cot::Result<cot::response::Response> {
+    let Some(user) = auth::get_session_user(&session, &db).await else {
+        return Ok(json_error(StatusCode::UNAUTHORIZED, "not authenticated"));
+    };
+    let (config, _) = AppConfig::load_with_db(&db).await;
+    let Some(credentials) = LastfmCredentials::from_config(&config) else {
+        return Json(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Last.fm is not configured".to_string()),
+        })
+        .into_response();
+    };
+    let Some(account) = load_lastfm_account(pool, user.id).await? else {
+        return Json(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Last.fm account is not connected".to_string()),
+        })
+        .into_response();
+    };
+    if account.reauth_required {
+        return Json(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: account.last_error,
+        })
+        .into_response();
+    }
+    let Some(track) = load_lastfm_track_payload(pool, entry.track_id).await? else {
+        return Json(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Track has no primary artist for Last.fm".to_string()),
+        })
+        .into_response();
+    };
+    let client = LastfmClient::new(credentials).map_err(|e| cot::Error::internal(e.to_string()))?;
+    match client
+        .update_now_playing(&account.session_key, &track)
+        .await
+    {
+        Ok(()) => Json(LastfmActionResponse {
+            ok: true,
+            queued: false,
+            sent: true,
+            message: None,
+        })
+        .into_response(),
+        Err(err) => {
+            let reauth_required = err.is_invalid_session();
+            update_lastfm_account_error(pool, user.id, &err.to_string(), reauth_required).await?;
+            Json(LastfmActionResponse {
+                ok: false,
+                queued: false,
+                sent: false,
+                message: Some(err.to_string()),
+            })
+            .into_response()
+        }
+    }
+}
+
+async fn lastfm_scrobble_handler(
+    session: Session,
+    db: Database,
+    pool: &sqlx::PgPool,
+    Json(entry): Json<LastfmScrobbleRequest>,
+) -> cot::Result<cot::response::Response> {
+    let Some(user) = auth::get_session_user(&session, &db).await else {
+        return Ok(json_error(StatusCode::UNAUTHORIZED, "not authenticated"));
+    };
+    let (config, _) = AppConfig::load_with_db(&db).await;
+    Json(
+        enqueue_lastfm_scrobble(
+            pool,
+            &config,
+            user.id,
+            entry.track_id,
+            entry.started_at,
+            entry.listened_seconds,
+        )
+        .await?,
+    )
+    .into_response()
+}
+
 // ---------------------------------------------------------------------------
 // GET /api/player/agent-queue
 // ---------------------------------------------------------------------------
@@ -465,6 +999,8 @@ async fn release_detail_handler(
         r#"SELECT t.id, t.title::text as title, t.track_number, t.disc_number,
                   t.duration_seconds, t.cover_file_id,
                   r.cover_file_id as release_cover_file_id,
+                  r.id as release_id,
+                  r.title::text as release_title,
                   r.year as release_year,
                   COALESCE(mf.uploader_name, 'UFO')::text AS uploader_name,
                   mf.audio_format,
@@ -542,6 +1078,8 @@ async fn release_detail_handler(
                 duration_seconds: t.duration_seconds,
                 artists: track_main_artists.remove(&tid).unwrap_or_default(),
                 featured_artists: track_feat_artists.remove(&tid).unwrap_or_default(),
+                release_id: t.release_id,
+                release_title: t.release_title,
                 release_year: t.release_year,
                 cover_url: track_cover_variant_url(
                     t.cover_file_id,
@@ -707,6 +1245,8 @@ async fn playlist_detail_handler(
         r#"SELECT t.id, t.title::text as title, t.track_number, t.disc_number,
                   t.duration_seconds, t.cover_file_id,
                   r.cover_file_id as release_cover_file_id,
+                  r.id as release_id,
+                  r.title::text as release_title,
                   r.year as release_year,
                   COALESCE(mf.uploader_name, 'UFO')::text AS uploader_name,
                   mf.audio_format,
@@ -804,6 +1344,8 @@ async fn build_track_items(
                 duration_seconds: t.duration_seconds,
                 artists: track_main_artists.remove(&tid).unwrap_or_default(),
                 featured_artists: track_feat_artists.remove(&tid).unwrap_or_default(),
+                release_id: t.release_id,
+                release_title: t.release_title,
                 release_year: t.release_year,
                 cover_url: track_cover_variant_url(
                     t.cover_file_id,
@@ -835,13 +1377,19 @@ async fn likes_playlist_handler(
         r#"SELECT t.id, t.title::text as title, t.track_number, t.disc_number,
                   t.duration_seconds, t.cover_file_id,
                   r.cover_file_id as release_cover_file_id,
+                  r.id as release_id,
+                  r.title::text as release_title,
                   r.year as release_year,
                   COALESCE(mf.uploader_name, 'UFO')::text AS uploader_name,
                   mf.audio_format,
                   mf.audio_bitrate,
                   mf.audio_sample_rate,
                   mf.audio_bit_depth,
-                  mf.file_size_bytes
+                  mf.file_size_bytes,
+                  t.lastfm_listeners,
+                  t.lastfm_playcount,
+                  t.lastfm_rating,
+                  t.lastfm_updated_at
            FROM furumusic__user_liked_track ult
            JOIN furumusic__track t ON t.id = ult.track_id
            JOIN furumusic__release r ON r.id = t.release_id
@@ -904,7 +1452,8 @@ async fn stream_handler(
         return Ok(json_error(StatusCode::NOT_FOUND, "track not found"));
     };
 
-    let full_path = std::path::Path::new(&config.agent_storage_dir).join(&media.file_path);
+    let full_path =
+        crate::media_paths::resolve_media_file_path(&config.agent_storage_dir, &media.file_path);
 
     if !full_path.exists() {
         return Ok(json_error(
@@ -973,7 +1522,7 @@ async fn local_upload_handler(
             "agent_inbox_dir is not configured",
         ));
     }
-    let inbox_root = std::path::PathBuf::from(inbox_dir);
+    let inbox_root = crate::media_paths::resolve_config_path_buf(inbox_dir);
     if !inbox_root.is_absolute() {
         return Ok(json_error(
             StatusCode::BAD_REQUEST,
@@ -1196,7 +1745,8 @@ async fn cover_response(
         return Ok(json_error(StatusCode::NOT_FOUND, "media file not found"));
     };
 
-    let full_path = std::path::Path::new(&config.agent_storage_dir).join(&media.file_path);
+    let full_path =
+        crate::media_paths::resolve_media_file_path(&config.agent_storage_dir, &media.file_path);
 
     if !full_path.exists() {
         return Ok(json_error(StatusCode::NOT_FOUND, "file not found on disk"));
@@ -1412,6 +1962,45 @@ async fn history_handler(
     .await
     .map_err(|e| cot::Error::internal(e.to_string()))?;
 
+    if let Some(listened_seconds) = entry.duration_listened {
+        let (config, _) = AppConfig::load_with_db(&db).await;
+        match enqueue_lastfm_scrobble(
+            pool,
+            &config,
+            user.id,
+            entry.track_id,
+            entry.started_at,
+            listened_seconds,
+        )
+        .await
+        {
+            Ok(result) if result.queued => {
+                tracing::info!(
+                    user_id = user.id,
+                    track_id = entry.track_id,
+                    sent = result.sent,
+                    "Queued Last.fm scrobble from play history"
+                );
+            }
+            Ok(result) => {
+                tracing::debug!(
+                    user_id = user.id,
+                    track_id = entry.track_id,
+                    message = ?result.message,
+                    "Play history did not queue Last.fm scrobble"
+                );
+            }
+            Err(err) => {
+                tracing::warn!(
+                    user_id = user.id,
+                    track_id = entry.track_id,
+                    error = %err,
+                    "Failed to queue Last.fm scrobble from play history"
+                );
+            }
+        }
+    }
+
     Json(serde_json::json!({"ok": true})).into_response()
 }
 
@@ -1476,6 +2065,8 @@ async fn search_handler(
             r#"SELECT t.id, t.title::text AS title, t.track_number, t.disc_number,
                       t.duration_seconds, t.cover_file_id,
                       rel.cover_file_id AS release_cover_file_id,
+                      rel.id AS release_id,
+                      rel.title::text AS release_title,
                       rel.year AS release_year,
                       COALESCE(mf.uploader_name, 'UFO')::text AS uploader_name,
                       mf.audio_format,
@@ -1550,11 +2141,13 @@ async fn search_handler(
 
         let t = sqlx::query_as::<_, SearchTrackRow>(
             r#"SELECT id, title, track_number, disc_number, duration_seconds, cover_file_id,
-                      release_cover_file_id, release_year, uploader_name, audio_format, audio_bitrate,
+                      release_cover_file_id, release_id, release_title, release_year, uploader_name, audio_format, audio_bitrate,
                       audio_sample_rate, audio_bit_depth, file_size_bytes, lastfm_listeners, lastfm_playcount, lastfm_rating, lastfm_updated_at FROM (
                 SELECT t.id, t.title::text AS title, t.track_number, t.disc_number,
                        t.duration_seconds, t.cover_file_id,
                        rel.cover_file_id AS release_cover_file_id,
+                       rel.id AS release_id,
+                       rel.title::text AS release_title,
                        rel.year AS release_year,
                        COALESCE(mf.uploader_name, 'UFO')::text AS uploader_name,
                        mf.audio_format,
@@ -1580,7 +2173,7 @@ async fn search_handler(
                 ) t
                 JOIN furumusic__release rel ON rel.id = t.release_id
                 LEFT JOIN furumusic__media_file mf ON mf.id = t.audio_file_id
-                GROUP BY t.id, t.title, t.track_number, t.disc_number, t.duration_seconds, t.cover_file_id, rel.cover_file_id, rel.year,
+                GROUP BY t.id, t.title, t.track_number, t.disc_number, t.duration_seconds, t.cover_file_id, rel.cover_file_id, rel.id, rel.title, rel.year,
                          mf.uploader_name, mf.audio_format, mf.audio_bitrate, mf.audio_sample_rate, mf.audio_bit_depth, mf.file_size_bytes,
                          t.lastfm_listeners, t.lastfm_playcount, t.lastfm_rating, t.lastfm_updated_at
                 ORDER BY similarity DESC
@@ -1677,6 +2270,8 @@ async fn search_handler(
                 duration_seconds: t.duration_seconds,
                 artists: track_main_artists.remove(&tid).unwrap_or_default(),
                 featured_artists: track_feat_artists.remove(&tid).unwrap_or_default(),
+                release_id: t.release_id,
+                release_title: t.release_title,
                 release_year: t.release_year,
                 cover_url: track_cover_variant_url(
                     t.cover_file_id,
@@ -2252,6 +2847,8 @@ async fn tracks_by_ids_handler(
         r#"SELECT t.id, t.title::text as title, t.track_number, t.disc_number,
                   t.duration_seconds, t.cover_file_id,
                   r.cover_file_id as release_cover_file_id,
+                  r.id as release_id,
+                  r.title::text as release_title,
                   r.year as release_year,
                   COALESCE(mf.uploader_name, 'UFO')::text AS uploader_name,
                   mf.audio_format,
@@ -2328,6 +2925,8 @@ async fn tracks_by_ids_handler(
                 duration_seconds: t.duration_seconds,
                 artists: track_main_artists.remove(&tid).unwrap_or_default(),
                 featured_artists: track_feat_artists.remove(&tid).unwrap_or_default(),
+                release_id: t.release_id,
+                release_title: t.release_title,
                 release_year: t.release_year,
                 cover_url: track_cover_variant_url(
                     t.cover_file_id,
@@ -2413,6 +3012,152 @@ impl App for PlayerApp {
                 },
                 "player_me",
             ),
+            Route::with_handler_and_name(
+                "/lastfm/status",
+                get({
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    move |session: Session, db: Database| {
+                        let pool = Arc::clone(&pool);
+                        let pool_config = Arc::clone(&pool_config);
+                        async move {
+                            let pg_pool = pool
+                                .get_or_init(|| async {
+                                    sqlx::postgres::PgPoolOptions::new()
+                                        .max_connections(5)
+                                        .connect(&pool_config.database_url)
+                                        .await
+                                        .expect("player pool")
+                                })
+                                .await;
+                            lastfm_status_handler(session, db, pg_pool).await
+                        }
+                    }
+                }),
+                "player_lastfm_status",
+            ),
+            Route::with_handler_and_name(
+                "/lastfm/connect",
+                get({
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    move |session: Session, db: Database, request: cot::request::Request| {
+                        let pool = Arc::clone(&pool);
+                        let pool_config = Arc::clone(&pool_config);
+                        async move {
+                            let pg_pool = pool
+                                .get_or_init(|| async {
+                                    sqlx::postgres::PgPoolOptions::new()
+                                        .max_connections(5)
+                                        .connect(&pool_config.database_url)
+                                        .await
+                                        .expect("player pool")
+                                })
+                                .await;
+                            lastfm_connect_handler(session, db, pg_pool, request).await
+                        }
+                    }
+                }),
+                "player_lastfm_connect",
+            ),
+            Route::with_handler_and_name(
+                "/lastfm/callback",
+                get({
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    move |session: Session,
+                          db: Database,
+                          query: cot::request::extractors::UrlQuery<LastfmCallbackQuery>| {
+                        let pool = Arc::clone(&pool);
+                        let pool_config = Arc::clone(&pool_config);
+                        async move {
+                            let pg_pool = pool
+                                .get_or_init(|| async {
+                                    sqlx::postgres::PgPoolOptions::new()
+                                        .max_connections(5)
+                                        .connect(&pool_config.database_url)
+                                        .await
+                                        .expect("player pool")
+                                })
+                                .await;
+                            lastfm_callback_handler(session, db, pg_pool, query).await
+                        }
+                    }
+                }),
+                "player_lastfm_callback",
+            ),
+            Route::with_handler_and_name(
+                "/lastfm/disconnect",
+                post({
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    move |session: Session, db: Database| {
+                        let pool = Arc::clone(&pool);
+                        let pool_config = Arc::clone(&pool_config);
+                        async move {
+                            let pg_pool = pool
+                                .get_or_init(|| async {
+                                    sqlx::postgres::PgPoolOptions::new()
+                                        .max_connections(5)
+                                        .connect(&pool_config.database_url)
+                                        .await
+                                        .expect("player pool")
+                                })
+                                .await;
+                            lastfm_disconnect_handler(session, db, pg_pool).await
+                        }
+                    }
+                }),
+                "player_lastfm_disconnect",
+            ),
+            Route::with_handler_and_name(
+                "/lastfm/now-playing",
+                post({
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    move |session: Session, db: Database, json: Json<LastfmNowPlayingRequest>| {
+                        let pool = Arc::clone(&pool);
+                        let pool_config = Arc::clone(&pool_config);
+                        async move {
+                            let pg_pool = pool
+                                .get_or_init(|| async {
+                                    sqlx::postgres::PgPoolOptions::new()
+                                        .max_connections(5)
+                                        .connect(&pool_config.database_url)
+                                        .await
+                                        .expect("player pool")
+                                })
+                                .await;
+                            lastfm_now_playing_handler(session, db, pg_pool, json).await
+                        }
+                    }
+                }),
+                "player_lastfm_now_playing",
+            ),
+            Route::with_handler_and_name(
+                "/lastfm/scrobble",
+                post({
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    move |session: Session, db: Database, json: Json<LastfmScrobbleRequest>| {
+                        let pool = Arc::clone(&pool);
+                        let pool_config = Arc::clone(&pool_config);
+                        async move {
+                            let pg_pool = pool
+                                .get_or_init(|| async {
+                                    sqlx::postgres::PgPoolOptions::new()
+                                        .max_connections(5)
+                                        .connect(&pool_config.database_url)
+                                        .await
+                                        .expect("player pool")
+                                })
+                                .await;
+                            lastfm_scrobble_handler(session, db, pg_pool, json).await
+                        }
+                    }
+                }),
+                "player_lastfm_scrobble",
+            ),
             Route::with_handler_and_name(
                 "/agent-queue",
                 {

src/player/queries.rs

@@ -3,6 +3,7 @@ use serde::Deserialize;
 #[derive(Debug, Deserialize)]
 pub(super) struct HistoryEntry {
     pub(super) track_id: i64,
+    pub(super) started_at: Option<i64>,
     pub(super) duration_listened: Option<i32>,
     pub(super) completed: bool,
 }

src/player/rows.rs

@@ -37,6 +37,8 @@ pub(super) struct TrackRow {
     pub(super) duration_seconds: f64,
     pub(super) cover_file_id: Option<i64>,
     pub(super) release_cover_file_id: Option<i64>,
+    pub(super) release_id: i64,
+    pub(super) release_title: String,
     pub(super) release_year: Option<i32>,
     pub(super) uploader_name: String,
     pub(super) audio_format: Option<String>,
@@ -107,6 +109,8 @@ pub(super) struct PlaylistTrackRow {
     pub(super) duration_seconds: f64,
     pub(super) cover_file_id: Option<i64>,
     pub(super) release_cover_file_id: Option<i64>,
+    pub(super) release_id: i64,
+    pub(super) release_title: String,
     pub(super) release_year: Option<i32>,
     pub(super) uploader_name: String,
     pub(super) audio_format: Option<String>,
@@ -170,6 +174,8 @@ pub(super) struct SearchTrackRow {
     pub(super) duration_seconds: f64,
     pub(super) cover_file_id: Option<i64>,
     pub(super) release_cover_file_id: Option<i64>,
+    pub(super) release_id: i64,
+    pub(super) release_title: String,
     pub(super) release_year: Option<i32>,
     pub(super) uploader_name: String,
     pub(super) audio_format: Option<String>,

src/scheduler/mod.rs

@@ -460,6 +460,16 @@ impl PendingReview {
         self.save(db).await
     }
 
+    pub async fn set_result_json(
+        &mut self,
+        db: &Database,
+        result_json: String,
+    ) -> cot::db::Result<()> {
+        self.result_json = Some(result_json);
+        self.updated_at = now_iso();
+        self.save(db).await
+    }
+
     pub async fn set_failed(&mut self, db: &Database, error: &str) -> cot::db::Result<()> {
         self.status = LimitedString::new("failed").unwrap();
         self.error_message = Some(error.to_owned());
@@ -1347,7 +1357,11 @@ async fn run_scheduled_job(
 
     // Check agent_enabled (re-read from DB every run)
     let (live_config, _) = AppConfig::load_with_db(db).await;
-    if !live_config.agent_enabled && job_name != "lastfm_popularity" {
+    if !live_config.agent_enabled
+        && job_name != "lastfm_popularity"
+        && job_name != "lastfm_scrobble"
+        && job_name != "artwork_backfill"
+    {
         tracing::warn!(job = job_name, "Skipping: agent_enabled=false");
         return;
     }
@@ -1457,6 +1471,17 @@ pub async fn start_scheduler(
         Err(e) => tracing::error!("Failed to recover stale reviews: {e}"),
     }
 
+    let (live_config, _) = AppConfig::load_with_db(&db).await;
+    if !live_config.agent_storage_dir.trim().is_empty() {
+        match crate::media_paths::normalize_media_file_paths(&pool, &live_config.agent_storage_dir)
+            .await
+        {
+            Ok(0) => {}
+            Ok(n) => tracing::info!("Normalized {n} media file path(s) to relative storage paths"),
+            Err(e) => tracing::warn!("Failed to normalize media file paths: {e:#}"),
+        }
+    }
+
     // Upsert ScheduledJob rows
     for job in registry.all_jobs() {
         ScheduledJob::upsert(&db, job.name(), job.description(), job.default_cron())

src/torrents.rs

@@ -1242,7 +1242,7 @@ fn validate_selection(files: &[TorrentFileDto], selected_files: &[usize]) -> any
 
 fn validate_inbox_dir(inbox_dir: &str) -> anyhow::Result<PathBuf> {
     let trimmed = inbox_dir.trim();
-    let path = PathBuf::from(trimmed);
+    let path = crate::media_paths::resolve_config_path_buf(trimmed);
     if !path.is_absolute() {
         bail!(
             "agent_inbox_dir must be an absolute path for this host, got `{}`",

templates/admin/review_detail.html

@@ -25,28 +25,76 @@
 </div>
 {% endif %}
 
+{% if review.status_str() == "pending" %}
+<h2>{{ t.reviews_result }}</h2>
+<form method="post" action="/admin/reviews/{{ review.id_val() }}/approve" style="margin: 1rem 0;">
+    <table>
+        <tr>
+            <td><label for="artist">Artist</label></td>
+            <td><input name="artist" id="artist" value="{{ edit.artist }}" style="width:100%"></td>
+        </tr>
+        <tr>
+            <td><label for="album">Album</label></td>
+            <td><input name="album" id="album" value="{{ edit.album }}" style="width:100%"></td>
+        </tr>
+        <tr>
+            <td><label for="title">Title</label></td>
+            <td><input name="title" id="title" value="{{ edit.title }}" style="width:100%"></td>
+        </tr>
+        <tr>
+            <td><label for="year">Year</label></td>
+            <td><input name="year" id="year" type="number" min="0" max="3000" value="{{ edit.year }}" style="width:100%"></td>
+        </tr>
+        <tr>
+            <td><label for="track_number">Track</label></td>
+            <td><input name="track_number" id="track_number" type="number" min="0" value="{{ edit.track_number }}" style="width:100%"></td>
+        </tr>
+        <tr>
+            <td><label for="genre">Genre</label></td>
+            <td><input name="genre" id="genre" value="{{ edit.genre }}" style="width:100%"></td>
+        </tr>
+        <tr>
+            <td><label for="featured_artists">Featured artists</label></td>
+            <td><input name="featured_artists" id="featured_artists" value="{{ edit.featured_artists }}" style="width:100%"></td>
+        </tr>
+        <tr>
+            <td><label for="release_type">{{ t.releases_type }}</label></td>
+            <td>
+                <select name="release_type" id="release_type" style="width:100%; padding:.4rem;">
+                    {% for rt in release_types %}
+                    <option value="{{ rt.0 }}"{% if edit.release_type == rt.0 %} selected{% endif %}>{% if lang_code == "ru" %}{{ rt.2 }}{% else %}{{ rt.1 }}{% endif %} ({{ rt.0 }})</option>
+                    {% endfor %}
+                </select>
+            </td>
+        </tr>
+        <tr>
+            <td><label for="notes">Notes</label></td>
+            <td><textarea name="notes" id="notes" style="width:100%; min-height:4rem;">{{ edit.notes }}</textarea></td>
+        </tr>
+    </table>
+    <button type="submit" style="margin-top:1rem; padding:.4rem 1rem; background:#28a745; color:#fff; border:none; border-radius:4px; cursor:pointer;">{{ t.reviews_approve }}</button>
+</form>
 <div style="margin: 1rem 0; display: flex; gap: .5rem;">
-    {% if review.status_str() == "pending" %}
-    <form method="post" action="/admin/reviews/{{ review.id_val() }}/approve" style="display:inline;">
-        <button type="submit" style="padding:.4rem 1rem; background:#28a745; color:#fff; border:none; border-radius:4px; cursor:pointer;">{{ t.reviews_approve }}</button>
-    </form>
     <form method="post" action="/admin/reviews/{{ review.id_val() }}/reject" style="display:inline;">
         <button type="submit" style="padding:.4rem 1rem; background:#dc3545; color:#fff; border:none; border-radius:4px; cursor:pointer;">{{ t.reviews_reject }}</button>
     </form>
-    {% endif %}
+</div>
+{% else %}
+<div style="margin: 1rem 0; display: flex; gap: .5rem;">
     {% if review.status_str() == "failed" || review.status_str() == "processing" %}
     <form method="post" action="/admin/reviews/{{ review.id_val() }}/requeue" style="display:inline;" onsubmit="return confirm('{{ t.reviews_requeue_confirm }}');">
         <button type="submit" style="padding:.4rem 1rem; background:#17a2b8; color:#fff; border:none; border-radius:4px; cursor:pointer;">{{ t.reviews_requeue }}</button>
     </form>
     {% endif %}
 </div>
+{% endif %}
 
 {% if !context_pretty.is_empty() %}
 <h2>{{ t.reviews_context }}</h2>
 <pre style="background:#f4f4f4; padding:1rem; border-radius:6px; overflow-x:auto; font-size:.85rem;">{{ context_pretty }}</pre>
 {% endif %}
 
-{% if !result_pretty.is_empty() %}
+{% if !result_pretty.is_empty() && review.status_str() != "pending" %}
 <h2>{{ t.reviews_result }}</h2>
 <pre style="background:#f4f4f4; padding:1rem; border-radius:6px; overflow-x:auto; font-size:.85rem;">{{ result_pretty }}</pre>
 {% endif %}

templates/admin/settings.html

@@ -85,6 +85,16 @@
     <td><input type="checkbox" name="swagger_enabled" id="swagger_enabled" value="on"{% if swagger_enabled %} checked{% endif %}></td>
     <td><span class="badge badge-{{ swagger_enabled_source }}">{{ swagger_enabled_source }}</span></td>
   </tr>
+  <tr>
+    <td><label for="lastfm_api_key">{{ t.settings_lastfm_api_key }}</label><br><span style="font-size:.75rem;color:#999;">{{ t.settings_lastfm_api_key_help }}</span></td>
+    <td><input type="password" name="lastfm_api_key" id="lastfm_api_key" value="{{ lastfm_api_key }}"></td>
+    <td><span class="badge badge-{{ lastfm_api_key_source }}">{{ lastfm_api_key_source }}</span></td>
+  </tr>
+  <tr>
+    <td><label for="lastfm_shared_secret">{{ t.settings_lastfm_shared_secret }}</label><br><span style="font-size:.75rem;color:#999;">{{ t.settings_lastfm_shared_secret_help }}</span></td>
+    <td><input type="password" name="lastfm_shared_secret" id="lastfm_shared_secret" value="{{ lastfm_shared_secret }}"></td>
+    <td><span class="badge badge-{{ lastfm_shared_secret_source }}">{{ lastfm_shared_secret_source }}</span></td>
+  </tr>
 </table>
 
 <h2>{{ t.settings_agent }}</h2>

templates/admin/v2.html

@@ -851,7 +851,8 @@ tbody tr:hover {
 }
 
 .field input,
-.field textarea {
+.field textarea,
+.field select {
     width: 100%;
     min-height: 34px;
     padding: 8px 10px;
@@ -869,6 +870,165 @@ tbody tr:hover {
     font-size: 11px;
 }
 
+.image-editor {
+    display: grid;
+    grid-template-columns: 150px minmax(0, 1fr);
+    gap: 14px;
+    margin-bottom: 12px;
+}
+
+.image-preview {
+    width: 150px;
+    aspect-ratio: 1;
+    border: 1px solid var(--border-color);
+    border-radius: 8px;
+    background: var(--bg-primary);
+    display: grid;
+    place-items: center;
+    overflow: hidden;
+    color: var(--text-subdued);
+    font-size: 12px;
+}
+
+.image-preview img {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+}
+
+.cover-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(86px, 1fr));
+    gap: 8px;
+}
+
+.cover-option {
+    min-width: 0;
+    padding: 6px;
+    border: 1px solid var(--border-color);
+    border-radius: 8px;
+    background: var(--bg-primary);
+    color: var(--text-secondary);
+    cursor: pointer;
+}
+
+.cover-option:hover {
+    border-color: rgba(29, 185, 84, 0.55);
+    color: var(--text-primary);
+}
+
+.cover-option img {
+    width: 100%;
+    aspect-ratio: 1;
+    object-fit: cover;
+    border-radius: 5px;
+    display: block;
+}
+
+.cover-option span {
+    display: block;
+    margin-top: 5px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    font-size: 10px;
+}
+
+.artist-tags {
+    display: flex;
+    gap: 6px;
+    flex-wrap: wrap;
+    margin-bottom: 8px;
+}
+
+.artist-picker {
+    position: relative;
+}
+
+.artist-picker input {
+    width: 100%;
+}
+
+.artist-results {
+    position: absolute;
+    left: 0;
+    right: 0;
+    top: calc(100% + 5px);
+    z-index: 5;
+    max-height: 242px;
+    overflow: auto;
+    border: 1px solid var(--border-color);
+    border-radius: 8px;
+    background: var(--bg-elevated);
+    box-shadow: 0 14px 34px rgba(0, 0, 0, 0.38);
+}
+
+.artist-result {
+    width: 100%;
+    min-height: 34px;
+    padding: 8px 10px;
+    border: 0;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.06);
+    background: transparent;
+    color: var(--text-secondary);
+    text-align: left;
+    cursor: pointer;
+}
+
+.artist-result:hover,
+.artist-result:focus {
+    background: var(--bg-hover);
+    color: var(--text-primary);
+}
+
+.artist-result:last-child {
+    border-bottom: 0;
+}
+
+.tag button {
+    width: 16px;
+    height: 16px;
+    margin-left: 5px;
+    border: 0;
+    border-radius: 999px;
+    background: rgba(255, 255, 255, 0.14);
+    color: inherit;
+    cursor: pointer;
+    line-height: 1;
+}
+
+.tag button:hover {
+    background: rgba(255, 255, 255, 0.24);
+}
+
+.editor-grid {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 12px;
+}
+
+.image-actions {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    flex-wrap: wrap;
+    margin-bottom: 10px;
+}
+
+.file-name {
+    max-width: 280px;
+    color: var(--text-subdued);
+    font-size: 11px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.cover-option.active {
+    border-color: rgba(29, 185, 84, 0.8);
+    box-shadow: 0 0 0 1px rgba(29, 185, 84, 0.32);
+}
+
 .muted {
     color: var(--text-subdued);
 }
@@ -976,7 +1136,7 @@ tbody tr:hover {
             <button class="nav-btn" :class="{active: activeView === 'settings'}" @click="openSettings()">
                 <i data-lucide="settings"></i>
                 <span>Settings</span>
-                <span class="nav-count" x-text="settings.lastfm_api_key_configured ? 'ok' : ''"></span>
+                <span class="nav-count" x-text="settings.lastfm_scrobbling_configured ? 'ok' : ''"></span>
             </button>
         </div>
 
@@ -1574,7 +1734,7 @@ tbody tr:hover {
                                     <strong>API</strong>
                                     <span>Developer and enrichment integrations</span>
                                 </div>
-                                <span class="badge" :class="settings.lastfm_api_key_configured ? 'ok' : 'disabled'" x-text="settings.lastfm_api_key_configured ? 'Last.fm configured' : 'Last.fm missing'"></span>
+                                <span class="badge" :class="settings.lastfm_scrobbling_configured ? 'ok' : 'disabled'" x-text="settings.lastfm_scrobbling_configured ? 'Last.fm configured' : 'Last.fm missing'"></span>
                             </div>
                             <div class="settings-grid">
                                 <div class="setting-toggle">
@@ -1590,11 +1750,19 @@ tbody tr:hover {
                                 </div>
                                 <div class="setting-field">
                                     <label>
-                                        <span>Last.fm API key</span>
+                                        <span>{{ t.settings_lastfm_api_key }}</span>
                                         <span class="source-pill" :class="sourceClass('lastfm_api_key')" x-text="settingSource('lastfm_api_key')"></span>
                                     </label>
                                     <input type="password" x-model="settingsDraft.lastfm_api_key" autocomplete="off" />
-                                    <div class="setting-help">Used by the weekly Last.fm popularity task.</div>
+                                    <div class="setting-help">{{ t.settings_lastfm_api_key_help }}</div>
+                                </div>
+                                <div class="setting-field">
+                                    <label>
+                                        <span>{{ t.settings_lastfm_shared_secret }}</span>
+                                        <span class="source-pill" :class="sourceClass('lastfm_shared_secret')" x-text="settingSource('lastfm_shared_secret')"></span>
+                                    </label>
+                                    <input type="password" x-model="settingsDraft.lastfm_shared_secret" autocomplete="off" />
+                                    <div class="setting-help">{{ t.settings_lastfm_shared_secret_help }}</div>
                                 </div>
                             </div>
                         </section>
@@ -1673,7 +1841,60 @@ tbody tr:hover {
                     <label>Error</label>
                     <textarea readonly x-text="activeReview?.error_message || ''"></textarea>
                 </div>
+                <div x-show="activeReview?.status === 'pending'">
+                    <div class="field">
+                        <label>Artist</label>
+                        <input x-model="reviewDraft.artist" />
+                    </div>
+                    <div class="field">
+                        <label>Album</label>
+                        <input x-model="reviewDraft.album" />
+                    </div>
+                    <div class="field">
+                        <label>Title</label>
+                        <input x-model="reviewDraft.title" />
+                    </div>
+                    <div style="display:grid; grid-template-columns: 1fr 1fr; gap: 12px;">
+                        <div class="field">
+                            <label>Year</label>
+                            <input type="number" min="0" max="3000" x-model="reviewDraft.year" />
+                        </div>
+                        <div class="field">
+                            <label>Track</label>
+                            <input type="number" min="0" x-model="reviewDraft.track_number" />
+                        </div>
+                    </div>
+                    <div class="field">
+                        <label>Genre</label>
+                        <input x-model="reviewDraft.genre" />
+                    </div>
+                    <div class="field">
+                        <label>Featured artists</label>
+                        <input x-model="reviewDraft.featured_artists" />
+                    </div>
+                    <div class="field">
+                        <label>Release type</label>
+                        <select x-model="reviewDraft.release_type">
+                            <option value="album">Album</option>
+                            <option value="single">Single</option>
+                            <option value="ep">EP</option>
+                            <option value="compilation">Compilation</option>
+                            <option value="soundtrack">Soundtrack</option>
+                            <option value="live">Live</option>
+                            <option value="remix">Remix</option>
+                            <option value="unknown">Unknown</option>
+                        </select>
+                    </div>
+                    <div class="field">
+                        <label>Notes</label>
+                        <textarea x-model="reviewDraft.notes"></textarea>
+                    </div>
+                </div>
                 <div class="toolbar">
+                    <button class="btn primary" x-show="activeReview?.status === 'pending'" @click="approveActiveReview()">
+                        <i data-lucide="check"></i>
+                        Approve
+                    </button>
                     <button class="btn warn" @click="bulkOneReview('requeue', activeReview)">
                         <i data-lucide="rotate-ccw"></i>
                         Requeue
@@ -1699,30 +1920,120 @@ tbody tr:hover {
                 </button>
             </div>
             <div class="modal-body" x-show="activeLibraryItem">
-                <div class="field">
-                    <label>Title</label>
-                    <input x-model="editorDraft.title" />
-                </div>
-                <div class="field">
-                    <label>Primary Relation Search</label>
-                    <input placeholder="Start typing to attach artist, release, or playlist" />
-                </div>
-                <div class="field">
-                    <label>Visibility</label>
-                    <select class="search" style="width:100%" x-model="editorDraft.hidden">
-                        <option value="false">Visible in player</option>
-                        <option value="true">Hidden from player</option>
-                    </select>
-                </div>
-                <div class="toolbar">
-                    <button class="btn primary" @click="saveLibraryItem()">
-                        <i data-lucide="save"></i>
-                        Save
-                    </button>
-                    <button class="btn danger" @click="deleteLibraryItem(activeLibraryItem)">
-                        <i data-lucide="trash-2"></i>
-                        Delete
-                    </button>
+                <div class="empty" x-show="editorLoading">Loading editor...</div>
+                <div x-show="!editorLoading">
+                    <div class="field">
+                        <label x-text="isArtistEditor() ? 'Artist name' : 'Title'"></label>
+                        <input x-model="editorDraft.title" />
+                    </div>
+
+                    <div class="editor-grid" x-show="isReleaseEditor()">
+                        <div class="field">
+                            <label>Release type</label>
+                            <select x-model="editorDraft.release_type">
+                                <option value="album">Album</option>
+                                <option value="single">Single</option>
+                                <option value="ep">EP</option>
+                                <option value="compilation">Compilation</option>
+                                <option value="soundtrack">Soundtrack</option>
+                                <option value="live">Live</option>
+                                <option value="remix">Remix</option>
+                                <option value="unknown">Unknown</option>
+                            </select>
+                        </div>
+                        <div class="field">
+                            <label>Year</label>
+                            <input type="number" min="0" max="3000" x-model="editorDraft.year" />
+                        </div>
+                    </div>
+
+                    <div class="field" x-show="isReleaseEditor()">
+                        <label>Release artists</label>
+                        <div class="artist-tags">
+                            <template x-for="artist in selectedEditorArtists()" :key="artist.id">
+                                <span class="tag relation">
+                                    <span x-text="artist.name"></span>
+                                    <button type="button" @click="removeEditorArtist(artist.id)">x</button>
+                                </span>
+                            </template>
+                            <span class="muted" x-show="selectedEditorArtists().length === 0">No artists attached</span>
+                        </div>
+                        <div class="artist-picker">
+                            <input class="search" placeholder="Search artist" x-model="editorArtistToAdd" @keydown.enter.prevent="addEditorArtist()" @keydown.escape="editorArtistToAdd = ''" />
+                            <div class="artist-results" x-show="editorArtistSearchOpen()" x-transition>
+                                <template x-for="artist in filteredEditorArtists()" :key="artist.id">
+                                    <button class="artist-result" type="button" @click="addEditorArtist(artist)" x-text="artist.name"></button>
+                                </template>
+                                <div class="artist-result muted" x-show="filteredEditorArtists().length === 0">No matching artists</div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="field">
+                        <label>Visibility</label>
+                        <select class="search" style="width:100%" x-model="editorDraft.hidden">
+                            <option value="false">Visible in player</option>
+                            <option value="true">Hidden from player</option>
+                        </select>
+                    </div>
+
+                    <div x-show="canEditLibraryImage()">
+                        <label class="muted" style="display:block; margin: 2px 0 8px; font-size: 11px; font-weight: 800; text-transform: uppercase;">Image</label>
+                        <div class="image-editor">
+                            <div class="image-preview">
+                                <template x-if="editorDetail && editorDetail.current_image_url">
+                                    <img :src="editorDetail.current_image_url" alt="" />
+                                </template>
+                                <span x-show="!editorDetail || !editorDetail.current_image_url">No image</span>
+                            </div>
+                            <div>
+                                <div class="image-actions">
+                                    <input type="file" accept="image/*" x-ref="libraryImageInput" style="display:none" @change="setEditorImageFile($event)" />
+                                    <button class="btn" type="button" @click="$refs.libraryImageInput.click()">
+                                        <i data-lucide="image-plus"></i>
+                                        Choose image
+                                    </button>
+                                    <button class="btn primary" type="button" @click="uploadLibraryImage()" :disabled="!editorImageFile || editorImageUploading">
+                                        <i :data-lucide="editorImageUploading ? 'loader-circle' : 'upload'"></i>
+                                        <span x-text="editorImageUploading ? 'Uploading...' : 'Upload'"></span>
+                                    </button>
+                                    <button class="btn danger" type="button" @click="removeLibraryImage()" :disabled="!editorDetail || !editorDetail.current_image_url || editorImageUploading">
+                                        <i data-lucide="trash-2"></i>
+                                        Remove
+                                    </button>
+                                    <span class="file-name" x-show="editorImageFile" x-text="editorImageFile ? editorImageFile.name : ''"></span>
+                                </div>
+                                <p class="muted" x-show="isReleaseEditor()">Release covers are uploaded manually here.</p>
+                                <p class="muted" x-show="isArtistEditor()">Pick an image from releases where this artist appears, or upload one manually.</p>
+                            </div>
+                        </div>
+
+                        <div x-show="isArtistEditor()">
+                            <div class="field" style="margin-bottom:8px">
+                                <label>Available release images</label>
+                            </div>
+                            <div class="cover-grid" x-show="editorDetail && editorDetail.available_covers && editorDetail.available_covers.length">
+                                <template x-for="cover in editorDetail.available_covers" :key="cover.media_file_id">
+                                    <button class="cover-option" type="button" :class="{active: editorDetail.current_image_url && editorDetail.current_image_url.includes('/cover/' + cover.media_file_id + '/')}" @click="setLibraryImage(cover.media_file_id)">
+                                        <img :src="cover.cover_url" alt="" />
+                                        <span x-text="cover.release_title"></span>
+                                    </button>
+                                </template>
+                            </div>
+                            <div class="empty" x-show="editorDetail && (!editorDetail.available_covers || editorDetail.available_covers.length === 0)">No release images found for this artist</div>
+                        </div>
+                    </div>
+
+                    <div class="toolbar">
+                        <button class="btn primary" @click="saveLibraryItem()" :disabled="!editorCanSave()">
+                            <i :data-lucide="editorSaving ? 'loader-circle' : 'save'"></i>
+                            <span x-text="editorSaving ? 'Saving...' : 'Save'"></span>
+                        </button>
+                        <button class="btn danger" @click="deleteLibraryItem(activeLibraryItem)" :disabled="editorSaving || editorImageUploading">
+                            <i data-lucide="trash-2"></i>
+                            Delete
+                        </button>
+                    </div>
                 </div>
             </div>
         </section>
@@ -1751,6 +2062,17 @@ function adminV2() {
         selectedReviewIds: {},
         reviewSelectionScope: 'ids',
         activeReview: null,
+        reviewDraft: {
+            title: '',
+            artist: '',
+            album: '',
+            year: '',
+            track_number: '',
+            genre: '',
+            featured_artists: '',
+            release_type: 'album',
+            notes: ''
+        },
         reviewModalOpen: false,
         reviewStatuses: [
             { value: null, label: 'All' },
@@ -1772,8 +2094,14 @@ function adminV2() {
         librarySelectionScope: 'ids',
         activeLibraryItem: null,
         editorOpen: false,
-        editorDraft: { title: '', hidden: 'false' },
-        settings: { values: {}, sources: {}, lastfm_api_key_configured: false },
+        editorLoading: false,
+        editorSaving: false,
+        editorImageUploading: false,
+        editorImageFile: null,
+        editorArtistToAdd: '',
+        editorDetail: null,
+        editorDraft: { title: '', hidden: 'false', release_type: 'album', year: '', artist_ids: [] },
+        settings: { values: {}, sources: {}, lastfm_api_key_configured: false, lastfm_shared_secret_configured: false, lastfm_scrobbling_configured: false },
         settingsDraft: {
             auth_password_enabled: false,
             auth_sso_enabled: false,
@@ -1785,6 +2113,7 @@ function adminV2() {
             oidc_user_groups: '',
             swagger_enabled: false,
             lastfm_api_key: '',
+            lastfm_shared_secret: '',
             agent_enabled: false,
             agent_inbox_dir: '',
             agent_storage_dir: '',
@@ -1859,14 +2188,18 @@ function adminV2() {
             const parts = raw.split('/').filter(Boolean);
             const view = parts[0] || 'reviews';
             if (view === 'reviews') {
+                const nextStatus = parts[1] || null;
+                if (this.reviewFilter.status !== nextStatus) this.clearReviewSelection();
                 this.activeView = 'reviews';
-                this.reviewFilter.status = parts[1] || null;
+                this.reviewFilter.status = nextStatus;
             } else if (view === 'jobs') {
                 this.activeView = 'jobs';
                 if (parts[1]) this.activeJobName = decodeURIComponent(parts[1]);
             } else if (view === 'library') {
+                const nextKind = ['artists', 'releases', 'playlists'].includes(parts[1]) ? parts[1] : 'artists';
+                if (this.libraryKind !== nextKind) this.clearLibrarySelection();
                 this.activeView = 'library';
-                this.libraryKind = ['artists', 'releases', 'playlists'].includes(parts[1]) ? parts[1] : 'artists';
+                this.libraryKind = nextKind;
             } else if (view === 'settings') {
                 this.activeView = 'settings';
             } else if (view === 'tools') {
@@ -1906,6 +2239,7 @@ function adminV2() {
         },
 
         openReviews(status = null) {
+            if (this.reviewFilter.status !== status) this.clearReviewSelection();
             this.activeView = 'reviews';
             this.reviewFilter.status = status;
             this.setRoute(status ? `#reviews/${status}` : '#reviews');
@@ -1922,7 +2256,9 @@ function adminV2() {
 
         openLibrary(kind = this.libraryKind) {
             this.activeView = 'library';
-            this.libraryKind = ['artists', 'releases', 'playlists'].includes(kind) ? kind : 'artists';
+            const nextKind = ['artists', 'releases', 'playlists'].includes(kind) ? kind : 'artists';
+            if (this.libraryKind !== nextKind) this.clearLibrarySelection();
+            this.libraryKind = nextKind;
             this.setRoute(`#library/${this.libraryKind}`);
             this.loadLibrary();
         },
@@ -1941,7 +2277,7 @@ function adminV2() {
             params.set('offset', this.reviews.offset || 0);
             try {
                 this.reviews = await this.request(`${this.apiBase}/reviews?${params.toString()}`);
-                this.clearReviewSelection();
+                if (resetOffset) this.clearReviewSelection();
             } catch (error) {
                 this.showToast(error.message);
             } finally {
@@ -1972,7 +2308,7 @@ function adminV2() {
             if (this.librarySearch) params.set('search', this.librarySearch);
             try {
                 this.library = await this.request(`${this.apiBase}/library?${params.toString()}`);
-                this.clearLibrarySelection();
+                if (resetOffset) this.clearLibrarySelection();
             } catch (error) {
                 this.showToast(error.message);
             } finally {
@@ -2072,6 +2408,17 @@ function adminV2() {
 
         openReview(row) {
             this.activeReview = row;
+            this.reviewDraft = Object.assign({
+                title: '',
+                artist: '',
+                album: '',
+                year: '',
+                track_number: '',
+                genre: '',
+                featured_artists: '',
+                release_type: 'album',
+                notes: ''
+            }, row.normalized || {});
             this.activeRunDetail = null;
             this.reviewModalOpen = true;
         },
@@ -2152,6 +2499,7 @@ function adminV2() {
                     body: JSON.stringify(payload)
                 });
                 this.showToast(`${result.affected} review row(s) updated`);
+                this.clearReviewSelection();
                 await this.loadReviews(false);
             } catch (error) {
                 this.showToast(error.message);
@@ -2165,6 +2513,23 @@ function adminV2() {
             this.reviewModalOpen = false;
         },
 
+        async approveActiveReview() {
+            if (!this.activeReview) return;
+            try {
+                await this.request(`${this.apiBase}/reviews/${this.activeReview.id}/approve`, {
+                    method: 'POST',
+                    body: JSON.stringify(this.reviewDraft)
+                });
+                this.showToast('Review approved');
+                this.reviewModalOpen = false;
+                this.activeReview = null;
+                await this.loadReviews(false);
+                await this.loadLibrary(false);
+            } catch (error) {
+                this.showToast(error.message);
+            }
+        },
+
         async runJob(job) {
             job.launching = true;
             try {
@@ -2250,9 +2615,184 @@ function adminV2() {
             this.activeLibraryItem = item;
             this.editorDraft = {
                 title: item.title || '',
-                hidden: item.is_hidden ? 'true' : 'false'
+                hidden: item.is_hidden ? 'true' : 'false',
+                release_type: 'album',
+                year: '',
+                artist_ids: []
             };
+            this.editorDetail = null;
+            this.editorImageFile = null;
+            this.editorArtistToAdd = '';
             this.editorOpen = true;
+            this.loadEditorDetail(item);
+        },
+
+        async loadEditorDetail(item) {
+            const key = `${item.kind}:${item.id}`;
+            this.editorLoading = true;
+            try {
+                const params = new URLSearchParams({ kind: item.kind, id: item.id });
+                const detail = await this.request(`${this.apiBase}/library/item/detail?${params.toString()}`);
+                if (!this.activeLibraryItem || `${this.activeLibraryItem.kind}:${this.activeLibraryItem.id}` !== key) return;
+                this.editorDetail = detail;
+                this.editorDraft = {
+                    title: detail.title || '',
+                    hidden: detail.hidden ? 'true' : 'false',
+                    release_type: detail.release_type || 'album',
+                    year: detail.year || '',
+                    artist_ids: Array.isArray(detail.selected_artist_ids) ? detail.selected_artist_ids.slice() : []
+                };
+                this.editorImageFile = null;
+                this.editorArtistToAdd = '';
+            } catch (error) {
+                this.showToast(error.message);
+            } finally {
+                if (this.activeLibraryItem && `${this.activeLibraryItem.kind}:${this.activeLibraryItem.id}` === key) {
+                    this.editorLoading = false;
+                }
+                this.icons();
+            }
+        },
+
+        isArtistEditor() {
+            return this.activeLibraryItem && this.activeLibraryItem.kind === 'artists';
+        },
+
+        isReleaseEditor() {
+            return this.activeLibraryItem && this.activeLibraryItem.kind === 'releases';
+        },
+
+        canEditLibraryImage() {
+            return this.isArtistEditor() || this.isReleaseEditor();
+        },
+
+        editorCanSave() {
+            return Boolean(this.activeLibraryItem && this.editorDetail && !this.editorLoading && !this.editorSaving);
+        },
+
+        selectedEditorArtists() {
+            const selected = this.editorDraft.artist_ids || [];
+            const artists = (this.editorDetail && this.editorDetail.artists) || [];
+            return selected.map(id => {
+                const artist = artists.find(row => Number(row.id) === Number(id));
+                return artist || { id, name: `Artist #${id}` };
+            });
+        },
+
+        editorAvailableArtists() {
+            const selected = new Set((this.editorDraft.artist_ids || []).map(id => Number(id)));
+            const artists = (this.editorDetail && this.editorDetail.artists) || [];
+            return artists.filter(artist => !selected.has(Number(artist.id)));
+        },
+
+        normalizedArtistSearch(value) {
+            return String(value || '').trim().toLowerCase();
+        },
+
+        filteredEditorArtists() {
+            const raw = String(this.editorArtistToAdd || '').trim();
+            const query = this.normalizedArtistSearch(raw);
+            const candidates = this.editorAvailableArtists();
+            if (!query) return candidates.slice(0, 12);
+            return candidates
+                .map(artist => {
+                    const name = this.normalizedArtistSearch(artist.name);
+                    let score = 3;
+                    if (name === query) score = 0;
+                    else if (name.startsWith(query)) score = 1;
+                    else if (name.includes(query)) score = 2;
+                    return { artist, score };
+                })
+                .filter(row => row.score < 3)
+                .sort((a, b) => a.score - b.score || a.artist.name.localeCompare(b.artist.name))
+                .slice(0, 12)
+                .map(row => row.artist);
+        },
+
+        editorArtistSearchOpen() {
+            return this.isReleaseEditor() && String(this.editorArtistToAdd || '').trim().length > 0;
+        },
+
+        addEditorArtist(artist = null) {
+            const raw = String(this.editorArtistToAdd || '').trim();
+            const candidates = this.filteredEditorArtists();
+            artist = artist
+                || candidates.find(row => this.normalizedArtistSearch(row.name) === this.normalizedArtistSearch(raw))
+                || candidates[0];
+            if (artist && !(this.editorDraft.artist_ids || []).map(Number).includes(Number(artist.id))) {
+                this.editorDraft.artist_ids = (this.editorDraft.artist_ids || []).concat([Number(artist.id)]);
+            }
+            this.editorArtistToAdd = '';
+        },
+
+        removeEditorArtist(id) {
+            this.editorDraft.artist_ids = (this.editorDraft.artist_ids || []).filter(value => Number(value) !== Number(id));
+        },
+
+        setEditorImageFile(event) {
+            this.editorImageFile = event.target.files && event.target.files.length ? event.target.files[0] : null;
+        },
+
+        readFileAsDataUrl(file) {
+            return new Promise((resolve, reject) => {
+                const reader = new FileReader();
+                reader.onload = () => resolve(reader.result);
+                reader.onerror = () => reject(reader.error || new Error('failed to read file'));
+                reader.readAsDataURL(file);
+            });
+        },
+
+        async uploadLibraryImage() {
+            if (!this.activeLibraryItem || !this.editorImageFile || this.editorImageUploading) return;
+            this.editorImageUploading = true;
+            try {
+                const dataUrl = await this.readFileAsDataUrl(this.editorImageFile);
+                const data = String(dataUrl).split(',')[1] || '';
+                await this.request(`${this.apiBase}/library/item/upload-image`, {
+                    method: 'POST',
+                    body: JSON.stringify({
+                        kind: this.activeLibraryItem.kind,
+                        id: this.activeLibraryItem.id,
+                        filename: this.editorImageFile.name,
+                        mime_type: this.editorImageFile.type || 'application/octet-stream',
+                        data
+                    })
+                });
+                await this.loadEditorDetail(this.activeLibraryItem);
+                this.showToast('Image uploaded');
+            } catch (error) {
+                this.showToast(error.message);
+            } finally {
+                this.editorImageUploading = false;
+                if (this.$refs.libraryImageInput) this.$refs.libraryImageInput.value = '';
+                this.icons();
+            }
+        },
+
+        async setLibraryImage(mediaFileId) {
+            if (!this.activeLibraryItem || this.editorImageUploading) return;
+            this.editorImageUploading = true;
+            try {
+                await this.request(`${this.apiBase}/library/item/image`, {
+                    method: 'POST',
+                    body: JSON.stringify({
+                        kind: this.activeLibraryItem.kind,
+                        id: this.activeLibraryItem.id,
+                        media_file_id: mediaFileId
+                    })
+                });
+                await this.loadEditorDetail(this.activeLibraryItem);
+                this.showToast(mediaFileId ? 'Image selected' : 'Image removed');
+            } catch (error) {
+                this.showToast(error.message);
+            } finally {
+                this.editorImageUploading = false;
+                this.icons();
+            }
+        },
+
+        removeLibraryImage() {
+            this.setLibraryImage(null);
         },
 
         toggleLibrary(item) {
@@ -2269,14 +2809,18 @@ function adminV2() {
 
         selectedLibraryCount() {
             if (this.librarySelectionScope === 'filter') return this.library.total || 0;
-            return Object.keys(this.selectedLibraryIds).length;
+            return this.currentLibrarySelectionKeys().length;
+        },
+
+        currentLibrarySelectionKeys() {
+            return Object.keys(this.selectedLibraryIds).filter(key => key.startsWith(`${this.libraryKind}:`));
         },
 
         async bulkLibrary(action) {
             const count = this.selectedLibraryCount();
             if (!count) return;
             if (action === 'delete' && !confirm(`Delete ${count} ${this.libraryKind}?`)) return;
-            const ids = Object.keys(this.selectedLibraryIds)
+            const ids = this.currentLibrarySelectionKeys()
                 .map(key => Number(key.split(':')[1]))
                 .filter(Boolean);
             try {
@@ -2291,6 +2835,7 @@ function adminV2() {
                     })
                 });
                 this.showToast(`${result.affected} ${this.libraryKind} updated`);
+                this.clearLibrarySelection();
                 await this.loadLibrary(false);
                 await this.refreshCountsOnly();
             } catch (error) {
@@ -2299,7 +2844,8 @@ function adminV2() {
         },
 
         async saveLibraryItem() {
-            if (!this.activeLibraryItem) return;
+            if (!this.editorCanSave()) return;
+            this.editorSaving = true;
             try {
                 const updated = await this.request(`${this.apiBase}/library/item`, {
                     method: 'POST',
@@ -2307,16 +2853,22 @@ function adminV2() {
                         kind: this.activeLibraryItem.kind,
                         id: this.activeLibraryItem.id,
                         title: this.editorDraft.title,
-                        hidden: this.editorDraft.hidden === 'true'
+                        hidden: this.editorDraft.hidden === 'true',
+                        release_type: this.editorDraft.release_type || null,
+                        year: this.editorDraft.year || '',
+                        artist_ids: this.editorDraft.artist_ids || []
                     })
                 });
                 this.replaceLibraryItem(updated);
                 this.activeLibraryItem = updated;
-                this.editorOpen = false;
+                if (this.editorDetail) this.editorDetail.item = updated;
                 this.showToast('Saved');
                 await this.refreshCountsOnly();
             } catch (error) {
                 this.showToast(error.message);
+            } finally {
+                this.editorSaving = false;
+                this.icons();
             }
         },
 

templates/player/modals.html

@@ -11,7 +11,32 @@
                         </svg>
                     </button>
                 </div>
-                <pre class="info-modal-body" x-text="$store.info.modal.body"></pre>
+                <div class="info-modal-body">
+                    <template x-if="$store.info.modal.rows && $store.info.modal.rows.length">
+                        <table class="info-table">
+                            <tbody>
+                                <template x-for="(row, idx) in $store.info.modal.rows" :key="row.label + '-' + idx">
+                                    <tr>
+                                        <th x-text="row.label"></th>
+                                        <td>
+                                            <template x-if="row.links && row.links.length">
+                                                <div class="info-link-list">
+                                                    <template x-for="link in row.links" :key="link.type + '-' + link.id + '-' + link.label">
+                                                        <button class="info-link" type="button" @click="$store.info.navigate(link)" x-text="link.label"></button>
+                                                    </template>
+                                                </div>
+                                            </template>
+                                            <template x-if="!row.links || !row.links.length">
+                                                <span x-text="row.value"></span>
+                                            </template>
+                                        </td>
+                                    </tr>
+                                </template>
+                            </tbody>
+                        </table>
+                    </template>
+                    <pre class="info-modal-plain" x-show="!$store.info.modal.rows || !$store.info.modal.rows.length" x-text="$store.info.modal.body"></pre>
+                </div>
             </div>
         </div>
     </template>

templates/player/scripts.html

@@ -4,11 +4,14 @@ const T = {
     info: "{{ t.player_info }}",
     noDetails: "{{ t.player_no_details }}",
     trackInfoTitle: "{{ t.player_track_info }}",
+    releaseInfoTitle: "{{ t.player_release_info }}",
     loadingHistory: "{{ t.player_loading_history }}",
     failedLoadHistory: "{{ t.player_failed_load_history }}",
     totalPlays: "{{ t.player_total_plays }}",
     unknown: "{{ t.player_unknown }}",
     unknownSize: "{{ t.player_unknown_size }}",
+    title: "{{ t.player_title }}",
+    release: "{{ t.player_release }}",
     unknownRelease: "{{ t.player_unknown_release }}",
     unknownTrack: "{{ t.player_unknown_track }}",
     unknownAudio: "{{ t.player_unknown_audio }}",
@@ -27,6 +30,16 @@ const T = {
     lastfmPlaycount: "{{ t.player_lastfm_playcount }}",
     lastfmUpdated: "{{ t.player_lastfm_updated }}",
     lastfmNotLoaded: "{{ t.player_lastfm_not_loaded }}",
+    lastfmProfile: "{{ t.player_lastfm_profile }}",
+    lastfmConnect: "{{ t.player_lastfm_connect }}",
+    lastfmConnected: "{{ t.player_lastfm_connected }}",
+    lastfmReconnect: "{{ t.player_lastfm_reconnect }}",
+    lastfmNotConfigured: "{{ t.player_lastfm_not_configured }}",
+    lastfmDisconnectConfirm: "{{ t.player_lastfm_disconnect_confirm }}",
+    lastfmConnectFailed: "{{ t.player_lastfm_connect_failed }}",
+    lastfmDisconnectFailed: "{{ t.player_lastfm_disconnect_failed }}",
+    connectionLost: "{{ t.player_connection_lost }}",
+    connectionLostDetail: "{{ t.player_connection_lost_detail }}",
     trackWord: "{{ t.player_tracks_count }}",
     clientIdle: "{{ t.player_client_idle }}",
     active: "{{ t.player_active }}",
@@ -104,6 +117,42 @@ function coverVariantUrl(url, variant) {
 }
 
 document.addEventListener('alpine:init', () => {
+    // -----------------------------------------------------------------------
+    // Connection monitor
+    // -----------------------------------------------------------------------
+    Alpine.store('connection', {
+        failureCount: 0,
+        disconnected: false,
+        threshold: 2,
+
+        init() {
+            if (navigator.onLine === false) {
+                this.failureCount = this.threshold;
+                this.disconnected = true;
+            }
+            window.addEventListener('online', () => this.recordSuccess());
+            window.addEventListener('offline', () => this.recordFailure());
+        },
+
+        message() {
+            return T.connectionLostDetail;
+        },
+
+        recordSuccess() {
+            this.failureCount = 0;
+            this.disconnected = false;
+        },
+
+        recordFailure() {
+            this.failureCount += 1;
+            if (this.failureCount >= this.threshold) {
+                this.disconnected = true;
+            }
+        },
+    });
+
+    installConnectionFetchMonitor();
+
     // -----------------------------------------------------------------------
     // Audio element
     // -----------------------------------------------------------------------
@@ -124,14 +173,33 @@ document.addEventListener('alpine:init', () => {
     Alpine.store('info', {
         modal: null,
         open(title, body) {
+            if (Array.isArray(body)) {
+                this.openRows(title, body);
+                return;
+            }
             this.modal = {
                 title: title || T.info,
                 body: body || T.noDetails,
+                rows: null,
+            };
+        },
+        openRows(title, rows) {
+            this.modal = {
+                title: title || T.info,
+                body: '',
+                rows: (rows || []).filter(row => row && ((row.value !== undefined && row.value !== null && row.value !== '') || (row.links && row.links.length))),
             };
         },
         close() {
             this.modal = null;
         },
+        navigate(link) {
+            if (!link || !link.id) return;
+            this.close();
+            const library = Alpine.store('library');
+            if (link.type === 'release') library.openRelease(link.id);
+            if (link.type === 'artist') library.openArtist(link.id);
+        },
     });
 
     // -----------------------------------------------------------------------
@@ -140,9 +208,21 @@ document.addEventListener('alpine:init', () => {
     Alpine.store('user', {
         profile: null,
         menuOpen: false,
+        lastfm: { configured: false, connected: false, username: null, reauth_required: false, last_error: null },
+        lastfmBusy: false,
 
         init() {
+            this.cleanLastfmQuery();
             this.load();
+            this.loadLastfm();
+        },
+
+        cleanLastfmQuery() {
+            const url = new URL(window.location.href);
+            if (!url.searchParams.has('lastfm')) return;
+            url.searchParams.delete('lastfm');
+            const clean = `${url.pathname}${url.search}${url.hash}`;
+            window.history.replaceState({}, document.title, clean || '/');
         },
 
         async load() {
@@ -155,6 +235,56 @@ document.addEventListener('alpine:init', () => {
             }
         },
 
+        async loadLastfm() {
+            try {
+                const res = await fetch('/api/player/lastfm/status');
+                if (!res.ok) throw new Error('failed');
+                this.lastfm = await res.json();
+                const player = Alpine.store('player');
+                if (player?.isPlaying) player._sendNowPlaying();
+            } catch {
+                this.lastfm = { configured: false, connected: false, username: null, reauth_required: false, last_error: null };
+            }
+        },
+
+        lastfmLabel() {
+            if (!this.lastfm?.configured) return T.lastfmNotConfigured;
+            if (this.lastfm?.connected && this.lastfm?.reauth_required) return T.lastfmReconnect;
+            if (this.lastfm?.connected) {
+                const user = this.lastfm.username || T.unknown;
+                return T.lastfmConnected.replace('{user}', user);
+            }
+            return T.lastfmConnect;
+        },
+
+        lastfmClass() {
+            if (!this.lastfm?.configured) return 'not-configured';
+            if (this.lastfm?.connected && this.lastfm?.reauth_required) return 'needs-auth';
+            if (this.lastfm?.connected) return 'connected';
+            return 'available';
+        },
+
+        async handleLastfm() {
+            if (this.lastfmBusy) return;
+            if (!this.lastfm?.configured) return;
+            if (!this.lastfm?.connected || this.lastfm?.reauth_required) {
+                window.location.href = '/api/player/lastfm/connect';
+                return;
+            }
+            const user = this.lastfm.username || T.unknown;
+            if (!window.confirm(T.lastfmDisconnectConfirm.replace('{user}', user))) return;
+            this.lastfmBusy = true;
+            try {
+                const res = await fetch('/api/player/lastfm/disconnect', { method: 'POST' });
+                if (!res.ok) throw new Error(T.lastfmDisconnectFailed);
+                await this.loadLastfm();
+            } catch {
+                alert(T.lastfmDisconnectFailed);
+            } finally {
+                this.lastfmBusy = false;
+            }
+        },
+
         initials() {
             const name = this.profile?.name || '';
             return name.trim().charAt(0) || '?';
@@ -272,6 +402,10 @@ document.addEventListener('alpine:init', () => {
         progress: 0,
         _saveTimer: null,
         _historyRecorded: false,
+        _nowPlayingSent: false,
+        _playbackStartedAt: null,
+        _listenedSeconds: 0,
+        _lastAudioTime: 0,
 
         init() {
             audio.volume = this.volume;
@@ -280,15 +414,25 @@ document.addEventListener('alpine:init', () => {
                 this.currentTime = audio.currentTime;
                 this.duration = audio.duration || 0;
                 this.progress = this.duration > 0 ? (this.currentTime / this.duration) * 100 : 0;
+                this._trackListenedDelta();
             });
 
             audio.addEventListener('ended', () => {
+                this._trackListenedDelta();
                 this._recordHistory(true);
                 this.next();
             });
 
-            audio.addEventListener('play', () => { this.isPlaying = true; });
-            audio.addEventListener('pause', () => { this.isPlaying = false; });
+            audio.addEventListener('play', () => {
+                this.isPlaying = true;
+                if (!this._playbackStartedAt) this._playbackStartedAt = Math.floor(Date.now() / 1000);
+                this._lastAudioTime = audio.currentTime || 0;
+                this._sendNowPlaying();
+            });
+            audio.addEventListener('pause', () => {
+                this.isPlaying = false;
+                this._lastAudioTime = audio.currentTime || 0;
+            });
 
             audio.addEventListener('loadedmetadata', () => {
                 this.duration = audio.duration || 0;
@@ -311,6 +455,7 @@ document.addEventListener('alpine:init', () => {
         play(track) {
             this.currentTrack = track;
             this._historyRecorded = false;
+            this._resetPlaybackTracking();
             audio.src = track.stream_url;
             audio.play().catch(() => {});
             this._updateMediaSession();
@@ -327,11 +472,13 @@ document.addEventListener('alpine:init', () => {
 
         seek(time) {
             audio.currentTime = time;
+            this._lastAudioTime = audio.currentTime || 0;
         },
 
         seekRelative(delta) {
             if (!this.currentTrack) return;
             audio.currentTime = Math.max(0, Math.min(audio.duration || 0, audio.currentTime + delta));
+            this._lastAudioTime = audio.currentTime || 0;
         },
 
         seekFromClick(event) {
@@ -347,9 +494,13 @@ document.addEventListener('alpine:init', () => {
             const queue = Alpine.store('queue');
             if (queue.tracks.length === 0) return;
 
+            this._recordHistoryIfListenThresholdReached();
+
             let nextIdx;
             if (this.repeatMode === 'one') {
                 this.seek(0);
+                this._historyRecorded = false;
+                this._resetPlaybackTracking();
                 this.resume();
                 return;
             } else if (this.shuffle) {
@@ -519,6 +670,7 @@ document.addEventListener('alpine:init', () => {
                                 if (currentTrack) {
                                     this.currentTrack = currentTrack;
                                     this._historyRecorded = false;
+                                    this._resetPlaybackTracking();
                                     audio.src = currentTrack.stream_url;
                                     // Seek to saved position once metadata is loaded
                                     const seekMs = state.position_ms || 0;
@@ -541,16 +693,94 @@ document.addEventListener('alpine:init', () => {
         _recordHistory(completed) {
             if (this._historyRecorded || !this.currentTrack) return;
             this._historyRecorded = true;
+            const listenedSeconds = this._historyListenedSeconds(completed);
             fetch('/api/player/history', {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify({
                     track_id: this.currentTrack.id,
-                    duration_listened: Math.floor(this.currentTime),
+                    started_at: this._playbackStartedAt,
+                    duration_listened: listenedSeconds,
                     completed: completed,
                 }),
             }).catch(() => {});
         },
+
+        _recordHistoryIfListenThresholdReached() {
+            if (this._historyRecorded || !this.currentTrack) return false;
+            this._trackListenedDelta();
+            const duration = this._trackDuration();
+            if (duration <= 0) return false;
+            const listened = Math.floor(Number(this._listenedSeconds || 0));
+            const threshold = Math.ceil(duration / 2);
+            if (threshold <= 0 || listened < threshold) return false;
+            this._recordHistory(true);
+            return true;
+        },
+
+        _resetPlaybackTracking() {
+            this._nowPlayingSent = false;
+            this._playbackStartedAt = null;
+            this._listenedSeconds = 0;
+            this._lastAudioTime = 0;
+        },
+
+        _trackListenedDelta() {
+            if (!this.currentTrack) return;
+            const current = audio.currentTime || 0;
+            if (!this.isPlaying) {
+                this._lastAudioTime = current;
+                return;
+            }
+            const previous = Number.isFinite(this._lastAudioTime) ? this._lastAudioTime : current;
+            const delta = current - previous;
+            if (delta > 0 && delta < 5) {
+                this._listenedSeconds += delta;
+            }
+            this._lastAudioTime = current;
+        },
+
+        _trackDuration() {
+            const candidates = [
+                this.currentTrack?.duration_seconds,
+                this.duration,
+                audio.duration,
+            ];
+            for (const value of candidates) {
+                const duration = Number(value || 0);
+                if (Number.isFinite(duration) && duration > 0) return duration;
+            }
+            return 0;
+        },
+
+        _scrobbleThreshold(duration) {
+            return Math.min(duration / 2, 240);
+        },
+
+        _historyListenedSeconds(completed) {
+            const duration = this._trackDuration();
+            const listened = Number(this._listenedSeconds || 0);
+            const finalGrace = completed ? 1 : 0;
+            const precise = Math.floor(listened + finalGrace);
+            if (precise > 0) return precise;
+            const current = Number(audio.currentTime || this.currentTime || 0);
+            if (duration > 0 && Number.isFinite(current)) {
+                return Math.floor(Math.min(current, duration));
+            }
+            return Math.floor(current || 0);
+        },
+
+        _sendNowPlaying() {
+            if (this._nowPlayingSent || !this.currentTrack) return;
+            const lastfm = Alpine.store('user')?.lastfm;
+            if (!lastfm?.configured || !lastfm?.connected || lastfm?.reauth_required) return;
+            this._nowPlayingSent = true;
+            fetch('/api/player/lastfm/now-playing', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ track_id: this.currentTrack.id }),
+            }).catch(() => {});
+        },
     });
 
     // -----------------------------------------------------------------------
@@ -892,7 +1122,7 @@ document.addEventListener('alpine:init', () => {
         },
 
         openTrackInfo(track) {
-            Alpine.store('info').open(T.trackInfoTitle, this.trackInfo(track));
+            Alpine.store('info').openRows(T.trackInfoTitle, this.trackInfoRows(track));
         },
 
         uploadersInfo(uploaders) {
@@ -915,6 +1145,31 @@ document.addEventListener('alpine:init', () => {
             return lines.join('\n');
         },
 
+        openReleaseInfo(release) {
+            Alpine.store('info').openRows(T.releaseInfoTitle, this.releaseInfoRows(release));
+        },
+
+        infoLinks(items, type) {
+            const seen = new Set();
+            return (items || [])
+                .filter(item => item && item.id && !seen.has(Number(item.id)) && seen.add(Number(item.id)))
+                .map(item => ({ type, id: item.id, label: item.label || item.name || item.title || String(item.id) }));
+        },
+
+        releaseInfoRows(release) {
+            if (!release) return [];
+            const rows = [
+                { label: T.release, value: release.title || T.unknownRelease },
+                { label: T.type, value: release.release_type || T.unknown },
+                { label: T.year, value: release.year || T.unknown },
+                { label: T.tracks, value: release.track_count || release.tracks?.length || 0 },
+                { label: T.uploaders, value: this.uploadersInfo(release.uploaders || []) },
+            ];
+            const artistLinks = this.infoLinks(release.artists || [], 'artist');
+            if (artistLinks.length) rows.splice(1, 0, { label: T.artists, links: artistLinks });
+            return rows;
+        },
+
         trackInfo(track) {
             if (!track) return '';
             const artists = this.trackArtistLinks(track).map(artist => artist.label).join(', ') || T.unknown;
@@ -945,6 +1200,40 @@ document.addEventListener('alpine:init', () => {
             return lines.join('\n');
         },
 
+        trackInfoRows(track) {
+            if (!track) return [];
+            const artistLinks = this.infoLinks(this.trackArtistLinks(track), 'artist');
+            const releaseLinks = track.release_id
+                ? [{ type: 'release', id: track.release_id, label: track.release_title || T.unknownRelease }]
+                : [];
+            const audio = [
+                track.audio_format || null,
+                track.audio_bitrate ? `${track.audio_bitrate} kbps` : null,
+                track.audio_sample_rate ? `${track.audio_sample_rate} Hz` : null,
+                track.audio_bit_depth ? `${track.audio_bit_depth}-bit` : null,
+            ].filter(Boolean).join(' · ') || T.unknownAudio;
+            const rows = [
+                { label: T.title, value: track.title || T.unknownTrack },
+                { label: T.release, links: releaseLinks },
+                { label: T.artists, links: artistLinks },
+                { label: T.releaseYear, value: track.release_year || T.unknown },
+                { label: T.duration, value: formatTime(track.duration_seconds) },
+                { label: T.audio, value: audio },
+                { label: T.size, value: this.bytes(track.file_size_bytes) },
+                { label: T.uploader, value: track.uploader_name || 'UFO' },
+            ];
+            if (track.lastfm_rating != null || track.lastfm_listeners != null || track.lastfm_playcount != null) {
+                const rating = Number(track.lastfm_rating || 0);
+                rows.push({ label: T.lastfmRating, value: Number.isFinite(rating) ? Math.round(rating) : T.unknown });
+                rows.push({ label: T.lastfmListeners, value: new Intl.NumberFormat().format(track.lastfm_listeners || 0) });
+                rows.push({ label: T.lastfmPlaycount, value: new Intl.NumberFormat().format(track.lastfm_playcount || 0) });
+                if (track.lastfm_updated_at) rows.push({ label: T.lastfmUpdated, value: track.lastfm_updated_at });
+            } else {
+                rows.push({ label: T.lastfmRating, value: T.lastfmNotLoaded });
+            }
+            return rows;
+        },
+
         async openRelease(id, options = {}) {
             this._beginNavigation('#release/' + id, options);
             this.searchQuery = '';
@@ -2068,4 +2357,39 @@ document.addEventListener('alpine:init', () => {
         },
     });
 });
+
+function installConnectionFetchMonitor() {
+    if (window.__furumusicConnectionMonitorInstalled || !window.fetch) return;
+    window.__furumusicConnectionMonitorInstalled = true;
+    const nativeFetch = window.fetch.bind(window);
+
+    window.fetch = async (...args) => {
+        const tracked = isTrackedPlayerRequest(args[0]);
+        try {
+            const response = await nativeFetch(...args);
+            if (tracked) {
+                if (response.status >= 500) {
+                    Alpine.store('connection')?.recordFailure();
+                } else {
+                    Alpine.store('connection')?.recordSuccess();
+                }
+            }
+            return response;
+        } catch (error) {
+            if (tracked) Alpine.store('connection')?.recordFailure();
+            throw error;
+        }
+    };
+}
+
+function isTrackedPlayerRequest(input) {
+    const rawUrl = typeof input === 'string' ? input : input?.url;
+    if (!rawUrl) return false;
+    try {
+        const url = new URL(rawUrl, window.location.href);
+        return url.origin === window.location.origin && url.pathname.startsWith('/api/player/');
+    } catch {
+        return false;
+    }
+}
 </script>

templates/player/shell.html

@@ -38,6 +38,13 @@
                         <span class="user-stat-label">{{ t.player_listened }}</span>
                     </div>
                 </div>
+                <button class="lastfm-profile-action"
+                        :class="$store.user.lastfmClass()"
+                        :disabled="$store.user.lastfmBusy || !$store.user.lastfm?.configured"
+                        @click="$store.user.handleLastfm()">
+                    <span class="lastfm-dot"></span>
+                    <span class="lastfm-profile-text" x-text="$store.user.lastfmLabel()"></span>
+                </button>
             </div>
             <div class="sidebar-header">
                 <h2>{{ t.player_library }}</h2>
@@ -268,6 +275,20 @@
                         <path d="M4 4.5A2.5 2.5 0 016.5 2H20v20H6.5A2.5 2.5 0 014 19.5z"/>
                     </svg>
                 </button>
+                <div class="connection-alert"
+                     x-show="$store.connection.disconnected"
+                     x-cloak
+                     :title="$store.connection.message()"
+                     role="status"
+                     aria-live="polite">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <path d="M2 8.82a15 15 0 0120 0"/>
+                        <path d="M5 12.86a10 10 0 0114 0"/>
+                        <path d="M8.5 16.43a5 5 0 017 0"/>
+                        <line x1="2" y1="2" x2="22" y2="22"/>
+                    </svg>
+                    <span class="connection-alert-text">{{ t.player_connection_lost }}</span>
+                </div>
                 <div class="search-bar">
                     <span class="search-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="11" cy="11" r="8"/><line x1="21" y1="21" x2="16.65" y2="16.65"/></svg></span>
                     <input id="search-input" type="text" placeholder="{{ t.player_search_placeholder }}"
@@ -324,6 +345,13 @@
                             <span class="user-stat-label">{{ t.player_listened }}</span>
                         </div>
                     </div>
+                    <button class="lastfm-profile-action"
+                            :class="$store.user.lastfmClass()"
+                            :disabled="$store.user.lastfmBusy || !$store.user.lastfm?.configured"
+                            @click="$store.user.handleLastfm()">
+                        <span class="lastfm-dot"></span>
+                        <span class="lastfm-profile-text" x-text="$store.user.lastfmLabel()"></span>
+                    </button>
                     <button class="modal-btn modal-btn-primary mobile-account-logout"
                             @click="$store.user.logout()">
                         {{ t.player_log_out }}
@@ -391,7 +419,7 @@
                                                     <template x-if="!release.cover_url">
                                                         <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><rect x="3" y="3" width="18" height="18" rx="2"/><circle cx="12" cy="12" r="4"/></svg>
                                                     </template>
-                                                    <button class="card-info-btn" @click.stop="$store.info.open('{{ t.player_release_info }}', $store.library.releaseInfo(release))" :title="$store.library.releaseInfo(release)" aria-label="{{ t.player_release_info }}">
+                                                    <button class="card-info-btn" @click.stop="$store.library.openReleaseInfo(release)" :title="$store.library.releaseInfo(release)" aria-label="{{ t.player_release_info }}">
                                                         <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><line x1="12" y1="16" x2="12" y2="12"/><line x1="12" y1="8" x2="12.01" y2="8"/></svg>
                                                     </button>
                                                 </div>
@@ -562,7 +590,7 @@
                                             <template x-if="!release.cover_url">
                                                 <span class="placeholder-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><rect x="3" y="3" width="18" height="18" rx="2"/><circle cx="12" cy="12" r="4"/></svg></span>
                                             </template>
-                                            <button class="card-info-btn" @click.stop="$store.info.open('{{ t.player_release_info }}', $store.library.releaseInfo(release))" :title="$store.library.releaseInfo(release)" aria-label="{{ t.player_release_info }}">
+                                            <button class="card-info-btn" @click.stop="$store.library.openReleaseInfo(release)" :title="$store.library.releaseInfo(release)" aria-label="{{ t.player_release_info }}">
                                                 <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><line x1="12" y1="16" x2="12" y2="12"/><line x1="12" y1="8" x2="12.01" y2="8"/></svg>
                                             </button>
                                             <button class="card-enqueue-btn" @click.stop="$store.library.enqueueRelease(release.id)" title="{{ t.player_add_to_queue }}">
@@ -690,7 +718,7 @@
                             <div class="release-year" x-text="$store.library.currentRelease.year || ''"></div>
                             <div class="release-actions">
                                 <button class="release-action-btn secondary"
-                                        @click.stop="$store.info.open('{{ t.player_release_info }}', $store.library.releaseInfo($store.library.currentRelease))"
+                                        @click.stop="$store.library.openReleaseInfo($store.library.currentRelease)"
                                         :title="$store.library.releaseInfo($store.library.currentRelease)"
                                         aria-label="{{ t.player_release_info }}">
                                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><line x1="12" y1="16" x2="12" y2="12"/><line x1="12" y1="8" x2="12.01" y2="8"/></svg>
@@ -928,7 +956,16 @@
                         </template>
                     </div>
                     <div class="player-track-info">
-                        <div class="player-track-title" x-text="$store.player.currentTrack.title"></div>
+                        <div class="player-track-title-row">
+                            <div class="player-track-title" x-text="$store.player.currentTrack.title"></div>
+                            <button class="like-btn player-current-like"
+                                    :class="{ liked: $store.likes.has($store.player.currentTrack.id) }"
+                                    @click.stop="$store.likes.toggle($store.player.currentTrack.id)"
+                                    title="{{ t.player_like }}"
+                                    aria-label="{{ t.player_like }}">
+                                <svg viewBox="0 0 24 24" :fill="$store.likes.has($store.player.currentTrack.id) ? 'currentColor' : 'none'" stroke="currentColor" stroke-width="2"><path d="M20.84 4.61a5.5 5.5 0 00-7.78 0L12 5.67l-1.06-1.06a5.5 5.5 0 00-7.78 7.78L12 21.23l8.84-8.84a5.5 5.5 0 000-7.78z"/></svg>
+                            </button>
+                        </div>
                         <div class="player-track-artist">
                             <template x-for="(artist, artistIdx) in $store.library.trackArtistLinks($store.player.currentTrack)" :key="artist.label + '-' + artist.id + '-' + artistIdx">
                                 <span>

templates/player/styles.html

@@ -165,6 +165,68 @@ button.user-stat:hover {
     color: var(--text-subdued);
 }
 
+.lastfm-profile-action {
+    width: 100%;
+    min-height: 34px;
+    margin-top: 8px;
+    padding: 7px 9px;
+    border: 1px solid var(--border-color);
+    border-radius: 6px;
+    background: var(--bg-primary);
+    color: var(--text-secondary);
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    text-align: left;
+    transition: background 0.15s, border-color 0.15s, color 0.15s;
+}
+
+.lastfm-profile-action:not(:disabled):hover {
+    background: var(--bg-hover);
+    color: var(--text-primary);
+}
+
+.lastfm-profile-action:disabled {
+    cursor: default;
+    opacity: 0.72;
+}
+
+.lastfm-dot {
+    width: 8px;
+    height: 8px;
+    border-radius: 50%;
+    background: var(--text-subdued);
+    flex-shrink: 0;
+}
+
+.lastfm-profile-action.connected {
+    border-color: rgba(29, 185, 84, 0.32);
+    color: var(--text-primary);
+}
+
+.lastfm-profile-action.connected .lastfm-dot {
+    background: #1db954;
+}
+
+.lastfm-profile-action.available .lastfm-dot,
+.lastfm-profile-action.needs-auth .lastfm-dot {
+    background: var(--accent);
+}
+
+.lastfm-profile-action.needs-auth {
+    border-color: rgba(255, 184, 77, 0.4);
+}
+
+.lastfm-profile-text {
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    font-size: 11px;
+    font-weight: 650;
+}
+
 .sidebar-header {
     padding: 16px;
     display: flex;
@@ -1079,12 +1141,28 @@ button.user-stat:hover {
     overflow: hidden;
     min-width: 0;
 }
+
+.player-track-title-row {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    min-width: 0;
+}
+
 .player-track-title {
     font-size: 13px;
     font-weight: 500;
     white-space: nowrap;
     overflow: hidden;
     text-overflow: ellipsis;
+    min-width: 0;
+}
+
+.player-current-like {
+    width: 24px;
+    height: 24px;
+    padding: 4px;
+    flex: 0 0 auto;
 }
 
 .player-track-artist {
@@ -1299,6 +1377,37 @@ button.user-stat:hover {
     margin-bottom: 20px;
 }
 
+.connection-alert {
+    flex: 0 0 auto;
+    min-width: 42px;
+    height: 42px;
+    padding: 0 12px;
+    border: 1px solid rgba(248, 113, 113, 0.34);
+    border-radius: 8px;
+    background: rgba(127, 29, 29, 0.2);
+    color: #f87171;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 8px;
+}
+
+.connection-alert svg {
+    width: 18px;
+    height: 18px;
+    flex: 0 0 auto;
+}
+
+.connection-alert-text {
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    color: #fecaca;
+    font-size: 12px;
+    font-weight: 700;
+}
+
 /* Search bar */
 .search-bar {
     position: relative;
@@ -1763,7 +1872,7 @@ button.user-stat:hover {
 .modal-playlist-item svg { width: 16px; height: 16px; flex-shrink: 0; }
 
 .info-modal {
-    max-width: min(520px, calc(100vw - 24px));
+    max-width: min(620px, calc(100vw - 24px));
 }
 
 .info-modal-head {
@@ -1785,14 +1894,72 @@ button.user-stat:hover {
     border-radius: 8px;
     background: var(--bg-primary);
     color: var(--text-secondary);
-    font-family: ui-monospace, SFMono-Regular, Consolas, monospace;
     font-size: 13px;
     line-height: 1.55;
-    white-space: pre-wrap;
     overflow: auto;
     max-height: min(58dvh, 520px);
 }
 
+.info-modal-plain {
+    margin: 0;
+    font-family: ui-monospace, SFMono-Regular, Consolas, monospace;
+    white-space: pre-wrap;
+}
+
+.info-table {
+    width: 100%;
+    border-collapse: collapse;
+}
+
+.info-table th,
+.info-table td {
+    padding: 9px 0;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.07);
+    vertical-align: top;
+}
+
+.info-table tr:last-child th,
+.info-table tr:last-child td {
+    border-bottom: 0;
+}
+
+.info-table th {
+    width: 34%;
+    padding-right: 18px;
+    color: var(--text-subdued);
+    font-size: 11px;
+    font-weight: 700;
+    text-align: left;
+    text-transform: uppercase;
+}
+
+.info-table td {
+    color: var(--text-primary);
+}
+
+.info-link-list {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 6px;
+}
+
+.info-link {
+    border: 1px solid rgba(29, 185, 84, 0.36);
+    border-radius: 999px;
+    background: rgba(29, 185, 84, 0.1);
+    color: var(--text-primary);
+    cursor: pointer;
+    padding: 3px 8px;
+    font: inherit;
+    line-height: 1.3;
+}
+
+.info-link:hover {
+    border-color: rgba(29, 185, 84, 0.7);
+    background: rgba(29, 185, 84, 0.18);
+    color: var(--accent);
+}
+
 .modal-btn {
     padding: 8px 16px;
     border-radius: 20px;
@@ -2540,6 +2707,15 @@ button.user-stat:hover {
         flex: 1 1 auto;
     }
 
+    .connection-alert {
+        width: 42px;
+        padding: 0;
+    }
+
+    .connection-alert-text {
+        display: none;
+    }
+
     .mobile-library-btn {
         display: flex;
     }
@@ -2921,6 +3097,22 @@ button.user-stat:hover {
         max-width: 400px;
     }
 
+    .info-table th,
+    .info-table td {
+        display: block;
+        width: 100%;
+        padding-right: 0;
+    }
+
+    .info-table th {
+        padding-bottom: 2px;
+        border-bottom: 0;
+    }
+
+    .info-table td {
+        padding-top: 0;
+    }
+
     .torrent-modal {
         width: 100vw;
         max-width: none;